1 Introduction

In the last years, the use of Unmanned Aerial Systems (UAS) has been growing at a very fast rate thanks to the development of lower cost technologies and the vast number of possible new applications that have appeared in the market. Numerous global companies are investing in the possibility of using small and medium sized Unmanned Aerial Vehicles (UAVs) for different services including cargo, surveillance, civil protection or delivery tasks, but also even more demanding use cases like personal mobility services (e.g. air taxis). It is therefore likely that in a near future a considerable amount of unmanned (and/or autonomous) aerial vehicles will need to share the airspace, particularly at low altitudes. The integration of UAS into a common air space with manned aircraft presents many challenges from the Air Traffic Management (ATM) point of view due to the potential different operational constraints.

Since 2013 the Joint Authorities for Rulemaking on Unmanned Systems (JARUS) is getting importance in the development of guidelines for the integration of UAS into the airspace. JARUS is a group of experts from the National Aviation Authorities (NAAs) and regional aviation safety organizations. Its purpose is to recommend a single set of technical, safety and operational requirements for the certification and safe integration of UAS. Within this scope, published guidance and regulations include the safety assessment of Remotely Piloted Aircraft Systems (RPAS) [1] and Specific Operations Risk Assessment (SORA) [2].

When considering the use of smaller UAS at lower altitudes and nearby or in urban environments, the design of both the Unmanned Air Traffic Management and the different on-board subsystems presents many new challenges. Moreover, one important goal is the design of these systems to guarantee a safe operation in potentially crowded urban environments, where collisions with other UAS as well as obstacles or people can be considered a major risk [3]. Common agreed challenges regarding the UAS operations include Detect and Avoid (DAA), Command and Control (C2) and surveillance, among others. The integration of UAS in non-segregated airspace will also require for the definition of minimum navigation, communication and surveillance performance standards, as specified by the current development of UAS Concept of operations in Europe [4]. Of particular importance is the limitation of current approaches to provide a thorough analysis of the accuracy, continuity, availability and integrity of the navigation performance of UAVs in cities as compared to the current avionics Minimum Operational Performance Standards, such as [5]. The major challenges in terms of navigation appear around four main aspects:

  1. 1.

    the operation within an unrestricted air and ground space,

  2. 2.

    the operation in challenging environment for sensors (e.g., Global Navigation Satellite System (GNSS) signal blockage and multipath) and near other (aerial) vehicles or obstacles,

  3. 3.

    the need to use cost-efficient, small and light-weight sensors and

  4. 4.

    the necessity to consider very heterogeneous onboard-unit designs and requirements depending on the area of operation.

In [6], a first assessment related to the threats and events that would lead to a technical and mechanical failure is provided. In relation to the navigation payload, the identified events are sensor or camera failures with respect to computer vision or a directional loss that can be caused by a Global Positioning System (GPS) failure due to GPS perturbations, compass failure, Inertial Measurement Unit (IMU) failure or altitude sensor failure. Although this description covers in general the main failure events, it does not provide an in-depth analysis of the specific threats to the navigation sensors, their implication in the navigation solution and possible mitigation measures. The complete safety assessment of Communication, Navigation and Surveillance (CNS) systems in Urban Air Mobility remains therefore an intensive research area [3].

In this work, we first review the current regulation context for urban air mobility and derive new navigation requirements for drones operation, with focus on vertiport precision approach. We then propose a multisensor navigation architecture based on the strength of different sensor technologies and services. The subsystems in the proposed architecture are discussed with focus on faults identification and challenges. Finally, initial validation results based on flight trials are provided, followed by outlook and conclusions.

2 Urban air mobility

For the safe operation of drones in the European air space, the EU has defined three categories to classify drone operations with a risk-based approach [7]: the open, specific and certified categories.

  • Open Category: The operational risk in this category is considered low, no operational authorization is required and the safety is ensured by the civil drone operator complying with the requirements of the intended operation.

  • Specific Category: This category covers riskier operations that require a specific operational authorization where the drone operator is responsible to carry out a risk assessment. For this category, JARUS has developed a SORA methodology to facilitate the authorization and risk-assessment process [2].

  • Certified Category: In this category, the risk is assumed to be considerably higher and the certification of drone operator and vehicle is required to ensure safety.

For the specific category, the JARUS SORA defines different Safety Assurance and Integrity Levels (SAIL) based on the intrinsic ground and air related risk of the UAS operation. For the different SAIL levels, the operator is required to show compliance with specific Operational Safety Objectives (OSO) with a certain robustness level (safety integrity and assurance) depending on the assigned SAIL for the operation. Please note that SORA integrity refers to the safety gain of a specific OSO, whereas navigation integrity is a measure of trust that can be placed in the correctness of the information provided by the navigation system.

2.1 Current standardization actions

Currently, no navigation related standard is suitable for the operation of drones in any of the categories needing authorization or certification. For higher risk operations, which might cover the SAIL V-VI levels and the certified category, RTCA SC-228 has elaborated a navigation gap analysis focused on fixed wing aircraft operating in and out of traditional airports [8]. One major aspect is the lack of specific navigation requirements to support UAS operations, which is the case for both the specific and certified categories. GNSS is considered to be a primary system for most UAS operations. There is however, even for GBAS (Ground-based Augmentation System) Approach Service Type (GAST) D, which is designed for autoland operations in Category III airports, no available standard that covers a fully autonomous landing below 12 feet. The operation within cities (i.e., non-restricted air-space) will make the standards deviate even more from an intended operation like landing in a vertiport. RTCA SC-228 plans to analyze UAS taxing operations, which will in the future help to provide guidelines for more challenging environmental conditions. For low-risk operations (i.e., SAIL I-II), the European Organization for Civil Aviation Equipment (EUROCAE) has elaborated guideline material for the use of GNSS to support safety for these specific categories [9]. These recommendations focus on the analysis of the OSO #13 related to external services and therefore they provide recommendations to operators only for GNSS as a service. Plans exist to extend these guidelines to medium-risk operations. The complete navigation subsystem uses additional onboard sensors and systems and therefore other operational safety objectives must be analyzed beyond the external services.

2.2 Navigation requirements

Table 1 provides an overview of possible requirements for different use cases and safe operations in the specific category. The approach and landing requirements are derived from the previous vertiport analysis. The enroute requirements are extracted from [10] and are used here as a reference. The values in Table 1 are possible guidance requirements which are under discussion and can change in the future. Although SORA provides only a qualitative risk assessment methodology, for the derivation of the integrity risk requirement, we have assumed the following equation:

$$\begin{aligned} {\text{Integrity Risk (IR)}} < \frac{10^{-(SAIL + 1)}}{\text{Operation}}, \end{aligned}$$
(1)

where SAIL refers to the SAIL risk level. Equation (1) is an adaptation of the assumption in [10] where we consider an operation can be either a flight hour or an approach and landing. For the achievement of other SORA integrity and assurance compliance, specific levels could also be linked to other quantitative industry standards. For instance, a Design Assurance Level (DAL) C for SAIL IV.

Table 1 Navigation requirements for UAM flight phases
Full size table

2.2.1 Vertiport use case

For the final approach at the vertiport, we can first consider the potential associated horizontal requirements. The European Union Aviation Safety Agency (EASA) defines the D-value as the diameter of the smallest circle enclosing the Vertical Take-Off and Landing (VTOL) aircraft projection on a horizontal plane, while the aircraft is in the take-off or landing configuration  [11]. We assume that it is expected that the vehicle dimension (D-value) must be inside the final approach and take-off area (FATO) with a high probability when reaching the hovering altitude. We will, therefore, use it as a criterion to derive navigation requirements, similar to an aircraft reaching the touchdown area during precision approaches to airport runways. The actual Touch-down and Lift-off (TLOF) area for vertiports is reached by the vehicle from the FATO hovering position, and it can be either situated inside the FATO footprint or could potentially be placed at the stand location and reached while hovering [12]. This final touchdown maneuver is performed in a much controlled and low dynamics situation and can be supported also by visual references or additional proximity sensors and therefore we won’t cover it in this paper. Figure 1 depicts an example of a funnel-shaped vertiport design and Fig. 2 shows the possible different vertiport areas, including the safety area (SA).

Fig. 1
figure 1

Example of a funnel-shaped vertiport design

Full size image
Fig. 2
figure 2

Vertiport areas definitions

Full size image

The FATO area is proposed by EASA as twice the D-value as a reference, with a minimum value of the maximum between 1.5 times the D-value and the length of the rejected take-off distance (RTODV) for the required take-off procedure of the VTOL-capable aircraft. The minimum FATO imposes tighter requirements for the navigation system and therefore we can consider:

$$\begin{aligned} FATO = \max \{1.5D_\text {max}, RTODV_\text {max}\}, \end{aligned}$$
(2)

where \(D_\text {max}\) and \(RTODV_\text {max}\) are the highest D-value and RTODV among the VTOLs that are expected to operate in that particular vertiport, since the vertiport would be designed with that criteria. Information about RTODV is not available at the moment, we will, therefore, focus on the design constraint based on the D-value.

For the horizontal nominal case, we can assume that the vehicle must be laterally inside the FATO area when it reaches the hovering altitude from the approach slope. The maximum allowed radial total system error (TSE) for the most constraining vehicle (that is, the largest one that drove the design of the vertiport) can be therefore expressed as a function of the margin between the wingtip and the end of the FATO area Wingtip-To-Safety Area (WTSA):

$$\begin{aligned} WTSA = (FATO - D)/2. \end{aligned}$$
(3)

This margin represents the maximum allowed deviation from the center of the FATO or approach slope that could result in a collision with surrounding obstacles. Please note, that we assume conservatively here that obstacle collision can happen immediately beyond the FATO area, leaving the vertiport safety area (SA) as an additional buffer. According to the vertiport design, the minimum WTSA would be:

$$\begin{aligned} WTSA_\text {min} = (FATO - D_\text {max})/2 = D_\text {max}/4. \end{aligned}$$
(4)

Assuming a certain risk probability of finishing the approach outside the FATO area (\(P_\text {out}\)), we can express the equivalent TSE standard deviation as:

$$\begin{aligned} \sigma _\text {TSE} = \frac{WTSA_\text {min}}{\sqrt{2}\cdot \text {erfc}^{-1}(P_\text {out})}, \end{aligned}$$
(5)

where \(\text {erfc}\) is the complementary error function. In Eq.(5), we have assumed the error to be Gaussian distributed or overbound by a Gaussian distribution. The TSE is the sum of the flight technical error (FTE), the navigation system error (NSE) and the path definition error (PDE) and can be related by their variances (again assuming Gaussian distribution or bounds) as:

$$\begin{aligned} \sigma ^2_\text {TSE} = \sigma ^2_\text {FTE} + \sigma ^2_\text {NSE} + \sigma ^2_\text {PDE}, \end{aligned}$$
(6)

where the latter is normally neglected. The NSE variance can be therefore written as:

$$\begin{aligned} \sigma ^2_\text {NSE} = \sqrt{\left( \frac{WTSA_\text {min}}{\sqrt{2}\cdot \text {erfc}^{-1}(P_\text {out})}\right) ^2 - \sigma ^2_\text {FTE}}. \end{aligned}$$
(7)

The FTE highly depends on the technical specifications of the vehicles, purpose, type and size. The analysis of the FTE is out of the scope of this work and we will assume for the moment a typical accuracy value of 0.5 m (i.e. at 95%). We will also assume that the safety probability of violating the FATO area in the final approach (\(P_\text {out}\)) is not more stringent than the one of CAT-III landing, where a maximum allowed probability of 1E-6 is reported of exceeding the lateral limits of the landing box [13]. Finally, reported VTOLs prototypes of industry have a D-value ranging from 5.61 m (eHang) up to 15.24 m (Uber) [14]. It is unrealistic that vertiports will be designed only with the goal of supporting the smallest vehicles. If we assume a vertiport design based on the largest reported VTOL, the corresponding NSE standard deviation from Eq.(7) would be \(\sigma _\text {NSE} \approx 0.74\) m. An associated alert limit for a SAIL VI or certified operation with integrity risk 1E-7/h would be \(HAL \approx 3.93\) m. If instead of the minimum value of the design of FATO we used the typical value of 2D mentioned in [11]. The horizontal accuracy (95%) and alert limit would be 1.54 m and 8.2 m, respectively.

Related to vertical dimension requirements, there are two contributing aspects: the contribution of the vertical positioning in arriving short or far to the FATO in the longitudinal direction and the requirements related to the distance to the ground. For the longitudinal arrival to the FATO area at the end of the approach phase, the vertical error will have an important impact. Assuming the same probability of arriving short or late for a square FATO area, the vertical error can be simply obtained as a function of the approach/departure slope angle (also assuming a similar flight technical error for the vertical control):

$$\begin{aligned} \sigma _\text {NSE,v} = \sigma _\text {NSE}\cdot \tan (\theta _\text {ADS}), \end{aligned}$$
(8)

where \(\sigma _\text {NSE,v}\) is the standard deviation of the vertical navigation system error and \(\theta _\text {ADS}\) is the Approach/Departure slope angle. In order to determine the slope angle, we use the reference volume type 1 in [11]. For this volume, we can compute the slope based on the sizing of the high hover height take-off (TO) area located at 30.5 m specified with a size of 4D and the FATO area at low hovering height of 3 m, which is in this case 2D. The slope angle is therefore:

$$\begin{aligned} \theta _\text {ADS} = \tan ^{-1}\left( \frac{30.5-3}{2D-D}\right) . \end{aligned}$$
(9)

For the maximum D-value of 15.24 m, the slope angle is therefore 61 deg. This leads to an standard deviation of 1.33 m and an associated vertical alert limit (at an integrity risk of 1E–7) of 7.1 m. The other possible vertical requirement for the reference volume 1 is related to the low hover height of 3 m. If we assume that the vertical error cannot be larger than 3 m for the same probability of 1E–6 assumed up to now, the associated vertical navigation system accuracy (95%) would be 1.12 m, and an associated alert limit in the nominal case of 2.98 m.

2.3 Navigation technologies

GNSSs have been for decades the backbone of aerial vehicles navigation systems because of their wide availability. However, they are known to be unreliable in the urban environment and are relatively easy to be jammed or spoofed. Additionally, standalone GNSS vertical accuracy may not be sufficient for certain Urban Air Mobility (UAM) operations such as landing. The augmentation of GNSS with aircraft-based (ABAS), ground-based (GBAS) or satellite-based (SBAS) augmentation systems can increase accuracy and ensure safety.

Current ABAS developments focus on proving that Advanced Receiver Autonomous Integrity Monitoring (ARAIM) is able to provide a robust operation for horizontal services and vertical guidance via the use of Multi-frequency and Multi-constellation GNSS. Although ARAIM can attain high levels of integrity, the achievable protection levels are limited by the overbounding of error distributions to account for worst case expected performances. Moreover, due to the required maneuvers in terminal vicinity and precision procedures, the availability and continuity of the system may be compromised by the loss of satellites or high presence of cycle slips [15]. In this sense, the support of several various augmentation systems is essential to guarantee all the navigation requirements and extend the achievable accuracy and integrity for stringent operations, such as UAM ones (especially in vertiport nearness). GBAS provides real-time differential corrections for GNSS to allow aircraft landings with high accuracy and integrity, but as GNSS-based system is susceptible to jamming and spoofing. A GNSS fusion with an Inertial Navigation System (INS) is effective for coasting during GNSS signals losses, ensuring continuity in critical operations and in general availability. It can also increase robustness and resiliency to GNSS in tightly or deeply integration. INS can additionally provide attitude and thus heading information. In aviation, barometers are used for the computation of pressure altitude. This is a virtual altitude that, depending on weather conditions, can differ by up to hundred of meters from geodetic altitude, which is employed by GNSSs. The latter is also the altitude expected to be used for vertical navigation of future UAM applications [16,17,18]. The use of barometric altimeters for UAM navigation, potentially also in combination with GNSS, requires therefore an accurate correction of pressure altitude and a rigorous conversion to geodetic altitude. Radar altimeters may be a valid alternative to barometric ones. They present several limitations though. Interpolation of digital terrain elevation data (DTED) based on horizontal location is needed to produce geodetic altitude measurements. Accurate horizontal positioning is therefore necessary, even though sharp terrain elevation variations may not be observable with available DTED. Furthermore, dynamic variations of the orientation of radar sensors with respect to the ground may lead to potentially large errors. Finally, measurement errors increase with increasing altitude above ground. Nevertheless, radar altimeters may be useful for vertiport operations of VTOL vehicles because of: approximately flat vertiport surface and knowledge of its elevation, negligible attitude dynamics, proximity to the ground, and absence of obstacles [19, 20]. The aforementioned limitations may however not allow to effectively use radar altimeters for other flight phases. Lidar (light detection and ranging) sensors represent a further option for vertical navigation. Their working principle is similar to radar altimeters, but it is based on the transmission, reflection and reception of laser pulses, rather than of radio waves. Lidar sensors can provide more accurate and higher resolution data than radars. However, the performance of lidar is more susceptible to weather conditions, in particular to fog and rain [21].

Fig. 3
figure 3

Navigation architecture for vertiport operations

Full size image

Visual navigation has great potential for UAM applications. Digital images are captured using airborne cameras, and the images are processed onboard in real-time to search key features. For enroute flight, vision can be used for lateral positioning based on map-matching [22]. If a known geo-referenced pattern in the database, such as a fiducial marker at the vertiport, is detectable in the camera view, the six degrees of freedom relative poses (positions and attitude) between the camera and the pattern can be estimated using the pixel points detected in the images. This enables the possibility to apply cameras as a complementary navigation sensor during the take-off and landing phases at vertiports. For low-light conditions (e.g., night operations), infrared cameras and lighting patterns at vertiports can be used as proposed in [23]. The authors in [8, 22] have identified that performance standards and mature certifiable solutions of vision-based navigation for UAM/UAS application are still missing. In particular, it is challenging to quantify the integrity of visual navigation in a reliable way, as well as certify the solution. In our proposed architecture, we have considered INS to support the attitude determination. This solution may be complemented by magnetometers, in particular with respect to the heading. These sensors are however susceptible to electromagnetic interference, which could pose a threat to the attitude determination and may be difficult to consider within an integrity monitoring algorithm.

3 A first navigation architecture design for vertiports approach

This section focuses on a potential architecture and safety design analysis for aerial vehicles approach and landing operations. The navigation system architecture considered in this paper makes use of the following sensors and technologies: Local Differential GNSS Augmentation (Urban GBAS), Inertial Measurement Unit (IMU), Barometers and Cameras. Each of these technologies can provide important relative or absolute information and would have a major role depending on the UAS operation. As an example, Table 2 provides an overview of in which operation each technology may have a larger importance or contribution to the navigation solution.

Table 2 Navigation technologies relevance for UAM operations
Full size table

A general system overview and design is presented in Fig. 3.

Fig. 4
figure 4

Navigation integrity tree

Full size image

The system architecture consists of a ground reference infrastructure part and a multisensor onboard navigation unit.

The ground reference infrastructure consists of spatially distributed ground stations equipped with GNSS antennas and receivers and weather stations. The ground infrastructure perform the following tasks:

  • Computes GNSS local corrections

  • Computes reference pressure levels

  • Performs GNSS integrity monitoring for the signal in space

  • Broadcast the corrections and the integrity information

The multisensor onboard unit consists of several sensors installed on the vehicle and different processing blocks:

  • GNSS Processing performing dedicated local GNSS monitoring, reception of GNSS augmentation information and local corrections, and computation of a reference differential GNSS position.

  • Camera Processing detecting landing pad markers to estimate a camera-based vehicle pose based on monocular camera.

  • The Multisensor Navigation Computer processes Inertial Measurement Unit (IMU) data into inertial navigation system quantities, converts onboard pressure to barometric geodetic altitude and combines corrected GNSS, INS, Baro-altitude and Camera data to compute a position, velocity, attitude and timing solution of the system. This block also performs different fault monitoring levering the redundancy between the different sensor information.

  • The integrity monitoring processing evaluates the performance of the different estimations and fault monitors in the system to derive protection levels and associated integrity information on the final position, velocity and attitude solutions.

For the design of fault detection mechanisms and perform an assessment of the integrity of the system, it is essential to derive a threat model of the system. Figure 4 provides a possible general overview of the different components that would contribute to a failure of the positioning system. They include the possible failure of the nominal sensor fusion algorithm (typically based on Kalman filtering), the residual GNSS and barometric altitude faults, the failure of the inertial system and the fault of the vision-based positioning determination. In the next, the different subsystems in Fig. 3 are further detailed.

4 Subsystems considerations

In this section, we provide with further information about the subsystems of the multisensor navigation architecture, also commenting on the advantages and challenges of using these technologies.

4.1 Global navigation satellite system (GNSS)

The different faults associated to GNSS measurements can be separated between the airborne and the differential ground side (Fig. 5).

Fig. 5
figure 5

Fault tree of GNSS measurements (separated between airborne and differential)

Full size image

4.1.1 Airborne GNSS

GNSS positioning in unrestricted and close-to-ground airspace can be significantly affected by various local threats that cannot be corrected or compensated for through augmentation information. Therefore, GNSS positioning algorithms must be safeguarded against the impact of these local effects, which can distort GNSS code and carrier measurements, rendering their errors inconsistent with the nominal error model assumed by the estimation algorithm. A list of pertinent local threats and possible detection techniques is provided in [24] for land-based applications, which are also applicable to close-to-ground flying operations. Several protection measures can be considered, including:

  • Radio-Frequency Interference (RFI) Detection Based on Power Spectral Density (PSD) Analysis: Commercial-off-the-shelf (COTS) GNSS receivers can provide information about the frequency spectrum or I/Q samples for computation. By comparing the nominal PSD with the currently received one, various types of narrow and wideband interference can be detected [25].

  • Excessive Multipath Detection: For urban scenarios, a multipath detector can be developed based on the Code-minus-Carrier (CMC) observable, using the expected rate change of multipath as a criterion [26]. If strong multipath is detected on a specific channel, measurements from that satellite can be discarded.

  • Data Editing: The practice of discarding measurements through reasonable checks and decisions has proven effective in reducing the presence of large, unbounded measurement errors [27]. This process, known as data editing, may involve applying a CN0 mask, discarding measurements based on the loss of lock indicator (LLI), or removing measurements when both L1 and L2 measurements are unavailable, among other criteria.

Excessive protection against local threats can impact measurement availability. Therefore, it is essential to strike a balance between the nominal error model and protection against threats to meet availability requirements. However, it is expected that continuity and availability of the final solution will be ensured through the presence of additional sensors, such as inertial measurement units and their filter-based integration [27]. Consequently, it is crucial to guarantee measurement integrity even if this reduces the number of available (i.e., reliable) code and carrier phase measurements.

4.1.2 Differential GNSS (U-GBAS)

Classical GBAS was developed with the requirement to replace established landing systems, in particular Instrument Landing System (ILS). As a result, many design decisions were made with established operational aspects and the need to ensure compatibility with existing systems in mind. The existing standardized systems are currently limited to the use of GPS and single frequency measurements. Although there are ongoing efforts to take advantage of developments in satellite navigation by integrating additional constellations and a second frequency, backward compatibility still limits the freedom to change design philosophies. In urban air mobility, such an ecosystem of constraints does not yet exist, providing more room for innovative ideas and concepts. New data links, the use of additional GNSS constellations as well as new signals can compensate for some of the shortcomings and problems encountered in an urban environment. Our proposed concept [28] of Urban GBAS (U-GBAS) involves the deployment of a network of local reference receivers mainly at vertiports within a given service area. These reference receivers form a network covering an urban or metropolitan area, providing accurate and reliable local GNSS corrections for UAM operations, particularly during take-off and landing. Additionally, satellite signals are monitored for faults and larger distortions, be it from various possible hardware failures aboard the satellites or from ionospheric effects along the signal path [29]. This can reduce user (airborne) monitoring requirements and therefore improve system availability especially for users with lower-grade GNSS hardware on board. Furthermore, especially at the critical take-off and landing sites, installed ground receivers provide a possibility to monitor for local interference, another potential threat to GNSS with its weak signals. The core service volume of the U-GBAS system includes the polygon spanned by the reference sites. Unlike the classical GBAS system, which relies on expensive antennas installed in open sky free of obstacles, the proposed U-GBAS system envisions the use of smaller and cheaper hardware, including antennas, while still covering all relevant civil frequency bands and multiple constellations. This approach is intended to make it easier and less costly to integrate U-GBAS into a future urban airspace.

4.2 GNSS/INS

The Inertial Navigation System (INS) is typically in multisensor solutions the central sensor that leads the high frequency positioning solution. The rest of the sensors provide information that is used to correct the drift of the INS. The inertial measurement unit is not affected by the environment or scenario (e.g., loss of satellite signals due to urban canyon or bad image quality). The IMU measurements (i.e., specific forces and angular rates) are typically processed by a strapdown computer in order to obtain the INS attitude, position and velocity over time. The solution of the INS is normally the main positioning solution provided by the integrated system. In order to prevent the estimated pose from drifting over time due to the IMU error processes, an error state Extended Kalman filter is implemented to calibrate the INS system over time thanks to GNSS or other information. An error state version of the EKF is normally chosen so that effects due to linearization of the INS differential equations does not have a significant impact on the representations of the error estimation provided by the filter.

4.3 Barometer-based vertical navigation subsystem

Barometers are traditionally employed in aviation for the computation of altitude information, known as pressure altitude, based on the International Standard Atmosphere (ISA) model [30]. This model is used to obtain the altitude, above a certain isobar reference, that corresponds to a measured air pressure. Above so-called transition altitudes, the constant temperature and pressure of the ISA mean sea level (MSL) standard isobar are used to obtain the so—called QNE pressure altitude, which is used for relative vertical separation of aircraft. Depending on weather conditions, QNE pressure altitude can differ by up to hundreds of meters from geodetic altitude, which is employed by GNSS [31]. The latter is also the altitude expected to be used for vertical navigation of future UAM applications [16,17,18].

Fig. 6
figure 6

Fault tree of the ground-corrected barometric geodetic altitude

Full size image

For UAM vertical navigation during approach and operations in vertiport vicinity, we envision a correction of pressure altitude based on pressure and temperature measurements performed at the vertiport. This corresponds to using as a reference an estimate of the isobar surface that is currently aligned with the vertiport surface. We refer to this approach as the ground- correction approach. This is then followed by a conversion procedure to geodetic altitude that takes into account the differences in terms of altitude scale and reference that exist between (corrected) pressure altitude and geodetic altitude [31].

The ground-correction approach is similar to but different from other approaches that in aviation are used for correcting pressure altitude with the aim of ensuring separation from the ground in airport vicinity operations. These corrections consist in setting as reference the isobar at the airport’s location (QFE approach), or an estimate of the actual MSL isobar (QNH approach) at the same horizontal location of the airport [32]. For these corrections, only pressure settings are considered. Indeed, the reference temperature employed in QNH, QFE or QFE pressure altitude computation is the constant ISA MSL temperature. Pressure altitude above a certain reference overestimates the true geopotential altitude above that reference when the actual atmospheric temperature is lower than predicted by the ISA, which is of course safety—critical. Airplanes receive QFE or QNH pressure settings from airports. Depending on the vertical and horizontal distance from the transmitting airport, the QNH— or QFE—corrected pressure altitudes can more or less deviate from the actual geopotential altitude above MSL or above the airport, respectively. Besides, the QNH— or QFE— pressure settings are rounded down to the nearest lower whole hPa [33], with therefore a maximum rounding error of 99 Pa. This rounding error corresponds to a pressure altitude offset of more than 8 m, at ISA MSL conditions. Finally, it can be assumed that QFE or QNH corrections degrade over time, as both are contained in half-hourly or hourly weather reports transmitted by airports [33].

Unlike for the QFE or QNH and as mentioned above, in our ground-correction approach we propose to directly employ ground temperature measurements too in order to mitigate the temperature effects. Additionally, for the ground-approach we propose a pseudo-continuous transmission of the ground weather measurements (i.e. whenever new measurements are available), whereby the pressure readings are rounded not more than to the closest Pa.

Ground-correction may also be based on weather measurements performed on top of buildings for the transition between flight phases at higher altitudes and approach/landing.

The usage of weather measurements from a vertiport for pressure altitude computation may be less suitable during UAM flight phases happening at relatively large distances from that vertiport. This may be the case during enroute operations. In those scenarios, the correction of pressure altitude may be performed based on estimates of local weather parameters obtained through the interpolation of weather data made available by an external provider [34] on numerous vertical levels. We refer to this approach as the weather-corrected pressure altitude [31].

We call the geodetic altitude obtained from any corrected pressure altitude the barometric geodetic altitude. A fault tree can be generated for the safety assessment of barometric geodetic altitude computation in UAM. The fault tree can be structured with two main top-level branches, as shown in Fig. 6. One branch—here the right one— is related to airborne pressure measuring. The left branch is related to the data used for the pressure altitude correction. In the ground-correction approach the left branch shall consider the components of the system providing ground weather measurements. Here, we have directly included as fault rate the inverse of a typical mean time between failure (MTBF), i.e. 15,000 h, of suitable pressure and temperature transmitters [35]. In case the weather- correction approach was considered, then the left branch would need to be related to the used weather dataset instead [36]. The fault rate in the right branch of Fig. 6 is derived from the analyses of [37], which focus on the safety assessment of an air data system suitable for UAM applications.

Fig. 7
figure 7

Visual positioning processing chain

Full size image
Fig. 8
figure 8

Vision subsystem integrity tree

Full size image

4.4 Camera

Fig. 9
figure 9

Test set-up for navigation systems during HorizonUAM project in Cochstedt airport, Germany (Image: Google Earth)

Full size image

For UAM vertiport operations, machine vision can play an important role as a complement to radio-based navigation systems due to its high precision and availability in environments with radio interference. Nevertheless, for safety-critical UAM applications, the standardization and certification gaps for computer-vision-based navigation methods have limited the application of this technology. To the best of our knowledge, there is no standard yet to certify visual navigation methods for UAM applications. In guidance material published by RTCA to identify navigation gaps for unmanned aircraft systems [8], it was noted that certification of the vision systems will be difficult and there is a gap in standardized methods to assess the integrity performance. Identifying the critical fault modes to monitor and quantifying the algorithm integrity are the main challenges of certifying visual navigation systems. For visual navigation, the fault occurrence frequency and the consequent error magnitude are highly dependent on the scenarios, the onboard sensor setup and the specific processing algorithm applied. These aspects are taken into account in our research and design to take a step towards future certifiable systems.

Depending on the application scenario, different categories of visual navigation methods (from visual odometry for relative motion estimation to deep-learning-based map matching, see [38] for a more detailed review) can be used to fulfill the design need. For safety-critical UAM landing, high integrity is required when the vision subsystem is used for navigation purposes. As a result, the design of the visual navigation method should satisfy the following criteria to achieve high integrity:

  • The processing procedure must be interpretable so that the residual error can be properly quantified and monitored.

  • The algorithm should be robust to lighting condition changes.

  • There must be measurement redundancy for integrity checking.

According to the above criteria, we choose to apply a visual positioning algorithm using the feature points of the georeferenced markers. The chosen algorithm also has the advantage that the position of the onboard camera can be estimated independently at each time snapshot, so it is not affected by the error correlation over time, which is challenging to model conservatively. From the implementation and operation points of view, the cost and effort of painting and georeferencing markers on vertiports is usually quite affordable.

The core procedure of positioning the camera includes processing in different data spaces, as shown in Fig. 7.

Faults that can result in positioning integrity risk or continuity risk may occur at each individual phase and propagate in the processing. In order to quantify the visual positioning integrity, all the errors in different domains in the processing must be properly monitored. Therefore, we design the visual positioning algorithm for UAM landing by allocating the integrity budget to different processing blocks, following the multi-domain integrity monitoring framework for visual navigation proposed in [38].

As a subsystem providing additional availability and accuracy to the multisensor navigation solution during approach and landing phases, the vision system is used for navigation only if the integrity risk of the subsystem itself fulfills the integrity requirements. For our design for these specific application scenarios, the vision subsystem faults can be broken down as in Fig. 8. It should be mentioned that the decomposition is a preliminary proposal according to the subsystem requirements analysis, given that there is no standard yet to quantify the exact values of the integrity requirements on visual navigation systems. Such a decomposition of the integrity tree provides a first basis for the design and implementation of the integrity monitors for visual positioning in our research. Further developments and validations are necessary to obtain more precise requirements and practically achievable performance of the visual positioning system.

5 Initial subsystems proof of concept

Fig. 10
figure 10

Reference trajectory of short flights between Vertiport 1 and 2 in Fig. 9

Full size image
Fig. 11
figure 11

Real-time protection levels based on close-by GNSS reference during take-off and landing operations

Full size image

5.1 U-GBAS

During test flights in July 2023 the U-GBAS subsystem was tested in real-time in terms of nominal performance for take-off and landing at close-by vertiport. The ground correction calculation and limited integrity monitoring was performed based on a single reference system consisting of a low-cost Tallysmann TW7972 triple band antenna, a Javad Omega receiver as well as a Laptop for processing and correction generation. The reference antenna was located about 100 m away from the vertiports. Nominal noise and multipath models for both ground and airborne antenna were derived from earlier tests using the same hardware [28]. The system utilized L1/E1 measurements from up to 14 available GPS and Galileo satellites.

The flown trajectory where real-time computed U-GBAS positions and protection levels are available consists of two short flights between the two vertiports (see also Fig. 9) at the Cochstedt test facility. Figure 10 shows the trajectory generated from differential GNSS post-processing. This case, straight vertical take-off and landing were conducted, not considering future, potentially more complex approach trajectories. Figure 11 depicts the achieved protection levels as well as position errors (compared with the post-processing trajectory) for the two flights. As we can see, after an initial convergence phase where fewer satellites are used and therefore protection levels are higher, we reach values of 3–4 m in horizontal and 4–5 m in vertical domain, approximately in the order of magnitude of the requirements derived in Sect. 2.2. While vertical results appear particularly promising in this favorable scenario (open sky, close-by reference), the achieved horizontal position errors show a bias of around 1 m.

5.2 Ground-corrected barometer for vertiport operations

5.2.1 Setup and system calibration

During the flight trials, the airborne pressure measurements were performed by the barometer of an industrial grade navigation system. A ground computer read the ground measurement from a weather station and transmitted them to the drone. The data was transmitted over the WLAN provided by a router and locally extended with an additional antenna. An airborne computer processed the airborne and ground pressure measurements to compute barometric geodetic altitude.

Fig. 12
figure 12

Pressure measurements (upper plot) and barometric geodetic altitude (lower plot) along HorizonUAM test flights

Full size image

The employed airborne barometer was realistically of a notably lower grade if compared to barometers used in aviation or even to the one described in [37] for UAM vehicles. For this reason an adjustment of the airborne barometer measurements was particularly needed. Biases could otherwise result in large altitude estimation errors. A comparison of a time series of pressure measurements of the adopted airborne barometer with the ones of the weather station showed an almost constant offset of approximately 193 Pa. A second comparison six weeks later showed an offset of 197 Pa. The employed airborne barometer and the weather station were factory- calibrated several years ago and few months ago, respectively. Based on this and on the specifications of these devices, it can be assumed the weather station to be more reliable. It can also be assumed that a constant bias of approximately 195 Pa, or a possibly slowly growing bias, is present in the airborne barometer. This bias would translate to an absolute altitude offset of approximately 16 m, at ISA MSL conditions. We hence adjusted the airborne pressure measurements by removing this bias, before employing them for the barometric geodetic altitude computation.

In an operational scenario, we recommend the usage of reliable and stable ground weather stations. We also advocate regular inspections and calibrations of airborne barometers, in case their stability and accuracy will be limited by industry requirements for reduced cost and mass.

5.2.2 Initial results

The lower plot of Fig. 12 presents some initial results of the barometric geodetic altitude computation based on the ground-correction approach. The results represent several short flights over more than 30 min. The upper plot of Fig. 12 shows the airborne and the vertiport pressure measurements. From this plot, it can be noticed that the employed method produces altitude measurements that quite well capture the true altitude profile. However, the barometric geodetic altitude shows a quite noisy behavior. This is due to the noise in the airborne pressure measurements, of a notably higher level than the one in the ground pressure measurements. The highest errors in the geodetic altitude computation are found in those transients during which the drone is flying very close to the ground. Despite these errors, the proposed approach shows first promising performances as a vertical navigation aid for UAM applications.

5.3 Camera-aided takeoff and landing

It is very challenging to achieve the navigation requirements only using GNSS when vehicles fly close to the ground. Thus, vision-based positioning was applied to support the take-off and landing phases. For visual positioning, two different AprilTag markers [39,40,41] were generated using the family type “tag25h9” and pattern ID=11 and 21. A marker with pattern ID=11 was placed on the take-off site (Vertiport 1 in Fig. 9), and the other one with ID=21 was placed on the landing site (Vertiport 2 in Fig. 9). Both markers’ size was equally set as \(0.785\textrm{m}\times 0.785\textrm{m}\). Figure 13 shows an example of the marker detection with the green line during the landing phase at Vertiport 2.

Fig. 13
figure 13

Marker detection (green line) during the landing phase at Vertiport 2

Full size image

5.3.1 Error analysis of camera intrinsic parameter estimation

Before the flight experiments, the camera intrinsic parameters, such as focal length and the position of the optical center point, were estimated (camera calibration process). Then, the errors of the estimates were first analyzed since they have a significant impact on the camera position estimation. First, multiple ArUco markers [42] were placed on the ground, and one of corner points was defined as the origin of the reference frame. True 3D locations of the other markers’ corner points were computed with respect to the reference frame by measuring the distances between the markers. Then, corner points were detected in the sample images. The 3D coordinates of each corner points were reconstructed with respect to the reference frame, using the camera intrinsic parameters (estimated during the calibration process) and the detected corner points. Finally, the differences between the reconstructed coordinates and the true 3D locations can be computed, and back-propagated to the intrinsic parameters. If the errors exceeds the required accuracy, the camera should be re-calibrated. Otherwise, the calibration results are accepted, and the uncertainty in the intrinsic parameters are propagated to the position estimates and included in the protection level calculation. The more detailed processes and results can be found in our paper [43].

Fig. 14
figure 14

Vision-based trajectory estimates during take-off at Vertiport 1 and landing at Vertiport 2 (time is marked with colorbar). Ground truth trajectory is depicted in gray

Full size image

5.3.2 Visual positioning validation

In the experiments, the vehicle took off at the Vertiport 1, flew the planned trajectory, and then landed on the Vertiport 2. The ground truth trajectory (gray in Fig. 14) were obtained using the differential correction method with GNSS as well as GBAS signals, and the decimeter level accuracy is expected. During the take-off and landing phases, the 3D positions of the vehicle were estimated using the markers placed on each vertiport. The position estimates are shown with colorbar in Fig. 14. As can be seen in the figure, the vehicle’s trajectory was accurately estimated using the marker-based method during the both phases, following the ground truth trajectory within meter level differences.

6 Outlook

Future work will address the integration and further developments of the navigation subsystems and their validation and testing with respect to the foreseen navigation requirements for the intended operations. The derivation of error and threat models for the UAM use cases will also be continued in future work. In particular, to reach a quantification of specific fault probabilities for each subsystem. Additional sensors will also be considered in the future to support more reliable operations, for instance related to the final touchdown and taking off phase.

7 Conclusions

This paper reviews current international standardization effort of UAM operations and derives first navigation requirements, with a focus on vertiport operations. The derived requirements will be instrumental for the design and validation of future UAM navigation systems and therefore for safe operations.

In this work, we present a brief overview of the available technical solutions for navigation systems suitable to UAM vertiport operations. We then focus on a subset of these solutions as subsystems of a first navigation integrity architecture proposal. Initial performance assessments of the chosen subsystems based on UAV flight trials show promising potential for their future inclusion within robust UAM navigation systems.