Risking to underestimate the integrity risk

Abstract

As parameter estimation and statistical testing are often intimately linked in the processing of observational data, the uncertainties involved in both estimation and testing need to be properly propagated into the final results produced. This necessitates the use of conditional distributions when evaluating the quality of the resulting estimator. As the conditioning should be on the identified hypothesis as well as on the corresponding testing outcome, omission of the latter will result in an incorrect description of the estimator’s distribution. In this contribution, we analyse the impact this omission or approximation has on the considered distribution of the estimator and its integrity risk. For a relatively simple observational model it is mathematically proven that the rigorous integrity risk exceeds the approximation for the contributions under the null hypothesis, which typically has a much larger probability of occurrence than an alternative. Actual GNSS-based positioning examples confirm this finding. Overall we observe a tendency of the approximate integrity risk being smaller than the rigorous one. The approximate approach may, therefore, provide a too optimistic description of the integrity risk and thereby not sufficiently safeguard against possibly hazardous situations. We, therefore, strongly recommend the use of the rigorous approach to evaluate the integrity risk, as underestimating the integrity risk in practice, and also the risk to do so, cannot be acceptable particularly in critical and safety-of-life applications.

Introduction

The DIA method for the detection, identification and adaptation of model misspecifications combines estimation with testing. Parameter estimation is conducted to determine estimates for the parameters of interest, and statistical testing is conducted to validate the results with the aim of removing any unwanted biases that may be present. To rigorously capture the estimation–testing combination, the DIA estimator has recently been introduced by Teunissen (2017) together with a unifying probabilistic framework. This allows one to take into account the intricacies of the combination when evaluating the contributions of the decisions and estimators involved. Procedures followed in practice are usually conditional ones implying that the quality and the performance of the resulting estimator must be described based on its subsequent conditional distribution. Hence, employing the distribution of the estimator under an identified hypothesis without regard to the conditioning process that led to the decision of accepting this hypothesis may impact the quality description of the resulting estimator in terms of precision, unbiasedness, confidence region and integrity risk.

In this contribution, we turn our attention specifically to the integrity risk, which—in short—is the probability that, whatever hypothesis is true in reality, the estimator of unknown parameters, directed by the testing outcome, is outside an acceptable area or volume around its targeted value. The estimator’s integrity risk is thus one minus its confidence level. As integrity plays a crucial role in critical and safety-of-life applications, for instance in aviation, when GNSS positioning is used to fly an approach to an airport, stringent requirements on integrity obviously apply. We compare, using a number of GNSS positioning examples, the integrity risk using unconditional distributions with the one obtained by rigorous evaluation of the correct conditional ones. We demonstrate that with the approximate approach of using unconditional distributions to evaluate the integrity risk, for instance when accounting for the event of removing from the solution an observation identified as faulty, one may obtain too optimistic figures, and thereby compromise the whole concept of integrity. The actual integrity risk, evaluated using the correct conditional distributions, may, in fact, be significantly larger.

This contribution is organized as follows. We start with a brief review of the detection, identification, and adaptation procedure, including the DIA estimator and its statistical distribution. Next, the integrity risk is defined, rigorous as well as approximate, with the latter following from neglecting the conditioning on the testing outcome. We then demonstrate in graphical form, using a simple observational model with just a single unknown parameter, both the unconditional and conditional distributions, so that the different contributions to the integrity risk, as well as the differences between the two approaches, are understood. We also prove in this section that, under the null hypothesis, the rigorous integrity risk always exceeds the approximate one. The integrity risk comparison is then continued, but now for a number of actual satellite-based single-point positioning examples. These findings show that one indeed runs a serious risk of underestimating the actual integrity risk (or overestimating the confidence level) when using the unconditional distributions instead of the conditional ones. We hereby note that our findings, although demonstrated by means of an application of the DIA procedure, are equally valid for any other method of fault detection and exclusion, and, therefore, hold true for a wide variety of different applications, such as geodetic quality control (Kösters and van der Marel 1990; Amiri Simkooei 2001; Perfetti 2006), navigational integrity (Teunissen 1990b; Gillissen and Elema 1996; Yang et al. 2014), structural health integrity (Verhoef and de Heus 1995; Yavaşoğlu et al. 2017; Durdag et al. 2018), and integrity monitoring of GNSS (Jonkman and de Jong 2000; Kuusniemi et al. 2004; Hewitson and Wang 2006). Finally, a summary with conclusions are presented.

Detection, identification and adaptation (DIA)

A brief recap of the DIA-datasnooping procedure is provided, and the DIA estimator introduced in Teunissen (2017) is presented. Then an inventory of all possible testing decisions is compiled, and the distribution of the DIA estimator is decomposed into contributions, conditioned on the testing outcome and the hypothesis.

Statistical hypotheses

We first formulate the null- and alternative hypotheses, denoted by ${\mathcal{H}_0}$ and ${\mathcal{H}_{\text{i}}},$ respectively. Throughout the paper, as alternative hypotheses, we consider those describing outliers in individual observations. Here we restrict ourselves to the case of one outlier at a time. In that case there are as many alternative hypotheses as there are observations. Therefore, the observational model under ${\mathcal{H}_0}$ and ${\mathcal{H}_{\text{i}}}$ is given as

$${\mathcal{H}_0} :E(y) =Ax{\text{;}} \quad D(y)={Q_{{{yy}}}}$$

(1)

$${\mathcal{H}_{\text{i}}} :E(y) =Ax+{c_i}{b_i}{\text{;}}\quad D(y)={Q_{{{yy}}}}$$

(2)

with $E( \cdot )$ the expectation operator, $D( \cdot )$ the dispersion operator, $y \in {{\mathbb{R}}^m}$ the normally distributed random vector of observables linked to the estimable unknown parameters through the design matrix $A \in {{\mathbb{R}}^{m \times n}}$ of ${\text{rank}}(A)=n$, and ${Q_{yy}} \in {{\mathbb{R}}^{m \times m}}$ the positive-definite variance matrix of $y$. The redundancy of ${\mathcal{H}_0}$ is $r=m - {\text{rank}}(A)=m - n$. ${c_i}$ is the canonical unit vector having one as its $i\text{th}$ entry and zeros elsewhere, and ${b_i}$ is the scalar bias. Note that $[A \;{c_i}]$ is a known matrix of full rank. As the number of observations is equal to $m,$ there are also $m$ alternative hypotheses ${\mathcal{H}_i}$ defined in (2); $i=1, \ldots ,m.$

The best linear unbiased estimator (BLUE) of the unknown parameters $x$ is given by

$${\mathcal{H}_0} : {\hat {x}_0}={A^+}y\quad {\mathcal{H}_{i \ne 0}} : {\hat {x}_i}=\bar {A}_{i}^{+}y$$

(3)

with ${A^+}={( {{A^T}Q_{{{{yy}}}}^{{-1}}A} )^{-1}}{A^T}Q_{{{{yy}}}}^{{-1}}$ the BLUE-inverse of $A,$ $\bar {A}_{i}^{+}={( {\bar {A}_{i}^{T}Q_{{{{yy}}}}^{{-1}}{{\bar {A}}_i}} )^{-1}}\bar {A}_{i}^{T}Q_{{{{yy}}}}^{{-1}}$ the BLUE-inverse of ${\bar {A}_i}=P_{{{c_i}}}^{ \bot }A$ and $P_{{{c_i}}}^{ \bot }={I_m}-{c_i}{( {c_{i}^{T}Q_{{{{yy}}}}^{{-1}}{c_i}})^{-1}}c_{i}^{T}Q_{{{{yy}}}}^{{-1}}$ being an orthogonal projector that projects onto the orthogonal complement of the range space of ${c_i}.$

DIA-datasnooping procedure

The DIA method has been widely employed in a variety of applications, such as the quality control of geodetic networks and the integrity monitoring of GNSS models, see, e.g., Teunissen (1990a) and Amiri Simkooei (2001). The DIA steps are realized using the misclosure vector $t \in {{\mathbb{R}}^r}$ given as

$$t={B^T}y{\text{;}}\quad {Q_{{{tt}}}} ={B^T}{Q_{{{yy}}}}B$$

(4)

where the $m \times r$ matrix $B$ is a full-rank matrix, with ${\text{rank}}(B)=r,$ of which the range space is an orthogonal complement of that of $A$, i.e., $[A\, B] \in {{\mathbb{R}}^{m \times m}}$ is invertible and ${A^T}B=0.$ Assuming that the measurement errors are normally distributed, i.e., $y\mathop \sim \limits^{{{\mathcal{H}_i}}} \mathcal{N}\left( {Ax+{c_i}{b_i},{Q_{{{yy}}}}} \right)$ for $i=0,1, \ldots ,m$ and ${c_0}{b_0}=0$, the misclosure vector is then distributed as

$$t\mathop \sim \limits^{{{\mathcal{H}_i}}} \mathcal{N}\left( {{\mu _{{t_i}}}={B^T}{c_i}{b_i},{Q_{tt}}} \right)\quad \text{for}\quad i=0,1, \ldots ,m$$

(5)

As $t$ is zero-mean under ${\mathcal{H}_0}$ and also independent of ${\hat {x}_0},$ it provides all the available information useful for validation of ${\mathcal{H}_0}$ (Teunissen 2017). Thus, an unambiguous testing procedure can be established through assigning the outcomes of $t$ to the statistical hypotheses ${\mathcal{H}_i}$ for $i=0,1, \ldots ,m.$

The DIA-datasnooping procedure is specified as follows.

Detection: Accept ${\mathcal{H}_0}$if $t \in {\mathcal{P}_0}$ with

$${\mathcal{P}_0}=\left\{ {t \in {{\mathbb{R}}^r}\left| { ||t||_{{ {Q_{{{tt}}}}}}^{2} \leqslant {k_{\alpha ,r}}} \right.} \right\}$$

(6)

in which $|| \cdot ||_{{ {Q_{tt}}}}^{2}=( \cdot {)^T}Q_{{tt}}^{{-1}}( \cdot )$ and ${k_{\alpha ,r}}$ is the $\alpha$-percentage of the central Chi-square distribution with $r$ degrees of freedom. If ${\mathcal{H}_0}$ is accepted, then ${\hat {x}_0}$is provided as the estimate of $x$. Otherwise, go to next step.

Identification: Compute Baarda’s test statistic for all alternative hypotheses as (Baarda 1967; Teunissen 2000)

$${w_i}=\frac{{c_{{{t_i}}}^{T}Q_{{{{tt}}}}^{{-1}}t}}{{\sqrt {c_{{{t_i}}}^{T}Q_{{{{tt}}}}^{{-1}}{c_{{t_i}}}} }}$$

(7)

in which ${c_{{t_i}}}={B^T}{c_i}$ is the ith column of matrix ${B^T}$ since ${c_i}$ is a canonical unit vector. Select ${\mathcal{H}_{i \ne 0}}$ if $t \in {\mathcal{P}_{i \ne 0}}$ with

$${\mathcal{P}_{i \ne 0}}=\left\{ {t \in {{\mathbb{R}}^r}/{\mathcal{P}_0}\left| { |{w_i}|=\mathop {\text{max}}\limits_{{j \in \{ 1, \ldots ,m\} }} |{w_j}|} \right.} \right\}$$

(8)

Adaptation: When ${\mathcal{H}_i}$ is selected, then ${\hat {x}_i}$ is provided as the estimate of $x$.

The partitioning ${\mathcal{P}_i}$ in terms of the (original) misclosure vector is introduced in Teunissen (2017), and an example is shown in Fig. 3 in [Ibid]. Note that the above datasnooping partitioning would need modification in case of ‘iterated datasnooping’ (Kok et al. 1984) for multiple outlier testing which involves consecutive rounds of detection and identification until no further outlier is detected.

DIA estimator

Given the above three steps, estimation and testing are combined in DIA-datasnooping. Teunissen (2017) presents a unifying framework to rigorously capture the probabilistic properties of this combination, see also Teunissen et al. (2017). As such, the DIA estimator $\bar {x}$ was introduced, which captures the whole estimation–testing scheme and it is given as

$$\bar {x}=\sum\limits_{{j=0}}^{m} { {{\hat {x}}_j} \,{p_j}(t)}$$

(9)

with ${p_j}(t)$ being the indicator function of region ${\mathcal{P}_j},$ i.e., ${p_j}(t)=1$ for $t \in {\mathcal{P}_j}$ and ${p_j}(t)=0$ elsewhere. Therefore, the DIA estimator $\bar {x}$ is a combination of ${\hat {x}_j}$ for $j=0,1, \ldots ,m$ and the misclosure vector $t.$ The probability density function (PDF) of $\bar {x}$ under ${\mathcal{H}_i}$ reads (Teunissen 2017)

$$\begin{aligned} {f_{\bar {x}}}(\theta |{\mathcal{H}_i}) & = \sum\limits_{{j=0}}^{m} {\int_{{{\mathcal{P}_j}}} {{f_{{{\hat {x}}_j},t}}(\theta , \tau |{\mathcal{H}_i}) \,\text{d}\tau } } \\ & = \sum\limits_{{j=0}}^{m} {\int_{{{\mathcal{P}_j}}} {{f_{{{\hat {x}}_0}}}(\theta +{L_j}\tau |{\mathcal{H}_i}) {f_t}(\tau |{\mathcal{H}_i})\, \text{d}\tau } } \\ \end{aligned}$$

(10)

where the second equality is a consequence of

$${\hat {x}_j}={\hat {x}_0} - {L_j}t$$

(11)

with

$${L_j}=\frac{1}{{||{c_{{t_j}}}||_{{ {Q_{{t}{t}}}}}^{2}}}{A^+}{c_j}c_{{{t_j}}}^{T}Q_{{{t}{t}}}^{{-1}}.$$

(12)

Testing decisions

As was shown above, the decisions of the testing procedure are driven by the outcome of the misclosure vector $t.$ If ${\mathcal{H}_i}$ is true, then the decision is correct if $t \in {\mathcal{P}_i},$ and wrong if $t \in {\mathcal{P}_{j \ne i}}.$ We, therefore, discriminate between the following events

$$\begin{aligned} {\text{CA}} & =(t \in {\mathcal{P}_0}|{\mathcal{H}_0})= {\text{correct\,acceptance}} \\ {\text{FA}} & =(t \notin {\mathcal{P}_0}|{\mathcal{H}_0})= \text{false \,alarm} \\ {\text{MD}_i} & =(t \in {\mathcal{P}_0}|{\mathcal{H}_i})= \text{missed\,detection} \\ \text{CD}_{i} & =(t \notin {\mathcal{P}_0}|{\mathcal{H}_i})= \text{correct\,detction}\, \\ \text{WI}_{i} & =(t \in { \cup _{j \ne 0,i}}{\mathcal{P}_j}|{\mathcal{H}_i}) = \text{wrong\,identification} \\ \text{CI}_{i} & =(t \in {\mathcal{P}_i}|{\mathcal{H}_i})= \text{correct\,identification} \\ \end{aligned}$$

(13)

With $* =\text{CAFAMD}_{i},\text{CD}_{i},\text{WI}_{i},\text{CI}_{i},$ we denote the probability of $*$ by ${\text{P}_ * }.$ satisfying

$$ \begin{gathered} {\text{P}}_{{{\text{CA}}}} + {\text{P}}_{{{\text{FA}}}} = {\text{1}} \hfill \\ {\text{P}}_{{{\text{MD}}_{i} }} + {\text{P}}_{{{\text{CD}}_{i} }} = {\text{1}} \hfill \\ {\text{P}}_{{{\text{WI}}_{i} }} + {\text{P}}_{{{\text{CI}}_{i} }} = {\text{P}}_{{{\text{CD}}}} \hfill \\ \end{gathered} $$

(14)

Computation of ${\text{P}_ * }$ requires information about the misclosure PDF which is given in (5). Here, it is important to note the difference between the CD- and CI-probability, i.e.${\text{P}_{\text{C}{\text{D}_i}}} \geqslant {\text{P}_{\text{C}{\text{I}_i}}}.$ They would be the same if there were only one single alternative hypothesis, say ${\mathcal{H}_1},$ since then ${\mathcal{P}_{\text{1}}}={{\mathbb{R}}^{\text{r}}}/{\mathcal{P}_0}.$

Decomposition of ${f_{\bar {x}}}(\theta |{\mathcal{H}_i})$

Given the events in (13) and using the total probability rule, ${f_{\bar {x}}}(\theta |{\mathcal{H}_i})$ can be decomposed as follows:

$${f_{\bar {x}}}(\theta |{\mathcal{H}_i})= \sum\limits_{{j=0}}^{m} {{f_{\bar {x}|t \in {\mathcal{P}_j}}}\left( {\theta |t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right)} \,P\left( {t \in {\mathcal{P}_j}|{\mathcal{H}_i}} \right)$$

(15)

where

$${f_{\bar {x}|t \in {\mathcal{P}_j}}}\left( {\theta |t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right)= {f_{{{\hat {x}}_j}|t \in {\mathcal{P}_j}}}\left( {\theta |t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right)$$

(16)

Therefore, in case $j=0,$ due to ${\hat {x}_0}$ being independent of t, we have

$${f_{\bar {x}|t \in {\mathcal{P}_0}}}\left( {\theta |t \in {\mathcal{P}_0},{\mathcal{H}_i}} \right)= {f_{{{\hat {x}}_0}}}\left( {\theta |{\mathcal{H}_i}} \right)$$

(17)

The proof of (16) and (17) is given as follows. The conditional PDF ${f_{\bar {x}|t \in {\mathcal{P}_j}}}\left( {\theta |t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right)$ is obtained through the following general expression

$${f_{\bar {x}|t \in {\mathcal{P}_j}}}\left( {\theta |t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right)= \int_{{{\mathcal{P}_j}}} {\frac{{{f_{\bar {x},t}}(\theta , \tau |{\mathcal{H}_i})}}{{\text{P}(t \in {\mathcal{P}_j}|{\mathcal{H}_i})}}} \text{d}\tau $$

(18)

in which (Teunissen 2017)

$${f_{\bar {x},t}}\left( {\theta , \tau |{\mathcal{H}_i}} \right)= \sum\limits_{{j=0}}^{m} {{f_{{{\hat {x}}_j},t}}} \left( {\theta , \tau |{\mathcal{H}_i}} \right) {p_j}(\tau )$$

(19)

Substituting (19) into (18) gives

$${f_{\bar {x}|t \in {\mathcal{P}_j}}}\left( {\theta |t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right)= \int_{{{\mathcal{P}_j}}} {\frac{{{f_{{{\hat {x}}_j},t}}\left( {\theta , \tau |{\mathcal{H}_i}} \right)}}{{\text{P}\left( {t \in {\mathcal{P}_j}|{\mathcal{H}_i}} \right)}}} \text{d}\tau $$

(20)

Comparing the structure of (20) with that of (18), we achieve (16). For $j=0,$ we have ${f_{{{\hat {x}}_0},t}}\left( {\theta , \tau |{\mathcal{H}_i}} \right)= {f_{{{\hat {x}}_0}}}(\theta |{\mathcal{H}_i}) {f_t}\left( {\tau |{\mathcal{H}_i}} \right)$ of which the substitution into (20) gives (17). Note that the conditional PDFs ${f_{{{\hat {x}}_j}|t \in {\mathcal{P}_j}}}\left( {\theta |t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right)$ for $j \ne 0$ are non-normal, which is further discussed in the following sections.

Integrity risk

Being an estimator of $x,$ the DIA estimator $\bar {x}$ is likely to be considered a good estimator if it is close to $x$ with a sufficiently large probability. Defining ‘closeness’ as ‘lying in an x-centered region ${\mathcal{B}_x}$’, and ‘sufficiently large’ as ‘$1 - \varepsilon$’ for a very small $\varepsilon$, then $\bar {x}$ is an acceptable estimator of $x$ if $\text{P}(\bar {x} \in {\mathcal{B}_x}) \geqslant 1 - \varepsilon$ or equivalently

$$\text{P}(\bar {x} \in \mathcal{B}_{x}^{c})<\varepsilon $$

(21)

with $\mathcal{B}_{x}^{c}={{\mathbb{R}}^n}/{\mathcal{B}_x}.$ We refer to the above probability as integrity risk, see also, e.g., Schuster et al. (2007) and Salós et al. (2010). The integrity risk (21) is thus one minus the probability of $\bar {x}$ lying inside the confidence region ${\mathcal{B}_x}$. In the sequel, we denote this probability by $\overline {{\text{IR}}} .$

Assuming that $\sum\nolimits_{{j=0}}^{m} {\text{P}\left( {{\mathcal{H}_j}} \right)} =1,$ with $\text{P}\left( {{\mathcal{H}_j}} \right)$ being the probability of occurrence of ${\mathcal{H}_j},$ describing a bias in the single jth measurement, cf. (2), the integrity risk can be decomposed, using the total probability rule, as

$$\overline {{\text{IR}}} =\sum\limits_{{j=0}}^{m} {\text{P}\left( {\bar {x} \in \mathcal{B}_{x}^{c}|{\mathcal{H}_j}} \right) \text{P}} \left( {{\mathcal{H}_j}} \right)$$

(22)

Here it is important to realize that the above expression depends on the bias value ${b_i}$ under ${\mathcal{H}_i}$ for $i=1, \ldots ,m.$ One may take a conservative route by computing each term in the summation for a bias value ${b_i}$ which maximizes the product $\text{P}\left( {\bar {x} \in \mathcal{B}_{x}^{c}|{\mathcal{H}_i}} \right) \text{P}\left( {{\mathcal{H}_i}} \right).$ The probabilities $\text{P}\left( {\bar {x} \in \mathcal{B}_{x}^{c}|{\mathcal{H}_i}} \right)$ in the summation (22), using (15) and (16), can be expressed as

$$\overline {{\text{IR}}} |{\mathcal{H}_i}=\text{P}\left( {\bar {x} \in \mathcal{B}_{x}^{c}|{\mathcal{H}_i}} \right)=\sum\limits_{{j=0}}^{m} {\text{P}\left( {{{\hat {x}}_j} \in \mathcal{B}_{x}^{c}|t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right) \text{P}\left( {t \in {\mathcal{P}_j}|{\mathcal{H}_i}} \right)} $$

(23)

The conditional probabilities in the above equation are computed based on the PDFs ${f_{{{\hat {x}}_j}|t \in {\mathcal{P}_j}}}\left( {\theta |t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right).$

Would one neglect the correlation between ${\hat {x}_j}$ and t, and use the unconditional PDFs ${f_{{{\hat {x}}_j}}}\left( {\theta |{\mathcal{H}_i}} \right)$ instead, an approximation of the rigorous integrity risk $\overline {{\text{IR}}} |{\mathcal{H}_i}$ is obtained as

$$\text{IR}^{o}|{\mathcal{H}_i}=\sum\limits_{{j=0}}^{m} {\text{P}\left( {{{\hat {x}}_j} \in \mathcal{B}_{x}^{c}|{\mathcal{H}_i}} \right) \text{P}} \left( {t \in {\mathcal{P}_j}|{\mathcal{H}_i}} \right)$$

(24)

In $\left( {\overline {{\text{IR}}} |{\mathcal{H}_i}} \right),$ one conditions on both the hypothesis and the testing outcome, while in $\left( {\text{IR}^{o}|{\mathcal{H}_i}} \right),$ one conditions only on the hypothesis and not on the testing outcome.

The difference between the rigorous and approximate integrity risks under ${\mathcal{H}_i}$ reads

$$\overline {{\text{IR}}} |{\mathcal{H}_i} - \text{IR}^{o}|{\mathcal{H}_i}=\sum\limits_{{j=0}}^{m} {\left[ {\text{P}\left( {{{\hat {x}}_j} \in \mathcal{B}_{x}^{c}|t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right) - \text{P}\left( {{{\hat {x}}_j} \in \mathcal{B}_{x}^{c}|{\mathcal{H}_i}} \right)} \right] \text{P}} \left( {t \in {\mathcal{P}_j}|{\mathcal{H}_i}} \right)$$

(25)

Note, in the above summation, that $j$ runs from 1 to $m$ as $\text{P}\left( {{{\hat {x}}_0} \in \mathcal{B}_{x}^{c}|t \in {\mathcal{P}_0},{\mathcal{H}_i}} \right)=\text{P}\left( {{{\hat {x}}_0} \in \mathcal{B}_{x}^{c}|{\mathcal{H}_i}} \right)$, cf. (17). For a given region ${\mathcal{B}_x},$ the difference within square brackets depends on the difference between ${f_{{{\hat {x}}_j}|t \in {\mathcal{P}_j}}}\left( {\theta |t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right)$ and ${f_{{{\hat {x}}_j}}}\left( {\theta |{\mathcal{H}_i}} \right).$ The conditional PDF ${f_{{{\hat {x}}_j}|t \in {\mathcal{P}_j}}}\left( {\theta |t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right)$ would become equal to the PDF ${f_{{{\hat {x}}_j}}}\left( {\theta |{\mathcal{H}_i}} \right),$ if the correlation between ${\hat {x}_j}$ and $t$ would be zero. With (11), however, there is a non-zero correlation between ${\hat {x}_j}$ and t, driven by ${Q_{{{\hat {x}}_0}{{\hat {x}}_0}}}$, ${Q_{tt}}$ and ${L_j}$. In addition, the conditional PDF ${f_{{{\hat {x}}_j}|t \in {\mathcal{P}_j}}}\left( {\theta |t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right),$ using the total probability rule, can be written as

$$\begin{aligned} {f_{{{\hat {x}}_j}|t \in {\mathcal{P}_j}}}(\theta |t \in {\mathcal{P}_j},{\mathcal{H}_i}) & =\frac{1}{{\text{P}(t \in {\mathcal{P}_j}|{\mathcal{H}_i})}} \\ & \quad \times \left( {{f_{{{\hat {x}}_j}}}(\theta |{\mathcal{H}_i}) - \sum\limits_{{k \ne j}}^{m} {{f_{{{\hat {x}}_j}|t \in {\mathcal{P}_k}}}\left( {\theta |t \in {\mathcal{P}_k},{\mathcal{H}_i}} \right) \text{P}\left( {t \in {\mathcal{P}_k}|{\mathcal{H}_i}} \right)} } \right) \\ \end{aligned}$$

(26)

which reveals that

$$\text{P}\left( {t \in {\mathcal{P}_j}|{\mathcal{H}_i}} \right) \to 1 \Rightarrow {f_{{{\hat {x}}_j}|t \in {\mathcal{P}_j}}}\left( {\theta |t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right) \to {f_{{{\hat {x}}_j}}}\left( {\theta |{\mathcal{H}_i}} \right)$$

(27)

If $j=i$ and $|{b_i}| \to \infty$ then we have $\text{P}\left( {t \in {\mathcal{P}_i}|{\mathcal{H}_i}} \right) \to 1.$ As a result, the difference $\left( {\overline {{\text{IR}}} |{\mathcal{H}_i} - \text{IR}^{o}|{\mathcal{H}_i}} \right)$ is mainly driven by the term in the summation corresponding with $j=i.$ This in tandem with (27) gives

$$|{b_i}| \to \infty \Rightarrow \overline {{\text{IR}}} |{\mathcal{H}_i} - \text{IR}^{o}|{\mathcal{H}_i} \to 0$$

(28)

saying that for a very large bias magnitude, the difference between rigorous and approximate integrity risk vanishes.

Finally, we note that the issue of correlation-neglect between ${\hat {x}_j}$ and $t$ also comes up if one would use the outcomes of testing in an a posteriori evaluation. In that case one would have to work with the PDF of $\left( {\bar {x}|t \in {\mathcal{P}_j}} \right)$ which is different from that of ${\hat {x}_j},$ despite the fact that both random vectors, $\left( {\bar {x}|t \in {\mathcal{P}_j}} \right)$ and ${\hat {x}_j},$ have the same sample outcome (Teunissen 2017). For instance, if ${\mathcal{H}_j}$ is the identified hypothesis, confidence levels are typically evaluated in practice as $\text{P}\left( {{{\hat {x}}_j} \in {\mathcal{B}_x}|{\mathcal{H}_i}} \right)$, see e.g. (Wieser 2004; Devoti et al. 2011; Dheenathayalan et al. 2016), while they should be evaluated as $\text{P}\left( {{{\hat {x}}_j} \in {\mathcal{B}_x}|t \in {\mathcal{P}_j},{\mathcal{H}_i}} \right).$ The difference between their hypothesis averaged versions will then provide differences as those between (23) and (24).

Numerical analysis: single alternative hypothesis

In this section, we evaluate both the “rigorous” and “approximate” integrity risks defined by (23) and (24). To get a better understanding of their characteristics, we consider a simple observational model with only a single alternative hypothesis. Suppose that in (1), there is only one unknown parameter (n = 1) and also the redundancy of the model is one (r = 1), i.e., $x \in {\mathbb{R}}$ and $t \in {\mathbb{R}}.$ The canonical form of such a model, applying the Tienstra-transformation $\mathcal{T}$ to the (assumed) normally distributed vector of observables $y$ (Teunissen 2017), reads

$$\mathcal{T}y=\left[ \begin{gathered} {A^+} \hfill \\ {B^T} \hfill \\ \end{gathered} \right]y=\left[ \begin{gathered} {{\hat {x}}_0} \hfill \\ t \hfill \\ \end{gathered} \right]\mathop \sim \limits^{{{\mathcal{H}_i}}} \mathcal{N}\left( {\left[ \begin{array}{cc} x+{b_{{{\hat {x}}_{0,i}}}} \hfill \\ {b_{{t_i}}} \hfill \\ \end{array} \right] , \left[ \begin{array}{cc} \sigma _{{{{\hat {x}}_0}}}^{2} \quad0 \hfill \\ 0 \quad\sigma _{t}^{2} \hfill \\ \end{array} \right]} \right)$$

(29)

which is specified for $i \in \{ 0,a\}$ as

$$\begin{gathered} {\mathcal{H}_0}: {b_{{{\hat {x}}_{0,0}}}}=0,\;{b_{{t_0}}}=0 \hfill \\ {\mathcal{H}_a}: {b_{{{\hat {x}}_{0,a}}}}={L_a} {b_a},\;{b_{{t_a}}}={b_a} \hfill \\ \end{gathered}$$

(30)

for some ${b_a} \in {\mathbb{R}}/\{ 0\} ,$ and also ${L_a} \in {\mathbb{R}}$ which establishes the following link:

$${\hat {x}_{a}}={\hat {x}_0} - {L_{a}} t$$

(31)

With the mean of $\hat{x}_{0}$ and $t$ given by (29) and (30), we have $E({\hat {x}_a}|{\mathcal{H}_0})=E({\hat {x}_a}|{\mathcal{H}_a})=x.$

The corresponding DIA-datasnooping procedure is defined as

Detection: Accept ${\mathcal{H}_0}$ if $t \in {\mathcal{P}_0}$ with

$${\mathcal{P}_0}=\left[ { - \sqrt {{k_{\alpha ,1}}} , \sqrt {{k_{\alpha ,1}}} } \right]$$

(32)

Provide ${\hat {x}_0}$ as the estimate of $x.$

Identification: Select ${\mathcal{H}_a}$ if $t \in \mathcal{P}_{0}^{c}$ with $\mathcal{P}_{0}^{c}={\mathbb{R}}/{\mathcal{P}_0}$.

Adaptation: When ${\mathcal{H}_a}$ is selected, ${\hat {x}_a}$ is provided as the estimate of x.

With the above three steps, the DIA estimator and its PDF under ${\mathcal{H}_i},$ $i \in \{ 0,a\} ,$ are given by

$$\bar {x}={\hat {x}_0} {p_0}(t)+{\hat {x}_{a}} (1 - {p_0}(t))$$

(33)

and

$$\begin{aligned} {f_{\bar {x}}}\left( {\theta |{\mathcal{H}_i}} \right) & = {f_{{{\hat {x}}_0}}}\left( {\theta |{\mathcal{H}_i}} \right)\int_{{{\mathcal{P}_0}}} {{f_t}\left( {\tau |{\mathcal{H}_i}} \right)\text{d}\tau } + \int_{{\mathcal{P}_{0}^{c}}} {{f_{{{\hat {x}}_0}}}\left( {\theta +{L_a}\tau |{\mathcal{H}_\text{i}}} \right)} {f_t}\left( {\tau |{\mathcal{H}_i}} \right)\text{d}\tau \\ & = {f_{{{\hat {x}}_0}}}\left( {\theta |{\mathcal{H}_i}} \right)+ \int_{{\mathcal{P}_{0}^{c}}} {\left[ {{f_{{{\hat {x}}_0}}}\left( {\theta +{L_a}\tau |{\mathcal{H}_i}} \right) - {f_{{{\hat {x}}_0}}}\left( {\theta |{\mathcal{H}_i}} \right)} \right]{f_t}\left( {\tau |{\mathcal{H}_i}} \right)\text{d}\tau } \\ \end{aligned}$$

(34)

In (34), the second equality follows from $\mathcal{P}_{0}^{c}={\mathbb{R}}/{\mathcal{P}_0}.$

Decomposition of ${f_{\bar {x}}}\left( {\theta |{\mathcal{H}_0}} \right)$ and ${f_{\bar {x}}}\left( {\theta |{\mathcal{H}_a}} \right)$

As there is only one alternative hypothesis ${\mathcal{H}_a},$ the events in (13) are reduced to four events CA, FA, MD and CD, and the decomposition of ${f_{\bar {x}}}\left( {\theta |{\mathcal{H}_i}} \right)$ in (15) is then simplified to

$$\begin{aligned} {f_{\bar {x}}}\left( {\theta |{\mathcal{H}_0}} \right) & = {f_{{{\hat {x}}_0}}}\left( {\theta |{\mathcal{H}_0}} \right) {\text{P}_{\text{CA}}} + {f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA}) {\text{P}_{\text{FA}}} \\ {f_{\bar {x}}}\left( {\theta |{\mathcal{H}_a}} \right) & = {f_{{{\hat {x}}_0}}}\left( {\theta |{\mathcal{H}_{a}}} \right) {\text{P}_{\text{MD}}} + {f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD}) {\text{P}_{\text{CD}}} \\ \end{aligned}$$

(35)

Note that the subscripts of MD and CD as in (13) are dropped, as ${\mathcal{H}_a}$ is the only alternative. In Fig. 1, assuming (for example) that $\sigma _{{{{\hat {x}}_0}}}^{2}=0.5{\text{m}^2},$ $\sigma _{t}^{2}=2\,{\text{m}^2}$ and ${L_{a}}=0.5,$ we show how the PDFs ${f_{\bar {x}}}\left( {\theta |{\mathcal{H}_0}} \right)$ (top) and ${f_{\bar {x}}}\left( {\theta |{\mathcal{H}_a}} \right)$ (middle and bottom) are formed according to (35). The solid and dashed blue curves, respectively, depict ${f_{{{\hat {x}}_0}}}\left( {\theta |{\mathcal{H}_0}} \right)={f_{\bar {x}|\text{CA}}}(\theta |\text{CA})$ and ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ in the top panel, and ${f_{{{\hat {x}}_0}}}\left( {\theta |{\mathcal{H}_a}} \right) = {f_{\bar {x}|\text{MD}}}(\theta |\text{MD})$ and ${f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD})$ in the middle and bottom panels. The black curve shows ${f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_0}} \right),$ which is also equal to${f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_\text{a}}} \right).$ The probability of false alarm P_FA is usually user defined by setting the appropriate size of $\mathcal{P}_{0}$, hence an input to the DIA procedure both under null and alternative hypotheses. To assess the PDF of $\hat{x}_{0}$ and $\bar{x}$ under the alternative H_a, one additionally needs to set the size of the bias b_a, or alternatively, one may choose to set the correct detection probability P_CD as we did here.

Fig. 1

Illustration of the DIA estimator PDF [top] under null hypothesis ${\mathcal{H}_0}$ and [middle and bottom] under alternative hypothesis ${\mathcal{H}_{a}}.$ The contributing parameters are set to be $\sigma _{{{{\hat {x}}_0}}}^{2}=0.5{\text{m}^2},$ $\sigma _{t}^{2}=2\,{\text{m}^2},$ and ${L_a}=0.5.$ Panels, from left to right, correspond to ${\text{P}_{\text{FA}}}={10^{ - 3}}$ and ${\text{P}_{\text{FA}}}={10^{ - 1}}.$ Panels in the middle and at the bottom correspond to, resp., ${\text{P}_{\text{CD}}}=0.4$ and ${\text{P}_{\text{CD}}}=0.99$

As was mentioned earlier, the conditional PDFs ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ and ${f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD})$ are non-normal, which for the case of one single alternative can be expressed as

$${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})=\frac{1}{{{\text{P}_{\text{FA}}}}}\left[ {{f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_0}} \right) - {f_{{{\hat {x}}_a}|\text{CA}}}(\theta |\text{CA}) {\text{P}_{\text{CA}}}} \right]$$

(36)

$${f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD})=\frac{1}{{{\text{P}_{\text{CD}}}}}\left[ {{f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_a}} \right) - {f_{{{\hat {x}}_{a}}|\text{MD}}}(\theta |\text{MD}) {\text{P}_{\text{MD}}}} \right]$$

(37)

Substituting (36) and (37) into (35), given ${\text{P}_{\text{FA}}}=1 - {\text{P}_{\text{CA}}}$ and ${\text{P}_{\text{CD}}}=1 - {\text{P}_{\text{MD}}},$ we have

$$\begin{aligned} {\text{P}_{\text{FA}}} \to 1 & \Rightarrow {f_{\bar {x}}}\left( {\theta |{\mathcal{H}_0}} \right) \to {f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_0}} \right) \\ {\text{P}_{\text{FA}}} \to 0 & \Rightarrow {f_{\bar {x}}}\left( {\theta |{\mathcal{H}_0}} \right) \to {f_{{{\hat {x}}_0}}}\left( {\theta |{\mathcal{H}_0}} \right) \\ {\text{P}_{\text{CD}}} \to 1 & \Rightarrow {f_{\bar {x}}}\left( {\theta |{\mathcal{H}_a}} \right) \to {f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_a}} \right) \\ {\text{P}_{\text{CD}}} \to 0 & \Rightarrow {f_{\bar {x}}}\left( {\theta |{\mathcal{H}_a}} \right) \to {f_{{{\hat {x}}_0}}}\left( {\theta |{\mathcal{H}_a}} \right) \\ \end{aligned}$$

(38)

In Fig. 1, in agreement with (38), as ${P_{\text{FA}}}$ decreases, in the graphs on top, the curve of ${f_{\bar {x}}}\left( {\theta |{\mathcal{H}_0}} \right)$ in red gets close to that of ${f_{{{\hat {x}}_0}}}\left( {\theta |{\mathcal{H}_0}} \right)$ in blue. Also, when ${P_{\text{CD}}}$ increases from 0.40 to 0.99, in the graphs in the middle and at the bottom, the curve of ${f_{\bar {x}}}\left( {\theta |{\mathcal{H}_a}} \right)$ in red gets close to that of ${f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_a}} \right)$ in black and to that of ${f_{\bar {x}|\text{CD}}}(\theta |\text{CD})$ as well.

Non-normality of ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ and ${f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD})$

To appreciate the non-normality of the two PDFs ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ and ${f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD}),$ we show them for different values of the contributing factors, namely ${\text{P}_{\text{FA}}},$ ${\text{P}_{\text{MD}}}\left( {=1 - {\text{P}_{\text{CD}}}} \right),$ ${\sigma _{{{\hat {x}}_0}}},$ ${\sigma _t}$ and ${L_a},$ in Fig. 2. To highlight the non-normality of ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ and ${f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD}),$ we have also plotted (for reference) their normal counterparts having the same mean and variance in black. These normal PDFs, respectively, correspond with the random variables

Fig. 2

Illustration of the non-normal distribution of the components of the DIA estimator (left) ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ in blue and the normal distribution ${f_{{{\hat {x}}_{\text{fa}}}}}(\theta ),$ cf. (39), for reference, in black; (right) ${f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD})$ in blue and the normal distribution ${f_{{{\hat {x}}_{\text{cd}}}}}(\theta )$, cf. (39), for reference, in black. Unless otherwise mentioned in each panel, the default settings for the left panels are $\sigma _{{{{\hat {x}}_0}}}^{2}=0.5{\text{m}^2},$ $\sigma _{t}^{2}=2\,{\text{m}^2},$ ${L_a}=0.5$ and ${\text{P}_{\text{FA}}}={10^{ - 3}},$ and for the right panels are $\sigma _{{{{\hat {x}}_0}}}^{2}=0.5{\text{m}^2},$ $\sigma _{t}^{2}=2{\text{m}^2},$ ${L_a}=1.5,$ ${\text{P}_{\text{FA}}}={10^{ - 3}}$ and ${\text{P}_{\text{CD}}}=0.6$

$$\begin{gathered} {{\hat {x}}_{\text{fa}}}\sim \mathcal{N}\left( {E\left( {{{\hat {x}}_a}|\text{FA}} \right), \sigma _{{{{\hat {x}}_{a}}|\text{FA}}}^{2}} \right) \hfill \\ {{\hat {x}}_{\text{cd}}}\sim \mathcal{N}\left( {E\left( {{{\hat {x}}_a}|\text{CD}} \right), \sigma _{{{{\hat {x}}_a}|\text{CD}}}^{2}} \right) \hfill \\ \end{gathered}$$

(39)

Note that the above random variables are only introduced here to illustrate the departure from normality of $\left( {{{\hat {x}}_a}|\text{FA}} \right)$ and $\left( {{{\hat {x}}_a}|\text{CD}} \right).$

The panels to the left side of Fig. 2 demonstrate the behavior of ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ in blue, in comparison to ${f_{{{\hat {x}}_{\text{fa}}}}}(\theta )$ in black. We note that the following situations ${\sigma _{{{\hat {x}}_0}}} \uparrow ,$ ${\sigma _t} \downarrow ,$ ${L_a} \downarrow$ and ${\text{P}_{\text{FA}}} \uparrow$ make the PDF ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ get closer to a normal one. This can be explained as follows. We first consider the impact of ${\sigma _{{{\hat {x}}_0}}},$ ${\sigma _{t}}$ and ${L_a}$ which drive the correlation between ${\hat {x}_{a}}$ and $t$ as

$$\left| {{\rho _{{{\hat {x}}_a},t}}} \right|={\left( {1+\frac{{\sigma _{{{{\hat {x}}_0}}}^{2}}}{{L_{{a}}^{2} \sigma _{{t}}^{2}}}} \right)^{ - \tfrac{1}{2}}}$$

(40)

If this correlation becomes zero, then the PDF ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ becomes identical to the unconditional normal PDF ${f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_0}} \right).$ As (40) suggests, this would be realized if ${L_a} \to 0$ and ${\sigma _t} \to 0$ as well as ${\sigma _{{{\hat {x}}_0}}} \to \infty .$ Now, we consider the impact of ${\text{P}_{\text{FA}}},$ which can be explained through (36). Since ${\text{P}_{\text{CA}}}=1 - {\text{P}_{\text{FA}}},$ increasing ${\text{P}_{\text{FA}}}$ (thus decreasing ${\text{P}_{\text{CA}}}$) leads to smaller differences between ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ and ${f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_0}} \right).$ This can also be seen by comparing the dashed blue curves with the solid black ones in the first row of Fig. 1.

Shown to the right of Fig. 2 are the graphs of ${f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD})$ together with those of ${f_{{{\hat {x}}_{\text{cd}}}}}(\theta ).$ The response of ${f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD})$ to the changes in the parameters ${\sigma _{{{\hat {x}}_0}}},$ ${\sigma _{t}}$ and ${L_{a}}$ is similar to that of ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA}).$ ${f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD})$ in addition depends on ${\text{P}_{\text{CD}}}$ according to (37). Since ${\text{P}_{\text{CD}}}=1 - {\text{P}_{\text{MD}}}$, increasing ${\text{P}_{\text{CD}}}$ (thus decreasing ${\text{P}_{\text{MD}}}$) leads to smaller differences between ${f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD})$ and ${f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_a}} \right).$ This can also be seen by comparing the dashed blue curves with the solid black ones in the second and third rows of Fig. 1.

Rigorous vs approximate integrity risk

The rigorous and approximate integrity risks for the case of working with a single alternative hypothesis ${\mathcal{H}_a}$ are formulated in, respectively, the first and the second rows of Table 1. The difference between them reads

$$\overline {{\text{IR}}} - \text{IR}^{o}= \text{P}({\mathcal{H}_0}) \times \left( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} \right)+\text{P}({\mathcal{H}_a}) \times \left( {\overline {{\text{IR}}} |{\mathcal{H}_a} - \text{IR}^{o}|{\mathcal{H}_a}} \right)$$

(41)

where

$$\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}={P_{\text{FA}}} \int\limits_{{\mathcal{B}_{x}^{c}}} {\left[ {{f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA}) - {f_{{{\hat {x}}_a}}}(\theta |{\mathcal{H}_0})} \right]d\theta }$$

(42)

and

$$\overline {{\text{IR}}} |{\mathcal{H}_a} - \text{IR}^{o}|{\mathcal{H}_a}={\text{P}_{\text{CD}}} \int\limits_{{\mathcal{B}_{x}^{c}}} {\left[ {{f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD}) - {f_{{{\hat {x}}_a}}}(\theta |{\mathcal{H}_a})} \right] \text{d}\theta } $$

(43)

Table 1 Integrity risk based on the DIA estimator ($\overline {{\text{IR}}}$) and its approximation by ignoring the correlation between ${\hat {x}_a}$ and $t$ ($\text{IR}^{o}$) for the case of a null- and a single alternative hypotheses. $\mathcal{B}_{x}^{c}={{\mathbb{R}}^n}/{\mathcal{B}_x}$

The difference between $\overline {{\text{IR}}}$ and $\text{IR}^{o}$ lies in the difference between ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ and ${f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_0}} \right)$ and the difference between ${f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD})$ and ${f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_a}} \right).$ These differences, as discussed previously, depend on ${\rho _{{{\hat {x}}_a},t}},$ ${\text{P}_{\text{FA}}}$ and, in case of the latter, on ${\text{P}_{\text{CD}}}.$ In case ${\rho _{{{\hat {x}}_a},t}}=0,$ then ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})={f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_0}} \right)$ and ${f_{{{\hat {x}}_a}|\text{CD}}}(\theta |\text{CD})={f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_a}} \right),$ thereby $\overline {{\text{IR}}} =\text{IR}^{o}.$ As nominal conditions are more likely than anomalies incurring measurement biases, the probability of the occurrence of ${\mathcal{H}_0}$ is far larger than that of ${\mathcal{H}_a}$, see e.g. Wu et al. (2013). Thus, the impact of $( {\overline {{\text{IR}}} |{\mathcal{H}_a} - \text{IR}^{o}|{\mathcal{H}_a}})$ is downweighted by the small value of $\text{P}\left( {{\mathcal{H}_a}} \right).$ Therefore, in the following, we first discuss the behavior of $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ and then the behavior of $( {\overline {{\text{IR}}} - \text{IR}^{o}}).$

Evaluation of $\left( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} \right)$

It can be shown that the difference $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ in (42) is always positive. For a proof, see the Appendix. Assuming $\sigma _{{{{\hat {x}}_0}}}^{2}=0.5{\text{m}^2}$ and $\sigma _{t}^{2}=2\,{\text{m}^2},$ Fig. 3 illustrates graphs of $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}})$ (solid lines) and those of $( {\overline {{\text{IR}}} |{\mathcal{H}_0}})$ (dashed lines) as a function of AL, for ${\text{P}_{\text{FA}}}={10^{ - 1}}$ (top) and ${\text{P}_{\text{FA}}}={10^{ - 3}}$ (bottom), and ${L_a}=0.5, 1.5$ (in blue and red, resp.). Comparing the solid lines with their corresponding dashed lines, we note, depending on the values of ${L_a}$ and ${\text{P}_{\text{FA}}}$, that after a certain alert limit, the values of $( {\overline {{\text{IR}}} |{\mathcal{H}_0}} )$ and $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ approach each other, implying that the approximate integrity risk $\left( {\text{IR}^{o}|{\mathcal{H}_0}} \right)$ gets very small indeed. We explain this behavior for the blue curves at the bottom when AL = 4 m. The probability mass of the PDFs ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ and ${f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_0}} \right),$ the dashed blue curve and the black curve in the upper left panel in Fig. 1, are at the level of $2 \times {10^{ - 2}}$ and $6 \times {10^{ - 5}},$ respectively, outside ${\mathcal{B}_x}=[x - 4 , x+4].$ In addition, the probability mass of the PDF ${f_{{{\hat {x}}_0}}}\left( {\theta |{\mathcal{H}_0}} \right)$ outside ${\mathcal{B}_x}=[x - 4 , x+4]$ is at the level of ${10^{ - 8}}.$ These values, given ${P_{\text{FA}}}={10^{ - 3}},$ will then result in a difference at the level of $8 \times {10^{ - 8}}$ between $( {\overline {{\text{IR}}} |{\mathcal{H}_0}} )$ and $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} ).$ As a consequence of this case, the approximate integrity risk under the null hypothesis is too optimistic by a factor of 300.

Fig. 3

Illustration of the behavior of integrity risks corresponding with ${\mathcal{B}_x}=[x - \text{AL}, x+\text{AL}]$ as a function of AL, assuming $\sigma _{{{{\hat {x}}_0}}}^{2}=0.5\,{\text{m}^2}$ and $\sigma _{t}^{2}=2\,{\text{m}^2}$, for the case of a null- and a single alternative hypotheses. The solid lines show $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ , cf. (42), while the dashed lines show the corresponding $( {\overline {{\text{IR}}} |{\mathcal{H}_0}} )$

It can be seen that the graphs of $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ take only positive values. We note that all curves as a function of AL show almost the same signature. They first increase and then decrease to zero. Since this behavior depends on AL, it can be explained by looking at the integral part in (42), which is the difference between $\text{P}\left( {|{{\hat {x}}_a} - x|>\text{AL}|\text{FA}} \right)$ and $\text{P}\left( {|{{\hat {x}}_a} - x|>\text{AL}|{\mathcal{H}_0}} \right).$ We have

$$\begin{aligned} \text{AL} \to 0 & \Rightarrow \left\{ \begin{gathered} \text{P}(|{{\hat {x}}_a} - x|>\text{AL}|\text{FA}) \to 1 \hfill \\ \text{P}(|{{\hat {x}}_a} - x|>\text{AL}|{\mathcal{H}_0}) \to 1 \hfill \\ \end{gathered} \right. \\ \text{AL} \to \infty & \Rightarrow \left\{ \begin{gathered} \text{P}(|{{\hat {x}}_a} - x|>\text{AL}|\text{FA}) \to 0 \hfill \\ \text{P}(|{{\hat {x}}_a} - x|>\text{AL}|{\mathcal{H}_0}) \to 0 \hfill \\ \end{gathered} \right. \\ \end{aligned}$$

(44)

As shown in the Appendix, ${\text{P}}(|\hat{x}_{a}-x|\le {\text{AL}}|\mathcal{H}_{0})$ is always greater than ${\text{P}}(|\hat{x}_{a}-x|\le {\text{AL}}|{\text{FA}}).$ Therefore, it can be concluded that the PDF ${f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_0}} \right)$ is more peaked around $x$ than ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA}).$ Therefore, when AL increases, $\text{P}\left( {|{{\hat {x}}_a} - x|>\text{AL}|{\mathcal{H}_0}} \right)$ decreases more rapidly than $\text{P}\left( {|{{\hat {x}}_a} - x|>\text{AL}|\text{FA}} \right).$ This, together with (44) and the fact that the probabilities $\text{P}\left( {|{{\hat {x}}_a} - x|>\text{AL}|{\mathcal{H}_0}} \right)$ and $\text{P}\left( {|{{\hat {x}}_a} - x|>\text{AL}|\text{FA}} \right)$ are continuous functions of AL, results in an increasing and then decreasing behavior for $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$.

In Fig. 3, when ${L_a}$ increases, the curve of $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ stretches over a larger range of values of AL. This is due to the fact that increasing ${L_a}$ reduces the peakedness of the PDFs ${f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_0}} \right)$ and ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ around $x$. The impact of changing ${L_a}$ on ${f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_0}} \right)$ and ${f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA})$ is demonstrated in (31) and Fig. 2 (top-left), respectively. Therefore, both the probabilities $\text{P}\left( {|{{\hat {x}}_a} - x|>\text{AL}|{\mathcal{H}_0}} \right)$ and $\text{P}\left( {|{{\hat {x}}_a} - x|>\text{AL}|\text{FA}} \right)$ behave more smoothly as function of AL, and so does their difference.

Decreasing $\alpha$ by a factor of ${10^2},$ we note that the values of $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ in Fig. 3 also decrease by almost a factor of ${10^2}.$ Reducing $\alpha$ by a factor of ${10^2}$ will reduce $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ by the same amount if $\text{P}\left( {|{{\hat {x}}_a} - x|>\text{AL}|\text{FA}} \right)$ remains invariant. However, as Fig. 2 (bottom-left) shows, reducing $\alpha$ by a factor of ${10^2}$ increases $\text{P}\left( {|{{\hat {x}}_a} - x|>\text{AL}|\text{FA}} \right),$ which results in $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ decreasing by a factor slightly smaller than ${10^2}.$

Evaluation of $\left( {\overline {{\text{IR}}} - \text{IR}^{o}} \right)$

Here, we investigate the behavior of the integrity risks when both the null- and alternative hypotheses are taken into account. The difference $( {\overline {{\text{IR}}} - \text{IR}^{o}} )$ in (41), due to the contribution of ${\mathcal{H}_a},$ depends on the bias value ${b_a}$. Considering $\sigma _{{{{\hat {x}}_0}}}^{2}=0.5\,{\text{m}^2},$ $\sigma _{t}^{2}=2\,{\text{m}^2}$ and $\text{P}\left( {{\mathcal{H}_0}} \right)=0.9$ (thus $\text{P}\left( {{\mathcal{H}_a}} \right)=0.1;$ the latter probability is usually much smaller in practice), Fig. 4 shows the curves of $( {\overline {{\text{IR}}} - \text{IR}^{o}})$ as a function of ${b_a}$ for two different values of AL in ${\mathcal{B}_x}=[x - \text{AL}, x+\text{AL}],$ ${L_a}$ and ${\text{P}_{\text{FA}}}.$ Decreasing ${L_a},$ although the correlation ${\rho _{{{\hat {x}}_a},t}}$ decreases, the difference $( {\overline {{\text{IR}}} - \text{IR}^{o}} )$ may increase or decrease depending on AL and ${\text{P}_{\text{FA}}}.$ It can be seen that $( {\overline {{\text{IR}}} - \text{IR}^{o}} )$ does not change too much as a function of ${b_a}.$ This is due to the fact that any change in ${b_a}$ will change $( {\overline {{\text{IR}}} |{\mathcal{H}_a} - \text{IR}^{o}|{\mathcal{H}_a}} ),$ of which the impact is downweighted by $\text{P}\left( {{\mathcal{H}_a}} \right)=0.1.$ Note that $\overline {{\text{IR}}}$ is larger than $\text{IR}^{o}$ in most cases, revealing that using the approximate integrity risk instead of the rigorous one generally will be hazardous. The $\text{IR}^{o}$ does not provide a safe bound to the actual $\overline {{\text{IR}}}$.

Fig. 4

Illustration of the difference between rigorous and approximate integrity risks $( {\overline {{\text{IR}}} - \text{IR}^{o}} )$ in (41) as a function of bias value ${b_a}$ corresponding with ${\mathcal{B}_x}=[x - \text{AL}, x+\text{AL}]$. The contributing parameters are set to be $\sigma _{{{{\hat {x}}_0}}}^{2}=0.5\,{\text{m}^2},$ $\sigma _{t}^{2}=2\,{\text{m}^2}$ and $\text{P}\left( {{\mathcal{H}_0}} \right)=0.9.$ The variation of ${\text{P}_{\text{FA}}}$ and ${L_a}$ is highlighted through changing the style and color of the curve, respectively: ${\text{P}_{\text{FA}}}={10^{ - 1}}$ in solid line and ${\text{P}_{\text{FA}}}={10^{ - 3}}$ in dashed line, ${L_a}=0.5$ in blue and ${L_a}=1.5$ in red

Numerical analysis: multiple alternative hypotheses

So far, for simplicity, we have been working with an observational model with one unknown parameter and one redundancy. In this section, we work with a satellite-based single-point positioning (SPP) model based on the observations of $m$ satellites with four unknown parameters ($n=4$) and $r=m - 4$ redundancy. As alternative hypotheses, we consider those given in (2). In that case there are as many alternative hypotheses as there are observations.

We first present the observational model, and then we analyze, by means of three practical examples, the difference between the rigorous and approximate integrity risk for the contributions under the null hypothesis (${\mathcal{H}_0}$).

SPP observational model

Assuming there are $m$ pseudorange observations, the observational model under ${\mathcal{H}_i}$ for $i=0,1, \ldots ,m$ is given as

$${\mathcal{H}_i}:E(y)=[G\quad{e_m}]\left[ \begin{gathered} x \hfill \\ {d}t \hfill \\ \end{gathered} \right]+{c_i}{b_i},\,{Q_{\text{yy}}}=\sigma _{p}^{2} {I_m}$$

(45)

where the $m \times 3$ matrix $G={\left[ { - \,u_{1}^{T}, \ldots , - \,u_{m}^{T}} \right]^T}$ contains the receiver-satellite unit direction vectors ${u_i}$ as its rows, ${e_m}$ is the m-vector of ones, and again ${c_0}{b_0}=0.$ The unknown receiver coordinate components and clock error are, respectively, denoted by the 3-vector $x$ and scalar ${d}t.$ The dispersion of the observables is characterized through the standard deviation ${\sigma _p}$ and the identity matrix ${I_m}$. At this stage, to simplify our analysis, we do not consider a satellite-elevation-dependent variance matrix. In the following, we only concentrate on the ${\mathcal{H}_0}$-driven difference between $\overline {{\text{IR}}}$ and $\text{IR}^{o},$ as the probability of the occurrence of ${\mathcal{H}_0}$ is by far larger than that of the alternative hypotheses.

Evaluation of $\left( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} \right)$

Setting $i=0$ in (25), we have

$$\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}=\sum\limits_{{j=1}}^{m} {\left[ {P({{\hat {x}}_j} \in \mathcal{B}_{x}^{c}|t \in {\mathcal{P}_j},{\mathcal{H}_0}) - P({{\hat {x}}_j} \in \mathcal{B}_{x}^{c}|{\mathcal{H}_0}) } \right] P} \left( {t \in {\mathcal{P}_j}|{\mathcal{H}_0}} \right)$$

(46)

which shows, for a given satellite geometry (design matrix), that the difference $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ depends on ${\text{P}_{\text{FA}}}=\alpha ,$ ${\mathcal{B}_x}$ and ${Q_{yy}}.$ In the following, for a few satellite geometries, we illustrate $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ as function of the contributing factors. Note, we will compute the integrity risk for the horizontal components and the vertical component separately. As such, the integrity risk for the vertical component is computed for

$${\mathcal{B}_{{x_V}}}=\left\{ {{\theta _V} \in {\mathbb{R}}\left| { |{\theta _V} - {x_V}| \leq \text{AL}} \right.} \right\}$$

(47)

and for the horizontal components for

$${\mathcal{B}_{{x_H}}}=\left\{ {{\theta _H} \in {{\mathbb{R}}^2}\left| { ||{\theta _H} - {x_H}|{|_{ {I_2}}} \leq \text{AL}} \right.} \right\}$$

(48)

$${\tilde {\mathcal{B}}_{{x_H}}}=\left\{ {{\theta _H} \in {{\mathbb{R}}^2}\left| { ||{\theta _H} - {x_H}|{|_{ {C_{{{\hat {x}}_{{H_0}}}{{\hat {x}}_{{H_0}}}}}}} \leq \text{AL}} \right.} \right\}$$

(49)

where ${x_H} \in {{\mathbb{R}}^2}$ and ${x_V} \in {\mathbb{R}}$ are, respectively, the horizontal components and the vertical component of $x.$ Region ${\mathcal{B}_{{x_H}}}$ is a circle with radius AL, and ${\tilde {\mathcal{B}}_{{x_H}}}$ is an ellipse driven by cofactor matrix ${C_{{{\hat {x}}_{{H_0}}}{{\hat {x}}_{{H_0}}}}}.$ Without loss of generality, our illustrations will be depicted for $x=0,$ thus ${x_V}=0$ and ${x_H}=0.$

Example 1: Fig. 5

Fig. 5

Skyplot of the satellites (top), the difference $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ for vertical component (second row) and horizontal components (third and fourth rows) in the model given in (45), as a function of alert limit AL, for different values of ${\sigma _p}$ (cf. 45) and ${\text{P}_{\text{FA}}}=\alpha$

The skyplot in Fig. 5 (top) shows a geometry of six satellites. The graphs of the difference $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ as a function of AL are shown for the vertical component [second row] and the horizontal components (third and fourth rows) for different values of ${\sigma _p}$ (cf. 45) and ${\text{P}_{\text{FA}}}=\alpha .$ The third row corresponds with ${\mathcal{B}_{{x_H}}}$, cf. (48), while the fourth row corresponds with ${\tilde {\mathcal{B}}_{{x_H}}}$, cf. (49). It is important to note that $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ has always ‘positive’ values for all components, meaning that employing the approximate integrity risk instead of the rigorous one could be dangerous, depending on the application at hand. To get a better appreciation of such danger, the values of $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ together with $( {\overline {{\text{IR}}} |{\mathcal{H}_0}} )$ are tabulated in Table 2 for some values of AL. For example, for the vertical component with the settings of ${\text{P}_{\text{FA}}}={10^{ - 1}},$ ${\sigma _p}=1\text{m}$ and AL = 15 m, we have $( {\overline {{\text{IR}}} |{\mathcal{H}_0}} )=0.0168$ and $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )=0.0148,$ implying that the approximate integrity risk $( {\overline {{\text{IR}}} |{\mathcal{H}_0}} )$ is too optimistic by a factor of 8.

Table 2 Values of the rigorous integrity risk $(\overline {{\text{IR}}} |{\mathcal{H}_0})$ and its difference with its approximation $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} ),$ taken from the graphs in Fig. 5

We also note that all graphs as a function of AL show almost the same signature. They first increase and then decrease to zero at different slopes. Since this behavior depends on the AL values, it can be explained by looking at $\text{P}( {{{\hat {x}}_{{*_j}}} \in \mathcal{B}_{{{x_*}}}^{c}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} ) - \text{P}( {{{\hat {x}}_{{*_j}}} \in \mathcal{B}_{{{x_*}}}^{c}|{\mathcal{H}_0}})$ as a function of AL with $* =\{ H,V\} .$ We have

$$\begin{aligned} \text{AL} \to 0 & \Rightarrow \left\{ \begin{gathered} \text{P}({{\hat {x}}_{{*_j}}} \in \mathcal{B}_{{{x_*}}}^{c}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}) \to 1 \hfill \\ \text{P}({{\hat {x}}_{{*_j}}} \in \mathcal{B}_{{{x_*}}}^{c}|{\mathcal{H}_0}) \to 1 \hfill \\ \end{gathered} \right. \\ \text{AL} \to \infty & \Rightarrow \left\{ \begin{gathered} \text{P}({{\hat {x}}_{{*_j}}} \in \mathcal{B}_{{{x_*}}}^{c}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}) \to 0 \hfill \\ \text{P}({{\hat {x}}_{{*_j}}} \in \mathcal{B}_{{{x_*}}}^{c}|{\mathcal{H}_0}) \to 0 \hfill \end{gathered} \right. \\ \end{aligned}$$

(50)

We now, as an example, take the vertical component integrity risk. Assuming that ${x_V}=0$ and ${\sigma _p}=1\text{m},$ Fig. 6 illustrates the PDFs ${f_{{{\hat {x}}_{{V_j}}}}}\left( {{\theta _V}|{\mathcal{H}_0}} \right)$ (dashed blue curves) and ${f_{{{\hat {x}}_{{V_j}}}|t \in {\mathcal{P}_j}}}\left( {{\theta _V}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} \right)$ for $\alpha ={10^{ - 1}}$ (solid blue curves) and $\alpha ={10^{ - 2}}$ (solid red curves), for all six alternative hypotheses $j=1, \ldots ,6.$ It can be seen that the PDF ${f_{{{\hat {x}}_{{V_j}}}}}\left( {{\theta _V}|{\mathcal{H}_0}} \right)$ (dashed) is more peaked around zero than ${f_{{{\hat {x}}_{{V_j}}}|t \in {\mathcal{P}_j}}}\left( {{\theta _V}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} \right).$ Therefore, when the AL increases, then $\text{P}( {{{\hat {x}}_{{V_j}}} \in \mathcal{B}_{{{x_V}}}^{c}|{\mathcal{H}_0}} )$ decreases more rapidly than $\text{P}( {{{\hat {x}}_{{V_j}}} \in \mathcal{B}_{{{x_V}}}^{c}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} ).$ This, together with (50) and the fact that the probabilities $\text{P}( {{{\hat {x}}_{{V_j}}} \in \mathcal{B}_{{{x_V}}}^{c}|{\mathcal{H}_0}} )$ and $\text{P}( {{{\hat {x}}_{{V_j}}} \in \mathcal{B}_{{{x_V}}}^{c}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} )$ are continuous functions of AL, results in increasing and then decreasing behavior for $\text{P}( {{{\hat {x}}_{{V_j}}} \in \mathcal{B}_{{{x_V}}}^{c}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} ) - \text{P}( {{{\hat {x}}_{{V_j}}} \in \mathcal{B}_{{{x_V}}}^{c}|{\mathcal{H}_0}})$ as function of AL.

Fig. 6

Illustration of the PDFs ${f_{{{\hat {x}}_{{V_j}}}}}\left( {{\theta _V}|{\mathcal{H}_0}} \right)$ (dashed blue curves) and ${f_{{{\hat {x}}_{{V_j}}}|t \in {\mathcal{P}_j}}}\left( {{\theta _V}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} \right)$ for $\alpha ={10^{ - 1}}$ (blue curves) and $\alpha ={10^{ - 2}}$ (red curves), for the model in (45), corresponding to the satellite geometry in Fig. 5 and ${\sigma _p}=1\text{m},$ for all six alternative hypotheses $j=1, \ldots ,6.$ The probability given on top of each panel is computed for $\alpha ={10^{ - 1}}$

In Fig. 5, when ${\sigma _p}$ increases, the graph of $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ stretches over a larger range of AL. This is due to the fact that increasing ${\sigma _p}$ reduces the peakedness of the PDFs ${f_{{{\hat {x}}_{{*_j}}}}}\left( {{\theta _*}|{\mathcal{H}_0}} \right)$ and ${f_{{{\hat {x}}_{{*_j}}}|t \in {\mathcal{P}_j}}}\left( {{\theta _*}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} \right)$ around zero. Therefore, both the probabilities $\text{P}( {{{\hat {x}}_{{*_j}}} \in \mathcal{B}_{{{x_*}}}^{c}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} )$ and $\text{P}( {{{\hat {x}}_{{*_j}}} \in \mathcal{B}_{{{x_*}}}^{c}|{\mathcal{H}_0}} )$ behave more smoothly as function of AL, and so does their difference.

Decreasing $\alpha ={\text{P}_{\text{FA}}}$ by a factor of 10, we note that the graphs of $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ for both the vertical and horizontal components also decrease by almost a factor of 10. In (46), the dependence on the false alarm probability $\alpha$ is introduced by $\text{P}( {t \in {\mathcal{P}_j}|{\mathcal{H}_0}} )$ and $\text{P}( {{{\hat {x}}_j} \in \mathcal{B}_{x}^{c}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} ).$With the definition of ${\mathcal{P}_0}$ in (6) and ${\mathcal{P}_{j \ne 0}}$ in (8), for some scalar $0<s<1,$ we have

$$\alpha \to s \times \alpha \Rightarrow \text{P}(t \in {\mathcal{P}_{j \ne 0}}|{\mathcal{H}_0}) \to s \times \text{P}\left( {t \in {\mathcal{P}_{j \ne 0}}|{\mathcal{H}_0}} \right).$$

(51)

Therefore, if $\alpha$ reduces, for instance, by a factor of 10, then the probability $\text{P}\left( {t \in {\mathcal{P}_{j \ne 0}}|{\mathcal{H}_0}} \right)$ also decreases by a factor of 10. For the vertical component, as Fig. 6 shows, changing $\alpha$ from ${10^{ - 1}}$ to ${10^{ - 2}}$ does not significantly affect the shape of ${f_{{{\hat {x}}_{{V_j}}}|t \in {\mathcal{P}_j}}}\left( {{\theta _V}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} \right)$ for $j=2,3,5,6.$ Therefore, the leading factors driving the difference between $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ for $\alpha ={10^{ - 1}}$ and $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ for $\alpha ={10^{ - 2}}$ are the probabilities $\text{P}\left( {t \in {\mathcal{P}_{j \ne 0}}|{\mathcal{H}_0}} \right)$ which, according to (51), get 10 times smaller when reducing $\alpha$ from ${10^{ - 1}}$ to ${10^{ - 2}}.$ Therefore, the reduction of $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ due to reducing $\alpha$ from ${10^{ - 1}}$ to ${10^{ - 2}}$ is expected to be by almost one order of magnitude.

From Fig. 6, we note that the difference between the two PDFs ${f_{{{\hat {x}}_{{V_j}}}}}\left( {{\theta _V}|{\mathcal{H}_0}} \right)$ and ${f_{{{\hat {x}}_{{V_j}}}|t \in {\mathcal{P}_j}}}\left( {{\theta _V}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} \right)$ can be arranged in an ascending order for $j=6,3,5,2,1,4.$ To understand the impact of conditioning on $t \in {\mathcal{P}_j}$ on ${\hat {x}_j},$ we consider (11), which describes the link between ${\hat {x}_j}$ and $t$ established through ${L_j}$, cf. (12). For the observational model at hand, in which the redundancy is $r=2$ and also $x \in {{\mathbb{R}}^3},$ ${L_j}$ is a $3 \times 2$ matrix which can be decomposed as ${L_j}={[{l_{j,1}}, {l_{j,2}}, {l_{j,3}}]^T}$ with ${l_{j,i}} \in {{\mathbb{R}}^2} (i=1,2,3).$ The conditional PDF ${f_{{{\hat {x}}_{{V_j}}}|t \in {\mathcal{P}_j}}}\left( {{\theta _V}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} \right)$ is then given by

$${f_{{{\hat {x}}_{{V_j}}}|t \in {\mathcal{P}_j}}}({\theta _V}|t \in {\mathcal{P}_j}, {\mathcal{H}_0})=\frac{1}{{\text{P}(t \in {\mathcal{P}_j}| {\mathcal{H}_0})}} \times \int\limits_{{{\mathcal{P}_j}}} {{f_t}(\tau |{\mathcal{H}_0})\, {f_{{{\hat {x}}_{{V_0}}}}}({\theta _V}+l_{{j,3}}^{T} \tau |{\mathcal{H}_0}) \,\text{d}\tau }$$

(52)

in which

$$l_{{j,3}}^{T} \tau = - \frac{{{w_j}(\tau )}}{{||{c_{{t_j}}}|{|_{ {Q_{tt}}}}}} q_{{{{\hat {x}}_0}{{\hat {x}}_{{V_0}}}}}^{T}\left( {{u_j} - \bar {u}} \right)$$

(53)

with ${q_{{{\hat {x}}_0}{{\hat {x}}_{{V_0}}}}} \in {{\mathbb{R}}^3}$ the covariance vector between ${\hat {x}_0}$ and ${\hat {x}_{{V_0}}}$, ${w_j}(\tau )$ given by (7), and the average receiver-satellite unit direction vector $\bar {u}=\tfrac{1}{m}\sum\nolimits_{{j=1}}^{m} { {u_j}} .$ The above equations reveal that the impact of ${L_j}$ on the vertical component ${\hat {x}_{{V_j}}}$ is governed by various factors. Table 3 gives the values of ${{|q_{{{{\hat {x}}_0}{{\hat {x}}_{{V_0}}}}}^{T}({u_j} - \bar {u})|} \mathord{\left/ {\vphantom {{|q_{{{{\hat {x}}_0}{{\hat {x}}_{{V_0}}}}}^{T}({u_j} - \bar {u})|} {||{c_{{t_j}}}|{|_{ {Q_{tt}}}}}}} \right. \kern-0pt} {||{c_{{t_j}}}|{|_{ {Q_{tt}}}}}}$ in (53) for ${\sigma _p}=1\text{m}$ for all hypotheses $j=1, \ldots ,6.$ As the value of $\text{P}\left( {t \in {\mathcal{P}_j}|{\mathcal{H}_0}} \right)$ does not change too much for different $j$ (see Fig. 6), it can be stated that the shapes of the regions ${\mathcal{P}_j}$ are similar to each other. Therefore, the leading factor driving the difference in the shape of ${f_{{{\hat {x}}_{{V_j}}}|t \in {\mathcal{P}_j}}}\left( {{\theta _V}|t \in {\mathcal{P}_j}, {\mathcal{H}_0}} \right)$ is ${{|q_{{{{\hat {x}}_0}{{\hat {x}}_{{V_0}}}}}^{T}\left( {{u_j} - \bar {u}} \right)|} \mathord{\left/ {\vphantom {{|q_{{{{\hat {x}}_0}{{\hat {x}}_{{V_0}}}}}^{T}\left( {{u_j} - \bar {u}} \right)|} {||{c_{{t_j}}}|{|_{ {Q_{tt}}}}}}} \right. \kern-0pt} {||{c_{{t_j}}}|{|_{ {Q_{tt}}}}}}$ which is by far greatest for $j=4.$ This explains the discrepancy between ${f_{{{\hat {x}}_{{V_4}}}|t \in {\mathcal{P}_4}}}\left( {{\theta _V}|t \in {\mathcal{P}_4}, {\mathcal{H}_0}} \right)$ and ${f_{{{\hat {x}}_{{V_{j \ne 4}}}}|t \in {\mathcal{P}_{j \ne 4}}}}\left( {{\theta _V}|t \in {\mathcal{P}_{j \ne 4}}, {\mathcal{H}_0}} \right).$ The red and blue curves for $j=4$ in Fig. 6 (middle right) really differ from those in the other panels.

Table 3 Evaluation of (53) for Example 1 (Fig. 5) assuming ${\sigma _p}=1\text{m}$

Example 2: Fig. 7

Fig. 7

Skyplot of the satellites (top), the difference $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ for vertical component (second row) and horizontal components (third and fourth rows) in the model given in (45), as a function of alert limit AL, for different values of ${\sigma _p}$ (cf. 45) and ${\text{P}_{\text{FA}}}=\alpha$

Figure 7 presents the same type of information as Fig. 5 but for a different geometry of six satellites. For this example, again we note the ‘positive’ values for $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ in case of both the vertical and horizontal components. The difference in integrity risk (rigorous minus approximate) in general behaves similar to the earlier example.

Example 3: Fig. 8

Fig. 8

Skyplot of the satellites (top), the difference $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ for vertical component (second row) and horizontal components (third row) in the model given in Blanch et al. (2012), Appendix J, as a function of alert limit AL, for different values of ${\text{P}_{\text{FA}}}=\alpha$

In Fig. 8, we present the same type of information as in Figs. 5 and 7, but now for a multi-constellation example given in Blanch et al. (2012), Appendix J. This constellation is made of five GPS (G) and five Galileo (E) satellites. In this case, we have three position parameters and two receiver clock parameters (one for GPS and one for Galileo). The misclosure vector is of the dimension of five. Note that the results in Fig. 8 use an elevation-dependent variance (${C_{\text{int}}}$ in the mentioned paper) for the observations. Also here, like in the previous examples, we note the ‘positive’ values for $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} ).$

Summary and conclusion

The message of this contribution finds its origin in the combination of parameter estimation and statistical testing. These two activities are typically disconnected in practice when it comes to describing the quality of the eventual estimator. That is, the distribution of the estimator under an identified statistical hypothesis is used without regard to the conditioning process that led to the decision to accept this hypothesis as the working model. We analyzed what the contribution of this simplification is to the actual integrity risk.

Considering a null hypothesis and a single alternative, the different distributions were first shown graphically for a simple observational model with a one-dimensional unknown parameter and a one-dimensional misclosure for statistical testing. It was demonstrated that, with normally distributed observables and linear models, the distributions of the estimators conditioned on false alarm and correct detection turn out to be no longer normal. To compute the integrity risk rigorously, one needs to condition on both the hypothesis and the testing outcome. An approximate risk is obtained, however, when one omits the connection between testing and estimation and thus only conditions on the hypothesis and not on the testing outcome.

For the simple observational model, it was mathematically proven that the rigorous integrity risk exceeds the approximate one. This comparison of the rigorous and approximate integrity risk was then continued by means of a number of satellite-based single-point positioning examples, focusing again on the contributions under the null hypothesis. Although a mathematical proof for the multi-dimensional case does not yet exist, these examples support the previously obtained conclusion that the approximate integrity risk has a tendency of being smaller than its rigorous counterpart. Thus, by including the uncertainty of the decision process driven by statistical testing and using conditional distributions instead of unconditional ones, the actual integrity risk may end up being larger than the computed approximate one. In other words, the approximate approach may provide a too optimistic description of the integrity risk and thereby not sufficiently safeguard against possibly hazardous situations.

We, therefore, clearly advocate the use of the rigorous approach to evaluate the integrity risk, as underestimating the risk, or knowingly allowing this possibility to exist, cannot be acceptable particularly in critical and safety-of-life applications.

Appendix

To prove that the difference $( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} )$ in (42) is always positive, consider the following expression:

$$I= \int\limits_{{{\mathcal{B}_x}}} {\left[ {{f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA}) - {f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_0}} \right)} \right]\text{d}\theta } $$

(54)

which, given $\text{P}(t \notin {\mathcal{P}_0}|{\mathcal{H}_0})=\alpha$ and

$$\begin{aligned} {f_{{{\hat {x}}_a}|\text{FA}}}(\theta |\text{FA}) & =\frac{1}{\alpha } \int\limits_{{\mathcal{P}_{0}^{c}}} {{f_{{{\hat {x}}_a},t}}\left( {\theta , \tau |{\mathcal{H}_0}} \right)\text{d}\tau } \\ {f_{{{\hat {x}}_a}}}\left( {\theta |{\mathcal{H}_0}} \right) & =\int\limits_{\mathbb{R}} {{f_{{{\hat {x}}_a},t}}\left( {\theta , \tau |{\mathcal{H}_0}} \right)\text{d}\tau } \\ \end{aligned}$$

(55)

can be worked out as

$$I={I_1} - {I_2}$$

(56)

with

$$\begin{aligned} {I_1} & = \int\limits_{{\mathcal{P}_{0}^{c}}} {\left( {\frac{1}{\alpha } - 1} \right) {f_t} \left( {\tau |{\mathcal{H}_0}} \right)\int\limits_{{{\mathcal{B}_x}}} {{f_{{{\hat {x}}_0}}}\left( {\theta +{L_a}\tau |{\mathcal{H}_0}} \right)\text{d}\theta } \text{d}\tau } \\ {I_2} & = \int\limits_{{{\mathcal{P}_0}}} {{f_t}\left( {\tau |{\mathcal{H}_0}} \right) \int\limits_{{{\mathcal{B}_x}}} {{f_{{{\hat {x}}_0}}}\left( {\theta +{L_a}\tau |{\mathcal{H}_0}} \right)\text{d}\theta } \text{d}\tau } \\ \end{aligned}$$

(57)

As ${\hat {x}_0}\mathop \sim \limits^{{{\mathcal{H}_0}}} \mathcal{N}( {x,\sigma _{{{{\hat {x}}_0}}}^{2}} )$ and also ${\mathcal{B}_x}=[x - \text{AL}, x+\text{AL}]$ is a convex $x$-centered region, for some Alert Limit AL > 0, we have

$$|{\tau _1}| \geq |{\tau _2}| \Rightarrow \int\limits_{{{\mathcal{B}_x}}} {{f_{{{\hat {x}}_0}}}\left( {\theta +{L_a}{\tau _1}|{\mathcal{H}_0}} \right)\text{d}\theta } \leq \int\limits_{{{\mathcal{B}_x}}} {{f_{{{\hat {x}}_0}}}\left( {\theta +{L_a}{\tau _2}|{\mathcal{H}_0}} \right)\text{d}\theta }$$

(58)

which, given the definition of ${\mathcal{P}_0}$ in (32), results in

$$\begin{aligned} {I_1} & \leqslant \int\limits_{{\mathcal{P}_{0}^{c}}} {\left( {\frac{1}{\alpha } - 1} \right) {f_t}\left( {\tau |{\mathcal{H}_0}} \right)\text{d}\tau } \int\limits_{{{\mathcal{B}_x}}} {{f_{{{\hat {x}}_0}}}\left( {\theta +{L_a}\sqrt {{k_{\alpha ,1}}} \Big\vert{\mathcal{H}_0}} \right)\text{d}\theta } \\ & = \int\limits_{{{\mathcal{P}_0}}} { {f_t}\left( {\tau |{\mathcal{H}_0}} \right)\text{d}\tau } \int\limits_{{{\mathcal{B}_x}}} {{f_{{{\hat {x}}_0}}}\left( {\theta +{L_a}\sqrt {{k_{\alpha ,1}}} \Big\vert{\mathcal{H}_0}} \right)\text{d}\theta } \\ & <\int\limits_{{{\mathcal{P}_0}}} { {f_t}\left( {\tau |{\mathcal{H}_0}} \right) } \int\limits_{{{\mathcal{B}_x}}} {{f_{{{\hat {x}}_0}}}\left( {\theta +{L_a}\tau \Big\vert{\mathcal{H}_0}} \right) \text{d}\theta } \text{d}\tau \\ & = {I_2} \\ \end{aligned}$$

(59)

in which the second equality follows from $\text{P}\left( {t \in {\mathcal{P}_0}|{\mathcal{H}_0}} \right)=\left( {\frac{1}{\alpha } - 1} \right) \times \text{P}\left( {t \in \mathcal{P}_{0}^{c}|{\mathcal{H}_0}} \right),$ and the third inequality follows from (48) given that $|\tau |<\sqrt {{k_{\alpha ,1}}}$ for any $\tau \in {\mathcal{P}_0}.$ From (59), we have $I<0,$ and with $\mathcal{B}_{x}^{c}={{\mathbb{R}}^n}/{\mathcal{B}_x}$ we get for (42)

$$\left( {\overline {{\text{IR}}} |{\mathcal{H}_0} - \text{IR}^{o}|{\mathcal{H}_0}} \right)>0$$

(60)