Toward High-Integrity Roadway Applications of Georeferenced Lidar Positioning: A Review

3.1 Engineered-Target Architecture

The engineered-target localization methodology is based on the deployment of geolocated, uniquely identifiable targets throughout the operational environment. The user has access to a database (or almanac) corresponding to accurate geographic locations of each target. Such information can be stored in memory local to the lidar and updated as needed over a communication channel. In the algorithm presented here, we treat targets as distinct points (Csanyi & Toth, 2007) rather than as detailed feature-rich objects that enable a direct inference of pose (Huang et al., 2022). As a result, at least two targets in common view are needed to determine the two-dimensional lidar position and yaw, and a minimum of three target positions is needed to determine the full six-degree-of-freedom pose in the navigation frame.

Integral to this process is the use of an encoding scheme that allows for identification of individual targets, such that the targets can be mapped to a specific geolocation. Targets might convey their unique identifiers via a variety of modalities, for example, by embedding the code into the lidar image itself, conveying the code via a secondary sensor such as a camera, or transmitting the identifier over radio frequencies.

Embedding the identifier into the lidar signal is advantageous in that the vehicle system would require no additional sensing or communication components. Data bits would be patterned by placing infrared reflecting panels on the target to indicate a high bit and absorbing panels to indicate a low bit (Huang et al., 2021). More than two reflectivity levels can be used to increase the density of the data message. An example, an engineered target using twelve panels, each with three values, was built and evaluated by Wassaf et al. (2021). As shown in Figure 3, this prototype provided the equivalent of a 19-bit message (3¹² ≈ 2¹⁹). A schematic of the data message is shown on the left side of the figure, with each of the twelve data panels labeled according to their reflectance level: R1 (high), R2 (medium), and R3 (low). A point cloud is shown on the right side of the figure, where the cloud was experimentally generated by placing the lidar 6.5 m from the 1.8-m-wide target. Assuming a lidar with an azimuthal resolution of at least 0.2°, the data panels are sized at 30 cm across, to ensure the placement of a minimum of two lidar samples across the width of each panel even when the target is viewed at a range of 30 m and an angle of 45°.

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 3

A target’s unique identifier can be encoded on the target through a pattern of variable reflectance, as shown in the schematic (left) and experimental point cloud data (right). In the point cloud, color represents the intensity of the return, with red indicating high (R1), cyan indicating medium (R2), and dark blue indicating low (R3) intensity.

A disadvantage of a lidar-only target is its large size. This liability might be offset by re-arranging the panels to conform to the shape of existing infrastructure. For instance, the data panels might be aligned vertically, in a single column, to conform better to the shape of a streetlight or telephone pole.

More compact targets are enabled by leveraging mixed-modality imaging, with both a lidar and camera sensor viewing the target at the same time. Our team is currently designing a set of mixed-modality targets with uniform reflectance, to promote reliable lidar extraction, and with color panels, to encode identifier data. The color-based encoding uses patterns, similar to Gold codes, that feature auto-correlation and cross-correlation properties designed to allow accurate localization and unique target classification, respectively. As illustrated in Figure 4, our protype targets use 16 panels, each identified by one of four colors (for a total code length of 32 bits).

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 4

Two targets identified by distinct color patterns

The proposed mixed-modality target of Figure 4 improves on the original lidar-only target of Figure 3, simultaneously increasing the code from 19 bits to 32 bits, doubling the viewing range, and shrinking the target size to 60 cm × 60 cm, which is comparable to a standard road sign. The viewing range is doubled because the entire target is reflective to lidar (such that two azimuthal lidar points are sampled at a distance of 60 m and an angle of 45° for a lidar with an azimuthal resolution of 0.2°). Because each color-blocked panel is 15 cm × 15 cm, at least three camera pixels are sampled across the width (and height) of each panel for a camera with an angular resolution of 0.03°.

For either the lidar-only or mixed-modality case, the target is extracted from the lidar image via a correlation operation. The correlation entails scaling a replica code pattern and comparing the replica to the acquired image to find a match. After target detection and identification, the target’s bearing is inferred from the correlation peak and augmented with the measured range to create a relative position vector between the lidar and target. In this paper, we use the notation $y_k^L$ to refer to the centroid vector for each confirmed target k. The trailing superscript indicates the measurement frame, which is the lidar frame L in this case. To solve for lidar pose, i.e., the position and attitude, the first step is to construct a full observation vector y, which concatenates the centroid locations for a total of K visible targets:

$y=\left[\begin{array}{c}{y}_1^L\\ ⋮\\ y_K^L\end{array}\right]$ 1

A simulated example of a vehicle equipped with six cameras and a lidar is shown in Figure 5. The illustration depicts an open area (nominally a parking lot) of roughly 40 m × 40 m. The vehicle has three targets in view (K = 3), including one flat target and two corner targets. The corner targets are deployed to allow viewing from a wider range of directions.

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 5

Simulation of a vehicle (blue rectangle) traveling along a path (red line) The six blue arrows on the vehicle indicate camera look angles. A spinning lidar collects scans in the round, with the start of each scan aligned with the lidar x-axis (green arrow). Three targets are shown, each with a centroid marked by a magenta asterisk and with surface normals marked by cyan arrows.

A state vector ξ describes the pose of the lidar frame relative to the world (or navigation) frame N. The state vector consists of a set of Euler angles ψ_LN = [ϕ θ ψ]^T and a translation vector $x_{NL}^N$. The translation vector, which runs to the lidar reference point from the navigation reference point (as indicated by the NL subscript), is written in lidar-frame coordinates (indicated by the L superscript):

$\xi =\left[\begin{array}{c}{\begin{array}{c}\psi \end{array}}_{LN}\\ {\begin{array}{c}x\end{array}}_{NL}^L\end{array}\right]$ 2

Using the target’s unique identifier, each measured target location $y_k^L$ is associated with the corresponding georeferenced target location ${\overline{y}}_k^N$ drawn from the map database. (The overbar indicates surveyed truth as recorded on the map.) The measured and surveyed target locations are related by the following equation, where the rotation matrix $R_N^L$ converts from the navigation basis to the lidar basis and the vector ${\epsilon }_k^L$ describes the measurement error:

$y_k^L=R_N^L\left({\psi }_{LN}\right)\cdot {\overline{y}}_k^N-x_{NL}^L+{\epsilon }_k^L$ 3

A unique solution can be obtained by simultaneously solving the measurement equations (Equation (3)) for a set of three or more targets k. This set of nonlinear measurement equations for all K targets can be written as follows:

$y=h\left(\xi \right)+\epsilon$ 4

Here, the concatenated observation vector y is described by Equation (1), and the state vector ξ is described by Equation (2). The nonlinear function h is the concatenation of the measurement equation (Equation (3)) for each target k, where each set of three rows in h describes a different target. The concatenated measurement error is $\epsilon ={[{\left({\epsilon }_1^L\right)}^T\dots {\left({\epsilon }_K^L\right)}^T]}^T$, a column vector compiling the individual error vectors ${\epsilon }_k^L$ for each target k. Given a reasonable starting guess, Equation (4), which is nonlinear, can be solved by linearizing and applying an iterative nonlinear least-squares approach such as the Newton–Raphson, Gauss–Newton, or Levenberg–Marquardt (also known as the damped least squares) approach. These solutions employ a Taylor series expansion, with higher-order terms assumed to be small. The following equation results from the Taylor series expansion of Equation (4):

$\delta y=H \delta \xi +\epsilon$ 5

Here, the measurement perturbation, δy = y − h(ξ₀), is the difference between the measurement and the model h(ξ), evaluated at a reference pose ξ₀. The state perturbation, δξ = ξ − ξ₀, is linearly related to the measurement perturbation. The Jacobian H ∈ ℝ^3K×6 is constructed by concantenating a set of 3 × 6 blocks, one for each target k. Each block is the derivative of h(ξ) in Equation (3) with respect to each of the six states in ξ. A weighted least-squares solution is obtained as follows, where the weighting matrix W is the inverse of the measurement covariance matrix R, such that W = R⁻¹:

$\delta \xi ={\left(H^{T}WH\right)}^{-1}{H}^{T}W\cdot \delta y$ 6

Equation (6) is iteratively resolved to update the reference state: ξ → ξ + δξ. The measurement model is linear in the measurement error ε. Thus, the weighted least-squares process predicts the covariance of the pose error, which is the difference between the estimate ξ and the true pose $\overline{\xi }$. The prediction of the covariance matrix, $P=E\left[(\xi -\overline{\xi }){(\xi -\overline{\xi })}^T\right]$, is as follows:

$P={\left(H^{T}WH\right)}^{-1}$ 7

One factor in establishing integrity for these equations is addressing the risk of false extraction of the target. By construction, the probability of a false target extraction should be remote for the engineered-target architecture, given that random background noise is very unlikey to match the target code. Even if the false-extraction risk is negligble, there is always a finite risk of a large measurement error that results in a hazard (e.g., vehicle strays from its lane) even in otherwise nominal operating conditions. Thus, integrity risks must be characterized for both nominal and adverse conditions, possibly including bad weather, broken components, or malicious attacks. These issues will be discussed in more detail in Section 4.

3.2 Landmark-Based Architecture

In the opportunity-feature approach, the lidar identifies existing features in the built environment, such as light or telephone poles. Features in the lidar’s field of view are associated with preregistered landmarks whose locations are stored in a database accessible to the vehicle. Functionally, this approach closely resembles the engineered-target approach visualized in Figure 1, with the exception that features are not uniquely identifiable. Consequently, the opportunity-feature architecture can be implemented by using Equations (1)–(7) from the prior section, with the primary difference being that each measurement vector $y_k^L$ in Equation (1) refers to an opportunity feature and each reference location ${\overline{y}}_k^N$ in Equation (3) refers to a georeferenced landmark, or more specifically to a specified reference point on each landmark.

The lack of unique identifiers on each landmark adds uncertainty to the process of extracting features from an image and to the process of associating extracted features to the correct database entries. Mismatches can occur during both processes (Bar-Shalom & Fortmann, 1988). If undetected, mistaken matches can cause hazardous errors in pose estimation. To better understand these risks, consider Figure 6. The figure shows a sidewalk as a lidar point cloud (left) as well as a corresponding camera photograph (right). In analysis, two regions of the point cloud were extracted as candidate features, including a pedestrian (blue points) and a lamp post (red points). In early testing, the algorithm identified the pedestrian as the “correct match” to a database record for the lamp post, which implies a potential integrity concern.

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 6

An illustration of incorrect extraction

The pedestrian (blue) was mistakenly extracted and matched with the lamp post landmark (red), as documented by Nagai et al. (2023).

In the remainder of this section, we characterize the integrity risk associated with uncertain feature matching. To this end, we define four related terms: correct extraction, incorrect extraction, correct association, and incorrect association. A correct extraction (CE) occurs when an extracted feature corresponds to a landmark in the database; conversely, an incorrect extraction (IE) happens when an extracted feature does not relate to a landmark in the database. A correct association (CA) is defined as a true match of the extracted landmark to the database. An incorrect association (IA) occurs when the extracted feature is erroneously associated with an incorrect landmark in the database. Data association follows feature extraction, and each of these processes can be modeled as a complementary pair of probabilities, as we summarize in Table 1.

Nagai et al. (2023) derived a bound to account for extraction and association risks. The combined integrity risk was called the probability of hazardously misleading information P(HMI). The bound on P(HMI) was derived for a time epoch j using the law of total probability:

$P\left({HMI}_j\right)\le 1-(1-P\left({HMI}_j\right|{CA}_{\Im },{CE}_{\Im }))P\left({CA}_{\Im }\right|{CE}_{\Im })P\left({CE}_{\Im }\right)$ 8

Here, 𝒯 (upper case) denotes all time increments from time epoch 1 to j: 𝒯 = {1, 2, 3, ... j}. The probabilities P(CA_𝒯|CE_𝒯) and P(CE_𝒯) can be calculated via the following equations (Jamoom, 2016; Joerger et al., 2016; Hassani et al., 2023):

$P\left({CA}_{ℐ}\right|{CE}_{ℐ})=\prod _{i=1}^{j}P\left({CA}_i\right|{CA}_{\Im -1},{CE}_{\Im })$ 9

$P\left({CE}_{ℐ}\right)=\prod _{i=1}^{j}P\left({CE}_i\right|{CE}_{\Im -1})$ 10

$P\left({HMI}_j\right|{CA}_{\Im },{CE}_{\Im })=2\Phi (-\frac{AL}{{\sigma }_j})$ 11

Here, the symbol ℑ denotes all time increments from time epoch 1 to i, and Φ represents the cumulative density function for a zero-mean, Gaussian overbounding model for the fault-free position-error distribution (in one dimension); the Gaussian overbound is characterized by its standard deviation σ_j. The maximum allowed error for safe operation is the alert limit AL. A conservative yet practical approximation assumes that any past incorrect extraction or association events result in current HMI. With these assumptions, Equation (8) can account for the combined integrity risks associated with both the fault-free case and the case of faulted data extraction/association.

To meet stringent integrity risk requirements, as described by Reid (2019), it is necessary to minimize the fault-free position integrity risk P(HMI|CA, CE) and maximize the correct association probability P(CA_J|CE_J) and correct extraction probability P(CE_J). When navigating via lidar fused with GNSS, a high-quality INS, wheel speed sensors, and vehicle kinematic constraints, our test system met integrity requirements for a maximum landmark spacing of approximately 14 m (Nagai, Spenko, et al., 2024). The test system focused on extracting pole-like landmarks (e.g., street lamps or traffic lights) because of their location flexibility, relative ubiquity, and defined shapes, as demonstrated by Sefati et al. (2017) and Teo and Chiu (2015). Pole-like landmarks typically exist in urban environments, with separations in the range of 2–14 m, a distance appropriate for achieving both fault-free integrity and a low probability of missed association.

3.3 Scan-Matching Architecture

In the scan-matching architecture, a lidar-processing algorithm aligns, or registers, an entire scan to a reference map. The reference map is often assumed to be a high-definition (HD) map, which is a point cloud constructed as a mosaic of many individual lidar scans (Nagy & Benedek, 2018; Li et al., 2022). Point clouds in the HD map are aligned and georeferenced offline through the use of GNSS or other ground-truth measurements. Because HD maps are storage-intensive, compressed maps are also of interest; for example, neural radiance fields offer the potential to compress the map data and allow novel-view reconstruction by encoding the map in a simple neural network (Deng et al., 2023; Huang et al., 2023; Zhang et al., 2024; McDermott & Rife, 2025). If the map itself is georeferenced, then alignment of the current scan to the map results in absolute positioning.

Importantly, the scan-matching process aligns all lidar points to the map simultaneously. This aspect of the scan-matching architecture differs from target- and landmark-based architectures, where the current scan is first converted to a set of features, which must then be registered to a map database (see Figure 1). By extension, an advantage of scan matching is that feature-extraction faults (as shown in Figure 6) do not occur, because features are not extracted. However, a disadvantage of the scan-matching architecture is the ubiquity of scene changes. Whereas targets and landmarks can be selectively defined to be stationary over time, scan matching must handle all parts of a scene, even regions where objects are in motion or have moved since map creation. Figure 7 illustrates several examples of phenomena that can create discrepancies between a lidar scan and a reference map.

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 7

Although scene changes affect all lidar-positioning architectures, they are ubiquitous in scan-matching. Scene changes can be caused, for example, by (a) wind, (b) pedestrian and vehicle motion as well as construction, (c) repositioning of temporary infrastructure and waste bins, and (d) seasonal growth of foliage and loss of leaves.

To delve deeper into the scan-matching process, we choose to focus on analytical scan-matching methods. Analytical scan-matching methods can be characterized via principles of geometry and physics, and thus, they are fully interpretable. Because of our emphasis on safety analysis, we do not consider scan-matching algorithms that rely on machine learning (ML) models, such as deep neural networks, which ingest the current scan and reference data as inputs and produce a relative pose as an output (Aoki et al., 2019; Zhang et al., 2020; Zhou & Tuzel, 2018). Although efforts are underway to characterize ML-based integrity (Joerger et al., 2022), methods do not yet exist to interpret and analyze faults for general ML-based algorithms (Willers et al., 2020). Our team has implemented practical demonstrations of analytical algorithms that can run in real time, or faster, on a single processor when post-processing real-world lidar data (McDermott & Rife, 2024; Nagai, Spenko, et al., 2024).

Within the space of analytical scan-matching algorithms, our team has focused on implementing a grid-based algorithm that subdivides the full scan into a regular set of volume elements (or voxels) before aligning the textures within each voxel. Voxel-based algorithms are advantageous in that no explicit correspondence is required between points; by contrast, the well-known point-to-point iterative closest point scan-matching algorithm establishes an explicit correspondence between points within two clouds (Besl & McKay, 1992; Segal et al., 2009), a process that may require additional modeling of incorrect association probabilities as described by Equations (8)–(11). The particular voxel-based scan algorithm we have implemented is called the iterative closest ellipsoid transform (ICET) (McDermott & Rife, 2022a; McDermott & Rife, 2024), which is a variant of the well-known normal distributions transform (NDT) (Biber & Straßer, 2003; Stoyanov et al., 2012). Compared with the NDT, the ICET adds processes to better predict output-error covariance and exclude misleading measurements. The pose-correction accuracy is relatively independent of voxel size, so long as the length scale of the grid is significantly larger than the mean distance between lidar points, as discussed in the sensitivity-study appendix of McDermott and Rife (2024).

The mathematical model for this process is described, once again, by Equations (1)–(7). For scan matching, a grid of local textures (the textures within each voxel) replaces recognizable features. Within voxel k, the displacement δy_k is the vector shift that must be applied to the local scan texture to best align it with the map texture. In other words, if a reference point for the texture were defined at $y_k^L$ in the current scan, it would best match to the point ${\overline{y}}_k^N$ in the map, and thus, the displacement would be written as follows:

$\delta y_k=y_k^L-h(\xi ;{\overline{y}}_k^N)$ 12

where the nonlinear function h converts the map point into the lidar frame through the rigid transform in Equation (3): $h(\xi ;{\overline{y}}_k^N)=R_N^L\left({\psi }_{LN}\right){\overline{y}}_k^N-x_{NL}^L+{\epsilon }_k^L$. Algorithmically, it is not necessary to designate specific reference points for the textures within each voxel k; local textures are assumed only to translate (and not rotate); thus, the displacement describes the entire texture (and not just one point on the texture).

The displacements δy_k are concatenated over all voxels to define an observation vector δy, which appears in the concatenated measurement equation (Equation (5)). A pose estimate can be obtained iteratively from Equation (6), and covariance can be predicted by Equation (7).

The use of voxels to define texture in a local neighborhood is illustrated in Figure 8. Two complete lidar scans are overlaid: a current scan and a reference scan. The alignment of the scans is imperfect; hence, objects such as trees appear twice (once in red, once in blue), subject to a slight offset. Voxel-based algorithms overlay a regular pattern of voxels across the lidar scan. A representative subset of three adjacent voxels is shown in the figure. The three adjacent voxels are defined in spherical coordinates, over a distinct range of azimuth and elevation angles, with adaptive range limits (McDermott & Rife, 2022b). The portions of the lidar point cloud within the three adjacent voxels include parts of two trees and the gap between the trees. However, the lidar algorithm is unaware that the objects are trees. The algorithm simply recognizes that the local pattern of red dots needs to be shifted by a vector displacement to better align with the local pattern of blue dots within the same voxel. Similar vector displacements δy_k are computed for all voxels k across the scan (the majority of which are not shown). A common method of computing the local offset within a voxel, used in the NDT and ICET, is to difference the centroids of the two local texture patterns within that voxel. If lidar points are scarce within a voxel, as in case of the middle of the three adjacent voxels shown in Figure 8, a valid displacement cannot be computed, and thus, the voxel is excluded from the pose-estimation process.

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 8

Voxel-based alignment of local textures

A current and reference scan, in red and blue, respectively, are approximately aligned. Three representative voxels are shown superimposed on the scans. Local offsets between the two texture patterns are evaluated within each voxel. A global pose correction is inferred from the vector field of local offsets computed over all voxels.

Similar to the opportunity-feature architecture, the scan-matching architecture relies on a reasonable initial estimate ξ₀ of the lidar pose to align lidar imagery to reference data. In our current implementations of voxel-based algorithms, we start with a Global Positioning System (GPS) position to obtain a first fix on the lidar map and then use a lidar-estimated position afterward, updating the guess for the next epoch using a lidar-derived velocity estimate. For a future deployed system, we envision that the initial pose might be provided by an integrated positioning system featuring GNSS, INS, and wheel odometry (Nagai, Spenko, et al., 2024; Liu et al., 2023). Alternatively, the acquisition problem could be solved by applying lidar along with a large-scale map-matching method (Desrochers et al., 2015; Xu et al., 2022).

Our implementation of ICET incorporates several pre- and post-processing steps to mitigate adversities. A key post-processing step is a conventional monitor that checks the converged pose solution by flagging any voxel with a large residual discrepancy (above 10 cm); this test detects many moving objects and scene changes. A key pre-processing step is detection and removal of measurements parallel to extended surfaces, such as along a flat wall or in the ground plane; these measurement directions appear to have finite variance, capped by voxel width, but provide no meaningful localization information (McDermott & Rife, 2024). We also perform a motion-distortion correction that unwarps the effects of vehicle translation and rotation during the time required to form a full scan, typically about 0.1 s (McDermott & Rife, 2023). To conduct a complete integrity analysis, further work is needed to assess the effectiveness of these mitigations and the magnitude of errors that persist after mitigation.

4.1 Complementarity

The lidar architectures presented in this paper are complementary in the sense that a single vehicle might deploy more than one architecture in parallel. The architectures have different strengths, and their measurement errors and adversities are largely independent. In this section, we explore how the architectures can be leveraged in a complementary manner to better satisfy guidance-quality requirements.

Guidance-quality requirements characterize a navigation sensor’s error distribution in terms of its “width.” More specifically, guidance-quality requirements define limits on (i) the standard deviation of the nominal error distribution and (ii) the probability of the largest error that can be tolerated without a severe consequence, such as a vehicle crash. These two basic requirements correspond to the concepts of accuracy and integrity. Additional requirements (continuity, availability, resiliency) specify how often the navigation sensor needs to operate with its full capability. By briefly defining accuracy, integrity, continuity, availability, and resiliency concepts, we can contextualize how lidar architectures complement each other.

Accuracy: Accuracy is a target for the nominal magnitude of a navigation sensor’s pose-estimation errors. The accuracy requirement is usually defined as a bound that contains 95% of errors, roughly equivalent to twice the standard deviation for a one-dimensional Gaussian distribution.

Integrity: Integrity defines a maximum acceptable instantaneous risk that the sensor error exceeds a predefined upper bound without a timely warning. This bound on large errors is sometimes called an alert limit. Detailed quantifications of integrity risk and alert limits can be found in the navigation literature, such as the work by Liu et al. (1997) and Rife et al. (2023).

Continuity: Continuity refers to maintaining uninterrupted accuracy and integrity, with the exception of during predicted interruptions forecast at the start of a journey. A loss of continuity can result from an unanticipated change in conditions, for instance, when an integrity monitor alerts that features extracted from the current lidar scan are clearly inconsistent with available map data (for instance, because of construction).

Availability: Availability is the fraction of time that the navigation sensor is predicted, at the start of a journey, to meet its operational requirements for accuracy, integrity, and continuity.

Resiliency: Resiliency quantifies the delivery of degraded navigation capabilities when exposed to a specific sensor adversity, such as severe weather or malicious spoofing. For example, in a blizzard, a local government might leverage the internet of things to declare that a pair of northbound lanes should function together, effectively forming a single wider lane. This action reduces navigation risk at the expense of roadway capacity. The lidar system would support resilient operations if its measurement quality were sufficient to deliver the target integrity-risk level for operations in the double-wide lane.

Complementary architectures might be considered as a strategy to address whichever guidance-quality requirements are hardest to meet. For instance, if the limiting requirement is integrity, an integrity monitor might be defined to compare the outputs of two architectures and to provide an alert if outputs diverge, with the goal of detecting anomalous conditions that create different errors for different architectures. Alternatively, if the limiting requirement is accuracy, pose estimates generated by different architectures might be fused to enhance accuracy (e.g., in a Kalman filter that leverages any measure of independence of the estimation errors between architectures). Although benefits are possible, complementary architectures are not a panacea. Experience in designing integrity systems for the aviation domain suggests that complementary architectures will enhance one or perhaps two guidance-quality parameters, but not all of them.

Perhaps the most compelling use of complementary architectures is to enhance the availability of long routes. This aim might be accomplished by running multiple algorithms in parallel and weighting each based on a real-time performance prediction. Predicted performance will change in different operational domains. For example, a vehicle might travel from a heavily forested area (favoring scan matching) to a dense urban center (favoring landmarks) before ending its journey in a parking garage (favoring engineered targets). To understand this aspect of complementarity, one can consider the cost-based performance of each architecture across eight different operating environments, as summarized in Table 2. The table assigns a cost-based performance level to three lidar architectures (columns) operating in eight domains (rows). A fourth column characterizes the performance of GNSS, for comparison. The table assigns three levels of cost-based performance, including use cases that are strongly justified (blue), possibly justified (yellow), and challenging to justify (red). Levels were assigned based on author discussions and field tests (Wassaf et al., 2021; Nagai, Spenko, et al., 2024; McDermott & Rife, 2024), and not on cost–benefit analysis.

A strong justification (blue) was assigned in only two cases. In these cases, GNSS signal quality is poor, and lidar costs appear to be offset by a clear use case. The first of these strongly justified cases involves extended underground tunnels, where GNSS is not available. Tunnels tend to have relatively few existing landmarks (which is problematic for the landmark-based architecture); thus, it would likely be necessary to install engineered targets to enable absolute lidar positioning. Although installation costs might be high, the infrastructure would likely serve a large number of users, as tunnels themselves are expensive to construct and generally only built on high-value, highly trafficked routes. Additionally, tunnels are often public infrastructure, simplifying negotiation of sign placement; moreover, tunnel walls and ceilings are often blank, implying that sign placement is not likely to compete with aesthetic or commercial interests. The second strongly justified case involves dense urban settings, where landmarks are plentiful. Particularly in urban canyons, where GNSS quality may be limited, exploiting landmark-based lidar positioning has a strong potential benefit at low cost (as new infrastructure need not be installed).

At the other extreme, eleven entries are labeled as challenging to justify (red) because of the high anticipated cost per user for securing land rights, installing signage, and maintaining that infrastructure. The number of users is considered low for roadway infrastructure in areas of moderate or low population density (e.g., rural, forest, and mountain environments). If the density of useful existing landmarks is low (more than 60-m intervals), then new landmarks would need to be installed, most likely in the form of engineered targets; consequently, landmark-based and engineered-target architectures are essentially equivalent in these operating environments.

Eleven entries are labeled as possibly justified (yellow). In these cases, the value tradeoffs are difficult to assess without a more formal analysis. For example, let us consider the case of a parking garage. In this environment, existing structural elements (e.g., columns) may be sufficient to support landmark-based navigation, or if features are sparse, high-traffic density may justify the installation of engineered targets. Similarly, in dense urban environments, engineered targets might be viable in areas where existing landmarks are sparse or ambiguous, as in the case of a roadway sided by uniformly spaced lamp posts. As population density decreases (e.g., in suburban neighborhoods), engineered targets become less viable, although the landmark-based architecture may remain viable if lamp posts (and other existing, identifiable structures) are sufficiently dense. Wide open spaces (e.g., deserts and plains) are a special case. With low population density, these spaces have few existing landmarks. The cost of deploying a dense network of engineered targets is very high relative to usage; however, a low-density network of engineered targets might still be viable, if lane-keeping can be accomplished via road-relative navigation. In that case, absolute positioning might only be needed sporadically (e.g., near highway exits), a narrow application that would be well supported by the engineered-target infrastructure.

The scan-matching architecture is listed as possibly justified for all operating environments. We interpret scan matching as a general-purpose tool that does not take advantage of structure in the built environment but that works everywhere (i.e., a “jack of all trades but master of none”). Although physical infrastructure is not needed, map-related costs are higher than for other architectures, both because HD maps are data-intensive (more space on disk) and because they may need to be periodically updated to reflect construction or other durable scene changes. Given these tradeoffs, the scan-matching architecture is the only architecture that is potentially justified in most low-density environments. Even if environmental features are extremely sparse, as in tunnels or flat terrain like deserts or plains, we assume that scan matching can provide “lateral-only” coverage (cross-track but not along-track positioning) by using features of the road itself, such as painted markings and the road edge.

4.2 Adversities to Meeting Integrity Requirements

To leverage the benefits of multiple architectures, or even a single architecture, it will be necessary to resolve the significant technical challenges associated with developing a safety case for lidar positioning. The navigation community has significant experience with developing safety cases for navigation sensing in aviation applications, where the operating environment is highly constrained. In these environments, it has been largely possible to decouple analysis into two components: the mitigation of anomalous errors under faulted conditions and the bounding of far-tail errors under nominal conditions (Enge et al., 1996; Enge, 1999). In the less structured environment of ground transportation, these two cases are blurred, resulting in a spectrum of intermediate conditions between nominal and faulted.

To distinguish from the word fault, which implies the occurrence of a rare anomaly, we describe these intermediate conditions using the word adversity, which implies a challenging condition that is not always present but that is not necessarily rare. In this sense, adversities are a broader category than faults because frequency is not implied. In other words, a fault is a rare adversity. For lidar positioning, we go a step farther and define an adversity as any phenomenon diverging from the fundamental assumption that lidar data depict static features that have not changed in size, shape, position, or orientation since the creation of the reference map.

As a reasonable first step toward developing a safety case, this section compiles a list of known adversities for lidar positioning. The compiled list can be found in Table 3. The table characterizes each adversity in terms of a cause (or mode) that may have one or more effect. The entries in the table (checkboxes) link a particular mode (row) to its potential effects (columns).

The table rows classify adversity modes in eight categories: lidar sampling, signal in space, hardware design, platform motion, map data, algorithm, spoofing, and scene changes. The definitions of these eight categories are expanded below.

The table columns identify five categories of effects: measurement errors (local and scanwise), feature-extraction issues, and data-association issues (local and scanwise). Measurement-error effects introduce random or systematic biases that perturb the locations of the points in a lidar cloud away from their true position. Local measurement errors impact small regions of the point cloud, such that errors are generally independent from one feature to another. Scanwise measurement errors impact the entire point cloud, such that errors can be correlated between features. Feature-extraction issues involve the conversion of the lidar scan into a set of recognizable features for comparison to mapped targets or landmarks. Data-association issues arise in matching scanned features to the map. Local data-association issues include problems in which individual features are not correctly represented in the map database. Scanwise data-association issues include problems in which the scan is not matched to the correct segment of the map, such that most, if not all, scan features are incorrectly matched.

In Table 3, the first set of adversity modes is compiled under the category of lidar sampling, which includes random and systematic effects degrading the position measurement associated with each individual lidar return. Although individual lidar returns are often formatted as three-dimensional position vectors, each point might better be visualized in spherical coordinates, where the range is measured based on the time the lidar beam takes to travel from the transmitter back to the receiver and where the pointing direction is inferred from sensor geometry. For a mechanically rotating lidar unit, the elevation angle is a preset offset from the horizontal, and the azimuth angle is inferred as a fractional rotation based on interpolating a time tag between the known start and end times for the current scan. In this context, we expect the error distribution for the return to be anisotropic, with different extents in the radial, elevation, and azimuthal directions. Factors contributing to the anisotropic error distribution include time-of-flight, beam width, variable scanning speed, calibration bias, and time-tagging bias effects.

• Time-of-flight noise: The range measurement is obtained from the two-way time of flight for an infrared pulse traveling from the lidar unit to a surface in the world and back. Noise may be introduced into the ranging measurement from electronic noise in the detector or from clock jitter, for example.

• Beam width: The lidar beam has finite width. A well-documented example is for the Velodyne VLP-16 sensor. When the beam leaves the sensor, it measures only millimeters across in any direction, but it diverges to a height of 8.5 cm and a width of 15 cm at a range of 50 m (Velodyne, 2019). This divergence corresponds to a full-beam angle of just under 0.1° in elevation and just under 0.2° in azimuth. The implication is that the pulse arriving at the detector is the integrated response of returns arriving from across the beam pattern. By extension, the photons that dominate the detected pulse may arrive from azimuth/elevation angles shifted from the beam centerline, and the photons that define the peak of the detected pulse may be blurred if arriving from an oblique or complex surface. In short, range, elevation, and azimuth measurements are not intrinsic properties of the sensor, as they reflect the shape of surfaces visualized across the beam pattern. In some cases, the detector may even measure multiple peaks (see multipath, below).

• Variable scanning speed: For a rotating sensor, full rotations are measured with an encoder, but fractional azimuthal rotation is indirectly inferred from the time tag of each measurement. Assuming a constant rotation rate, the azimuth of the beam centerline can be computed by interpolating the measurement’s time tag between the rotation start and end times. Systematic errors may occur in inferring the centerline azimuth for each return if the motor speed controller does not maintain a constant rotation rate.

• Calibration bias: Nominal boresight angles (e.g., azimuth and elevation) are specified for each beam. Small perturbations associated with fabrication may cause the transmitted beam to deviate slightly from its nominal angle. Moreover, thermal expansion may cause boresight angles to vary with ambient temperature.

• Time-tagging bias: The lidar clock (used to tag each return) experiences a drifting bias relative to the system clock (used to fuse measurements from different sensors). The time offset injects velocity-dependent error into sensor fusion.

Adversity modes affecting the signal in space include random and systematic effects that occur along the path between transmission and reception. Signal-in-space effects generally distort the measurement range, making the measured range longer or shorter than expected. Examples include multipath, absorption, transmission, spectral reflection, crosstalk, shadowing, and refraction.

• Multipath: When the beam pattern falls on a surface discontinuity, such as the corner of a building or the branches of a tree, multiple reflections can occur from near and far surfaces. These cases generate distinct peaks at the detector, any of which might be used to generate a range measurement for a given pointing direction. To help resolve this ambiguity, some lidar systems can be configured to record the first peak, the last peak, the strongest peak, or multiple peaks (Velodyne, 2019; Ouster, 2024).

• Crosstalk: If two lidar units, both operating at the same wavelength, are mounted on vehicles that approach each other, then the transmissions from one unit can be received by the other (Hu, 2024). This adversity might occur for two vehicles passing each other or sitting adjacent in traffic. Crosstalk might also result from static lidar units used in infrastructure, for instance, to count passing vehicles. The effects of the crosstalk signal will be similar to multipath effects, as discussed above. With regard to multipath-ambiguity resolution, note that the crosstalk signal will always be stronger than the true signal (because energy is not lost as a result of scattering) but that the crosstalk is not necessarily the first return.

• Absorption: Typical surfaces return a significant fraction of energy from the lidar transmitter back to its detector. For cases in which no strong return is detected, the lidar reports a non-return. In most cases, a non-return indicates that no object is present within the detection range of the lidar, with the detection range defined somewhat sharply by spreading losses (inverse of range to the fourth power). However, exceptions are possible, including in cases of highly absorptive materials. If a surface absorbs sufficient energy, the detected power will fall below the threshold triggering a non-return. In such cases, an object may be present but not detectable.

• Transmission: Certain surfaces may not reliably produce a return. For example, when a lidar beam passes near the edge of an isolated object or interior gaps in a surface (such as a fence or tree branches), a non-return may result. Glass and other transparent surfaces may also fail to produce a return. Consequently, as with the absorption case above, an object may be present but not detectable. In many cases, transmission is highly dependent on lidar configuration, with slight changes of pose resulting in either a valid range measurement or a non-return. Such surfaces might be defined as generating probabilistic returns in the sense that detections are inconsistent, with no easily calibrated pattern describing when the surface will produce valid returns or non-returns.

• Spectral reflection: Typical “matte” surfaces scatter light diffusely, in all directions. By contrast, “shiny” surfaces reflect some fraction of light spectrally, like a mirror. Unless the reflecting surface is viewed from the normal direction, spectral reflection redirects the lidar beam away from the lidar unit. In most cases, the reflected lidar beam travels into empty sky and dissipates (non-return). If the reflected beam hits a secondary surface, it may scatter back along the original ray path, bouncing off the reflector and returning to the lidar unit’s detector, thereby generating a non-line-of-site (NLOS) measurement. Whereas the non-return case represents missing data, which can make it difficult to reconstruct surface shape, the NLOS case manifests as a positive bias in the measured range. Either way, care is needed to infer scene geometry when windows, mirrors, polished metal, or shiny paint are present.

• Shadowing: When viewing a scene from different angles, foreground objects may occlude background objects from certain angles, effectively shadowing the background objects from view (McDermott & Rife, 2022b). Objects with curved surfaces can also shadow themselves, a phenomenon sometimes called self-shadowing or perspective error (Rife & McDermott, 2024). Shadowing effects may distort the apparent shape of an object, making it harder to extract features and/or match the map. Shadow edges can also create “spurious” features along walls or across the ground.

• Refraction: Lidar systems assume that light travels in a straight line from the emitter to the scattering surface and back to the detector. Refraction effects violate this assumption by bending the trajectory of light. Refraction occurs when light travels through a temperature and density gradient in the air, such as when passing above an asphalt roadway heated above the ambient air temperature by solar radiation (Yang et al., 2019). When the lidar beam’s trajectory is bent by refraction, the result is an increased time of flight and, accordingly, distortion of the inferred position of the scattering surface.

Adversity modes related to hardware design include spontaneous hardware faults and glitches related to system angular resolution.

• Hardware fault: A lidar unit might experience a partial-power condition or a subcomponent might wear out, resulting in reduced measurement quality, also known as HMI. Such events are expected to be rare and occur stochastically, with little or no advanced warning.

• Low angular resolution: Low lidar resolution (i.e., a low number of scan lines) makes it more difficult to identify small-scale features. When complicated objects with high spatial frequencies (relative to resolution) are imaged, smallscale features may be under-resolved, smoothed, or aliased, depending on the design of the lidar unit.

Adversity modes involving platform motion include bulk translation or rotation of the vehicle on which the lidar unit is mounted. Platform motion can cause apparent changes to the scene when the scene has not actually changed.

• Scan boundary: Platform motion can cause objects to partially appear or disappear near the edges of the viewable domain. This adversity can impact accuracy and feature-extraction probabilities. For a mechanical rotating lidar, the boundaries of the viewable domain are usually defined by an upper and a lower elevation limit. Some units also have boundaries in the azimuthal direction. The viewable domain may be further restricted if parts of the ego vehicle carrying the lidar appear inside the field of view (in which case, a mask can be defined to exclude those regions).

• Motion distortion: Sometimes called motion blur or rolling shutter, this adversity arises when the vehicle translates or rotates during the interval needed to capture a complete scan. For a rotating lidar unit, the time to complete a full 360° scan is typically 50–200 ms, far from instantaneous. During this interval, any non-zero translation or rotation will influence the position of the points in the scan. For example, a complete 360° rotation of the lidar rotor relative to the vehicle might occur as the vehicle rotates by 10° relative to the world. In the world frame, the resulting scan will capture either 350° (missing a slice of the scene) or 370° (overlapping a slice of the scene), depending on the relative directions of the two rotations. Motion distortion can be partially mitigated by estimating the vehicle translational and rotational speeds and applying a correction assuming that those speeds are constant; however, accelerations and vibrations remain difficult to correct.

Another set of adversity modes relate to the map data used for localization. These modes include the following:

• Data anomalies: On rare instances, it is possible that map data will be corrupted by a communication fault (e.g., a bit error or a buffer overflow), a human mistake (e.g., scheduling the wrong upload), or the corruption of stored data (e.g., by a cosmic ray or a power surge). Examples of bad data uploads have not been discussed in the lidar literature, but they have been observed in the operation of satellite navigation systems (Pullen et al., 2001). Data anomalies are rare and unintentional.

• Artifact or mislabeled feature: Map data are assumed to be highly reliable. However, it is possible that an artifact may appear, i.e., a fictitious piece of data may be injected during map construction that does not match the real world. It is also possible that a feature may be mislabeled, such as in the case when two lamp posts are very close and the map labels both as reliable features or only one as an unreliable feature. (Recall that an extraction fault can occur for closely spaced features, as discussed in Section 3.2.)

• Large-scale ambiguity: Large-scale ambiguities occur in a map if two or more disparate locations have similar appearances. Examples might include similar intersections located on opposite sides of a city, patterns of lamp post spacings that appear repeatedly on different streets, or even a uniformly spaced series of features (e.g., cables on a suspension bridge). When large-scale ambiguities exist in a database, it may be difficult to initialize a pose solution. This situation is akin to an acquisition problem in GNSS (Misra & Enge, 2011) or a lost-robot problem in the field of robotics (Majdik et al., 2010).

The lidar algorithm itself can also result in adversity modes. In particular, we are concerned with aspects of the algorithm that are implementation-dependent and that can result in a significantly incorrect pose estimate.

• Poor initialization: A nonlinear set of equations such as that in Equation (4) can be solved iteratively. The result of the iterations depends on having a reasonable initial guess. If the initial guess is outside the zone of convergence for the correct solution, then the estimated pose will converge to another local optimum, away from the true solution.

• Divergence: Nonlinear equations admit multiple solutions. Moreover, if the measurements are inconsistent, the geometry is sparse, or the linearization is ill-conditioned, then the iterations may diverge away from the true solution, even with a good initial guess. If the solution diverges severely, then it is not difficult to detect divergence and exclude the solution. However, if the solution starts to diverge but later locks on to a secondary solution, then the solver will report a wrong answer. The first case is a continuity problem (where the adversity is detectable but prevents use of the lidar data), and the second case is an integrity problem (where the adversity introduces a localization error yet is not detectable).

Another adversity mode is intentional interference with lidar operation, in the form of spoofing. Spoofing can be either electronic or physical. Because spoofing is a malicious cyberattack, this adversity cannot be considered a rare, probabilistic event. Instead, engineers should assume that an attack could happen and address it with a combination of hardening, monitoring, and resilient procedures.

• Electronic spoofing: Modes of electronic spoofing include lidar repeaters, transmitters, and infrared jammers. These devices might implant intentional patterns of false returns into a scene (similar to crosstalk, as discussed above, but intentional in nature). An electronic spoofing attack might also be launched via the transmission of a false data message (e.g., an alert to update the map data in an intentionally disruptive manner).

• Physical spoofing: Perhaps the easiest way to attack lidar navigation is to intentionally disrupt the physical scene. One might transform a scene like a movie set, by bringing in props or covering otherwise visible features.

A final category of adversity mode is scene change. Scene changes include all categories of moving objects within an environment, other than spoofing attacks. Scene changes can have localized effects (on one feature) or scanwise effects (on all lidar points in a scene), depending on the nature of the effect. Scene changes can create local errors, false or failed feature extraction, or problems in associating features with the map data. The variety of scene changes is broad enough that we have introduced a separate table (Table 4) to categorize them. It is relevant to note that, by construction, the engineered-target and landmark-based architectures rely on objects in the environment that change infrequently; by contrast, the scan-matching architecture includes all visible objects, and thus, changes are expected to have a more prominent impact on scan matching.

Although we have been diligent in constructing the table of adversities (Table 3), it is possible that other adversities will be discovered in time. Our team is continuing to develop tools with the goal of isolating adversities in real data sets, in order to assess the severity of known adversities and identify new adversities should they appear (Choate & Rife, 2024).

4.3 Mitigations

The goal of identifying adversities is to mitigate them. The simplest adversities (e.g., noise and beam width effects) are nominal effects that should be included in a nominal error distribution. Rare adversities (e.g., hardware faults and data anomalies) may be mitigated by using reliable equipment and redundancy to ensure a low prior probability of a fault. For the most part, other adversities are neither nominal behaviors nor rare faults; thus, additional mitigations are necessary. It is our belief that such mitigations are possible via a combination of careful design practices and achievable research.

In this section, we explore potential avenues to mitigate adversities. For each adversity identified in this paper, a subset of reasonable mitigations is listed in Table 5. The table includes five categories of mitigation, each listed as a distinct column. The first mitigation approach is to manage risks, by leveraging a fault tree or other risk-management tools to account for rare events (Pullen et al., 2006). In this approach, system-safety engineers leverage the low prior probability of a fault and component redundancy to ensure that the overall risk is acceptable. Other approaches are needed to reduce system risk if adversities are not rare events. For instance, a second mitigation approach is to design systems to suppress risks. Safety-by-design approaches can eliminate certain well-characterized adversities through a combination of careful engineering, verification, and validation, before the system ever reaches the field. A third mitigation approach is to correct systematic errors. This approach addresses adversities algorithmically by removing repeatable biases, applying geometric constraints, or deterministically eliminating certain measurements under unsafe conditions. A fourth mitigation approach is to monitor the lidar signal to ensure its quality. Signal quality monitoring acts in real time to classify navigation measurements as either healthy or unsafe to use (Mitelman et al., 2000). A final mitigation approach is to bound errors that remain after other mitigations have been applied. Bounding involves establishing an upper limit on the magnitude of large errors as a confidence interval for the allowed integrity risk (Decleene, 2000; Rife et al., 2006). Error bounding helps to manage sources of random error, as well as small deterministic biases.

Fault management (first mitigation column in Table 5) is a classical approach to accounting for and mitigating risks for rare events. The list of adversities includes only two rare events: hardware component failures and data anomalies. For both of these adversities, it seems reasonable to characterize a fault probability and combine that probability with appropriate redundancy to ensure an adequate upper bound on associated integrity risks (Lee et al., 1985).

Safety-by-design methods (second mitigation column in Table 5) promise to mitigate a wide range of adversities, particularly adversities that are frequent and well-structured. As examples, we believe that the following adversities can be resolved by developers, as a matter of sound engineering design: time-tagging biases, crosstalk, low angular resolution, data artifacts/mislabeling, and large-scale map ambiguities. For instance, time-tagging issues can potentially be resolved with an appropriate clock-triggering mechanism; crosstalk, by monitoring for high received-signal power; and low angular resolution, by using emerging high-resolution lidar systems. Map issues such as artifacts, mislabeling, and large-scale ambiguities can be mitigated by rigorous verification of the map data before use.

Correction methods (third mitigation column in Table 5) promise to address adversities that are largely geometric in nature or that are well modeled by physics. Examples of proposed correction algorithms include methods to address shadowing effects (McDermott & Rife, 2022b), field-of-view limitations (Choate & Rife, 2024), and motion distortion (Hong et al., 2010; Zhang & Singh, 2014; Al-Nuaimi et al., 2016; Inui et al., 2017; Setterfield et al., 2023; McDermott & Rife, 2023). In some cases, the same correction may address more than one adversity; for instance, a generalized form of motion-distortion correction could potentially address variable scanning speed. Although calibration of lidar intrinsic parameters has been studied (Bergelt, 2017; Lv, 2022), more work may be needed to ensure longer-term stability of calibration parameters. Similarly, models of porous or permeable scenes have been previously introduced (Browning et al., 2012), but they have not yet been adapted for use in a safety-critical system.

Online monitors (fourth mitigation column in Table 5) can exclude bad measurements or provide alerts if measurement quality degrades. Monitors may be particularly helpful for detecting scene changes or dynamic obstacles. To this end, a simple residual-based consistency check provides significant benefit (McDermott & Rife, 2024), and more sophisticated dynamic-object removal methods have been proposed to enhance performance (Wang et al., 2015; Pagad et al., 2020; Cai et al., 2023; Wang et al., 2023). Researchers are also tackling the subject of monitoring for cyberattacks, including physical and electronic spoofing (Cao et al., 2019; Changalvala & Malik, 2019; Liu & Park, 2021; You et al., 2021; Sun et al., 2020; Hu et al., 2024). One useful anti-spoofing technique, for instance, may be to monitor for returns with unusually high power. Work remains to characterize monitor integrity performance, especially considering the range of different scene changes described in Table 4. From an integrity perspective, feature-extraction monitors are among the best developed of current lidar monitors (Joerger et al., 2024).

Weather-related scene changes represent a particular concern for all architectures, as many researchers have pointed out impacts of weather on lidar measurements, including Levinson et al. (2007), Filgueira et al. (2017), Heinzler et al. (2019), and Chang et al. (2023). Monitors may help detect weather conditions, but they may not be able to mitigate all associated integrity risks. In some cases, however, particularly for extraction errors, landmark detection can be enhanced by careful system design, for example, by adding reflective features that maximize the distinction between landmarks and other non-reflective objects (Nagai, Ahmed, & Pervan, 2024) or by using additional information for classification, such as feature height (Nagai & Pervan, 2024).

Error bounding (fifth mitigation column in Table 5) captures residual effects that cannot be addressed by other mitigation methods. The error-bounding process, sometimes called uncertainty quantification, characterizes the probability density function for random and systematic errors. Error characterization is nontrivial in that lidar accuracy can rival that of many ground-truth systems (for example, carrier-phase GPS positioning), making it difficult to directly measure the lidar pose-estimation error. More work is also needed to generate reduced-order models that capture both scene dependencies and different error mechanisms including time-of-flight, beam width, variable scanning speed, calibration bias, multipath, spectral reflection, and porous object issues. Fortunately, lidar uncertainty quantification is a topic of growing interest in the research community (Stoyanov et al., 2012; Joerger et al., 2022; Yuan et al., 2023; McDermott & Rife, 2024).

4.4 Mitigation Through Complementary Architectures

While mitigation techniques can be developed and implemented within a single architecture, the deployment of parallel architectures is potentially a useful approach for mitigating many adversities. As suggested in Section 4.1, the same adversity may impact each architecture differently. As one example, consider spoofing. Engineered targets can be replicated and/or manipulated to spoof or deny positioning information. Infrastructure monitoring and/or target code authentication methods might help address this risk; however, another simple approach is to compare the engineered-target solution to the solution of a feature-based or scan-matching architecture. It is particularly difficult to spoof a scan-matching architecture, because the system uses the entire scene and not just a handful of extracted features.

As another example, consider scene changes. The engineered-target architecture is relatively resilient to undetected nominal scene change adversities. Even if a parked vehicle blocks an engineered target, it is unlikely that other features will be mistaken for the actual engineered target, given that the target is coded as shown in Figure 3 and Figure 4. In other words, the parked vehicle might cause a loss of continuity but not a loss of integrity. This resilience to scene changes could support change identification in a scan-matching system, particular for cases in which the map becomes outdated over a large area (because of construction, for instance).