Method for performing integrity check on GNSS correction data provided without associated integrity information

Abstract

The invention relates to a method for checking the integrity of GNSS correction data (1), comprising at least the following steps: a) receiving GNSS correction data (1) provided without associated integrity information; b) receiving reference data (2) allowing the integrity of the GNSS correction data (1) received in step a) to be inferred; c) checking the integrity of the GNSS correction data (1) received in step a) using the reference data (2) received in step b).

Description

Technical Field

[0001] The present invention relates to a method for integrity checking GNSS correction data, a method for providing integrity data, a method for providing GNSS correction data, a computer program, and a machine-readable storage medium. The present invention is particularly useful in connection with autonomous driving. Furthermore, the present invention may also be used in other safety-related applications in the field of satellite positioning. Background Art

[0002] In the case of GNSS (Global Navigation Satellite System) navigation, GNSS correction data are usually used. These correction data are used to take into account the ascertainable errors of the GNSS signals during positioning. Ascertainable errors can, for example, be the propagation time errors of the GNSS signals. This propagation time error can be determined, for example, by receiving the GNSS signals using reference stations whose geodetic positions are precisely known. Here, the correction can be determined by comparing the position calculated using the received GNSS signals with the precisely known position. An example of this is so-called DGPS (Differential GPS). However, instead of or in addition to the propagation time errors, GNSS correction data can also take into account atmospheric influences, environmental influences, clock errors, and / or satellite orbit errors.

[0003] GNSS correction data is typically provided by correction data providers dedicated to this purpose (also known as GNSS correction services). These providers typically differ in the type of corrections they provide and whether they also provide integrity information for the GNSS correction data they provide. However, corresponding information about the integrity of the correction data that has been used or may be used is particularly important for safety-related applications (i.e., applications that require a specific level of data security). For example, GNSS positioning for at least partially autonomous vehicles is an application area that requires a certain (high) level of security.

[0004] Known GNSS correction services that provide relevant integrity information include, for example, commercial PPP-RTK (Precise Point Positioning - Real-Time Kinematics) services, where integrity checks are typically part of proprietary algorithms. This integrity information can be used, for example, to achieve a level of security (particularly according to ISO 26262 and / or IEC 61508). This integrity information is crucial because inconsistent or inaccurate correction data in position calculations can lead to positioning errors if not detected in time.

[0005] Known GNSS correction services that do not provide any relevant integrity information are, for example, services using PPP (Precise Point Positioning) technology or PPP-RTK, free or non-commercial services, as well as commercial services. In addition to the terms PPP and PPP-RTK, SSR (1 to 4) and other terms used by proprietary service providers are also commonly used to describe the technology. The systems currently available on the market for position correction (including for data generation, transmission and processing) do not provide relevant integrity information and currently do not generally meet the requirements for use in safety-related applications such as autonomous driving. The applicability of corresponding correction data for safety-related applications would advantageously increase the bandwidth of available correction data for safety-related applications. Summary of the Invention

[0006] According to claim 1, a method for integrity checking of GNSS correction data is proposed, comprising at least the following steps:

[0007] a) receiving GNSS correction data provided without associated integrity information;

[0008] b) receiving reference data allowing to infer the integrity of the GNSS correction data received in step a);

[0009] c) Checking the integrity of the GNSS correction data received in step a) using the reference data received in step b).

[0010] The method is particularly useful for checking the integrity of GNSS correction data that were initially provided by a correction data provider without associated integrity information or integrity data. The integrity of these (initially unchecked) GNSS correction data determined in this manner can be provided to a GNSS receiver receiving these GNSS correction data. However, it is also conceivable to perform the integrity check on the receiver side. The integrity determined externally or on the receiver side can be used, for example, to ensure that a (predetermined) safety level (e.g., ASIL, SIL) is met, with or without the use of the checked correction data.

[0011] The integrity of GNSS correction data generally describes the accuracy, quality and / or consistency of these GNSS correction data. Therefore, during the integrity check, the GNSS correction data is checked in particular for accuracy, quality, plausibility and / or consistency.

[0012] In step a), GNSS correction data are received, which correction data are provided without associated integrity information. In other words, this particularly relates to GNSS correction data provided by a correction data provider that provides (these) GNSS correction data without associated integrity information or integrity data. In particular, these GNSS correction data do not include any (additional) data describing the accuracy, quality, plausibility and / or consistency of the actual correction data. Therefore, these GNSS correction data (per se) particularly do not allow any conclusions to be drawn as to whether they meet a (pre-)determined safety level or quality level (e.g. SIL, ASIL). In step a), the GNSS correction data are received, in particular, by a (mobile) GNSS receiver (per se) or by a higher-level evaluation system (e.g. a data center). In step a), the GNSS correction data (correction data of the service to be checked) are preferably received via IP (Internet Protocol, e.g. TCP / IP or UDP), L-Band or other signal paths.

[0013] In step b), reference data are received that allow conclusions to be drawn about the integrity of the GNSS correction data received in step a). The reference data may, for example, be orbital data, GNSS correction data provided with associated integrity information, and / or GNSS correction data provided by a correction data provider that is different from the correction data provider that provided the GNSS correction data received in step a). In step b), the reference data are received, in particular, by the (mobile) GNSS receiver (itself) or by a higher-level evaluation system, such as a computing center. The reference data may, for example, be provided by a GNSS reference ground station.

[0014] In step c), the integrity of the GNSS correction data received in step a) is checked using the reference data received in step b). In particular, in step c), the accuracy, quality, plausibility and / or consistency of the GNSS correction data received in step a) is determined using the reference data received in step b). In order to check the integrity of the correction data, in particular within predefined thresholds, the correction quality of the satellite orbits and / or satellite clocks is preferably compared. Typically, a target value for the integrity check is (pre)determined. If the (pre)determined target value is met, the integrity check is, for example, set to "positive". Alternatively or additionally, a quality indicator can be calculated, which reflects the deviation of the received correction data from the reference data.

[0015] The check according to step c) can be performed, for example, by the (mobile) GNSS receiver (itself) or by a higher-level evaluation system, such as a computing center. Furthermore, based on the check process, and in particular based on the results of the check process, integrity information about the GNSS correction data received in step a) can be formed and, if necessary, provided. The integrity information can, if necessary, include or describe a calculated quality indicator. The integrity information and / or the quality indicator can be assigned as integrity data to the respective GNSS correction data and / or can be provided as integrity data about the GNSS correction data (possibly together with or separately from the respective GNSS correction data). The integrity information and / or the quality indicator can, for example, allow conclusions to be drawn as to whether the GNSS correction data meet a (predetermined) quality level.

[0016] The results of the integrity check (of data from one or more services) can be provided (possibly uniformly) via IP, or, if necessary, via other signal paths, such as geostationary satellite (L-band) or digital radio (e.g., SiriusXM, DAB). Furthermore, an integrity message can be generated containing the results for one or more, and preferably all, observed services. For example, this method can be used to check the integrity of GNSS correction data from different providers. In this context, in step a), for example, GNSS correction data can be received from multiple (different) services without associated integrity information.

[0017] According to an advantageous embodiment, it is provided that the GNSS correction data received in step a) are provided by (at least) one correction data provider which does not perform an integrity check and / or does not provide any integrity information about the GNSS correction data.

[0018] A correction data provider that does not perform an integrity check and / or does not provide any integrity information about the GNSS correction data may be, for example, a PPP service and / or a PPP-RTK service. In particular, a correction data provider that does not perform an integrity check and / or does not provide any integrity information about the GNSS correction data is a non-commercial correction data provider.

[0019] According to another advantageous embodiment, the reference data received in step b) include orbit data and / or satellite clock data and / or (if applicable) regional and / or global corrections for the ionosphere and / or troposphere. The orbit data (for verification) may be, for example, a predicted part of an ultra-rapid orbit of the IGS (International GNSS Service).

[0020] According to a further advantageous embodiment, it is provided that the reference data received in step b) include GNSS correction data, which are provided with associated integrity information.

[0021] The associated integrity information preferably allows conclusions to be drawn as to whether the GNSS correction data meet a (pre-)determined quality level (eg SIL, ASIL).Correction data providers providing GNSS correction data with associated integrity information are typically commercial correction data providers.

[0022] According to another advantageous embodiment, the reference data received in step b) include GNSS correction data provided by a (further) correction data provider that is different from the correction data provider that provided the GNSS correction data received in step a).

[0023] The other correction data provider may be one that does not perform an integrity check and / or does not provide integrity information about the GNSS correction data. In this case (particularly after a comparison), even (pure) GNSS correction data from the other correction data provider can enable conclusions to be drawn about the integrity of the correction data received in step a).

[0024] By using two services without integrity checking (one of which serves as a reference product), ASIL-A according to ISO 26262 or SIL 1 according to IEC 61508 can already be advantageously achieved. By using a service with integrity checking (e.g. with ASIL level) as a reference product, ASIL-B or higher can advantageously be achieved if necessary (in certain constellations).

[0025] According to another advantageous embodiment, it is provided that the checking in step c) comprises comparing, verifying and / or merging the GNSS correction data received in step a) with the reference data received in step b).

[0026] In particular, if GNSS correction data are received as reference data from another correction data provider in step b), the GNSS correction data received in step a) can be compared and / or verified with the reference data received in step b) in step c). In particular, if GNSS correction data are received in step b) provided with associated integrity information, the GNSS correction data received in step a) can be compared, verified and / or merged with the reference data received in step b) in step c).

[0027] According to another aspect, a method for providing integrity data for GNSS correction data provided without associated integrity information is provided, wherein the method for checking integrity described herein is performed to determine integrity data. In particular, the integrity data determined in this manner can be assigned to corresponding GNSS correction data provided (initially or initially) without associated integrity information. For example, the integrity data can be transmitted to a (mobile) GNSS receiver. In particular, the integrity data allows conclusions to be drawn as to whether the GNSS correction data to which they are assigned meet a (predetermined) quality level (e.g., ASIL, SIL).

[0028] According to another aspect, a method for providing GNSS correction data to a (mobile) GNSS receiver is also proposed, wherein the method described herein for checking integrity and / or the method also described herein for providing integrity data are performed. In particular, the GNSS correction data can be provided together with the integrity data determined and assigned to them, these correction data being provided (initially or initially) without the associated integrity information. This can occur, for example, in a data stream in which the GNSS correction data and the associated integrity data are combined, for example, linked to form data pairs. However, it is also conceivable that the GNSS correction data and the assigned integrity data are transmitted to the GNSS receiver via different paths. The GNSS receiver can, for example, be arranged in or on a (motor) vehicle, which is preferably designed for at least partially automated or autonomous driving operation.

[0029] According to another aspect, a computer program for executing the method described herein is also proposed. In other words, this particularly relates to a computer program (product) comprising instructions which, when executed by a computer, cause the computer to execute the method described herein.

[0030] According to another aspect, a machine-readable storage medium is provided, on which a computer program is stored. A machine-readable storage medium is generally a computer-readable data carrier.

[0031] The details, features, and advantageous configurations discussed in conjunction with the method for checking the integrity of GNSS correction data may also be found in the method for providing integrity data, the method for providing GNSS correction data, the computer program, and / or the storage medium presented herein, and vice versa. In this respect, reference is made fully to the statements therein for a more detailed characterization. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The solution proposed herein and its technical environment are explained in more detail below with reference to the accompanying drawings. It should be noted that the present invention is not limited to the illustrated embodiments. In particular, unless otherwise explicitly stated, some aspects of the facts illustrated in the drawings may be extracted and combined with other components and / or insights from other drawings and / or this specification. Schematically:

[0033] Figure 1 : Provides an exemplary graphical representation of GNSS correction data according to the prior art;

[0034] Figure 2 : Flowchart of the method proposed here for checking the integrity of GNSS correction data;

[0035] Figure 3 : an exemplary diagrammatic view of the method proposed herein for providing GNSS correction data to a GNSS receiver; and

[0036] Figure 4 : An exemplary flow chart of the method proposed herein for providing GNSS correction data to a GNSS receiver. DETAILED DESCRIPTION

[0037] Figure 1 An exemplary diagrammatic view of providing GNSS correction data 1 according to the prior art is schematically shown. Three GNSS satellites 7 of different constellations, a correction data provider 4 receiving signals from the GNSS satellites 7 at a known geodetic position, and a mobile GNSS receiver 6 also receiving signals from the GNSS satellites 7 are shown. The correction data provider 4 determines the GNSS correction data 1 from the received signals, for example by comparing them with a known geodetic position.

[0038] Furthermore, the correction data provider 4, for example, determines integrity information associated with the GNSS correction data 1 it provides, thereby forming integrity data 5. The correction data provider 4 provides the GNSS correction data 1 in combination with the associated integrity data 5 to a GNSS receiver 6. Thus, the GNSS receiver 6, which can be, for example, a GNSS receiver 6 of an at least partially autonomous vehicle, can determine from the integrity data 5 whether the provided GNSS correction data 1 meets a certain safety level (here, for example, ASIL requirements). If this is the case, the GNSS receiver 6 can use the GNSS correction data 1 to correct the received GNSS signals and thereby (reliably) improve its own positioning. In principle, ASIL requirements can also be met if, for example, integrity information is missing. If there is no integrity information for checking, the data is generally classified as unchecked and, therefore, as unsafe. ASIL classification specifically describes a well-known design, for example, with various redundancies and test modules developed according to the corresponding program requirements.

[0039] Figure 2 A flowchart schematically illustrates the method proposed herein for checking the integrity of GNSS correction data 1. Steps a), b), and c), represented by blocks 110, 120, and 130, can be performed at least once in sequence. Furthermore, at least steps a) and b) can also be performed at least partially in parallel or simultaneously. In block 110, according to step a), GNSS correction data 1 are received, provided without associated integrity information. In block 120, according to step b), reference data 2 are received that allow inferences about the integrity of the GNSS correction data 1 received in step a). In block 130, according to step c), the integrity of the GNSS correction data 1 received in step a) is checked using the reference data 2 received in step b).

[0040] Figure 3 Schematically, an exemplary diagrammatic representation of the method proposed here for providing GNSS correction data 1 to a (mobile) GNSS receiver 6 is shown. Here, the method described here for integrity checking is performed. In this context, the GNSS receiver 6 is also provided with integrity data 5. Here, the integrity data 5 are provided for GNSS correction data 1, which are provided (on the part of the prepared correction data provider 3) without associated integrity information. Here, in order to determine the integrity data 5, the method described here for integrity checking is performed. In this respect, we refer to the method for Figure 2 explanation.

[0041] exist Figure 3In the embodiment of the present invention, the GNSS correction data 1 received in step a) are provided by a correction data provider 3 that does not perform an integrity check and / or does not provide any (relevant) integrity information about the GNSS correction data 1. These GNSS correction data 1 are also provided to a GNSS receiver 6 (without integrity information or directly). In addition (and independently or in parallel therewith), the GNSS receiver 6 is provided with integrity data 5 for the GNSS correction data 1 determined according to the method for integrity checking described herein. As a result, the GNSS receiver 6 can check whether the GNSS correction data 1 meet a specific (predetermined) security level.

[0042] The reference data 2 received in step b) here, for example, include GNSS correction data provided by a correction data provider 4, which is different from the correction data provider 3 that provided the GNSS correction data 1 received in step a). Furthermore, the reference data 2 received in step b) here, for example, include GNSS correction data provided with associated integrity information.

[0043] Alternatively or additionally, the received reference data 2 may be GNSS correction data provided without associated integrity information, but provided by a correction data provider 4 different from the correction data provider 3 providing the GNSS correction data 1 received in step a). Furthermore, the reference data 2 received in step b) may alternatively or additionally include orbit data, satellite clock data, regional and / or global corrections for the ionosphere and / or troposphere.

[0044] The check in step c) here comprises, for example, comparing and / or combining the GNSS correction data 1 received in step a) with the reference data 2 received in step b). Figure 4 A more detailed example of this is described.

[0045] Figure 4An exemplary flow chart of the method proposed here for providing GNSS correction data 1 to a GNSS receiver 6 is schematically shown. The data provided by the various correction data providers 3, 4 are initially checked 10 with respect to value range, completeness and / or up-to-dateness. In addition, various assistance data 8, 9 can be considered. The assistance data can be, for example, orbital data from the IGS (International GNSS Service) and / or CODE (Centre for the Determination of Orbits in Europe). However, a plausibility check with the aid of a global tropospheric model (e.g., UNB3 from the University of New Brunswick) and / or a global ionospheric model (e.g., an ionosphere map) is also conceivable. This is followed by a time synchronization 11 of the data. Within the scope of a normalization and / or plausibility check 12 of the data characteristics, the data are subjected to a plausibility check and / or normalization (e.g., conversion of relative correction parameters into absolute correction parameters using broadcast ephemeris).

[0046] Based on the determined parameters, the correction data and any assistance data (from the normalization and / or plausibility check 12) are compared with one another within the scope of a comparison 13. The results of the comparison are further used within the scope of a selection 4. Depending on the result of the comparison 13, individual data elements, data attributes, or complete data streams are discarded or forwarded. In a final (assembly) step 15, the selected correction and assistance data from the selection 14 are combined into a new correction data stream. The correction data stream contains GNSS correction data 1 and integrity data 5 related to these correction data 1.

[0047] In particular, the method proposed here has the advantage that GNSS correction data provided without associated integrity information can also be used in conjunction with at least partially automated driving, wherein high requirements are usually placed on the integrity of the data used.

Claims

1. A method for performing integrity check on GNSS correction data (1), comprising at least the following steps: a) receiving, by a GNSS receiver (6) of the vehicle, GNSS correction data (1) provided without associated integrity information from a correction data provider located on the ground, said correction data provider not performing an integrity check and / or not providing any integrity information on said GNSS correction data (1); b) receiving, by means of the GNSS receiver (6) of the vehicle, reference data (2) from a GNSS reference ground station situated on the ground, said reference data allowing to infer said integrity of said GNSS correction data (1) received in step a); c) checking the integrity of the GNSS correction data (1) received in step a) using the reference data (2) received in step b) by the GNSS receiver (6) of the vehicle.

2. The method according to claim 1, wherein Said reference data (2) received in step b) comprises orbital data.

3. The method according to claim 1 or 2, wherein: Said reference data (2) received in step b) comprises provided GNSS correction data with associated integrity information.

4. The method according to claim 1 or 2, wherein: The reference data (2) received in step b) includes GNSS correction data provided by a correction data provider that is different from the correction data provider that provided the GNSS correction data (1) received in step a).

5. The method according to claim 1 or 2, wherein: The checking in step c) comprises comparing, verifying and / or merging the GNSS correction data (1) received in step a) with the reference data (2) received in step b).

6. A method for providing integrity data (5) relating to GNSS correction data (1), said GNSS correction data being provided without associated integrity information, wherein: The method according to any one of claims 1 to 5 is performed to determine the integrity data (5).

7. A method for providing GNSS correction data (1) to a GNSS receiver (6), wherein: The method according to any one of claims 1 to 5 and / or the method according to claim 6 is performed.

8. A computer program product designed to perform the method according to any one of claims 1 to 7. 9 . A machine-readable storage medium having a computer program stored thereon, the computer program being designed to execute the method according to claim 1 .

Images