A method for evaluating the integrity of satellite navigation application terminals under multiple fault excitations

Abstract

This invention relates to a method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations, comprising: determining the required fault modes of the risk sources based on the probability of occurrence of the fault modes; converting the integrity risk index into an equivalent false negative rate index to determine the probability of occurrence of each fault mode in the test samples; determining the worst-case fault amplitude based on the worst-case fault criterion; constructing a Type I / II error probability assessment model based on the equivalent false negative rate index to quantify the assessment confidence; determining the number of test samples to be collected and the assessment threshold based on the Type I / II error probability assessment model, randomly selecting multiple test locations globally, determining the number of test samples at each test site, and injecting the worst-case fault into the test samples used at each test site; collecting the test samples generated by the satellite navigation application terminal and assessing whether the integrity risk of the satellite navigation application terminal meets expectations.

Description

Technical Field

[0001] This invention relates to the field of satellite navigation technology, and specifically to a method for evaluating the integrity of satellite navigation application terminals under multiple fault excitations. Background Technology

[0002] The Global Navigation Satellite System (GNSS) possesses powerful functions such as navigation, positioning, and timing, providing comprehensive, all-weather, and all-time navigation and positioning services. GNSS is increasingly supporting navigation and positioning scenarios such as automatic guidance and autopilot for shipborne aircraft, and collaborative operations of intelligent agricultural machinery. These typical application scenarios demonstrate the widespread use of GNSS in navigation fields related to life safety. Therefore, its positioning performance services are gradually shifting from high precision to high reliability, a trend indicating that integrity is becoming increasingly important in life safety-related navigation fields.

[0003] Currently, the precise approach phase during aircraft landing utilizes Real-Time Kinematic (RTK) positioning to obtain relative positioning. To ensure highly reliable precision landing, it is necessary to effectively utilize the operational statistical characteristics of satellite navigation application terminals and assess user integrity risk indicators to provide a reference for further optimization of integrity performance.

[0004] Existing assessment methods have the following drawbacks: satellite navigation application terminals face challenges from multiple risk sources, including satellite segments, space and atmospheric segments, and satellite navigation application receiver terminals. The probability of these risk sources occurring is extremely low, and the large number of multi-satellite failure amplitudes makes it difficult to traverse them all, resulting in high testing difficulty. The precision approach phase test duration is relatively short, and the high number of test samples required by traditional methods leads to high assessment costs. Reducing the number of test samples can easily cause inaccurate integrity risk assessments. Summary of the Invention

[0005] To address the problems in scenarios involving extremely low probability of multiple satellite faults from various sources, difficulty in traversing and exciting the amplitude of multiple satellite faults from various sources, and inaccurate confidence levels in short-term integrity assessments, this invention proposes a method for evaluating the integrity of satellite navigation application terminals under multiple fault excitations, including:

[0006] Step S1) Determine the required excitation failure mode based on the occurrence probability of the failure mode of the risk source;

[0007] Step S2) Use the sum of prior failure probabilities of the failure modes that need to be stimulated to convert the integrity risk index into an equivalent false negative rate index, and at the same time determine the probability of occurrence of each failure mode in the test sample.

[0008] Step S3) Determine the worst-case failure amplitude based on the worst-case failure criterion;

[0009] Step S4) Based on the equivalent false negative rate index converted from the integrity risk index, construct a Type I / II error probability assessment model to quantify the confidence level.

[0010] Step S5) Determine the number of test samples to be collected and the evaluation threshold based on the Type I / II error probability assessment model;

[0011] Step S6) Randomly select multiple test locations globally, determine the number of test samples for each test site, and inject the worst-case fault into the test samples used at each test location;

[0012] Step S7) Collect test samples generated by satellite navigation application terminals and assess whether the integrity risk of satellite navigation application terminals meets expectations.

[0013] The beneficial effects of this invention are:

[0014] This invention provides a method for evaluating the integrity of satellite navigation application terminals under multiple fault excitations. Under constraints such as extremely low probability of risk source failures, difficulty in exciting multiple satellite faults, and inaccurate confidence levels due to limited short-term test samples, this method addresses the challenges of testing due to extremely low probability of risk source failures and difficulty in exciting multiple satellite faults by employing worst-case fault injection and worst-case fault amplitude methods. By constructing a Type I / II error probability assessment model, the required number of samples for testing can be determined, resolving the issue of inaccurate confidence levels caused by limited short-term test samples. This method enables high-confidence, high-efficiency testing and assessment of the integrity risks of satellite navigation application terminals, providing reliable assurance for satellite-guided landing during precise approach phases. It is of great significance in navigation and positioning applications related to life safety. Attached Figure Description

[0015] Figure 1 A flowchart of a method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations provided by the present invention;

[0016] Figure 2 A schematic diagram of the processing flow after the integrity assessment method provided by the present invention is applied to a simulator and a test evaluation platform. Detailed Implementation

[0017] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0018] The satellite navigation application terminal integrity evaluation method proposed in this invention can effectively cope with the constraints of scenarios with multiple concurrent risk sources and difficulties in exciting fault amplitude, and can efficiently and confidently evaluate the integrity risk of satellite navigation application terminals. The technical solution of this invention will be further described in detail below with reference to the accompanying drawings.

[0019] like Figure 1 As shown, this invention provides a method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations, comprising the following steps:

[0020] Step S1) Determine the required excitation failure mode based on the occurrence probability of the failure mode of the risk source.

[0021] By utilizing known typical risk sources affecting satellite navigation application terminals, such as satellite ephemeris faults, atmospheric anomaly faults, multipath anomalies, and cycle slips, and comparing published or statistically available prior faults with the integrity risk indicators of the satellite navigation application terminal to be tested, the required excitation fault mode is determined. This fault mode refers to the satellite observation fault state caused by the anomaly of the risk source, and is therefore also called the risk source fault mode. The fault mode is determined to be a fault that occurs randomly on one or more satellites after combining the above-mentioned multiple risk sources. The probability of occurrence of the risk source fault mode under single-satellite fault is the prior fault probability of each risk source, and the probability of occurrence under multi-satellite fault conditions is the product of the prior fault probabilities after traversing the combination of satellites and risk sources. Risk sources include satellite ephemeris faults, atmospheric anomaly faults, multipath anomalies, cycle slips, etc., and a risk source (or fault) is simply represented as f. h ,

[0022]

[0023] The probability of a failure mode occurring can be expressed as:

[0024]

[0025] In formula (2) Indicates the probability of a failure mode occurring, with the subscript H. k (k = 1, 2, 3, 4) represent the fault modes. k = 1 represents the satellite ephemeris fault mode, k = 2 represents the atmospheric anomaly fault mode, k = 3 represents the multipath anomaly mode, k = 4 represents the cycle slip mode, and H0 represents the fault-free mode. Since the integrity risk caused by the fault-free mode is extremely low compared to the probability of the fault mode, it is not included in the test scope. f Indicates the number of satellites that malfunctioned; This indicates the probability of a single satellite's failure mode occurring. Indicates that on satellite x i (i = 1, 2, ..., n) s A fault occurred on f hThe probability is important to note; it is assumed here that each risk source (fault) has an equal probability of occurring on every satellite. Subsequent use... Indicates; n s Indicates the number of satellites involved in the positioning; N represents the probability of a multi-star failure mode occurring. sat,max This represents the maximum number of faulty satellites, which will be determined later in the process of identifying the risk source failure modes for which the required stimulus is needed.

[0026] Next, we need to determine the risk source failure modes that require incentives for the integrity assessment. The specific method for determination is as follows:

[0027] (1) Obtain the cumulative probability of occurrence of single-star failure mode to the cumulative probability of occurrence of multi-star failure mode.

[0028]

[0029] In equation (3), N sat,max N represents the maximum number of faulty satellites. total This represents the total number of failure modes that require incentives. Let n represent the number of combinations. s Indicates the number of satellites involved in the positioning, m f P represents the number of satellites that malfunctioned. fh This indicates that each satellite experienced a malfunction (f). h The probability, H represents the probability of a failure mode occurring. k (k = 1, 2, 3, 4) represents the failure mode. This indicates the probability of multiple star failure modes occurring. This represents the number of combinations.

[0030] (2) Since the sum of the calculated cumulative failure mode probabilities is greater than the probability of the benign risk failure event to be considered, conservative upper and lower boundaries are used to determine the maximum number of faulty satellites and the total number of failure modes that need to be stimulated, in order to simplify the calculation, the following description is given:

[0031]

[0032] In equation (4), N sat,max N represents the maximum number of faulty satellites. total P represents the total number of failure modes that require stimulation. IR Indicators representing the integrity risk of satellite navigation application terminals This indicates the probability of a failure mode occurring.

[0033] Step S2) Use the sum of prior failure probabilities of the failure modes that require stimulation to convert the integrity risk index into an equivalent false negative rate index, and at the same time determine the probability of occurrence of each failure mode in the test sample.

[0034] Based on existing classic integrity risk assessment models under known failure modes, the integrity risk index is transformed into an equivalent false negative rate index. By amplifying the test index, the required sample size can be significantly reduced. Considering that integrity risk failure events are mainly caused by failure modes, the classic integrity risk model under failure modes is transformed into an integrity risk testing model, specifically expressed as follows:

[0035]

[0036] In equation (5), P IR N represents the integrity risk indicator for satellite navigation application terminals. total The total number of failure modes that require stimulating, including single-star failure modes and multi-star failure modes. H represents the probability of a failure mode occurring. k (k = 1, 2, 3, 4) represents the failure mode; HMI represents a dangerous misleading information event, and its expression is:

[0037] HMI={PE|>AL,|t|<T} (6)

[0038] In Equation (6), PE is the positioning error of the satellite navigation application terminal, AL is the alarm limit for the precise approach phase, t is the test statistic of the satellite navigation application terminal integrity monitoring algorithm, and T is the corresponding test threshold.

[0039] By utilizing the sum of prior failure probabilities of the failure modes that require stimulation, the integrity risk index is transformed into an equivalent false detection rate index. The transformation method is as follows:

[0040]

[0041] In formula (7) This represents the equivalent false negative rate indicator, which is obtained by converting the integrity risk indicator into an equivalent false negative rate indicator by using the sum of the probabilities of failure modes.

[0042] By using the conversion formula (7), the index can be increased by at least 3 orders of magnitude, significantly reducing the number of samples required and greatly reducing the difficulty of index testing.

[0043] To ensure the probabilistic equivalence of integrity risk indicators, each precision approach test must result in one failure. Taking each precision approach as an integrity test sample, based on the completeness of failure mode occurrence probabilities and the mutual exclusivity of each failure mode, Bayes' theorem can be used to determine the probability of a single failure caused by each failure mode in the integrity test sample. That is, the probability of each failure mode in the integrity test sample is determined as follows:

[0044]

[0045] In formula (8) Represented as each failure mode H in the test sample k The probability of occurrence, i.e., the occurrence of failure mode H within a single integrity test precision approach. k The probability of.

[0046] Step S3) Determine the worst-case fault amplitude based on the worst-case fault criterion.

[0047] Due to the real-valued nature of fault amplitudes from risk sources and the fact that most faults can cause integrity failure events, the number of fault amplitudes is enormous, making traversal difficult. Therefore, when multiple satellites experience concurrent faults, a conservative assessment of integrity risk must be performed under worst-case fault conditions. The worst-case fault refers to the observable fault that maximizes the probability of the positioning error exceeding the positioning alarm limit and the fault detector failing. Worst-case faults include single-satellite worst-case faults and multi-satellite worst-case faults. Using worst-case faults effectively avoids traversing various fault amplitudes from different risk sources, thereby accelerating the integrity risk testing process.

[0048] Taking the LS estimator with least squares (LS) positioning estimation and the RB fault detector based on least squares residual (RB) as examples, the worst fault amplitude under conditions including single-star fault and multi-star fault is derived.

[0049] First, the decorrelation-free measurement model is constructed as follows:

[0050] y = Gx + v + f (9)

[0051] Where y is the observation, and in the RTK floating-point solution, y is 2n. s ×1 vector, y = n under RTK fixed solution s Let G be a ×1 vector, where G is the double-difference observation matrix after removing the correlation of the covariance matrix of measurement noise. In the RTK floating-point solution, G is 2n. s A matrix of size ×m, where G is n under a fixed RTK solution. s A ×3 matrix; v represents measurement noise. Let I be the variance of the observation error. n For n s ×n s Identity matrix; f is the fault amplitude vector; n s Let m be the number of satellites involved in the positioning, and m be the least squares estimated state.

[0052] Secondly, construct the failure mode H k The fault vector f k for:

[0053]

[0054] Where A k Indicates fault mode H k n below s ×r-dimensional faulty satellite matrix, faulty satellite matrix A k Containing only elements 0 representing satellite health and elements 1 representing satellite malfunction, n s The number of satellites participating in the positioning, r represents the number of faulty satellites; b k Let e ​​be an r×1 dimensional observation bias vector; k Represents an r×1 dimensional fault unit vector, characterizing the ratio between the observational biases of the faulty satellite; b k This represents the magnitude of the fault vector.

[0055] The maximum integrity risk caused by the worst-case failure vector can be expressed as:

[0056]

[0057] In equation (11), IR is the integrity risk index to be assessed, and PE k Fault mode H k The positioning error of the satellite navigation application terminal is AL, which is the alarm limit for the precise approach phase, and t. k Fault mode H k The test statistic for the integrity algorithm of satellite navigation application terminals is given below, where T is the corresponding test threshold and H is the test statistic. k Indicates the fault mode, f k Fault mode H k The fault vector is given below. The right side of equation (11) represents the maximum probability that the positioning error exceeds the positioning alarm limit and the fault detector fails, which is the maximum probability of a dangerous misleading information event (integrity failure event).

[0058] As can be seen from the worst-case fault expression, the maximum fault can be obtained by finding the worst-case fault unit vector and the worst-case fault magnitude.

[0059] The worst-case fault unit vector is the unit vector that maximizes the ratio of the location error to the test statistic, and can be expressed as:

[0060]

[0061] In formula (12) The worst-case unit fault vector represents the unit fault vector that introduces the greatest location error under the same test statistic value, thus making it highly susceptible to being missed by monitoring algorithms. k Represents an r×1 dimensional fault unit vector, PE k Fault mode H kThe positioning error of the satellite navigation application terminal under the following conditions, t k Fault mode H k The test statistic for the integrity algorithm of satellite navigation application terminals, A k Indicates fault mode H k n below s ×r-dimensional faulty satellite matrix, s T It is the transpose of s. It is the projection matrix from the measurement domain to the positioning domain. For n s A ×4 direction matrix, where column q is 1 and the rest are 0; p = I n -G(G T G) -1 G T It is the projection matrix from the measurement domain to the detection domain, In is the ns×ns identity matrix, and G is the double-difference observation matrix after removing the correlation of the measurement noise covariance matrix.

[0062] According to the Rayleigh quotient solution theory, when the matrix By obtaining the largest eigenvalue, the worst-case fault unit vector can be obtained. Specifically, it is expressed as follows:

[0063]

[0064] Where v max,k This indicates that in the eigenvector λ i,k Matrix (i = 1, 2, ..., r) Take the eigenvector corresponding to the largest eigenvalue.

[0065] Next, we calculate the worst-case fault amplitude. Given the worst-case fault unit vector, the worst-case fault amplitude can be expressed as:

[0066]

[0067] In formula (14) The worst-case fault amplitude is represented by Q(·), which represents the Gaussian tail distribution function. AL is the alarm limit for the precision approach phase. T A is the projection matrix from the measurement domain to the positioning domain. k Indicates fault mode H k n below s ×r-dimensional faulty satellite matrix Let b represent the worst-case unit vector of failures. k σ represents the magnitude of the fault vector, T represents the test threshold, and σ represents the magnitude of the fault vector. ε This represents the variance of the observation error. Indicates n degrees of freedom s -m, the decentralization parameter is The chi-square distribution.

[0068] The worst-case fault amplitude can be obtained by setting the upper and lower boundaries. It can generally be conservatively set to about 0 to 10m, that is, the lower boundary is 0 and the upper boundary is 10m.

[0069] Step S4) Based on the equivalent false negative rate index converted from the integrity risk index, construct a Type I / II error probability assessment model to quantify the confidence level.

[0070] To avoid inaccurate sample distribution characteristics due to testing with a small number of samples, which could lead to inaccurate assessment confidence, this invention employs a Type I / II error probability assessment model to quantify the assessment confidence, ensuring that the assessment confidence is accurate. The integrity risk of satellite navigation application terminals is assessed by comparing the missed samples with the assessment inspection threshold.

[0071] A missed sample refers to a test sample in which the positioning error PE of the satellite navigation application terminal exceeds the alarm limit AL during the precise approach phase, and the test statistic t of the integrity monitoring algorithm is lower than the corresponding test threshold T, thus the satellite navigation application terminal does not issue an alarm. By determining whether a test sample is a missed sample, the number of missed samples among all test samples can be counted. Since the LS estimator and RB fault detector are used, it can be determined that the test statistic of the satellite navigation application terminal is independent of the positioning error, and therefore the test samples are independent of each other. During the evaluation, if the number of missed samples is less than or equal to the preset allowable number of missed samples, the test passes, indicating that the integrity risk index of the satellite navigation application terminal is qualified; otherwise, the test fails, indicating that the integrity risk index of the satellite navigation application terminal is unqualified. Specifically:

[0072]

[0073] In equation (15), TS represents a pass, TF represents a fail, and n MD This represents the number of samples that were missed, and N represents the evaluation threshold, which is the preset number of samples that can be missed.

[0074] Therefore, the confidence level can be represented by Type I / II error probabilities: Type I error probability refers to the probability that the actual false alarm rate of the satellite navigation application terminal does not exceed the preset false alarm rate but the test fails, representing the assessment of false alarm risk; Type II error probability refers to the probability that the actual false alarm rate of the satellite navigation application terminal exceeds the preset false alarm rate but the test passes, representing the assessment of false alarm risk. Since the test samples are independent of each other, they can be considered to follow a binomial distribution. Therefore, the Type I / II error probability assessment model is expressed as:

[0075]

[0076] In equation (16), P typeILet P be the probability of a Type I error. typeII Here, α represents the probability of a Type I error, and β represents the probability of a Type II error that must be met. Both α and β are generally below 5%. This is the equivalent false negative rate indicator converted from the integrity risk indicator. represents the actual false negative rate of the satellite navigation application terminal to be tested. The actual false negative rate is unknown in advance, and whether it meets the equivalent false negative rate index is determined by formula (15); TS indicates that the test is passed, which means that the equivalent false negative rate index is met; TF indicates that the test is failed, which means that the equivalent false negative rate index is not met; N represents the evaluation test threshold; NIS represents the number of independent test samples. This represents the number of combinations.

[0077] When the evaluated P typeI or P typeII The lower the value, the higher the confidence level of the assessment.

[0078] By controlling the probability of Type I errors to be no higher than α and the probability of Type II errors to be no higher than β, the reliability of the integrity assessment can be guaranteed.

[0079] Step S5) Determine the number of test samples to be collected and the evaluation threshold based on the Type I / II error probability assessment model.

[0080] To simplify the calculation of Type II error probability, the false negative rate is typically set to K times the false negative rate index. Therefore, the test sample size and the evaluation threshold must meet the following conditions:

[0081]

[0082] In equation (17), L(NIS,N,2α) represents the lower confidence limit of the Clopper-Pearson exact confidence interval, U(NIS,N,2β) represents the upper confidence limit of the Clopper-Pearson exact confidence interval, NIS represents the number of independent test samples, and n MD The value represents the number of missed samples, N represents the evaluation threshold, the lower confidence limit is a function of NIS, N, and α, and the upper confidence limit is a function of NIS, N, and β. This is the equivalent false negative rate indicator converted from the integrity risk indicator.

[0083] The required number of test samples and the evaluation threshold are determined by setting upper and lower bounds for the traversal. The lower and upper bounds of the required number of test samples are generally the equivalent false negative rate indicators. The upper bound of the test sample size is 1e4, and the lower bound is 333, for example, when the equivalent false negative rate index is 1e-4. The evaluation threshold is generally set to 1 and should not exceed the test sample size. The evaluation test threshold is generally traversed from 1 to the required number of test samples. The specific operation is as follows: (1) Input the lower limit value of the number of test samples as the starting value of the test sample number traversal; (2) Traverse the evaluation test threshold from 1 to the traversal value of the number of test samples; (3) During the traversal of the evaluation test threshold, if the number of test samples and the evaluation test threshold meet the condition formula (17), then select the number of test samples and the evaluation test threshold at this time and stop the traversal; if the condition formula (17) is not met, then increase the number of test samples used as the traversal value by a unit step and jump to (2). The unit step is usually set to 5; (4) If the number of test samples increases to the upper limit value and the evaluation test threshold is traversed from 1 to the upper limit value of the number of test samples, and there is still no number of test samples and the evaluation test threshold that meet the condition formula (17), then it indicates that the requirements are not met and α or β needs to be relaxed, and jump to (1) to start again.

[0084] Step S6) Randomly select multiple test locations globally, determine the number of test samples for each test site, and inject the worst-case fault into the test samples used at each test site.

[0085] The global (Earth) area is divided into a grid of K°×K°, and N is randomly selected. station Each grid intersection point is a test site, and the number of test samples for each test site is determined as follows:

[0086] n single =ceil(n MD / N station (18)

[0087] In equation (18) n single This represents the number of test samples required for each test site, and ceil(·) represents the floor function. MD N represents the number of samples that were missed during testing. station This indicates the number of test sites.

[0088] Using a single precision approach (e.g., 150 seconds for civil aviation applications) as a test sample, the worst-case fault is injected into each test sample according to the occurrence probability of each fault mode determined in step S2. The occurrence probability of the fault mode corresponding to the worst-case fault is determined according to the method provided in step S2, for example, selecting fault mode H corresponding to the worst-case fault. k The probability is The fault injection is a step-type fault, with an amplitude equal to the worst-case fault amplitude, and the duration is selectable within the approach time period. Worst-case faults are injected into the test samples at other test locations in the same manner.

[0089] By injecting worst-case faults into the test samples, including using worst-case fault amplitudes, the problem of extremely low probability of occurrence of risk source faults and difficulty in exciting multi-star faults is solved, which greatly reduces the difficulty of testing.

[0090] Step S7) Collect test samples generated by satellite navigation application terminals and assess whether the integrity risk of satellite navigation application terminals meets expectations.

[0091] The short-term positioning error and alarm flag data of the satellite navigation application terminal during a single precision approach are used as a test sample. The required number of test samples generated by the satellite navigation application terminal, as determined in step S4, are collected. Based on the equivalent missed detection rate index after integrity risk conversion, and according to the definition of missed detection samples in step S4, it is determined whether the collected test samples are missed detection samples. The number of missed detection samples among all test samples is counted, and compared with the evaluation and inspection threshold determined in step S4 to determine whether the integrity risk of the satellite navigation application terminal meets expectations: if the number of missed detection samples is less than or equal to the preset allowable number of missed detection samples, the inspection passes, indicating that the integrity risk index of the satellite navigation application terminal meets expectations; otherwise, the inspection fails, indicating that the integrity risk index of the satellite navigation application terminal does not meet expectations.

[0092] Appendix Figure 2 The illustration schematically shows the process of applying the integrity assessment method provided by the present invention to a multi-system satellite navigation simulator and integrity testing and evaluation equipment.

[0093] The above description, in conjunction with specific embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, several simple deductions or substitutions can be made without departing from the concept of the present invention, and all such deductions or substitutions should be considered to fall within the scope of protection defined by the claims submitted herein.

Claims

1. A method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations, comprising: Step S1) Determine the required excitation failure mode based on the occurrence probability of the failure mode of the risk source; Step S2) Use the sum of prior failure probabilities of the failure modes that need to be stimulated to convert the integrity risk index into an equivalent false negative rate index, and at the same time determine the probability of occurrence of each failure mode in the test sample. Step S3) Determine the worst-case failure amplitude based on the worst-case failure criterion; Step S4) Based on the equivalent false negative rate index converted from the integrity risk index, construct a Type I / II error probability assessment model to quantify the confidence level; Step S5) Determine the number of test samples to be collected and the evaluation threshold based on the Type I / II error probability assessment model; Step S6) Randomly select multiple test sites globally, determine the number of test samples for each test site, and inject the worst-case fault into the test samples used at each test site; Step S7) Collect test samples generated by satellite navigation application terminals and assess whether the integrity risk of satellite navigation application terminals meets expectations.

2. The method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 1, wherein in step S1, the fault modes include: Satellite ephemeris faults, atmospheric anomaly faults, multipath anomalies, and cycle slips, among which... Indicates various failure modes; The method for determining the probability of a risk source failure mode is as follows: Under single-satellite failure, the probability of a risk source failure is the prior failure probability of each risk source; under multi-satellite failure, the probability of a risk source failure is the product of the prior failure probabilities after traversing the combination of satellite and risk source elements, specifically expressed as: ， in Indicates the probability of a failure mode occurring, with the subscript H. k The values ​​represent the fault modes: k = 1 indicates a satellite ephemeris fault mode, k = 2 indicates an atmospheric anomaly fault mode, k = 3 indicates a multipath anomaly mode, and k = 4 indicates a cycle slip mode. This indicates the probability of a single satellite's failure mode occurring. Indicates the number of satellites that malfunctioned. Indicates in satellite The probability of a failure occurring, i = 1, 2, …, Because the probability of each fault occurring is the same on every satellite, therefore Simplified to , This indicates the probability of multiple star failure modes occurring. Indicates the number of satellites involved in the positioning process. This indicates the maximum number of faulty satellites.

3. The method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 2, wherein in step S1, the method for determining the risk source fault mode to be excited is as follows: (1) Obtain the probability of occurrence of cumulative single-star failure mode to the probability of occurrence of cumulative multi-star failure mode. ， in Indicates the maximum number of faulty satellites. This represents the total number of failure modes that require incentives. Represents the number of combinations. Indicates the number of satellites involved in the positioning process. Indicates the number of satellites that malfunctioned. This indicates that each satellite has malfunctioned. The probability, H represents the probability of a failure mode occurring. k This represents the fault mode, where k = 1, 2, 3, 4. This indicates the probability of multiple star failure modes occurring; (2) Based on the fact that the sum of the calculated cumulative failure mode occurrence probabilities is greater than the probability of the goodness risk failure event to be considered, the maximum number of faulty satellites and the total number of failure modes that need to be stimulated are determined: ， in Indicates the maximum number of faulty satellites. This represents the total number of failure modes that require incentives. Indicators representing the integrity risk of satellite navigation application terminals This indicates the probability of a failure mode occurring.

4. The method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 1, wherein in step S2, the method for converting the integrity risk index into an equivalent missed detection rate index includes: ， in This represents the equivalent false detection rate indicator, which is derived from the integrity risk indicator by using the sum of the probabilities of occurrence of failure modes. H represents the total number of failure modes that require stimulation. k Indicates the fault mode. Indicators representing the integrity risk of satellite navigation application terminals The HMI represents the probability of a failure mode occurring, and is expressed as a dangerous misleading information event. ， in AL represents the positioning error of the satellite navigation application terminal, t represents the alarm limit for the precise approach phase, T represents the test statistic of the satellite navigation application terminal integrity monitoring algorithm, and T represents the corresponding test threshold.

5. The method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 1, wherein in step S2, the method for determining the probability of occurrence of each fault mode in the test sample is as follows: based on the completeness of the probability of occurrence of fault modes and the mutual exclusivity of each fault mode, the probability of occurrence of a single fault caused by each fault mode in a single precision approach is determined using Bayes' theorem: ， in Represented as each failure mode H in the test sample k The probability of occurrence, The total number of failure modes that require incentives. H represents the probability of a failure mode occurring. k Indicates the fault mode.

6. A method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 1, wherein in step S3, the worst-case fault refers to an observed fault that maximizes the probability of the positioning error exceeding the positioning alarm limit and the fault detector failing, including single-satellite worst-case faults and multi-satellite worst-case faults, and the step of determining the amplitude of the worst-case fault includes: First, obtain the worst-case fault unit vector, and then use the worst-case fault unit vector to obtain the worst-case fault amplitude.

7. The method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 6, wherein: The method for finding the worst-case fault unit vector is to find the unit vector that maximizes the ratio of the location error to the test statistic, specifically expressed as: ， in Let e ​​represent the worst-case unit vector of failures. k Represents an r×1 dimensional fault unit vector. Fault mode H k Positioning error of satellite navigation application terminals under the following conditions Fault mode H k The test statistic for the integrity algorithm of satellite navigation application terminals, A k Indicates fault mode H k n below s ×r-dimensional faulty satellite matrix It is the projection matrix from the measurement domain to the positioning domain. For n s A ×4 directional matrix, where column q is 1 and the rest are 0; It is the projection matrix from the measurement domain to the detection domain, I n For n s ×n s identity matrix The double-difference observation matrix after removing the correlation of the measurement noise covariance matrix; According to the theory of finding the maximum Rayleigh quotient, when the matrix When the largest eigenvalue is obtained, the worst-case fault unit vector can be acquired, represented as: ， in In the eigenvector In the matrix, i = 1, 2, ..., r, the matrix is... Take the eigenvector corresponding to the largest eigenvalue.

8. The method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 7, wherein: The method for obtaining the worst-case fault magnitude using the worst-case fault unit vector is as follows: ， in The worst-case fault amplitude is represented by Q(·), which represents the Gaussian tail distribution function, and AL is the alarm limit for the precision approach phase. A is the projection matrix from the measurement domain to the positioning domain. k Indicates fault mode H k n below s ×r-dimensional faulty satellite matrix Represents the worst-case unit vector. The magnitude of the fault vector is represented by T, and the test threshold is represented by T. This represents the variance of the observation error. Indicates n degrees of freedom s -m, the decentralization parameter is The chi-square distribution; The worst-case fault amplitude is then obtained by setting upper and lower boundaries.

9. The method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 1, wherein the method for constructing the Type I / II error probability assessment model in step S4 is as follows: ， in For Type I error probability, Let α be the probability of a Type II error, β be the probability requirement of a Type I error that needs to be met, and β be the probability requirement of a Type II error that needs to be met. This is the equivalent false negative rate indicator converted from the integrity risk indicator. The value represents the actual false negative rate of the satellite navigation application terminal to be tested; N represents the evaluation test threshold; NIS represents the number of independent test samples; TS represents the test passed, which means that the number of false negative samples is less than or equal to the preset allowable number of false negative samples; TF represents the test failed, which means that the number of false negative samples is greater than the preset allowable number of false negative samples. Type I error probability refers to the probability that the actual missed detection rate of the satellite navigation application terminal does not exceed the preset missed detection rate and thus fails the test, which represents the assessment of false alarm risk; Type II error probability refers to the probability that the actual missed detection rate of the satellite navigation application terminal exceeds the preset missed detection rate and thus passes the test, which represents the assessment of missed detection risk. The lower the probability of a Type I error or a Type II error, the higher the confidence level of the assessment.

10. A method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 1, wherein in step S5, the method for determining the required number of test samples and the evaluation threshold based on the Type I / II error probability assessment model is as follows: the required number of test samples and the evaluation threshold are determined by setting an upper and lower bound for traversal, and the determined number of test samples and the evaluation threshold must satisfy the following condition formula: ， in This represents the lower confidence limit of the Clopper-Pearson exact confidence interval. This represents the upper confidence level of the Clopper-Pearson exact confidence interval, where NIS represents the number of independent test samples, n. MD The value represents the number of missed samples, N represents the evaluation threshold, the lower confidence limit is a function of NIS, N, and α, and the upper confidence limit is a function of NIS, N, and β. This is the equivalent false negative rate indicator converted from the integrity risk indicator.

11. A method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 10, wherein the method for determining the required number of test samples and the evaluation threshold by setting an upper and lower bound for traversal is as follows: Step a) Input the lower bound value of the number of test samples as the starting traversal value of the number of test samples; Step b) Traverse the evaluation threshold from 1 to the traversal value of the number of test samples; Step c) During the traversal of the evaluation threshold, if the number of test samples and the evaluation threshold satisfy the condition formula, select the current number of test samples and the evaluation threshold, and stop the traversal; if the condition formula is not satisfied, increase the number of test samples used as the traversal value by one unit step, and jump to step b); Step d) If the number of test samples increases to the upper bound value and the evaluation threshold traverses from 1 to the upper bound value of the number of test samples, and there is still no number of test samples and the evaluation threshold satisfying the condition formula, relax the α value or β value, and jump to step a) to start again.

12. The method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 10, wherein the lower bound of the number of test samples to be collected is the inverse of the equivalent missed detection rate index, and the upper bound of the number of test samples to be collected is 1 / 3 of the inverse of the equivalent missed detection rate index.

13. The method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 1, wherein in step S6, the method for determining the test sites and the number of test samples for each test site is as follows: dividing the globe into a grid of K°×K°, and randomly selecting N... station Each grid intersection point is a test site, and the number of test samples for each test site is determined as follows: ， in This indicates the number of test samples required for each test site, and ceil(·) is the rounding function. N represents the number of samples that were missed during testing. station This indicates the number of test sites.

14. The method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 1, wherein in step S6, the method for injecting the worst-case fault into the test sample used at each test station is as follows: taking a single precision approach as a test sample, injecting the corresponding worst-case fault into each test sample according to the probability of occurrence of the fault mode determined in step S2, and determining the probability of occurrence of the fault mode corresponding to the worst-case fault; the fault injection form is a step form, and the amplitude is the amplitude of the worst-case fault.

15. The method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations according to claim 1, wherein in step S7, the method for evaluating whether the integrity risk of the satellite navigation application terminal meets expectations is as follows: if the number of missed samples is less than or equal to the preset allowable number of missed samples, the test is passed, indicating that the integrity risk index of the satellite navigation application terminal meets expectations; otherwise, the test fails, indicating that the integrity risk index of the satellite navigation application terminal does not meet expectations.

16. A method for evaluating the integrity of a satellite navigation application terminal under multiple fault excitations as described in claim 9, 10, 13 or 15, wherein the missed sample refers to a test sample in which the positioning error of the satellite navigation application terminal exceeds the alarm limit for the precise approach phase and the test statistic of the integrity monitoring algorithm is lower than the corresponding test threshold, and therefore the satellite navigation application terminal does not alarm. Based on this definition, it is determined whether the collected test sample is a missed sample and the number of missed samples in all test samples is counted.

Images