System and method for delimiting satellite positioning solution integrity

Abstract

A method may include the steps of receiving a satellite signal, determining a monitor condition, determining monitor performance, determining a residual error magnitude, fitting the residual error magnitude, and determining a positioning solution, or a system may be configured to perform the steps of receiving a satellite signal, determining a monitor condition, determining monitor performance, determining a residual error magnitude, and determining a positioning solution.

Description

[0001] Cross - Reference to Related Applications

[0002] This application claims the benefit of U.S. Provisional Application No. 63 / 432,759, filed on Dec. 15, 2022, which is incorporated herein by reference in its entirety. Technical Field

[0003] The present invention generally relates to the field of GNSS positioning, and more particularly, to a new and useful system and method in the field of GNSS positioning. Brief Description of the Drawings

[0005] Figure 1 is a schematic representation of an embodiment of the method.

[0006] Figure 2 is a schematic representation of an example of determining the condition of a monitor.

[0007] Figure 3 is a schematic representation of an example of iteratively determining bounds for different integrity risks.

[0008] Figure 4 is a schematic representation of an example of bounds for different integrity risks.

[0009] Figure 5 is a schematic representation of an example of fitting bounds for different integrity risks.

[0010] Figure 6 is a schematic representation of an example of determining bounds when using multiple monitoring chains.

[0011] Figure 7 is a schematic diagram of an example of the delimiter performance (and potential delimiter performance enhancement by unevenly distributing the probability of false alarms or misdetections among monitors) when using multiple monitors.

[0012] Figure 8 is a schematic representation of an exemplary minimum bound.

[0013] Figure 9 is a waterfall representation of an exemplary data flow in an example of the method.

[0014] Figure 10 is a schematic representation of an exemplary system.

[0015] Description of the Preferred Embodiment

[0016] The following description of the preferred embodiments of the present invention is not intended to limit the present invention to these preferred embodiments, but rather to enable any person skilled in the art to make and use the present invention.

[0017] 1. Overview

[0018] As Figure 1 shown, the method may include receiving a satellite signal S100, determining a monitor condition S200, determining a monitor performance S300, determining a deviation S400, fitting the deviation S500, and determining a positioning solution S600.

[0019] The method is preferably used to determine the protection level bounds of the positioning solution and / or the bounds of GNSS correction values generated by a GNSS correction value generator. The bounds (e.g., correction value bounds, protection level bounds, etc.) may depend on the integrity risk, the application of the positioning solution (e.g., usage, the manner in which the GNSS receiver is mounted to, connected to, etc., an external system), the integrity monitor condition (e.g., the number of satellites in view, the number of satellite constellations in view, satellite geometry, the number of reference receivers (e.g., base stations providing satellite observations), one or more monitor models, etc.), the probability of missed detection of an error (or other event of concern or predefined event), the probability of false alarm, the availability of the GNSS positioning solution, and / or based on any suitable information. However, the method may additionally or alternatively function in any way.

[0020] Embodiments of the system and / or method may be used for, for example, autonomous or semi-autonomous vehicle guidance (e.g., for unmanned aerial vehicles (UAVs), unmanned aircraft systems (UASs), autonomous vehicles, agricultural equipment, robots, rail transportation / conveyance systems, autonomous trucking, last mile delivery, etc.), GPS / GNSS research, surveying systems, user equipment, mobile applications, Internet of Things (IoT) devices, and / or may be used for any other suitable application. In a specific example, the system (and / or components) may be coupled to any suitable external system, such as a vehicle (e.g., UAV, UAS, car, truck, etc.), a robot, a rail vehicle, a user equipment (e.g., a mobile phone), and / or any suitable system, and may provide positioning data, integrity data (e.g., protection level data), and / or other data to the system.

[0021] 2. Benefits

[0022] Variations of the technology may provide several benefits and / or advantages.

[0023] First, variations of the technology can enable determination of protection level bounds without extensively characterizing the probability distribution of error occurrences. For example, to achieve six sigma confidence, approximately one million data points are minimally required to characterize the true probability distribution (since six sigma refers to at most 3 errors per million events). Achieving lower integrity risks (e.g., integrity levels of 10 -7 / hour, 10 -8 / hour, 10 -9 / hour, etc.) would require correspondingly more data. The inventors have found that instead of extensively characterizing the true probability distribution, comparable performance can be achieved by determining bounds on the error magnitude, which can be monitored with a target probability of missed detection of the error and a target (e.g., sufficiently small) probability of false alarm. For example, in some variations, the present invention can include providing bounds on the error that depend on the monitor condition (as opposed to bounds that are independent of the monitor or monitor condition).

[0024] Second, the inventors have found that μ and σ can be used as optimization parameters rather than being regarded as physical parameters representing the mean and standard deviation of a bounded (e.g., overbounded) distribution representing the actual error chain distribution. By treating μ and σ as optimization parameters, they can address different integrity risks and / or can avoid one penalizing the other due to flag messages or checks (e.g., the constraints on risk are covered by a single monitor and / or a single flag message channel). Additionally, treating μ and σ as optimization parameters can be beneficial because going beyond the bounds of the actual error chain distribution can be costly and difficult to do (e.g., because of the need to reference products, because of the necessary amount of reference data, requirements for analysis tools, etc.).

[0025] Third, variations of the technology can enable a single set of bounded parameters to be sent to GNSS receivers with different integrity requirements (and scaled to the correct integrity risk). For example, the same bounds can be sent to GNSS receivers with different IRs (and / or for determining the protection levels of GNSS receivers with different IRs), such as a first GNSS receiver with a target integrity risk of approximately 10 -4 / hour and a second GNSS receiver with a target integrity risk of approximately 10 -8 / hour. Relatedly, rather than monitoring GNSS correction values for multiple different integrity risk allocations, monitoring GNSS correction values for multiple different allocated integrity risks can be enabled by generating bounds represented by a fitting function (and not being significantly overconservative, e.g., not more than about 1.1 times, 1.05 times, 1.01 times, 1.005 times, or other suitable multiples of a more accurate bound for a particular allocated integrity risk, particularly but not exclusively, when the fitting function is within a restricted integrity risk range (e.g., 10-4 per hour to 10 -8 / hour) when effective).

[0026] However, variants of the technology can confer any other suitable benefits and / or advantages.

[0027] 3. System

[0028] The system is preferably used to perform a method (e.g., as described below). However, the system can additionally or alternatively be used to determine GNSS receiver positioning solutions (e.g., position, velocity, higher-order derivatives of position with respect to time, etc.) and / or can act in other ways.

[0029] For example, as Figure 10 shown, the system can include a computing system. The system can optionally include one or more GNSS receivers, one or more sensors, and / or any suitable components. The computing system can include, for example, a correction value generator, one or more integrity monitors (e.g., correction value monitor, correction value checker, etc.), a fusion engine (e.g., for fusing positioning solutions derived from satellite signals with positioning solutions derived from IMMU sensors or other positioning sources, such as the fusion engines described in U.S. Patent Application No. 18 / 115,963, titled "SYSTEM AND METHOD FOR FUSING SENSOR AND SATELLITE MEASUREMENTS FOR POSITIONING DETERMINATION," filed on August 18, 2023, and / or U.S. Patent Application No. 18 / 073,304, titled "SYSTEM AND METHOD FOR FUSING DEAD RECKONING AND GNSS DATASTREAMS," filed on December 1, 2022, each of which is incorporated herein by reference in its entirety), a positioning engine, and / or any suitable components (e.g., positioning engine, integrity module, etc.).

[0030] The system can communicate with one or more data sources (e.g., satellites, reference stations, etc.). Examples of data sources include GNSS receivers (e.g., processors, computing systems connected to antennas), reference stations (e.g., base stations, monitor stations, etc., such as GNSS receivers typically located at fixed known positions), sensors, satellites, databases, and / or any suitable data source can be used.

[0031] The set of satellite signals can include orbital data, timestamps, range rate data, carrier phase data, pseudorange data, Doppler data, and / or any suitable data. The set of satellite signals can be associated with metadata (e.g., ephemeris) and / or any suitable data. The set of satellite signals can include satellite signals corresponding to satellites from one or more satellite constellations (e.g., Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), BeiDou Navigation Satellite System (BDS), Galileo, Indian Constellation Navigation (NavIC), Quasi-Zenith Satellite System (QZSS), GPS Aided Geo Augmented Navigation (GAGAN), etc.). The set of satellite signals can additionally or alternatively include any suitable data.

[0032] In a variation of the system, which receives information from more than one GNSS receiver (e.g., more than one antenna), each GNSS receiver can provide the same or different data (e.g., information associated with the same or different satellites, information associated with the same satellite epoch, etc.). For example, different GNSS receivers can be configured to receive satellite observations associated with one or more satellite constellations, one or more carrier frequencies (e.g., frequencies such as L1, L2, L5, E1, E5a, E5b, Eab, E6, G1, G3, B1, B2, B3, LEX, etc.) and / or corresponding to any suitable data.

[0033] The computing system is preferably used to execute all or part of a method (e.g., as described below) and / or process data received by one or more GNSS receivers and / or one or more sensors (e.g., satellite observations, reference station observations, sensor data, etc.), but may operate otherwise (e.g., generate operation instructions for an external system or rover based on a positioning solution). The computing system may: aggregate data (e.g., combine receiver satellite observations, reference station satellite observations, satellite correction values, and / or sensor data; reorganize receiver satellite observations, reference station satellite observations, and / or sensor data based on, e.g., timestamps, transmit times, receive times, etc.); filter data (e.g., to calculate state vectors, ambiguities (e.g., phase ambiguities), etc. associated with the data); determine GNSS correction values; monitor (e.g., check) GNSS correction values; combine GNSS correction values (e.g., when the correction values are monitored more than once); determine ambiguities in satellite observations (e.g., carrier phase ambiguities, such as floating point values, integer values, best integer equivariant, etc.); calculate the receiver position (e.g., based on the ambiguity, based on the relative pose between the GNSS receiver and / or sensors, etc.); calculate the external system position (e.g., based on the pose difference between the GNSS receiver and the external system reference point, based on the pose difference between the sensor and the external system reference point, etc.); correct data (e.g., correct satellite observations for clock errors, orbit errors, hardware biases, atmospheric delays, etc. based on, e.g., correction values received from a correction value service); detect faults (e.g., events of concern, predefined events, etc.); and / or process data in any other way. The computing system may be local (e.g., local to the rover, local to the GNSS receiver, local to an external system supporting the GNSS receiver, local to the reference station, local to the sensor, etc.), remote (e.g., cloud computing, server, networked, etc.), and / or distributed in other ways. Typically, different computing system components (e.g., correction value generator, correction value monitor, positioning engine, etc.) each operate on separate and different processors (e.g., microprocessors, CPUs, GPUs, TPUs, FPGAs / ASICs, etc.). However, one or more computing system components may operate on the same processor.

[0034] In a variant of the computing system, the computing system includes a correction value generator, one or more monitors, one or more delimiter modules (e.g., error module, bias module, REM module, etc.), one or more combiners, and / or a positioning engine (e.g., a client positioning engine, a positioning engine operating on a processor collocated with the GNSS receiver, etc.). However, the computing system may include any suitable components.

[0035] The correction value generator is preferably used to determine (e.g., estimate, calculate, generate, filter, identify, etc.) GNSS correction values, where the GNSS correction values can be used to determine (e.g., facilitate, improve determination, etc.) the GNSS receiver position solution (e.g., to achieve a target accuracy, such as an accuracy of 1 mm, 5 mm, 1 cm, 5 cm, 10 cm, 50 cm, 1 m, etc.; achieve a target integrity, such as a total integrity risk < 10 -8 / hour, 10 -7 / hour, 10 -6 / hour, 10 -5 / hour, etc.; and so on). However, the GNSS correction values can be used in other ways. The correction value generator is preferably implemented in a remote computing environment (e.g., in a cloud computing server). However, the correction value generator can be implemented in any suitable computing environment (e.g., distributed among different servers, distributed between a local computing system and a remote computing system, distributed in a local computing system, etc.). The GNSS correction values can include one or more of the following: satellite orbit correction values, satellite clock correction values, satellite code bias correction values, satellite phase bias correction values, atmospheric delays (e.g., ionospheric correction values such as slant total electron content (STEC) correction values, ionospheric gradients, second-order ionospheric delays, etc.; tropospheric delays such as hydrostatic delays, wet delays, etc.; and so on, which can be provided as gridded corrections, mapped corrections, etc.), gridded corrections (e.g., STEC residuals, tropospheric delays, etc., such as those disclosed in U.S. Patent Application No. 17 / 833,560, titled "SYSTEM AND METHOD FOR DETERMINING GNSS POSITIONING CORRECTIONS", filed on June 6, 2022, and / or U.S. Patent Application No. 18 / 117,879, titled "SYSTEM AND METHOD FOR PROVIDING GNSS CORRECTIONS", filed on March 6, 2023, each of which is incorporated herein by reference in its entirety), user range accuracy (URA) (e.g., information regarding the estimated accuracy of the correction values for each satellite or satellite constellation), correction points (e.g., the coordinates or grids of the correction points where the gridded corrections are valid, such as those disclosed in U.S. Patent Application No. 17 / 833,560, titled "SYSTEM AND METHOD FOR DETERMINING GNSS PROSITIONING CORRECTIONS", filed on June 6, 2022, and / or U.S. Patent Application No. 18 / 117,879, titled "SYSTEM AND METHOD FOR PROVIDING GNSS CORRECTIONS", filed on March 6, 2023, each of which is incorporated herein by reference in its entirety), and / or any suitable correction values (e.g., for any suitable error source).

[0036] The GNSS correction value generator may include a delimiting module. However, additionally or alternatively, the delimiting module may be separate from the GNSS correction value generator. The delimiting module is preferably used to determine the error bounds of the GNSS correction values. The delimiting module (e.g., its output) generally depends on the quality of the monitor (e.g., its sensitivity). However, the delimiting module may be independent of the quality of the monitor and / or may depend on any suitable information. The delimiting module generally operates in a remote computing environment (e.g., on a server, cloud computing, etc.). For example, the delimiting module may operate within the correction value generator (e.g., the correction value generator may include the delimiting module), as for example Figure 9 shown. However, the delimiting module may additionally or alternatively operate on a local computing system and / or be distributed in any manner (e.g., between different servers, between a local computing system and a remote computing system, etc.).

[0037] The inputs to the GNSS correction value generator (and / or its delimiting module) may include: satellite observations (e.g., received from one or more satellites tracked by one or more reference stations associated with one or more satellite constellations), monitor test statistics (e.g., the probability distribution of the test statistics), integrity risk allocation (which may depend on the GNSS receiver application, available data (e.g., available satellite signals), etc.), false alarm allocation (which may depend on the integrity risk, monitor quality, etc.), one or more missed detection allocations (which may depend on the integrity risk, monitor quality, etc.), the conditional distribution of the monitor (e.g., as for example Figure 2 shown), satellites in the field of view of the reference station providing the satellite observations to the monitor (e.g., predicted satellites based on the geographical locations of the reference station and the satellite orbits, actual satellites with received signals, etc.), and / or may include any suitable inputs.

[0038] The outputs from the correction value generator (and / or its delimiting module) may include: GNSS correction values, GNSS correction value errors, residual error magnitudes (e.g., "REM", sometimes referred to as bias), bounds, fitting functions or fitting coefficients associated with the fitting functions (e.g., for the bounds, such as a fit as a function of the integrity risk, which is also referred to as a delimiting function), and / or may generate any suitable outputs.

[0039] The GNSS correction values are preferably state space representation (SSR) correction values (e.g., where different error terms or correction value terms are modeled and distributed separately). However, the GNSS correction values can additionally or alternatively be observation state representation (OSR) correction values (e.g., where error terms are grouped together as observations such as for a virtual reference station, such as the OSR correction values derived from SSR correction values disclosed in U.S. Patent Application 18 / 079,640, titled "SYSTEM AND METHOD FOR CORRECTION SATELLITE OBSERVATIONS", filed on December 12, 2022, which is incorporated by reference in its entirety herein, etc.) and / or any suitable correction values.

[0040] In a first specific example, a correction value generator may generate GNSS correction values by processing satellite observations of each reference station in a set of reference stations to determine local (e.g., near the reference station) satellite delays (e.g., atmospheric delay, ionospheric delay, tropospheric delay, ionospheric gradient, total electron content, slant electron content, etc.) (e.g., using a PPP filter), combining the local satellite delays to generate a non-local (e.g., global, not spatially restricted, etc.) model of the satellite delays, and optionally generating tiled satellite delays and / or grid (or other distribution of points) satellite delays (e.g., tiled delays and / or grid delays as described in U.S. Patent Application No. 17 / 833,560, titled "SYSTEM AND METHOD FOR DETERMINING GNSS POSITIONING CORRECTIONS", filed on June 6, 2022, which is incorporated herein by reference in its entirety). In a second specific example, correction value generation may use a Gaussian model to generate GNSS correction values to process satellite observations from a set of reference station observations (e.g., in the manner described in U.S. Patent Application No. 17 / 554,397, titled "SYSTEM AND METHOD FOR GAUSSIAN PROCESS ENHANCED GNSS CORRECTIONS GENERATION", filed on December 17, 2021, which is incorporated herein by reference in its entirety). The covariance function of the Gaussian model may depend on the GNSS correction values to be determined, the target accuracy of the GNSS correction values, the target speed of generating the GNSS correction values, and / or may depend on any suitable aspect. Examples of covariance functions include: constant function, polynomial (e.g., linear, quadratic, piecewise smooth polynomial, etc.) function, white noise function, Kronecker delta (or Dirac delta function) function, squared exponential function, Ornstein-Uhlenbeck (e.g., Brownian) function (e.g., having a variable drift term depending on the current value of the process), Weiner function, Matérn function, Bessel function, periodic function, rational (e.g., rational quadratic) function, γ-exponential function, neural network covariance function, and / or any suitable covariance function. However, any covariance function may be used. In a variant of the second specific example, (e.g., in addition to as an alternative to the Gaussian process) other state estimators (e.g., Kalman filter, unscented Kalman filter, extended Kalman filter, etc.) may be used. However, the GNSS correction values may be determined in any way.

[0041] A monitor (e.g., a correction value monitor, an integrity monitor, a correction value checker, etc.) can be used to monitor correction values and / or satellite observation values (such as those used to generate correction values) for one or more predefined events (e.g., outliers, faults, error sources, etc.). The monitor typically operates in a remote computing environment (e.g., on a server, cloud computing, etc.). The monitor preferably operates on a processor separate from the correction value generator. However, the monitor can operate on the same processor as the correction value generator. In a variant including multiple monitors, each monitor preferably operates on a different processor. However, two or more of the multiple monitors can operate on the same processor (e.g., when the monitors are monitoring unrelated, uncorrelated, etc. events of concern). However, the monitor can additionally or alternatively operate on a local computing system and / or be distributed in any manner (e.g., between different servers, between a local computing system and a remote computing system, etc.).

[0042] The monitor can include a monitor for events of concern, an exception event monitor, a residual monitor, a range error monitor, a position error monitor, an observation value monitor, and / or any suitable monitor.

[0043] The inputs to the monitor can include: satellite observation values (e.g., satellite signals, satellite observation values from a set of reference stations for monitoring, satellite observation values different from those used for correction value generation, etc.), GNSS correction values (e.g., current GNSS correction values, previous GNSS correction values, verified GNSS correction values, GNSS correction values within a threshold time before becoming invalid, etc.), global information (e.g., satellite ephemeris), probabilities (e.g., probability assignments such as missed detection assignments, false alarm assignments, etc.), GNSS correction value bounds (e.g., residual error magnitudes, residual thresholds, delimiting functions, etc.), and / or any suitable inputs can be used.

[0044] Output from the monitor may include flags (e.g., indicating the validity or invalidity of GNSS correction values), and / or may generate any suitable output. The flags may be associated with specific errors, error groups, satellites, satellite constellations, and / or any suitable information. For example, a first flag (e.g., for each satellite) may be used to indicate whether to use or not use correction values for satellite orbits, clocks, biases (e.g., code bias, phase bias), a second flag may be used to indicate whether to use or not use correction values for ionospheric delay, and a third flag may be used to indicate whether to use or not use correction values for tropospheric delay (e.g., vertical hydrostatic delay, vertical wet delay). However, any suitable flags may be generated (e.g., a single flag for all correction values, separate flags for each correction value, a single flag for all atmospheric delays, a single flag for a satellite constellation, etc.).

[0045] In a particular example, the monitor may be configured to ensure (e.g., issue a "safe to use" flag when the following conditions are met, generate an alert or a "not safe to use" flag when the conditions are not met, etc.) that P(error > bound | NOT DNU) <= residual risk + IRallocation, where P(error > bound | NOT DNU) is the probability that the error (e.g., correction value error) exceeds the bound and no flag (e.g., alert) indicating that the error has exceeded the bound is issued, the residual risk is a potential constant such as a minimum risk (e.g., error caused by a fault), and IRallocation may be between a minimum and a maximum value (e.g., such as a random statistical error under fault-free conditions, which depends on the application of the GNSS receiver, may depend on the satellites in the field of view of the reference station providing satellite observations to the monitor, is related to or derived from a bounding function, etc., where the minimum and / or maximum value may be 10 -1 / h, 10 -2 / h, 10 -3 / h, 10 -4 / h, 10 -5 / h, 10 -5 / h, 10 -6 / h, 10 -7 / h, 10 -8 / h, 10 -9 / h, 10 -10 / h, values therebetween, etc.). The residual risk (for each satellite, each satellite constellation, each atmospheric effect, etc.) can be expressed as, for example, a probability of onset (e.g., the probability of an event or a fault starting), the probability of a predetermined event (e.g., a fault) being present at a given moment (which can be related to the probability of onset based on the duration of the predetermined event), and / or can be expressed in other ways. In some variants, the residual risk can be set to 0 (e.g., where IR allocation can consider both nominal and fault cases). In some variants, the monitor can simultaneously (e.g., without performing separate calculations for each value) determine whether P(error > bound | NOT DNU) <= residual risk + IR allocation for multiple IR allocation values. The minimum and maximum IR allocation values typically span at most about 4 orders of magnitude of the integrity risk (e.g., to optimize the impact on availability versus exceeding the error bound), e.g., between 10 -4 / h and 10 -8 / h. However, the minimum and maximum IR allocation values can span any suitable range of values.

[0046] The quality of the monitor (also referred to as condition, sensitivity, etc.) can refer to the ability of the monitor to determine with a confidence (e.g., probability) greater than a threshold that an error has occurred. However, this quality can be defined in other ways. The quality of the monitor can depend on the reference stations providing data to the monitor (e.g., the number of reference stations, the geographical distribution of the reference stations, the geometry of the satellites relative to the reference stations, the number of satellite constellations in the field of view of the reference stations, which satellite constellations provide data to the monitor, the epochs of the satellite observations transmitted to the monitor, the GNSS receivers at each monitor reference station, etc.), the data link (e.g., the data connection between data sources such as between the reference stations and the monitor, the latency in the data link, the data connection between the monitor and the mobile GNSS receiver, etc.), the correction validity time, the number of observations available to the monitor (e.g., the total number of satellite observations provided to the monitor, the number of observations associated with each satellite constellation, the number of observations associated with the frequency, etc.), and / or can depend on any suitable information.

[0047] In some variants (e.g., as, for example, Figure 6 or Figure 7As shown in [figure reference], the system may include multiple monitors. The multiple monitors are preferably independent (e.g., using different data sources, such as different sets of reference stations; using different data, such as satellite observations from different epochs, different satellite constellations, different satellites, different frequencies, codes, or carrier phases, etc.). However, the multiple monitors may be dependent on each other (e.g., using the same data, including subsets of shared data, etc.). As for example in Figure 7 As shown, different monitors may have different probability assignments (e.g., different false alarm probabilities, different miss detection assignments, etc.), which can be beneficial for improving the operation of the system (e.g., can produce better (e.g., smaller, tighter, more accurate, etc.) bounds than a naive (e.g., equal) distribution of probabilities). The distribution of probability assignments may depend on the number of monitors, the quality of the monitors, the satellite observations available to the monitors, the reference stations available to the monitors, the processor bandwidth available to the monitors, and / or any suitable data or information. For example, a higher false alarm probability may be assigned to a higher quality monitor relative to a lower quality monitor. However, the false alarm probabilities may be equally assigned (e.g., each chain may be assigned Pfa / 2) and / or may be assigned in any suitable manner. In another example, each monitor may have a miss detection assignment probability that depends on the condition of the corresponding monitor. The probability assignments may be determined in real-time or near real-time (e.g., dynamically determined, updated, etc.) and / or determined at any suitable timing. For example, the probability assignments may be determined based on simulations from a set of training data (e.g., a database of previous data; simulated satellite observations, such as using different reference stations, satellite geometries, satellite constellations, etc.). As an illustrative example, the miss detection probability may be assigned as IR req = P(error > bound & no alarm) ≥ P(error > bound).P MD (Int chain 1).P MD (Int chain 2), where P(error > bound) is the probability that the position error exceeds the bound (e.g., protection level), P MD (Int chain 1) is the miss detection probability assigned to the first monitor, and P MD (Int chain 2) is the miss detection probability assigned to the second monitor (e.g., assuming the miss detection probabilities of the two chains are independent events). In a variant of this example (as for example in Figure 8 As shown), IR pred may be assigned according to IR pred = P(error > bound) < 10 -2 / SV / h, which may be a loose minimum bound (and may be interpreted as requiring the bound to be "10 -2The " / h percentile" is large enough (and is typically a safety margin) because the actual margins (e.g., delimiter functions, false alarm driven thresholds, missed detection driven thresholds, etc.) are typically greater than this minimum margin. In another variation of this example, the IR pred can be assigned a prior probability of 1 for P(error > margin), which can be a conservative margin (e.g., resulting in a margin greater than necessary). In another variation of this example, IRreq can be modified to account for the probability of missed detection from two integrity chains that are related or otherwise not independent (e.g., including a PMD(int chain 1, int chain 2) term). However, the integrity risk assignment can be determined in any way.

[0048] When using multiple monitors, the computing system can include a combiner that can be used to combine the outputs from the multiple monitors. The combiner can use voting (e.g., between different monitor results), threshold testing (e.g., issuing a safe to use flag only when all monitors indicate that the corrected value can be safely used), using a weighted average of the monitor results, using an average of the monitor results, combining results based on monitor quality (e.g., weighting higher quality monitors more, excluding results from monitors with less than a threshold quality, etc.) to combine the outputs from the monitors, and / or can combine the outputs in any way. For example, the combiner can operate in the manner described in U.S. Patent Application No. 18 / 503,662, titled "SYSTEM AND METHOD FOR GNSS CORRECTION MONITORING", filed on November 7, 2023, which is incorporated herein by reference in its entirety.

[0049] 4. Method

[0050] As Figure 1 shown, the method can include receiving a satellite signal S100, determining monitor status S200, determining monitor performance S300, determining a deviation S400, fitting the deviation S500, and determining a positioning solution S600. The method is preferably performed by a system (e.g., the system described above), but can be performed by any suitable system. The method is preferably performed in real-time or near real-time (e.g., when a new satellite signal is observed, performing or repeating the method before a subsequent epoch; when a satellite signal is received; during using a GNSS receiver to determine the positioning solution of a mobile rover; etc.). However, the method can be performed with a delay and / or at any suitable timing.

[0051] Receiving one or more satellite observations S100 is preferably used for tracking, measuring (e.g., at one or more reference stations, at the GNSS receiver of a rover, etc.) and / or accessing one or more sets of satellite observations (e.g., carrier phase measurements, pseudorange measurements, code measurements, Doppler measurements, etc.) from one or more observed satellites. The satellite observations are preferably accessed or received by a computing system (e.g., a GNSS receiver computing system, a positioning engine, a fusion engine, a correction value generator, a correction value monitor, etc.), but can be accessed by any component. The satellite observations (and / or correction values) can be measured by a set of reference stations (e.g., monitor reference stations, correction value reference stations, etc.), mobile GNSS receivers, retrieved from a database (e.g., retrieving stored satellite observations; retrieving stored correction values; retrieving ephemeris; etc.), and / or can be received in other ways. S100 can include receiving Doppler measurement data, reference data, and / or any suitable data. The satellite observations can include signals from one or more satellite constellations. Each set of satellite observations preferably includes satellite observations associated with multiple satellite constellations. However, one or more sets of satellite observations can correspond to a single satellite constellation.

[0052] The method can optionally include determining GNSS correction values. However, additionally or alternatively, S100 can include receiving GNSS correction values (e.g., where the method can be used to determine bounds for GNSS correction value errors and / or monitor GNSS correction values) and / or can access GNSS correction values in other ways. Determining GNSS correction values is for determining (e.g., calculating, estimating, generating, etc.) GNSS correction values that can be used by a GNSS receiver when determining the GNSS receiver positioning solution. The GNSS correction values are preferably determined by a correction value generator (e.g., which operates on a cloud computing server, on a processor collocated with the GNSS receiver, on an external system processor, etc.). However, any suitable component can be used to determine the GNSS correction values. A set of reference station observations (e.g., a collection of one or more satellite signals received by one or more reference stations) is preferably used to determine the GNSS correction values. However, previously determined GNSS correction values, rover observations, sensor data, and / or any suitable data or information can be additionally or alternatively used to determine the GNSS correction values.

[0053] The GNSS correction values can include bias correction values (e.g., phase bias correction values, code bias correction values, true bias correction values, etc.), clock correction values, orbit correction values, atmospheric delays (e.g., ionospheric delays, tropospheric delays, etc.), antenna phase centers, solid earth tides, solid earth pole tides, ocean tide loads, and / or any suitable correction values.

[0054] A Kalman filter, Gaussian process, particle filter, and / or any suitable estimator can be used to determine GNSS correction values. For example, the GNSS correction values can be determined in the manner disclosed in U.S. Patent Application No. 17 / 554,397, titled "SYSTEM AND METHOD FOR GAUSSIAN PROCESS ENHANCED GNSS CORRECTIONS GENERATION," filed on December 17, 2021, and / or U.S. Patent Application No. 17 / 347,874, titled "SYSTEMS AND METHODS FOR DISTRIBUTED DENSE NETWORK PROCESSING OF SATELLITE POSITIONING DATA," filed on June 15, 2021, each of which is incorporated by reference in its entirety herein. However, the GNSS correction values can be determined in any manner.

[0055] Determining monitor condition S200 can be used to determine the condition or quality of a monitor and / or each monitor (e.g., in a variant including multiple monitors). S200 is preferably performed by a correction value generator (e.g., a delimiter module of the correction value generator). Additionally or alternatively, S200 can be performed by any suitable component (e.g., by an integrity monitor when the integrity monitor is used to generate bounds). Preferably, S200 is performed without directly receiving information from a reference station or other data source that provides information to and / or from the monitor. However, S200 can include receiving information from a reference station or other data source that provides information to and / or from the monitor.

[0056] The condition can be a numerical value (e.g., a normalized value between 0 and 1, a non-normalized value as shown, for example, Figure 7 in, a value associated with the number of satellites in the reference station's field of view (e.g., providing satellite observations to the monitor), a value associated with the geometry of the satellites in the reference station's field of view, etc.), a classification, a qualitative value (e.g., "good," "acceptable," "bad," "N / A," etc.), a dilution of precision (or derived therefrom), a conditional distribution of the monitor, and / or can have any suitable value or name. The quality of the monitor can depend on the application and / or usage of the GNSS receiver. As an illustrative example, a GNSS receiver with more stringent vertical protection level tolerance requirements can identify a monitor that receives a greater number of observations from a reference station with satellites near the overhead (e.g., elevation angles between approximately 70° and 90°) because the quality is higher than the same monitor would be rated for horizontal protection level requirements.

[0057] Preferably, the monitor condition is determined based on a reference station that provides satellite observations to the monitor (e.g., the number of reference stations, the geographical distribution of the reference stations, the number of satellites in the field of view of each reference station, the geometry of the satellites in the field of view of the reference station, etc.). However, the monitor condition can be determined additionally or alternatively in any way.

[0058] Determining the monitor condition can include determining the conditional distribution of the monitor based on the residual correction error. As, for example Figure 2 shown, the conditional distribution of the monitor can be determined for an unknown actual error distribution by observing the error at an epoch and determining the distribution of the monitoring metric centered on that error (e.g., the conditional distribution of the monitor). Generally, a Gaussian distribution is used. However, additionally or alternatively, a Cauchy distribution, a Lévy distribution, a Voight distribution, a generalized normal distribution, a logistic distribution, a Laplace distribution, a hyperbolic secant distribution, a Landau distribution, and / or other suitable distributions can be used. However, the conditional distribution of the monitor can be determined in any way. The conditional distribution can be determined by determining the average distribution of the observable error state distribution for the reference station observables, a linear distribution combination of the observable error state distribution for the reference station observables (e.g., weighted based on the line-of-sight vector between the satellite and the reference station, weighted based on a concerned event such as multipath or cycle slip, etc.), using simulations (e.g., Monte Carlo simulations) of the error distribution of the reference station (e.g., in different satellite configurations), and / or can be determined in other ways. Additionally or alternatively, the actual error distribution of the monitor can be determined and used (e.g., based on the characterization of the monitor to at least achieve the most stringent integrity risk to be fitted).

[0059] Determine a monitor threshold S300 for determining one or more thresholds, where the thresholds can be used to determine REM (e.g., in S400). S300 is preferably performed by a correction value generator (e.g., its delimiting module), but can be performed by any suitable component. The thresholds can depend on IR (e.g., the target IR, the IR allocation also stylized as IRallocation, etc.), the GNSS receiver application, the monitor quality, the monitor probability assignment (e.g., false alarm probability, miss detection probability, etc.), the conditional distribution of the monitor (e.g., as determined in S200), the actual error distribution of the monitor, the distribution of the residual error correction values (e.g., the assigned residual error correction values, such as IR pred = P(error > bound) < 10 -2The prior probability of 1 for / SV / h or P(error > bound); the actual residual error correction value; the overbound function of the actual residual error correction value, such as using a normal distribution, Cauchy distribution, Voigt distribution, logistic distribution, skew normal distribution, Platykurtic distribution, Leptokurtic distribution, etc. for modeling the distribution of the actual residual error correction value; and so on), and / or using any suitable information. In a variant using the false alarm probability, the false alarm probability is typically constant (e.g., for different users, for different integrity risks, etc.). However, the false alarm probability can vary (e.g., be different for different integrity risks).

[0060] As an illustrative example, the threshold (e.g., a threshold driven by the monitor false alarm probability) can be determined based on the convolution of the distribution of the residual correction error (e.g., IR pred = P(error > bound) < 10 -2 / SV / h) and the conditional monitor distribution (e.g., calculated directly based on this value, values weighted or scaled relative to this value, etc.). However, the threshold can be determined in other ways.

[0061] Determine REM S400 for determining REM ("residual error magnitude", also known as bias) for an integrity risk value for which the probability of missed detection assignment is met at the threshold (e.g., the false alarm threshold determined as in S300). S400 is preferably performed by a correction value generator (e.g., its delimiter module), but can be performed by any suitable component (e.g., by the monitor when the monitor generates the bound). For example, REM can be determined by comparing the area under the conditional (or actual) distribution between two limits (e.g., one limit can be REM, and the other limit can be the threshold, approximately infinity, a conservative bound, an aggressive bound, the P of the integrity risk md assignment, such as the area shown in Figure 3 etc.) (e.g., calculated by integrating the probability density function). However, REM can be determined in other ways.

[0062] Such as Figure 3 shown in, preferably S300 and S400 are iteratively (e.g., continuously) performed for each assigned integrity risk (e.g., between the minimum integrity risk and the maximum integrity risk) to determine the REM associated with each assigned integrity risk (such as Figure 4as shown). The iterations can be computed in parallel (e.g., simultaneously) or sequentially. The IR (integrity risk) can be distributed evenly (e.g., with a linear value of the IR, with a logarithmic value of the IR, etc.) or unevenly (e.g., with a greater density for regions that are more sensitive to changes in the IR, for regions that require a more accurate fit or to ensure bounds for overbounds, etc.). As an illustrative example, the REM can be determined for each integrity risk of 10 -4 / hour, 10 -5 / hour, 10 -6 / hour, 10 -7 / hour, and 10 -8 / hour. However, any suitable integrity risk can be evaluated. Preferably, each iteration is performed in the same manner. However, different iterations can be performed in different ways (e.g., using different conditional probability distributions, different probability assignments, etc.).

[0063] The REM fit S500 is preferably used to fit the REM as a function of the integrity risk to a fitting function, where the coefficients of the fitting function can be used, for example, to determine the protection level. Preferably, S500 is performed after S300 and S400 (e.g., after the iterations between S300 and S400 are completed). However, S500 can be performed at any suitable timing. S500 is preferably performed by a correction value generator (e.g., its delimiter module), but can be performed by any suitable component (e.g., any suitable component of a computing system, a monitor, etc.).

[0064] The REM fit is preferably constrained such that the fit extends beyond the bounds of all the computed REM values of the data (as shown, for example, in Figure 5 ). For example (e.g., for a linear fit), the REM fit can intersect exactly one or two REM values (where the other REM values are below the fit). Although overbounds can result in bounds that are too conservative for some integrity risks, it ensures safety for all integrity risks. However, the REM fit can be constrained to achieve a constant false alarm probability (e.g., for all integrity risks), a constant miss detection probability (e.g., for all integrity risks), can be unconstrained (e.g., to achieve the best fit to the REM data, which may result in insufficient bounds for some integrity risks), and / or can be otherwise constrained or unconstrained.

[0065] Linear regression is preferably used to fit the REM (e.g., the REM is fit to a line (as shown, for example, in Figure 5as shown in etc.). However, REM can additionally or alternatively use non - linear regression (e.g., fitting to a polynomial of order greater than 1, such as a parabola, cubic function, quartic function, etc.; fitting to an exponential function; fitting to a logarithm; fitting to a rational function; fitting to a power function; etc.), use logistic regression (e.g., fitting to a sigmoid function) for fitting and / or can be fitted in any suitable manner. The fitting can use a least - squares model (e.g., linear least - squares, non - linear least - squares, weighted least - squares, etc.), least absolute deviation, mean square error, errors - in - variables model, multivariate least - squares, and / or use any suitable evaluation criterion or method to evaluate (e.g., optimize). The fitting coefficients can be referred to as, for example, μ and σ, which satisfy REM(IR) ≤ μ + K(IR).σ for any IR value between the minimum IR and the maximum IR, and where K(IR) is a scaling factor depending on the integrity risk (e.g., integrity risk allocation, target integrity risk, integrity risk depending on the application of the GNSS receiver, etc.). K(IR) can depend on the assumed probability distribution function (e.g., the conditional probability distribution function for the monitor). As an illustrative example (for a two - tailed distribution), where ppf is the percentile function or the reciprocal of the cumulative distribution (e.g., K(IR) is the number of σ's or standard deviations equal to the target integrity risk of a normal distribution. For example, to determine REM in the range of 10 -4 / hour to 10 -8 / hour, K(IR) is between approximately 3.89 and approximately 5.74. However, K can additionally or alternatively be approximately 1.64, approximately 1.95, approximately 2.57, approximately 3.29, approximately 4.42, approximately 4.90, approximately 5.33, approximately 5.73, approximately 6.11, approximately 6.47, approximately 6.81, values or ranges between them, greater than 6.81 or less than 3.89. Although in some variants, μ and σ can be related to the mean and standard deviation or variance of a probability distribution (e.g., the probability distribution of exceeding the error distribution bounds), generally the μ and σ in this example are independent of the probability distribution (i.e., more accurately considered as offset and scaling or slope factors, and negative values can be achieved, etc.).

[0066] The method can include monitoring GNSS correction values (e.g., to determine whether the calculated correction value error is less than a threshold residual error magnitude (i.e., REM) in the case of a target miss - detection probability and false - alarm probability). Monitoring the GNSS correction values is preferably performed by an integrity monitor (e.g., operating on a cloud computing server, operating on a monitoring station, operating on a computing system collocated with the GNSS receiver, etc.), but can be performed by any suitable component (e.g., by the correction value generator).

[0067] Monitoring GNSS Correction ValuesPreferably, current GNSS correction values (e.g., the most recently generated GNSS correction values) and previous GNSS correction values (e.g., previous valid GNSS correction values) are monitored. For example, all GNSS correction values generated within a validity time window can be monitored. Monitoring both the current GNSS correction value and the previous GNSS correction value can provide the technical advantage of identifying abnormal behavior in components (e.g., satellites) that can invalidate the previous correction value (e.g., by setting a flag to NOT OK for the component when the error is greater than a threshold). However, only the current GNSS correction value can be monitored (which can facilitate or enable filtering, separating, isolating, etc., of GNSS correction values that can be safely used from those that are not, such as by altering GNSS correction value messages to include only safe GNSS correction values) and / or any suitable GNSS correction values can be monitored.

[0068] Preferably, a set of independent satellite observations is used to monitor the correction values (e.g., the monitoring satellite observations are preferably independent of the correction value satellite observations. For example, the monitoring satellite observations can be received at a different set of reference stations than the correction value satellite observations, the monitoring satellite observations can be received during a different epoch than the correction value satellite observations, the monitoring observations can have a different frequency than the correction value frequency (e.g., where the correction value frequency and / or the monitoring frequency can be converted between each other in a manner disclosed in U.S. Patent Application 18 / 241,542, titled "SYSTEM AND METHOD FOR DETERMINING GNSS CORRECTIONS", filed on September 1, 2023, which is incorporated by reference in its entirety), the monitoring observations can be associated with different satellites and / or satellite constellations relative to the generation of the satellite observations, and / or the monitoring satellite observations can be otherwise independent of the satellite observations. However, additionally or alternatively, interdependent satellite observations can be used to monitor the correction values (e.g., the monitoring satellite observations and the correction value satellite observations can include common satellite observations), a set of correction value satellite observations can include one or more satellite observations for monitoring the correction values (e.g., but not for determining the correction values), and / or any suitable satellite observations and / or other data can be used to monitor the correction values.

[0069] Monitoring GNSS correction values may include determining a residual value based on applying the GNSS correction value to monitored satellite observations, and comparing the residual (and / or other corrected reference station observations of reliability) to one or more thresholds (e.g., REM, delimiting functions, etc.). The threshold may be associated with an integrity bound (e.g., when the residual meets the threshold, the correction value may enable high-accuracy estimated position, integer-valued carrier phase ambiguity determination, intermediate data generation, etc.), a confidence level that the integrity bound can be achieved (e.g., the confidence level that the correction value can enable high-accuracy estimated position, integer-valued carrier phase ambiguity determination, intermediate data generation, etc.), and / or any suitable outcome.

[0070] When the residual is less than or equal to the threshold, the correction value may be transmitted to and / or used by the positioning engine (e.g., the reliability of the correction value may indicate that the correction value can be used safely, an estimated position and / or velocity with a target integrity will be generated, an "ok" integrity flag may be generated, a safe GNSS correction value may be transmitted, etc.). When the residual is greater than the threshold, the integrity monitor may: generate an integrity flag (e.g., a flag, an alert, "NOK", etc.) indicating that the correction value should not be used (e.g., a non-"ok" alert), generate an integrity flag indicating that using the correction value will likely result in a position estimate with an integrity or accuracy exceeding the target integrity or accuracy, generate an integrity flag indicating the integrity of the positioning solution that can be generated by using the GNSS correction value, and / or may generate and / or may use in any suitable manner any suitable integrity flag (e.g., not transmit to the positioning engine). The integrity flag (e.g., the flag) may be associated with a set of correction value validities, individual correction value data, a subset of the set of correction value validities, and / or any suitable correction value.

[0071] In some variations, monitoring GNSS correction values may include monitoring the change in the residual over time (e.g., to detect drift that may affect speed estimation). When the change in the residual over time is greater than a threshold, an integrity flag (e.g., a flag) may be generated indicating that the correction value should not be used (e.g., for speed estimation), an integrity flag may be generated indicating the estimated accuracy and / or integrity of the positioning solution generated by using the correction value, and / or any suitable integrity flag may be generated and / or the correction value may be used in any way (e.g., not transmitted).

[0072] S500 may include transmitting fitting coefficients (e.g., fitting functions, delimiter functions) to the GNSS receiver, transmitting a protection level to the GNSS receiver (e.g., determined in the manner described in S600), and / or may include any suitable means for providing REM to the GNSS receiver (e.g., as a fitting coefficient). S500 may optionally include transmitting GNSS correction values, age of integrity information (e.g., as described in and incorporated by reference in its entirety in U.S. Patent Application 18 / 491,167, titled "SYSTEM AND METHOD FOR DISTRIBUTED INTEGRITY MONITORING", filed on October 20, 2023), integrity flags, and / or other suitable information (e.g., reaching the positioning engine directly or indirectly (such as via a router, proxy, etc.)). The information may be transmitted in the same or separate messages (e.g., correction value message, integrity message, separate integrity message for each monitor, etc.).

[0073] Determining a positioning solution S600 is for determining the position (and / or higher-order derivative of the position over time or vector components thereof) of a (typically mobile) GNSS receiver. S600 is preferably executed by a local computing system (e.g., a positioning engine running on a processor collocated with the GNSS receiver), but may be executed by any suitable component (e.g., on a remote computing server).

[0074] The GNSS receiver positioning solution is preferably determined using corrected satellite observations (e.g., the positioning satellite observations received in S100 corrected using the correction values generated in S200), but may be determined using any suitable satellite observations (e.g., uncorrected satellite observations, differential satellite observations, etc.). The satellite observations may be pre-corrected (e.g., before a filter processes the satellite observations to determine the GNSS receiver positioning solution), corrected in an estimator (such as a Kalman filter, extended Kalman filter, unscented Kalman filter, particle estimator, Gaussian process, etc.; where the GNSS correction value may be an input to the estimator), and / or may be corrected in other ways.

[0075] The positioning solution is preferably determined using carrier phase (e.g., the carrier phase for ambiguity resolution), but may additionally or alternatively use pseudorange, Doppler, and / or any suitable satellite signal to determine. Determining the positioning solution may include determining the carrier phase ambiguity (e.g., to floating point precision, to integer precision, etc., such as disclosed in U.S. Patent Application No. 16 / 817,196, filed on March 12, 2020, titled "SYSTEMS AND METHODS FOR REAL TIME KINEMATIC SATELLITE POSITIONING" or in U.S. Patent Application No. 17 / 022,924, filed on September 16, 2020, titled "SYSTEMS AND METHODS FOR HIGH - INTEGRITY SATELLITE POSITIONING", each of these U.S. patent applications is hereby incorporated by reference in its entirety), determining a set of floating phase ambiguity hypotheses, determining a set of integer phase ambiguity hypotheses based on the set of floating phase ambiguity hypotheses, performing hypothesis testing to verify the set of integer phase ambiguity hypotheses, and / or any suitable steps.

[0076] S600 may include determining a protection level (e.g., where the positioning solution may be compared with the protection level to ensure that the GNSS receiver operates under safe conditions with at least a threshold probability). The protection level is typically determined on a local computing system, but may be determined on a remote computing system and / or using any suitable computing system. The protection level is preferably determined according to fitting coefficients (e.g., from S500, e.g., evaluated for a predetermined, application - specific, user - selected, etc. integrity risk) (e.g., bounds in the position domain; in contrast to bias or REM, the protection level typically refers to bounds in the range domain). However, the protection level may be determined based on any suitable information. In a first illustrative example, a bias propagation method may be used, e.g., according to to calculate the protection level. In a second illustrative example, sigma equivalents may be used, e.g., according to to calculate the protection level. In a third illustrative example, a less conservative propagation may be used, such as removing the average REM (e.g., average bias, such as ) propagation, and / or REM terms (e.g., fitted values) can be optimized for spreading in the position domain (e.g., rather than the range domain). However, the protection level can be determined in any way. In some variations, the protection level can be determined additionally or alternatively as disclosed in U.S. Patent Application 17 / 873,068, titled "SYSTEM AND METHOD FOR COMPUTING POSITIONING PROTECTION LEVELS," filed on July 25, 2022 (which is incorporated by reference in its entirety hereby).

[0077] In an illustrative example, the method can include: determining the conditional distribution of a monitor given a residual correction error; for each P md (IR) assignment, iteratively performing: using the convolution of the conditional distribution of the monitor and the distribution of the residual correction error to determine the monitor P fa (false alarm probability)-driven threshold (e.g., where the residual correction error does not need to be conservative as it affects the monitor's P fa ), and computing the residual error magnitude (REM) when the P md assignment is satisfied at the P fa -driven threshold to determine the bounds that can be checked for the P md assignment; and determining the fitting coefficients (μ and σ) such that for all IRs within the range, μ + K(IR).σ >= REM(IR). In a variation of this illustrative example, the P md for each integrity risk can be assigned according to IR req = P(error > bound & no alarm) >= P(error > bound).P MD (Int chain), and the integrity risk can be assigned as IR pred = P(error > bound) < 10 -2 / SV / h (e.g., to ensure that the bound or minimum bound is large enough relative to the 10 -2 / hour percentile). In this illustrative example, the fitting coefficients can be transmitted to a GNSS receiver, which can determine the protection level (e.g., for a target integrity risk based on the operation of the GNSS receiver).

[0078] However, the method can include any suitable steps or processes.

[0079] In a first illustrative example, a method can include receiving global navigation satellite signal (GNSS) correction values, determining a correction value monitor probability distribution associated with a correction value monitor, for each of a plurality of integrity risks: determining a false alarm probability driven threshold associated with the correction value monitor probability distribution, and determining a residual error magnitude such that a probability of missed detection is met at the false alarm driven threshold, and fitting the residual error magnitude with a bounding function greater than or equal to the residual error magnitude for each of the plurality of integrity risks. A variant of the method can further include generating, at the correction value monitor, a flag indicating whether the GNSS correction value error exceeds the bounding function. In a variant of this particular example, generating the flag can include: determining a residual between satellite observations received from a set of reference stations; and comparing the residual with a monitoring threshold derived from the bounding function; wherein when the residual is less than or equal to the monitoring threshold, the flag can indicate that the GNSS correction value does not exceed the bounding function, and wherein when the residual is greater than the monitoring threshold, the flag can indicate that the GNSS correction value exceeds the bounding function. In a variant of this particular example, the minimum residual error magnitude can be determined relative to the 10 -2 / hour percentile of the correction value monitor probability distribution. In a variant of this particular example, the bounding function can be a linear function of the form (residual error magnitude) ≤ μ + Kσ, where K is a constant that can depend on the target integrity risk. In a variant of this illustrative example, μ and σ can be transmitted to a positioning engine, where the method can further include, at the positioning engine: determining a bound associated with the GNSS correction value based on a target integrity risk associated with the positioning engine; determining a positioning solution of the GNSS receiver based on satellite observations tracked by the GNSS receiver; and comparing the positioning solution with the bound to determine whether the positioning solution meets a threshold probability for safe use. In a variant of this particular example, determining the positioning solution can include: using the GNSS correction values to correct satellite observations tracked by the GNSS receiver; and determining an integer-valued carrier phase ambiguity for the carrier phase of the satellite observations tracked by the GNSS receiver, wherein the positioning solution is determined based on the integer-valued carrier phase ambiguity. In a variant of this particular example, K can be restricted between 3.89 and 5.74. In a variant of this particular example, determining the correction value monitor probability distribution can include: predicting which satellites will be in the field of view of a reference station providing satellite observations to the correction value monitor; and determining the correction value monitor probability distribution based on the predicted satellites and a set of events of concern. In a variant of this particular example, the GNSS correction values and the bounding function are determined by a correction value generator, where the correction value generator operates on a processor separate from the correction value monitor. In a variant of this particular example, the GNSS correction values can include state space representation correction values for satellite clock error, satellite code bias, satellite carrier bias, satellite orbit error, and atmospheric delay.

[0080] In a second specific example, a system for determining GNSS correction values and bounds may include: a correction value generator and an integrity monitor. The correction value generator is configured to determine GNSS correction values based on a set of satellite observations received from a set of reference stations, and to determine bounds associated with the GNSS correction values; and the integrity monitor is configured to determine whether the GNSS correction values exceed the bounds with a probability greater than the integrity risk assigned for the GNSS correction values to exceed the bounds; wherein, the correction value generator is configured to determine the bounds based on the ability of the integrity monitor to monitor the prediction of the GNSS correction values. In a variant of the second specific example, the system may include a positioning engine configured to determine a GNSS receiver position by processing a set of satellite observations corrected using the GNSS correction values. In a variant of the second specific example, processing the set of satellite observations may include determining the integer-valued carrier phase ambiguity of the set of satellite observations. In a variant of the second specific example, the correction value generator and the integrity monitor may be implemented on a cloud processor remote from the GNSS receiver, and wherein the positioning engine may be implemented on a processor collocated with the GNSS receiver. In a variant of the second specific example, the GNSS correction values may include state space representation correction values for satellite clock errors, satellite code biases, satellite carrier biases, satellite orbit errors, and atmospheric delays. In a variant of the second specific example, the bounds may be determined as a linear function according to bounds ≤ μ + Kσ, where K is a constant depending on the target integrity risk. In a variant of the second specific example, K may be limited between 3.89 and 5.74. In a variant of the second specific example, the correction value generator may be configured to determine the GNSS correction values using a Gaussian process that operates without combining satellite observations. In a variant of the second specific example, the correction value generator may be configured to generate a minimum bound based on the 10 -2 percentile of the integrity monitor probability distribution per hour.

[0081] As used herein, "substantially" or other approximating words (e.g., "about", "approximate", etc.) may be within a predetermined error threshold or tolerance of a measurement, component, or other reference (e.g., within 0.001%, 0.01%, 0.1%, 1%, 5%, 10%, 20%, 30%, etc. of the reference), or may be otherwise interpreted.

[0082] The methods of the preferred embodiments and their variations can be at least partially embodied and / or implemented as a machine that is configured to receive a computer-readable medium storing computer-readable instructions. The instructions are preferably executed by computer-executable components integrated with a system for GNSS PVT generation. The computer-readable medium can be stored on any suitable computer-readable medium (such as RAM, ROM, flash memory, EEPROM, optical devices (CD or DVD), hard disk drives, floppy disk drives, or any suitable device). The computer-executable components are preferably general or special-purpose processors, but any suitable special hardware or hardware / firmware combination device can alternatively or additionally execute the instructions.

[0083] Embodiments of the system and / or method can include every combination and permutation of various system components and various method processes, where one or more instances of the methods and / or processes described herein can be executed asynchronously (e.g., sequentially), simultaneously (e.g., in parallel), or in any other suitable order by and / or using one or more instances of the systems, elements, and / or entities described herein.

[0084] As those skilled in the art will recognize from the foregoing detailed description as well as from the drawings and claims, modifications and changes can be made to the preferred embodiments of the present invention without departing from the scope of the present invention as defined in the appended claims.

Claims

1. A method, comprising: receiving global navigation satellite signal (GNSS) correction values; determining a correction value monitor probability distribution associated with a correction value monitor; for each of a plurality of integrity risks: o determining a false alarm probability-driven threshold associated with the correction value monitor probability distribution; o determining a residual error magnitude such that a probability of undetected error is satisfied at the false alarm-driven threshold; and fitting the residual error magnitude with a bounding function that is greater than or equal to the residual error magnitude for each of the plurality of integrity risks.

2. The method according to claim 1, further comprising generating, at the correction value monitor, a flag indicating whether a GNSS correction value error exceeds the bounding function.

3. The method according to claim 2, wherein, generating the flag comprises: determining a residual between satellite observations received from a set of reference stations; and comparing the residual with a monitoring threshold; wherein, when the residual is less than or equal to the monitoring threshold, the flag indicates that the GNSS correction value does not exceed the bounding function, and wherein, when the residual is greater than the monitoring threshold, the flag indicates that the GNSS correction value exceeds the bounding function.

4. The method according to claim 1, wherein, Determine the minimum residual error magnitude based on the 10 -2 / hour percentile of the calibration value monitor probability distribution.

5. The method according to claim 1, wherein, the bounding function is a linear function of the form (residual error magnitude) ≤ μ + Kσ, where K is a constant depending on a target integrity risk.

6. The method according to claim 5, wherein, μ and σ are transmitted to a positioning engine, and wherein the method further comprises, at the positioning engine: determining a bound associated with the GNSS correction value based on a target integrity risk associated with the positioning engine; determining a positioning solution of the GNSS receiver based on satellite observations tracked by the GNSS receiver; and comparing the positioning solution with the bound to determine whether the positioning solution meets a threshold probability for safe use.

7. The method according to claim 6, wherein, determining the positioning solution comprises: using the GNSS correction value to correct the satellite observations tracked by the GNSS receiver; and determining an integer-valued carrier phase ambiguity for a carrier phase of the satellite observations tracked by the GNSS receiver, wherein the positioning solution is determined based on the integer-valued carrier phase ambiguity.

8. The method according to claim 5, wherein, K is limited between 3.89 and 5.

74.

9. The method according to claim 1, wherein, determining the correction value monitor probability distribution comprises: predicting which satellites will be in the field of view of a reference station providing satellite observations to the correction value monitor; and determining the correction value monitor probability distribution based on the predicted satellites and a set of concerned events.

10. The method according to claim 1, wherein, the GNSS correction value and the bounding function are determined by a correction value generator, and wherein the correction value generator operates on a processor separate from the correction value monitor.

11. The method according to claim 1, wherein, the GNSS correction values include state - space representation correction values for satellite clock error, satellite code bias, satellite carrier bias, satellite orbit error, and atmospheric delay.

12. A system for determining GNSS correction values and bounds associated therewith, comprising: a correction value generator configured to: o determine the GNSS correction values based on a set of satellite observations received from a set of reference stations; o determine bounds associated with the GNSS correction values; and an integrity monitor configured to determine whether the GNSS correction values exceed the bounds with a probability greater than the integrity risk assigned for the GNSS correction values to exceed the bounds; wherein, the correction value generator is configured to determine the bounds based on the ability of the integrity monitor to monitor predictions of the GNSS correction values.

13. The system according to claim 12, further comprising a positioning engine configured to determine a GNSS receiver position by processing a set of satellite observations corrected using the GNSS correction values.

14. The system according to claim 13, wherein, processing the set of satellite observations includes determining an integer - valued carrier phase ambiguity of the set of satellite observations.

15. The system according to claim 13, wherein, the correction value generator and the integrity monitor are implemented on a cloud processor remote from the GNSS receiver, and wherein the positioning engine is implemented on a processor collocated with the GNSS receiver.

16. The system according to claim 12, wherein, the GNSS correction values include state - space representation correction values for satellite clock error, satellite code bias, satellite carrier bias, satellite orbit error, and atmospheric delay.

17. The system according to claim 12, wherein, the bounds are determined as a linear function according to bounds ≤ μ + Kσ, where K is a constant depending on the target integrity risk.

18. The system according to claim 17, wherein, K is restricted between 3.89 and 5.

74.

19. The system according to claim 12, wherein, the correction value generator is configured to determine the GNSS correction values using a Gaussian process operating without combining satellite observations.

20. The system according to claim 12, wherein, The correction value generator is configured to generate a minimum bound based on the 10 -2 / hour percentile of the integrity monitor probability distribution.

Images