Method and device for detecting and excluding a satellite failure

Abstract

The present invention relates to a method and a device for detecting and excluding a satellite failure. In particular, the proposed method comprises a step consisting of identifying (S300) a faulty satellite Sx among the set of satellites S1,…,SN, this step (S300) comprising for at least one satellite Sj assumed to be faulty: a step consisting of configuring (S320) an additional Kalman filter FA from a Kalman filter Fsk excluding a satellite Sk distinct from the satellite Sj assumed to be faulty and of which a satellite failure indicator Rsk is maximum; a step consisting of resetting (S330) the additional filter FA, this additional filter FA excluding the satellite Sj assumed to be faulty; and a step consisting of determining (S350) whether the satellite Sj is faulty according to a satellite failure indicator RA of the additional filter FA calculated after a determined duration (TE). Figure for abstract: Fig. 5

Description

Title of the invention: Method and device for detecting and excluding a satellite failure Technical field

[0001] The present invention relates to the field of satellite navigation, also known as GNSS navigation for "Global Navigation Satellite System" in English. In particular, the present invention relates to a method and a device for detecting and excluding a satellite failure. It also relates to a navigation system, a mobile device, and a computer program. The present invention finds a particularly advantageous, although in no way limiting, application for the implementation of navigation systems for aircraft, ships, or land vehicles. Prior art

[0002] The present invention falls, in particular, within the context of hybrid inertial-GNSS navigation. To determine the navigation data of a mobile such as an aircraft, a hybrid inertial-GNSS navigation system combines inertial data from an inertial measurement unit and pseudo-distances provided by a satellite positioning receiver. The pseudo-distances, also called "pseudo-ranges" in English, characterize the distances between the mobile and the visible satellites of a constellation. A hybrid inertial-GNSS navigation system uses a hybridization algorithm, generally based on a Kalman filter, to combine the data from the different sensors and take advantage of their respective benefits. The use of the pseudo-distances associated with the satellites makes it possible in particular to compensate for the inertial navigation drift.

[0003] Some applications require that navigation systems comply with strict integrity constraints. In the field of aeronautics, the reliability of navigation data is critical. The navigation systems used must be able to determine the position of an aircraft with a given integrity risk, i.e. with a defined probability (for example, 10 7) that the position error is greater than a protection radius (an alert terminal) without triggering an alert. In the case of a hybrid inertial-GNSS navigation system, the failure of a satellite affects the pseudo-distance relative to this satellite, in particular in the form of a bias, a drift or an acceleration. The failure of a satellite can thus lead to significant errors in the estimated position of the mobile, and these errors tend to increase over time.It is therefore essential to be able to detect a possible satellite failure and exclude the faulty satellite to guarantee the integrity of the navigation system.

[0004] To detect and exclude a satellite failure, it is known to use a bank of Kalman filters in which each of the filters excludes the pseudo-distance relative to a satellite. Patent EP2411832B1 illustrates such a solution. For each of the filters in the bank, a satellite failure indicator is calculated using cross-innovation of the filter, i.e. using the difference between the pseudo-distance to the satellite in question provided by the satellite positioning receiver and an estimate of this pseudo-distance provided by the filter excluding this satellite. These satellite failure indicators generally make it possible to detect and exclude a satellite failure. For example, the satellite associated with the highest satellite failure indicator and exceeding a certain detection threshold can be identified as being the faulty satellite.

[0005] However, the reliability of existing solutions is not fully satisfactory. These may erroneously exclude a functional satellite instead of the faulty satellite. Such exclusion errors occur in particular in the case of poor geometric configurations of the satellite constellation, characterized by a significant horizontal dilution of precision coefficient (or "Horizontal Dilution Of Precision" in English). For example, such exclusion errors may occur when few satellites are visible, or when these are located close to the horizon.

[0006] There is therefore a need for a solution for reliably identifying a faulty satellite among a set of satellites. Presentation of the invention

[0007] The present invention aims to remedy all or part of the drawbacks of the prior art, in particular those set out above.

[0008] According to one aspect of the invention, a method is proposed implemented by a device comprising a plurality of Kalman filters Fsb.. .,FsN, each filter Fs i determining navigation data of a mobile from pseudo-distances relating to a set of satellites Si,...,SN with the exception of satellite Si, the method comprising a step consisting of identifying a faulty satellite Sx among the set of satellites Si,.. .,SN, this step comprising for at least one satellite Sj assumed to be faulty: - a step consisting of configuring an additional Kalman filter FA (also called arbiter sub-filter) from the filter Fsk excluding a satellite Sk distinct from the satellite Sj assumed to be faulty and of which a satellite failure indicator Rsk is maximum (among the plurality of filters Fsb...,FsN with the exception of the filter Fsj associated with the satellite Sj assumed to be faulty); - a step consisting of (partially) resetting the additional filter FA, this additional filter FA excluding the satellite Sj assumed to be faulty; and - a step consisting of determining whether the satellite Sj (assumed to be faulty) is faulty based on a satellite failure indicator RA of the additional filter FA calculated after a determined duration (also called quarantine period).

[0009] The present invention makes it possible to reliably identify a faulty satellite Sx among a set of satellites Si,.. .,SN. To do this, it is proposed to use at least one additional Kalman filter FA (independent of the filters Fsb.. .,FsN) to simulate the exclusion of a supposedly faulty satellite Sj. This makes it possible to test a quarantine hypothesis to confirm or invalidate the supposed failure of a satellite Sj. We present here the operating principle of the present invention by considering a single additional filter FA, but several additional filters can be used.

[0010] The steps of the proposed method, mentioned above, are notably implemented following the detection of a satellite failure (for example, if one or more satellite failure indicators of the filters Fsb...,FsN are greater than a threshold). To simulate the exclusion of a satellite Sj assumed to be faulty, an additional Kalman filter Fa is used. More precisely, the additional filter FA is configured from the filter Fs k excluding the satellite Sk (distinct from the satellite Sj assumed to be faulty) and whose satellite failure indicator Rsk is maximum. This additional filter FA does not use the pseudodistance relative to the satellite Sj assumed to be faulty which is placed in quarantine. The filter Fa is reset to ensure rapid convergence of its states.

[0011] At the end of a quarantine period, the satellite failure indicator RA of the additional filter FA is evaluated to confirm or deny the supposed failure of the satellite Sj. For example, if the satellite failure indicator RA has fallen below a certain threshold following the exclusion of the supposedly faulty satellite Sj, then the satellite Sj is indeed faulty. The satellite Sj can then be excluded so that the pseudodistance relating to it is no longer used for navigation, and the various filters can also be reset.

[0012] Compared to existing solutions, the present invention makes it possible to reliably identify a faulty satellite among a set of satellites, even in the case of poor geometric configurations of the satellite constellation. In other words, the present invention makes it possible to reduce the number of erroneous exclusions during satellite failures.

[0013] More particularly, it is appropriate to emphasize the advantages of the present invention compared to the solution described in patent EP2411832B1. In the latter, as soon as the cross-innovation associated with a satellite exceeds a certain threshold, this satellite is declared faulty so that the pseudo-distance associated with this satellite is no longer used by the navigation device filters, and these filters are reset. The cross-innovations of the different filters are then monitored for a predetermined period of time to confirm or deny the failure of the excluded satellite. If it turns out that the satellite declared to be faulty is not the failed satellite, then the navigation device filters have been wrongly reset, and they continue to be affected by the failure. In fact, when such an erroneous exclusion has been made, the filters have been reset using erroneous values. Thus, even if the cross-innovations of the different filters continue to be monitored thereafter, it is likely that the actually faulty satellite cannot be identified and excluded, given that the different filters will have been using erroneous values ​​for a significant period of time.In other words, it is particularly difficult to remedy an erroneous exclusion during a satellite failure.

[0014] Differently from the solution described in patent EP2411832B1, the present invention proposes to use an additional filter FA independent of the filters Fsi,...,Fsn to test a quarantine hypothesis and simulate the exclusion of a satellite assumed to be faulty. The present invention makes it possible to quickly determine whether the satellite assumed to be faulty is actually faulty. This therefore makes it possible not to reset the Kalman filters if it is determined that the satellite assumed to be faulty is not in fact faulty. In this way, the present invention advantageously makes it possible to guarantee that the navigation solution and the various filters of the device are not altered (in particular reset) until the failure of a satellite is actually confirmed. The present invention thus reduces the number of erroneous exclusions during satellite failures and contributes to guaranteeing the integrity of the navigation device.

[0015] It is important to note that the identification of the satellite Sj assumed to be faulty can be carried out by the device implementing the method, but can also be carried out on the basis of information provided by another device. In particular, the identification of the satellite Sj assumed to be faulty can be carried out on the basis of information provided by a device conforming to that proposed in patent application FR2303580.

[0016] According to one embodiment, a said satellite failure indicator is a cross-innovation ratio (or is determined from the cross-innovation).

[0017] It is proposed here to use the cross-innovation ratio as a satellite failure indicator. For a filter Fs; excluding the satellite Si, the cross-innovation ratio RS; is notably defined as the ratio of the cross-innovation of the pseudo-distance to the satellite S; to the variance of this cross-innovation. The cross-innovation of the pseudo-distance to the satellite Si corresponds to the difference between: the pseudo-distance to the satellite Si provided by the satellite positioning receiver, and an estimate of this pseudo-distance provided by the filter Fs;. The same applies to said at least one additional filter FA.

[0018] This embodiment is advantageous in that it allows a faulty satellite to be reliably identified, while ensuring minimal implementation complexity. On the one hand, the cross-innovation ratio is a reliable indicator of satellite failure, and the reliability thereof is even enhanced by the proposed solution. On the other hand, the use of the cross-innovation ratio as a satellite failure indicator helps to minimize the resources required (e.g., computing and memory resources, processing time, etc.) to implement the proposed solution.

[0019] Alternatively, embodiments could be envisaged in which other satellite failure indicators are used. For example, it could be envisaged to use a satellite failure likelihood ratio.

[0020] According to one embodiment, said step of identifying the faulty satellite Sx comprises said steps of configuring, resetting, and determining, only if several of the filters Fsi,.. .,FsN have satellite failure indicators greater than a threshold.

[0021] In this embodiment, said at least one additional filter FA is used only when several filters among the filters Fsi .. .,FsN have satellite failure indicators greater than a certain detection threshold.

[0022] If a single filter Fs; has a satellite failure indicator Rs; greater than the detection threshold, the satellite Si associated with the filter Fs; can be identified as being the faulty satellite Sx. However, when several filters have satellite failure indicators greater than the detection threshold, there is ambiguity as to the faulty satellite and several satellites are potentially faulty. Said at least one additional filter FA is then used to arbitrate between these potentially faulty satellites, by testing the chosen quarantine hypothesis. This makes it possible to reliably identify the faulty satellite.

[0023] Said at least one additional filter FA is used here only when it is necessary to arbitrate between several potentially faulty satellites. This embodiment therefore makes it possible to reliably identify a faulty satellite, while minimizing the resources required to implement the proposed solution.

[0024] Alternatively, embodiments could be envisaged in which said at least one additional filter FA is used each time a satellite failure is detected.

[0025] According to one embodiment, the satellite Sj assumed to be faulty corresponds to the satellite being associated with the filter Fsj of which a satellite fault indicator Rsj is maximum (among the plurality of filters Fsb.. .,FsN) and not having been previously assumed to be faulty.

[0026] In this embodiment, only one satellite Sj at a time is assumed to be faulty. This satellite is quarantined so that the pseudo-distance relating to it is no longer used by the filters Fsi,...,Fsn. The satellite Sj assumed to be faulty is the satellite associated with the filter FSj whose satellite failure indicator RSj is maximum and which has not already been quarantined. The satellite Sj is therefore the one that is most likely to be faulty. To simulate the exclusion of this single satellite Sj assumed to be faulty, a single additional filter FA is used. This makes it possible to confirm or invalidate the chosen quarantine hypothesis.

[0027] This embodiment thus makes it possible to reliably identify a faulty satellite among a set of satellites, while minimizing the resources required.

[0028] According to one embodiment, if the satellite failure indicator RA of the additional filter FA is lower than a threshold (after the determined duration), the satellite Sj assumed to be faulty is determined to be faulty; otherwise, another satellite Sj- (distinct from the satellite Sj) is assumed to be faulty, and said steps of configuring, resetting, and determining are repeated (for this satellite Sj).

[0029] This embodiment proposes to sequentially test the different quarantine hypotheses until the faulty satellite is identified.

[0030] As a reminder, the additional filter FA excludes the satellite Sj assumed to be faulty, which is quarantined. If, at the end of the quarantine period, the satellite failure indicator RA of the additional filter FA is lower than the threshold, this means that the additional filter FA is no longer affected by the satellite failure and that it excludes the faulty satellite Sx. The quarantine hypothesis is therefore correct: the satellite Sj assumed to be faulty and placed in quarantine does indeed correspond to the faulty satellite Sx. This satellite can therefore be excluded so that the pseudo-distance relating to it is no longer used, and the filters of the navigation device can be reset.

[0031] On the other hand, if the satellite failure indicator RA of the additional filter FA is greater than the threshold at the end of the quarantine period, this means that the quarantine hypothesis is incorrect: the satellite Sj assumed to be faulty and quarantined is in fact functional, and the satellite Sx actually faulty has not been quarantined. In this case, another satellite Sj' is assumed to be faulty and the steps of the method are repeated to simulate the exclusion of this satellite Sj. A new quarantine hypothesis is thus tested.

[0032] This embodiment thus contributes to reliably identifying the faulty satellite among the set of satellites.

[0033] According to one embodiment, several satellites Sj i,...,Sj M are assumed to be faulty, and several additional filters FA i,...,Fa M are configured and reset.

[0034] In this embodiment, several additional filters are used in parallel. This makes it possible to simultaneously test different quarantine hypotheses.

[0035] In fact, several satellites Sj b... ,Sj M are assumed to be faulty; and said steps of configuring, resetting, and determining are implemented simultaneously for these satellites Sj b... ,Sj M. Each additional filter FA m is used to test a quarantine hypothesis. The faulty satellite Sx is then identified based on the satellite failure indicators RA i,...,RA m of the additional filters FAi,...,F AM calculated after the quarantine period.

[0036] This embodiment is advantageous in that it makes it possible to identify, reliably and quickly, the faulty satellite among a set of satellites.

[0037] According to one embodiment, the satellite Sj m assumed to be faulty, for which the additional filter FA m has the minimum satellite failure indicator RA m (among the additional filters FA i,...,Fa M), is determined to be faulty.

[0038] We recall that the different additional filters FA i,...,FaM make it possible to test different quarantine hypotheses (i.e. to simulate the exclusion of different satellites). However, the additional filter associated with the correct quarantine hypothesis is the one that simulates the exclusion of the faulty satellite Sx. It will therefore present the lowest satellite failure indicator at the end of the quarantine period.

[0039] This is why the satellite Sx identified as faulty here corresponds to the satellite Sj m associated with the additional filter FA m whose satellite failure indicator RA m is minimum at the end of the quarantine period (the additional filter FA m simulates the exclusion of the satellite Sj m). This embodiment thus contributes to reliably and quickly identifying the faulty satellite among the set of satellites.

[0040] According to one embodiment, the satellites Sj i,...,Sj M assumed to be faulty correspond to the satellites associated with the filters FSj i,...,FSj M whose satellite failure indicators Rsj i,...,RSj M are greater than a threshold.

[0041] As mentioned previously, when several of the filters Fsi,...,Fsn have satellite failure indicators above the detection threshold, there is ambiguity as to which satellite is faulty. Several satellites are potentially faulty. In this embodiment, several additional filters FA i,...,Fa M are used to test different quarantine hypotheses in parallel, and quickly arbitrate between the potentially faulty satellites Sj i,...,Sj M. The number of additional filters used here corresponds to the number of filters FSj i,...,FSj M whose satellite failure indicators Rsj i,...,RSj M are above the detection threshold.

[0042] This embodiment thus makes it possible to achieve a particularly advantageous compromise between the speed of identification of the faulty satellite and the quantity of resources required (e.g. computing resources and memory) to implement the proposed solution. In other words, this embodiment makes it possible to reliably and quickly identify a faulty satellite among a set of satellites, while limiting the amount of resources required.

[0043] Alternatively, embodiments could be envisaged in which the number of additional filters used corresponds to the number of satellites in the set of satellites.

[0044] According to one aspect of the invention, there is provided a device comprising a plurality of Kalman filters Fsb.. .,FsN, each filter Fs; determining navigation data of a mobile from pseudo-distances relating to a set of satellites Si,...,SN with the exception of satellite Si, the device comprising a module configured to identify a faulty satellite Sx among the set of satellites Sb...,SN, this module being configured to: - configure an additional Kalman filter FA from the Fsk filter excluding a satellite Sk distinct from a satellite Sj assumed to be faulty and whose satellite fault indicator Rsk is maximum; - reset (partially) the additional filter FA, this additional filter FA excluding the satellite Sj assumed to be faulty; and - determine whether the satellite Sj (assumed to be faulty) is faulty based on a satellite failure indicator RA of the additional filter FA calculated after a determined duration.

[0045] The proposed device may be configured to implement any of the embodiments of a method according to the invention. In particular, for each step of a method according to the invention, the proposed device may comprise a module configured to implement this step.

[0046] In particular, the proposed device is a navigation device intended to be included in a navigation system on board a mobile (for example, an aircraft).

[0047] In addition to the filters Fsb.. .,FsN, the proposed device can comprise a Kalman filter FP (also called main filter) determining navigation data of the mobile from the pseudo-distances relative to the set of satellites Si,.. .,SN. It should be specified that the main filter FP uses the pseudo-distances relative to each satellite Si of the set of satellites Si,...,SN, provided that the satellite Si has not been excluded.

[0048] According to one aspect of the invention, there is provided a navigation system intended to be embedded in a mobile comprising: - a satellite positioning receiver configured to provide pseudo-distances relative to a set of satellites Si,...,SN; and - a device in accordance with the invention.

[0049] This navigation system may, for example, be mounted on an aircraft, a ship, or a land vehicle. It may further comprise an inertial measurement unit, comprising, for example, accelerometers and / or gyroscopes.

[0050] According to one aspect of the invention, there is provided a mobile machine comprising a navigation system according to the invention.

[0051] The proposed mobile device may be an aircraft, a ship, or a land vehicle.

[0052] According to one aspect of the invention, there is provided a computer program comprising instructions for implementing the steps of a method according to the invention, when the computer program is executed by at least one processor or computer.

[0053] The computer program may be formed of one or more sub-parts stored in the same memory or in separate memories. The program may use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0054] According to one aspect of the invention, there is provided a computer-readable information medium comprising a computer program according to the invention.

[0055] The information carrier may be any entity or device capable of storing the program. For example, the carrier may comprise a storage means, such as a non-volatile memory or ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a hard disk. Furthermore, the storage medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by a telecommunications network or by a computer network or by other means. The program according to the invention may in particular be downloaded onto a computer network. Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

[0056] The proposed device, navigation system, aircraft, computer program, and information medium have the advantages described above in connection with the proposed method. Brief description of the drawings

[0057] Other features and advantages of the present invention will become apparent from the description provided below, illustrating given embodiments of the invention. as an example and without any limiting character, with reference to the attached drawings:

[0058] [Fig.l] represents the hardware architecture of an aircraft according to an embodiment of the invention;

[0059] [Fig.2] represents the functional architecture of a device according to an embodiment of the invention;

[0060] [Fig.3] represents steps of a method according to an embodiment of the invention for detecting a satellite failure and excluding the faulty satellite;

[0061] [Fig.4] represents steps of a method according to an embodiment of the invention for detecting a satellite failure; and

[0062] [Fig.5] represents steps of a method according to an embodiment of the invention for identifying a faulty satellite. Description of the embodiments

[0063] The present invention applies, in particular, to navigation systems for aircraft. The following description of the invention will refer to this particular context of application, which is given only as an illustrative example and should not limit the invention. The latter applies to navigation for any type of carrier, mobile machine, or vehicle.

[0064] [Fig.l] represents the hardware architecture of an aircraft according to an embodiment of the invention. This figure is described below to introduce the present invention and to exemplify a context of application thereof.

[0065] The aircraft AC illustrated in [Fig.l] is equipped with a navigation system SYS. In the context of the invention, the term "aircraft" designates any device capable of rising and moving in the air, such as an airplane, a helicopter, a drone, etc.

[0066] The SYS navigation system comprises: an inertial measurement unit IMU; a GNSS satellite positioning receiver; and an APP navigation device.

[0067] The inertial measurement unit IMU is configured to provide inertial increments INC to the navigation device APP. This IMU unit comprising accelerometers and gyroscopes, the increments INC correspond to speed increments and angular increments.

[0068] The GNSS receiver is configured to receive signals emitted by a set of satellites Si,.. .,SN. These satellites belong, for example, to the satellite constellation of the GPS system, or the Galileo system. The GNSS receiver is configured to determine, from the signals received from the satellites Si,.. .,SN, the pseudo-distances PR between the satellites Si,.. .,SN and the GNSS receiver (i.e. the receiver). It provides these pseudo-distances PR to the navigation device APP. We also use the expression “pseudo-distance relative to a satellite S ,» to designate the pseudo-distance between the satellite Si and the GNSS receiver and let us denote this pseudo-distance pp.

[0069] The navigation device APP is configured to determine navigation data NAV of the aircraft AC. By "navigation data", we mean data relating to the position, and / or the movement of the aircraft AC, such as geographic coordinates (e.g. latitude, longitude, altitude), speed, attitudes. This navigation data NAV can for example be provided to a guidance device CMD of the aircraft AC (e.g. an automatic pilot device).

[0070] The APP navigation device here implements a hybrid inertial-GNSS navigation solution. It determines the NAV navigation data of the aircraft AC using both the pseudo-distances PR provided by the GNSS satellite positioning receiver, and the inertial increments INC provided by the inertial measurement unit IMU.

[0071] Within the scope of the invention, other embodiments could also be envisaged in which other forms of hybridization are used. For example, data from additional sensors, such as a barometer or a camera, could be used.

[0072] The APP navigation device is further configured to detect a satellite failure and / or exclude a faulty satellite from the set of satellites Si,...,SN. We will present in more detail the manner in which the APP device detects a satellite failure and excludes a faulty satellite, with reference to the following figures.

[0073] The hardware architecture of the APP device is illustrated by [Fig.l]. According to this embodiment, the APP device comprises: at least one processing unit or processor PROC; and at least one memory MEM.

[0074] According to one embodiment, the APP device has the hardware architecture of a computer. The memory MEM constitutes an information medium in accordance with the invention, on which a computer program PROG in accordance with the invention is recorded. The program PROG comprises instructions for carrying out steps of a method in accordance with the invention, when the program PROG is executed by the processor PROC. The program PROG defines the functional modules of the APP device represented in [Fig.2], which rely on or control the hardware elements of this device.

[0075] As illustrated by [Fig.l], the APP device has a communication module COM configured to communicate with: the GNSS receiver, the inertial measurement unit IMU, and / or the guidance module CMD. No limitation is attached to the nature of the communication interfaces between these devices.

[0076] We have presented above the hardware architecture of the APP navigation device. We now describe its functional architecture with reference to the following figure.

[0077] [Fig.2] represents the functional architecture of a device according to an embodiment of the invention. This figure illustrates the operation of the APP navigation device.

[0078] As mentioned previously, the APP navigation device is configured to determine NAV navigation data of the aircraft from the inertial increments INC provided by the inertial measurement unit IMU and the pseudo-distances PR provided by the GNSS receiver. According to the embodiment of [Fig.2], the APP device comprises the following modules: a virtual platform PFV (or inertial navigation module); a hybridization module HBD; and an EXCL module for detecting and excluding satellite failures.

[0079] It should first be noted that the architecture of the APP device proposed here is based on that of the device presented in patent EP2411832B1. However, the APP device proposed here differs from the device described in patent EP2411832B1 in several points, and in particular by its use of at least one additional Kalman filter FA (also called arbiter filter). It should also be emphasized that the EXCL module for detecting and excluding satellite failures proposed in the present application uses said at least one additional Kalman filter FA. Thus, the implementation of the EXCL module proposed here differs from the implementation of the satellite failure detection and exclusion module previously proposed in patent EP2411832B1.

[0080] We briefly present below the functions of the different modules of the APP device. Concerning the implementation details of some of these modules, it is also possible to refer to patent EP2411832B1, and to the references cited therein.

[0081] The virtual platform PFV is configured to determine inertial navigation data NAV_INS from the INC increments provided by the inertial measurement unit IMU. The virtual platform PFV may further use the NAV navigation data determined by the hybridization module HBD (for example, to compensate for inertial navigation drift).

[0082] The EXCL module is configured to detect a satellite failure and / or exclude the faulty satellite. It provides the HBD hybridization module with all or part of the pseudo-distances PR delivered by the GNSS receiver depending on the satellites identified as functional or faulty. If a satellite Si is identified as faulty (i.e. if it is excluded), the EXCL module receives the pseudo-distance pp relating to this satellite, but does not provide it to the HBD hybridization module. We will detail the operation of the EXCL module with reference to Figures 3 to 5.

[0083] The HBD hybridization module is configured to determine NAV navigation data of the aircraft AC from the inertial navigation data NAV_INS provided by the virtual platform PFV and the pseudo-distances PR provided by the EXCL module. The HBD module thus implements an inertial-GNSS hybridization.

[0084] As mentioned above, embodiments of the invention could be envisaged in which other forms of hybridization are used. For example, the hybridization module could also use data from additional sensors, such as a camera, or a barometer.

[0085] To implement the inertial-GNSS hybridization, the HBD hybridization module includes (implements) several Kalman filters: a so-called main FP filter, and so-called secondary filters Fsi,...Fsn (or sub-filters). The main FP filter uses all the pseudo-distances PR provided by the EXCL module. It thus uses the pseudo-distances relative to all the satellites Si,...,SN (we consider here that no satellite has been excluded). The FP filter develops a main inertial-GNSS hybrid navigation solution.

[0086] On the other hand, the secondary filters Fsb.. .,FsN use only a part of the pseudoranges PR. Each secondary filter F; determines navigation data using: the inertial navigation data NAV_INS; and the pseudo-ranges relative to the set of satellites Si,.. .,SN with the exception of satellite Si. In other words, a secondary filter Fs; uses the pseudo-ranges {prb...,prN}\{pr;}. We designate the secondary filter Fs; as being associated with satellite Si. The secondary filters Fsb ...,FsN develop secondary hybrid inertial-GNSS navigation solutions.

[0087] The HBD hybridization module further comprises at least one additional Kalman filter FA (also called arbiter sub-filter). This additional filter FA also develops a hybrid inertial-GNSS navigation solution. As we will detail later, this filter FA is used by the APP device to identify the faulty satellite Sx following the detection of a satellite failure.

[0088] However, before detailing the use of the additional filter FA, we present the general operation of the EXCL module with reference to [Fig.3] and the detection of a satellite failure with reference to [Fig.4].

[0089] [Fig. 3] represents steps of a method according to an embodiment of the invention for detecting a satellite failure and excluding the faulty satellite. This figure illustrates the operation of the EXCL module for detecting and excluding satellite failures.

[0090] As illustrated by [Fig.3], the EXCL module implements all or part of the illustrated steps S100 to S400 described below.

[0091] In step S100, the EXCL module obtains the pseudo-distances PR provided by the GNSS receiver. It also obtains all or part of the NAV navigation data from the HBD hybridization module.

[0092] In step S200, the EXCL module detects the presence or absence of a FLT satellite failure. To do this, it uses the pseudo-distances PR relating to the satellites Sb...,SN provided by the GNSS receiver and the NAV navigation data determined by the various filters of the HBD hybridization module. The implementation of step S200 is detailed with reference to [Fig.4].

[0093] As illustrated by [Fig.3], if an FLT satellite failure is detected, then the method continues to step S300; otherwise, the method repeats steps S100 and S200.

[0094] In step S300, following the detection of a satellite FLT failure, the EXCL module identifies the faulty satellite Sx among the set of satellites Si,...,SN. The implementation of step S300 is detailed with reference to [Fig.5].

[0095] In step S400, the EXCL module excludes the satellite Sx identified as faulty. Following the exclusion of the satellite Sx, the pseudo-distance prx relative to the satellite Sx will no longer be used by the navigation device APP to determine the navigation data NAV. In addition, a partial reset of the filters of the hybridization module HBD is carried out, in a manner similar to that described in patent EP2411832B1.

[0096] [Fig.4] represents steps of a method according to an embodiment of the invention for detecting a satellite failure. This figure is presented below to illustrate the implementation of step S200 of detecting an FLT satellite failure.

[0097] According to the embodiment of [Fig.4], the EXCL module detects an FLT satellite failure by implementing the steps S210 and S220 described below.

[0098] In step S210, the EXCL module calculates satellite failure indicators Rsi,...,Rs N associated with the secondary filters Fsi,...,Fsn. For each secondary filter Fs;, a satellite failure indicator Rs; is calculated by the EXCL module.

[0099] The satellite failure indicators Rsb...,RsN may in particular correspond to the cross-innovation ratios of the secondary filters Fsi,...,Fsn. The cross-innovation ratio of a filter Fs; may in particular be defined as the ratio of the cross-innovation of the pseudo-distance pp to the satellite S; to the variance of this cross-innovation. The cross-innovation of the pseudo-distance to the satellite Si corresponds to the difference between: the pseudo-distance to the satellite Sifoumie by the GNSS receiver, and an estimate of this pseudo-distance provided by the filter Fs; which excludes the satellite Si.

[0100] Within the scope of the invention, it could also be envisaged to use other satellite failure indicators. For example, embodiments could be envisaged in which the satellite failure indicators correspond to satellite failure likelihood ratios.

[0101] In step S220, the EXCL module detects a satellite failure FLT if at least one of the satellite failure indicators Rsb.. .,RsN is greater than a detection threshold Xdet.

[0102] For example, suppose that satellite S8 is faulty. The secondary filter Fs8 uses the pseudo-distances relative to all the satellites except satellite S8. By using the cross-innovation ratio Rs8 (or another satellite fault indicator), it is possible to detect that the pseudo-distance pr8 is erroneous and that satellite S8 is faulty. Indeed, the secondary filter Fs8 is not affected by the failure of satellite S8 (given that it excludes this satellite). A significant gap is therefore observed between: the pseudo-distance pr8 provided by the GNSS receiver, and the estimate of this pseudo-distance provided by the filter Fs8. It follows that the cross-innovation ratio Rs8 is greater than the detection threshold Xdet.

[0103] That being said, a satellite failure FLT can affect several secondary filters, so that several satellite failure indicators can exceed the detection threshold Xdet. A secondary filter Fs; which uses the pseudo-distance prx relative to the faulty satellite Sx (i.e. not excluding the satellite Sx) can have a satellite failure indicator Rs; higher than the threshold Xdet, and this in particular in the case of a bad geometric configuration of the constellation. It is therefore possible that the first satellite failure indicator to exceed the threshold Xdet is that of a secondary filter affected by the failure. Shortly after, the satellite failure indicator Rsx of the secondary filter Fsx excluding the faulty satellite Sx will in turn exceed the threshold Xdet.

[0104] In this embodiment, the FLT satellite failure is detected by the APP navigation device itself. However, other embodiments could be envisaged in which the FLT satellite failure is detected by another device (distinct from the APP device). For example, the FLT satellite failure could be detected by a device conforming to that proposed in patent application FR2303580.

[0105] When a FLT satellite failure has been detected, it is necessary to identify the faulty satellite Sx among the set of satellites Si,...,SN to exclude it and guarantee the integrity of the navigation solution. We present the way in which the faulty satellite Sx is identified with reference to the following figure.

[0106] [Fig.5] represents steps of a method according to an embodiment of the invention for identifying a faulty satellite. This figure illustrates the implementation of step S300 previously introduced with reference to [Fig.3].

[0107] It should be recalled that step S300 is implemented to identify the faulty satellite Sx following the detection of a satellite failure FLT. This step is therefore implemented if one or more of the satellite failure indicators Rsi,...,RsN of the secondary filters Fsi,...,Fsn are greater than the detection threshold Xdet.

[0108] If a single satellite failure indicator Rs; is greater than the detection threshold Xdet, the satellite Si associated with the secondary filter Fs; can be identified as the failed satellite Sx. However, when several secondary filters have satellite failure indicators greater than the threshold Xdet, there is ambiguity as to which satellite is failed. Several satellites are potentially failed.

[0109] This is why, according to one embodiment, said at least one additional filter FA is used only when several secondary filters Fsi,.. ,,FsN have satellite failure indicators greater than the threshold Xdet. The steps described below are then implemented. This embodiment makes it possible to use said at least one additional filter FA only when it is necessary to arbitrate between several potentially faulty satellites. This makes it possible to minimize the resources used by the APP device, while ensuring that the faulty satellite is reliably identified in the event of a satellite failure.

[0110] Alternatively, it could also be envisaged to use said at least one additional filter FA and to implement the steps below each time a satellite failure is detected.

[0111] [Fig.5] illustrates an embodiment in which different hypotheses of quarantine hypotheses are tested sequentially until the faulty satellite Sx is identified. We first present this so-called sequential embodiment, and then describe a so-called parallel embodiment in which several quarantine hypotheses are tested simultaneously.

[0112] According to the sequential embodiment illustrated by [Fig.5], step S300 of identifying the faulty satellite Sx comprises steps S310 to S360 described below.

[0113] In step S310, the EXCL module identifies a satellite Sj assumed to be faulty among the set of satellites Si,...,SN.

[0114] In this embodiment, a single satellite Sj is identified as supposedly faulty. This satellite is quarantined so that the pseudo-distances relating to it are no longer used by the filters Fsb.. .,FsN. As we detail below, an additional filter FA will be used to test this quarantine hypothesis, and confirm or deny the supposed failure of the satellite Sj.

[0115] In particular, the satellite Sj identified as presumed to be faulty corresponds to the satellite associated with the filter FSj whose satellite fault indicator RSj is maximum and which has not already been quarantined. The identified satellite Sj is therefore the satellite which is most likely to be faulty, for two reasons: on the one hand, it is associated with the filter Fsj whose satellite failure indicator Rsj is the highest, and on the other hand, the exclusion of this satellite Sj has not yet been tested.

[0116] The choice of the satellite Sj assumed to be faulty and quarantined can be carried out by the navigation device APP itself, as described above. However, this choice of quarantine can also be carried out on the basis of information provided by another device (distinct from the APP device). According to one embodiment, the identification of the satellite Sj assumed to be faulty is thus carried out on the basis of information provided by a device conforming to that proposed in patent application FR2303580. The information provided by this other device indicating a satellite assumed to be faulty, or comprising additional satellite failure indicators making it possible to identify a satellite assumed to be faulty.

[0117] In step S320, the EXCL module configures (initializes) an additional Kalman filter FA (also called an arbiter sub-filter). This additional filter FA is used to simulate the exclusion of the satellite Sj assumed to be faulty, and therefore test the chosen quarantine hypothesis.

[0118] More precisely, the EXCL module identifies the secondary filter Fk which has the maximum satellite failure indicator Rk and which excludes a satellite Sk distinct from the satellite Sj assumed to be faulty. In other words, the satellite failure indicator Rsk is the maximum indicator among {Rsi,.. .,RsN]\{RSj}. Then, the EXCL module configures (initializes) the additional filter FA on the basis of the secondary filter Fsk. The configuration of the additional filter FA consists in particular of copying the covariance matrix, the estimated states, and the measurements used by the secondary filter Fsk.

[0119] Note that the additional filter FA excludes the satellite Sk, and the supposedly faulty satellite Sj which is quarantined. It therefore uses the pseudo-distances {pri,...,prN}\{prk, pq}.

[0120] In step S330, the EXCL module performs a (partial) reset of the additional filter FA.

[0121] To reset the additional filter FA, the following operations are performed. The states related to the pseudo-distances provided by the GNSS receiver and the states related to the other sensors used are reset. The states potentially affected by a failure of the satellite Sj are desensitized by adding state noise.

[0122] Clock states and bias states generally have non-negligible correlation times which do not allow sufficiently rapid convergences. The reset proposed here makes it possible to force rapid convergence of the states of the additional filter FA.

[0123] In step S340, the EXCL module calculates a satellite failure indicator RA of the additional filter FA after a determined duration TE (also called quarantine period)•

[0124] The determined duration TE between the resetting of the additional filter FA and the calculation of its satellite failure indicator RA is generally of the order of a few minutes (for example, between 2 and 3 minutes).

[0125] Resetting the additional filter FA ensures rapid convergence of the states of the additional filter FA. If the quarantine hypothesis is correct (the satellite SjSupposed to be faulty corresponds to the faulty satellite Sx), the convergence of the states of the additional filter FA towards zero allows the convergence of its satellite failure indicator RA towards zero. At the end of the quarantine period, the satellite failure indicator RA will thus be lower than the threshold Xdet.

[0126] In particular, the satellite failure indicator RA of the additional filter FA corresponds to the cross-innovation ratio of the additional filter FA. However, and as mentioned previously, it could be envisaged to use other satellite failure indicators.

[0127] In step S350, the module EXCL determines whether the satellite failure indicator RA of the additional filter FA is greater than or equal to the threshold Xdet. It thus determines whether the satellite Sj assumed to be faulty is actually faulty or is functional.

[0128] We recall that the additional filter FA simulates the exclusion of the satellite Sj which is assumed to be faulty and is quarantined. If, at the end of the quarantine period, the satellite failure indicator RA is lower than the threshold, this means that the additional filter FA is no longer affected by the satellite failure and that it excludes the faulty satellite Sx. The quarantine hypothesis is therefore correct: the satellite Sj assumed to be faulty is actually faulty. In this case, the method continues at step S360.

[0129] On the other hand, if the satellite failure indicator RA is greater than or equal to the threshold Xdet , this means that the quarantine hypothesis is incorrect: the satellite Sj assumed to be faulty and quarantined is in fact functional, and the satellite Sx actually faulty has not been quarantined. In this case, the satellite Sj assumed to be faulty is determined to be functional and its quarantine is suspended. The method resumes at step S310 to identify another satellite Sj' assumed to be faulty (distinct from the satellite Sj), and reiterates the following steps to simulate the exclusion of this satellite Sj'. A new quarantine hypothesis is thus tested.

[0130] In step S360, the EXCL module identifies the satellite Sj as being the faulty satellite Sx.

[0131] If the satellite failure indicator RA is lower than the threshold Xdet, the quarantine hypothesis is correct: the satellite Sj assumed to be faulty and quarantined actually corresponds to the faulty satellite Sx at the origin of the satellite failure FLT. The method will continue at step S400 to exclude this satellite.

[0132] We have presented above an embodiment in which the different quarantine hypotheses are tested one after the other using a single additional filter FA. However, several additional filters can be used in parallel to simultaneously test different quarantine hypotheses, which we now detail.

[0133] According to an embodiment paraZZèZe (not illustrated), the EXCL module proceeds as follows to identify the faulty satellite Sx using several additional filters noted FA b...,FAM.

[0134] First, a plurality of satellites Sj b...,Sj M are identified as presumed to be faulty (step S310). For each satellite Sj m presumed to be faulty, an additional filter FA m is configured and reset (step S320 and S330).

[0135] Each additional filter FA m is configured from a secondary filter Fsk which has the maximum satellite failure indicator Rsk and which excludes a satellite Sk distinct from the satellite Sj m. The additional filter FA m makes it possible to simulate the exclusion of the satellite Sj m.

[0136] At the end of the quarantine period TE, the satellite failure indicators RA b ...,Ra m of the different additional filters FA b...,FA M are calculated (step S340). These indicators RA b.. .,RA M are then compared to identify the faulty satellite Sx (step S360).

[0137] The satellite Sx identified as faulty corresponds, according to one embodiment, to the satellite Sj m assumed to be faulty for which the additional filter FA m has the minimum satellite fault indicator RA m. Indeed, the different additional filters FA b...,FAM used make it possible to test different quarantine hypotheses. The additional filter associated with the correct quarantine hypothesis is the one that simulates the exclusion of the faulty satellite Sx. It will therefore have the lowest satellite fault indicator at the end of the quarantine period.

[0138] For the number of additional filters used in parallel, several embodiments can be envisaged. It can be envisaged to use as many additional filters as there are satellites in the set of satellites (i.e. M=N). In this case, all the satellites Sb...,SN are identified as supposedly faulty, and the additional filters FA b...,FA N simulate the exclusion of each of them to identify the faulty satellite Sx.

[0139] Alternatively, the number of additional filters may correspond to the number of secondary filters whose satellite failure indicator is greater than the detection threshold Xdet. When several secondary filters have satellite failure indicators greater than the threshold Xdet, there is ambiguity as to the faulty satellite. Several satellites are potentially faulty. To quickly arbitrate between these different satellites and limit the quantity of resources required, it is relevant to use as many additional filters as there are secondary filters whose satellite failure indicator is greater than a threshold. Such an embodiment makes it possible to achieve an advantageous compromise between the speed of identification of the faulty satellite and the quantity of resources required to implement the proposed solution.

[0140] Additional variants: A person skilled in the art will understand that the variants and embodiments described above constitute only non-limiting examples of implementation of the invention. In particular, a person skilled in the art may envisage any adaptation or combination of the embodiments and variants described above in order to meet a very specific need.

[0141] It should also be noted that the order in which the steps of a method according to the invention are carried out, in particular with reference to the attached drawings, constitutes only an example of embodiment without any limiting character, variants being possible. In particular, a method according to the invention may comprise one or more iterations of the steps described above, in particular with reference to the attached drawings. Furthermore, the reference signs do not limit the scope of the protection, their sole function being to facilitate the understanding of the claims.

[0142] Finally, the term module can correspond to a software component as well as to a hardware component or to a set of hardware and software components, a software component itself corresponding to one or more computer programs or subroutines or more generally to any element of a program capable of implementing a function or a set of functions as described for the modules concerned. In the same way, a hardware component corresponds to any element of a hardware assembly capable of implementing a function or a set of functions for the module concerned (integrated circuit, smart card, memory card, etc.).

Claims

Claims

1. Method implemented by a device (APP) comprising a plurality of Kalman filters Fsi,...,Fsn, each filter Fs; determining navigation data (NAV) of a mobile (AC) from pseudo-distances (PR) relating to a set of satellites Si,...,SN with the exception of satellite S;, the method comprising a step consisting of identifying (S300) a faulty satellite Sx among the set of satellites Si,...,SN, this step (S300) comprising for at least one satellite Sj assumed to be faulty: - a step consisting of configuring (S320) an additional Kalman filter FA from the filter Fsk excluding a satellite Sk distinct from the satellite Sj assumed to be faulty and of which a satellite failure indicator Rsk is maximum; - a step consisting of resetting (S330) the additional filter FA, this additional filter FA excluding the satellite Sj assumed to be faulty; and - a step consisting of determining (S350) whether the satellite Sj is faulty according to a satellite failure indicator RA of the additional filter FA calculated after a determined duration (TE).

2. The method of claim 1, wherein a said satellite failure indicator is a cross-innovation report.

3. The method of claim 1 or 2, wherein said step of identifying (S300) the failed satellite Sx comprises said steps of configuring (S320), resetting (S330), and determining (S350), only if several of the filters Fsk.. ,,FsN have satellite failure indicators greater than a threshold (Xdet

4. )■ Method according to any one of claims 1 to 3, in which the satellite Sj assumed to be faulty corresponds to the satellite being associated with the filter FSj of which a satellite failure indicator RSj is maximum and not having been previously assumed to be faulty.

5. Method according to claim 4, in which: - if the satellite failure indicator RA of the additional filter Fa is lower than a threshold (Xdet), the satellite Sj assumed to be faulty is determined (S350) as being faulty; and - otherwise, another satellite Sr is assumed to be faulty, and said steps of configuring (S320), resetting (S330), and determining (S350) are repeated.

6. Method according to any one of claims 1 to 3, wherein several satellites Sj b...,Sj M are assumed to be faulty, and several additional filters FA i,.. .,FA m are configured (S320) and reset (S330).

7. The method of claim 6, wherein the satellite Sj m assumed to be faulty, for which the additional filter FA m has the minimum satellite fault indicator RA m, is determined (S350) to be faulty.

8. Method according to claim 6 or 7, in which the satellites Sj b ...,Sj m assumed to be faulty correspond to the satellites associated with the filters FSj b.. ,,FSj M whose satellite fault indicators RSj b.. .,RSj M are greater than a threshold (^).

9. Device (APP) comprising a plurality of Kalman filters Fsi,.. .,Fsn, each filter Fs; determining navigation data (NAV) of a mobile (AC) from pseudo-distances (PR) relating to a set of satellites Sb.. .,SN with the exception of the satellite Si, the device (APP) comprising a module (EXCL) configured to identify (S300) a faulty satellite Sx among the set of satellites Sb...,SN, this module (EXCL) being configured to: - configure (S320) an additional Kalman filter FA from the filter Fsk excluding a satellite Sk distinct from a satellite Sj assumed to be faulty and of which a satellite failure indicator Rsk is maximum; - reset (S330) the additional filter FA, this additional filter FA excluding the satellite Sj assumed to be faulty; and - determining (S350) whether the satellite Sj is faulty based on a satellite failure indicator RA of the additional filter Fa calculated after a determined duration (TE).

10. Navigation system (SYS) intended to be embedded in a mobile (AC) comprising: - a satellite positioning receiver (GNSS) configured to provide pseudo-distances relative to a set of satellites Sb...,SN; and

11.

12. - a device (APP) according to claim 9. Mobile machine (AC) comprising a navigation system (SYS) according to claim 10. Computer program (PROG) comprising instructions for implementing the steps of a method according to any one of claims 1 to 8, when said computer program (PROG) is executed by at least one processor (PROC).

Images