Method and device for detecting and ruling out a satellite failure

Abstract

The present invention relates to a method and device for detecting and excluding a satellite failure. In particular, the proposed method comprises a step of identifying (S300) a failed satellite Sx from among the set of satellites S1,…,SN, this step (S300) comprising, for at least one satellite Sj presumed to be failed: a step of configuring (S320) an additional Kalman filter FA from a Kalman filter Fsk excluding a satellite Sk distinct from the presumed failed satellite Sj and whose satellite failure indicator Rsk is at its maximum; a step of resetting (S330) the additional filter FA, this additional filter FA excluding the presumed failed satellite Sj; and a step of determining (S350) whether the satellite Sj is failed based on a satellite failure indicator RA of the additional filter FA calculated after a specified time (TE). Figure for the abstract: Fig. 5

Description

Title of the invention: Method and device for detecting and excluding a satellite failure. Technical field

[0001] The present invention relates to the field of satellite navigation, also known as GNSS (Global Navigation Satellite System). In particular, the present invention relates to a method and a device for detecting and ruling out a satellite failure. It also relates to a navigation system, a mobile device, and a computer program. The present invention finds a particularly advantageous, though not limiting, application in the implementation of navigation systems for aircraft, ships, or land vehicles. Prior art

[0002] The present invention relates, in particular, to the context of hybrid inertial-GNSS navigation. To determine the navigation data of a mobile device such as an aircraft, a hybrid inertial-GNSS navigation system combines inertial data from an inertial measurement unit and pseudo-ranges provided by a satellite positioning receiver. Pseudo-ranges characterize the distances between the mobile device and the visible satellites of a constellation. A hybrid inertial-GNSS navigation system uses a hybridization algorithm, generally based on a Kalman filter, to combine the data from the different sensors and take advantage of their respective strengths. The use of pseudo-ranges associated with the satellites makes it possible, in particular, to compensate for inertial navigation drift.

[0003] Certain applications require navigation systems to meet strict integrity constraints. In the field of aeronautics, the reliability of navigation data is critical. The navigation systems used must be able to determine the position of an aircraft with a given integrity risk, that is, with a defined probability (for example, 10⁷) that the position error will exceed a protection radius (an alert boundary) without triggering an alert. In the case of a hybrid inertial-GNSS navigation system, the failure of a satellite affects the relative pseudorange to that satellite, notably in the form of bias, drift, or acceleration. The failure of a satellite can thus lead to significant errors in the estimated position of the moving object, and these errors tend to increase over time.It is therefore essential to be able to detect any satellite failure and to exclude the faulty satellite to guarantee the integrity of the navigation system.

[0004] To detect and exclude a satellite failure, it is known to use a bank of Kalman filters in which each filter excludes the pseudo-range relative to a satellite. Patent EP2411832B1 illustrates such a solution. For each filter in the bank, a satellite failure indicator is calculated using cross-filter innovation, that is, by using the difference between the pseudo-range to the satellite in question provided by the satellite positioning receiver and an estimate of this pseudo-range provided by the filter excluding that satellite. These satellite failure indicators generally make it possible to detect and exclude a satellite failure. For example, the satellite associated with the highest satellite failure indicator and exceeding a certain detection threshold can be identified as the failed satellite.

[0005] However, the reliability of existing solutions is not entirely satisfactory. They may erroneously exclude a functional satellite instead of the faulty one. Such exclusion errors occur particularly in the case of poor geometric configurations of the satellite constellation, characterized by a significant horizontal dilution of precision. For example, such exclusion errors can occur when few satellites are visible, or when they are located close to the horizon.

[0006] There is therefore a need for a solution that reliably identifies a faulty satellite among a group of satellites. Description of the invention

[0007] The present invention aims to remedy all or part of the drawbacks of the prior art, in particular those previously described.

[0008] According to one aspect of the invention, a method is proposed implemented by a device comprising a plurality of Kalman filters Fsb...,FsN, each filter Fs i determining navigation data for a mobile device from pseudo-distances relative to a set of satellites Si,...,SN, excluding satellite Si, the method comprising a step of identifying a faulty satellite Sx among the set of satellites Si,...,SN, this step comprising, for at least one satellite Sj assumed to be faulty: - a step consisting of configuring an additional Kalman filter FA (also called arbiter subfilter) from the Fsk filter excluding a Sk satellite distinct from the supposedly failed Sj satellite and whose Rsk satellite failure indicator is maximum (among the plurality of Fsb.. .,FsN filters except for the Fsj filter associated with the supposedly failed Sj satellite); - a step consisting of (partially) resetting the additional FA filter, this additional FA filter excluding the supposedly faulty satellite Sj; and - a step consisting of determining whether the satellite Sj (assumed to be faulty) is faulty based on a satellite failure indicator RA of the additional FA filter calculated after a specified period (also called quarantine period).

[0009] The present invention makes it possible to reliably identify a failed satellite Sx among a set of satellites Si,...,SN. To do this, it is proposed to use at least one additional Kalman filter FA (independent of the filters Fsb,...,FsN) to simulate the exclusion of a supposedly failed satellite Sj. This makes it possible to test a quarantine hypothesis to confirm or refute the supposed failure of a satellite Sj. We present here the operating principle of the present invention considering a single additional filter FA, but several additional filters can be used.

[0010] The steps of the proposed method, mentioned above, are implemented following the detection of a satellite failure (for example, if one or more satellite failure indicators of the Fsb...,FsN filters are greater than a threshold). To simulate the exclusion of a supposedly failed satellite Sj, an additional Kalman filter Fa is used. More precisely, the additional filter FA is configured based on the Fs k filter, which excludes the satellite Sk (distinct from the supposedly failed satellite Sj) and whose satellite failure indicator Rsk is at its maximum. This additional filter FA does not use the pseudodistance relative to the supposedly failed satellite Sj, which is quarantined. The filter Fa is reset to ensure rapid convergence of its states.

[0011] At the end of a quarantine period, the satellite failure indicator RA of the additional filter FA is evaluated to confirm or refute the presumed failure of satellite Sj. For example, if the satellite failure indicator RA falls below a certain threshold following the exclusion of the presumed faulty satellite Sj, then satellite Sj is indeed faulty. Satellite Sj can then be excluded so that the pseudodistance relative to it is no longer used for navigation, and the various filters can also be reset.

[0012] Compared to existing solutions, the present invention makes it possible to reliably identify a failed satellite among a set of satellites, even in the case of poor geometric configurations of the satellite constellation. In other words, the present invention makes it possible to reduce the number of erroneous exclusions during satellite failures.

[0013] In particular, it is worth highlighting the advantages of the present invention compared to the solution described in patent EP2411832B1. In the latter, as soon as the cross-innovation associated with a satellite exceeds a certain threshold, that satellite is declared faulty, so that the pseudo-distance associated with that satellite is no longer The filters in the navigation system use this information, and these filters are reset. The cross-reactions of the different filters are then monitored for a predetermined period to confirm or refute the failure of the excluded satellite. If it turns out that the declared failed satellite is not the failed satellite, then the navigation system filters were incorrectly reset and continue to be affected by the failure. In fact, when such an erroneous exclusion was performed, the filters were reset using incorrect values. Thus, even if the cross-reactions of the different filters continue to be monitored afterward, it is likely that the actually failed satellite cannot be identified and excluded, since the different filters will have used incorrect values ​​for a significant period of time.In other words, it is particularly difficult to rectify an erroneous exclusion during a satellite outage.

[0014] Unlike the solution described in patent EP2411832B1, the present invention proposes using an additional filter FA, independent of the Fsi,...,Fsn filters, to test a quarantine hypothesis and simulate the exclusion of a supposedly failed satellite. The present invention makes it possible to quickly determine whether the supposedly failed satellite is indeed malfunctioning. This avoids resetting the Kalman filters if it is determined that the supposedly failed satellite is not in fact malfunctioning. In this way, the present invention advantageously ensures that the navigation solution and the various filters of the device are not altered (in particular, reset) until the failure of a satellite is actually confirmed. The present invention thus reduces the number of erroneous exclusions during satellite failures and helps to guarantee the integrity of the navigation system.

[0015] It is important to note that the identification of the supposedly faulty satellite Sj can be performed by the device implementing the method, but can also be performed on the basis of information provided by another device. In particular, the identification of the supposedly faulty satellite Sj can be performed on the basis of information provided by a device conforming to that proposed in patent application FR2303580.

[0016] According to one embodiment, a said satellite failure indicator is a cross-innovation ratio (or is determined from cross-innovation).

[0017] It is proposed here to use the cross-innovation ratio as a satellite failure indicator. For a filter Fs; excluding satellite Si, the cross-innovation ratio RS; is defined in particular as the ratio of the cross-innovation of the pseudodistance to satellite S; to the variance of this cross-innovation. The cross-innovation of the pseudodistance to satellite Si corresponds to the difference between: the pseudodistance to satellite Si provided by the satellite positioning receiver, and an estimate of this pseudo-distance provided by the filter Fs; The same applies to the aforementioned at least one additional filter FA.

[0018] This embodiment is advantageous because it allows for the reliable identification of a failing satellite while ensuring minimal implementation complexity. On the one hand, the cross-innovation ratio is a reliable indicator of satellite failure, and its reliability is further enhanced by the proposed solution. On the other hand, using the cross-innovation ratio as a satellite failure indicator helps minimize the resources required (e.g., computing and memory resources, processing time, etc.) to implement the proposed solution.

[0019] Alternatively, embodiments could be considered in which other satellite failure indicators are used. For example, a satellite failure likelihood ratio could be used.

[0020] According to one embodiment, said step of identifying the faulty satellite Sx includes said steps of configuring, resetting, and determining, only if several of the filters Fsi,...,FsN have satellite failure indicators above a threshold.

[0021] In this embodiment, said at least one additional FA filter is used only when several filters among the Fsi .. .,FsN filters have satellite failure indicators greater than a certain detection threshold.

[0022] If a single filter Fs; has a satellite failure indicator Rs; above the detection threshold, the satellite Si associated with filter Fs; can be identified as the failed satellite Sx. However, when several filters have satellite failure indicators above the detection threshold, there is ambiguity regarding the failed satellite, and several satellites are potentially failed. At least one additional filter FA is then used to arbitrate between these potentially failed satellites by testing the chosen quarantine hypothesis. This allows for the reliable identification of the failed satellite.

[0023] Said at least one additional FA filter is used here only when it is necessary to arbitrate between several potentially failing satellites. This embodiment therefore makes it possible to reliably identify a failing satellite, while minimizing the resources required to implement the proposed solution.

[0024] Alternatively, embodiments could be envisaged in which said at least one additional FA filter is used each time a satellite failure is detected.

[0025] According to one embodiment, the satellite Sj assumed to be faulty corresponds to the satellite associated with the filter Fsj whose satellite failure indicator Rsj is maximum (among the plurality of filters Fsb.. .,FsN) and not having been previously assumed to be faulty.

[0026] In this embodiment, only one satellite Sj at a time is assumed to be faulty. This satellite is quarantined so that the pseudo-distance relative to it is no longer used by the filters Fsi, ..., Fsn. The satellite Sj assumed to be faulty is the satellite associated with filter FSj whose satellite failure indicator RSj is at its maximum and which has not already been quarantined. Satellite Sj is therefore the one most likely to be faulty. To simulate the exclusion of this single assumed faulty satellite Sj, a single additional filter FA is used. This allows the chosen quarantine hypothesis to be confirmed or refuted.

[0027] This embodiment thus makes it possible to reliably identify a faulty satellite among a set of satellites, while minimizing the resources required.

[0028] According to one embodiment, if the satellite failure indicator RA of the additional filter FA is less than a threshold (after the determined time), the supposedly failed satellite Sj is determined to be failed; otherwise, another satellite Sj- (distinct from satellite Sj) is assumed to be failed, and said steps of configuring, resetting, and determining are repeated (for this satellite Sj).

[0029] This embodiment proposes to sequentially test the different quarantine hypotheses until the faulty satellite is identified.

[0030] As a reminder, the additional filter FA excludes the presumed faulty satellite Sj, which is quarantined. If, at the end of the quarantine period, the satellite failure indicator RA of the additional filter FA is below the threshold, this means that the additional filter FA is no longer affected by the satellite failure and that it excludes the faulty satellite Sx. The quarantine assumption is therefore correct: the supposedly faulty satellite Sj, which is quarantined, does indeed correspond to the faulty satellite Sx. This satellite can therefore be excluded so that the pseudo-range relative to it is no longer used, and the navigation device filters can be reset.

[0031] Conversely, if the satellite failure indicator RA of the additional filter FA is above the threshold at the end of the quarantine period, this means that the quarantine assumption is incorrect: the supposedly faulty satellite Sj that was quarantined is in fact functional, and the actually faulty satellite Sx was not quarantined. In this case, another satellite Sj' is assumed to be faulty, and the steps of the process are repeated to simulate the exclusion of this satellite Sj. A new quarantine assumption is thus tested.

[0032] This embodiment thus contributes to reliably identifying the faulty satellite among the set of satellites.

[0033] According to one embodiment, several satellites Sj i,...,Sj M are assumed to be faulty, and several additional filters FA i,...,Fa M are configured and reset.

[0034] In this embodiment, several additional filters are used in parallel. This allows different quarantine hypotheses to be tested simultaneously.

[0035] In fact, several satellites Sj b... ,Sj M are assumed to be faulty; and the steps of configuring, resetting, and determining are implemented simultaneously for these satellites Sj b... ,Sj M. Each additional filter FA m is used to test a quarantine hypothesis. The faulty satellite Sx is then identified based on the satellite failure indicators RA i,...,RA m of the additional filters FAi,...,FA m calculated after the quarantine period.

[0036] This embodiment is advantageous in that it allows the faulty satellite to be identified reliably and quickly among a set of satellites.

[0037] According to one embodiment, the satellite Sj m assumed to be faulty, for which the additional filter FA m presents the minimum satellite failure indicator RA m (among the additional filters FA i,...,Fa M), is determined to be faulty.

[0038] We recall that the various additional filters FA i,...,FaM allow testing different quarantine hypotheses (i.e., simulating the exclusion of different satellites). The additional filter associated with the correct quarantine hypothesis is the one that simulates the exclusion of the failed satellite Sx. It will therefore exhibit the lowest satellite failure indicator at the end of the quarantine period.

[0039] Therefore, the satellite Sx identified as faulty here corresponds to the satellite Sj m associated with the additional filter FA m, whose satellite failure indicator RA m is at a minimum at the end of the quarantine period (the additional filter FA m simulates the exclusion of the satellite Sj m). This embodiment thus contributes to reliably and quickly identifying the faulty satellite among the set of satellites.

[0040] According to one embodiment, the satellites Sj i,...,Sj M assumed to be faulty correspond to the satellites associated with the filters FSj i,...,FSj M whose satellite failure indicators Rsj i,...,RSj M are greater than a threshold.

[0041] As mentioned previously, when several of the Fsi,...,Fsn filters have satellite failure indicators above the detection threshold, there is ambiguity regarding the failed satellite. Several satellites are potentially faulty. In this embodiment, several additional filters FA i,...,Fa M are used to test different quarantine hypotheses in parallel and quickly arbitrate between the potentially faulty satellites Sj i,...,Sj M. The number of additional filters used here corresponds to the number of FSj i,...,FSj M filters whose satellite failure indicators Rsj i,...,RSj M are above the detection threshold.

[0042] This embodiment thus makes it possible to achieve a particularly advantageous compromise between the speed of identification of the faulty satellite and the amount of resources required (e.g., computing resources and memory) to implement the proposed solution. In other words, this embodiment makes it possible to reliably and quickly identify a faulty satellite among a set of satellites, while limiting the amount of resources required.

[0043] Alternatively, embodiments could be envisaged in which the number of additional filters used corresponds to the number of satellites in the satellite set.

[0044] According to one aspect of the invention, a device is proposed comprising a plurality of Kalman filters Fsb...,FsN, each filter Fs determining navigation data for a mobile device from pseudo-ranges relative to a set of satellites Si,...,SN, excluding satellite Si, the device comprising a module configured to identify a faulty satellite Sx among the set of satellites Sb...,SN, this module being configured to: - configure an additional Kalman filter FA from the Fsk filter excluding a Sk satellite distinct from a supposedly failed Sj satellite and whose satellite failure indicator Rsk is maximum; - reset (partially) the additional FA filter, this additional FA filter excluding the supposedly faulty Sj satellite; and - determine if the satellite Sj (assumed to be faulty) is faulty based on a satellite failure indicator RA of the additional filter FA calculated after a determined time.

[0045] The proposed device can be configured to implement any of the embodiments of a process according to the invention. In particular, for each step of a process according to the invention, the proposed device can include a module configured to implement that step.

[0046] In particular, the proposed device is a navigation device intended to be included in a navigation system on board a mobile device (for example, an aircraft).

[0047] In addition to the Fsb.. .,FsN filters, the proposed device may include a Kalman filter FP (also called the main filter) determining navigation data of the mobile from the pseudo-distances relative to the set of satellites Si,.. .,SN. It should be specified that the main filter FP uses the pseudo-distances relative to each satellite Si of the set of satellites Si,...,SN, provided that the satellite Si has not been excluded.

[0048] According to one aspect of the invention, a navigation system is proposed for embedding in a mobile device comprising: - a satellite positioning receiver configured to provide pseudo-ranges relative to a set of satellites Si,...,SN; and - a device conforming to the invention.

[0049] This navigation system can, for example, be installed in an aircraft, a ship, or a land vehicle. It can also include an inertial measurement unit, comprising, for example, accelerometers and / or gyroscopes.

[0050] According to one aspect of the invention, a mobile device is proposed comprising a navigation system in accordance with the invention.

[0051] The proposed mobile device may be an aircraft, a ship, or a land vehicle.

[0052] According to one aspect of the invention, a computer program is proposed comprising instructions for implementing the steps of a process according to the invention, when the computer program is executed by at least one processor or computer.

[0053] The computer program may consist of one or more sub-parts stored in the same memory or in separate memories. The program may use any programming language and may be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0054] According to one aspect of the invention, a computer-readable information carrier is proposed comprising a computer program in accordance with the invention.

[0055] The information carrier can be any entity or device capable of storing the program. For example, the carrier can include a storage means, such as non-volatile memory or ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a hard drive. On the other hand, the storage carrier can be a transmissible medium such as an electrical or optical signal, which can be transmitted via an electrical or optical cable, by radio, by a telecommunications network, by a computer network, or by other means. The program according to the invention can, in particular, be uploaded to a computer network. Alternatively, the information carrier can be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the process in question.

[0056] The proposed device, navigation system, aircraft, computer program, and information support have the advantages described above in connection with the proposed method. Brief description of the drawings

[0057] Other features and advantages of the present invention will become apparent from the description provided below, illustrating given embodiments of the invention. By way of example and without limitation, with reference to the attached drawings:

[0058] [Fig.1] represents the material architecture of an aircraft according to one embodiment of the invention;

[0059] [Fig.2] represents the functional architecture of a device according to one embodiment of the invention;

[0060] [Fig.3] represents steps of a process according to an embodiment of the invention for detecting a satellite failure and excluding the faulty satellite;

[0061] Figure 4 represents steps in a process according to an embodiment of the invention for detecting a satellite failure; and

[0062] [Fig.5] represents steps of a process according to an embodiment of the invention for identifying a faulty satellite. Description of the implementation methods

[0063] The present invention applies, in particular, to aircraft navigation systems. The following description of the invention will refer to this particular application context, which is given only by way of illustration and is not intended to limit the invention. The latter applies to navigation for any type of carrier, mobile device, or vehicle.

[0064] Figure 1 represents the hardware architecture of an aircraft according to an embodiment of the invention. This figure is described below to introduce the present invention and exemplify an application context thereof.

[0065] The AC aircraft illustrated in [Fig. 1] is equipped with a SYS navigation system. In the context of the invention, the term "aircraft" refers to any device capable of rising and moving through the air, such as an airplane, a helicopter, a drone, etc.

[0066] The SYS navigation system includes: an inertial measurement unit (IMU); a GNSS satellite positioning receiver; and an APP navigation device.

[0067] The inertial measurement unit (IMU) is configured to provide inertial increments (INC) to the navigation device (APP). This IMU includes accelerometers and gyroscopes; the INC increments correspond to velocity increments and angular increments.

[0068] The GNSS receiver is configured to receive signals emitted by a set of satellites Si,...,SN. These satellites belong, for example, to the satellite constellation of the GPS system or the Galileo system. The GNSS receiver is configured to determine, from the signals received from the satellites Si,...,SN, the pseudo-ranges PR between the satellites Si,...,SN and the GNSS receiver (i.e., the receiver). It provides these pseudo-ranges PR to the navigation device APP. We also use the expression "satellite-relative pseudo-range S". ,» to designate the pseudo-distance between the Si satellite and the GNSS receiver and let us denote this pseudo-distance pp.

[0069] The APP navigation device is configured to determine NAV navigation data for the AC aircraft. By "navigation data," we mean data relating to the position and / or movement of the AC aircraft, such as geographic coordinates (e.g., latitude, longitude, altitude), speed, and attitudes. This NAV navigation data can, for example, be provided to a CMD guidance device for the AC aircraft (e.g., an autopilot system).

[0070] The APP navigation device here implements a hybrid inertial-GNSS navigation solution. It determines the NAV navigation data of the AC aircraft by using both the pseudo-ranges PR provided by the GNSS satellite positioning receiver, and the inertial increments INC provided by the inertial measurement unit (IMU).

[0071] Within the scope of the invention, other embodiments could also be envisaged in which other forms of hybridization are used. For example, data from additional sensors, such as a barometer or a camera, could be used.

[0072] The APP navigation device is further configured to detect a satellite failure and / or exclude a failing satellite from the set of satellites Si,...,SN. We will describe in more detail how the APP device detects a satellite failure and excludes a failing satellite, with reference to the following figures.

[0073] The hardware architecture of the APP device is illustrated by [Fig. 1]. According to this embodiment, the APP device comprises: at least one processing unit or processor PROC; and at least one memory MEM.

[0074] According to one embodiment, the APP device has the hardware architecture of a computer. The MEM memory constitutes an information storage medium according to the invention, on which a computer program PROG according to the invention is stored. The PROG program includes instructions for carrying out steps of a process according to the invention when the PROG program is executed by the PROC processor. The PROG program defines the functional modules of the APP device shown in [Fig. 2], which rely on or control the hardware elements of this device.

[0075] As illustrated in [Fig. 1], the APP device has a COM communication module configured to communicate with: the GNSS receiver, the IMU inertial measurement unit, and / or the CMD guidance module. There are no limitations on the nature of the communication interfaces between these devices.

[0076] We have presented above the hardware architecture of the APP navigation device. We now describe its functional architecture with reference to the following figure.

[0077] Figure 2 represents the functional architecture of a device according to one embodiment of the invention. This figure illustrates the operation of the APP navigation device.

[0078] As mentioned previously, the APP navigation device is configured to determine NAV navigation data for the aircraft from the inertial increments INC provided by the inertial measurement unit (IMU) and the pseudo-ranges PR provided by the GNSS receiver. According to the embodiment of [Fig. 2], the APP device comprises the following modules: a virtual platform PFV (or inertial navigation module); an HBD hybridization module; and an EXCL module for detecting and excluding satellite failures.

[0079] It should first be noted that the architecture of the APP device proposed here is based on that of the device presented in patent EP2411832B1. However, the APP device proposed here differs from the device described in patent EP2411832B1 in several respects, and in particular by its use of at least one additional Kalman FA filter (also called an arbiter filter). It should also be emphasized that the EXCL module for detecting and excluding satellite faults proposed in this application uses said at least one additional Kalman FA filter. Thus, the implementation of the EXCL module proposed here differs from the implementation of the satellite fault detection and exclusion module previously proposed in patent EP2411832B1.

[0080] We briefly present below the functions of the various modules of the APP device. Regarding the implementation details of some of these modules, it is also possible to refer to patent EP2411832B1, and the references cited therein.

[0081] The PFV virtual platform is configured to determine NAV_INS inertial navigation data from the INC increments provided by the IMU inertial measurement unit. The PFV virtual platform can further use NAV navigation data determined by the HBD hybridization module (for example, to compensate for inertial navigation drift).

[0082] The EXCL module is configured to detect a satellite failure and / or exclude the failing satellite. It provides the HBD hybridization module with all or part of the pseudoranges PR delivered by the GNSS receiver, depending on which satellites are identified as functional or failing. If a satellite Si is identified as failing (i.e., if it is excluded), the EXCL module receives the pseudorange pp associated with that satellite. satellite, but does not supply it to the HBD hybridization module. We will detail the operation of the EXCL module with reference to Figures 3 to 5.

[0083] The HBD hybridization module is configured to determine NAV navigation data for the AC aircraft from the NAV_INS inertial navigation data provided by the PFV virtual platform and the PR pseudo-distances provided by the EXCL module. The HBD module thus implements inertial-GNSS hybridization.

[0084] As mentioned previously, embodiments of the invention could be considered in which other forms of hybridization are used. For example, the hybridization module could also use data from additional sensors, such as a camera or a barometer.

[0085] To implement inertial-GNSS hybridization, the HBD hybridization module includes (implements) several Kalman filters: a main FP filter, and secondary (or sub-filters) Fsi,...Fsn filters. The main FP filter uses all the PR pseudo-ranges provided by the EXCL module. It thus uses the pseudo-ranges relative to all the satellites Si,...,SN (we assume here that no satellite has been excluded). The FP filter generates a main inertial-GNSS hybrid navigation solution.

[0086] In contrast, the secondary filters Fsb...,FsN use only a portion of the PR pseudoranges. Each secondary filter F; determines navigation data using: the inertial navigation data NAV_INS; and the pseudoranges relative to the set of satellites Si,...,SN, with the exception of satellite Si. In other words, a secondary filter Fs; uses the pseudoranges {prb...,prN}\{pr;}. We designate the secondary filter Fs; as being associated with satellite Si. The secondary filters Fsb...,FsN develop secondary hybrid inertial-GNSS navigation solutions.

[0087] The HBD hybridization module further includes at least one additional Kalman filter FA (also called an arbiter subfilter). This additional FA filter also provides a hybrid inertial-GNSS navigation solution. As we will detail later, this FA filter is used by the APP device to identify the faulty satellite Sx following the detection of a satellite failure.

[0088] However, before detailing the use of the additional FA filter, we present the general operation of the EXCL module with reference to [Fig.3] and the detection of a satellite failure with reference to [Fig.4].

[0089] Figure 3 shows steps in a process according to an embodiment of the invention for detecting a satellite failure and excluding the faulty satellite. This figure illustrates the operation of the EXCL module for detecting and excluding satellite failures.

[0090] As illustrated by [Fig.3], the EXCL module implements all or part of the illustrated steps S100 to S400 described below.

[0091] At step S100, the EXCL module obtains the pseudo-ranges PR provided by the GNSS receiver. It also obtains all or part of the NAV navigation data from the HBD hybridization module.

[0092] At step S200, the EXCL module detects the presence or absence of an FLT satellite failure. To do this, it uses the pseudo-ranges PR relative to the Sb...,SN satellites provided by the GNSS receiver and the NAV navigation data determined by the various filters of the HBD hybridization module. The implementation of step S200 is detailed with reference to [Fig. 4].

[0093] As illustrated by [Fig.3], if an FLT satellite failure is detected, then the process continues at step S300; otherwise, the process repeats steps S100 and S200.

[0094] At step S300, following the detection of an FLT satellite failure, the EXCL module identifies the faulty satellite Sx among the set of satellites Si,...,SN. The implementation of step S300 is detailed with reference to [Fig. 5].

[0095] At step S400, the EXCL module excludes the satellite Sx identified as faulty. Following the exclusion of satellite Sx, the pseudo-range prx relative to satellite Sx will no longer be used by the APP navigation device to determine NAV navigation data. In addition, a partial reset of the filters of the HBD hybridization module is performed, in a manner similar to that described in patent EP2411832B1.

[0096] Figure 4 shows steps of a process according to an embodiment of the invention for detecting a satellite failure. This figure is shown below to illustrate the implementation of step S200 for detecting an FLT satellite failure.

[0097] According to the embodiment of [Fig.4], the EXCL module detects an FLT satellite failure by implementing the steps S210 and S220 described below.

[0098] In step S210, the EXCL module calculates satellite failure indicators Rsi,...,Rs N associated with the secondary filters Fsi,...,Fsn. For each secondary filter Fs;, a satellite failure indicator Rs; is calculated by the EXCL module.

[0099] The satellite failure indicators Rsb...,RsN may, in particular, correspond to the cross-innovation ratios of the secondary filters Fsi,...,Fsn. The cross-innovation ratio of a filter Fs; may, in particular, be defined as the ratio of the cross-innovation of the pseudo-distance pp to satellite S; to the variance of this cross-innovation. The cross-innovation of the pseudo-distance to satellite Si corresponds to the difference between: the pseudo-distance to satellite Sifoumie by the GNSS receiver, and an estimate of this pseudo-distance provided by the filter Fs; which excludes satellite Si.

[0100] Within the scope of the invention, it could also be envisaged to use other satellite failure indicators. For example, embodiments could be envisaged in which the satellite failure indicators correspond to satellite failure likelihood ratios.

[0101] At step S220, the EXCL module detects an FLT satellite failure if at least one of the satellite failure indicators Rsb.. .,RsN is greater than a detection threshold Xdet.

[0102] Suppose, for example, that satellite S8 has failed. The secondary filter Fs8 uses the pseudo-ranges relative to all satellites except satellite S8. By using the cross-innovation ratio Rs8 (or another satellite failure indicator), it is possible to detect that the pseudo-range pr8 is incorrect and that satellite S8 has failed. Indeed, the secondary filter Fs8 is not affected by the failure of satellite S8 (since it excludes this satellite). A significant discrepancy is therefore observed between: the pseudo-range pr8 provided by the GNSS receiver, and the estimate of this pseudo-range provided by the filter Fs8. It follows that the cross-innovation ratio Rs8 is greater than the detection threshold Xdet.

[0103] That being said, a satellite failure FLT can affect several secondary filters, so that several satellite failure indicators can exceed the detection threshold Xdet. A secondary filter Fs; that uses the pseudo-distance prx relative to the failed satellite Sx (i.e., not excluding the satellite Sx) can have a satellite failure indicator Rs; that exceeds the threshold Xdet, particularly in the case of a poor geometric configuration of the constellation. It is therefore possible that the first satellite failure indicator to exceed the threshold Xdet will be that of a secondary filter affected by the failure. Shortly thereafter, the satellite failure indicator Rsx of the secondary filter Fsx that excludes the failed satellite Sx will in turn exceed the threshold Xdet.

[0104] In this embodiment, the FLT satellite failure is detected by the APP navigation device itself. However, other embodiments could be envisaged in which the FLT satellite failure is detected by another device (distinct from the APP device). For example, the FLT satellite failure could be detected by a device conforming to that proposed in patent application FR2303580.

[0105] When a FLT satellite failure has been detected, it is necessary to identify the faulty satellite Sx from among the set of satellites Si,...,SN in order to exclude it and guarantee the integrity of the navigation solution. We present how the faulty satellite Sx is identified with reference to the following figure.

[0106] Figure 5 represents steps of a process according to an embodiment of the invention for identifying a faulty satellite. This figure illustrates the implementation of step S300 previously introduced with reference to Figure 3.

[0107] It should be noted that step S300 is implemented to identify the faulty satellite Sx following the detection of a satellite FLT failure. This step is therefore implemented if one or more of the satellite failure indicators Rsi,...,RsN of the secondary filters Fsi,...,Fsn are greater than the detection threshold Xdet.

[0108] If a single satellite failure indicator Rs; is greater than the detection threshold Xdet, the satellite Si associated with the secondary filter Fs; can be identified as the failed satellite Sx. However, when several secondary filters have satellite failure indicators greater than the threshold Xdet, there is ambiguity as to which satellite is failing. Several satellites are potentially failing.

[0109] Therefore, according to one embodiment, said at least one additional FA filter is used only when several secondary filters Fsi, ..., FsN exhibit satellite failure indicators exceeding the Xdet threshold. The steps described below are then implemented. This embodiment allows said at least one additional FA filter to be used only when it is necessary to arbitrate between several potentially failing satellites. This minimizes the resources used by the APP device, while ensuring that the failing satellite is reliably identified in the event of a satellite failure.

[0110] Alternatively, consideration could also be given to using said at least one additional FA filter and implementing the steps below each time a satellite failure is detected.

[0111] Figure 5 illustrates an embodiment in which different assumptions of Quarantines are tested sequentially until the faulty satellite Sx is identified. We first present this so-called sequential embodiment, and then describe a so-called parallel embodiment in which several quarantine hypotheses are tested simultaneously.

[0112] According to the sequential embodiment illustrated by [Fig.5], the S300 step of identifying the faulty satellite Sx comprises the steps S310 to S360 described below.

[0113] At step S310, the EXCL module identifies a satellite Sj assumed to be faulty among the set of satellites Si,...,SN.

[0114] In this embodiment, a single satellite Sj is identified as presumed to be faulty. This satellite is quarantined so that the pseudo-ranges relative to it are no longer used by the Fsb...FsN filters. As detailed below, an additional FA filter will be used to test this quarantine hypothesis and confirm or refute the presumed failure of satellite Sj.

[0115] In particular, the satellite Sj identified as presumed to be faulty corresponds to the satellite associated with the filter FSj whose satellite failure indicator RSj is at its maximum and which has not already been quarantined. The identified satellite Sj is therefore the satellite most likely to be faulty, for two reasons: firstly, it is associated with the filter Fsj whose satellite failure indicator Rsj is the highest, and secondly, the exclusion of this satellite Sj has not yet been tested.

[0116] The selection of the presumed failed satellite Sj, which is placed in quarantine, can be carried out by the APP navigation device itself, as described above. However, this quarantine selection can also be made based on information provided by another device (distinct from the APP device). According to one embodiment, the identification of the presumed failed satellite Sj is thus carried out based on information provided by a device conforming to that proposed in patent application FR2303580. The information provided by this other device indicates a presumed failed satellite, or includes additional satellite failure indicators enabling the identification of a presumed failed satellite.

[0117] At step S320, the EXCL module configures (initializes) an additional Kalman filter FA (also called an arbiter subfilter). This additional FA filter is used to simulate the exclusion of the supposedly failed satellite Sj, and thus test the chosen quarantine hypothesis.

[0118] More specifically, the EXCL module identifies the secondary filter Fk that has the maximum satellite failure indicator Rk and excludes a satellite Sk distinct from the assumed failed satellite Sj. In other words, the satellite failure indicator Rsk is the maximum indicator among {Rsi, ..., RsN]\{RSj}. Next, the EXCL module configures (initializes) the additional filter FA based on the secondary filter Fsk. The configuration of the additional filter FA consists, in particular, of copying the covariance matrix, the estimated states, and the measures used by the secondary filter Fsk.

[0119] Note that the additional FA filter excludes the Sk satellite, and the supposedly faulty Sj satellite which is quarantined. It therefore uses the pseudo-distances {pri,...,prN}\{prk, pq}.

[0120] At step S330, the EXCL module performs a (partial) reset of the additional FA filter.

[0121] To reset the additional FA filter, the following operations are performed. The states related to the pseudo-ranges provided by the GNSS receiver and the states related to the other sensors used are reset. The states potentially affected by a failure of the Sj satellite are desensitized by adding state noise.

[0122] Clock and bias states generally exhibit non-negligible correlation times that do not allow for sufficiently rapid convergence. The reset proposed here forces rapid convergence of the states of the additional FA filter.

[0123] At step S340, the EXCL module calculates a satellite failure indicator RA of the additional FA filter after a determined duration TE (also called the quarantine period)•

[0124] The determined time TE between the reset of the additional filter FA and the calculation of its satellite failure indicator RA is generally on the order of a few minutes (for example, between 2 and 3 minutes).

[0125] Resetting the additional filter FA ensures rapid convergence of its states. If the quarantine assumption is correct (the supposedly failed satellite Sj corresponds to the failed satellite Sx), the convergence of the additional filter FA's states to zero allows its satellite failure indicator RA to converge to zero. At the end of the quarantine period, the satellite failure indicator RA will thus be below the threshold Xdet.

[0126] In particular, the satellite failure indicator RA of the FA additional filter corresponds to the cross-innovation ratio of the FA additional filter. However, and as mentioned previously, it could be considered to use other satellite failure indicators.

[0127] At step S350, the EXCL module determines whether the satellite fault indicator RA of the additional filter FA is greater than or equal to the threshold Xdet. It thus determines whether the satellite Sj, assumed to be faulty, is actually faulty or functional.

[0128] We recall that the additional filter FA simulates the exclusion of the satellite Sj, which is assumed to be faulty and is quarantined. If, at the end of the quarantine period, the satellite failure indicator RA is below the threshold, this means that the additional filter FA is no longer affected by the satellite failure and that it excludes the faulty satellite Sx. The quarantine assumption is therefore correct: the supposedly faulty satellite Sj is indeed faulty. In this case, the process continues at step S360.

[0129] Conversely, if the satellite failure indicator RA is greater than or equal to the threshold Xdet, this means that the quarantine assumption is incorrect: the supposedly failed satellite Sj that was quarantined is in fact functional, and the actually failed satellite Sx was not quarantined. In this case, the supposedly failed satellite Sj is determined to be functional and its quarantine is suspended. The process resumes at step S310 to identify another supposedly failed satellite Sj' (distinct from satellite Sj), and repeats the following steps to simulate the exclusion of this satellite Sj'. A new quarantine assumption is thus tested.

[0130] At step S360, the EXCL module identifies satellite Sj as the faulty satellite Sx.

[0131] If the satellite failure indicator RA is below the threshold Xdet, the quarantine assumption is correct: the satellite Sj assumed to be faulty and placed in quarantine does indeed correspond to the faulty satellite Sx that caused the satellite failure FLT. The process will continue at step S400 to exclude this satellite.

[0132] We have presented above an embodiment in which the different quarantine hypotheses are tested one after the other using a single additional filter FA. However, several additional filters can be used in parallel to simultaneously test different quarantine hypotheses, which we will now detail.

[0133] According to one embodiment paraZZèZe (not illustrated), the EXCL module proceeds as follows to identify the faulty satellite Sx using several additional filters denoted FA b...,FAM.

[0134] First, a plurality of satellites Sj b...,Sj M are identified as supposedly faulty (step S310). For each satellite Sj m supposedly faulty, an additional filter FA m is configured and reset (steps S320 and S330).

[0135] Each additional filter FA m is configured from a secondary filter Fsk which presents the maximum satellite failure indicator Rsk and which excludes a satellite Sk distinct from the satellite Sj m. The additional filter FA m allows the exclusion of the satellite Sj m to be simulated.

[0136] At the end of the TE quarantine period, the satellite failure indicators RA b ...,Ra m of the various additional filters FA b ...,FA M are calculated (step S340). These indicators RA b ...,RA M are then compared to identify the faulty satellite Sx (step S360).

[0137] The satellite Sx identified as faulty corresponds, according to one embodiment, to the assumed faulty satellite Sj m for which the additional filter FA m exhibits the minimum satellite failure indicator RA m. Indeed, the various additional filters FA b...,FAM used allow testing different quarantine hypotheses. The additional filter associated with the correct quarantine hypothesis is the one that simulates the exclusion of the faulty satellite Sx. It will therefore exhibit the lowest satellite failure indicator at the end of the quarantine period.

[0138] Several embodiments can be considered for the number of additional filters used in parallel. One option is to use as many additional filters as there are satellites in the satellite set (i.e., M=N). In this case, all satellites Sb...,SN are identified as assumed to be faulty, and the additional filters FA b...,FA N simulate the exclusion of each of them to identify the faulty satellite Sx.

[0139] Alternatively, the number of additional filters can correspond to the number of secondary filters whose satellite failure indicator is greater than the detection threshold Xdet. When several secondary filters have satellite failure indicators greater than the threshold Xdet, there is ambiguity as to which satellite is failing. Several satellites are potentially failing. To quickly arbitrate between these different satellites and limit the amount of resources required, it is appropriate to use as many additional filters as there are secondary filters whose satellite failure indicator is greater than a threshold. Such an embodiment allows for an advantageous compromise between the speed of identifying the failing satellite and the amount of resources required to implement the proposed solution.

[0140] Additional variations: A person skilled in the art will understand that the variations and embodiments described above are only non-limiting examples of implementation of the invention. In particular, a person skilled in the art may consider any adaptation or combination of the embodiments and variations described above to meet a specific need.

[0141] It should also be noted that the order in which the steps of a process according to the invention are carried out, particularly with reference to the accompanying drawings, is only one example of an embodiment and is not in any way limiting, as variations are possible. In particular, a process according to the invention may comprise one or more iterations of the steps described above, particularly with reference to the accompanying drawings. Furthermore, the reference symbols do not limit the scope of protection; their sole purpose is to facilitate understanding of the claims.

[0142] Finally, the term module can refer to a software component, a hardware component, or a set of hardware and software components. A software component itself corresponds to one or more computer programs or subprograms, or more generally to any element of a program capable of implementing a function or set of functions as described for the modules concerned. Similarly, a hardware component corresponds to any element of a hardware assembly capable of implementing a function or set of functions for the module concerned (integrated circuit, smart card, memory card, etc.).

Claims

Demands

1. A method implemented by a device (APP) comprising a plurality of Kalman filters Fsi,...,Fsn, each filter Fs; determining navigation data (NAV) of a mobile (AC) from pseudo-ranges (PR) relative to a set of satellites Si,...,SN excluding satellite S; the method comprising: - following the detection (S200) of a satellite failure (FLT), a step of identifying (S300) a failed satellite Sx among the set of satellites Si,...,SN, this step (S300) comprising for at least one satellite Sj assumed to be failed: • a step of identifying the filter Fsk excluding a satellite Sk distinct from the satellite Sj assumed to be failed and whose satellite failure indicator Rsk is maximum; • a step of configuring (S320) an additional Kalman filter FA distinct from the filters Fsi,...,,Fsn, this additional filter FA being configured from the filter Fsk; • a step of resetting (S330) the additional filter FA, this additional filter FA excluding the Sk satellite and the supposedly failed satellite Sj; and • a step of determining (S350) whether the Sj satellite is failed based on a satellite failure indicator RA of the additional filter FA calculated after a specified time (TE).

2. A method according to claim 1, wherein a said satellite failure indicator is a cross-innovation ratio.

3. A method according to claim 1 or 2, wherein said step of identifying (S300) the faulty satellite Sx comprises said steps of configuring (S320), resetting (S330), and determining (S350), only if several of the Fsk.. ,,FsN filters have satellite failure indicators above a threshold (Xdet )•

4. A method according to any one of claims 1 to 3, wherein the assumed faulty satellite Sj corresponds to the satellite associated with the filter Fsj whose satellite failure indicator Rsj is maximum and which has not been previously assumed to be faulty.

5. A method according to claim 4, wherein: - if the satellite failure indicator RA of the additional filter Fa is less than a threshold (Xdet), the satellite Sj assumed to be faulty is determined (S350) to be faulty; and - otherwise, another satellite Sj- is assumed to be faulty, and said steps of configuring (S320), resetting (S330), and determining (S350) are repeated.

6. A method according to any one of claims 1 to 3, wherein several satellites Sj i,...,Sj M are assumed to be faulty, and several additional filters FA i,...,FaM are configured (S320) and reset (S330).

7. Method according to claim 6, wherein the satellite Sj m assumed to be faulty, for which the additional filter FA m has the minimum satellite fault indicator RA m, is determined (S350) to be faulty.

8. Method according to claim 6 or 7, wherein the supposedly faulty satellites Sj i, ...,Sj M correspond to the satellites associated with the filters Fsj i,... .,FSj M whose satellite failure indicators Rsj b.... .,RSj M are greater than a threshold (Xdet).

9. Device (APP) comprising a plurality of Kalman filters Fsi,...,Fsn, each filter Fs; determining navigation data (NAV) of a mobile (AC) from pseudo-ranges (PR) relative to a set of satellites Si,...,SN excluding satellite S;, the device (APP) comprising: - a module (EXCL) configured to, following the detection (S200) of a satellite failure (FLT), identify (S300) a failing satellite Sx among the set of satellites Si,...,SN, this module (EXCL) being configured to: • identify the filter Fsk excluding a satellite Sk distinct from the supposedly failing satellite Sj and whose satellite failure indicator Rsk is maximum; • configure (S320) an additional Kalman filter FA distinct from the Fsb.. .,FsN filters, this additional filter FA being configured from the Fsk filter • reset (S330) the additional filter FA, this additional filter FA excluding the Sk satellite and the supposedly failed Sj satellite; and • determine (S350) whether the Sj satellite is failed based on a satellite failure indicator RA of the additional filter FA calculated after a specified time (TE).

10. Navigation system (SYS) intended to be carried in a mobile (AC) comprising: - a satellite positioning receiver (GNSS) configured to provide pseudo-ranges relative to a set of Sb...,SN satellites; and - a device (APP) according to claim 9.

11. Mobile device (AC) comprising a navigation system (SYS) according to claim 10.

12. Computer program (PROG) comprising instructions to carry out the steps of a process according to any one of claims 1 to 8, when said computer program (PROG) is executed by at least one processor (PROC).

Images