Method and device for detecting and excluding a satellite failure

Abstract

The present invention relates to a method and a device for detecting and excluding a satellite failure, the device comprising a plurality of Kalman filters Fs1,...,FsN, each filter Fsi determining navigation data (NAV) of a mobile (AC) from pseudo-distances (PR) relating to a set of satellites S1,...,SN except for the satellite Si. In particular, the proposed method comprises, following the detection (S200) of a satellite failure, a step of identifying (S300) a faulty satellite Sx among the set of satellites S1,...,SN, this step (S300) comprising, for at least one satellite Sj assumed to be faulty: a step of identifying the filter Fsk excluding a satellite Sk distinct from the satellite Sj assumed to be faulty and a satellite failure indicator Rsk of which is at a maximum; a step of configuring (S320) an additional Kalman filter FA distinct from the filters Fs1,...,FsN, this additional filter FA being configured based on the filter Fsk; a step of resetting (S330) the additional filter FA, this additional filter FA excluding the satellite Sk and the satellite Sj assumed to be faulty; and a step of determining (S350) whether the satellite Sj is faulty based on a satellite failure indicator RA of the additional filter FA computed after a determined duration (TE).

Description

Description Title of the invention: Method and device for detecting and excluding a satellite failure Technical field

[0001] The present invention relates to the field of satellite navigation, also known as GNSS navigation for "Global Navigation Satellite System" in English. In particular, the present invention relates to a method and a device for detecting and excluding a satellite failure. It also relates to a navigation system, a mobile vehicle, and a computer program. The present invention finds a particularly advantageous, although in no way limiting, application for the implementation of navigation systems for aircraft, ships, or land vehicles. Prior art

[0002] The present invention falls, in particular, within the context of hybrid inertial-GNSS navigation. To determine the navigation data of a mobile such as an aircraft, a hybrid inertial-GNSS navigation system combines inertial data from an inertial measurement unit and pseudo-distances provided by a satellite positioning receiver. The pseudo-distances, also called "pseudo-ranges" in English, characterize the distances between the mobile and the visible satellites of a constellation. A hybrid inertial-GNSS navigation system uses a hybridization algorithm, generally based on a Kalman filter, to combine the data from the different sensors and take advantage of their respective benefits. The use of the pseudo-distances associated with the satellites makes it possible in particular to compensate for the inertial navigation drift.

[0003] Some applications require navigation systems to meet strict integrity constraints. In the field of aeronautics, the reliability of navigation data is critical. The navigation systems used must be able to determine the position of an aircraft with a given integrity risk, i.e. with a defined probability (e.g., IO 7) that the position error is greater than a protection radius (an alert terminal) without triggering an alert. In the case of a hybrid inertial-GNSS navigation system, the failure of a satellite affects the pseudo-distance relative to this satellite, in particular in the form of a bias, a drift or an acceleration. The failure of a satellite can thus lead to significant errors in the estimated position of the mobile, and these errors tend to increase over time. It is therefore essential to be able to detect a possible satellite failure and to exclude the faulty satellite to guarantee the integrity of the navigation system.

[0004] To detect and exclude a satellite failure, it is known to use a bank of Kalman filters in which each of the filters excludes the pseudo-distance relative to a satellite. Patent EP2411832B1 illustrates such a solution. For each of the filters in the bank, a satellite failure indicator is calculated using the cross-innovation of the filter, i.e. using the difference between the pseudo-distance to the satellite in question provided by the satellite positioning receiver and an estimate of this pseudo-distance provided by the filter excluding this satellite. These satellite failure indicators generally make it possible to detect and exclude a satellite failure. For example, the satellite associated with the highest satellite failure indicator and exceeding a certain detection threshold can be identified as the faulty satellite.

[0005] However, the reliability of existing solutions is not fully satisfactory. They may erroneously exclude a functioning satellite instead of the faulty one. Such exclusion errors occur in particular in the case of poor geometric configurations of the satellite constellation, characterized by a significant horizontal dilution of precision coefficient (or "Horizontal Dilution of Precision"). For example, such exclusion errors can occur when few satellites are visible, or when they are located close to the horizon.

[0006] There is therefore a need for a solution that can reliably identify a faulty satellite among a set of satellites. Statement of the invention

[0007] The present invention aims to remedy all or part of the drawbacks of the prior art, in particular those set out above.

[0008] According to one aspect of the invention, a method is proposed implemented by a device comprising a plurality of Kalman filters FSI,...,FSN, each filter Fsi determining navigation data of a mobile from pseudo-distances relating to a set of satellites SI,...,SN with the exception of the satellite Si, the method comprising a step consisting of identifying a faulty satellite Sx among the set of satellites SI,...,SN, this step comprising for at least one satellite Sj assumed to be faulty: a step consisting of configuring an additional Kalman filter FA (also called an arbitrated sub-filter) from the filter Fsk excluding a satellite Sk distinct from the satellite Sj assumed to be faulty and of which a satellite failure indicator Rsk is maximum (among the plurality of filters Fsi,...,FsN with the exception of the Fsj filter associated with the satellite Sj assumed to be faulty); a step consisting of resetting (partially) the additional filter FA, this additional filter FA excluding the satellite Sj assumed to be faulty; and. a step consisting of determining whether the satellite Sj (assumed to be faulty) is faulty based on a satellite failure indicator RA of the additional filter FA calculated after a determined duration (also called quarantine period).

[0009] The present invention makes it possible to reliably identify a faulty satellite Sx among a set of satellites SI,...,SN. To do this, it is proposed to use at least one additional Kalman filter FA (independent of the filters FSI,...,FSN) to simulate the exclusion of a supposedly faulty satellite Sj. This makes it possible to test a quarantine hypothesis to confirm or invalidate the supposed failure of a satellite Sj. We present here the operating principle of the present invention by considering a single additional filter FA, but several additional filters can be used.

[0010] The steps of the proposed method, mentioned above, are notably implemented following the detection of a satellite failure (for example, if one or more satellite failure indicators of the filters FSI,...,FSN are greater than a threshold). To simulate the exclusion of a satellite Sj assumed to be faulty, an additional Kalman filter FA is used. More precisely, the additional filter FA is configured from the filter Fsk excluding the satellite Sk (distinct from the satellite Sj assumed to be faulty) and whose satellite failure indicator Rsk is maximum. This additional filter FA does not use the pseudo-distance relative to the satellite Sj assumed to be faulty which is placed in quarantine. The filter FA is reset to ensure a rapid convergence of its states.

[0011] At the end of a quarantine period, the satellite failure indicator RA of the additional filter FA is evaluated to confirm or deny the supposed failure of the satellite Sj. For example, if the satellite failure indicator RA has fallen below a certain threshold following the exclusion of the supposedly faulty satellite Sj, then the satellite Sj is indeed faulty. The satellite Sj can then be excluded so that the pseudo-distance relating to it is no longer used for navigation, and the various filters can also be reset.

[0012] Compared to existing solutions, the present invention makes it possible to reliably identify a faulty satellite among a set of satellites, even in the case of poor geometric configurations of the satellite constellation. In other words, the present invention makes it possible to reduce the number of erroneous exclusions during satellite failures.

[0013] More particularly, the advantages of the present invention should be highlighted compared to the solution described in patent EP2411832B1. In the latter, as soon as the cross-innovation associated with a satellite exceeds a certain threshold, this satellite is declared faulty so that the pseudo-distance associated with this satellite is no longer used by the filters of the navigation device, and these filters are reset. The cross-innovations of the different filters are then monitored for a predetermined period to confirm or deny the failure of the excluded satellite. If it turns out that the satellite declared faulty is not the faulty satellite, then the filters of the navigation device have been reset wrongly, and they continue to be affected by the failure. In fact, when such an erroneous exclusion has been carried out, the filters have been reset using erroneous values. Thus, even if cross-innovations of the different filters continue to be monitored thereafter, it is likely that the actual faulty satellite cannot be identified and excluded, given that the different filters will have been using erroneous values ​​for a significant period of time. In other words, it is particularly difficult to remedy an erroneous exclusion during a satellite failure.

[0014] Unlike the solution described in patent EP2411832B1, the present invention proposes to use an additional filter FA independent of the filters FSI,...,FSN to test a quarantine hypothesis and simulate the exclusion of a satellite assumed to be faulty. The present invention makes it possible to quickly determine whether the satellite assumed to be faulty is actually faulty. This therefore makes it possible not to reset the Kalman filters if it is determined that the satellite assumed to be faulty is not in fact faulty. In this way, the present invention advantageously makes it possible to guarantee that the navigation solution and the various filters of the device are not altered (in particular reset) until the failure of a satellite is actually confirmed. The present invention thus reduces the number of erroneous exclusions during satellite failures and contributes to guaranteeing the integrity of the navigation device.

[0015] It is important to note that the identification of the satellite Sj assumed to be faulty can be carried out by the device implementing the method, but can also be carried out on the basis of information provided by another device. In particular, the identification of the satellite Sj assumed to be faulty can be carried out on the basis of information provided by a device conforming to that proposed in patent application FR2303580.

[0016] According to one embodiment, a said satellite failure indicator is a cross-innovation ratio (or is determined from cross-innovation).

[0017] It is proposed here to use the cross-innovation ratio as an indicator of satellite failure. For an Fsi filter excluding the satellite Si, the cross-innovation ratio Rsi is notably defined as the ratio of the cross-innovation of the pseudo-distance to the satellite Si to the variance of this cross-innovation. The cross-innovation of the pseudo-distance to the satellite Si corresponds to the difference between: the pseudo-distance to the satellite Si provided by the satellite positioning receiver, and an estimate of this pseudo-distance provided by the Fsi filter. The same applies to said at least one additional filter FA.

[0018] This embodiment is advantageous in that it allows for the reliable identification of a faulty satellite, while ensuring minimal implementation complexity. On the one hand, the cross-innovation ratio is a reliable indicator of satellite failure, and its reliability is even enhanced by the proposed solution. On the other hand, the use of the cross-innovation ratio as a satellite failure indicator helps minimize the resources required (e.g., computing and memory resources, processing time, etc.) to implement the proposed solution.

[0019] Alternatively, embodiments could be contemplated in which other satellite failure indicators are used. For example, it could be contemplated to use a satellite failure likelihood ratio.

[0020] According to one embodiment, said step of identifying the faulty satellite Sx comprises said steps of configuring, resetting, and determining, only if several of the filters FSI,...,FSN have satellite fault indicators greater than a threshold.

[0021] In this embodiment, said at least one additional filter FA is used only when several filters among the filters FSI,...,FSN have satellite failure indicators above a certain detection threshold.

[0022] If a single filter Fsi has a satellite failure indicator Rsi above the detection threshold, the satellite Si associated with the filter Fsi can be identified as the failed satellite Sx. However, when several filters have satellite failure indicators above the detection threshold, there is ambiguity regarding the failed satellite and several satellites are potentially failed. Said at least one additional filter FA is then used to arbitrate between these potentially failed satellites, by testing the chosen quarantine hypothesis. This allows to reliably identify the failed satellite.

[0023] Said at least one additional FA filter is used here only when it is necessary to arbitrate between several potentially faulty satellites. This embodiment therefore makes it possible to reliably identify a faulty satellite, while minimizing the resources required to implement the proposed solution.

[0024] Alternatively, embodiments could be envisaged in which said at least one additional FA filter is used each time a satellite failure is detected.

[0025] According to one embodiment, the satellite Sj assumed to be faulty corresponds to the satellite being associated with the filter Fsj of which a satellite failure indicator Rsj is maximum (among the plurality of filters FSI,...,FSN) and not having been previously assumed to be faulty.

[0026] In this embodiment, only one satellite Sj at a time is assumed to be faulty. This satellite is quarantined so that the pseudo-distance relating to it is no longer used by the filters FSI,...,FSN. The satellite Sj assumed to be faulty is the satellite associated with the filter Fsj whose satellite failure indicator Rsj is maximum and which has not already been quarantined. The satellite Sj is therefore the one that is most likely to be faulty. To simulate the exclusion of this single satellite Sj assumed to be faulty, a single additional filter FA is used. This makes it possible to confirm or invalidate the chosen quarantine hypothesis.

[0027] This embodiment thus makes it possible to reliably identify a faulty satellite among a set of satellites, while minimizing the resources required.

[0028] According to one embodiment, if the satellite failure indicator RA of the additional filter FA is lower than a threshold (after the determined duration), the satellite Sj assumed to be faulty is determined as being faulty; otherwise, another satellite Sy (distinct from satellite Sj) is assumed to be faulty, and said steps of configuring, resetting, and determining are repeated (for this satellite Sj).

[0029] This embodiment proposes to sequentially test the different quarantine hypotheses until the faulty satellite is identified.

[0030] As a reminder, the additional filter FA excludes the supposedly faulty satellite Sj which is quarantined. If, at the end of the quarantine period, the satellite failure indicator RA of the additional filter FA is below the threshold, this means that the additional filter FA is no longer affected by the satellite failure and that it excludes the faulty satellite Sx. The quarantine hypothesis is therefore correct: the supposedly faulty satellite Sj placed in quarantine corresponds to the faulty satellite Sx. This satellite can therefore be excluded so that the pseudo-distance relating to it is no longer used, and the filters of the navigation device can be reset.

[0031] On the other hand, if the satellite failure indicator RA of the additional filter FA is greater than the threshold at the end of the quarantine period, this means that the quarantine hypothesis is incorrect: the supposedly faulty satellite Sj quarantined is in fact functional, and the actually faulty satellite Sx has not been quarantined. In this case, another satellite Sj' is assumed to be faulty and the steps of the method are repeated to simulate the exclusion of this satellite Sj'. A new quarantine hypothesis is thus tested.

[0032] This embodiment thus contributes to reliably identifying the faulty satellite among the set of satellites.

[0033] According to one embodiment, several satellites Sji,...,Sj M are assumed to be faulty, and several additional FAI,...,FAM filters are configured and reset.

[0034] In this embodiment, several additional filters are used in parallel. This allows different quarantine hypotheses to be tested simultaneously.

[0035] In fact, several satellites Sji,...,Sj M are assumed to be faulty; and said steps of configuring, resetting, and determining are implemented simultaneously for these satellites Each additional filter FA™ is used to test a quarantine hypothesis. The faulty satellite Sx is then identified based on the satellite failure indicators RAI,...,RAM of the additional filters FAI,...,FAM calculated after the quarantine period.

[0036] This embodiment is advantageous in that it makes it possible to reliably and quickly identify the faulty satellite among a set of satellites.

[0037] According to one embodiment, the satellite Sj massumed to be faulty, for which the additional filter FA™ has the minimum satellite failure indicator RA™ (among the additional filters FAI,...,FAM), is determined to be faulty.

[0038] We recall that the different additional filters FAI,...,FAM allow to test different quarantine hypotheses (i.e. to simulate the exclusion of different satellites). However, the additional filter associated with the correct quarantine hypothesis is the one that simulates the exclusion of the faulty satellite Sx. It will therefore present the lowest satellite failure indicator at the end of the quarantine period.

[0039] This is why the Sx satellite identified as faulty corresponds here to the Sj satellite massociated with the additional filter FA™ whose satellite failure indicator RA™ is minimum at the end of the quarantine period (the additional filter FAm simulates the exclusion of the satellite Sjm). This embodiment thus contributes to reliably and quickly identifying the faulty satellite among the set of satellites.

[0040] According to one embodiment, the satellites Sji,...,Sj M supposedly faulty correspond to the satellites associated with the filters Fsji,...,Fsj M including satellite failure indicators Rsji,...,Rsj M are above a threshold.

[0041] As mentioned previously, when several of the filters FSI,...,FSN have satellite failure indicators above the detection threshold, there is ambiguity regarding the failed satellite. Several satellites are potentially faulty. In this embodiment, several additional filters FAI,...,FAM are used to test different quarantine hypotheses in parallel, and quickly arbitrate between the potentially faulty satellites Sji,...,Sj M The number of additional filters used here corresponds to the number of filters Fsji,...,Fsj M whose satellite failure indicators Rsji,...,Rsj M are above the detection threshold.

[0042] This embodiment thus makes it possible to achieve a particularly advantageous compromise between the speed of identification of the faulty satellite and the quantity of resources required (e.g. computing resources and memory) to implement the proposed solution. In other words, this embodiment makes it possible to reliably and quickly identify a faulty satellite among a set of satellites, while limiting the quantity of resources required.

[0043] Alternatively, embodiments could be envisaged in which the number of additional filters used corresponds to the number of satellites in the satellite set.

[0044] According to one aspect of the invention, a device is proposed comprising a plurality of Kalman filters FSI,...,FSN, each filter Fsi determining navigation data of a mobile from pseudo-distances relating to a set of satellites SI,...,SN with the exception of the satellite Si, the device comprising a module configured to identify a faulty satellite Sx among the set of satellites SI,...,SN, this module being configured to: configure an additional Kalman filter FA from the filter Fsk excluding a satellite Sk distinct from a satellite Sj assumed to be faulty and of which a satellite failure indicator Rsk is maximum; (partially) resetting the additional filter FA, this additional filter FA excluding the satellite Sj assumed to be faulty; and determining whether the satellite Sj (assumed to be faulty) is faulty based on a satellite failure indicator RA of the additional filter FA calculated after a determined duration.

[0045] The proposed device may be configured to implement any of the embodiments of a method according to the invention. In particular, for each step of a method according to the invention, the proposed device may comprise a module configured to implement this step.

[0046] In particular, the proposed device is a navigation device intended to be included in a navigation system on board a mobile (for example, an aircraft).

[0047] In addition to the filters FSI,...,FSN, the proposed device may comprise a Kalman filter Fp (also called main filter) determining navigation data of the mobile from the pseudo-distances relative to the set of satellites SI,...,SN. It should be specified that the main filter FP uses the pseudo-distances relative to each satellite Si of the set of satellites SI,...,SN, provided that the satellite Si has not been excluded.

[0048] According to one aspect of the invention, a navigation system is proposed intended to be embedded in a mobile comprising: a satellite positioning receiver configured to provide pseudo-distances relative to a set of satellites SI,...,SN ; and a device according to the invention.

[0049] This navigation system may, for example, be installed in an aircraft, a ship, or a land vehicle. It may also include an inertial measurement unit, for example comprising accelerometers and / or gyroscopes.

[0050] According to one aspect of the invention, there is provided a mobile machine comprising a navigation system according to the invention.

[0051] The proposed mobile device may be an aircraft, a vessel, or a land vehicle.

[0052] According to one aspect of the invention, there is provided a computer program comprising instructions for implementing the steps of a method according to the invention, when the computer program is executed by at least one processor or computer.

[0053] The computer program may consist of one or more subparts stored in the same memory or in separate memories. The program may use any programming language, and may be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0054] According to one aspect of the invention, there is provided a computer-readable information medium comprising a computer program according to the invention.

[0055] The information carrier may be any entity or device capable of storing the program. For example, the carrier may comprise a storage means, such as a non-volatile memory or ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a hard disk. Furthermore, the storage medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by a telecommunications network or by a computer network or by other means. The program according to the invention may in particular be downloaded onto a computer network. Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

[0056] The proposed device, navigation system, aircraft, computer program, and information medium have the advantages described above in connection with the proposed method. Brief description of the drawings

[0057] Other characteristics and advantages of the present invention will emerge from the description provided below, illustrating embodiments of the invention given by way of example and without any limiting character, with reference to the attached drawings:

[0058] Figure 1 represents the hardware architecture of an aircraft according to one embodiment of the invention;

[0059] Figure 2 represents the functional architecture of a device according to one embodiment of the invention;

[0060] Figure 3 represents steps of a method according to an embodiment of the invention for detecting a satellite failure and excluding the faulty satellite;

[0061] Figure 4 represents steps of a method according to an embodiment of the invention for detecting a satellite failure; and

[0062] Figure 5 represents steps of a method according to an embodiment of the invention for identifying a faulty satellite. Description of the embodiments

[0063] The present invention applies, in particular, to aircraft navigation systems. The following description of the invention will refer to this particular context of application, which is not given only as an illustrative example and should not limit the invention. The latter applies to navigation for any type of carrier, mobile machine, or vehicle.

[0064] Figure 1 represents the hardware architecture of an aircraft according to an embodiment of the invention. This figure is described below to introduce the present invention and to exemplify a context of application thereof.

[0065] The aircraft AC illustrated in Figure 1 is equipped with a navigation system SYS. In the context of the invention, the term "aircraft" means any device capable of rising and moving in the air, such as an airplane, a helicopter, a drone, etc.

[0066] The SYS navigation system includes: an IMU inertial measurement unit; a GNSS satellite positioning receiver; and an APP navigation device.

[0067] The inertial measurement unit IMU is configured to provide inertial increments INC to the navigation device APP. This IMU unit includes accelerometers and gyroscopes, the increments INC correspond to velocity increments and angular increments.

[0068] The GNSS receiver is configured to receive signals emitted by a set of satellites SI,...,SN. These satellites belong, for example, to the satellite constellation of the GPS system, or the Galileo system. The GNSS receiver is configured to determine, from the signals received from the satellites SI,...,SN, the pseudo-distances PR between the satellites SI,...,SN and the GNSS receiver (i.e. the receiver). It provides these pseudo-distances PR to the APP navigation device. We also use the expression "pseudo-distance relative to a satellite Si" to designate the pseudo-distance between the satellite Si and the GNSS receiver and denote this pseudo-distance pn.

[0069] The APP navigation device is configured to determine NAV navigation data of the AC aircraft. By "navigation data", we mean data relating to the position and / or movement of the AC aircraft, such as geographical coordinates (e.g. latitude, longitude, altitude), speed, attitudes. This NAV navigation data may for example be provided to a CMD guidance device of the AC aircraft (e.g. an autopilot device).

[0070] The APP navigation device here implements a hybrid inertial-GNSS navigation solution. It determines the NAV navigation data of the aircraft AC using both the pseudo-distances PR provided by the GNSS satellite positioning receiver, and the inertial increments INC provided by the inertial measurement unit IMU.

[0071] Within the scope of the invention, other embodiments could also be envisaged in which other forms of hybridization are used. For example, data from additional sensors, such as a barometer or a camera, could be used.

[0072] The APP navigation device is further configured to detect a satellite failure and / or exclude a failed satellite from the set of satellites SI,...,SN. WE will present further details how the APP device detects a satellite failure and excludes a failed satellite, with reference to the following figures.

[0073] The hardware architecture of the APP device is illustrated in Figure 1. According to this embodiment, the APP device comprises: at least one processing unit or processor PROC; and at least one memory MEM.

[0074] According to one embodiment, the APP device has the hardware architecture of a computer. The memory MEM constitutes an information medium in accordance with the invention, on which a computer program PROG in accordance with the invention is recorded. The program PROG comprises instructions for carrying out steps of a method in accordance with the invention, when the program PROG is executed by the processor PROC. The program PROG defines the functional modules of the APP device shown in Figure 2, which rely on or control the hardware elements of this device.

[0075] As illustrated in Figure 1, the APP device has a COM communication module configured to communicate with: the GNSS receiver, the IMU inertial measurement unit, and / or the CMD guidance module. No limitation is attached to the nature of the communication interfaces between these devices.

[0076] Above we have introduced the hardware architecture of the APP navigation device. Now we describe its functional architecture with reference to the following figure.

[0077] Figure 2 represents the functional architecture of a device according to one embodiment of the invention. This figure illustrates the operation of the APP navigation device.

[0078] As mentioned previously, the APP navigation device is configured to determine NAV navigation data of the aircraft from the inertial increments INC provided by the inertial measurement unit IMU and the pseudo-distances PR provided by the GNSS receiver. According to the embodiment of FIG. 2, the APP device comprises the following modules: a virtual platform PFV (or inertial navigation module); a hybridization module HBD; and an EXCL module for detecting and excluding satellite failures.

[0079] It should first be noted that the architecture of the APP device proposed here is based on that of the device presented in patent EP2411832B1. However, the APP device proposed here differs from the device described in patent EP2411832B1 in several points, and in particular by its use of at least one additional Kalman filter FA (also called arbiter filter). It should also be emphasized that the EXCL module for detecting and excluding satellite failures proposed in the present application uses said at least one additional Kalman filter FA. Thus, the implementation of the EXCL module proposed here differs from the implementation of the satellite failure detection and exclusion module previously proposed in patent EP2411832B1.

[0080] Below we briefly present the functions of the different modules of the APP device. Regarding the implementation details of some of these modules, it is also possible to refer to patent EP2411832B1, and the references cited therein.

[0081] The PFV virtual platform is configured to determine inertial navigation data NAV_INS from the INC increments provided by the inertial measurement unit IMU. The PFV virtual platform may further use the NAV navigation data determined by the HBD hybridization module (e.g., to compensate for inertial navigation drift).

[0082] The EXCL module is configured to detect a satellite failure and / or exclude the faulty satellite. It provides the HBD hybridization module with all or part of the pseudo-distances PR delivered by the GNSS receiver depending on the satellites identified as functional or faulty. If a satellite Si is identified as faulty (i.e. if it is excluded), the EXCL module receives the pseudo-distance pn relating to this satellite, but does not provide it to the HBD hybridization module. We will detail the operation of the EXCL module with reference to figures 3 to 5.

[0083] The HBD hybridization module is configured to determine NAV navigation data of the aircraft AC from the inertial navigation data NAV_INS provided by the virtual platform PFV and the pseudo-distances PR provided by the EXCL module. The HBD module thus implements an inertial-GNSS hybridization.

[0084] As discussed above, embodiments of the invention could be envisaged in which other forms of hybridization are used. For example, the hybridization module could also use data from additional sensors, such as a camera, or a barometer.

[0085] To implement inertial-GNSS hybridization, the HBD hybridization module includes (implements) several Kalman filters: a so-called main Fp filter, and secondary FSI,...FSN filters (or sub-filters). The main FP filter uses all the pseudo-distances PR provided by the EXCL module. It thus uses the pseudo-distances relative to all the satellites SI,...,SN (we consider here that no satellite has been excluded). The Fp filter develops a main inertial-GNSS hybrid navigation solution.

[0086] In contrast, the secondary filters FSI,...,FSN use only a part of the pseudo-ranges PR. Each secondary filter Fi determines navigation data using: the inertial navigation data NAV_INS; and the pseudo-ranges relative to the set of satellites SI,...,SN except for satellite Si. In other words, a secondary filter FSÎ uses the pseudo-ranges {pri,...,prN}\{pri}. We designate the secondary filter Fsi as being associated with satellite Si. The secondary filters FSI,...,FSN develop secondary hybrid inertial-GNSS navigation solutions.

[0087] The HBD hybridization module further includes at least one additional Kalman filter FA (also called arbiter subfilter). This additional filter FA also develops a solution of hybrid inertial-GNSS navigation. As we will detail later, this FA filter is used by the APP device to identify the faulty satellite Sx following the detection of a satellite failure.

[0088] However, before detailing the use of the additional FA filter, we present the general operation of the EXCL module with reference to figure 3 and the detection of a satellite failure with reference to figure 4.

[0089] Figure 3 represents steps of a method according to an embodiment of the invention for detecting a satellite failure and excluding the faulty satellite. This figure illustrates the operation of the EXCL module for detecting and excluding satellite failures.

[0090] As illustrated in Figure 3, the EXCL module implements all or part of the illustrated steps S100 to S400 described below.

[0091] In step S 100, the EXCL module obtains the PR pseudo-distances provided by the GNSS receiver. It also obtains all or part of the NAV navigation data from the HBD hybridization module.

[0092] In step S200, the EXCL module detects the presence or absence of an FLT satellite failure. To do this, it uses the pseudo-distances PR relating to the satellites SI,...,SN provided by the GNSS receiver and the NAV navigation data determined by the different filters of the HBD hybridization module. The implementation of step S200 is detailed with reference to Figure 4.

[0093] As illustrated in Figure 3, if an FLT satellite failure is detected, then the method continues to step S300; otherwise, the method repeats steps S100 and S200.

[0094] In step S300, following the detection of a satellite failure FLT, the module EXCL identifies the faulty satellite Sx among the set of satellites SI,...,SN. The implementation of step S300 is detailed with reference to figure 5.

[0095] In step S400, the EXCL module excludes the satellite Sx identified as faulty. Following the exclusion of the satellite Sx, the pseudo-distance pr relative to the satellite Sx will no longer be used by the navigation device APP to determine the navigation data NAV. In addition, a partial reset of the filters of the HBD hybridization module is carried out, in a manner similar to that described in patent EP2411832B1.

[0096] Figure 4 represents steps of a method according to an embodiment of the invention for detecting a satellite failure. This figure is presented below to illustrate the implementation of step S200 of detecting an FLT satellite failure.

[0097] According to the embodiment of FIG. 4, the EXCL module detects an FLT satellite failure by implementing steps S210 and S220 described below.

[0098] In step S210, the EXCL module calculates satellite failure indicators RSI,...,RSN associated with the secondary filters FSI,...,FSN. For each secondary filter Fsi, a satellite failure indicator Rsi is calculated by the EXCL module.

[0099] The satellite failure indicators RSI,...,RSN can correspond in particular to the cross-innovation ratios of the secondary filters FSI,...,FSN. The cross-innovation ratio of an Fsi filter can be defined in particular as the ratio of the cross-innovation of the pseudo-distance pn to the satellite Si to the variance of this cross-innovation. The cross-innovation of the pseudo-distance to the satellite Si corresponds to the difference between: the pseudo-distance to the satellite Si provided by the GNSS receiver, and an estimate of this pseudo-distance provided by the Fs filter, which excludes the satellite Si.

[0100] Within the scope of the invention, it could also be envisaged to use other satellite failure indicators. For example, embodiments could be envisaged in which the satellite failure indicators correspond to satellite failure likelihood ratios.

[0101] In step S220, the EXCL module detects a satellite failure FLT if at least one of the satellite failure indicators RSI,...,RSN is greater than a detection threshold Àdet.

[0102] For example, suppose that satellite Ss is out of order. The secondary filter Fss uses the pseudo-distances relative to all satellites except satellite Ss. Using the cross-innovation ratio Rss (or another satellite failure indicator), it is possible to detect that the pseudo-distance prs is erroneous and that satellite Ss is out of order. Indeed, the secondary filter Fss is not affected by the outage of satellite Ss (since it excludes this satellite). A significant discrepancy is therefore observed between: the pseudo-distance prs provided by the GNSS receiver, and the estimate of this pseudo-distance provided by the filter Fss. It follows that the cross-innovation ratio Rss is greater than the detection threshold Àdet.

[0103] That being said, an FLT satellite failure can affect multiple secondary filters, so multiple satellite failure indicators can exceed the detection threshold Àdet. A secondary filter Fsi that uses the pseudo-range pr x relating to the faulty satellite Sx (i.e. not excluding the satellite Sx) may have a satellite failure indicator Rs greater than the threshold Àdet, particularly in the case of a poor geometric configuration of the constellation. It is therefore possible that the first satellite failure indicator to exceed the threshold Àdet is that of a secondary filter affected by the failure. Shortly after, the satellite failure indicator Rs x of the secondary filter Fs x excluding the faulty satellite Sx will in turn exceed the threshold Àdet.

[0104] In this embodiment, the FLT satellite failure is detected by the APP navigation device itself. However, other embodiments could be envisaged in which the FLT satellite failure is detected by another device (distinct from the APP device). For example, the FLT satellite failure could be detected by a device conforming to that proposed in patent application FR2303580.

[0105] When an FLT satellite failure has been detected, it is necessary to identify the faulty satellite Sx among the set of satellites SI,...,SN to exclude it and guarantee the integrity of the navigation solution. We present how the faulty satellite Sx is identified with reference to the following figure.

[0106] Figure 5 represents steps of a method according to an embodiment of the invention for identifying a faulty satellite. This figure illustrates the implementation of step S300 previously introduced with reference to Figure 3.

[0107] It should be recalled that step S300 is implemented to identify the faulty satellite Sx following the detection of a satellite failure FLT. This step is therefore implemented if one or more of the satellite failure indicators RSI,...,RSN of the secondary filters FSI,...,FSN are greater than the detection threshold Adet.

[0108] If a single satellite failure indicator Rsi is above the detection threshold Adet, the satellite Si associated with the secondary filter Fsi can be identified as the failed satellite Sx. However, when several secondary filters have satellite failure indicators above the Adet threshold, there is ambiguity as to which satellite has failed. Several satellites are potentially failed.

[0109] This is why, according to one embodiment, said at least one additional filter FA is used only when several secondary filters FSI,...,FSN have satellite failure indicators higher than the threshold Adet. The steps described below are then implemented. This embodiment makes it possible to use said at least one additional filter FA only when it is necessary to arbitrate between several potentially faulty satellites. This makes it possible to minimize the resources used by the APP device, while ensuring that the faulty satellite is reliably identified in the event of a satellite failure.

[0110] Alternatively, it could also be envisaged to use said at least one additional FA filter and to implement the steps below each time a satellite failure is detected.

[0111] Figure 5 illustrates an embodiment in which different quarantine hypotheses are tested sequentially until the faulty satellite Sx is identified. We first present this so-called sequential embodiment, and will then describe a so-called parallel embodiment in which several quarantine hypotheses are tested simultaneously.

[0112] According to the embodiment oz / enfe / illustrated by FIG. 5, the step S300 of identifying the faulty satellite Sx comprises the steps S310 to S360 described below.

[0113] At step S310, the EXCL module identifies a satellite Sj presumed to be faulty among the set of satellites SI,...,SN.

[0114] In this embodiment, only one satellite Sj is identified as supposedly faulty. This satellite is quarantined so that the pseudo-distances relating to it are no longer used by the filters FSI,...,FSN. As we detail below, an additional filter FA will be used to test this quarantine hypothesis, and confirm or deny the supposed failure of satellite S ; .

[0115] In particular, the satellite Sj identified as presumed to be faulty corresponds to the satellite associated with the filter Fsj whose satellite fault indicator Rsj is maximum and which has not already been put into quarantine. The identified Sj satellite is therefore the satellite that is most likely to fail, for two reasons: firstly, it is associated with the Fsj filter whose Rsj satellite failure indicator is the highest, and secondly, the exclusion of this Sj satellite has not yet been tested.

[0116] The choice of the satellite Sj assumed to be faulty and quarantined can be made by the APP navigation device itself, as described above. However, this quarantine choice can also be made on the basis of information provided by another device (distinct from the APP device). According to one embodiment, the identification of the satellite Sj assumed to be faulty is thus made on the basis of information provided by a device conforming to that proposed in patent application FR2303580. The information provided by this other device indicates a satellite assumed to be faulty, or includes additional satellite failure indicators making it possible to identify a satellite assumed to be faulty.

[0117] In step S320, the EXCL module configures (initializes) an additional Kalman filter FA (also called arbitrated sub-filter). This additional filter FA is used to simulate the exclusion of the satellite Sj assumed to be faulty, and therefore test the chosen quarantine hypothesis.

[0118] More precisely, the EXCL module identifies the secondary filter Fk that has the maximum satellite failure indicator Rk and that excludes a satellite S distinct from the supposedly faulty satellite Sj. In other words, the satellite failure indicator Rsk is the maximum indicator among {Rsi,...,RsN}\{Rsj}. Then, the EXCL module configures (initializes) the additional filter FA based on the secondary filter Fsk. The configuration of the additional filter FA consists in particular of copying the covariance matrix, the estimated states, and the measurements used by the secondary filter Fsk.

[0119] Note that the additional filter FA excludes the Sk satellite, and the supposedly faulty Sj satellite which is quarantined. It therefore uses the pseudo-distances {pri,...,prN}\{prk, prj}.

[0120] In step S330, the EXCL module performs a (partial) reset of the additional filter FA.

[0121] To reset the additional FA filter, the following operations are performed. The states related to the pseudo-distances provided by the GNSS receiver and the states related to the other sensors used are reset. The states potentially affected by a failure of the Sj satellite are desensitized by adding state noise.

[0122] Clock states and bias states generally have non-negligible correlation times that do not allow sufficiently fast convergences. The reset proposed here allows forcing a fast convergence of the states of the additional filter FA.

[0123] In step S340, the EXCL module calculates a satellite failure indicator RA of the additional filter FA after a determined duration TE (also called quarantine period).

[0124] The determined duration TE between the resetting of the additional filter FA and the calculation of its satellite failure indicator RA is generally of the order of a few minutes (for example, between 2 and 3 minutes).

[0125] Resetting the additional filter FA ensures rapid convergence of the states of the additional filter FA. If the quarantine hypothesis is correct (the assumed faulty satellite Sj corresponds to the faulty satellite Sx), the convergence of the states of the additional filter FA towards zero allows the convergence of its satellite failure indicator RA towards zero. At the end of the quarantine period, the satellite failure indicator RA will thus be below the threshold Adet.

[0126] In particular, the satellite failure indicator RA of the additional filter FA corresponds to the cross-innovation ratio of the additional filter FA. However, and as mentioned previously, it could be considered to use other satellite failure indicators.

[0127] In step S350, the EXCL module determines whether the satellite failure indicator RA of the additional filter FA is greater than or equal to the threshold Adet. It thus determines whether the satellite Sj assumed to be faulty is actually faulty or is functional.

[0128] We recall that the additional filter FA simulates the exclusion of the satellite Sj which is assumed to be faulty and is quarantined. If, at the end of the quarantine period, the satellite failure indicator RA is lower than the threshold, this means that the additional filter FA is no longer affected by the satellite failure and that it excludes the faulty satellite Sx. The quarantine hypothesis is therefore correct: the satellite Sj assumed to be faulty is actually faulty. In this case, the method continues at step S360.

[0129] On the other hand, if the satellite failure indicator RA is greater than or equal to the threshold Adet, this means that the quarantine hypothesis is incorrect: the supposedly faulty satellite Sj quarantined is in fact functional, and the actually faulty satellite Sx has not been quarantined. In this case, the supposedly faulty satellite Sj is determined to be functional and its quarantine is suspended. The method resumes at step S310 to identify another supposedly faulty satellite Sj (distinct from satellite Sj), and repeats the following steps to simulate the exclusion of this satellite Sj'. A new quarantine hypothesis is thus tested.

[0130] In step 5360, the EXCL module identifies the satellite Sj as the faulty satellite Sx.

[0131] If the satellite failure indicator RA is lower than the threshold Adet, the quarantine hypothesis is correct: the satellite Sj assumed to be faulty and quarantined actually corresponds to the faulty satellite Sx which caused the satellite failure FLT. The method will continue at step S400 to exclude this satellite.

[0132] Above, we presented an embodiment in which the different quarantine hypotheses are tested one after the other using a single additional filter FA. However, several additional filters can be used in parallel to simultaneously test different quarantine hypotheses, which we now detail.

[0133] According to a parallel embodiment (not illustrated), the EXCL module proceeds as follows to identify the faulty satellite Sx using several additional filters noted FAI,...,FAM.

[0134] First, a plurality of satellites Sji,...,S are identified as presumed to be faulty (step S310). For each presumed faulty satellite Sjm, an additional filter FA™ is configured and reset (step S320 and S330).

[0135] Each additional filter FAH is configured from a secondary filter Fsk which has the maximum satellite failure indicator Rsk and which excludes a satellite Sk distinct from the satellite Sjm. The additional filter FA™ allows to simulate the exclusion of the satellite Sjm.

[0136] At the end of the quarantine period TE, the satellite failure indicators RAI,...,RAM of the different additional filters FAI,...,FAM are calculated (step S340). These indicators RAI,...,RAM are then compared to identify the faulty satellite Sx (step S360).

[0137] The satellite Sx identified as faulty corresponds, according to one embodiment, to the satellite Sjm assumed to be faulty for which the additional filter FA™ has the minimum satellite fault indicator RAm. Indeed, the different additional filters FAI,...,FAM used make it possible to test different quarantine hypotheses. The additional filter associated with the correct quarantine hypothesis is the one that simulates the exclusion of the faulty satellite Sx. It will therefore have the lowest satellite fault indicator at the end of the quarantine period.

[0138] For the number of additional filters used in parallel, several embodiments can be considered. It can be considered to use as many additional filters as there are satellites in the set of satellites (i.e. M=N). In this case, all satellites SI,...,SN are identified as supposedly faulty, and the additional filters FAI,...,FAN simulate the exclusion of each of them to identify the faulty satellite Sx.

[0139] Alternatively, the number of additional filters may correspond to the number of secondary filters whose satellite failure indicator is greater than the detection threshold Àdet. When several secondary filters have satellite failure indicators greater than the threshold Àdet, there is ambiguity regarding the faulty satellite. Several satellites are potentially faulty. To quickly arbitrate between these different satellites and limit the amount of resources required, it is relevant to use as many additional filters as there are secondary filters whose satellite failure indicator is greater than a threshold. Such an embodiment makes it possible to achieve an advantageous compromise between the speed of identification of the faulty satellite and the amount of resources required to implement the proposed solution.

[0140] Additional Variants: A person skilled in the art will understand that the variants and embodiments described above constitute only non-limiting examples of implementation of the invention. In particular, a person skilled in the art may envisage any adaptation or combination of the embodiments and variants described above in order to meet a very specific need.

[0141] It should also be noted that the order in which the steps of a method according to the invention are carried out, in particular with reference to the attached drawings, constitutes only an example. embodiment without any limiting character, variants being possible. In particular, a method in accordance with the invention may comprise one or more iterations of the steps described above, in particular with reference to the attached drawings. Furthermore, the reference signs do not limit the scope of the protection, their sole function being to facilitate the understanding of the claims.

[0142] Finally, the term module can correspond to a software component as well as to a hardware component or to a set of hardware and software components, a software component itself corresponding to one or more computer programs or subroutines or more generally to any element of a program capable of implementing a function or a set of functions as described for the modules concerned. In the same way, a hardware component corresponds to any element of a hardware assembly capable of implementing a function or a set of functions for the module concerned (integrated circuit, smart card, memory card, etc.).

Claims

Claims 1. Method implemented by a device (APP) comprising a plurality of Kalman filters FSI,...,FSN, each filter Fs, determining navigation data (NAV) of a mobile (AC) from pseudo-distances (PR) relating to a set of satellites SI,...,SN with the exception of the satellite Si, the method comprising: following the detection (S200) of a satellite failure (FLT), a step consisting of identifying (S300) a faulty satellite Sx among the set of satellites SI,...,SN, this step (S300) comprising for at least one satellite Sj assumed to be faulty: o a step consisting of identifying the filter Fsk excluding a satellite Sk distinct from the satellite Sj assumed to be faulty and of which a satellite failure indicator Rsk is maximum; o a step consisting of configuring (S320) an additional Kalman filter FA distinct from the filters FSI,...,FSN, this additional filter FA being configured from the filter Fsk; o a step consisting of resetting (S330) the additional filter FA, this additional filter FA excluding the satellite Sk and the satellite Sj assumed to be faulty; and o a step consisting of determining (S350) whether the satellite Sj is faulty based on a satellite failure indicator RA of the additional filter FA calculated after a determined duration (TE).

2. The method of claim 1, wherein a said satellite failure indicator is a cross-innovation report.

3. The method of claim 1 or 2, wherein said step of identifying (S300) the faulty satellite Sx comprises said steps of configuring (S320), resetting (S330), and determining (S350), only if several of the filters FSI,...,FSN have satellite fault indicators above a threshold (det).

4. Method according to any one of claims 1 to 3, in which the satellite Sj assumed to be faulty corresponds to the satellite being associated with the filter Fsj of which a satellite fault indicator Rsj is maximum and not having been previously assumed to be faulty.

5. Method according to claim 4, wherein: if the satellite failure indicator RA of the additional filter FA is lower than a threshold (Àdet), the satellite Sj assumed to be faulty is determined (S350) to be faulty; and otherwise, another satellite Sj- is assumed to be faulty, and said steps of configuring (S320), resetting (S330), and determining (S350) are repeated.

5. Method according to any one of claims 1 to 3, in which several satellites Sji,...,Sj M are assumed to be faulty, and several additional filters FAI,..., FAN are configured (S320) and reset (S330).

7. Method according to claim 6, in which the satellite Sj m assumed to be faulty, for which the additional filter FA™ has the minimum satellite fault indicator RA™, is determined (S350) to be faulty.

8. Method according to claim 6 or 7, in which the satellites Sji,...,Sj M supposedly faulty correspond to the satellites associated with the filters Fsji,...,Fsj M whose satellite failure indicators RSJI,...,RSJM are above a threshold (Àdet).

9. Device (APP) comprising a plurality of Kalman filters FSI,...,FSN, each filter Fsi determining navigation data (NAV) of a mobile (AC) from pseudo-distances (PR) relating to a set of satellites SI,...,SN with the exception of the satellite Si, the device (APP) comprising: a module (EXCL) configured to, following the detection (S200) of a satellite failure (FLT), identify (S300) a faulty satellite Sx among the set of satellites SI,...,SN, this module (EXCL) being configured to: o identify the filter FS excluding a satellite Sk distinct from the satellite Sj assumed to be faulty and for which a satellite failure indicator Rsk is maximum; o configure (S320) an additional Kalman filter FA distinct from the filters FSI,...,FSN, this additional filter FA being configured from the filter Fsk; o reset (S330) the additional filter FA, this additional filter FA excluding the satellite Sk and the satellite Sj assumed to be faulty; and o determine (S350) whether the satellite Sj is faulty based on a satellite failure indicator RA of the additional filter FA calculated after a determined duration (TE).

10. Navigation system (SYS) intended to be embedded in a mobile (AC) comprising: a satellite positioning receiver (GNSS) configured to provide pseudodistances relating to a set of satellites SI,...,SN; and a device (APP) according to claim 9.

11. Mobile machine (AC) comprising a navigation system (SYS) according to claim 10.

12. Computer program (PROG) comprising instructions for implementing the steps of a method according to any one of claims 1 to 8, when said computer program (PROG) is executed by at least one processor (PROC).

Images