WO2015165908A1

WO2015165908A1 - Method and device for controlling integrity with double level of consolidation

Info

Publication number: WO2015165908A1
Application number: PCT/EP2015/059219
Authority: WO
Inventors: David Roberfroid; Jean-Luc DEMANGE; Michel Destelle; Yves Becheret
Original assignee: Sagem Defense Securite
Priority date: 2014-04-28
Filing date: 2015-04-28
Publication date: 2015-11-05
Also published as: FR3020469A1; FR3020469B1

Abstract

There is proposed a method of controlling the integrity of measurements acquired by a navigation system (S) on the basis of radionavigation signals emitted by a plurality of constellations (GNSS1, GNSS2) of satellites, the method being characterized in that it comprises: a first level of processing (C1) consolidating the data of the various reception pathways of at least two constellations, and a second level of processing (C2) detecting a global fault with at least one of the constellations, and invalidating the outputs consolidated by the first level of processing when a global fault is detected.

Description

Dual integrity consolidation method and device

GENERAL AREA

The present invention relates to the field of integrity control in navigation systems.

It relates more particularly to an integrity control method using measurements derived from signals of constellations of radionavigation satellites, and a device adapted to implement such a method.

STATE OF THE ART

It is conventional to use for navigation including aircraft or ships of hybrid INS / GNSS equipment (the Anglo-Saxon "Inertial Navigation System" and "Global Navigation Satellite System").

Inertial equipment, using measurements from inertial sensors to compute location, speed, and orientation information, provides low-noise, accurate, short-term information. However, in the long term, the location accuracy of this inertial equipment is degraded (more or less quickly depending on the quality of the sensors, accelerometers or gyroscopes, for example, and treatments performed).

Although information from a satellite radionavigation system is very unlikely to drift in the long term, it is often noisy and of varying accuracy. On the other hand, inertial measurements are still available while GNSS information is not available and is likely to be deceived and scrambled.

Integrity control systems to detect the occurrence of such failures and to exclude the responsible satellites in order to find a navigation solution no longer containing an undetected error, are known.

In addition, a number of applications today exploit the possibility of receiving signals from several satellite constellations (GPS and GLONASS now, soon GALILEO). Such a possibility is described in particular in document US 2013/0304376.

In the context of such particular applications, methods have been proposed taking into account events corresponding to several simultaneous satellite failures of a satellite constellation (in particular in the documents of the prior art cited in the bibliography at the end of this document. description).

However, these methods do not meet the integrity requirements in case of a global constellation failure (i.e., when all the satellites in a given constellation are simultaneously failing while providing radionavigation signals with an incorrect position or speed).

PRESENTATION OF THE INVENTION

The aim of the invention is to implement an integrity check of measurements delivered by several satellite constellations, which makes it possible to detect several simultaneous satellite failures and to detect an overall failure of one of the constellations, and which operates in the presence of a reduced number of satellites in sight.

It is therefore proposed a method for controlling the integrity of measurements acquired by a radionavigation system from radio signals transmitted by a plurality of satellite constellations, the method being characterized in that it comprises:

a first level of processing consolidating the measurements of the different channels for receiving signals coming from at least two constellations, and then a second processing level detecting an overall failure of at least one of the constellations, and invalidating the outputs of the first processing level when such a global failure is detected. A method implemented according to such a two-level architecture is able to detect multiple and simultaneous satellite failures within the same constellation and the overall failure of a radiolocation system, while requiring only a number reduced satellites in sight to meet a need for integrity at 10 ^-9 per hour of flight, as part of a multi-constellations application.

Such architecture allows in particular to detect rare events, ie with an occurrence rate between 10- ⁷ / h and 10 ^-9 / h such as:

- some rare cases of GNSS failure as a common mode failure,

- double satellite failures.

With the proposed method, it is sufficient to have 7 measurements from different satellites in view on a set of two constellations for the consolidation level 1 (first level of treatment) is able to detect one or two simultaneous satellite failures of which effect is an added error.

It is also sufficient to have 4 satellites in view per constellation so that level 2 consolidation (second level of processing) is able to detect the overall failure of a radiolocation system.

The method according to the invention is advantageously completed by the following characteristics, taken alone or in any of their technically possible combinations.

The second level of treatment (C2) may include the steps that: at least one difference value is calculated between mono constellation navigation solutions calculated for different constellations,

- Determining, based on the calculated deviation value, global validity information representative of the presence or absence of a global failure on one of the constellations.

The difference value can be compared with a predetermined threshold, the global validity information depending on the result of this comparison.

The difference value can further be calculated as a distance between navigation data vectors from different constellation navigation solutions.

The global validity information may be set to an invalid value if the deviation value is greater than the predetermined threshold.

The global validity information may also be set to an invalid value if at least one of the navigation data vectors is declared invalid by the first level of processing.

The method may also include the steps of:

calculating a first protection distance associated with the global navigation solution from a first probability of loss of predetermined integrity,

computation for each constellation navigation solution of a second protection distance from a second probability of loss of predetermined integrity,

calculation of an output protection distance, defined as the maximum between the first protection distance and the largest of the second protection distances.

The acquired measurements can include, for each satellite, a pseudo-distance and a pseudo-speed, and each solution of calculated navigation includes estimated speed data and position data for the system.

According to a second aspect, a device for checking the integrity of measurements acquired from radionavigation signals emitted by a plurality of satellite constellations is also proposed, the device comprising two processing modules adapted to implement the two levels of processing. of the above process.

It is also proposed a navigation system comprising a receiver configured to acquire measurements of radio navigation signals transmitted by a plurality of satellite constellations, and a device the second aspect to control the integrity of the measurements acquired by the receiver.

The receiver may include a plurality of elementary receivers, each elementary receiver being configured to acquire radio navigation signal measurements transmitted by a respective constellation.

It is also proposed a navigation system comprising a device according to the second aspect of the invention, and an inertial unit arranged at the output of the device, the inertial unit being configured to implement to provide a navigation solution by hybridization of the data provided. by the device with data measured by inertial sensors.

A computer program product comprising program code instructions for executing the steps of the described method may be executed by a data processing unit, for example embedded in a radio navigation system or hybrid inertial navigation equipment. -GNSS. DESCRIPTION OF THE FIGURES

Other features, objects and advantages of the invention will emerge from the description which follows, which is purely illustrative and nonlimiting, and which should be read with reference to the appended drawings in which:

FIG. 1 represents data flows in a navigation system comprising an integrity control device according to one embodiment of the invention.

FIG. 2 represents the steps of an integrity control method according to one embodiment of the invention.

FIGS. 3 and 4 represent the respective sub-steps of two steps of the method illustrated in FIG.

In all the figures, similar elements bear identical references.

DETAILED DESCRIPTION OF THE INVENTION

With reference to FIG. 1, a navigation system S comprises a receiver R of radionavigation signals, a first consolidation module C1, a second consolidation module C2, and an output module CS. The system S is intended to be carried on a carrier

(not shown), for example an aircraft or a ship.

The receiver R is configured to acquire radio navigation measurements from radiofrequency signals transmitted by at least two constellations of GNSS satellites (for example GPS, GLONAS,

GALILEO, etc. ), here referenced GNSS1 and GNSS2. Each constellation

GNSS1, GNSS2 comprises at least two radionavigation satellites operating in concert.

The first and second consolidation modules C1 and C2 are each connected to the receiver R and receive from it a same set of acquired measurements. The first and second modules of consolidation C1 and C2 together form a device D integrity control of this set of acquired measures.

The first consolidation module C1 is configured to implement, on all of the navigation measurements provided by the receiver R, one or more multi-failure RAIM type algorithms ("Receiver Autonomous Integrity Monitoring"). . Examples of such algorithms are described in the documents of the prior art cited in the bibliography at the end of the present description; they are not further detailed.

These RAIM algorithms deal with pseudorange, pseudo-speed and / or antenna-satellite delta-range measurements provided by the receiver R, taken alone or in groups.

The first consolidation module C1 is configured to detect the inconsistency of one or two of these measurements with respect to the other available measurements. It may, under certain conditions, identify and exclude calculations from the satellite (s) responsible for these inconsistencies.

The first module C1 makes it possible to deliver geographic radiolocation data of up to 10 ^-9 / fh if there is no global constellation failure as long as it has a sufficient number of pseudo measurements and a adequate spatial distribution of satellites. On the other hand, in the case of a constellation failure, this algorithm does not always deliver honest data, which is also the case when there are more than two simultaneous satellite failures. This module draws indicators for the validity of non-excluded measures from each GNSS.

The second consolidation module C2 comprises a plurality of consolidation units U1, U2 and a test unit T. Each consolidation unit also receives the information developed by the first consolidation module C1. Each consolidation unit U1, U2 develops a navigation solution by only using measurements associated with satellite signals of a single constellation, acquired by the receiver R and not excluded by the module C1. In the illustrated embodiment, the consolidation unit U1 is associated with the GNSS1 constellation, and the consolidation unit U2 is associated with the GNSS2 constellation.

The test unit T is connected at the output of each consolidation unit U1, U2. The test unit T is configured to implement a test intended to detect the possible presence of a global failure of one of the GNSS1 and GNSS2 constellations, from the navigation solutions developed by the consolidation units U1, U2. .

The output module CS is connected at the output of the first consolidation module C1, and at the output of the test unit of the second consolidation module C2; this output module CS is configured to develop a robust navigation solution to a global constellation failure and at least two simultaneous satellite failures from data developed by the "Receiver Autonomous Integrity Monitoring" (RAIM) processing of the first module C1 of consolidation and data output by the test unit T of the second consolidation module C2.

The system may also include an inertial unit arranged at the output of the output module.

The inertial unit is configured to provide a navigation hybridization solution of the output navigation solution provided by the device D, with data from inertial sensors.

The system may also include such inertial sensors.

The steps of an integrity control method implemented in the navigation system S are illustrated in FIG. In an acquisition step ACQ, the receiver R acquires a set of navigation measurements, from radionavigation signals emitted by the GNSS1 and GNSS2 satellite constellations.

The navigation measurements can typically be pseudo-speeds, pseudo-distances, delta-ranges, or a combination of these types of measurements. In the embodiment illustrated and detailed below, is considered a set of acquired measurements comprising, for each constellation, at least one pseudo-distance measurement and at least one pseudo-speed measurement or delta range developed by the receiver R (for example, a pseudo-distance measurement and a pseudo-speed measurement for each satellite of each constellation).

In fact, treating pseudo-distances in addition to pseudo-speeds or delta-ranges can be advantageous for calculating the possible range of error in speed or geographical displacement, since it is necessary to take account of steering errors. geographical satellite antenna and therefore the geographical position error. For example a horizontal position error of 300 meters on the ground generates an error equivalent to about 6 cm / s on the pseudo speed in the worst case of a GPS satellite at the zenith. As a result, a pseudorange RAIM type algorithm can be implemented in addition to the equivalent pseudo-speed or delta-range algorithm if the integrity requirement is for speed.

Two levels of consolidation of the acquired measures are implemented in the navigation system S: a first level of consolidation implemented by the first consolidation module C1 and a second level of consolidation implemented by the second consolidation module C2. These two levels are called respectively "level 1" and "level 2" in the following. First level of consolidation

The first consolidation module C1 detects and / or identifies among the measurements acquired the measurements from failed satellites, using the RAIM algorithm or algorithms described above, in the step referenced DET1. In the case of a constellation failure or if there are more than two simultaneous satellite failures, the algorithm implemented in this first consolidation module C1 may provide false indications of defective satellites or fail to detect failed satellites. As the case may be, the algorithm implemented during step DET1 exploits the measurements of pseudo-range and pseudo-speed or delta range. This algorithm is adapted to detect the inconsistency of at most two measurements among the set of measurements of the same type. It may, under certain conditions, identify and exclude the satellite or satellites responsible for these inconsistencies.

The detecting step DET1 may also comprise the evaluation of a probable maximum error taking into account cases of non-detection without failure and in the presence of single or double failure. Faults taken into account are those whose effect is a bias added to the measurement obtained in the absence of failure.

The first consolidation module C1 then generates in the step referenced CALC1 a global navigation solution from the measurements available for the location, once excluded the measurements from satellites identified as failing by the identification step DET1.

This global navigation solution is obtained by exploiting the measurements acquired by the receiver R which come from the satellites of the different constellations GNSS1 and GNSS2 available for the localization, that is to say for the evaluation of the position and possibly of the speed of receiver R.

The global navigation solution typically comprises at least one geographic position datum and at least one speed datum geographical estimate of the receiver R and therefore the carrier on which the system S is embedded.

Each data item of the global radionavigation solution can be of dimension 1 (for example, the altitude of the carrier, the speed or the vertical displacement of the carrier), or of dimension greater than 1 (like the horizontal position, the horizontal velocity or the geographical horizontal displacement of the wearer).

The first consolidation module C1 can also calculate during the step referenced PROTG, for each data part of the global navigation solution developed, a distance or protection radius out of global failure. This value corresponds to the possible domain of the data if there is no global constellation failure for a previously allocated rate of loss of integrity.

In other words, the algorithm computes the possible domain around the position or geographic velocity developed from the non-excluded satellite measurements. The loss of integrity corresponds to a navigation value (position or geographical speed) whose possible domain is larger than the authorized domain indicated to the equipment, or whose possible domain is not calculable. The possible domain is calculated according to the rate of loss of integrity not to be exceeded, which is also called the need for integrity.

Moreover, in a step VALIDC, the first module C1 produces validity data identifying the satellites detected as defective among the measurements provided as well as the constellations to which they belong. For example, the validity data includes, for each measure available for navigation:

^■ the identifier of the satellite transmitting the measured signal, named PRN or "Pseudo-Random Noise" in English with reference to the unique pseudo-random codes which modulate the signal emitted by each GPS satellite ^■ the identifier of the associated constellation (GPS, GALILEO, etc.)

^■ validity information that indicates the failure or proper functioning of this satellite resulting from RAIM processing and other possible tests.

Second level of consolidation

The second level of consolidation C2 performs on the measurements associated with each of the constellations GNSS1 and GNSS2 operations of the type "comparison at a threshold of the gap between similar data from different constellations". This level of consolidation aims to detect a possible inconsistency between constellations and thus to detect an overall constellation failure.

In a SPLT ranking step, the measurements acquired during the acquisition step are divided into several sets of measurements, each set includes the measurements available for navigation from a constellation.

Each consolidation unit U1, U2 receives as input a set of navigation measurements from a respective constellation GNSS1, GNSS2, as well as the validity information of the satellites calculated during the step VALIDC and implemented by the first C1 consolidation module.

The unit U1 thus receives all of the navigation measurements from the GNSS1 constellation as well as the validity data associated with these measurements, in particular the validity information associated with these measurements, and the unit U2 receives the set of measurements. from the GNSS2 constellation and the validity data associated with these measurements, including the validity information associated with these measurements.

In a calculation step referenced CALC2, each consolidation unit U1, U2 develops a respective navigation solution to from certain measurements contained in the set of measurements available for the corresponding navigation, and corresponding satellite validity information. The U1 unit is developing a navigation solution for the GNSS1 constellation, and the U2 unit is developing a navigation solution for the GNSS2 constellation.

In the following, the navigation solutions produced by the U1 and U2 units are called "mono-constellation" or "constellation" navigation solutions.

More precisely, during this calculation step CALC2, each consolidation unit U1, U2 analyzes the validity information of the satellites, and constitutes a subset of measurements available for navigation by exclusion of the set of measurements that the consolidation unit takes as input the measurements from the satellites marked as failing in the validity information. For the development of each mono-constellation navigation solution, only the measurements contained in the subset constituted, containing only measurements that are not detected as faulty by the first level of consolidation, are taken into account.

The U1, U2 consolidation units produce constellation navigation solutions that are processed by the T test unit. Each of these mono-constellation navigation solutions is protected from the presence of up to two simultaneous failures on the terminal. set of constellations.

In a manner similar to the step CALC1, implemented in the first consolidation module C1, each mono constellation navigation solution can be elaborated during the step CALC2 by means of a Bancroft type algorithm, each navigation solution mono constellation comprising navigation data representative of the position and speed of the carrier of the plant, using pseudo-distances and pseudo-speeds specifically derived from the corresponding constellation. Each navigation data of constellation can be of dimension 1 (for example, the altitude of the carrier, or the vertical speed of the carrier), or of dimension greater than 1 (typically the horizontal position or the horizontal speed of the carrier).

In a step referenced TEST, the test unit implements a test of the mono-constellation navigation solutions developed by the units U1, U2, by means of the following three sub-steps shown in FIG.

In a sub-step referenced INC, a gap measurement is calculated by the test unit T from mono constellation navigation solutions. This gap measure is sensitive to the presence of inconsistencies between data of the same type contained in the different constellation navigation solutions.

In a sub-step COMP, the difference measure is then compared to a predetermined threshold S. The value of this threshold S depends on the probability of false alarm (detection of inconsistency wrongly) allocated to the second consolidation module.

In a sub-step VALIDG, the test unit T then determines a global validity information for all of the acquired measurements. The value of this global validity information depends on the result of these comparisons, and indicates whether or not there is an overall failure of one of the constellations.

In case of constellation failure detection, the level 2 consolidation implemented by the C2 module invalidates the global navigation solution at the end of the consolidation of the first level.

Therefore, it will be possible to obtain reliable output data, both in the case of two simultaneous satellite failures (integrity obtained by level 1), and in the event of an overall constellation failure (integrity obtained by level 2 triggering an invalidation of level 1 outputs). The TEST step can be implemented for different types of navigation data.

Each validity information (from the two consolidation modules C1 and C2) may for example be a boolean taking two values: an OK value that indicates a valid state, and a KO value, which indicates an invalid state.

It is possible, for example, to use, for a geographical location data V with a dimension (typically the altitude or the vertical speed), in an architecture with two GNSS constellations the following test:

In the preceding test example, abs (V1 -V2) designates the absolute value of the difference between the data item V1 and the item V2, both of dimension equal to 1; the global validity information is set to the KO value (invalid) if this absolute value is greater than the predetermined threshold S or when a constellation validity information is invalid.

For a two-dimensional "V" datum (typically the horizontal position or the horizontal speed), for an architecture with two GNSS constellations the following test:

The foregoing tests can be generalized for the processing of N dimension data of the type present in each constellation navigation solution. The inconsistency value is then a distance (Cartesian for example) between vectors, each vector being formed by the dimension data N from a respective constellation navigation solution.

The second consolidation level optionally further comprises a PROTC step for calculating, for each mono-constellation navigation solution, a second protection distance and / or a so-called mono-constellation protection radius as a function of the probability of loss of integrity. mono constellation allocated. The impossibility of calculating these protection values, which appears for example if only 4 satellite measurements are available for mono constellation navigation, is equivalent to an infinite protection value. Elaboration of the output data

In the OUT step of the output module CS as shown in FIG. 2, output data are produced from the data available for navigation from the consolidation modules C1 and C2.

The step OUT may comprise the following substeps represented in FIG. 4.

In a VALIDS sub-step, the output module CS calculates output validity information from the global validity information itself derived from the mono constellation validity information. The output validity information indicates the valid value. if and only if the global validity information indicates the valid value as well as each validity information of the measurements used for calculating the output data.

This calculation is illustrated by the following pseudo language:

In a CALCS step, the output module CS also delivers an output navigation solution, which is the global navigation solution developed in the first consolidation level. In In the example presented above, the position and speed data (horizontal and vertical) at the output are therefore equal to the positions and speed (horizontal and vertical) calculated by the level 1 (multi-constellation multi-failure RAIM).

In a PROTS step, the output module CS calculates an output protection distance, defined as the maximum between the first protection distance and the greater of the second protection distances, respectively calculated by the first and second consolidation levels.

The distances and radii of protection are calculated from the distances and radii of protection provided by the two levels of consolidation. We will take the following formulas:

- Output protection distance = max (protection distance level 1, protection distances level 2)

- Global protection radius = max (protection level level 1, protection levels level 2)

In an embodiment shown in FIG. XXX, the receiver R comprises a plurality of reception units or elementary receivers. Each elementary receiver is then configured to acquire measurements of radionavigation signals emitted by a respective constellation. It is therefore possible in a two-constellation case to provide two elementary receivers R1 and R2, one capturing measurements emanating from the GNSS1 constellation and the other capturing measurements emanating from the GNSS2 constellation.

According to a first variant, the different elementary receivers are synchronized with each other, so as to provide optimum protection radii.

According to a second variant, the different elementary receivers are not synchronized with each other, but the measurements acquired by each of them are time-stamped. The development of thresholds protection is then implemented by exploiting these timestamps. The protection thresholds will be higher than in the case of synchronous measurements.

The output navigation solution can for example be used in the context of a GNSS / inertial hybridization. In this case, the navigation solution is also time stamped.

The previously described integrity checking method may be encoded as a computer program comprising program code instructions executable by one or more of the device D's processor.

In the foregoing, it is considered that the modules C1 and C2 are modules forming part of the device D cooperating with the receiver R. In a variant, the modules C1 and C2 can be integrated into the receiver R or to an inertial unit.

Study of the cases of breakdowns to be covered to answer a need for integrity at 10-9 per hour of flight

To ensure a rate of loss of integrity less than or equal to 10 ^-9 per hour of flight, it is sufficient to detect in the system S, the following failure cases with sufficient efficiency, that is to say a probability of not sufficiently weak detection in the following failure cases:

- a satellite failure;

- two satellite failures belonging to the same constellation (case 1);

- two satellite failures belonging to different constellations (case 2); - a failure of one of the two constellations or radiolocation system (case 3).

In fact, the remaining failure cases represent an apparition rate of less than 10 ^-9 / h according to the GPS failure analysis results, see document 7 with reference, and corresponding to the hatched lines in the "rate" table. breakdowns of the GPS system by categories ".

The following assumptions are made:

The average flight duration is 1 hour.

Let H_cons_FF be the operating condition of having both constellations "Fault Free".

Let H_cons_Fault be the operating condition of having at least one of the two failed constellations. The occurrence rate of this condition is 2 * 10 ^-8 per hour (based on Lee Y. C, and MP McLaughlin, "Feasibility Analysis of RAIM to Provide LPV-200 Approaches with Future GPS"). , ION GNSS 2007)

We pose:

Pint = Pint_H_cons_FF + Pint_H_cons_Fault With:

- Pint: probability of loss of global integrity.

- Pint_H_cons_FF: loss rate of integrity under condition "H_cons_FF (no breakdown constellation). This rate is the result of non detections of satellite failures by the first level of consolidation.

- Pint_H_cons_Fault: conditional integrity loss rate H_cons_Fault (a constellation failure). This rate is the result of non-failure detections of a system by the second level of consolidation. A possible allocation for Pint is less than or equal to 10 ^-9 / h:

Pint_niveau1 = Pint_H_cons_FF = 0.5 * Pint = 0.5 * 10 ^-9 / h Pint_niveau2 = Pint_ H_cons_Fault = 0.5 * Pint = 0.5 * 10 ^-9 / h

Total allocated = Pint = 10 ^-9 / h

With:

- Pint_num1: probability of loss of integrity allocated to non detections by first level consolidation.

- Pint_niveau2: probability of loss of integrity allocated to non detections by the second level consolidation.

The false alarm rate of the desired consolidation tests is hereinafter selected for example at 10 ⁵ per hour of flight. It represents the unavailability rate of secure data added by the consolidation tests. We have neglected the double false alarm cases:

Pfa = Pfa_niveau1 + Pfa_niveau2

With:

- Pfa_level1: false alarm rate by first level consolidation.

- Pfa_niveau2: false alarm rate by the second level consolidation.

A possible allocation is:

Pfa_level1 = 0.5 * 10 ^-5 / h

Pfa_niveau2 = 0.5 * 10 ^-5 / h

Total allocated to Pfa = 10 ^-5 / h

To define the values of the parameters used by the RAIM in the first consolidation module C1, the following assumptions are made:

- The availability of the two constellations are independent (GPS and GALILEO type). these two constellations have independent failures, and the same risks of loss of integrity.

- The average number of satellites in a constellation is 10. With these assumptions and the results of the FMEA GPS satellites and the system that implements them we obtain the following probabilities per hour of flight:

The shaded lines in the table indicate the exceptionally rare conditions that can be overlooked for the integrity assessment.

Breakdown rate of the GPS system by category

As explained above, the first consolidation module C1 according to one embodiment of the invention is a multiple multi-failure type multi-constellation RAIM adapted to detect up to two simultaneous satellite failures.

We can find known embodiments of this type of RAIM in each of the documents of the prior art cited in the bibliography at the end of the present description.

The following table summarizes the ability of the system S at two consolidation levels to protect the outputs of the effect of failures, if the first module C1 protection is able to detect two simultaneous satellite failures:

In the case of failure # 1, two satellite failures belonging to the same constellation occur. The RAIM used in level 1 consolidation then effectively detects failed satellites. The constellation test implemented in the level 2 consolidation does not take into account these two satellites for the constellation considered. The constellation test indicates that both constellations are intact.

In the case of failure No. 2, two satellite failures occur, these satellites belonging to different constellations. The RAIM used in Level 1 consolidation effectively detects failed satellites. The constellation test implemented in the Level 2 consolidation does not take into account these two satellites in each of the constellations considered. The constellation test indicates that both constellations are intact.

In the case of failure No. 3, there is an overall breakdown of a constellation. The RAIM used in the consolidation of level 1 does not protect then because one makes the assumption that a breakdown constellation is a common mode affecting simultaneously several satellites. However, the constellation test implemented in Level 2 consolidation detects the constellation failure.

This table therefore shows that even if the RAIM used is not able to detect cases with more than two simultaneous satellite failures, the global S system is robust to an overall constellation failure.

It should be noted that an S system comprising a first single-failure multi-constellation RAIM consolidation module, that is, adapted to detect only one satellite failure, is an embodiment to be excluded; such an algorithm indeed has shortcomings to meet the needs of posited integrities, as demonstrated below. In the case of two simultaneous satellite failures, it is conservatively assumed that this RAIM detects neither of the two failures.

The following table summarizes the capacity of the system S with two levels of protection, if the first protection module C1 can detect only one fault:

In case 1 (two satellite failures, for two satellites belonging to the same constellation), the level 1 RAIM does not protect; one of the two constellations is integrity, and the constellation test level 2 will however detect a constellation inconsistency, inconsistency due in fact to two simultaneous satellite failures.

In case 2 (two satellite failures, for two satellites belonging to different constellations), the RAIM used at level 1 does not protect. Both constellations are unrepresentative and the constellation test may not detect a constellation inconsistency. Indeed, conservatively, it is assumed that the satellite failed on the first constellation has the same effect as the failed satellite on the second constellation, so we are in a non-detectable common mode case.

In case 3 (global breakdown of a constellation), the RAIM used at level 1 does not protect because it is assumed that a constellation failure is a common mode affecting simultaneously several satellites. The constellation test will detect a constellation inconsistency.

The above table therefore shows that an RAIM that is capable of detecting only one satellite failure among a set of acquired measurements is insufficient to make the constellation test robust to two simultaneous satellite failures in the system S.

Example of sizing system S at two consolidation levels

The parameters of a particular embodiment of the proposed system S will now be detailed.

The first consolidation module C1 comprises a multisolution multi-constellation type RAIM adapted to detect two simultaneous satellite failures but not to detect a constellation failure.

The input parameters allocated to the first consolidation module C1 to develop the distance or radius calculation formula the following values given by way of example:

Pint_level 1 = 0.5 * 10 ^-9 / h

Pfa_level1 = 0.5 * 10 ^-5 / h

The parameters associated with the first consolidation module C1 for calculating the distance or the corresponding protection radius are as follows:

(*) The probability of having 3 satellite failures at the entrance of the RAIM Bi-constellation bi-breakdown is 1.1 * 10 ^-12 per flight hour; out of constellation breakdown, this standard deviation is therefore valid up to (at least) 10 ^-9 per hour of flight.

The formula for calculating the protection distance is:

Level 1 protection distance =

The input parameters allocated to the second consolidation module C2 are as follows:

Pint_level 2 = 0.5 * 10-9 / h

Pfa level2 = 0.5 * 10-5 / h The following parameters are also defined:

The formula for calculating the distance or protection radius takes into account the integrity level desired for the function, its allocation between the various failure combinations, and the value of the threshold S used in the validity test.

The value of the threshold S depends on the probability of false alarm "Pfa_niveau2".

In the case of a two-constellation architecture, a level 2 loss of integrity risk allocation may be as follows for a level of risk of Pint_niveau2 loss of integrity, excluding outages of radionavigation equipment and consolidation calculations. :

Pint_global level 2: average overall loss of integrity to allocate for level 2 consolidation

Pint_H00: average rate of loss of integrity in fault-free cases of constellation 1 and constellation 2 - Pint_H10: average rate of loss of integrity in the case of a breakdown constellation 1 and without breakdown of constellation 2

- Pint_H01: average rate of loss of integrity in the case without fault constellation 1 and with a breakdown of constellation 2

If one poses in addition:

- P_panne_constellation1: average rate of occurrence of a constellation breakdown per hour of flight (= 2 * 10 ^-8 / h)

- P_panne_constellation2: average rate of occurrence of a constellation breakdown per hour of flight (= 2 * 10 ^-8 / h)

He comes:

With

- Pmd_H10: probability of missed detection of a breakdown of constellation 1 and without breakdown of constellation 2.

- Pmd_H01: probability of missed detection of a breakdown of constellation 2 and without breakdown of constellation 1.

We will estimate the protection distance of variable V from constellation 1 "DprotV1" associated with level 2 consolidation, and the protection distance of variable V from constellation 2 "DprotV2" associated with level consolidation. 2.

the protection distance associated with Level 2 consolidation is increased by:

Dprot global level 2 <= max (DprotV1, DprotV2)

This protection distance increases the outputs of Level 1 consolidation in the event of a constellation failure. It is assumed that the outputs of levels 1 (speeds resulting from a calculation) are impacted by a constellation breakdown of the maximum impact of a constellation failure on level 2 consolidation data (velocities from a single-constellation calculation); this assumption is greater in the sense that a breakdown of a constellation does not fully impact the speed outputs calculated from two constellations, because these speeds are calculated "half" with data belonging to a constellation without failure.

We have :

With:

: Flight time during which probability rates are defined

The calculation of the output protection distance can then be the following.

Exit protection radius

= max (protection level 1, protection level 2)

The method according to the invention is not limited to the integrity control of measurements emanating from two satellite constellations but can obviously be adapted to control the integrity of a larger number of constellations. BIBLIOGRAPHY

1) "An Optimized Multiple Hypothesis RAIM Algorithm for Vertical Guidance" by Juan Blanch, Alex Ene, Todd Walter, Per Enge, 2007

2) GNSS Integrity Monitoring for Two Satellite Faults by Nathan L. Knight, Jinling Wang, Chris Rizos, Songlai Han, 2009

3) "GNSS Receiver Autonomous Integrity Monitoring (RAIM) for Multiple Outliers" by Steve Hewitson, Jinling Wang, 2006

4) "Integrity control algorithms for hybrid GNSS navigation and inertial navigation systems in the presence of multiple faulty satellite measurements", thesis of the University of Bordeaux, by Frédéric Faurie, 2011

5) Patent Application WO 2012/013524.

6) Patent Application WO 2012/013525.

7) Failure Modes and Effects Analysis (FMEA) of GNSS Aviation Applications, Center for Transport Studies, Dep. of Civil and Environmental Engineering, Imperial College London (Carl D. Milner and Prof. Washington Y. Ochieng).

8) "Feasibility Analysis of RAIM to Provide LPV-200 Approaches with Future GPS", ION GNSS 2007 (Lee Y. C, and P. McLaughlin).

Claims

A method for controlling the integrity of measurements acquired by a navigation system (S) from radionavigation signals transmitted by a plurality of satellite constellations (GNSS1, GNSS2), the method being characterized in that it comprises:

a first processing level (C1) consolidating the data of the different reception channels of at least two constellations, and

a second processing level (C2) detecting an overall failure of at least one of the constellations, and invalidating the consolidated outputs by the first processing level when a global failure is detected.

The integrity checking method of claim 1, wherein the second processing level (C2) comprises the steps of:

calculating (INC) at least one difference value between mono constellation navigation solutions calculated for different constellations,

- Determining (VALIDG), based on the calculated deviation value, global validity information representative of the presence or absence of a global failure on one of the constellations.

The integrity checking method according to claim 2, wherein the difference value is compared (COMP) with a predetermined threshold, the global validity information depending on the result of this comparison.

The integrity checking method according to one of claims 2 or 3, wherein the difference value is calculated as a distance between navigation data vectors from different constellation navigation solutions.

The integrity checking method according to one of claims 2 to 4, wherein the global validity information is set to an invalid value if the deviation value is greater than the predetermined threshold.

The integrity checking method of claim 5, wherein the global validity information is also set to an invalid value if at least one of the navigation data vectors is declared invalid by the first processing level.

The integrity control method according to one of claims 2 to 6, further comprising the steps of:

calculating (PROTG) a first protection distance associated with the global navigation solution from a first probability of loss of predetermined integrity,

computing (PROTC), for each constellation navigation solution, a second protection distance from a second probability of loss of predetermined integrity,

- calculation (PROTS) of an output protection distance, defined as the maximum between the first protection distance and the largest of the second protection distances.

The integrity control method according to one of claims 1 to 7, wherein the acquired measurements comprise, for each satellite, a pseudo-distance and a pseudo-speed, and each calculated navigation solution comprises a speed datum. and an estimated position data for the system (S).

9. Device (D) for measuring integrity integrity acquired from radionavigation signals transmitted by a plurality of satellite constellations (GNSS1, GNSS2), the device comprising:

a first processing module (C1) configured to consolidate the data of the different reception channels of at least two constellations, and

a second processing module (C2) configured to detect an overall failure of at least one of the constellations, and to invalidate the consolidated outputs by the first processing level when a global failure is detected.

A navigation system (S) comprising a receiver (R) configured to acquire measurements of radio navigation signals transmitted by a plurality of satellite constellations (GNSS1, GNSS2), and a device (D) according to claim 9 for controlling the integrity of the measurements acquired by the receiver (R).

The system of claim 10, wherein the receiver comprises a plurality of elementary receivers, each elementary receiver being configured to acquire measurements of radionavigation signals transmitted by a respective constellation.

12. Navigation system comprising a device (D) according to claim 9 and an inertial unit arranged at the output of the device, the inertial unit being configured to provide a navigation solution by hybridization of the data provided by the device (D) with data. measured by inertial sensors.

13. Computer program product comprising program code instructions for executing process steps according to one of the Claims 1 to 8, when this program is executed by a data processing unit.