CA2645656C - Navigation system with apparatus for detecting accuracy failures - Google Patents

Abstract

A navigation system for a vehicle having a receiver operable to receive a plurality of signals from a plurality of transmitters includes a processor (16) and a memory device (18). The memory device (18) has stored thereon machine-readable instructions that, when executed by the processor (16), enable the processor (16) to determine a set of error estimates corresponding to pseudo-range measurements derived from the plurality of signals, determine an error covariance matrix for a main navigation solution using ionospheric-delay data, and, using a solution separation technique, determine at least one protection level value based on the error covariance matrix.

Description

NAVIGATION SYSTEM WITH APPARATUS FOR DETECTING
ACCURACY FAILURES

CROSS REFERENCE TO RELATED APPLICATION

[0001] This application claims priority from U. S. Provisional Appl. No.
61/012,303 entitled "RAIM WITH SPECIALLY CORRELATED IONOSPHERIC
ERRORS" filed December 7, 2007, which is incorporated by reference as if fully set forth herein.

BACKGROUND OF THE INVENTION

[0002] Conventional RAIM algorithms may be based on either a weighted or un-weighted least squares solution where the errors in each satellite's pseudo-range measurement are uncorrelated with the errors in the other satellites' pseudo-range measurements.

[0003] However, the ionospheric error (which can be the dominant error source) in each satellite's pseudo-range is, in fact, highly correlated with that of each of the other satellites. By ignoring this correlation, the computed Horizontal Protection Limit (HPL) which bounds the horizontal position error is much larger than necessary. As a result the availability of GPS to do a low Required Navigation Performance (RNP) approach suffers.

SUMMARY OF THE INVENTION

[0004] In an embodiment of the invention, a navigation system for a vehicle having a receiver operable to receive a plurality of signals from a plurality of transmitters includes a processor and a memory device. The memory device has stored thereon machine-readable instructions that, when executed by the processor, enable the processor to determine a set of error estimates corresponding to pseudo-range measurements derived from the plurality of signals, determine an error covariance matrix for a main navigation solution using ionospheric-delay data, and, using a solution separation technique, determine at least one protection level value based on the error covariance matrix.

BRIEF DESCRIPTION OF THE DRAWINGS

[0005) Preferred and alternative embodiments of the present invention are described in detail below with reference to the following drawings.

[0006] FIG. 1 shows a navigation system incorporating embodiments of the present invention;

[0007] FIG. 2 shows a graphical illustration of HPL determination according to an embodiment of the present invention; and

[0008] FIG. 3 shows a process according to an embodiment of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

[0009] FIG. 1 shows a radio navigation system incorporating the teachings of an embodiment of the present invention. The system includes several transmitters 1-N and user set 12. Transmitters 1-N, in the preferred embodiment, are a subset of the NAVSTAR GPS constellation of satellite transmitters, with each transmitter visible from the antenna of user set 12. Transmitters 1-N broadcast N
respective signals indicating respective transmitter positions and signal transmission times to user set 12.

[0010] User set 12, mounted to an aircraft (not shown), includes receiver 14, processor 16, and a memory device, such as processor memory 18. Receiver 14, preferably NAVSTAR GPS compatible, receives the signals, extracts the position and time data, and provides pseudorange measurements to processor 16. From the pseudorange measurements, processor 16 derives a position solution for the user set 12. Although the satellites transmit their positions in World Geodetic System of 1984 (WGS-84) coordinates, a Cartesian earth-centered earth-fixed system, the preferred embodiment determines the position solution in a local reference frame L, which is level with the north-east coordinate plane and tangential to the Earth. This frame choice, however, is not critical, since it is well-understood how to transform coordinates from one frame to another.

[0011] Processor 16 also uses the pseudorange measurements to detect satellite transmitter failures and to determine a worst-case error, or protection limit, both of which it outputs with the position solution to flight management system 20.
Flight management system 20 compares the protection limit to an alarm limit corresponding to a particular aircraft flight phase. For example, during a pre-landing flight phase, such as nonprecision approach, the alarm limit (or allowable radial error) is 0.3 nautical miles, but during a less-demanding oceanic flight phase, the alarm limit is 2-10 nautical miles. (For more details on these limits, see RTCA
publication DO-208, which is incorporated herein by reference.) If the protection limit exceeds the alarm limit, the flight management system, or its equivalent, announces or signals an integrity failure to a navigational display in the cockpit of the aircraft.
The processor also signals whether it has detected any satellite transmitter failures.

[0012] An embodiment of the invention models the correlation of the ionospheric errors between each pair of satellites as a function of the distance between their ionospheric pierce points. The closer the pierce points, the higher the correlation. The root-mean-square (RMS) uncertainty (or sigma) of each satellite's pseudo-range measurement is computed using the ionospheric variance model defined in DO-229D, Appendix J. Using the computed correlation coefficients and the sigma for each satellite, the ionospheric measurement error covariance matrix is formed. The remaining errors (satellite clock and ephemeris, tropospheric, multi-path and receiver noise) are assumed to be uncorrelated. Thus, the combined measurement error covariance matrix for these error sources is diagonal. These two matrices are added to form the total measurement error covariance matrix. This matrix is then inverted to form the weighting matrix for the least squares solution. Fault detection and exclusion can then be performed and the various protection levels such as the horizontal protection level (HPL), vertical protection level (VPL), horizontal exclusion level (HEL), and vertical exclusion level (VEL) computed based on the methods of solution separation previously described in U. S. Patent Nos.
5,760,737 and 6,639,549, each of which are incorporated by reference as if fully set forth herein.

[0013] FIG. 3 illustrates a process 300, according to an embodiment of the invention, that can be implemented in the radio navigation system illustrated in FIG.
1. The process 300 is illustrated as a set of operations or steps shown as discrete blocks. The process 300 may be implemented in any suitable hardware, software, firmware, or combination thereof. As such the process 300 may be implemented in computer-executable instructions that can be transferred from one electronic device to a second electronic device via a communications medium. The order in which the operations are described is not to be necessarily construed as a limitation.

[0014] Referring to FIG. 3, at a step 310, the processor 16 computes the sigma (error) values on pseudo-range and measurements.

[0015] At a step 320, the processor 16 determines the measurement matrix.
The true vector of pseudo-range residuals op is related to the incremental position/time solution vector ox (distance from the position linearization point) as follows:

Ap=p-{i=HOx (1) where H is the measurement matrix and is given by:

-LOS,X -LOSIY -LOSIz 1 -LOS2x -LOSzy -LOSZZ I
H

-LOSNx -LOSNv -LOSNz I
LOS;x LOS;, = Line-of-sight unit vector pointing from the user to satellite i LOS;.
Ax = x- ic = true position/clock bias - linearization point

[0016] At a step 330, the processor 16 computes the Error Covariance Matrix.
The vector of measured pseudo-range residuals Ap is the true pseudo-range residual vector plus the vector of residual errors 8p and is thus:

OP=p+Sp-p = p - p (2) = HOx+Bp

[0017] The processor 16 designates the post-update estimate of ox as oz .
Then, the processor 16 can defme the vector of post-update measurement residuals as:
4 = 0p - HOz (3)

[0018] Each post-update measurement residual is the difference between the measured pseudo-range residual and the predicted pseudo-range residual based on the post-update estimate oz.

[0019] A "weighted least-squares solution" can be detennined by the processor 16 by fmding the value of oz which mininiizes the weighted sum of squared residuals. Thus, the processor 16 may minimize:

4TW4 =(Op-HOz)T W(Ap-HAz) (4) where W is an appropriate weighting matrix. The weighting matrix generally chosen is one which normalizes the residuals based on the uncertainty of each pseudo-range measurement. Thus, the processor 16 yields:

0 ...

0 2 ... 0 w = ~Z , assuming uncorrelated measurements (5) 0 0 ===
QN

which represents the inverse of the pseudo-range measurement error covariance matrix assuming each pseudo-range error is uncorrelated with the others.

[0020] However, the vertical ionospheric delay component of each pseudo-range error is highly correlated with the others. If this correlation is known, then the processor 16 can take advantage of that knowledge by using the true pseudo-range measurement error covariance matrix R. The weighting matrix then becomes 6i E1SPiSP2l ... EISPiSPNI

W _ R-' _ ELSPiSPzl ai ... E[SP25PN1 (6) ELSPiSPNI EISP28PNl ... 6N

[0021) The value of oz that minimizes (4) is determined by taking the derivative, setting it equal to zero, and solving for oz. This yields:

Oz={HTWH)1 HTWOp (7) = SAp where the processor 16 has defined the weighted least-squares solution matrix S as:

S = (HTWH) 'HTW (8) Altitude Aiding

[0022] Barometric altitude can be used by the processor 16 to augment the GPS pseudo-range measurements. If it is used, the measurement matrix is then augmented as follows -LOSiX -LOSI y -LOSI, 1 -LOS2x -LOSZ,, -LOS2z 1 H = (9) -LOSNs -LOSN, -LOSjyZ 1

[0023] This measurement matrix assumes that the incremental position vector (the first 3 elements) within ox are given in local-level coordinates (with the z axis down). The line-of-sight (LOS) elements then must also be expressed in the local-level coordinates. The weighting matrix is also augmented as follows 6i E[SPisP2] ... E[SPiSPNI 0 E[SPiBP2I aZ ELSPzSPNI 0 W= R-1 = (10) ELSPiSPNI E[SP2SPvl =.. a'N 0 0 0 ... 0 ~barn Computing the Measurement Covariance Matrix

[0024] There are multiple methods that can be employed to determine the measurement error covariance matrix. In the case of a Kalman filter application, the temporal behavior (time-correlation) of the ionospheric delays may be modeled.
The spatially correlated ionospheric error for satellite i can be modeled as a weighted sum of three independent normalized (sigma = 1.0) Gaussian random errors scaled by the nominal iono sigma value for that satellite as follows:

SYI'onu_I - cionn_]kiuno_lxref ll l) where xõ4 is a 3xl vector of independent Gaussian random errors with zero mean and a variance of 1. The weighting vector k;,~ ; is determined by the processor 16 by first defming three grid points on the thin shell model of the ionosphere (at a height of 350 km) equally spaced in azimuth at a great circle distance of 1500 km from the user. The processor 16 may then define a 3x 1 vector x';d of normalized delays at these points. The delays at gridpoints i and j may be spatially correlated with each other based on the great circle distances between them according to:

F[T )2 'Cgrid_ix8rid_j] =l-(l~e (12) where dg,;d ig- j= great circle distance between grid point i and grid pointj (13) d;,,. = correlation distance of the ionospheric delay = 4000 km 100251 Using that relationship the processor 16 can form a 3x3 covariance matrix Ps,;d which describes the correlations between each of the grid points:

r PI.;d = E xx,.ldxgrid [0026] If the delay processes that exist at these grid points are a certain linear combination of the reference independent Gaussian random errors, then they will have the desired spatial and temporal correlation. The processor 16 may assume that the desired linear combination is obtained by using a 3x3 upper-triangular mapping matrix ugr;A as follows:

xgrid - Ugrid xref (14) [0027] The grid covariance matrix is then:

iT L+
Pgrid =E xgriJxT grid V grldr' [xreJxT nJ' ]*7T
vgrid T (15) - Ugp;dUgrid [0028] Therefore, the mapping matrix Ug,., can be formed by the processor 16 simply by factoring the covariance matrix P,,,. Since the geometry of the three gridpoints is fixed, the covariance matrix P,,, is constant and can thus be pre-computed by the processor 16. Now the processor 16 can choose a linear combination of the three grid-point delays that yields a normalized delay at the pierce-point of the satellite i such that the proper spatial correlation with the three grid points (and thus, presumably, each of the other satellites) is achieved as follows:

_ T
Spnurm_ionn_I -ksar_i_gridXgrid (16) where ksa, ;,,,W = 3-vector of weighting factors Spnõm i,,,,, i= nonnalized delay at the satellite pierce-point [0029) The satellite pseudo-range delay may be correlated to the delay at the k'ti grid point according to:

E~SPnnnx_ionu_ixgrid_k~=1-~1-e w_.gnJ.ki d- )= (17) where df,,,,g,;d k= great circle distance between the satellite pierce point and the grid point (18) d;~nõ = correlation distance of the nominal ionospheric delay [0030] The lx3 covariance matrix Ps,n, _,;d , which defmes the correlations between satellite i and each of the grid points, is _ i~ r _ r r Psu1_!_grid -E[Upnorm_iXgrul] E[ksul_i_gridXgrWxgrid (19) = ksu_i_gridPgrrd [0031] Therefore the weighting vector k,,,,_gr;d can be found by the processor 16 as follows:
k r n i (20) .cnt_;_grid = r.ra1_i_gridPgrid [0032] Combining (14) and (16), the processor 16 can obtain the normalized vertical delays directly from the three independent reference delays as follows:

SPnnrm _ iono _ i- k ur grid Ugrid X ref (21) k iuno X reI

[0033] Thus, the weighting vector is:

T kr rT (22) kinno_i = ru,_!_gridvgrid [0034] The processor 16 can form a vector of N normalized pseudo-range iono delays from (21) as follows:

T
k a~nr _ 1_ grid r ksW
z _ g;d Spmrm_i,~n~ = UgridXrer (23) r ksa!_ N_gnul _ Kvn _ grid v grid xraf [0035] The actual (non-normalized) delay along the line of sight can be obtained by the processor 16 by scaling the normalized delay by the sigma value for that satellite based on the geomagnetic latitude of the pierce-point and obliquity factor as defined in DO-229. In vector form, the processor 16 yields:

Q,oRn_ ~ 0 ... 0 0 6uno_2 r/~
Spiona = . . O V Y- _ ionu O ... 0 ~iono N
6inno_I O ... 0 _ O ~iunn_2 ' ' K 'T (24) . . . 0 sul_gridvgrfdxref O ... 0 Qiuno N
= rK sol _ grld V grid X reJ' [0036] The ionospheric delay error covariance matrix may be defined as:
T
R;nnn = E Sp,nn~sp;nnn ]

= rKan,_grwvgrid '(''[XrefXef ]UgrldK~n_gr,drT (25) T T
= rKsw_gr,dPgrdK.n,_gr,dr arbno_~ EISP,p,n_jSPannzl EI~P,n~~SP,n~l E[SP. SP
mo1 iona21 mm_2 "~ P~uno 2~inrtn N1 Riaro - - _ E[sP m ~SParo Nl LjSP,.o zSP,oro Nl 6z mnn N

[0037] The rest of the pseudo-range measurement errors are assumed to be uncorrelated with a composite one-sigma value denoted by an,h, , for satellite i. For simplicity, the processor 16 can assume that the one-sigma value for each satellite is a constant six meters. The total measurement error covariance matrix is then:

0 ... 0 R=W-' = R._ + 0 7.11~ _z 0 (26) z 0 ==. o 6aAer N

[0038] In a snapshot RAIM approach, the correlations between satellites are computed directly without the use of a grid. Computing the correlations between satellites directly may be both simpler and slightly more accurate.

[0039] Specifically, ionospheric error covariance may be modeled as a function of the great circle distance between the pierce points along the ionospheric shell (350 km above the earth's surface):

'ann ~
E[SP,o,~ _;SPo,._ j 6rono_16iono_ j 1- (1- e-dJ Id)Z

where:
du = great circle distance between pierce points for sats i andj d;o = de-correlation distance = 4000 km [0040] Ionospheric errors are highly correlated. As such:
w = R ~R,ono + Rothe. }_ where:

~ono-1 ELSPiono_1vPiono_21 "' E[SPionoI9Piono_NJ

ELSP;.ISP;o,x, 2l 6ron., 2 "' ELSP;ono 24P;,~no_N l Riono = - -E[SP,o,~_ISP;ono_N] E1SPio,~_2SP,o,~_N1 ... 6Z
iorro N
' rher 1 0 . . . 0 O 6other_2 '=. O
Rolher 0 0 = = 6other N

Error Covariance for the Weighted Least Squares Solution [00411 At a step 340, the processor 16 computes a weighted least-squares solution. The error in the post-updated solution is:
8X=r1x-AX
(HTWH) IHTWt1p-Ox (27) [0042] Substituting (2) into (27) yields:

Si=(HT WH) 1 HTW(HDx+Sp)-Ox =Ax-(HTWH)-I HTWSp-Ax (28) =(HTWH) I HTWSp = Sbp [0043] Thus, the solution matrix S maps the pseudo-range errors into the post-updated solution error vector. The solution error covariance matrix may be defined as:

P = E[S%tS%T ] = SE[SpSpT ]ST
= SW-lSr =(HrWH)-'HTWW-'WH(HTWH)-' (29) =(HTWH)-' [0044] The x and y horizontal position errors are statistically described by the upper 2x2 portion of P. The major and minor axes of the horizontal position error ellipse are equal to the square roots of the maximum and minimum eigenvalues of this 2x2 matrix and represent the one-sigma errors in the corresponding directions.
Thus, the one-sigma error in the worst-case direction is given by:

C = aP(i:z.i:z) b.

~ ~,(P14)Z (30) = Pii 2Pzz { (Pn 2P2z 2 [0045] The one-sigma error in the vertical position is given by:

~ prf = A3 (31) 100461 Horizontal Figure of Merit is a conservative 95% fault-free error bound and may be computed by the processor 16 as the 2D RMS enror from the error covariance matrix HFOM=2 P(1,1)+P(2,2) [0047] Similarly, the Vertical Figure of Merit may be computed by the processor 16 as the 2-sigma vertical error from the error covariance matrix VFOM = 2 P(3, 3) Snapshot Solution Separation RAIM

100481 At a step 350, the processor 16 computes at least one protection level value. In doing so, the processor 16 can employ a snapshot solution separation algorithm. Snapshot solution separation RAIM is analogous to a hybrid Kalman filter solution separation FDE. A main snapshot least-squares solution may be computed by the processor 16 using all N satellites in view (plus barometric altitude, if desired).
In addition, N sub-solutions may be computed using each combination of N-1 satellites (plus altitude, if desired). Satellite failure detection occurs when the separation between the main position solution and one of the sub-solutions exceeds a threshold based on the expected statistical separation. Likewise, 1V 1 sub-sub-solutions may be computed by the processor 16 for each sub-solution using each combination of N-2 satellites which excludes the satellite excluded from the parent sub-solution plus one other. (Again altitude may also be used as an additional measurement). Isolation and exclusion of the failed satellite is accomplished by the processor 16 by comparing the separation of each sub-solution from each of its sub-sub-solutions against a threshold based on the expected statistical separation. In order to meet the time-to-detect requirement of eight seconds, fault detection may be performed and the RAIM HPL may be calculated by the processor 16 at least every four seconds.

[0049] As long as there are at least five satellites being tracked, the n`h sub-solution can be computed by the processor 16 by zeroing out the ? row of the measurement matrix. If the processor 16 designates the measurement matrix of the sub-solution as Hoõ , then the resulting least-squares sub-solution is:

' AXoõ _ (HoõwonHon ) Ho w0nAP (32) = SoROP

where Hon = geometry matrix with n''' row zeroed Ron = covariance matrix R with n" row and column deleted wo. = Ron with n'" zero row and column inserted and where the weighted least-squares sub-solution matrix Soõ is:

= T I T SOn - (HOnwROn ) HOn W (33) [00501 Note that the n'h column of son will contain all zeros. If the processor 16 designates the main solution with the subscript 00, then the separation between the main solution and sub-solution On is:

dxoõ = Dioo - Azoõ
= SooAP - SOõOP
(34) =(Soo -Soõ)Ap = dSOnAP

Where dSoõ is referred to as the separation solution matrix.
RAIM Fault Detection [0051] In order to detect a satellite failure, the horizontal position solution separation (f.e., the discriminator) between each sub-solution and the main solution may be compared by the processor 16 to a detection threshold. The discriminator for sub-solution Oj is given by:

doõ = Id"xoõ (1: 2)1 = [d xo,, (1)]2 +[dxo,, (2)]2 (35) [0052] The detection threshold is set by the processor 16 to a multiple of the one-sigma separation in the worst case direction in order to give a false detection rate of 10"5/hr. Using (34) the processor 16 can express the solution separation in terms of the normalized pseudo-range enors as follows:

dxoõ = Oxoo - Oxon = (Ax + CSxoo ) - (Ax t Sxon ) = Sx00 -Sxoõ (36) = S008p - SonSP
=(Soo -Soõ)8p = dSoõsP

[0053] The covariance of this solution separation is:

dPon = E[ T
dxon =dxon =dSonE[SPapT ]dSon = dSanRdSpn r (37) = (S~ -Son ) R(Soo -S0n ~

= E [(5006-poo - Sonbpon pno4oo - Son4on )r = SooRSoro +SonRSon -S~RSon -SonRS~
[0054] Note that:

SOORS~ = [(Hwu)HWJ WI WH(HWHJ
~H r WH )-'(H WH )(Ha WH00) ' (38) _ (HT ~WHoo ) ~
and SooRSo =[~HooWooHoo) IHoo~'oo]Woo I [w0u0 (no WonHon)-I
, (39) T 'T T ' = ~Hoo~'ooHoo ) Hoo~'onHon ~Hon WonHon ) [0055] But, it can be shown that r r HooWonHon = Hon~'onHon (40) 100561 Substituting into (39) yields:

Soo~o =(Hoo~'~'ooHoo) HOnWonHan(Hon~'~'onHon~-= (H r WooH ) ' (41) = SooRSr oe [0057] Taking the transpose of each side, the processor 16 gets:
SonRST ~ = SOORST oo (42) [0058] Substituting (41) and (42) into (37), the processor 16 gets:

T T
dPon = son~on -SooRSoo r ~ ~
=~HOn~'onHon) -(Hr oo~'ooHoo) (43) = Pon - Poo [0059] The x and y horizontal separations are statistically described by the upper 2x2 portion of dP. The major and minor axes of the horizontal position separation ellipse are equal to the square roots of the maximum and minimum eigenvalues of this 2x2 matrix and represent the one-sigma separations in the corresponding directions. Thus, the one-sigma separation in the worst-case direction is given by:

Q = ~aPu,uz.1x) do mex dP~ I 2 dPzz + dPl I 2 dPzz 12 2 (44) _ l J +(dp,2 ) [0060] The processor 16 can assume that the separation is dominant along this worst case direction and thus the distribution can be considered Gaussian.

[0061] The detection threshold is computed by the processor 16 using the allowed false alarm probability and a Normal distribution assumption as follows:

, Pfa D0o = . ""Q 2N = qo. ' Kf. (N) (45) where:
p f~ = probability of false alert per independent sample N = Number of sub-solutions (i.e., number of satellites being tracked) and Q' is the inverse of:

Q(z) = 1 je -Y du =1- 1 j e'ydu = i- F(z) (46) ~~ ~-m [0062] The function F(z) is the well known standard normal distribution function.

[0063] Horizontal failure detection may be declared by the processor 16 when a discriminator exceeds its threshold, according to the following:

[0064] For each active sub-solution On If (doõ I> D, then DETECTION = TRUE
End if End For RAIM HPL

[0065) The RAIM horizontal protection level (HPL) is the largest horizontal position error in the least-squares position solution that can occur and that meets the required probability of missed detection of 0.001. For a given sub-solution On, this occurs when the separation between the sub-solution and the main solution is just under the detection threshold and the sub-solution position error, which may be called ao., is at its 99.9% performance bound. Thus, the HPL for sub-solution On is:

a0a - 66reõ L _' (Cmd 6droõ Ka (47) where Q' is as defined in (46) and:

~=6ry_ APo.l1::.1:2) (48) and A P=Q`Z' 2' is the maximum eigenvalue of the 2x2 horizontal position elements of the sub-solution covariance matrix PaR computed by the processor from the normalized geometry matrix Hon as follows:

r ' P. = (Hon~'Hon ) (49) 100661 Note that the processor 16 may only consider one side of the distribution, since the failure biases the distribution to one side.
Evaluating the Kmd for 99.9% Gaussian bound the processor 16 gets:
K,,,d = 3.1 (50) [0067] The HPL for each active sub-solution On, is then computed by the processor 16 as:

HPLxn, (n) = D, +ao. (51) [0068] The overall HPL and the hardest-to-detect satellite ID (needed for fault insertion test purposes) are computed by the processor 16 as follows:

HPLwM = O

[0069) For each active sub-solution On HPLR,,,y = max(HPLR4,M,HPLRe,M (n)) (52) If HPLR,,,M = HPLRõM (n), then iSVIDhurd_Jei_Mn -/ix(n) (53) End if End for where f,(n) is an array that maps the sub-solution number n to the satellite ID. A graphical illustration of HPL determination is provided in FIG. 2.

RAIM HUL

[0070] The Horizontal Uncertainty Level (HUL) is an estimate of horizontal position that bounds the true horizontal position error with a probability greater than or equal to 0.999. A conservative 0.999 bound on the horizontal position error of the primary solution can be computed by the processor 16 by simply adding the sub-solution horizontal position 0.999 error bound aon to the horizontal separation between the primary solution and the sub-solution. This will bound the error even in the case of a failure on the satellite excluded by that sub-solution. To bound the error for any satellite failure, the processor 16 may compute the HUL for all sub-solutions and take the worst case.

[0071] The HUL is thus computed by the processor 16 as follows:
HUL.,M =max(do. +QO,), n=1,N (54) where ao, is as defined in (47).

[0072] The HUL can be substituted for the HPL when a failure is detected. In this way, the failure continues to be bounded until the faulty satellite is isolated and excluded.

Vertical Position Error Detection [0073] For protection of vertical position, the discriminator is:
donr, - Idxoõ (3)I

[0074] For vertical error detection, the sigma of the vertical position error is computed by the processor 16 from the third diagonal of the covariance:

wrt 6da. = dPoõ (3,3) [0075] The threshold set to meet allowed false detection probability is:
D'~ ~NJ=a~n~'K`a(N)

-25-Vertical Protection Level (VPL) [00761 The error bound of the sub-solution vertical position may be determined by the processor 16 from the sub-solution error covariance matrix:

vert a's,oa = PoA(3, 3 ) ao ` = 6a`""Q ' (P,d ) = Qs `Kr [0077] VPL may be computed by the processor 16 by adding this bound to the threshold for each sub-solution and taking the worst case:

VPL = max (Don'r + ao RAIM Fault Isolation and Exclusion [00781 Fault isolation for RAIM may be performed by the processor 16 by performing fault detection on the separations between each sub-solution and its corresponding sub-sub-solutions.

[0079] Sub-sub-solution nm which excludes satellites n and m is:

Axnm -(H mWnmHnm)_' HnmWnnAp = S.Ap where:
H,,,,, = geometry matrix with n'h and m`' row zeroed Rnm = R with n'" and m``' rows and columns deleted W. = R~;, with nt~' and m~' zero row and column inserted

-26-[00801 Solution separation between sub and sub-sub-solution is:
axnm = AiOn -Axnm = `50nAP -SnmOP

-lSOn -Snm/Ap - dJnmAP

[0081] The horizontal position solution separation vector for each active sub-solutions On and each of its corresponding active sub-sub-solutions (nm for m > n or mn for n > m) may be calculated by the processor 16 as:

dxnm(-)=0xpn(i)-Oxnm(i), i=1,2; m>n (55) dx,,,,,(i)=0xoõ(i)-Axn,n(i); i=1,2; n>m (56) [0082] The horizontal discriminator (the horizontal solution separation distance) for each active sub-solution may be calculated by the processor 16 using the x and y position separation states:

dnm [dxnm (1)]Z +[dxnm (2)]2 (57) [0083J As for detection, the threshold is based on the separation covariance matrix. For each active sub-solution On and each of its corresponding active sub-sub-solutions (nm for m > n or mn for n > m), the separation covariance matrix is computed by the processor 16 as:
dP,m, Pnm - Pon; m> n (58) dP m= Pmn - i'On ; n> m (59)

-27-[00841 Again, the horizontal position error is an elliptical distribution in the x-y plane. The error along any one axis is normally distributed. For the purpose of setting a threshold to meet the required false alarm rate and to calculate the protection level, the processor 16 makes the worst case assumption that the error is entirely along the semi-major axis of this ellipse. The variance in this worst case direction is given by the maximum eigenvalue idP_":z':2' of the 2x2 matrix formed from the horizontal position elements of the separation covariance. Thus, the horizontal position separation uncertainty in the worst case direction for each sub-solution is computed by the processor 16 as follows:
~,d~ _ ~~ o:z.1z> (60) [0085] Each threshold is computed by the processor 16 as follows:

D'm.7d-Q 1I 2(N~ 1) )=a,,..'Kfo(N-1) (61) where plQ, N, Q-', and x fa are as previously defined for detection.

[0086] Exclusion proceeds in an analogous manner to detection with the sub-solution taking the role of the main solution and the sub-sub-solution taking the role of the sub-solution. For each sub-solution, the separation from each of its sub-sub-solutions is determined by the processor 16 and tested against its threshold.

[0087] The exclusion logic is as follows:

If sub-solution n is separated from at least one of its sub-sub-solutions by more than its threshold, then satellite n cannot be the failed satellite (i.e.
the failed satellite is still included in sub-solution n). On the other hand, if the separation of

-28-sub-solution r from each of its sub-sub-solutions is less than the exclusion threshold, then satellite r is the failed satellite (providing each of the other sub-solutions is separated from at least one of its sub-sub-solutions by more than its threshold).

[0088] This is equivalent to saying that satellite r is isolated as the failed satellite if and only if:
drn, < D,,,, ; for all m* r and dõm>_D.,,; for at least one m # n foralln# r [0089] Exclusion of a vertical position failure may be accomplished by the processor 16 in a similar manner.

[0090] The following algorithm executed by the processor 16 will accomplish the isolation as described above:

If (DETECTION_HORZ) ISOLATION HORZ = FALSE

PREVIOUS ISOLATION HORZ = FALSE
For each active sub-solution On If I d:' I< Dõ',:- for all m (active sub-sub-solutions only), then If (PREVIOUS_ISOLATION HORZ), then ISOLATION HORZ = FALSE

Else ISOLATION HORZ = TRUE

-29-PREVIOUS ISOLATION HORZ
TRUE

~/uiled _.svid - J (n) End if End if End for End if If (ISOLATION_HORZ), then SAT STATUS = ISOLATION
End if [0091] When the failure is isolated, the satellite is marked by the processor as failed, all the solutions excluding satellite are dropped, and the satellite will be retried in one hour.

RAIM HEL

100921 RAIM HEL is computed by the processor 16 in a fashion analogous to that of the Kalman filter solution separation. At exclusion, the horizontal position solution of sub-solution On is separated by the processor 16 from sub-sub-solution nm by D.. (see equation (61)). The sub-solution position error with respect to the true position is thus Dn,õ plus the sub-sub-solution position error (assuming, in the worst case, that they are in opposite directions). The sub-solution position error

-30-bound aõ,õ can be determined by the processor 16 from the maximum eigenvalue AP_n:2=1:2' of the 2x2 matrix formed from the horizontal position error elements of the sub-sub-solution error covariance matrix. That is:

_ = ~6. Q-'(Pmd ) = 6s,_ K.d (62) where Q-' is as previously defined and AP,..(12.12) (63) [00931 Again, the processor 16 may only consider one side of the distribution, since the failure biases the distribution to one side. The allowed probability of missed detection is 1.0e-3 and is assumed by the processor 16 to be the same as the allowable probability of failed exclusion. The sigma multiplier Kmd is as previously defined for the RAIM HPL calculation. The RAIM HEL for each active sub-sub-solution nm of sub-solution On is then computed by the processor 16 as:

HELwua (nm) = Dn. +Q,,,,, (64) [00941 Note that the HEL does not consider the failure-free rare normal condition, since exclusion assumes that a failure is present. The overall HEL
and the hardest-to-exclude satellite ID (needed for fault insertion test purposes) may be computed by the processor 16 as follows:

HELR,,,, (nm) = 0 For each active sub-solution On For each active sub-sub-solution nm of sub-solution On HELR,1,y = max(HELR,M,HELR,,,M (nm)) (65) If HELR,,,y = HELR11Af (nm), then

-31-'SVrD hard eed hon = Jir\n) (66) End if End for End for As such:

HEL = max (max (Dõm + aõm )), n =1, . . . N, m 1,... N
Similarly:

VEL=max(max(Dm"+am`)), n=l,...N, m=l,...N
Ionospheric Error Model Calculations Determination of Ionospheric Grid Points and Pierce Point Coordinates [0095] For a Kalman filter approach, and in order to utilize (17), the processor 16 may first determine the coordinates of each gridpoint and the coordinates of the satellite's ionospheric pierce point. Then, using those two sets of coordinates, the great circle distance between the pierce point and the grid point can be calculated by the processor 16. For either a Kalman filter or snapshot RAIM approach, knowing the coordinates of a point i (e.g., the system illustrated in FIG. 1, or "user") and the distance and azimuth from point i to a point j(e.g. the gridpoint), the coordinates of point j can be determined by the processor 16 as follows:

-32-I sin ~., cos yr, + cos ~,, sin yr;~ cos A~
~.. = tan' (A.1) j (cos A; cos yfy - sin A; sin yr;j cos Aj )Z +sin` y/~ sin2 A;~

'-sin yr. sin A~
A~ = A. + tan (A.2) cos A; cos yr, - sin A; sin yr,, cos A,, A; = Geodetic latitude of point i Aj = Geodetic latitude of pointj A, = Geodetic longitude of point i Ai = Geodetic longitude of pointj Aii = Azimuth angle (bearing) from point i to pointj yiij = Angular distance (earth's central angle) from point i to pointj dy Re + h, dij = Great circle distance from point i to pointj Re = Radius of the earth = 6378 km h, = Height of the ionosphere thin shell model = 350 km [0096] The coordinates of the ionospheric pierce point of the satellite can also be calculated using (A. 1) and (A.2). In this case, yr, represents the central angle from the user location to the pierce point and may be calculated by the processor 16 as follows:

y r , ~ = 2-E-sin-' I R Reh cosE I (A.3) l e f J

where E is the elevation angle of the satellite from the user location with respect to the local tangent plane.

-33-Computing Elevation and Azimuth Angles of Satellite [0097] The elevation angle E of a satellite is defined as the angle the line-of-sight vector makes with the user's local tangent (horizontal) plane. The azimuth angle A of the satellite is the angle of the line-of-sight vector with respect to true north as measured in the horizontal plane. Thus, we have the following E = ATAN2(-u,~., ui~ x +u~OS-Y (A.4) Ao = ATAN2 (uLOS _ Y I ucas _x ) + a (A.5) Ao' -~r<_Ao<~r A = - 2;r, Ao > >r (A.6) Ao+2;r, Ao <;r where u,OS õuLW OuLOS z= x, y, and z components of the line-of-sight vector uiOS
a = wander angle (angle in azimuth from north to the x local-level frame axis) [0098] Note that the azimuth angle is adjusted by t2;r so that the result is between -;r and +n .

Determination of Great Circle Distance 100991 The great circle distance along the ionospheric thin shell model from a point i (e.g. satellite pierce point) to another point j(e.g. grid point) may be calculated by the processor 16 as follows:

-34-cosZ ~,' . sin 2 AA~ + (cos ~.; sin Aj - sin ~,; cos ~,j cos AA,~
d;~ =(Rr+h,)tan' (A.7) cos A; cos Aj cos DA;~ + sin A, sin Aj where DAii =Ai -A;

Ionospheric Variance Model [00100] The algorithm that may be executed by the processor 16 for calculation of the ionospheric model error variance may be from ICD-GPS-200C
and DO-229D J.2.3. Note that the symbols in this section are unique to this section.

[00101] Using the satellite's elevation angle E, form the earth's central angle between the user position and the earth projections of ionospheric pierce pointyrPP using equation (A.3).

[00102] Next, using the satellite's elevation angle E, the azimuth angle , A, the earth's central angle yrPP and the user geodetic latitude ~õ and longitude A, determine the pierce point geodetic latitude Opp Land longitude App using equations (A.1) and (A.2).

[0100] Form the absolute value of the geomagnetic latitude of the ionospheric pierce point.

IAI =lApp +0.064;rcos(ApP -I.617ir)I radians (A.8) [01011 Form an estimate of the vertical delay error based on geomagnetic latitude

- 35 -9 meters, I.i. I<_ 20 degrees rwr, = 4.5 meters, 22.5 <'.i,,, I S 55 (A.9) 6 meters, IAm I> 55 [0102] Using the elevation angle E, calculate the square of the obliquity factor.

Fppz = z (A.10) Re cos(E)~
RQ + h!

101031 Form the modeled estimated variance of the ionospheric delay.
z amodel = Fpp2tvert (A. 11) 101041 Form the estimated variance using the compensation that is applied if available from the receiver. (If not, assume zero).

2 (cTNo)2 (A.12) 101051 Form the estimated variance of the ionospheric delay.

Qz =max(6Ld,az~,,,P) (A.13) [0106] While the preferred embodiment of the invention has been illustrated and described, as noted above, many changes can be made without departing from the spirit and scope of the invention. Accordingly, the scope of the invention is not limited by the disclosure of the preferred embodiment. Instead, the invention should be determined entirely by reference to the claims that follow.

-36-

Claims (10)

1. A navigation system for a vehicle having a receiver operable to receive a plurality of signals from a plurality of transmitters, the navigation system comprising:
a processor (16); and a memory device (18) having stored thereon machine-readable instructions that, when executed by the processor (16), enable the processor (16) to:
determine a set of error estimates corresponding to pseudo-range measurements derived from the plurality of signals, determine an error covariance matrix for a navigation solution using ionospheric-delay data, the error covariance matrix including off-diagonal elements representing ionospheric-delay spatial correlation, and using a solution separation technique, determine at least one protection level value based on the error covariance matrix.

2. The system of claim 1 wherein determining the error covariance matrix includes determining a spatially correlated ionospheric error associated with each of the transmitters.

3. The system of claim 2 wherein determining the error covariance matrix includes defining a plurality of grid points on a thin shell model of the ionosphere.

4. The system of claim 3 wherein the defined grid points are equally spaced in azimuth at a great circle distance from the system.

5. The system of claim 4 wherein the great circle distance is 1500 km.

6. The system of claim 3 wherein determining the error covariance matrix includes defining a vector of normalized ionospheric delays at the grid points.

7. The system of claim 1 wherein the at least one protection level value comprises a horizontal protection level value.

8. The system of claim 1 wherein the at least one protection level value comprises a vertical protection level value.

9. The system of claim 1 wherein the at least one protection level value comprises a horizontal exclusion level value.

10. A computer-readable medium (18) having computer-executable instructions for performing steps comprising:
determining a set of error estimates corresponding to pseudo-range measurements derived from the plurality of signals;
determining an error covariance matrix for a navigation solution using ionospheric-delay data, wherein the error covariance matrix includes off-diagonal elements representing the spatially correlated ionospheric error for the plurality of signals;
using a solution separation technique, determining at least one protection level value based on the error covariance matrix; and displaying the at least one protection level value.