Abstract:
The present invention relates to a method for determining a protection space in the event of two faulty measurements of a pseudo-range between a satellite and a receiver for receiving signals transmitted by various satellites in a radio-navigation constellation, characterized in that said method includes the steps of: (a) determining, on the basis of the pseudo-ranges measured by the receiver, a test variable representative of the likelihood of a fault; (b) estimating, for each pair of pseudo-ranges from among the pseudo-ranges measured by the receiver and from the expression of the thus-obtained test variable, a set of minimum-bias pairs detectable for a given missed detection probability; (c) expressing, for each pair of pseudo-ranges, the estimated set of detectable minimum-bias pairs in the form of an equation defining an ellipse associated with the pair of pseudo-ranges in question; (d) expressing the equation of each ellipse in parametric coordinates and expressing each detectable associated minimum-bias pair on the basis of a single parameter; (e) projecting each of the thus-parameterized detectable minimum-bias pairs over at least one subspace of R3; (f) calculating, for each subspace and for each bias pair, the maximum position error induced by the bias pair; (g) selecting, for each subspace, the maximum from among all of the calculated maximum position errors, and transmitting the results of said selection outward. The present invention also relates to an integrity-monitoring system and to a vehicle therefor.

Description:
GENERAL TECHNICAL FIELD 
       [0001]    The present invention relates to the field of integrity-control systems for civil and military aviation. 
         [0002]    More precisely, it concerns a method for determining a protection volume in the case of two simultaneous satellite failures in a navigation system. 
       PRIOR ART 
       [0003]    Vehicles with satellite navigation systems are conventionally equipped with a receiver tracking N satellites, as shown in  FIG. 1 . Every second, the receiver must determine its position from N measurements originating from the satellites in view. 
         [0004]    For each of these satellites, the receiver calculates an estimation of the distance separating them from the latter, called pseudorange due to the different errors by which it is flawed. Each measurement is actually perturbed by a noise measurement due especially to the wave passing through the atmosphere. However, the statistical characteristics of these measurement noises are known and these perturbations are not considered failures. 
         [0005]    However, some satellites can present more substantial faults and provide incorrect information to the receiver, dangerously degrading the precision of the navigation solution. These satellite breakdowns, due essentially to malfunctions of the satellite clock or to problems of ephemerides, result in bias on the failing satellite measurement or the failing satellite measurements which must be detected. These biases are added to the measurements and are modelled either by echelons or by ramps evolving over time. 
         [0006]    Even if these satellite breakdowns were rare (probability of the order of 10 −4 /h per satellite), navigation systems must take this risk into account, in particular in aviation where a position discrepancy can be fatal. 
         [0007]    The aim of integrity-control systems is the detection and exclusion of satellite breakdowns. There are two distinct configurations for the integrity-control systems. When the system is coupled to a navigation support system (such as an inertial system), this means AAIM context (for Aircraft Autonomous Integrity Monitoring). When the integrity-control system operates autonomously, this means RAIM context (for Receiver Autonomous Integrity Monitoring). At a given missed detection probability, dependent on the flight phase and fixed by the International Civil Aviation Organisation (ICAO), integrity-control systems must be capable of providing a terminal on the position error of the device which may not be exceeded without detecting a malfunction in a timely manner. This is why they are known as a protection volume. 
         [0008]    This is a cylinder centred on the estimated position of the apparatus and defined by a horizontal protecting radius and a vertical protecting radius (the height of the cylinder). It defines the volume in which it can be affirmed that the apparatus is really close to the missed detection probability. 
         [0009]    Until recently, the single hypothesis of a single satellite failure was enough to satisfy ICAO requirements. But with the next deployment of novel constellations of satellites (Galileo in 2014 and modernised GPS in 2013), as well as tightening of ICAO requirements (missed detection probability less than one in ten million), integrity-control systems today must take into account an increase in the number of available satellite measurements. In particular, they must be able to process several simultaneous satellite breakdowns, an event whereof the occurrence probability is no longer negligible with respect to ICAO requirements. 
         [0010]    Various methods have been proposed to date for providing a solution to the problem of calculating the protecting radii. 
         [0011]    Whether this is in a RAIM context or an AAIM context, the integrity-control systems use one or more hypothesis tests for detecting one or more possible faults among the measurements available. These hypothesis tests are based on test variables compared to thresholds for detecting the presence of faults. These test variables are constructed from one or more estimations of the navigation solution and optionally of the measurements received. The navigation solution can be estimated for example by a Kalman filter or by an estimator in terms of least squares. 
         [0012]    Determining the protection volume translating performances of the integrity-control system is based on the statistics of the different test variables used. The protecting radii associated with the most used algorithms for detecting a satellite failure are mentioned in the document “Fde using multiple integrated gps/inertial Kalman filters in the presence of temporally and spatially correlated ionospheric errors”,  Proceedings  of ION GPS (2001), by K. Vanderwerf. 
         [0013]    The diagram of an example of a method for determining a protection volume in the case of a single satellite failure is illustrated by  FIG. 3 . By way of definition, the protecting radii must be independent of the measurements and therefore predictable for a given place and time. As mentioned previously, the method for failure detection used during step  100  is based on one or more hypothesis tests. For clarity, the case of a single hypothesis test based on a test variable, noted T t , is considered, whereof the statistical distribution is known and for which a decision threshold can be determined for a given probability of false alarm, noted P fa . For a given missed detection probability P md , step  200  defines a minimum bias detectable for each measurement i ε[1, N]; this bias is noted hereinbelow as b min,i . The minimum detectable bias b min,i  represents the minimum amplitude of a bias appearing on the measurement i which the hypothesis test can detect for a given missed detection probability. It should be noted that b min,i  depends not on measurements but on the geometry of the satellite i as well as the variance in noise measurement. The impact of this bias on the estimation of the navigation solution is then evaluated during projection step  300  on the position error. The result is a upper bound on the estimation error, noted HPL(i) for the horizontal error and VPL(i) for the vertical error, which the method may not exceed without detecting a failure on the measurement i with the missed detection probability P md : 
         [0000]      HPL(i)=μ H   (i) {tilde over (b)} min,t  
 
         [0000]      VPL(i)=μ V   (i) {tilde over (b)} min,i  
   with μ H   (i)  and μ V   (i)  the projection matrices of the bias of the measurement on the horizontal and vertical plane of the navigation solution respectively.   
 
         [0015]    The protecting radii under the assumption of a single failure at the instant t are defined during step  400  by selecting the worst hypothesis, that is, the maximum value according to the N measurements for HPL and for VPL. 
         [0016]    It should be noted that in the case of a single failure the minimum detectable bias for each potentially faulty measurement is a scale which can therefore easily be projected again onto the position error. In the case of a double failure, an infinity of bias pairs is detectable for a missed detection probability. 
         [0017]    There is currently no method for determining a protection volume in the case of a simultaneous double satellite failure. 
       PRESENTATION OF THE INVENTION 
       [0018]    The aim of the present invention is to resolve these difficulties by proposing a solution for determining a protection volume in the case of a simultaneous double satellite failure in a constellation of about fifteen satellites, without the need for calculating power substantially greater than that of current onboard systems, and therefore without additional cost. 
         [0019]    With this taken into account of a larger number of possible incidents, the invention allows increased aerial security, considering cases which to date would have resulted in aerial catastrophes. 
         [0020]    In addition, another aim of the invention is to arrive at this objective by proposing a method which can be integrated into both an AAIM context and a RAIM context. There is therefore total adaptability. 
         [0021]    The present invention therefore relates to a method for determining a protection volume in the event of two faulty measurements of pseudorange between a satellite and a receiver receiving signals transmitted by different satellites of a radio-positioning constellation, characterised in that it comprises steps of: 
         [0022]    (a) Determining a test variable representative of the likelihood of a fault as a function of the pseudoranges measured by the receiver; 
         [0023]    (b) Estimating, for each pair of pseudoranges among the pseudoranges measured by the receiver, the set of detectable minimum-bias pairs for a given missed detection probability, from the expression of the test variable obtained; 
         [0024]    (c) Expressing, for each pair of pseudoranges, the set of detectable minimum-bias pairs estimated in the form of an equation defining an ellipse associated with the pair of pseudoranges in question; 
         [0025]    (d) Expressing the equation of each ellipse in parametric coordinates and expression of each detectable minimum-bias pair associated as a function of a single parameter; 
         [0026]    (e) Projecting each detectable minimum-bias pair accordingly parameterised onto at least one subspace of R 3 ; 
         [0027]    (f) Calculating, for each subspace and each bias pair, the maximal position error caused by the bias pair; 
         [0028]    (g) Selecting, for each subspace, the maximum among all maximal position errors calculated and transmission outwards of the results of this selection. 
         [0029]    According to other advantageous and non-limiting characteristics of the invention: 
         [0030]    the subspace or the subspaces selected at step (e) are additional in R 3 , in such a way that the position errors maximum define the dimensions of a volume;  
         [0031]    step (e) comprises projection on the horizontal plane and projection on the vertical axis; 
         [0032]    the test variable generated at step (a) follows a X 2  distribution with N degrees of freedom; 
         [0033]    the coefficients of the ellipse equation determined at step (c) are expressed as a function of the missed detection probability and of the variance in noise measurement; 
         [0034]    step (d) comprises the projection of the ellipse on an eigenvector basis; 
         [0035]    the parameterization of step (d) is polar parameterization, the single parameter being an angular coordinate; 
         [0036]    an estimation error is obtained at each projection at step (e) of a bias pair on a subspace of R 3 , this estimation error being a vector of the same dimension as the subspace expressed only as a function of the single parameter obtained at step (d), noted θ; 
         [0037]    the maximal position error caused is calculated at step (f) by adopting the standard of the vector estimation error and deriving therefrom relative to θ. 
         [0038]    According to a second aspect, the invention relates to a integrity-control system, comprising data-processing means, associated with a receiver receiving signals transmitted by different satellites of a radio-positioning constellation and supplying the system with pseudoranges measured between satellites of said constellation and the receiver on which the means execute a method according to the first aspect of the invention, on completion of which a signal is transmitted to an interface of the system. 
         [0039]    According to other advantageous and non-limiting characteristics of the invention: 
         [0040]    the system is coupled to an inertial navigation device according to an AAIM context. 
         [0041]    The invention finally relates to a vehicle equipped with a system according to the second aspect of the invention. 
     
    
     
       PRESENTATION OF THE FIGURES 
         [0042]    Other characteristics and advantages of the present invention will emerge from the following description of a preferred embodiment. This description will be given in reference to the attached diagrams, in which: 
           [0043]      FIG. 1  is a diagram of a constellation of satellites sending data to a plane in its protection volume; 
           [0044]      FIG. 2  is a diagram of an embodiment of an integrity-control system according to the invention connected to a receiver; 
           [0045]      FIG. 3  is a diagram of a known method for determining a protection volume in the case of a single faulty measurement of pseudorange between a satellite and a receiver; 
           [0046]      FIG. 4  is a diagram of an embodiment of the method for determining a protection volume in the event of two faulty measurements of pseudorange between a satellite and a receiver according to the invention; 
           [0047]      FIG. 5  is a diagram representing steps of an embodiment of the method for determining a protection volume in the event of two faulty measurements of pseudorange between a satellite and a receiver according to the invention; 
           [0048]      FIG. 6  is a graphic illustrating an ellipse used during a step of an embodiment of the method for determining a protection volume in the event of two faulty measurements of pseudorange between a satellite and a receiver according to the invention; 
           [0049]      FIG. 7  is a graphic illustrating the position error calculated during a step of an embodiment of the method for determining a protection volume in the event of two faulty measurements of pseudorange between a satellite and a receiver according to the invention. 
       
    
    
     DETAILED DESCRIPTION 
       [0050]    As shown in  FIG. 1  then  2 , a vehicle  1  such as a plane, equipped with a receiver  10  of GNSS type, receives electromagnetic signals (generally microwaves) originating from a plurality of satellites 2 forming a radio-positioning constellation. 
         [0051]    Each satellite  2  is equipped with a high-precision clock, and the receiver  10  precisely knows their position due to ephemerides stored in a memory  13 . Because of the clock, the time can be measured precisely by a signal for creating the trajectory between the satellite  2  and the receiver. For this, the receiver  10  uses a correlation technique to estimate the propagation time of the satellite signal, between emission and receipt. Knowing the speed of light, at which the wave of the signal moves, a computer  11  comprised in the receiver  10  multiplies the duration measured by this speed, providing the pseudorange which separates it from the satellite  2 , as explained previously. The fact that the distance is not known with certainty especially because of the noise measurement causes some uncertainty as to the position of the vehicle  1 . The cylinder illustrated in  FIG. 1  corresponds to the volume centered on the estimated position in which the presence of the vehicle is guaranteed within a missed detection probability. 
         [0052]    In general, the navigation measurement equation by satellite among a constellation of N satellites is shown as: 
         [0000]      {tilde over (Y)} t =h t (r t ,b H,t )+ε t +b t  
 
         [0053]    where, at the instant t: 
         [0054]    {tilde over (Y)} t  is the vector containing the N measurements formed by the receiver, that is, the N pseudoranges calculated according to the principle hereinabove with each of the N satellites, 
         [0055]    ε t  is the vector of N supposed Gaussian and centred measurement noises, 
         [0056]    b t  is the vector of N bias impacting the N measurements whereof several components can be non zero, 
         [0057]    the i th  component of the vector function h t (.) represents the geometric distance separating the receiver from the i th  satellite, perturbed by the clock bias. It is expressed as follows: h t   i (r t ,b H,t )=∥r t −r t   i ∥+b H,t  where is the clock bias, and r t  and r t   i  designate the position in Cartesian coordinates of the receiver and of the i th  satellite, respectively. E N  is the set such that its i th  element E N   i ,i ε[1, N] is the i th  satellite measurement. 
         [0058]    By linearising around an adequately selected point, the measurement equation becomes Y t =H t X t +ε t +b t    
         [0059]    where, at the instant t: 
         [0060]    X t  is the status vector containing the position of the receiver, 
         [0061]    H t  is the linearised observation matrix. 
         [0062]    The method for determining a protection volume according to the invention is executed by an integrity-control system  20 , also illustrated in  FIG. 2 , connected to the receiver  10 . This system  20 , comprising data processing means  21  (a computer), receives and processes the N satellite measurements provided by the receiver  10 . Throughout the description i th  satellite measurement will designate the pseudorange measured between the i th  satellite of the observed radio-positioning constellation and the receiver  10 , calculated by a computer  11  which this receiver  10  comprises. 
         [0063]    After processing, the characteristics of the determined protection volume are transmitted to an interface  22  to be exploited especially by the pilot, or by other navigation instruments. 
         [0064]    The steps of an embodiment of the method for determining a protection volume according to the invention are represented in  FIG. 4 , and more particularly in  FIG. 5 . 
       Detection of Failure 
       [0065]    Determining a protection volume in the case of two potentially faulty measurements starts similarly to methods known by a first step  100  for failure detection from N satellite measurements. 
         [0066]    For this, the computer  21  of the integrity-control system  20  determines a test variable T t , which as explained previously, is representative of the likelihood of a failure, for example if it exceeds a threshold dependent on a given probability of false alarm, noted P fa . 
         [0067]    For example, in the case of a RAIM algorithm based on the residue method, the test variable used to decide the presence of a failure is advantageously: 
         [0000]    
       
         
           
             
               
                 T 
                 t 
               
               = 
               
                 
                   
                     w 
                     t 
                     T 
                   
                    
                   
                     w 
                     t 
                   
                 
                 
                   σ 
                   2 
                 
               
             
             , 
           
         
       
       
         where w t  is the residue vector. It is defined as follows: 
       
     
         [0000]    
       
         
           
             
               w 
               t 
             
             = 
             
               
                 
                   Z 
                   t 
                 
                 - 
                 
                   
                     H 
                     t 
                   
                    
                   
                     
                       X 
                       ^ 
                     
                     t 
                     LS 
                   
                 
               
               = 
               
                 
                   
                     ( 
                     
                       
                         I 
                         
                           N 
                           × 
                           N 
                         
                       
                       - 
                       
                         
                           
                             
                               H 
                               t 
                             
                              
                             
                               ( 
                               
                                 
                                   H 
                                   t 
                                   T 
                                 
                                  
                                 
                                   H 
                                   t 
                                 
                               
                               ) 
                             
                           
                           
                             - 
                             1 
                           
                         
                          
                         
                           H 
                           t 
                           T 
                         
                       
                     
                     ) 
                   
                   
                      
                     
                       G 
                       t 
                     
                   
                 
                  
                 
                   
                     Z 
                     t 
                   
                   . 
                 
               
             
           
         
       
     
         [0069]    The test variable advantageously follows a X 2  (chi-squared) distribution with N degrees of freedom, as is the case in this example. 
       Pairs of Minimum Detectable Bias 
       [0070]    Once this variable is determined, during a step  200  the method will express a plurality of detectable minimum-bias pairs. This plurality of detectable minimum-bias pairs corresponds to the hypotheses of possible failures. So, in the prior art, N possible failures of a single satellite measurement were considered. 
         [0071]    The method according to the invention envisages the 
         [0000]    
       
         
           
             
               C 
               N 
               2 
             
             = 
             
               
                 N 
                  
                 
                   ( 
                   
                     N 
                     + 
                     1 
                   
                   ) 
                 
               
               2 
             
           
         
       
       
         simultaneous failures of two satellite measurements. During a first sub-step  210 , the system  20  estimates for each pair of pseudoranges measured the set of possible pairs of minimum detectable bias for a given missed detection probability P md . 
       
     
         [0073]    The difficulty is that moving to two-dimension, an infinity of bias pairs is detectable for a given missed detection probability, whereas there is one single solution in the case of a single satellite failure. 
         [0074]    To estimate the set of bias pairs b min,i  and b min,j , the system  20  recalculates the test variable T t  by considering that the bias vector b t  has two non-zero components corresponding to the faulty measurements. 
         [0075]    In the case of our example of residue, in the absence of satellite failure, the bias vector is entirely zero and the residue vector can be put in the form w t =G t ε t . 
         [0076]    The test variable normally verifies 
         [0000]    
       
         
           
             
               T 
               t 
             
             = 
             
               
                 
                   ɛ 
                   t 
                   T 
                 
                  
                 
                   G 
                   t 
                 
                  
                 
                   ɛ 
                   t 
                 
               
               
                 σ 
                 2 
               
             
           
         
       
       
         (this result is obtained in noting that G t   T G t =G t   2 =G t ) and it follows a X 2  distribution with N-4 degrees of freedom. 
       
     
         [0078]    If one of the components at least of the bias vector b t  is non-zero then the test variable follows a X 2  distribution decentred by non-centrality parameter λ and with N-4 degrees of freedom. Given that the i th  and the j th  measurement are in failure, b t  is of the form b t =[0, . . . ,b i , . . . ,b j , . . . ,0]. The test variable can be connected to its parameter of non-centrality: 
         [0000]    
       
         
           
             
               λ 
               = 
               
                 
                   
                     
                       b 
                       T 
                     
                      
                     Gb 
                   
                   
                     σ 
                     2 
                   
                 
                 = 
                 
                   
                     
                       
                         G 
                          
                         
                           ( 
                           
                             i 
                             , 
                             i 
                           
                           ) 
                         
                       
                       
                         σ 
                         2 
                       
                     
                      
                     
                       b 
                       i 
                       2 
                     
                   
                   + 
                   
                     
                       
                         G 
                          
                         
                           ( 
                           
                             j 
                             , 
                             j 
                           
                           ) 
                         
                       
                       
                         σ 
                         2 
                       
                     
                      
                     
                       b 
                       j 
                       2 
                     
                   
                   + 
                   
                     2 
                      
                     
                       
                         G 
                          
                         
                           ( 
                           
                             i 
                             , 
                             j 
                           
                           ) 
                         
                       
                       
                         σ 
                         2 
                       
                     
                      
                     
                       b 
                       i 
                     
                      
                     
                       b 
                       j 
                     
                   
                 
               
             
             , 
           
         
       
       
         with G(l,m) the element situated on the line and the column m of the matrix G. 
       
     
         [0080]    Corresponding to a probability P md  and a given number of degrees of freedom is a value of λ and therefore to a set of values b i  and b j  as per the preceding equation. These are minimum detectable biases. 
         [0081]    The following step  220  comprises modifying this equation to make of it an ellipse equation of the form 
         [0000]      α(b min,i ) 2 +β(b min,j ) 2 +γb min,i b min,j =1
 
         [0082]    with α, β and γ coefficients dependent advantageously especially on the missed detection probability P md  and on the variance in noise measurement. This is done by identification of the coefficients of the polynom by the computer  21 . 
         [0083]    This ellipse, seen in  FIG. 6 , is such that the bias pairs located outside the ellipse are detected with a missed detection probability less than P md . 
         [0084]    In particular equations of the residue method give for example 
         [0000]    
       
         
           
             
               α 
               = 
               
                 
                   G 
                    
                   
                     ( 
                     
                       i 
                       , 
                       i 
                     
                     ) 
                   
                 
                 
                   λσ 
                   2 
                 
               
             
             , 
             
               
 
             
              
             
               β 
               = 
               
                 
                   G 
                    
                   
                     ( 
                     
                       j 
                       , 
                       j 
                     
                     ) 
                   
                 
                 
                   λσ 
                   2 
                 
               
             
           
         
       
       
         
           et 
         
       
       
         
           
             γ 
             = 
             
               2 
                
               
                 
                   G 
                    
                   
                     ( 
                     
                       i 
                       , 
                       j 
                     
                     ) 
                   
                 
                 
                   λσ 
                   2 
                 
               
             
           
         
       
     
         [0085]    The protecting radii are by definition constructed from the worst impact of bias defined by the ellipse. Due to the infinity of detectable bias pairs, their calculation needs an optimisation problem to be resolved under difficult conditions. 
         [0086]    For this the computer  21  will recalculate the equation of each ellipse in parametric coordinates, advantageously by projecting it on an eigenvector basis during a step  230 . 
         [0087]    In fact, the general ellipse equation presented earlier can be rewritten in matrix form: 
         [0088]    [b min,i ,b min,j ]M[b min,i ,b min,j ] t =1 with [.] T  designating the transposed vector or a matrix and 
         [0000]    
       
         
           
             M 
             = 
             
               
                 [ 
                 
                   
                     
                       α 
                     
                     
                       γ 
                     
                   
                   
                     
                       γ 
                     
                     
                       β 
                     
                   
                 
                 ] 
               
               . 
             
           
         
       
     
         [0089]    The matrix M is symmetrical and diagonalisable by the computer  21  on an eigenvector basis as follows: 
         [0090]    M=PDP T  where D is a diagonal matrix 
         [0000]    
       
         
           
             D 
             = 
             
               
                 [ 
                 
                   
                     
                       
                         D 
                         11 
                       
                     
                     
                       0 
                     
                   
                   
                     
                       0 
                     
                     
                       
                         D 
                         22 
                       
                     
                   
                 
                 ] 
               
               . 
             
           
         
       
     
         [0091]    By using this decomposition, the preceding equation can be in the form: 
         [0000]      [b min,i ,b min,j ]PDP T [b min,i ,b min,j ] T =1 
         [0092]    That is, 
         [0000]    
       
         
           
             
               [ 
               
                 
                   
                     b 
                     ~ 
                   
                   
                     min 
                     , 
                     i 
                   
                 
                 , 
                 
                   
                     b 
                     ~ 
                   
                   
                     min 
                     , 
                     j 
                   
                 
               
               ] 
             
              
             
               
                 D 
                  
                 
                   [ 
                   
                     
                       
                         b 
                         ~ 
                       
                       
                         min 
                         , 
                         i 
                       
                     
                     , 
                     
                       
                         b 
                         ~ 
                       
                       
                         min 
                         , 
                         j 
                       
                     
                   
                   ] 
                 
               
               T 
             
           
         
       
       
         
           
             
               with 
                
               
                 
 
               
               [ 
               
                 
                   
                     
                       
                         b 
                         ~ 
                       
                       
                         min 
                         , 
                         i 
                       
                     
                   
                 
                 
                   
                     
                       
                         b 
                         ~ 
                       
                       
                         min 
                         , 
                         j 
                       
                     
                   
                 
               
               ] 
             
             = 
             
               
                 
                   P 
                   T 
                 
                  
                 
                   [ 
                   
                     
                       
                         
                           b 
                           
                             min 
                             , 
                             i 
                           
                         
                       
                     
                     
                       
                         
                           b 
                           
                             min 
                             , 
                             j 
                           
                         
                       
                     
                   
                   ] 
                 
               
               . 
             
           
         
       
     
         [0093]    With this marker change, the equation describing the ellipse of the minimum detectable biases for a given missed detection probability P md  becomes: 
         [0000]    
       
         
           
             
               
                 
                   
                     ( 
                     
                       
                         
                           b 
                           ~ 
                         
                         
                           min 
                           , 
                           i 
                         
                       
                       a 
                     
                     ) 
                   
                   2 
                 
                 + 
                 
                   
                     ( 
                     
                       
                         
                           b 
                           ~ 
                         
                         
                           min 
                           , 
                           j 
                         
                       
                       b 
                     
                     ) 
                   
                   2 
                 
               
               = 
               1 
             
             , 
           
         
       
       
         with a and b of the parameters dependent on D and M and corresponding to the semi-axes of the ellipse, as shown in  FIG. 6 . 
       
     
         [0095]    Projection of the ellipse on an eigenvector basis cancelled the cross term between b min,i  and b min,j  of the equation. 
         [0096]    The determination by the computer  21  of the parameters a and b during step  240  from the matrices calculated at the preceding step expresses bias in parametric coordinates, hence transformation of the bidimensional problem into a one-dimensional problem: 
         [0000]    
       
         
           
               
             
               { 
               
                 
                   
                     
                       
                         
                           
                             b 
                             ~ 
                           
                           
                             min 
                             , 
                             i 
                           
                         
                         = 
                         
                           a 
                            
                           
                               
                           
                            
                           cos 
                            
                           
                               
                           
                            
                           θ 
                         
                       
                       , 
                     
                   
                 
                 
                   
                     
                       
                         
                           b 
                           ~ 
                         
                         
                           min 
                           , 
                           j 
                         
                       
                       = 
                       
                         b 
                          
                         
                             
                         
                          
                         sin 
                          
                         
                             
                         
                          
                         
                           θ 
                           . 
                         
                       
                     
                   
                 
               
             
           
         
       
     
         [0097]    Therefore, each detectable minimum-bias pair for a missed detection probability is a function of a single parameter θ, here a polar coordinate. 
       Position Errors 
       [0098]    To obtain the protecting radii, it remains to project onto the position error the bias pairs located on the contour of the ellipse and find the maximal position error, that is, the most unfavourable. This approach is conservative as the pairs inside the ellipse lead to a lesser position error than those located on the contour. This is step  300 . 
         [0099]    It starts with a sub-step  310  for projection of each detectable minimum-bias pair on at least one subspace of R 3 . In fact the ellipse is a curve in a three-dimensional space. To determine a protection volume, the dimensions of this volume have to be determined, and therefore different projections have to be made. The subspace of R 3  is any vector subspace in single or dual dimension, that is, all the planes and straight lines. By way of advantage, these subspaces are selected such that they are additional: for example, a plane and a non-coplanar straight line, three non-colinear straight lines in pairs, two non-parallel nor combined planes, etc. In this way, the space engendered by these subspaces is in three dimensions, and therefore defines volume. 
         [0100]    As it is standard, the protection volumes are generally cylinders of horizontal base, defined by a radius and a height. For such a volume it suffices advantageously to adopt the horizontal plane as first subspace, and a vertical straight line as second subspace. The maximum position error on the plane will be the radius of the base, and the maximum position error on the straight line will be the height of the cylinder. The person skilled in the art can however adapt the invention to other geometries of protection volumes. 
         [0101]    This sub-step  310  is performed by the computer  21  by means of a matricial product of the matrix of the bias by a marker change matrix. 
         [0102]    In this preferred embodiment with cylindrical geometry, the horizontal estimation errors (in the plane) and vertical estimation errors (on the straight line), noted respectively ΔX H   (i,j)  and ΔX V   (i,j) , engendered by the possible bias pairs (b min,i , b min,j ) are expressed as: 
         [0000]    
       
         
           
             
               Δ 
                
               
                   
               
                
               
                 X 
                 H 
                 
                   ( 
                   
                     i 
                     , 
                     j 
                   
                   ) 
                 
               
             
             = 
             
               
                 μ 
                 H 
                 
                   ( 
                   
                     i 
                     , 
                     j 
                   
                   ) 
                 
               
                
               
                 [ 
                 
                   
                     
                       
                         b 
                         
                           min 
                           , 
                           i 
                         
                       
                     
                   
                   
                     
                       
                         b 
                         
                           min 
                           , 
                           j 
                         
                       
                     
                   
                 
                 ] 
               
             
           
         
       
       
         
           and 
         
       
       
         
           
             
               Δ 
                
               
                   
               
                
               
                 X 
                 V 
                 
                   ( 
                   
                     i 
                     , 
                     j 
                   
                   ) 
                 
               
             
             = 
             
               
                 μ 
                 V 
                 
                   ( 
                   
                     i 
                     , 
                     j 
                   
                   ) 
                 
               
                
               
                 [ 
                 
                   
                     
                       
                         b 
                         
                           min 
                           , 
                           i 
                         
                       
                     
                   
                   
                     
                       
                         b 
                         
                           min 
                           , 
                           j 
                         
                       
                     
                   
                 
                 ] 
               
             
           
         
       
       
         with μ H   (i,j) , and μ V   (i,j)  the bias projection matrices on the measurements i and j on the horizontal plane and the vertical axis of the navigation solution respectively. 
       
     
         [0104]    In fact, for an embodiment including an estimator of least squares type, estimation of the vector X t  in terms of least squares verifies: {circumflex over (X)} t   t,S ={tilde over (H)} t Z t ={tilde over (H)} t (H t X t +ε t +b t )=X t +{tilde over (H)} t (ε t +b t ). So, if only the estimation error connected to the bias is considered, 
         [0000]    
       
         
           
             
               
                 
                   
                     
                       X 
                       ^ 
                     
                     t 
                     LS 
                   
                   - 
                   
                     X 
                     t 
                   
                 
                 
                    
                   
                     Δ 
                      
                     
                         
                     
                      
                     
                       X 
                       t 
                     
                   
                 
               
               = 
               
                 
                   
                     H 
                     ~ 
                   
                   t 
                 
                  
                 
                   b 
                   t 
                 
               
             
             , 
           
         
       
       
         with {tilde over (H)} t =H t (H t   T H t ) −1 H t   T . 
       
     
         [0106]    In this embodiment, μ H   (i,j)  and μ V   (i,j)  are therefore sub-matrices of {tilde over (H)} t  formed from the lines corresponding to the coordinates in the horizontal plane and its columns i and j for the first, and of the line corresponding to the vertical axis and its columns i and j for the second. The estimation errors are therefore vectors of one or two dimensions. Here, for the horizontal parameter, the subspace on which the ellipse is projected, is a plane, therefore in two dimensions, which is why ΔX H   (i,j)  is a vector. 
         [0107]    The system  20  calculates the position errors caused by the bias pair during a step  320  for each subspace and each bias pair from the estimation errors. 
         [0108]    Hereinbelow, only the position error on the horizontal plane is presented. However, the same approach is made for the vertical position error. Advantageously this step  320  is resolved by calculation of the standard of the vector estimation error. 
         [0109]    If for example the standard is selected in terms of the classic scale product (∥ū∥=√{square root over ({right arrow over (u)}·ū) by placing M H =P T (μ H   (i,j) ) T  μ H   (i,j) P, the position error on the horizontal plane caused by the pair (b min,i , b min,j ) is calculated by the computer  21  by way of the equation: 
         [0000]    
       
         
           
             
               
                  
                 
                    
                   
                     Δ 
                      
                     
                         
                     
                      
                     
                       X 
                       H 
                       
                         ( 
                         
                           i 
                           , 
                           j 
                         
                         ) 
                       
                     
                   
                    
                 
                  
               
               = 
               
                 
                   
                     
                       
                         M 
                         H 
                       
                        
                       
                         ( 
                         
                           1 
                           , 
                           1 
                         
                         ) 
                       
                     
                      
                     
                       a 
                       2 
                     
                      
                     
                       cos 
                       2 
                     
                      
                     θ 
                   
                   + 
                   
                     
                       
                         M 
                         H 
                       
                        
                       
                         ( 
                         
                           2 
                           , 
                           2 
                         
                         ) 
                       
                     
                      
                     
                       b 
                       2 
                     
                      
                     
                       sin 
                       2 
                     
                      
                     θ 
                   
                   + 
                   
                     2 
                      
                     
                       
                         M 
                         H 
                       
                        
                       
                         ( 
                         
                           1 
                           , 
                           2 
                         
                         ) 
                       
                     
                      
                     ab 
                      
                     
                         
                     
                      
                     sin 
                      
                     
                         
                     
                      
                     θ 
                      
                     
                         
                     
                      
                     cos 
                      
                     
                         
                     
                      
                     θ 
                   
                 
               
             
             , 
           
         
       
       
         with M H (l,m) the element of the line l and of the column m of the matrix M H . This function of θ is illustrated in  FIG. 7 . 
       
     
         [0111]    The horizontal protecting radius is obtained at step  330  by searching for the maximum relative to the parameter θ of the position error defined previously. This function has several local extremas, as seen in  FIG. 7 ; there are four here, for example. To obtain this, the computer  21  will advantageously derive the function position error as a function of θ, and select the values where the derivative is cancelled. After calculation, the solutions verify: 
         [0000]    
       
         
           
             
               θ 
               = 
               
                 
                   
                     1 
                     2 
                   
                    
                   
                     arctan 
                      
                     
                       ( 
                       
                         
                           2 
                            
                           
                             
                               abM 
                               H 
                             
                              
                             
                               ( 
                               
                                 1 
                                 , 
                                 2 
                               
                               ) 
                             
                           
                         
                         
                           
                             
                               b 
                               2 
                             
                              
                             
                               
                                 M 
                                 H 
                               
                                
                               
                                 ( 
                                 
                                   2 
                                   , 
                                   2 
                                 
                                 ) 
                               
                             
                           
                           - 
                           
                             
                               a 
                               2 
                             
                              
                             
                               
                                 M 
                                 H 
                               
                                
                               
                                 ( 
                                 
                                   1 
                                   , 
                                   1 
                                 
                                 ) 
                               
                             
                           
                         
                       
                       ) 
                     
                   
                 
                 + 
                 
                   k 
                    
                   
                     π 
                     2 
                   
                 
               
             
             , 
           
         
       
       
         with k a whole number. p The computer  21  recalculates the value of the position error for each of these extrema and selects the maximum. If θ* H  is noted as the set of values of θ which corresponds to the extrema of the horizontal error position function (each θ corresponding to a pair of b min,i  and b min,j ) this gives 
       
     
         [0000]    
       
         
           
             
               H 
                
               
                   
               
                
               P 
                
               
                   
               
                
               
                 L 
                 
                   ( 
                   
                     i 
                     , 
                     j 
                   
                   ) 
                 
               
             
             = 
             
               
                 max 
                 
                   θ 
                   ∈ 
                   
                     θ 
                     H 
                     ″ 
                   
                 
               
                
               
                 
                    
                   
                      
                     
                       Δ 
                        
                       
                           
                       
                        
                       
                         X 
                         H 
                         
                           ( 
                           
                             i 
                             , 
                             j 
                           
                           ) 
                         
                       
                     
                      
                   
                    
                 
                 . 
               
             
           
         
       
       
         This then is the maximum position error caused by the bias for the pertinent pair (i,j)ε[1, N]×[1,N] et i≠j of satellite measurements. 
       
     
       Protecting Radii 
       [0114]    The maximal error is calculated for each of the measurement pairs. During a step  410  the system  20  obtains the protecting radii in the case of two failures at an instant by selecting the maximum of the errors calculated for all these pairs; 
         [0000]    
       
         
           
             
               H 
                
               
                   
               
                
               P 
                
               
                   
               
                
               
                 L 
                 
                   ( 
                   2 
                   ) 
                 
               
             
             = 
             
               
                 max 
                 
                   i 
                   , 
                   j 
                 
               
                
               
                 ( 
                 
                   H 
                    
                   
                       
                   
                    
                   P 
                    
                   
                       
                   
                    
                   
                     L 
                     
                       ( 
                       
                         i 
                         , 
                         j 
                       
                       ) 
                     
                   
                 
                 ) 
               
             
           
         
       
       
         
           
             
               
                 with 
                  
                 
                   
 
                 
                 ( 
                 
                   i 
                   , 
                   j 
                 
                 ) 
               
               ∈ 
               
                 
                   [ 
                   
                     1 
                     , 
                     N 
                   
                   ] 
                 
                 × 
                 
                   [ 
                   
                     1 
                     , 
                     N 
                   
                   ] 
                 
               
             
             , 
             
               
 
             
              
             
               i 
               ≠ 
               
                 j 
                 . 
               
             
           
         
       
     
         [0115]    The same reasoning can be applied for the vertical axis. The method provides the values of the protecting radii to onboard systems during the ultimate step  420 . 
       Systems and Vehicles 
       [0116]    As described previously, the integrity-control system  20  shown in  FIG. 2  is connected to a receiver  10 , type GNSS, configured to receive measurements originating from N satellites. The receiver  10  comprises data-processing means  11  and a memory  13 . They transfer the measurements conventionally to onboard instruments to allow exploitation of geolocation data calculated from the satellite measurements, as well as to the system  20  which will control them. 
         [0117]    The system  20  also comprises data-processing means  21 , by which it will be able to execute a method according to the first aspect of the invention, and an interface  22 . This interface  22  can take numerous forms such as a monitor, a loudspeaker, or simply be connected to the onboard instruments and generally serves to define a guaranteed positioning zone around the apparatus  1 . For example, on a pilot monitor, it will designate a volume in which a collision is possible. In addition, aerial corridors are defined for the planes. The protection volume can be used to keep a plane inside the aerial corridor with certainty. 
         [0118]    In addition, the system  20  can advantageously be coupled to a navigation system  30 , such as an inertial system, supplying the means  21  for processing navigation data which can be used during the failure detection step to be in an AAIM context. 
         [0119]    The invention also relates to a vehicle  1 , in particular a plane, equipped with such an integrity-control system  20 , allowing it an unequalled level of security, since it is no longer aware of the possibility of having two simultaneous satellite breakdowns, a case not treated previously, and which might result in an aerial catastrophe if an excessively limited protection volume was calculated due the possibility of a second faulty measurement. The invention is not however limited to planes and can be fitted to any aircraft, or even a ship or terrestrial vehicle, even if the integrity requirement of satellite measurements is not as crucial.