Patent Description:
Currently, an aircraft is usually equipped with several radar altimeters. Typically, the measurements from all radar altimeters are processed (e.g., compared to each other) and the resulting value of the altitude is provided to onboard systems and the pilot. However, the altitude is provided without any information related to its accuracy or integrity, which limits utilization of radar altimeter measurements in envisioned applications related to more autonomous aircraft.

[<NUM>] "<NPL>, discloses integrity monitoring receivers to derive multiple position solutions by excluding one satellite at a time, where inconsistencies in the results are used to identify and exclude a faulty satellite. "<NPL> discloses using radar altimeters for determining altitude in aircrafts, and the integration of their results in GPS integrity.

Accuracy and integrity of the navigation information (horizontal and vertical position) provided by a Global Navigation Satellite System (GNSS) based navigation system or hybridized Global Navigation Satellite System and Inertial Navigation System (GNSS/INS) based navigation system with respect to possible faults of GNSS satellites has been solved since the advent of GNSS-based navigation systems. However, accuracy and integrity of the navigation information provided by a navigation system utilizing radar altimeters with respect to possible faults of the radar altimeter has not been addressed yet.

The invention is set out in accordance with the appended claims. Methods for radar altimeter integrity monitoring are provided. One method comprises obtaining one or more global navigation satellite system (GNSS) measurements, or one or more hybridized GNSS/inertial navigation system (INS) measurements, in an earth-centered-earth-fixed (ECEF) coordinate frame for a vehicle; obtaining one or more altitude measurements from one or more radar altimeters on the vehicle; transforming the one or more altitude measurements into the ECEF coordinate frame using a terrain map and a GNSS or hybridized GNSS/INS based position estimate with ensured integrity as defined in the appended claim <NUM>; determining a full solution estimate of position for the vehicle based on the transformed one or more altitude measurements, and the one or more GNSS or hybridized GNSS/INS measurements; determining one or more sub-solution estimates of position for the vehicle based on a subset of the transformed one or more altitude measurements, and the one or more GNSS or hybridized GNSS/INS measurements; comparing the full solution estimate with the one or more sub-solution estimates using statistical analysis; and determining an altitude protection level for the vehicle based on a probability of hazardous misleading information and a probability of false detection.

In the following detailed description, embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It is to be understood that other embodiments may be utilized without departing from the scope of the invention as defined by the appended claims. The following detailed description is, therefore, not to be taken in a limiting sense.

Altitude above the ground or terrain (i.e., the clearance) information with assured accuracy and integrity is an important component of envisioned aircraft avionics architecture. Accordingly, systems and methods for integrity monitoring of radar altimeters are described herein, which allow for computation of the accuracy (e.g., in terms of the standard deviation) and integrity (protection level) of the altitude above terrain measured by the radar altimeters and possibly other sensors (e.g., global navigation satellite system (GNSS)).

The proposed integrity monitoring methods are based on a statistical comparison of the radar altimeter measurements with outputs of other navigation systems and sensors, and in principle, offer a trade-off between accuracy and integrity. The integrity monitoring methods are based on the concept of solution separation integrity monitoring.

Further details of the present systems and methods are described hereafter with reference to the drawings.

<FIG> illustrates a navigation system <NUM> according to one embodiment, which can implement the radar altimeter integrity monitoring methods in an aircraft. The navigation system <NUM> generally includes at least one processor <NUM> operatively coupled with at least one memory unit <NUM>, at least one satellite receiver <NUM> such as a GNSS receiver in operative communication with processor <NUM>, at least one radar altimeter <NUM> also in operative communication with processor <NUM>, and a terrain map <NUM> stored in memory unit <NUM>. The navigation system <NUM> can also include one or more additional sensors <NUM>, such as a barometric altimeter, which provide additional sensor data to processor <NUM>.

In an alternative embodiment, navigation system <NUM> can be hybridized by also including an inertial navigation system (INS) <NUM> having one or more inertial sensors that provide inertial data to processor <NUM>. In one embodiment, the inertial sensors are implemented in an inertial measurement unit (IMU), which includes three accelerometers for measuring acceleration in three dimensions and three gyroscopes for measuring angular velocity relative to a reference plane.

The present integrity monitoring methods include centralized radar altimeter integrity monitoring, parallel radar altimeter integrity monitoring, and combined radar altimeter integrity monitoring. These approaches are described as follows.

The centralized radar altimeter integrity monitoring (cRIM) method employs an extended version of the solution separation disclosed in <CIT>, entitled NAVIGATION SYSTEM WITH SOLUTION SEPARATION APPARATUS FOR DETECTING ACCURACY FAILURES. In principle, the solution separation computes the protection levels (the integrity information) on the basis of position estimate covariance matrices (accuracy information) of the full-solution and all sub-solutions. The full-solution processes all available GNSS measurements, and the sub-solution processes a subset of the GNSS measurements selected according to specified GNSS fault states to be mitigated. The solution separation also computes the protection levels on the basis of probabilities of false detection and missed detection, in which user-defined parameters are allocated according to either equal or free allocation schemes. The probability of missed detection is related to the probability of hazardous misleading information (HMI) and a priori probability of the faults.

The cRIM method extends the solution separation by considering one or more radar altimeter measurements as additional satellite measurements. In order to be able to process the radar altimeter measurement(s) expressed in the navigation (NAV) frame in a GNSS (or hybridized) navigation system, it is necessary to assume an available terrain map and transform the radar altimeter measurement into the Earth-Centered-Earth-Fixed (ECEF) coordinate system, i.e., to the coordinate system of GNSS measurements. The transformed radar altimeter measurement can be, in principle, then considered as a measurement provided by a satellite located at the ECEF frame origin.

The transformed radar altimeter measurement is given by the following equation: <MAT> where ρ̃RA is the radar altimeter (RA) measurement (altitude above terrain in NAV frame), and ρ̂TERMAP is the estimate of the orthogonal distance between the ECEF frame origin and the terrain at the point given by the horizontal position of the aircraft and available terrain map; thus, it depends on the horizontal position provided, for example, by GNSS, which is a random variable.

The radar altimeter measurement is characterized by a measurement noise description (probability density function or at least the moments; mean and covariance matrix), and a radar altimeter failure probability. These are a given. The orthogonal distance estimate is characterized by a distribution with a certain mean and variance (defining accuracy) computed on the basis of horizontal position moments and terrain map properties. The orthogonal distance estimate integrity is characterized by a terrain map failure probability given by the map and horizontal position integrity information. The errors affecting the horizontal position estimate, map, and radar altimeter measurement are assumed to be independent.

The cRIM method requires computation of the transformed radar altimeter measurement characteristics, especially of the orthogonal distance ρTERMAP moments. The mean value is computed as: <MAT> where ρ̂HOR is the aircraft horizontal position estimate (e.g., from GNSS navigation system) and map is the terrain map. The variance of ρTERMAP is given, in the simplest case, by the map accuracy. Moments of the orthogonal distance can be also computed by other techniques for computation of moments of nonlinearly transformed random variables, e.g., by the unscented transformation or by methods based on a numerical integration.

The radar altimeter measurement and orthogonal distance estimate are assumed to be independent random variables, allowing for straightforward computation of the transformed radar altimeter measurement moments. The integrity of the transformed radar altimeter measurement is given by the probability of failure of the radar altimeter, the GNSS (or hybridized) horizontal position navigation information integrity, and information coming from map integrity (according to addition law of probability).

<FIG> is a flow diagram for a method <NUM> for implementing the centralized radar altimeter integrity monitoring. Initially, one or more GNSS or hybridized GNSS/INS measurements are obtained in an ECEF coordinate frame for a vehicle (block <NUM>), and one or more altitude measurements are obtained from one or more radar altimeters on the vehicle (block <NUM>). The altitude measurement(s) are transformed into the ECEF coordinate frame using a terrain map and a GNSS or hybridized GNSS/INS based position estimate with ensured integrity (block <NUM>). A full solution estimate of position is determined for the vehicle, based on the transformed altitude measurement(s) and the GNSS or hybridized GNSS/INS measurements (block <NUM>). The method <NUM> also determines sub-solution estimates of position for the vehicle, based on a subset of the transformed altitude measurement(s) and the GNSS or hybridized GNSS/INS measurements (block <NUM>). Thereafter, the full solution estimate is compared with the sub-solution estimates using statistical analysis (block <NUM>). An altitude protection level for the vehicle is then determined based on a probability of hazardous misleading information and a probability of false detection (block <NUM>).

In the cRIM method, the full solution processes all GNSS measurements, all transformed radar altimeter measurements, and additional sensor measurements (e.g., from barometric altimeter and IMU). The sub-solutions process a subset of all GNSS and transformed radar altimeter measurements (e.g., by excluding one GNSS or radar altimeter measurement if a single failure is assumed), and additional sensor measurements.

The computation of the solution separation parameter (Dn) and the error parameter (an), which are related to the altitude for all sub-solutions, is based on moments of the full solution and sub-solutions. The computation of altitude protection level is based on the probability of hazardous misleading information (HMI), the probability of false detection, the probability of satellite failure, the probability of radar altimeter failure (including a map related integrity allocation), and probabilities of wide failures (probabilities that all GNSS and altitude measurements affected by a failure).

<FIG> illustrates an exemplary cRIM architecture <NUM>, with a single failure assumption (either one GNSS or one radar altimeter failed). The full solution based on all GNSS measurements and radar altimeter measurements is indicated at <NUM>. The sub-solutions processing all available measurements of radar altimeters and all but one of the GNSS measurements are indicated at 320a, 320b, 320c,. Each sub-solution excludes a different GNSS measurement. The sub-solutions processing all GNSS measurements and all but one of the radar altimeter measurements are indicated at 330a,. Each sub-solution excludes a different radar altimeter measurement. Note that the radar altimeter measurements are supposed to be transformed from the navigation frame to the ECEF frame as described above. Then, all the sub-solutions are statistically compared with the full-solution according to the concept of the solution separation, and it is decided whether all GNSS and radar measurements are healthy or one of the measurements is affected by a failure.

Disclosed but not claimed is a parallel radar altimeter integrity monitoring (pRIM) method which employs an extended version of the weighted architecture of the high integrity solution separation disclosed in <CIT>, entitled ARCHITECTURES FOR HIGH INTEGRITY MULTI-CONSTELLATION SOLUTION SEPARATION. In principle, the high integrity solution separation computes the (local) protection areas independently for several disjunctive sub-groups of satellites, and the resulting protection area is the one somehow overbounding all the local protection areas. Each radar altimeter measurement can be considered as a sub-group providing measurement and characteristic of altitude above terrain.

<FIG> is a flow diagram for a method <NUM> for implementing the parallel radar altimeter integrity monitoring. Initially, one or more GNSS or hybridized GNSS/INS measurements are obtained in an ECEF coordinate frame for a vehicle (block <NUM>), and one or more altitude measurements are obtained from one or more radar altimeters on the vehicle (block <NUM>). The method <NUM> determines a first plurality of sub-solution estimates of altitude above terrain with ensured integrity for the vehicle, based on subsets of the one or more GNSS or hybridized GNSS/INS outputs and a terrain map, with each sub-solution estimate determined based on a respective subset of the one or more GNSS or hybridized GNSS/INS outputs (block <NUM>) as detailed below. The method <NUM> also determines a second plurality of sub-solution estimates of altitude above terrain with ensured integrity for the vehicle, based on a subset of the one or more altitude measurements, with each of these sub-solution estimates being determined based on a respective subset of the one or more altitude measurements (block <NUM>). The method <NUM> then merges the first plurality of sub-solution estimates and second plurality of sub-solution estimates to determine a full solution or global estimate of altitude above terrain, which provides an altitude protection level for the vehicle (block <NUM>).

<FIG> is a block diagram illustrating an exemplary pRIM architecture <NUM>, which includes a GNSS (or hybridized GNSS/INS) navigation system <NUM>, which employs a terrain map <NUM>. The navigation system <NUM> provides a three-dimensional (3D) position estimate of a vehicle and covariance in ECEF, plus integrity information. The terrain map <NUM> includes information on map accuracy plus integrity. The outputs from navigation system <NUM> and terrain map <NUM> are used to compute the estimate of altitude above terrain at computation block <NUM>, which includes accuracy and integrity information, such as probability density function (or moments) of the horizontal position estimate, related probability of failure (or of hazardous misleading information), and accuracy and integrity of the map. Thus, the altitude estimate moments depend on the moments of the horizontal position estimate and terrain map properties. The probability of failure (or of hazardous misleading information) related to the computed altitude estimate depends on the integrity of the terrain map and the integrity of the navigation system horizontal position estimate, both of which need to be computed as described hereafter.

One or more radar altimeters <NUM>-<NUM> to <NUM>-n provide measurement or measurements of the altitude above terrain, respectively. For each considered altimeter, information related to its accuracy and integrity is supposed to be known. The statistical description of the radar altimeter measurement noise is available (defining its accuracy), along with the probability of radar altimeter failure (defining its integrity).

A fusion block <NUM>, which computes overall (or global) altitude along with its accuracy and integrity information, is configured to receive the altitude estimate from computation block <NUM> (local <NUM>), and the altitude measurements from radar altimeters <NUM>-<NUM> to <NUM>-n (local <NUM> to local n+<NUM>). The fusion block <NUM> merges the (local) altitude estimate and measurements to produce a global estimate output of altitude above terrain with ensured integrity and accuracy.

The pRIM method is based on computation of the altitude estimate above terrain and its characteristics (integrity and variance (or other moments) defining altitude estimate accuracy) on the basis of GNSS horizontal position estimate and a terrain map. The altitude estimate mean value can be computed in the same way as in the cRIM method discussed previously. The variance can be computed as: <MAT> where <MAT> is given by the terrain map accuracy and <MAT> describes the additional uncertainty given by the GNSS horizontal position protection area. The term <MAT> can be computed on the basis of terrain map evaluation (scanning) at multiple points within the protected horizontal area given by horizontal protection level (HPL) as: <MAT>.

<FIG> is a graphical representation <NUM> of an exemplary pRIM computation of uncertainty <MAT>. <FIG> shows the mean and covariance matrix of horizontal position, and the HPL. The GNSS HPL defines the area used for computation of the uncertainty <MAT>. The computation is based on evaluation (or scanning) of the terrain variability at multiple points in the area computed on the basis of the available map. The integrity of the altitude estimate is given by the integrity of the GNSS horizontal position and of the map computed according to the addition law of probability.

<FIG> is a graphical representation <NUM> of an exemplary pRIM fusion (merging) function. <FIG> shows the altitude and protection level (PL) value for each of an altitude estimate (local <NUM>), and altitude measurements <NUM> to n (local <NUM> to local n+<NUM>). The estimates are fused to produce the global estimate of altitude above terrain, for example as illustrated in <FIG>. In this example, the global altitude estimate mean can be computed as a (weighted) average of the local means. The global covariance matrix can be then computed as a (weighted) sum of local variances (assuming mutual independence of local estimates). The global PL can be determined as the protection level overbounding all the local PLs as it can be shown that: <MAT> The pRIM architecture is composed of local blocks providing altitude integration each with ensured integrity. Therefore, the global output is also with ensured integrity and there is no need to detect failed measurements. Detection, if any, is performed in local estimators.

In general, the cRIM method provides estimates with better accuracy than pRIM, while the pRIM method allows for trade-off between accuracy and integrity.

Disclosed but not claimed is a combined radar altimeter integrity monitoring architecture (combRIM) is provided, which combines characteristic properties of the cRIM and pRIM approaches. The combRIM method is in principle solution separation but just in the altitude domain.

In the combRIM method, all available radar altimeter measurements and (possibly) altitude estimates are processed (e.g., by averaging filter with or without weights defined by the measurement noise variances) and a global (full-solution) estimate of altitude above terrain is computed. A set of sub-solutions is created (based on faults definition) and a set of sub-solutions estimates of altitude above terrain is computed. A full solution and sub-solution estimates are statistically compared, and protection level for altitude above terrain is computed for required probabilities of missed and false detection.

<FIG> is a flow diagram for a method <NUM> for implementing the combRIM method. Initially, two or more altitude measurements are obtained from one or more radar altimeters (or other sensors) on a vehicle (block <NUM>). The method <NUM> determines a full solution estimate of altitude above terrain for the vehicle based on the two or more altitude measurements (block <NUM>), and determines two or more sub-solution estimates of altitude above terrain for the vehicle based on a subset of the two or more altitude measurements (block <NUM>). The method <NUM> then compares the full solution estimate with the two or more sub-solution estimates using statistical analysis (block <NUM>). An altitude protection level for the vehicle is then determined based on a probability of hazardous misleading information and a probability of false detection (block <NUM>).

The combRIM approach can be implemented with or without the GNSS (or hybridized GNSS/INS) system and terrain map based altitude above terrain. At least two radar altimeter measurements or estimates are needed for detection capability, while at least three radar altimeter measurements or estimates are needed for exclusion capability.

In some embodiments, if two radar altimeter measurements are available, then integrity monitoring with fault detection can be done according to solution separation.

In another embodiment, if two radar altimeter measurements and one altitude estimate (based on terrain map aided GNSS/INS system) is available, then integrity monitoring with fault detection and exclusion can be done according to solution separation.

A computer or processor used in the present system and method can be implemented using software, firmware, hardware, or any appropriate combination thereof, as known to one of skill in the art. These may be supplemented by, or incorporated in, specially-designed application-specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs). The computer or processor can also include functions with software programs, firmware, or other computer readable instructions for carrying out various process tasks, calculations, and control functions used in the present method and system.

The present methods can be implemented by computer executable instructions, such as program modules or components, which are executed by at least one processor. Generally, program modules include routines, programs, objects, data components, data structures, algorithms, and the like, which perform particular tasks or implement particular abstract data types.

Instructions for carrying out the various process tasks, calculations, and generation of other data used in the operation of the methods described herein can be implemented in software, firmware, or other computer-readable or processor-readable instructions. These instructions are typically stored on any appropriate computer program product that includes a computer readable medium used for storage of computer readable instructions or data structures. Such a computer readable medium can be any available media that can be accessed by a general purpose or special purpose computer or processor, or any programmable logic device.

Suitable processor-readable media may include storage or memory media such as magnetic or optical media. For example, storage or memory media may include conventional hard disks, compact disks, DVDs, Blu-ray discs, or other optical storage disks; volatile or nonvolatile media such as Random Access Memory (RAM); Read Only Memory (ROM), Electrically Erasable Programmable ROM (EEPROM), flash memory, and the like; or any other media that can be used to carry or store desired program code in the form of computer executable instructions or data structures.

Claim 1:
A method (<NUM>) for radar altimeter integrity monitoring, the method comprising:
obtaining one or more global navigation satellite system, GNSS, measurements, or one or more hybridized GNSS /inertial navigation system, INS, measurements, in an earth-centered-earth-fixed, ECEF, coordinate frame for a vehicle (<NUM>);
obtaining one or more altitude measurements from one or more radar altimeters on the vehicle (<NUM>);
transforming the one or more altitude measurements into the ECEF coordinate frame using a terrain map and a GNSS or hybridized GNSS/INS based position estimate with ensured integrity (<NUM>), wherein the transformed one or more altitude measurements are given by the following equation: <MAT> where ρ̃RA is the radar altimeter measurement, and ρ̂TERMAP is an estimate of orthogonal distance between an ECEF frame origin and a terrain at a point given by a horizontal position of the vehicle and the terrain map;
computing one or more characteristics of the transformed one or more altitude measurements, including orthogonal distance ρTERMAP moments, wherein a mean value of the orthogonal distance ρTERMAP is computed as: <MAT> where ρ̂HOR is a horizontal position estimate of the vehicle and map is the terrain map, wherein the mean of orthogonal distance is computed on the basis of horizontal position moments and terrain map properties;
determining a full solution estimate of position for the vehicle based on the transformed one or more altitude measurements, and the one or more GNSS or hybridized GNSS/INS measurements (<NUM>);
determining one or more sub-solution estimates of position for the vehicle based on a subset of the transformed one or more altitude measurements, and the one or more GNSS or hybridized GNSS/INS measurements (<NUM>);
comparing the full solution estimate with the one or more sub-solution estimates using statistical analysis (<NUM>); and
determining an altitude protection level for the vehicle based on a probability of hazardous misleading information and a probability of false detection (<NUM>).