Patent ID: 12217615

DETAILED DESCRIPTION OF THE INVENTION

For purposes of description herein, the terms “upper,” “lower,” “right,” “left,” “rear,” “front,” “vertical,” “horizontal,” and derivatives thereof shall relate to the invention as oriented inFIG.1. However, it is to be understood that the invention may assume various alternative orientations and step sequences, except where expressly specified by claim to the contrary. It is also to be understood that the specific devices and processes illustrated in the attached drawings, and described in the following specification, are simply exemplary embodiments of the inventive concepts defined in the appended claims. Hence, specific dimensions and other physical characteristics relating to the embodiments disclosed herein are not to be considered as limiting, unless the claims expressly state otherwise.

As a preliminary matter, the unmanned vehicles discussed herein may comprise unmanned ground vehicles (e.g., cars, trucks), unmanned marine vehicles (e.g., boats), and/or unmanned aircraft (e.g., commercial airplanes, helicopters, drones, fixed winged aircraft, rockets). While many examples are described with respect to flight, which presents three dimensions of movement and therefore more complexity in some respects, all examples apply in equal force to ground and/or marine travel, which present in some respects more simplified travel constraints.

The approaches described herein provide a quantifiable or known measure of assurance that an unmanned vehicle will conform to a desired geo-containment scheme.FIG.1is a schematic representation of a geo-containment system for unmanned vehicles. An assured geo-containment system1for unmanned vehicles may comprise an unmanned vehicle2that may be communicably connected to a base station4. The unmanned vehicle2may include an enforcement system10that is operably connected to a propulsion system12(e.g., an engine, a motor, or the like), typically indirectly through an avionic or onboard control system, as discussed below. Enforcement system10itself is a control system that interrelates with other elements of geo-containment system1to assure or enforce conformance of vehicle2to the applicable geo-containment scheme. The enforcement system10, F, may have virtually any suitable configuration to properly relate to vehicle2for achieving the functionality claimed herein. For example, enforcement system10may include a programmable controller component, electrical circuit components, software, and/or the like. The unmanned vehicle2may be communicatively coupled with variety of supporting systems for positioning, navigation, and timing (PNT). The geo-containment system1may include a primary PNT system16(which may, e.g., be a GPS system) and an alternative PNT system14, which may provide GPS-independent data18. Primary PNT system16and alternative PNT system14communicate with a boundary violation prediction and detection component22, such that it may receive GPS-based position data20and GPS-independent data18. The GPS-independent data18and the data from the primary PNT system16need not differ in format such that, for example, the two sets of data may differ only in their sources and respective degree of reliability or accuracy. The boundary violation prediction and detection component22may comprise its own programmable controller component, processor, executable software, and/or other suitable arrangement. As discussed in more detail below, the boundary violation prediction and detection component22may provide an output24comprising diagnostic output or a message, a termination output26, or a warning output28. Thus, enforcement system10in the embodiment shown inFIG.1may comprise or interrelate with alternative PNT system14, primary PNT system16, and boundary violation prediction and detection component22. Disposition or location of enforcement system10onboard the unmanned vehicle2simplifies or enables the integrated use of GPS-independent data18, as well as simplifying the inter-relation with other components onboard unmanned vehicle2, such as propulsion system12. Additionally, onboard positioning of enforcement system10enables higher definition and reliability of communication among these components, reducing the risk of degradation or communication errors. In some embodiments, it is contemplated that enforcement system10may be portable, such that enforcement system10may be loaded onto vehicle2for use during operation, and in which case enforcement system10may inter-relate with, but not necessarily physically incorporate primary PNT system16.

The base station4may include a graphical user interface30or other suitable device/feature that provides graphical and/or text data to a user. Base stations are often used by a pilot or user to define flight paths or to set a range or distance limit a vehicle may travel from the pilot, sometimes as a means to ensure the vehicle remains within sight. See 14 CFR 107.31. In the present case, however, base station4may permit a user to input one or more boundary points32, vehicle dynamics coefficients34, and data regarding the travel plan36. These pre-travel inputs may then be evaluated by the onboard boundary violation prediction and detection component22before and during travel of unmanned vehicle2.

Enforcement system10may relate to a propulsion system12of unmanned vehicle2through communication signals or “triggers” that are communicated to an onboard vehicle control system1306, which causes onboard vehicle control system1306to respond, as further discussed below with reference toFIG.13. The unmanned vehicle2may, in some embodiments, also include an auto pilot that is operably connected to the boundary violation prediction and detection component22and, similarly, propulsion system12that may be operably connected to boundary violation prediction and detection component22, in each case by signals through onboard vehicle control system1306. An auto pilot may thus be an element or component of onboard vehicle control system1306. The unmanned vehicle2may also include a power system9(e.g., a battery) that may provide electrical power to the various onboard electrical components.

Enforcement system10is that onboard portion of the geo-containment system1that is configured to determine safe distances and thereby limit or conform the travel of unmanned vehicle2to the geo-containment scheme. For example,FIG.2shows boundaries of stay-in regions and stay-out regions. Boundary points may define one or more hard boundaries38,38A,38B, and the like. The hard boundary38may form a stay-in region40. The hard boundary38A may define a stay-out region42A, and the hard boundary38B may define a stay-out region42B. The hard boundaries38,38A,38B may represent lateral boundaries; however, the geo-containment system1may additionally and/or alternatively use one or more boundaries in any direction desired (e.g., vertical boundaries). The boundary violation prediction and detection component22of the geo-containment system1is configured to determine a soft boundary44and a warning boundary46. The soft boundary44is spaced apart from hard boundary38by a distance D1, and the warning boundary46is spaced apart from the hard boundary38by a distance D2. The distance D1may correspond to a minimum safe distance that is determined by the boundary violation prediction and detection component22of the onboard enforcement system10utilizing vehicle dynamics coefficients34and positional data and velocity of the unmanned vehicle2, as determined by the alternative PNT system14and/or the GPS primary PNT system16. The minimum safe distance D1preferably changes dynamically, i.e., as a maximum distance the unmanned vehicle2could travel if a contingency were triggered. As such, for UAV embodiments, this parameter is driven by the aerodynamic parameters of the vehicle combined with dynamics information such as the altitude, speed, and in some cases, attitude. The distance D2may be greater than the distance D1. The distance D2may be calculated by the enforcement system10onboard by multiplying the distance D1. For example, the distance D2may be 1.25 times the distance D1. The boundary violation prediction and detection component22of the geo-containment system1may also determine soft boundaries44A and44B and warning boundaries46A and46B for stay-out regions42A and42B. Although hard boundaries (e.g., the hard boundaries38,38A, and38B) may be determined prior to travel of the unmanned vehicle2utilizing the boundary points32, the locations of the soft boundary44and warning boundary46corresponding to distances D1and D2, respectively, may be calculated onboard during travel by the boundary violation prediction and detection component22. The distances D1and D2may be calculated and updated at a high frequency (e.g., 100 or 1000 times or more per second). Calculation of distance D1may thus involve the onboard boundary violation prediction and detection component22using vehicle dynamics coefficients34and position and velocity of the unmanned vehicle2as determined by the alternative PNT system14and/or the GPS system of the primary PNT system16. For clarity, the collection and use of such coefficients and measures are enabled by the positioning of enforcement system10onboard unmanned vehicle2, including violation prediction and detection component22, alternative PNT system14, and primary PNT system16. Specifically, it enables achieving high levels of reliability without the loss of integrity that can occur with wireless data links. For clarity, all computations are done onboard unmanned vehicle2except for loading in the initial conformance parameters (e.g., the geofence boundaries.) This approach is illustrated, for example, in the embodiments shown inFIG.1.

FIG.3shows example boundary violation prediction and detection logic for stay-in regions (e.g., the stay-in region40) during operation of the geo-containment system1.FIG.4shows example boundary violation prediction and detection logic for stay-out regions. In general, steps32,34,36,48,50, and52may involve some input from a user of base station4. However, the remainder of steps involve iterations of enforcement system10and the operation of other onboard elements before and during travel of unmanned vehicle2. The operating logic ofFIGS.3and4may be implemented utilizing the boundary violation prediction and detection component22. The logic diagrams ofFIGS.3and4are exemplary and are not limited to specific sequences or steps. For example, the logic diagrams ofFIGS.3and4are examples of logic with respect to aircraft; however, similar logic may be implemented with respect to ground vehicles and/or marine vehicles.

Referring toFIG.3, data regarding the travel plan36and the boundary points32may be input into pre-travel checks48. The pre-travel checks48may include evaluating the travel plan36to determine if the travel plan will violate a boundary. The vehicle dynamics coefficients34and current vehicle state50are utilized in a minimum safe distance to boundary determination52. The minimum safe distance to boundary is shown schematically as the distance D1inFIG.2. Step54represents a determination if the unmanned vehicle2is presently inside a polygon (e.g., the hard boundary38). At steps56and58, if the unmanned vehicle2is not inside the polygon (e.g., the hard boundary38), the system may trigger termination as shown at step58. Termination may comprise onboard vehicle control system1306to respond (seeFIG.13) by shutting down the propulsion system12(e.g., an engine of a car, a turbine of a plane) or other action to stop the travel of the unmanned vehicle2. Although termination preferably involves eliminating all travel potential (e.g., thrust) from the propulsion system12, termination may also comprise reducing speed and/or maneuvering the unmanned vehicle2so it stops (e.g., lands) with minimal additional travel.

If the unmanned vehicle2is determined to be inside the polygon and/or hard boundary38at step56, the system may then determine if the current state is at least a minimum safe distance D1from a hard boundary at steps60and62. Such steps may be equivalent to determining if the vehicle has crossed (and thereby violated) the soft boundary44(e.g., as shown inFIG.2). If the unmanned vehicle2is at a distance that is less than the minimum safe distance, the enforcement system10issues a signal or trigger, which ultimately initiates termination as shown at step64. As discussed above, termination may include reducing or eliminating the travel potential of propulsion system12(e.g., by disabling an engine, reducing fuel flow to the propulsion system12, or the like via the response of onboard vehicle control system1306to the trigger).

As shown at steps66and68, the system may also determine if the current state is at least a predetermined or assured amount (e.g., 1.25 times) of the minimum safe distance away from the boundary determination. These steps may be equivalent to determining if the unmanned vehicle2has crossed (and has thereby violated) the warning boundary46. If the unmanned vehicle2has crossed the warning boundary46, the system may issue a trigger warning as shown at70. The warning70may comprise an audio or visual warning to a user (e.g., via the graphical user interface30and/or speakers of the base station4). The warning70may also include or trigger a travel maneuver by an auto pilot system of the unmanned vehicle2. The travel maneuver may be a maneuver that, if possible, changes a travel path of the unmanned vehicle2to avoid crossing soft boundary44, and also avoids hard boundary38. If the travel maneuver fails to avoid crossing the soft boundary44, termination may be triggered, as shown at step64.

As shown at steps72,74, and76, if the unmanned vehicle2is at a safe distance (step68), the system may evaluate the health of the navigation system at72, and may determine an action at step76if the navigation system has been degraded. The navigation system health evaluation is discussed in more detail below in connection withFIG.5.

As shown at steps78,80, and82, the system also evaluates/monitors the health of the power system9of the vehicle and, if the power system9has degraded, takes action at step82. Such power system monitoring is discussed in more detail below in connection withFIG.6.

The operating logic ofFIG.4for stay-out regions is substantially similar to the operating logic for stay-in regions (e.g., the example shown inFIG.3); however, at steps54A and56A, the system may determine if the vehicle is outside of the polygon, rather than determining if the system is inside the polygon as shown at steps54and56ofFIG.3. The operating logic ofFIGS.3and4may be utilized simultaneously to control unmanned vehicle2if the unmanned vehicle2is operating in a region that includes both stay-in regions and stay-out regions as shown inFIG.2.

With further reference toFIG.4A, the pre-travel check48may use the boundary points32to determine if a valid boundary has been entered as shown at84and86. If the boundary is not valid (e.g., if edges of the boundary cross each other and/or have very sharp corners), propulsion may be disabled as shown at88. One or more of the following criteria may be utilized to determine if a boundary (e.g., a polygon) is valid:(1) The vertices of the polygon region may be in counter-clockwise order;(2) Two non-adjacent boundary edges of the polygon region may avoid crossing each other or may be further than a first predefined minimum distance;(3) For two adjacent boundary edges, their respective non-shared endpoints may be greater than a second predefined minimum distance from the other edge;(4) Two adjacent boundary edges of the polygon region may form sufficiently non-sharp corners (e.g., may form corners greater than 3 degrees); and/or(5) Boundary edge may be greater than a predefined minimum length (e.g., 1.0 meter or 0.1 meter).

As shown at steps90and92, the boundary points32and travel plan36may also be evaluated to determine if the travel plan violates a polygon (e.g., the hard boundary38). The travel plan evaluation logic is discussed in more detail below in connection withFIGS.10A-10C. If the travel plan does not remain inside a boundary polygon, the system disables propulsion as shown at step94.

If the vehicle will stay inside a polygon at step92(or outside a polygon if the boundary points32include a stay-out region), the pre-travel checks may then proceed to evaluate the navigation system health as shown at72and74. The propulsion system may be disabled at76A if the navigation system is not healthy (e.g., is not operating properly). Such disabling may be accomplished by either comparing the independent positioning sources to verify that they agree within an acceptable threshold or by estimating the errors present within the position solutions and verifying that they are below an acceptable threshold. The system may then assesses the power system at steps78and80, and may disable propulsion at step82A if the power system is not functioning properly. Evaluation of the health of the power system is discussed in more detail below in connection withFIGS.12A-12D. The output96of the pre-travel checks may comprise disabling propulsion or allowing propulsion. The output96may further comprise an audio and/or visual signal to the operator utilizing the graphical user interface30. For example, if the pre-travel checks48do not detect a problem, the graphical user interface30may provide a message indicating that the pre-travel checks have not revealed a problem, and that the unmanned vehicle2may proceed; however, a warning signal may also be provided if the pre-travel checks indicate a problem to alert a user concerning the nature of the problem. For example, the graphical user interface30may display a message indicating that the travel path will violate a boundary, that the navigation system is not operating properly, and/or that the electrical power system of the unmanned vehicle2is not operating properly.

Evaluation of various travel paths is shown schematically inFIGS.10A-10C. With reference toFIG.10A, if a travel plan36A is within hard boundary38and soft boundary44, the system need not take any action. The travel plan36A ofFIG.10Amay generally correspond to an affirmative determination at step92ofFIG.4A.

FIG.10Bis a schematic plan view showing pre-travel travel plan evaluation logic with travel plan warning. If a travel path36B crosses soft boundary44, but does not cross hard boundary38, the system may cause output of a warning to the operator. The warning may comprise a message that is displayed on graphical user interface30, and/or may comprise any other suitable warning to the operator. The determination ofFIG.10Bmay be implemented utilizing a second determination that is similar to the “inside polygon?” determination at step92and following an affirmative determination at step92, which may include warning an operator if soft boundary44is violated, but still proceeding to the navigation system health evaluation at step72.

FIG.10Cis a schematic plan view showing pre-travel travel plan evaluation logic in which the travel plan is invalid. If a travel path36C crosses both hard boundary38and soft boundary44, the geo-containment system1may determine that an invalid travel plan has been entered, and the geo-containment system1may disable propulsion.FIG.10Cmay correspond to the steps92and94ofFIG.4A.

FIG.5is a diagram showing operating logic for navigation system monitoring. If the navigation systems (e.g., the alternative PNT system14and/or the (GPS) primary PNT system16) are not operating properly at step74(e.g., as described with respect toFIGS.3and4), at step76, the boundary violation prediction and detection component22may determine what action to take. At step98, the boundary violation prediction and detection component22may determine if a navigation sensor has been lost. If not, the boundary violation prediction and detection component22may determine at step100if both navigation sensors (e.g., alternative PNT system14and (GPS) primary PNT system16) indicate a safe state. If so, the system may trigger a warning at step102. If not, the boundary violation prediction and detection component22may trigger termination at step104. The warning at step102may comprise a message displayed on graphical user interface30, and the termination at step104may comprise halting all thrust from propulsion system12. If, at step98, it is determined that all or portions of the navigation sensors (e.g., alternative PNT system14and primary PNT system16) have been lost, the boundary violation prediction and detection component22may determine if a functioning navigation system (e.g., alternative PNT system14and/or primary PNT system16) indicate a safe state. If so, a warning trigger may be issued as shown at108. Otherwise, it may issue a trigger for termination as shown at110. The warning108may be substantially the same as the warning at step102, and termination110may be substantially the same as the termination at step104.

With further reference toFIG.6, at step80(see alsoFIGS.3and4), the system may determine if the power system9is operating properly. If not, at step112, the boundary violation prediction and detection component22may determine if the power system is fully compromised. If so, the boundary violation prediction and detection component22may trigger termination at step112. If not, the boundary violation prediction and detection component22may trigger a warning at step114.

FIG.12Ais a graph showing power system evaluation logic for normal operation. If the power system9is determined to be healthy (e.g., if it is operating within a safe voltage range), the boundary violation prediction and detection component22need not take any action. As such,FIG.12Amay correspond to a normal operation of the unmanned vehicle2.

FIG.11Bis a schematic plan view showing navigation system evaluation logic in which there is a loss of one navigation system. If the voltage level Vis in a range that is below the lowest safe voltage but above the highest unsafe voltage, the boundary violation prediction and detection component22may execute a contingency maneuver. The contingency maneuver ofFIG.12Bmay correspond to the warning at step114ofFIG.6. The contingency maneuver may, for example, involve issuing a trigger for reducing thrust of propulsion system12and causing the unmanned vehicle2to stop and/or land. This maneuver may be executed by auto pilot7of the unmanned vehicle2, in conjunction with the onboard vehicle control system1306.

FIG.11Cis a schematic plan view showing navigation system evaluation logic in which an unacceptable but safe position discrepancy is detected.FIG.11Dis a schematic plan view showing navigation system evaluation logic in which an unacceptable and unsafe position discrepancy is detected. If the voltage V is unsafe because it is either too low (FIG.12C) or too high (FIG.12D), the boundary violation prediction and detection component22may terminate operation of the unmanned vehicle2. Termination may involve preventing propulsion system12from producing any thrust. The safe and unsafe voltage criteria may be different for different unmanned vehicles, and such criteria are not limited to any specific range of voltages.

FIG.7Ais a schematic plan view showing lateral boundary evaluation logic for stay-in regions in which an error ellipse is defined around an unmanned vehicle that is inside all boundaries.FIG.7Bis a schematic plan view showing lateral boundary evaluation logic for stay-in regions in which the error ellipse has breached a warning boundary.FIG.7Cis a schematic plan view showing lateral boundary evaluation logic for stay-in regions in which the error ellipse has breached a soft boundary.FIG.7Dis a schematic plan view showing lateral boundary evaluation logic for stay-in regions in which the error ellipse has breached a hard boundary. The navigation sensors (e.g., the alternative PNT system14and primary PNT system16) may have uncertainty (e.g., error) associated with respect to the accuracy of the position of the unmanned vehicle2. For example, with GPS the error may be established using Dilution of Precision (DOP) calculation, such that a lower DOP value represents lower error and greater reliability or higher quality of positional data. This uncertainty is shown inFIGS.7A-7Das an error ellipse120or region around the unmanned vehicle2. The error ellipse120may be a three dimensional or two dimensional region about the unmanned vehicle2having a size and shape defined by the uncertainty of the unmanned vehicle2. Thus, the uncertainty may be a function of reliability or quality of the positional data of one or both of alternative PNT system14and primary PNT system16. The shape of the error ellipse120need not be an ellipse, and may be any shape appropriate to the application and vehicle. The lateral boundary evaluation logic for stay-in regions40takes into account the error ellipse120. More specifically, as shown inFIG.7A, if the error ellipse120is inside all boundaries (e.g., including the warning boundary46), no action need be taken. However, if the error ellipse crosses warning boundary46as shown inFIG.7B, the boundary violation prediction and detection component22may execute a contingency maneuver. For example, the boundary violation prediction and detection component22may cause the auto pilot7to stop the unmanned vehicle2by turning off power to one or more engines. If positional data shows the error ellipse120crosses the soft boundary44(FIG.7C) or the hard boundary38(FIG.7D), the boundary violation prediction and detection component22may terminate operation of the unmanned vehicle2. Termination may comprise stopping all thrust of propulsion system12. The boundary violation prediction and detection component22may terminate operation when the error ellipse120crosses the soft boundary44(FIG.7C), such that the unmanned vehicle2does not reach the position ofFIG.7Din which error ellipse120crosses hard boundary38. The boundary violation prediction and detection component22may further be configured to terminate operation if the error ellipse120does cross hard boundary38, as shown inFIG.7D.

The lateral boundary evaluation logic for stay-out regions is shown inFIGS.8A-8D. The logic operation ofFIGS.8A-8Dmay correspond to the operating logic for the stay-in regions ofFIGS.7A-7D, respectively. When positional data shows the error ellipse120is outside of all boundaries (FIG.8A) the boundary violation prediction and detection component22need not take any action, and the unmanned vehicle2may continue to operate in a normal manner. If the error ellipse120crosses warning boundary46(FIG.8B), the boundary violation prediction and detection component22may cause the auto pilot7to execute a contingency maneuver. If the error ellipse120crosses the soft boundary44(FIG.8C) or the hard boundary38(FIG.8D), the boundary violation prediction and detection component22terminates operation of unmanned vehicle2.

The boundary evaluation logic for vertical boundaries is shown inFIGS.9A-9D. If the error ellipse120is inside all boundaries (FIG.9A), the boundary violation prediction and detection component22need not take any action, and the unmanned vehicle2may continue to operate in a normal manner. If the error ellipse120crosses warning boundary46, the boundary violation prediction and detection component22may execute a contingency maneuver (e.g., the auto pilot7may cause the unmanned vehicle2to stop). If the error ellipse120crosses the soft boundary44(FIG.9C) or a hard boundary38(FIG.9D), the boundary violation prediction and detection component22may terminate operation by shutting off all thrust of propulsion system12. As shown inFIGS.9A-9D, both upper and lower boundaries may be entered to limit vertical travel of the unmanned vehicle2in both upward and downward directions. An upper boundary, a lower boundary, or both may be entered, depending upon the circumstances (e.g., restrictions) present in the area in which the unmanned vehicle2is being operated.

FIGS.11A-11Dare schematic plan views showing navigation system evaluation logic. The alternative PNT system14may provide a first vehicle location2A, and the primary PNT system16may provide a second vehicle location2B that is not exactly the same as the first vehicle location2A. The first vehicle location2A and the second vehicle location2B may be associated with error boundaries that, when combined, may produce an error ellipse122.FIG.11Ais a schematic plan view showing navigation system evaluation logic for normal operation. During normal operation, the error ellipse122may be within all boundaries (e.g., the soft boundary44and the hard boundary38), and the boundary violation prediction and detection component22need not take any action, such that the unmanned vehicle2may operate in its normal manner.

FIG.11Bis a schematic plan view showing navigation system evaluation logic in which there is a loss of one navigation system. If one of the navigation systems (e.g., the alternative PNT system14and/or the GPS system16) is lost such that the first vehicle location2A and/or the second vehicle location2B is available, the boundary violation prediction and detection component22may cause the auto pilot7to execute a contingency maneuver. The contingency maneuver may comprise stopping the unmanned vehicle2.

FIG.11Cis a schematic plan view showing navigation system evaluation logic in which an unacceptable but safe position discrepancy is detected. If the first vehicle location2A and the second vehicle location2B provided by the navigation systems (e.g., the alternative PNT system14and/or the GPS system16), respectively, show an unacceptably high discrepancy, and if the combined error ellipse122is within both soft boundary44and hard boundary38, the boundary violation prediction and detection component22may cause the auto pilot7to execute a contingency maneuver (e.g., stopping the unmanned vehicle2).

FIG.11Dis a schematic plan view showing navigation system evaluation logic in which an unacceptable and unsafe position discrepancy is detected. If the navigation systems (e.g., the alternative PNT system14and/or the GPS system16) produce an unacceptable discrepancy between the first vehicle location2A and the second vehicle location2B, and if the combined error ellipse122crosses the soft boundary44(and/or the hard boundary38), the boundary violation prediction and detection component22may cause the auto pilot7to terminate travel by eliminating all power from propulsion system12.

FIG.13shows a boundary violation prediction and detection component1301(i.e., corresponding to embodiments of the boundary violation prediction and detection component22described above), which may be communicatively coupled to a primary PNT system1302(which may be, e.g., a GPS, INS, altimeter, or the like) and an alternative PNT system1303.FIG.13is in many respects similar toFIG.1and depicts an embodiment of geo-containment system1. The boundary violation prediction and detection component1301may further be communicatively coupled to a base station1305, an onboard contingency mechanism1307, an onboard vehicle control system1306, and a diagnostics system1308. The alternative PNT system1303may be communicatively coupled to alternative PNT system transmitters1304(which may be the same or similar as the Alternative PNT System Transmitters6). For clarity, the onboard vehicle control system1306is directed to avionics functionality in response to triggers from enforcement system10; it does not correspond to enforcement system10.

The alternative PNT system1303, primary PNT system1302, and the boundary violation prediction and detection component1301as a system are depicted inFIG.13, and may be configured to be lightweight for onboard placement and to receive power from an independent power source. In that way, cessation of power to the vehicle (e.g., where a battery runs out of power) does not result in cessation of operations of the boundary violation prediction and detection component1301. Similarly, the components depicted inFIG.13may be designed and/or shielded to protect against conditions that harm performance, e.g., electromagnetic interference.

The boundary violation prediction and detection component1301may be the same as or similar to the boundary violation prediction and detection component22and preferably may, e.g., be implemented on one or more computing devices onboard or inside of a vehicle (e.g., an airplane, car, or the like) for inter-relation with sensors and other onboard systems. The boundary violation prediction and detection component1301may comprise processors and memory which, when executed by the one or more processors, cause steps including, for example, receiving data from the base station1305or issuing trigger signals to onboard vehicle control system1306.

The primary PNT system1302and the alternative PNT system1303(which may be the same or similar to the primary PNT system16and/or the alternative PNT system14), and preferably may be configured onboard to transmit positional data corresponding to a vehicle to the boundary violation prediction and detection component1301. For example, the alternative PNT system1303may transmit a first set of positional data values (e.g., an x, y, and z value of a vehicle) to the boundary violation prediction and detection component1301, whereas the primary PNT system1302may be configured to transmit a different, potentially broader set of positional data values (e.g., rotational information about the vehicle, yaw information about the vehicle) to the boundary violation prediction and detection component1301. Data transmitted by the alternative PNT system1303need not be GPS based (i.e., preferably is an alternative form of information for reliability), and may be received in whole or in part from the alternative PNT system transmitters1304. The positional data may be based on the type of vehicle. For example, altitude information about a ground-based vehicle (e.g., a car) need not be collected and transmitted to the boundary violation prediction and detection component1301; however, altitude information about an air-based vehicle (e.g., an airplane) may be collected onboard and transmitted or made available to the onboard boundary violation prediction and detection component1301.

The base station1305, which may be similar to the base station4, may have a graphical user interface and/or input devices which enable one or more users to transmit data such as, e.g., transmit boundary points, vehicle dynamics coefficients, and/or route plans to the boundary violation prediction and detection component1301. The base station1305need not be located in and/or around the vehicle, and the transmission of such data may be performed over a wireless network, asynchronously with any motion of the vehicle, and/or the like. In particular, data receive from the base station1305may be received before the vehicle begins travel. For example, a user may use the base station4to input data relating to roads which may and/or may not be driven by an automobile, a region which a boat is prohibited from entering, or the like, and before the vehicle begins to move.

The boundary violation prediction and detection component1301may be configured to, based on the data from the base station1305, the alternative PNT system1303, and/or the primary PNT system1302, transmit instructions or signals to the diagnostics system1308, the onboard vehicle control system1306, and/or the onboard contingency mechanism1307. The diagnostics system1308may be configured to receive diagnostic messages from the boundary violation prediction and detection component1301and, e.g., display them for one or more users, such as an occupant of a vehicle. The onboard vehicle control system1306may be configured to receive and respond to various information and trigger signals from the boundary violation prediction and detection component1301including, but not limited to, information regarding system faults, geospatial warnings (e.g., warnings that a vehicle is approaching a boundary), altitude warnings, travel plan deviation warnings, speed warnings, and the like. Such information or trigger may cause the onboard vehicle control system1306to, among other things, respond by causing a change a direction, speed, acceleration, altitude, and/or other operating parameters of the vehicle. Thus, a role of these components in embodiments of enforcement system10is to issue triggers that include informing onboard vehicle control system1306how to respond to control the vehicle. The onboard contingency mechanism1307may be configured to receive termination instructions from the boundary violation prediction and detection component1301and, based on such instructions, cause the vehicle to stop, slow down, or otherwise cease operation (e.g., by parking, landing, docking).

In the event that a qualified operator (not shown) is available at a vehicle, the onboard contingency mechanism1307need not be implemented. For example, rather than causing the vehicle to stop (e.g., land), the onboard vehicle control system1306may instead be disabled, such that the qualified operator may be required to take control of the vehicle using base station1305, for example. In this way, autopilot operations may cease and responsibility for enforcement of any transgression of restricted areas may be the responsibility of the qualified operator.

A simplified example of how the boundary violation prediction and detection component1301may operate is provided herein. The boundary violation prediction and detection component1301may receive, from the base station1305, input regarding designated geospatial boundaries or restricted areas (geospatial areas where vehicle operation is prohibited or should be avoided). Boundaries may be expressed as polygons (e.g., concave or convex polygons), may comprise with altitude limits (e.g., if the vehicle in question is an airplane), and may comprise hard boundaries. Such boundary data may be received prior to operation by the vehicle operator. Data regarding restricted areas, temporary operational restrictions, and other geospatial limitations may originate from regulatory authorities or other approved sources. The boundary violation prediction and detection component1301may additionally and/or alternatively receive information regarding vehicle characteristics, such as the vehicle's travel plan, speed limitations, and/or operational constraints. During operation, the boundary violation prediction and detection component1301may receive positional data from the primary PNT system1302and/or the alternative PNT system1303. During operation, the boundary violation prediction and detection component1301may establish intermediate boundaries or buffer zones with respect to the hard boundaries. The buffer zones may be used to provide a warning of proximity to the hard boundary to allow action to alter the route to avoid operation beyond the hard boundary. Such buffers may be sized using vehicle characteristics and current state information to allow contingency maneuvers. The positional information and the boundaries of the buffer zone and the hard boundaries may be monitored dynamically on an ongoing basis. If the vehicle crosses into a first (warning) buffer zone, a first enforcement warning or trigger may be transmitted to the diagnostics system1308and/or the onboard vehicle control system1306. The timing of the trigger warning may be configured to allow the onboard vehicle control system1306and/or a qualified operator to avoid the hard boundary. If the vehicle crosses into a second (termination) buffer zone, a second or additional warning or trigger may be provided to the diagnostics system1308, the onboard vehicle control system1306, and/or the onboard contingency mechanism1307, and such an enforcement trigger or warning may ultimately cause the vehicle to cease operation. For example, if the vehicle appears to continue to travel towards the hard boundary, the onboard vehicle control system1306may turn the vehicle around, and/or the onboard contingency mechanism1307may disable an engine of the vehicle. Additionally and/or alternatively, if a qualified operator (e.g., a driver) is present in the vehicle, the onboard vehicle control system1306may cease operation and the qualified operator may be required to take over operation of the vehicle.

Although examples are described above, features and/or steps of those examples may be combined, divided, omitted, rearranged, revised, and/or augmented in any desired manner. Various alterations, modifications, and improvements will readily occur to those skilled in the art. Such alterations, modifications, and improvements are intended to be part of this description, though not expressly stated herein, and are intended to be within the spirit and scope of the disclosure. Accordingly, the foregoing description is by way of example only, and is not limiting