Technical Field

This application relates to methods and apparatus for determining integrity information for users of Global Navigation Satellite System (GNSS) receiver devices. This application particularly relates to improving a GNSS integrity concept and to determining required levels of reliability for determined navigation information that may be applied by users of GNSS receiver devices.

Background

The integrity concept of GNSSs, such as Galileo or the Global Positioning System (GPS), for example, relies on the determination of the availability of the service (GNSS service) at every epoch. In practice, availability of the service is determined by computing the probability of Hazardous Misleading Information (HMI), i.e. the probability that determined navigation information is HMI. The probability of HMI expresses the probability that the error (position error) at the user level exceeds given alarm limits. The computation of the probability of HMI is based on the geometry of the satellites (GNSS satellites) that are currently in view of the user's GNSS receiver device (e.g., navigation device), and on additional information comingfrom the mission segment that is broadcast by the satellites. The probability of HMI is compared to a threshold that is derived directly from the integrity allocation.

To comply with service requirements (e.g., based on civil aviation needs), continuity performance in addition to availability performance must be fulfilled. By comparing, at the user level, the probability of HMI to the threshold that has been derived from the integrity information, it can be ensured that both the availability performance and continuity performance are fulfilled.

In practice, continuity performance is a critical driver of a GNSS, such as Galileo, especially due to the impact of ionospheric scintillations affecting the monitoring stations network of the mission segment. For example, the analyses carried out in the framework of the WP2 work package for Galileo (LPV200/average continuity study) indicate that the continuity performance (expressed per 15 second period) is the dimensioningfactor of the monitoring stations network of the mission segment. In particular, it has been found that the continuity performance constraints require a global network of about 30 monitoring stations. This number is further increased by political and security constraints that inhibit arbitrary placement of monitoring stations across the globe.

At the user level, failure of the service to meet the continuity performance requirement may lead to situations in which critical navigation operations, such as an approach to an airport or landing in the case of (civil) aviation, for example, need to be aborted.

Thus, there is a need for methods and apparatus for determining integrity information for users of GNSS receiver devices that address the above issues. There is a particular need for such methods and apparatus that relax implementation constraints on the network of monitoring stations of the mission segments and/or that reduce the likelihood of critical navigation operations having to be aborted due to failure of meeting the continuity performance requirement.

Summary

In view of this need, the present document proposes methods of determining integrity information for a user of a GNSS receiver device, apparatus for determining integrity information for a user of a GNSS receiver device, and a GNSS receiver device, having the features of the respective independent claims.

An aspect of the disclosure relates to a method of determining integrity information for a GNSS receiver device (e.g., for a user of the GNSS receiver device). The GNSS receiver device may include a GNSS receiver for receiving signals from a plurality of GNSS satellites. The GNSS receiver device may further include a computation unit for determining navigation information indicative of (e.g., including) a position of the GNSS receiver device based on the received signals. The method may include determining first information (first data) indicative of a status of the plurality of GNSS satellites and transmitting the first information to the GNSS receiver device. The status of the GNSS satellites may relate to a functional state of (e.g., each of) the plurality of satellites (e.g. the GNSS satellites that are currently in view of the GNSS receiver device). The status may further indicate whether (and which) satellites are considered faulty by a mission segment including a plurality of (ground-based) monitoring stations for monitoring the GNSS satellites. In general, the status may indicate whether a given GNSS satellite may be used for determining navigation information indicative of the position of the GNSS receiver device. The method may further include determining a first level of reliability based on second information (second data) indicative of a status of a portion of ionosphere that is passed by the signals from the plurality of GNSS satellites on their passage from respective GNSS satellites to the GNSS receiver and transmitting an indication of the first level of reliability to the GNSS receiver device. The second information may be indicative of a degree of ionospheric activity and/or an impact of ionospheric scintillations, for example. The first level of reliability may be determined such that a first indication indicating that a navigation operation relying on the navigation information may be commenced may be generated at the GNSS receiver device if a first quantity indicative of a reliability of the navigation information satisfies the first level of reliability. Thus, the first level of reliability may relate to a start condition for the navigation operation. The first quantity may be obtainable based on the first information and third information (third data) indicative of a geometry of the plurality of GNSS satellites. The third information may be indicative of current positions of the plurality of satellites and may include or be derived from the ephemerides of the plurality of satellites, for example.

Configured as above, the first level of reliability (and a corresponding first threshold) is dynamically determined on the basis of information relating to a status of the ionosphere (i.e., on the basis of ionospheric conditions). The second level of reliability (and a corresponding second threshold) may be fixed and is in general different from the dynamically determined first level of reliability. A computed quantity that is indicative of a reliability of determined navigation information can be compared to the dynamically determined first threshold for determining whether a (critical) navigation operation, such as approach or landing in (civil) aviation, can be started, and can be compared to a second threshold for determining whether an ongoing (critical) navigation operation can be continued in case of a change of the user conditions, e.g. in case of new information arriving from the mission segment. By using these two distinct thresholds, one of them dynamically determined, a trade-off between continuity and availability can be performed in a manner tailored to current ionospheric conditions. This trade-off corresponds to reallocating part of the integrity budget from the availability part to the continuity part. Effects of the trade-off are twofold. First, it enables to reduce the likelihood of continuity events in which the ongoing (critical) navigation operation needs to be aborted for security reasons. In other words, the proposed method enhances robustness of the GNSS service under the influence of ionospheric scintillations. Second, the trade-off allows to relax design constraints on the GNSS, for instance with regard to the number and/or placement of monitoring stations of the GNSS. Notably, both effects can be achieved in a simple manner by adding a new test at the user level (i.e., at the level of a user of a GNSS receiver device), which involves to distinguish between the (first) threshold for availability and the (second) threshold for continuity, without requiring any conceptually new computations at the user level. Moreover, since the availability performance has been found to be fulfilled with a significant margin for state of the art GNSS services, the proposed method does not affect availability as perceived by the user.

In embodiments, the method may further include determining, at the GNSS receiver device, the first quantity indicative of a reliability of the determined navigation information based on the first information and the third information. For example, the first quantity may be determined (e.g., calculated) based on the status and geometry (spatial arrangement, e.g., position) of the plurality of satellites. The method may further include generating, at the GNSS receiver device, the first indication indicating that the navigation operation relying on the navigation information may be commenced if the reliability of the navigation information indicated by the first quantity satisfies the first level of reliability. The method mayfurther include generating, at the GNSS receiver device, a second indication indicating that the navigation operation may be continued if the reliability of the navigation information indicated by the first quantity satisfies a second level of reliability. If the second indication is not generated, a third indication indicating that the navigation operation is to be aborted may be generated. The first, second and/or third indications may be presented to the user of the GNSS receiver device, for example in visual and/or acoustic form.

In embodiments, the first level of reliability may correspond to a higher level of reliability than the second level of reliability. In other words, the first level of reliability be more stringent than the second level of reliability.

As indicated above, the GNSS receiver device receives the dynamically determined first level of reliability from the mission segment, while the second level of reliability may be fixed and in general corresponds to a lower level of reliability than the first level of reliability. Thereby, the aforementioned trade-off between availability and continuity can be achieved, together with the associated advantages. In embodiments, the first quantity may be indicative of a probability that the navigation information relates to (e.g., is) Hazardous Misleading Information (HMI).

In embodiments, the method may further include determining a first threshold based on the second information and transmitting the first threshold to the GNSS receiver device. The first threshold may correspond to the first level of reliability and may represent a threshold forthe probability that the navigation information is HMI. The method mayfurther include comparing, at the GNSS receiver device, the determined first quantity to the first threshold. The method may yet further include generating the first indication if the first quantity does not exceed the first threshold.

In embodiments, the method may further include comparing the determined first quantity to a second threshold, wherein the second threshold corresponds to the second level of reliability and represents a threshold for the probability that the navigation information relates to (e.g., is) HMI. The method may yet further include generating the second indication if the first quantity does not exceed the second threshold.

In embodiments, the method mayfurther include monitoringthe plurality of GNSS satellites to acquire the first information. This may involve monitoring a status of the plurality of satellites.

In embodiments, the navigation operation may be a critical navigation operation, such as approach to an airport or landing in (civil) aviation.

Another aspect of the disclosure relates to a method of operating a GNSS receiver device. The GNSS receiver device may include a GNSS receiver for receiving signals from a plurality of GNSS satellites. The GNSS receiver device may further include a computation unit for determining navigation information indicative of (e.g., including) a position of the GNSS receiver device based on the received signals. The method may include receiving first information (first data) indicative of a status of the plurality of GNSS satellites. The status of the GNSS satellites may relate to a functional state of (e.g., each of) the plurality of satellites (e.g. the GNSS satellites that are currently in view of the GNSS receiver device). The status may further indicate whether (and which) satellites are considered faulty by a mission segment including a plurality of (ground-based) monitoring stations for monitoring the GNSS satellites. In general, the status may indicate whether a given GNSS satellite may be used for determining navigation information indicative of the position of the GNSS receiver device. The method may further include determining a first quantity indicative of a reliability of the determined navigation information based on the first information and information (data) indicative of a geometry of the plurality of GNSS satellites. The information indicative of a geometry of the plurality of GNSS satellites may be indicative of current positions of the plurality of satellites and may be derived from the ephemerides of the plurality of satellites, for example. The method may further include generating a first indication indicating that a navigation operation relying on the navigation information may be commenced if the reliability of the navigation information indicated by the first quantity satisfies a first level of reliability. Thus, the first level of reliability may relate to a start condition for the navigation operation. The method may yet further include generating a second indication indicatingthatthe navigation operation may be continued if the reliability of the navigation information indicated by the first quantity satisfies a second level of reliability. Thus, the second level of reliability may relate to a condition for continuing an ongoing navigation operation. The first level of reliability may correspond to a higher level of reliability than the second level of reliability. In other words, the first level of reliability be more stringent than the second level of reliability.

Configured as above, the first level of reliability corresponds to a higher level of reliability than the second level of reliability. By using these two distinct levels of reliability (corresponding to distinct thresholds), a trade-off between continuity and availability can be performed in a manner tailored to current ionospheric conditions. This trade-off corresponds to reallocating part of the integrity budget from the availability part to the continuity part. First, this enables to reduce the likelihood of continuity events in which the ongoing (critical) navigation operation needs to be aborted for security reasons. In other words, the proposed method enhances robustness of the GNSS service under the influence of ionospheric scintillations. Second, the trade-off allows to relax design constraints on the GNSS, for instance with regard to the number and/or placement of monitoring stations of the GNSS. Notably, both effects can be achieved in a simple manner by adding a new test at the user level (i.e., at the level of a user of a GNSS receiver device), which involves to distinguish between the (first) threshold for availability and the (second) threshold for continuity, without requiring any conceptually new computations at the user level. Moreover, since the availability performance has been found to be fulfilled with a significant margin for state of the art GNSS services, the proposed method does not affect availability as perceived by the user.

Another aspect of the disclosure relates to an apparatus for determining integrity information for a GNSS receiver device (e.g., for a user of the GNSS receiver device). The GNSS receiver device may include a GNSS receiver for receiving signals from a plurality of GNSS satellites. The GNSS receiver device may further include a computation unit for determining navigation information indicative of a position of the GNSS receiver device based on the received signals. The apparatus may include a computation unit. The computation unit may be configured to determine first information (first data) indicative of a status of the plurality of GNSS satellites. The computation unit may be further configured to determine a first level of reliability based on second information (second data) indicative of a status of a portion of ionosphere that is passed by the signals from the plurality of GNSS satellites on their passage from respective GNSS satellites to the GNSS receiver. The first level of reliability may be determined in such a manner that a first indication indicating that a navigation operation relying on the navigation information may be commenced may be generated at the GNSS receiver device if a first quantity indicative of a reliability of the navigation information satisfies the first level of reliability. The first quantity is obtainable based on the first information and third information indicative of a geometry of the plurality of GNSS satellites. The apparatus may further include a transmission unit configured to transmit the first information and the first level of reliability to the GNSS receiver device.

In embodiments, the first level of reliability may correspond to a higher level of reliability than a second level of reliability, wherein the second level of reliability is usable to generate a second indication indicating that the navigation operation relying on the navigation information may be continued if the first quantity satisfies the second level of reliability. In other words, the first level of reliability be more stringent than the second level of reliability. In embodiments, the computation unit may be further configured to generate the first information based on a result of monitoring the plurality of GNSS satellites. This may involve monitoring a status of the plurality of satellites. Another aspect of the disclosure relate to a GNSS receiver device. The GNSS receiver device may include a GNSS receiver for receiving signals from a plurality of GNSS satellites, for receiving first information (first data) indicative of a status of the plurality of GNSS satellites, and for receiving an indication of a first level of reliability. The GNSS receiver device may further include a computation unit for determining navigation information indicative of a position of the GNSS receiver device based on the received signals. The computation unit may be further configured to determine a first quantity indicative of a reliability of the determined navigation information based on the first information and information (data) indicative of a geometry of the plurality of GNSS satellites. The computation unit may be yet further configured to generate a first indication indicating that a navigation operation relying on the navigation information may be commenced if the reliability of the navigation information indicated by the first quantity satisfies the first level of reliability.

In embodiments, the computation unit may be further configured to generate a second indication indicating that the navigation operation may be continued if the reliability of the navigation information indicated by the first quantity exceeds a second level of reliability (e.g., a pre-stored second level of reliability).

Another aspect of the disclosure relates to a GNSS receiver device. The GNSS receiver device may include a GNSS receiver for receiving signals from a plurality of GNSS satellites and for receiving first information (first data) indicative of a status of the plurality of GNSS satellites. The GNSS receiver device may further include.a computation unit for determining navigation information indicative of a position of the GNSS receiver device based on the received signals. The computation unit may be further configured to determine a first quantity indicative of a reliability of the determined navigation information based on the first information and information (data) indicative of a geometry of the plurality of GNSS satellites. The computation unit may be further configured to generate a first indication indicating that a navigation operation relying on the navigation information may be commenced if the reliability of the navigation information indicated by the first quantity satisfies a first level of reliability. The computation unit may be yet further configured to generate a second indication indicating that the navigation operation may be continued if the reliability of the navigation information indicated by the first quantity satisfies a second level of reliability. The first level of reliability may correspond to a higher level of reliability than the second level of reliability. In other words, the first level of reliability be more stringent than the second level of reliability.

In embodiments, the first quantity may be indicative of a probability that the navigation information relates to (e.g., is) HMI.

In embodiments, the computation unit may be further configured to compare the determined first quantity to a first threshold corresponding to the first level of reliability, and to a second threshold corresponding to the second level of reliability, wherein the first and second thresholds represent thresholds for the probability that the navigation information relates to (e.g., is) HMI. The computation unit may be further configured to generate the first indication indicating that the navigation operation may be commenced if the first quantity does not exceed the first threshold. The computation unit may be yet further configured to generate the second indication indicating that the navigation operation may be continued if the first quantity does not exceed the second threshold.

It will be appreciated that method steps and apparatus or system features may be interchanged in many ways. In particular, the details of the disclosed method can be implemented by an apparatus or system, and vice versa, as the skilled person will appreciate. Moreover, any of the above statements made with respect to methods are understood to likewise apply to apparatus and systems, and vice versa.

Brief Description of the Figures

Exemplary embodiments of the disclosure are explained below with reference to the accompanying drawings, wherein

Fig. 1 schematically illustrates a GNSS configuration to which embodiments of the disclosure may be applied, Fig. 2 is a flowchart schematically illustrating an example of a method for determining integrity information according to embodiments of the disclosure,

Fig. 3 is a flowchart schematically illustrating additional steps that may be performed in connection with the method of Fig. 2,

Fig. 4 is a flowchart schematically illustrating an example of another method for determining integrity information according to embodiments of the disclosure, Fig. 5A schematically illustrates an example of a situation in which a single threshold is applied for a reliability of navigation information,

Fig. 5B illustrates an example of a situation according to embodiments of the disclosure in which two distinct thresholds are applied for the reliability of navigation information,

Fig. 6 schematically illustrates an example of an apparatus for determining integrity information according to embodiments of the disclosure, and

Fig. 7 schematically illustrates an example of a GNSS receiver device according to embodiments of the disclosure.

Detailed Description

In the following, exemplary embodiments of the disclosure will be described with reference to the appended figures. Identical elements in the figures may be indicated by identical reference numbers, and repeated description thereof may be omitted.

Broadly speaking, the present disclosure proposes an integrity scheme (i.e., a method for determining integrity information) for a GNSS, such as Galileo, for example. According to this integrity scheme, part of the integrity budget is reallocated from the availability part to the continuity part. This can be done in a simple manner by adding a new test at the user level (i.e., at the level of a user of a GNSS receiver device). According to the proposed integrity scheme, a computed quantity that is indicative of a reliability of determined navigation information (e.g., a computed probability of HMI) is compared to two distinct thresholds, instead of only one. A first threshold (TH_start; corresponding to a first level of reliability) determines whether the user can start a navigation operation (e.g., a critical navigation operation), such as an approach to an airport or a landing operation of an aircraft, for example. A second threshold (TH_cont; corresponding to a second level of reliability) determines whether the user can continue an ongoing navigation operation, even in case of a change of the user conditions, e.g. in case of new information arriving from the mission segment.

Both thresholds need to be lower than (or equal to) the integrity allocation in order to ensure that the integrity requirement is fulfilled. The first threshold (TH_start) may be made lower than the second threshold (TH_cont). For example, the second threshold may essentially correspond to the conventional single threshold. Thereby, intrinsically marginal user conditions (i.e., conditions that would lead to the computed quantity indicative of the reliability of determined navigation information to cross the second threshold in case of change of the user conditions, such as, for example, a degradation of the monitoring capability of the mission segment due to ionospheric scintillation) can be discarded and the continuity risk (i.e., the risk that an ongoing navigation operation has to be aborted) can be reduced. In other words, the proposed integrity scheme enhances robustness of the GNSS service under the influence of ionospheric scintillations.

By the proposed integrity scheme, the availability of the service is— theoretically— reduced. However, the proposed scheme exploits the fact that for the conventional technique, the service availability performance requirement is typically fulfilled with a significant margin for a monitoring stations network that satisfies the continuity performance requirement. Accordingly, the first threshold can be tuned so that the availability performance requirement is still satisfied in the proposed integrity scheme.

According to the proposed integrity scheme, the first threshold may be determined (e.g., calculated) by the mission segment (in general, by a ground station) and broadcast through the GNSS signal that is transmitted by the GNSS satellites, for example. The first threshold may be determined dynamically. For example, the first threshold may be determined on the basis of information indicative of a status of the ionosphere, or at least a part of the ionosphere intervening between the GNSS satellites in view of a particular user and ground (e.g., intervening between the GNSS satellites and the particular user and/or the monitoring stations of the mission segment). Accordingly, the mission segment could determine whether the current ionospheric conditions are quiet (which would lead to low scintillation impact) or disturbed (leading to high scintillation impact). Then, in quiet conditions, the first threshold would have a higher value, thus increasing availability while maintaining the continuity risk at a low level. I n disturbed conditions, the first threshold (i.e., availability) would be decreased by some amount in order to ensure that the continuity requirement is fulfilled despite the disturbed ionospheric conditions. Since the first threshold is determined at least in part on the basis of time-variable ionospheric conditions (i.e., the status of the ionosphere or part of the ionosphere), the first threshold may be determined periodically (e.g., at regular intervals), such as for each epoch or for each predetermined multiple of epochs.

By contrast, the second threshold may be determined in the conventional manner, in particular without reference to ionospheric conditions. Under certain circumstances, the second threshold may be fixed, while the first threshold is determined dynamically and/or periodically.

In the proposed integrity scheme, the first and second thresholds may vary from GNSS receiver device to GNSS receiver device, e.g. depending on the type of the respective GNSS receiver device. Moreover, under certain circumstances the first and second thresholds could be fixed, in which case the first threshold would be different from the second threshold, and in particular, lower than the second threshold.

The above description of the proposed integrity scheme applies not only to the case of Galileo as the GNSS, but also to other services employing integrity concepts different from that of Galileo. For example, the proposed integrity scheme is directly applicable to a number of Receiver Autonomous Integrity Monitoring (RAIM) formulations that consider a probability of HMI. Other integrity formulations such as classical RAIM, the Wide Area Augmentation System (WAAS), and the European Geostationary Navigation Overlay Service (EGNOS) are based on a determination of protection level (PL)— instead of determination of the probability of HMI— and a comparison to alarm limits. In this case, the computed quantity that is indicative of a reliability of determined navigation information would apply to the PL, and the first and second levels of reliability would apply to two distinct alarm limits, one for starting the navigation operation and one for continuing the ongoing navigation operation.

Simulations have shown that the proposed integrity scheme is capable of reducing the continuity risk while still fulfilling the availability performance requirement, e.g. for a Galileo mission segment composed of 30 monitoring stations (Galileo Sensor Stations, GSS), 7 Uplink Stations (ULS), 2 communication lines per GSS, 1 communication line per ULS, for first and second thresholds of, respectively, TH_start = 10 ¹³ and TH_cont = 1.7 · 10 ⁷ .

Next, exemplary embodiments of the disclosure will be described with reference to Fig. 1 to Fig. 7.

Fig. 1 schematically illustrates an example of a GNSS configuration to which embodiments of the disclosure may be applied. In general, a GNSS receiver device 10 may receive signals from a plurality of GNSS satellites 20, e.g. GNSS satellites 20 that are in (unobstructed) view of the GNSS receiver device 10. The GNSS receiver device 10 may comprise a GNSS receiver for receiving the GNSS signals from the plurality of GNSS satellites, and a computation unit that is configured to determine (e.g., calculate) navigation information on the basis of the GNSS signals received by the GNSS receiver (see Fig. 7). The navigation information may be indicative of (e.g., include) a position of the GNSS receiver device 10. That is, the computation unit may perform position detection on the basis of the received GNSS signals. Integrity information and/or further information required for performing integrity assessment at the GNSS receiver device 10 may be transmitted to the GNSS receiver device 10 by the mission segment of the GNSS service. Transmission of the integrity information and the further information may be performed through the plurality of GNSS satellites 20. The mission segment may include a plurality of interconnected ground- based monitoring stations 30 for monitoring the GNSS satellites 20. The mission segment may further include one or more uplink stations 40 interconnected with the monitoring stations 30, for transmitting the integrity information to the plurality of GNSS satellites 20 for relaying to the GNSS receiver device 10.

Fig. 2 is a flowchart schematically illustrating an example of a method for determining integrity information for a GNSS receiver device (e.g., a user of the GNSS receiver device), according to embodiments of the disclosure. The steps of Fig. 2 may be performed, for example, by the mission segment of the GNSS service. In general, the steps of Fig. 2 may be said to be performed by or at a ground station.

At step S2010, first information (first data) that is indicative of a status of the plurality of GNSS satellites is determined. The status may be an operational status of the GNSS satellites (e.g., for each individual GNSS satellite), and may include an operational state of the GNSS satellites. For example, the status may be indicative of whether or not a given GNSS satellite is faulty, and in general, of whether (or to which degree) the GNSS signal from the given GNSS satellite should be relied upon for position determination at the GNSS receiver device. The first information may be determined by monitoring the plurality of GNSS satellites, in particular by monitoring a status of the plurality of GNSS satellites.

At step S2020. the first information is transmitted to the GNSS receiver device. This transmission may proceed through one or more (potentially all) of the plurality of GNSS satellites. In more detail, transmission may proceed through uplink transmission to one or more (potentially all) of the plurality of GNSS satellites, and subsequent downlink transmission from the one or more (potentially all) of the plurality of GNSS satellites to the GNSS receiver device.

At step S2030, second information (second data) indicative of a status of the ionosphere or part of the ionosphere is obtained. The part of the ionosphere may relate to a portion of the ionosphere that is passed by the GNSS signals on their course to the GNSS receiver device and/or the monitoring stations of the mission segment. In general, the part of the ionosphere may be a portion of the ionosphere between each of the plurality of GNSS satellites and earth. The second information may be indicative of a degree of ionospheric activity and/or an impact of ionospheric scintillations, for example. The second information may be determined (e.g., calculated) on the basis of an analysis of GNSS signals received from the GNSS satellites and/or observation of solar activity, or may be acquired from an external source. At step S2040. a first level of reliability is determined (e.g., calculated). The first level of reliability may be a level of reliability of navigation information determined at the GNSS receiver device that must be satisfied if commencing a navigation operation (such as, for example a critical navigation operation) is intended. A state in which the navigation operation relying on the navigation information may be commenced may be indicated by a first indication that may be generated at the GNSS receiver device, for example.

In more detail, the first level of reliability may be determined in such a manner that the navigation operation relying on the navigation information may be commenced if a first quantity indicative of a reliability of the navigation information satisfies the first level of reliability. The first quantity may be indicative of (e.g., correspond to, or be) a probability that the navigation information is HMI. The first level of reliability may correspond to a first threshold for the probability that the navigation information is HMI. Thus, the first threshold may be said to be generated on the basis of the second information. When using the first threshold, it may be determined that the navigation operation relying on the determined navigation information may be commenced (and the first indication may be generated accordingly) if the probability that the navigation information is HMI is below the first threshold. The first threshold may thus be referred to as availability threshold (TH_START). The first quantity may be obtainable (e.g., calculable), for example at the GNSS receiver device, on the basis of the first information and third information indicative of a geometry (spatial arrangement, e.g. positions) of the plurality of GNSS satellites. For example, the first quantity may be obtainable (e.g., calculable) on the basis of the status and geometry (spatial arrangement, e.g. positions) of the plurality of GNSS satellites.

The first level of reliability may be determined on the basis of the second information. That is, the first level of reliability may be determined on the basis of the status of the ionosphere or the part of the ionosphere. The higher the degree of activity and/or impact of ionospheric scintillations, the higher the first level of reliability may be. For the first level of reliability corresponding to the first threshold, a higher degree of activity and/or impact of ionospheric scintillations may translate into a lower (i.e., more stringent) threshold for the probability that the determined navigation information is HMI.

At step S2050. an indication of the first level of reliability is transmitted to the GNSS receiver device, for example as part of the integrity information. The indication may be transmitted to the GNSS receiver device through one or more (potentially all) GNSS satellites, for example through an uplink station and one or more (potentially all) GNSS satellites. Then, the method of Fig. 2 may end or return to step S2010 for continuous operation. For example, the sequence of steps of Fig. 2 may be run through continuously in a loop, such as for each epoch or each predetermined multiple of epochs. Notably, unless steps require certain other steps as prerequisites, the aforementioned steps may be performed in any order and the exemplary order illustrated in Fig. 2 is understood to be non-limiting.

Fig. 3 is a flowchart schematically illustrating additional steps that may be performed in the context of the method of Fig. 2. The steps of Fig. 3 may be performed, for example, at the GNSS receiver device 10. It is understood that in addition to the steps illustrated in Fig. 3, the GNSS receiver device may (continuously) determine navigation information indicative of (e.g., including) a position of the GNSS receiver device on the basis of received GNSS signals.

At step S3010, the first information determined at step S2010 and transmitted to the GNSS receiver device at step S2020 is received. Further, the (indication of the) first level of reliability determined at step S2040 and transmitted to the GNSS receiver device at step S2050 is received. The first information and/or first level of reliability may be received via relaying by the GNSS satellites, i.e., may be received in the same manner as GNSS signals from the GNSS satellites are received.

In addition, the third information indicative of the geometry (spatial arrangement, e.g. positions) of the plurality of GNSS satellites may be obtained. The third information may be obtained from the mission segment, or may be derived from known ephemerides of the plurality of GNSS satellites. The third information may include information on GNSS satellites that are about to leave the field of view of the GNSS receiver device, for example.

At step S3020, the first quantity indicative of the reliability of the determined navigation information is determined (e.g., calculated). The first quantity may be determined (e.g., calculated) on the basis of the received first information and the third information determined at step S3010. As indicated above, the first quantity may be a probability that the determined navigation information is HMI. At step S3030. it is determined whether the first quantity determined at step S3020 satisfies the first level of reliability. For example, the probability that the navigation information is HMI may be compared to the first threshold, and it may be judged that the first quantity satisfies the first level of reliability if the probability that the navigation information is HMI is below the first threshold. This may involve comparing the first quantity to the first threshold for a predetermined period of time, and judging that the first quantity satisfies the first level of reliability if the first quantity is below the first threshold throughout the predetermined period of time. The predetermined period of time may be on the order of few minutes, e.g. 150 seconds. Otherwise, it may be judged that the first quantity does not satisfy the first level of reliability.

If the first quantity is found to satisfy the first level of reliability (Yes at step S3030), the first indication may be generated atstep S3040. Otherwise (No atstep S3030), the method may proceed to step S3050 without generating the first indication. The first indication may be presented to the user of the GNSS receiver device, for example in visual and/or acoustic form.

If no navigation operation is currently in progress, the method of Fig. 3 may end at this point or return to step S3010. On the other hand, if a navigation operation is already in progress, step S3030 and step S3040 may be skipped, and the method may proceed straight from step S3020 to step S3050.

At step S3050. it is determined whether the first quantity determined at step S3020 satisfies a second level of reliability. The second level of reliability may be a level of reliability of navigation information determined at the GNSS receiver device that must be satisfied if continuing an ongoing navigation operation (such as, for example a critical navigation operation) is intended. In other words, the second level of reliability may have such a value that an ongoing navigation operation relying on the determined navigation information may be continued if the first quantity indicative of the reliability of the navigation information satisfies the second level of reliability.

A state in which the navigation operation relying on the navigation information may be continued may be indicated by a second indication that may be generated at the GNSS receiver device, for example. Alternatively, or in addition, a state in which the navigation operation relying on the navigation information may not be continued (i.e., should be aborted) may be indicated by a third indication that may be generated at the GNSS receiver device, for example. In general, either one of the second and third indications may be seen as an indication of whether the ongoing navigation operation may be continued. If only generation of the third indication is foreseen (e.g., in the form of an alarm to abort the ongoing navigation operation), absence of the third indication may be seen as an indication that the navigation operation relying on the determined navigation information may be continued. In the alternative, if generation thereof is foreseen, absence of the second indication may be seen as an indication that the ongoing navigation operation should be aborted.

Likewise, a state in which the navigation operation relying on the navigation information should not be commenced may be indicated by a fourth indication. The fourth indication may be presented to the user of the GNSS receiver device, for example in visual and/or acoustic form. Generation of the fourth indication in case that the navigation operation should not be commenced may be foreseen additionally or alternatively to generating the first indication in case that the navigation information may be commenced. In general, either one of the first and fourth indications may be seen as an indication of whether the navigation operation relying on the determined navigation operation may be commenced. If only generation of the fourth indication is foreseen (e.g., in the form of an alarm not to start a navigation operation relying on the determined navigation information), absence of the fourth indication may be seen as an indication that the navigation operation relying on the determined navigation information may be commenced. In the alternative, if generation thereof is foreseen, absence of the first indication may be seen as an indication that the navigation operation should not be commenced.

The second level of reliability may correspond to a second threshold for the probability that the navigation information is HMI. In this case, the probability that the navigation information is HMI may be compared to the second threshold, and it may be judged that the first quantity satisfies the second level of reliability if the probability is below the second threshold. Otherwise, it may be judged that the first quantity does not satisfy the second level of reliability. Here, an instantaneous exceeding of the second threshold by the probability that the navigation information is HMI may be sufficient forjudging that the first quantity does not satisfy the second level of reliability. In other words, when using the second threshold, it may be determined that the navigation operation relying on the determined navigation information may be continued (and the second indication may be generated accordingly) if the probability that the navigation information is HMI is below the second threshold. The second threshold may thus be referred to as continuity threshold (TH_cont).

As indicated above, the first level of reliability is determined dynamically at step S2040. The second level of reliability may be a fixed level (e.g., corresponding to a fixed threshold). For example, the second level of reliability may be stored at the GNSS receiver device.

In any case, the first level of reliability may be determined dynamically in such a manner that the second level of reliability is a lower limit for the dynamically generated first level of reliability, i.e. such that the first level of reliability is at least as stringent as the second level of reliability. If the first and second levels of reliability are represented by respective first and second thresholds for the probability that the determined navigation information is HMI, this translates into the first threshold being lower than the second threshold. In embodiments, the first threshold may be equal to the second threshold in extremal cases. Thus, in general, the first threshold will be different from the second threshold and will be smaller than the second threshold. In terms of reliabilities, the first level of reliability will be different from the second level of reliability and will be more stringent than the second level of reliability. In embodiments, the first level of reliability may be as stringent as the second level of reliability in extremal cases.

If the first quantity is found to satisfy the second level of reliability (Yes at step S3050), the second indication may be generated at step S3060. Otherwise (No at step S3050), the method may end or return to step S3010 for continuous operation without generating the second indication. In addition or alternatively, as in the case of Fig. 3, the third indication may be generated. The second indication (and/or third indication) may be presented to the user of the GNSS receiver device, for example in visual and/or acoustic form.

If no navigation operation is currently in progress, steps S3050 and step S3060 may be skipped. Then, the method of Fig. 3 may end or return to step S3010 for continuous operation. For example, the sequence of steps of Fig. 3 may be run through continuously in a loop, once per predetermined period of time, such as for each epoch or each predetermined multiple of epochs, for example.

Notably, unless steps require certain other steps as prerequisites, the aforementioned steps may be performed in any order and the exemplary order illustrated in Fig. 3 is understood to be non-limiting.

Fig. 4 is a flowchart schematically illustrating an example of another method for determining integrity information according to embodiments of the disclosure. The method of Fig. 4 may be performed at the GNSS receiver device. Unless indicated otherwise, the steps of Fig. 4 correspond to respective steps of Fig. 3, and respective analogous statements apply.

At step S4010, first information indicative of a status of the plurality of GNSS satellites is received. The first information may be received for example from the mission segment of the GNSS service, and in general, from a ground station. The first information may have been determined as described above with reference to step S2010.

At step S4020, the first quantity indicative of the reliability of the determined navigation information is determined (e.g., calculated). The first quantity may be determined (e.g., calculated) on the basis of the first information received at step S4010 and information indicative of the geometry (spatial arrangement, e.g. positions) of the plurality of GNSS satellites. This information (which may correspond to the third information described above) may be obtained beforehand from the mission segment, or may be derived beforehand from known ephemerides of the plurality of GNSS satellites. This information may include information on GNSS satellites that are about to leave the field of view of the GNSS receiver device, for example. As indicated above, the first quantity may be a probability that the determined navigation information is HMI.

Then, at step S4030, it is determined whether the first quantity determined at step S4020 satisfies a first level of reliability. For example, the probability that the navigation information is HMI may be compared to a first threshold corresponding to the first level of reliability, and it may be judged that the first quantity satisfies the first level of reliability if the probability that the navigation information is HMI is below the first threshold. This may involve comparing the first quantity to the first threshold for a predetermined period of time, and judging that the first quantity satisfies the first level of reliability if the first quantity is below the first threshold throughout the predetermined period of time. The predetermined period of time may be on the order of few minutes, e.g. 150 seconds. Otherwise, it may be judged that the first quantity does not satisfy the first level of reliability. If the first quantity is found to satisfy the first level of reliability (Yes at step S4030), the first indication may be generated at step 43040. The first indication may be presented to the user of the GNSS receiver device, for example in visual and/or acoustic form. Otherwise (No at step S4030), the method may proceed to step S4050 without generating the first indication. As in the case of Fig. 3, the fourth indication may be generated alternatively or additionally to generating the first indication. The fourth indication may be presented to the user of the GNSS receiver device, for example in visual and/or acoustic form.

If no navigation operation is currently in progress, the method of Fig. 4 may end at this point or return to step S4010. On the other hand, if a navigation operation is already in progress, step S4030 and step S4040 may be skipped, and the method may proceed straight from step S4020 to step S4050.

At step S4050. it is determined whether the first quantity determined at step S4020 satisfies a second level of reliability. For example, the probability that the navigation information is HMI may be compared to a second threshold corresponding to the second level of reliability, and it may be judged that the first quantity satisfies the second level of reliability if the probability that the navigation information is HMI is below the second threshold. Otherwise, it may be judged that the first quantity does not satisfy the second level of reliability. Here, an instantaneous exceeding of the second threshold by the probability that the navigation information is HMI may be sufficient forjudging that the first quantity does not satisfy the second level of reliability.

If the first quantity is found to satisfy the second level of reliability (Yes at step S4050), the second indication may be generated at step S4060. The second indication may be presented to the user of the GNSS receiver device, for example in visual and/or acoustic form. Otherwise (No at step S4050), the method may end or return to step S4010 for continuous operation without generating the second indication. Additionally, the third indication may be generated. The third indication may be presented to the user of the GNSS receiver device, for example in visual and/or acoustic form.

If no navigation operation is currently in progress, steps S4050 and step S4060 may be skipped. As in the case of the method of Fig. 2 and Fig. 3, the first level of reliability may be a level of reliability of navigation information determined at the GNSS receiver device that must be satisfied if commencing a navigation operation (such as, for example a critical navigation operation) is intended, and statements analogous to those made above apply. Further, the second level of reliability may be a level of reliability of navigation information determined at the GNSS receiver device that must be satisfied if continuing an ongoing navigation operation (such as, for example a critical navigation operation) is intended, and statements analogous to those made above apply.

This time however, the first and second levels of reliability may be both fixed levels of reliability. The first level of reliability may strictly correspond to a higher required reliability than the second level of reliability. This translates into the first threshold being lower (i.e., more stringent) than the second threshold. The first and second levels of reliability (e.g., first and second thresholds) may be stored at the GNSS receiver device, e.g. in a nonvolatile memory of the GNSS receiver device. Alternatively or additionally, the first and second levels of reliability (e.g., first and second thresholds) may be broadcast (i.e., transmitted to the GNSS receiver device) by the mission segment at appropriate timings, e.g. periodically.

Then, the method of Fig. 4 may end or return to step S4010 for continuous operation. For example, the sequence of steps of Fig. 4 may be run through continuously in a loop, once per predetermined period of time, such as for each epoch or each predetermined multiple of epochs, for example.

Notably, unless steps require certain other steps as prerequisites, the aforementioned steps of Fig. 4 may be performed in any order and the exemplary order illustrated in Fig. 4 is understood to be non-limiting.

Fig. 5A schematically illustrates a situation in which a single threshold (TH) for a reliability of determined navigation information is applied, for both determining whether a navigation operation relying on the navigation information may be commenced and whether an ongoing navigation operation relying on the navigation information may be continued. In this figure, reference 500 indicates an exemplary relative distribution N(PHMI) of the probability PHMI that the navigation information is HMI, reference 510 indicates the single threshold (TH), reference 530 indicates a range that is sensitive to ionospheric scintillations, and reference 520 indicates a range for which the GNSS service is unavailable. In particular, the range 530 that is sensitive to ionospheric scintillations is a range of probabilities that the navigation information is HMI for which the navigation operation could be commenced (availability requirement satisfied), for which however small changes in the user conditions due to e.g. ionospheric scintillations would result in a continuity event (i.e., an ongoing navigation operation would need to be aborted for security reasons). Such ionospheric scintillations could result in an altered evaluation of the status of one or more GNSS satellites by the mission segment, which would then result (via a change in the first information) in a higher determined value of the probability that the navigation information is HMI. Put differently, the range 530 that is sensitive to ionospheric scintillations relates to unfavorable satellite geometries for which minute changes in ionospheric conditions (e.g., ionospheric scintillations) would result in a continuity event, for example for reasons of one or more of the GNSS satellites not being considered as reliable by the mission segment anymore, or the mission segment loosing track of one or more of the GNSS satellites (which would be reflected in the first information).

By contrast, Fig. 5B illustrates an example of a situation according to embodiments of the disclosure in which two distinct thresholds TH_start and TH_cont are applied for the reliability of determined navigation information. In this figure, reference 500 again indicates an exemplary relative distribution N(PHMI) of the probability PHMI that the navigation information is HMI, reference 540 indicates the first threshold (availability threshold TH_start), reference 550 indicates the second threshold (continuity threshold TH_cont), reference 570 indicates a range that is sensitive to ionospheric scintillations, and reference 560 indicates a range for which the GNSS service is unavailable. Integrity is maintained by enforcing the second threshold 550, which may essentially correspond to (e.g., be equal to) the single threshold 510 in the technique of Fig. 5A. As can be seen from the figure, the first threshold 540 is lower (more stringent) than the second threshold 550. A degradation of the reliability of the determined navigation information (i.e., an increase of the probability that the navigation information is HMI) in the sensitive range 570 this time would not result in a continuity event (i.e., the probability that the determined navigation information is HMI would not exceed the second threshold 550). The reason is that unfavorable satellite geometries are excluded from the outset by enforcing the first threshold 540 when judging whether the navigation operation relying on the determined navigation information can be started.

Broadly speaking, a key aspect of the present disclosure is to use two distinct thresholds that enable a trade-off between continuity and availability. To his end, the two thresholds may be either fixed with different set values, or one of them may be fixed, and the other may be determined dynamically, taking into account a status of the ionosphere and/or an impact of ionospheric scintillations. The lower threshold may be said to relate to a more demanding integrity risk, and the higher threshold may be said to relate to the nominal integrity risk. This enables to reduce the likelihood of continuity events in which an ongoing navigation operation has to be aborted for security reasons. Moreover, not using a single threshold for trying to comply with availability and continuity allows to relax constraints on the system design of the GNSS service (e.g. with regard to the number and locations of monitoring stations).

Advantageously, this concept does not require a new computation at the user level, except for distinguishing between the (first) threshold for availability and the (second) threshold for continuity.

It is understood that the proposed method of determining integrity information may be implemented by an apparatus (e.g., implemented by or included in a ground station) for determining integrity information and/or by a GNSS receiver device. Such apparatus and/or GNSS receiver device may comprise respective units adapted to carry out respective method steps described above. An example of an apparatus 600 for determining integrity information according to embodiments of the disclosure is schematically illustrated in Fig. 6. For instance, such apparatus 600 may comprise a first information determination unit 611 adapted to perform aforementioned step S2010, a transmission/reception unit 620 coupled (e.g., connected) to an antenna 630 and adapted to perform aforementioned steps S2020 and S2050, a second information determination unit 612 adapted to perform aforementioned step S2030, and a reliability level determination unit 613 adapted to perform aforementioned step S2040. It is understood that determination units 611, 612, 613 of such apparatus 600 may be embodied by a processor 610 of a computing device that is adapted to perform the processing carried out by each of said respective determination units 611, 612, 613, i.e. that is adapted to carry out each of the aforementioned steps S2010, S2030, and S2040.

An example of a GNSS receiver device 700 according to embodiments of the disclosure is schematically illustrated in Fig. 7. For instance, such GNSS receiver device 700 may comprise a GNSS receiver 720 coupled (e.g., connected) to an antenna 730 and adapted to receive signals from a plurality of GNSS satellites and to perform Step S3010 (and/or step S4010). The GNSS receiver device 700 may further comprise a reliability determination unit 711 adapted to perform aforementioned step S3020 (or step S4020), a first indication generation unit 712 adapted to perform aforementioned steps S3030 and S3040 (or steps S4030 and S4040), a second indication generation unit 713 adapted to perform aforementioned steps S3050 and S3060 (or steps 4050 and S4060), and a navigation information determination unit 714 adapted to determine the navigation information on the basis of the received GNSS signals. The GNSS receiver device 700 may further comprise an output device 740, such as a display and/or a speaker adapted to present the first, second, third and/or fourth indications to a user of the GNSS receiver device 700. It is understood that determination units 711, 712, 713, 714 of such GNSS receiver device 700 may be embodied by a processor 710 of a computing device that is adapted to perform the processing carried out by each of said respective determination units 711, 712, 713, 714, i.e. that is adapted to carry out each of the aforementioned steps S3020, S3030, S3040, S3050, and S3060, or steps S4020, S4030, S4040, S4050, and S4060. It should be noted that the apparatus and system features described above correspond to respective method features that may not be explicitly described, for reasons of conciseness, and vice versa. The disclosure of the present document is considered to extend also to such method features, and vice versa.

It should further be noted that the description and drawings merely illustrate the principles of the proposed method and system. Those skilled in the art will be able to implement various arrangements that, although not explicitly described or shown herein, embody the principles of the invention and are included within its spirit and scope. Furthermore, all examples and embodiment outlined in the present document are principally intended expressly to be only for explanatory purposes to help the reader in understanding the principles of the proposed method and system. Furthermore, all statements herein providing principles, aspects, and embodiments of the invention, as well as specific examples thereof, are intended to encompass equivalents thereof.