Return to Answer

If you want a decent solution that may still have availability or accuracy issues, there are two traditional ways of doing fault detection and exclusion: comparison between sensors, and comparing each sensor to a model. You could use both simultaneously to detect a split, then identify which sensor is more likely to be faulty.

Often each sensor is compared to a system model, using statistical hypothesis testing like a chi-squared test, cumulative sum algorithms, or checking Kalman filter innovation values. This is called "model-based fault diagnosis" or "analytic redundancy" in literature. Extended Kalman filters are the industry standard for position and velocity, but you could also look at sliding mode observers, proportional integral observers, or even something much simpler, like an assumption that changes in speed are always below certain thresholds. This lets you exclude a single sensor without performing any cross-checks, but your exclusion is only as good as your model. Covering every practical scenario can be difficult and can give false positives when an INS realigns, satellites drop in and out of the GNSS solutions, and tests points jump around.

Multiple redundancy is traditionally done by assembling several sub-groups or sub-filters, to identify a sub-filter that has good performance. This may be done using sensor models and statistical tests like when we're looking at a single sensor, or it might use the distribution expected from the split between sensors based on their reported HFOM or ANP. The problem in your case is that with only two sensors, you can't get a working combination of multiple sensors in the face of a fault. The only alternative I've seen before is to use a synthetic sensor for comparison, like extrapolating from the previous state using control inputs, but if the noise in that estimate is larger than the sensor faults you're trying to exclude this doesn't add anything.

The short answer is that generally you can't exclude faults with only two GNSS-INS with a high level of confidence. Even if you had a good way of resolving ambiguous faults, if one of the systems fails now you have no more fault detection and the pilot can't trust the avionics. As explained further in this answer, while you can do CAT III with two INS, the availability of such a system has to be scrutinized to match safety targets. Less stringent uses like CAT I or EGPWS can use just two INS (or sometimes even one) just fine.

If you want a decent solution that may still have availability or accuracy issues, there are two traditional ways of doing fault detection and exclusion: comparison between sensors, and comparing each sensor to a model. You could use both simultaneously to detect a split, then identify which sensor is more likely to be faulty.

Often each sensor is compared to a system model, using statistical hypothesis testing like a chi-squared test, cumulative sum algorithms, or checking Kalman filter innovation values. This is called "model-based fault diagnosis" or "analytic redundancy" in literature. Extended Kalman filters are the industry standard for position and velocity, but you could also look at sliding mode observers, proportional integral observers, or even something much simpler, like an assumption that changes in speed are always below certain thresholds. This lets you exclude a single sensor without performing any cross-checks, but your exclusion is only as good as your model. Covering every practical scenario can be difficult and can give false positives when an INS realigns, satellites drop in and out of the GNSS solutions, and tests points jump around.

Multiple redundancy is traditionally done by assembling several sub-groups or sub-filters, to identify a sub-filter that has good performance. This may be done using sensor models and statistical tests like when we're looking at a single sensor, or it might use the distribution expected from the split between sensors based on their reported HFOM or ANP. The problem in your case is that with only two sensors, you can't get a working combination of multiple sensors in the face of a fault. The only alternative I've seen before is to use a synthetic sensor for comparison, like extrapolating from the previous state using control inputs, but if the noise in that estimate is larger than the sensor faults you're trying to exclude this doesn't add anything.

There seems to be an assumption here you're the blended GPS-INS solution is the only source of position, and not individual INS and GPS? In reality this isn't usually quite the case. Yes, a "tightly coupled" INS that uses individual satellite data is usually better engineered to detect GPS faults than what you could do. On the other hand, there are lots of faults, like on ARINC 429, that you can mostly eliminate by simple comparisons between INS data with GPS. So in reality you rarely have only two position sources in a modern cockpit.

The short answer is that generally you can't exclude faults with only two GNSS-INS with a high level of confidence. Even if you had a good way of resolving ambiguous faults, if one of the systems fails now you have no more fault detection and the pilot can't trust the avionics. As explained further in this answer, while you can do CAT III with two INS, the availability of such a system has to be scrutinized to match safety targets. Less stringent uses like CAT I or EGPWS can use just two INS (or sometimes even one) just fine.

If you want a decent solution that may still have availability or accuracy issues, there are two traditional ways of doing fault detection and exclusion: comparison between sensors, and comparing each sensor to a model. You could use both simultaneously to detect a split, then identify which sensor is more likely to be faulty.

Often each sensor is compared to a system model, using statistical hypothesis testing like a chi-squared test, cumulative sum algorithms, or checking Kalman filter innovation values. This is called "model-based fault diagnosis" or "analytic redundancy" in literature. Extended Kalman filters are the industry standard for position and velocity, but you could also look at sliding mode observers, proportional integral observers, or even something much simpler, like an assumption that changes in speed are always below certain thresholds. This lets you exclude a single sensor without performing any cross-checks, but your exclusion is only as good as your model. Covering every practical scenario can be difficult and can give false positives when an INS realigns, satellites drop in and out of the GNSS solutions, and tests points jump around.

Multiple redundancy is traditionally done by assembling several sub-groups or sub-filters, to identify a sub-filter that has good performance. This may be done using sensor models and statistical tests like when we're looking at a single sensor, or it might use the distribution expected from the split between sensors based on their reported HFOM or ANP. The problem in your case is that with only two sensors, you can't get a working combination of multiple sensors in the face of a fault. The only alternative I've seen before is to use a synthetic sensor for comparison, like extrapolating from the previous state using control inputs, but if the noise in that estimate is larger than the sensor faults you're trying to exclude this doesn't add anything.

The short answer is that generally you can't exclude faults with only two GNSS-INS with a high level of confidence. Even if you had a good way of resolving ambiguous faults, if one of the systems fails now you have no more fault detection and the pilot can't trust the avionics. As explained further in this answer, availability with two INS may be problematically low for CAT III Autoland, but other uses like CAT I or EGPWS can likely use just one or two INS.

If you want a decent solution that may still have availability or accuracy issues, there are two traditional ways of doing fault detection and exclusion: comparison between sensors, and comparing each sensor to a model. You could use both simultaneously to detect a split, then identify which sensor is more likely to be faulty.

Often each sensor is compared to a system model, using statistical hypothesis testing like a chi-squared test, cumulative sum algorithms, or checking Kalman filter innovation values. This is called "model-based fault diagnosis" or "analytic redundancy" in literature. Extended Kalman filters are the industry standard for position and velocity, but you could also look at sliding mode observers, proportional integral observers, or even something much simpler, like an assumption that changes in speed are always below certain thresholds. This lets you exclude a single sensor without performing any cross-checks, but your exclusion is only as good as your model. Covering every practical scenario can be difficult and can give false positives when an INS realigns, satellites drop in and out of the GNSS solutions, and tests points jump around.

Multiple redundancy is traditionally done by assembling several sub-groups or sub-filters, to identify a sub-filter that has good performance. This may be done using sensor models and statistical tests like when we're looking at a single sensor, or it might use the distribution expected from the split between sensors based on their reported HFOM or ANP. The problem in your case is that with only two sensors, you can't get a working combination of multiple sensors in the face of a fault. The only alternative I've seen before is to use a synthetic sensor for comparison, like extrapolating from the previous state using control inputs, but if the noise in that estimate is larger than the sensor faults you're trying to exclude this doesn't add anything.

The short answer is that generally you can't exclude faults with only two GNSS-INS with a high level of confidence. Even if you had a good way of resolving ambiguous faults, if one of the systems fails now you have no more fault detection and the pilot can't trust the avionics. As explained further in this answer, while you can do CAT III with two INS, the availability of such a system has to be scrutinized to match safety targets. Less stringent uses like CAT I or EGPWS can use just two INS (or sometimes even one) just fine.

If you want a decent solution that may still have availability or accuracy issues, there are two traditional ways of doing fault detection and exclusion: comparison between sensors, and comparing each sensor to a model. You could use both simultaneously to detect a split, then identify which sensor is more likely to be faulty.

Often each sensor is compared to a system model, using statistical hypothesis testing like a chi-squared test, cumulative sum algorithms, or checking Kalman filter innovation values. This is called "model-based fault diagnosis" or "analytic redundancy" in literature. Extended Kalman filters are the industry standard for position and velocity, but you could also look at sliding mode observers, proportional integral observers, or even something much simpler, like an assumption that changes in speed are always below certain thresholds. This lets you exclude a single sensor without performing any cross-checks, but your exclusion is only as good as your model. Covering every practical scenario can be difficult and can give false positives when an INS realigns, satellites drop in and out of the GNSS solutions, and tests points jump around.

Multiple redundancy is traditionally done by assembling several sub-groups or sub-filters, to identify a sub-filter that has good performance. This may be done using sensor models and statistical tests like when we're looking at a single sensor, or it might use the distribution expected from the split between sensors based on their reported HFOM or ANP. The problem in your case is that with only two sensors, you can't get a working combination of multiple sensors in the face of a fault. The only alternative I've seen before is to use a synthetic sensor for comparison, like extrapolating from the previous state using control inputs, but if the noise in that estimate is larger than the sensor faults you're trying to exclude this doesn't add anything.

The short answer is that generally you can't exclude faults with only two GNSS-INS with a high level of confidence. Even if you had a good way of resolving ambiguous faults, if one of the systems fails now you have no more fault detection and the pilot can't trust the avionics. As explained further in this answer, certification almost certainly wouldn't be allowed with only two INS for something like CAT III Autoland, but other uses like CAT I or EGPWS can likely use just two INS.

If you want a decent solution that may still have availability or accuracy issues, there are two traditional ways of doing fault detection and exclusion: comparison between sensors, and comparing each sensor to a model. You could use both simultaneously to detect a split, then identify which sensor is more likely to be faulty.

Often each sensor is compared to a system model, using statistical hypothesis testing like a chi-squared test, cumulative sum algorithms, or checking Kalman filter innovation values. This is called "model-based fault diagnosis" or "analytic redundancy" in literature. Extended Kalman filters are the industry standard for position and velocity, but you could also look at sliding mode observers, proportional integral observers, or even something much simpler, like an assumption that changes in speed are always below certain thresholds. This lets you exclude a single sensor without performing any cross-checks, but your exclusion is only as good as your model. Covering every practical scenario can be difficult and can give false positives when an INS realigns, satellites drop in and out of the GNSS solutions, and tests points jump around.

Multiple redundancy is traditionally done by assembling several sub-groups or sub-filters, to identify a sub-filter that has good performance. This may be done using sensor models and statistical tests like when we're looking at a single sensor, or it might use the distribution expected from the split between sensors based on their reported HFOM or ANP. The problem in your case is that with only two sensors, you can't get a working combination of multiple sensors in the face of a fault. The only alternative I've seen before is to use a synthetic sensor for comparison, like extrapolating from the previous state using control inputs, but if the noise in that estimate is larger than the sensor faults you're trying to exclude this doesn't add anything.

The short answer is that generally you can't exclude faults with only two GNSS-INS with a high level of confidence. Even if you had a good way of resolving ambiguous faults, if one of the systems fails now you have no more fault detection and the pilot can't trust the avionics. As explained further in this answer, availability with two INS may be problematically low for CAT III Autoland, but other uses like CAT I or EGPWS can likely use just one or two INS.