How to identify the faulty GPS-INS in dual redundant installation?

Question

If we have two GPS-INS sensors on an aircraft, how can we decide which one is giving the correct measurement? I know that for sensors, we can vote, but what if we have two sensors? Please give me a reference if there is one.

Answer 1

Two is for redundancy in case of a complete failure - not to vote in case of false information.
For that you need more to decide in case something goes wrong (normally you would use an uneven number for that). But luckily there is more - like traditional navaids (VOR, DME, NDB, ...) You can see that on most shorter haul aircraft (where these navaids are likely to be available, they use two systems (failure redundancy), while on long haul you commonly find three systems. But with more and more robust technology this also gets reduced.

Answer 2

If you want a decent solution that may still have availability or accuracy issues, there are two traditional ways of doing fault detection and exclusion: comparison between sensors, and comparing each sensor to a model. You could use both simultaneously to detect a split, then identify which sensor is more likely to be faulty.

Often each sensor is compared to a system model, using statistical hypothesis testing like a chi-squared test, cumulative sum algorithms, or checking Kalman filter innovation values. This is called "model-based fault diagnosis" or "analytic redundancy" in literature. Extended Kalman filters are the industry standard for position and velocity, but you could also look at sliding mode observers, proportional integral observers, or even something much simpler, like an assumption that changes in speed are always below certain thresholds. This lets you exclude a single sensor without performing any cross-checks, but your exclusion is only as good as your model. Covering every practical scenario can be difficult and can give false positives when an INS realigns, satellites drop in and out of the GNSS solutions, and tests points jump around.

Multiple redundancy is traditionally done by assembling several sub-groups or sub-filters, to identify a sub-filter that has good performance. This may be done using sensor models and statistical tests like when we're looking at a single sensor, or it might use the distribution expected from the split between sensors based on their reported HFOM or ANP. The problem in your case is that with only two sensors, you can't get a working combination of multiple sensors in the face of a fault. The only alternative I've seen before is to use a synthetic sensor for comparison, like extrapolating from the previous state using control inputs, but if the noise in that estimate is larger than the sensor faults you're trying to exclude this doesn't add anything.

There seems to be an assumption here you're the blended GPS-INS solution is the only source of position, and not individual INS and GPS? In reality this isn't usually quite the case. Yes, a "tightly coupled" INS that uses individual satellite data is usually better engineered to detect GPS faults than what you could do. On the other hand, there are lots of faults, like on ARINC 429, that you can mostly eliminate by simple comparisons between INS data with GPS. So in reality you rarely have only two position sources in a modern cockpit.

The short answer is that generally you can't exclude faults with only two GNSS-INS with a high level of confidence. Even if you had a good way of resolving ambiguous faults, if one of the systems fails now you have no more fault detection and the pilot can't trust the avionics. As explained further in this answer, while you can do CAT III with two INS, the availability of such a system has to be scrutinized to match safety targets. Less stringent uses like CAT I or EGPWS can use just two INS (or sometimes even one) just fine.