0
$\begingroup$

If we have two GPS-INS sensors on an aircraft, how can we decide which one is giving the correct measurement? I know that for sensors, we can vote, but what if we have two sensors? Please give me a reference if there is one.

$\endgroup$
1
  • $\begingroup$ Each INS tracks its own computed position, not updated by GPS or other inputs; if one INS position diverges significantly from the other, then the GPS position could "break the tie" to identify which INS is navigating poorly (and needs to be replaced by maintenance). $\endgroup$
    – Ralph J
    Aug 30, 2023 at 15:53

2 Answers 2

2
$\begingroup$

Two is for redundancy in case of a complete failure - not to vote in case of false information.
For that you need more to decide in case something goes wrong (normally you would use an uneven number for that). But luckily there is more - like traditional navaids (VOR, DME, NDB, ...) You can see that on most shorter haul aircraft (where these navaids are likely to be available, they use two systems (failure redundancy), while on long haul you commonly find three systems. But with more and more robust technology this also gets reduced.

$\endgroup$
1
$\begingroup$

If you want a decent solution that may still have availability or accuracy issues, there are two traditional ways of doing fault detection and exclusion: comparison between sensors, and comparing each sensor to a model. You could use both simultaneously to detect a split, then identify which sensor is more likely to be faulty.

Often each sensor is compared to a system model, using statistical hypothesis testing like a chi-squared test, cumulative sum algorithms, or checking Kalman filter innovation values. This is called "model-based fault diagnosis" or "analytic redundancy" in literature. Extended Kalman filters are the industry standard for position and velocity, but you could also look at sliding mode observers, proportional integral observers, or even something much simpler, like an assumption that changes in speed are always below certain thresholds. This lets you exclude a single sensor without performing any cross-checks, but your exclusion is only as good as your model. Covering every practical scenario can be difficult and can give false positives when an INS realigns, satellites drop in and out of the GNSS solutions, and tests points jump around.

Multiple redundancy is traditionally done by assembling several sub-groups or sub-filters, to identify a sub-filter that has good performance. This may be done using sensor models and statistical tests like when we're looking at a single sensor, or it might use the distribution expected from the split between sensors based on their reported HFOM or ANP. The problem in your case is that with only two sensors, you can't get a working combination of multiple sensors in the face of a fault. The only alternative I've seen before is to use a synthetic sensor for comparison, like extrapolating from the previous state using control inputs, but if the noise in that estimate is larger than the sensor faults you're trying to exclude this doesn't add anything.

There seems to be an assumption here you're the blended GPS-INS solution is the only source of position, and not individual INS and GPS? In reality this isn't usually quite the case. Yes, a "tightly coupled" INS that uses individual satellite data is usually better engineered to detect GPS faults than what you could do. On the other hand, there are lots of faults, like on ARINC 429, that you can mostly eliminate by simple comparisons between INS data with GPS. So in reality you rarely have only two position sources in a modern cockpit.

The short answer is that generally you can't exclude faults with only two GNSS-INS with a high level of confidence. Even if you had a good way of resolving ambiguous faults, if one of the systems fails now you have no more fault detection and the pilot can't trust the avionics. As explained further in this answer, while you can do CAT III with two INS, the availability of such a system has to be scrutinized to match safety targets. Less stringent uses like CAT I or EGPWS can use just two INS (or sometimes even one) just fine.

$\endgroup$
2
  • $\begingroup$ Hmmm... the 737 has had a Cat III autoland capability for decades with only 2 INS's. Both have to be working, but only 2 are installed. $\endgroup$
    – Ralph J
    Aug 30, 2023 at 21:26
  • $\begingroup$ Thanks @RalphJ, I've updated my answer accordingly $\endgroup$
    – Cody P
    Aug 31, 2023 at 0:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .