If you want a decent solution that may still have availability or accuracy issues, there are two traditional ways of doing fault detection and exclusion: comparison between sensors, and comparing each sensor to a model.  You could use both simultaneously to detect a split, then identify which sensor is more likely to be faulty.

Often each sensor is compared to a system model, using statistical hypothesis testing like a chi-squared test, cumulative sum algorithms, or checking Kalman filter innovation values. This is called "model-based fault diagnosis" or "analytic redundancy" in literature. Extended Kalman filters are the industry standard for position and velocity, but you could also look at sliding mode observers, proportional integral observers, or even something much simpler, like an assumption that changes in speed are always below certain thresholds. This lets you exclude a single sensor without performing any cross-checks, but your exclusion is only as good as your model. Covering every practical scenario can be difficult and can give false positives when an INS realigns, satellites drop in and out of the GNSS solutions, and tests points jump around.

Multiple redundancy is traditionally done by assembling several sub-groups or sub-filters, to identify a sub-filter that has good performance.  This may be done using sensor models and statistical tests like when we're looking at a single sensor, or it might use the distribution expected from the split between sensors based on their reported HFOM or ANP. The problem in your case is that with only two sensors, you can't get a working combination of multiple sensors in the face of a fault. The only alternative I've seen before is to use a synthetic sensor for comparison, like extrapolating from the previous state using control inputs, but if the noise in that estimate is larger than the sensor faults you're trying to exclude this doesn't add anything.

The short answer is that generally you can't exclude faults with only two GNSS-INS with a high level of confidence. Even if you had a good way of resolving ambiguous faults, if one of the systems fails now you have no more fault detection and the pilot can't trust the avionics. As explained further in [this answer][1], availability with two INS may be problematically low for CAT III Autoland, but other uses like CAT I or EGPWS can likely use just one or two INS.


  [1]: https://aviation.stackexchange.com/a/46678/14613