Navigation Safety Assurance of a KF-Based GNSS/IMU System: Protection Levels Against IMU Failure

2.1 Definition of an IMU Fault Within a KF-Based GNSS/IMU Navigation System

In this section, we first define an IMU fault to investigate its impact on user navigation integrity and continuity within a KF. In a KF-based GNSS/IMU navigation system, the navigation state is predicted from a kinematic inertial navigation equation, and IMU sensor measurements are utilized as input values to these equations. Thus, a fault in the IMU sensor measurements results in a fault vector in the predicted state and sequentially affects future KF estimates through the recursive estimation process of the KF. The defined fault vector is used in the remainder of this paper to analyze fault impacts on user navigation solutions and to derive PLs that bound IMU sensor faults.

A general dynamic system model of a KF is expressed as in Equation (1):

1

where x is the state vector, F is the state transition matrix, and G_w and G_u are coefficient matrices of the stochastic random noise vector (w) and control input vector (u), respectively. For a KF-based GNSS/IMU navigation system, the state vector includes the attitude ψ, velocity (v), and position (r) navigation states. In addition to these states, the system also estimates the biases included in IMU measurements of an accelerometer (b_a) and a gyroscope (b_g). The GNSS receiver clock drift (clk) and the clock bias drift rate (clkr) are estimated and utilized to formulate the predicted pseudorange. The state vector is shown as in Equation (2):

2

This paper uses a full-state representation to show the generalized algorithm derivation procedure for any EKF. Note that the following derivations, resulting IMU fault definition, and resulting PL equation can be applied to both full-state and error-state extended KFs (EKFs). When implementing these EKFs, the error state version has the advantage of corresponding better to the linear error assumption made as part of this derivation.

Equation (3) shows the kinematic inertial navigation model defined in the Earth-centered, Earth-fixed (ECEF) coordinate frame, which is used to formulate the dynamic system model of the KF:

3

The kinematic model sequentially updates the attitude , velocity , and position , where the subscript eb denotes the state of the origin of the body frame, b, with respect to an ECEF frame, e. The superscript e indicates that the components of the vector are represented along the axes of the ECEF frame. IMU sensor measurements are input to these equations, including the angular rate from the gyroscope and the specific force from the accelerometer , where the subscript ib denotes the measurement of the origin of the IMU body frame with respect to an inertial frame i. The superscript b indicates that the components of the vector are represented along the axes of the IMU body frame. The attitude is estimated from the measured angular rate transformed by the coordinate transformation matrix from the body frame to the Earth frame, . denotes the skew-symmetric matrix of the Earth’s rotation rate. The velocity is updated using the updated attitude, specific force , and acceleration due to gravity . Finally, the position is determined by integrating the velocity.

Now, let us assume that the input IMU measurements have faults, where we denote faulty parameters using an apostrophe (‘). The kinematic expression in Equation (3) is then replaced with Equation (4), which accounts for these faults. Note that faulty IMU sensor measurements ( and ) sequentially cause faults in the attitude , transformation matrix , velocity , and position :

4

These faulty parameters can be expressed as follows:

5

where the quantities after Δ indicate deviations from the nominal parameters due to faulty IMU sensor measurements. By substituting Equation (5) into Equation (4), the states under the fault condition are expressed as in Equation (6):

6

where , and are the resultant fault vectors for the equations of attitude, velocity, and position, respectively. The components of each resultant fault vector are shown in Equation (7):

7

In a KF, the sensor measurements of an accelerometer and a gyroscope are typically modeled as a summation of the true quantity, a constant bias, and Gaussian random noise (Groves, 2007), as in Equation (8):

8

where and represent the true angular rate and the true specific force, b_g and b_a are the biases of a gyroscope and an accelerometer, and w_g and w_a are the gyroscope and accelerometer random noise vectors, respectively. By substituting Equation (8) into Equation (6), the kinematic model under the fault condition can be expressed as functions of the KF states, control input, process noise, and fault vector, as shown in Equation (9):

9

In addition to the navigation states, equations for the IMU sensor biases, receiver clock drift, and clock drift rate are required to complete the system model. As explained earlier, IMU sensor biases are generally augmented in a KF state vector and are continuously estimated from the filter based on an error dynamics model. In a closed-loop KF algorithm, the estimated IMU biases for each axis are fed back and subtracted from an input IMU measurement at the next epoch. However, this bias estimation process is not sufficient to capture IMU faults because 1) IMU faults may not follow the predefined error dynamics model and 2) even if IMU faults are assumed to follow the predefined error model, there is a time delay to perfectly capture the faults. Figure 1 shows the state error of an EKF-based GNSS/IMU navigation system, where an IMU step fault (0.5 m/s² on each axis of the accelerometer) is injected after 40 s of simulation time. The state error increases after the fault injection, but decreases over time because of the estimation and correction of the bias by the filter. It is worth noting that user integrity may be threatened by the increased state error that occurs before the fault is fully mitigated.

• Download figure
• Open in new tab
• Download powerpoint

FIGURE 1

State errors of an EKF-based GNSS/IMU navigation system when an IMU step fault (0.5 m/s² on each axis of the accelerometer) is injected

An IMU sensor exhibits static bias, dynamic bias, scale factor and cross-coupling error, and random noise (Groves, 2007). Well-developed models for each bias are provided in the literature (Bhatti & Ochieng, 2007; Groves, 2007; Zhiqiang & Gebre-Egziabher, 2008). IMU biases are often modeled as static biases or first-order Markov processes. In this paper, static biases are chosen for simplicity in the presence of the requirement for rare-event error bounding, as the focus of this paper is to compute PLs against IMU faults using filter output covariances. While detailed modeling of IMU biases improves estimation accuracy, it increases system complexity by requiring additional KF states for each of the bias components and analysis of uncertain error parameters. In this study, static biases are assumed for the system model, as shown in Equation (10), and conservative variances are applied to the model to assure that the resulting PL can bound the position error:

10

It should be noted that for a given type of IMU sensor fault, its impacts may appear differently in user states, depending on the system model for IMU bias estimation.

The system model for the GNSS receiver clock drift and drift rate is given by Equation (11), where a constant drift rate is assumed (Groves, 2007):

11

Finally, we can express the dynamic model of the KF under the IMU fault condition in a continuous form by representing Equation (11) as Equation (12). The components of this form are shown in Equation (13):

12

13

where f_ẋ is the resultant fault vector included in the dynamic model due to faulty IMU sensor measurements. w_g, w_a, and are random noise vectors for the gyroscope bias, accelerometer bias, and clock drift rate.

The discrete form of Equation (12) is expressed as follows:

14

The discrete forms x_k, Φ_k, Γ_w, w_k, Γ_u, u_k, and f_xk correspond to the continuous forms x, F, G_w, w, G_u, u, and f_ẋ, respectively.

2.2 IMU Fault Propagation Through the KF

This section presents how an IMU fault (defined in the previous section) propagates within a KF. The fault propagates through the KF sequential estimation process, which includes the state prediction and measurement update, as described in Equations (15) and (16), respectively:

15

16

where

• is the predicted state vector at time k;

• is the measurement-updated state vector at time k;

• K_k is the Kalman gain matrix;

• z_k is the measurement vector;

• H_k is the observation matrix.

Under the IMU fault condition, the predicted state at time k follows Equation (17):

17

where is the resultant fault vector included in the predicted state vector. Substituting Equation (17) into Equation (16) yields a measurement-updated state as follows:

18

where represents the Kalman gain matrix corrupted by the faulty IMU sensor measurements. For compactness, we introduce a new matrix . Subsequently, Equation (18) is simplified as follows:

19

Based on the expression derived in Equation (19), the vector is added because of the impact of the faulty IMU measurements at time k. Finally, the state error is derived using the following relation:

20

where the true state is expressed as follows:

21

The resulting state error equation is shown in Equation (22), where ν_k is the vector of measurement noise included in the GNSS measurement, z_k = H_kx_k +ν_k. A detailed derivation of the state error is presented in Appendix A:

22

The derived state error equation indicates that IMU sensor faults sequentially affect the state error. In addition to the current-time fault vector , it is observed that the past-time fault vectors remain in the state error of the previous time , affecting the current-time state error , although their effect degrades over time. The design of an integrity and continuity algorithm should consider these sequential fault impacts to properly assure user navigation safety against IMU fault conditions.

3.1 Integrity and Continuity of a KF-Based GNSS/IMU Navigation System

In this section, we review the concept of integrity and continuity assurance for navigation systems and apply this concept to a KF-based GNSS/IMU navigation system against all sensor fault hypotheses, with an emphasis on the IMU sensor fault hypothesis. Note that prior works on a GNSS/IMU integrated system reported by Bhattacharyya & Gebre-Egziabher (2015), Brenner (1996), Joerger & Pervan (2013), Tanil et al. (2017), Tanil et al. (2018, 2019) assumed that an IMU sensor is fault-free (or that its failure rate is small enough to be negligible) and focused on GNSS fault hypotheses only. However, this assumption is generally untrue, especially for AV applications that utilize low-cost IMU sensors.

Figure 3 shows the integrity and continuity requirements that define the potential risks of the GNSS/IMU navigation system. The left branch represents events that create integrity risk (I_GNSS/IMU). This branch defines the fault hypotheses of the navigation system, which include the nominal condition (I_nominal), where faults occur in neither the GNSS nor the IMU, the GNSS fault condition (I_GNSS), and the IMU sensor fault condition (I_IMU). We assumed that the probability of a simultaneous sensor fault occurring in both the GNSS and the IMU is sufficiently low compared with the total integrity risk requirement, which allows us to neglect the integrity risk of a simultaneous fault condition.

• Download figure
• Open in new tab
• Download powerpoint

FIGURE 3

GNSS/IMU navigation system integrity and continuity requirements

The allocated integrity risk for each hypothesis is achieved by designing the risk in the integrity algorithms, including fault monitors and PL calculations (or, equivalently, integrity risk probability quantification). Integrity algorithms under a hypothesis A are designed to achieve a missed detection probability (P_md,A), which is approximately determined by dividing the allocated risk (I_A) by the prior probability of fault hypothesis A . Detailed algorithms for monitor design and PL calculation under the IMU sensor fault hypothesis are described in the following section.

Loss of integrity (LOI) of the integrated navigation system occurs when LOI takes place in any fault hypothesis, given that the solution of the integrated navigation system is computed by fusing GNSS and IMU measurements. In other words, given that the total integrity requirement of a navigation system is fixed, the requirement allocated to each sensor becomes tighter by including the IMU sensor when compared with a GNSS-only navigation system. This tightened integrity risk does not necessarily indicate availability loss. Generally, a tighter integrity risk allocation leads to a larger minimum detectable error (MDE) of a monitor, which may increase PLs and lead to availability loss. However, the benefit of adding a sensor is likely to compensate for the tighter integrity risk allocations to each sensor that result from dividing the overall integrity risk requirement into smaller pieces. In the ideal case, integration of an additional sensor makes the system noise level very small, such that the overall MDE decreases even though the tightened integrity allocation to each sensor is smaller. Therefore, additional analyses on various factors that depend on sensor quality, including nominal noise level, fault monitoring performance, and continuity performance after sensor integration, are required to elucidate the impact of additional sensors on system availability. Availability analysis is beyond the scope of this paper, as the main focus here is the introduction of a new algorithm for integrity and continuity evaluation against IMU sensor faults.

In addition to integrity, continuity assurance is also important for AV applications. Continuity is a measure of the capability to continuously generate navigation solutions during operation without unexpected interruptions (ICAO, 1996). Previous work on requirements for autonomous cars has shown that continuity assurance is required during critical operations, including lane changes and overtaking (Reid, Pervez, et al., 2019). For drones, critical operations include landing and flight close to infrastructure. For the use of an integrated navigation system in a safety-critical AV application, an algorithm that protects integrity while simultaneously meeting the allocations to each component of continuity risk should be designed to meet the required level of continuity for each AV application.

The right branch in Figure 3 shows a continuity risk event tree (C_GNSS/IMU) of the GNSS/IMU navigation system. Loss of continuity (LOC) of the integrated navigation system is allocated into LOC due to GNSS faults (C_GNSS) and LOC due to IMU faults (C_IMU). There are two ways to define the total LOC given a LOC event in any single sensor depending on the system design approach: “series” or “parallel.” In the “series” approach, the total LOC is defined as the probability of any sensor losing its continuity. In other words, integrated system continuity is maintained only when both GNSS and IMU sensors maintain their individual continuity. Assuming that the total continuity requirement for the application of interest is known, the division of the total continuity budget between the two sensors results in a stricter continuity allocation for each sensor compared with the case in which only a single sensor is used. This approach is conservative by limiting the condition that satisfies total system continuity to the case in which both sensors are properly functioning.

In contrast, in the “parallel” approach to continuity of the integrated navigation system, continuity is satisfied when either of the sensors is working. For a fixed continuity risk of each sensor, this approach significantly reduces the total continuity risk of the integrated navigation system. This lowered continuity risk can be seen as an increase in system robustness, which is one of the key advantages of using multiple sensors. Note that if GNSS is integrated with multiple IMUs of which only one IMU needs to work, the IMU function would be in parallel, and the work in this paper can be extended to that case. However, in this paper, we will make the most conservative assumption and assume that the sensors are in series, meaning that the target application requires both GNSS and IMU sensors to be functional during the entire period of operation.

LOC of a sensor can be caused either by a true alert (P_ta,A) or a false alert (P_fa,A), as shown in Figure 3. LOC due to a true alert occurs when a monitor detects actual sensor faults or the fault makes itself apparent (e.g., when the sensor stops providing measurements). LOC due to a false (or “fault-free”) alert takes place when no fault occurs but a monitor issues an erroneous alert leading to exclusion of that sensor from use in navigation. The required (or sub-allocated) false alert probability can be met by adjusting the monitor detection threshold.

As explained in the previous paragraph, a true alert is dependent on the prior probability of the actual sensor faults used for AVs. Thus, the continuity risk of a true alert becomes a fixed (albeit not precisely known) value once the sensor is chosen. The prior probability of GNSS faults has been extensively investigated in previous studies (Department of Defense, 2020). For example, advanced RAIM assumes the prior probability of faults as 10⁻⁵/h/satellite for a global positioning system (GPS) satellite (FAA, 2021). In contrast, the prior probability of IMU sensor faults is not as well understood and is highly dependent on IMU sensor quality. This risk can be roughly estimated from the mean time between failures (MTBF) in the datasheets released by IMU manufacturers. For example, a datasheet of a tactical-grade IMU provides the MTBF as 1 failure per 100,000 h (EMCORE, n.d.). This value can be converted to 10⁻⁵ failures per hour. However, the use of these values for assuring system continuity is limited because most of the published datasheets provide data derived under idealized test conditions and do not reflect the actual operating conditions of AVs. Further investigations are required before we can confidently apply these failure rates to a certified continuity algorithm. However, for this study, the probability of LOC of an IMU sensor caused by a true alert is pre-allocated based on the MTBF specification provided by the IMU manufacturer, as described above.

In contrast, the false alert probability can be controlled by adjusting the monitor threshold. The false alert probability decreases as the monitor threshold is increased, which leads to larger PLs if the same missed detection probability is maintained for integrity assurance. An IMU fault monitoring algorithm is designed to assure the false alert probability allocated to the IMU fault hypothesis (P_fa,IMU).

The remainder of this paper focuses on the false alert continuity risk, assuming that the risk due to true alerts (P_ta,IMU) is known and pre-allocated. The following section introduces the IMU fault monitoring algorithm designed in this study.

3.2 KF Innovation-Based IMU Fault Monitor

This study proposes utilizing a KF innovation vector to detect IMU sensor faults. Innovation vectors have been widely used for GNSS fault monitoring within a KF. Previous studies (Crespillo et al., 2017; Tanil et al., 2017; Tanil et al., 2018, 2019), addressed earlier in Section 1, developed GNSS fault monitoring and integrity risk evaluation algorithms using KF innovations. In the case of a KF-based GNSS fault monitor, a GNSS fault can occur in either a single pseudorange or multiple pseudorange measurements. Thus, a KF innovation monitor accordingly assumes either a single fault (Crespillo et al., 2017) or multiple simultaneous faults (Tanil et al., 2017; Tanil et al., 2018, 2019) in its test statistics. These assumptions are valid because the faulty subset of GNSS measurements only affects corresponding KF innovations computed based on the subset.

In contrast, an IMU sensor fault simultaneously corrupts all KF innovation vectors because each KF innovation is formulated using the common erroneous predicted state determined by the faulty IMU sensor measurements. In response, the IMU fault monitor is developed based on the fact that every innovation is affected by the IMU sensor fault.

Figure 4 illustrates the KF-based IMU fault monitoring algorithm. The KF innovation under nominal conditions for the j-th GNSS measurement at epoch k, q_k,j|H0, is as follows:

23

• Download figure
• Open in new tab
• Download powerpoint

FIGURE 4

Illustration of KF innovation-based IMU fault monitoring concept

PDF: Probability density function

This expression is computed as the difference between the j-th GNSS measurement z_k,j and the j-th predicted range , where H_k,j is the j-th row of matrix H_k, as shown in Equation (23). The innovation vector consists of KF innovations formulated by the total of m GNSS pseudorange measurements. Under fault-free conditions, this quantity follows a zero-mean Gaussian distribution with a variance of S_jj:

24

where the subscript jj indicates the j-th diagonal element of the matrix. The variance is a function of the covariance matrices of GNSS measurement noise, R, and the predicted state, .

Under an IMU fault condition H_IMU, the test statistic is assumed to follow a biased Gaussian distribution with a mean of μ_j,IMU:

25

where the mean is computed as in Equation (26), which is a function of the bias fault vector defined in Section 2.1:

26

To monitor for an IMU sensor fault, each KF innovation must be compared with its corresponding threshold. The monitor then declares an IMU sensor fault if any innovation test statistic exceeds its threshold. Let T_j be the detection threshold of the j-th KF innovation. Under the fault-free hypothesis H₀, the false alert probability of the j-th innovation is defined as the probability that the test statistic q_j exceeds the threshold T_j, as shown in Equation (27):

27

Note that the prior probability of the fault-free condition, , can be approximated as unity (this is slightly conservative), considering the very low prior probability of sensor failure. According to the above definition of the false alert probability in the j-th monitor, a threshold is defined as in Equation (28):

28

Here, Q⁻¹ is the inverse of the unit Gaussian cumulative distribution function.

Considering the decision logic of the IMU monitor that an IMU sensor fault is declared if any innovation test statistic exceeds its threshold, a false alert occurs when any of the individual KF innovation monitors generate a false alert. Thus, is defined as the probability of a union of false alert events for each KF innovation, which should be less than or equal to the allocated requirement, as in Equation (29):

29

Figure 5 shows an example result for this KF innovation-based IMU fault monitor at one example time epoch after an arbitrary fault vector has been injected. An IMU sensor step fault (sudden change) with a magnitude of 0.5 m/s² is injected into each axis of the accelerometer. The other simulation conditions are the same as those applied to the simulations that will be introduced in Section 3.3 and Table 1. In Figure 5, all KF innovations were simultaneously affected, with two innovations ( and ) exceeding their thresholds. Based on the detection logic of the monitor, the system declares an IMU fault.

• Download figure
• Open in new tab
• Download powerpoint

FIGURE 5

Example result of the KF innovation-based IMU fault monitor

Two KF innovations exceed their thresholds, and the system declares an IMU fault.

3.3 PL Against IMU Sensor Faults

This section derives PLs against IMU sensor faults, which provide users with bounds on errors in their navigation solutions after monitoring for IMU faults. Two types of PLs are introduced, namely, a real-time PL_KF,IMU and a predictive PL_KF,IMU. We use the subscript “KF, IMU” to clarify that the PL bounds the user KF state under the IMU sensor fault hypothesis. The final PL of the KF-based GNSS/IMU navigation system is determined by taking the maximum over the PLs for each fault mode, including PL_KF,nominal, PL_KF,GNSS, and PL_KF,IMU. In this paper, we will focus on describing the newly suggested PL_KF,IMU values. Before doing so, we will first summarize related studies dedicated to formulating the other PLs.

To compute PLs, positioning uncertainty due to both nominal sensor noise and unmitigated fault effects must be quantified so that bounds can be computed at the probabilities dictated by the navigation requirements. Studies on uncertainty quantification for sequential estimators have been conducted by several researchers (Khanafseh et al., 2010; Langel et al., 2021, 2019; Langel et al., 2013; Rife et al., 2004, 2006). Output variances of the navigation states of interest are used for all PLs to bound navigation errors against nominal sensor noise. This is a key issue for determining PLs because bounds of KF estimate error distributions must account for uncertainties in sensor noise parameters.

Previous studies have shown that the output KF covariance in a sequential estimator is bounded when both measurement and process noise covariance, which are inputs to the KF, are properly bounded. When sensor noise can be modeled by a Gaussian distribution, one can bound the input covariance matrices by utilizing existing Gaussian overbounding methods (Rife et al., 2004, 2006). A major challenge occurs when the sensor noise is correlated with time, such as in GNSS multipath or IMU sensor measurements in which the “white” Gaussian noise assumption is not valid. To solve this problem, researchers have developed the methods described in Khanafseh et al. (2010), Langel et al. (2021, 2019), and Langel et al. (2013) to obtain an overbounding distribution on the KF estimate error when the measurement and process noises are time-correlated with an uncertain time-correlation constant and variance.

In addition to nominal noise bounding, recent studies have actively discussed several approaches for bounding unmitigated fault impacts on user PL or integrity risk within a sequential KF (as noted in Section 1). Most studies have developed methods for the case of a GNSS fault, which affects the measurement update step. Based on these studies, PL_KF,GNSS or the worst-case integrity risk against a GNSS sensor fault can be calculated (Bhattacharyya & Gebre-Egziabher, 2015; Brenner, 1996; Joerger & Pervan, 2013; Tanil et al., 2017; Tanil et al., 2018, 2019). However, unlike GNSS sensors, which are used in the measurement update step, IMU sensors are generally used in the state prediction step within a KF. The different roles of these two sensors result in different fault propagation characteristics within a sequential KF. We derive PL_KF,IMU values based on the propagation characteristic of IMU faults and their impacts on user position later in this section.

Figure 6 illustrates the fundamental concept of the two types of PL_KF,IMU with an application to UAS operations. For AV applications, integrity bounds on position estimate errors are needed operationally to inform the user in real time whether a mission should be continued or aborted. In this example, the UAS must not exceed either the upper or lower alert limits (ALs) to avoid collision with manned aircraft or ground obstacles. The real-time PL_KF,IMU is utilized to bound the user position against IMU sensor faults and for comparison with the AL during operation. If a real-time PL_KF,IMU exceeds either AL, the UAS may initiate an emergency mode or switch to an alternative navigation system. Many AV applications also need to predict operational availability in “downstream” airspace prior to traveling within that airspace. Figure 6 illustrates an example of this situation, in which the UAS is faced with an upcoming region of airspace narrower than the current one due to tall buildings below the airspace. In such cases, the predictive PL_KF,IMU is utilized before the restricted airspace is reached to predict whether the system will remain available in that region.

• Download figure
• Open in new tab
• Download powerpoint

FIGURE 6

Two types of PL_KF,IMU: Real-time and predictive PL_KF,IMU

The following subsections contain detailed derivations for each type of PL_KF,IMU.

3.3.1 Real-Time PL_KF,IMU

This section presents the mathematical development of the real-time PL in the presence of an IMU sensor failure. In this study, we show the use of KF innovations to capture IMU fault impacts on the user states in real time. Recall that the derived equation for the state error in Equation (22) is as follows:

30

To investigate the relationship between the state error and the KF innovation, we introduce a new matrix B_k,p and multiply the negative of B_k,p by the KF innovation in Equation (23):

31

where B_k,p is the matrix consisting of KF parameters:

32

Note that H_k and K_k are not full-rank matrices because only a subset of the state vector is related to the input GNSS measurements. This subset includes the position and the receiver clock bias when pseudorange measurements are used. If the pseudorange rate is applied as an additional measurement, the velocity and receiver clock drift rates are also included in the subset. Because H_k is not a full-rank matrix, (H_k^TH_k) becomes a singular matrix and is not invertible. By using the partial matrices of H_k and K_k, denoted as H_k,p and K_k,p, respectively, it is possible to convert the KF innovation from the monitor domain to the state error domain, where the subscript p indicates the partial matrices. Let K_k be a n×m matrix and H_k be a m×n matrix, where n is the number of KF states and m is the number of pseudorange measurements. Then, the matrix K_k,p can be obtained by stacking matrices K_k,r and K_k,clk as follows:

33

where K_k,r and K_k,clk are constructed by extracting the rows of K_k that correspond to the position (r) and the receiver clock bias (clk) states, respectively. In the same manner, H_k,p can be expressed as follows:

34

where H_k,r and H_k,clk are the columns of H_k corresponding to the position (r) and the receiver clock bias (clk) states, respectively.

By comparing Equations (30) and (31), one notices that the first three terms on the right side of both equations are the same. These terms include both the previous fault impacts and the current-time fault impact as well as the process noise. This comparison shows that the innovation in Equation (31) fully captures the recursive fault impacts on the state error. The process noise term is also the same in both equations; thus, the innovation captures the real-time process noise impact as well.

This observation is the starting point for the derivation of PL_KF,IMU, which enables users to directly estimate the real-time fault impacts on user state errors. The following is the state error expressed as a function of the KF innovation vector and the remaining noise terms, B_kν_k and , that come from the KF innovation vector and the state error, respectively. Note that the effect of process noise is included in the innovation vector, which is a function of process noise as well as measurement noise, as shown in Equation (25):

35

The expression of the state error in terms of the innovation vector, which does not require additional knowledge of the fault vector, allows us to estimate the IMU fault impact on user state errors in real time. Based on this expression, the real-time PL_KF,IMU is expressed as follows:

36

Equation (36) gives PL_KF,IMU in the vertical position domain (vertical PL [VPL]) as an example. The first term on the right-hand side of Equation (36) represents the real-time bias estimate obtained by using the KF innovation vector, and t_v is the vector used to convert the state from the ECEF frame to the local coordinate system and to extract the bias in the vertical position axis. The second term on the right-hand side is added to bound the remaining noise terms, which are functions of GNSS measurement noise. In this term, the standard deviation that bounds the noise terms in the vertical position domain is multiplied by the factor K_md,IMU. Note that the noise terms in the vertical position domain can be extracted from the output covariance matrix transformed from the ECEF frame to the local coordinate frame. This multiplier is applied to assure that the PL bounds the user position to the level of integrity risk that is allocated to the IMU fault hypothesis (i.e., a fraction of the total integrity risk requirement). Thus, the real-time VPL_KF,IMU is a bound on the user vertical position error under the IMU sensor fault condition (to the allocated level of integrity risk). As bias estimates are computed in real time, it is possible to have two-sided PLs surrounding them. This results in a lower level of conservatism compared with the method of using the absolute value of the worst-case bias magnitude, as this method considers the actual magnitude of the position bias caused by potential IMU faults experienced by the navigation system in real time.

In this paper, the real-time VPL_KF,IMU is evaluated by a simulation assuming a hovering UAS operation scenario. The simulation assumes that a dual-frequency GPS and a tactical-grade IMU sensor are integrated and included within the UAS equipage. Bounding models for each dual-frequency GPS error component are listed in Table 1. The error model for a tactical-grade IMU provided in Groves (2007) is used for the simulation and is also summarized in Table 1. The total integrity and continuity requirements are chosen to be 10⁻⁷ and 10⁻⁶ per hour for the vertical domain, respectively, based on civil aviation en route operation requirements (ICAO, 1996). These requirements are likely to vary for different UAS applications.

Figure 7 shows the simulated real-time VPL_IMU,KF based on the derived expression in Equation (36). An IMU sensor step fault (sudden change) with a magnitude of 0.5 m/s² is injected into each axis of the accelerometer for a duration of 80 s, starting at t = 40 s, as shown in Figure 7(a). The thin solid lines in the left (Figure 7(b)) and right (Figure 7(c)) figures at the bottom represent the true state errors, which indicate vertical position errors in this example. The dotted curve represents the estimated bias based on the KF innovation, which is the first term on the right-hand side of Equation (36). This result indicates that the KF innovation captures the recursive IMU sensor fault impact, from IMU faults on previous epochs as well as the current-time fault, on the user KF state error. The thick curves in the right figure show the two-sided real-time VPL_IMU,KF, including the additional noise-bounding term (i.e., the second term on the right-hand side of Equation (36)). The real-time VPL_IMU,KF bounds the user state error both under nominal and IMU sensor fault conditions. By utilizing the real-time VPL_IMU,KF, the user can assure that their navigation solution meets the level of integrity requirement allocation against IMU sensor faults.

• Download figure
• Open in new tab
• Download powerpoint

FIGURE 7

Simulation results for the real-time VPL_{KF, IMU}

Utilizing this real-time PL is less conservative than the conventional method of computing PLs based upon the worst-case user position bias caused by remaining errors after fault monitoring. However, the worst-case approach can be taken for cases in which it is not possible to estimate the actual magnitude of the bias in real time. As an example, estimation of the sequential bias is not possible under a GNSS fault condition. In Appendix B, we show that the method for estimating the bias in real time using the KF innovation is not valid under a GNSS fault condition.

3.3.2 Predictive PL_KF,IMU

Although the real-time PL_KF,IMU can bound the state error in real time without applying much conservatism, a prediction of the system availability prior to operation is required in many applications. For this purpose, navigation safety assurance systems have implemented a concept of a predictive PL for availability prediction against GNSS faults (Blanch et al., 2010; Joerger et al., 2020). Note that a predictive PL can be designed for each system by taking into account the tradeoff between safety and availability, as it is applied prior to operation for availability evaluation. The following presents the predictive PL designed for a GNSS/IMU navigation system against IMU faults.

Because the actual measurements of KF innovations required for computing the real-time PL_KF,IMU are unknown in advance, an upper bound of the KF innovations is predicted for a specified probability, labeled P_fa,IMU in Figure 3, assuming fault-free conditions. This upper bound is then applied to predict availability. We denote the predictive bound against IMU sensor faults as the predictive PL_KF,IMU. This section provides a detailed derivation of this predictive PL_KF,IMU.

Instead of utilizing the KF innovation vector, which is only available in real time, an upper bound on the KF innovation that meets the false alert probability requirement is derived from the distribution of KF innovations. By definition, this upper bound is given by the thresholds introduced in Equation (28). The threshold vector is then converted into position bias using the relationship between the KF innovation vector and the state vector introduced in Equation (31). The vertical position bias is expressed as Equation (37):

37

As stated earlier in Section 3.2, the threshold magnitude depends on the allocated probability of a false alert. In this study, the false alert probability is optimally allocated in a way to minimize the vertical position bias while meeting the false alert probability requirement as expressed in Equation (38), where we denote the optimized vertical position bias as the minimum bounding bias:

38

To simplify the calculation of the optimization in Equation (38), we compute an upper bound for (given in Equation (29)) by taking the sum of individual terms, as shown in Equation (39):

39

Finally, a predictive PL against IMU faults is determined by the sum of the minimum bounding bias and the remaining uncertainty due to nominal sensor noise. The output standard deviation of the vertical position state error, (or equivalently ), is multiplied by the factor K_md,IMU. The final predictive VPL_KF,IMU is expressed as Equation (40):

40

The predictive HPL_KF,IMU can be expressed as Equation (41):

41

where and are the north and east components of the KF output covariance and can be computed in the same way as . Note that additional consideration is required for the allocation of integrity and continuity risk between vertical and horizontal directions when computing both the VPL and horizontal PL (HPL) together. In this paper, only the VPL is simulated by allocating all integrity and continuity risk to the vertical components.

Figure 8 shows the predictive VPL_KF,IMU simulated with the same conditions presented in Table 1. The predictive VPL_KF,IMU depends on the monitor performance and is likely to be larger than the real-time VPL_KF,IMU when the fault magnitude is less than the MDE. As discussed earlier, a key purpose of the predictive PL_KF,IMU is to evaluate availability prior to operation. However, for comparison, the predictive VPL_KF,IMU (the thickest solid curve) is plotted along with the state error and the real-time VPL_KF,IMU in this figure. The circles indicate epochs when the fault is detected by the monitor. Before the monitor detects the injected IMU fault, both the state error and the real-time VPL_KF,IMU are well below the predictive PL_KF,IMU. Users can utilize the real-time VPL_KF,IMU, which is valid even after detection, as a means of providing navigation safety before the system reaches an AL.

• Download figure
• Open in new tab
• Download powerpoint

FIGURE 8

Simulation results for the predictive VPL_KF,IMU

The proposed PL can be applied to any type of IMU error condition to ensure user position error. Appendix C contains examples of the proposed PL simulated under the assumption of other IMU fault modes, including an accelerometer ramp fault, a gyroscope step fault, and a gyroscope ramp fault. Future work will investigate system availability under different IMU fault modes as well as IMU sensor quality by applying the proposed PLs against IMU faults.