Failure detection system

[0002] This application claims the benefit of U.S. Provisional Application No. 60/085,825, filed May 18, 1998.

[0003] (Not Applicable)

[0004] This invention relates generally to navigation systems and apparatus and more particularly to integrated radio-inertial navigation systems and apparatus.

[0005] The National Aeronautical Association has described the Global Positioning System as “the most significant development for safe and efficient navigation and surveillance of air and spacecraft since the introduction of radio navigation 50 years ago.” The Global Positioning System (GPS) consists of 24 globally-dispersed satellites with synchronized atomic clocks that transmit radio signals. Time, as measured by each satellite, is embedded in the transmitted radio signal of each satellite. The difference between the time embedded in a satellite's radio signal and a time measured at the point of reception of the radio signal by a clock synchronized to the satellite clocks is a measure of the range of the satellite from the point of reception. Since the clocks in the system cannot be maintained in perfect synchronism, the measure of range is referred to as “pseudorange” because it includes both a satellite clock error and the clock error at the point of reception.

[0006] Each satellite transmits, in addition to its clock time, its position in an earth-fixed coordinate system and its own clock error. A user, by measuring the pseudoranges to four satellites and correcting the pseudoranges for the satellite clock errors, can first of all determine his actual range to each satellite and his own clock error. The user can then determine his own position in the earth-fixed coordinate system, knowing his range to each of the four satellites and the position of each satellite in the earth-fixed coordinate system.

[0007] GPS by itself is unsatisfactory as a sole means of navigation for civil aviation users. GPS has been designed to have extensive self-test features built into the system. However, a slowly increasing range bias error could occur due to satellite clock faults or due to errors in the uploaded data introduced as a result of human errors at the GPS Operational Control System Facility. Since such failures could affect users over a wide area, the Federal Aviation Authority requires that, even for approval as a supplemental navigation system, the system have “integrity” which is defined by the Federal Radio Navigation Plan (U.S. Dept. of Defense, DOD-4650.4 and U.S. Dept. of Transportation, DOT-TSC-RSPA-87-3 1986, DOT-TSC-RSPA-88-4 1988) as the ability to provide timely warnings to users when the system should not be used for navigation. For sole means of navigation, the system must also have sufficient redundancy that it can continue to function despite failure of a single component. For the non-precision approach phase of flight, a timely warning is 10 seconds. The present GPS integrity-monitoring system in the Operation Control System may take hours. A GPS “integrity channel” has been proposed to provide the integrity-monitoring function.

[0008] Because of the high cost of the GPS integrity channel, “receiver autonomous integrity monitoring” (RAIM) has been proposed wherein a receiver makes use of redundant satellite information to check the integrity of the navigation solution. It is sufficient to simply detect a satellite failure in the case of supplemental navigation. However, to detect a satellite failure using RAIM requires that at least five satellites with sufficiently good geometry be available.

[0009] For a sole means of navigation, it is also necessary to isolate the failed satellite and to be able to navigate with the remaining satellites. This requires that at least six satellites with sufficiently good geometry be available. To meet the integrity limit of 0.3 n.m. required for a non-precision approach, the availability of the five satellites, as required for supplemental navigation, is only 95 to 99 percent, depending on assumptions. However, the availability of the six satellites required for sole means is only 60 or 70 percent, which is totally inadequate.

[0010] If an inertial reference system (IRS) is also available, an attempt could be made to coast through integrity outage periods when the five satellites required for integrity are not available. Such periods sometimes last more than 10 minutes. An IRS which has not been calibrated in flight by GPS has a velocity accuracy specification of eight knots, 2 dRMS. It would therefore not be capable of meeting the accuracy requirement during such integrity outage periods. Moreover, for sole means of navigation it might also be necessary to coast through periods when six satellites were unavailable, in case a failure of one of these were detected. Since such periods can last more than an hour, the accuracy requirement cannot be achieved with an IRS uncalibrated by GPS.

[0011] The problem with calibrating the IRS with GPS using a conventional Kalman filter is that a GPS failure can contaminate the integrated GPS/IRS solution before the failure is detected. If the GPS failure causes a pseudorange error drift of less than one meter/sec., it cannot be detected by tests of the Kalman filter residuals.

[0012] The invention is a method and apparatus for determining a failure in a subsystem that is part of a system, the system being characterized in terms of a state vector comprising a plurality of state variables. The state vector is updated at times (jK+k)TΔt using one or more Kalman filter processes, j taking on integer values, K being a predetermined integer, k taking on integer values between 1 and K for each value of j, T being a predetermined integer, and Δt being a predetermined time interval. The method comprises the steps: (a) executing at present time a plurality of Kalman filter processes where one of the Kalman filter processes determines the state vector at present time minus (K−1)TΔt using data from subsystems without failures; (b) determining the values of one or more statistical measures of one or more residuals for each of one or more Kalman filter processes for one or more time periods equal to or greater than TΔt; and (c) determining a subsystem failure from the one or more values of the statistical measures.

[0013] FIG. 1 shows a block diagram of the failure detection system, a global positioning system receiver, and an inertial navigation system.

[0014] FIG. 2 shows the flow diagram for the interrupt routine which is performed each time new data is available to the failure detection system.

[0015] FIG. 3 shows a functional block diagram of a digitally-implemented processor for obtaining the difference between the smoothed measured psuedorange to a satellite and the computed pseudorange.

[0016] FIG. 4 shows the flow diagram for the main program of the failure detection system.

[0017] The purpose of the failure detection system is to identify the satellites whose clock drifts are within specification and to use only those satellites within specification in estimating the user's position.

[0018] As shown in FIG. 1, the failure detection system 1 operates in conjunction with a GPS receiver 3 and an inertial reference system 5 to produce navigation data for the platform on which it is installed by means of a Kalman filter process. The preferred embodiment of the failure detection system utilizes an Intel 80960 microprocessor and memory resources.

[0019] The interrupt routine shown in FIG. 2 details the operations regularly performed by the failure detection system at Δt intervals where at for the preferred embodiment is 1 second. In step 7, input data is obtained from the GPS receiver 3 and the inertial reference system 5.

[0020] The GPS receiver 3 supplies ARINC 743 quantities comprising the pseudorange PR_ito each satellite i within view and the coordinates X_Si, Y_Si, and Z_Siof each satellite in an earth-fixed/earth-centered coordinate system. The failure detection system is designed to accommodate up to N satellites at a time. Thus, the index i takes on values from 1 to N. The value of N for the preferred embodiment is 8.

[0021] The platform to which the failure detection system and the associated GPS and IRS equipments are mounted is a dynamic system which exists in a state that can be characterized by a state vector—a set of state variables that define in whole or in part the platform's position and orientation in space and the first and second derivatives with respect to time of its position. It is convenient in the present case to deal with the error-state vector which is the difference between the true state vector for the platform and the state vector as determined by the IRS.

[0022] The IRS supplies the following ARINC 704 quantities relating to the position, velocity, acceleration, and attitude of the IRS/GPS/failure detection system platform at intervals Δt.

[0023] The transition matrix φ(t) is defined by the equation $\begin{array}{cc}\phi \left(t\right)=I+\sum _{n=1}^{t}F\left(n\right)\Delta t& \left(1\right)\end{array}$

[0024] where I (=Kronecker delta δ_ij) is the unit matrix and the integer t measures time in increments of Δt. The integer takes on values from 1 to T, T being a design parameter. The value of T for the preferred embodiment is 150. The value of the increments in t in the preferred embodiment are one second increments. Although equation (1) is taken here as a definition of the transition matrix, it is sometimes necessary to add second order terms, which correspond more closely to the exact definition given in standard references on Kalman filters (e.g. A. Gelb, ed., Applied Optimal Estimation,The Analytical Sciences Corporation, The M.I.T. Press, Cambridge, Mass., 1974).

[0025] In step 9 of FIG. 2, the transition matrix φ(t) is obtained by adding F(t)Δt to the prior value of φ(t), the prior value of φ(t) being the unit matrix when t equals 1.

[0026] The dynamics matrix F=[F_ij] transforms the error-state vector into the time rate of change of the error-state vector, as shown by the equation

[0027] {dot over (x)}=Fx  (2)

[0028] For M=8 the dynamics matrix has 24 rows and 24 columns. The non-zero components of the dynamics matrix are defined as follows:

[0029] The quantities R_xand R_yare the radii of curvature in the x and y directions respectively of the oblate spheroid that is used to model the earth. The values of these quantities are obtained from the equations $\begin{array}{cc}\frac{1}{R_x}=\frac{{\cos }^2\alpha }{R_N}+\frac{{\sin }^2\alpha }{R_M}\frac{1}{R_y}=\frac{{\cos }^2\alpha }{R_M}+\frac{{\sin }^2\alpha }{R_N}& \left(3\right)\end{array}$

[0030] The radius of the earth along a meridian R_Mand the radius normal to a meridian R_Nare defined by equations (4) in terms of the equatorial radius a, the eccentricity e of the oblate spheroid that is used to model the earth, the wander-azimuth angle α, and the latitude φ. $\begin{array}{cc}{R}_M=\frac{a\left(1-e^2\right)}{{\left(1-e^2{\sin }^2\phi \right)}^{3/2}}{R}_N=\frac{a}{{\left(1-e^2{\sin }^2\phi \right)}^{1/2}}& \left(4\right)\end{array}$

[0031] The wander-azimuth angle α is the angle of rotation of the y-axis counter-clockwise from North. The wander-azimuth angle is obtained from the equation $\begin{array}{cc}\alpha \left(t\right)={\alpha }_0+\sum _{n=1}^t\frac{V_E\left(n\right)}{R_N}\tan \phi \left(n\right)\Delta t& \left(5\right)\end{array}$

[0032] where α₀is equal to the IRS platform heading ψ_Hfor the first summation and is equal to the α(T) of the previous summation for each subsequent summation.

[0033] The IRS platform acceleration components in the x-y-z coordinate system are given by the equations

[0034] A_x=A_Tsin(α+ψ_T)+A_Ccos(α+ψ_T)

[0035] A_y=A_Tcos(α+ψ_T)−A_Csin(α+ψ_T)

[0036] A_z=A_V+g  (6)

[0037] where g is the acceleration of gravity.

[0038] The angular velocity components in the x-y-z coordinate system are given by the equations

[0039] ω_x=ρ_x+Ω_x

[0040] ω_y=ρ_y+Ω_y

[0041] ω_z=ρ_z+Ω_z  (7)

[0042] The components in the x-y-z coordinate system of the IRS platform angular velocity ρ are given by the equations $\begin{array}{cc}{\rho }_x=-\frac{V_y}{R_y}{\rho }_y=\frac{V_x}{R_x}{\rho }_z=0& \left(8\right)\end{array}$

[0043] where

[0044] V_x=V_Ecos α+V_Nsin α

[0045] V_y=V_Esin α+V_Ncos α  (9)

[0046] The components in the x-y-z coordinate system of the earth angular velocity Ω_Eare given by the equations

[0047] Ω_x=Ω_Ecos φ sin α

[0048] Ω_y=Ω_Ecos φ cos α

[0049] Ω_z=Ω_Esin φ  (10)

[0050] The coordinate transformation matrix C=[C_ij], where the indices i and j take on the values x, y, and z, transforms vector components referenced to a body-fixed coordinate system on the IRS platform to vector components referenced to the x-y-z coordinate system. For example, the transformation from body-fixed acceleration components [A^B_ij] to x-y-z components [A_ij] is accomplished in the following way. $\begin{array}{cc}\left[\begin{array}{c}{A}_x\\ A_y\\ A_z\end{array}\right]=\left[\begin{array}{ccc}{C}_{\mathrm{xx}}& C_{\mathrm{xy}}& C_{\mathrm{xz}}\\ C_{\mathrm{yz}}& C_{\mathrm{yy}}& C_{\mathrm{yz}}\\ C_{\mathrm{zx}}& C_{\mathrm{zy}}& C_{\mathrm{zz}}\end{array}\right]\left[\begin{array}{c}{A}_x^B\\ A_y^B\\ A_z^B\end{array}\right]& \left(11\right)\end{array}$

[0051] The direction cosines C_ijin these equations are computed from the IRS ARINC 704 heading, pitch, and roll outputs.

[0052] The τ's are the correlation times for the correlated error states. The values are as follows: τ_G=3600 s, τ_A=300 s, τ_r=600 s, τ_h=1200 s, and τ_R=3600 s. The diagonal elements of the process noise covariance matrix Q are obtained from the correlation times and the steady-state (s.s.) values for the diagonal elements of the error-state covariance matrix P(s.s.) by means of the equation $\begin{array}{cc}{Q}_{\mathrm{RR}}=\frac{2P_{\mathrm{RR}}\left(s.s.\right)}{{\tau }_n}& \left(12\right)\end{array}$

[0053] The values for the initial error-state covariance matrix are as follows: P_GG(0)=(0.01 degrees/hr)², P_AA(0)=(25 μg)², P_rr(0)=(0.1 m/s)², P_hh(0)=(100 m)², and P_RR(0)=(30 m)². In the case of Kalman filters denoted below by indices between 1 and M, the value of P_RR(0) for the satellite being tested is (1000 m)². The double subscripts are intended to identify the quantities and also to indicate that the quantities are the diagonal elements of the covariance matrix. The zero in parentheses indicates that the quantities are initial values. For satellite-related quantities, the elements are inserted when a satellite first comes into view. For IRS quantities, the elements are inserted at equipment startup.

[0054] The 24 components of the error-state vector x(t)=[x_i] for the Kalman filter processing are defined as follows:

[0055] The error-state terms are referenced to a local-level wander-azimuth coordinate system having its origin at the IRS. The error-state terms have the following meanings.

[0056] The error-state vector extrapolated to time t is defined by the equation

[0057] x(t)=φ(t)x(k=K)  (13)

[0058] where x_M+1(k=K) is the present estimate of the error-state vector obtained during the previous execution of the main program.

[0059] In step 11 of FIG. 2 x(t) is obtained using equation (13).

[0060] The measurements vector z(t) is obtained from the components of x(t). New values of longitude, latitude, and altitude are first determined from the equations

[0061] dθ_N=dθ_xsin α+dθ_ycos α

[0062] dθ_E=dθ_xcos α−dθ_ysin α  (14)

[0063] dλ=dθ_Ncos φ

[0064] dφ=−dθ_E  (15)

[0065] $\begin{array}{cc}\lambda ={\lambda }_{\mathrm{ARINC704}}+d\lambda \phi ={\phi }_{\mathrm{ARINC704}}+d\phi h_B=h_{B\mathrm{ARINC704}}+d{h}_B+\frac{h}{30K}d{h}_{\mathrm{B30K}}& \left(16\right)\end{array}$

[0066] The quantities λ_ARINC704, φ_ARINC704, and h_{B ARINC704}in equation (16) denote the ARINC 704 values of λ, φ, and h_B.

[0067] The updated values of λ, φ, and h_Bfrom equation (16) are used to calculate updated values for the position coordinates X_I, Y_I, and Z_Iof the IRS in an earth-fixed/earth-centered coordinate system by means of the equations

[0068] X_I=(R_N+h_B)cos φ cos λ

[0069] Y_I=(R_N+h_B)cos φ sin λ

[0070] Z_I=[R_N(1−e²)+h_B] sin φ  (17)

[0071] The ranges R_cito the satellites and the direction cosines of the vector connecting the IRS platform to each of the satellites in the earth-fixed/earth-centered coordinate system are calculated using equations (18) and (19). The index i denotes a particular satellite. $\begin{array}{cc}{R}_{\mathrm{ci}}=\sqrt{{\left(X_{\mathrm{Si}}-X_I\right)}^2+{\left(Y_{\mathrm{Si}}-Y_I\right)}^2+{\left(Z_{\mathrm{Si}}-Z_I\right)}^2}& \left(18\right)\\ e_{\mathrm{xi}}^E=\frac{\left(X_{\mathrm{Si}}-X_I\right)}{R_{\mathrm{ci}}}{e}_{\mathrm{yi}}^E=\frac{\left(Y_{\mathrm{Si}}-Y_I\right)}{R_{\mathrm{ci}}}{e}_{\mathrm{zi}}^E=\frac{\left(Z_{\mathrm{Si}}-Z_I\right)}{R_{\mathrm{ci}}}& \left(19\right)\end{array}$

[0072] The direction cosines to local level reference axes are obtained using equation (20). The symbol “C” denotes “cosine” and the symbol “S” denotes “sine”. $\begin{array}{cc}\left[\begin{array}{c}{e}_{\mathrm{xi}}\\ e_{\mathrm{yi}}\\ e_{\mathrm{zi}}\end{array}\right]=\left[\begin{array}{ccc}C\alpha & S\alpha & 0\\ -S\alpha & C\alpha & 0\\ 0& 0& 1\end{array}\right]\left[\begin{array}{ccc}1& 0& 0\\ 0& C\phi & -S\phi \\ 0& S\phi & C\phi \end{array}\right]\left[\begin{array}{ccc}C\lambda & 0& -S\lambda \\ 0& 1& 0\\ S\lambda & 0& C\lambda \end{array}\right]\left[\begin{array}{ccc}0& 1& 0\\ 0& 0& 1\\ 1& 0& 0\end{array}\right]\begin{array}{c}\left[\begin{array}{c}{e}_{\mathrm{xi}}^E\\ e_{\mathrm{yi}}^E\\ e_{\mathrm{zi}}^E\end{array}\right]\end{array}& \left(20\right)\end{array}$

[0073] The computed pseudorange to the i'th satellite PR_{ic is obtained using equation (}21). The quantity B is the GPS receiver clock bias.

[0074] PR_ic=R_ci−B−dB−dRB_i  (21)

[0075] Finally, the value of zi for each satellite is obtained using equation (22) and the pre-filtered measured pseudorange PR_i⁺.

[0076] z_i=PR_ic−PR_i⁺  (22)

[0077] Equation (22) is solved with the digitally-implemented processor shown in block diagram form in FIG. 3. The function of the processor is to reduce the high-frequency noise due to “selective availability”. “Selective availability” is the process by which the GPS managers deliberately introduce satellite timing and position errors into the satellite transmissions for the purpose of reducing the accuracy of position determination by civilian and unauthorized users of the system. The processor in FIG. 3 consists of the scaler 25, the lowpass filter 27, the adder 29, and the adder 31. The output of the adder 31 is the difference e_ibetween the filtered pseudorange PR⁺_iand the pseudorange PR_isupplied by the GPS receiver. This difference is substantially increased in amplitude by the scaler 25 and then filtered by the lowpass filter 27 having a time constant of about TΔt thereby rapidly attenuating noise components with frequencies above about 1/TΔt Hz. The output z_iof the lowpass filter 27 is subtracted from PR_icby adder 29 to give PR⁺_iin accordance with equation (22).

[0078] The sum of z(t) over all values of t, denoted by sm.z(t), is defined by the equation $\begin{array}{cc}\mathrm{sm}.z\left(t\right)=\sum _{n=1}^{t}z\left(n\right)& \left(23\right)\end{array}$

[0079] the quantity sm.z(t) is obtained by adding z(t) to the prior value of sm.z(t).

[0080] The vector z(t) (=[z_i(t)]) is related to the error-state vector x(t) (=[x_j]) by the equation

[0081] z(t)=H(t)x(t)+v(t)  (24)

[0082] The matrix H (=[H_ij]) is called the observation matrix. The vector components v_i(t) are measurement noise. The index i denotes an association with the i'th satellite and takes on the values from 1 to M.

[0083] The index j takes on the values from 1 to 24, the number of error-state components.

[0084] The values of H_ijare zero except as follows: H_i,1=−R_ye_yi, H_i,2=R_xe_xi, H_i,13=1, H_i,15=e_zi, H_i,16=(h_B/30K) e_zi, H_i,i+161. The values of H_ijare calculated in step 17.

[0085] The weighted sum of H(t), denoted by wt.sm.H(t), is defined by the equation $\begin{array}{cc}\mathrm{wt}.\mathrm{sm}.H\left(t\right)=\sum _{n=1}^{t}H\left(n\right)\phi \left(n\right)& \left(25\right)\end{array}$

[0086] In step 19 of FIG. 2, wt.sm.H(t) is obtained by adding H(t)φ(t) to the prior value of wt.sm.H(t).

[0087] In step 21 the value of t is tested. If t is not equal to T, t is incremented in step 22 and a return to the main program is executed. If t is equal to T, the vectors x(t) and (1/T)sm.z(t) and the matrices Φ(t) and (1/T)wt.sm.H(t) are stored in memory in step 23 with the following names: $\begin{array}{cc}\begin{array}{c}X\left(t=T\right)=x\left(k=K+1\right)\\ x\left(t=0\right)=x_z\left(k=K\right)\\ \frac{1}{T}\mathrm{sm}.z\left(t=T\right)=z\left(k=K\right)\\ \phi \left(t=T\right)=\phi \left(k=K\right)\\ \frac{1}{T}\mathrm{wt}.\mathrm{sm}.H\left(t=T\right)=H\left(k=K\right)\end{array}& \left(26\right)\end{array}$

[0088] A “new data” flag is set and a return to the main program is then executed.

[0089] Previously stored data are assigned k-values ranging from 1 to K, the k=1 data being the oldest and the k=K data being the most recent. Newly-calculated data replaces the oldest data so that there are always K sets of data available in memory. The parameter K is equal to 12 in the preferred embodiment.

[0090] A range bias validity flag VRB_i(k) is associated with each set of k-indexed data. If satellite i goes out of view, VRB_iis set equal to 0. If satellite i is new in view, VRB_iis set equal to 1.

[0091] The main program is comprised of M+3 Kalman filters—filters 1 through M for testing each of the M satellites, the (M+1)'th filter for updating present position, and the (M+2)'th filter for updating position 12 iterations in the past. The (M+3)'th filter is for testing failures of the inertial or barometric reference systems. Additional filters can be added to test additional failure modes.

[0092] A Kalman filter is a minimal mean-square-error method for estimating the error-state vector x(k) and its covariance matrix P(k) based on new measured data z(k), the previous estimates x(k−1) and P(k−1), the transition matrix φ(k), and the observation matrix H(k). Since the Kalman filter methodology is well understood in the art and details are readily available in a number of textbooks (e.g. A. Gelb, ed., Applied Optimal Estimation,The Analytical Sciences Corporation, The M.I.T. Press, Cambridge, Mass., 1974), details of the Kalman filter calculations will not be discussed herein.

[0093] Satellite data for a maximum of M satellites are saved in tables in the k-indexed portion of memory. As each satellite goes out of view, its entries in the table are zeroed, and the corresponding row and column of the covariance matrix for the range bias for that satellite are zeroed. The diagonal element is reinitialized with the initial variance of the range bias error.

[0094] When a new satellite comes into view, the data associated with the new satellite is placed in the first available empty position in the table. When a satellite represented in the table goes out of view, its data entries in the k-indexed memory are zeroed. The measurements for a newly-viewable satellite and its observation matrix are entered into the first available satellite slot at k=K.

[0095] The value of M is chosen such that the probability of more than M satellites being viewable at one time is low. However, if more than M satellites are viewable, those satellites that will remain in view for the longest periods of time are entered and allowed to remain in the tables.

[0096] The flow diagram for the main program is shown in FIG. 4. In step 41, the microprocessor continually checks the status of the “new data” flag. When the flag indicates that new data is available in memory, the microprocessor proceeds to simultaneously test the validity of individual satellite data for all satellites represented in the satellite tables by means of M Kalman filters operating in parallel.

[0097] The i'th Kalman filter, which is used to test satellite i, has an extra error-state component dRB_riwhich is defined as the range bias rate error for satellite i. For M=8, this component becomes error-state component x₂₅. The additional non-zero dynamics matrix elements for this state are: F_16+i,25=1 and F_25,25=−(1/τ_Rr). The value of the correlation time τ_Rris 3600 s. The value of the diagonal element in the covariance matrix is: P_RrRr(0)=(1 m/s)².

[0098] Each of the testing Kalman filters uses all of the measured satellite pseudorange data but is initialized with large variances for the range bias error and the range bias rate error for the satellite it is testing when that satellite first comes into view.

[0099] In step 43 the M Kalman filters update their calculations of the error-state vector and the covariance matrix utilizing the k=K data. The error-state vector used in calculating the measurement vector z_i(k=K) was x_z(k=K)=x_(M+1)(k=K) from the (M+1)'th Kalman filter. The error-state vector x_j(k=K−) was obtained by the j'th Kalman filter as a result of the previous updating. A measurement vector z_ij(k=K) consistent with x_j(k=K−) is obtained from the equation

[0100] z_ij(k=K)=z_i(k=K)+H[x_j(k=K−)−x_z(k=K)]  (27)

[0101] Using x_j(k=K−) and z_ij(k=K) the M testing Kalman filters update the error-state vector and the covariance matrix. The updated error-state vector and covariance matrix are stored in memory locations indexed by k=1 which will be reindexed later in the program to k=K prior to the next updating.

[0102] In step 45 the validity flags VRB_iare set. The Kalman filter model for testing a satellite is based on the assumption that the particular satellite it is testing may be out of specification insofar as the satellite's clock drift is concerned. If for satellite i, the i'th Kalman filter estimated standard deviation of the range bias error is less than a specified maximum acceptable standard deviation for testing, and the estimated range bias error is less than a specified maximum acceptable value, the validity flag VRB_i(k) is set equal to 2 for k=K.

[0103] If for satellite i, the Kalman filter estimated standard deviation of the range bias rate error is less than a specified maximum acceptable standard deviation for testing, and the range bias rate error estimate is less than a specified maximum acceptable value, the validity flag VRB_i(k) is set equal to 3 for all values of k for which the satellite has been in view.

[0104] The test period is equal to KTΔt which for the preferred embodiment is equal to 30 minutes. The probability of two satellites unexpectedly failing during the same 30-minute interval is negligible. It is therefore reasonable to assume that all satellites other than satellite i are within specification when testing satellite i for failure. The test hypotheses are therefore:

[0105] H₀(i): All satellites other than satellite i are within specification and satellite i is also within specification;

[0106] H₁(i): All satellites other than satellite i are within specification and satellite i is out of specification.

[0107] When the failure hypothesis for all satellites in view has been tested, all satellites which have been determined to be within specification 30 minutes in the past with validity flag VRB_i(k=1)=3 are used by the (M+2)'th Kalman filter to determine the error-state vector X_M+2(k=1 +) and the associated covariance matrix in step 47. The Kalman filter utilizes error-state vector x_M+2(k =1−), its associated covariance matrix, and the other data indexed at k=1. The error-state vector used in calculating the measurement vector z_i(k=1) was x_z(k=1) from the (M+1)'th Kalman filter with k=K at that time in the past. The error-state vector x_M+2(k=1−) was obtained by the (M+2)'th Kalman filter as a result of the previous updating. A measurement vector z_ii(k=1) consistent with x_M+2(k=1−) is obtained from the equation

[0108] z_ii(k=1)=z_i(k=1)+H[x_M+2(k=1−)−x_z(k=1)]  (28)

[0109] In step 49 all satellites which have been determined to be within specification with validity flag VRB_i(k)>1 are used by the (M+1)'th Kalman filter in the k'th iteration to determine the error-state vector x_M+1(k=K+) and its associated covariance matrix. The (M+1)'th Kalman filter begins the updating process with the k=1 data. The Kalman filter utilizes error-state vector X_M+2(k=1−), its associated covariance matrix, and the other data indexed at k=1 to obtain updated error-state vector x_M+1(k=1+).

[0110] The error-state vector used in calculating the measurement vector z_i(k=1) was x_z(k) from the (M+1)'th Kalman filter with k=K at that time in the past. The error-state vector x_M+2(k=1−) was obtained by the (M+2)'th Kalman filter as a result of the microprocessor's previous execution of the main program. The measurement vector z_ii(k=1) is again defined by equation (27).

[0111] The (M+1)'th Kalman filter continues the updating process with the k=2 data. The Kalman filter utilizes error-state vector x_M+1(k=2−)=φ(k=1)x_M+1(k=1+), its associated covariance matrix, and the data indexed at k=2 to obtain updated error-state vector x_M+(k=2+).

[0112] The error-state vector used in calculating the measurement vector z_i(k=2) was x_z(k=2) from the (M+1)'th Kalman filter with k=K at that time in the past. The error-state vector X_M+1(k=1+) was obtained by the (M+1)'th Kalman filter as a result of the k=1 updating. A measurement vector z_ii(k=2) consistent with x_M+1(k=1 +) is obtained from the equations

[0113] x_M+1(k=2−)=φ(k=1)x_M+1(k=1+)

[0114] z_ii(k=2)=z_i(k=2)+H[x_M+1(k=2−)−x_z(k=2)]  (29)

[0115] The (M+1)'th Kalman filter continues the updating process in the same manner for k=3, k=4, . . . , k=K. At each step, the residuals for each measurement are saved in memory. After k=K, the residuals for each satellite are averaged over the entire interval to detect a slow satellite clock drift.

[0116] In step 51 the k indices of the memory locations are decremented by 1 so that K becomes K−1, K−1 becomes K−2, . . . , 2 becomes 1, and 1 becomes K. The measurements z_i(k=K) and x_z(k=K) will not be available until they are calculated in equation (26) as z(k=K) and x(k=K) in step 23 of FIG. 2. In step 53 the “new data” flag is reset. The updating process is now complete and the microprocessor returns to the beginning of the main program.

[0117] The preferred embodiment as described herein performs the measurements that establish the quality of the measurements supplied by the GPS for determining platform position. In particular, if a slow clock drift for a particular satellite is detected, that satellite's measurements are not used. The failure detection system could also perform its intended function if the quality measurements were supplied by an external source.

[0118] It was stated above that at each step, the residuals for each measurement are saved in memory, and after k=K, the residuals for each satellite are averaged over the entire interval to detect a slow satellite clock drift. A new approach to obtaining such an average is described below.

[0119] The residual vector r(k) is defined as

[0120] r(k)=z(k)−H(k)·x⁻(k)  (30)

[0121] where x⁻(k) is the error state estimate prior to measurement update. The covariance of the residual vector is defined by the equation

[0122] V(k)=E[r(r(k)·r^T(k)]  (31)

[0123] where E[ ] stands for the expected value of the quantity in brackets.

[0124] The covariance of the averaged residual vector over the entire interval is calculated by first calculating its inverse: $\begin{array}{cc}{V}_{\mathrm{avg}}^{-1}=\sum _k{V}^{-1}\left(k\right)& \left(32\right)\end{array}$

[0125] where

[0126] V(k)=H(k)·P⁻(k)·H^T(k)+R(k)+R(k)  (33)

[0127] P (k) is the covariance matrix prior to measurement update, and R(k) is the measurment noise power spectral density.

[0128] The average of the residual vector is then obtained as $\begin{array}{cc}{r}_{\mathrm{avg}}={\left(V_{\mathrm{avg}}^{-1}\right)}^{-1}·\sum _k{V}^{-1}\left(k\right)·r\left(k\right)& \left(34\right)\end{array}$

[0129] The normalized sum-squared average residual is then computed:

[0130] s_avg²=r_avg^T·V_avg⁻¹·r_avg  (35)

[0131] A threshold is set on the magnitude of s_avg², which is the statistic used to detect failures. If the threshold is exceeded, a failure is indicated.

[0132] To detect fast, medium, and slow failures, the residual is averaged over short, medium, and long intervals. In the preferred embodiment, with Kalman filter cycles of 150 seconds, the short, medium and long intervals are respectively 1 cycle (2.5 minutes), 4 cycles (10 minutes), and 12 cycles (30 minutes).

[0133] If a failure is detected by the (M+1)'th Kalman filter for estimating position, the single test filter from 1 through M which has the smallest corresponding normalized sum-squared average residual statistic is assumed to correspond to the bad satellite. This is true since it has a larger initial covariance and also a larger than normal process noise for the bad satellite so that its hypothesis of failure of the satellite will cause smaller normalized residuals. This principle is also applied to the (M+3)'th test filter for detecting IRS or barometric altitude failures. If the normalized sum-squared average residuals of this filter are smallest, the IRS or barometric altitude is identified as the source of the failure.

[0134] There may be an insufficient number of satellites in view at system turn-on to detect and identify failures using new satellite information alone. For this reason, if the position and altitude errors at the end of the previous flight are small, as indicated by the corresponding covariance matrix, the position and altitude are stored for the next flilght. This enables the Kalman filter to be initialized with small initial position errors to assist in detecting and identifying initial satellite errors. To determine that the aircraft has not been moved since the previous flight, the heading at the end of the previous flight is also stored, and compared with the heading determined during alignment after the present turn-on. A comparison heading change tolerance of one degree is used in the preferred embodiment.

[0135] When used for precision approach with differential GPS, as when using the wide area augmentation system (WAAS), it is desirable to store gravity anomalies and gravity deflections of the vertical along the final approach path to improve the accuracy of the IRS for detecting DGPS failures, and for improved coasting, in case the DGPS signal is lost due to intentional or unintentional interference. In this case, additional error-states for the estimated gravity errors are added to the lowpass filter labeled 27 in FIG. 3.