Two-Level Integrity-Monitoring Method for Multi-Source Information Fusion Navigation

Abstract

To address the issue of integrity monitoring for a multi-source information fusion navigation system, a theoretical framework of two-level integrity monitoring is proposed. Firstly, at the system level, a system-integrity-monitoring method based on the Kalman filter weighted least-squares form is established to detect and isolate faulty navigation sources. Secondly, at the sensor level, considering the redundancy of the faulty navigation sources, this paper presents the design of a multi-mode comprehensive fault-detection method for non-redundant navigation sources. Additionally, an extended-dimension matrix optimized sensor-fault detection and verification method for redundant navigation sources is proposed. Finally, integrity risk allocation criteria are established based on the effectiveness of navigation sources to calculate the system protection level and trigger integrity alarms. The two-level integrity-monitoring method was tested on a multi-source information fusion navigation system integrated with an inertial navigation system (INS), global positioning system (GPS), BeiDou satellite navigation system (BDS), Doppler velocity log (DVL), barometric altimeter (BA), and terrain-aided navigation (TAN). Test results demonstrate that the proposed method can effectively isolate the faulty navigation source within 10 s. Furthermore, it can detect the faulty sensors within the faulty navigation sources, thereby enhancing the reliability and robustness of the multi-source information fusion navigation system.

1. Introduction

With the introduction and promotion of the “all source navigation” concept, the navigation system is progressively evolving towards diversifying navigation sources, expanding compatibility, and adopting the plug-and-play approach. In routine operational conditions, a multi-source information fusion navigation system, equipped with a substantial number of redundant navigation observations, can deliver high-precision, highly reliable, and interference-resistant navigation services for the carrier. However, in practical applications, various factors such as adverse environmental conditions, human interference, and hardware aging can contribute to the potential failure of any navigation source. If these faults are not promptly detected, the entire navigation system may be compromised by erroneous data, resulting in a reduction in navigation accuracy. In severe cases, such failures can lead to overall breakdown of the navigation system [1,2]. Therefore, establishing an integrity-monitoring method for a multi-source information fusion navigation system is a crucial issue that requires resolution.

Integrity monitoring of navigation systems is crucial for ensuring confidence in positional information, encompassing the system’s ability to promptly alert users when navigation becomes unreliable [3,4]. Early integrity monitoring predominantly targets homogeneous and redundant navigation sources within the global navigation satellite system (GNSS), capable of detecting abnormalities in satellite measurements, receiver hardware, or signal distortions. A widely adopted method is receiver autonomous integrity monitoring (RAIM) [5,6,7]. In recent years, numerous scholars have enhanced and innovated RAIM algorithms. For instance, in reference [8], an integrity-monitoring algorithm is proposed, utilizing the innovation variance of the Kalman filter for fault detection (KF-RAIM). Reference [9] achieved integrity monitoring based on carrier phase observation (CRAIM). Reference [10] introduces an advanced RAIM algorithm (ARAIM) that ensures both horizontal and vertical integrity requirements. Addressing the issue of data delay, reference [11] proposes a relative RAIM algorithm (RRAIM). Furthermore, to account for time variability, reference [12] introduces a time-RAIM algorithm (TRAIM). However, these algorithms are all designed for homogeneous and redundantly equipped GNSS navigation sources. In contrast, non-redundant multi-sensor navigation sources, such as terrain-aided navigation (TAN), have relatively few associated integrity algorithms. For instance, references [13,14,15] propose a terrain-data anomaly detection algorithm based on GPS and radar altimeters. This method involves horizontal consistency detection by estimating and extracting terrain heights, introducing positive and negative vertical deviations on the measured elevation, and stacking horizontal detection results layer by layer to form a spatial envelope. However, this approach heavily relies on the precise positional information provided by satellite navigation systems. The key challenge lies in monitoring terrain data and height-sensor anomalies in the event of a satellite navigation system failure and avoiding mismatches, which is crucial for ensuring the integrity of TAN.

Currently, the focus of integrity monitoring for multi-source information fusion navigation systems is primarily on GNSS/INS fusion navigation systems, with many algorithms still relying on GNSS integrity-monitoring methods. For instance, reference [16] effectively detects slowly increasing errors in satellites by extrapolating and accumulating new information from multiple epochs of the GNSS/INS integrated navigation system. References [17,18,19] employ the least-squares multiple solution separation method to detect faults in navigation sources. However, when constructing the least-squares separation solution in the location domain, the measurement error can be easily submerged, leading to low sensitivity in small-fault detection. References [20,21,22] utilize federated filters to create multiple binary sub-filters and employ fuzzy logic and weighted residual eigenvalues for each sub-filter to achieve fault diagnosis. Although this method can detect and isolate faulty navigation sources, its primary goal is to enhance the system’s fault tolerance and it cannot calculate the system protection level. Additionally, as the number of fused navigation sources increases, the need to establish sub-filters also significantly increases. References [23,24,25,26] proposes a multi-sensor integrity-management model that accomplishes integrity management of multiple sensors by dynamically assigning each sensor to one of four modes: monitoring, validation, calibration, and reconstruction. Although the model has a relatively complete logical structure, as the number of sensors and simultaneously faulty sensors increases, the number of parallel sub-filters that need to be constructed significantly increases, resulting in an escalation of computational load.

In summary, research on integrity-monitoring methods for multi-source information fusion navigation systems is still in its early stages, and the detection of faults in navigation systems is currently limited to a single hierarchical structure of navigation sources or sensors. However, multi-source information fusion navigation systems feature a redundant configuration structure. The impact of sensor faults in a particular navigation source on the entire navigation system exhibits significant hierarchical transmission characteristics. Additionally, diverse types of information sources, varying dimensions of measurement matrices, and distinct characteristics of measurement noise in multi-source information fusion navigation systems present new challenges to integrity monitoring.

In this paper, we propose a two-level integrity method for multi-source information fusion navigation; the structure is shown in Figure 1. This method can detect, isolate, and verify faulty navigation sources and faulty sensors at different levels, and dynamically adjust the fault hypotheses that need to be monitored to calculate the system protection level, so as to realize the integrity monitoring of multi-source information fusion navigation.

In detail, the contributions of this paper are as follows:

(1)

A two-level integrity-monitoring structure is introduced. Utilizing the loosely coupled filtering model, the structure establishes integrity-monitoring models at both the system and sensor levels. It accomplishes fault detection, isolation, and verification from navigation sources to sensors in a systematic manner.

(2)

For the navigation source TAN, based on its working principle, this paper designs search-mode and tracking-mode fault-detection models to achieve integrity monitoring for non-redundant navigation sources.

(3)

The proposed integrity-monitoring method adopts the integrity risk dynamic allocation criterion, allowing the dynamic adjustment of monitored fault hypotheses based on the effective navigation sources in the system.

The remainder of this paper is structured as follows. Section 1 introduces the current research status of navigation integrity monitoring. Section 2 elaborates on the system-level integrity-monitoring method. Section 3 focuses on the fault detection methods for two types of navigation sources at the sensor level. Section 4 introduces the integrity risk allocation criteria and protection-level calculation. Section 5 presents the simulation test results of the proposed method. Finally, concluding remarks and future research directions are provided in Section 6.

2. System-Level Integrity-Monitoring Method

At system level, a loosely coupled filtering model is constructed for each navigation source. Therefore, it is necessary to design a fault-detection model to detect and isolate faulty navigation sources. Meanwhile, to ensure fault-detection capability, this paper presents the design of a navigation source recovery verification model to judge whether the isolated navigation source has returned to normal.

2.1. Navigation-Source Fault-Detection Model

Differing from the traditional multiple-solution separation method in the position domain [27], we have designed a multiple residual separation method in the measurement domain.

Since three sets of inertial navigation systems are typically employed in airborne applications to ensure the reliability of inertial navigation, INS faults are not considered in this paper. Subsequently, the remaining navigation sources are ranked to form different combinations. Assuming that the number of simultaneous faulty navigation sources is one, the fusion navigation system INS/GPS/BDS/DVL/BA/TAN has the following five forms of combinations:

Combination 1 (Com1): INS/GPS/BDS/DVL/BA

$$Z_{k,1}={\left[\begin{array}{cccccc}\delta r_{eb}^{e,gps}& \delta v_{eb}^{e,gps}& \delta r_{eb}^{e,bds}& \delta v_{eb}^{e,bds}& \delta v_{eb}^{e,dvl}& \delta h_{eb}^{e,ba}\end{array}\right]}^{\mathrm{T}}$$

(1)

Combination 2 (Com2): INS/GPS/BDS/DVL/TAN

$$Z_{k,2}={\left[\begin{array}{cccccc}\delta r_{eb}^{e,gps}& \delta v_{eb}^{e,gps}& \delta r_{eb}^{e,bds}& \delta v_{eb}^{e,bds}& \delta v_{eb}^{e,dvl}& \delta r_{eb}^{e,\tan }\end{array}\right]}^{\mathrm{T}}$$

(2)

Combination 3 (Com3): INS/GPS/BDS/BA/TAN

$$Z_{k,3}={\left[\begin{array}{cccccc}\delta r_{eb}^{e,gps}& \delta v_{eb}^{e,gps}& \delta r_{eb}^{e,bds}& \delta v_{eb}^{e,bds}& \delta h_{eb}^{e,ba}& \delta r_{eb}^{e,\tan }\end{array}\right]}^{\mathrm{T}}$$

(3)

Combination 4 (Com4): INS/GPS/DVL/BA/TAN

$$Z_{k,4}={\left[\begin{array}{ccccc}\delta r_{eb}^{e,gps}& \delta v_{eb}^{e,gps}& \delta v_{eb}^{e,dvl}& \delta h_{eb}^{e,ba}& \delta r_{eb}^{e,\tan }\end{array}\right]}^{\mathrm{T}}$$

(4)

Combination 5 (Com5): INS/BDS/DVL/BA/TAN

$$Z_{k,5}={\left[\begin{array}{ccccc}\delta r_{eb}^{e,bds}& \delta v_{eb}^{e,bds}& \delta v_{eb}^{e,dvl}& \delta h_{eb}^{e,ba}& \delta r_{eb}^{e,\tan }\end{array}\right]}^{\mathrm{T}}$$

(5)

where $\delta r_{eb}^{e,\ast }$ represents the position difference between navigation source and INS, $\delta v_{eb}^{e,\ast }$ represents the velocity difference between the navigation source and INS, $\delta h_{eb}^{e,ba}$ represents the altitude difference between BA and INS.

The traditional extended Kalman filter (EKF) [28] mainly comprises two components: state propagation and measurement update. The updated state estimation results from the combined influence of historical states and current measurements. This introduces the possibility of the integrity risk being related to past states. Furthermore, the Kalman filter gain acts as a time-varying matrix, exacerbating the correlation between the two. Therefore, it is essential to establish a direct mapping relationship between the final state and the input. Additionally, the measurement update formula in the classical EKF should be reconstructed into a least-squares form [19], encompassing both system propagation and measurement, as illustrated below:

Y_k = C_kX_k + v_zx

(6)

$$Y_k=\left[\begin{array}{c}{Z}_k\\ X_{k|k-1}\end{array}\right] C_k=\left[\begin{array}{c}{H}_k\\ I\end{array}\right] v_{zx}=\left[\begin{array}{c}{v}_k\\ v_x\end{array}\right]$$

(7)

where k is the time epoch, $X_k$ is a 15-dimensional system state, $X_{k|k-1}$ is the one-step state prediction obtained through the Kalman filter, $H_k$ is the measurement matrix of the Kalman filter, $v_{zx}$ is the noise matrix with the corresponding covariance matrix $V_k$, as follows:

$$V_k=\left[\begin{array}{cc}R& 0\\ 0& P_{k|k-1}\end{array}\right]$$

(8)

Using $W=V_k^{-1}$ as the weight matrix, the state estimation solution of Kalman filter weighted least-squares form is:

$$X_k={(C_k^{\mathsf{{\rm T}}}W{C}_k)}^{-1}{C}_k^{\mathsf{{\rm T}}}W{Y}_k$$

(9)

By setting the partial elements of the weight matrix $W$ to zero (the navigation source in which combination c is not contained), the separation residual $r_{k,c}$ with covariance matrix $P_{r,k}^c$ of combination c is obtained as follows:

$$r_{k,c}^{}=Y_{k,all}-C_k{X}_{k,c}$$

(10)

$$P_{r,k}^c=V_{k,c}^{}+C_k{(C_k^{\mathsf{{\rm T}}}{W}_{k,c}{C}_k)}^{-1}{C}_k^{\mathrm{T}}$$

(11)

where $Y_{k,all}$ is the all-measurement vector, ${\widehat{X}}_{k,c}$ is the separation solution, $W_c$ is the weight matrix, $V_{k,c}$ is the noise covariance matrix.

The fault detection statistic $d_{s,c}$ of combination c is constructed from the Mahalanobis distance of the separation residual, $d_{s,c}$ satisfies the chi-square distribution with n degrees of freedom, and its corresponding threshold $T_{s,c}$ is calculated as follows:

$$d_{s,c}=r_{k,c}^{\mathrm{T}}{(P_{r,k}^c)}^{-1}{r}_{k,c}$$

(12)

$$T_{s,c}={\chi }^2(1-{\alpha }_c,n)$$

(13)

where ${\alpha }_c$ is the significance level, which is the probability of integrity risk assigned to the subsystem, ${\chi }^2(\cdot )$ represents the chi-square probability distribution function, n is the measurement dimension.

The faulty navigation source can be isolated based on the relationship between $d_{s,c}$ and $T_{s,c}$ under each combination. For the INS/GPS/BDS/DVL/BA/TAN navigation, the detection results under different fault cases are shown in

Table 1. The Detection Results under Different Fault Cases.

Fault Source	GPS	BDS	DVL	BA	TAN
Com1	1	0	0	0	0
Com2	0	1	0	0	0
Com3	0	0	1	0	0
Com4	0	0	0	1	0
Com5	0	0	0	0	1

, where 1 represents $d_{s,c}\ge T_{s,c}$ and 0 represents $d_{s,c}<T_{s,c}$.

2.2. Navigation-Source Fault-Detection Model

Previously faulty navigation sources that have returned to normal, such as isolated faulty sensors, can be reintegrated into the fusion positioning solution. However, before re-inclusion, recovery verification is necessary to prevent contaminating the fusion solution.

A least-squares form is constructed that includes measurement information provided by the KF main system state and isolated navigation sources, as follows:

$$Y_{k,v}=\left[\begin{array}{c}{Z}_{k,Nsource}\\ X_{k,main}\end{array}\right] C_{k,v}=\left[\begin{array}{c}{H}_{k,Nsource}\\ I_{k,main}\end{array}\right] V_{k,v}=\left[\begin{array}{cc}{R}_{k,Nsource}& 0\\ 0& P_{k,main}\end{array}\right]$$

(14)

where $Z_{k,Nsource}$ is the untrusted measurement, $R_{k,Nsource}$ is the measurement noise variance matrix, $H_{k,Nsource}$ is the measurement matrix, $X_{k,main}$ is the estimated state provided by the main filter, $P_{k,main}$ is the state error covariance matrix.

This paper uses the w-detection method [29] for verification. If there are multiple navigation source to be verified, parallel verification can be carried out. Therefore, the validation detection statistics and detection thresholds in the least-squares form are:

$$w_{Nsource}=\left|\frac{{\mathit{e}}_i^{{\rm T}}\mathit{V}\mathit{Y}}{\sqrt{{\mathit{e}}_i^{{\rm T}}\mathit{V}{\mathit{P}}_{zz}\mathit{V}{\mathit{e}}_i}}\right|$$

(15)

$${\delta }_{Nsource}=\nabla {\mathit{S}}_i\sqrt{{\mathit{e}}_i^{{\rm T}}\mathit{V}{\mathit{P}}_{zz}\mathit{V}{\mathit{e}}_i}$$

(16)

where e_i is the vector with the i-th element (untrusted measurement) 1, and the remaining elements are 0, P_zz is the measurement residual covariance matrix in the LS form, ∇S_i represents the critical outlier.

According to Formulas (15) and (16), real-time verification can be performed on isolated navigation sources. If the verification detection $w_{Nsource}$ is less than the detection threshold ${\delta }_{Nsource}$ five consecutive times, it is judged that the isolated navigation source has returned to normal.

3. Sensor-Level Integrity-Monitoring Method

For non-redundant navigation source systems, isolating a faulty sensor will render the navigation source inoperable. However, a hardware reset or a “heartbeat” reset can be performed on a faulty sensor to restart the navigation source. In the case of redundant navigation sources, they can continue to function normally even after isolating faulty sensors.

3.1. Non-Redundant Navigation Source TAN

Terrain-aided navigation utilizes airborne terrain-elevation databases, barometric altimeters, and radio altimeters to achieve multi-sensor, non-redundant, and heterogeneous fusion navigation. Various TAN algorithms exist, and this paper primarily investigates the integrity monitoring method of the robust BITAN algorithm [30]. The BITAN algorithm encompasses two working modes: search and tracking. Consequently, this paper presents the design of a multi-mode comprehensive fault-detection method.

3.1.1. Search-Mode Fault-Detection Model

From the moment that the system enters the search mode until the epoch that fulfills the search conversion logic, the terrain data at each search location are tallied to compute the sum of the squares of the absolute deviation of the Mahalanobis distance. The fault statistics for the search mode are established as:

$$T_s(i,j)=\frac{1}{{\sigma }_p^2}{\displaystyle \sum _{k=1}^{N_s}{\left({\widehat{h}}_{dem}(t_k)-h_{dem}(i,j)\right)}^2}$$

(17)

where $N_s$ is the number of the time epoch that satisfies the search conversion logic, ${\widehat{h}}_{dem}$ is the estimated terrain data obtained by barometric altimeter and radio altimeter at time $t_k$, $h_{dem}(i,j)$ represents the terrain data in row $i$ and column $j$ within the search scope, ${\sigma }_p$ is the standard deviation of absolute deviation error.

The threshold $T_{ds}$ of the search-fault-detection statistic can be obtained by preset probability of false detection, and the $T_s$ value at each position in the search range is compared. Therefore, the search anomaly for the missed detection identifier $T_f$ is as follows. Mapping the $T_f$ to the search area can obtain the abnormal missed detection area $S_{area}$:

$$T_f(i,j)=\left\{\begin{array}{l}0,T_s(i,j)<T_{ds}\\ 1,T_s(i,j)\ge T_{ds}\end{array}\right.$$

(18)

The search mode is prone to mismatches in the following three situations: (1) When the search filtering position is located outside the abnormal search missed detection area. (2) When the deviation between the search filtering position and the minimum position in $T_s$ is significant. (3) When the area of the missed area in the search for abnormal missed areas is relatively large.

Therefore, through a comprehensive search of the abnormal missed detection area and minimizing position deviation, the design for determining anomalies in the search positioning results is as follows:

$$F_{trust}=\left\{\begin{array}{l}0,(X_s,Y_s)\in S_{area}\&\max (d{X}_s,d{Y}_s)<T_g\&P_{area}<P_d\\ 1,(X_s,Y_s)\notin S_{area}|\min (d{X}_s,d{Y}_s)\ge T_g|P_{area}\ge P_d\end{array}\right.$$

(19)

where $d{X}_s$ and $d{Y}_s$ are the deviations between the minimum position and the search filtering position, $T_g$ is the deviation threshold, $\max (\ast )$ represents the maximum value, $\min (\ast )$ represents the minimum value, $P_{area}$ is the proportion of missed detection area, $P_d$ is the threshold for the proportion of missed detection area, $F_{trust}=0$ indicates that the search is normal, $F_{trust}=1$ indicates an abnormal search, and needs to be re-searched and filtered.

3.1.2. Tracking-Mode Fault-Detection Model

The measurement residual of the tracking filter is used to construct the fault-detection statistic $T_t$ as follows:

$$T_t={(z_k-H{\widehat{x}}_k)}^{\mathrm{T}}{R}_0^{-1}(z_k-H{\widehat{x}}_k)$$

(20)

where $k$ is the k-th time epoch, $z_k$ represents the measured value, $H$ is the measurement matrix, ${\widehat{x}}_k$ is the estimated state value, $P_k$ is the covariance matrix of state error, $R_0$ is the covariance matrix of measurement noise.

Under fault-free conditions, the tracking anomaly detection statistic follows a central chi-square distribution; under fault conditions, it follows a non-central chi-square distribution. Based on the prior probability of false detection and the measurement of degrees of freedom, the threshold for tracking-fault-detection statistics can be obtained. When T_t is greater than T_td, there is a fault in the tracking mode, and the system will switch back to search mode.

3.2. Redundant Navigation Source GPS/BDS

3.2.1. Sensor-Fault Detection Model

The redundant navigation source comprises multiple homogeneous sensors. For the fault detection of these sensors, the parallel sub-filter method proposed by Jurado J. D. is effective in identifying faulty sensors. The working principle of this method is summarized as follows: the method firstly creates parallel sub-filters by excluding one sensor measurement in turn. Secondly, it constructs a sliding-window residual Mahalanobis distance as the fault-detection statistics for each sensor in each sub-filter. Then, based on the fault-detection results for each sensor in each sub-filter, the method designs a score vector to sum the fault-detection results of all sensors in each sub-filter. Finally, when there is a unique non-zero value in the score vector, the sensor excluded by the sub-filter corresponding to that non-zero value is the faulty sensor. However, this method presents a delay issue in detecting faults across multiple sensors. Therefore, this paper introduces an expanded-dimension matrix optimization method to enhance multi-fault-detection performance. The design and construction of sensor-fault detection statistics are detailed in reference [23]. In this paper, our focus is on elucidating the construction process of the expanded-dimension matrix.

When the sensor level detects multiple faults or identifies faulty sensors, it becomes necessary to reinitialize and construct a new parallel sub-filter. This process requires a specific sampling interval for the initialized detection model to identify the corresponding fault. However, detection delays may result in undetected fault sensors affecting the accuracy of the navigation solution, and in severe cases, may lead to filtering divergence. This paper addresses these issues by establishing the corresponding relationship between the old sub-filters and new sub-filters to construct the expanded dimension. Subsequently, the new fault-detection statistics are initialized for each sub-filter.

For each old sub-filter, excluding one sensor at a time can yield multiple sensor combinations, forming the expanded dimension. Interestingly, we observe that these combinations are identical to the sensor combinations in the new sub-filter. Consequently, the fault-detection statistics with the same sensor combinations in the expanded dimension are averaged. These averaged values are then assigned to the new sub-filters as initial values. This approach effectively mitigates the impact of adjusting the number of simultaneous faults on the fault-detection time. The calculation formula for the extended-dimension matrix and the new fault-detection statistics is as follows:

$$E(j,s)=\left\{d_{k-M+1:k}^{[i,j]}\right\} i,s=1,\dots ,N_{all}-N_{f\_old}\&i\ne s$$

(21)

$$d_{k-M+1:k}^{[j_{new}]}=\frac{{\displaystyle \sum _{A_e=A_j}E(j,s)}}{N_{fnew}} j=1,2,\dots ,J, s=1,2,\dots ,N_{all}-N_{fold}$$

(22)

where $N_{fold}$ is the number of simultaneous faults in the old sub-filter, $N_{fnew}$ is the number of simultaneous faults in the new sub-filter, $j_{new}$ is the new sub-filter serial number, $A_e$ is the sensor combination in extended-dimension matrix $E$, $A_j$ is the sensor combination of the j-th new sub-filter.

When the extended-dimension matrix detects multiple faults, the reconstructed parallel sub-filter is initialized. Additionally, for the adjustment of the parallel sub-filter after isolating faulty sensors or adding new sensors (after verification), an extended-dimension matrix can also be used for optimized assignment.

3.2.2. Sensor-Recovery Verification Model

The verification filter model is essentially similar to the navigation source filter solution model, with the difference lying in the measurement model. The validation measurement model is constructed from both untrusted sensor measurements and normal sensor measurements within the navigation source. The measurement model is:

$$z_{k,vaild}=\left[\begin{array}{l}{z}_{k,main}\hfill \\ z_{k,fsensor}\hfill \end{array}\right]=\left[\begin{array}{l}{H}_{k,vaild}\hfill \\ H_{k,fsensor}\hfill \end{array}\right]x_{k|k-1}+\left[\begin{array}{l}{v}_{k,main}\hfill \\ v_{k,fsensor}\hfill \end{array}\right]$$

(23)

where vaild represents the normal sensor, $fsensor$ represents the untrusted sensor to be verified.

The validation test statistics are calculated from the measurement residuals of the untrusted sensors during the validation period as follows:

$${\mathit{r}}_{k,v}={\mathit{z}}_{k,fsensor}-{\mathit{H}}_{k,fsensor}{\widehat{\mathit{x}}}_k$$

(24)

$${\mathit{P}}_{k,vv}={\mathit{R}}_{k,v}+{\mathit{H}}_{k,fsensor}{\mathit{P}}_k{\mathit{H}}_{k,fsensor}^T$$

(25)

$$d_v=\sum _{t=k}^{k+M_v}{\mathit{r}}_{t,v}^T{\mathit{P}}_{t,vv}^{-1}{\mathit{r}}_{t,v}$$

(26)

where R_k,v is the covariance matrix of the measurement noise, ${\widehat{\mathit{x}}}_k$ is the state estimation provided by the verification filter, P_k is the state error covariance matrix, M_v is the verification period.

If the verification detection is below the threshold, the sensor is deemed credible and can be reintegrated into the navigation source solution. Otherwise, the sensor is considered untrusted. Furthermore, when successfully validated sensors are reintroduced into the navigation source solution, it is necessary to adjust the sensor-fault-detection model using the extended-dimension matrix.

4. System-Protection-Level Calculation

4.1. Integrity Risk Allocation Criteria

It is well known that any fault-detection model has a missed-detection probability. In a navigation system, integrity risk is typically defined as the probability that the position error (PE) exceeds the alert limit (AL) and the fault is not detected. To ensure the reliability of the navigation system, the probability that the PE exceeds the AL and the fault is not detected must be less than or equal to the integrity risk probability budget P_risk. The relationship between the integrity risk and the position error [31] can be defined as:

$$P(\left|PE\right|>AL\&d_s>T_s)\le P_{risk}$$

(27)

where $d_s$ is the fault detection statistics and $T_s$ is the detection threshold.

For a multi-source information fusion navigation system, the integrity risk can be expressed as the multiple-fault hypothesis. Let $H_m(m=1,2,\dots ,h_s)$ represent the fault hypothesis and $H_0$ be the fault-free hypothesis. For each fault hypothesis, its integrity risk can be expressed as:

$$P_{risk,H_m}=P(\left|P{E}_m\right|>AL\&d_{s,m}<T_{s,m}|H_m)P(H_m)$$

(28)

Because, in practical applications, the true error of the system is unknown but the probability of integrity risk can be budgeted based on carrier requirements, therefore, the ultimate goal of integrity monitoring is to derive the position error bound, commonly known as the protection level (PL), through the integrity risk budget. Subsequently, an integrity alert is sent when the PL exceeds the AL. Therefore, Equation (27) can be further rewritten as:

$${\displaystyle \sum _{m=0}^{h_s}P(P{L}_m<AL\&d_{s,m}<T_{s,m}|H_m)P(H_m)}\le P_{risk}$$

(29)

In a multi-source information navigation system, the prior probability of the occurrence of certain fault hypotheses is lower than the required integrity risk. These fault hypotheses do not need to be monitored. Let $n_{MIN}$ be the minimum number of fault hypothesis that need monitoring. The fault hypotheses can be categorized into two classes. One includes the fault hypotheses exceeding $n_{MIN}$ (labeled as $>n_{MIN}$). The other comprises the remaining fault hypotheses that need monitoring. The system integrity risk is:

$${\displaystyle \sum _{m=0}^{h_s}P(P{L}_m<AL\&d_{s,m}<T_{s,m}|H_m)P(H_m)+P_{>n_{MIN}}}\le P_{risk}$$

(30)

where $P_{>n_{MIN}}$ is the total prior probability of occurrence of fault hypotheses that need not be monitored.

For satellite navigation systems, the ARAIM algorithm report provides a clear value for the integrity risk probability budget, with the prior fault probability of each satellite being equal. However, in a multi-source information fusion navigation system, the prior fault probability of each navigation source is not uniform, and there is no clear definition for the prior fault probability of each navigation source. According to existing research [32], the prior failure probability of GPS and BDS navigation sources is set to ${10}^{-4}$, DVL to ${10}^{-5}$, BA to ${10}^{-3}$, and TAN to ${10}^{-4}$. Without considering INS fault, the maximum value of the fault hypothesis is $h_s=5$ when the TAN is updated and $h_s=4$ when the TAN is not updated. Therefore, under different fault hypotheses, the system’s ability to meet the integrity risk probability also varies. It is essential to dynamically adjust the fault hypotheses that need monitoring based on the actual effective participation of navigation sources.

For airborne multi-source information fusion navigation systems, the overall integrity risk of the system is set to $1\times {10}^{-7}$, $2\times {10}^{-9}$ in the horizontal direction, and $9.8\times {10}^{-8}$ in the vertical direction. For the convenience of observing the satisfaction of integrity risk under different fault assumptions, the logarithmic ratio of the integrity risk level is calculated as:

$$R_x=\frac{\log \left(P(H_m)\right)}{\log (P_{risk\_x})}$$

(31)

The logarithm of integrity risks under different fault hypotheses was calculated, as shown in Figure 2a. In Figure 2a, the black dashed line represents the situation when the prior fault probability is assumed to be equal to the integrity risk. A ratio less than 1 indicates that the probability of fault assumption occurrence is greater than the integrity risk, while a ratio greater than 1 indicates that the probability of fault assumption occurrence is less than the integrity risk. Therefore, for the multi-source information fusion navigation system INS/GPS/BDS/DVL/BA/TAN, regardless of whether the TAN system is updated or not, the fault assumptions that need to be monitored are all less than $H_3$.

Additionally, not all combinations of fault hypothesis $H_2$ need to be monitored, and the combinations that require monitoring will also change in real time based on the effective navigation source in the system. Therefore, to facilitate the monitoring of navigation source combinations under different fault hypothesis, this paper establishes a dynamic monitoring tree for integrity risk to monitor fault hypotheses and combinations.

For the INS/GPS/BDS/DVL/BA/TAN system, the integrity risk dynamic monitoring tree under the updated TAN conditions is illustrated in Figure 2b, where the red represents combinations that do not need to be monitored, and the blue represents combinations that need to be monitored. Here, G denotes GPS, B denotes BDS, D denotes DVL, A denotes BA, and T denotes TAN.

4.2. Protection Level Calculation

We derived the protection level under the least-squares method in our previous work [33]. Here, we provide the final protection-level calculation formula as follows:

$$P{L}_{k,c}=B_k{Y}_{k,c}-K_{md}{\sigma }_{p,c}-slop{e}_{k,c}{T}_{s,c}$$

(32)

where $T_{s,c}$ is the fault-detection threshold, $K_{md}$ is the risk factor calculated according to the probability of missed detection, ${\sigma }_{k,c}$ is the standard deviation of position estimation error, $slop{e}_{k,c}$ is the projection slope from the measurement domain to the positional domain, obtained by the ratio of the square of the mean state error of the fault vector to the non-central parameter of the measurement residual.

$$slop{e}_{k,c}^2=\frac{{\mu }_{k,c}^2}{{\lambda }_{k,c}^2}=\frac{f_k^{\mathsf{{\rm T}}}{S}_{k,c}^{\mathsf{{\rm T}}}{S}_{k,c}^{}{f}_{k,c}}{f_k^{\mathsf{{\rm T}}}{V}_{k,c}^{-1}\left(I-C_k{S}_{k,c}\right)f_k}$$

(33)

where f_k is the fault vector, $S_{k,c}$ is the pseudo inverse of the observation matrix $C_k$, $S_{k,c}={\left(C_k^{\mathsf{{\rm T}}}{V}_{k,c}^{-1}{C}_k\right)}^{-1}{C}_k^{\mathsf{{\rm T}}}{V}_{k,c}^{-1}$.

For each fault hypothesis $H_m$, there are several combinations that need to be monitored, and the protection levels calculated for each combination reflect the position error. To obtain a more conservative protection limit, the maximum value is selected. Therefore, the protection level $P{L}_m$ under fault hypothesis $H_m$ is:

$$P{L}_m=\underset{c\in H_m}{\max }(P{L}_{k,c})$$

(34)

By combining Formulas (30) and (32), the integrity risk of multi-source information fusion navigation systems can be further expressed as:

$$2P(H_0)Q\left(\frac{P{L}_0}{{\sigma }_0}\right)+{\displaystyle \sum _{m=1}^{h}P(H_m)Q\left(K_{md}^{}\right)}+P_{>n_{MIN}}\le I_{REQ}$$

(35)

$$2P(H_0)Q\left(\frac{P{L}_0}{{\sigma }_0}\right)+{\displaystyle \sum _{m=1}^{h}P(H_m)Q\left(\frac{P{L}_m-slop{e}_{\max ,m}{T}_{s,m}-B_k{Y}_k}{{\sigma }_m}\right)}+P_{>n_{MIN}}\le I_{REQ}$$

(36)

where $P{L}_0$ is the protection level under the fault-free hypothesis, ${\sigma }_0$ and ${\sigma }_m$ are the standard deviation of estimated position error under the fault-free hypothesis and $H_m$ fault hypothesis, respectively, $slop{e}_{\max ,m}$ is the maximum projection slope under the $H_m$ fault hypothesis, $T_{s,m}$ is the fault-detection threshold.

The PL can be obtained by solving Equation (36), but solving the above inequality exactly is a complex process. This paper employs the half-interval search method proposed in the ARAIM baseline algorithm to calculate the protection level. The detailed steps of the half-interval search method have been previously described [34,35].

5. Results and Analysis

Using a simulated flight trajectory and real terrain-elevation data (with a resolution of 30 m), the proposed method was tested and validated by constructing a simulated airborne multi-source information fusion navigation system INS/GPS/BDS/DVL/BA/TAN. The specific simulation parameters are shown in

Table 2. Simulation Parameter Settings.

Subject	Parameter	Value
INS errors	Gyro bias	200°/h
	Gyro random walk coefficient	$1.0°/\sqrt{\mathrm{h}}$
	Accelerometer bias	0.09 m/s2
	Accelerometer walk coefficient	$0.01 \mathrm{m}/\mathrm{s}\sqrt{\mathrm{s}}$
GPS errors	Pseudorange measurement noise	2.5 m
	Pseudorange measurement noise rate	0.05 m/s
BDS errors	Pseudorange measurement noise	1.5 m
	Pseudorange measurement noise rate	0.03 m/s
GPS/BDS clock errors	Receiver clock offset	104 m
	Receiver clock drift	100 m/s
DVL error	Measurement noise	0.08 m/s
Barometric altitude error	Measurement noise	3 m
Radio altitude error	Measurement noise	5 m
Integrity	System integrity budget (SIB)	10−7
	SIB in the horizontal direction	9.8 × 10−8
	SIB in the vertical direction	2 × 10−9

. For the various navigation sources, the respective update periods were set as shown in

Table 3. Update Period of Different Navigation Sources.

Navigation Source	INS	GPS	BDS	DVL	BA	TAN
Update period (s)	0.01	0.5	0.5	0.5	0.1	1.0

.

Constant deviation faults and slowly increasing faults were added to the sensor measurements of different navigation sources at different time epochs to construct fault cases and verify the fault-detection ability of the proposed method. The specific fault description is shown in

Table 4. Simulation Fault Description.

Case	Fault Time (s)	Fault Navigation Source	Fault Sensors	Description
1	60~90	TAN	RA	5 m/s GIF
2	100~130	BA	BA	50 m CBF
3	140~170	DVL	Vn	2 m/s CBF
4	180~210	GPS	SAT1&3	40 m CBF
5	220~250	BDS	SAT 2	5 m/s GIF

, where RA represents radio altitude, Vn represents north velocity, SAT represents satellite, GIF represents gradual increase fault, and CBF represents constant bias fault.

5.1. Performance of System-Level Integrity Monitoring

This paper analyzes the system-level navigation-fault-detection results under different fault cases without activating sensor-level integrity monitoring, as shown in

Table 5. System-Level Fault-Detection Results.

Case	Tdec (s)	RMSE without FNI (m)			RMSE with FI (m)
		East	North	Down	East	North	Down
1	67	0.12	0.28	1.09	0.11	0.17	1.18
2	100.5	0.14	0.16	1.10	0.11	0.19	1.24
3	140.5	0.12	4.02	2.06	0.10	0.16	1.17
4	180.5	2.24	0.34	2.58	0.24	0.33	1.27
5	226	0.48	0.91	2.22	0.13	0.28	1.26

. The results include the fault-detection time T_dec, and the RMSE values without fault isolation (FI) and with FI. Using Case 1 and Case 5 as examples, the results of system-level integrity monitoring are illustrated in Figure 3 and Figure 4, respectively. In the fault-detection statistics curve, the upper part represents the result without FI, while the lower part represents the result with FI.

It can be seen from Figure 3a and Figure 4a that the detection statistics without FI for Com5 and Com2 significantly exceed the threshold, while the fault-detection statistics with FI are less than the threshold. This indicates that the fault-detection model design proposed in this paper can effectively detect the faulty navigation source. Comparing the position error curves without FI and with FI, it can be seen that if the fault is not isolated, the position error curve changes significantly, as shown in the red area in Figure 3b and Figure 4b.

From Table 5, it can be seen that in Case 1, the RMSE values without FI were 0.12 m, 0.28 m, and 1.09 m in the east, north, and down directions, respectively. The RMSE values with FI were 0.11 m, 0.17 m, and 1.18 m in the east, north, and down directions, respectively. Compared with the RMSE values without FI, the RMSE values with FI decreased by 0.01 m and 0.11 m in the east and north directions, respectively, while the RMSE values in the down direction increased by 0.09 m. It can be seen from Figure 3a that under normal conditions, the initial down error was positive. After adding faults, the down error increased in the negative direction, leading to a decrease in the RMSE value. The same situation also occurred in Case 2. For Case 3 to Case 5, taking the east direction as an example, compared with the RMSE without FI, the RMSE values with FI decreased by 0.02 m, 2 m, and 0.35 m, respectively. In addition, from the detection time of the navigation source fault shown in Table 5, it can be seen that for constant deviation and slowly increasing faults, the system-level integrity-monitoring model can detect and isolate the navigation source fault within 6 s.

Taking Case1 to Case3 as examples, the RMSE values with and without navigation source recovery validation function (NRV) are shown in

Table 6. Navigation Source Recovery Verification Results.

Case	Tval (s)	RMSE with NRV (m)			RMSE without NRV (m)
		East	North	Down	East	North	Down
1	95	0.11	0.17	1.18	0.11	0.16	1.17
2	132	0.11	0.19	1.24	0.11	0.17	1.19
3	172	0.10	0.16	1.17	0.09	0.13	1.17

, including the verification success time T_val.

From Table 6, taking the north direction as an example, the RMSE values without the NRV function are 0.17 m, 0.19 m, and 0.16 m in Case 1, Case 2, and Case 3, respectively. The RMSE values with the NRV function are 0.16 m, 0.17 m, and 0.13 m in Case 1, Case 2, and Case 3, respectively. Compared with the RMSE values without NRV function, the RMSE values with the NRV function decreased by 0.01 m, 0.02 m, and 0.03 m in Case 1, Case 2, and Case 3, respectively, indicating a slight improvement in positioning performance.

To further verify the advantages of the method proposed in this paper, based on the faults set in Table 4 (reducing the amplitude of each fault), the multi-combination separation residual method proposed in this paper and the multi-solution separation method proposed in reference [19] were used for navigation-source fault detection. The fault-detection time under different methods is shown in

Table 7. The fault-detection time under different methods.

Case	Fault Amplitude	Proposed Method	Method of Reference [19]
1	1 m/s GIF	70 s	-
2	20 m CBF	102 s	108 s
3	0.5 m/s CBF	141 s	141.5 s
4	10 m CBF	182.5 s	-
5	0.5 m/s GIF	221 s	222.5 s

.

It can be seen from Table 7, even with reduced fault amplitude, our method can still detect the navigation source faults under five cases, while the method of reference [19] can detect only the BA, DVL, and BDS faults, and missed detecting the TAN and GPS faults. In addition, in the fault cases, both methods can detect navigation-source faults; the detection time of the proposed method is 5 s, 0.5 s and 1.5 s faster than the detection time of the method proposed in reference [19]. Therefore, compared with the multi-solution separation method, the multi-combination separation method has higher sensitivity in fault detection.

5.2. Performance of Sensor-Level Integrity Monitoring

5.2.1. Non-Redundant Navigation Source TAN

The integrity-monitoring method for non-redundant navigation sources TAN, as proposed in this paper, was tested and validated under various working modes of the BITAN algorithm.

(1) Search-mode fault detection (SMFD)

In the search mode of terrain-aided navigation, a faulty sensor is often constrained by the search conversion logic, preventing the system from transitioning to the tracking mode. During such instances, the fault does not pose an integrity risk to the system. However, when the anomaly precisely aligns with the conversion requirements, the provided matching position can significantly deviate from the actual position, impacting the overall positioning performance. Additionally, an incorrect matching position may occur due to the influence of search filtering parameters, if the preset filtering measurement noise variance matrix R parameter is not appropriate. To test and verify the search-mode fault-detection model, this paper described the introduction of anomalies in sensor data and search filtering parameters, creating search anomaly cases. The description of anomaly test cases is presented in

Table 8. Description of Abnormal Search Cases.

Case	Fault Time (s)	Fault Description
1	22–83	100 m CBF of radio altimeter
2	96–157	10 m/s GBF of barometric altimeter
3	173–234	Reduce matrix R to 20

.

Table 9. The RMSE with and without SMFD.

Case	RMSE with SMFD		RMSE without SMFD
	North (m)	East (m)	North (m)	East (m)
1	0.25	0.37	36.42	1.58
2	0.27	0.42	35.43	36.37
3	0.73	0.27	108.26	73.14

displays the RMSE values of TAN with and without SMFD for different cases. The SMFD results under abnormal search Case 2 are depicted in Figure 5, with the missed detection area highlighted in the red area in Figure 5b.

From Figure 5, it is evident that when a significant deviation occurs between the matching position provided by the search mode and the true value, the search-mode fault-detection model designed in this paper can effectively identify anomalies and reinitialize the search filter. Without SMFD, the TAN performs the tracking filtering based on mismatching positions, leading to incorrect positional information. Table 9 provides an example using north error, revealing that compared with RMSE values of TAN without SMFD, the RMSE values of TAN with SMFD decreased by 36.17 m, 35.16 m, and 107.53 m, respectively. Therefore, the SMFD model proposed in this paper can effectively prevent mismatching, thereby enhancing the reliability of TAN.

(2) Tracking-mode Fault detection (TMFD)

For the tracking mode, as it utilizes single-state Kalman filtering based on height measurement values, a failure in the radio altimeter sensor or barometric altimeter sensor directly impacts the positioning performance. The proposed TMFD model was tested using Case 1 and Case 2 from Table 4.

Table 10. The RMSE with and without TMFD.

Case	Fault Detection Time (s)	RMSE with TMFD		RMSE without TMFD
		North (m)	East (m)	North (m)	East (m)
1	65	1.07	0.99	3.96	3.25
2	101	0.34	0.71	1.53	1.49

displays the fault-detection time and RMSE values for TAN with and without TMFD. Figure 6 illustrates the TMFD results under Case 1, where the fault-detection statistics curve in Figure 6a shows the upper part as the result without TMFD and the lower part as the result with TMFD.

From Figure 6, it is evident that the tracking-mode fault-detection model proposed in this paper can effectively identify anomalies in the height sensor and promptly switch back to the search mode. Moreover, Table 10 demonstrates a significant reduction in position error with TMFD. Taking the east error as an example, under Case 1 and Case 2, the position error with TMFD decreased by 1.24 m and 0.78 m, respectively, effectively ensuring the reliability of TAN positioning.

5.2.2. Redundant Navigation Source GPS/BDS

Using Case 4 and Case 5 in Table 4 to test the navigation source redundancy integrity-monitoring method, the results of sensor-fault-detection and verification are presented in

Table 11. The Results of Sensor Fault Detection and Verification.

Case	Detection	Verification
4 (original)	Detected in 190.5 s; isolated in 201 s	Started in 201 s; succeeded in 215.5 s
4 (optimized)	Detected in 190.5 s; isolated in 198 s	Started in 198 s; succeeded in 215 s
5	Detected in 236.5 s; isolated in 236.5 s	Started in 236.5 s; succeeded in 256 s

. The RMSE value with and without sensor fault isolation (SFI) are provided in

Table 12. The RMSE without and with SFI.

Case	RMSE with SFI (m)			RMSE without SFNI (m)
	East	North	Down	East	North	Down
4	5.57	3.74	8.87	4.35	3.00	7.02
5	5.29	0.89	5.56	2.54	0.88	3.07

. The navigation source position error curves with and without SFI are plotted as shown in Figure 7.

It can be observed from Figure 7 and Table 12 that the sensor fault detection and validation model can enhance the positioning accuracy of the navigation source. Taking the GPS navigation source as an example, the RMSE values of GPS without SFI were 5.57 m, 3.74 m, and 8.87 m in the north, east, and down directions, while the RMSE values with SFI were 4.35 m, 3.00 m, and 7.02 m. In comparison to the RMSE values of GPS without SFI, the RMSE values with SFI decreased by 1.22 m, 0.74 m, and 1.85 m, respectively. The sensor integrity monitoring can enhance the positioning accuracy of navigation sources while ensuring the positioning reliability of the multi-source information fusion navigation system.

In addition, sensor integrity monitoring can significantly reduce the duration of navigation source failures, as depicted by the red areas in Figure 7. According to Table 11, the original recovery time of GPS simulation failures was 210 s, and the recognition time for sensor failures was 198 s. By isolating the faulty sensor, the recovery time of the navigation source was reduced by 12 s. The original recovery time of BDS simulation faults was 250 s, and the recognition time for sensor faults was 236.5 s. By isolating the faulty sensor, the recovery time of the navigation source was reduced by 13.5 s. The sensor verification function can rapidly recover the isolated sensor after the fault disappears, as shown in the green areas in Figure 7. The verification success time of the GPS faulty sensor was 215 s, and the verification success time of the BDS faulty sensor was 256 s. Compared with the original recovery time of the simulated faults, the two examples went through verification cycles of 5 s and 6 s, respectively, after the fault disappeared, and the isolated sensor could be reintegrated into the navigation source solution. The corresponding positioning accuracy was restored to the level before the fault.

To verify the performance of the extended-dimension matrix optimization method proposed in this paper, the fault-detection results of the original method and the optimized method were calculated for Case 4, as shown in

Table 13. The Sensor Fault Detection Results of the Original Method and Optimized Method.

Case	Tsdec (s)	Tsvar (s)	RMSE (m)
			East	North	Down
4 (original)	10.5	5.5	4.63	3.19	7.46
4 (optimized)	7.5	5.0	4.35	3.00	7.02

, where T_sdec represents the sensor fault detection time and T_svar represents the sensor verification success time.

From the fault detection and verification results in Table 13, it can be seen that the original method identified the faulty sensors in 10.5 s, while the optimized method identified the faulty sensors in 7.5 s. Compared with the original method, the optimized method was able to identify faulty sensors faster, and the fault identification time was shortened by 3 s. The sensor validation success time of the original method was 5.5 s, and the sensor validation success time of the optimized method was 5 s. The validation success times of the two methods were basically the same. The RMSE of GPS for the original method was 4.63 m, 3.19 m, and 7.46 m, while the RMSE of GPS for the optimized method was 4.35 m, 3.00 m, and 7.02 m. Compared with the original method, the RMSE values of GPS for the optimized method decreased by 0.28 m, 0.19 m, and 0.44 m, respectively.

5.3. Performance of System-Protection Level

The effectiveness of the protection level calculated in this paper was tested under the simulation faults in Table 4. After the system stabilized, the system-protection-level results within the fault time under different fault cases were calculated, as shown in

Table 14. System-Protection-Level Results under Different Fault Cases.

Case	Without/with FI	HPL (m)		VPL (m)		Integrity Alarm
		μ	Max	μ	Max
0	-	3.56	4.09	2.11	3.58	No
1	Without	3.53	4.31	2.27	3.54	No
	With	3.61	4.31	2.16	3.54	No
2	Without	3.92	4.43	3.74	3.87	No
	With	3.51	4.09	2.89	2.36	No
3	Without	5.56	9.09	3.85	7.07	Yes
	With	4.40	5.04	2.57	3.60	No
4	Without	6.17	8.81	6.42	9.93	Yes
	With	4.27	5.12	2.46	3.81	No
5	Without	6.25	11.46	4.06	8.19	Yes
	With	3.80	4.73	2.43	4.04	No

. Here, Case 0 represents the fault-free condition, μ represents the mean value, and Max represents the maximum value. Taking Case2 and Case4 as examples, the position error and protection-level curves are illustrated in Figure 8, where the upper part displays the result without FI, and lower part displays the result with FI.

Based on the positioning performance and protection level of the multi-source information fusion navigation system under fault-free conditions, the alarm limit for this experiment was tentatively set to 6 m (which needs to be set according to flight conditions in practice). When the alarm limit is exceeded, the system will issue an integrity alarm. It can be observed from Table 14 that for Case1 and Case2, the protection level without FI and with FI is essentially the same. Additionally, it can be seen from Figure 8 that the change in the protection level curve without FI and with FI is relatively small. This is because the positioning error caused by the fault itself is small, and the change mapped to the system protection level is also small.

From Figure 3b and Figure 8a, it is evident that the positioning error without FI actually decreases, causing the protection level not to change significantly. Thus, it is normal for the system not to generate integrity alarms. For Case4, Figure 8b illustrates that during the time period of the fault, the position error and protection level without FI significantly increased, quickly exceeding the set alarm limit, resulting in an integrity alarm. Table 14 corroborates this, showing that the protection level calculated in this paper surpasses the set alarm limit in both horizontal and vertical directions. Taking the vertical direction as an example, the VPLs of Case3 to Case5 exceed the alarm limit by 3.47 m, 6.12 m, and 4.15 m, respectively. Therefore, the system will generate integrity alarms, signifying that the current positioning information has lost its reliability. Additionally, Figure 4b indicates that the fault, when unisolated, will cause significant positioning errors. Considering the current alarm limit, the true position error has exceeded the alarm limit, and an integrity alarm should be issued. Figure 8 demonstrates that after the system correctly detects and isolates the fault navigation source, the system protection level calculated in this paper remains within the normal range during the fault time, and integrity alarms are not triggered.

6. Conclusions

In this paper, we propose a two-level integrity-monitoring method for multi-source information fusion navigation and report simulation tests conducted in an airborne environment. At the system level, the fault and verification model constructed by the loosely coupled Kalman filtered least-squares method can effectively detect and isolate faulty navigation sources. After passing the verification, the isolated sources can be re-incorporated into the fusion model. At the sensor level, suitable fault-detection models were constructed based on the redundancy of faulty navigation sources. Specifically, for the non-redundant navigation source TAN, different fault-detection methods were established according to its working mode to avoid mismatching. For the redundant navigation source GPS/BDS, the traditional method has been enhanced by optimizing the initial value of the fault-detection statistics using the expanded-dimension matrix. This optimization effectively reduces the detection delay caused by sub-filter adjustment. Finally, an integrity-risk dynamic allocation criterion was established to calculate the system-protection level for multi-source information fusion navigation. Simulation test results show that the method proposed in this paper can effectively detect, isolate, and verify faulty navigation sources and sensors. It issues integrity alarms in a timely manner without fault isolation, thereby improving the reliability of the navigation system.

Future works will focus on the following aspects: (1) in-depth investigation of integrity-monitoring methods under various fusion models; (2) further exploration of INS faults; (3) application of the proposed two-level integrity-monitoring structure in diverse scenarios. Additionally, the investigation of various fault-detection methods, such as machine learning, will be undertaken to enhance fault-detection performance.