FDI decision functions

A filter produces residuals continuously. Fault detection and isolation is the business of converting those continuous, noisy numbers into a discrete declaration — "sensor 3 has failed" — with a quantified probability of being wrong in either direction. This page derives the standard decision functions, shows where their thresholds come from, and is explicit about the assumption each one silently depends on.

Symbols used on this page are defined in the Nomenclature → estimation & filtering.

Why this needs formal machinery. "Reject the measurement if it looks wrong" is not a specification. You must be able to state a false-alarm rate (how often you throw away good data or fail a healthy string) and a missed-detection rate at a given fault size, and those two trade against each other along a curve you cannot escape — only move along, or shift by adding information. Every number below exists to make that trade explicit rather than accidental.

1 · Everything starts with a normalised residual

Given a measurement $\mathbf z$, a model prediction $h(\hat{\mathbf x})$, state covariance $P$ and measurement noise $R$, the innovation and its covariance are

$$ \mathbf y=\mathbf z-h(\hat{\mathbf x}^-),\qquad S=HPH^\top+R $$

The raw residual $\mathbf y$ is not directly testable — a 5 m residual is alarming for a laser ranger and unremarkable for a code pseudorange. What is testable is the residual in units of its own predicted standard deviation. Under the no-fault hypothesis with correct models,

$$ \mathbf y\sim\mathcal N(\mathbf 0,S) \qquad\Longrightarrow\qquad \underbrace{q=\mathbf y^\top S^{-1}\mathbf y\;\sim\;\chi^2_m}_{\text{normalised squared residual, } m=\dim\mathbf y} $$

This single scalar is the foundation of nearly every practical test. The scalar form for one measurement at a time is the familiar

$$ q=\frac{y^2}{\sigma_y^2}=\frac{y^2}{HPH^\top+R}\;\sim\;\chi^2_1 \qquad\text{(gate: } |y|<k\sigma_y\text{)} $$

The assumption that fails in practice. $q\sim\chi^2_m$ holds only if $S$ is right — correct $P$, correct $R$, correct $H$, unbiased state. In a real filter $P$ is optimistic (unmodelled errors, linearisation, mistuned $Q$), so the measured distribution of $q$ has fatter tails than $\chi^2$ and a threshold computed from the ideal table produces far more false alarms than designed. This is why thresholds are validated empirically against flight/sim data and why covariance realism is a prerequisite for FDI, not a separate concern.

2 · The decision as a hypothesis test

Formally, we test a null hypothesis against a fault hypothesis in which an unknown fault vector $\mathbf f$ enters through a known signature matrix $M$:

$$ H_0:\ \mathbf y\sim\mathcal N(\mathbf 0,S) \qquad\text{vs}\qquad H_1:\ \mathbf y\sim\mathcal N(M\mathbf f,\,S),\quad \mathbf f\neq\mathbf 0 $$

The four outcomes, and the two that the design has to trade:

	Declare healthy	Declare faulted
Truly healthy	correct	false alarm, prob. $P_{FA}=\alpha$
Truly faulted	missed detection, prob. $P_{MD}=\beta$	correct detection, power $1-\beta$

The threshold is set from the false-alarm requirement, because that is the side you can compute without knowing the fault:

$$ T=F^{-1}_{\chi^2_m}(1-\alpha) \qquad\text{e.g. } m=1,\ \alpha=10^{-3}\ \Rightarrow\ T\approx10.8\ (|y|<3.29\sigma) $$

Detection performance then follows — you do not get to choose it. Under $H_1$ the statistic has a non-central chi-square distribution whose non-centrality parameter is the key quantity in all of FDI:

$$ q\sim\chi'^2_m(\lambda),\qquad \boxed{\;\lambda=\mathbf f^\top M^\top S^{-1}M\,\mathbf f\;} $$

$\lambda$ is the "signal-to-noise ratio" of the fault. It says the detectability of a fault depends on its size, on how it projects through the geometry $M$, and on how noisy the residual already is. Three consequences worth internalising:

Detectability is a geometry problem, not just a magnitude problem. A large fault with a small projection is invisible; a modest fault aligned with a well-observed direction is obvious.
If $M\mathbf f$ lies in the null space of the test, $\lambda=0$ and the fault is undetectable at any size. Such directions always exist when you have no redundancy.
The minimum detectable fault for required $\alpha,\beta$ follows by inverting the non-central distribution — this, not intuition, is what belongs in a requirements document.

3 · The standard decision functions

3.1 Snapshot $\chi^2$ / parity test

With redundant measurements ($m$ measurements, $n$ states, $m>n$), a least-squares solution leaves a residual that must be small if the measurements are mutually consistent:

$$ \hat{\mathbf x}=(H^\top W H)^{-1}H^\top W\mathbf z,\qquad \mathbf r=\big(I-H(H^\top W H)^{-1}H^\top W\big)\mathbf z $$ $$ q=\mathbf r^\top W\mathbf r\;\sim\;\chi^2_{m-n} $$

The degrees of freedom $m-n$ is the redundancy, and it drives everything:

Redundancy $m-n$	Capability	Why
0	nothing	solution fits any data exactly; residual is identically zero
1	detection only	one consistency check exists, but all faults look alike in it
≥2	detection + isolation	the residual direction becomes informative, so faults are distinguishable

This is the classic result behind RAIM in GNSS integrity: you need one extra satellite to detect a fault and two to identify which one. Isolation works by comparing the residual's direction to the predicted fault signature for each hypothesis — in parity space, each potential fault traces a characteristic line, and you identify the fault by which line the parity vector lies along.

3.2 Generalised likelihood ratio (GLR)

When the fault magnitude is unknown but its signature is known, the Neyman–Pearson optimal approach is to maximise the likelihood over the unknown magnitude. For a scalar fault of known direction $\mathbf m$:

$$ \hat f=\frac{\mathbf m^\top S^{-1}\mathbf y}{\mathbf m^\top S^{-1}\mathbf m},\qquad \ell=\frac{\big(\mathbf m^\top S^{-1}\mathbf y\big)^2}{\mathbf m^\top S^{-1}\mathbf m}\;\sim\;\chi^2_1 $$

This is a matched filter: it projects the residual onto the expected fault direction, so it is far more sensitive than an omnidirectional $\chi^2$ when the signature is known — and correspondingly blind to faults whose signature you did not anticipate. Running one GLR per hypothesis and comparing gives both detection and isolation, and $\hat f$ conveniently also estimates the fault size for reporting or compensation.

3.3 Sequential tests: CUSUM and SPRT for slow faults

Snapshot tests are blind to the most dangerous fault class: a slow drift that never produces a single outlying residual but biases the state over minutes. Because the filter partially absorbs it, the residual may stay inside the gate indefinitely. The fix is to accumulate evidence over time:

$$ g_k=\max\big(0,\;g_{k-1}+s_k-\nu\big),\qquad s_k=\text{log-likelihood ratio at } k,\ \ \nu=\text{drift allowance} $$

with a declaration when $g_k>h$. The same logic in Wald's sequential form (SPRT) accumulates $\Lambda_k=\sum s_i$ and decides between two thresholds. The essential point is the complementarity:

Fault type	Snapshot $\chi^2$ / gate	Sequential CUSUM
Large step, outlier, spike	detects immediately	detects, but slower
Slow ramp / drift	may never trip	accumulates until detected
Small bias within noise	invisible	detectable given enough time
Increased noise only	occasional trips	needs a variance-targeted test

A complete FDI design therefore runs both families, because they cover different failure modes. Omitting the sequential test is the common gap, and the drift fault is exactly the one that quietly corrupts a navigation state while every instantaneous check passes.

3.4 Cross-channel voting and analytical redundancy

With replicated hardware, differences between channels are testable directly. For channels $i,j$ with independent errors,

$$ d_{ij}=\mathbf x_i-\mathbf x_j\ \sim\ \mathcal N(\mathbf 0,\,P_i+P_j) \qquad\Rightarrow\qquad q_{ij}=d_{ij}^\top(P_i+P_j)^{-1}d_{ij} $$

and the number of channels sets the capability — the standard fault-tolerance result:

Channels	Detect	Isolate	Notes
2	yes	no	a disagreement tells you nothing about which is wrong
3	yes	yes (1 fault)	mid-value select; median is robust to one arbitrary outlier
4	yes	yes (2 faults)	fail-operational after one failure

Two traps in cross-channel testing. First, the threshold must scale with $P_i+P_j$, which grows during unaided coast — a fixed threshold will start failing healthy channels precisely when the vehicle is most degraded. Second, replicated channels running the same algorithm on the same data share common-mode errors, so their agreement is much weaker evidence than it appears. Genuinely independent opinions — inertial vs GNSS vs a dynamics model — are worth more than more copies of the same thing.

4 · Setting thresholds: the trade you cannot avoid

Threshold selection is a system decision driven by consequence asymmetry, and it is worth stating the logic plainly:

Per-test vs per-mission false alarms. A test at $\alpha=10^{-3}$ running at 10 Hz false-alarms about once every 100 s. Over a 600 s flight with 12 satellites that is dozens of events. Requirements must be stated per-mission, then divided down — the per-test $\alpha$ is typically far smaller than intuition suggests.
Asymmetric costs. Rejecting one good measurement costs a little accuracy; accepting a bad one can corrupt the state and bias every subsequent test (because $P$ shrinks while the state moves). Gates are therefore set tight, and the system is designed to tolerate over-rejection.
Persistence / M-of-N logic. Requiring $M$ trips out of $N$ opportunities before declaring a permanent fault suppresses transient false alarms at the cost of detection latency — the cleanest way to buy robustness against single-sample noise.
Escalation. De-weight → reject a measurement → exclude a satellite → declare a sensor failed → declare a channel failed. Each level is harder to reverse, so each needs stronger evidence.

The whole trade is summarised by the ROC curve: for a given $\lambda$, you slide along a fixed curve trading $P_{FA}$ against $P_{MD}$. You can only leave the curve by increasing $\lambda$ — better sensors, more redundancy, better geometry, or longer observation. That is the value of writing $\lambda$ down explicitly: it tells you whether a performance shortfall is a tuning problem or an architecture problem.

5 · Failure modes of FDI itself

Pitfall	Mechanism	Mitigation
Optimistic $P$	test statistic inflated → false alarms, or state already biased → missed detections	covariance realism first; validate $q$ statistics against data before trusting the test
Fault already absorbed	filter fitted the fault, so the residual looks fine	redundancy-based tests that do not rely on the filter's self-assessment
Smearing	one bad measurement corrupts the state, making good ones look faulty	test before update; sequential processing with re-screening; solution separation
Multiple simultaneous faults	single-fault isolation logic mis-identifies	size redundancy for the required fault count; verify the single-fault assumption is acceptable
Unmodelled dynamics read as a fault	real motion the model lacks (flexure, slosh) trips the test	model it, or inflate $Q$ honestly rather than loosening the gate
No self-test on the detector	FDI logic is software and can itself fail silently	monitor the rejection rate as a health metric — an implausibly clean channel is suspicious too

6 · Further reading

Basseville & Nikiforov, Detection of Abrupt Changes: Theory and Application — the reference for CUSUM/GLR and change detection.
Gustafsson, Adaptive Filtering and Change Detection — practical treatment for estimation contexts.
Bar-Shalom, Li & Kirubarajan, Estimation with Applications to Tracking and Navigation — normalised innovation squared (NIS/NEES) and gating.
Walter & Enge, Weighted RAIM for Precision Approach — the weighted parity/least-squares formulation used for GNSS integrity.
Willsky, "A survey of design methods for failure detection in dynamic systems" (Automatica, 1976) — the classic survey framing detection, isolation and parity space.
Carpenter & D'Souza, Navigation Filter Best Practices (NASA/TP-2018-219822) — residual editing and underweighting in flight filters. Summary.