Rocket Navigation

A launch vehicle's navigator is not one filter — it is a sequence of estimators, each of which exists because the vehicle passes through a regime where the previous one stops being observable, stops being accurate enough, or stops being valid. This page walks that sequence from power-on on the pad to orbit insertion and booster recovery: which sensors are available when, which states each stage estimates and why those states and not others, what the measurement model is, and what the interfaces and timing look like at the system level.

Symbols used on this page are defined in the Nomenclature → inertial navigation.

Scope note: this is a generic, first-principles treatment assembled from the open literature — Titterton & Weston Strapdown Inertial Navigation Technology; Groves Principles of GNSS, Inertial and Multisensor Integrated Navigation; Farrell Aided Navigation; Kaplan & Hegarty Understanding GPS/GNSS; Bierman Factorization Methods for Discrete Sequential Estimation; Carpenter & D'Souza, NASA/TP-2018-219822 Navigation Filter Best Practices. Numbers are order-of-magnitude illustrations chosen to make the trade visible, not any particular vehicle's specification.

1 · What the navigator must produce, and against what error budget

Everything downstream — guidance, flight control, stage separation logic, range safety, payload pointing, landing — consumes one product: a time-tagged navigation state. Before designing any filter, it is worth being precise about what that product is, because the consumers have very different requirements and they drive different parts of the design.

Two consequences fall straight out of this table and they shape the whole architecture. First, attitude and position have different customers with different latency tolerance, which is why the fast inertial integration is architecturally separate from the slow aiding filter (§3, §6). Second, "accuracy" and "integrity" are different requirements: the filter that minimises RMS error is not automatically the one that can certify a bound, which is why measurement screening and RAIM-style consistency checks are first-class subsystems rather than afterthoughts (§7.3).

1.1 Why an IMU is unavoidable, and why it is never sufficient

A launch vehicle could in principle navigate on GNSS alone. It must not, for four independent reasons, and each of these is a design driver rather than a nicety:

• Bandwidth. GNSS gives 1–20 solutions/s. Structural and slosh modes needing active control live at tens of Hz. Control needs ~100–1000 Hz state. Only inertial sensors are fast enough.
• Dynamics. Under high jerk, staging transients and plume/ionospheric disturbance, GNSS carrier tracking loops stress and can lose lock; an IMU does not care.
• Attitude. A single GNSS antenna observes no attitude at all. Attitude is what the control system is actually closing on.
• Integrity. GNSS is a shared, jammable, spoofable RF resource. An inertial solution is a physically independent opinion, which is the basis of every fault-detection scheme on board.

But the same integration that gives bandwidth is also unbounded error growth. This is the central quantitative fact of the discipline, so it is worth writing the error propagation explicitly. Notation, used throughout: $\mathbf f$ is the specific force measured by the accelerometers, $\mathbf g$ is gravitational acceleration, $C^n_b$ is the rotation matrix taking body axes to the navigation frame, $[\,\mathbf a\times]$ denotes the skew-symmetric cross-product matrix of $\mathbf a$, and superscripts name the frame a vector is resolved in (§2.2). With $\delta\boldsymbol\theta$ the attitude (tilt) error, $b_a$ accelerometer bias and $b_g$ gyro bias, the error propagation for small errors over short times is:

$$ \delta\dot{\mathbf r}=\delta\mathbf v,\qquad \delta\dot{\mathbf v}\;\approx\;\underbrace{-[\mathbf f^n\times]\,\delta\boldsymbol\theta}_{\text{tilt mis-resolves specific force}} \;+\;\underbrace{C^n_b\,b_a}_{\text{accel bias}},\qquad \delta\dot{\boldsymbol\theta}\;\approx\;\underbrace{C^n_b\,b_g}_{\text{gyro bias}} $$

Integrating the three dominant terms separately gives the classic signatures — and in each case below the vehicle is taken to be near-stationary or coasting, so that $\|\mathbf f\|\approx g$. A constant accelerometer bias $b_a$ produces

$$ \delta r \;=\; \tfrac12 b_a t^2 $$

while a gyro bias $b_g$ first tilts the computed frame, which mis-resolves gravity $g$, which then double-integrates — a cubic:

$$ \delta\theta = b_g t,\qquad \delta a = g\,\delta\theta = g\,b_g t,\qquad \delta r \;=\; \tfrac{1}{6}\,g\,b_g\,t^3 $$

and an initial tilt error $\delta\theta_0$ that alignment failed to remove gives $\delta r=\tfrac12 g\,\delta\theta_0 t^2$. Put numbers in: a modest $b_a=100\ \mu g\approx10^{-3}\,$m/s² gives ~0.5 m after 30 s but ~180 m after 10 minutes. A gyro bias of $0.01^\circ/\text{h}$ ($4.8\times10^{-8}$ rad/s) gives only ~2 cm at 30 s but ~28 m at 10 min through the $t^3$ term. An initial tilt of just 1 milliradian — a very good alignment — costs $\tfrac12(9.81)(10^{-3})t^2\approx$ 4.4 m at 30 s and 1.8 km at 10 min.

2 · System architecture: what the boxes are and why they are separate

A recurring, defensible decomposition looks like the following. The important thing is not the names but why the cut lines are where they are: each boundary is placed at a change in rate, a change in criticality, or a change in the trust you can place in the data.

2.1 Why the fast mechanization is separated from the slow filter

This is the most important architectural decision, and it is forced by three different considerations landing on the same answer:

• Rate and latency. Control needs state at IMU rate with minimal lag. A covariance update is $O(n^3)$ in the state dimension; you cannot afford it at 1 kHz, and you do not need to — the correction changes slowly even though the state changes fast.
• Criticality and certification. The mechanization is simple, deterministic, and always runs. The filter is complex and can be wrong. Keeping them separate means a filter fault degrades you to free inertial rather than losing the vehicle — the mechanization has no dependence on the filter being sane.
• Linearisation validity. The filter estimates small corrections about the mechanized trajectory. Keeping the large, nonlinear, fast motion in the mechanization is exactly what keeps the filter's linearisation valid — this is the error-state formulation of §6.1.

The cost of the split is that corrections arrive late, referenced to an older state. That is why the mechanization keeps a buffered history of state and accumulated $F$: a measurement valid at $t-\tau$ must be applied at $t-\tau$ and the correction brought forward, not simply dumped onto the current state. This buffering is not an optimisation — without it you inject an error of $\|\dot{\mathbf x}\|\tau$ every update, which at launch accelerations is metres per second.

2.2 Frames, and why the choice is not cosmetic

Errors of frame handling are silent and catastrophic. Two examples with real magnitude: Earth rate is $\omega_{ie}=7.292\times10^{-5}$ rad/s, so omitting the Coriolis/transport term costs ~15°/h of apparent attitude error — larger than most gyro biases you are working hard to estimate. And an ECI↔ECEF conversion in error by 1 ms of time rotates the Earth's surface by $\omega_{ie}R_e\Delta t\approx0.46$ m. Hence the time base (§4) is a named subsystem.

3 · The mechanization: the one block that always runs

Strapdown mechanization is the deterministic core. Sensors give integrated increments over the interval — $\Delta\boldsymbol\theta=\int\boldsymbol\omega^b_{ib}\,dt$ and $\Delta\mathbf v=\int\mathbf f^b\,dt$ — and the mechanization converts these into a trajectory. Increments rather than instantaneous samples is itself a deliberate choice: integration in the sensor eliminates aliasing of vibration that plain sampling would fold into the band.

3.1 Attitude: why the rotation-vector form and not Euler integration

Attitude is propagated by composing the incremental rotation onto the current quaternion. With $\|\Delta\boldsymbol\theta\|=\phi$,

$$ q_{k+1}=q_k\otimes\delta q,\qquad \delta q=\begin{bmatrix}\cos(\phi/2)\\[2pt]\dfrac{\Delta\boldsymbol\theta}{\phi}\sin(\phi/2)\end{bmatrix} $$

Quaternions (or direction-cosine matrices) are used rather than Euler angles because Euler angles have coordinate singularities — a launch vehicle flying nose-up passes straight through the classic pitch-90° gimbal lock, where yaw and roll become indistinguishable and the kinematic equations blow up. A launch trajectory guarantees that geometry, so Euler integration is disqualified on day one. Normalisation $q\leftarrow q/\|q\|$ is applied each step because finite precision otherwise lets $\|q\|$ drift, which shows up as a spurious scale factor on every transformed vector.

3.2 Coning and sculling: why naive integration loses accuracy under vibration

Rotations do not commute, and the accelerometer triad rotates during the integration interval. Two second-order effects therefore appear whenever angular rate and acceleration have correlated oscillatory content — which is exactly what a rocket has, at every structural and engine frequency:

$$ \underbrace{\Delta\boldsymbol\theta_{con}=\tfrac12\!\int\!\boldsymbol\theta\times\boldsymbol\omega\,dt}_{\text{coning: rectified attitude error}} \qquad \underbrace{\Delta\mathbf v_{scul}=\tfrac12\!\int\!(\boldsymbol\theta\times\mathbf a+\mathbf v\times\boldsymbol\omega)\,dt}_{\text{sculling: rectified velocity error}} $$

These matter because they rectify: zero-mean vibration produces a non-zero mean error, so the effect is a steady drift, not noise that averages out. Left uncompensated under a few-arcminute coning motion the equivalent attitude drift can swamp a navigation-grade gyro's own bias — you would be paying for an expensive IMU and then throwing its performance away in the integration algorithm. This is why the compensation lives in the high-rate pre-processing, at the raw increment rate, and not in the filter.

3.2.1 Where does coning/sculling compensation actually run?

This is a frequent source of confusion, so it is worth stating plainly: it is never done in the Kalman filter. It is a deterministic integration correction, not an estimation problem — there is nothing statistical about it, and the filter runs 50–1000× too slowly to see the motion that causes it. It is always a high-rate code routine that runs before anything reaches the filter. The only real question is which high-rate routine — inside the IMU, or in the navigation computer:

The layered picture, then, is: IMU or high-rate routine handles algorithmic integration effects (coning, sculling, scale/misalignment, and the size-effect correction for accelerometers not colocated at a point); the mechanization handles the deterministic frame/gravity physics; the filter handles only the slowly-varying stochastic errors (biases, tilt, clock). Each error goes to the layer that runs fast enough to see it.

3.3 Velocity and position: the terms that are easy to get wrong

In ECI the velocity update is short, which is a good reason to integrate there:

$$ \dot{\mathbf v}^i=C^i_b\,\mathbf f^b+\mathbf g^i(\mathbf r^i),\qquad \dot{\mathbf r}^i=\mathbf v^i $$

In a rotating or local-level frame, extra terms appear and each has a physical meaning that must not be dropped:

$$ \dot{\mathbf v}^n=C^n_b\mathbf f^b \underbrace{-\,(2\boldsymbol\omega^n_{ie}+\boldsymbol\omega^n_{en})\times\mathbf v^n}_{\text{Coriolis + transport}} +\underbrace{\mathbf g^n_l}_{\text{local gravity (incl. centrifugal)}} $$

Note the distinction between gravitation $\mathbf g$ (mass attraction) and local gravity $\mathbf g_l=\mathbf g-\boldsymbol\omega_{ie}\times(\boldsymbol\omega_{ie}\times\mathbf r)$, which is what a plumb bob and a stationary accelerometer actually measure. Mixing them up puts a ~0.3% error on the dominant term of the whole equation. Gravity itself must be modelled well enough: a spherical model is wrong by ~$10^{-3}g$, and the $J_2$ oblateness term is the first correction that matters for ascent and is essential for any orbital propagation.

4 · The time base — the interface that makes everything else meaningful

A navigation state without a trustworthy time tag is not a measurement, it is a rumour. Time is a named subsystem because four distinct error mechanisms all present as "position error" and are otherwise indistinguishable from each other:

The design response is threefold, and the same three ideas recur in every well-built navigator. (1) Every datum carries its own time tag at the instant of validity, and the filter uses the tag, never the order of arrival. (2) The onboard clock is steered softly, or not at all. A hard jump in the time base is a discontinuity in the state transition and corrupts the filter; it is far better to estimate the offset and drift as states and apply a smooth correction. (3) GNSS time is treated as a measurement, not as truth — it goes through the same screening as any other observable, because a receiver reporting a wrong time is a real failure mode and it would otherwise poison every other channel at once.

5 · Ground alignment: on the pad, and why it takes two stages

Before flight the navigator must determine its initial attitude. Position and velocity are nearly free — the launch point is surveyed, and velocity is zero apart from Earth rotation, which is known analytically. But attitude has to be measured, and recall from §1.1 that a 1 mrad initial tilt becomes ~1.8 km of position error after 10 minutes of unaided flight. This is why alignment is treated as two distinct modes rather than one: they solve different observability problems and have different convergence times.

5.1 Coarse alignment — levelling from the gravity vector

A stationary accelerometer triad measures specific force $\mathbf f^b=-C^b_n\,\mathbf g^n$, i.e. it observes the direction of the local vertical expressed in body axes. That single vector immediately fixes two of the three attitude degrees of freedom — roll and pitch:

$$ \phi=\operatorname{atan2}\!\left(-f_y,\,-f_z\right),\qquad \theta=\operatorname{atan2}\!\left(f_x,\;\sqrt{f_y^2+f_z^2}\right) $$

This is fast (a short average over noise) and robust, and it is only capable of levelling. The reason is pure geometry and it is the key insight of the whole alignment problem: rotating about the gravity vector leaves $\mathbf f^b$ unchanged, so heading is in the null space of this measurement. One vector can never determine a full 3-DOF attitude — you need a second, non-parallel reference direction.

The accuracy achievable is set by how well you can separate gravity direction from accelerometer bias. A horizontal accelerometer bias $b_a$ tilts the estimated vertical by

$$ \delta\theta \;\approx\; \frac{b_a}{g} $$

so $100\ \mu g$ of bias produces $10^{-4}$ rad ≈ 20 arcsec of unavoidable levelling error. Averaging longer does not fix this — it is a bias, not noise. That hard floor is the reason coarse alignment is only the initialisation for a second stage, and the reason the bias itself must become a filter state.

5.2 Fine alignment / gyrocompassing — heading from Earth rotation

The second reference direction is the Earth's rotation axis, and the gyros can see it. A stationary navigation-grade gyro triad measures

$$ \boldsymbol\omega^b_{ib}=C^b_n\,\boldsymbol\omega^n_{ie},\qquad \boldsymbol\omega^n_{ie}=\omega_{ie}\begin{bmatrix}\cos L\\ 0\\ -\sin L\end{bmatrix}\ \text{(NED, latitude } L) $$

The horizontal component $\omega_{ie}\cos L$ points to true north. Given a levelled frame from §5.1, heading follows from the horizontal gyro components:

$$ \psi=\operatorname{atan2}\!\left(-\omega_y,\;\omega_x\right) $$

Now the difficulty. The total signal is $\omega_{ie}=15.04^\circ/\text{h}$, and the north component is only $\omega_{ie}\cos L$ — at $L=45^\circ$ about $10.6^\circ/\text{h}$. The heading error caused by a gyro bias $b_g$ is

$$ \delta\psi \;\approx\; \frac{b_g}{\omega_{ie}\cos L} $$

which has three brutal consequences that drive real system decisions:

• It demands navigation-grade gyros. For $\delta\psi=1$ mrad (0.057°) at $L=45^\circ$ you need $b_g\lesssim0.01^\circ/\text{h}$. A tactical-grade IMU at $1^\circ/\text{h}$ would give ~5.4° of heading error — useless. Self-alignment capability is what makes an IMU "navigation grade", far more than its drift number in isolation.
• It degrades with latitude as $1/\cos L$ and fails outright at the poles, where $\cos L\to0$ and north is unobservable from gyros at all.
• It is slow. You are estimating a ~10°/h signal in the presence of noise, which requires averaging over minutes — which is precisely why this is a filter (an estimator with a covariance that tells you when you are done) rather than a formula.

5.3 The alignment filter: states, and why each one is there

Fine alignment is run as a Kalman filter with a zero-velocity constraint as its measurement. The vehicle is bolted to the pad, so true velocity is known (zero, in an Earth-fixed sense). Any velocity the mechanization accumulates is therefore pure error — a direct observation of the error state. That is the trick: it converts an unobservable attitude problem into an observable one by supplying a measurement with zero uncertainty in the truth.

$$ \mathbf z=\hat{\mathbf v}-\mathbf 0=\delta\mathbf v,\qquad \mathbf x=\begin{bmatrix}\delta\mathbf v\\ \delta\boldsymbol\theta\\ \mathbf b_g\\ \mathbf b_a\end{bmatrix}\in\mathbb R^{12} $$

Two further practical points the covariance forces on the design. First, the transition criterion out of fine alignment is a covariance threshold — $\sigma_\psi$ below requirement, and trending flat — plus a minimum dwell time, not merely a timer. Second, the vertical channel is unstable in any local-level mechanization: an altitude error changes modelled gravity in the direction that increases the error, giving exponential rather than oscillatory divergence. On the pad that is handled by the surveyed height; in flight it is why a height-aiding source matters.

6 · GNSS-INS: the workhorse estimator

Once moving, the zero-velocity measurement is gone and the only thing that can bound inertial drift is an external absolute reference. GNSS-INS is the primary aided mode from lift-off through insertion. Its job is not to "compute position from GPS" — it is to estimate the slowly-varying error of the inertial solution, including the sensor errors, so that the inertial solution stays good even when GNSS goes away.

6.1 Why an error-state (indirect) filter, not a total-state filter

A direct filter would put position, velocity and attitude themselves in the state vector. Essentially all production inertial navigators instead estimate the error $\delta\mathbf x=\mathbf x-\hat{\mathbf x}$ about the mechanized trajectory. The reasons are decisive:

• Linearity where it counts. The vehicle's motion is violently nonlinear; its error dynamics are nearly linear because errors stay small. An EKF linearises about the current estimate, so the approximation quality depends on the size of the error, not the size of the motion.
• Rate separation. Errors evolve on timescales of seconds to the 84-minute Schuler period, while the trajectory evolves in milliseconds. The error filter can therefore run at 1–20 Hz while the mechanization runs at 1 kHz — the architectural split of §2.1 is only sound because of this formulation.
• Graceful degradation. If the filter stops, the mechanization continues with the last correction. In a total-state filter, the filter is the navigator, and there is nothing to fall back to.
• Small-angle attitude. The attitude error is a 3-vector $\delta\boldsymbol\theta$ with no singularity and no normalisation constraint, avoiding the quaternion's unit-norm problem inside the covariance. The correction is applied multiplicatively, $C\leftarrow(I-[\delta\boldsymbol\theta\times])\,C$, keeping the attitude on the manifold — the same multiplicative/MEKF idea used in spacecraft attitude filters.

6.2 The state vector, term by term, and why each earns its place

A representative ascent state is 15–17 core states plus GNSS nuisance states. Every state costs $O(n^2)$ memory and $O(n^3)$ time, and — more importantly — every weakly-observable state you add is a way for the filter to absorb error into the wrong place. So inclusion has to be justified:

6.3 Error dynamics and the process model

The continuous error model is $\delta\dot{\mathbf x}=A\,\delta\mathbf x+\mathbf w$. In an inertial frame, with $[\mathbf f\times]$ the skew matrix of measured specific force and $G=\partial\mathbf g/\partial\mathbf r$ the gravity gradient (tensor):

$$ A=\begin{bmatrix} 0 & I & 0 & 0 & 0\\ G & 0 & -[\mathbf f^i\times] & -C^i_b & 0\\ 0 & 0 & 0 & 0 & -C^i_b\\ 0 & 0 & 0 & -\tfrac{1}{\tau_a}I & 0\\ 0 & 0 & 0 & 0 & -\tfrac{1}{\tau_g}I \end{bmatrix},\qquad \delta\mathbf x=\begin{bmatrix}\delta\mathbf r\\ \delta\mathbf v\\ \delta\boldsymbol\theta\\ \mathbf b_a\\ \mathbf b_g\end{bmatrix} $$

Read the physics out of the structure — every non-zero block is a coupling that must exist:

• $-[\mathbf f^i\times]$ in the velocity row: attitude error couples into velocity error proportionally to the specific force being measured. During high-thrust ascent $\|\mathbf f\|$ can be several $g$, so this coupling is strong — which is good news, because strong coupling means GNSS velocity observations become powerful observations of attitude. This is the mechanism that makes in-flight re-alignment possible (§8), and it is why observability is dynamics-dependent.
• $-C^i_b$ blocks: bias enters in body axes and must be rotated in. Because $C^i_b$ changes as the vehicle manoeuvres, manoeuvring is what makes bias observable — a state flying straight and level cannot separate bias from tilt, while a pitch-over sweeps the coupling and separates them.
• $G$ (gravity gradient) in the position→velocity coupling: this is the term that makes the vertical channel unstable and produces the Schuler oscillation in the horizontal ones.
• $-\tfrac{1}{\tau}I$ on the bias rows: biases modelled as first-order Gauss-Markov processes rather than constants. A pure random walk lets uncertainty grow without bound; an exponentially-correlated model with correlation time $\tau$ and steady-state variance $\sigma^2$ matches how real instruments behave (bias instability over hours), and keeps $P$ from either exploding or collapsing to zero and going deaf.

6.3.1 The translation process model, written out explicitly

"Process model" means two different things that are easy to conflate, and the distinction matters because they run in different places at different rates:

The key point for translation specifically: the EKF does not use a vehicle dynamics model for position and velocity. There is no thrust model, no mass-flow model, no aerodynamic model in the ascent filter. The accelerometers measure the sum of all non-gravitational forces directly, so the IMU acts as the process model. This is the defining property of an inertially-driven filter and it is why the same filter works for any thrust profile, any winds, and any staging event without being retuned — it never needed to know them.

So the translation part of the propagation is the trapezoidal/midpoint integration of measured increments,

$$ \mathbf v_{k+1}=\mathbf v_k+\underbrace{C^i_{b,k+1/2}\,\Delta\mathbf v_k}_{\text{measured, attitude at interval midpoint}} +\underbrace{\mathbf g^i(\mathbf r_k)\,\Delta t}_{\text{modelled}},\qquad \mathbf r_{k+1}=\mathbf r_k+\tfrac{\Delta t}{2}\big(\mathbf v_k+\mathbf v_{k+1}\big) $$

and the corresponding error model — the part that is actually in the EKF — is the linear system whose translation rows are simply

$$ \delta\dot{\mathbf r}=\delta\mathbf v,\qquad \delta\dot{\mathbf v}=\underbrace{G\,\delta\mathbf r}_{\text{gravity gradient}} \underbrace{-\,[\mathbf f^i\times]\,\delta\boldsymbol\theta}_{\text{tilt}} \underbrace{-\,C^i_b\,\mathbf b_a}_{\text{bias}} \underbrace{-\,C^i_b\,\mathbf w_a}_{\text{VRW noise}} $$

Note what is absent and why: there is no $\delta\mathbf v$ term in $\delta\dot{\mathbf v}$ (no drag derivative, no damping), because the accelerometer already measured whatever drag did. The velocity-error equation is driven entirely by instrument errors and gravity-model errors. That is the whole reason accelerometer bias must be a state (§6.2) — in this formulation it is the only systematic forcing term in the velocity channel.

The two exceptions, both already covered, are where a real dynamics model does appear: orbit propagation (§10), where specific force is ~0 so a gravitational dynamics model genuinely beats integrating sensor noise; and the ship-motion predictor (§11.2), where a harmonic wave model is used to forecast. Ascent is not one of them.

The process-noise inputs to the translation channel come from the sensor noise specification rather than from any vehicle model — velocity random walk (VRW) on the accelerometers and angular random walk (ARW) on the gyros, plus the bias-instability driving terms:

$$ Q_c=\operatorname{diag}\big(\,\mathbf 0_{3},\ \sigma_{VRW}^2 I_3,\ \sigma_{ARW}^2 I_3,\ \tfrac{2\sigma_{b_a}^2}{\tau_a}I_3,\ \tfrac{2\sigma_{b_g}^2}{\tau_g}I_3\,\big) $$

with the position row zero because position has no independent noise source — it is the exact integral of velocity. In practice $\sigma_{VRW},\sigma_{ARW}$ start from the datasheet and are then inflated to cover unmodelled effects (vibration-rectified error, thermal transients, flexure), which is the honest way to keep the covariance realistic rather than merely optimistic.

Discretisation over a step $\Delta t$ uses $\Phi\approx I+A\Delta t+\tfrac12A^2\Delta t^2$ (more terms only if $\|A\|\Delta t$ is not small), with process noise accumulated as

$$ Q_k=\int_0^{\Delta t}\Phi(\tau)\,Q_c\,\Phi(\tau)^\top d\tau \;\approx\;\tfrac12\big(\Phi Q_c\Phi^\top+Q_c\big)\Delta t $$

$Q$ is the tuning that matters most in practice. Too small and the filter becomes over-confident, stops listening, and diverges while reporting a small covariance — the classic and most dangerous failure. Too large and it chases noise and never learns the biases, throwing away the calibration investment of §6.2.

6.4 Numerical form: why factorised updates and Joseph form

The textbook update $P=(I-KH)P^-$ is numerically fragile: in finite precision it can lose symmetry and develop negative eigenvalues, at which point the filter is meaningless while still producing plausible numbers. Flight code therefore uses a form that cannot do that:

$$ \underbrace{P=(I-KH)P^-(I-KH)^\top+KRK^\top}_{\text{Joseph form — symmetric, positive-semidefinite by construction}} $$

and frequently a factorised representation — UDU$^\top$ or square-root/Bierman-Thornton — which propagates a factor of $P$ rather than $P$ itself. The condition number of the factor is the square root of that of $P$, effectively doubling available precision. This matters here specifically because the state mixes quantities spanning many orders of magnitude (metres of position against $10^{-8}$ rad/s of gyro bias), so $P$ is inherently badly scaled. Related standard practices for the same reason: sequential (scalar) processing of measurements to avoid inverting $S$, underweighting to protect against linearisation error when residuals are large, and residual editing so one bad measurement cannot move the state.

7 · GNSS processing — turning RF into a valid residual

"GNSS gives you position" hides most of the engineering. The filter needs a residual and a variance, both defensible, and producing them requires a chain of corrections each of which is larger than the accuracy being sought.

7.1 Pseudorange: the measurement and its error budget

$$ \rho = \underbrace{\|\mathbf r_{sv}-\mathbf r_{rx}\|}_{\text{geometric range}} + \underbrace{c\,(b_{rx}-b_{sv})}_{\text{clock biases}} + \underbrace{I}_{\text{ionosphere}} + \underbrace{T}_{\text{troposphere}} + \underbrace{\epsilon_{mp}}_{\text{multipath}} + \nu $$

The measurement model for the filter is the linearisation of the above. For pseudorange the geometry row is the unit line-of-sight vector, which is why geometry (DOP) and not just measurement noise sets accuracy:

$$ H_\rho=\begin{bmatrix}-\hat{\mathbf u}^\top & \mathbf 0 & \mathbf 0 & \mathbf 0 & \mathbf 0 & c & 0\end{bmatrix}, \qquad \hat{\mathbf u}=\frac{\mathbf r_{sv}-\hat{\mathbf r}_{rx}}{\|\mathbf r_{sv}-\hat{\mathbf r}_{rx}\|} $$

7.2 Delta-range / Doppler: why velocity aiding is the valuable part

Carrier-phase change over an interval (delta-range, or accumulated Doppler) is a far more precise observable than code pseudorange — millimetre-level phase noise versus metre-level code noise. Differencing over an interval cancels the ambiguity, leaving a direct measurement of range rate:

$$ \Delta\rho_{k}=\lambda\big(\phi_k-\phi_{k-1}\big) \;\approx\;\int_{t_{k-1}}^{t_k}\!\big[\hat{\mathbf u}^\top(\mathbf v_{sv}-\mathbf v_{rx})+c\,\dot b\big]dt $$

This matters disproportionately for a launch vehicle for two reasons. First, insertion accuracy is a velocity problem (§1), so the most precise observable is aimed at the most important state. Second, from the $-[\mathbf f\times]$ coupling of §6.3, velocity observations are the principal route by which attitude and accelerometer bias become observable in flight. Precise velocity aiding under high specific force is what lets the filter calibrate the IMU during ascent.

7.3 Screening, RAIM and the integrity chain

Kalman filters are optimal for Gaussian noise and have zero robustness to outliers: one 100 m multipath error weighted as a 1 m measurement will move the state hard, and — worse — will shrink $P$ while doing it, making the filter more confident of a worse answer. A layered defence is therefore mandatory, with each layer catching what the previous cannot:

The deep point: the innovation gate depends on $P$ being right, and $P$ is only right if the filter has not already been corrupted. That circularity is why redundancy-based checks (RAIM, solution separation, cross-source voting) are needed in addition to innovation gating — they do not depend on the filter's own self-assessment. Note also the asymmetry that makes tuning hard: rejecting a good measurement costs a little accuracy, while accepting a bad one can lose the vehicle. Gates are set accordingly, and a mode that has rejected too much for too long must declare itself unhealthy rather than quietly coasting.

8 · Free inertial — the mode that must always be available

Free inertial is pure mechanization with no aiding: propagate, and honestly grow the covariance. It is not a degraded curiosity, it is the backbone, and it is entered both deliberately and as a fallback:

• Staging / separation transients — shock and attitude excursions make GNSS tracking unreliable for seconds at a time.
• Plume and fairing effects — antenna obscuration and RF attenuation during high-thrust phases.
• Jamming, spoofing, or receiver fault — any time GNSS is untrustworthy, which screening (§7.3) may have just declared.
• Deliberate exclusion during known-bad windows, rather than letting the filter eat corrupted data.

Two things make free inertial useful rather than merely a placeholder. First, the biases were calibrated during the aided phase (§6.2), so the coast starts from a much better sensor model than the spec sheet. Second, the covariance continues to propagate, $P\leftarrow\Phi P\Phi^\top+Q$, giving consumers a truthful, growing uncertainty — which is what lets a downstream consumer decide to stop trusting the state. A navigator that hides its own degradation is more dangerous than one that degrades.

9 · In-flight re-alignment — recovering attitude without stopping

Suppose alignment was cut short, or the vehicle sat on the pad long enough for gyro bias to walk, or a transient corrupted the attitude. On the ground you would re-run gyrocompassing; in flight you cannot — there is no zero-velocity measurement, and the Earth-rate signal is buried under vehicle dynamics.

The solution comes straight out of the $-[\mathbf f^i\times]$ coupling in §6.3. Because attitude error couples into velocity error in proportion to the specific force, high thrust makes attitude strongly observable from velocity measurements. Turn that structure around and it becomes an estimator:

$$ \delta\dot{\mathbf v}= -[\mathbf f^i\times]\,\delta\boldsymbol\theta - C^i_b\,\mathbf b_a + \dots \;\;\Longrightarrow\;\; \boxed{\ \text{observed velocity error over time}\ \Rightarrow\ \text{attitude error}\ } $$

The information content is proportional to $\|\mathbf f\|$ and to how much the direction of $\mathbf f$ changes: a single constant thrust direction leaves the rotation about $\mathbf f$ unobservable (the same null-space argument as coarse alignment in §5.1), while a pitch-over sweeps $\mathbf f$ through a plane and observes the remaining axis. So the design conclusion is that in-flight re-alignment converges during powered, manoeuvring flight and stalls during coast — the opposite availability profile to ground alignment, which is exactly why both exist.

10 · Orbit propagation — why a different propagator for coast

After insertion, or during a long exo-atmospheric coast, the vehicle is in free fall. Integrating the IMU through that phase is possible but pointless and harmful: the accelerometers measure essentially zero specific force (only drag and venting), so all you integrate is noise and bias, and $\delta r=\tfrac12b_at^2$ accumulates for no information gain.

The better model is dynamics. Position and velocity obey a known equation of motion, and integrating that with a well-modelled force field beats integrating a noisy sensor:

$$ \ddot{\mathbf r}= -\frac{\mu}{r^3}\mathbf r \underbrace{-\frac{3}{2}J_2\frac{\mu R_e^2}{r^5}\Big[\Big(1-5\frac{z^2}{r^2}\Big)\mathbf r+2z\,\hat{\mathbf e}_3\Big]}_{\text{oblateness — the first correction that actually matters}} + \mathbf a_{drag}+\mathbf a_{3body}+\dots $$

The system-level reasons this is a separate capability, rather than "just keep propagating":

• Error growth changes character. Inertial coast error grows polynomially from sensor bias; orbital propagation error grows from model error and initial-condition error, and along-track error grows mainly through period mismatch — a much slower, better-behaved growth for long coasts.
• The gravity model becomes the accuracy driver, so spherical harmonics beyond $J_2$ and a numerically stable evaluation (recursive normalised Legendre functions) start to matter.
• It enables prediction, which inertial integration cannot do: time of next GNSS visibility, ground track, insertion/deorbit targeting.
• Sanity checking. An independent dynamic prediction is a powerful cross-check during a phase where no other reference may be available.

11 · Relative navigation and sea-based recovery

Landing changes the question being asked. Absolute accuracy in ECEF is no longer what matters — what matters is the vector from the vehicle to the landing surface, and if that surface is a ship, it is moving in six degrees of freedom.

11.1 Why relative, and why differencing wins

If both vehicle and landing site observe the same GNSS satellites, the errors are common — satellite clock, ephemeris, and over short baselines ionosphere and troposphere. Differencing removes them:

$$ \nabla\rho = \rho_{veh}-\rho_{site} \;\;\Longrightarrow\;\;\text{SV clock, ephemeris, iono, tropo largely cancel} $$

The absolute position of both may be off by metres, yet the relative vector can be good to centimetres with carrier phase. Since the requirement is to land on a specific deck, this is precisely the error that needs to be small — a case where the system requirement is best met by not trying to improve absolute accuracy at all.

11.2 A moving landing surface: prediction, not just estimation

A ship in a seaway heaves, rolls and pitches with amplitudes of metres and degrees at wave periods of roughly 5–15 s. Two distinct problems follow, and they need different machinery:

• Estimation — know the deck's current position, attitude and velocity. This is a navigation problem on the ship: its own INS, GNSS (often multi-antenna for heading), and attitude/wind sensing.
• Prediction — the vehicle needs to know where the deck will be at touchdown, seconds ahead. Because wave motion is quasi-periodic and band-limited, it is genuinely predictable over a short horizon by fitting the dominant oscillatory modes:

$$ z(t)\approx \bar z+\sum_{i=1}^{N} A_i\cos(\omega_i t+\varphi_i) \quad\Longrightarrow\quad \hat z(t+\Delta t)\ \text{at the touchdown instant} $$

This is why prediction is a separate subsystem from estimation: the filter tracking the deck's state is optimised for accuracy now, whereas the predictor is a harmonic/AR model whose entire value is in the forward horizon — and whose uncertainty must grow honestly as that horizon extends.

11.3 Transfer alignment — aligning a vehicle that is already moving

A vehicle on a ship cannot gyrocompass: the deck moves, so the zero-velocity assumption of §5.3 is invalid, and the ~10°/h Earth-rate signal is buried under wave-induced rates orders of magnitude larger. Instead the ship's master INS supplies the reference, and the vehicle's navigator estimates the relative attitude — the boresight misalignment between the two instruments:

$$ \mathbf z=\mathbf v_{slave}-\mathbf v_{master},\qquad \mathbf x=\begin{bmatrix}\delta\mathbf v\\ \delta\boldsymbol\theta_{rel}\\ \mathbf b_g\\ \mathbf b_a\\ \text{flexure}\end{bmatrix} $$

The observability driver is the same as §9: shared manoeuvres — ship turns, or even wave-induced rotation — modulate the coupling and make the misalignment observable. Velocity matching is standard because velocity is what both systems know well. A flexure/vibration state is included because the two IMUs are metres apart on a structure that bends; treating a real, time-varying structural deflection as a rigid transform would put that error straight into the alignment.

12 · The mode manager — who owns the state, and when

All of the above are capabilities. What makes them a system is the arbitration logic that decides which estimator owns the navigation state at each instant, and on what evidence it hands over. Three principles make this tractable:

• Exactly one owner. Two estimators writing the state produces an unreproducible, untestable system. Others may run in parallel as monitors, but only one writes.
• Transitions are gated on covariance and health, not on timers. A timer cannot know whether the estimate is good. The covariance is the filter's own statement about whether it has converged; that is what it is for.
• Every transition is state-preserving. Handing over means passing $(\hat{\mathbf x},P)$ with $P$ inflated as appropriate, never re-initialising from scratch. Discarding $P$ throws away all the calibration earned in the previous mode — the §6.2 investment.

13 · Timing: rates, latency, and the ascent timeline

13.1 Rate structure within one major frame

The navigator is a multi-rate system. The diagram below is one 100 ms window, showing why the tasks sit at the rates they do — and note that the expensive covariance work is deliberately placed after the state output, so filter cost can never delay the control-critical product.

13.2 The mission timeline: which estimator and which sensors, phase by phase

This is the same sequence in mission time. The point of the diagram is the correlation between the lanes: aiding availability drops out exactly when dynamics are worst, which is why the passive modes have to be ready before they are needed.

13.3 Sensor availability and what it is good for, by phase

13.4 The call sequence within one aided cycle

Order is not arbitrary — each step exists to protect the next, and swapping two of them introduces a specific, named failure:

14 · Interfaces: what an ICD has to pin down, and why each field earns its place

Most integration failures are interface failures, not algorithm failures. The algorithm is tested in simulation; the interface is where two teams' assumptions meet. The fields below are the ones that, in practice, cause flight-data anomalies when left implicit.

14.1 Inputs

14.2 Outputs — and why covariance is part of the product

15 · Redundancy, voting and FDIR

Launch vehicles fly multiple navigation strings. The system question is not "how do we average them" but how do we detect that one is lying, since a faulty string that votes confidently is more dangerous than one that fails silent.

• Independent sensing chains. Separate IMUs, receivers, antennas and power — common-mode failures (a shared clock, a shared supply) defeat redundancy no matter how many strings you have.
• Mid-value select or voting on the outputs rather than averaging: the median is robust to a single arbitrary outlier, while the mean is dragged by it in proportion to how wrong it is.
• Cross-string consistency tests scaled by the strings' own covariances — the disagreement threshold must grow as the solutions legitimately degrade, or you will start failing healthy strings during a long coast.
• Analytical redundancy. Inertial vs GNSS vs dynamic (orbit) propagation are three physically different opinions; agreement among them is much stronger evidence than agreement between two copies of the same algorithm eating the same data.
• Fail-silent preferred over fail-arbitrary. A string that declares itself invalid is easy to handle; one that emits plausible-but-wrong numbers is the hard case, and is the reason for the screening layers of §7.3 and the health flags of §14.2.

16 · Putting it together: the error budget as a design argument

The whole design can be summarised by which term dominates in each phase, because that is what tells you where to spend money and effort.

17 · Further reading

• Titterton & Weston, Strapdown Inertial Navigation Technology — mechanization, coning/sculling, alignment, the vertical-channel instability.
• Groves, Principles of GNSS, Inertial and Multisensor Integrated Navigation Systems — integration architectures (loose/tight/deep), error-state models, transfer alignment.
• Farrell, Aided Navigation — observability of aided INS and the structure of the error dynamics.
• Kaplan & Hegarty, Understanding GPS/GNSS: Principles and Applications — measurement models, error budgets, receiver behaviour.
• Bierman, Factorization Methods for Discrete Sequential Estimation — UDU/square-root filtering and why it is used in flight software.
• Carpenter & D'Souza (eds.), Navigation Filter Best Practices, NASA/TP-2018-219822 — underweighting, residual editing, consider states, covariance realism. Summarised here.
• Walter & Enge, Weighted RAIM for Precision Approach — the integrity-monitoring formulation.

Related pages: IMU & inertial navigation · Attitude & rotations · The EKF · Filtering: KF/EKF/UKF/PF · GNSS · Alt-PNT when GNSS is denied · ADCS pointing case study.