Measurement Validation and Innovation Gating

4.2.15 Measurement Validation and Innovation Gating

A state estimator should not automatically trust every measurement that arrives.

Real spacecraft sensors can produce measurements that are:

• physically impossible,
• inconsistent with the predicted spacecraft state,
• corrupted by noise spikes,
• affected by multipath,
• associated with the wrong optical feature,
• generated by a false LiDAR return,
• delayed or mistimed,
• affected by sensor faults,
• numerically malformed,
• inconsistent with the expected uncertainty.

Therefore, before a measurement is allowed to influence the navigation estimate, it should normally pass a measurement validation process.

The central idea is:

\[ \boxed{ \text{Predict What the Sensor Should Measure} } \]

\[ \downarrow \]

\[ \boxed{ \text{Compare Prediction with Actual Measurement} } \]

\[ \downarrow \]

\[ \boxed{ \text{Quantify How Statistically Plausible the Difference Is} } \]

\[ \downarrow \]

\[ \boxed{ \text{Accept, Downweight, or Reject the Measurement}. } \]

The most important mathematical quantity is the innovation:

\[ \boxed{ \mathbf r_k = \mathbf z_k - \hat{\mathbf z}_k } \]

where

\[ \hat{\mathbf z}_k = h( \hat{\mathbf x}_k^- ). \]

The innovation tells us how different the real sensor output is from what the estimator expected.

But the magnitude of

\[ \mathbf r_k \]

alone is not sufficient.

A residual of

\[ 1~\mathrm{m} \]

might be extremely large for a high-precision LiDAR measurement but perfectly acceptable for a noisy far-range sensor.

Therefore the residual must be interpreted relative to its expected covariance:

\[ \boxed{ \mathbf S_k = \mathbf H_k \mathbf P_k^- \mathbf H_k^T + \mathbf R_k. } \]

The combination of innovation and innovation covariance leads naturally to the Mahalanobis distance and Normalised Innovation Squared (NIS):

\[ \boxed{ \mathrm{NIS} = \mathbf r_k^T \mathbf S_k^{-1} \mathbf r_k. } \]

This provides the statistical foundation for innovation gating.

4.2.15.1 Why Measurement Validation Is Necessary

Consider a navigation filter using:

\[ \boxed{ \text{GNSS} + \text{Camera} + \text{LiDAR} + \text{Star Tracker} + \text{IMU}. } \]

Suppose one camera measurement is incorrect.

If it is blindly fused, the Kalman correction may move the navigation state toward the wrong target location.

Similarly, a false LiDAR return can cause a large range correction.

Therefore:

\[ \boxed{ \text{Measurement Availability} \neq \text{Measurement Validity}. } \]

A measurement should normally be checked before fusion.

4.2.15.2 Measurement Validation Is a Layered Process

Validation is usually not one single test.

A measurement may pass through several layers:

\[ \boxed{ \text{Packet / Interface Validation} } \]

\[ \downarrow \]

\[ \boxed{ \text{Physical Range Validation} } \]

\[ \downarrow \]

\[ \boxed{ \text{Timing Validation} } \]

\[ \downarrow \]

\[ \boxed{ \text{Geometric / Association Validation} } \]

\[ \downarrow \]

\[ \boxed{ \text{Innovation Statistical Test} } \]

\[ \downarrow \]

\[ \boxed{ \text{Accept / Downweight / Reject}. } \]

This is important because statistical gating should not be expected to catch every possible failure mode.

4.2.15.3 Basic Measurement Model

Consider the nonlinear measurement model:

\[ \boxed{ \mathbf z_k = h( \mathbf x_k ) + \mathbf v_k } \]

with

\[ \boxed{ \mathbf v_k \sim \mathcal N( \mathbf 0, \mathbf R_k ). } \]

The predicted measurement is

\[ \boxed{ \hat{\mathbf z}_k = h( \hat{\mathbf x}_k^- ). } \]

The innovation is then

\[ \boxed{ \mathbf r_k = \mathbf z_k - \hat{\mathbf z}_k. } \]

4.2.15.4 Physical Meaning of the Innovation

The innovation answers:

\[ \boxed{ \text{How Surprising Is the New Measurement Relative to the Prediction?} } \]

If

\[ \mathbf r_k \approx \mathbf 0, \]

the measurement agrees closely with prediction.

If

\[ \|\mathbf r_k\| \]

is large, possible causes include:

• genuine state error,
• large measurement noise,
• inaccurate process model,
• sensor bias,
• wrong data association,
• timing error,
• sensor fault,
• outlier.

Therefore:

\[ \boxed{ \text{Large Innovation} \neq \text{Automatically Bad Measurement}. } \]

Its magnitude must be judged relative to expected uncertainty.

4.2.15.5 Innovation Covariance

For a linearized measurement model,

\[ \boxed{ \mathbf z_k \approx \mathbf H_k \mathbf x_k + \mathbf v_k, } \]

the innovation covariance is

\[ \boxed{ \mathbf S_k = \mathbf H_k \mathbf P_k^- \mathbf H_k^T + \mathbf R_k. } \]

This contains two uncertainty sources:

\[ \boxed{ \mathbf H_k \mathbf P_k^- \mathbf H_k^T } \]

from predicted-state uncertainty, and

\[ \boxed{ \mathbf R_k } \]

from sensor measurement uncertainty.

4.2.15.6 Why Residual Magnitude Alone Is Misleading

Suppose two sensors produce the same residual:

\[ r=1. \]

For sensor A,

\[ \sigma=0.01. \]

For sensor B,

\[ \sigma=10. \]

The same residual is:

\[ 100\sigma \]

for sensor A but only

\[ 0.1\sigma \]

for sensor B.

Therefore:

\[ \boxed{ \text{Residual Must Be Normalized by Uncertainty}. } \]

4.2.15.7 Scalar Normalized Residual

For a scalar measurement with innovation variance

\[ S, \]

define

\[ \boxed{ \nu = \frac{r}{\sqrt S}. } \]

This is the residual expressed in units of standard deviation.

For example:

\[ |\nu|=1 \]

means the residual is one standard deviation from prediction.

4.2.15.8 Multi-Dimensional Measurements

For a measurement vector

\[ \mathbf z \in \mathbb R^m, \]

the innovation may contain correlated components.

For example, a 2-D camera measurement:

\[ \boxed{ \mathbf z = \begin{bmatrix} u\\ v \end{bmatrix}. } \]

Simple component-wise thresholds may fail because the innovation covariance can be rotated and correlated.

This motivates the Mahalanobis distance.

4.2.15.9 Mahalanobis Distance

The squared Mahalanobis distance is

\[ \boxed{ d_M^2 = \mathbf r^T \mathbf S^{-1} \mathbf r. } \]

The Mahalanobis distance itself is

\[ \boxed{ d_M = \sqrt{ \mathbf r^T \mathbf S^{-1} \mathbf r }. } \]

This measures residual magnitude relative to the covariance geometry.

4.2.15.10 Euclidean Distance vs Mahalanobis Distance

Euclidean distance is

\[ \boxed{ d_E = \|\mathbf r\|. } \]

It does not consider uncertainty.

Mahalanobis distance is

\[ \boxed{ d_M = \sqrt{ \mathbf r^T \mathbf S^{-1} \mathbf r }. } \]

It accounts for:

• measurement scale,
• uncertainty magnitude,
• correlations between measurement components.

Therefore Mahalanobis distance is generally the correct statistical quantity for innovation gating.

4.2.15.11 Innovation Ellipsoid

For a 2-D innovation, the expected uncertainty region is an ellipse.

The equation

\[ \boxed{ \mathbf r^T \mathbf S^{-1} \mathbf r = c } \]

defines an equal-probability contour.

For 3-D measurements, it defines an ellipsoid.

Therefore innovation gating is geometrically equivalent to checking whether the residual lies inside an expected covariance ellipsoid.

4.2.15.12 Normalised Innovation Squared

The Normalised Innovation Squared is

\[ \boxed{ \epsilon_\nu = \mathbf r^T \mathbf S^{-1} \mathbf r. } \]

It is often written simply as

\[ \boxed{ \mathrm{NIS} = \mathbf r^T \mathbf S^{-1} \mathbf r. } \]

Thus for a single measurement update,

\[ \boxed{ \mathrm{NIS} = d_M^2. } \]

4.2.15.13 Why NIS Is Important

NIS combines

• the observed residual,
• predicted-state uncertainty,
• sensor uncertainty.

Therefore it answers:

\[ \boxed{ \text{Is This Residual Reasonable Given What the Filter Believes Its Uncertainty Is?} } \]

This is more meaningful than checking residual magnitude alone.

4.2.15.14 NIS Distribution

If

• the model is correct,
• the covariance is correctly tuned,
• measurement noise is Gaussian,
• the estimator is statistically consistent,

then for measurement dimension

\[ m, \]

the NIS approximately follows a chi-square distribution:

\[ \boxed{ \mathrm{NIS} \sim \chi_m^2. } \]

This provides a probabilistic threshold for gating.

4.2.15.15 Degrees of Freedom

The degrees of freedom equal the dimension of the innovation:

\[ \boxed{ m = \dim( \mathbf z ). } \]

Examples:

Scalar range

\[ m=1. \]

Image-plane point

\[ m=2. \]

3-D position

\[ m=3. \]

Position + velocity

\[ m=6. \]

The gate threshold must therefore depend on measurement dimension.

4.2.15.16 Chi-Square Gate

Let

\[ \gamma \]

be a chosen chi-square threshold.

Then:

\[ \boxed{ \mathrm{NIS} \le \gamma } \]

means the measurement passes the gate.

If

\[ \boxed{ \mathrm{NIS} > \gamma, } \]

the measurement is statistically inconsistent with the predicted measurement under the assumed model.

4.2.15.17 Gate Probability

The threshold is usually selected from

\[ \boxed{ \gamma = \chi^2_{m,\alpha} } \]

where

\[ \alpha \]

is a desired probability level.

Typical choices may correspond to:

• 95%,
• 99%,
• 99.7%.

The correct value depends on the application and measurement dimension.

4.2.15.18 Gate Acceptance Region

For an m-dimensional measurement:

\[ \boxed{ \mathcal G = \left\{ \mathbf r: \mathbf r^T \mathbf S^{-1} \mathbf r \le \gamma \right\}. } \]

If the innovation lies inside

\[ \mathcal G, \]

the measurement is accepted.

If it lies outside,

\[ \mathbf r\notin\mathcal G, \]

it may be rejected or treated as suspicious.

4.2.15.19 Example: Scalar 3-Sigma Gate

For a scalar measurement,

\[ r\sim\mathcal N(0,S). \]

A simple gate is

\[ \boxed{ |r| \le 3\sqrt S. } \]

Squaring both sides gives

\[ \boxed{ \frac{r^2}{S} \le 9. } \]

Thus the scalar three-sigma gate corresponds to

\[ \boxed{ \mathrm{NIS} \le 9. } \]

approximately.

4.2.15.20 Scalar Gate vs Multi-Dimensional Gate

For a scalar sensor, a sigma threshold may be sufficient.

For multi-dimensional measurements, component-wise sigma thresholds do not properly account for covariance correlation.

Therefore:

\[ \boxed{ \text{Scalar Measurement} \rightarrow \text{Sigma Gate Can Be Convenient} } \]

while

\[ \boxed{ \text{Vector Measurement} \rightarrow \text{Mahalanobis / NIS Gate Preferred}. } \]

4.2.15.21 Measurement Acceptance

A simple logic is:

\[ \boxed{ \text{if } \mathrm{NIS} \le \gamma \Rightarrow \text{Accept Measurement}. } \]

Then the ordinary measurement update is performed.

For a Kalman-type filter:

\[ \boxed{ \hat x^+ = \hat x^- + K\mathbf r. } \]

4.2.15.22 Measurement Rejection

If

\[ \boxed{ \mathrm{NIS} > \gamma, } \]

the simplest action is

\[ \boxed{ \hat x^+ = \hat x^- } \]

and

\[ \boxed{ P^+ = P^-. } \]

No measurement correction is applied.

This protects the estimator from a potentially harmful update.

4.2.15.23 Rejection Does Not Mean the Sensor Is Failed

A single rejected measurement may result from:

• random noise,
• temporary obstruction,
• unusual geometry,
• genuine rapid maneuver,
• measurement association error.

Therefore:

\[ \boxed{ \text{One Gate Failure} \neq \text{Permanent Sensor Failure}. } \]

Persistent or patterned failures are much more informative.

4.2.15.24 Hard Gating

Hard gating means:

\[ \boxed{ \text{Accept} \quad\text{or}\quad \text{Reject}. } \]

There is no intermediate weighting.

This is simple and common in safety-critical estimators.

4.2.15.25 Soft Gating

Instead of completely rejecting a suspicious measurement, its influence can be reduced.

Possible approaches include:

• increasing R,
• robust weighting,
• M-estimators,
• covariance scaling.

Conceptually:

\[ \boxed{ \text{Large Residual} \rightarrow \text{Smaller Measurement Influence}. } \]

4.2.15.26 Adaptive Measurement Covariance

Suppose a measurement is somewhat suspicious but not clearly invalid.

One approach is to inflate

\[ R. \]

For example:

\[ \boxed{ R_{\text{eff}} = \lambda R } \]

with

\[ \lambda>1. \]

Then the Kalman gain becomes smaller.

This causes the filter to trust the measurement less.

4.2.15.27 Caution with Adaptive R

Inflating

\[ R \]

should not be used to hide:

• wrong frame transformations,
• timing errors,
• calibration errors,
• systematic model errors.

Otherwise the estimator may appear stable while the underlying defect remains.

Thus:

\[ \boxed{ \text{Adaptive Covariance} \neq \text{Substitute for Correct Modelling}. } \]

4.2.15.28 Innovation Gating Before the Kalman Update

The correct order is normally:

\[ \boxed{ \text{Predict Measurement} } \]

\[ \downarrow \]

\[ \boxed{ \text{Compute Innovation} } \]

\[ \downarrow \]

\[ \boxed{ \text{Compute Innovation Covariance} } \]

\[ \downarrow \]

\[ \boxed{ \text{Calculate NIS} } \]

\[ \downarrow \]

\[ \boxed{ \text{Gate} } \]

\[ \downarrow \]

\[ \boxed{ \text{Only Then Apply Measurement Update}. } \]

The invalid measurement should not be fused first and rejected afterward.

4.2.15.29 Sensor-Specific Gates

Different sensors should generally have different gating parameters.

For example:

\[ \boxed{ \gamma_{\text{GNSS}} } \]

\[ \boxed{ \gamma_{\text{camera}} } \]

\[ \boxed{ \gamma_{\text{LiDAR}} } \]

\[ \boxed{ \gamma_{\text{star tracker}}. } \]

Reasons include:

• different measurement dimensions,
• different noise models,
• different failure modes,
• different operational consequences.

4.2.15.30 GNSS Validation

GNSS measurements may be affected by:

• multipath,
• poor satellite geometry,
• cycle slips,
• receiver faults,
• stale solution,
• poor fix quality.

Validation may use:

\[ \boxed{ \text{Receiver Status} } \]

\[ + \]

\[ \boxed{ \text{Satellite / Geometry Checks} } \]

\[ + \]

\[ \boxed{ \text{Innovation Gate}. } \]

4.2.15.31 GNSS Position Innovation

For position measurement:

\[ \boxed{ \mathbf r_r = \mathbf r_{\text{GNSS}} - \hat{\mathbf r}^-. } \]

Then

\[ \boxed{ \mathrm{NIS}_r = \mathbf r_r^T \mathbf S_r^{-1} \mathbf r_r. } \]

If the GNSS solution is inconsistent with predicted navigation state, it may be rejected.

4.2.15.32 GNSS Position and Velocity Joint Gate

A combined measurement may be

\[ \boxed{ \mathbf z_G = \begin{bmatrix} \mathbf r_G\\ \mathbf v_G \end{bmatrix}. } \]

Then

\[ m=6. \]

A six-dimensional chi-square gate can be used.

This evaluates the combined position-velocity consistency.

4.2.15.33 Separate GNSS Sub-Gates

Sometimes position and velocity should be gated independently.

For example:

\[ \boxed{ \mathrm{NIS}_{pos} } \]

and

\[ \boxed{ \mathrm{NIS}_{vel}. } \]

This can help isolate whether only one portion of the GNSS solution is problematic.

4.2.15.34 Camera Measurement Validation

Camera measurements may fail because of:

• incorrect target detection,
• feature mismatch,
• poor illumination,
• blur,
• occlusion,
• wrong pose solution,
• ambiguous target geometry.

Therefore innovation gating should usually be combined with vision-specific quality metrics.

4.2.15.35 Image-Plane Innovation

Suppose the camera observes image coordinates:

\[ \boxed{ \mathbf z_C = \begin{bmatrix} u\\ v \end{bmatrix}. } \]

The predicted image location is

\[ \boxed{ \hat{\mathbf z}_C = \begin{bmatrix} \hat u\\ \hat v \end{bmatrix}. } \]

The residual is

\[ \boxed{ \mathbf r_C = \begin{bmatrix} u-\hat u\\ v-\hat v \end{bmatrix}. } \]

Then

\[ \boxed{ \mathrm{NIS}_C = \mathbf r_C^T \mathbf S_C^{-1} \mathbf r_C. } \]

4.2.15.36 Camera Feature Association Gate

Before a detected feature is associated with a predicted feature, require:

\[ \boxed{ d_M^2 \le \gamma. } \]

This defines a statistical search region in the image.

Only candidate features inside the gate are considered plausible matches.

4.2.15.37 Why Association Gating Matters

Suppose several bright objects exist in the image.

Without gating, the navigation system may associate the wrong object with the target.

A statistical gate reduces the candidate search region and protects the estimator.

Thus innovation gating is useful both for:

• estimator protection,
• data association.

4.2.15.38 Multiple Camera Features

Suppose the camera tracks

\[ N_f \]

features.

Each feature may have its own residual:

\[ \boxed{ \mathbf r_i = \mathbf z_i - \hat{\mathbf z}_i. } \]

Each feature can be individually gated before forming the final measurement update.

This prevents a small number of bad features from corrupting the whole pose estimate.

4.2.15.39 Feature-Level vs Pose-Level Gating

Camera processing can be validated at two levels.

Feature Level

Check each image feature before pose estimation.

Pose Level

Check the final estimated pose against the navigation prediction.

A robust system may use both.

4.2.15.40 LiDAR Measurement Validation

LiDAR may produce:

• range,
• bearing,
• point cloud,
• relative pose.

Possible bad data include:

• multipath-like reflections,
• background returns,
• target-edge returns,
• partial target visibility,
• false pose convergence.

Validation should therefore combine physical and statistical checks.

4.2.15.41 LiDAR Range Gate

For a range measurement:

\[ \boxed{ \rho_m. } \]

Predicted range is

\[ \boxed{ \hat\rho = \| \hat{\mathbf r}_{rel} \|. } \]

Residual:

\[ \boxed{ r_\rho = \rho_m-\hat\rho. } \]

Then:

\[ \boxed{ \mathrm{NIS}_{\rho} = \frac{ r_\rho^2 }{ S_\rho }. } \]

4.2.15.42 LiDAR Physical Range Validation

Before NIS gating, verify:

\[ \boxed{ \rho_{\min} < \rho_m < \rho_{\max}. } \]

A physically impossible range should be rejected immediately.

There is no need to send obviously invalid data into the statistical gate.

4.2.15.43 Star Tracker Validation

Star-tracker measurements may fail due to:

• lost-in-space ambiguity,
• sun or Earth intrusion,
• false star pattern,
• blinding,
• poor quality solution.

Validation should consider both:

• tracker quality flags,
• innovation statistics.

4.2.15.44 Quaternion Innovation

For measured quaternion

\[ q_m \]

and predicted quaternion

\[ \hat q^-, \]

do not generally use component-wise subtraction.

Instead compute relative quaternion:

\[ \boxed{ \delta q = q_m \otimes (\hat q^-)^{-1}. } \]

Then convert the small attitude error into a 3-D vector:

\[ \boxed{ \delta\boldsymbol\theta. } \]

This vector can be statistically gated.

4.2.15.45 Attitude NIS

For attitude residual

\[ \delta\boldsymbol\theta, \]

the NIS is

\[ \boxed{ \mathrm{NIS}_{att} = \delta\boldsymbol\theta^T \mathbf S_\theta^{-1} \delta\boldsymbol\theta. } \]

This is appropriate for MEKF and ESKF attitude updates.

4.2.15.46 Magnetometer Validation

Magnetometer measurements can be corrupted by:

• onboard magnetic disturbances,
• current-dependent fields,
• saturation,
• calibration errors.

Useful checks include:

\[ \boxed{ \|\mathbf B_m\| } \]

against expected field magnitude and directional innovation against the predicted magnetic field vector.

4.2.15.47 Magnitude Gate

For a predicted field magnitude

\[ B_p \]

and measured magnitude

\[ B_m, \]

one may require

\[ \boxed{ |B_m-B_p| < \Delta B_{\max}. } \]

Only after basic physical validation should the vector measurement enter the estimator.

4.2.15.48 Sun Sensor Validation

Sun-sensor measurements may be invalid during:

• eclipse,
• partial obstruction,
• Earth albedo contamination,
• field-of-view limits.

Therefore a sun-vector measurement must first pass visibility logic.

Statistical gating comes afterward.

4.2.15.49 Measurement Geometry Must Be Valid First

Innovation gating assumes the measurement model is meaningful.

For example, if a camera target is outside the field of view, a predicted pixel location may not be valid.

Thus:

\[ \boxed{ \text{Geometry Validity} \rightarrow \text{Statistical Validity}. } \]

The order matters.

4.2.15.50 Timing Validation Before Innovation Gating

A delayed measurement fused at the wrong epoch can generate a large innovation.

The gate might reject it even though the sensor itself is healthy.

Therefore:

\[ \boxed{ \text{Correct Timestamp} \rightarrow \text{Correct Innovation} \rightarrow \text{Meaningful Gate}. } \]

Timing validation should occur before innovation gating.

4.2.15.51 Frame Validation Before Innovation Gating

Similarly, a measurement transformed using the wrong frame can produce a large innovation.

Thus the following should be correct before statistical validation:

• frame,
• units,
• timestamp,
• calibration,
• measurement model.

Otherwise the gate merely detects an upstream modelling mistake.

4.2.15.52 Innovation Whitening

Define whitened innovation:

\[ \boxed{ \tilde{\mathbf r} = \mathbf S^{-1/2} \mathbf r. } \]

Then

\[ \boxed{ \mathrm{NIS} = \tilde{\mathbf r}^T \tilde{\mathbf r}. } \]

This transforms the innovation into approximately unit-covariance coordinates.

4.2.15.53 Why Whitening Helps

In whitened coordinates, all measurement directions are normalized according to uncertainty.

Thus an innovation covariance ellipse becomes approximately a unit sphere.

This makes the meaning of the NIS geometrically intuitive.

4.2.15.54 Avoid Explicit Matrix Inversion

Although NIS is written as

\[ \mathbf r^T \mathbf S^{-1} \mathbf r, \]

software should usually avoid explicitly computing

\[ \mathbf S^{-1}. \]

Instead solve

\[ \boxed{ \mathbf S\mathbf y = \mathbf r } \]

and compute

\[ \boxed{ \mathrm{NIS} = \mathbf r^T \mathbf y. } \]

This is numerically more stable.

4.2.15.55 Cholesky-Based NIS

If

\[ \mathbf S \]

is positive definite, compute

\[ \boxed{ \mathbf S = \mathbf L\mathbf L^T. } \]

Solve:

\[ \boxed{ \mathbf L\mathbf y = \mathbf r. } \]

Then:

\[ \boxed{ \mathrm{NIS} = \mathbf y^T\mathbf y. } \]

This is efficient and numerically robust.

4.2.15.56 Innovation Covariance Must Be Positive Definite

A valid innovation covariance should generally satisfy

\[ \boxed{ \mathbf S \succ0. } \]

If it is singular or indefinite, possible causes include:

• covariance corruption,
• incorrect R,
• duplicate states,
• numerical problems,
• invalid measurement model.

This itself should trigger diagnostic logic.

4.2.15.57 NIS as an Instantaneous Test

A single NIS test evaluates one measurement event.

It is useful for detecting:

• isolated outliers,
• abrupt errors,
• association failures.

But persistent filter inconsistency may require looking at NIS over time.

4.2.15.58 Average NIS

Over

\[ N \]

updates, define:

\[ \boxed{ \overline{\mathrm{NIS}} = \frac1N \sum_{k=1}^{N} \mathrm{NIS}_k. } \]

This provides a long-term consistency indicator.

4.2.15.59 Expected NIS Mean

For a consistent m-dimensional measurement,

\[ \boxed{ E[ \mathrm{NIS} ] = m. } \]

Therefore if average NIS is much larger than

\[ m, \]

the filter may be overconfident or incorrectly modelled.

4.2.15.60 Low NIS Can Also Indicate a Problem

If NIS is systematically much smaller than expected, it may indicate:

• R is too large,
• P is too large,
• noise is overestimated.

Thus:

\[ \boxed{ \text{Very Low NIS} \neq \text{Automatically Excellent Filter}. } \]

The estimator may simply be too conservative.

4.2.15.61 Statistical Consistency

A consistent filter should have innovations whose actual statistics agree with predicted innovation covariance.

Conceptually:

\[ \boxed{ \text{Observed Innovation Distribution} \approx \text{Predicted Innovation Distribution}. } \]

NIS is one tool for testing this.

4.2.15.62 Innovation Mean

For a well-modelled unbiased estimator:

\[ \boxed{ E[ \mathbf r_k ] \approx \mathbf 0. } \]

A nonzero mean innovation may indicate:

• sensor bias,
• model bias,
• timing offset,
• frame error,
• calibration error.

4.2.15.63 Innovation Autocorrelation

Innovations should ideally be approximately white:

\[ \boxed{ E[ \mathbf r_k \mathbf r_{k-\ell}^T ] \approx 0 \qquad \ell\neq0. } \]

Persistent temporal correlation may indicate:

• unmodelled dynamics,
• colored noise,
• bias,
• improper process-noise tuning.

4.2.15.64 Innovation Sequence as a Diagnostic

Innovation plots are among the most useful estimator diagnostics.

Plot:

\[ \boxed{ r_k } \]

with bounds such as

\[ \boxed{ \pm3\sqrt{ \operatorname{diag} ( S_k ) }. } \]

This allows visual inspection of:

• bias,
• outliers,
• model mismatch,
• incorrect covariance.

4.2.15.65 NIS Time History

Plot:

\[ \boxed{ \mathrm{NIS}_k } \]

together with the selected chi-square threshold.

Repeated excursions may reveal:

• poor sensor model,
• sensor degradation,
• underestimated uncertainty,
• timing errors,
• fault onset.

4.2.15.66 False Rejection

Even a perfectly valid Gaussian measurement can occasionally fall outside the selected gate.

This is a false rejection.

If acceptance probability is

\[ P_G, \]

then approximately:

\[ \boxed{ P_{\text{false reject}} = 1-P_G. } \]

Therefore an extremely tight gate will reject more valid measurements.

4.2.15.67 Missed Detection

If the gate is too wide, invalid measurements may pass.

This is a missed detection from the outlier-detection perspective.

Therefore:

\[ \boxed{ \text{Tight Gate} \rightarrow \text{More False Rejections} } \]

while

\[ \boxed{ \text{Wide Gate} \rightarrow \text{More Bad Measurements Accepted}. } \]

Gate design is a trade-off.

4.2.15.68 Gate Selection Is an Engineering Decision

The gate probability should consider:

• sensor reliability,
• measurement update rate,
• consequences of a bad update,
• ability to reacquire,
• mission phase,
• expected non-Gaussian behavior.

There is no universally correct gate probability.

4.2.15.69 Mission-Phase-Dependent Gates

Far from the target, uncertainty may be large and measurements sparse.

A wider gate may help acquisition.

Near capture, incorrect measurements can be dangerous.

The system may use:

\[ \boxed{ \gamma = \gamma( \text{mission phase} ). } \]

However, changing the gate should be based on defined requirements rather than arbitrary tuning.

4.2.15.70 Acquisition Gate

During initial target acquisition, predicted state uncertainty may be large.

Therefore:

\[ \boxed{ \mathbf S } \]

is already large.

The statistical gate naturally expands.

In some systems, an additional broad acquisition gate may be defined.

4.2.15.71 Tracking Gate

Once tracking is established, covariance becomes smaller.

Therefore the innovation gate narrows automatically through

\[ \mathbf S. \]

This is desirable because well-established tracking should tolerate less unexpected measurement deviation.

4.2.15.72 Reacquisition Gate

After sensor dropout, uncertainty grows.

A returning measurement may therefore require:

• larger predicted S,
• relaxed physical association logic,
• staged confirmation.

Reacquisition should not necessarily use the same logic as steady-state tracking.

4.2.15.73 Sensor Confirmation Logic

For a suspicious sensor, one may require several consistent measurements before returning it to full use.

For example:

\[ \boxed{ N_{\text{good}} \ge N_{\text{reaccept}}. } \]

This avoids rapid accept/reject oscillation.

4.2.15.74 Consecutive Gate Failures

A sensor may be declared suspect after:

\[ \boxed{ N_{\text{fail}} \ge N_{\text{threshold}}. } \]

This is stronger evidence than one isolated gate failure.

4.2.15.75 Hysteresis in Sensor Validity

Use different thresholds for disabling and re-enabling a sensor.

For example:

\[ \boxed{ N_{\text{fail}}^{\text{disable}} } \]

and

\[ \boxed{ N_{\text{good}}^{\text{enable}}. } \]

This prevents rapid switching between healthy and unhealthy states.

4.2.15.76 Measurement Gating State Machine

A sensor may have states:

\[ \boxed{ \text{Healthy} } \]

\[ \boxed{ \text{Suspect} } \]

\[ \boxed{ \text{Rejected} } \]

\[ \boxed{ \text{Reacquiring}. } \]

This is often more robust than a simple one-sample Boolean decision.

4.2.15.77 Data Association Gate

For tracking applications, the gate can define which candidate observations may correspond to the predicted target.

Suppose candidate measurements are

\[ z_1,z_2,\dots,z_N. \]

Only candidates satisfying:

\[ \boxed{ d_{M,i}^2 \le \gamma } \]

are considered plausible.

4.2.15.78 Nearest-Neighbour Association

After gating, one simple strategy is to select:

\[ \boxed{ i^\star = \arg\min_i d_{M,i}^2. } \]

This chooses the statistically closest candidate.

But this may still fail in dense clutter.

4.2.15.79 Association Ambiguity

If several candidates have similar Mahalanobis distances, association is ambiguous.

The estimator should not automatically assume the smallest residual is correct.

More advanced approaches include:

• joint compatibility,
• probabilistic data association,
• multiple hypothesis tracking.

4.2.15.80 Sequential Compatibility

For multiple features, individual measurements may each pass their own gates but be mutually inconsistent as a group.

Therefore some systems perform joint compatibility testing.

This becomes important in optical navigation with many feature matches.

4.2.15.81 Batch Gate

For a stacked measurement:

\[ \boxed{ \mathbf z = \begin{bmatrix} \mathbf z_1\\ \mathbf z_2\\ \cdots \end{bmatrix}, } \]

one can compute one joint NIS:

\[ \boxed{ \mathrm{NIS}_{batch} = \mathbf r^T \mathbf S^{-1} \mathbf r. } \]

This tests the complete measurement set together.

4.2.15.82 Limitation of Batch Gating

If one component is bad, the whole batch may fail.

Then all valid measurements in that batch may be rejected.

Therefore feature-level or sensor-level pre-gating can be valuable.

4.2.15.83 Sequential Gating

Process each measurement one at a time:

\[ \boxed{ z_1 \rightarrow \text{Gate} \rightarrow \text{Update} } \]

\[ \boxed{ z_2 \rightarrow \text{Gate} \rightarrow \text{Update}. } \]

This can isolate bad measurements more effectively.

However, update order may matter for nonlinear filters.

4.2.15.84 Gating and Correlated Measurements

If measurement noises are correlated, independent scalar gates may be statistically inconsistent.

The full covariance

\[ R \]

should be used.

Then the multi-dimensional Mahalanobis distance accounts for correlations.

4.2.15.85 Innovation Gating in EKF

For EKF:

\[ \boxed{ r = z-h(\hat x^-) } \]

\[ \boxed{ H = \left. \frac{\partial h}{\partial x} \right|_{\hat x^-} } \]

\[ \boxed{ S = HP^-H^T+R. } \]

Then:

\[ \boxed{ \mathrm{NIS} = r^TS^{-1}r. } \]

The measurement is gated before the state correction.

4.2.15.86 Innovation Gating in ESKF

For an ESKF, gating is performed using the predicted measurement based on the nominal state.

The resulting innovation determines whether the measurement is allowed to correct the error state.

Thus:

\[ \boxed{ \text{Nominal Prediction} \rightarrow \text{Innovation Gate} \rightarrow \delta x \rightarrow \text{Injection}. } \]

4.2.15.87 Innovation Gating in MEKF

For attitude measurements, construct a local small-angle innovation.

Then:

\[ \boxed{ \mathrm{NIS} = \delta\theta^T S_\theta^{-1} \delta\theta. } \]

This avoids directly gating quaternion components.

4.2.15.88 Innovation Gating in UKF

For UKF, predicted measurement mean is:

\[ \boxed{ \hat z^- = \sum_i W_i^{(m)} Z_i. } \]

Measurement covariance is:

\[ \boxed{ S = \sum_i W_i^{(c)} ( Z_i-\hat z^- ) ( Z_i-\hat z^- )^T + R. } \]

Then ordinary NIS gating can be applied.

No Jacobian is required.

4.2.15.89 Particle-Filter Measurement Validation

A Particle Filter does not use innovation covariance in exactly the same way.

Instead, measurement likelihood:

\[ \boxed{ p(z|x_i) } \]

determines particle weights.

However, external measurement validation can still be used before applying a sensor likelihood.

For example, an impossible LiDAR return should still be rejected before weighting particles.

4.2.15.90 Robust Likelihoods

Instead of Gaussian likelihood:

\[ \boxed{ p(z|x) \propto \exp \left( -\frac12 r^TR^{-1}r \right), } \]

one may use heavy-tailed likelihoods for outlier robustness.

This reduces the effect of unusually large residuals.

4.2.15.91 Measurement Gating and Filter Divergence

A filter that is already divergent may reject valid measurements because the prediction is wrong.

Thus repeated gate failures do not always mean the sensor is bad.

Possible causes include:

• filter divergence,
• incorrect process model,
• covariance collapse,
• wrong initialization.

This distinction is extremely important.

4.2.15.92 Gate Too Tight Because P Is Too Small

Suppose predicted covariance is underestimated.

Then:

\[ \boxed{ S } \]

becomes too small.

Even reasonable residuals produce large NIS.

Thus:

\[ \boxed{ P\text{ Too Small} \rightarrow \text{Excessive Measurement Rejection}. } \]

A gating problem may therefore actually be a covariance-consistency problem.

4.2.15.93 Gate Too Loose Because P Is Too Large

If

\[ P \]

is unrealistically large, then

\[ S \]

becomes large.

Bad measurements may then pass the gate.

Therefore:

\[ \boxed{ \text{Good Gating Requires Credible Covariance}. } \]

4.2.15.94 Gate Too Tight Because R Is Too Small

If measurement noise covariance is underestimated:

\[ R\downarrow, \]

then:

\[ S\downarrow. \]

NIS increases.

Valid measurements may be rejected.

4.2.15.95 Gate Too Loose Because R Is Too Large

If

\[ R \]

is overly conservative, NIS becomes artificially small.

Outliers may pass.

Thus gating performance is strongly tied to realistic sensor-noise characterization.

4.2.15.96 Measurement Bias and Gating

Suppose a measurement has constant bias:

\[ \boxed{ z = h(x) + b + v. } \]

Then innovation mean becomes nonzero:

\[ \boxed{ E[r] \approx b. } \]

The sensor may repeatedly approach or exceed the gate.

Bias should ideally be calibrated or estimated rather than simply tolerated.

4.2.15.97 Slow Sensor Degradation

Some sensor faults grow gradually.

For example:

\[ \boxed{ b(t) \uparrow } \]

slowly over time.

Individual measurements may still pass the gate initially.

Therefore single-event gating is insufficient for detecting slow degradation.

Trend monitoring is also required.

4.2.15.98 Cumulative Innovation Monitoring

One can monitor innovation statistics over a moving window.

For example:

\[ \boxed{ J_N = \sum_{k=1}^{N} r_k^TS_k^{-1}r_k. } \]

Persistent growth beyond expected limits can indicate a gradual fault.

4.2.15.99 CUSUM Concept

A cumulative-sum detector can accumulate small persistent residual deviations.

Conceptually:

\[ \boxed{ g_k = \max \left( 0, g_{k-1} + s_k-\nu \right). } \]

If

\[ g_k \]

crosses a threshold, a persistent change may be declared.

This can detect faults that ordinary instantaneous gates miss.

4.2.15.100 Innovation Gating vs Fault Detection

Innovation gating primarily protects the current estimator update.

Fault detection asks a broader question:

\[ \boxed{ \text{Is This Sensor or Subsystem Failing Persistently?} } \]

Thus:

\[ \boxed{ \text{Gating} \neq \text{Complete FDIR}. } \]

Gating is often one input into FDIR.

4.2.15.101 Measurement Validation Status

A measurement packet may carry validation states such as:

\[ \boxed{ \text{VALID} } \]

\[ \boxed{ \text{REJECTED\_PHYSICAL} } \]

\[ \boxed{ \text{REJECTED\_TIMING} } \]

\[ \boxed{ \text{REJECTED\_INNOVATION} } \]

\[ \boxed{ \text{SENSOR\_FAULT}. } \]

This is more informative than one Boolean valid flag.

4.2.15.102 Validation Reason Codes

Logging a reason code helps debugging.

For example:

• timestamp stale,
• physical range failure,
• NIS too large,
• pose confidence low,
• target outside FOV,
• sequence number invalid.

Without the reason, rejected measurements are difficult to diagnose.

4.2.15.103 Measurement Quality Metric

Some sensors provide internal quality measures.

Examples include:

• GNSS DOP,
• number of satellites,
• image feature count,
• pose solver residual,
• LiDAR fit quality,
• star-tracker confidence.

These can modify:

\[ R \]

or validity logic.

4.2.15.104 Quality-Adaptive R

Suppose camera quality score is

\[ q. \]

Then measurement covariance may be modeled as:

\[ \boxed{ R_C = R_C(q). } \]

Poor image quality leads to larger covariance.

This is preferable to using one fixed noise level for all operating conditions.

4.2.15.105 Quality Flag vs Statistical Gate

Sensor quality metrics and innovation gating answer different questions.

Quality metric:

\[ \boxed{ \text{Does the Sensor Believe Its Measurement Is Good?} } \]

Innovation gate:

\[ \boxed{ \text{Does the Estimator Believe the Measurement Is Consistent?} } \]

Both are useful.

4.2.15.106 Measurement Gating During Sensor Handover

During sensor handover:

\[ \boxed{ A \rightarrow A+B \rightarrow B, } \]

both sensors can be independently gated.

The overlap period allows consistency comparison before fully relying on sensor B.

4.2.15.107 Cross-Sensor Consistency

Suppose camera and LiDAR both measure relative range.

Then compare:

\[ \boxed{ \rho_C-\rho_L. } \]

The covariance of the difference can be used to assess mutual consistency.

This provides a second layer beyond individual innovation gates.

4.2.15.108 Cross-Sensor Difference Covariance

For independent measurements:

\[ \boxed{ S_{CL} = R_C + R_L. } \]

Then:

\[ \boxed{ d^2 = ( \rho_C-\rho_L )^2 S_{CL}^{-1}. } \]

Large disagreement may indicate one sensor is faulty.

4.2.15.109 Cross-Sensor Correlation

If sensor errors are correlated, the covariance of the difference becomes:

\[ \boxed{ P_\Delta = P_C + P_L - P_{CL} - P_{LC}. } \]

Ignoring correlation can produce misleading consistency results.

4.2.15.110 Redundant Sensor Validation

With three sensors measuring related quantities:

\[ A, B, C, \]

one can compare all pairs.

If:

\[ A\approx B \]

but

\[ C \]

strongly disagrees with both, sensor C becomes suspect.

This is a common redundancy principle.

4.2.15.111 Majority Voting Limitation

Simple majority voting ignores sensor uncertainty.

A more accurate sensor may disagree with two poor sensors.

Therefore statistical consistency and covariance should be considered rather than raw majority alone.

4.2.15.112 Innovation Gate and RPO Far Range

At far range:

• relative GNSS may dominate,
• camera measurements may be weak,
• covariance may be relatively large.

The gate should reflect:

\[ S \]

rather than using a fixed absolute residual threshold.

4.2.15.113 Innovation Gate and RPO Mid Range

At mid range:

\[ \boxed{ \text{GNSS} + \text{Camera} } \]

may both contribute.

Camera association errors become increasingly important.

Feature-level gates and relative-state innovation gates are useful.

4.2.15.114 Innovation Gate and RPO Close Range

Near the target:

\[ \boxed{ \text{Camera} + \text{LiDAR} } \]

may dominate.

Outlier rejection becomes critical because a single bad relative pose measurement can generate an unsafe control command.

4.2.15.115 Capture-Phase Measurement Validation

Before declaring capture-ready, measurements supporting:

\[ r_{rel}, v_{rel}, \theta_{rel}, \omega_{rel} \]

should be statistically valid.

Therefore capture readiness should depend on:

\[ \boxed{ \text{State Within Limits} } \]

\[ + \]

\[ \boxed{ \text{Covariance Within Limits} } \]

\[ + \]

\[ \boxed{ \text{Measurement Health}. } \]

4.2.15.116 Capture Readiness with Innovation Health

A robust capture condition may include:

\[ \boxed{ \mathrm{NIS}_{camera} < \gamma_C } \]

and/or

\[ \boxed{ \mathrm{NIS}_{LiDAR} < \gamma_L. } \]

This helps ensure that the state estimate is supported by measurements consistent with the predicted navigation solution.

4.2.15.117 Dwell Logic and Measurement Validity

Suppose capture conditions must hold for:

\[ T_d. \]

The dwell timer should generally advance only when the navigation solution remains valid.

Thus:

\[ \boxed{ \text{Capture Condition} + \text{Navigation Valid} \rightarrow \text{Dwell Accumulation}. } \]

A rejected measurement may pause or invalidate the dwell, depending on system requirements.

4.2.15.118 Measurement Rejection During Final Approach

If a key close-range sensor measurement fails validation, the system may:

• continue briefly on prediction,
• hold position,
• reduce approach rate,
• switch to a redundant sensor,
• retreat,
• abort.

The response belongs to higher-level FDIR and guidance logic.

4.2.15.119 Innovation Gate and Abort Logic

A single gate failure may not justify abort.

But repeated failure combined with growing covariance may trigger:

\[ \boxed{ \text{Navigation Degraded}. } \]

If navigation confidence falls below mission requirements:

\[ \boxed{ \text{Hold / Retreat / Abort}. } \]

4.2.15.120 Sensor Availability vs Navigation Availability

A sensor may be unavailable while navigation remains healthy due to redundant sensors.

Thus:

\[ \boxed{ \text{Sensor Failure} \neq \text{Immediate Navigation Failure}. } \]

Navigation availability depends on remaining observability and uncertainty.

4.2.15.121 Innovation Gating and Federated Filters

In a federated architecture, each local filter may maintain its own:

\[ \boxed{ r_i, S_i, NIS_i. } \]

A master filter can use these quantities to evaluate local-filter health.

This supports sensor isolation and fault-tolerant navigation.

4.2.15.122 Local Filter Gate

For local filter i:

\[ \boxed{ NIS_i = r_i^TS_i^{-1}r_i. } \]

If repeated failures occur:

\[ \boxed{ \text{Local Filter }i \rightarrow \text{Suspect}. } \]

Its information contribution may then be reduced or removed.

4.2.15.123 Sensor Exclusion

Once a sensor is declared unhealthy:

\[ \boxed{ \text{Exclude Measurement Updates}. } \]

The filter continues using:

\[ \boxed{ \text{Dynamics} + \text{Remaining Sensors}. } \]

Covariance should increase appropriately.

4.2.15.124 Sensor Reintroduction

After fault recovery, do not necessarily restore full trust immediately.

Possible sequence:

\[ \boxed{ \text{Faulted} } \]

\[ \downarrow \]

\[ \boxed{ \text{Monitor Only} } \]

\[ \downarrow \]

\[ \boxed{ \text{Several Valid Innovations} } \]

\[ \downarrow \]

\[ \boxed{ \text{Re-enable Fusion}. } \]

4.2.15.125 Robust Weighting

Instead of hard rejection, assign a residual-dependent weight:

\[ \boxed{ 0 \le w(r) \le 1. } \]

Then large residuals have reduced influence.

This can be useful when measurements are contaminated by occasional moderate outliers.

4.2.15.126 Huber Weighting

A common robust approach is the Huber loss.

For normalized residual e:

\[ \rho(e) = \begin{cases} \frac12e^2, & |e|\le c \\ c|e|-\frac12c^2, & |e|>c. \end{cases} \]

Small residuals are treated quadratically.

Large residuals are penalized approximately linearly.

4.2.15.127 Robust Weight from Huber Loss

The corresponding influence can be represented approximately as:

\[ \boxed{ w(e) = \begin{cases} 1, & |e|\le c \\ \frac{c}{|e|}, & |e|>c. \end{cases} } \]

Thus large residuals are downweighted rather than fully discarded.

4.2.15.128 Tukey-Type Robust Weighting

More aggressive robust estimators can reduce very large residual influence toward zero.

This is useful when outliers are clearly unrelated to the true measurement process.

However, tuning must be handled carefully.

4.2.15.129 Hard Gating vs Robust Weighting

Hard gating:

\[ \boxed{ w \in \{0,1\}. } \]

Robust weighting:

\[ \boxed{ 0\le w\le1. } \]

Hard gating is simpler and easier to certify.

Robust weighting may provide smoother performance with mildly contaminated measurements.

4.2.15.130 Measurement Mixture Model

A measurement distribution can be modeled as:

\[ \boxed{ p(z|x) = (1-\epsilon) \mathcal N( h(x),R ) + \epsilon p_{\text{outlier}}(z). } \]

This explicitly acknowledges that some measurements are outliers.

Such models are common in robust Bayesian estimation.

4.2.15.131 Innovation Saturation

Another simple robust method limits residual magnitude:

\[ \boxed{ r_{\text{used}} = \operatorname{sat} ( r, -r_{\max}, r_{\max} ). } \]

This prevents one extreme residual from generating an extreme correction.

However, this is less statistically principled than proper robust estimation.

4.2.15.132 Innovation Clipping Warning

Clipping can hide severe sensor faults.

Therefore it should not replace fault detection.

If residuals repeatedly hit the clipping limit, the sensor should be investigated or isolated.

4.2.15.133 Outlier Probability

Suppose nominal measurements are Gaussian.

Even valid measurements occasionally produce large residuals.

Therefore outlier rejection must consider expected tail probability.

This is exactly why chi-square gating is preferable to arbitrary residual limits.

4.2.15.134 Gate Probability and Update Frequency

Suppose a valid sensor updates at very high rate.

Even a very small false-rejection probability can produce frequent rejected samples over time.

Therefore gate probability should be interpreted together with sensor rate.

4.2.15.135 Example

If false-rejection probability per measurement is

\[ 0.001 \]

and sensor rate is

\[ 100~\mathrm{Hz}, \]

then over

\[ 1000~\mathrm{s}, \]

there are

\[ 100000 \]

measurements.

One would statistically expect many valid measurements to fall outside the gate eventually.

Thus occasional rejection is not automatically alarming.

4.2.15.136 Innovation Burst

A temporary dynamic event may produce several consecutive large innovations.

Possible causes include:

• thruster firing,
• unmodelled target maneuver,
• sudden attitude slew.

Before declaring sensor failure, the estimator should consider whether the process model explains the event.

4.2.15.137 Thruster Event and Gating

Suppose a thruster fires but the navigation process model does not include the impulse correctly.

Then sensors may all produce large residuals.

If all sensors simultaneously fail gates, a model mismatch is more likely than simultaneous independent sensor failures.

4.2.15.138 Common-Mode Innovation Failure

If camera, GNSS, and LiDAR all disagree with prediction in a consistent direction, the common process model may be wrong.

Thus:

\[ \boxed{ \text{Many Sensors Fail Together} \rightarrow \text{Check Common Model / Timing / Frames}. } \]

This is an important diagnostic principle.

4.2.15.139 Single-Sensor Innovation Failure

If only one sensor repeatedly fails while others agree with prediction, that sensor becomes more suspect.

Thus:

\[ \boxed{ \text{One Sensor Fails} + \text{Others Agree} \rightarrow \text{Likely Sensor-Specific Problem}. } \]

4.2.15.140 Sensor Bias Detection from Innovation Mean

For sensor j, calculate average innovation:

\[ \boxed{ \bar r_j = \frac1N \sum_{k=1}^N r_{j,k}. } \]

A persistent nonzero value may indicate bias.

This is useful even when individual measurements remain within the gate.

4.2.15.141 Innovation Standard Deviation Check

Compare empirical innovation covariance:

\[ \boxed{ \hat S_{\text{emp}} = \frac1{N-1} \sum_k ( r_k-\bar r ) ( r_k-\bar r )^T } \]

with predicted:

\[ \boxed{ S_k. } \]

Large disagreement indicates covariance-model inconsistency.

4.2.15.142 Innovation Histogram

Plot innovation histogram and compare with the expected Gaussian distribution.

This can reveal:

• heavy tails,
• bias,
• skewness,
• multimodality.

Such behavior may justify robust estimation rather than standard Gaussian gating.

4.2.15.143 Q-Q Plot

A quantile–quantile plot can compare empirical normalized innovations with the expected normal distribution.

Departures in the tails reveal non-Gaussian measurement behavior.

This is useful for sensor characterization.

4.2.15.144 NIS Histogram

Likewise, compare empirical NIS values with

\[ \chi_m^2. \]

A well-tuned estimator should show approximate agreement under nominal conditions.

4.2.15.145 Monte Carlo Consistency

Across many runs, compute NIS distributions and compare them with expected chi-square bounds.

This tests:

• measurement covariance,
• state covariance,
• model consistency.

One trajectory alone is not enough for strong statistical conclusions.

4.2.15.146 NIS Confidence Interval Across Runs

If there are

\[ N \]

independent innovation samples of dimension

\[ m, \]

then the sum

\[ \boxed{ \sum_{k=1}^{N} NIS_k } \]

approximately follows

\[ \boxed{ \chi^2_{Nm}. } \]

This can be used to construct aggregate consistency bounds.

4.2.15.147 NIS vs NEES

NIS uses measurement residual:

\[ \boxed{ NIS = r^TS^{-1}r. } \]

NEES uses state-estimation error:

\[ \boxed{ NEES = e^TP^{-1}e. } \]

NIS can be calculated during flight because truth state is not required.

NEES generally requires truth and is therefore mainly a simulation or test metric.

4.2.15.148 Why NIS Is Valuable Onboard

Truth state is unavailable in flight.

But the system always has:

• measurement,
• predicted measurement,
• innovation covariance.

Therefore NIS provides one of the few real-time statistical consistency indicators available onboard.

4.2.15.149 Dynamic Gate Based on Measurement Quality

Suppose camera uncertainty increases at long range.

Rather than manually widening the NIS threshold, it may be more correct to increase:

\[ R_C. \]

Then:

\[ S_C \]

increases naturally.

The statistical threshold can remain tied to the same probability level.

4.2.15.150 Why Adjusting R Is Often Better Than Arbitrary Threshold Changes

If actual sensor precision changes, the covariance model should reflect that change.

The NIS threshold represents probability, while

\[ R \]

represents sensor uncertainty.

These should not be confused.

Thus:

\[ \boxed{ \text{Sensor Quality Change} \rightarrow R\text{ Change} } \]

rather than automatically changing the statistical significance level.

4.2.15.151 Adaptive Gate for Non-Gaussian Conditions

In some missions, strict Gaussian assumptions are not realistic.

Then a gate may incorporate:

• robust likelihood,
• mixture model,
• empirical residual distribution,
• phase-dependent statistics.

However, the method should still have a clear statistical interpretation.

4.2.15.152 Gate After Sensor Mode Change

When a sensor changes mode, its noise properties may change.

Examples include:

• GNSS fix mode,
• camera exposure setting,
• LiDAR range mode.

The estimator should update:

\[ R \]

and validation thresholds accordingly.

4.2.15.153 Measurement Covariance Validation

Before using a sensor-reported covariance, verify that it is:

• finite,
• symmetric,
• positive definite or semidefinite as appropriate,
• physically reasonable.

An invalid R can corrupt innovation gating and the Kalman gain.

4.2.15.154 Minimum Measurement Covariance

A system may enforce:

\[ \boxed{ R \succeq R_{\min}. } \]

This prevents a sensor from reporting unrealistically small uncertainty and dominating the estimator.

4.2.15.155 Maximum Measurement Covariance

If reported uncertainty becomes enormous:

\[ R \rightarrow \infty, \]

the sensor contributes almost no information.

At some point it may be better to treat the measurement as unavailable.

4.2.15.156 Measurement Range Check

Before statistical gating, verify each quantity lies inside allowed physical limits:

\[ \boxed{ z_{\min} \le z \le z_{\max}. } \]

This catches gross corruption cheaply.

4.2.15.157 Rate-of-Change Check

A measurement can also be compared with maximum physically possible rate.

For example:

\[ \boxed{ \left| \frac{ z_k-z_{k-1} }{ t_k-t_{k-1} } \right| < \dot z_{\max}. } \]

This catches abrupt impossible jumps.

4.2.15.158 Acceleration / Slew Plausibility Check

For navigation states, physical dynamic limits can provide additional validation.

Examples:

\[ \boxed{ \|a\| < a_{\max} } \]

\[ \boxed{ \|\omega\| < \omega_{\max}. } \]

Statistical gating and physical plausibility are complementary.

4.2.15.159 Field-of-View Check

For optical sensors:

\[ \boxed{ u_{\min} < u < u_{\max} } \]

\[ \boxed{ v_{\min} < v < v_{\max}. } \]

A feature outside the valid imaging region should not be fused.

4.2.15.160 Range-Dependent Sensor Validity

Some sensors are valid only over specific ranges.

For example:

\[ \boxed{ \rho_{\min} < \rho < \rho_{\max}. } \]

This can be especially relevant for:

• LiDAR,
• camera pose estimation,
• relative GNSS.

4.2.15.161 Innovation Gating and Saturated Sensors

A saturated sensor can still produce finite numeric values.

Therefore physical status flags are needed.

Innovation gating alone may not always detect saturation immediately.

4.2.15.162 Missing Measurement Handling

If a measurement is absent:

\[ \boxed{ \text{Do Not Generate Artificial Zero Measurement}. } \]

Simply skip the update.

Using zero as a placeholder may create a catastrophic false innovation.

4.2.15.163 NaN and Infinite Values

Before any matrix calculation, check measurement components for:

\[ \boxed{ \mathrm{NaN} } \]

or

\[ \boxed{ \pm\infty. } \]

Invalid numeric values should be rejected immediately.

4.2.15.164 Packet Integrity Check

Digital packets may include:

• CRC,
• checksum,
• sequence number.

If packet integrity fails, the measurement should not reach statistical gating.

4.2.15.165 Timestamp Validation

Verify:

\[ \boxed{ t_m \le t_{\text{current}} } \]

unless future-dated data have a defined interpretation.

Also check:

\[ \boxed{ t_m > t_{\text{oldest accepted time}}. } \]

This prevents corrupted timestamps from entering the filter.

4.2.15.166 Duplicate Measurement Check

Each measurement should normally be fused once.

Sequence numbers or unique IDs can prevent duplicate updates.

Repeated fusion artificially reduces covariance.

4.2.15.167 Measurement Freshness

Define:

\[ \boxed{ \Delta t_{\text{age}} = t_{\text{current}} - t_m. } \]

If:

\[ \Delta t_{\text{age}} > \Delta t_{\max}, \]

use delayed-update logic or reject the measurement.

Do not treat it as current.

4.2.15.168 Validation Order

A recommended order is:

\[ \boxed{ \text{Packet Integrity} } \]

\[ \downarrow \]

\[ \boxed{ \text{Numeric Validity} } \]

\[ \downarrow \]

\[ \boxed{ \text{Timestamp Validity} } \]

\[ \downarrow \]

\[ \boxed{ \text{Physical Range / FOV} } \]

\[ \downarrow \]

\[ \boxed{ \text{Sensor Quality} } \]

\[ \downarrow \]

\[ \boxed{ \text{Innovation Gate} } \]

\[ \downarrow \]

\[ \boxed{ \text{Measurement Update}. } \]

4.2.15.169 Why Validation Order Matters

Cheap deterministic checks should occur before expensive statistical calculations.

There is no need to compute:

\[ S^{-1} \]

for a packet with invalid CRC or NaN values.

This reduces computation and simplifies diagnostics.

4.2.15.170 Measurement Validation Architecture

A software architecture may contain:

\[ \boxed{ \text{Raw Sensor Packet} } \]

\[ \downarrow \]

\[ \boxed{ \text{Interface Validation} } \]

\[ \downarrow \]

\[ \boxed{ \text{Time / Frame / Unit Validation} } \]

\[ \downarrow \]

\[ \boxed{ \text{Sensor-Specific Quality Checks} } \]

\[ \downarrow \]

\[ \boxed{ \text{Innovation Calculation} } \]

\[ \downarrow \]

\[ \boxed{ \text{NIS Gate} } \]

\[ \downarrow \]

\[ \boxed{ \text{Accepted Measurement} } \]

\[ \downarrow \]

\[ \boxed{ \text{Estimator Update}. } \]

4.2.15.171 Validation Output Structure

A validation function might output:

\[ \boxed{ \{ \text{accepted}, \text{reason}, r, S, NIS, \gamma \}. } \]

This provides enough information for:

• estimator update,
• telemetry,
• diagnostics,
• FDIR.

4.2.15.172 Sensor-Specific Validation Module

Each sensor may implement a module:

\[ \boxed{ \text{validateGNSS()} } \]

\[ \boxed{ \text{validateCamera()} } \]

\[ \boxed{ \text{validateLiDAR()} } \]

\[ \boxed{ \text{validateStarTracker()}. } \]

A common statistical-gating library can then be reused across sensors.

4.2.15.173 Innovation Gate Pseudocode

A conceptual implementation is:

1. read measurement,
2. validate packet,
3. validate timestamp,
4. validate physical range,
5. propagate state to measurement epoch,
6. compute predicted measurement,
7. compute innovation,
8. compute S,
9. calculate NIS,
10. compare with threshold,
11. accept or reject,
12. log result,
13. update sensor health.

4.2.15.174 Numerical Stability

Avoid:

\[ \boxed{ S^{-1} } \]

as a direct matrix inverse whenever possible.

Use:

• Cholesky decomposition,
• LDL decomposition,
• QR-based methods,
• linear solves.

This improves reliability in flight software.

4.2.15.175 Symmetry of S

Numerically:

\[ S \]

may lose exact symmetry due to floating-point arithmetic.

A practical implementation may enforce:

\[ \boxed{ S \leftarrow \frac12 ( S+S^T ). } \]

This should only correct tiny numerical asymmetry, not hide modelling errors.

4.2.15.176 Ill-Conditioned Innovation Covariance

If:

\[ \kappa(S) \]

is extremely large, the NIS calculation may be unreliable.

Possible reasons include:

• redundant measurement components,
• incorrect covariance,
• poor scaling.

The measurement should be handled cautiously.

4.2.15.177 Units and Scaling

Suppose one measurement vector contains:

• meters,
• radians,
• pixels.

The covariance matrix normalizes these scales.

Without proper covariance scaling, Euclidean residual magnitude would be meaningless.

This is another advantage of Mahalanobis distance.

4.2.15.178 Measurement Dimension Change

Some sensors may provide different measurement dimensions depending on availability.

For example:

• camera bearing only: m=2,
• camera full pose: m=6.

The chi-square gate must use the correct current:

\[ \boxed{ m. } \]

4.2.15.179 Partial Measurement Availability

Suppose GNSS velocity is available but position is invalid.

The filter may construct a reduced measurement vector containing only valid components.

Then:

\[ H, R, S, m \]

must all be reduced consistently.

4.2.15.180 Innovation Gating for Partial Measurements

If only selected measurement components are used:

\[ \boxed{ z_{\text{valid}} } \]

then compute:

\[ \boxed{ r_{\text{valid}}, S_{\text{valid}}, NIS_{\text{valid}}. } \]

Do not include invalid components with artificially large covariance unless this is an intentional architectural choice.

4.2.15.181 Sequential Feature Rejection

For camera features:

1. calculate individual feature residual,
2. reject gross outliers,
3. form pose or batch update from remaining features.

This reduces the influence of incorrect feature associations.

4.2.15.182 RANSAC and Innovation Gating

RANSAC may reject geometric outliers during vision processing.

Innovation gating then provides a second estimator-level check.

Thus:

\[ \boxed{ \text{RANSAC} \rightarrow \text{Geometric Consistency} } \]

and

\[ \boxed{ \text{NIS Gate} \rightarrow \text{Navigation Consistency}. } \]

They serve different purposes.

4.2.15.183 Pose Solver Covariance

If a camera pose solver provides:

\[ \hat T \]

with estimated covariance:

\[ R_{\text{pose}}, \]

the estimator can use this in:

\[ S = HPH^T + R_{\text{pose}}. \]

Poorly conditioned pose estimates should therefore naturally receive less weight.

4.2.15.184 LiDAR ICP Validation

For point-cloud registration, useful internal metrics may include:

• ICP residual,
• inlier ratio,
• convergence status,
• point count.

These should be checked before accepting the resulting relative pose.

4.2.15.185 Measurement Confidence Conversion

A sensor confidence score should not automatically be treated as variance.

A calibrated mapping is needed:

\[ \boxed{ q \rightarrow R(q). } \]

Otherwise reported covariance may have no statistical meaning.

4.2.15.186 Calibration of Gate Performance

Using truth data, evaluate:

• valid-measurement acceptance rate,
• outlier rejection rate,
• false rejection rate,
• missed detection rate.

Gate thresholds should be verified statistically rather than chosen only from visual inspection.

4.2.15.187 Injected Outlier Test

During simulation, deliberately inject:

\[ \boxed{ z_{\text{bad}} = z_{\text{true}} + \Delta z_{\text{outlier}}. } \]

Verify:

\[ \boxed{ NIS > \gamma } \]

and the update is rejected.

4.2.15.188 Small Outlier Test

Inject a smaller error near the gate boundary.

This tests whether threshold behavior is implemented correctly.

It also helps evaluate sensitivity to marginal measurements.

4.2.15.189 Persistent Bias Test

Add:

\[ \boxed{ b\neq0 } \]

to a sensor.

Observe:

• innovation mean,
• NIS history,
• gate failures,
• fault-detection delay.

This tests slowly developing faults.

4.2.15.190 Noise-Mismatch Test

Generate measurements with true covariance:

\[ R_{\text{true}} \]

but let the estimator use:

\[ R_{\text{filter}}. \]

Then evaluate NIS statistics.

This directly demonstrates sensitivity to incorrect noise tuning.

4.2.15.191 Covariance-Mismatch Test

Likewise, underestimate or overestimate process noise:

\[ Q. \]

Observe how NIS changes.

This tests consistency between process and measurement tuning.

4.2.15.192 Timing-Error Test

Introduce a known measurement delay.

Even with perfect sensor values, NIS should rise during motion if the timestamp is mishandled.

Then verify that proper delay compensation restores consistency.

4.2.15.193 Frame-Error Test

Rotate one sensor frame incorrectly by a known angle.

Observe systematic innovation patterns.

This helps distinguish frame mismatch from random measurement noise.

4.2.15.194 Association-Error Test

For camera navigation, intentionally associate the wrong feature.

Verify that:

\[ \boxed{ \text{Geometric / NIS Gate} } \]

rejects the false association.

4.2.15.195 Sensor Dropout Test

Disable one sensor.

The estimator should:

• stop receiving its updates,
• not generate fake residuals,
• allow covariance to evolve,
• continue using other sensors.

4.2.15.196 Sensor Reacquisition Test

Restore the sensor after a long outage.

Verify:

• gate behavior,
• reacquisition logic,
• covariance consistency,
• sensor re-enable logic.

4.2.15.197 Consecutive Outlier Test

Inject several outliers in succession.

Verify transition through:

\[ \boxed{ \text{Healthy} \rightarrow \text{Suspect} \rightarrow \text{Rejected}. } \]

4.2.15.198 Recovery Test

After the sensor is rejected, return valid measurements.

Verify:

\[ \boxed{ \text{Rejected} \rightarrow \text{Reacquiring} \rightarrow \text{Healthy}. } \]

4.2.15.199 High-Dynamics Test

Run:

• fast slew,
• rapid translation,
• thruster burn.

Verify that valid measurements are not incorrectly rejected simply because dynamics increased.

If they are, check:

• timing,
• process model,
• covariance tuning.

4.2.15.200 Monte Carlo Validation

Monte Carlo validation should randomize:

• sensor noise,
• initial state,
• process noise,
• outlier occurrence,
• outlier magnitude,
• sensor dropout,
• timing error,
• calibration error.

Evaluate statistical gate performance.

4.2.15.201 Monte Carlo Outputs

Useful metrics include:

\[ \boxed{ \text{Valid Measurement Acceptance Rate} } \]

\[ \boxed{ \text{Outlier Rejection Rate} } \]

\[ \boxed{ \text{False Rejection Probability} } \]

\[ \boxed{ \text{Missed Detection Probability} } \]

\[ \boxed{ \text{NIS Consistency} } \]

\[ \boxed{ \text{Navigation RMSE}. } \]

4.2.15.202 Detection Probability

Define:

\[ \boxed{ P_D = P( \text{Reject Bad Measurement} ). } \]

Higher is generally desirable.

But increasing sensitivity may also increase false alarms.

4.2.15.203 False Alarm Probability

Define:

\[ \boxed{ P_{FA} = P( \text{Reject Good Measurement} ). } \]

A good validation system balances:

\[ \boxed{ P_D } \]

and

\[ \boxed{ P_{FA}. } \]

4.2.15.204 Receiver Operating Characteristic

A Receiver Operating Characteristic conceptually plots:

\[ \boxed{ P_D } \]

against

\[ \boxed{ P_{FA} } \]

for different thresholds.

This can help choose practical fault-detection gates.

4.2.15.205 Mission Consequence Matters

For a benign sensor:

\[ \boxed{ \text{False Rejection Cost} } \]

may dominate.

For a close-range docking sensor:

\[ \boxed{ \text{False Acceptance of Bad Data} } \]

may be much more dangerous.

Threshold selection should therefore reflect mission consequence.

4.2.15.206 Measurement Validation and FDIR

Measurement gating provides evidence to Fault Detection, Isolation, and Recovery logic.

Conceptually:

\[ \boxed{ \text{Innovation Monitoring} } \]

\[ \downarrow \]

\[ \boxed{ \text{Fault Detection} } \]

\[ \downarrow \]

\[ \boxed{ \text{Fault Isolation} } \]

\[ \downarrow \]

\[ \boxed{ \text{Recovery / Reconfiguration}. } \]

4.2.15.207 Gate Result Should Be Telemetry

Useful telemetry includes:

\[ \boxed{ r } \]

\[ \boxed{ NIS } \]

\[ \boxed{ \gamma } \]

\[ \boxed{ \text{accepted} } \]

\[ \boxed{ \text{reason code}. } \]

These are invaluable during commissioning and anomaly investigation.

4.2.15.208 Sensor Validation Dashboard

A ground diagnostic display may show:

Such monitoring makes sensor-fusion behavior much easier to interpret.

4.2.15.209 Innovation Gating in Simulink

A practical Simulink structure could be:

\[ \boxed{ z } \]

\[ \downarrow \]

\[ \boxed{ \text{Predicted Measurement} } \]

\[ \downarrow \]

\[ \boxed{ r=z-\hat z } \]

\[ \downarrow \]

\[ \boxed{ S } \]

\[ \downarrow \]

\[ \boxed{ NIS } \]

\[ \downarrow \]

\[ \boxed{ NIS<\gamma? } \]

\[ \downarrow \]

\[ \boxed{ \text{Enabled Measurement Update}. } \]

4.2.15.210 Simulink Enabled Subsystem

The actual measurement update can be placed inside an enabled subsystem.

Enable signal:

\[ \boxed{ \text{measurementAccepted}. } \]

If false, the filter continues prediction without correction.

4.2.15.211 MATLAB Gating Function

A reusable function may conceptually implement:

\[ \boxed{ [\text{accepted},NIS] = \text{gateMeasurement} ( r,S,\gamma ). } \]

This keeps statistical validation separate from sensor-specific preprocessing.

4.2.15.212 Sensor Validation Interface

Each sensor should ideally provide:

\[ \boxed{ z } \]

\[ \boxed{ R } \]

\[ \boxed{ t } \]

\[ \boxed{ \text{quality} } \]

\[ \boxed{ \text{health}. } \]

The estimator adds predicted quantities:

\[ \boxed{ \hat z, r,S,NIS. } \]

4.2.15.213 Gating Must Be Reproducible

Given identical:

\[ x^-, P^-, z,R, \]

the gating decision should be deterministic.

This is important for:

• testing,
• flight-software verification,
• debugging.

4.2.15.214 Threshold Configuration

Thresholds should be stored as configuration data, not scattered throughout code.

For example:

\[ \boxed{ \gamma_{\text{GNSS,pos}} } \]

\[ \boxed{ \gamma_{\text{camera,bearing}} } \]

\[ \boxed{ \gamma_{\text{LiDAR,range}}. } \]

This improves traceability.

4.2.15.215 Configuration Traceability

Each threshold should ideally have:

• measurement dimension,
• probability level,
• source,
• mission phase,
• verification evidence.

This avoids undocumented tuning.

4.2.15.216 Innovation Gate and Sensor Covariance Source

Document whether:

\[ R \]

comes from:

• datasheet,
• calibration,
• sensor-reported covariance,
• empirical flight data,
• Monte Carlo characterization.

Gating is only as meaningful as the covariance supplied to it.

4.2.15.217 Static Sensor Characterization

Before flight, collect stationary or controlled data.

Estimate:

\[ \boxed{ \mu_v } \]

and

\[ \boxed{ R. } \]

Check whether noise is approximately Gaussian.

This informs both estimator tuning and gate design.

4.2.15.218 Dynamic Sensor Characterization

Sensor errors may change under:

• vibration,
• temperature,
• motion blur,
• range,
• illumination.

Therefore validation parameters should be tested under realistic dynamics.

4.2.15.219 Temperature Dependence

A sensor's measurement covariance may vary with temperature:

\[ \boxed{ R = R(T). } \]

If this dependence is strong, fixed gating parameters may perform poorly across the mission.

4.2.15.220 Vibration Dependence

During thruster firing or mechanism operation, sensor noise may increase.

Thus:

\[ \boxed{ R_{\text{burn}} > R_{\text{coast}} } \]

may be realistic.

The estimator should model this if supported by test data.

4.2.15.221 Innovation During Thruster Firing

If sensor residuals increase during burns, first determine whether this comes from:

• actual sensor vibration,
• unmodelled thrust,
• timing error,
• structural flex.

Do not automatically classify every large burn-time residual as a sensor outlier.

4.2.15.222 Adaptive Sensor Mode

A navigation system may use:

\[ \boxed{ R_{\text{nominal}} } \]

during coast and

\[ \boxed{ R_{\text{dynamic}} } \]

during high-vibration phases.

The NIS gate then remains statistically meaningful.

4.2.15.223 Gate and Measurement Correlation over Time

If successive measurements are correlated, repeated NIS samples are not independent.

This matters when interpreting cumulative chi-square statistics.

Instantaneous gating may still work, but long-term consistency bounds require care.

4.2.15.224 Gate and Shared Measurements

In federated systems, multiple local filters may use the same underlying measurement.

A rejected measurement should be consistently handled across all branches where appropriate.

Otherwise local estimators may diverge simply because validation policy differs.

4.2.15.225 Measurement Validation and Information Filters

In information form, an accepted measurement contributes:

\[ \boxed{ H^TR^{-1}H } \]

and

\[ \boxed{ H^TR^{-1}z. } \]

A rejected measurement contributes:

\[ \boxed{ 0. } \]

Thus gating prevents bad information from being added to the information state.

4.2.15.226 Measurement Validation and Particle Filters

For Particle Filters, a corrupted measurement can collapse weights incorrectly.

Therefore external validity checks remain extremely important.

One bad likelihood can drive:

\[ N_{\text{eff}} \rightarrow 1. \]

4.2.15.227 Innovation Gate and Relative Pose

Suppose a sensor reports relative pose:

\[ \boxed{ z = \begin{bmatrix} r_{rel}\\ \theta_{rel} \end{bmatrix}. } \]

Translation and attitude have different units and uncertainties.

A proper covariance-based gate handles both simultaneously.

4.2.15.228 Separate Relative-Pose Gates

Alternatively, use:

\[ \boxed{ NIS_r } \]

for translation and

\[ \boxed{ NIS_\theta } \]

for attitude.

This makes it easier to identify whether the bad component is translational or rotational.

4.2.15.229 Combined Gate vs Component Gates

Combined gate:

\[ \boxed{ \text{Tests Overall Measurement Consistency}. } \]

Component gates:

\[ \boxed{ \text{Provide Better Diagnostic Isolation}. } \]

A robust implementation may use both.

4.2.15.230 Relative Velocity Validation

A camera may estimate relative velocity indirectly.

Because numerical differentiation can amplify noise, velocity covariance may be large.

Its gate should reflect this.

A fixed absolute velocity residual threshold may be inappropriate.

4.2.15.231 Measurement Innovation and Capture Corridor

During final approach, predicted relative position lies inside a capture corridor.

A measurement implying a state far outside the corridor may be:

• a true safety event,
• a navigation outlier.

The system must distinguish these carefully.

It should not automatically reject any measurement simply because it is operationally inconvenient.

4.2.15.232 Gate Should Not Hide Real Dynamics

If the target genuinely maneuvers unexpectedly, the innovation may be large.

Rejecting all such measurements could prevent the estimator from recognizing the maneuver.

Therefore process-model mismatch and outlier detection must be balanced.

4.2.15.233 Maneuver Detection

Repeated consistent residuals across sensors may indicate a genuine maneuver rather than bad data.

Possible response:

\[ \boxed{ \text{Increase Process Uncertainty} } \]

or

\[ \boxed{ \text{Switch Dynamic Model}. } \]

This belongs to adaptive estimation rather than simple measurement rejection.

4.2.15.234 Measurement Gate and Multiple Models

In a multiple-model estimator, each model may produce its own innovation:

\[ r^{(1)}, r^{(2)},\dots \]

A measurement inconsistent with one model may be consistent with another.

This helps distinguish sensor faults from model mismatch.

4.2.15.235 Navigation Integrity Concept

Measurement validation contributes to navigation integrity.

Integrity means the navigation system can provide confidence that its output is not only accurate on average but also protected against undetected hazardous errors.

Innovation gating is one part of such protection.

4.2.15.236 Integrity Risk

A hazardous case is:

\[ \boxed{ \text{Bad Measurement Accepted} } \]

followed by:

\[ \boxed{ \text{Navigation Error Exceeds Safe Limit} } \]

without detection.

Reducing this risk is especially important near docking or capture.

4.2.15.237 Availability vs Integrity

A very strict gate improves protection but may reject many measurements.

This reduces availability.

Thus:

\[ \boxed{ \text{Integrity} \leftrightarrow \text{Availability} } \]

is another important trade-off.

4.2.15.238 Continuity

Navigation continuity measures the ability to provide uninterrupted valid navigation over a required operation.

Frequent false rejections can reduce continuity even if each rejection is statistically defensible.

Therefore gate design affects:

• integrity,
• availability,
• continuity.

4.2.15.239 RPO Integrity Monitoring

During close RPO, navigation integrity logic may monitor:

\[ \boxed{ P } \]

\[ \boxed{ NIS } \]

\[ \boxed{ \text{sensor health} } \]

\[ \boxed{ \text{measurement age}. } \]

The guidance system can then decide whether approach remains safe.

4.2.15.240 Gate Failure and Hold Point

If a critical sensor repeatedly fails validation near a hold point, the spacecraft can remain at the hold rather than proceeding.

This is a direct connection between estimator health and mission sequencing.

4.2.15.241 Gate Failure During Final Approach

During final approach:

\[ \boxed{ \text{Repeated Critical Gate Failure} } \]

may trigger:

\[ \boxed{ \text{Hold} \rightarrow \text{Retreat} \rightarrow \text{Abort} } \]

depending on mission logic.

4.2.15.242 Measurement Acceptance Should Be Logged

For each update, record:

\[ \boxed{ \text{sensorID} } \]

\[ \boxed{ t } \]

\[ \boxed{ r } \]

\[ \boxed{ S } \]

\[ \boxed{ NIS } \]

\[ \boxed{ \gamma } \]

\[ \boxed{ \text{accepted}. } \]

This allows complete reconstruction of estimator behavior.

4.2.15.243 Rejected Measurement Storage

Rejected measurements should often still be logged.

They are valuable for:

• post-flight analysis,
• fault investigation,
• threshold tuning.

Discarding them entirely makes diagnosis harder.

4.2.15.244 Gate Statistics by Sensor

Compute over time:

\[ \boxed{ N_{\text{accepted}} } \]

\[ \boxed{ N_{\text{rejected}} } \]

and rejection ratio:

\[ \boxed{ f_{\text{reject}} = \frac{ N_{\text{rejected}} }{ N_{\text{total}} }. } \]

A sudden change can reveal sensor degradation.

4.2.15.245 Gate Statistics by Mission Phase

Rejection rates may differ between:

• far approach,
• mid approach,
• close approach,
• capture.

This may reveal phase-specific modelling problems.

4.2.15.246 Gate Statistics by Operating Condition

Also compare rejection rate against:

• temperature,
• vibration,
• illumination,
• target range,
• angular rate.

This helps identify environmental dependencies.

4.2.15.247 Verification with Truth

In simulation, after a measurement is rejected, compare it against true state.

Classify it as:

• true positive rejection,
• false rejection,
• true acceptance,
• false acceptance.

This enables quantitative validation of the gate.

4.2.15.248 Confusion Matrix

The validation system can be summarized using:

This provides a clear picture of detection performance.

4.2.15.249 Precision and Recall Concepts

For outlier detection, metrics analogous to:

• precision,
• recall,
• false positive rate,
• false negative rate

can be used.

This is especially useful when evaluating robust vision measurements.

4.2.15.250 Gate Threshold Sweep

Test several gate probabilities.

For each threshold, evaluate:

\[ \boxed{ P_D } \]

\[ \boxed{ P_{FA} } \]

\[ \boxed{ RMSE } \]

\[ \boxed{ \text{Navigation Availability}. } \]

This supports evidence-based threshold selection.

4.2.15.251 Gate Threshold Should Not Be Tuned Only for Lowest RMSE

A very permissive gate may produce low nominal RMSE but poor fault protection.

A very strict gate may protect against faults but reduce availability.

Therefore threshold selection should consider the full mission risk trade.

4.2.15.252 Verification with Real Sensor Data

Synthetic Gaussian data are useful but not sufficient.

Real sensor data reveal:

• non-Gaussian tails,
• dropouts,
• quantization,
• processing failures,
• environmental effects.

Validation logic should ultimately be tested with representative hardware data.

4.2.15.253 HIL Measurement Fault Injection

During HIL testing, inject:

• spikes,
• frozen values,
• stale timestamps,
• missing packets,
• false camera detections,
• LiDAR jumps,
• GNSS offsets.

Verify the estimator responds correctly.

4.2.15.254 Frozen Sensor Fault

A frozen sensor outputs:

\[ \boxed{ z_k = z_{k-1} } \]

repeatedly.

Initially it may pass the innovation gate if dynamics are slow.

Therefore separate frozen-data detection is useful.

4.2.15.255 Stuck-at Fault Detection

Monitor:

\[ \boxed{ z_k-z_{k-1}. } \]

If it remains exactly zero for an implausibly long interval while dynamics exist, the sensor may be stuck.

This demonstrates why innovation gating should be combined with sensor-specific fault logic.

4.2.15.256 Bias Jump Fault

A sudden bias jump:

\[ \boxed{ b_k = b_{k-1} + \Delta b } \]

usually produces an abrupt innovation excursion.

Innovation gating is very effective for such faults.

4.2.15.257 Drift Fault

A slowly growing bias may remain inside the gate for many samples.

Long-term innovation monitoring is therefore required.

4.2.15.258 Excessive Noise Fault

If sensor noise suddenly increases, NIS may become highly variable.

The rejection rate increases.

This can be used as a health indicator.

4.2.15.259 Covariance Reporting Fault

A sensor may report correct values but incorrect covariance.

If:

\[ R_{\text{reported}} \ll R_{\text{true}}, \]

NIS becomes too large.

Thus covariance itself should be monitored.

4.2.15.260 Measurement Dropout vs Rejection

Dropout means:

\[ \boxed{ \text{No Measurement Arrives}. } \]

Rejection means:

\[ \boxed{ \text{Measurement Arrives but Is Not Used}. } \]

These should be logged separately.

They imply different failure modes.

4.2.15.261 Estimator Behavior after Rejection

After rejecting a measurement:

\[ \boxed{ \text{Continue Propagation}. } \]

Do not reset the state arbitrarily.

The estimator should naturally become more uncertain if measurements continue to be unavailable.

4.2.15.262 Covariance after Rejection

If no measurement update occurs:

\[ \boxed{ P^+ = P^-. } \]

Subsequent process propagation causes further growth.

This correctly reflects lost information.

4.2.15.263 Do Not Artificially Reduce P after Rejection

Rejecting a measurement means no new information was gained.

Therefore covariance must not decrease due to that rejected packet.

This is a fundamental consistency rule.

4.2.15.264 Innovation Gate During Filter Initialization

At startup, covariance may be large.

Therefore:

\[ S \]

is large and the gate naturally becomes broad.

This helps the filter acquire measurements despite initial uncertainty.

4.2.15.265 Poor Initial Covariance

If initial covariance is unrealistically small, valid measurements may immediately fail the gate.

Thus gating can reveal poor initialization.

4.2.15.266 Initialization Bypass

Some systems temporarily disable strict gating during initialization.

This should be used carefully.

A better approach is often to initialize with realistic covariance rather than bypassing statistical protection.

4.2.15.267 Gate Warm-Up Period

A short warm-up period may use:

• wider gates,
• alternate initialization logic,
• acquisition mode.

Once convergence is confirmed, nominal gates become active.

4.2.15.268 Innovation Gate During Covariance Reset

If an ESKF or MEKF resets the error state, covariance must also be correctly reset.

Otherwise innovation covariance can become inconsistent, affecting later gating.

4.2.15.269 Gating after Filter Reconfiguration

After switching sensor sets or models, transient residuals may occur.

Validation logic should account for expected reconfiguration transients without becoming excessively permissive.

4.2.15.270 Measurement Validation and Redundancy

Redundant sensors improve validation because disagreement can be cross-checked.

For example:

\[ \boxed{ \text{Camera Range} } \]

and

\[ \boxed{ \text{LiDAR Range} } \]

can validate each other.

4.2.15.271 Triple Redundancy

With three independent sensors, pairwise consistency can help isolate one bad branch.

But independence assumptions must be verified.

Shared calibration or timing errors can affect all sensors simultaneously.

4.2.15.272 Common-Mode Failure

Suppose camera and LiDAR both use the same incorrect spacecraft attitude.

Both may agree with each other but still be wrong.

Thus:

\[ \boxed{ \text{Cross-Sensor Agreement} \neq \text{Guaranteed Truth}. } \]

Common-mode failures remain important.

4.2.15.273 Measurement Validation and Observability

If a measurement observes only certain state directions, its innovation cannot validate all state components.

For example, range-only measurement may not directly validate lateral position.

Therefore measurement validation should be interpreted according to sensor observability.

4.2.15.274 Innovation Direction

For vector measurements, inspect not only NIS but also residual direction.

A consistent directional pattern can identify specific modelling errors.

Example:

\[ \boxed{ r_x>0 } \]

persistently while other components are unbiased.

This may indicate axis-specific bias or frame error.

4.2.15.275 Innovation Decomposition

An eigenvalue decomposition:

\[ \boxed{ S = V\Lambda V^T } \]

reveals principal uncertainty directions.

Transform:

\[ \boxed{ r^\prime = V^Tr. } \]

Then normalized components can be inspected along independent covariance axes.

4.2.15.276 Standardized Innovation Components

Define:

\[ \boxed{ e_i = \frac{ r_i }{ \sqrt{S_{ii}} }. } \]

These are useful for diagnostics.

But if S has strong off-diagonal terms, they should not replace full NIS gating.

4.2.15.277 Component-Wise Diagnostic Limits

One may plot:

\[ \boxed{ e_i } \]

with:

\[ \boxed{ \pm3. } \]

This helps identify which measurement component contributes to a gate failure.

4.2.15.278 Innovation Contribution Analysis

Using a whitened innovation:

\[ \tilde r = L^{-1}r, \]

each squared component contributes to:

\[ \boxed{ NIS = \sum_i \tilde r_i^2. } \]

This helps diagnose which transformed measurement direction causes inconsistency.

4.2.15.279 Gate Failure Reasoning

When NIS is high, investigate in this order:

1. measurement validity,
2. timestamp,
3. frame and units,
4. sensor calibration,
5. measurement covariance,
6. process covariance,
7. process model,
8. possible true maneuver,
9. sensor fault.

This prevents immediately blaming the sensor.

4.2.15.280 Innovation Gate and Tuning

Repeated high NIS can result from:

\[ \boxed{ Q\text{ too small} } \]

or

\[ \boxed{ R\text{ too small}. } \]

Repeated low NIS can result from:

\[ \boxed{ Q\text{ too large} } \]

or

\[ \boxed{ R\text{ too large}. } \]

Therefore NIS is valuable for tuning.

4.2.15.281 But NIS Alone Cannot Separate Q and R

Both process covariance and measurement covariance contribute to:

\[ S. \]

Therefore NIS mismatch alone does not tell you which covariance is wrong.

Additional tests and sensor characterization are required.

4.2.15.282 Compare NIS Across Sensors

If only camera NIS is high while GNSS and LiDAR are consistent, investigate camera-specific modelling.

If all NIS values are high, investigate common state propagation.

This comparison is diagnostically powerful.

4.2.15.283 NIS During Sensor Dropout

There is no NIS if no measurement exists.

Do not generate a synthetic NIS value.

Instead log:

\[ \boxed{ \text{Measurement Unavailable}. } \]

4.2.15.284 NIS During Rejected Measurement

Even when a measurement is rejected, its NIS should usually be logged.

This is valuable for health monitoring.

Thus:

\[ \boxed{ \text{Rejected} \neq \text{Ignore Diagnostic Information}. } \]

4.2.15.285 Gate Threshold Table

A configuration table may contain:

Values should come from the chosen chi-square probabilities.

4.2.15.286 Why Thresholds Should Not Be Hard-Coded Without Documentation

A value such as:

\[ \gamma=10 \]

has little meaning unless one knows:

• measurement dimension,
• probability level,
• model assumptions.

Threshold traceability is important.

4.2.15.287 Chi-Square Table or Library

Thresholds can be obtained from:

• statistical libraries,
• precomputed configuration tables.

For flight software, precomputed thresholds may be preferable when deterministic execution is required.

4.2.15.288 Numerical Example: Scalar Range

Suppose:

\[ r=0.15~\mathrm{m} \]

and:

\[ S=0.01~\mathrm{m^2}. \]

Then:

\[ \boxed{ NIS = \frac{0.15^2}{0.01} = 2.25. } \]

Whether this passes depends on the chosen one-dimensional chi-square threshold.

4.2.15.289 Numerical Example: More Precise Sensor

Suppose the same residual:

\[ r=0.15~\mathrm{m} \]

but now:

\[ S=0.0004~\mathrm{m^2}. \]

Then:

\[ \boxed{ NIS = \frac{0.0225}{0.0004} = 56.25. } \]

The same physical residual is now extremely inconsistent.

This demonstrates why covariance matters.

4.2.15.290 Numerical Example: Large Predicted Uncertainty

Suppose:

\[ S=0.25~\mathrm{m^2}. \]

Then:

\[ \boxed{ NIS = \frac{0.0225}{0.25} = 0.09. } \]

The residual is easily plausible given the uncertainty.

4.2.15.291 Camera Example

Suppose:

\[ r = \begin{bmatrix} 2\\ 1 \end{bmatrix} \text{ pixels} \]

and:

\[ S = \begin{bmatrix} 4&0\\ 0&1 \end{bmatrix}. \]

Then:

\[ S^{-1} = \begin{bmatrix} 1/4&0\\ 0&1 \end{bmatrix}. \]

Therefore:

\[ \boxed{ NIS = 2. } \]

The residual is interpreted relative to anisotropic pixel uncertainty.

4.2.15.292 Correlated Camera Example

Suppose:

\[ S = \begin{bmatrix} 4&1.5\\ 1.5&1 \end{bmatrix}. \]

Now the gate ellipse is rotated.

Independent pixel thresholds no longer capture the true probability geometry.

The Mahalanobis distance remains valid because it uses the full covariance.

4.2.15.293 Geometric Interpretation of Correlation

Positive correlation means certain combinations of:

\[ u,v \]

errors are more likely than others.

The gate ellipse therefore tilts.

A measurement can have moderate component-wise errors but still be improbable in the correlated direction.

4.2.15.294 Innovation Gate and Navigation Safety

The purpose of gating is not merely mathematical elegance.

It prevents:

\[ \boxed{ \text{One Bad Measurement} } \]

from causing:

\[ \boxed{ \text{Large State Correction} } \]

which could lead to:

\[ \boxed{ \text{Unsafe Guidance Command}. } \]

This is especially important during close proximity operations.

4.2.15.295 Gating Cannot Guarantee Safety by Itself

A bad measurement may still pass.

A valid measurement may be rejected.

Therefore safety requires multiple layers:

\[ \boxed{ \text{Measurement Validation} } \]

\[ + \]

\[ \boxed{ \text{Estimator Consistency} } \]

\[ + \]

\[ \boxed{ \text{Redundancy} } \]

\[ + \]

\[ \boxed{ \text{FDIR} } \]

\[ + \]

\[ \boxed{ \text{Guidance Safety Logic}. } \]

4.2.15.296 Innovation Gating in One Diagram

The complete concept can be summarized as:

\[ \boxed{ \text{Measurement} } \]

\[ \downarrow \]

\[ \boxed{ \text{Basic Sensor / Packet / Timing Checks} } \]

\[ \downarrow \]

\[ \boxed{ \text{Predict Measurement} } \]

\[ \downarrow \]

\[ \boxed{ r=z-\hat z } \]

\[ \downarrow \]

\[ \boxed{ S=HP^-H^T+R } \]

\[ \downarrow \]

\[ \boxed{ NIS=r^TS^{-1}r } \]

\[ \downarrow \]

\[ \boxed{ NIS\le\gamma? } \]

If yes:

\[ \boxed{ \text{Accept Measurement} } \]

and perform:

\[ \boxed{ \text{Estimator Update}. } \]

If no:

\[ \boxed{ \text{Reject / Downweight / Flag Measurement}. } \]

4.2.15.297 Key Equations at a Glance

Predicted Measurement

\[ \boxed{ \hat z = h( \hat x^- ). } \]

Innovation

\[ \boxed{ r = z-\hat z. } \]

Innovation Covariance

\[ \boxed{ S = HP^-H^T+R. } \]

Mahalanobis Distance

\[ \boxed{ d_M = \sqrt{ r^TS^{-1}r }. } \]

Normalised Innovation Squared

\[ \boxed{ NIS = r^TS^{-1}r. } \]

Chi-Square Distribution

\[ \boxed{ NIS \sim \chi_m^2. } \]

Gate

\[ \boxed{ NIS \le \gamma \Rightarrow \text{Accept}. } \]

Rejection

\[ \boxed{ NIS > \gamma \Rightarrow \text{Reject / Downweight}. } \]

Average NIS

\[ \boxed{ \overline{NIS} = \frac1N \sum_k NIS_k. } \]

Expected NIS

\[ \boxed{ E[NIS]=m. } \]

Whitened Innovation

\[ \boxed{ \tilde r = S^{-1/2}r. } \]

Then:

\[ \boxed{ NIS = \tilde r^T\tilde r. } \]

4.2.15.298 Key Takeaways

The most important concepts of measurement validation and innovation gating are:

• Not every available measurement should automatically be fused.
• Measurement validation should occur before the estimator correction.
• Validation should be layered.
• Packet integrity, numeric validity, timestamps, frames, units, physical ranges, and sensor quality should be checked before statistical gating.
• The innovation is:

\[ \boxed{ r=z-\hat z. } \]

• Innovation magnitude alone is not sufficient.
• The innovation covariance:

\[ \boxed{ S=HP^-H^T+R } \]

determines how large a residual should be expected.

• Mahalanobis distance normalizes the residual by its uncertainty.
• The Normalised Innovation Squared is:

\[ \boxed{ NIS=r^TS^{-1}r. } \]

• Under Gaussian consistency assumptions:

\[ \boxed{ NIS\sim\chi_m^2. } \]

• The chi-square threshold depends on measurement dimension.
• Scalar and multi-dimensional measurements require different thresholds.
• A valid measurement may occasionally fail the gate.
• A bad measurement may occasionally pass.
• Gate selection therefore trades false rejection against false acceptance.
• A single gate failure should not automatically declare permanent sensor failure.
• Repeated gate failures are more informative.
• Sensor-specific validation logic is important.
• Camera feature association should be gated before navigation fusion.
• LiDAR measurements should pass physical and statistical checks.
• GNSS quality flags should be combined with innovation validation.
• Quaternion attitude measurements should be gated through a local attitude-error representation rather than component subtraction.
• Timing and frame validity must be correct before innovation statistics are meaningful.
• High NIS can indicate sensor faults, but also incorrect timing, frames, model dynamics, or underestimated covariance.
• Low NIS can indicate overly conservative covariance.
• NIS should therefore be used for both measurement validation and estimator tuning.
• Innovations should ideally have approximately zero mean.
• Innovation sequences should ideally be approximately white.
• Persistent bias or autocorrelation indicates modelling problems.
• Hard gating gives accept/reject decisions.
• Robust weighting provides intermediate trust.
• Adaptive R can represent genuine changes in sensor quality.
• Covariance inflation should not be used to hide model or timing errors.
• Batch gating tests entire measurement groups.
• Sequential gating can isolate individual bad measurements.
• Sensor reintroduction should normally require several valid measurements.
• Rejected measurements should still be logged.
• Gate reason codes are important for diagnosis.
• Measurement validation contributes to FDIR but does not replace it.
• Gate statistics should be evaluated by sensor and mission phase.
• Monte Carlo testing should quantify false-rejection and outlier-detection rates.
• HIL fault injection should verify real implementation behavior.
• Navigation integrity depends on both rejecting hazardous data and maintaining sufficient measurement availability.
• During close RPO and capture, measurement validity should be part of navigation-health logic.
• Capture-ready decisions should rely on statistically credible state estimates supported by valid measurements.

The most important measurement-validation principle is:

\[ \boxed{ \text{Do Not Ask Only Whether a Measurement Is Different—Ask Whether It Is More Different Than Its Expected Uncertainty Allows}. } \]

The central statistical test is:

\[ \boxed{ NIS = r^TS^{-1}r. } \]

The basic gate is:

\[ \boxed{ NIS \le \chi^2_{m,\alpha} \Rightarrow \text{Measurement Statistically Consistent}. } \]

And the most important practical warning is:

\[ \boxed{ \text{A Large Innovation Does Not Automatically Mean a Bad Sensor—It Means Something in the Sensor, Timing, Model, State, or Covariance Is Inconsistent}. } \]

Next: 4.2.16 Outlier Rejection, Fault Detection and Robust Fusion

Innovation gating answers the immediate question:

\[ \boxed{ \text{Should This Measurement Be Used Right Now?} } \]

But real spacecraft navigation must also answer broader questions:

\[ \boxed{ \text{Is the Sensor Developing a Fault?} } \]

\[ \boxed{ \text{Should the Sensor Be Isolated?} } \]

\[ \boxed{ \text{Can Navigation Continue Without It?} } \]

\[ \boxed{ \text{How Should Remaining Sensors Be Reweighted?} } \]

This leads naturally to 4.2.16 Outlier Rejection, Fault Detection and Robust Fusion, including:

• sensor faults,
• measurement outliers,
• bad-data rejection,
• persistent bias,
• drift faults,
• frozen sensors,
• excessive noise,
• measurement dropout,
• fault detection,
• fault isolation,
• sensor exclusion,
• recovery and reintroduction,
• FDIR interaction,
• robust weighting,
• Huber and other M-estimators,
• heavy-tailed likelihoods,
• redundant sensor checking,
• degraded navigation modes,
• navigation availability,
• integrity,
• continuity,
• and fault-tolerant RPO navigation.