{'fraction_non_alphanumeric': 0.03722139262208948, 'fraction_numerical': 0.011752668547093633, 'mean_word_length': 4.730153699889082, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Error Overboundings of KF-Based IMU/GNSS Integrated System Against IMU Faults

Considering the inertial measurement unit (IMU) faults risk of an unmanned aerial vehicle (UAV), this paper studies the error overboundings of the state estimation of the extended Kalman filter (EKF) in a tightly coupled IMU/global navigation satellite system (GNSS) integrated architecture under the IMU fault condition, which can be used to assure the integrity of the UAV navigation system. The error overboundings of the error-state inertial navigation equations based EKF (error-state EKF) are obtained according to the IMU faults propagation derivation, which can be expressed as a sum of the terms related to the EKF innovation, the estimated bias, and the remaining position error. It presents the same expression with the error overbounding of the full-state inertial navigation equations based EKF (full-state EKF). Simulation results show that both the error overboundings of the error-state and full-state EKFs can fit the state error against the IMU faults, but the error-state EKF is more suitable for UAV navigation system integrity assurance due to its higher calculation efficiency. This study will be extended to the integrity monitoring of multisensor systems.


Introduction
Unmanned aerial vehicles (UAVs) are widely used in many aspects of our daily life. The application of UAVs will permeate more aspects of public life in the near future. To ensure the safety of a UAV, its navigation solution should be fully protected by an integrity assurance mechanism, including real-time fault detection and an integrity risk evaluation. Integrity risk is the probability of hazardous misleading information (HMI) [1] and can be evaluated by the error overboundings (i.e., protection levels (PLs)) of the estimated position solution corresponding to the required probability of HMI, i.e., the integrity risk requirement [2,3].
An UAV usually adopts an inertial measurement unit (IMU)/global navigation satellite system (GNSS) integrated navigation system. The configuration of the IMU on UAVs can be performed according to the practical application requirements. UAVs similar to the DJI Phantom series use two IMUs to provide redundant measurements [4]. The experimental test carried out by Rhudy uses four IMUs to provide redundant IMU data [5]. Although the redundantly configured IMU can be used to detect IMU faults, there is still a probability of missed detection, and the fault risk of IMU still exists. Moreover, the low-cost micro-electromechanical system (MEMS) IMU on an UAV has a lower reliability and is more vulnerable to the flight environment than the fiber-optic strapdown IMU on civil aviation aircraft. Giorgio showed that IMUs are more prone to malfunction in high-vibration environments, where UAVs typically operate [6]. Bhatti listed the fault types of IMU sensors and summarized the potential causes of each fault type [7]. The IMU also has a high fault risk in the integrated navigation

Error-State EKF Model
Using the error-state IMU equations as the system propagation equation, the state vector includes the IMU attitude error, IMU velocity error, IMU position error, inertial sensor biases, and GNSS receiver clock offset and drift for the error-state EKF [22]. The EKF is described as a system propagation equation (Equation (1)) and a measurement update equation (Equation (2)) [6]. In the measurement updates step, the GNSS pseudo-range and pseudo-range rate measurements are used for the measurement update, and the difference between the GNSS pseudo-range, GNSS pseudorange rate and the corresponding predicted IMU pseudo-range, IMU pseudo-range rate constitute the EKF innovation. There is another expression of the system propagation equation, the full-state inertial navigation equations based EKF (i.e., the full-state EKF). For either the full-state or error-state in EKF, the essence is to estimate the state error. However, there is a difference between the errorstate EKF and the full-state EKF in the system propagation step, the control input is added to the fullstate EKF (Appendix A): where ˆk X − is the predicted error-state vector at epoch k, ˆk X is the measurement updated errorstate vector at epoch k, Φk is the dynamic state transition matrix at epoch k, Гwk is the process noise matrix at epoch k, k w  is the process noise vector at epoch k, k K is the Kalman gain at epoch k

Error-State EKF Model
Using the error-state IMU equations as the system propagation equation, the state vector includes the IMU attitude error, IMU velocity error, IMU position error, inertial sensor biases, and GNSS receiver clock offset and drift for the error-state EKF [22]. The EKF is described as a system propagation equation (Equation (1)) and a measurement update equation (Equation (2)) [6]. In the measurement updates step, the GNSS pseudo-range and pseudo-range rate measurements are used for the measurement update, and the difference between the GNSS pseudo-range, GNSS pseudo-range rate and the corresponding predicted IMU pseudo-range, IMU pseudo-range rate constitute the EKF innovation. There is another expression of the system propagation equation, the full-state inertial navigation equations based EKF (i.e., the full-state EKF). For either the full-state or error-state in EKF, the essence is to estimate the state error. However, there is a difference between the error-state EKF and the full-state EKF in the system propagation step, the control input is added to the full-state EKF (Appendix A): based on innovations, (4) the simulations for the error overboundings calculation under IMU faults are presented, and (5) the summary and concluding remarks close the paper. Figure 1 illustrates an overview of the EKF-based tightly coupled IMU/GNSS integration architecture. The inputs are the GNSS pseudo-range,  , pseudo-range rate,   , GNSS receiver clock offset, c  , and GNSS receiver drift, c   , from the GNSS ranging processor and the IMU position, IMU P , velocity, IMU V , and attitude, IMU A , navigation parameters from the inertial navigation processor. The outputs of the integrated navigation system are the corrected IMU position, P , velocity, V , and attitude, Â . The integration is completed in the range domain. In this study, the error-state inertial navigation equations based EKF (i.e., the error-state EKF) was used for the IMU/GNSS integration architecture, and the outputs of the IMU/GNSS integration Kalman filter were the UAV navigation parameter error estimation,X  [21].

Error-State EKF Model
Using the error-state IMU equations as the system propagation equation, the state vector includes the IMU attitude error, IMU velocity error, IMU position error, inertial sensor biases, and GNSS receiver clock offset and drift for the error-state EKF [22]. The EKF is described as a system propagation equation (Equation (1)) and a measurement update equation (Equation (2)) [6]. In the measurement updates step, the GNSS pseudo-range and pseudo-range rate measurements are used for the measurement update, and the difference between the GNSS pseudo-range, GNSS pseudorange rate and the corresponding predicted IMU pseudo-range, IMU pseudo-range rate constitute the EKF innovation. There is another expression of the system propagation equation, the full-state inertial navigation equations based EKF (i.e., the full-state EKF). For either the full-state or error-state in EKF, the essence is to estimate the state error. However, there is a difference between the errorstate EKF and the full-state EKF in the system propagation step, the control input is added to the fullstate EKF (Appendix A): whereX − k is the predicted error-state vector at epoch k,X k is the measurement updated error-state vector at epoch k, Φ k is the dynamic state transition matrix at epoch k, Γ wk is the process noise matrix at epoch k, → w k is the process noise vector at epoch k, K k is the Kalman gain at epoch k (Appendix B.1), → Z k is the estimate of the measurement produced by the states estimated by the Kalman filter, H k is the measurement matrix at epoch k (Appendix B.1), and r k is the EKF innovation vector at epoch k.

Error Overboundings Against IMU Faults
This part analyzes the propagation process of IMU faults for the error-state EKF in detail. Through the analysis, the recursive propagation equation between adjacent epochs of the EKF state error is obtained. Based on the EKF state error propagation equation and the EKF innovation equation, the error overboundings of the EKF state error are given.

IMU Faults Propagation in the Error-State EKF
In this section, the IMU faults propagation process in the state vector for the error-state EKF is explained. The differences between the output measurement value and the true value of the IMU are expressed in Equation (3): where "~" represents the measurement value, ϕ α β is the attitude vector (rad), v r βα is the velocity vector (m/s), and r r βα is the position vector (m). The inertial navigation error equations in the Earth-centered, Earth-fixed (ECEF) coordinate frame can be seen in Equation (4), including the attitude error, velocity error, and position error update equations: where C e b is the coordinate transformation matrix from the body frame to the Earth frame (a detailed expression can be found in Appendix B.2), → ω e ie is the Earth rotation rate (rad/s), → g e is the gravity vector in the Earth-centered, Earth-fixed frame (m/s 2 ), and [•×] represents the calculation of a skew-symmetric matrix.
Neglecting the effects of gravity errors, Equation (4) can be simplified as Figure 2 shows the updating process of the attitude, velocity, and position in the ECEF coordinate frame for the IMU. When IMU faults occur in the gyroscope or accelerometer, the computed attitude, velocity, and position are sequentially affected, finally resulting in position errors.
Under the condition of a faulty IMU, the inertial navigation error equation in Equation (5) becomes Equation (6), where the apostrophe (') indicates the faulty parameter. The parameters affected by the fault are expressed as the sum of a normal error term and a faulty additional error term, as shown in Equation (7):    Under the condition of a faulty IMU, the inertial navigation error equation in Equation (5) becomes Equation (6), where the apostrophe (') indicates the faulty parameter. The parameters affected by the fault are expressed as the sum of a normal error term and a faulty additional error term, as shown in Equation (7): eb eb Substituting Equation (7) into Equation (6), the inertial navigation error equation under the IMU faults condition can be shown as C  Substituting Equation (7) into Equation (6), the inertial navigation error equation under the IMU faults condition can be shown as Under the condition of a faulty IMU, the inertial navigation error equation in Equation (5) becomes Equation (6), where the apostrophe (') indicates the faulty parameter. The parameters affected by the fault are expressed as the sum of a normal error term and a faulty additional error term, as shown in Equation (7): eb eb Substituting Equation (7) into Equation (6) C , and e r eb f     represent the resultant bias vectors for the attitude, velocity, and position error states due to the IMU faults. In the EKF, the accelerometer measurement of the specific force represent the resultant bias vectors for the attitude, velocity, and position error states due to the IMU faults. In the EKF, the accelerometer measurement of the specific force → f b ib,meas is represented as Equation (10), which includes the true specific force, the accelerometer bias, and the process noise. In addition, the gyroscope measurement of the angular rate, → ω b ib,meas , is represented as Equation (11), which includes the true angular rate, the gyroscope bias, a g-dependent bias related to the specific force, and process noise. The accelerometer bias and gyroscope bias are usually modeled as constant errors [23]: Sensors 2019, 19, 4912 According to Equations (10) and (11), the accelerometer measurement of the specific force error and the gyroscope measurement of the angular rate error are derived from the accelerometer measurement of the specific force, → f b ib,meas , and the gyroscope measurement of the angular rate, → ω b ib,meas , as shown in Equation (12): Substituting Equation (12) into Equation (9), the inertial navigation error equation under the IMU faults condition is Rearranging Equation (13), the inertial navigation error equation under the IMU faults condition (Equation (8)) becomes a continuous form of an EKF error-state equation as a function of EKF error states, process noise, and the state fault vector, as shown in Equation (14): According to Equations (10) and (11), the accelerometer measurement of the specific force error and the gyroscope measurement of the angular rate error are derived from the accelerometer measurement of the specific force, , b ib meas f  , and the gyroscope measurement of the angular rate, , as shown in Equation (12): Substituting Equation (12) into Equation (9), the inertial navigation error equation under the IMU faults condition is Rearranging Equation (13), the inertial navigation error equation under the IMU faults condition (Equation (8)) becomes a continuous form of an EKF error-state equation as a function of EKF error states, process noise, and the state fault vector, as shown in Equation (14): Based on the integral relationship between the velocity and the position in the error-state inertial navigation equations, Equation (14) can be rewritten as Based on the integral relationship between the velocity and the position in the error-state inertial navigation equations, Equation (14) can be rewritten as Hence, an EKF state equation under the IMU faults condition generalized as Equation (16) in a continuous form. The error-state vector contains the IMU position error, the IMU velocity error, the IMU attitude error, accelerometer biases, gyroscope biases, the GNSS receiver offset, and the GNSS receiver drift: The discrete form of Equation (16) is shown in Equation (17): The discrete form of F is shown as where τ s is the time interval of the adjacent propagation. Thus, the predicted state under the IMU faults condition at epoch k iŝ Substituting Equation (19) into Equation (2), the measurement update state under the IMU faults condition at epoch k isX where K k is the Kalman gain matrix computed by the faulty state transition matrix due to the IMU faults measurements and H k is the measurement matrix at epoch k (Appendix B.1). To simplify Equation (20), we introduce a matrix L k as shown in Equation (21): Subsequently, Equation (20) can be simplified aŝ According to Equation (22), the additional term due to the IMU faults measurement at epoch k is

EKF State Error Caused by IMU Faults
The PL against an IMU gyroscope and accelerometer fault should be formulated to overbound the state error with the integrity risk requirement. The true state is defined as shown in Equation (23): The state error propagation between two adjacent epochs can be derived as follows: In step 1, multiply the matrix L k by the true state, In step 2, subtract L k → X k fromX k in Equation (22): In step 3, substitute (25): Substitute Equation (21) into Equation (26): As shown in Equation (27), the state error vector at epoch k can be expressed as a function of the previous state error vector, a state fault vector, a measurement noise vector, and a process noise vector, indicating that the derived state error vector affected by the IMU faults is recursive.

Error Overboundings
In the tightly coupled IMU/GNSS integration architecture, the EKF innovation is defined as the pseudo-range and the pseudo-range rate differences between the GNSS measurements and IMU predictions. The pseudo-range and pseudo-range rate measurements are obtained from the GNSS ranging processor. The pseudo-range and pseudo-range rate predictions are constructed using the corrected inertial navigation parameters, estimated receiver clock offset and clock drift, and satellite positions and velocities calculated according to the ephemeris. The relationship between the innovation and the state error under the IMU faults condition can be derived from the innovation definition as described below.
For the error-state EKF, the innovation at epoch k can be expressed as follows: Substitute Equation (21) Substitute Equation (21) into Equation (26): As shown in Equation (27), the state error vector at epoch k can be expressed as a function of the previous state error vector, a state fault vector, a measurement noise vector, and a process noise vector, indicating that the derived state error vector affected by the IMU faults is recursive.

Error Overboundings
In the tightly coupled IMU/GNSS integration architecture, the EKF innovation is defined as the pseudo-range and the pseudo-range rate differences between the GNSS measurements and IMU predictions. The pseudo-range and pseudo-range rate measurements are obtained from the GNSS ranging processor. The pseudo-range and pseudo-range rate predictions are constructed using the corrected inertial navigation parameters, estimated receiver clock offset and clock drift, and satellite positions and velocities calculated according to the ephemeris. The relationship between the innovation and the state error under the IMU faults condition can be derived from the innovation definition as described below.
For the error-state EKF, the innovation at epoch k can be expressed as follows: As shown in Equation (27), the state error vector at epoch k can be expressed as a function of the previous state error vector, a state fault vector, a measurement noise vector, and a process noise vector, indicating that the derived state error vector affected by the IMU faults is recursive.

Error Overboundings
In the tightly coupled IMU/GNSS integration architecture, the EKF innovation is defined as the pseudo-range and the pseudo-range rate differences between the GNSS measurements and IMU predictions. The pseudo-range and pseudo-range rate measurements are obtained from the GNSS ranging processor. The pseudo-range and pseudo-range rate predictions are constructed using the Sensors 2019, 19, 4912 9 of 23 corrected inertial navigation parameters, estimated receiver clock offset and clock drift, and satellite positions and velocities calculated according to the ephemeris. The relationship between the innovation and the state error under the IMU faults condition can be derived from the innovation definition as described below.
For the error-state EKF, the innovation at epoch k can be expressed as follows:

Error Overboundings
In the tightly coupled IMU/GNSS integration architecture, the EKF innovation is defined as the pseudo-range and the pseudo-range rate differences between the GNSS measurements and IMU predictions. The pseudo-range and pseudo-range rate measurements are obtained from the GNSS ranging processor. The pseudo-range and pseudo-range rate predictions are constructed using the corrected inertial navigation parameters, estimated receiver clock offset and clock drift, and satellite positions and velocities calculated according to the ephemeris. The relationship between the innovation and the state error under the IMU faults condition can be derived from the innovation definition as described below.
For the error-state EKF, the innovation at epoch k can be expressed as follows: Due to the relationship between the innovation and the state error, the error overboundings for the error-state EKF under the IMU faults can be expressed by the innovation. To simplify Equation (28), we introduce a matrix k U as shown in Equation (29): which is a common term in both the state error, in Equation (27), and the EKF innovation, in Equation (28), representing the impact caused by the IMU faults. Substitute Equation (29) into Equations (27) and (28): Due to the relationship between the innovation and the state error, the error overboundings for the error-state EKF under the IMU faults can be expressed by the innovation. To simplify Equation (28), we introduce a matrix U k as shown in Equation (29): which is a common term in both the state error, in Equation (27), and the EKF innovation, in Equation (28), representing the impact caused by the IMU faults. Substitute Equation (29) into Equations (27) and (28): As an EKF does not take measurements for all the EKF states in the IMU/GNSS integration architecture, H k T H k becomes a singular matrix and is not an invertible matrix. Thus, as shown in Equation (32), we define U k,p as a partial matrix of U k , only computed by the nonzero terms of H k . The state error can be captured from the EKF innovation vector: Substituting Equation (32) into Equation (30), the state error can be expressed by using the EKF innovation vector, which can be accessed in real time as shown in Equation (33): To simplify Equation (33), introduce a matrix V k as shown in Equation (34): Thus, the state error can be expressed as the sum of the innovation and the measurement noise by substituting Equation (34) into Equation (33): According to Equation (35), the state error under the IMU faults condition can be bounded based on the distribution of the measurement noise. With the assumption of the measurement noise obeying a normal distribution, the error overboundings for the EKF state can be expressed as In Equation (36), the uncertainty noise bounding terms include the bias estimates term, σ V k,p → v k ,v , the remaining position error term, σ K k,p → v k ,v , and the coefficient, K md,IMU , which is related to the integrity risk requirement allocated to the IMU faults condition of the IMU/GNSS integrated navigation architecture. Due to the fact that the IMU sensor bias estimates are computed in real time, it is highly probable that the error overboundings can overbound the state error for two sides [19]. This leads to a lower level of conservatism than using the absolute error overboundings.

Simulation Conditions
Simulations were conducted to show the error overboundings for UAVs under the IMU faults condition using both the full-state EKF (Appendix C) and the error-state EKF. In the simulations, the GNSS measurement noise and the IMU gyroscope and accelerometer measurement noise were modeled as Gaussian white noise, and the corresponding noise parameters were also used in the error overboundings.
The specific UAV trajectory can be seen in Figure 3, configured as an integration of two 45 • turns and one vertical climb. The simulation time was 7 min. The specific UAV trajectory can be seen in Figure 3, configured as an integration of two 45° turns and one vertical climb. The simulation time was 7 min. The IMU sensors were set as consumer-grade inertial sensors with the noise parameters listed in Table 1 [24]. In the simulation, a 24-satellite GPS constellation was used, and the mask angle was 7.5°. The GNSS measurement noise was introduced into the pseudo-ranges as white Gaussian noise with a mean of zero and a variance of 30 m 2 . The data update frequency was 5 Hz for the GNSS receiver and 100 Hz for the IMU sensors. The integrated Kalman filter update was only performed when the GNSS signal was updated, otherwise only the IMU output was used. The output frequency was 100 Hz, which was the same as the IMU update frequency.
All simulations were performed using MATLAB R2018a on a Windows 10 PC with 12 GB of RAM and an Intel Core i7-6700 3.4 GHz processor.  The IMU sensors were set as consumer-grade inertial sensors with the noise parameters listed in Table 1 [24]. In the simulation, a 24-satellite GPS constellation was used, and the mask angle was 7.5 • . The GNSS measurement noise was introduced into the pseudo-ranges as white Gaussian noise with a mean of zero and a variance of 30 m 2 . The data update frequency was 5 Hz for the GNSS receiver and 100 Hz for the IMU sensors. The integrated Kalman filter update was only performed when the GNSS signal was updated, otherwise only the IMU output was used. The output frequency was 100 Hz, which was the same as the IMU update frequency.
All simulations were performed using MATLAB R2018a on a Windows 10 PC with 12 GB of RAM and an Intel Core i7-6700 3.4 GHz processor.

Simulation Under Injected IMU Gyroscope and Accelerometer Faults
For the simulations of the error overboundings, the prior probabilities of an IMU gyroscope and accelerometer sensor faults were assumed to be 10 −3 , considering the IMU hardware performance used for a low-cost use and consumer-grade inertial device [25]. In the simulation, the ramp IMU gyroscope and accelerometer faults, with magnitudes of 1.5 m/s 2 in the accelerometer and 0.03 rad/s in the gyroscope, was injected into the IMU accelerometer and gyroscope for three axes after 200 s. The faults injection lasted 10 s.
As an example, the vertical position errors are presented as the red dotted curve, which is the difference between the EKF estimated vertical position and the true vertical position, in Figure 4. In addition, the vertical error overboundings (VPL error.overboundings ) are presented in Figure 4, as blue solid curves for the error-state EKF and green solid curves for the full-state EKF. In order to intuitively present the vertical state error in Figure 4, the state error is represented in Figure 5, as a blue dotted curve for the error-state EKF and a red solid curve for the full-state EKF. In this simulation, the value of K md,IMU was chosen to be 3.29, which overbounds the noise of the state bias estimates with a missed detection probability of 10 −3 (Appendix B.3). The simulation results show that the overboundings had the same trend as the position error and that the position error can be accurately overbounded during UAV operations under the missed detection probability requirement. Moreover, the error overboundings of the two EKFs were the same when no fault occurred. When faults were injected, the error overboundings for the error-state were higher than the full-state; the reason for this is that the error-state EKF is more sensitive to the faults than the full-state EKF. The east and north state errors and overboundings (i.e., east error overboundings (EPL error.overboundings ), north error overboundings (NPL error.overboundings )) are also presented in Figures 6 and 7, respectively, which further proves that the position error can be accurately overbounded and that the error overboundings of the two EKFs are the same in all directions.

Computational Efficiency Comparison
To compare the efficiency of the full-state and the error-state EKFs in the error overboundings calculation, the filtering time at each epoch is recorded in Figure 8. The filtering time of the error-state EKF was lower and more stable than that of the full-state EKF. The average filtering time for the error-state EKF was approximately 7.573 × 10 −4 s, 16.163% less than that for the full-state error, approximately 9.033 × 10 −3 s. A detailed comparison can be seen in Table 2. period, the state transition matrix Φk of the full-state EKF has more nonzero elements than that of the error-state EKF. As shown in Figure 8, taking, for example, the simulation times at 312.5 s and 357.5 s, there are distinct peaks for the full-state EKF because of the sparse matrices in the system propagation equation. Moreover, the convergence process of the EKF was evaluated by 3.66 times variance. As shown in Figure 9, the state error of the error-state EKF converged faster than the fullstate EKF, the oscillation before convergence was smaller, and the convergence process was smoother.   Actually, the filtering time required for sparse matrix operations is usually proportional to the number of arithmetic operations in the number of nonzero elements. In the system state propagation period, the state transition matrix Φ k of the full-state EKF has more nonzero elements than that of the error-state EKF. As shown in Figure 8, taking, for example, the simulation times at 312.5 s and 357.5 s, there are distinct peaks for the full-state EKF because of the sparse matrices in the system propagation equation. Moreover, the convergence process of the EKF was evaluated by 3.66 times variance. As shown in Figure 9, the state error of the error-state EKF converged faster than the full-state EKF, the oscillation before convergence was smaller, and the convergence process was smoother.

Conclusions
The IMU faults propagation process was analyzed in this paper for the error-state EKF of tightly coupled IMU/GNSS integrated architecture. Accordingly, the error overboundings against the IMU faults was obtained. The error overboundings for the full-state and the error-state EKFs presented the same form in theoretical derivation, consisting of terms relating to the EKF innovation, the

Conclusions
The IMU faults propagation process was analyzed in this paper for the error-state EKF of tightly coupled IMU/GNSS integrated architecture. Accordingly, the error overboundings against the IMU faults was obtained. The error overboundings for the full-state and the error-state EKFs presented the same form in theoretical derivation, consisting of terms relating to the EKF innovation, the estimated bias, and the remaining position error. The simulation result shows that the derived error overboundings can fit the position error, reflecting the position error change caused by the IMU faults. Moreover, the error overboundings of the error-state EKF were the same as that of the full-state EKF in mathematical simulation. As the error-state EKF is more practical and its error overboundings calculation time was lower, the error-state EKF is recommended to assure the integrity of the IMU/GNSS integrated architecture for an UAV. The proposed error overbounding method with real collected data will be carried out in future work.
Author Contributions: W.L. and D.S. conceived of and designed the research. W.L. and D.S. performed the theoretical derivation, experiments, and analyzed the results. W.L. and D.S. wrote the paper. Z.W. and K.F. were responsible for data acquisitions and data processing. Z.W. was responsible for project management. W.L., D.S., Z.W., and K.F. finalized the manuscript version to be published.
With the measurements, the new optimal state estimate is a linear combination of measurements and previous estimates. Therefore,x where L k and K k are the weight functions to be determined. Substitute Equation (A4) into Equation (A5): Since KF is an unbiased estimation algorithm, the expected value of Equation (A6) can be calculated as Bring Equation (A7) into Equation (A5): and the error covariance matrix of the measurement can be obtained: where R k is the covariance matrix of the measurement noise. The best choice of weight function K k is to minimize the estimation error ofx + k . In addition, the variance of error estimation is determined by the diagonal element of the error covariance matrix. Therefore, it is necessary to minimize the trace of P + k matrix with respect to K k , as shown in Equation (A10): the Kalman gain matrix can be obtained: Update the state vector with the actual measurement vector: where r k is the measurement innovation vector: Once the state estimate converges to its corresponding true value, the measurement innovation can be modeled as a linear function of the state vector, but direct measurement cannot be modeled as a linear function. Therefore, For the tightly coupled integrated navigation in the ECEF coordinate system, H k can be expressed as where u e aj T is the line of sight unit vector, h i ρ T is shown as Equation (A18): where R N is the meridian radius of curvature, R E is the transverse radius of curvature,L b is the geodetic latitude of users, andĥ b is the geodetic height of users.

Appendix B.2. The Detailed Expression of the Coordinate Transformation Matrix C e b
The coordinate transformation matrix from the body frame to the Earth frame is shown in Equation (A19): where L b is the geodetic latitude of the user and λ b is the geodetic longitude of the user.
Appendix B.3. The Detailed Calculation of the Coefficient K md,IMU The value of K md,IMU is calculated from the Gaussian quantile with the given probability of missed detection:

Appendix C. IMU Faults Propagation in the Full-State EKF
For either the full-state or error-state in the extended Kalman filter for a linear system, the essence is to estimate the error. For nonlinear systems, the second or higher order errors are neglected. This is also true for other estimation methods (e.g., least squares). Therefore, the state error equations for the error-state EKF are the same as for the full-state EKF. However, there is a difference between the error-state EKF and the full-state EKF in the system propagation step-the control input is added to the full-state EKF. Thus, when faults occur, the faults propagation process makes a difference, which needs to be considered.
The inertial navigation equations in the Earth-centered, Earth-fixed (ECEF) coordinate frame can be seen in Equation (A22), including the attitude, velocity, and position update equations: . → .  C  (rad/s); a g-dependent bias related to the specific force, g G (rad·s/m); and process noise, g w  : Rearranging Equation (A27) and Equation (A28), the true specific force and angular rate can be expressed as follows: , and (rad/s); bias in the gyroscope, → b g (rad/s); a g-dependent bias related to the specific force, G g (rad·s/m); and process noise, Rearranging Equation (A27) and Equation (A28), the true specific force and angular rate can be expressed as follows: Substituting Equations (A29) and (A30) into Equation (A26) is expressed as  Hence, an EKF state equation under the IMU faults condition can be generalized as Equation (A34) in a continuous form: The discrete form of Equation (A34) is shown in Equation (A35): where Γ uk is the discrete system control-driven matrix. The discrete form of F is shown as where τ s is the time interval of the adjacent propagation. According to Equation (A35), the predicted state under the IMU faults condition at epoch k is shown in Equation (A36): (A37) By substituting Equation (A37) into Equation (A2), the measurement update state under the IMU faults condition at epoch k iŝ where K k is the Kalman gain matrix computed by the faulty state transition matrix due to the IMU faults measurements.
To simplify Equation (A38), a matrix L k is introduced as shown in Equation (A39): Subsequently, Equation (A38) is simplified as Equation (A40): According to Equation (A40), the additional term due to the IMU faults measurement at epoch k The PL against an IMU gyroscope and accelerometer fault should be formulated to overbound the state error with the probability of the integrity risk requirement. The state error is defined as shown in Equation (A41): where → X k represents the true state as shown in Equation (A42): Thus, the state error propagation between two adjacent epochs can be derived as follows: In step 1, multiply the matrix L k by the true state, → X k : In step 2, subtract L k → X k fromX k : In step 3, insert → v k is the measurement noise vector: ) Thus, the state error propagation between two adjacent epochs can be derived as follows: In step 1, multiply the matrix As shown in Equation (A46), the state error vector at epoch k can be expressed as a function of the previous state error vector, a state fault vector, a measurement noise vector, and a process noise vector, indicating that the derived state error vector affected by the IMU faults is recursive. Contrasting Equation (A46) with Equation (27), it can be found that the IMU faults present the same propagation law in both the error-state and full-state EKFs, resulting in the same state error.
According to the expression of the matrix shown in Equation (A39), rearrange Equation (A45): Thus, the state error propagation between two adjacent epochs can be derived as follows: In step 1, multiply the matrix