M8-T13: IMU failure handling

Learning objectives

After this lesson, you should be able to:

• Classify IMU failure modes and their signatures in gyro and accelerometer data.
• Implement cross-check voting for triple redundancy and explain why dual redundancy cannot isolate.
• Use model-based residuals (gyro vs attitude change, accelerometer vs gravity) for single-IMU detection.
• State detection time and what the vehicle does on a confirmed failure.

Conceptual explanation

Established Redundancy management by voting and cross-checks is standard in avionics. Many autopilots use several IMUs and a selection logic; check what yours does and how it is configured. Thresholds in the example are placeholders and must be derived from the sensor noise specification and validated.

Failure modes and their signatures:

Detection approaches:

• Cross-check between units: with $n\ge 3$ the median of redundant measurements isolates one faulty unit; with 2, only a disagreement is seen.
• Model-based residuals: integrate the gyro and compare with the attitude change from another source (magnetometer, vision, GNSS velocity); compare the accelerometer’s mean at rest with gravity; compare the estimator’s innovations with their expected size.
• Built-in tests and data quality: sensor status flags, sample counters, temperature, vibration metrics.

Engineering intuition

Three clocks on a wall: if one disagrees, you believe the other two. Two clocks that disagree tell you something is wrong, not which one. IMUs work the same way, except vibration makes “disagree” fuzzy: two units at different mounting positions legitimately see slightly different signals during manoeuvres (lever arm, mounting flexure), so the thresholds must exceed the normal disagreement while staying below the level that matters to the estimator.

Isolation is only half the answer. After removing a faulty IMU the system has less redundancy; the next failure may be unrecoverable. The response ladder is: continue with warning on the first fault if two healthy units remain; land promptly if one remains; and treat a failure with no healthy unit as an emergency (controlled descent from a model-based estimate if the autopilot has one, otherwise termination).

Mathematical formulation

For three units measuring the same quantity with independent noise $\sigma$ and no fault, the pairwise differences have standard deviation $\sigma \sqrt{2}$; a fault is declared when a unit’s disagreement with the median of the three persists. For unit $i$ with measurement $z_{i}$ and the median $m$ of the three, the residual $r_{i}=z_{i}-m$ is a noise-like quantity whose standard deviation is below $\sigma$ for an unfaulted unit, so a threshold of several $\sigma$ is conservative:

where $\sigma _{\text{mount}}$ accounts for legitimate disagreement from lever arms (for angular rate $\omega$ and a lever-arm acceleration, a·$r$) and $k\approx 5\text{–}6$ keeps the false-alarm probability per sample at about $10^{-6}$ to $10^{-9}$ for Gaussian noise. The detection delay for a bias step of size $\Delta$ with $N$ required samples at rate $f$ is N/f provided $\Delta \gg \gamma$; for $\Delta$ near $\gamma$ detection takes longer and a CUSUM test improves sensitivity: $S_{k}=\max (0,\,S_{k-1}+|r_{k}|-\nu )$, alarm when $S_{k}>h$. A gyro bias of $\Delta$ rad/s gives an attitude error $\Delta \,t$, so a 0.05 rad/s bias reaches $2.9^{\circ}$ in 1 s: detection within tens of milliseconds is needed for a fast vehicle.

$\sigma$, $\sigma _{\text{mount}}$

sensor noise and legitimate inter-unit disagreement.

$k$, $N$

threshold multiplier and consecutive-sample count.

$\nu$, $h$

CUSUM allowance and alarm level.

Architecture and data flow

IMU $A$, $B$, $C$ (SPI, each with its own sample counter and timestamp) → sensor drivers → sensors module (voter and selection) → estimator input (selected unit, or the combination of healthy units) with flags in the status message. The vehicle status reports the selected IMU and failure flags; the commander applies the failure response. The log records every unit’s raw data and the voter decisions so that a fault can be reconstructed. (In PX4 the sensors module and EKF2 handle multi-IMU selection and use innovation checks; consult the documentation of your version for the parameters and behaviour.)

Real-world UAV applications

• Triple-IMU flight controllers with automatic failover.
• Single-IMU vehicles using model-based residuals and a conservative failsafe.
• Vibration and mounting diagnostics during development.
• Verification of fault detection by injecting faults in recorded data.

Implementation example

This runs as shown. A triple-IMU gyro voter with three injected faults on different units (stuck output, bias step, noise increase), detection by median cross-check with $N$ consecutive samples and a CUSUM for small biases. It reports detection delays and false alarms, and shows that two units alone detect but cannot isolate.

import numpy as np
rng = np.random.default_rng(51)
fs, T = 250, 60.0; n = int(fs * T); t = np.arange(n) / fs
sigma = 0.004                                                                         # gyro noise (rad/s) per sample, placeholder
truth = 0.8 * np.sin(2 * np.pi * 0.5 * t) + 0.3 * np.sin(2 * np.pi * 1.7 * t)           # true body rate about one axis
def triple(fault=None, unit=0, t_fault=20.0):
    z = np.stack([truth + sigma * rng.standard_normal(n) for _ in range(3)]); k = int(t_fault * fs)
    if fault == 'stuck': z[unit, k:] = z[unit, k]
    if fault == 'bias': z[unit, k:] += 0.03                                           # about 7.5 sigma
    if fault == 'noise': z[unit, k:] += 0.05 * rng.standard_normal(n - k)             # about 12 sigma
    return z
def voter(z, k=6.0, N=5, nu=1.5 * sigma, h=12 * sigma, window=125):
    # median cross-check of three units; returns the time at which each unit is first flagged (None if never)
    alarm = [None] * 3; S = np.zeros(3); cnt = np.zeros(3, int)
    for j in range(z.shape[1]):
        m = np.median(z[:, j]); r = np.abs(z[:, j] - m)
        cnt = np.where(r > k * sigma, cnt + 1, 0); S = np.maximum(0.0, S + r - nu)          # consecutive-exceedance counter and a CUSUM
        if j > window:
            w = z[:, j - window:j]; frozen = np.ptp(w, axis=1) < 1e-9                       # no change at all for 0.5 s
            d = np.std(np.diff(w, axis=1), axis=1); noisy = d > 3 * np.median(d)            # much noisier than the median unit
        else: frozen = noisy = np.zeros(3, bool)
        for i in range(3):
            if alarm[i] is None and (cnt[i] >= N or S[i] > h or frozen[i] or noisy[i]): alarm[i] = t[j]
    return alarm
for fault, unit in (('stuck', 0), ('bias', 1), ('noise', 2)):
    a = voter(triple(fault, unit)); delay = a[unit] - 20.0
    print(f"{fault:>5} fault on unit {unit}: flagged at {a[unit]:.3f} s (delay {delay:.3f} s); other units flagged: {[x for i, x in enumerate(a) if i != unit and x is not None]}")
    assert 0 <= delay < 0.8 and all(x is None for i, x in enumerate(a) if i != unit)
fa = sum(x is not None for x in voter(triple())); print("false alarms on 60 s of fault-free data (3 units):", fa); assert fa == 0
z = triple('bias', 1); two = z[[0, 1]]; dis = np.abs(two[0] - two[1])[int(20 * fs):]
print(f"with two units only: disagreement after the fault is {dis.mean():.3f} rad/s ({dis.mean() / sigma:.0f} sigma) on average, but which of the two is wrong is undetermined")
assert dis.mean() > 5 * sigma
print(f"attitude error from the bias if not isolated: {np.degrees(0.03 * 1.0):.2f} deg after 1 s")

Common engineering mistakes

Failure modes

Debugging approach

1. Log raw data of all IMUs and the voter state; plot pairwise differences.
2. Measure normal disagreement in flight to set thresholds above it.
3. Inject frozen, biased and noisy data into a recorded flight and replay.
4. Check vibration spectra at the IMU mounts for resonances.

Practical exercises

1. Compute the detection delay for a 0.02 rad/s bias with the example CUSUM parameters.
2. Add the accelerometer and a gravity check at rest to the monitor.
3. Estimate $\sigma _{\text{mount}}$ for a 0.1 m lever arm at $5\,\mathrm{rad}/\mathrm{s}^{2}$ angular acceleration.
4. Define the response ladder for your vehicle (three, two, one IMU).

Interview questions

Write an answer in your own words, then reveal the model answer. Nothing is sent anywhere.

References and further reading

Primary papers, official documentation and standards. Each claim above that is specific to a tool or version points here.

• PX4: Using the ECL EKF (multi-IMU and innovation checks)
• ArduPilot: IMU batch sampling (vibration and sensor diagnostics)
• NASA Systems Engineering Handbook (NASA/SP-2007-6105), fault tolerance

What’s next