Demonstration
Six sensors. One goes wrong. Named in flight.
Checks on the overlaps, and the fix they allow
Consistency is a property of the overlaps, so a failure arrives with a location.
How to read this figure
The ground: one of fourteen kinds of country on each run, from desert, alpine range and ice sheet to fjord, reef and open ocean. Each is tinted by altitude in its own colours, lit from its own sun, contoured, and its weather is drawn as haze where it lies.
Six sensors in a wheel: S0 looks straight down and S1 to S5 look out around it, each over its own patch and in its own colour. Every triangle of three overlapping patches is one check, drawn in the corner wheel.
Rose: a broken check, and the sensor the checks name. The named sensor is excluded and the checks it sat on are retired, drawn hatched.
Dashed rose: what the named sensor was reading. A sensor reporting the wrong place gets a line to where it is looking; one reading the wrong height has its patch redrawn at the heights it reads, tied to the ground below.
Dashed white: the route ahead, planned over this ground before the run begins, weaving through the low ground and advancing only downrange.
White: the vehicle on the checked fix, with a line down to the ground under it.
Grey outline and grey track: the same vehicle navigating on the plain average of all six. A rose cross marks where it meets the ground.
The strip beneath: the largest check still in use, on a log scale, with the threshold a check must stay under dashed across it.
Consistency is a property of the overlaps, so a failure arrives with a location. Each sensor reports the height of the ground over its own patch, through its own calibration offset. Where two patches overlap the two reports are compared, and round every triangle of three overlapping patches the three differences must sum to zero, because a calibration offset cancels round a loop. A sensor that has gone wrong breaks the checks on its own triangles: the hub sits on all five, each rim sensor on two, so the pattern of broken checks points to one sensor. A sensor is named when it alone explains the pattern; while two could, the fix is held back and the checks go on being read.
Every run flies a different country, and the fault that develops belongs to it. Canyon walls hide most of the sky from a satellite receiver; reflections off fjord walls pull a satellite fix; a spoofer drags one aside. Ridges give a radar altimeter its return off the nearest slope. A forest canopy or a reed bed returns its tops to a laser rangefinder; fog, sea mist, dust, sea spray and rain give an altimeter a false surface above the ground; sun glint misreads the shallows; dry snow lets a radar pulse read below the surface. Which sensor fails changes from run to run, and the checks are given only the readings. The fault opens a fifth of the way into the run, holds at full strength through the middle and closes before the terminal leg; the phases on the rail are named for it.
Over 30 consecutive runs, every country flown at least twice, the checks named the failing sensor in 30, a median of 2.2 seconds after the fault opened and 4.5 seconds at the longest, and every name given was the right one. The checked vehicle cleared the ground in all 30 runs. The same six sensors averaged flew into terrain in 5; in the others the average carried the fault as a drift off the route or a rise or fall in height, which the readout beside the figure reports as it happens.