On this page
The failure chain after GNSS is lost
A well-structured response separates detection, estimation, mode eligibility,
and action. These stages may occur quickly, but they answer different questions.
- The receiver or estimator detects a condition. Messages may stop, age
beyond a limit, lose a valid fix, fail receiver-quality gates, or disagree
with inertial prediction.
- The estimator changes its aiding status. It rejects or stops receiving
GNSS position and velocity, then propagates with the IMU and any remaining
observations.
- Uncertainty grows by state. Attitude, height, air-relative velocity,
local position, and global position can degrade at different rates.
- Mode logic reevaluates prerequisites. A mode that requires valid global
position may become unavailable even though attitude control still works.
- The vehicle or operator selects a contingency. The result might be a less
position-dependent mode, a controlled descent or landing, continued flight on
alternative navigation, a route change, or flight termination in a
specifically designed system.
- Recovery logic decides whether to reuse GNSS. Restored messages are not
automatically trustworthy. The system may require quality, consistency, and
stability checks before fusion and mode restoration.
This chain follows the functional boundaries in
how IMUs, GNSS, estimators, and autopilots work together.
The dedicated
GNSS-aided inertial navigation guide
explains why unaided error grows and how measurement updates normally constrain
it.
The transition should be driven by estimator validity and mode requirements, not
by a hard-coded assumption that every loss of receiver fix makes the aircraft
immediately uncontrollable. It also should not preserve a position mode after
the position estimate has exceeded its verified limit merely because motor
control and attitude remain available.
Loss, degradation, and spoofing are different
“GPS lost” is often used for several observably different conditions.
Scroll horizontally to compare all columns.
The FAA's current
GNSS Interference Resource Guide
addresses both jamming and spoofing and emphasizes the wider human and system
effects of misleading information. It is written for pilots and operators in the
broader aviation system, not as a small-drone flight manual. Its durable lesson
is that inaccurate navigation can create confusion and delayed response, not
merely a clean “GPS unavailable” flag.
The FAA Aeronautical Information Manual's
jamming and spoofing section
lists intentional and unintentional interference sources and notes that effects
can extend beyond navigation into surveillance, safety systems, automation, and
time-dependent functions. The exact functions on a commercial UAS must be traced
from its own architecture.
GPS.gov's interference overview
separately identifies nearby emissions, intentional or unintentional jamming,
and natural space weather as interference sources. Signal absence does not prove
intent, and a field anomaly should not be publicly labeled jamming or spoofing
without supporting evidence.
What states can remain usable
The correct unit of analysis is the estimated state, not the receiver icon. A
GNSS outage removes measurements that commonly aid global position, horizontal
and vertical velocity, time, and sometimes heading. Other sensors may still
support some of those states.
Scroll horizontally to compare all columns.
Inertial coasting does not end at a universal number of seconds. Position error
depends on sensor errors, alignment, temperature, vibration, vehicle dynamics,
estimator design, other aiding, and the required containment. A consumer drone,
survey aircraft, and high-grade navigation unit can have very different behavior
while all advertise an IMU.
Command and control is a separate boundary. The operator may retain a healthy
control link while the aircraft loses GNSS, or lose the link while navigation
remains healthy. The
UAS lost-link procedure guide addresses
that second event. Treating the two as one failsafe can create a response that
requires the very function that failed.
Why return-to-home may not be available
Return-to-home sounds like a universal safe response, but it normally requires
several trustworthy inputs:
- a valid current position;
- a valid home or alternate destination;
- velocity and heading sufficient for guidance;
- an obstacle, terrain, airspace, and route strategy appropriate to the flight;
- enough energy and controllability; and
- a navigation source that remains usable throughout the return.
If global position is the failed state, commanding a geographic return can be
impossible or hazardous. A stored home coordinate does not tell the aircraft
where it is now. A dead-reckoned position may support a limited response only
within the verified uncertainty and duration.
An alternative contingency might descend using attitude and height, hold using
local vision or radar, continue along a bounded heading and airspeed plan, reach
a preselected termination area, or transfer authority to a trained operator in a
mode that does not require global position. None is universally correct. The
aircraft type, operating area, people and property at risk, link availability,
energy, weather, airspace, and approval basis determine the appropriate action.
The configuration must also define what happens if GNSS is restored during the
contingency. Automatically switching back to return mode after an inconsistent
position reset can be worse than completing a stable degraded response.
How aircraft type changes the response
A multirotor can often stabilize attitude and control vertical motion without a
valid global position. It may drift horizontally with wind if no ground-relative
observation remains. A manual attitude or altitude mode can therefore preserve
control authority without preserving a point over the ground. That distinction
must be trained and tested.
A conventional fixed-wing aircraft must continue moving through the air to
generate lift. It may use attitude, airspeed, barometric height, and a heading
reference to maintain controlled flight after global position degrades, but it
cannot simply stop. Wind uncertainty separates an air-relative path from a
ground track, so containment can grow even with stable attitude and airspeed.
A VTOL changes behavior by phase. It may use fixed-wing degraded logic in
wing-borne flight and multirotor logic in hover, but a transition itself needs
valid states, energy, altitude, and control authority. “Land” can mean a
vertical descent, a fixed-wing pattern, a transition then vertical landing, or
flight termination, depending on the aircraft.
PX4's official
safety and failsafe documentation
illustrates this dependency-based approach. It distinguishes position-estimate
loss from manual-control loss and documents different fallbacks based on vehicle
type, available height or position states, current mode, and configuration.
Those are PX4 behaviors, not defaults to copy into an unrelated aircraft.
ArduPilot's
EKF failsafe documentation
provides another implementation example. It connects estimator confidence, mode
prerequisites, operator indication, logging, and configured actions. The
differences between these two documented systems reinforce the main point: an
operator must verify the exact software version, parameters, aircraft, and mode,
not rely on a generic expectation about “what drones do.”
What alternative aiding can preserve
Alternative navigation is not a product category. Each source observes
particular states under particular conditions.
Optical flow can measure image motion relative to a viewed surface. Scaling
often depends on height, and performance depends on texture, light, blur, field
of view, and surface motion.
Visual-inertial odometry can constrain motion using tracked image features.
It can drift, lose tracking, or fail under lighting, texture, motion, compute,
or lens conditions outside its verified envelope.
Radar or lidar can provide range, velocity, terrain-relative, or
map-relative observations depending on design. Geometry, material, multipath,
weather, interference, field of view, and map assumptions remain relevant.
Radio beacons or external tracking can provide local position or range.
Their infrastructure, geometry, coverage, synchronization, communications path,
and common power or network dependencies become part of the aircraft system.
Airspeed and heading can support a fixed-wing air-relative trajectory, but
wind must be known or estimated to infer ground motion. A magnetometer is not an
independent position source.
A second GNSS constellation, frequency, antenna, or receiver can improve
availability or fault detection in some conditions. It may still share the same
interference environment, correction link, antenna installation, clock, power,
processor, or software. Redundancy should be credited only for failures it can
actually isolate or survive.
CISA's
Federal PNT Services Acquisitions Guidance
frames resilience by required behavior during and after a threat, including the
difference between an unbounded degraded solution and a bounded one. It is
federal acquisition guidance, not a UAS operating rule. The useful procurement
lesson is to specify the service and bound during disruption rather than ask
only whether a backup sensor exists.
The operator and human-machine interface
The operator needs an actionable state, not a cascade of ambiguous warnings. The
interface should distinguish at least:
- GNSS receiver unavailable or degraded;
- GNSS rejected by the estimator;
- navigation coasting without global aiding;
- position or velocity uncertainty above a mode limit;
- active navigation source and any source switch;
- current flight mode and the reason for a change;
- contingency action in progress;
- operator commands that remain accepted; and
- recovery checks pending or complete.
Indications need priority, persistence, plain language, and an associated
procedure. A map icon that continues moving on dead-reckoned coordinates can
look authoritative after the underlying state has degraded. Displays should show
age and uncertainty in a form the operator can interpret during workload, not
only in postflight engineering logs.
Procedures must match real authority and link conditions. If the response asks
the operator to change mode, confirm the command path remains available and the
selected mode does not depend on global position. If the aircraft is intended to
respond autonomously, the trigger, decision boundary, route or landing-area
assumptions, and override behavior need equivalent evidence.
The FAA's active
AC 20-138D record
includes guidance to document aircraft-level effects, indications, and
procedures when GNSS position, velocity, and time are disrupted. It applies to
conventional-aircraft approvals, not directly to most small-UAS operations. The
dependency-accounting principle is still sound: GNSS may feed functions that are
not labeled navigation.
How to test GNSS-loss behavior
Start with a dependency and transition analysis, then progress from software to
controlled flight. Do not begin by transmitting interference. Radio-frequency
emissions and GNSS test methods are legally and operationally constrained; use
approved facilities, conducted or shielded methods, simulation, receiver test
equipment, or other authorized techniques with competent oversight.
Scroll horizontally to compare all columns.
Test modes separately. Position hold, route following, return, landing,
geofence, payload georeferencing, surveillance output, time synchronization, and
operator map display can consume different GNSS-derived states. A pass in one
mode does not establish the others.
Test subtle failures as well as removal: intermittent availability, a frozen
position, valid-looking time with bad position, position with bad velocity,
correction-state changes, a receiver reboot, dual-receiver disagreement, and a
slow drift. Exercise compound conditions justified by the hazard analysis, such
as GNSS loss with high wind, low energy, payload operation, or loss of a
separate link. Keep causes distinct in logs and acceptance criteria.
Recovery is another state transition
Restored satellite tracking does not mean the estimator should immediately
resume normal navigation. The new observation may differ from the dead-reckoned
state, use a reset clock, carry stale corrections, or remain affected by the
same interference.
A guarded recovery can require:
- receiver fix, quality, and data-age checks;
- stable measurements for a defined dwell period;
- consistency with inertial and alternative observations;
- controlled state correction or a documented reset;
- updated uncertainty and origin handling;
- operator indication of the source and mode transition; and
- criteria for returning to position-dependent automation.
Hysteresis can prevent rapid switching at a quality boundary, but it must not
hide a recurring fault. The system should preserve the outage start, detection,
rejection, mode change, operator command, receiver restoration, reacceptance,
and final state in synchronized logs.
Recovery also includes postflight action. Preserve configuration, software and
hardware identifiers, raw receiver data when available, estimator diagnostics,
operator observations, location and time, other radio states, and independent
truth. Report suspected interference through the applicable authority and
organizational process without asserting a cause the evidence does not support.
The decision before flight
Before approving a GNSS-dependent operation, the operator and system owner
should be able to answer:
- Which functions consume GNSS position, velocity, or time directly or through
another system?
- Which states and modes remain valid after each GNSS measurement is rejected?
- How does uncertainty grow, and what verified limit ends inertial coasting?
- Which alternative observations work across the actual altitude, speed,
lighting, texture, weather, terrain, and payload envelope?
- Which indication appears first, and what authority does the operator retain?
- Does the contingency require current position, home position, a link, a map,
or another dependency that may be unavailable?
- How do multirotor, fixed-wing, VTOL, and phase-of-flight behaviors differ?
- How are misleading data, receiver disagreement, and correction loss handled?
- What must be true before restored GNSS is accepted again?
- Which analysis, simulation, bench, hardware-in-the-loop, ground, and flight
evidence applies to the exact released configuration?
If those answers are missing, “land,” “hover,” or “return home” is a label, not
a contingency plan.
Frequently asked questions
Not necessarily. Attitude stabilization can remain available from inertial and
other sensors even when global position is not. The aircraft may drift, change
mode, descend, land, continue on alternative navigation, or take another
configured action. The result is system- and condition-specific.
How long can a drone fly on its IMU after GNSS loss?
There is no universal duration. The useful interval ends when the required state
exceeds its verified uncertainty or containment limit. Sensor errors,
initialization, motion, vibration, temperature, other aiding, and mission needs
all affect that point.
Does a second GPS receiver solve GNSS loss?
It can help with receiver failures or disagreement detection, but both receivers
may share satellite signals, interference, corrections, antenna environment,
power, software, or timing. Credit only the independent failure coverage that
the installed architecture and tests demonstrate.
Is GPS loss the same as a lost control link?
No. GNSS is a navigation input. The command-and-control link carries authority
and related messages. Either can fail while the other remains healthy, and each
requires its own detection, response, and recovery logic.
