Three ways a position fails — lost, quietly wrong, or never available at all — and one requirement underneath all of them: never act on a position you cannot trust, and keep flying when there is none.
Sector: Infrastructure survey, and a restricted programme
The constraint
Survey flights near certain installations were being abandoned. Some aborted cleanly on loss of GNSS lock. The concerning ones did not: the receiver held a lock, reported healthy status, and produced a position that drifted tens of metres from truth. A confidently wrong position is far more dangerous than no position, because every system downstream believes it.
A separate programme pushed the same question to its limit: operate with no satellite navigation, no command link, nothing pre-placed in the environment, and no expectation that the environment matches a map held in advance. All processing onboard, inside the thermal and power envelope of a small airframe.
Different customers, the same underlying problem. A positioning solution is only as good as its worst failure mode, and none of these failure modes is rare.
What we did
Measure the environment before modelling it. We ran spectrum surveys at the sites where failures occurred rather than assuming a jamming model. The dominant problem turned out to be broadband out-of-band energy desensitising the front end, with intermittent narrowband contributions — not what had been assumed.
Harden the primary source. An interference-rejecting multi-band, multi-constellation receiver, so degradation of one band does not remove the solution. Antenna placement was reworked against measured patterns on the actual airframe, which mattered as much as the receiver choice.
Carry independent alternatives. Inertial, visual odometry and onboard perception, each failing in a different way, so no single condition takes them all. Perception runs on an embedded accelerator sized against the airframe's real continuous thermal limit rather than a burst benchmark — a model that throttles after four minutes is not a solution.
Cross-check, and be willing to say no. The part customers value most is the integrity monitoring: the satellite solution is compared against the independent sources, and when they diverge beyond threshold the position is declared untrusted and handed over, rather than published. Below the confidence threshold the vehicle executes a deterministic, pre-agreed fallback rather than improvising.
Validation was run against the conditions that break these systems rather than the ones that flatter them: low sun, rain, low texture, featureless surfaces, high-power RF, and the transitions between them.
