M8-T11: GNSS loss handling

Learning objectives

After this lesson, you should be able to:

• Define GNSS loss and degradation using receiver quality indicators and estimator statistics.
• Design the mode transition and the allowed degraded operations.
• Derive a failsafe timeout from a drift rate and a clearance requirement.
• Test the response in simulation and in flight with a defined procedure.

Conceptual explanation

Implementation-specific The behaviours below are system-design choices, not universal rules. PX4 provides configurable failsafes (parameter names change between versions): read the PX4 safety documentation and map these requirements onto its configuration.

Treat GNSS availability as a graded quality, not a flag: satellite count, DOP, accuracy estimate, fix type, carrier-to-noise ratio, and the estimator’s innovation statistics all feed a judgement. The system should detect degradation (before the estimate is wrong, if possible), transition to a defined mode, operate within restrictions while uncertainty is bounded, and terminate safely when it is not.

Engineering intuition

The estimate does not suddenly become wrong when GNSS stops; it becomes uncertain, and the uncertainty grows at a rate set by the quality of the remaining aiding. That growing uncertainty is the clock. A vehicle with good LiDAR-inertial odometry might drift at a fraction of a percent of distance and be good for minutes; a vehicle on bare inertial navigation has seconds. The rules of operation should be written in terms of uncertainty (σ, drift rate, time since last absolute fix) rather than in terms of “GNSS yes/no”, because that is what actually bounds the risk.

Mathematical formulation

If the remaining aiding gives a position drift rate $\rho$ ($m$ per metre travelled) or a drift velocity-error growth, the position uncertainty after time $t$ at speed $v$ is roughly:

Given a clearance requirement $c$ (the smallest distance to an obstacle or a boundary that the plan relies on), a margin factor $k$ (for example 3 for $3\sigma$), the maximum permitted time in the degraded mode is:

Example: clearance 2 m, $k=3$, $\sigma _{0}=0.3\,\mathrm{m}$, drift $\rho =0.01$ (1% of distance) at $v=2\,\mathrm{m}/\mathrm{s}$ gives $t_{\max}=(0.667-0.3)/(0.02)\approx 18\,\mathrm{s}$. If the mission needs 60 s to reach a safe landing area, either the speed must drop, the clearance requirement relax, or better aiding is needed. Slower flight increases time but not distance, so with drift proportional to distance the distance, not the time, is the budget: here 0.367/0.01 = 37 m.

Architecture and data flow

Receiver quality + estimator innovation (NIS) + odometry cross-check → GNSS trust flag with hysteresis → navigation manager → mode and speed/clearance limits to the planner → mission layer (hold, return, land). The planner must receive the uncertainty, not just the mode, so it can inflate obstacle margins. When GNSS returns, the estimator should blend the new fix gradually and the manager should require a period of consistent GNSS before restoring the nominal mode, to avoid chatter.

Real-world UAV applications

• Urban canyon flights that leave GNSS coverage for short stretches.
• Indoor-outdoor transitions in inspection missions.
• Defining PX4 failsafe configurations and offboard behaviour on loss of position.
• Writing the acceptance tests for the “GNSS loss” requirement in Capstone 4.

Implementation example

This runs as shown: it computes the maximum degraded-mode time from the clearance requirement and the drift rate, and implements a GNSS trust function with hysteresis so that brief fix recoveries do not restore the nominal mode.

def max_degraded_time(clearance_m, k, sigma0_m, drift_ratio, speed_ms):
    """Time until k*sigma exceeds the clearance, with sigma(t) = sigma0 + drift_ratio * speed * t (odometry-aided)."""
    budget = clearance_m / k - sigma0_m
    return max(0.0, budget / (drift_ratio * speed_ms))

t_max = max_degraded_time(2.0, 3.0, 0.3, 0.01, 2.0)
print(f"maximum time in GNSS-denied mode: {t_max:.1f} s at 2 m/s -> {t_max * 2.0:.0f} m of travel")
assert abs(t_max - 18.3) < 0.2
assert max_degraded_time(2.0, 3.0, 0.3, 0.01, 1.0) > 2 * t_max - 1          # half the speed doubles the time (same distance)

class GnssTrust:
    """Lose trust immediately on bad quality; regain it only after a continuous good period (hysteresis)."""
    def __init__(self, regain_after_s=5.0):
        self.trusted = True; self.good_since = None; self.regain_after_s = regain_after_s
    def update(self, t, sats, hdop, nis_ok):
        good = sats >= 8 and hdop < 2.0 and nis_ok
        if not good:
            self.trusted, self.good_since = False, None
        elif not self.trusted:
            self.good_since = t if self.good_since is None else self.good_since
            if t - self.good_since >= self.regain_after_s: self.trusted = True
        return self.trusted

g = GnssTrust()
assert g.update(0.0, 12, 0.9, True) is True
assert g.update(1.0, 4, 6.0, False) is False                               # lost
assert g.update(2.0, 12, 0.9, True) is False                               # brief recovery: still not trusted
assert g.update(4.0, 5, 3.0, True) is False                                # good again? no: resets the timer
assert g.update(5.0, 12, 0.9, True) is False and g.update(9.9, 12, 0.9, True) is False
assert g.update(10.1, 12, 0.9, True) is True                               # 5.1 s of continuous good quality: regain
print("trust logic ok")

Common engineering mistakes

Failure modes

Debugging approach

1. Replay a log with GNSS data removed and check detection time, mode transitions and the estimate.
2. Inject the loss in SITL (disable the GNSS sensor) and measure position error growth against the model $\sigma (t)$.
3. Check hysteresis by feeding alternating good and bad quality sequences.
4. Test GNSS return with an offset in the estimate and verify the correction is blended.

Practical exercises

1. Compute $t_{\max}$ for clearance 1 m, $k=3$, $\sigma _{0}=0.2\,\mathrm{m}$, drift 2%, speed 1.5 m/s.
2. Add a receiver accuracy estimate to the trust logic and choose its threshold.
3. Specify the allowed speed and clearance in AMBER mode as a function of $\sigma$.
4. In the GNSS-Denied Failure Simulator, compare the time to failsafe with and without a LiDAR.

Interview questions

Write an answer in your own words, then reveal the model answer. Nothing is sent anywhere.

References and further reading

Primary papers, official documentation and standards. Each claim above that is specific to a tool or version points here.

• PX4: Safety configuration (failsafes)
• PX4: EKF2 and GNSS fusion
• $P$. $D$. Groves, Principles of GNSS, Inertial, and Multisensor Integrated Navigation Systems, 2nd ed., Artech House, 2013 (integrity and integration).

What’s next