GPS-Denied Drone Autonomy

The drone that knows where it is, and knows the instant it can't

Lodestar is a navigation-integrity engine for GPS-denied flight. It keeps tracking through a jamming bubble to about 0.9% drift, and when the scene goes genuinely unobservable it flips RED and returns home rather than flying a confident-but-wrong fix into a wall. Trust is computed outside the estimator, so it holds no matter how good the underlying VIO gets.

0.92%

Position drift held through the GPS-denied leg (ours)

Seeded synthetic mission; dead-reckoning hit 30.95%

RED at 52.5 s

Return-to-home when the tunnel became unobservable

Same mission, LiDAR fusion off

100% / 0.1%

Unobservable tunnel flagged / false alarms on the healthy leg

Abstention check, this run

Everything below is a seeded, synthetic mission over a 245.3 m path, reproducible offline. No real drone, flight log, or electronic-warfare emitter is involved.

The dangerous failure isn't drift. It's a confident-but-wrong position.

Electronic warfare has made GPS unreliable in exactly the places autonomous drones now matter most: contested airspace, mining pits, tunnels, urban canyons. The reflexive fix is to bolt on visual-inertial odometry (VIO) and hope. But VIO fails in two ways, and only one of them is the drift everyone talks about.

The first failure is that VIO drifts, accumulating error the longer GPS stays denied. That is manageable. The second is worse: VIO fails silently. It locks onto moving objects or an empty scene and reports a crisp, confident position that is simply wrong. For a defense, mining, or Blue UAS buyer, a confidently-wrong position is more dangerous than an honest "I don't know," because the aircraft acts on it with full conviction and flies precisely toward a place it is not.

When we built this demo, we treated that second failure as the real problem. Making the estimator more accurate does not solve it, because "is this position trustworthy?" is a different question than "what is this position?" You cannot answer the first with the same machinery that produced the second, any more than you would let a witness certify their own testimony. So Lodestar's durable value is not a better estimator. It is an integrity monitor that sits outside the estimator and is willing to say the unglamorous thing: this position cannot be trusted, return to home.

How it works: trust computed outside the estimator

The pipeline is all real, deterministic, seeded code. A synthetic mission generates ground truth independently of every estimator; a tightly-coupled VIO EKF produces the position; a separate Navigation Integrity Monitor judges whether that position can be trusted; and a benchmark plus a Flight Integrity Report score the whole run against ground truth.

The estimator: one EKF, three honest configurations

The same tightly-coupled VIO EKF runs in three genuinely different settings, not strawmen. Dead-reckoning IMU uses no vision. Stock VIO runs with semantic masking off. Integrity-aware VIO (ours) runs with semantic masking on, so it rejects the visual features that belong to moving objects instead of tracking them. When GPS is denied at t=18 s, the EKF hands off from GPS to vision with no operator-visible mode change and keeps the position continuous.

The integrity monitor: a GREEN / AMBER / RED verdict

The Navigation Integrity Monitor is separate code on purpose. It fuses three signals into one integrity state with hard thresholds:

RED sustained for 0.5 seconds latches the failsafe and commands return-to-home. The monitor also reweights the GPS-to-VIO balance as trust changes. Because it lives outside the estimator, its verdict does not depend on the thing being trusted.

The receipt: a one-click Flight Integrity Report

One click exports the audit receipt as JSON and printable HTML: the scoreboard, headline metrics, abstention correctness, failsafe time, an event timeline, and an explicit scope disclosure of what is stubbed versus deferred. It runs fully offline and deterministically at a fixed seed, so the entire result is reproducible. The only optional LLM is a "Draft narrative" button that writes the technical-review narrative from the structured report and sits entirely outside the flight loop; the deterministic integrity gate decides, the model only advises.

The proof: one flight, four beats

The demo is one continuous seeded mission. These are its four beats in order, recorded with LiDAR fusion off, the headline run where the failsafe fires.

Lodestar dashboard at the GPS-good baseline: the integrity state reads GREEN, drift is 0.38 m, and the benchmark scoreboard shows integrity-aware VIO at 0.92% drift against dead-reckoning at 30.95% and stock VIO at 28.79%.
Beat 1, GPS good (t below 18 s). The estimated track sits on ground truth and integrity reads GREEN. This is the baseline before the jamming bubble.

Beat 2, GPS denied (t=18 s, the jamming bubble)

The drone crosses into a simulated R-330Zh-style electronic-warfare bubble and GPS drops. The EKF hands off to VIO with no mode change and keeps tracking to about 0.9% drift, while the dead-reckoning IMU baseline blows out to 30.95% drift and 75.92 m of final error. The accuracy is real, but it is not the point. The point is what happens when accuracy is no longer possible.

The moving-convoy segment: stock VIO with masking off has locked onto the moving vehicles and flown off in red, while the integrity-aware track holds close to ground truth and the integrity state reads AMBER with 2 usable features and 10 masked.
Beat 3, the moving convoy (t=30 to 43 s). A convoy crosses a feature-sparse clearing. Stock VIO locks onto the moving vehicles and flies off to 28.79% drift and 70.61 m error, the documented "tracked the truck, thought the drone was still" failure. Semantic masking rejects the dynamic features, so the integrity-aware track holds. Integrity honestly dips to AMBER because there are now few static features, but the trajectory stays good.
The dark-tunnel segment: usable features have collapsed to zero, the integrity state reads RED with the label position not trustworthy, and the timeline shows TRACKING DEGRADED with return-to-home triggered at t=52.5 s.
Beat 4, the dark tunnel (t=52 to 66 s), the honest-abstain case. Visual features collapse to near zero. No estimator can manufacture a trustworthy position from an unobservable scene, so the monitor flips RED and triggers return-to-home at t=52.5 s. It does not bluff a fix. It declares the estimate untrustworthy and commands a safe action.
The same tunnel segment with LiDAR fusion toggled on: integrity holds, no failsafe fires, and the scoreboard shows integrity-aware VIO plus LiDAR at 0.43 m ATE and 0.01% drift.
The recovery, LiDAR fusion on. Toggle a simulated tightly-coupled LiDAR range constraint on and the same segment becomes observable. Integrity holds, no failsafe fires, and drift drops to 0.01% on this run. LiDAR is a trade, not magic: it adds 250 to 400 g of payload and 8 to 12 W of power, a real SWaP-C cost the report surfaces rather than hides.
The exported Flight Integrity Report showing the accuracy table versus independent ground truth, abstention correctness, an event timeline, and a scope disclosure section.
The Flight Integrity Report. One click exports the full audit receipt: accuracy against ground truth, abstention correctness, failsafe time, the event timeline, and an explicit disclosure of what is stubbed versus deferred. This is the technical-review receipt, built for the kind of scrutiny an SBIR or AFWERX reviewer would apply.

The numbers, with exact scope

Produced by the report builder at seed 20260619 over a 245.3 m path, fully reproducible offline. The headline run is LiDAR fusion off, where the RED failsafe fires.

Method (LiDAR off) ATE Final error Drift
Dead-reckoning IMU 25.37 m 75.92 m 30.95%
Stock VIO (masking off) 32.95 m 70.61 m 28.79%
Integrity-aware VIO (ours) 0.90 m 2.26 m 0.92%

On the same run, 56.3% of the GPS-denied flight held at GREEN integrity, the monitor flagged the genuinely-unobservable tunnel 100% of the time, and it false-alarmed on the healthy GPS-denied leg only 0.1% of the time. The return-to-home failsafe triggered at t=52.5 s. With simulated LiDAR fusion on, the tunnel becomes observable, drift drops to 0.01%, GREEN coverage rises to 78.9%, and no failsafe fires, which is the correct behavior, not a missed one.

Throughput measured on this run was 16,000 EKF propagation updates (80 s at 200 Hz). The 30 to 45 FPS on an NVIDIA Jetson Orin NX 16 GB figure is a target-hardware spec, not measured here, and the report labels it as such.

What this demo does not do

Honesty is the product, so the scope is explicit. This is a demo of the mechanism, not a deployed pipeline.

  • Everything is synthetic and seeded. There is no real drone, flight log, public dataset, or electronic-warfare emitter. The R-330Zh is a named scenario, not a sensed signal.
  • The visual front-end (SuperPoint), the LiDAR fusion (a simulated range constraint, not a real LiDAR factor), the MAVLink/autopilot interface, and the Jetson throughput are stubbed or simulated.
  • Loop closure and pose-graph optimization, a real ORB-SLAM3 plus SuperPoint front-end, a public-dataset benchmark, the optimization-based sliding-window backend, a PX4 SITL bridge, and a flight test are all deferred.
  • The exact metres and percentages are this one seeded mission's results, not flight-tested guarantees. The durable claim is the structure: trust computed outside the estimator, RED triggering return-to-home, and abstention on unobservable scenes.

Questions buyers ask

How does a drone keep flying when GPS is jammed?

When GPS drops inside a jamming bubble, Lodestar hands off to a tightly-coupled visual-inertial odometry (VIO) EKF that fuses camera landmarks and 200 Hz IMU data to keep estimating position. On our seeded synthetic mission that held drift to about 0.9 percent of the flown path, where a dead-reckoning IMU baseline blew out to roughly 31 percent. The estimator is only half the story: a separate integrity monitor decides, moment to moment, whether the position can be trusted at all.

Why is a confidently wrong position more dangerous than drift?

A slightly drifting position degrades gracefully and an operator can plan around it, but a confidently wrong one sends the aircraft precisely toward a place that is not where it thinks it is. VIO fails this way when it locks onto moving objects or an empty scene and reports a crisp fix that is simply false. Lodestar's answer is honest abstention: when no position can be trusted, it says so and returns home instead of flying a confident-but-wrong fix into a wall.

What happens when the drone enters a tunnel and cannot see anything?

In the dark-tunnel segment of our mission, usable visual features collapse to near zero, so no estimator can manufacture a trustworthy position. The Navigation Integrity Monitor flips to RED, and after 0.5 seconds of sustained RED it latches a failsafe and commands return-to-home, at t=52.5 s in this run. Toggle the optional simulated LiDAR fusion on and the same segment becomes observable again, so the monitor correctly holds and no failsafe fires.

Is this a real flight test or a simulation?

It is a simulation. Everything is a synthetic, seeded mission with ground truth generated independently of every estimator, so the run is byte-for-byte reproducible; there is no real drone, flight log, or electronic-warfare emitter, and the R-330Zh is used only as a named scenario. What is real is the code: a working VIO EKF, the integrity monitor, and the benchmark all run deterministically offline. The durable claim is the structure, meaning trust computed outside the estimator and RED triggering return-to-home, not the exact metres of one mission.

How is this different from stock VIO or ORB-SLAM3?

Stock VIO estimates position but has no separate judge of whether that position is trustworthy, and it can lock onto dynamic features. In the same seeded run, stock VIO with semantic masking off latched onto a moving convoy and flew off to about 29 percent drift, the classic case of tracking the truck and thinking the drone was still. Lodestar adds semantic masking that rejects the moving features, plus an integrity monitor that lives outside the estimator so trust does not depend on the thing being trusted.

Can Lodestar run onboard a drone, on a Jetson?

The demo runs offline and deterministically on a laptop as a FastAPI service with a NumPy EKF and integrity monitor. The 30 to 45 FPS on an NVIDIA Jetson Orin NX 16 GB figure is a target-hardware spec, not a measured result, and the Flight Integrity Report states it as such. Onboard deployment, a real image front-end, and the autopilot/MAVLink bridge are deferred, not built in this version.

Is Lodestar Blue UAS or NDAA compliant?

Blue UAS is the U.S. Defense Innovation Unit's cleared list of NDAA-compliant drones, and SBIR/AFWERX fund exactly this kind of GPS-denied autonomy work; we reference them as market context, not as affiliations. Veriprajna is not stated to be on any list or under any contract. What the demo provides for that kind of review is a one-click Flight Integrity Report with an explicit scope disclosure of what is stubbed versus deferred.

Technical Research

The research behind this demo — the architecture, the verification design, and the enterprise blueprint.

Full solution

Explore the GPS-Denied Drone Autonomy solution →

Building autonomy for airspace where GPS can't be trusted?

The demo proves the mechanism. The harder work is adapting it to your platform, your sensors, and your mission.

If your team is wrestling with GPS-denied navigation and the question of when an autonomy stack should refuse to trust its own position, we would genuinely like to hear how you are thinking about it. The problem is industry-wide and the answers will be too.

Navigation integrity review

  • • Assess your GPS-denied failure modes, including silent VIO failures
  • • Define the trust signals and thresholds that matter for your mission
  • • Design the abstention and failsafe policy for unobservable scenes
  • • Produce a reproducible integrity benchmark against ground truth

Autonomy engineering build

  • • Integrate a tightly-coupled VIO EKF with a real image front-end
  • • Add an integrity monitor that lives outside the estimator
  • • Bring up sensor fusion and the autopilot bridge for your airframe
  • • Deliver the technical-review receipt for SBIR/AFWERX-style scrutiny
Connect via WhatsApp Email Our Team
WhatsApp
Chat instantly
Book a Call
Schedule via Calendly
Email
[email protected]