Navigation When GPS Cannot Be Trusted

A navigation system can fail in two fundamentally different ways. It can stop producing a position, or it can continue producing a position that is wrong.

The first failure is usually visible. The second may look credible long enough to influence a flight-management system, an autonomous vehicle, a timing-dependent network or an operator's decision. That distinction is why resilient navigation is not simply the ability to continue after a satellite signal disappears. It is the ability to determine which information remains trustworthy, what uncertainty has developed and whether the mission can continue within defined limits.

The title uses GPS because it is the term most readers know. The broader engineering problem concerns global navigation satellite systems (GNSS), including GPS and other satellite constellations, and the positioning, navigation and timing services built around them.

GPS is exceptionally useful. It provides global coverage, common timing and high accuracy from compact receivers. The problem is dependence. A system designed around continuous access to one external radio-frequency source inherits the conditions under which that source can be blocked, corrupted or unavailable.

Denial, jamming and spoofing are not the same event

These terms are often used interchangeably. Operationally, they describe different conditions and require different responses.

GPS denial is an outcome. The receiver cannot obtain a usable satellite-based navigation solution, or the wider platform cannot use that solution. Denial may be deliberate, but it can also result from terrain, buildings, antenna faults, damaged equipment, service interruption or an environment in which satellite signals do not propagate adequately.

Jamming is a cause of denial or degradation. Intentional radio-frequency interference prevents a receiver from reliably acquiring or tracking authentic satellite signals. Depending on power, distance, antenna geometry and receiver design, the effect may range from reduced accuracy or loss of some satellites to complete loss of the GNSS solution. Unintentional interference, emissions in adjacent bands and space weather can also disrupt reception; GPS.gov identifies all three as recognised interference sources.

Spoofing is a loss of integrity. Counterfeit or manipulated signals cause the receiver to calculate false position, navigation or timing data. Unlike obvious signal loss, a spoofed output may remain numerically smooth and superficially plausible. That makes the problem more dangerous than simple unavailability: incorrect data can be accepted and propagated before the discrepancy is detected.

The European Union Aviation Safety Agency has warned that spoofing can be harder to detect than jamming and may affect several aircraft systems cumulatively. Its published examples include false terrain-warning behaviour triggered by corrupted navigation information. EASA's safety bulletin series was revised again in July 2026, reflecting the continuing operational relevance of the problem.

Unavailable infrastructure is the non-adversarial case that resilient systems must not ignore. Satellite reception is weak or absent indoors, underground and underwater, and it can be obstructed or distorted in urban canyons, under dense cover and alongside steep terrain. A platform may also lose correction services, communications links or local navigation aids even while some satellite signals remain visible. A design that addresses only hostile jamming is not resilient to the full availability problem.

The operational consequence is larger than a missing map position

Positioning, navigation and timing data rarely remain inside one receiver. Depending on the platform, they may support route guidance, sensor registration, geofencing, surveillance, communication timing, system synchronisation, terrain awareness and autonomous decision-making.

The exact consequence of failure therefore depends on integration. A lost position may force a system to revert to a lower-capability mode. A false position may contaminate other functions that assume the navigation source is valid. A false time solution can affect systems even when geographic position is not their primary concern.

This leads to four separate operational requirements:

• Availability: is a navigation output present when the mission requires it?
• Accuracy: how close is that output to the true value under stated conditions?
• Continuity: can the service remain within its limits for the required period?
• Integrity: can the system detect when the output should no longer be trusted, and do so early enough to act?

A system can be accurate in benign testing and still be operationally unsafe if it cannot identify deception or bound its error during an outage. Government PNT policy consequently advises users to plan for signal loss and verify or authenticate received PNT data where small errors can have severe consequences. The US National Coordination Office describes this as responsible use of PNT.

Alternative navigation starts with independent physical evidence

There is no universal, drop-in replacement for GPS. The useful question is not which sensor is “best” in isolation. It is what physical quantity remains observable in the intended environment, what navigation information that quantity can constrain and whether its failure mode is independent of the failure that removed GPS.

Five broad categories are particularly important.

Inertial navigation: continuous motion without an external transmission

Inertial navigation uses measurements of acceleration and rotation to propagate position, velocity and attitude from a known starting condition. It is self-contained, produces data continuously and does not depend on receiving an external radio signal. Those properties make it the natural bridge through short GNSS interruptions.

Its limitation is equally fundamental. Small sensor biases, alignment errors and scale-factor errors are integrated over time. Velocity error grows and position error accumulates. The rate depends on sensor grade, temperature, vibration, vehicle dynamics, initial alignment and the aiding information available on the platform. Inertial navigation can preserve continuity, but without an independent external reference it does not provide an indefinitely stable absolute position.

This is why “the platform has an IMU” is not an adequate resilience claim. The relevant questions are how quickly error grows under the mission's actual conditions and how long the resulting position remains inside the required operating bound. Research on fixed-wing GNSS-denied navigation explicitly treats horizontal and vertical drift as the central limitation to be reduced. Gallo and Barrientos, Aerospace Science and Technology (2022)

Magnetic navigation: using spatial structure in the Earth's field

Magnetic navigation is broader than compass heading. The Earth's crust creates spatial variations in magnetic-field intensity. If those variations are measured and a suitable reference is available, they can provide geographically informative evidence without receiving a GNSS-band transmission.

The attraction is operationally clear. Magnetic measurement is passive, the underlying field is widely present and a jammer aimed at satellite-navigation frequencies does not remove the Earth's magnetic field. It can therefore offer a failure mode that is meaningfully different from GNSS.

That does not make magnetic navigation invulnerable or uniformly informative. The host platform can generate magnetic interference through electrical systems, ferromagnetic structures and changing equipment states. Magnetic features vary in spatial distinctiveness. Measurement altitude reduces access to shorter-wavelength features. Reference-map quality, temporal field variation and local magnetic disturbance all affect the information available.

These are measurable engineering constraints, not caveats to be hidden. A peer-reviewed flight-data study by Canciani and Raquet identified altitude, magnetic-map quality, inertial performance and spatial field variability as major determinants of magnetic-navigation performance. Canciani and Raquet, ION GNSS+ (2016)

Terrain-referenced navigation: locating against the physical landscape

Terrain-referenced navigation compares observed terrain with stored geographic information. The observation may come from radar altitude, lidar, imaging, bathymetry or another ranging or perception system. The physical landscape supplies an external reference that can constrain accumulated inertial error.

Its usefulness depends on both the sensor and the terrain. Mountainous or otherwise distinctive regions provide more discriminating structure than flat land or open ocean. Radar, lidar and cameras have different dependencies on altitude, weather, lighting, surface reflectivity, line of sight and emissions policy. Stored elevation or imagery must have adequate accuracy, resolution, coverage and currency.

Even a seemingly simple height measurement is conditional. Radar-altimeter errors can change with beam shape, aircraft attitude and the interaction between the radar footprint and terrain. Recent terrain-referenced navigation research has shown how a mismatch between assumed and actual measurement error can degrade the navigation solution or cause divergence. Kim, Park and Bang, International Journal of Aeronautical and Space Sciences (2025)

Terrain is therefore a powerful reference where the route, map and sensing conditions support it. It is not a universal source of position.

Celestial navigation: an external reference beyond terrestrial radio

Celestial navigation uses observations of the Sun, stars or other known objects to constrain orientation and, with the appropriate observations and supporting information, position. It is passive and independent of terrestrial transmitters. It remains attractive for aircraft, maritime platforms and space systems because the reference is external to the contested radio environment around the vehicle.

Different celestial measurements provide different information. Star observations are particularly strong for attitude. Position determination may require additional geometry, precise timing, ephemeris data or observations of other objects. Cloud, haze, daylight, obscuration, sensor field of view and optical alignment affect availability and accuracy.

The category is not merely historical. Celestial-aided navigation has been demonstrated in GPS-denied flight testing, while the published test record also identifies limited object-ephemeris availability and quality as performance constraints. Stephens et al., PNTAX flight testing (2021)

Signals of opportunity: using transmissions that already exist

Signals of opportunity are radio transmissions created primarily for communication, broadcasting or another service but observed for navigation. Examples can include cellular, television, radio and suitable satellite transmissions. Where several transmitters are observable, their timing, frequency or ranging characteristics can provide position-related information.

This approach can exploit infrastructure that is already deployed, but it does not control that infrastructure. Coverage, transmitter geometry, clocks, signal formats and operating schedules may change. Remote or damaged areas may offer few usable transmitters. A communications network can also share parts of the same contested electromagnetic environment as GNSS, so the independence of its failure mode must be demonstrated rather than assumed.

The category has credible experimental evidence. A 2024 study reported four flight runs on a US Air Force C-12 using terrestrial signals of opportunity across semi-urban, urban and rural routes without assuming GNSS availability. The reported accuracy varied materially with the route and with how much was known about the transmitters, illustrating both the capability and its dependence on the radio environment. Kassas et al., IEEE Transactions on Intelligent Transportation Systems (2024)

Resilience is not the number of sensors

Adding sensors does not automatically create resilient navigation. Two sources can fail together because they depend on the same spectrum, map, visibility, timing source, power supply, antenna location or environmental condition.

A defensible architecture evaluates each source against the mission:

• Does it provide an absolute geographic reference, relative motion, attitude, velocity or only a consistency check?
• How does its error grow, and for how long does it remain useful after GNSS loss?
• Where and when is the source observable along the route?
• What infrastructure, map or prior information does it require?
• Can its measurements be corrupted by the platform itself?
• Is its failure independent of GNSS jamming and spoofing?
• How quickly can invalid information be detected and isolated?
• What size, weight, power, compute, antenna, optical or emission burden does it add?

The answer will differ across a high-altitude aircraft, a low-cost uncrewed vehicle, a ship, a ground platform and an indoor robot. “GPS-denied capable” is incomplete unless it is tied to a platform, environment, outage duration, accuracy requirement and integrity requirement.

The Mondren perspective

Mondren is developing magnetic-navigation capability for operations in which GPS is denied or unavailable. The objective is a navigation engine that can produce position, confidence and availability information from physically grounded evidence while making its operating limits explicit.

Magnetic navigation is not presented as a universal replacement for GNSS. It is one complementary source with a distinct set of strengths and constraints. Its value depends on the information present in the field, the measurement environment, the reference data and the platform on which it is installed.

The system is currently in development. We make no public claim here about operational accuracy, platform qualification or deployment readiness. Those claims require evidence from representative hardware, routes, altitudes, vehicle configurations and environmental conditions. A best-case demonstration or a result from another organisation cannot establish the performance of our system.

This boundary is deliberate. Concept, validation criteria and operational purpose can be public. The implementation used to produce the navigation solution remains proprietary.

What credible validation must show

Resilient-navigation claims should be evaluated under controlled denial and against an independent truth reference. A professional test programme should state, at minimum:

• the platform, sensor configuration and relevant installation conditions;
• the route, altitude, speed, manoeuvres and duration of the denied period;
• the provenance, resolution and age of any reference data;
• whether routes and regions were withheld from development;
• the interference and environmental conditions applied;
• horizontal, vertical, velocity and attitude error where relevant;
• error distributions and worst-case behaviour, not only a selected run;
• continuity, availability and recovery after source loss;
• time to detect an unsafe solution, missed detections and false alerts; and
• any operational region in which the source was not sufficiently informative.

These requirements prevent a demonstration from being mistaken for a deployable capability. They also expose the difference between maintaining an estimate and knowing when that estimate remains safe to use.

The commercial implication

Operators do not need an abstract promise of navigation without GPS. They need a defined level of positioning, navigation and timing performance for a specific mission when particular infrastructure is lost or compromised.

That changes procurement and development. Requirements must specify the outage duration, operating region, platform constraints, acceptable error, alerting time and consequence of an undetected false solution. Candidate technologies can then be assessed by the physical evidence they use and by the independence of their failure modes.

The US Department of Transportation's complementary-PNT programme reflects this principle at national-infrastructure scale: resilience is pursued through backup and complementary capabilities, not through the assumption that one technology reproduces GPS in every environment. US DOT complementary PNT demonstration programme

Trust must be engineered

When GPS cannot be trusted, the central question is not simply, “What replaces it?”

The useful questions are more exact: What independent physical evidence remains? What part of the navigation problem does it constrain? Under which conditions is it observable? How does its error develop? And how quickly can the system recognise when the evidence is no longer sufficient?

Inertial, magnetic, terrain, celestial and opportunistic-radio navigation each answer part of that problem. None is universally available, and none should be evaluated without its operating limits.

Resilient navigation begins when loss, deception and uncertainty are treated as design conditions rather than exceptions. The goal is not merely to keep producing a position. It is to produce a position whose trustworthiness is understood.