GNSS is a convenience, not a foundation

There is a common architecture in commercial drones where GNSS is load-bearing. Position comes from the satellite fix, everything else corrects it, and loss of lock triggers a failsafe — usually a climb and a return, sometimes a hover-and-hope.

That architecture is fine over open ground. It is useless for most of the work people actually want an aircraft to do: fly between two buildings, inspect the underside of a structure, move something across a plant with steel overhead, or operate in an urban canyon where multipath makes the reported position confidently wrong. Confidently wrong is worse than absent.

We inverted the dependency. The primary position solution comes from optical flow: a downward sensor tracks features on the ground frame to frame, and their displacement — scaled by a measured height above surface — is a direct velocity measurement. Integrate it and you have position, computed onboard, with nothing external in the loop.

The honest limitation of any dead-reckoned solution is drift. Errors accumulate. We bound it the only way that works, by fusing every observation available — inertial, barometric, LiDAR structure, visual landmarks, and GNSS when it is there — in one estimator that weights each input by its current confidence rather than by a fixed hierarchy.

That last part matters more than the sensor list. A fixed hierarchy is what produces the confidently-wrong failure: the estimator keeps trusting the satellite fix because the satellite fix is at the top of the tree, even as multipath drags it through a wall. Confidence-weighted fusion lets the solution quietly stop believing a degraded input without anyone declaring an emergency.

The result is that GNSS-denied is not a mode we switch into. There is no switch. It is the ordinary case, and satellite lock is a cross-check that improves the estimate when it happens to be available.