Every UAV navigation conversation starts with GNSS and most end with an accuracy number, centimeters with RTK, meters with a standalone receiver. The contested-spectrum conversation starts with a different question: what happens to the aircraft when the GNSS signal is not degraded but deliberately attacked? The attack surface is real and measurable. Portable jammers rated at 10 W can blanket L1 at ranges of hundreds of meters to kilometers, and GPS spoofing demonstrations have steered drone autopilots off course with nothing more than a $500 transmitter. For defense, public safety, UTM-enabled BVLOS and logistics platforms, GNSS resilience is now a written procurement requirement, not a nice-to-have. This guide covers the five defense layers you can actually specify, antenna, front end, receiver, inertial backup and detection, and the procurement evidence that proves a supplier's claims.
Jamming vs spoofing: the two threat models and their signatures
The two attacks are often discussed together, but they target different vulnerabilities and require different countermeasures. Jamming is a denial-of-service attack: the attacker transmits noise or continuous wave energy on the GNSS bands, raising the noise floor until the receiver can no longer lock the satellite signals. A typical GPS L1 signal arrives at the antenna at roughly −130 dBm; a jammer that lifts the noise floor by 30 dB destroys the carrier-to-noise ratio (C/N0) margin for every receiver in range. Jamming is easy to detect, the C/N0 values collapse across all satellites simultaneously, and the consequence is a loss of position, usually with the aircraft still under manual or inertial control.
Spoofing is a deception attack: the attacker transmits counterfeit satellite signals that the receiver locks onto and tracks as genuine. The receiver then computes a position chosen by the attacker, a few meters offset to push a survey drone off line, or a few kilometers offset to redirect a delivery aircraft. The dangerous part of spoofing is that the receiver reports a healthy fix: C/N0 looks normal, the constellation looks normal, and the navigation output is confidently wrong. Detection requires receiver-internal checks. Clock jump monitoring, ephemeris validation, C/N0 anomaly signatures, and cross-checks against inertial and other sensors.
The two threats also differ in cost and legality. Jammers are cheap, widely available and banned in most jurisdictions, but enforcement is rare and incidents are common. Spoofing requires more engineering but the hardware is commodity. Both attacks are now regular enough that the UAV defense and security components guide treats GNSS resilience as part of the baseline contested-spectrum stack, and the UTM and detect-and-avoid integration guide covers how degraded navigation feeds into the BVLOS safety case.
Concept illustration
The antenna layer: CRPA and the difference between gain and pattern control
The first defense is at the antenna, before the RF energy reaches the receiver. A conventional GNSS antenna is a single patch element with a hemispherical gain pattern, it receives the sky and the jammer equally. A CRPA (controlled reception pattern antenna) is an array of elements whose outputs are weighted so that the antenna pattern places nulls in the direction of interference sources while maintaining gain toward the satellites. The practical specification numbers that matter in procurement:
Number of elements. A 4-element CRPA can place one to three nulls; a 7-element array (the common defense-grade configuration) handles more simultaneous interferers and produces deeper, more stable nulls. More elements mean more weight, more power and more cost. A 7-element array with its electronics adds roughly 150–400 g and 2–5 W to the aircraft, which is why the element count must be matched to the threat model, not maximized.
Null depth and width. Defense-grade CRPAs typically specify 20–30 dB of null depth with a beamwidth of 20–40 degrees per null. A 25 dB null reduces a jammer's effective power by a factor of 300 at the receiver input, the difference between losing lock and maintaining a degraded fix.
Anti-jam gain and the J/N budget. The antenna system's anti-jam performance is usually quoted as the jamming-to-noise ratio (J/N) at which the receiver still maintains lock, or as the jammer power density the system survives. A useful procurement benchmark: a modern anti-jam antenna plus receiver combination should maintain position across a 60–80 dBJ J/N budget against continuous wave and narrowband jammers, versus roughly 30–40 dBJ for an unprotected receiver with a good front end.
The GNSS module selection guide covers the receiver-side choices, constellation support, multi-band architecture and RTK accuracy, while this article focuses on the resilience layer that sits in front of the receiver. The two specifications must be read together: an RTK-grade receiver behind a poor antenna is still jam-vulnerable, and an anti-jam antenna feeding a single-band receiver leaves the L2/L5 bands unprotected.
RF front-end hardening: filtering, LNA saturation and the interference budget
Between the antenna and the receiver's correlators sits the RF front end, the filters, low-noise amplifiers (LNAs), mixers and the ADC that conditions the signal. This is the layer where a cheap design fails first under attack. The failure mode is desensitization: a strong in-band jammer saturates the LNA or the ADC, and the receiver's noise figure collapses even if the jammer is later filtered. The procurement-relevant defenses:
Out-of-band filtering. SAW filters and dielectric resonator filters reject the strong out-of-band transmitters that share the RF environment, cellular bands, 2.4 GHz ISM, FM broadcast, before they reach the LNA. The spec is the filter rejection (typically 40–60 dB at 50–100 MHz offset from the GNSS band edge) and the insertion loss in-band (below 2 dB).
LNA linearity and headroom. A hardened front end uses LNAs with high IP3 (third-order intercept) and enough dynamic range to survive moderate jammers without saturation. The measurable outcome is the 1 dB compression point and the ADC headroom: typically 14–20 dB of margin above the expected signal-plus-noise floor, which lets the receiver keep processing through interference that a marginal design would clip.
Jamming-to-noise budget in the spec. The most useful single procurement number is the receiver's stated J/N tolerance: the ratio of jammer power to noise power at the antenna port at which the receiver maintains a defined level of performance (e.g., position accuracy within 10 m, or time-to-first-fix under 60 s). Suppliers who quote this number have designed for it; suppliers who quote only sensitivity have not.
Front-end hardening interacts with the rest of the avionics environment, the EMC/EMI design and compliance guide covers how the GNSS front end coexists with the ESC switching noise, the video transmitters and the telemetry radios on the same airframe, which is where most real-world desensitization actually originates.
Receiver-internal defenses: RAIM, multi-constellation and spoofing detection
The receiver itself carries the second and third lines of defense. The first is RAIM (receiver autonomous integrity monitoring) with fault detection and exclusion (FDE): the receiver continuously checks the consistency of the pseudorange measurements and can detect and exclude a failing satellite. RAIM is a baseline requirement for aviation-grade navigation and catches the accidental failures, a failed satellite, a bad ephemeris, but it is not a spoofing defense by itself, because a sophisticated spoofer makes all the measurements consistent with the false position. RAIM becomes useful against spoofing when the attacker makes errors: the transition from genuine to spoofed signals usually produces measurable discontinuities.
The second is multi-constellation, multi-band reception. A receiver that tracks GPS, GLONASS, Galileo and BeiDou across L1/L2/L5/E1/E5 bands is dramatically harder to jam or spoof completely, because the attacker must cover more spectrum with more power and more precision. A single-band L1-only receiver can be defeated by one narrowband jammer; a dual-band receiver forces the attacker to jam two bands; a tri-band receiver with four constellations forces the attacker to replicate the entire multi-constellation signal environment coherently. A problem that is orders of magnitude harder than replaying one band.
The third is spoofing detection logic, which lives in the receiver firmware and reports a navigation integrity flag rather than silently continuing. The detection metrics that appear in real products:
- Carrier-to-noise anomalies. All satellites suddenly showing identical or suspiciously flat C/N0, a signature of a single spoofer broadcasting from one location, triggers a warning.
- Clock and NCO jumps. A sudden receiver clock jump or a discontinuity in the numerically controlled oscillator output indicates a handover from genuine to spoofed signals.
- Ephemeris and almanac validation. Comparing broadcast ephemeris against known constellation data; a mismatch flags the source as suspect.
- Cross-band and cross-constellation consistency. The position computed from L1 must agree with the position from L5; disagreement indicates band-specific interference or spoofing.
- Inertial cross-check. The GNSS position compared against the integrated inertial solution. A spoof that drags the position away while the accelerometers and gyros see no corresponding motion is detectable within seconds.
The receiver output that matters for the rest of the aircraft is not just the position but the integrity status: a receiver that reports "degraded. Inertial hold" instead of a confidently wrong position is what lets the flight controller execute a safe fallback. The sensor fusion and redundant navigation guide covers how the flight controller arbitrates between GNSS, IMU, barometer, magnetometer and vision inputs when the GNSS integrity flag drops.
Concept illustration
The IMU fallback: how long the aircraft can navigate without GNSS
Every anti-jam specification eventually meets the same arithmetic: the antenna and front end extend how much jamming the receiver survives, but a determined attacker with enough power will eventually win. The platform-level answer is the navigation fallback . The sensors that keep the aircraft safe when GNSS is gone. The quality of the fallback is defined by the inertial sensor grade and the fusion architecture:
Consumer MEMS IMUs (the class in most commercial flight controllers) drift at rates of several degrees per minute and tens of meters of position error within seconds to a minute of GNSS loss. They are fine for attitude hold, not for navigation. Industrial/tactical MEMS IMUs (bias stability in the single-digit deg/hr range) hold a usable position for minutes. Navigation-grade sensors (fiber-optic or high-end ring-laser gyros, 0.01–0.1 deg/hr) can navigate for tens of minutes, but they cost more than most UAVs and are not a realistic component for the commercial segment.
The realistic procurement position for a commercial or public-safety platform is: a tactical-grade MEMS IMU plus the fusion of whatever auxiliary measurements exist, the barometer for altitude, the magnetometer for heading, optical flow or visual odometry for velocity, and UWB or range measurements where a ground anchor network exists. The sensor fusion and redundant navigation guide details the arbitration and the Remote ID and BVLOS components guide covers the regulatory side. Most BVLOS waivers now require the operator to demonstrate a defined degraded-navigation response, and the IMU grade is the first number the authority asks for.
The specification to write is not "has an IMU" but a degraded-navigation time: "the aircraft shall maintain a position error of less than 50 m for 5 minutes after total GNSS loss, using inertial and onboard sensors alone." That single sentence forces the supplier to make the IMU grade, the fusion algorithm and the antenna resilience choices explicit, and it is testable in a jam-box trial.
Concept illustration
Detection and mitigation: the strategy that turns resilience into procedure
The defense layers above make the aircraft harder to attack; the detection layer decides what the aircraft does when the attack happens. A complete GNSS resilience strategy has three phases, and the component specification should name all three:
Detect. The receiver's integrity flags (C/N0 collapse, clock jump, cross-constellation inconsistency) plus an optional dedicated jamming detector, a small spectrum-monitoring front end that measures the noise floor in the GNSS bands and reports a jamming-to-noise estimate to the flight controller. The output is an event: "GNSS under attack, integrity invalid."
Mitigate. The flight controller switches the navigation source. From GNSS-aided to inertial/vision-aided navigation, holds altitude and heading, and either continues the mission within the degraded-navigation envelope or executes a pre-programmed return-to-launch. The public safety components guide covers the operational side of this decision: for a search-and-rescue platform the procedure may be "hold position and loiter," while for a delivery platform it is usually "return to launch immediately."
Report. The aircraft records the attack event, the timing, the C/N0 profile, the detected jammer direction if the CRPA provides it, and transmits the log with the telemetry. For defense and law-enforcement operators this record is often as valuable as the aircraft itself, and it is the evidence that justifies the anti-jam budget on the next program.
The mitigation behavior is specified at the flight controller level, and the ArduPilot vs PX4 guide is a useful reference for how each open-source stack exposes GNSS integrity to the mission logic. Both support EKF-based GNSS/inertial fusion and both expose the innovation/health parameters that a jamming-detection watch can monitor.
Concept illustration
Testing anti-jam performance: the jam-box trial and what to measure
Anti-jam performance is one of the most over-claimed specifications in UAV components, because it is hard to test and easy to hand-wave. The procurement team should not accept a datasheet line; it should specify a test. The standard approach is a jam-box trial: the aircraft or the receiver under test is placed in an RF-shielded chamber (or an open-field range with controlled emissions), a signal generator injects jamming at defined power levels and frequencies, and the receiver's behavior is recorded. The measurement points that belong in the acceptance test:
- J/N at loss of lock. The jamming-to-noise ratio at which the receiver loses position, the headline anti-jam number.
- Time to re-acquire. How quickly the receiver re-locks after the jammer is removed. A receiver that takes 5 minutes to re-acquire is operationally useless even if it survives a strong jammer.
- Spoofing detection latency. How long the receiver takes to flag a spoofing attack. The target is under 10 seconds for a platform that will maneuver.
- Degraded-navigation accuracy. The position error growth over the specified GNSS-denied period, measured against a truth reference.
- Multi-threat scenarios. Continuous wave, swept, chirp and pulsed jamming across the band plan, plus combined jamming-plus-spoofing, the realistic attack.
The UAV propulsion testing and validation guide covers the general testing framework for UAV components, the same discipline of specified inputs, recorded outputs and pass criteria applies to RF resilience. A supplier that offers a documented jam-box report for its GNSS stack is a different procurement category from a supplier that offers a brochure.
The RFQ checklist: 12 line items for specifying GNSS resilience
The following line items translate the defense layers into an RFQ-ready specification. Each item names the evidence the supplier should provide, and the checklist works for a complete GNSS stack, a standalone anti-jam antenna or a receiver upgrade.
1. Threat model statement. The RFQ states the design basis: the jammer power levels, the frequency bands and the spoofing sophistication the platform must survive. Verification: the supplier's threat-model response and the architecture that follows from it.
2. Anti-jam antenna architecture. Element count, null depth (≥20 dB recommended for the defense tier), null steering method (analog vs digital beamforming) and the mass/power budget. Verification: the antenna datasheet and the pattern measurements.
3. J/N tolerance. The receiver shall maintain position at a stated J/N (e.g., 70 dBJ against narrowband continuous-wave jamming). Verification: the jam-box test report.
4. Front-end headroom. LNA IP3, ADC dynamic range and out-of-band filter rejection specified numerically. Verification: the front-end test data.
5. Constellation and band plan. The receiver shall track the constellations and bands required for the operating region, minimum dual-band, quad-constellation for defense and BVLOS tiers. Verification: the receiver's tracking specification and a recorded skyplot.
6. RAIM/FDE. The receiver shall implement RAIM with fault detection and exclusion, with the protection-level output exposed. Verification: the receiver interface document and a test log showing an excluded satellite.
7. Spoofing detection. The receiver shall detect spoofing within 10 seconds and raise a navigation integrity flag. Verification: the spoofing-detection test record with the detection latency.
8. Integrity output. The receiver shall expose a machine-readable integrity status (not just a position) to the flight controller. Verification: the interface control document and a signal trace showing the flag transition under attack.
9. Inertial fallback. The aircraft shall maintain a position error below 50 m for 5 minutes after total GNSS loss. Verification: the GNSS-denied trial record against a truth reference.
10. Re-acquisition. Time to re-acquire position shall be under 60 seconds after jammer removal. Verification: the jam-box re-acquisition measurement.
11. Environmental rating. The antenna and receiver shall meet the platform's operating temperature, vibration and IP requirements, and the CRPA mounting shall not interfere with the airframe's other antennas. Verification: the environmental test reports and the antenna placement study.
12. Test evidence and traceability. The supplier shall provide the jam-box test methodology, the recorded results for the delivered serial numbers and the firmware version control for the receiver. Verification: the delivery documentation package.
The component selection context for the rest of the navigation and communication stack is covered in the GNSS module selection guide and the UAV RF communication systems guide . The antenna placement and the RF coexistence decisions are made together, not separately.
What resilience costs when it is specified rather than hoped for
GNSS resilience is the one subsystem where the price spread between two platforms that both claim jamming resistance is a factor of eight. The reason is that the claim covers four different things: antenna pattern control, front-end headroom, receiver integrity logic and the inertial fallback that carries the aircraft through the gap. The table prices the four layers separately, because a quotation that bundles them at a single number cannot be compared with another quotation.
| Layer | What is actually bought | Typical band (USD) | Evidence that separates real from claimed |
|---|---|---|---|
| Single-antenna receiver with no hardening | Patch or helix antenna plus a multi-constellation receiver, no interference defence | 150 to 600 | Receiver datasheet only; no jam-box data exists for this class |
| Front-end hardening | Filtered LNA chain, higher IP3, out-of-band rejection at the GNSS bands, protected power rail | 400 to 1,800 | Measured J/N at 1 dB compression, out-of-band rejection curve |
| Controlled-reception antenna (CRPA) | Multi-element array with analog null steering, ground plane and mounting kit | 4,000 to 18,000 | Null depth in dB at the specified interference direction, with the array pattern measured on the aircraft |
| Digital beamforming front end | Per-element digitisation and digital null steering, several receivers behind one array | 15,000 to 60,000 | Adaptive null depth under two simultaneous interferers |
| Receiver integrity (RAIM, spoofing detection) | Fault detection and exclusion, integrity flag exposed to the flight controller, spoofing detector with stated latency | 0 to 3,000 above base receiver | Signal trace showing the integrity flag transition during a spoofing attempt |
| Inertial fallback qualification | GNSS-denied flight trial against a truth reference, sensor bias calibration, filter retune | 3,000 to 12,000 per platform | Position-error-versus-time record for the stated holdover window |
| Jam-box campaign | Chamber or range time, interference profiles, re-acquisition measurement | 2,500 to 9,000 per campaign | Report with recorded results per delivered serial number |
The pattern to notice is that the two cheapest rows are the ones that most often decide whether a platform survives an incident, and both are qualification work rather than hardware. A hardened antenna on a receiver whose integrity flag is never wired to the flight controller is an expensive ornament: the aircraft still flies on a spoofed position because nothing in the control loop was told the position is suspect. Conversely a modest receiver with an honest integrity channel and a calibrated inertial fallback gives the operator something to act on. Budget the qualification rows before the array, not after.
Who is accountable when the position is wrong
Interference events end in an argument more often than in a crash report. The split below is the one we write into component supply engagements, where the customer integrates the avionics. It exists to make the answer to "who should have caught this" obvious before the first flight rather than after it.
| Scope | GNSS supplier owns | Integrator owns |
|---|---|---|
| Stated threat envelope | Publishes the interference levels the unit was tested against, in dB, by band | Declares the threat model the platform is actually deployed against |
| Antenna pattern on the aircraft | Supplies the isolated array pattern and the mounting constraints | Verifies the installed pattern after mounting; an array beside a carbon boom or a video transmitter is a different array |
| Integrity output | Exposes a machine-readable integrity flag and documents the latency to assert it | Wires the flag into the flight controller and defines the resulting failsafe action |
| Filter and estimator tuning | Documents default estimator parameters and their limits | Retunes against the actual IMU and vibration environment; defaults are a starting point, not an answer |
| Inertial fallback claim | States the holdover performance of the receiver alone | Qualifies system-level holdover including IMU drift, filter behaviour and the flight envelope |
| Firmware change control | Notifies of firmware changes to the integrity or spoofing-detection logic | Re-runs the spoofing and denial trials after every firmware change; no notification, no re-flash |
| Incident forensics | Provides the receiver log and firmware version on request | Preserves the flight log and the receiver log together, since neither alone reconstructs the event |
The firmware clause is the one that gets tested in practice. Spoofing detection lives in the receiver's own signal processing, so a firmware update can change detection latency, false-alarm behaviour or the J/N at which the receiver declares an alarm. Any of those changes silently invalidates the trial evidence the platform was signed off against. Treating a receiver firmware change as a design change, with the spoofing and denial trials repeated, is the only version of this split that holds up when a customer asks for the evidence file.
Two reference builds and what resilience meant on each
Neither of the platforms below was built as a counter-UAS exercise, and that is the point: interference tolerance showed up as a requirement in both cases because of where the aircraft operates, not because someone asked for a hardened receiver as a feature.
Heavy-lift agricultural X8, 25 kg MTOW. The aircraft works at 4 to 6 m above crop, in repeated short sorties from a field-adjacent staging point, and it depends on RTK against a local base station for the spray pass. Two things make GNSS resilience a flight-safety matter here rather than a navigation nicety: the working height leaves no recovery time if the position jumps, and the 30 L payload makes an uncommanded descent expensive in a way that a survey aircraft's is not. The published architecture uses a local RTK base rather than NTRIP corrections precisely because cellular coverage at field edges is unreliable, and terrain following is handled by a downward lidar that is independent of GNSS. That independence is the design answer to jamming: the aircraft's altitude reference never passes through the interference path. See the heavy-lift agriculture reference build for the full stack.
Long-endurance VTOL mapping platform, 5 kg payload, 120 minutes. A VTOL fixed-wing flying corridor surveys at 100 to 120 m above ground level, 16 to 18 m/s cruise, on an 888 Wh pack drawing about 85 W in cruise. The exposure here is duration rather than proximity: two hours aloft over a corridor means the probability of passing through an interference event is a function of time, and a transition phase at low altitude is the worst moment for a position fault. The published design pairs the GNSS receiver with an inertial and air-data layer so that a corridor can be completed on dead reckoning if the integrity flag drops, and the autopilot's transition logic is written to complete the transition before evaluating the flag rather than aborting it. See the LiDAR mapping platform reference build for the energy budget and the antenna arrangement.
In both builds the receiver is a catalogue part. The resilience came from three decisions that are not in any receiver datasheet: an independent altitude or attitude reference, a defined failsafe action wired to the integrity flag, and a trial that produced evidence against a truth reference. If the platform has not yet been frozen, the GNSS-denied navigation guide covers the fallback design in more depth, and the sensor fusion guide covers how much of the holdover performance is decided by the estimator rather than the sensors.
Acceptance evidence: what a jam-box report has to contain
A jam-box report that states "passed at 70 dBJ" without the test conditions is not evidence. The matrix below is the acceptance structure we ask suppliers to populate, and the right-hand column is the part that is most often missing. The rows marked as not samplable cannot be converted into a pass or fail statement on a sample unit, and suppliers routinely try.
| Row | Acceptance criterion | Recorded form | Samplable per unit |
|---|---|---|---|
| Static J/N threshold | Position maintained at the specified J/N for the specified duration | Time series with the interference profile overlaid | Yes, on a sample basis |
| Null depth, installed | Stated dB rejection in the specified interference direction | Pattern measurement on the aircraft, not on the bench | No, this is a design-level property |
| Spoofing detection latency | Integrity flag asserted within the stated seconds of a position pull-off | Signal trace of the flag transition with timestamps | Yes, per firmware build |
| False-alarm rate | Integrity flag does not assert during nominal flight over a stated number of hours | Flight log review, not a bench test | No, this is a fleet-population property |
| Holdover position error | Error below the stated metres for the stated minutes after total denial | Truth-referenced trajectory comparison | No, it depends on the aircraft's IMU and filter |
| Re-acquisition time | Position re-acquired within the stated seconds of jammer removal | Timed record with the removal event marked | Yes, on a sample basis |
| Firmware traceability | The delivered serial numbers ran the firmware build whose test record is supplied | Version string read back from each unit | Yes, every unit |
The unsamplable rows are where the risk sits, and the honest way to handle them is to accept them as qualified design properties and test them once, thoroughly, on a representative aircraft, then control the firmware so the qualification stays valid. Trying to buy them as per-unit pass or fail statements produces paperwork rather than resilience, and the paperwork rarely survives contact with a real interference event.
If the platform is still at subsystem selection, the RF spectrum management guide covers the frequency plan that determines whether the GNSS front end and the video downlink interfere with each other in the first place, and the RFQ component specification guide shows how to fold these criteria into a single specification rather than an appendix. When the resilience layer needs to be specified and integrated rather than sourced as a part, our communications and RF capability page covers the RF front-end work we do, and you can send the threat model through the quotation request form.
Explore custom engineering Back to Blog
Both the RF and antenna hardware and the navigation avionics are built in-house at EMS Drone, which means the interfaces between them are specified by the same team. Review the hardware we manufacture if you are scoping a build, or read how we handle the adjacent subsystem.
Continue Reading
UAV GNSS Module Selection Guide
The receiver-side decisions, constellation support, multi-band architecture, RTK vs PPK accuracy tiers, that the resilience layer protects.
UAV Sensor Fusion and Redundant Navigation
How the flight controller arbitrates between GNSS, IMU, barometer and vision when the GNSS integrity flag drops.
UAV Defense & Security Components
The contested-spectrum stack, encrypted links, anti-jam navigation and ruggedization, as a single procurement picture.
UTM and Detect-and-Avoid Integration
How degraded navigation feeds into the BVLOS safety case and the UTM compliance architecture.
UAV Public Safety Components
The operational mitigation procedures, loiter, return-to-launch, report, that the detection layer triggers.