One fix, two witnesses: why radar and thermal must agree

Every navigation system has to answer one question, over and over: where am I now? Most answer it by asking the sky. SenzFusion answers it by looking at the ground — twice, with two different sensors — and only believes the answer when both agree.

One continuous estimate

The starting point is not a fix at all. It is a prediction. The IMU predicts position, velocity and orientation 1,000 times a second, throughout the flight and including the time between fixes. Barometer and airspeed feed the same fusion core.

Inertial prediction is fast and self-contained, but it is not perfect: small errors accumulate, and the estimate slowly drifts away from the truth. The job of everything else in the pipeline is to notice that drift and correct it — without ever relying on satellite signals to do so.

The radar witness

The first witness is radar. A radar altimeter measures ground heights along the track, building a terrain profile beneath the aircraft. Imaging radar adds a 2D ground patch.

That profile is then matched against the stored terrain map. Where the measured shape of the ground fits the map, the match tells the system where the aircraft must be — and how far the inertial estimate has drifted. This is the radar map match, and its role in the pipeline is correction.

Terrain matching is powerful because the ground stays where it is, out of reach of a distant spoofer. But a height profile on its own can be ambiguous: two stretches of similar terrain can produce similar profiles.

The thermal witness

The second witness is thermal. A thermal camera captures a picture of the terrain below, and the thermal scene check compares it against a stored reference scene prepared before flight. RECONN.EARTH converts reference imagery to the thermal domain for exactly this check.

Its role in the pipeline is verification. Where the radar asks "does the shape of the ground fit the map here?", the thermal check asks "does the ground look the way the reference says it should here?" — a different physical measurement of the same place.

A position fix is accepted only when the radar map match and the thermal scene check agree.

Why agreement, not either

The rule is strict by design. The estimate is updated along-track and cross-track only when both matches agree. If they disagree, the IMU keeps carrying the estimate until they do.

Requiring two independent witnesses trades a little availability for a lot of confidence. Two sensors that measure different physical properties are unlikely to be fooled in the same way at the same moment. A height profile that happens to fit the wrong valley will not usually also produce a matching thermal picture of that valley.

GNSS has a different job: it is compared against the navigation output to detect a contested environment. When the two agree, the sky is clean; when they disagree, the payload has spotted jamming or spoofing.

The corrected estimate then leaves the payload as a course correction to the host autopilot, sent over a signed serial link. The autopilot keeps flight control throughout; SenzFusion tells it where the aircraft is, not how to fly.

Rehearsing an outage

The ShoalOS Simulator shows the idea end to end. It flies an authored waypoint route through the Engadin valley in Switzerland, with UAV camera, imaging IR, radar and navigation-sensor panels running alongside the 3D scene and an event log of each phase and GNSS state.

1. Valley transit — follow the authored waypoints along the lake valley with GNSS available.
2. Degraded environment — rehearse the GNSS outage while the route continues.
3. Mountain passage — cross mountain terrain along the planned route.
4. Observation orbit — GNSS recovered; orbit the observation area.

It is important to be precise about what that is: a scripted animation from an authored route, with the UAV enlarged for visibility. The sensor panels are simulated or illustrative, not flight results. It is a scripted demonstration, not a flight result — a way to see how the pieces relate, not evidence of performance.

Follow the whole pipeline step by step on How it navigates, or see the simulation phases.