Lost link is not a boolean

Degraded operation · June 8, 2026 · 6 min read

Most autonomy specifications contain a line that reads something like on loss of link, return to launch. It is a single branch off a single boolean, and the radio layer underneath it does not produce a boolean. It produces a packet loss rate, a jitter distribution, a signal margin, and a set of timestamps that sometimes arrive out of order. Somewhere between that and the behaviour tree, somebody wrote a threshold, and that threshold is now the most safety-significant constant in the vehicle.

Start with what the link actually does. It degrades before it disappears: throughput collapses while reachability survives, so commands still arrive but video does not. It fails asymmetrically: the uplink can hold while the downlink is gone, which means the vehicle is controllable by an operator who can no longer see what they are controlling — a worse state than silence, because silence at least announces itself. And it recovers, often within the same interval over which the timeout was set. A link is not a wire that is cut. It is a channel with a time-varying capacity that occasionally reaches zero.

Model it as a flag and you get mode thrash. The link sits near the threshold, the vehicle declares loss, abandons its task and turns for home, the link returns, the vehicle resumes, and the cycle repeats until the energy budget is gone. Every one of those transitions is a discontinuity in the guidance state: a new trajectory, a new set of assumptions in the planner, possibly a new deconfliction claim on airspace or water it has just told somebody else it was vacating. Hysteresis in the declaration — a longer time to enter the degraded state than to leave it, or the reverse, depending on which error you can afford — is not a polish item. It is the difference between a fallback that helps and a fallback that is itself the failure.

The ladder, not the switch

The useful structure is a ladder rather than a switch, and the ladder is indexed on two things rather than one: how long the vehicle has been acting without fresh direction, and what it still knows.

The first index gives graded behaviour. Seconds without a command mean nothing and should mean nothing; the vehicle continues the manoeuvre it was already committed to, because interrupting a committed manoeuvre is itself a hazard. Tens of seconds mean the operator’s picture is stale and the vehicle should stop acquiring new commitments — finish the leg, do not start the next one. Longer still, and the vehicle should move to a state that is easy for a returning operator to understand and rejoin: a known holding pattern in a known place, not a novel one computed from a stale plan. The specific durations belong to the platform and the task. The graded structure does not; a system with one timeout has decided that all of those situations are the same situation.

The second index is the one that gets skipped. Behaviours should be written in terms of what the vehicle knows, not in terms of what has failed. Fault trees enumerate failures, so specifications written from fault trees enumerate failures too, and the vehicle ends up with a branch per fault and no branch for the combination nobody drew. What the vehicle actually has at runtime is a set of confidences: a position estimate with a covariance, an energy estimate with a margin, a picture of other traffic with an age. A ladder written over those quantities covers combinations that were never enumerated, because the quantities degrade continuously whatever caused them to degrade.

Freshness is not connectivity

The same argument applies one level up, to the data itself. A telemetry frame that arrives four seconds late is not the same fault as a frame that never arrives, and a stack that only checks whether data arrived will treat the two identically — which is to say it will trust the late one. The fix is unglamorous and cheap: timestamp every observation at the point of measurement, carry the timestamp through every hop, and let each consumer apply its own staleness bound. A controller running at high rate and a mission planner running at low rate have genuinely different tolerances for age, and only the consumer knows which is which. Trusting the transport to deliver freshness is how a vehicle ends up manoeuvring smoothly and confidently on a picture of the world that stopped being true before the manoeuvre began.

Satellite navigation deserves exactly the same treatment, and usually gets worse. Denial is not binary either. Jamming raises the noise floor gradually: first the fix degrades, then it drops out, then it comes back — and in between there is a region where a fix is still reported and is quietly wrong. Spoofing is the hostile version of the same property, and its defining characteristic is that the receiver reports high confidence while being incorrect. Any navigation architecture that treats its most confident sensor as its most trustworthy one has no defence against this, because confidence is precisely what the attacker controls.

What does work is consistency checking against estimators that fail differently: inertial propagation, which is accurate over short intervals and drifts over long ones; terrain or visual matching, which is unavailable in some places and excellent in others; clock behaviour, which is hard to fake without producing an inconsistency somewhere else. None of these is a replacement. Collectively they let the vehicle notice that its position solution has become internally inconsistent, which is the only observable an attack of this kind produces.

Then bound the fallback honestly. Dead reckoning does not have an accuracy; it has an accuracy per unit time, and the error grows without limit. So a plan that must survive without satellite fixes needs a stated interval it must survive for, and either an independent fixing opportunity before that interval expires or a behaviour that is safe with a position uncertainty the size of the accumulated drift. Writing “operates in GNSS-denied environments” without that interval is not a capability claim. It is an unfinished sentence.

All of this points at one testing consequence. Most campaigns exercise the ends of the distribution — link present, link absent, satellites available, satellites gone — because those are the states that are easy to create and easy to score. The failures live in the middle: partial loss, high jitter, out-of-order delivery, a fix that is present and wrong. Those states have to be injected deliberately, at the interfaces, with the vehicle in motion and committed to something. A stack that has only been shown to work at the ends of the distribution has been shown to work in the two conditions it will spend the least time in.