INNOVATION INSIGHTS with Richard Langley

IT’S A HOSTILE (ELECTRONIC) WORLD OUT THERE, PEOPLE. Our wired and radio-based communication systems are constantly under attack from evil doers. We are all familiar with computer viruses and worms hiding in malicious software or malware distributed over the Internet or by infected USB flash drives. Trojan horses are particularly insidious. These are programs concealing harmful code that can lead to many undesirable effects such as deleting a user’s files or installing additional harmful software. Such programs pass themselves off as benign, just like the “gift” the Greeks delivered to the Trojans as reported in Virgil’s Aeneid. This was a very early example of spoofing. Spoofing of Internet Protocol (IP) datagrams is particularly prevalent. They contain forged source IP addresses with the purpose of concealing the identity of the sender or impersonating another computing system.

To spoof someone or something is to deceive or hoax, passing off a deliberately fabricated falsehood made to masquerade as truth. The word “spoof” was introduced by the English stage comedian Arthur Roberts in the late 19th century. He invented a game of that name, which involved trickery and nonsense. Now, the most common use of the word is as a synonym for parody or satirize — rather benign actions. But it is the malicious use of spoofing that concerns users of electronic communications.

And it is not just wired communications that are susceptible to spoofing. Communications and other services using radio waves are, in principle, also spoofable. One of the first uses of radio-signal spoofing was in World War I when British naval shore stations sent transmissions using German ship call signs. In World War II, spoofing became an established military tactic and was extended to radar and navigation signals. For example, German bomber aircraft navigated using radio signals transmitted from ground stations in occupied Europe, which the British spoofed by transmitting similar signals on the same frequencies. They coined the term “meaconing” for the interception and rebroadcast of navigation signals (meacon = m(islead)+(b)eacon).

Fast forward to today. GPS and other GNSS are also susceptible to meaconing. From the outset, the GPS P code, intended for use by military and other so-called authorized users, was designed to be encrypted to prevent straightforward spoofing. The anti-spoofing is implemented using a secret “W” encryption code, resulting in the P(Y) code. The C/A code and the newer L2C and L5 codes do not have such protection; nor, for the most part, do the civil codes of other GNSS. But, it turns out, even the P(Y) code is not fully protected from sophisticated meaconing attacks.

So, is there anything that military or civil GNSS users can do, then, to guard against their receivers being spoofed by sophisticated false signals? In this month’s column, we take a look at a novel, yet relatively easily implemented technique that enables users to detect and sequester spoofed signals. It just might help make it a safer world for GNSS positioning, navigation, and timing.

“Innovation” is a regular feature that discusses advances in GPS technology andits applications as well as the fundamentals of GPS positioning. The column is coordinated by Richard Langley of the Department of Geodesy and Geomatics Engineering, University of New Brunswick. He welcomes comments and topic ideas. To contact him, see the “Contributing Editors” section on page 4.

The radionavigation community has known about the dangers of GNSS spoofing for a long time, as highlighted in the 2001 Volpe Report (see Further Reading). Traditional receiver autonomous integrity monitoring (RAIM) had been considered a good spoofing defense. It assumes a dumb spoofer whose false signal produces a random pseudorange and large navigation solution residuals. The large errors are easy to detect, and given enough authentic signals, the spoofed signal(s) can be identified and ignored.

That spoofing model became obsolete at The Institute of Navigation’s GNSS 2008 meeting. Dr. Todd Humphreys introduced a new receiver/spoofer that could simultaneously spoof all signals in a self-consistent way undetectable to standard RAIM techniques. Furthermore, it could use its GNSS reception capabilities and its known geometry relative to the victim to overlay the false signals initially on top of the true ones. Slowly it could capture the receiver tracking loops by raising the spoofer power to be slightly larger than that of the true signals, and then it could drag the victim receiver off to false, but believable, estimates of its position, time, or both.

Two of the authors of this article contributed to Humphreys’ initial developments. There was no intention to help bad actors deceive GNSS user equipment (UE). Rather, our goal was to field a formidable “Red Team” as part of a “Red Team/Blue Team” (foe/friend) strategy for developing advanced “Blue Team” spoofing defenses.

This seemed like a fun academic game until mid-December 2011, when news broke that the Iranians had captured a highly classified Central Intelligence Agency drone, a stealth Lockheed Martin RQ-170 Sentinel, purportedly by spoofing its GPS equipment. Given our work in spoofing and detection, this event caused quite a stir in our Cornell University research group, in Humphreys’ University of Texas at Austin group, and in other places. The editor of this column even got involved in our extensive e-mail correspondence. Two key questions were: Wouldn’t a classified spy drone be equipped with a Selective Availability Anti-Spoofing Module (SAASM) receiver and, therefore, not be spoofable? Isn’t it difficult to knit together a whole sequence of false GPS position fixes that will guide a drone to land in a wrong location? These issues, when coupled with apparent inconsistencies in the Iranians’ story and visible damage to the drone, led us to discount the spoofing claim.

Developing a New Spoofing Defense

My views about the Iranian claims changed abruptly in mid-April 2012. Todd Humphreys phoned me about an upcoming test of GPS jammers, slated for June 2012 at White Sands Missile Range (WSMR), New Mexico. The Department of Homeland Security (DHS) had already spent months arranging these tests, but Todd revealed something new in that call: He had convinced the DHS to include a spoofing test that would use his latest “Red Team” device. The goal would be to induce a small GPS-guided unmanned aerial vehicle (UAV), in this case a helicopter, to land when it was trying to hover. “Wow”, I thought. “This will be a mini-replication of what the Iranians claimed to have done to our spy drone, and I’m sure that Todd will pull it off. I want to be there and see it.” Cornell already had plans to attend to test jammer tracking and geolocation, but we would have to come a day early to see the spoofing “fun” — if we could get permission from U.S. Air Force 746th Test Squadron personnel at White Sands.

The implications of the UAV test bounced around in my head that evening and the next morning on my seven-mile bike commute to work. During that ride, I thought of a scenario in which the Iranians might have mounted a meaconing attack against a SAASM-equipped drone. That is, they might possibly have received and re-broadcast the wide-band P(Y) code in a clever way that could have nudged the drone off course and into a relatively soft landing on Iranian territory.

In almost the next moment, I conceived a defense against such an attack. It involves small antenna motions at a high frequency, the measurement of corresponding carrier-phase oscillations, and the evaluation of whether the motions and phase oscillations are more consistent with spoofed signals or true signals. This approach would yield a good defense for civilian and military receivers against both spoofing and meaconing attacks. The remainder of this article describes this defense and our efforts to develop and test it.

It is one thing to conceive an idea, maybe a good idea. It is quite another thing to bring it to fruition. This idea seemed good enough and important enough to “birth” the conception. The needed follow-up efforts included two parts, one theoretical and the other experimental.

The theoretical work involved the development of signal models, hypothesis tests, analyses, and software. It culminated in analysis and truth-model simulation results, which showed that the system could be very practical, using only centimeters of motion and a fraction of a second of data to reliably differentiate between spoofing attacks and normal GNSS operation.

Theories and analyses can contain fundamental errors, or overlooked real-world effects can swamp the main theoretical effect. Therefore, an experimental prototype was quickly conceived, developed, and tested. It consisted of a very simple antenna-motion system, an RF data-recording device, and after-the-fact signal processing. The signal processing used Matlab to perform the spoofing detection calculations after using a C-language software radio to perform standard GPS acquisition and tracking.

Tests of the non-spoofed case could be conducted anywhere outdoors. Our initial tests occurred on a Cornell rooftop in Ithaca, New York. Tests of the spoofed case are harder. One cannot transmit live spoofing signals except with special permission at special times and in special places, for example, at WSMR in the upcoming June tests. Fortunately, the important geometric properties of spoofed signals can be simulated by using GPS signal reception at an outdoor antenna and re-radiation in an anechoic chamber from a single antenna. Such a system was made available to us by the NASA facility at Wallops Island, Virginia, and our simulated spoofed-case testing occurred in late April of last year. All of our data were processed before mid-May, and they provided experimental confirmation of our system’s efficacy. The final results were available exactly three busy weeks after the initial conception.

Although we were convinced about our new system, we felt that the wider GNSS community would like to see successful tests against live-signal attacks by a real spoofer. Therefore, we wanted very much to bring our system to WSMR for the June 2012 spoofing attack on the drone. We could set up our system near the drone so that it would be subject to the same malicious signals, but without the need to mount our clumsy prototype on a compact UAV helicopter. We were concerned, however, about the possibility of revealing our technology before we had been able to apply for patent protection. After some hesitation and discussions with our licensing and technology experts, we decided to bring our system to the WSMR test, but with a physical cover to keep it secret. The cover consisted of a large cardboard box, large enough to accommodate the needed antenna motions. The WSMR data were successfully collected using this method. Post-processing of the data demonstrated very reliable differentiation between spoofed and non-spoofed cases under live-signal conditions, as will be described in subsequent sections of this article.

System Architecture and Prototype

The components and geometry of one possible version of this system are shown in FIGURE 1. The figure shows three of the GNSS satellites whose signals would be tracked in the non-spoofed case: satellites j-1, j, and j+1. It also shows the potential location of a spoofer that could send false versions of the signals from these same satellites. The spoofer has a single transmission antenna. Satellites j-1, j, and j+1 are visible to the receiver antenna, but the spoofer could “hijack” the receiver’s tracking loops for these signals so that only the false spoofed versions of these signals would be tracked by the receiver.

Figure 1. Spoofing detection antenna articulation system geometry relative to base mount, GNSS satellites, and potential spoofer.

The receiver antenna mount enables its phase center to be moved with respect to the mounting base. In Figure 1, this motion system is depicted as an open kinematic chain consisting of three links with ball joints. This is just one example of how a system can be configured to allow antenna motion. Spoofing detection can work well with just one translational degree of freedom, such as a piston-like up-and-down motion that could be provided by a solenoid operating along the z_a articulation axis. It would be wise to cover the motion system with an optically opaque radome, if possible, to prevent a spoofer from defeating this system by sensing the high-frequency antenna motions and spoofing their effects on carrier phase.

Suppose that the antenna articulation time history in its local body-fixed (x_a, y_a, z_a) coordinate system is b_a(t). Then the received carrier phases are sensitive to the projections of this motion onto the line-of-sight (LOS) directions of the received signals. These projections are along  , , and  in the non-spoofed case, with   being the known unit direction vector from the jth GNSS satellite to the nominal antenna location. In the spoofed case, the projections are all along , regardless of which signal is being spoofed, with  being the unknown unit direction vector from the spoofer to the victim antenna. Thus, there will be differences between the carrier-phase responses of the different satellites in the non-spoofed case, but these differences will vanish in the spoofed case. This distinction lies at the heart of the new spoofing detection method. Given that a good GNSS receiver can easily distinguish quarter-cycle carrier-phase variations, it is expected that this system will be able to detect spoofing using antenna motions as small as 4.8 centimeters, that is, a quarter wavelength of the GPS L1 signal.

The UE receiver and spoofing detection block in Figure 1 consists of a standard GNSS receiver, a means of inputting the antenna motion sensor data, and additional signal processing downstream of the standard GNSS receiver operations. The latter algorithms use as inputs the beat carrier-phase measurements from a standard phase-locked loop (PLL).

It may be necessary to articulate the antenna at a frequency nearly equal to the bandwidth of the PLL (say, at 1 Hz or higher). In this case, special post-processing calculations might be required to reconstruct the high-frequency phase variations accurately before they can be used to detect spoofing. The needed post-processing uses the in-phase and quadrature accumulations of a phase discriminator to reconstruct the noisy phase differences between the true signal and the PLL numerically controlled oscillator (NCO) signal. These differences are added to the NCO phases to yield the full high-bandwidth variations.

We implemented the first prototype of this system with one-dimensional antenna motion by mounting its patch antenna on a cantilevered beam. It is shown in FIGURE 2. Motion is initiated by pulling on the string shown in the upper left-hand part of the figure. Release of the string gives rise to decaying sinusoidal oscillations that have a frequency of about 2 Hz.

Figure 2. Antenna articulation system for first prototype spoofing detector tests: a cantilevered beam that allows single-degree-of-freedom antenna phase-center vibration along a horizontal axis.

The remainder of the prototype system consisted of a commercial-off-the-shelf RF data recording device, off-line software receiver code, and off-line spoofing detection software. The prototype system lacked an antenna motion sensor. We compensated for this omission by implementing additional signal-processing calculations. They included off-line parameter identification of the decaying sinusoidal motions coupled with estimation of the oscillations’ initial amplitude and phase for any given detection.

This spoofing detection system is not the first to propose the use of antenna motion to uncover spoofing, and it is related to techniques that rely on multiple antennas. The present system makes three new contributions to the art of spoofing detection: First, it clearly explains why the measured carrier phases from a rapidly oscillating antenna provide a good means to detect spoofing. Second, it develops a precise spoofing detection hypothesis test for a moving-antenna system. Third, it demonstrates successful spoofing detection against live-signal attacks by a “Humphreys-class” spoofer.

Signal Model Theory and Verification

The spoofing detection test relies on mathematical models of the response of beat carrier phase to antenna motion. Reasonable models for the non-spoofed and spoofed cases are, respectively:

  (1a)

(1b)

where  is the received (negative) beat carrier phase of the authentic or spoofed satellite-j signal at the kth sample time  . The three-by-three direction cosines matrix A is the transformation from the reference system, in which the direction vectors   and  are defined, to the local body-axis system, in which the antenna motion b_a(t) is defined. λ is the nominal carrier wavelength. The terms involving the unknown polynomial coefficients , , and  model other low-frequency effects on carrier phase, including satellite motion, UE motion if its antenna articulation system is mounted on a vehicle, and receiver clock drift. The term  is the receiver phase noise. It is assumed to be a zero-mean, Gaussian, white-noise process whose variance depends on the receiver carrier-to-noise-density ratio and the sample/accumulation frequency.

If the motion of the antenna is one-dimensional, then b_a(t) takes the form , with  being the articulation direction in body-axis coordinates and r_a(t) being a known scalar antenna deflection amplitude time history. If one defines the articulation direction in reference coordinates as  , then the carrier-phase models in Equations (1a) and (1b) become

   (2a)

  (2b)

There is one important feature of these models for purposes of spoofing detection. In the non-spoofed case, the term that models the effects of antenna motion varies between GPS satellites because the  direction vector varies with j. The spoofed case lacks variation between the satellites because the one spoofer direction  replaces  for all of the spoofed satellites. This becomes clear when one compares the first terms on the right-hand sides of Eqsuations (1a) and (1b) for the 3-D motion case and on the right-hand sides of Equations (2a) and (2b) for the 1-D case.

The carrier-phase time histories in FIGURES 3 and 4 illustrate this principle. These data were collected at WSMR using the prototype antenna motion system of Figure 2. The carrier-phase time histories have been detrended by estimating the , , and coefficients in Equations (2a) and (2b) and subtracting off their effects prior to plotting. In Figure 3, all eight satellite signals exhibit similar decaying sinusoid time histories, but with differing amplitudes and some of them with sign changes. This is exactly what is predicted by the 1-D non-spoofed model in Equation (2a). All seven spoofed signals in Figure 4, however, exhibit identical decaying sinusoidal oscillations because the  term in Equation (2b) is the same for all of them.

Figure 3. Detrended carrier-phase data from multiple satellites for a typical non-spoofed case using a 1-D antenna articulation system.

Figure 4. Multiple satellites’ detrended carrier-phase data for a typical spoofed case using a 1-D antenna articulation system.

As an aside, an interesting feature of Figure 3 is its evidence of the workings of the prototype system. The ramping phases of all the signals from t = 0.4 seconds to t = 1.4 seconds correspond to the initial pull on the string shown in Figure 2, and the steady portion from t = 1.4 seconds to t = 2.25 seconds represents a period when the string was held fixed prior to release.

Spoofing Detection Hypothesis Test

A hypothesis test can precisely answer the question of which model best fits the observed data: Does carrier-phase sameness describe the data, as in Figure 4? Then the receiver is being spoofed. Alternatively, is carrier-phase differentness more reasonable, as per Figure 3? Then the signals are trustworthy.

A hypothesis test can be developed for any batch of carrier-phase data that spans a sufficiently rich antenna motion profile b_a(t) or ρ_a(t). The profile must include high-frequency motions that cannot be modeled by the  , , and quadratic polynomial terms in Equations (1a)-(2b); otherwise the detection test will lose all of its power. A motion profile equal to one complete period of a sine wave has the needed richness.

Suppose one starts with a data batch that is comprised of carrier-phase time histories for L different GNSS satellites:  for samples k = 1, …, M_j and for satellites j = 1,…, L. A standard hypothesis test develops two probability density functions for these data, one conditioned on the null hypothesis of no spoofing, H₀, and the other conditioned on the hypothesis of spoofing, H₁.  The Neyman-Pearson lemma (see Further Reading) proves that the optimal hypothesis test statistic equals the ratio of these two probability densities. Unfortunately, the required probability densities depend on additional unknown quantities. In the 1-D motion case, these unknowns include the , , and coefficients, the dot product , and the direction   if one assumes that the UE attitude is unknown. A true Neyman-Pearson test would hypothesize a priori distributions for these unknown quantities and integrate their dependencies out of the two joint probability distributions. Our sub-optimum test optimally estimates relevant unknowns for each hypothesis based on the carrier-phase data, and it uses these estimates in the Neyman-Pearson probability density ratio. Although sub-optimal as a hypothesis test, this approach is usually effective, and it is easier to implement than the integration approach in the present case.

Consider the case of 1-D antenna articulation and unknown UE attitude. Maximum-likelihood calculations optimally estimate the nuisance parameters  , , and   for j = 1, …, L for both hypotheses along with the unit vector for the non-spoofed hypothesis, or the scalar dot product  for the spoofed hypothesis. The estimation calculations for each hypothesis minimize the negative natural logarithm of the corresponding conditional probability density. Because  , , and enter the resulting cost functions quadratically, their optimized values can be computed as functions of the other unknowns, and they can be substituted back into the costs. This part of the calculation amounts to a batch high-pass filter of both the antenna motion and the carrier-phase response.

The remaining optimization problems take, under the non-spoofed hypothesis, the form:

find:          (3a)

to minimize:         (3b)

subject to:                (3c)

and, under the spoofed hypothesis, the form:

find:      η    (4a)

to minimize:         (4b)

subject to:      .   (4c)

The coefficient  is a function of the deflections  for k = 1, …, M_j, and the non-homogenous term  is derived from the jth phase time history  for k = 1, …, M_j. These two quantities are calculated during the  , , optimization. The constraint in Equation (3c) forces the estimate of the antenna articulation direction to be unit-normalized. The constraint in Eq. (4c) ensures that η is a physically reasonable dot product.

The optimization problems in Equations (3a)-(3c) and (4a)-(4c) can be solved in closed form using techniques from the literature on constrained optimization, linear algebra, and matrix factorization. The optimal estimates of  and η can be used to define a spoofing detection statistic that equals the natural logarithm of the Neyman-Pearson ratio:

(5)

It is readily apparent that γ constitutes a reasonable test statistic: If the signal is being spoofed so that carrier-phase sameness is the best model, then η_opt will produce a small value of  because the spoofed-case cost function in Equation (4b) is consistent with carrier-phase sameness. The value of , however, will not be small because the plurality of   directions in Equation (3b) precludes the possibility that any  estimate will yield a small non-spoofed cost. Therefore, γ will tend to be a large negative number in the event of spoofing because  >>  is likely. In the non-spoofed case, the opposite holds true:   will yield a small value of , but no estimate of η will yield a small , and γ will be a large positive number because  << .

Therefore, a sensible spoofing detection test employs a detection threshold γ_th somewhere in the neighborhood of zero. The detection test computes a γ value based on the carrier-phase data, the antenna articulation time history, and the calculations in Equations (3a)-(5). It compares this γ to γ_th. If γ ≥ γ_th, then the test indicates that there is no spoofing. If γ < γ_th, then a spoofing alert is issued.

The exact choice of γ_th is guided by an analysis of the probability of false alarm. A false alarm occurs if a spoofing attack is declared when there is no spoofing. The false-alarm probability is determined as a function of γ_th by developing a γ probability density function under the null hypothesis of no spoofing p(γ|H₀). The probability of false alarm equals the integral of p(γ|H₀) from γ =  to γ = γ_th. This integral relationship can be inverted to determine the γ_th threshold that yields a given prescribed false-alarm probability

A complication arises because p(γ|H₀) depends on unknown parameters,   in the case of an unknown UE attitude and 1-D antenna motion. Although sub-optimal, a reasonable way to deal with the dependence of p(γ|,H₀) on  is to use the worst-case  for a given γ_th. The worst-case articulation direction  maximizes the p(γ|,H₀) false-alarm integral. It can be calculated by solving an optimization problem. This analysis can be inverted to pick γ_th so that the worst-case probability of false alarm equals some prescribed value. For most actual  values, the probability of false alarm will be lower than the prescribed worst case.

Given γ_th, the final needed analysis is to determine the probability of missed detection. This analysis uses the probability density function of g under the spoofed hypothesis, p(γ|η,H₁). The probability of missed detection is the integral of this function from γ = γ_th to γ = +. The dependence of p(γ|η,H₁) on the unknown dot product η can be handled effectively, though sub-optimally, by determining the worst-case probability of false alarm. This involves an optimization calculation, which finds the worst-case dot product η_wc that maximizes the missed-detection probability integral. Again, most actual η values will yield lower probabilities of missed detection.

Note that the above-described analyses rely on approximations of the probability density functions p(γ|,H₀) and p(γ|η,H₁). The best approximations include dominant Gaussian terms plus small chi-squared or non-central chi-squared terms. It is difficult to analyze the chi-squared terms rigorously. Their smallness, however, makes the use of Gaussian approximations reasonable.

We have developed and evaluated several alternative formulations of this spoofing detection method. One is the case of full 3-D b_a(t) antenna motion with unknown UE attitude. The full direction cosines matrix A is estimated in the modified version of the non-spoofed optimal fit calculations of Equations (3a)-(3c), and the full spoofing direction vector  is estimated in the modified version of Equations (4a)-(4c). A different alternative allows the 1-D motion time history ρ_a(t) to have an unknown amplitude-scaling factor that must be estimated. This might be appropriate for a UAV drone with a wing-tip-mounted antenna if it induced antenna motions by dithering its ailerons. In fixed-based applications, as might be used by a financial institution, a cell-phone tower, or a power-grid monitor, the attitude would be known, which would eliminate the need to estimate  or A for the non-spoofed case.

Test Results

The initial tests of our concept involved generation of simulated truth-model carrier-phase data  using simulated , , and polynomial coefficients, simulated satellite LOS direction vectors  for the non-spoofed cases, a simulated true spoofer LOS direction  for the spoofed cases, and simulated antenna motions parameterized by  and ρ_a(t). Monte-Carlo analysis was used to generate many different batches of phase data with different random phase noise realizations in order to produce simulated histograms of the p(γ|, H₀) and p(γ|η,H₁) probability density functions  that are used in false-alarm and missed-detection analyses.

The truth-model simulations verified that the system is practical. A representative calculation used one cycle of an 8-Hz 1-D sinusoidal antenna oscillation with a peak-to-peak amplitude of 4.76 centimeters (exactly 1/4 of the L1 wavelength). The accumulation frequency was 1 kHz so that there were M_j = 125 carrier-phase measurements per satellite per data batch. The number of satellites was L = 6, their  LOS vectors were distributed to yield a geometrical dilution of precision of 3.5, and their carrier-to-noise-density ratios spanned the range 38.2 to 44.0 dB-Hz. The worst-case probability of a spoofing false alarm was set at 10^-5 and the corresponding worst-case probability of missed detection was 1.2 ´ 10^-5. Representative non-worst-case probabilities of false alarm and missed detection were, respectively, 1.7 ´ 10^-9 and 1.1 ´ 10^-6. These small numbers indicate that this is a very powerful test. Ten-thousand run Monte-Carlo simulations of the spoofed and non-spoofed cases verified the reasonableness of these probabilities and the reasonableness of the p(γ|, H₀) and p(γ|η,H₁) Gaussian approximations that had been used to derive them.

The live-signal tests bore out the truth-model simulation results. The only surprise in the live-signal tests was the presence of significant multipath, which was evidenced by received carrier amplitude oscillations that correlated with the antenna oscillations and whose amplitudes and phases varied among the different received GPS signals. As a verification that these oscillations were caused by multipath, the only live-signal data set without such amplitude oscillations was the one taken in the NASA Wallops anechoic chamber, where one would not expect to find multipath. The multipath, however, seems to have negligible impact on the efficacy of this spoofing detection system.

FIGURES 5 and 6 show the results of typical non-spoofed and spoofed cases from WSMR live-signal tests that took place on the evening of June 19–20, 2012. Each plot shows the spoofing detection statistic γ on the horizontal axis and various related probability density functions on the vertical axis. This statistic has been calculated using a modified test that includes the estimation of two additional unknowns: an antenna articulation scale factor f and a timing bias t₀ for the decaying sinusoidal oscillation . The damping ratio ζ and the undamped natural frequency w_n are known from prior system identification tests.

Figure 5. Spoofing detection statistic, threshold, and related probability density functions for a typical non-spoofed case with live data.

Figure 6. Performance of a typical spoofed case with live data: spoofing detection statistic, threshold, and related probability density functions.

The vertical dashed black line in each plot shows the actual value of γ as computed from the GPS data. There are three vertical dash-dotted magenta lines that lie almost on top of each other. They show the worst-case threshold values γ_th as computed for the optimal and ±2σ estimates of t₀: t_0opt, t_0opt+2σ_t0opt, and t_0opt-2σ_t0opt. They have been calculated for a worst-case probability of false alarm equal to 10^-6. An ad hoc method of compensating for the prototype system’s t₀ uncertainty is to use the left-most vertical magenta line as the detection threshold γ_th. The vertical dashed black line lies very far to the right of all three vertical dash-dotted magenta lines in Figure 5, which indicates a successful determination that the signals are not being spoofed. In Figure 6, the situation is reversed. The vertical dashed black line lies well to the left of the three vertical dash-dotted magenta lines, and spoofing is correctly and convincingly detected.

These two figures also plot various relevant probability density functions. Consistent with the consideration of three possible values of the t₀ motion timing estimate, these are plotted in triplets. The three dotted cyan probability density functions represent the worst-case non-spoofed situation, and the dash-dotted red probability functions represent the corresponding worst-case spoofed situations. Obviously, there is sufficient separation between these sets of probability density functions to yield a powerful detection test, as evidenced by the ability to draw the dash-dotted magenta detection thresholds in a way that clearly separates the red and cyan distributions. Further confirmation of good detection power is provided by the low worst-case probabilities of false alarm and missed detection, the latter metric being 1.6 ´ 10^-6 for the test in Figure 5 and 7 ´ 10^-8 for Figure 6.

The solid-blue distributions on the two plots correspond to the η_opt estimate and the spoofed assumption, which is somewhat meaningless for Figure 5, but meaningful for Figure 6. The dashed-green distributions are for the  estimate under the non-spoofed assumption. The wide separations between the blue distributions and the green distributions in both figures clearly indicate that the worst-case false-alarm and missed-detection probabilities can be very conservative.

The detection test results in Figures 5 and 6 have been generated using the last full oscillation of the respective carrier-phase data, as in Figures 3 and 4, but applied to different data sets. In Figure 3, the last full oscillation starts at t = 3.43 seconds, and it starts at t = 2.11 seconds in Figure 4. The peak-to-peak amplitude of each last full oscillation ranged from 4-6 centimeters, and their periods were shorter than 0.5 seconds. It would have been possible to perform the detections using even shorter data spans had the mechanical oscillation frequency of the cantilevered antenna been higher.

Conclusions

In this article, we have presented a new method to detect spoofing of GNSS signals. It exploits the effects of intentional high-frequency antenna motion on the measured beat carrier phases of multiple GNSS signals. After detrending using a high-pass filter, the beat carrier-phase variations can be matched to models of the expected effects of the motion. The non-spoofed model predicts differing effects of the antenna motion for the different satellites, but the spoofed case yields identical effects due to a geometry in which all of the false signals originate from a single spoofer transmission antenna. Precise spoofing detection hypothesis tests have been developed by comparing the two models’ ability to fit the measured data.

This new GNSS spoofing detection technique has been evaluated using both Monte-Carlo simulation and live data. Its hypothesis test yields theoretical false-alarm probabilities and missed-detection probabilities on the order of 10^-5 or lower when working with typical numbers and geometries of available GPS signals and typical patch-antenna signal strengths. The required antenna articulation deflections are modest, on the order of 4-6 centimeters peak-to-peak, and detection intervals less than 0.5 seconds can suffice.

A set of live-signal tests at WSMR evaluated the new technique against a sophisticated receiver/spoofer, one that mimics all visible signals in a way that foils standard RAIM techniques. The new system correctly detected all of the attacks. These are the first known practical detections of live-signal attacks mounted against a civilian GNSS receiver by a dangerous new generation of spoofers.

Future Directions

This work represents one step in an on-going “Blue Team” effort to develop better defenses against new classes of GNSS spoofers. Planned future improvements include 1) the ability to use electronically synthesized antenna motion that eliminates the need for moving parts, 2) the re-acquisition of true signals after detection of spoofing, 3) the implementation of real-time prototypes using software radio techniques, and 4) the consideration of “Red-Team” counter-measures to this defense  and how the “Blue Team” could combat them; counter-measures such as high-frequency phase dithering of the spoofed signals or coordinated spoofing transmissions from multiple locations.

Acknowledgments

The authors thank the following people and organizations for their contributions to this effort:  The NASA Wallops Flight Facility provided access to their anechoic chamber. Robert Miceli, a Cornell graduate student, helped with data collection at that facility. Dr. John Merrill and the Department of Homeland Security arranged the live-signal spoofing tests. The U.S. Air Force 746th Test Squadron hosted the live-signal spoofing tests at White Sands Missile Range. Prof. Todd Humphreys and members of his University of Texas at Austin Radionavigation Laboratory provided live-signal spoofing broadcasts from their latest receiver/spoofer.

Manufacturers

The prototype spoofing detection data capture system used an Antcom Corp. (www.antcom.com) 2G1215A L1/L2 GPS antenna. It was connected to an Ettus Research (www.ettus.com) USRP (Universal Software Radio Peripheral) N200 that was equipped with the DBSRX2 daughterboard.

MARK L. PSIAKI is a professor in the Sibley School of Mechanical and Aerospace Engineering at Cornell University, Ithaca, New York. He received a B.A. in physics and M.A. and Ph.D. degrees in mechanical and aerospace engineering from Princeton University, Princeton, New Jersey. His research interests are in the areas of GNSS technology, applications, and integrity, spacecraft attitude and orbit determination, and general estimation, filtering, and detection.

STEVEN P. POWELL is a senior engineer with the GPS and Ionospheric Studies Research Group in the Department of Electrical and Computer Engineering at Cornell University. He has M.S. and B.S. degrees in electrical engineering from Cornell University. He has been involved with the design, fabrication, testing, and launch activities of many scientific experiments that have flown on high altitude balloons, sounding rockets, and small satellites. He has designed ground-based and space-based custom GPS receiving systems primarily for scientific applications.

BRADY W. O’HANLON is a graduate student in the School of Electrical and Computer Engineering at Cornell University. He received a B.S. in electrical and computer engineering from Cornell University. His interests are in the areas of GNSS technology and applications, GNSS security, and GNSS as a tool for space weather research.

VIDEO

Here is a video (in m4v format) of Cornell University’s antenna articulation system for the team’s first prototype spoofing detector tests.

FURTHER READING

• The Spoofing Threat and RAIM-Resistant Spoofers

“Status of Signal Authentication Activities within the GNSS Authentication and User Protection System Simulator (GAUPSS) Project” by O. Pozzobon, C. Sarto, A. Dalla Chiara, A. Pozzobon, G. Gamba, M. Crisci, and R.T. Ioannides, in Proceedings of ION GNSS 2012, the 25th International Technical Meeting of The Institute of Navigation, Nashville, Tennessee, September 18–21, 2012, pp. 2894-2900.

“Assessing the Spoofing Threat” by T.E. Humphreys, P.M. Kintner, Jr., M.L. Psiaki, B.M. Ledvina, and B.W. O’Hanlon in GPS World, Vol. 20, No. 1, January 2009, pp. 28-38.

Vulnerability Assessment of the Transportation Infrastructure Relying on the Global Positioning System – Final Report. John A. Volpe National Transportation Systems Center, Cambridge, Massachusetts, August 29, 2001.

• Moving-Antenna and Multi-Antenna Spoofing Detection

“Robust Joint Multi-Antenna Spoofing Detection and Attitude Estimation by Direction Assisted Multiple Hypotheses RAIM” by M. Meurer, A. Konovaltsev, M. Cuntz, and C. Hattich, in Proceedings of ION GNSS 2012, the 25th International Technical Meeting of The Institute of Navigation, Nashville, Tennessee, September 18–21, 2012, pp. 3007-3016.

“GNSS Spoofing Detection for Single Antenna Handheld Receivers” by J. Nielsen, A. Broumandan, and G. Lachapelle in Navigation, Vol. 58, No. 4, Winter 2011, pp. 335-344.

• Alternate Spoofing Detection Strategies

“Who’s Afraid of the Spoofer? GPS/GNSS Spoofing Detection via Automatic Gain Control (AGC)” by D.M. Akos, in Navigation, Vol. 59, No. 4, Winter 2012-2013, pp. 281-290.

“Civilian GPS Spoofing Detection based on Dual-Receiver Correlation of Military Signals” by M.L. Psiaki, B.W. O’Hanlon, J.A. Bhatti, D.P. Shepard, and T.E. Humphreys in Proceedings of ION GNSS 2011, the 24th International Technical Meeting of The Institute of Navigation, Portland, Oregon, September 19–23, 2011, pp. 2619-2645.

• Statistical Hypothesis Testing

Fundamentals of Statistical Signal Processing, Volume II: Detection Theory by S. Kay, published by Prentice Hall, Upper Saddle River, New Jersey,1998.

An Introduction to Signal Detection and Estimation by H.V. Poor, 2nd edition, published by Springer-Verlag, New York, 1994.

Video (in m4v format) of Cornell University’s antenna articulation system for their first prototype spoofing detector tests.

Smith’s photograph was taken at 21:58:38 UTC (start) with a Canon EOS 450D Digital Rebel camera with an 18-55mm zoom lens. The camera settings were: focal length 55mm, aperture f/5.6, and an exposure of 8 seconds at an ISO value of 1600. Two images are shown below: the original, as obtained from the camera, and a greyscale image with edge enhancement.

The Centaur can be seen traveling left to right and starts its track as it crosses the constellation of Cygnus. There’s a slight wobble at the beginning as the shutter release was pressed. The glow at the bottom of the frame is from a streetlight. The elevation angle of the Centaur was approximately 12 degrees.

SVN66 will operate as PRN27 and it will eventually occupy the C-2 orbital slot, replacing SVN33/PRN03, a Block IIA satellite launched in 1996. SVN66 is currently in a drift orbit about 400 kilometers above the operational constellation. It should reach the C-2 slot within a few days from now. The satellite has already been added to the broadcast almanac although it has not yet started to transmit standard signals. It is currently marked as unhealthy in the almanac and will remain so, even after standard signals are switched on, until testing is completed sometime this summer.

Centaur upper stage with the payload still attached, original photo. Photo credit: Andy Smith

The same photo digitally enhanced:

Digitally enhanced photo. Photo credit: Andy Smith

Photo credit: Pat Corkery, United Launch Alliance.

A U.S. Air Force Global Positioning System satellite built by Boeing was successfully launched May 15. The fourth GPS IIF satellite, Space Vehicle Number (SVN) 66, was carried aboard a United Launch Alliance Atlas V Launch Vehicle at 5:38 p.m. EDT (21:38 UTC) May 15 from Cape Canaveral Air Force Station, Florida.

The new capabilities of the IIF satellites will provide greater navigational accuracy through improvements in atomic clock technology; a more robust signal for commercial aviation and safety-of-life applications, known as the new third civil signal (L5); and a 12-year design life providing long-term service. These upgrades improved anti-jam capabilities for the warfighter and improved security for military and civil users around the world, the Air Force said in a statement.

The Atlas rocket took off on schedule. The satellite was released from the Centaur upper stage at T+ 3 hours, 23 minutes and 52.8 seconds or about 01:02 UTC on May 16. Details on the Block IIF satellites and the Atlas rocket can be found here.

“I’m extremely pleased with today’s launch and delighted to be part of this mission that enhances our nation’s critical GPS capability. Thanks to the superb efforts of the of the 45th and 50th Space Wings, United Launch Alliance, our industry partners, the Atlas V and GPS IIF launch teams, the GPS IIF-4 mission was successfully carried out,” said Col. Bernie Gruber, director of the Space and Missile Systems Center’s Global Positioning Systems Directorate.

“The GPS constellation remains healthy and continues to meet and exceed the performance standards to which the satellites were built. Our goal is to deliver sustained, reliable GPS capabilities to America’s warfighters, our allies and civil users around the world, and this is done by maintaining GPS performance, fielding new capabilities and developing more robust modernized capabilities for the future,” said Colonel Gruber.

Here are videos of the launch:


Opening photo by Pat Corkery, United Launch Alliance.

Photos show the launch of the U.S. Air Force’s GPS IIF-4 satellite from the Kennedy Space Center and Cape Canaveral Air Force Station.

INNOVATION INSIGHTS with Richard Langley

INTEGRITY.  It is one of the most desirable personality traits. It is the characteristic of truth and fair dealing, of honesty and sincerity. The word also can be applied to systems and actions with a meaning of soundness or being whole or undivided. This latter definition is clear when we consider that the word integrity comes from the Latin word integer, meaning untouched, intact, entire — the same origin as that for the integers in mathematics: whole numbers without a fractional or decimal component.

Integrity is perhaps the most important requirement of any navigation system (along with accuracy, availability, and continuity). It characterizes a system’s ability to provide a timely warning when it fails to meet its stated accuracy. If it does not, we have an integrity failure and the possibility of conveying hazardously misleading information. GPS has built into it various checks and balances to ensure a fairly high level of integrity. However, GPS integrity failures have occasionally occurred.

One of these was in 1990 when SVN19, a GPS Block II satellite operating as PRN19, suffered a hardware chain failure, which caused it to transmit an anomalous waveform. There was carrier leakage on the L1 signal spectrum. Receivers continued to acquire and process the SVN19 signals, oblivious to the fact that the signal distortion resulted in position errors of three to eight meters. Errors of this magnitude would normally go unnoticed by most users, and the significance of the failure wasn’t clear until March 1993 during some field tests of differential navigation for aided landings being conducted by the Federal Aviation Administration. The anomaly became known as the “evil waveform.”

(I’m not sure who first came up with this moniker for the anomaly. Perhaps it was the folks at Stanford University who have worked closely with the FAA in its aircraft navigation research. The term has even made it into popular culture. The Japanese drone-metal rock band, Boris, released an album in 2005 titled Dronevil. One of the cuts on the album is “Evil Wave Form.” And if drone metal is not your cup of tea, you will find the title quite appropriate.) Other types of GPS evil waveforms are possible, and there is the potential for such waveforms to also occur in the signals of other global navigation satellite systems. It is important to fully understand the implications of these potential signal anomalies. In this month’s column, our authors discuss a set of GPS and Galileo evil-waveform experiments they have carried out with an advanced GNSS RF signal simulator. Their results will help to benchmark the effects of distorted signals and perhaps lead to improvements in GNSS signal integrity.

“Innovation” is a regular feature that discusses advances in GPS technology andits applications as well as the fundamentals of GPS positioning. The column is coordinated by Richard Langley of the Department of Geodesy and Geomatics Engineering, University of New Brunswick. He welcomes comments and topic ideas.

GNSS signal integrity is a high priority for safety applications. Being able to position oneself is useful only if this position is delivered with a maximum level of confidence. In 1993, a distortion on the signals of GPS satellite SVN19/PRN19, referred to as an “evil waveform,” was observed. This signal distortion induced positioning errors of several meters, hence questioning GPS signal integrity. Such events, when they occur, should be accounted for or, at least, detected.

Since then, the observed distortions have been modeled for GPS signals, and their theoretical effects on positioning performance have been studied through simulations. More recently, the models have been extended to modernized GNSS signals, and their impact on the correlation functions and the range measurements have been studied using numerical simulations. This article shows, for the first time, the impact of such distortions on modernized GNSS signals, and more particularly on those of Galileo, through the use of RF simulations. Our multi-constellation simulator, Navys, was used for all of the simulations.

These simulations are mainly based on two types of scenarios: a first scenario, referred to as a static scenario, where Navys is configured to generate two signals (GPS L1C/A or Galileo E1) using two separate RF channels. One of these signals is fault free and used as the reference signal, and the other is affected by either an A- or B-type evil waveform (EW) distortion (these two types are described in a latter section).

The second type of scenario, referred to as a dynamic scenario, uses only one RF channel. The generated signal is fault free in the first part of the simulation, and affected by either an A- or B-type EW distortion in the second part of the scenario. Each part of the scenario lasts approximately one minute.

All of the studied scenarios consider a stationary satellite position over time, hence a constant signal amplitude and propagation delay for the duration of the complete scenario.

Navys Simulator

The first versions of Navys were specified and funded by Centre National d’Etudes Spatiales or CNES, the French space agency. The latest evolutions were funded by the European Space Agency and Thales Alenia Space France (TAS-F). Today, Navys is a product whose specifications and ownership are controled by TAS-F. It is made up of two components: the hardware part, developed by ELTA, Toulouse, driven by a software part, developed by TAS-F.

The Navys simulator can be configured to simulate GNSS constellations, but also propagation channel effects. The latter include relative emitter-receiver dynamics, the Sagnac effect, multipath, and troposphere and ionosphere effects. Both ground- and space-based receivers may be considered.

GNSS Signal Generation Capabilities. Navys is a multi-constellation simulator capable of generating all existing and upcoming GNSS signals. Up to now, its GPS and Galileo signal-generation capabilities and performances have been experienced and demonstrated. The simulator, which has a generation capacity of 16 different signals at the same time over the entire L band, has already been successfully tested with GPS L1 C/A, L1C, L5, and Galileo E1 and E5 receivers.

Evil Waveform Emulation Capabilities. In the frame of the ESA Integrity Determination Unit project, Navys has been upgraded to be capable of generating the signal distortions that were observed in 1993 on the signals from GPS satellite SVN19/PRN19. Two models have been developed from the observations of the distorted signals.

The first one, referred to as Evil Waveform type A (EWFA), is associated with a digital distortion, which modifies the duration of the GPS C/A code chips, as shown in FIGURE 1. A lead/lag of the pseudorandom noise code chips is introduced. The +1 and –1 state durations are no longer equal, and the result is a distortion of the correlation function, inducing a bias in the pseudorange measurement equal to half the difference in the durations. This model, based on GPS L1 C/A-code observations, has been extended to modernized GNSS signals, such as those of Galileo (see Further Reading). In Navys, type A EWF generation is applied by introducing an asymmetry in the code chip durations, whether the signal is modulated by binary phase shift keying (BPSK), binary offset carrier (BOC), or composite BOC (CBOC).

FIGURE 1. Theoretical L1 C/A code-chip waveforms in the presence of an EWFA (top) and EWFB (bottom).

The second model, referred to as Evil Waveform type B (EWFB) is associated with an analog distortion equivalent to a second-order filter, described by a resonance frequency (fd) and a damping factor (σ), as depicted in Figure 1. This failure results in correlation function distortions different from those induced by EWFA, but which also induces a bias in the pseudorange measurement. This bias depends upon the characteristics (resonance frequency, damping factor) of the filter. In Navys, an infinite impulse response (IIR) filter is implemented to simulate the EWFB threat. The filter has six coefficients (three in the numerator and three in the denominator of its transfer function). Hence, it appears that Navys can generate third order EWF type B threats, which is one order higher that the second order threats considered by the civil aviation community. Navys is specified to generate type B EWF with less than 5 percent root-mean-square  (RMS) error between the EWF module output and the theoretical model. During validation activities, a typical value of 2 percent RMS error was measured. This EWF simulation function is totally independent of the generated GNSS signals, and can be applied to any of them, whatever its carrier frequency or modulation.

It is important to note that such signal distortions may be generated on the fly — that is, while a scenario is running. FIGURE 2 gives an example of the application of such threat models on the Galileo E1 BOC signal using a Matlab theoretical model.

FIGURE 2. Theoretical E1 C code-chip waveforms in the presence of an EWFA (top) and EWFB (bottom).

GEMS Description

GEMS stands for GNSS Environment Monitoring Station. It is a software-based solution developed by Thales Alenia Space aiming at assessing the quality of GNSS measurements. GEMS is composed of a signal processing module featuring error identification and characterization functions, called GEA, as well as a complete graphical user interface (see online version of this article for an example screenshot) and database management.

The GEA module embeds the entire signal processing function suite required to build all the GNSS observables often used for signal quality monitoring (SQM). The GEA module is a set of C/C++ software routines based on innovative-graphics-processing-unit (GPU) parallel computing, allowing the processing of a large quantity of data very quickly. It can operate seamlessly on a desktop or a laptop computer while adjusting its processing capabilities to the processing power made available by the platform on which it is installed. The GEA signal-processing module is multi-channel, multi-constellation, and supports both real-time- and post-processing of GNSS samples produced by an RF front end.

GEMS, which is compatible with many RF front ends, was used with a commercial GNSS data-acquisition system. The equipment was configured to acquire GNSS signals at the L1 frequency, with a sampling rate of 25 MHz. The digitized signals were provided in real time to GEMS using a USB link.

From the acquired samples, GEMS performed signal acquisition and tracking, autocorrelation function (ACF) calculation and display, and C/N₀ measurements. All these figures of merit were then logged in text files.

EWF Observation

Several experiments were carried out using both static and kinematic scenarios with GPS and Galileo signals.

GPS L1 C/A. The first experiment was intended to validate Navys’ capability of generating state-of-the-art EWFs on GPS L1 C/A signals. It aimed at verifying that the distortion models largely characterized in the literature for the GPS L1 C/A are correctly emulated by Navys.

EWFA, static scenario. In this scenario, Navys is configured to generate two GPS L1 C/A signals using two separate RF channels. The same PRN code was used on both channels, and a numerical frequency transposition was carried out to translate the signals to baseband. One signal was affected by a type A EWF, with a lag of 171 nanoseconds, and the other one was EWF free. Next, its amplified output was plugged into an oscilloscope. The EWFA effect is easily seen as the faulty signal falling edge occurs later than the EWF-free signal, while their rising edges are still synchronous. However, the PRN code chips are distorted from their theoretical versions as the Navys integrates a second-order high pass filter at its output, meant to avoid unwanted DC emissions. The faulty signal falling edge should occur approximately 0.17 microseconds later than the EWF-free signal falling edge.

A spectrum analyzer was used to verify, from a spectral point of view, that the EWFA generation feature of Navys was correct. For this experiment, Navys was configured to generate a GPS L1 C/A signal at the L1 frequency, and Navys output was plugged into the spectrum analyzer input. Three different GPS L1 C/A signals are included: the spectrum of an EWF-free signal, the spectrum of a signal affected by an EWF type A, where the lag is set to 41.1 nanoseconds, and the spectrum of a signal affected by an EWF type A, where the lag is set to 171 nanoseconds. As expected, the initial BPSK(1) signal is distorted and spikes appear every 1 MHz. The spike amplitude increases with the lag.

EWFA, dynamic scenario. In a second experiment, Navys was configured to generate only one fault-free GPS L1 C/A signal at RF. The RF output was plugged into the GEMS RF front end, and acquisition was launched. One minute later, an EWFA distortion, with a lag of 21 samples (about 171 nanoseconds at 120 times f₀, where f₀ equals 1.023 MHz), was activated from the Navys interface.

FIGURE 3 shows the code-phase measurement made by GEMS. Although the scenario was static in terms of propagation delay, the code-phase measurement linearly decreases over time. This is because the Navys and GEMS clocks are independent and are drifting with respect to each other.

FIGURE 3. GEMS code-phase measurements on GPS L1 C/A signal, EWFA dynamic scenario.

The second observation is that the introduction of the EWFA induced, as expected, a bias in the measurement. If one removes the clock drifts, the bias is estimated to be 0.085 chips (approximately 25 meters). According to theory, an EWFA induces a bias equal to half the lead or lag value. A value of 171 nanoseconds is equivalent to about 50 meters.

FIGURE 4 represents the ACFs computed by GEMS during the scenario. It appears that when the EWFA is enabled, the autocorrelation function is flattened at its top, which is typical of EWFA distortions. Eventually, FIGURE 5 showed that the EWFA also results in a decrease of the measured C/N₀, which is completely coherent with the flattened correlation function obtained when EWFA is on.

FIGURE 4. GEMS ACF computation on GPS L1 C/A signal, EWFA dynamic scenario.

FIGURE 5. GEMS C/N0 measurement on GPS L1 C/A signal, EWFA dynamic scenario.

Additional analysis has been conducted with Matlab to confirm Navys’ capacity. A GPS signal acquisition and tracking routine was modified to perform coherent accumulation of GPS signals. This operation is meant to extract the signal out of the noise, and to enable observation of the code chips. After Doppler and code-phase estimation, the signal is post-processed and 1,000 signal periods are accumulated. The result, shown in FIGURE 6, confronts fault-free (blue) and EWFA-affected (red) code chips. Again, the lag of 171 nanoseconds is clearly observed. The analysis concludes with FIGURE 7, which shows the fault-free (blue) and the faulty (red) signal spectra. Again, the presence of spikes in the faulty spectrum is characteristic of EWFA.

FIGURE 6. Fault-free vs. EWFA GPS L1 C/A signal.

FIGURE 7. Fault-free vs. EWFA GPS L1 C/A signal power spectrum density.

EWFB, static scenario. The same experiments as for EWFA were conducted for EWFB. Fault-free and faulty (EWFB with a resonance frequency of 8 MHz and a damping factor of 7 MHz) signals were simultaneously generated and observed using an oscilloscope and a spectrum analyzer. The baseband temporal signal undergoes the same default as that of the EWFA because of the Navys high-pass filter. However, the oscillations induced by the EWFB are clearly observed.

The spectrum distortion induced by the EWFB at the L1 frequency is amplified around 8 MHz, which is consistent with the applied failure.

EWFB, dynamic scenario. Navys was then configured to generate one fault-free GPS L1 C/A signal at RF. The RF output was plugged into the GEMS RF front end, and acquisition was launched. One minute later, an EWFB distortion with a resonance frequency of 4 MHz and a damping factor of 2 MHz was applied. As for the EWFA experiments, the GEMS measurements were analyzed to verify the correct application of the failure. The code-phase measurements, illustrated in FIGURE 8, show again that the Navys and GEMS clocks are drifting with respect to each other. Moreover, it is clear that the application of the EWFB induced a bias of about 5.2 meters on the code-phase measurement. One should notice that this bias depends upon the chip spacing used for tracking. Matlab simulations were run considering the same chip spacing as for GEMS, and similar tracking biases were observed.

FIGURE 8. GEMS code-phase measurements on GPS L1 C/A signal, EWFB dynamic scenario.

FIGURE 9 shows the ACF produced by GEMS. During the first minute, the ACF looks like a filtered L1 C/A correlation function. Afterward, undulations distort the correlation peak.

FIGURE 9. GEMS ACF computation on GPS L1 C/A signal, EWFB dynamic scenario.

Again, additional analysis has been conducted with Matlab, using a GPS signal acquisition and tracking routine. A 40-second accumulation enabled comparison of the faulty and fault-free code chips. FIGURE 10 shows that the faulty code chips are affected by undulations with a period of 244 nanoseconds, which is consistent with the 4 MHz resonance frequency. This temporal signal was then used to compute the spectrum, as shown in FIGURE 11. The figure shows well that the faulty L1 C/A spectrum (red) secondary lobes are raised up around the EWFB resonance frequency, compared to the fault-free L1 C/A spectrum (blue).

FIGURE 10. Fault-free vs EWFB GPS L1 C/A signal.

FIGURE 11. Fault-free vs EWFB GPS L1 C/A signal power spectrum density.

Galileo E1 CBOC(6, 1, 1/11). In the second part of the experiments, Navys was configured to generate the Galileo E1 Open Service (OS) signal instead of the GPS L1 C/A signal. The goal was to assess the impact of EWs on such a modernized signal.

EWFA, static scenario. First, the same Galileo E1 BC signal was generated using two different Navys channels. One was affected by EWFA, and the other was not. The spectra of the obtained signals were observed using a spectrum analyzer. The spectrum of the signal produced by the fault-free channel shows the BOC(1,1) main lobes, around 1 MHz, and the weaker BOC(6,1) main lobes, around 6 MHz. The power spectrum of the signal produced by the EWFA channel has a lag of 5 samples at 120 times f₀ (40 nanoseconds). Again, spikes appear at intervals of f₀, which is consistent with theory. The signal produced by the same channel, but with a lag set to 21 samples (171.07 nanoseconds) was also seen. Such a lag should not be experienced on CBOC(6,1,1/11) signals as this lag is longer than the BOC(6,1) subcarrier half period (81 nanoseconds). This explains the fact that the BOC(6,1) lobes do not appear anymore in the spectrum.

EWFB, static scenario. The same experiments as for EWFA were conducted for EWFB. Fault-free and faulty (EWFB with a resonance frequency of 8 MHz and a damping factor of 7 MHz) signals were simultaneously generated and observed using the spectrum analyzer. The spectrum distortion induced by the EWFB at the E1 frequency was evident. The spectrum is amplified around 8 MHz, which is consistent with the applied failure.

EWFA, dynamic scenario. The same scenario as for the GPS L1 C/A signal was run with the Galileo E1 signal: first, for a period of one minute, a fault-free signal was generated, followed by a period of one minute with the faulty signal. GEMS was switched on and acquired and tracked the two-minute-long signal. Its code-phase measurements, shown in FIGURE 12, reveal a tracking bias of 6.2 meters. This is consistent with theory, where the set lag is equal to 40 nanoseconds (12.0 meters). GEMS-produced ACFs show the distortion of the correlation function in FIGURE 13. The distortion is hard to observe because the applied lag is small.

FIGURE 12. GEMS code-phase measurements on Galileo E1 pilot signal, EWFA dynamic scenario.

FIGURE 13. GEMS ACF computation on Galileo E1 pilot signal, EWFA dynamic scenario.

A modified version of the GPS signal acquisition and tracking Matlab routine was used to acquire and track the Galileo signal. It was configured to accumulate 50 seconds of fault-free signal and 50 seconds of a faulty signal. This operation enables seeing the signal in the time domain, as in FIGURE 14. Accordingly, the following observations can be made:

• The E1 BC CBOC(6,1,1/11) signal is easily recognized from the blue curve (fault-free signal).
• The EWFA effect is also seen on the BOC(1,1) and BOC(6,1) parts. The observed lag is consistent with the scenario (five samples at 120 times f₀ ≈ 0.04 chips).
• The lower part of the BOC(6,1) seems absent from the red signal. Indeed, the application of the distortion divided the duration of these lower parts by a factor of two, and so multiplied their Fourier representation by two. Therefore, the corresponding main lobes should be located around 12 MHz. At the receiver level, the digitization is being performed at 25 MHz; this signal is close to the Shannon frequency and is therefore filtered by the anti-aliasing filter.

FIGURE 14. Fault-free vs EWFA Galileo E1 signal.

The power spectrum densities of the obtained signals were then computed. FIGURE 15 shows the CBOC(6,1,1/11) fault-free signal in blue and the faulty CBOC(6,1,1/11) signal, with the expected spikes separated by 1.023 MHz.

FIGURE 15. Fault-free vs. EWFA Galileo E1 signal power spectrum density.

It is noteworthy that the EWFA has been applied to the entire E1 OS signal, which is B (data component) minus C (pilot component). EWFA could also affect exclusively the data or the pilot channel. Although such an experiment was not conducted during our research, Navys is capable of generating EWFA on the data component, the pilot component, or both.

EWFB, dynamic scenario. In this scenario, after one minute of a fault-free signal, an EWFB, with a resonance frequency of 4 MHz and a damping factor of 2 MHz, was activated. The GEMS code-phase measurements presented in FIGURE 16 show that the EWFB induces a tracking bias of 2.8 meters. As for GPS L1 C/A signals, it is to be noticed that the bias induced by EWFB depends upon the receiver characteristics and more particularly the chip spacing used for tracking.

FIGURE 16. GEMS code-phase measurements on Galileo E1 pilot signal, EWFB dynamic scenario.

The GEMS produced ACFs are represented in FIGURE 17. After one minute, the characteristic EWFB undulations appear on the ACF.

FIGURE 17. GEMS ACF computation on Galileo E1 pilot signal, EWFB dynamic scenario.

In this case, signal accumulation was also performed to observe the impact of EWFB on Galileo E1 BC signals. The corresponding representation in the time domain is provided in FIGURE 18, while the Fourier domain representation is provided in FIGURE 19. From both points of view, the application of EWFB is compliant with theoretical models. The undulations observed on the signal are coherent with the resonance frequency (0.25 MHz ≈ 0.25 chips), and the spectrum also shows the undulations (the red spectrum is raised up around 4 MHz).

FIGURE 18. Fault-free vs EWFB Galileo E1 signal.

FIGURE 19. Fault-free vs. EWFB Galileo E1 signal power spectrum density.

Conclusion

Navys is a multi-constellation GNSS simulator, which allows the generation of all modeled EWF (types A and B) on both GPS and Galileo signals. Indeed, the Navys design makes the EWF application independent of the signal modulation and carrier frequency.

The International Civil Aviation Organization model has been adapted to Galileo signals, and the correct application of the failure modes has been verified through RF simulations. The theoretical effects of EWF types A and B on waveforms, spectra, autocorrelation functions and code-phase measurements have been confirmed through these simulations.

For a given lag value, the tracking biases induced by type A EWF distortions are equal on GPS and Galileo signals, which is consistent with theory.

Eventually, for a given resonance frequency-damping factor combination, the type B EWF distortions induce a tracking bias of about 5.2 meters on GPS L1 C/A measurements and only 2.8 meters on Galileo E1 C measurements. This is mainly due to the fact that the correlator tracking spacing was reduced for Galileo signal tracking (± 0.15 chips instead of ± 0.5 chips). (Additional figures showing oscilloscope and spectrum analyzer screenshots of experimental results are available in the online version of this article.)

Acknowledgments

This article is based on the paper “Generating Evil WaveForms on Galileo Signals using NAVYS” presented at the 6th ESA Workshop on Satellite Navigation Technologies and the European Workshop on GNSS Signals and Signal Processing, Navitec 2012, held in Noordwijk, The Netherlands, December 5–7, 2012.

Manufacturers

In addition to the Navys simulator, the experiments used a Saphyrion sagl GDAS-1 GNSS data acquisition system, a Rohde & Schwarz GmbH & Co. KG RTO1004 digital oscilloscope, and a Rohde & Schwarz FSW26 signal and spectrum analyzer.

MATHIEU RAIMONDI is currently a GNSS systems engineer at Thales Alenia Space France (TAS-F). He received a Ph.D. in signal processing from the University of Toulouse (France) in 2008.

ERIC SENANT is a senior navigation engineer at TAS-F. He graduated from the Ecole Nationale d’Aviation Civile (ENAC), Toulouse, in 1997.

CHARLES FERNET is the technical manager of GNSS system studies in the transmission, payload and receiver group of the navigation engineering department of the TAS-F navigation business unit. He graduated from ENAC in 2000.

RAPHAEL PONS is currently a GNSS systems engineering consultant at Thales Services in France. He graduated as an electronics engineer in 2012 from ENAC.

HANAA AL BITAR is currently a GNSS systems engineer at TAS-F. She graduated as a telecommunications and networks engineer from the Lebanese Engineering School of Beirut in 2002 and received her Ph.D. in radionavigation in 2007 from ENAC, in the field of GNSS receivers.

FRANCISCO AMARILLO FERNANDEZ received his Master’s degree in telecommunication engineering from the Polytechnic University of Madrid. In 2001, he joined the European Space Agency’s technical directorate, and since then he has worked for the Galileo program and leads numerous research activities in the field of GNSS evolution.

MARC WEYER is currently working as the product manager in ELTA, Toulouse, for the GNSS simulator and recorder.

Additional Images

GEMS graphical interface.

Observation of EWF type A on GPS L1 C/A signal with an oscilloscope.

Impact of EWF A on GPS L1 C/A signal spectrum for 0 (green), 41 (black), and 171 (blue) nanosecond lag.

Observation of EWF type A on GPS L1 C/A signal with an oscilloscope.

Impact of EWF B on GPS L1 C/A signal spectrum for fd = 8 MHz and σ = 7 MHz.

Impact of EWF A on Galileo E1 BC signal spectrum for 0 (green), 40 (black), and 171 (blue) nanosecond lag.

Navys hardware equipment – Blackline edition.

Further Reading

• Authors’ Conference Paper

“Generating Evil WaveForms on Galileo Signals using NAVYS” by M. Raimondi, E. Sénant, C. Fernet, R. Pons, and H. AlBitar in Proceedings of Navitec 2012, the 6th ESA Workshop on Satellite Navigation Technologies and the European Workshop on GNSS Signals and Signal Processing, Noordwijk, The Netherlands, December 5–7, 2012, 8 pp., doi: 10.1109/NAVITEC.2012.6423071.

• Threat Models

“A Novel Evil Waveforms Threat Model for New Generation GNSS Signals: Theoretical Analysis and Performance” by D. Fontanella, M. Paonni, and B. Eissfeller in Proceedings of Navitec 2010, the 5th ESA Workshop on Satellite Navigation Technologies, Noordwijk, The Netherlands, December 8–10, 2010, 8 pp., doi: 10.1109/NAVITEC.2010.5708037.

“Estimation of ICAO Threat Model Parameters For Operational GPS Satellites” by A.M. Mitelman, D.M. Akos, S.P. Pullen, and P.K. Enge in Proceedings of ION GPS 2002, the 15th International Technical Meeting of the Satellite Division of The Institute of Navigation, Portland, Oregon, September 24–27, 2002, pp. 12–19.

• GNSS Signal Deformations

“Effects of Signal Deformations on Modernized GNSS Signals” by R.E. Phelts and D.M. Akos in Journal of Global Positioning Systems, Vol. 5, No. 1–2, 2006, 9 pp.

“Robust Signal Quality Monitoring and Detection of Evil Waveforms” by R.E. Phelts, D.M. Akos, and P. Enge in Proceedings of ION GPS-2000, the 13th International Technical Meeting of the Satellite Division of The Institute of Navigation, Salt Lake City, Utah, September 19–22, 2000, pp. 1180–1190.

“A Co-operative Anomaly Resolution on PRN-19” by C. Edgar, F. Czopek, and B. Barker in Proceedings of ION GPS-99, the 12th International Technical Meeting of the Satellite Division of The Institute of Navigation, Nashville, Tennessee, September 14–17, 1999, pp. 2269–2271.

• GPS Satellite Anomalies and Civil Signal Monitoring

An Overview of Civil GPS Monitoring by J.W. Lavrakas, a presentation to the Southern California Section of The Institute of Navigation at The Aerospace Corporation, El Segundo, California, March 31, 2005.

• Navys Signal Simulator

“A New GNSS Multi Constellation Simulator: NAVYS” by G. Artaud, A. de Latour, J. Dantepal, L. Ries, N. Maury, J.-C. Denis, E. Senant, and T. Bany in  Proceedings of ION GPS 2010, the 23rd International Technical Meeting of the Satellite Division of The Institute of Navigation, Portland, Oregon, September 21–24, 2010, pp. 845–857.

“Design, Architecture and Validation of a New GNSS Multi Constellation Simulator : NAVYS” by G. Artaud, A. de Latour, J. Dantepal, L. Ries, J.-L. Issler, J. Tournay, O. Fudulea, J.-M. Aymes, N. Maury, J.-P. Julien , V. Dominguez, E. Senant, and M. Raimondi in  Proceedings of ION GPS 2009, the 22nd International Technical Meeting of the Satellite Division of The Institute of Navigation, Savannah, Georgia, September 22–25, 2009, pp. 2934–2941.

INNOVATION INSIGHTS with Richard Langley

IT’S NOT JUST FOR POSITIONING, NAVIGATION, AND TIMING. Many people do not realize that GPS is being used in a variety of ways in addition to those of its primary mandate, which is to provide accurate position, velocity, and time information.

The radio signals from the GPS satellites must traverse the Earth’s atmosphere on their way to receivers on or near the Earth’s surface. The signals interact with the atoms, molecules, and charged particles that make up the atmosphere, and the process slightly modifies the signals. It is these modified or perturbed signals that a receiver actually processes. And should a signal be reflected or diffracted by some object in the vicinity of the receiver’s antenna, the signal is further perturbed — a phenomenon we call multipath.

Now, these perturbations are a bit of a nuisance for conventional users of GPS. The atmospheric effects, if uncorrected, reduce the accuracy of the positions, velocities, and time information derived from the signals. However, GPS receivers have correction algorithms in their microprocessor firmware that attempt to correct for the effects. Multipath, on the other hand, is difficult to model although the use of sophisticated antennas and advanced receiver technologies can minimize its effect.

But there are some GPS users who welcome the multipath or atmospheric effects in the signals. By analyzing the fluctuations in signal-to-noise-ratio due to multipath, the characteristics of the reflector can be deduced. If the reflector is the ground, then the amount of moisture in the soil can be measured. And, in wintery climes, changes in snow depth can be tracked from the multipath in GPS signals.

The atmospheric effects perturbing GPS signals can be separated into those that are generated in the lower part of the atmosphere, mostly in the troposphere, and those generated in the upper, ionized part of the atmosphere — the ionosphere. Meteorologists are able to extract information on water vapor content in the troposphere and stratosphere from the measurements made by GPS receivers and regularly use the data from networks of ground-based continuously operating receivers and those operating on some Earth-orbiting satellites to improve weather forecasts.

And, thanks to its dispersive nature, the ionosphere can be studied by suitably combining the measurements made on the two legacy frequencies transmitted by all GPS satellites. Ground-based receiver networks can be used to map the electron content of the ionosphere, while Earth-orbiting receivers can profile electron density. Even small variations in the distribution of ionospheric electrons caused by earthquakes; tsunamis; and volcanic, meteorite, and nuclear explosions can be detected using GPS.

In this month’s column, I am joined by two of my graduate students, who report on an advance in the signal processing procedure for better monitoring of the ionosphere, potentially allowing scientists to get an even better handle on what’s going on above our heads.

Representation and forecast of the electron content within the ionosphere is now routinely accomplished using GPS measurements. The global distribution of permanent ground-based GPS tracking stations can effectively monitor the evolution of electron structures within the ionosphere, serving a multitude of purposes including satellite-based communication and navigation.

It has been recognized early on that GPS measurements could provide an accurate estimate of the total electron content (TEC) along a satellite-receiver path. However, because of their inherent nature, phase observations are biased by an unknown integer number of cycles and do not provide an absolute value of TEC. Code measurements (pseudoranges), although they are not ambiguous, also contain frequency-dependent biases, which again prevent a direct determination of TEC. The main advantage of code over phase is that the biases are satellite- and receiver-dependent, rather than arc-dependent. For this reason, the GPS community initially adopted, as a common practice, fitting the accurate TEC variation provided by phase measurements to the noisy code measurements, therefore removing the arc-dependent biases. Several variations of this process were developed over the years, such as phase leveling, code smoothing, and weighted carrier-phase leveling (see Further Reading for background literature).

The main challenge at this point is to separate the code inter-frequency biases (IFBs) from the line-of-sight TEC. Since both terms are linearly dependent, a mathematical representation of the TEC is usually required to obtain an estimate of each quantity. Misspecifications in the model and mapping functions were found to contribute significantly to errors in the IFB estimation, suggesting that this process would be better performed during nighttime when few ionospheric gradients are present. IFB estimation has been an ongoing research topic for the past two decades are still remains an issue for accurate TEC determination.

A particular concern with IFBs is the common assumption regarding their stability. It is often assumed that receiver IFBs are constant during the course of a day and that satellite IFBs are constant for a duration of a month or more. Studies have clearly demonstrated that intra-day variations of receiver instrumental biases exist, which could possibly be related to temperature effects. This assumption was shown to possibly introduce errors exceeding 5 TEC units (TECU) in the leveling process, where 1 TECU corresponds to 0.162 meters of code delay or carrier advance at the GPS L1 frequency (1575.42 MHz).

To overcome this limitation, one could look into using solely phase measurements in the TEC estimation process, and explicitly deal with the arc-dependent ambiguities. The main advantage of such a strategy is to avoid code-induced errors, but a larger number of parameters needs to be estimated, thereby weakening the strength of the adjustment. A comparison of the phase-only (arc-dependent) and phase-leveled (satellite-dependent) models showed that no model performs consistently better. It was found that the satellite-dependent model performs better at low-latitudes since the additional ambiguity parameters in the arc-dependent model can absorb some ionospheric features (such as gradients). On the other hand, when the mathematical representation of the ionosphere is realistic, the leveling errors may more significantly impact the accuracy of the approach.

The advent of precise point positioning (PPP) opened the door to new possibilities for slant TEC (STEC) determination. Indeed, PPP can be used to estimate undifferenced carrier-phase ambiguity parameters on L1  and L2, which can then be used to remove the ambiguous characteristics of the carrier-phase observations. To obtain undifferenced ambiguities free from ionospheric effects, researchers have either used the widelane/ionosphere-free (IF) combinations, or the Group and Phase Ionospheric Calibration (GRAPHIC) combinations. One critical problem with such approaches is that code biases propagate into the estimated ambiguity parameters. Therefore, the resulting TEC estimates are still biased by unknown quantities, and might suffer from the unstable datum provided by the IFBs.

The recent emergence of ambiguity resolution in PPP presented sophisticated means of handling instrumental biases to estimate integer ambiguity parameters. One such technique is the decoupled-clock method, which considers different clock parameters for the carrier-phase and code measurements. In this article, we present an “integer-leveling” method, based on the decoupled-clock model, which uses integer carrier-phase ambiguities obtained through PPP to level the carrier-phase observations.

Standard Leveling Procedure

This section briefly reviews the basic GPS functional model, as well as the observables usually used in ionospheric studies. A common leveling procedure is also presented, since it will serve as a basis for assessing the performance of our new method.

Ionospheric Observables. The standard GPS functional model of dual-frequency carrier-phase and code observations can be expressed as:

   (1)

    (2)

   (3)

   (4)

where Φ_i ^j is the carrier-phase measurement to satellite j on the L_i link and, similarly, P_i ^j is the code measurement on L_i. The term  is the biased ionosphere-free range between the satellite and receiver, which can be decomposed as:

   (5)

The instantaneous geometric range between the satellite and receiver antenna phase centers is ρ ^j. The receiver and satellite clock errors, respectively expressed as dT and dt^j, are expressed here in units of meters. The term T^j stands for the tropospheric delay, while the ionospheric delay on L1 is represented by I ^j and is scaled by the frequency-dependent constant μ for L2, where . The biased carrier-phase ambiguities are symbolized by  and are scaled by their respective wavelengths (λⁱ). The ambiguities can be explicitly written as:

   (6)

where N_i ^j is the integer ambiguity, b_i is a receiver-dependent bias, and b_i ^j is a satellite-dependent bias. Similarly, B_i and B_i ^j are instrumental biases associated with code measurements. Finally, ε contains unmodeled quantities such as noise and multipath, specific to the observable. The overbar symbol indicates biased quantities.

In ionospheric studies, the geometry-free (GF) signal combinations are formed to virtually eliminate non-dispersive terms and thus provide a better handle on the quantity of interest:

   (7)

   (8)

where IFB_r and IFB ^j represent the code inter-frequency biases for the receiver and satellite, respectively. They are also commonly referred to as differential code biases (DCBs). Note that the noise terms (ε) are neglected in these equations for the sake of simplicity.

Weighted-Leveling Procedure. As pointed out in the introduction, the ionospheric observables of Equations (7) and (8) do not provide an absolute level of ionospheric delay due to instrumental biases contained in the measurements. Assuming that these biases do not vary significantly in time, the difference between the phase and code observations for a particular satellite pass should be a constant value (provided that no cycle slip occurred in the phase measurements). The leveling process consists of removing this constant from each geometry-free phase observation in a satellite-receiver arc:

   (9)

where the summation is performed for all observations forming the arc. An elevation-angle-dependent weight (w) can also be applied to minimize the noise and multipath contribution for measurements made at low elevation angles. The double-bar symbol indicates leveled observations.

Integer-Leveling Procedure

The procedure of fitting a carrier-phase arc to code observations might introduce errors caused by code noise, multipath, or intra-day code-bias variations. Hence, developing a leveling approach that relies solely on carrier-phase observations is highly desirable. Such an approach is now possible with the recent developments in PPP, allowing for ambiguity resolution on undifferenced observations. This procedure has gained significant momentum in the past few years, with several organizations generating “integer clocks” or fractional offset corrections for recovering the integer nature of the undifferenced ambiguities. Among those organizations are, in alphabetical order, the Centre National d’Études Spatiale; GeoForschungsZentrum; GPS Solutions, Inc.; Jet Propulsion Laboratory; Natural Resources Canada (NRCan); and Trimble Navigation. With ongoing research to improve convergence time, it would be no surprise if PPP with ambiguity resolution would become the de facto methodology for processing data on a station-by-station basis. The results presented in this article are based on the products generated at NRCan, referred to as “decoupled clocks.”

The idea behind integer leveling is to introduce integer ambiguity parameters on L1 and L2, obtained through PPP processing, into the geometry-free linear combination of Equation (7). The resulting integer-leveled observations, in units of meters, can then be expressed as:
   (10)
where  and  are the ambiguities obtained from the PPP solution, which should be, preferably, integer values. Since those ambiguities are obtained with respect to a somewhat arbitrary ambiguity datum, they do not allow instant recovery of an unbiased slant ionospheric delay. This fact was highlighted in Equation (10), which indicates that, even though the arc-dependency was removed from the geometry-free combination, there are still receiver- and satellite-dependent biases (b_r and b ^j, respectively) remaining in the integer-leveled observations. The latter are thus very similar in nature to the standard-leveled observations, in the sense that the biases b_r and b ^j replace the well-known IFBs. As a consequence, integer-leveled observations can be used with any existing software used for the generation of TEC maps. The motivation behind using integer-leveled observations is the mitigation of leveling errors, as explained in the next sections.

Slant TEC Evaluation

As a first step towards assessing the performance of integer-leveled observations, STEC values are derived on a station-by-station basis. The slant ionospheric delays are then compared for a pair of co-located receivers, as well as with global ionospheric maps (GIMs) produced by the International GNSS Service (IGS).

Leveling Error Analysis. Relative leveling errors between two co-located stations can be obtained by computing between-station differences of leveled observations:

   (11)

where subscripts A and B identify the stations involved, and ε_l is the leveling error. Since the distance between stations is short (within 100 meters, say), the ionospheric delays will cancel, and so will the satellite biases (b ^j) which are observed at both stations. The remaining quantities will be the (presumably constant) receiver biases and any leveling errors. Since there are no satellite-dependent quantities in Equation (11), the differenced observations obtained should be identical for all satellites observed, provided that there are no leveling errors. The same principles apply to observations leveled using other techniques discussed in the introduction. Hence, Equation (11) allows comparison of the performance of various leveling approaches.

This methodology has been applied to a baseline of approximately a couple of meters in length between stations WTZJ and WTZZ, in Wettzell, Germany. The observations of both stations from March 2, 2008, were leveled using a standard leveling approach, as well as the method described in this article. Relative leveling errors computed using Equation (11) are displayed in Figure 1, where each color represents a different satellite. It is clear that code noise and multipath do not necessarily average out over the course of an arc, leading to leveling errors sometimes exceeding a couple of TECU for the standard leveling approach (see panel (a)). On the other hand, integer-leveled observations agree fairly well between stations, where leveling errors were mostly eliminated. In one instance, at the beginning of the session, ambiguity resolution failed at both stations for satellite PRN 18, leading to a relative error of 1.5 TECU, more or less. Still, the advantages associated with integer leveling should be obvious since the relative error of the standard approach is in the vicinity of -6 TECU for this satellite.

FIGURE 1. Relative leveling errors between stations WTZJ and WTZZ on March 2, 2008: (a) standard-leveled observations and (b) integer-leveled observations.

The magnitude of the leveling errors obtained for the standard approach agrees fairly well with previous studies (see Further Reading). In the event that intra-day variations of the receiver IFBs are observed, even more significant biases were found to contaminate standard-leveled observations. Since the decoupled-clock model used for ambiguity resolution explicitly accounts for possible variations of any equipment delays, the estimated ambiguities are not affected by such effects, leading to improved leveled observations.

STEC Comparisons. Once leveled observations are available, the next step consists of separating STEC from instrumental delays. This task can be accomplished on a station-by-station basis using, for example, the single-layer ionospheric model. Replacing the slant ionospheric delays (I ^j) in Equation (10) by a bilinear polynomial expansion of VTEC leads to:

    (12)

where M(e) is the single-layer mapping function (or obliquity factor) depending on the elevation angle (e) of the satellite. The time-dependent coefficients a₀, a₁, and a₂ determine the mathematical representation of the VTEC above the station. Gradients are modeled using Δλ, the difference between the longitude of the ionospheric pierce point and the longitude of the mean sun, and Δϕ, the difference between the geomagnetic latitude of the ionospheric pierce point and the geomagnetic latitude of the station. The estimation procedure described by Attila Komjathy (see Further Reading) is followed in all subsequent tests. An elevation angle cutoff of 10 degrees was applied and the shell height used was 450 kilometers. Since it is not possible to obtain absolute values for the satellite and receiver biases, the sum of all satellite biases was constrained to a value of zero. As a consequence, all estimated biases will contain a common (unknown) offset. STEC values, in TECU, can then be computed as:

     (13)

where the hat symbol denotes estimated quantities, and  is equal to zero (that is, it is not estimated) when biases are obtained on a station-by-station basis. The frequency, f₁, is expressed in Hz. The numerical constant 40.3, determined from values of fundamental physical constants, is sufficiently precise for our purposes, but is a rounding of the more precise value of 40.308.

While integer-leveled observations from co-located stations show good agreement, an external TEC source is required to make sure that both stations are not affected by common errors. For this purpose, Figure 2 compares STEC values computed from GIMs produced by the IGS and STEC values derived from station WTZJ using both standard- and integer-leveled observations. The IGS claims root-mean-square errors on the order of 2-8 TECU for vertical TEC, although the ionosphere was quiet on the day selected, meaning that errors at the low-end of that range are expected. Errors associated with the mapping function will further contribute to differences in STEC values. As apparent from Figure 2, no significant bias can be identified in integer-leveled observations. On the other hand, negative STEC values (not displayed in Figure 2) were obtained during nighttimes when using standard-leveled observations, a clear indication that leveling errors contaminated the observations.

FIGURE 2. Comparison between STEC values obtained from a global ionospheric map and those from station WTZJ using standard- and integer-leveled observations.

STEC Evaluation in the Positioning Domain. Validation of slant ionospheric delays can also be performed in the positioning domain. For this purpose, a station’s coordinates from processing the observations in static mode (that is, one set of coordinates estimated per session) are estimated using (unsmoothed) single-frequency code observations with precise orbit and clock corrections from the IGS and various ionosphere-correction sources. Figure 3 illustrates the convergence of the 3D position error for station WTZZ, using STEC corrections from the three sources introduced previously, namely: 1) GIMs from the IGS, 2) STEC values from station WTZJ derived from standard leveling, and 3) STEC values from station WTZJ derived from integer leveling. The reference coordinates were obtained from static processing based on dual-frequency carrier-phase and code observations. The benefits of the integer-leveled corrections are obvious, with the solution converging to better than 10 centimeters. Even though the distance between the stations is short, using standard-leveled observations from WTZJ leads to a biased solution as a result of arc-dependent leveling errors. Using a TEC map from the IGS provides a decent solution considering that it is a global model, although the solution is again biased.

FIGURE 3. Single-frequency code-based positioning results for station WTZZ (in static mode) using different ionosphere-correction sources: GIM and STEC values from station WTZJ using standard- and integer-leveled observations.

This station-level analysis allowed us to confirm that integer-leveled observations can seemingly eliminate leveling errors, provided that carrier-phase ambiguities are fixed to proper integer values. Furthermore, it is possible to retrieve unbiased STEC values from those observations by using common techniques for isolating instrumental delays. The next step consisted of examining the impacts of reducing leveling errors on VTEC.

VTEC Evaluation

When using the single-layer ionospheric model, vertical TEC values can be derived from the STEC values of Equation (13) using:

    (14)

Dividing STEC by the mapping function will also reduce any bias caused by the leveling procedure. Hence, measures of VTEC made from a satellite at a low elevation angle will be less impacted by leveling errors. When the satellite reaches the zenith, then any bias in the observation will fully propagate into the computed VTEC values. On the other hand, the uncertainty of the mapping function is larger at low-elevation angles, which should be kept in mind when analyzing the results.

Using data from a small regional network allows us to assess the compatibility of the VTEC quantities between stations. For this purpose, GPS data collected as a part of the Western Canada Deformation Array (WCDA) network, still from March 2, 2008, was used. The stations of this network, located on and near Vancouver Island in Canada, are indicated in Figure 4. Following the model of Equation (12), all stations were integrated into a single adjustment to estimate receiver and satellite biases as well as a triplet of time-varying coefficients for each station. STEC values were then computed using Equation (13), and VTEC values were finally derived from Equation (14). This procedure was again implemented for both standard- and integer-leveled observations.

FIGURE 4. Network of stations used in the VTEC evaluation procedures.

To facilitate the comparison of VTEC values spanning a whole day and to account for ionospheric gradients, differences with respect to the IGS GIM were computed. The results, plotted by elevation angle, are displayed in Figure 5 for all seven stations processed (all satellite arcs from the same station are plotted using the same color). The overall agreement between the global model and the station-derived VTECs is fairly good, with a bias of about 1 TECU. Still, the top panel demonstrates that, at high elevation angles, discrepancies between VTEC values derived from standard-leveled observations and the ones obtained from the model have a spread of nearly 6 TECU. With integer-leveled observations (see bottom panel), this spread is reduced to approximately 2 TECU. It is important to realize that the dispersion can be explained by several factors, such as remaining leveling errors, the inexact receiver and satellite bias estimates, and inaccuracies of the global model. It is nonetheless expected that leveling errors account for the most significant part of this error for standard-leveled observations.

For satellites observed at a lower elevation angle, the spread between arcs is similar for both methods (except for station UCLU in panel (a) for which the estimated station IFB parameter looks significantly biased). As stated previously, the reason is that leveling errors are reduced when divided by the mapping function. The latter also introduces further errors in the comparisons, which explains why a wider spread should typically be associated with low-elevation-angle satellites. Nevertheless, it should be clear from Figure 5 that integer-leveled observations offer a better consistency than standard-leveled observations.

FIGURE 5. VTEC differences, with respect to the IGS GIM, for all satellite arcs as a function of the elevation angle of the satellite, using (a) standard-leveled observations and (b) integer-leveled observations.

Conclusion

The technique of integer leveling consists of introducing (preferably) integer ambiguity parameters obtained from PPP into the geometry-free combination of observations. This process removes the arc dependency of the signals, and allows integer-leveled observations to be used with any existing TEC estimation software. While leveling errors of a few TECU exist with current procedures, this type of error can be eliminated through use of our procedure, provided that carrier-phase ambiguities are fixed to the proper integer values. As a consequence, STEC values derived from nearby stations are typically more consistent with each other. Unfortunately, subsequent steps involved in generating VTEC maps, such as transforming STEC to VTEC and interpolating VTEC values between stations, attenuate the benefits of using integer-leveled observations.

There are still ongoing challenges associated with the GIM-generation process, particularly in terms of latency and three-dimensional modeling. Since ambiguity resolution in PPP can be achieved in real time, we believe that integer-leveled observations could benefit near-real-time ionosphere monitoring. Since ambiguity parameters are constant for a satellite pass (provided that there are no cycle slips), integer ambiguity values (that is, the leveling information) can be carried over from one map generation process to the next. Therefore, this methodology could reduce leveling errors associated with short arcs, for instance.

Another prospective benefit of integer-leveled observations is the reduction of leveling errors contaminating data from low-Earth-orbit (LEO) satellites, which is of particular importance for three-dimensional TEC modeling. Due to their low orbits, LEO satellites typically track a GPS satellite for a short period of time. As a consequence, those short arcs do not allow code noise and multipath to average out, potentially leading to important leveling errors. On the other hand, undifferenced ambiguity fixing for LEO satellites already has been demonstrated, and could be a viable solution to this problem.

Evidently, more research needs to be conducted to fully assess the benefits of integer-leveled observations. Still, we think that the results shown herein are encouraging and offer potential solutions to current challenges associated with ionosphere monitoring.

Acknowledgments

We would like to acknowledge the help of Paul Collins from NRCan in producing Figure 4 and the financial contribution of the Natural Sciences and Engineering Research Council of Canada in supporting the second and third authors. This article is based on two conference papers: “Defining the Basis of an ‘Integer-Levelling’ Procedure for Estimating Slant Total Electron Content” presented at ION GNSS 2011 and “Ionospheric Monitoring Using ‘Integer-Levelled’ Observations” presented at ION GNSS 2012. ION GNSS 2011 and 2012 were the 24th and 25th International Technical Meetings of the Satellite Division of The Institute of Navigation, respectively. ION GNSS 2011 was held in Portland, Oregon, September 19–23, 2011, while ION GNSS 2012 was held in Nashville, Tennessee, September 17–21, 2012.

SIMON BANVILLE is a Ph.D. candidate in the Department of Geodesy and Geomatics Engineering at the University of New Brunswick (UNB) under the supervision of Dr. Richard B. Langley. His research topic is the detection and correction of cycle slips in GNSS observations. He also works for Natural Resources Canada on real-time precise point positioning and ambiguity resolution.

WEI ZHANG received his M.Sc. degree (2009) in space science from the School of Earth and Space Science of Peking University, China. He is currently an M.Sc.E. student in the Department of Geodesy and Geomatics Engineering at UNB under the supervision of Dr. Langley. His research topic is the assessment of three-dimensional regional ionosphere tomographic models using GNSS measurements.

FURTHER READING

• Authors’ Conference Papers

“Defining the Basis of an ‘Integer-Levelling’ Procedure for Estimating Slant Total Electron Content” by S. Banville and R.B. Langley in Proceedings of ION GNSS 2011, the 24th International Technical Meeting of the Satellite Division of The Institute of Navigation, Portland, Oregon, September 19–23, 2011, pp. 2542–2551.

“Ionospheric Monitoring Using ‘Integer-Levelled’ Observations” by S. Banville, W. Zhang, R. Ghoddousi-Fard, and R.B. Langley in Proceedings of ION GNSS 2012, the 25th International Technical Meeting of the Satellite Division of The Institute of Navigation, Nashville, Tennessee, September 17–21, 2012, pp. 3753–3761.

• Errors in GPS-Derived Slant Total Electron Content

“GPS Slant Total Electron Content Accuracy Using the Single Layer Model Under Different Geomagnetic Regions and Ionospheric Conditions” by C. Brunini, and F.J. Azpilicueta in Journal of Geodesy, Vol. 84, No. 5, pp. 293–304, 2010, doi: 10.1007/s00190-010-0367-5.

“Calibration Errors on Experimental Slant Total Electron Content (TEC) Determined with GPS” by L. Ciraolo, F. Azpilicueta, C. Brunini, A. Meza, and S.M. Radicella in Journal of Geodesy, Vol. 81, No. 2, pp. 111–120, 2007, doi: 10.1007/s00190-006-0093-1.

• Global Ionospheric Maps

“The IGS VTEC Maps: A Reliable Source of Ionospheric Information Since 1998” by M. Hernández-Pajares, J.M. Juan, J. Sanz, R. Orus, A. Garcia-Rigo, J. Feltens, A. Komjathy, S.C. Schaer, and A. Krankowski in Journal of Geodesy, Vol. 83, No. 3–4, 2009, pp. 263–275, doi: 10.1007/s00190-008-0266-1.

• Ionospheric Effects on GNSS

“GNSS and the Ionosphere: What’s in Store for the Next Solar Maximum” by A.B.O. Jensen and C. Mitchell in GPS World, Vol. 22, No. 2, February 2011, pp. 40–48.

“Space Weather: Monitoring the Ionosphere with GPS” by A. Coster, J. Foster, and P. Erickson in GPS World, Vol. 14, No. 5, May 2003, pp. 42–49.

“GPS, the Ionosphere, and the Solar Maximum” by R.B. Langley in GPS World, Vol. 11, No. 7, July 2000, pp. 44–49.

Global Ionospheric Total Electron Content Mapping Using the Global Positioning System by A. Komjathy, Ph. D. dissertation, Technical Report No. 188, Department of Geodesy and Geomatics Engineering, University of New Brunswick, Fredericton, New Brunswick, Canada, 1997.

• Decoupled Clock Model

“Undifferenced GPS Ambiguity Resolution Using the Decoupled Clock Model and Ambiguity Datum Fixing” by P. Collins, S. Bisnath, F. Lahaye, and P. Héroux in  Navigation: Journal of The Institute of Navigation, Vol. 57, No. 2, Summer 2010, pp. 123–135.

While most receivers were just tracking GLONASS 743, some tracked both GLONASS 743 and 701K. While 701K was not in the broadcast almanac, it was transmitting ephemeris records identifying itself as a satellite in slot 8. The net result was that RINEX observation files from certain stations had a mixture of GLONASS 743 and 701K data, with no indication of which satellite was which. Of course, one could use expected Doppler shift and/or code/carrier rate of change to figure out which data records correspond to which satellite.

Furthermore, the GLONASS navigation files from certain stations contained a mixture of ephemeris records from GLONASS 743 and 701K. For day 54, for example, GLONASS navigation files for 146 (non-MGEX) stations were available at CDDIS. A number of these did not contain any R08 entries, presumably because the corresponding receivers were set to not track unhealthy satellites. Some of the files contained R08 ephemeris records from earlier dates. These were ignored.

This left 82 files containing either GLONASS 701K and/or 743 ephemeris records for day 54. These files were parsed to determine, for each file, for which times ephemeris records were available for which satellites. The results are summarized in the following plot (PDF available):

The station numbers correspond to those in this table.

The navigation files from 29 stations contain both GLONASS 701K and 743 records. It seems that JAVAD GNSS and Topcon receivers were primarily affected.

Note that the CDDIS brdc***0.13g files on affected days have a mixture of GLONASS 743 and 701K ephemeris records, but at any one epoch, only one satellite is represented.

Files from days 53 through 56 are affected.

It appears that GLONASS 701K stopped identifying itself as a slot 8 satellite after about 15:15 GPS Time on day 56 and was not subsequently tracked by any station supplying data files to CDDIS.

See also IGSMail-6734, “Irregular GLONASS constellation change (for R08).

By analyzing the signals from GPS satellites collected at ground-based monitoring stations in South Korea and Japan, scientists at the California Institute of Technology’s Jet Propulsion Laboratory, Purdue University, and the Korea Advanced Institute of Science and Technology independently confirmed the ionospheric disturbance generated by the North Korean test.

The researchers used the same GPS signals that are used by surveyors for precise positioning. These signals are slightly perturbed as they transit the ionosphere, and by processing the collected data with sophisticated software, the researchers were able to detect the small effect that the explosion-induced atmospheric waves had on the distribution of the ionosphere’s electrons.

The same technique is being used by the researchers and others to study the ionospheric effects from natural hazards such as tsunamis, earthquakes, and volcanic eruptions.

A team from The Ohio State University and Miami University are engaged in a similar project.

According to tracking data from NORAD/JSpOC, GLONASS 743 experienced a delta-V maneuver on or about February 12 as it approached its new orbital position at Slot 8 in Plane 1.

Note that GLONASS 743 is not currently in service but will likely rejoin the active constellation once the move is completed, replacing GLONASS 701K in the broadcast almanac.

Although GLONASS 701K, the test GLONASS K1 satellite, is currently transmitting on frequency channel -5, it continues to be set unhealthy in the almanac.

INNOVATION INSIGHTS with Richard Langley

THE ANTENNA IS A CRITICAL COMPONENT OF ANY GNSS RECEIVING EQUIPMENT. It must be carefully designed for the frequencies and structures of the signals to be acquired and tracked. Important antenna properties include polarization, frequency coverage, phase-center stability, multipath suppression, the antenna’s impact on receiver sensitivity, reception or gain pattern, and interference handling. While all of these affect an antenna’s performance, let’s just look at the last two here.

The gain pattern of an antenna is the spatial variation of the gain, or ratio of the power delivered by the antenna for a signal arriving from a particular direction compared to that delivered by a hypothetical isotropic reference antenna. Typically, for GNSS antennas, the reference antenna is also circularly polarized and the gain is then expressed in dBic units.

An antenna may have a gain pattern with a narrow central lobe or beam if it is used for communications between two fixed locations or if the antenna can be physically steered to point in the direction of a particular transmitter. GNSS signals, however, arrive from many directions simultaneously, and so most GNSS receiving antennas tend to be omni-directional in azimuth with a gain roll-off from the antenna boresight to the horizon.

While such an antenna is satisfactory for many applications, it is susceptible to accidental or deliberate interference from signals arriving from directions other than those of GNSS signals. Interference effects could be minimized if the gain pattern could be adjusted to null-out the interfering signals or to peak the gain in the directions of all legitimate signals. Such a controlled-reception-pattern antenna (CRPA) can be constructed using an array of antenna elements, each one being a patch antenna, say, with the signals from the elements combined before feeding them to the receiver. The gain pattern of the array can then be manipulated by electronically adjusting the phase relationship between the elements before the signals are combined. However, an alternative approach is to feed the signals from each element to separate banks of tracking channels in the receiver and form a beam-steering vector based on the double-difference carrier-phase measurements from pairs of elements that is subsequently used to weight the signals from the elements before they are processed to obtain a position solution. In this month’s column, we learn how commercial off-the-shelf antennas and a software-defined receiver can be used to design and test such CRPA arrays.

“Innovation” features discussions about advances in GPS technology, its applications, and the fundamentals of GPS positioning. The column is coordinated by Richard Langley, Department of Geodesy and Geomatics Engineering, University of New Brunswick. To contact him with topic ideas, email him at lang @ unb.ca.

Signals from global navigation satellite systems are relatively weak and thus vulnerable to deliberate or unintentional interference. An electronically steered antenna array system provides an effective approach to mitigate interference by controlling the reception pattern and steering the system’s beams or nulls. As a result, so-called controlled-reception-pattern-antenna (CRPA) arrays have been deployed by organizations such as the U.S. Department of Defense, which seeks high levels of interference rejection.

Our efforts have focused on developing a commercially viable CRPA system using commercial off-the-shelf (COTS) components to support the needs of Federal Aviation Administration (FAA) alternative position navigation and timing (APNT) efforts. In 2010, we implemented a seven-element, two-bit-resolution, single-beam and real-time CRPA software receiver. In 2011, the receiver was upgraded to support all-in-view, 16-bit-resolution with four elements.

Even though we can implement these CRPA software receivers in real time, the performance of anti-interference is highly dependent on the antenna array layout and characteristics of the antenna elements. Our beamforming approach allows us to use several COTS antennas as an array rather than a custom-designed and fully calibrated antenna. The use of COTS antennas is important, as the goal of our effort is to develop a CRPA for commercial endeavors — specifically for robust timing for the national airspace. Hence, it is important to study the geometry layout of the individual antennas of the array to assess the layouts and to determine how antenna performance affects the array’s use.

In our work, we have developed a procedure for calculating the electrical layouts of an antenna array by differential carrier-phase positioning. When compared to the physical layout, the results of electrical layouts can be used to determine the mutual coupling effect of each combination. Using the electrical layout, the resultant gain patterns can be calculated and used to see the beamwidth and the side-lobe issue. This is important as these factors have significant effects on anti-interference performance. This study focuses on understanding the performance effects of geometry and developing a method for describing the best geometry.

We adopted three models of COTS antenna and two possible layouts for a four-element array. Then, signal collection hardware consisting of four Universal Software Radio Peripheral (USRP) software-defined radios and one host personal computer was assembled to collect array data sets for each layout/antenna combination. Our developed CRPA software receiver was used to process all data sets and output carrier-phase measurements.

In this article, we will present the pattern analysis for the two selected layouts and describe how we collected the experimental data. We’ll then show the results of calculating the electrical spacing for the layouts are compare them to the physical layouts. Lastly, we’ll show the resulting patterns, discuss the antenna mutual coupling effects, and give our conclusions.

Antenna Array Pattern Analysis

Pattern is defined as the directional strength of a radio-frequency signal viewed from the antenna. The pattern of an antenna array is the product of the isotropic array factor and the isolated element pattern. We assume that the pattern of each element is identical and only consider the isotropic array factor. FIGURE 1 shows the coordination of an antenna array. The first element is set as a reference position. The x-axis is the east direction, the y-axis is the north direction, and the z-axis is the up direction. The baseline vector of the ith antenna is given by and  is the unit vector to the satellite.

Figure 1. Antenna array geometry and direction of satellite. Array elements are identified as E#1, E#2, E#3, and E#4.

The isotropic array factor is given by

   (1)

where λ is wavelength, and A_i is a complex constant. Currently, we only implement a four-element-array CRPA software receiver in real time. Hence, we analyze two kinds of layout of half-wavelength four-element arrays: a symmetrical Y array and a square array. Each antenna is separated from its nearest neighbor by a half wavelength. FIGURE 2 shows photos of the two layouts. FIGURE 3 shows the physical layouts.

Figure 2. Photos of antenna arrays (left: Y array; right: square array).

Figure 3A. Physical layout of antenna arrays (Y array).

Figure 3B. Physical layout of antenna arrays (square array).

The antenna patterns towards an elevation angle of 90 degrees, computed using equation 1 and the design layouts, are shown in FIGURE 4. One of the key characteristics of a pattern is the beamwidth, which is defined as the angle with 3-dB loss. FIGURE 5 shows the patterns in elevation angle where the beamwidth of the Y layout is 74 degrees and 86 degrees for the square layout. A narrow beamwidth will benefit anti-interference performance particularly if the interference is close to the direction of a target satellite.

Figure 4. Patterns of antenna arrays (left: Y array; right: square array).

Figure 5. Pattern beamwidths of Y and square arrays (3 dB beamwidth shown).

Specifications of COTS Antennas

Typically, the COTS antenna selection is determined by high gain and great out-of-band rejection. TABLE 1 shows the specifications of the three antenna models used in this article. These antennas are all patch antennas. The antennas are equipped with surface-acoustic-wave filters for rejecting out-of-band signals. A three-stage low noise amplifier with over 30 dB gain is also embedded in each antenna.

Table 1. Specifications of COTS antennas used.

Signal Collection Hardware and Experimental Setup

The hardware used to collect the antenna array datasets is shown in FIGURE 6 with block-diagram representation in FIGURE 7. The hardware includes a four-element antenna array, four USRP2 software radio systems and one host computer. The signal received from the COTS antenna passes to a USRP2 board equipped with a 800–2300 MHz DBSRX2 programmable mixing and down-conversion daughterboard. The individual USRP2 boards are synchronized by a 10-MHz external common clock generator and a pulse-per-second (PPS) signal. The USRP2s are controlled by the host computer running the Ubuntu distribution of Linux. The open-source GNU Radio software-defined radio block is used to configure USRP2s and collect datasets. All USRP2s are configured to collect the L1 (1575.42 MHz) signal. The signals are converted to near zero intermediate frequency (IF) and digitized to 14-bit complex outputs (I and Q).

Figure 6. Photo of the signal collection hardware.

Figure 7. Block diagram of the signal collection hardware.

The sampling rate is set as 4 MHz. The host computer uses two solid state drives for storing data sets. For our study, a 64-megabytes per second data transfer rate is needed. The fast solid state drives are especially useful when using high bandwidth signals such as L5, which will require an even higher data streaming rate (80 megabytes per second per channel).

To compare the physical and electrical layouts of the antenna arrays, we set up the signal collection hardware to record six data sets for the two layouts and the three antenna models as shown in TABLE 2. All of the data sets were five minutes long to obtain enough carrier-phase measurements for positioning.

Table 2. Experimental setups.

Logging Carrier-Phase Measurements

To calculate the precise spacing between the antenna elements, hundreds of seconds of carrier-phase measurements from each element are needed. The collected data sets were provided by our in-house-developed CRPA software receiver. The receiver was developed using Visual Studio under Windows. Most of source code is programmed using C++. Assembly language is used to program the functions with high computational complexity such as correlation operations. The software architecture of the receiver is depicted in FIGURE 8. This architecture exploits four sets of 12 tracking channels in parallel to process each IF signal from an antenna element. Each channel is dedicated to tracking the signal of a single satellite. The tracking channels output carrier-phase measurements to build the steering vectors for each satellite. The Minimum Variance Distortionless Response (MVDR) algorithm was adopted for adaptively calculating the weights for beamforming. Here, there are 12 weight sets, one for each satellite in a tracking channel, for the desired directions of satellites.

Figure 8. Block diagram of the software architecture.

Using the pre-correlation beamforming approach, the weights are multiplied with IF data and summed over all elements to form 12 composite signals. These signals are then processed by composite tracking channels. Finally, positioning is performed if pseudoranges and navigation messages are obtained from these channels. FIGURE 9 is the graphical user interface (GUI) of the CRPA software receiver. It consists of the channel status of all channels, carrier-phase differences, positioning results, an east-north (EN) plot, a sky plot, a carrier-to-noise-density (C/N₀) plot and the gain patterns of the array for each tracked satellite. In the figure, the CRPA software receiver is tracking 10 satellites and its positioning history is shown in the EN plot. The beamforming channels have about 6 dB more gain in C/N₀ than the channels of a single element. In each pattern, the direction with highest gain corresponds to the direction of the satellite. While the CRPA software receiver is running, the carrier-phase measurements of all elements and the azimuth and elevation angle of the satellites are logged every 100 milliseconds. Each data set in Table 2 was processed by the software receiver to log the data.

Figure 9. Screenshot of the controlled-reception-pattern-antenna software-receiver graphical user interface.

Electrical Layout of Antenna Array – Procedure

The procedure of calculating the electrical layout of an antenna array is depicted in FIGURE 10. The single-difference integrated carrier phase (ICP) between the signals of an element, i, and a reference element, j, is represented as:

   (2)

where r^k_ij is differential range toward the kth satellite between the ith and jth antenna elements (a function of the baseline vector between the ith and jth elements), δL_ij is the cable-length difference between the ith and jth antenna elements, N^k_ij is the integer associated with Φ^k_ij , ε^k_ij and  is the phase error. The double-difference ICP between the kth satellite and reference satellite l is represented as:
   (3)

The cable-length difference term is subtracted in the double difference. Since the distances between the antenna elements are close to one wavelength, equation (3) can be written as:
   (4)

where  is the unit vector to satellite k, p_ij is the baseline vector between the ith and jth elements. By combining all the double-difference measurements of the ijth pair of elements, the observations equation can be represented as:
      (5)

From the positioning results of composite channels, the azimuth and elevation angle of satellites are used to manipulate matrix G. To solve equation (5), the LAMBDA method was adopted to give the integer vector N. Then, p_ij  is solved by substituting N into equation (5). Finally, the cable-length differences are obtained by substituting the solutions of N and p_ij into equation (2).

This approach averages the array pattern across all satellite measurements observed during the calibration period.

Figure 10. Procedure for calculating antenna-array electrical spacing.

Electrical Layout of Antenna Array – Results

Using the procedure in the previous section, all electrical layouts of the antenna array were calculated and are shown in FIGURES 11 and 12. We aligned the vectors from element #1 to element #2 for all layouts. TABLE 3 lists the total differences between the physical and electrical layouts. For the same model of antenna, the Y layout has less difference than the square layout. And, in terms of antenna model, antenna #1 has the least difference for both Y and square layouts. We could conclude that the mutual coupling effect of the Y layout is less than that of the square layout, and that antenna #1 has the smallest mutual coupling effect among all three models of antenna for these particular elements and observations utilized.

Figure 11. Results of electrical layout using three models of antenna compared to the physical layout for the Y array.

Figure 12. Results of electrical layout using three models of antenna compared to physical layout for the square array.

Table 3. Total differences between physical and electrical layouts.

To compare the patterns of all calculated electrical layouts, we selected two specific directions: an elevation angle of 90 degrees and a target satellite, WAAS GEO PRN138, which was available for all data sets. The results are shown in FIGURES 13 and 14, respectively. From Figure 13, the beamwidth of the Y layout is narrower than that of the square layout for all antenna models. When compared to Figure 5, this result confirms the validity of our analysis approach. But, in Figure 14, a strong sidelobe appears at azimuth -60º in the pattern of Y layout for antenna #2. If there is some interference located in this direction, the anti-interference performance of the array will be limited. This is due to a high mutual coupling effect of antenna #2 and only can be seen after calculating the electrical layout.

Figure 13. Patterns of three models of antenna and two layouts toward an elevation angle of 90 degrees.

Figure 14. Patterns of three models of antenna and two layouts toward the WAAS GEO satellite PRN138.

Conclusions

The results of our electrical layout experiment show that the Y layout has a smaller difference with respect to the physical layout than the square layout. That implies that the elements of the Y layout have less mutual coupling. For the antenna selection, arrays based on antenna model #1 showed the least difference between electrical and physical layout. And its pattern does not have a high grating lobe in a direction other than to the target satellite.

The hardware and methods used in this article can serve as a testing tool for any antenna array. Specifically, our methodology, which can be used to collect data, compare physical and electrical layouts, and assess resultant antenna gain patterns, allows us to compare the performances of different options and select the best antenna and layout combination. Results can be used to model mutual coupling and the overall effect of layout and antenna type on array gain pattern and overall CRPA capabilities. This procedure is especially important when using COTS antennas to assemble an antenna array and as we increase the number of antenna elements and the geometry possibilities of the array.

Acknowledgments

The authors gratefully acknowledge the work of Dr. Jiwon Seo in building the signal collection hardware. The authors also gratefully acknowledge the Federal Aviation Administration Cooperative Research and Development Agreement 08-G-007 for supporting this research. This article is based on the paper “A Study of Geometry and Commercial Off-The-Shelf (COTS) Antennas for Controlled Reception Pattern Antenna (CRPA) Arrays” presented at ION GNSS 2012, the 25th International Technical Meeting of the Satellite Division of The Institute of Navigation, held in Nashville, Tennessee, September 17–21, 2012.

Manufacturers

The antennas used to construct the arrays are Wi-Sys Communications Inc., now PCTEL, Inc. models WS3978 and WS3997 and PCTEL, Inc. model 3978D-HR. The equipment used to collect data sets includes Ettus Research LLC model USRP2 software-defined radios and associated DBSRX2 daughterboards.

Yu-Hsuan Chen is a postdoctoral scholar in the GNSS Research Laboratory at Stanford University, Stanford, California.

Sherman Lo is a senior research engineer at the Stanford GNSS Research Laboratory.

Dennis M. Akos is an associate professor with the Aerospace Engineering Science Department in the University of Colorado at Boulder with visiting appointments at Luleå Technical University, Sweden, and Stanford University.

David S. De Lorenzo is a principal research engineer at Polaris Wireless, Mountain View, California, and a consulting research associate to the Stanford GNSS Research Laboratory.

Per Enge is a professor of aeronautics and astronautics at Stanford University, where he is the Kleiner-Perkins Professor in the School of Engineering. He directs the GNSS Research Laboratory.

FURTHER READING

• Authors’ Publications

“A Study of Geometry and Commercial Off-The-Shelf (COTS) Antennas for Controlled Reception Pattern Antenna (CRPA) Arrays” by Y.-H. Chen in Proceedings of ION GNSS 2012, the 25th International Technical Meeting of The Institute of Navigation, Nashville, Tennessee, September 17–21, 2012, pp. 907–914 (ION Student Paper Award winner).

“A Real-Time Capable Software-Defined Receiver Using GPU for Adaptive Anti-Jam GPS Sensors” by J. Seo, Y.-H. Chen, D.S. De Lorenzo, S. Lo, P. Enge, D. Akos, and J. Lee in Sensors, Vol. 11, No. 9, 2011, pp. 8966–8991, doi: 10.3390/s110908966.

“Real-Time Software Receiver for GPS Controlled Reception Pattern Array Processing” by Y.-H. Chen, D.S. De Lorenzo, J. Seo, S. Lo, J.-C. Juang, P. Enge, and D.M. Akos in Proceedings of ION GNSS 2010, the 23rd International Technical Meeting of The Institute of Navigation, Portland, Oregon, September 21–24, 2010, pp. 1932–1941.

“A GNSS Software Receiver Approach for the Processing of Intermittent Data” by Y.-H. Chen and J.-C. Juang in Proceedings of ION GNSS 2007, the 20th International Technical Meeting of The Institute of Navigation, Fort Worth, Texas, September 25–28, 2007, pp. 2772–2777.

• Controlled-Reception-Pattern Antenna Arrays

“Anti-Jam Protection by Antenna: Conception, Realization, Evaluation of a Seven-Element GNSS CRPA” by F. Leveau, S. Boucher, E. Goron, and H. Lattard in GPS World, Vol. 24, No. 2, February 2013, pp. 30–33.

“Development of Robust Safety-of-Life Navigation Receivers” by M.V.T. Heckler, M. Cuntz, A. Konovaltsev, L.A. Greda, A. Dreher, and M. Meurer in IEEE Transactions on Microwave Theory and Techniques, Vol. 59, No. 4, April 2011, pp. 998–1005, doi: 10.1109/TMTT.2010.2103090.

Phased Array Antennas, 2nd Edition, by R. C. Hansen, published by John Wiley & Sons, Inc., Hoboken, New Jersey, 2009.

• Antenna Principles

“Selecting the Right GNSS Antenna” by G. Ryley in GPS World, Vol. 24, No. 2, February 2013, pp. 40–41 (in PDF of 2013 Antenna Survey.)

“GNSS Antennas: An Introduction to Bandwidth, Gain Pattern, Polarization, and All That” by G.J.K. Moernaut and D. Orban in GPS World, Vol. 20, No. 2, February 2009, pp. 42–48.

“A Primer on GPS Antennas” by R.B. Langley in GPS World, Vol. 9, No. 7, July 1998, pp. 50-54.

• Software-Defined Radios for GNSS

“A USRP2-based Reconfigurable Multi-constellation Multi-frequency GNSS Software Receiver Front End” by S. Peng and Y. Morton in GPS Solutions, Vol. 17, No. 1, January 2013, pp. 89-102.

“Software GNSS Receiver: An Answer for Precise Positioning Research” by T. Pany, N. Falk, B. Riedl, T. Hartmann, G. Stangl, and C. Stöber in GPS World, Vol. 23, No. 9, September 2012, pp. 60–66.

“Simulating GPS Signals: It Doesn’t Have to Be Expensive” by A. Brown, J. Redd, and M.-A. Hutton in GPS World, Vol. 23, No. 5, May 2012, pp. 44–50.

Digital Satellite Navigation and Geophysics: A Practical Guide with GNSS Signal Simulator and Receiver Laboratory by I.G. Petrovski and T. Tsujii with foreword by R.B. Langley, published by Cambridge University Press, Cambridge, U.K., 2012.

“A Real-Time Software Receiver for the GPS and Galileo L1 Signals” by B.M. Ledvina, M.L. Psiaki, T.E. Humphreys, S.P. Powell, and P.M. Kintner, Jr. in Proceedings of ION GNSS 2006, the 19th International Technical Meeting of The Institute of Navigation, Fort Worth, Texas, September 26–29, 2006, pp. 2321–2333.