Electric Propulsion (EP) is a class of space propulsion, which makes use of electrical power to accelerate a propellant by different possible electrical and/or magnetic means. The use of electrical power enhances the propulsive performances of the EP thrusters compared with conventional chemical thrusters. Unlike chemical systems, electric propulsion requires very little mass to accelerate a spacecraft. The propellant is ejected up to twenty times faster than from a classical chemical thruster and therefore the overall system is many times more mass efficient. Reduced propellant mass consumption can lead to lower mission costs and/or can allow embarking more experiments on satellites. Electric Propulsion is not limited in energy, but is only limited by the available electrical power on-board the spacecraft. Therefore EP is suitable for low-thrust (micro and milli-newton levels), long duration (high Isp) applications on board satellites. 

Typically, an Electric Propulsion system is composed of one or more electrical thrusters connected to their Power Processing Units (PPUs) and to a propellant storage and feeding system (including tanks, pressure regulators, flow control units, valves, etc.) and to pointing mechanisms. Figure 1 shows EP system architecture. 

The development and production of an Electric Propulsion system involves a significant number of industrial organizations. Whilst thrusters and PPUs are specific to a technology, pressure regulators and pointing mechanisms need not be technology specific and are usually chosen based on individual mission requirements.

Electric thrusters are generally described in terms of method used to accelerate charged particles and produce the thrust. Following this logic, EP systems are classified according to three categories: electro-static, electro-magnetic, and electro-thermal thrusters:

• Electro-static: Gridded Ion Engines, Field Emission Electric Propulsion, Colloidal Thrusters 

• Electro-magnetic/electro-static thrusters: Hall Effect Thrusters, HEMPTs 

• Electro-magnetic thrusters: Magneto Plasma Dynamic thrusters, Pulse Plasma Thrusters 

• Electro-thermal: Arcjets, Resistojets 

Depending on the specific field of application, thrusters falling into one of these three categories can be more or less attractive, depending on their particular thrust capabilities, electrical power consumptions, and other propulsion performance characteristics (Isp).

The propellant used in EP systems varies with the type of thruster and can be a rare gas (i.e., xenon, krypton or argon), a liquid metal (i.e., cesium or indium), or an ionic liquid.

The level of development and flight heritage of the different thruster types can vary significantly. In Europe, developments have been carried out in all the different areas of electric propulsion over the last four decades (see Figure 2 for suppliers). Gridded Ion Engines (GIEs) and Hall Effect Thrusters (HETs) have emerged as leading electric propulsion technologies in terms of performance. These thrusters operate in the power range of hundreds of watts up to tens of kilowatts with an Isp of thousands of seconds to tens of thousands of seconds, and they produce thrust levels typically of some fraction of a newton. Figure 3 compares their performance.

In Hall Effect Thrusters (see Figure 4), electrons from an external cathode enter a ring-shaped accelerating channel attracted by an anode. Xenon gas is released into the channel. Permanent magnet or coils embedded within the thruster structure generate a magnetic field with a magnitude selected so that only electrons are excited and the influence on ions is neglected. Electron excitement causes propellant ionization and ion acceleration when gas crosses the EXB field. The accelerated ions leaving the channel generate thrust. The electrons from the cathode are also used to avoid spacecraft charge.

In Gridded Ion Engines (see Figures 5 and 6), Xenon gas is ionized by electron bombardment or through radiofrequency electron excitement. The ions are then extracted and accelerated using a high electrostatic potential applied to a grid system. An external neutralizer emits the electrons necessary to neutralize the space charge of the emerging ion beam.

Electric Propulsion Applications

Embarking propulsion capabilities on-board a satellite can serve multiple purposes:

• Station keeping: satellites shall compensate for perturbations to maintain the desired orbital position:

◉ LEO orbits are perturbed by the aerodynamic drag

◉ Gravitational fields of the Moon and the Sun affect the inclination of GEO satellites in North-South

◉ Non-circular shape of Earth’s equator causes perturbations in East-West

• Attitude management: satellites shall generate a momentum to off-load the reaction wheels used for attitude control.

• Orbital maneuvering: orbit transfer/raising from launch orbit to the operational orbit, relocation and disposal at end-of-life. 

Since the 1970s, Electric Propulsion has been used for station-keeping, orbit-raising, and as primary propulsion on telecommunications and science missions. Increasingly, it is being considered for Earth observation, navigation, and orbit debris removal. 

More recently, constellations of CubeSats, or small satellites with the mass ranging from one kilogram to few hundreds of kilograms, are also planning to use Electric Propulsion to enhance their capabilities.

Telecommunication

Commercial GEO telecommunication represents the largest market for electric propulsion. In the last 20 years, these satellites have become more competitive with the adoption of EP for North-South Station Keeping (NSSK) and Electric Orbit Raising (EOR). Launchers deliver these satellites into Geostationary Transfer Orbits (GTO) and orbit-raising maneuvers to reach GEO are then performed by the onboard propulsion. With Chemical Propulsion, orbit-raising takes up to one week but about half of satellite wet mass is propellant. With Electric Propulsion, orbit-raising takes up to six months but launch mass can be reduced by 40%. Telecommunication satellites using EP have greater appeal since the propellant mass saved can be used to accommodate larger and more complex payloads. In addition, in the last decade, the trend in GEO Telecommunication satellites has consolidated into a considerable increase in electrical power to satisfy the payload needs. The availability of such high power allows for the operation of the EP subsystem without requiring additional power or changes in the platform design. On the other hand, the low thrust produced by the EP thrusters means extended firing times and longer transfers to reach the final operational orbit. This implies reduced revenue in the short-term, but important savings in the long run.

Electric propulsion was primary used on Russian commercial satellites. In 1997 Boeing made the world’s first American EP telecoms satellite, PanAmSat, using XIPS gridded ion engines for station-keeping and chemical thrusters for orbit-raising maneuvers.

In 2001, the European Space Agency’s (ESA’s) ARTEMIS (the Advanced Relay and Technology Mission Satellite, Figure 7) offered the first European flight demonstration of European EP thrusters for orbit-raising, recovering the satellite to its final orbit following a launcher anomaly.

In 2005, Space System Loral started to use Russian SPT100 Hall Effect Thrusters for station keeping. 

In 2010, Lockheed Martin’s Advanced Extremely High Frequency (AEHF) satellite, after an anomaly with its main Chemical Propulsion system, used Hall Effect Thrusters intended for station keeping to complete its orbit-raising. 

In 2013 Thales and Airbus delivered the first large telecoms satellite, AlphaSat, using a set of four SAFRAN AIRCRAFT ENGINES PPS1350 thrusters for station keeping (Figure 8).

In 2015, Boeing successfully demonstrated the world’s first all-electric spacecraft using XIPS Ion Engines for station keeping and orbit-raising. 

In 2017, the ESA-OHB SmallGEO platform (Figure 9) was launched equipped with 8 SPT-100 thrusters to fulfil all the orbital manoeuvres for 15 years. In the same year, the EUTELSAT 172B satellite, an “all-electric” built by Airbus DS, reached geostationary orbit in record time by using these 5 kilowatt Hall Effect Thrusters.

European satellite manufacturers have been using electric propulsion for station keeping for more than 10 years: on Eurostar 3000 produced by Airbus, on Spacebus 4000 produced by Thales Alenia Space, on SmallGEO produced by OHB). All European Primes are now developing their new all-electric platforms, NEOSAT and ELECTRA, which use EP for both orbit raising and station keeping. By 2020, it is estimated that more than half of all commercial satellites sold will be all-electric or hybrid (embarking both chemical and electric systems). 

The European Space Agency, the National Space Agencies and industries have invested in the development of electric thrusters for the GEO market at SAFRAN AIRCRAFT ENGINES (Hall Effect Thrusters), SITAEL (Hall Effect Thrusters), QINETIQ (Ion Engines), ARIANEGROUP (Ion Engines), and THALES (HEMPT). These products are now competing with those from U.S. and Russia.

Navigation

The Galileo Second Generation (G2G) program is considering the use of EP for constellation deployment and satellites disposal at end of life. Electric Propulsion is thought to enhance payload capability and flexibility in deployment strategy. The full exploitation of launch vehicle capabilities and the design of efficient transfer trajectories are major components of developing an efficient deployment strategy for Galileo. Multiple satellite configurations are currently been studied to find solutions that satisfy accommodation requirements of the payload, solar arrays, and propellant, demonstrate sufficient mechanical and thermal performance, support the desired level of modularity, and ensure the ability to fit multiple spacecraft on European launchers. As the selection of EP thruster has a large impact on the satellite design, detailed trade-offs are still being carried out to analyze combinations of thruster type, number, and operating point in order to optimize satellite design with an acceptable transfer duration, to ensure failure robustness and technical maturity.

Science & Exploration 

The use of electric propulsion for scientific spacecraft is recognized as an important way to enhance mission performance. Replacing or augmenting chemical propulsion with electric thrusters as the primary propulsion system can bring the following benefits:

• an increase in net payload mass 

• a reduction in flight time with respect to mission based on chemical propulsion and complex gravity-assisted operations 

• independence from launch-window constraints, which are imposed by the classical gravity-assisted planetary fly-by operations

• possibility of using small/medium launch vehicles (providing substantial launch-cost savings)

Specific mission requirements, in terms of power availability, satellite mass, and mission profile, dictate the choice of the particular EP technology to be used.

Deep Space 1 was the first use of EP on an interplanetary mission, and its main objectives, the fly-by of asteroid Braille and Comet Borrelly, were successfully performed by NASA’s NSTAR ion engine in the late 1990s. The JAXA science mission Hyabusa used Japanese ion engines to rendezvous with an asteroid in 2005.

ESA’s first Moon mission, SMART-1 (Figure 10), paved the road for the use of EP on European Science and Exploration missions. The mission was technically and scientifically a success, helping ensure Europe’s technology competence in this promising technology as well as in lunar exploration. The relatively small satellite, equipped with one PPS-1350G HET from SAFRAN AIRCRAFT ENGINES, required only 82 kilograms of Xenon to reach and orbit the Moon. 

ESA’s cornerstone missions, BepiColombo, will provide the best understanding of Mercury to date by studying and understanding the composition, geophysics, atmosphere, magnetosphere, and history of Mercury, the least explored planet in the inner Solar System. BepiColombo, launched in October 2018, is propelled by four 5kW T6 Gridded Ion Engines developed by QinetiQ (Figure 11).

Future scientific missions such as LISA (Laser Interferometer Space Antennas) (Figure 12) may require electric microthrusters as very fine control actuators to ensure operation under drag-free conditions. These thrusters should also have a long lifetime. FEEP, colloidal thrusters, and miniaturized ion engines are main candidates for these kinds of missions.

ESA is currently studying the future evolution of the Exploration program and is assessing the possibility of implementing a technology mission that allows testing future technologies required for exploration missions. High-power EP (15-20 kilowatts) is considered a perfect candidate to perform an interplanetary cruise. Initiatives such as CISLUNAR will require 12.5-20 kilowatt Hall Effect Thrusters to keep the station around the Moon and/or transfer it to Mars. The first European prototype of a 20 kilowatt HET was built and tested in the frame of the HiPER project (High Power Electric propulsion: a Roadmap for the future) co-funded by the European Union under the space theme of the 7th Framework Program. Starting in 2015, ESA is also funding the development of a 20 kilowatt HET at SITAEL S.p.A..

Earth Observation 

Earth observation missions, like GOCE (Figure 13), also benefitted from the use of EP. The main aim of the GOCE mission was to provide unique models of Earth’s gravity field and its geoid to high spatial resolution and accuracy. The T5 GIE system from QinetiQ was operated on GOCE almost continuously from 2009 to 2013 to compensate aerodynamic drag. The engine performance exceeded the expectations and enabled a mission that met not only the baseline requirements, but was so successful that its duration was doubled from two years to four years.

The success of the ion engine in the GOCE spacecraft has demonstrated the potential of this technology for fine control of satellites flying in LEO. 

Next Generation Gravity Missions (NGGM) is considering miniaturized GIE from ARIANEGROUP and FEEP from FOTEC to compensate drag.

Furthermore, the use of small ion engines, small HETs, FEEPs, or helicon antenna thrusters would enable operation of Earth observation satellites at much lower altitude orbits. Studies and development programs have been conducted considering the use of atmospheric gases as propellant for electric thrusters (RAM-EP) to enable continuous operation at altitudes lower than 200 kilometers.

Finally, constellations of thousands of satellites are currently being developed. These satellites are launched in clusters and need low power EP to reach their operational orbit, stay there, and be disposed at the end of the mission. Low-cost and versatile electric propulsion systems will be required as the cost of the system must be one order of magnitude lower than current prices. 

Space Transportation

Based on growing maturation of electric propulsion systems and increasing capabilities of such propulsion devices, possible applications to space transportation vehicles have gradually been studied with more and more detailed levels of analysis. It is possible today to gather the different classes of applications around the two following families of concepts:

• Electric kick stages for launchers to increase performance capabilities (e.g., Electric-Vega) 

• Space Tugs for GEO servicing, LEO/MEO Debris Removal, LEO/MEO to GEO tugging, and Moon cargo delivery

CubeSats

Numerous EP micro-propulsion systems are currently under development in Europe to enhance the performance of CubeSats by enabling drag compensation, orbit keeping, formation flying, orbit transfer, and de-orbiting at end of life. Their compactness, good performance, and low price are increasingly appealing as the space industry interest in small satellites (mass ranging from one to a few hundreds of kilograms) grows all over the world. These satellites, often in constellation, could provide commercial services such as global internet coverage and monitoring of air and sea traffic or Earth observation to broadcast weather and monitor the response to natural disasters.

A miniaturized version of the Indium FEEP thruster for CubeSats and small satellites, the IFM Nano thruster (Figure 14, left image), is under development at Enpulsion and FOTEC (A) to provide highly accurate thrust ranging from 10 to 400 micronewtons at 40 watts with an Isp up to 6,000 seconds.  

A Pulsed Plasma Thruster (PPT) for CubeSats, PPTCUP (Figure 14, right image), is being developed by a consortium led by Mars Space (UK) to provide thrust of 40 micronewtons at 2 watts with an Isp of 600 seconds.

A consortium led by Queen Mary University (UK) is developing a very compact and highly efficient Electrospray Colloid EP system.

The “Electric Propulsion Innovation & Competitiveness” (EPIC) The European Commission funded, as part of the Horizon 2020 Space Work Programme 2014, a Programme Support Activity (PSA) for the implementation of the Strategic Research Cluster (SRC) on “In-Space electrical propulsion and station keeping”. The goal of the SRC is to enable major advances in Electric Propulsion for in-space operations and transportation, in order to contribute to guarantee the leadership of European capabilities in electric propulsion at world level within the 2020-2030 timeframe, always in coherence with the existing and planned developments at national, commercial and ESA level. This grant is structured along the two lines of Incremental Technologies and Disruptive Technologies. ESA is the coordinator whereas the team is made by several national space agencies and industries.

Incremental Technologies are the most mature technologies having flight heritage, with the physical principal well understood, and with established performance. They are the Hall Effect Thruster (HET), the Gridded Ion Engines (GIE), and the High Efficiency Multistage Plasma Thrusters (HEMPT). Under EPIC, these Incremental Technologies shall improve their current performance and reduce their cost in order to increase their competitiveness in the global market. 

Disruptive Technologies are very promising EP concepts which could disrupt the propulsion sector by providing a radical improvement in performance and/or cost reduction, leading to becoming the preferred technology for certain applications/markets or enabling new markets or applications not possible with the existing (Incremental) technologies. 

The selected Incremental Technologies contracts are: CHEOPS on HET, GIESEPP on GIE, and HEMPT-NG on HEMPT technologies. 

The selected Disruptive Technologies contracts are: GaNOMIC on PPU innovative Technologies, HiperLoc-EP on the Electrospray Colloid EP System, and MINOTOR on the Electron Cyclotron Resonance Accelerator thrusters.

Conclusions

Since the 1970s, Electric Propulsion has been used on satellites for station-keeping, orbit-raising, and primary propulsion. It has traditionally had applications for telecommunications and science missions, but increasingly the use of EP is being considered for Earth observation, navigation, and space transportation. 

More recently, constellations of small satellites (e.g., SpaceWeb) are being designed to use electric thrusters to perform the transfer to the operational orbit and other functions. Thanks to the mass savings made possible by the use of electric propulsion, fewer launchers are needed to place the constellation in orbit, thereby allowing a major cost reduction for the service being offered. The use of EP is also capable of enhancing the services offered by CubeSATs.

Europe is highly capable in the area of Electric Propulsion, stemming from decades of research and development. This expertise is exemplified by the success of ESA missions, such as ARTEMIS, SMART1, GOCE, and AlphaSAT, that have paved the way to the use of electric propulsion on BepiColombo and European commercial telecom platforms such as Neosat and Electra.

Electric propulsion is currently considered by all space actors as a key and revolutionary technology for the new generations of commercial and scientific satellites. Initiatives in this field all over the world are aimed at the development of competitive new generations of Electric Propulsion systems. In Europe too, all stakeholders including the European Space Agency, the National Space Agencies and industrial players have been setting efforts to develop and increase the competitiveness of the European EP technology for the different types of markets.

ESA is strongly involved and committed in this technology area, both as an initiator of electric propulsion system developments and as a user of this technology for its new missions. ESA’s goal is to maintain the competitiveness of European industries by ensuring the availability of qualified, cost-effective, and reliable EP systems, and to make new and challenging space missions possible. 

Acknowledgements

This article is based on a paper presented at the Munich Aerospace Summer Summit on Green Aerospace, June 2017.

Additional Resources

(1) Aguirre, M., A. Tobias, and M. Schuyer, “Propulsion System for the Gravity and Ocean Circulation Explorer Mission,” Second European Spacecraft Propulsion Conference (ESA-SP-398), Paper B2/1, May 1997

(2) Goebel, D. M. and I. Katz, “Fundamentals of Electric Propulsion: Ion and Hall Thrusters”

(3) Gonzalez del Amo, J. et alia, Q/A -{[ Should we name all the authors here ?]} “ESA Propulsion Laboratory (EPL),” International Electric Propulsion Conference, September 2011

(4) Gonzalez del Amo, J., Electric Propulsion Technologies, Technical Dossier, Harmonization, ESA, 2017

(5) Gonzalez del Amo, J., “Electric Propulsion Activities at ESA,” International Electric Propulsion Conference, October 2017

(6) Kutufa, N., “Small GEO Platform Propulsion System Overview,” Space Propulsion, May 2008

(7) Saccoccia, G., J. Gonzalez del Amo, and D. Estublier, “Electric Propulsion: A Key Technology for Space Missions in the New Millennium”

Authors

Davina Di Cara is an Electric Propulsion Engineer in the Electric Propulsion Section of the European Space Agency since 2006. She started her career in Space in 2004 at ESA as graduated trainee in the Electric Propulsion Section. She has Master degree (LAUREA) in Aerospace Engineering from Politecnico di Torino, Italy. She has been involved in several research and development activities on Electric Propulsion supervising industrial developments and carrying out testing at the ESA Propulsion Laboratory. She has been involved in many ESA mission studies and projects such as Smart-1, Lisa-Pathfinder, Small-GEO, EGEP, Galileo 2nd Generation, Galileo Transition Satellites, etc.

José Gonzales Del Amo is the Head of the Electric Propulsion Section at ESA since October 2003 and the ESA Propulsion Laboratory Manager since 2004. He was before Electric propulsion Engineer in the Electric Propulsion Section at ESA from 1991 to 2003. He started his career in Space, in 1989, at ESA as graduated trainee in the Power Conversion Division. He has a Master degree in Applied Physics (University Autonoma de Madrid) and in Space Systems Engineering (University of Delft). He has been involved in many research and development activities on Electric Propulsion supervising the industrial developments and carrying out testing and research activities at the ESA Propulsion Laboratory since 1991. He has been involved in many ESA projects such as Artemis, Smart-1, GOCE, Bepi Colombo, Lisa-pathfinder, AlphaBus, Neosat, Small GEO, Electra, Galileo Evolution, etc. He has been also the responsible for the roadmap of the Electric propulsion Technology within the ESA Harmonisation programme and the roadmap preparation for all the propulsion systems called Propulsion 2000. He has 115 papers in the field.

Em. Univ.-Prof. Dr.-Ing. habil. Dr. h.c. Guenter W. Hein is Professor Emeritus of Excellence at the University FAF Munich. He was ESA Head of EGNOS & GNSS Evolution Programme Dept. between 2008 and 2014, in charge of development of the 2nd generation of EGNOS and Galileo. Prof. Hein is still organising the ESA/JRC International Summerschool on GNSS. He is the founder of the annual Munich Satellite Navigation Summit. Prof. Hein has more than 300 scientific and technical papers published, carried out more than 200 research projects and educated more than 70 Ph. D.´s. He received 2002 the prestigious Johannes Kepler Award for “sustained and significant contributions to satellite navigation” of the US Institute of Navigation, the highest worldwide award in navigation given only to one individual each year. G. Hein became 2011 a Fellow of the US ION. The Technical University of Prague honoured his achievements in satellite navigation with a Doctor honoris causa in Jan. 2013. He is a member of the Executive Board of Munich Aerospace since 2016. 

The post Working Papers: Electric Propulsion Technology Overview appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Violations of road rules such as prolonged driving periods and infringements to speed limits can entail severe safety risks. For this reason, the adoption of the Smart Tachograph (ST), the new revision of the Digital Tachograph (DT), has been mandated in the European Union (EU). The ST is an electronic device that aims to improve safety in the transportation sector by monitoring driver behavior. Starting in June 2019, its installation will be mandatory in new commercial vehicles with a mass of more than 3.5 tonnes (3.5 metric tons) in goods transport and carrying more than nine people, including the driver, in passenger transport. The ST records information about driver behavior such as driving time, rest periods and breaks: by monitoring driver behavior, the ST is expected to discourage the violation of road rules and to improve road safety.

The legal framework of the ST has been recently revised according to Council Regulation (EU) No. 165/2014 listed in Additional Resources. Moreover, the technical specifications of the existing DT were discussed with stakeholders including law enforcers, manufacturers and service providers. This process led to the definition of new technical specifications of the ST that can be found in Council Regulation (EU) No. 799/2016 listed in Additional Resources.

A key feature of the ST is the adoption of an interface with Global Navigation Satellite Systems (GNSS), including the European GNSS, Galileo and EGNOS. A GNSS receiver will be used to record positions related to the daily work periods including the start and stop locations of the commercial vehicle. In addition to GNSS data, the ST will access information from other sensors such as the on-board odometer. The availability of data from different sensors allows the ST to perform periodic consistency checks to prevent the risk of data falsification. In this respect, Regulation (EU) No. 165/2016 prescribes the cross-validation between GNSS and motion sensor data to mitigate the risk above. For example, a motion conflict will be generated if a significant discrepancy between GNSS and odometry information is observed. These procedures have been implemented to reduce the risk of GNSS spoofing and data manipulation.

This article reviews the motion conflict procedure adopted by the ST and provides an experimental evaluation of the mechanism used for speed data verification. While logistic and cost reasons prevented the use of a real commercial vehicle above 3.5 tonnes, the experimental setup adopted and the measurement campaigns conducted are considered realistic. Two scenarios were considered and three different vehicles were employed for the data collections. Several hours of data were recorded and used for the experimental evaluation of the ST speed verification procedure. 

The analysis shows that, with the new ST, it is not sufficient to falsify GNSS information alone and an attacker has to forge data from both the vehicle sensor and the GNSS receiver simultaneously, which makes the attack implementation quite difficult.

The Smart Tachograph

Different architectures can be adopted for the implementation of the ST (see the article by Baldini et alia, 2018, Additional Resources). In all architectures, the main element of the ST is the Vehicle Unit (VU), which is responsible for the different functions of the ST including the collection of data from different sensors and data verification. The VU is connected to the motion sensor, whose purpose is to provide motion data, which reflect the vehicle’s speed and distance travelled. The VU is connected to a GNSS receiver that provides Position, Velocity and Time (PVT) information. GNSS data are used for different operations including the motion conflict detection process described below. The ST regulation mandates the use of the European GNSS, Galileo and EGNOS, that can be used in conjunction with other GNSS. The VU records information including the different events triggered by the tests performed by the device. Law enforcers can interrogate the ST through Dedicated Short Range Communication (DSRC) link (based on CEN-DSRC standards using the 5.8 gigahertz band). Depending on the result of the interrogation, law enforcers can decide to stop the vehicle and proceed with further investigations. A schematic representation of the ST architecture is depicted in Figure 1.

Motion Conflict Detection

The ST will verify the quality of GNSS data by comparing the speed obtained from the GNSS receiver with that provided by other sensors. A possibility is to use the speed obtained from the on-board odometer. In this respect, the VU can use the speed provided by the odometer, S_odo(t), and recovered through an On-Board Diagnostics (OBD)2 interface. We adopted this approach since OBD2 data readers are widely available on the market and the vehicle speed can be easily obtained by interrogating the vehicle OBD system. This system adopts a serial protocol where information is provided as a response to a data interrogation performed by sending a Parameter IDentifier (PID). In particular, the vehicle speed is retrieved using PID 13. The odometer speed is provided in an asynchronous way and thus S_odo(t) is sampled at irregular time instants, t = t_n. The vehicle speed is provided as an unsigned 8 bit integer with values in the [0, 255] km/h range. The speed is quantized with a 1 km/h resolution. 

GNSS receivers usually provide 3D information and the vehicle velocity can be obtained as a 3D vector. In this work, we considered the case where the 3D velocity vector is provided by the receiver and computed from Doppler measurements. In this case, the speed is derived as the absolute value of the velocity vector:

where V_E(t), V_N(t), and V_U(t) are the three velocity components expressed in a local East, North, Up (ENU) frame.

It is noted that the ST regulation (European Commission 2016) prescribes the usage of the National Marine Electronics Association (NMEA) 0183 protocol for the data exchange between GNSS receiver and VU. In this case, S_GNSS(t) is provided directly as part of the NMEA Recommended Minimum Data (RMC) sentence. We have tested this case by including a smartphone in the data collection system and by recording RMC sentences directly providing the GNSS-derived speed. This case is detailed later in the article.

GNSS measurements are provided at regular time instants and S_GNSS(t) is sampled at t = nT_s where n is the time index and T_s is the sampling interval. GNSS and odometry data are not synchronized and thus a synchronization mechanism needs to be implemented. For this reason, the procedure illustrated in Figure 2 has been adopted.

The GNSS time scale is used to generate PID requests for the OBD interface. These requests trigger the provision of new odometer measurements that can be compared with GNSS information. A small latency is introduced between the generation of the data request and the provision of S_odo(t_n). This causes a small synchronization error between S_GNSS(nT_s) and S_odo(t_n). This error is however small and the decision statistics considered by the ST regulation have been designed to be tolerant with respect to these types of errors.

The synchronization approach described in Figure 2 can be adopted for a real-time implementation of the motion conflict detection strategy prescribed by the ST regulation. In the data collections performed and described in the next sections, GNSS and OBD data were collected in an independent way. The synchronization approach described in Figure 2 was then implemented in post-processing. In particular, the data collected were roughly synchronized using a correlation approach. This synchronization was performed only once at the beginning of the dataset. The approach in Figure 2 was then implemented by associating to each GNSS measurement the next available odometer speed with the closest time stamp. Additional details on the synchronization procedure adopted in post-processing can be found in our article listed in Additional Resources (Borio, et alia 2018).

Using S_GNSS(nT_s) and S_odo(t_n), it is finally possible to compute the speed differences that are the basic signals used for the computation of the decision statistics:

In the previous equation, the symbol – denotes the impact of synchronization errors. ΔS(nT_s) is the ideal speed difference affected by the synchronisation error, η_syn(nT_s). According to the ST regulation, speed differences should be computed at least every 10 seconds. For this reason, T_s = 10 s was adopted. 

The decision statistics are finally computed using the approach described at the bottom part of Figure 2. The absolute values of the speed differences are at first computed: 

An analysis window is then used to select 5 minutes of data corresponding to N = 30 measurements for T_s = 10 s. The selected measurements are then used for the computation of the decision statistics. According to regulation (EU) No. 799/2016 (European Commission, 2016), the final decision statistic should be computed as the trimmed mean of the 30 measurements selected, where 20% of the observations are discarded. When N = 30, the six absolute speed differences with the largest values are removed and the mean absolute speed difference is computed and used to determine motion conflicts. In our work, we also considered the median absolute speed difference as a comparison term. In this case, the decision statistic is the sample median of the measurements selected by the analysis window. 

The decision statistics are compared with a decision threshold equal to 10 km/h. If this value is exceeded, a motion conflict event is triggered and recorded in the VU.

Experimental Setup

In order to experimentally evaluate the motion conflict detection mechanism described above, several data collections were performed considering different vehicles and scenarios. Different car models were considered since each vehicle implements slightly different OBD interfaces. Our goal was to evaluate possible inter-model differences by considering different car models. Three vehicles were used for the analysis and are denoted in the following as Model 1, Model 2 and Model 3.

In all cases, a single frequency GNSS high sensitivity module able to provide raw GNSS observables was used. The module was configured to use both GPS and Galileo. The use of Galileo provides benefits in terms of signal availability and position accuracy. We analyzed these aspects in our recent paper listed in Additional Resources. In all cases, a single frequency patch antenna was used. Depending on the test, different antenna positions were considered. Figure 3 provides different views of the experimental setup adopted for the data collections. Figure 3 a) shows the rooftop of Model 1 with the single frequency patch antenna taped above the front windshield. In the tests performed using Model 3, the antenna was placed inside the vehicle and below the front windshield as shown in Figure 3 d). Odometry data were collected using ELM327 OBD2 data readers. The device used for Model 3 is shown Figure 3 c). GNSS and odometry data were recorded using a laptop.

In order to test the impact of the GNSS receiver and to evaluate the use of RMC NMEA sentences, a smartphone was placed inside the vehicle and used to collect supplementary data. The low-cost GPS/GLONASS smartphone used for the tests with Model 3 is shown in Figure 3 d). 

The experiments considered two types of scenarios:

• Light-urban environments

• Highway experiments

The first type of environment was analyzed by performing several tests inside the Joint Research Centre (JRC) campus in Ispra, Italy. In this case, the closed trajectory illustrated in Figure 4 a) was repeated several times over several days. Model 1 and 2 were used for the tests and a total of 8 hours of data were collected.

The highway experiments were performed using Model 3 and considered a section of about 130 kilometers of Italian highways in the Turin/Milan area. The test was repeated several times. In the following, we will detail the results obtained considering data collected in August 2018. The results are consistent with the findings described in our paper listed in Additional Resources (Borio et alia 2018).

The trajectory of this test is illustrated in Figure 4 b). It also includes two urban areas, at the beginning of the test. These urban sections can be easily identified from the speed profile recorded.  

Experimental Results

The results obtained during the experimental campaigns discussed above are briefly described in the following. Specific focus is devoted to the results obtained under nominal conditions. The impact of simple data manipulations is analyzed at the end of the section.

In all the experiments performed, a good agreement between GNSS and odometry data have been observed. The speeds from the GNSS receiver and the OBD2 data reader recorded for the experiment described in Figure 4 b) are compared in Figure 5. The two speed curves overlap for almost the total duration of the test. In the plot, different events can be identified such as the urban sections of the experiments, characterized by moderate and more variable speed profiles, and the stops at the toll stations. GNSS and odometry data differs only when the car passes under a tunnel of about 670 meters. In this case, the GNSS receiver stops providing valid speed values. The GNSS receiver provides a zero speed and a spike is observable after about 4,000 seconds from the start of the test. 

The absolute speed differences and the two decision statistics (trimmed mean and median) obtained for the test analyzed in Figure 5 are provided in Figure 6. For the total duration of the experiment, the absolute speed differences assume values below 3 km/h. Spikes above this value occur sporadically and mostly in correspondence of specific events such as the stop at a rest area or the passage under a tunnel. The two decision statistics used for motion conflict detection are based on robust operators, the trimmed mean and the median, that have been selected for their ability to reject outliers and sporadic anomalous speed difference values. For this reason, the decision statistics are only marginally influenced by the presence of speed differences above 3 km/h. The decision statistics evaluated in Figure 6 assume values around 1 km/h that are significantly below the 10 km/h threshold prescribed by the ST regulation.  

The behavior of the decision statistics is analyzed in Figure 7, which compares the histograms obtained for the decision statistics when considering the three models. The histograms related to Model 1 and 2 have been obtained using the data collected during the tests performed for the light urban scenario on the JRC campus.  

The histograms for Model 3 have been obtained using the time series shown in Figure 6. In all cases, the decision statistics assume values below 1.5 km/h. Model 1 and 2 are characterized by lower maximum values that are below 1 km/h. This could be due to the location of the antenna that was placed on the roof of the vehicles. For Model 3, the antenna was inside the vehicle. A second difference is also related to the fact that the tests performed for Model 3 include tunnels and stops that caused sporadic spikes in the absolute speed differences. Despite these differences, the decision statistics are significantly below the decision threshold and robust to different errors, including residual synchronization effects. In all cases, the two decision statistics, median and trimmed mean, assume similar values and have a similar behavior when data are collected in the absence of manipulations. The impact of tunnels on the decision statistics is analysed in Figure 8. In the absence of GNSS signals, the GNSS receiver propagates the user’s position using the last velocity information. This operation is performed for 10 seconds. If the GNSS outage is longer than 10 seconds, the receiver provides an invalid speed equal to zero. This behavior is clearly observable in the upper part of Figure 8, which shows the speed time series provided by the GNSS receiver and the odometer. Invalid GNSS speed values generate large speed differences that can affect the decision statistics. In this case, the tunnel is quite short (about 670 meters) and the number of invalid measurements is not sufficient to significantly bias the decision statistics, whose behavior is analyzed in the bottom part of Figure 8. As already mentioned, the decision metrics selected by the ST regulation are robust to data gaps. The median decision statistic can tolerate data gaps up to 150 seconds while the trimmed mean will start to be biased when the data gaps last more than 60 seconds. 

The results presented above were obtained using a high sensitivity module and a patch antenna. The case where a low-cost smartphone GNSS receiver is adopted is considered in Figure 9, which compares the histograms of the decision statistics obtained when using different GNSS receivers. The histograms have been evaluated by considering the same scenario, i.e. the highway test described in Figure 4 b). When smartphone data obtained from NMEA RMC sentences are used, larger speed differences are obtained. This is due to the lower quality of the GNSS receiver and of the antenna integrated within the smartphone. Despite the lower quality of the measurements, the decision statistics assume values significantly lower than the 10 km/h threshold prescribed by the ST regulation. From the histograms reported in Figure 9, it emerges that the decision statistics computed using the smartphone data are characterized by maximum values lower than 2 km/h. 

These results show that the ST test statistics are resilient to false alarms, even when low quality devices are used. The analysis shows that the decision threshold provides sufficient margin to account for different errors, including synchronization effects. Moreover, the test procedure is resilient to data gaps on GNSS and odometry data.

In our work listed in Additional Resources, we have tested the impact of data manipulation on the ST decision statistics. We have considered the introduction of relative delays between odometry and GNSS data and the impact of data scaling. The introduction of relative delays between time series allows one to study the impact of synchronization errors, for short delays, and of meaconing attacks, for long delays. Effective decision statistics should be tolerant to small synchronization errors and be able to detect discrepancies when relatively long delays between time series are introduced. 

These effects are analyzed in Figure 10 that shows the maxima of the decision statistics as a function of the relative delays between GNSS and odometry data. All three vehicles are considered along with the two decision statistics. From the figure, it emerges that the detection threshold is not exceeded for relative delays lower than approximately 5 seconds. Larger delays trigger threshold crossing. The curves for Model 1 and 2 have been obtained using the data collected on the JRC campus, whereas the plots for Model 3 were obtained using the highway data. Despite these differences, consistent results were obtained.  

These results show that the decision statistics selected for detecting a motion conflict can tolerate a significant latency (synchronization error) between GNSS and odometry data. The second conclusion is that a simple meaconing attack seems unlikely to be successful. The ST decision statistics are able to detect inconsistencies between motion data even when only a few seconds of delay are introduced. When GNSS and odometry data come from different and unrelated scenarios, the decision statistics reach higher values than those shown in Figure 10. For this reason, a meaconing attack can be successful only if both sensors are compromised, which can be quite difficult to achieve.

When data are manipulated by scaling one of the time series, the ST consistency mechanism allows discrepancies lower than the decision threshold. These discrepancies depend on the speed profile. For example, if an average speed of 50 km/h is adopted by the driver, a maximum 20% scaling can be applied to one of the time series. This scaling corresponds to a discrepancy of 10 km/h and is equal to the detection threshold. This is the maximum error allowed by the decision threshold. More details on the effects of this type of data manipulation can be found in the authors’ paper listed in Additional Resources. 

Conclusions

This article evaluated the performance of the decision statistics introduced by the ST regulation to verify the consistency of speed data from different sensors. The speed consistency mechanism has been experimentally characterized using three vehicles and considering different scenarios. 

The experimental analysis showed that the test statistics have been designed to have a low number of false alarms and to be robust to different errors such as data gaps and synchronization errors. In the experiments conducted no false alarm was recorded. The decision threshold equal to 10 km/h defined in the ST regulation provides sufficient margin against false alarms.

The test statistics are also robust to latencies between GNSS and odometry data. Moreover, the experimental analysis shows that the decision statistics are effective against data manipulation forms such as meaconing attacks and data scaling. In this latter case, only discrepancies lower than the 10 km/h threshold are undetected by the tests prescribed by the ST regulation.

Manufacturers

The GNSS high sensitivity module used for the experiments is a u-blox M8T device from u-blox, Thalwil, Switzerland. 

Additional Resources

[1] Baldini, G., L. Sportiello, M. Chiaramello, and V. Mahieu, “Regulated applications for the road transportation infrastructure: The case study of the smart tachograph in the European Union”, International Journal of Critical Infrastructure Protection, Vol. 21,pp. 3-21, June 2018

[2] Borio, D., E. Cano, and G. Baldini, “Speed Consistency in the Smart Tachograph”, Sensors 18, No. 5, pp. 1-21, May 2018 

[3] European Commission, “Regulation (EU) No 165/2014 of the European Parliament and of the Council of 4 February 2014 on Tachographs in Road Transport,” online, http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32014R0165&from=EN, 2014

[4] European Commission, “Regulation (EU) No 799/2016 of the European Parliament and of the Council of 18th March 2016 on the requirements for the construction, testing, installation, operation and repair of tachographs and their components,” online, http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0799.

Authors

Daniele Borio received the M.S. degree in communications engineering from Politecnico di Torino, Italy, the M.S. degree in electronics engineering from ENSERG/INPG de Grenoble, France, and the doctoral degree in electrical engineering from Politecnico di Torino in April 2008. From January 2008 to September 2010 he was a senior research associate in the PLAN group of the University of Calgary, Canada. Since October 2010, he has been a scientific officer at the Joint Research Centre of the European Commission (EC). His research interests include the fields of digital and wireless communications, location, and navigation.

Eduardo Cano-Pons received the Master degree in Telecommunications in 2002 from the Technical University of Catalonia, Barcelona. He was awarded a PhD in 2006 from the University of Limerick in Ireland in the area of Ultra-Wideband Impulse Radio systems. From February 2016 to April 2018, he worked as scientific officer with the European Commission’s Joint Research Centre in Ispra, Italy, in the areas of interference modelling for wireless networks and of signal processing for GNSS and wireless communications. Since May 2018, he is an information system assistant at the Publications Office of the European Union, Luxembourg. 

Gianmarco Baldini completed his degree in 1993 in Electronic Engineering from the University of Rome “La Sapienza” with specialization in Wireless Communications. He has worked in Italy, UK, Ireland and USA as Senior Technical Architect and System Engineering Manager in Ericsson, Lucent Technologies, Hughes Network Systems and Finmeccanica (now Leonardo) before joining the Joint Research Centre of the European Commission in 2007 as a Scientific Officer. His current research activities focus on Internet of Things, navigation, wireless communications, machine learning, security and privacy where he has co-authored more than 70 research papers. 

Em. Univ.-Prof. Dr.-Ing. habil. Dr. h.c. Guenter W. Hein is Professor Emeritus of Excellence at the University FAF Munich. He was ESA Head of EGNOS & GNSS Evolution Programme Dept. between 2008 and 2014, in charge of development of the 2nd generation of EGNOS and Galileo. Prof. Hein is still organising the ESA/JRC International Summerschool on GNSS. He is the founder of the annual Munich Satellite Navigation Summit. Prof. Hein has more than 300 scientific and technical papers published, carried out more than 200 research projects and educated more than 70 Ph. D.´s. He received 2002 the prestigious Johannes Kepler Award for “sustained and significant contributions to satellite navigation” of the US Institute of Navigation, the highest worldwide award in navigation given only to one individual each year. G. Hein became 2011 a Fellow of the US ION. The Technical University of Prague honoured his achievements in satellite navigation with a Doctor honoris causa in Jan. 2013. He is a member of the Executive Board of Munich Aerospace since 2016. 

The post Working Papers: Speed Verification in the Smart Tachograph appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

As stated in Part 1, there is an increasing importance for GNSS open services for our economy, society, e.g., in the field of traffic monitoring and controlling, as well as for timing applications. Because of this it is necessary to enhance the availibility and more importantly the reliability of GNSS services. In this section of the article, we showcase the results of the performance of the ground system, and a working principle is proven and shown that it is a potential technique in the wide field of signal analyzation and optimization, be it in the field of multipath, channel coding, authentication or robustness against jamming, spoofing, or other interference for existing GNSS signals as well as for developing potential new GNSS signals.

Results 
Performance of Ground System

In a first step, the ground system of the testbed is validated. In this step we verify if the working chain of signal receiving, recording, and post processing works and yields reasonable results. Therefore, the Galileo signal in space (SIS) pilot E1C is processed and analyzed and E1B of the SIS is ignored. As in all tests, a sampling rate of 200 MS/s is used and the receiver internal replica signal is a Composite-BOC (CBOC). The tracking results for all three records (from left to right: S-FE, D-FE1, and D-FE2) are plotted in Figure 7. From top to bottom, the C/N₀, DLL, PLL, and FLL discriminators, and the Code Minus Carrier (CMC) values are displayed. The tracking performance of the SIS (PRN 3) is satisfying and comes up to expectations. S-FE and D-FE1 are almost identical, because they get their input from the same antenna (Rx1). For the D-FE2 there are slightly different values for C/N₀, discriminator, and CMC. This is most likely due to the ~40 meter longer coaxial cable and locally different receiver multipath conditions. This degradation is in the normal range and sufficient for the testbed.

White Rabbit Time Sync Performance within Ground System

In the next step, the FE clock synchronization is evaluated. In the current work, two synchronization approaches are tested. First, as a reference, the comparison of both D-FE inputs is presented. The D-FE has one clock which is used for the sampling of both inputs. Here the best performance is expected as no clock synchronization is needed. Secondly, the clock synchronization with the WR hardware is tested (described earlier). The clock synchronization performance will be measured by comparing the ΔPR Phase and ΔPR Code performance under each synchronization approach. As before, we use the SIS (Galileo OS PRN 3, E1C) for the synchronization performance measurements.

The processing, described in the Concept section, of the code and phase PR of the signals D-FE1 and D-FE2 (same clock; no external clock sync.), is displayed in Figure 7 and yields the ΔPR for code (Figure 8a) and phase (Figure 8b). The top plots of (a) and (b) show ΔPR(t) and ΔGR(t) (the satellite movement was approximated and removed by a quadratic polynomial fit of the ΔPRP). The bottom plots of (a) and (b) show the difference of ΔPR – ΔGR and represent the remaining residual error ε₁ – ε₂. For the ΔPR code (ΔPRC) a standard deviation of 0.664 meters and for the ΔPR phase (ΔPRP) a standard deviation of 0.58 centimeters is observed. These values are in the expected range of the Galileo OS SIS and prove the basic working principle. In Figure 9 the ΔPRC (a) and the ΔPRP (b) of the signals S-FE and D-FE2 (diff. clocks; WR clock sync.) are presented. The ΔPRC standard deviation is 0.659 meters and the ΔPRP standard deviation is 0.62 centimeters. Comparing the ΔPRP plots of Figure 8 and Figure 9, a clear phase jitter is visible under the usage of the WR synchronization. The 16.6 picoseconds deviation of the WR synchronization yield an estimated range error of approximately 0.5 centimeters. This was calculated by 16.6 ✴ 10^-9 ✴ c. This range error is clearly visible in the magnitude of the jitter in Figure 9b. The plots for the ΔPRC in Figure 8a and Figure 9a are almost identical. The values for the standard deviation are equal within the error margin. Therefore it is shown that the WR clock synchronization is sufficient for the code performance evaluation. However, the observed WR clock synchronization deviation of 16.6 picoseconds can become a relevant disturbance for phase processing purposes and needs further investigation, e.g. smoothing of the clock adjustments.

UAV Transmitted Composite-BOC (CBOC) Signal

Until now, only the SIS was processed and analyzed to verify that the ground system works as desired. From now on a self-created single CBOC pilot signal is used, with the same parameters as for the Galileo OS E1B CBOC. The transmission sampling rate was 40 MS/s (complex valued). Only the D-FE results will be shown from now on. In the flight test, the drone is hovering between the two Rx antennas at a height of 30 meters, pictured in Figure 1. In Figure 10, the tracking results for the D-FE1 and D-FE2 recording are shown. In the 500-second-long segment the transmitting power was increased by +6 dB at approximately 250 seconds. An increase in code tracking (DLL) and frequency tracking (FLL) performance, by increased power, can easily be seen in Figure 10 (middle row). On the contrary, a slight degradation of the phase tracking (PLL) is visible for the increased power (most likely but still to be verified due to transient errors or oscillator jitter). The CMC variation is in a reasonable range, but the small CMC drift in both signals is an issue for further investigation. As the ground system was tested and this drift only occurs in the UAVlite signal, it is assumed that either temperature or hardware effects are causing this drift in the USRP. A representative multi correlator (MC) plot of the recorded UAVlite signals is presented in Figure 11. The MC plot shows 201 correlation values of the CBOC signal for a chip offset of –0.51 till +0.51 chips.

For the ΔPR analysis of the UAVlite signal we analyzed 180 seconds from the lower (50-54 dB-Hz) C/N₀ power level and 180 seconds from the higher (57-60 dB-Hz) C/N₀ power level. The results for ΔPRC (top) and ΔPRP (bottom) are presented in Figure 12 (lower power) and Figure 13 (higher power). The standard deviation of the ΔPRC with a C/N₀≈ 52 dB-Hz is 0.369 meters and with a C/N₀ ≈ 58 dB-Hz it is 0.337 meters. Both values are better than for the SIS analysis. This is reasonable as the UAVlite signal was 6 dB stronger. Furthermore it shows that the signal, with 6 dB higher power, has a slightly better ΔPRC standard deviation error. This difference shows the right trend, however, is not significant. But as both signals are strong, no large difference can be expected and the error budget is expected to be dominated by multipath. The standard deviation of the ΔPRP with a C/N₀ ≈ 52 dB-Hz is 0.52 cm and with a C/N₀ ≈ 58 dB-Hz it is 0.66 cm. As mentioned above, the degradation of the phase tracking in the higher power signal also causes a bigger standard deviation in the ΔPRP.

Summary and Outlook

An innovative concept for code and phase performance analysis in a real test environment was presented with a detailed discussion of all relevant components needed to set up such a system. The ground system was tested and verified with Galileo OS SIS. It is shown that the WR clock synchronization induces a small jitter effect on the phase measurement, which is, however, uncritical in scale for delta pseudorange code performance analysis and is also acceptable in most cases for delta pseudorange phase performance analysis. In the subsequent analysis of the UAVlite transmitted E1B CBOC signal good values for code and phase tracking are reached as well as for the ΔPRC and ΔPRP performance analysis. The values are smaller or in the same range as for the SIS. However it was observed that the transmitting chain of PC, USRP, and Tx antenna seems to induce some effects, which are visible in both a small CMC drift and reduced phase tracking performance for higher transmitting power. These effects and the underlying processes need to be studied in more detail. The working principle is proven and it is shown that it is a potential technique in the wide field of signal analyzation and optimization, be it in the field of multipath, channel coding, authentication or robustness against jamming, spoofing, or other interference for existing GNSS signals as well as for developing potential new GNSS signals. Furthermore, the extension to multiple ground stations to allow real-time UAVlite position determination without multistation is straightforward thanks to the WR synchronization technology.

In the future we want to further improve the testbed and use the infrastructure for testing navigation message authentication (NMA) as well as spreading code authentication (SCA) methods. Furthermore, we want to use the testbed to validate the benefit of the Galileo PRS service compared to the Galileo OS. Testing promising future GNSS signal structures is also in the planning. On a bigger time scale, the expansion to multiple UAVlites and multiple receiving antennas is envisaged.

Manufacturers 

The software defined radio reconfigurable device used in the Pseudolite (Transmitter) section is a SDR USRP 2950R from National Instruments, Austin, Texas. Also, the virtual bench with a customized application program that was used to measure the time difference between the clocks of the WR-LENs was the VB-8054 from National Instruments.

In Receiver System where the authors state that the UAVlite signals as well as the signals in space (SIS) are captured, they are done so with two Trimble Zephyr 2 Geodetic antennas from Trimble, Sunnyvale, CA. Also in the Receiver Section, IFEN multi-GNSS software receiver front-ends (FE) from IFEN GmbH, Poing, Germany, are used; the SX3 Dual-RF-FE (D-FE) and the SX3 Single-RF-FE (S-FE). 

In Positioning and Range Verification, the authors are referring specifically to the MultiStation MS60 from Leica Geosystems, Heerbrugg, Switzerland.

The GNSS receiver used in the Front-end Clock Synchronization section is the PolaRx4TR from Septentrio, Leuven, Belgium and Torrance, CA. 

The drone referenced in the UAV section is the DJI Spreading Wings S1000+ Octocopter from DJI, Shenzhen, China. 

Acknowledgments and Disclaimer

Acknowledgement should go to Gerhard Kestel, Stephan Ullrich, and Mathias Philips-Blum for their support during the measurement campaigns and their work setting up the testbed system. The project is self-funded by the Institute of Space Technology and Space Applications of the “Universität der Bundeswehr München.” The setup and the gained knowledge are and will be used for the DLR projects SatNavAuth (FKZ: 50 NA 1703) and NeedForPRS (FKZ: 50 NP 1708).

Authors

Daniel Simon Maier has a professional training as a technical draftsman and received a bachelor in Physics in 2015 and a master in Applied and Engineering Physics in 2017 from the Technical University of Munich (TUM), Germany. Since 2017 he has been a research associate at the Institute of Space Technology and Space Applications of the “Universität der Bundeswehr München.” His current research interests include GNSS signal generation, signal authentication, and signal performance analysis.

Thomas Kraus graduated with a M.Sc. in Electrical Engineering from the University of Darmstadt, Germany. In 2008, he joined the Institute of Space Technology and Space Applications of the “Universität der Bundeswehr München.” He’s been working as a research associate on several projects of the German Space Agency (DLR) and European Space Agency (ESA-ESTEC). His main research focus is on future receiver design offering a superior detection and mitigation capability of intentional and unintentional interferences.

Daniela Elizabeth Sánchez Morales studied Telematics Engineering at Instituto Tecnológico Autónomo de México (ITAM) in Mexico City. She also holds a Masters degree in satellite applications engineering from the Technical University Munich (TUM). She has been a research associate at the Institute of Space Technology and Space Applications (ISTA) since 2017. Her main research area is sensor fusion. Her current research focuses on LiDAR, sensor fusion between LiDAR and GNSS/INS, and relative and absolute navigation algorithms particularly for terrestrial applications.

Ronny Blum received his Masters in Physics from the University of Basel, Switzerland. He then worked at Würth Elektronik in the field of signal transmission and later on at the Forest Research Institute in Freiburg im Breisgau in the field of GNSS reception within the forest. In 2017 he joined the University of Federal Armed Forces Munich, where he is working in the field of GNSS software receiver.

Prof. Thomas Pany is with the Universität der Bundeswehr München at the faculty of aerospace engineering where he teaches satellite navigation. His research includes all aspects of navigation ranging from deep space navigation to new algorithms and assembly code optimization. Currently he focuses on GNSS signal processing for Galileo second generation, GNSS receiver design, and GNSS/INS/LiDAR/camera fusion. To support this activities, he is developing a modular GNSS test bed for advanced navigation research. Previously he worked for IFEN GmbH and IGASPIN GmbH and is the architect of the ipexSR and SX3 software receiver. He has around 200 publications including patents and one monography.

Em. Univ.-Prof. Dr.-Ing. habil. Dr. h.c. Guenter W. Hein is Professor Emeritus of Excellence at the University FAF Munich. He was ESA Head of EGNOS & GNSS Evolution Programme Dept. between 2008 and 2014, in charge of development of the 2nd generation of EGNOS and Galileo. Prof. Hein is still organising the ESA/JRC International Summerschool on GNSS. He is the founder of the annual Munich Satellite Navigation Summit. Prof. Hein has more than 300 scientific and technical papers published, carried out more than 200 research projects and educated more than 70 Ph. D.´s. He received 2002 the prestigious Johannes Kepler Award for “sustained and significant contributions to satellite navigation” of the US Institute of Navigation, the highest worldwide award in navigation given only to one individual each year. G. Hein became 2011 a Fellow of the US ION. The Technical University of Prague honoured his achievements in satellite navigation with a Doctor honoris causa in Jan. 2013. He is a member of the Executive Board of Munich Aerospace since 2016.

The post Innovative Test System for GNSS Signal Performance Analysis in Real Environments Part 2 appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

We were all quiet at first, as nobody dared to answer. Then I responded: Tax authorities are currently writing-off a GNSS receiver in three years. The knowledge of mankind is doubling presently in two years (compared to 100 years between 1800 and 1900). Thus, how can we predict how satellite navigation looks in 50 years, or only in 20 years from now?

After a while, I tried to find a better answer for myself, just looking at what is going on with respect to our global and regional satellite navigation systems and augmentations.

With respect to (Satellite-Based Augmentation System) SBAS we recognize that Advanced Receiver Autonomous Integrity (ARAIM) has great potential. Horizontal ARAIM may be ready around 2023 and vertical ARAIM certainly a few years later. SBAS systems are guaranteed until 2035, especially for aviation. And after 2035: Are the SBAS systems becoming obsolete?

Let’s look around more. 5G wireless networks are coming in the coming years. The standardization process for the first release incorporating 5G capabilities has been completed in June 2018 with the 3GPP Release 15. 5G technology might represent a new mobile revolution in the wireless land­scape, with many new mission-critical services and positioning applications. Among the main targets you’ll find the Internet of Things (IoT) and ultrafast enhanced mobile broadband using millimeter waves and small cells. Will this produce a competitor to our GNSS? Or might the number of GNSS applications decrease? Or, more likely, we’ll see a hybridization GNSS/5G to develop.

And what about New Space, formerly known as alt/alternate space? Although there is no unique definition, it is certainly a movement and new philosophy, encompassing a globally emerging, private spaceflight and aerospace industry which is more socio-economically-oriented. In other words, working commercially and independent of governmental-funded (political) space programs with a faster, cheaper and better access to space.

Examples for such systems in the near future might be the low-earth orbit (LEO) systems with many hundreds or even thousands of mini-satellites mainly dedicated for communication and internet. OneWebb and SpaceX Starlink/Samsung are presently being built-up (see Figures 1 and 2). On the aerospace industry side, the company SpaceX is an example for New Space. But, can those LEO systems be used for satellite positioning and navigation?

Some Quick Considerations
GPS signals broadcast at 27 Watts which are received at 158 x 10^-18 Watts on earth. Signals of OneWebb and SpaceX Starlink are 1000x (30dB) stronger compared to LEO vs. MEO (GNSS). But, it takes seven LEOs to match the coverage of 1 MEO.

200+ LEOs are needed for similar coverage – but no problem, as both mentioned LEO systems have significantly more than 200 satellites. Thus, the geometry (Dilution of Precision – DOP values) is consequently 3x better than that of present GNSS.

When you consider further, that a positioning error is approximately SIS URE (signal-in-space (SIS) user range error (URE)) x geometry, then we can recognize that the 3x better geometry of a LEO system relaxes the URE. A constellation like OneWeb/SpaceX Starlink could have a URE 3x worse and give comparable positioning performance to GPS (about 3 meters horizontally, 4-5 meters vertically).

The chip-scale atomic clocks (low power < 120mW, small size 17 cc volume, low-cost < 1000 USD … 300 USD) in the LEO satellites are approximately 100x worse at one day compared to GPS atomic clocks. However, we may get comparable performance if they are updated once per LEO orbit (approx. 100min) instead of once every 12 hours (GPS).

Simple computations of the LEO orbits by ground stations indicate that it is possible to achieve 3m RMS, using in addition cross-links approximately 1.5 meters.

And the costs? No taxpayer’s money has to be provided by governments…?

Also, a new feature of satellite positioning in the near future might come up. If the high doppler of the LEO satellites can be used for fast carrier phase ambiguity resolution in conjunction with the GNSS MEO signals – an old proposal by Brad Parkinson and Stanford University (more than 20 years old) – then centimeter positioning from our GNSS in real time can be achieved. A hybrid LEO/MEO solution!

In conclusion: 5G wireless networks and New Space LEO systems for communication and the internet are being built up in the next 10-15 years. Advanced RAIM may make SBAS after 2035 obsolete. So, how does the future of satellite navigation look? No more RNSS and GNSS? Or only military operations with RNSS and GNSS in future?

I follow the customs of the tax authorities (writing-off a GNSS receiver within three years), as it is hard or even impossible to predict the future of satellite navigation over more than 3-5 years. Don’t we live in an exciting (satellite navigation) time and future?

For more details about LEO constellations for navigation, read the following article:
Reid, Tyler G.R., Neish, Andrew M., Walter, Todd, Enge, Per K., “Broadband LEO Constellations for Navigation”, NAVIGATION, Journal of  The Institute of Navigation, Vol. 65, No. 2, Summer 2018, pp. 205-220.

The post Thinking Allowed — Satellite Navigation and New Space appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

There is an increasing importance for GNSS open services for our economy, society, and security, e.g., in the field of traffic monitoring and controlling, be it in the air, at sea, or on land, or in first aid response in any kind of emergency, as well as for timing applications like bank transactions or power grid synchronization. Due to these developments, it is necessary to enhance the availability and more importantly the reliability of GNSS services. Improving the signal robustness against multipath, jamming, spoofing, and interference from secondary sources or even from other constellations is a crucial task for future research and development. To improve GNSS signals, it is crucial to test and analyze the signal performance under various conditions and harsh environments. This was and is done mainly with computer simulations. These simulations are easy and cheap to realize as well as flexible and repeatable. However, a simulation always relies on assumptions and simplifications of a real-world problem. Therefore, we are developing a flexible, cost-efficient, and highly adjustable test system, usable for real test scenarios. With this system, we can investigate the GNSS signal structures, range performance, authentication methods, channel coding, and signal behavior under foliation, blockage, jamming, spoofing, and other interference. 

The upcoming interference challenges for GNSS require a detailed analysis on the GNSS signal level. Therefore, a testing method is needed which goes beyond the possibilities of simulations to create a realistic and flexible test environment. The progress in unmanned aerial vehicles (UAV) and software defined radio (SDR) technologies obtained in recent years provide this efficient and flexible approach to mimic GNSS satellites and create an innovative GNSS signal performance testbed in a real environment. Besides UAV and SDR, our system includes a positioning and ranging unit to obtain the transmitter-receiver ranges in sub-centimeter and millisecond timestamp accuracy. Furthermore, two receiving antennas (Rx) with attached front-ends (FEs) are needed, see Figure 1. With the time synchronized FEs and the knowledge of the true transmission position, it is possible to eliminate the transmission clock error and analyze the code and phase ranging performance of every GNSS signal of interest.

After a detailed presentation of the concept, and an explanation of all relevant components, the performance analysis of the ground system is discussed. Thereafter, we discuss the performance analysis of our UAVlite CBOC signal for different power levels. We conclude with a summary and an outlook.

Concept

The airborne pseudolite (UAVlite), see Figure 6 in a later section, is composed of a UAV with an SDR and a mini PC as payload. The ground system includes two receiving antennas with a distance of around 40 meters apart from each other. The antennas are connected to clock-synchronized FEs with software receivers. In this way the two incoming signals are both tracked and processed with the same receiver clock and receiver clock error (drift) (see Figure 2). With the two code measurements, it is possible to eliminate the clock error from the SDR (dt_sv) on the UAV and the receiver FE clock error (dt_r). Equations (1) and (2) give the measured code pseudoranges (PR) for antenna 1 and antenna 2 to the UAV antenna. Subtracting the observed code pseudoranges P₁ – P₂ leads to the delta-pseudorange code (ΔPRC), expressed in Equation (3), which is independent of the clock errors dt_r and dt_sv. If the geometric range difference ΔGR = ρ₁ – ρ₂ is known, it is possible to investigate the error difference ε₁ – ε₂. The absolute pseudorange is, in our case, of no importance because we only investigate the pseudorange difference. An identical pseudorange offset in both pseudoranges has no influence on the evaluation and is canceled in the difference. Additionally, it is possible to correct the ΔPRC of the constant clock offset dt_Δh induced by hardware delays (dt_h1, dt_h2) via, e.g., cables or FEs. This correction is done by determining the offset of the functions ΔGR(t) and ΔPRC(t). This is possible because the time dependent clock errors dt_sv(t) and dt_r(t) are already eliminated.

The concept of the ΔPRC also applies for the phase pseudorange measurements. The only difference is that in the phase PR (Equations (4) and (5)) an additional term Nλ occurs, where λ is the RF wavelength and N is an integer number, representing the total number of accumulated waves between Tx and Rx antenna. This ambiguity condition N has to be fixed at the beginning and is thereafter constant during the measurement (as the PLL was always in lock). Therefore ΔNλ is like the constant clock offset dt_Δh time independent in the delta pseudorange phase ΔPRP, see Equation (6), and can be determined by determining the offset of the functions ΔGR(t) and ΔPRP(t).

By correcting the delta pseudorange ΔPR(t) for the constant offset cdt_Δh (cdt_Δh + ΔNλ) and subtracting the geometrical range difference ΔGR, we yield the remaining residual error ε₁ – ε₂. This error comes mainly from receiver noise, tracking delay, and noise from the electronics, but also from multipath, jamming, and other interference. Therefore, the influence of these effects on the signal can be studied. One simple idea of our measurement setup is to influence the line of sight from one antenna by foliage and let the other line of sight be unobscured. Therefore ε₁ changes differently than ε₂ and ε₁ – ε₂ is directly related to the influence of foliation on the signal. In this way, we can test GNSS signals on the robustness against foliation.

Components

There are five relevant components for using UAVs as pseudo GNSS satellites and performing signal analysis:

1. the transmitter system (pseudolite); 

2. the receiver systems (capturing, sampling, and recording); 

3. the front-end clock synchronization,

4. the positioning and ranging systems, which are used for precise position measurements of the phase centers of the receiving (Rx) and transmitting (Tx) antennas, and

5. the UAV as payload carrier.

The following section gives a detailed description and performance details of the used components.

Pseudolite (Transmitter)

A software defined radio reconfigurable device is used as the pseudolite (see Manufacturers and Additional Resources). The most critical part of the SDR is the clock. Therefore the clock characteristics and stability are tested and evaluated for the usage as a pseudolite. These results were presented by D. S. Maier et alia (2017) and show that the OCXO clock of the software defined radio reconfigurable device is sufficient and suitable for our system. In this measurement campaign, the device is used for: digital-analog conversion, the up-conversion of the IF-samples to the target RF, and the transmission of the RF. The IF-samples are generated with nominal signal parameters in advance, either with an in-house MATLAB toolbox or with the software transceiver MuSNAT (D. S. Maier et alia (2018)). These IF-samples are stored on a mini PC on the UAV. On the mini PC a LabView software runs to configure the USRP (file, power, RF, and sampling rate), reads in the IF-samples, and sends them to the software defined radio reconfigurable device. The mini PC and the software are controlled via remote control over WiFi by the PC3 on Ground (compare to Figure 2). The computational power of the mini PC allows us an I/Q sampling rate of 40 MS/s with a bit depth of 8 bits per sample.

In an earlier study (D. S. Maier et alia (2017)), the USRP FPGA was also used for the IF sample generation, but this task is now done beforehand and sent to the software defined radio reconfigurable device by the additional mini PC. The mini PC increases the payload weight and decreases the maximum sampling rate, however, it allows us greater flexibility, e.g., power control under operation, and an easier and broader usage of signal generation tools.

A frequency offset of +750 kilohertz was applied for transmission, so the used carrier frequency was 1.57617 GHz (1.57542 GHz + 750 kHz). With this offset we can guarantee the operation of the system without influencing the GNSS services in the surrounding area or the GNSS system on the UAV. Furthermore, the maximum signal power of the transmission is adjusted to a level such that an increase of the noise floor on the ground will never occur (satellite-like signal).

Receiver System

The UAVlite signals as well as the signals in space (SIS) are captured by two geodetic GNSS antennas. The antennas are separated by a distance of approximately 40 meters. On the receiver side we are using multi-GNSS software receiver front-ends (FE) (see Manufacturers and Additional Resources). The setup for signal recording is sketched in Figure 3. The Rx antenna 1 is connected via an RF-splitter to the Single-FE (S-FE) and the first RF input of the Dual-FE (D-FE1), with cable length of approximately 10 meters. The Rx antenna 2 is connected to the second RF input of the Dual-FE (D-FE2), with cable length of approximately 50 meters. Both FE are connected to a PC for IF sample recording. PC1 records the IF sample stream of the S-FE and PC2 records both IF sample streams of the D-FE. Both FE record with a sampling rate of 200 MHz/s and 2 bits per sample (real valued IF sampling). The recorded signals of the D-FE are clock and time synchronized and can be used in post processing without additional clock synchronization effort. However, comparing the record of the S-FE with the record of the D-FE2 is only possible if the FE clocks are synchronized. The clock synchronization is described below. Also a time offset synchronization is needed. This is currently done by tracking the GPS SIS and determining the PC time offsets to the GPS time.

The transmitted UAV signal is without secondary code and therefore without any long range timing information. To overcome this lack of information, the Hardsync option in the MuSNAT is used for the pseudorange determination. In Hardsync mode, the code ambiguity is resolved under the assumption of a vanishing measured receiver clock error, a vanishing satellite clock error, and with geometric distance much smaller than the code period. This procedure can be used and is uncritical as we are only interested in the pseudorange differences and therefore all constant time offsets are canceled, as mentioned earlier.

Front-end Clock Synchronization

The clock synchronization between the GNSS receivers is another crucial element in this testbed because of the absence of an atomic clock in the UAV transmitter. The simplest means of synchronization is to use a coaxial cable in between the two receivers, but a clock synchronization between two buildings (and in a later phase of the project between multiple buildings of the University campus) clearly needs  a long distance synchronization tool. We have chosen the so-called “White Rabbit Project” for this task. An additional advantage of such synchronization devices is, that they support clock synchronization in addition to time synchronization, which provides us a GNSS synchronization with all devices of our setup.

White Rabbit (WR) is a collaborative project of CERN, GSI Helmholtz Centre for Heavy Ion Research, and other partners from universities and industry. The hardware design as well as the source code are publicly available (Additional Resources). Our version is a COTS product of the Spanish company Seven Solutions S.L. with the name WR-LEN. WR-LEN provides sub-nanosecond accuracy via fiber connections over 80 kilometers of length. Thus this approach will allow us to later use multiple ground stations distributed even kilometers away from each other.

In our setup (see Figure 3) we used three WR-LENs. They were connected in a daisy chain (master, slave No. 1, and slave No. 2), in which the master was driven by a GNSS receiver with the PPS and 10 megahertz clock signal. The front-ends were connected with slave No. 1 and No. 2, respectively. One of the front-ends has two phase-aligned inputs, which gives us the possibility to compare the test results with the WR-synchronization, i.e., a “perfect” synchronization. The longest fiber connection we used was 250 meters long with most of the coils still on the cable reel.

The accuracy of the WR-LENs were measured in our laboratory. Therefore, the virtual bench with a customized application program was used to measure the time difference between the clocks of the WR-LENs. Figure 4 shows the histogram of two WR-LENs over a measurement time of approximately 36 minutes. The standard deviation of the clock jitter was 9.4 picoseconds. During the flight tests, we observed deviation between 14 and 16.6 picoseconds. This can perhaps be explained by stronger temperature conditions and/or a higher uncertainty of the measurement setup, but the results are still in the expected range. The brochure of the WR-LEN of Seven Solutions is showing similar results with the same deviation and a maximum time interval error (MTIE) of ±45 picoseconds. The WR concept demonstrated even better results with deviations of five to six picoseconds, but also, that there is a temperature effect on these systems of approximately four picoseconds per one degree Celsius. (See Additional Resources for both of these systems.)

Positioning and Ranging Verification 

For positioning and ranging verification, a multistation is used (again, see Additional Resources). The multistation operates with an electronic distance measurement (EDM) unit to compute the slope distance from the device to a reflector (prism). The distance is calculated by comparing the electromagnetic wave transmitted from the instrument to the one that is reflected back to the instrument. For the position accuracy specification, the distance to a fixed target was measured for five minutes. The distance between the multistation and the target was 20.127 meters. In the five minutes, a standard deviation of the measured distance of 93 μm could be observed. A distance bias was not determined, as constant distance offsets are canceled during the delta range processing. The multistation is able to acquire a target (reflector) up to 450 meters away and track it in locking mode up to 250 meters while the target is moving. This characteristic is very important as we want to track the UAV when it is flying. The maximum speed that the lock mode supports is 14 m/s. As mentioned before, the idea of using the multistation is to measure accurately the position of the three antennas with respect to their phase center: Rx antenna 1 and Rx antenna 2, which stay on ground and have a static position; and the Tx antenna, which is mounted on the UAV and is tracked during the flight (see Figure 5). Hence, a complete description of the geometry between the three phase centers is possible at all times. This allows the computation of the real distances (ρ₁, ρ₂) between the Rx antennas and the Tx antenna.

For Rx antenna 1 and Rx antenna 2, single point measurements are done with the multistation, as they are fixed on the ground and their position is static. On the contrary, with the Tx antenna, the data measured by the multistation is streamed in real time to PC2 through a Bluetooth connection at 20 hertz. The 20 hertz is the maximum measurement rate. In our test we observed a mean rate of 15 ± 5 Hz. The streamed data is stamped with the time given by the multistation. The time of PC2 and the multistation is synchronized at the beginning in the range of milliseconds, thus allowing a direct comparison with the signal recorded on PC2 as they share the same timestamp. Among the data that is streamed, one can find: Northing [m], Easting [m], Elevation [m], horizontal angle [rad], vertical angle [rad], slope distance [m], and time stamp [hh:mm:ss.ss].

Another point worth mentioning is the multistation setup, which is performed prior to the measurements, in which the computation of the orientation of the instrument is performed by using the known position of three geodetic pillars. One pillar, in which the multistation was installed, and the remaining two to use as multiple back sights. This step allows for having the coordinates of the targets in a global reference system instead of the instrument’s local coordinate system.

UAV

For our UAV, we chose a professional octocopter drone. The octocopter has a weight of 4.9 kg and is able to carry a payload of approximately 6 kg (including the batteries). The air time fully equipped is 12 minutes. The drone has IMU, GPS, and compass modules on board for stabilization. To shield the UAV electronics (especially the GPS antenna) from RF interference, an aluminum ground plate must to be installed between the UAV GPS antenna and at the Tx antenna. It was also necessary to cover the housing of the mini PC with EMV paint to ensure the UAV GPS reception. The housing of the mini PC as well as the mounts for the USRP, prism, Tx antenna, and battery were self-designed and 3D printed. A list with the main parts is shown in Table 1. The labels refer to the corresponding parts in Figure 6.

Results

Full results and more will be published in Part 2 in the November/December issue of Inside GNSS. Additionally, a full version of the article will be published online at insidegnss.com.

Manufacturers 

The software defined radio reconfigurable device used in the Pseudolite (Transmitter) section is a SDR USRP 2950R from National Instruments, Austin, Texas. Also, the virtual bench with a customized application program that was used to measure the time difference between the clocks of the WR-LENs was the VB-8054 from National Instruments.

In Receiver System where the authors state that the UAVlite signals as well as the signals in space (SIS) are captured, they are done so with two Trimble Zephyr 2 Geodetic antennas from Trimble, Sunnyvale, CA. Also in the Receiver Section, IFEN multi-GNSS software receiver front-ends (FE) from IFEN GmbH, Poing, Germany, are used; the SX3 Dual-RF-FE (D-FE) and the SX3 Single-RF-FE (S-FE). 

In Positioning and Range Verification, the authors are referring specifically to the MultiStation MS60 from Leica Geosystems, Heerbrugg, Switzerland.

The GNSS receiver used in the Front-end Clock Synchronization section is the PolaRx4TR from Septentrio, Leuven, Belgium and Torrance, CA. 

The drone referenced in the UAV section is the DJI Spreading Wings S1000+ Octocopter from DJI, Shenzhen, China. 

Acknowledgments and Disclaimer

Acknowledgement should go to Gerhard Kestel, Stephan Ullrich, and Mathias Philips-Blum for their support during the measurement campaigns and their work setting up the testbed system. The project is self-funded by the Institute of Space Technology and Space Applications of the “Universität der Bundeswehr München.” The setup and the gained knowledge are and will be used for the DLR projects SatNavAuth (FKZ: 50 NA 1703) and NeedForPRS (FKZ: 50 NP 1708).

Additional Resources

[1] IFEN, “SX3 GNSS Software Receiver,” http://www.ifen.com/products/sx3-gnss-software-receiver.html, 2017

[2] ISTA, “Multi Sensor Navigation Analysis Tool (MuSNAT),” https://www.unibw.de/lrt9/lrt-9.2/software-packages/musnat/view, 2018

[3] Leica Geosystems, “Leica Nova MS60 – The World’s First Self-Learning MultiStation,” http://leica-geosystems.com/products/total-stations/multistation/leica-nova-ms60, 2017

[4] Lipinski, M., “White Rabbit – Ethernet-based Solution for Sub-Ns Synchronization and Deterministic, Reliable Data Delivery,” Presentation (Tutorial), IEEE Plenary Meeting, Genève, July 2013 (http://www.ieee802.org/802_tutorials/2013-07/WR_Tutorial_IEEE.pdf)

[5] Maier, D. S., Kraus, T., Blum, R., Philips-Blum, M., and Pany, T., “Feasibility Study of Using UAVs as GNSS Satellites,” Proceedings of the 30th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2017), Portland, OR, September 2017

[6] Maier, D. S., Frankl, K., and Pany, T., “ The GNSS-Transceiver: Using Vector-Tracking Approach to Convert a GNSS Receiver to a Simulator; Implementation and Verification for Signal Authentication,” Proceedings of the 31st International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2018), Miami, FL, September 2018

[7] National Instruments Corporation, “SPECIFICATIONS USRP-2950,” http://www.ni.com/pdf/manuals/374194d.pdf, 2017

[8] Project on the Open Hardware Repository platform “White Rabbit Project,” https://www.ohwr.org/projects/white-rabbit

[9] Seven Solutions, “WHITE RABBIT LEN – WR-LEN,” brochure, http://sevensols.com/index.php/download/brochure-white-rabbit-len/?wpdmdl=992

Authors

Daniel Simon Maier has a professional training as a technical draftsman and received a bachelor in Physics in 2015 and a master in Applied and Engineering Physics in 2017 from the Technical University of Munich (TUM), Germany. Since 2017 he has been a research associate at the Institute of Space Technology and Space Applications of the “Universität der Bundeswehr München.” His current research interests include GNSS signal generation, signal authentication, and signal performance analysis.

Thomas Kraus graduated with a M.Sc. in Electrical Engineering from the University of Darmstadt, Germany. In 2008, he joined the Institute of Space Technology and Space Applications of the “Universität der Bundeswehr München.” He’s been working as a research associate on several projects of the German Space Agency (DLR) and European Space Agency (ESA-ESTEC). His main research focus is on future receiver design offering a superior detection and mitigation capability of intentional and unintentional interferences.

Daniela Elizabeth Sánchez Morales studied Telematics Engineering at Instituto Tecnológico Autónomo de México (ITAM) in Mexico City. She also holds a Masters degree in satellite applications engineering from the Technical University Munich (TUM). She has been a research associate at the Institute of Space Technology and Space Applications (ISTA) since 2017. Her main research area is sensor fusion. Her current research focuses on LiDAR, sensor fusion between LiDAR and GNSS/INS, and relative and absolute navigation algorithms particularly for terrestrial applications.

Ronny Blum received his Masters in Physics from the University of Basel, Switzerland. He then worked at Würth Elektronik in the field of signal transmission and later on at the Forest Research Institute in Freiburg im Breisgau in the field of GNSS reception within the forest. In 2017 he joined the University of Federal Armed Forces Munich, where he is working in the field of GNSS software receiver.

Prof. Thomas Pany is with the Universität der Bundeswehr München at the faculty of aerospace engineering where he teaches satellite navigation. His research includes all aspects of navigation ranging from deep space navigation to new algorithms and assembly code optimization. Currently he focuses on GNSS signal processing for Galileo second generation, GNSS receiver design, and GNSS/INS/LiDAR/camera fusion. To support this activities, he is developing a modular GNSS test bed for advanced navigation research. Previously he worked for IFEN GmbH and IGASPIN GmbH and is the architect of the ipexSR and SX3 software receiver. He has around 200 publications including patents and one monography.

Em. Univ.-Prof. Dr.-Ing. habil. Dr. h.c. Guenter W. Hein is Professor Emeritus of Excellence at the University FAF Munich. He was ESA Head of EGNOS & GNSS Evolution Programme Dept. between 2008 and 2014, in charge of development of the 2nd generation of EGNOS and Galileo. Prof. Hein is still organising the ESA/JRC International Summerschool on GNSS. He is the founder of the annual Munich Satellite Navigation Summit. Prof. Hein has more than 300 scientific and technical papers published, carried out more than 200 research projects and educated more than 70 Ph. D.´s. He received 2002 the prestigious Johannes Kepler Award for “sustained and significant contributions to satellite navigation” of the US Institute of Navigation, the highest worldwide award in navigation given only to one individual each year. G. Hein became 2011 a Fellow of the US ION. The Technical University of Prague honoured his achievements in satellite navigation with a Doctor honoris causa in Jan. 2013. He is a member of the Executive Board of Munich Aerospace since 2016.

The post Innovative Test System for GNSS Signal Performance Analysis in Real Environments | Part 1 appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

The signal composition and general architecture of the proposed software receiver implementation are provided along with detailed descriptions of the main signal processing algorithms involved in acquisition, tracking, and telemetry decoding of the navigation signal. Connections to external software by means of traditional format output standards are also presented and validated with real-life signals.

The transmission of new radio navigation signals in a dedicated band has revolutionized the GNSS industry by allowing for crosscompatibility and reduced expenses in receiver design. The concept started with the transmission of the Global Positioning System (GPS) L1 C/A signal, which soon after became the gold standard of radio navigation. GLONASS satellites followed and the constellation reached maturity during the Soviet Union era, but degraded after its collapse. The Galileo constellation finally cemented this idea with the addition of the E1 open service signals. Such efforts prepared the field for international collaboration and signal design around the concept of multi-constellation receiver designs.

The Government of the Russian Federation approved by its Decree No. 587 of 20 August 2001, a budget of 347 billion ruble (US $11.81 billion), running through 2020 by which a federal task program will restore and modernize the GLONASS constellation. The program aims at improving the space, groundbased, and user equipment segments of the system. By 2010, the constellation reached full coverage in Russia and in 2011 full operational capability when the full orbital constellation of 24 satellites was achieved. Aiming to provide better accuracy, multi-path resistance, and especially, greater interoperability with GPS, Galileo, and other GNSS, new GLONASS-K satellites will transmit Code Division Multiple Access (CDMA) signals in addition to the system’s traditional Frequency Division Multiple Access (FDMA) signals. GLONASS system restoration is almost completed and the latest updates seem to indicate that the program is on track and has enough budget to complete its modernization in the future (see Additional Resources, I. Revnivykh). The new modernized system will ensure that GLONASS coherent FDMA and CDMA navigation signal sets will satisfy a wide range of user requirements, from ordinary navigation to high-precision applications.

With the international community moving in this direction, it is more common nowadays to see receiver development focused on CDMA techniques targeting single bands and simplifying the receiver design. Given all this, it is worth asking: Is there benefit in GLONASS FDMA signal processing? What are the advantages of a navigation system processing GLONASS FDMA signals?

Previous research highlights feasibility and effectiveness of cheap jammers on radio navigation signals (T. Kraus et alia; A. D. Fonzo et alia). It can be speculated then that a system moving toward a single band navigation system by means of CDMA exploitation is also extremely susceptible to commercial off-the-shelf jammers and Personal Privacy Devices (PPD). An analysis of commercial offthe-shelf units and PPDs showed how these devices can turn a wide range of CDMA signals completely unusable in their presence (T. Kraus et alia). Interestingly enough, of the seven devices studied, only 10% were capable of blocking the bands where GLONASS and its frequency channels operate (Tables 1 and 2). Taking advantage of the processing of GLONASS FDMA signals is not a direct anti-jamming or anti-spoofing technique, but use of these signals does make it harder to harm the system.

Another interesting case was the recently reported episodes of GPS spoofing happening in the Black Sea (S. Goff). Given the resources available, receivers can no longer simply rely on one single constellation or the other. The future lies in the design of receivers capable of mixing solutions from multiple constellations in a wide range of frequencies. Maybe the presence of a GLONASS capable receiver would have avoided the spoofing by allowing the system to eliminate the compromised GPS measurements and perform navigation with the aid of the GLONASS FDMA signals, assuming of course that the latest signals were not also

spoofed in the area during those episodes.

This work presents a new signal addition to the Global Navigation Satellite System Software Defined Radio (GNSSSDR) platform, making the receiver more robust and diverse. With the GLONASS L1 C/A signal addition, the GNSS-SDR software receiver is available for a new set of applications based on the use of the GLONASS FDMA signals. Given the points made earlier, it seems that receivers taking advantage of a new signal could be better prepared against malicious attacks of any kind. This work is not of course the first implementation of the GLONASS L1 C/A signal and there are multiple implementations by commercial off-the-shelf receivers that support this signal without major issues. Such commercial receivers come with a high price tag that could be a barrier in low funded applications or studies. Some open source versions also support the GLONASS L1 C/A signal, like GNSSSDRLIB, but its software implementation is limited to only the Windows 64 bits platform, does not takes advantage of the latest Intel Advanced Vector Extensions (AVX), and does not support its exportation to available embedded platforms (T. Suzuki and N. Tubo).

GNSS Software Receivers

Since the advent of the Software Defined Radio (SDR), an increasing number of GNSS software receivers have been developed by members of the navigation community. Typical implementations will use low level programming languages like C or C++ in order to achieve a real time receiver running in a general

purpose computer or an embedded platform. Another design approach implements the receiver in a high level programming language like MATLAB or Python, and develops a software receiver ideal for post-processing applications. Popular and open source implementations include GNSS-SDR, GNSSSDRLIB, and SoftGNSS. GNSS-SDRLIB, mainly developed by Taro Suzuki was developed in C and uses the RTKLib navigation engine for computation of the position solution (T. Suzuki and N. Kubo). The software receiver supports all major constellations and signals providing acquisition, tracking, and pseudorange metrics for post-processing analysis. This software receiver, however, is no longer under active development. On the other hand, softGNSS is a software receiver for post processing analysis developed in MATLAB, source code of the receiver is provided with the book that introduces it (K. Borre et alia), and it provides code for a GPS L1/CA signal receiver. Even though multiple efforts have been directed towards extending the receiver capability with the addition of new signals and features, its MATLAB implementation does not make this software receiver adequate for real time signal processing. Another important contribution to the community comes with the software receiver developed by Thomas Pany and his book on GNSS signal processing (see Additional Resources), which introduces key concepts of GNSS software processing in personal computers and discusses several common techniques that can be used to achieve real time processing. In the author’s opinion, a major contribution of this book was the usage of assembly language to accelerate common operations on GNSS signal processing.

There are also commercially available software receivers for use in the community. The business approach for this concept mostly includes a combination of IP core licensing and/or royalties for its use. The commercial implementations will serve multiple applications such as multipath and spoofing evaluation, ionosphere scintillation, interference monitoring, etc. One such software receiver version is capable of running in real time more than 300 channels in a general purpose computer with an Intel Core i7-7490k processor. The solution also provides a hardware front end for data collection and is integrated with the software receiver provided (see Manufacturers section near the end of this paper). Other options will provide free academic versions (normally introduced with a textbook) (I. Petrovski and T. Tsujii) and will then charge for a professional version of the software, including one which will also have the option of a custom Radio Frequency (RF) front end to interface with the software receiver. The result of years of experimentation with software radios as applied to GNSS technologies is a well-established set of tools for the scientific community with plenty of options to pick from depending on end applications, budgets, and experience in the field of radio navigation.

GNSS-SDR

Development of the work presented here was accomplished with GNSS-SDR. This is an open source receiver developed in C++ that uses the GNURadio Application Programming Interface (API) to develop a real time software receiver. The high level of flexibility and re-configurability makes this implementation a very appealing solution to an ever increasing radio navigation signal environment. GNSS-SDR provides an interface to different suitable RF front-ends and implements the entire receiver chain from signal reception up to the navigation solution. Its design allows any kind of customization, including interchangeability of signal sources, signal processing algorithms, interoperability with other systems, and output formats, and offers interfaces to all the intermediate signals, parameters, and variables (C. FernándezPrades et alia, 2011). GNSS-SDR runs on a personal computer or an embedded platform and provides interfaces through Universal Serial Bus (USB) and Ethernet buses to a variety of either commercially available or custom-made RF. As an object-oriented platform and with the idea of keeping a sense of abstraction in the blocks developed, GNSS-SDR is divided into several processing blocks that participate in the whole process of navigation for receivers. These blocks (Figure 1) are part of the abstraction level in the software and can be divided as follows: 1) Signal Source Blocks: Hide the complexity of accessing each specific signal source, providing a single interface to a variety of different implementations. 2) Signal Conditioner Blocks: Adapt the sample bit depth to a data type tractable at the host computer running the software receiver, and optionally intermediate frequency to baseband conversion, resampling, and filtering. 3) Channel Blocks: Encapsulate all signal processing devoted to a single satellite. This is a large composite object which encapsulates the acquisition, tracking, and decoding modules. 1) Acquisition Blocks: Provide a coarse estimation of two signal parameters: the frequency shift (f d ) with respect to the nominal Intermediate Frequency (IF) frequency, and a code delay term (τ) of in view satellites relative to the shifted version of the local code replica. 2) Tracking Block: Aims to perform a local search for accurate estimates of code delay and carrier phase, with their eventual variations based on the input provided by the acquisition block. 3) Telemetry Decoder Block: Detects and decodes the navigation message containing the time the message was transmitted, orbital parameters of satellites (ephemeris), and an almanac. 4) Observables Block: Collects all the data provided by every tracked channel, aligns all received data into a coherent set, and computes the observables (pseudorange, carrier phase, etc.). 5) Position Velocity and Time (PVT) Block: Computes the position solution of the receiver based on all the data generated by the previous block.

Extending the Receiver to GLONASS Processing

Due to its different layers of abstraction, prototyping of the GLONASS L1 C/A signal was done rapidly in the code base. Figure 2 shows the blocks of code added to the system and its object oriented properties relationship with the core blocks of the receiver. Note that the figure only displays the blocks created or modified for GLONASS L1 C/A, and is by no means a detailed Unified Modeling Language (UML) diagram of the objects present in the platform. It is worth mentioning that the GNSS-SDR platform uses some of the key concept ideas of GNU Radio in the sense that it has an abstract block upon which all other interfaces and implementations are based. The block GNSSBlockInterface defines a set of basic properties common to all objects that inherit its properties. Direct descendants of this GNSSBlockInterface are interfaces that describe the software receiver, which range from a Channel interface to a PVT interface that serves as the top layer of the software. Once the basic layers of the GNSS-SDR are defined, then the adapter blocks are used to implement the basic methods of these interfaces and define some others if required (C. Fernández-Prades et alia, 2012). This in particular allows for an extremely flexible design in which adapter blocks could be swapped depending on the algorithm or signal to be processed. At the same time, each adapter block’s dependencies connect GNSS-SDR with the GNU Radio API inheriting some functionality of the gr::block upon which the entire GNU Radio platform is defined.

GLONASS FDMA Signal Model

GLONASS satellites orbit Earth at a 64.8 degree inclination (GPS uses six planes at 55 degrees). This inclination is ideal to ensure good coverage of polar latitudes, where a significant portion of the Russian Federation territory is located. The satellites have an altitude of around 19,100 kilometers in a nearly circular orbit with eccentricity near 0 (again, see Additional Resources). The previous orbital parameters make the satellites have an orbital period of 11 hours, 15 minutes, and 28 seconds, with repeating ground tracks every 7 days, 23 hours, 27 minutes, and 28 seconds. As mentioned before, the GLONASS system uses FDMA for its C/A signal. The system now has allocated 14 frequency channels in the L1 band that are spaced from each other with a constant frequency offset. The received signal can be described as per Equation (1): where: PC is the power of signals with C/A code, C k is the C/A code sequence assigned to satellite number k, τ is the code phase received in ground, Dk is the navigation data sequence, f kL1 is the nominal value of the FDMA L1 carrier frequencies, f d is the Doppler frequency seen in the ground, and n is the received noise. The nominal values of the FDMA L1 carrier frequencies are defined by Equation (2): where: k = represents the frequency channel, f 0L1 = 1602 MHz for the GLONASS L1 band, and ∆f L1 = 562.5 kHz frequency separation between GLONASS carriers in the L1 band. Since a total of 24 satellites populate the constellation and only 14 frequency channels are available, GLONASS satellites will share some frequency channels but only when in antipodal positions, i.e., satellites in opposite position on Earth. General parameters of this signal are defined in Table 2.

Signal Source & Signal Conditioner

The Signal Source block hides the complexity of accessing each specific signal source, providing a single interface to a variety of different implementations. Each implementation will target the parsing of data from specific front ends or custom formats in a raw file. It will then transform it to the standard used by the receiver. Using the NT1065 front end (N. C. Shivaramaiah et alia) data was collected across the GLONASS L1 frequency band and minor modifications to the signal source blocks were added to parse the data previously stored in a file. The Signal Conditioner block oversees adapting the sample bit depth to a data type tractable at the host computer running the software receiver, and optionally intermediate frequency to baseband conversion, resampling, and filtering. Regardless of the selected signal source configuration, this interface delivers a sample data stream to the receiver processing channels, acting as a facade between the signal source and the synchronization channels.

Acquisition

The role of an Acquisition block is the detection of signals from a given GNSS satellite. As per Equation (1),

in the case of a positive detection, it should provide coarse estimations of the code phase (τ) and the Doppler shift (f d ) to initialize the delay and phase tracking loops. Since GLONASS FDMA uses a gold code to detect time delay, acquisition techniques developed for GPS L1 C/A were modified to accommodate GLONASS processing. GLONASS signal acquisition can be seen as that of GPS L1 C/A, but instead of looping over different Pseudo Random Noise (PRN) code values, the code will loop over a single code at different frequency channels k. After frequency channel removal, the typical Parallel Code Phase Search (PCPS) algorithm (D. Akopian) (Figure 3) can be used for acquisition. Most importantly, this approach reuses previously developed blocks in the platform, which allows for this flexible level of abstraction within the internal software architecture. Figure 4 shows the acquisition results for a GLONASS satellite in real data collection. The significant peak in the figure indicates a positive signal detection on a frequency channel.

Tracking

The Tracking block is also receiving the data stream xIN, but does nothing until it receives a “positive acquisition” message from the control pane, along with the coarse estimations τacq and f dacq. Then, its role is to refine such estimations and track their changes along time. Three parameters are relevant for signal tracking: the code phase (τ), Doppler frequency (f d ), and carrier phase (ψ). As with the signal acquisition, GLONASS L1 C/A signal tracking reuses blocks developed for the legacy GPS L1 C/A signal tracking. The main difference to consider is the removal of the frequency channel offsets from IF due to its FDMA properties. After carrier removal happens, tracking for GLONASS could be treated as a typical GPS L1 C/A tracking module (Figure 5). Re-usability of existing

blocks reduces code complexity and highlights the benefits of flexibility within the platform. Tracking results are shown in Figure 6. The values for the C/ N0 , carrier frequency (relative to nominal frequency channel), and code frequency are shown in the bottom, while a discrete time scatter plot showing phase lock with bits of navigation is shown up top. Due to the effect of the meander sequence present in the GLONASS Navigation Message (GNAV) message (see Additional Resources), bits of navigation need further processing before decoding can be applied to the signal. WORKING PAPERS FIGURE 3 Generic PCPS acquisition implementation in GNSS-SDR Incoming signal Output Buffering Local oscillator Circular Shift Gold Code IFFT 1 | 2 FFT FFT 90 deg conj Q r FIGURE 4 Acquisition Results for GLONASS Satellite Number 22 in the GNSS-SDR platform Code Delay (chips) 0 –10000 –5000 0 5000 100 200 300 400 Dopler Shift (Hz) Acquisition metric (µ) ×1013 18 16

Telemetry Decoding

Telemetry Decoding block decodes the navigation message for the signal. Once the signal is properly tracked , the Tracking block will start to populate the required fields in the gnss_ syncro object, which ser ves as the pipeline between the implementation of the blocks in the channel. The symbols populated in gnss_syncro will be used to decode the GNAV message after the meander sequence has been removed, as shown in Figure 7. GNAV decoding is a very straightforward process that requires careful bookkeeping between the bit position for each of the fields in the string, which is carefully described in its Interface Control Document (ICD) (see Additional Resources). Following the design pattern of GNSS-SDR, the decoded data was divided into four objects, named Glonass_Gnav_Ephemeris, Glonass_Gnav_Navigation_Message, Glonass_Gnav_Utc_Model, and Glonass_Gnav_Almanac, holding the relationships described in Figure 2.

Observables

The Observables block generates by default three types of measurements for processing in the navigation solution computation. These measurements include pseudo-ranges, accumulated carrier phase, and Doppler frequencies. All of this is generated through a single object called Hybrid_Observables, which computes these measurements in a generic way across all channels. As such, work in this area was minimalistic and only consisted of managing the information flow between the Telemetry Decoder and Observables block. Nevertheless, a proper definition of the measurements as per the GNSS-SDR platform is offered for clarity. Pseudorange Measurements The basic observation equation for the pseudorange as given by K. Borre et alia, assuming that is geometric pseudorange from satellite k to the receiver i, c is speed of light, δti is receiver clock offset, δtk is satellite clock offset, is tropospheric delay, and is ionospheric delay, is Accumulated Carrier Phase Measurements Following the same definition of pseudorange, the carrier phase can be defined as a measurement of ranges as defined in Equation (4) The last term of the equation represents the initial unknown ambiguity in the cycle number relating to the distance between receiver and satellite. However, when applying a differentiation of continuous carrier phase measurements, ambiguities in the number of cycles are eliminated due to the fact that for continuous carrier phase measurements, the ambiguity will be the same in both cases. The result is a measurement of the range rate defined as:

Doppler Shift Measurement

The Doppler effect is the change in frequency for an observer (in this case, the GNSS receiver i) moving relative to its source (in this case, a given GNSS satellite k). Equation (6) gives the relationship between observed frequency f i and emitted frequency f k : Since the speeds of the receiver vi(t) and the satellite v k are small compared to the speed of light c, the difference between the observed frequency f i and emitted frequency f k can be approximated by Then, the Doppler Effect measurement can be written as where r r (t) and vr (t) are the position and velocity of the receiver at the instant t. The term v (s)(t(s)) − vr (t r ) T is the radial velocity from the receiver relative to the satellite, and and are the receiver and satellite clock drift, respectively. The Doppler Effect measurement is given in Hz.

PVT

The PVT solution in GNSS-SDR currently uses a module created based on the RTKLib library. As such, the GLONASS integration to this module was only in charge of providing the necessary conversion tools to translate from
the GNSS

-SDR modules to the RTKLib input. All conversion parameters were developed following the description of the RTKLib API library (T. Takasu and A. Yasuda). To test the code developed and presented in this work, a GNSS data logger using the NT1065 front end was used. The data logger of this device allowed for mult

i-frequency, multiband collection at the same time. For this study, the specific configuration loaded in the device’s firmware targeted a data collection for GPS L1 C/A, GLONASS L1 C/A, GLONASS L2 C/A, and GPS L2C, simultaneously. Figure 8 shows the first position solution for GLONASS L1 CA signals ever achieved by GNSSSDR. The figure shows the position of the receiver in the Earth Centered Earth Fixed (ECEF) coordinate frame with the position covariance for each of the components. The figure also plots the clock variation error, the number of observations used during the position computation, and the estimated position across the X and Y components relative to the true antenna position. Finally, the 90% Circular Error Probable (CEP) statistic, as per the description by G. M. Siouris, is shown. Case Study: Performance under RFI A Radio Frequency Interference (RFI) tone was introduced in the data set collected for the GPS L1 C/A signal, simulating a scenario where a common Continuous Wave (CW) PPD device will null the operating band of the signal. Typical RFI devices, such as those described in Table 1, were studied and a pulse mimicking their behavior was generated to null the band. The simulated interference in the band was inserted 60 seconds into the collected data (allowing initial position solution computation) and lasted for about 20 seconds. Figure 9 shows the position solution generated by GNSSSDR under the presence of a nulling RFI tone. After 60 seconds of data processing, the position solution stops, resuming around 50 seconds later. This indicates the inability of the receiver to compute its position. Also of interest is the fact that after the RFI resumes, the receiver will need to spend time to decode the ephemeris data before being able to compute a position solution unless some intelligent signal processing technique is applied to reuse the previous decoded ephemeris. If under the assumption of this experiment, a PPD device as in Table 1 is used, then the GLONASS FDMA signals could be used to keep the position solution active, even during the jamming period. Results of this scenario are shown in Figure 10. The receiver, when using a combined solution of GPS L1 C/A and GLONASS L1 C/A, is able to provide position estimates even though the RFI tone is nulling the GPS L1 band. Due to the reduction in the number of observations when the GPS L1 band is nulled, a small performance hit is seen but no loss of the position solution happens, which is the cumbersome mission of the proposal.

Conclusion

This article presents the first-ever position solution of GLONASS L1 C/A in the GNSS-SDR platform. This addition will allow the receiver to take advantage of the FDMA signals available in the radio navigation spectrum and will open a new set of tools for the scientific community to use in the diverse field of GNSS processing. Addition of the GLONASS L1 C/A in a combined position solution is a simple but effective technique to aid the overall position solution of a receiver when in the presence of RFI or spoofing attacks. We also present a detailed description of the process of signal addition to the GNSS-SDR platform and serves as a template for developers with the intention of contributing to the platform.

Acknowledgments

This material is based upon work partially supported by the National Science Foundation Graduate Research Fellowship under Grant No. DGE 1144083 and the Google Summer of Code (GSoC) 2017 program. Special thanks to the GNSS-SDR team mentors during the GSoC 2017 program including Luis Esteve, Carles Fernandez–Prades and Jordi Vilà Valls. In addition, special thanks to Professor Dennis M. Akos for providing some of the data sets used during the testing stage and to the editors of this manuscript Dr. Nagaraj Channarayapatna Shivaramaiah, Sara Hrbek, and members of the University of Colorado at Boulder Wri

ting Center. Manufacturers The first software receiver described in the GNSS Software Receivers section of the article and in Additional Resources (Pany et alia, 2012) is the SX3 software receiver developed by IFEN GmbH from Poing, Germany. Another commercial receiver discussed in the section was the ARAMIS from iP-Solutions with offices in Japan, UK and the U.S. Additional Resources 1. Akopian, D., “Fast FFT based GPS Satellite

Acquisition Methods,” IEE Proceedings – Radar, Sonar and Navigation, Volume: 152, Issue: 4, 2005 2. Borre, K., D. Akos, N. Bertelsen, P. Rinder, and S. Jensen, A Software-Defined GPS and Galileo Receiver: A Single-Frequency Approach, Applied and Numerical Harmonic Analysis, Birkhäuser, 2007 3. Fernández–Prades, C., J. Arribas, P. Closas, C. Avilés, and L. Esteve, “GNSS-SDR: An Open Source Tool For Researchers and Developers,” Proceedings of the ION GNSS 2011 Conference, Portland, OR, 2011 4. Fernández–Prades, C., J. Arribas, L. Esteve, D. Pubill, and P. Closas, “An Open Source Galileo E1 Software Receiver,” Proceedings of the 6th ESA Workshop on Satellite Navigation Technologies (NAVITEC ’12), ESTEC, Noordwijk, The Netherlands, 2012 5. Fonzo, A. D., M. Leonardi, G. Galati, P. Madonna, and L. Sfarzo, “Software-Defined-Radio Techniques Against Jammers for In-Car GNSS Navigation,” 2014 IEEE Metrology for Aerospace (MetroAeroSpace), 2014 6. Goff, S., “Reports of Mass GPS Spoofing Attack in the Black Sea Strengthen Calls for PNT Backup,” Inside GNSS, 2017 7. Kraus, T., R. Bauernfeind, and B. Eissfeller, “Survey of In-Car Jammers – Analysis and Modeling of the RF Signals and IF Samples (Suitable for Active Signal Cancelation),” Proceedings of the 24th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS 2011), Portland, OR, 2011 8. Pany, T., Navigation Signal Processing for GNSS Software Receivers, GNSS Technology and Applications Series, Artech House, 2010 9. Pany, T., N. Falk, B. Riedl, T. Hartmann, G. Stangl, and C. Stöber, “An Answer for Precise Positioning Research,” Innovation: Software GNSS Receiver, 2012 10. Petrovski, I., and T. Tsujii, Digital Satellite Navigation and Geophysics: A Practical Guide with GNSS Signal Simulator and Receiver Laboratory, Digital Satellite Navigation and Geophysics, Cambridge University Press, 2012 11. Revnivykh, I., “Glonass Programme Update,” 11th Meeting of the International Committee on Global Navigation Satellite Systems, Sochi, Russian Federation, 2016 12. Russian Institute of Space Device Engineering, “Global Navigation Satellite System (GLONASS) Interface Control Document, Navigational Radio Signal in Bands L1, L2,” Technical Report, Moscow, 2008 13. Shivaramaiah, N. C., D. M. Akos, and K. Yan, “A Multi-band GNSS Signal Sampler Module with Open-Source Software Receiver,” Proceedings of the 29th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2016), Portland,

OR, 2016 14. Siouris, G. M., Aerospace Avionics Systems : A Modern Synthesis, Academic Press, 1993 15. Suzuki, T. and N. Kubo, “GNSS-SDRLIB: An OpenSource and Real-Time GNSS Software Defined Radio Library,” Proceedings of the 27th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS 2014), Tampa, FL, 2014 16. Takasu, T. and A. Yasuda, “RTKLIB ver. 2.4.2 Manual,” No. C, 2013

Authors

Damian Miralles is a graduate student in the Department of Aerospace Engineering Sciences at the University of Colorado Boulder. He received a B.S. in Electrical and Computer Engineering from the Polytechnic University of Puerto Rico. His research interests are in GNSS receiver technologies, software defined radio and digital signal processing.

Gabriel F. P. Araujo is an undergraduate student in the Faculty of Technology at the University of Brasilia, Brazil, and scholarship researcher at LARA (Automation and Robotics Laboratory). He works with robotics estimation and navigation. He is currently working with SDR development, a software-defined radio for mobile robot localization using multi-constellation GNSS systems.

Em. Univ.-Prof. Dr.-Ing. habil. Dr. h.c. Guenter W. Hein is Professor Emeritus of Excellence at the University FAF Munich. He was ESA Head of EGNOS & GNSS Evolution Programme Dept. between 2008 and 2014, in charge of development of the 2nd generation of EGNOS and Galileo. Prof. Hein is still organizing the ESA/JRC International Summerschool on GNSS. He is the founder of the annual Munich Satellite Navigation Summit. Prof. Hein has more than 300 scientific and technical papers published, carried out more than 200 research projects and educated more than 70 Ph. D.´s. He received in 2002 the prestigious Johannes Kepler Award for “sustained and significant contributions to satellite navigation” of the US Institute of Navigation, the highest worldwide award in navigation given only to one individual each year. G. Hein became a Fellow of ION in 2011. The Technical University of Prague honored his achievements in satellite navigation with a Doctor honoris causa in Jan. 2013. He is a member of the Executive Board of Munich Aerospace since 2016.

The post Robustness Improvements for the PVT Solution via Consideration of GLONASS in a GNSS Software Defined Receiver appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Precise Point Positioning (PPP) techniques can be defined as processes where a single GNSS receiver can precisely compute its position (down to centimeter level) by autonomously correcting its raw pseudorange and carrier phase measurements using the PPP correction message content. PPP corrections data include the constellations’ orbits, clocks, code, and phase biases. They are provided to the receiver via different types of communication channels. The PPP enabled receiver handles these corrections in a real-time process.

PPP based positioning techniques have been extensively investigated and developed in recent years. These methods are now rather mature and provide very good means to achieve in real-time a few centimeters of accuracy and precision in remote areas, where other solutions like real-time kinematic (RTK) are impracticable or too expensive. One main advantage of PPP approaches is that they provide a global means to achieve high accuracy based on a global and low density network of base stations. There is no need for a very dense network of stations in the vicinity of the user, which is often unfeasible in remote areas.

Although PPP algorithms are the cornerstones of these methods, another important issue for their practical use is the way the PPP corrections can be provided to the user receiver. So far, typical solutions encompass:

• Internet, using fixed or mobile internet connections like mobile phone networks (3G/4G). This is a simple solution that suffers from a number of telecommunications issues such as connection discontinuities, unavailability or bad quality of the transmission in remote areas, and costs or limitations for data transmission. Use of such a solution for PPP broadcast to users would also generate a few gigabytes of data transmission per user per month. A generalized use to millions of users (for example, in cars) could rapidly exceed the network capacity.
• Satellite-based PPP solutions. These channels are more adapted to such a broadcast and do not suffer from the above described limitations. Commercial broadcast of such proprietary PPP service by specific Geostationary satellite channels is available (see O. Heunecke and H. Heister in Additional Resources) but requires proprietary receivers and remains expensive, thus limiting its use. Broadcasts using other satellite orbits have also been tested on Highly Elliptic Orbits (HEO) on the Quasi-Zenith Satellite System (QZSS) (C. H. Wickramasinghe and L. Samarakoon; K. Harima et alia) or planned with the Commercial Service (CS) on the Galileo constellation. Figure 1 (see inset photo, above right) shows the architecture of this demonstration, providing PPP via a Galileo E5b signal in real-time, through a geostationary satellite. This demonstration benefited from the opportunity that an EGNOS satellite in test was available, and that an E5b channel was free on the EGNOS payloads.

Complementarity Between MEO and GEO Based PPP Solutions
A demonstration of the PPP message being broadcast on the Galileo E6 central frequency was carried out by I. Fernandez et alia, and showed that broadcasting a PPP message through Medium Earth Orbit (MEO) satellites is meaningful. However, it also showed the weaknesses of such a scheme:

• A relatively high time latency causing decreased positioning performances;
• A low availability of the E6 message.

Adding a Geostationary Orbit (GEO) PPP broadcast channel to a Galileo MEO E6 channel could have the following advantages:

• A higher overall availability thanks to both frequency and spatial diversity. Indeed, the E6 frequency band is not part of the Aeronautical and Radio Navigation Satellite Service (ARNSS) band, and is more subject to interference than the E5b band. On the other hand, considering different types of environments, GEO signals may be masked in harsh environments like urban or deep urban situations. As GEO satellites are stationary, the receiver must be in an unmasked area towards the GEO. Another solution would be to involve differential measurements in the masked area with a second receiver. In such environments, MEO satellites have a clear advantage. It has to be noted that typically in urban areas, PPP is also accessible via wireless internet access such as 3G or Wi-Fi. In open sky environments, the GEO satellites have the advantage of providing a continuous service available in the whole GEO footprint;
• A higher geographic coverage thanks to the combination of MEO and GEO coverage, as MEO satellites offer higher latitudes coverage compared to GEO coverage;
• A higher data rate, as the PPP message can be broadcast with an incremental precision using both the E5b and E6 bandwidth. Using the GEO E5b bandwidth could alleviate the needs of bandwidth on GALILEO MEO E6 for high accuracy service, thus allowing more room for other commercial services like authentication service.

Most importantly, and apart from this end user service complementarity between MEO and GEO satellite-based PPP solutions, the E5b channel available today on EGNOS GEO satellites may be used in the future for several Galileo E6 CS testing ends. This is especially true as it is possible to use existing receivers compatible with Galileo E5b signals to process the PPP message by applying only a firmware update of the receiver, which greatly simplifies the needed infrastructure and thus allows for early testing of different possible Galileo E6 CS functionalities.

In this context, we propose to evaluate the feasibility of broadcasting a signal containing PPP information, via a Galileo signal through a GEO satellite, with a demonstration aiming at evaluating the obtained positioning performances in real conditions.

The demonstration principle consists of broadcasting an E5b signal containing value-added information into an ad-hoc user segment, using the SES Satellite-Based Augmentation System (SBAS) payload capacity to repeat such a signal. The value-added data incoming in real-time from a CNES hosted internet server are encapsulated in a message and signal structure similar to that of Galileo E5b.

Thales Alenia Space with the support of SES Networks implemented a preliminary demonstration of this capacity in early 2015. A second window of opportunity to broadcast the PPP signal through an EGNOS GEO payload was available in July 2016.

Following the context and demonstration presentation, this article describes the detailed test-bed architecture and presents results first obtained in factory and then in an on-site real time configuration.

GEO E5b SIS CHARACTERISTICS
GEO E5b SIS Structure
The E5b GEO signal center frequency is set to 5767.14 MHz for the uplink (NLES-to-Satellite RF link) and to 1207.14 MHz for the downlink (Satellite-to-users broadcast RF link). This is the same center frequency as that used for the Galileo E5b signals. Figure 2 (see inset photo, above right) shows the frequency plan used for this testbed, the resulting measured uplink EGNOS + PPP spectrum on site, and the spectral separation between the EGNOS L5 and the PPP E5b signals. A complete analysis of this spectral separation and interactions between both signals was assessed in H. Al Bitar et alia (2013).

The modulation used to generate the E5b signal is also the same as the one used for the nominal Galileo E5b signal, defined in the Galileo Open Service Signal In Space Interface Control Document (OS SIS ICD) (see Additional Resources). Namely a BPSK(10) modulation is used on two quadraphase channels: one data and one pilot. The data rate is the same as for Galileo E5b (250 sps).

The ranging codes are built from so-called primary and secondary codes by using a tiered codes construction (see Galileo OS SIS ICD).

The signal’s primary and secondary codes comply with the E5b ranging code characteristics. The Galileo PRN 38 as defined in the Galileo ICD is used. This PRN is not part of the Galileo PRNs that are assigned to Galileo satellites. Secondary codes CS41 and CS10088 as defined in the OS SIS ICD are allocated to the E5b GEO signal data and pilot components, respectively.

Tables 1 through 3 (see inset photo, above right) summarize the GEO E5b SIS structure and main RF characteristics.

It is important to note that the PPP corrections typically need a large bandwidth in order to achieve good performance, especially when providing corrections for several satellite constellations. Obviously, limiting the required data bandwidth is always necessary, due to the high cost of this scarce resource. But limiting the bandwidth may impact the resulting PPP performances such as solution accuracy and convergence time and the availability of PPP service to users. Thus a trade-off generally must be found between these two constraints.

For this demonstration, innovative compression techniques developed by the CNES were used to broadcast PPP corrections with the data rate available on one E5b Galileo like signal, i.e., 125 data bits/second, while keeping very good final accuracy and convergence time performances, as shown in the results presented later. These compression techniques are briefly described in the next paragraph.

GEO E5b PPP Message Characteristics
The E5b PPP message has the same structure as the Galileo E5b I/NAV message. The only difference is that the useful data bits of the Galileo E5b I/NAV message are replaced by the PPP corrections Radio Technical Commission for Maritime (RTCM) message, as described in Figure 3 (see inset photo, above right).

In the frame of this PPP demonstration campaign, the word type is set to 63, thus indicating a dummy message.

The PPP correction message contents are generated by the so-called CNES caster.

Indeed, in the framework of the International GNSS Service (IGS) Real Time Service (RTS) (see Additional Resources), CNES provides GNSS augmentation data in real-time. These data include the constellations’ orbits, clocks, code, and phase biases. The main goal of the participation in the IGS RTS for CNES is to promote a new precise point positioning technique that performs undifferenced ambiguity resolution (A. J. Van Dierendonck et alia; D. Laurichesse et alia (2006)). It allows for the positioning of an isolated receiver with centimeter level accuracy in real-time.

In the IGS RTS, the dissemination of the different quantities is performed by means of an open standard, the RTCM. The quantities are defined in a State Space Representation (SSR) (D. Laurichesse and A. Privat), as opposed to other techniques like RTK, which use an Observation State Representation.

Table 4 contains the different RTCM/SSR messages used by the CNES PPP demonstrator and available on the CLK91 mountpoint.

The RTCM standard is primarily designed for terrestrial communications and not with a very low bandwidth in mind. For example, the above-mentioned stream has a bandwidth of several kilobits/second, and is clearly not compatible with the bandwidth of the I/NAV E5b message of 186 bits every two seconds. Thus, an efficient compression scheme and a new message format need to be designed.

In order to compress the initial RTCM stream by a factor of 50, several ingredients are used. The chosen solution (inspired by other augmentation messages like those used in SBAS or JPL-GDGPS (see Additional Resources) is a trade-off between the available bandwidth and corrections latency, while maintaining the main characteristics of PPP, including ambiguity resolution:

• Selection of a reduced set (20) of satellites over the area of service (namely the European continent in this case). The satellites are selected upon their visibility and sorted by their elevation.
• Suppression of the code biases messages. Indeed, as the PPP is mainly a phase solution, code biases are not needed. In the user solution, code measurements are underweighted.
• Phase biases are directly applied to the clocks and do not need to be transmitted.
• Finally, each I/NAV message is comprised of:
  • A “slow” part containing orbit corrections, their first order derivative, a raw clock, and the widelane bias for one satellite.
  • A “fast” part containing accurate clock correction for four satellites.

With four clock corrections transmitted every two seconds, the set of 20
satellite clocks is actualized every 10 seconds. The entire cycle for
the orbit corrections is 40 seconds.

The compression module takes as input the CLK91 stream and sends the compressed stream to a new mountpoint created for this purpose on the CNES caster. It is then possible to access the compressed stream by simply pulling the new stream from the caster.

Figure 4 shows the gain in bandwidth brought by the compression algorithms, as measured by the independent BNC tool (again, see Additional Resources). The improvement is clearly visible.

On the user side, the PPP-Wizard open source software (Version 1.2) is used (D. Laurichesse). This tool is compatible with the RTCM real-time stream available at the IGS Real Time Service and provides centimeter level accuracy in real-time. It has been modified to support the decoding of the new compressed stream.

GEO E5b SIS Generation Scheme
The GEO E5b SIS is generated by an Earth station that is independent from EGNOS NLES. Two one-way links between the EGNOS NLES and the E5b generation Earth station were still needed in this PPP demonstrator for:

• A 10 megahertz input to the different E5b GEO SIS Earth generation station components
• A 1 PPS input for some of these components

These two links were maintained for the sake of E5b Earth station complexity and cost reduction. The different E5b Earth station possible architectures were thoroughly discussed by H. Al Bitar (2013).

DEMONSTRATION SETUP
We now describe the on-site demonstrator setup for the live tests. A description of specific setup related to factory tests follows.

On Site Setup
This section details the on-site setup. The demonstration took place in July 2016 at Betzdorf, Luxembourg, on the SES site. The PPP corrections are provided by the CNES PPP caster. Then, in the NLES E5b, the PPP corrections are encapsulated in the Galileo E5b message format, and generated via a Galileo E5b signal, with the PRN code 38. For the demonstration, the signal is uplinked via the C5 frequency on the SES ASTRA 5B GEO satellite. Finally, the Galileo E5b signal is broadcast via this GEO satellite over Europe, via the E5b frequency.

A commercial off-the-shelf (COTS) receiver is based at Toulouse in order to receive the Galileo E5b signal with the PPP corrections, broadcast by the GEO ASTRA 5B satellite. To be able to use these PPP corrections, the user also needs GNSS constellation measurements. In this demonstration, the PPP corrections for GLONASS and GPS are used.

Thus, the receiver needs to receive GNSS measurements from the GPS and GLONASS constellations.

The E5b demonstrator functional architecture is shown in Figure 5.

The demonstrator is composed of:

• The CNES PPP caster, in charge of the provision of the PPP corrections via internet,
• The NLES E5b, in charge of the Galileo E5b signal, in which the
  PPP corrections are encapsulated, (Figure 6), This station is in turn
  composed of :
• A control PC developed by Thales Alenia Space for this dem
• A signal generator developed by Thales Alenia Space and Elta (NAVYS) providing the flexibility to generate nonstandard signals,
• An L-to-C band frequency converter,
• An RF adapter in order to ensure that the transmitted signal
  quality complies with the uplink and downlink Signal In Space interface
  requirements. It includes an analogic filter, attenuators and splitters
  and combiners when needed.
• The NLES G2, in charge of the provision of time (PPS) and
  frequency (10 megahertz) references to the NLES E5b, along with the
  generation of the EGNOS L1 and L5 signals,
• The SES broadcast means, in charge of the broadcast of the signals
  (EGNOS L1 and L5, and Galileo E5b) over Europe via the GEO ASTRA 5B
  satellite,
• An E5b analysis module, in charge of the verification of the emitted Galileo E5b signal, and
• A PPP solution module, in charge of the reception of the Galileo
  E5b signal, in addition to the GPS and GLONASS measurements, in order to
  compute the PPP solution.

The CNES PPP caster provides PPP corrections via an internet connection. Detailed information on the CNES PPP caster can be found in the Additional Resources section.

The NLES E5b Control PC has two main functions:

• It manages the data interface by communicating with the CNES caster, and
• It manages the real-time interface with the NAVYS GNSS signal
  generator, by sending the real-time data message to NAVYS appropriately
  formatted.

These functions are performed by:

• TPACQ (standing for Thales PPP ACQuisition), in charge of the
  connection to the remote server, the extraction of the payload, its
  convolutional encoding, the construction of a Galileo I/NAV-like format,
  latency management, and providing a data message each and every second,
• GATEWAY, in charge of receiving the messages and writing them in
  the GCS hard drive. It sends commands to the GCS, writes synchronization
  commands, and writes the navigation message.

The RF interface is managed by the NLES-E5b RF Adapter elements. This RF interface is configured based on the given SES RF interface requirements, and the GSA downlink signal quality and characteristics requirements. It allows for controlling the output signal center frequency, power, bandwidth, in and out of band interference, etc.

The RF adapter is composed of:

• An RF filter. This is used at the output of the NAVYS generator in
  order to guarantee that the spectral characteristics of the L5
  generated signal are compliant with the needed safety barriers for the
  uplink signal.
• An Advantech L to C tunable up-converter, borrowed from the NLES
  G2 factory platform. This equipment, originally designed to up-convert
  EGNOS L5 signals in the uplink transmission band with the desired
  amplification level, perfectly fits the demonstrator needs because of
  its passband. It performs the L5 to C5b frequency translation of the
  signal generated by NAVYS.

The NLES G2 is the new generation of EGNOS NLES embedding the ability to generate L1/L5 dual-frequency GEO signals. As already stated, and in order to have a simplified architecture for the NLES E5b, it is foreseen for this station to share some outputs of the NLES G2, such as the 10 megahertz frequency reference and the 1 PPS signal.

The SES broadcast means include the uplink signal interface and the downlink signal interface. The uplink signal interface is a one way RF interface carrying the C5b signal to be uplinked to the GEO satellite. The power level must be adjusted so that, at the SES RF interface, the total power level in the C5 band is -5 dBm. In the demonstration configuration, the power of the C5b component equals -10 dBm. In order to obtain a resulting signal with a power of -5 dBm, the power of the C5a component must equal -6.5 dBm. This configuration is of high interest as authorities could dislike the idea of reducing the power budget allocated to the Safety of Life (SoL) component. The downlink signal interface is a one-way RF interface carrying the E5b signal received by the SES RF station from the ASTRA 5B satellite.

The E5b analysis module is composed of the Thales Alenia Space software receiver, GEMS, and a specific post-processing analysis tool, developed for the demonstration.

The PPP solution module is composed of a GNSS commercial off-the-shelf (COTS) receiver with a firmware patch to allow the processing of the Galileo PRN 38, and a PPP solution computation unit developed by CNES.

The GNSS receiver tracks the GPS and GLONASS constellation signals in order to provide dual-frequency GNSS measurements to the PPP solution computation unit (see Figure 7). In addition, the receiver tracks the Galileo E5b signal from satellite PRN38, corresponding to the E5b signal broadcast by the GEO ASTRA 5B satellite. As mentioned previously, this E5b signal provides the PPP corrections, associated with the GPS and GLONASS satellites and optimized for a user located in the GEO satellite ground track.

Factory Setup
Prior to the on-site demonstration, a comprehensive set of factory tests were performed.

The different objectives of this factory test campaign are recalled as follows:

• Integration of all the demonstrator elements,
• Verification of the feasibility of the demonstration,
• First assessment of the demonstrator performances,
• Demonstration that the demonstrator is compliant with SES requirements,
• Demonstration that the demonstrator does not jeopardize the EGNOS SoL operations.

During factory tests, a so-called GEO Payload Simulator was used to replace the GEO satellite. The GEO Payload Simulator simulated the uplink-GEO-downlink path of both L1 and L5 signals, and was used to generate the E5b signal uplink and downlink paths as well.

DEMONSTRATION RESULTS
Factory Live Tests Results
The factory test on Thales Alenia Space premises was performed on June 15, 2016. The conditions of the test were the same as those described in Figure 5, except that the GEO satellite was simulated by means of an RF payload simulator as previously stated.

Figure 8 shows the error of the PPP, obtained by computing the difference between the PPP module output and the accurate reference coordinates of the receiver antenna, projected in the local frame.

These results are representative of a PPP processing. After a first convergence phase of about one hour, the accuracy is less than 10 centimeters. Fourteen satellites is typical of the dual-constellation (GPS, GLONASS). After convergence, the horizontal accuracy has a Root Mean Square (RMS) error of seven centimeters. Up to six satellites have ambiguities estimated to their integer value. The overall latency is about 30 seconds and explains the short-term noise of the solution.

This successful result demonstrates the validity of the implementation.

On-Site Live Tests Results
The live experiment took place from July 21-27, 2016. The receiver was located on CNES premises, using a geodetic grade antenna on a roof of a building. The NLES E5b was installed on an SES site in Betzdorf, Luxembourg, together with the NLES G2 for the SES ASTRA 5B satellite.

On a typical one-day session (July 24, 2016), PPP results are identical to those obtained during the factory tests, in terms of convergence and accuracy (Figure 9):

After convergence, the RMS of the horizontal accuracy is approximately eight centimeters. The latency measured in this case is about 23 seconds. Note that the latency is mainly due to this testbed configuration, and will be reduced in any future deployment of such PPP corrections broadcast test.

In order to have a better understanding of the contribution of the GEO transfer function in terms of accuracy, the same measurements were processed using the RTCM realtime corrections, before the stream compression. The results are presented on Figure 10. The horizontal RMS is equal to two centimeters. We can deduce that the noise of the transfer function (compression and end-to-end latencies) is equal to seven-and-a-half centimeters.

Conclusion
The main and novel aspect of this article is obviously the implementation of a complete end-to-end GEO satellite-based PPP solution via real live tests.

A proof of concept was first assessed through a laboratory real-time testbed. Next, an on-site real-time end-to-end demonstration was held with different levels of implications of the concerned stakeholders (European GNSS Agency (GSA), SES, ESSP, CNES, and Thales Alenia Space).

The success of this demonstration first reminds us that an E5b non-SoL signal can co-exist with an SoL signal.

Second, and most importantly, the results presented here showed that with only 125 bits/second data rate available on a Galileo E5b-like message, the final accuracy and convergence time performance of the computed solution are still very satisfying (horizontal positioning error equal to eight centimeter RMS after a first convergence step of one hour).

This testbed further demonstrated that broadcasting an additional signal through an existing and transparent GEO payload requires neither heavy nor complex technical means. It is thus compatible with a possible fast deployment and could operate as a test platform for various functionalities to the upcoming CS E6 Galileo signal for example.

Ultimately, a GEO PPP broadcast channel and a Galileo MEO E6 channel used together could result in an improved accuracy service with better performance, thanks to an enhanced availability (frequency and spatial diversity), a higher geographic coverage, and a higher data rate.

Acknowledgements
We would like to thank the GSA (European GNSS Agency), ESSP, and SES engineering and operations teams for their very valuable support to E5b signal testing on SES’s EGNOS uplink station and ASTRA 5B EGNOS payload. We would also like to thank Septentrio for their support in providing a new firmware version of the PolaRx5 receiver allowing for tracking of the Galileo PRN 38 code.

Additional Resources
[1] Al Bitar, H., M. Raimondi, L. Ries, “NLES-NG: Augmenting EGNOS with an E5b Channel,” Proceedings of the 6th European Workshop on GNSS Signals and Signal Processing, Munich, December 2013
[2] Al Bitar, H., M. Raimondi, D. Kubrak, L. Ries, “Augmenting EGNOS with an E5b Channel,” Proceedings of The Institute of Navigation International Technical Meeting (ION ITM 2014), San Diego, CA, 2014
[3] Charlot, B., H. Delfour, D. Laurichesse, P. Lesage, “Efficient Message Coding To Broadcast PPP Corrections Through Satellite,” Proceedings of ISGNSS 2014, ICC Jeju, Korea, 2014
[4] Fernandez, E. C. I., I. Rodriguez, G. Tobias, J. D. Calle, E. Carbonell, G. Seco-Granados, J. Simon, R. Blasi, “Galileo’s Commercial Service, Testing GNSS High Accuracy and Authentication,” Inside GNSS, January/February 2015
[5] Galileo OS SIS ICD
[6] Harima, K. et alia, “Performance of Real-Time Precise Point Positioning using MADOCA-LEX Augmentation Messages,” International Federation of Surveyors Congress, Kuala Lumpur, Malaysia, 2014
[7] Heunecke, O. and H. Heister, “Worldwide Kinematic Positioning using the OmniSTAR HP and XP Services,” Institute of Geodesy, University of the Bundeswehr, Munich, 2010
[8] JPL GDGPS message
[9] Laurichesse, D., “The CNES Real-time PPP with Undifferenced Integer Ambiguity Resolution Demonstrator,” Proceedings of ION GNSS 2011, Portland, OR, September 2011
[10] Laurichesse, D., F. Mercier, J. P. Berthias, P. Broca, L. Cerri, “Integer Ambiguity Resolution on Undifferenced GPS Phase Measurements and its Application to PPP and Satellite Precise Orbit Determination,” NAVIGATION, Volume: 56, Issue: 2, Summer 2009
[11] Laurichesse, D. and A. Privat, “An Open-source PPP Client Implementation for the CNES PPP-WIZARD Demonstrator,” Proceedings of ION GNSS 2015, Tampa, FL, 2015
[12] SC-159, “Minimum Operational Performance Standards for Global Positioning System/Wide Area Augmentation System Airborne Equipment,” RTCA DO 229 D, Annex A, December 13, 2006
[13] Van Dierendonck, A. J. et alia, “Relationship between Allan Variances and Kalma Filter Parameters,” Proceedings of the 16th Annual Precise Time and Time Interval (PTTI) Applications and Planning Meeting, NASA Goddard Space Flight Center, pp 273–293.
[14] Wickramasinghe, C. H. and L. Samarakoon, “QZSS LEX Message Data for Precise Point Positioning,” Coordinates, A Monthly Magazine on Positioning, Navigation and Beyond, 2013
[15] https://igs.bkg.bund.de/ntrip/download, http://www.igs.org/rts, http://www.ppp-wizard.net, http://www.rtca.org
[16] http://www.igs.org/rts
[17] http://www.ppp-wizard.net
[18] http://www.rtca.org

The post A Demonstration of the Galileo E5b Signal appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Table 1

Working Papers explore the technical and scientific themes that underpin GNSS programs and applications. This regular column is coordinated by Em. Univ.-Prof. Dr.-Ing. habil. Dr. h.c. Günter W. Hein.

This is the second article in a series. For Part 1: GNSS localization, see here.

Working Papers explore the technical and scientific themes that underpin GNSS programs and applications. This regular column is coordinated by Em. Univ.-Prof. Dr.-Ing. habil. Dr. h.c. Günter W. Hein.

This is the second article in a series. For Part 1: GNSS localization, see here.

GNSS solutions are widely spread and currently able to provide excellent navigation performance under a variety of scenarios, especially with the advent of assisted and cloud GNSS solutions. However, when used indoors and in deep urban canyons, they still suffer from many challenges such as outages of the system due to very low signal powers received indoors or very high positioning errors due to multipath. There are two main ways to circumvent such problems and they are addressed in the following two sections: using hybrid solutions between GNSS and a typically complementary solution, such as cellular, wireless local area network (WLAN), or inertial sensors, or using purely non-GNSS solutions, which might be desirable, for example, on low-cost mobile devices not supporting GNSS chipsets.

Hybrid-GNSS Localization
Hybrid positioning techniques merge GNSS and non-GNSS technologies to provide an accurate position of the user or device. The non-GNSS category typically includes all the terrestrial navigation systems, ranging from cellular to WLAN, and from Ultra Wide Band (UWB) to Inertial Navigation Systems (INS).

Non-GNSS positioning signals are typically referred to as Signals of Opportunity (SoO). SoO by definition means any signal which can be used for positioning, but which, unlike GNSS, was not initially designed with positioning purposes in mind (e.g., cellular, WLAN, UWB, etc.,). A debatable category is the category of 5G cellular signals, which currently are being designed in such a way to also support positioning, and thus they no longer belong to the SoO category. We will briefly discuss 5G positioning in the next section.

Another arguable category is the category of Internet of Things (IoT) and the related IoT positioning. The IoT concept is based on the connection of sensing devices to the internet, with the objective of using the information provided by the sensors (i.e., positioning information) in different applications, such as LBS or transportation and logistics. IoT positioning sensor networks can be divided into homogenous or heterogeneous. The heterogeneity definition deserves a discussion by itself, but in here we refer to this heterogeneity as follows. In a homogenous IoT architecture, the network is only formed by either GNSS or non-GNSS sensors. In a heterogeneous IoT architecture, the network is formed by both GNSS and non-GNSS sensors, whose information is then processed by a control unit applying hybrid positioning techniques. Hybrid (or heterogeneous) IoT positioning is discussed in this section. Homogeneous IoT positioning along with modern navigation solutions purely based on non-GNSS systems are discussed in the next section. The rest of this section focuses on localization techniques which rely on both GNSS and non-GNSS systems.

The fact that GNSS and non-GNSS are complementary technologies enables a ubiquitous localization in a wide range of working cases, which may not be feasible by just using one of these technologies. For instance, GNSS localization systems offer an excellent positioning reliability and accuracy if the working conditions are adequate enough (i.e., outdoors). Nevertheless, their performance in harsh environments (i.e., indoor, urban areas) may be compromised due to the attenuation of the signal power or even the loss of signal, the multipath propagation, the presence of interferences such as jamming and spoofing, etc. Conversely, non-GNSS technologies typically provide reliable positioning in indoor and urban scenarios. For example, cellular systems, from second generation (2G) to the emerging fifth generation (5G) are specifically designed for reliable and continuous communications in populated areas, such as indoors and urban, and their signals are able to penetrate buildings and walls, thus making them suitable alternatives for situations where GNSS fails. Similarly, WLAN networks are widely spread indoors nowadays, and their high density and moderate propagation ranges (e.g., a few tens of meters indoors to a few hundred meters outdoors) make them another excellent candidate for offering localization solutions complementary to GNSS. Therefore, the simultaneous use of such technologies by means of hybrid positioning techniques improves the accuracy, fault tolerance, and availability of the localization service both outdoors and indoors.

There are different combinations of hybrid GNSS and non-GNSS, and these can be classified into two main groups: GNSS+INS and GNSS+SoO. Currently, hybrid localization with GNSS and SoO, such as Long Term Evolution (LTE), 5G, UWB, and WLAN, is a hot topic in the localization field.

In the GNSS+INS integration, the short-term stable INS data complements long-term stable GNSS data. These systems can provide more accurate and precise location information than a single system, also yielding information during a possible outage of one system. In GNSS+INS hybrid localization, the inertial information provided by the Micro-Electro-Mechanical Systems (MEMS) provides location relative to a previous location at high rate. Other devices such as cameras, radar, barometers, and many more deliver absolute position information which can also be synchronized with the GNSS signal. Due to this hybridization, the accuracy and ubiquity of the location service is boosted in indoor and urban environments (due to the non-GNSS technologies) while still maintaining the outdoor scenarios (thanks to GNSS technologies). However, INS systems usually require an initial calibration, and they accumulate position error with time.

For GNSS+INS integration, three principle approaches exist: i) loose coupling (combines a GNSS derived position with INS data), ii) tight coupling (integrates GNSS pseudoranges and INS data), and iii) deep coupling (involves INS data in the GNSS signal tracking). Regarding the location privacy of an end user, pure GNSS+INS systems are commendable because only the user equipment aggregates and processes data of both subsystems; no third party is involved.

Similar integration concepts can also be found for the integration of GNSS with terrestrial communication systems. Hybridization of position level is always possible. Many examples for a tighter integration exist as well. For example, GNSS+LTE combines GNSS technologies and cellular-specific technologies, including Observed Time Difference of Arrival (OTDoA), Uplink-Time Difference of Arrival (U-TDoA), and Enhanced-Cell ID (E-CID) to provide a more robust and ubiquitous localization service. Secondly, GNSS+UWB mixes GNSS positioning technologies and UWB technologies, which usually perform Time of Arrival (TOA) techniques. Thirdly, GNSS+WLAN merges GNSS and WLAN technologies, which often employ Received Signal Strength (RSS)-based techniques, to enhance the performance of the localization service.

A sub-group of GNSS+SoO is a heterogeneous IoT system, where GNSS sensors and terrestrial IoT sensors are combined. GNSS technologies suited for IoT receivers are hindered by the requirements of low computational power and low power consumption, which might clash with the computational requirements of GNSS signal processing, thus resulting in a faulty localization service in severe working conditions. In this sense, vendors are developing ultra-low power GNSS modules aimed for IoT mass-market devices, with the objective of providing high accuracy with low-powered sensors.

Many studies have been carried out evaluating these hybrid systems, in particular in autonomous vehicle applications (see J. A. Peral-Rosado et alia in Additional Resources), where security and privacy are mandatory to avoid life-or-death scenarios occasioned by attackers. As hybrid systems use GNSS and non-GNSS technologies, they also suffer from the same security and privacy threats as pure GNSS and pure non-GNSS technologies, and thus the same solutions may be applied (see Location Privacy Challenges and Solutions – Part 1 published in Inside GNSS September/October 2017 as well as later sections of this article). However, as the number of systems in use increases, so does the probability of suffering an attack. In addition, the software required to carry out the hybrid positioning techniques must offer security and privacy, provided by the usual security software. If not, this software becomes a security breach in the hybrid system that can be exploited by attackers.

The threats to location privacy in GNSS+SoO are more obscure and possibly more abundant compared to the case of GNSS+INS because more parties and communication between those parties are involved. The parties involved in a hybrid GNSS positioning system are: the GNSS space segment, the user’s device and the network segment, including the Location Service Provider (LSP), the anonymizer, and the Location Based Service Provider (LBSP), as illustrated in Figure 1 (see inset photo, above right, for all figures). In practice, some of the units shown in Figure 1 can be merged or absent. The main GNSS data regarding the user localization comes from the satellites. Non-GNSS data for localization comes from the LSP. Nonetheless, as compared to a GNSS-based localization, there are several terrestrial entities involved in a non-GNSS localization, as seen in the “Terrestrial positioning system” block from Figure 1.

First, an LSP should offer an entirely software or a hybrid software-hardware solution to the user for his/her positioning. For example, a mobile application for indoor positioning can be downloaded from a certain server. Alternately, a dedicated positioning hardware solution can be installed in a shopping mall (based on WLAN, Bluetooth Low Energy BLE, LED, etc.) and users visiting that particular shopping mall can download the application that uses the dedicated infrastructure. The LBSP is the one offering the services to the user, such as finding an item on a shelf in a supermarket, or finding the cheapest offers for nearby restaurants, etc. The LSP and LBSP are typically distinct entities, and, in order to preserve the users’ privacy, they might interact through the help of a third entity, called an Anonymizer. This is done in order to not send the user’s position in clear from one server to another. The last entity in the chain is, of course, the user mobile device, on which the positioning application is running.

The position can be computed in two ways:

• network-centric approach, when the LSP computes the user’s position and sends it to the user, or
• mobile-centric approach (J. H. Lee), when the LSP only sends some of the information to the user (e.g., training databases, maps, etc.), and the user device computes its final position based on the signals in range and the information received from the network.

Clearly, the second approach more successfully preserves location-privacy than the first one.

As mentioned earlier, hybrid GNSS positioning systems combine several positioning systems, thus they also incorporate the vulnerabilities of these positioning systems. In a hybrid positioning system aggregation, pre- and post-processing of data can almost arbitrarily be divided between LSP and user device as long they are able to share (intermediate) results. These exchanges of information can potentially suffer breaches of location privacy. Analogous to loose and tight GNSS/INS coupling in other hybrid GNSS systems, either positions or other features derived from the signals are used to yield a more robust solution. These features are often ranges or RSS, but any feature unique to a certain location could be used.

The location privacy vulnerabilities of hybrid GNSS systems depend on the data used by the non-GNSS positioning system, i.e., ranges or RSS, and whether the data is fused on the device or on the network by the LSP. Data that is missing at the fusion center must be transmitted to it. Data fusion on the user device reduces communication and is typically the better choice from a privacy point of view.

Non-GNSS Localization
In recent years, we have witnessed the advent of the IoT. Terrestrial IoT can have positioning capabilities either based on the signal strength of powers measured at the receiver side or as intrinsic to a certain IoT standard, such as 5G positioning (A. Dammann et alia; M. Koivisto et alia) or LoRa positioning (B. Ray). WLAN is currently the most widespread non-GNSS localization technology in IoT and it is typically based on RSS measurements. Cellular technologies are also gaining prominence in the IoT positioning field. The legacy cellular systems (2G and 3G) do not explicitly support positioning signals in their standards, but they do have positioning capabilities based, for example, on cell– ID (i.e., positioning of the device inside the coverage areas of the heard transmitters), RSS, time of arrival (TOA), or time difference of arrival (TDOA). In 4G cellular systems or LTE, the Positioning Reference Signals (PRS) have been introduced to support TDOA-based positioning. The 5G emerging cellular concept is based on the assumption of very dense Access Nodes (AN), e.g., even down to 5-10 meters average distances between the AN, and very large bandwidths (e.g., trend to move towards mmWave communications, where the spectrum is still scarcely used or unused). These two features strongly support the capacity of achieving highly accurate positioning and tracking through, for example, combinations of TOA, TDOA, and Angle of Arrival (AOA) solutions. The privacy threats in 5G will likely be related more to the attacks during channel transmission rather than to unsecure or malicious ANs, as the security in 5G has been actively addressed, deeply thought out and optimized.

Another category of emerging communication systems with potential support for positioning is the terrestrial IoT category. For instance, Low Power Wide Area Network (LPWAN) standards such as LoRa, NarrowBand IoT (NB-IoT), enhanced Machine Type Communication (eMTC) or Sigfox, which were incipiently devoted to IoT communications, can also be used for IoT positioning. These technologies are also affected with the security threats of typical cellular and non-GNSS based localization systems.

The main threats of IoT positioning techniques relate to attacks performed on the IoT sensor itself instead of the localization service. In this context, the IoT sensor suffers from similar threats as most non-GNSS localization techniques, which are node-based localization solutions. Finally, in heterogeneous IoT sensor networks, as the hybrid positioning techniques are applied in a control unit and not in the device itself by means of software, the security breach produced by this software is circumvented. It is supposed that the control unit is already protected against attacks which may jeopardize the security and privacy of the sensor or user. More aspects related to hybrid and non-GNSS localization are discussed later.

Passive Positioning Concept
The current literature includes a dual definition of “passive positioning.” The two definitions, used with opposite meanings, are given below:

1. “Passive” from the user’s point of view: the user terminal is passive, meaning that it does not send any positioning information to the network; the terminal only receives signalling or other information relevant to its positioning, similar to a pure GNSS device. Thus, the network does not have any knowledge about the user’s position. The user is the only one responsible for calculating his/her position in a fully mobile-centric mode and the only one who will have that information (see L. Chen et alia and V. Sark et alia).

2. “Passive” in the sense of “uninvolved” or non-participative user, also referred to as “device-free” localization: the user has no idea it is tracked or positioned and the network locates and tracks the user without his/her express authorization, typically in a radar-like approach, by using signal reflections on the users’ devices or body or passive tags. The user terminal can also be seen as “passive” in the sense that the user does not take an active part in the localization process (see N. Pirzada et alia and Z. Zhang et alia).

In this article, we adopt the first definition, as it is the one strictly associated with a privacy-preserving positioning. We also make the distinction here between the LSP, which is typically the network operator or the provider of the actual positioning information, and the LBSP, which is the provider of a certain service that needs the location information. Many times, they are one and the same, but sometimes they can be disjoint, e.g., an LBSP in a shopping mall which advertises the best-value in that shopping mall can take the position information from a separate LSP entity, which might have installed a positioning-specific infrastructure in that particular mall.

Location Privacy in Hybrid- and Non-GNSS-Based Positioning
In contrast to GNSS, the majority of modern communication systems use bidirectional communication and rely on unique identification of their nodes. Thus, the network operator is, in general, able to obtain knowledge of its user’s whereabouts just based upon the proximity to the AN or the transmitter the user is connected to. It already becomes clear that revelation of location information is almost inevitable when using a communication system for positioning purposes. However, to what extent this becomes critical depends primarily on the accuracy of the location information and the context it might be linked to. The following two sections assess the location privacy vulnerabilities of range-free and range-based positioning systems, which translate to hybrid GNSS positioning systems as part of a loosely or tightly coupled, user-centric or network-centric system.

RSS-Based Techniques
Any communication system can also be used deliberately as a positioning system. WLANs are among the most prominent SoO, providing location information as accurate as a consumer-grade GNSS, but are much less protective of privacy. Fingerprinting relies on the concept that signatures of Radio Frequency (RF) signals – typically RSS signatures (i.e., RSSs and corresponding MAC addresses) – are unique at different locations, and that once enough of these signatures are known at sufficient locations, a user’s location can be recognized at a later stage solely by the signature associated with that location. The set of RSS signatures obtained at known locations is known as a radio map or fingerprint database.

The vulnerabilities in terms of privacy of a fingerprinting-based positioning system depend on the type of positioning system/infrastructure. Two typologies are prevalent: a) infrastructure based, or network-centric, and b) terminal based, or mobile-centric. In a network-centric positioning system, the user observes the signal signatures of the network’s ANs and sends them back through the network to the location provider, where the location is retrieved as the position that is associated with the pre-recorded signatures of the radio map that best match the observed signatures. In a mobile-centric system, a copy of the radio map is available on the user’s device and the position is estimated by the device.

Both, network- and mobile-centric positioning systems are prone to breaches of the user’s location privacy due to a communication link that identifies the user device. Let’s consider the scenario of an adversary controlling an untrusted network. The adversary might use the known AN positions to which a user device connects and infer its location roughly based on proximity. The location disclosure type of attack basically depends on the user’s need and perception of his/her location privacy (J. H. Lee et alia) and by the granularity level of the position information disclosure, as discussed in our previous article.

We extend that scenario and assume that the attacker evaluates packets sent by the user at several ANs in range and that the attacker predicts a radio map with a basic pathloss model and knowledge of the AN positions. Now the adversary can use fingerprinting based on the MAC addresses of the ANs that received packets from the user device (MAC addresses are easily obtained by an eavesdropper, as they are transmitted in the clear by most existing WLAN chipsets.). A rank-based fingerprinting (FP) algorithm can be used to match the MAC addresses of the ANs in the range of the user with that of the radio map. The adversary might as well use fingerprinting with RSS signatures to deduce the user’s position even more accurately. In addition to the previous case he would need to evaluate the RSS from the user’s packets at the different AN positions. The symmetry of the channel (ANs’ RSS signature at the user position equates to the user’s RSSs at the ANs’ location) allows one to estimate the user location by matching the observed RSS to a radio map. A test performed in a four-floor university building in Tampere, Finland showed that the accuracy that can be obtained by an eavesdropper for RSS based FP in WLANs is about 8 meters and typically below 10 meters in more than 70-80% of cases, as illustrated in Figure 2.

Figure 2 shows the positioning accuracy (in terms of cumulative distribution of the distance error) that can be obtained by an adversary for the previously mentioned four-floor building. Three different cases are included: i) the adversary has access to the training database (radio map) and to both MAC addresses and RSS measured by the untrusted network from the attacked device (FP method, average accuracy about 8 meters), ii) the adversary has access to the training database and MAC address knowledge (rank based FP method, average accuracy about 17 meters), and iii) no training phase is needed (the radio map is predicted based on a simplified path loss (PL) model) and the adversary uses only MAC address knowledge (PL, rank based FP method, average accuracy about 27 meters). For networks with a low density of untrusted ANs, i.e., a few ANs placed in the building by an adversary, even the last approach would still offer building-level accuracy. If the adversary additionally has an actual radio map (i.e., training database), the average accuracy can decrease to about 17 meters or even 8 meters, depending on the positioning information used (MAC only or MAC+RSS).

In the network-centric setting, the same vulnerabilities exist. Additional risks arise due to the involvement of an LSP, storing and processing the user’s data with his consent, and the transmission of information that is part of the positioning process, for example, the RSS signature measured by the user, or the estimated position that is forwarded by the LSP to the LBSP. Methods to prevent this are addressed later in this article.

While some location-related vulnerabilities can only be exploited if the attacker has access to the network or information about it, others require information about the positioning system. In the worst case, the adversary is an untrusted network operator or LSP who intentionally computes and/or leaks the location data, or who provides unintentional access to information that allows a third party to compute and/or leak the sensitive information.

Assuming a trustworthy LSP/network operator, a mobile-centric positioning system preserves the location privacy better than a network-centric one because of the reduced communication or signaling between the user and the network. The location privacy in a mobile-centric WLAN positioning system can be further protected if the user does not need to associate with an AN and all necessary data for positioning. For example, a fingerprint database or access node position are broadcast while the user device just listens using 802.11’s “monitor mode” (F. Gschwandtner et alia). However, this scenario is limited to special use cases because this mode hinders communications for the user and is usually not enabled by the user.

Further arguments against the mobile-centric approach exist. First, the radio map is a valuable key component for the location service provider, which is therefore reluctant to make it available without obtaining the user’s location information in exchange. Secondly, maintaining multiple copies of the database implies additional costs. Thirdly, the mobile devices might lack sufficient memory and processing power. Thus, network-centric fingerprinting systems are the common case and one question becomes apparent: is the location service provider trustworthy?

If the LSP/network operator cannot be trusted, then an end-to-end encryption is required to preserve location privacy. For a network-centric positioning system, in which the user’s location is estimated by the LSP, end-to-end encryption can be achieved if the required computations are executed on the encrypted data. Homomorphic encryption allows computations on the encrypted data that, once decrypted, equal the result of the same computations performed on the plain data. For example, the Pallier cryptosystem, which provides only additive homomorphism and therefore reduces computational complexity, has been applied to WLAN fingerprinting (H. Li et alia). As the homomorphic property is reduced to additions, more complex operations can be decomposed and precomputed such that the LSP can perform signature matching based on additions only. However, transmitting several precomputed terms increases the communication overheads. Alternative secure two-party computation protocols, such as Additive Sharing, Yao’s Garbled Circuits, might further reduce the computational burden. Their use for RSS-based fingerprinting is currently under investigation.

One might conclude that, in order to achieve reasonable location privacy on the device, an end-to-end encryption is indispensable during communications and at the LSP side. The use of (partially) homomorphic encryption points to a promising direction, however, many practical issues have still to be solved. Given the diversity of pattern matching algorithms used in fingerprinting, the privacy protection scheme must be included in the design of the positioning system.

Timing and Angle-Based Techniques
Typically, timing and angle-based positioning methods require that the user device is communicating with the network. Examples of timing and angle-based positioning solutions widely used in cellular systems are, for example: TOA, TDOA, Round Trip Times (RTT), Time Of Flights (TOF), Angle or Direction of Arrival (AOA/DOA), Differential Direction of Arrival (DDOA), etc. Due to these communications over wireless channels, an untrusted network could get access to the user location information, but due to synchronization, authentication, and signaling requirements in various cellular and non-cellular communication networks, it is much harder for an attacker to build such an untrusted network, compared with the case when only RSS information is used.

An alternative to the situation when the user communicates with the network in order to get his/her position information via timing or angle approaches is the situation when the network broadcasts some signaling messages for all users in range, and such broadcast messages include the location of the network ANs, the starting time of the signaling message, and possibly some additional information, such as the forwarding time between two ANs. This approach has been proposed for the future 802.11az WLAN standard (see Additional Resources) and it is worth mentioning because it can offer a fully privacy-preserving approach, as the user is not sending back any information to the network. The concept is illustrated in Figure 3.

The ANs in a certain area or building are assumed to be synchronized and to belong to a certain LSP. One of the ANs in the network acts as an initiator and starts sending broadcast and forwarding messages in its range. Each AN that receives a forwarding message, re-sends it further with a certain delay (known to the network and broadcast in the broadcasting message). The mobile user receives such broadcast messages from all the ANs in range, and it is able to compute its position via hyperbolic trilateration (V. Sark et alia), as the ANs’ positions are known (transmitted in the broadcast messages). Such a positioning mechanism has recently been studied by E. S. Santiago. It has been found that at least 10 ANs must be in range of the user mobile in order to achieve good location accuracy. A basic open-source simulator for 802.11az-based positioning studies is also available from E. S. Lohan (see Additional Resources).

Methods to Protect Location Privacy
As the discussions so far show, there is an emerging need for protecting user location privacy and various methods and measures have already been studied or adopted. In our previous article, we described several possible methods currently used or proposed to protect location privacy, such as location cloaking, location obfuscation, position sharing, k-anonymity approaches, and mix zones. Table 1 (see inset photo, above right) presents a summary of privacy-preserving or privacy-protecting methods for user wireless localization.

The listed methods have been developed in light of certain attack scenarios and are vulnerable to attacks in which the adversary has further knowledge than originally assumed in the scenario. Here we mention only the base algorithms, to which many extensions exist. In general, the more information and context an adversary can link to the location data, the less effective these privacy-preserving methods will be. According to the protection goal, these context components are typically user location, temporal information, and user identity. Some privacy-preserving methods may need to be combined in order to achieve full user protection.

Conclusions
In comparison to modern GNSS solutions, such as Cloud and Assisted GNSS, where privacy of localization studies have only recently emerged, the location privacy in hybrid- and non-GNSS localization systems is a multi-faceted issue where many solutions have already been studied and published in the research community. These interdisciplinary efforts need to be further consolidated to design privacy-preserving IoT localization technologies and services. There is a clear inherent tradeoff between the granularity of defining the location accuracy by a certain Location Service Provider and the level of location privacy that the user can reach. Herein we have summarized some of the existing solutions for preserving the user’s location privacy. We have also pointed out that the research on location privacy is a worthy endeavor for future positioning systems targeting sub-meter level accuracies.

Acknowledgements

The authors express their warm thanks to the Academy of Finland (Project 303576) for its financial support for this research work.

Additional Resources
[1] Chen L., S. Thombre, K. Jarvinen, E.S. Lohan, A.K. Alen-Savikko, H. Leppäkoski, M.Z.H., Bhuiyan, S. Bu-Pasha, G.N. Ferrara, and H. Honkala, “Robustness, Security and Privacy in Location-Based Services for Future IoT: A Survey,” IEEE Access, 2017
[2] Dammann, A., R. Raulefs, and S. Zhang, S.,“On Prospects of Positioning in 5G,” 2015 IEEE International Conference on Communication Workshop (ICCW), London, pp. 1207-1213, 2015
[3] Gschwandtner, F. and C.K. Schindhelm, “Spontaneous Privacy-Friendly Indoor Positioning using Enhanced WLAN Beacons,” International Conference on Indoor Positioning and Indoor Navigation (IPIN), 2011
[4] Lee, J.H. and R.M. Buehrer, “Security Issues for Position Location,” chapter in Wiley Handbook for Position Location, 2011
[5] Koivisto, M., Costa, M., Werner, J., Heiska, K., Talvitie, J., Leppänen, K., Koivunen, V., and Valkama, M., “Joint Device Positioning and Clock Synchronization in 5G Ultra-Dense Networks,” IEEE Transactions on Wireless Communications, Volume: 16, Issue: 5, pp. 2866-2881, May 2017
[6] Li, H., L. Sun, H. Zhu, X. Lu, and X. Cheng, “Achieving Privacy Preservation in WiFi Fingerprint-Based Localization,” IEEE Conference INFOCOM, 2014
[7] Lohan, E. S., P. Richter, V. Lucas-Sabola, J. Lopez-Salcedo, G. Seco-Granados, H. Leppakoski, and E. Serna Santiago, “Location Privacy Challenges and Solutions – Part 1: GNSS Localization,” Inside GNSS, September/October 2017
[8] Lohan, E.S. et alia, “Open-Source Software and Measurement Data Available at TLTPOS Group, TUT,” accessed June 20, 2017
[9] Peral-Rosado, J.A., R. Estatuet, J.A. Lopez-Salcedo, G. Seco-Granados, G. Chaloupka, L. Ries, and J.A. Garcia Molina, “Evaluation of Hybrid Positioning Scenarios for Autonomous Vehicle Applications,” Proceedings of ION GNSS+, September 2017
[10] Pirzada, N.M.Y., F.S.M.F. Hassan, and M.A. Khan, “Device-Free Localization Technique for Indoor Detection and Tracking of Human Body: A Survey,” Procedia-Social and Behavioral Sciences, Volume: 129, pp. 422–429, 2014
[11] Ray, B., LoRa Localization, Blog entry, June 2016
[12] Sark, V., E. Grass, and J.G. Teran, “Efficient Positioning Method Applicable in Dense Multi User Scenarios,” IEEE 802.11 White Paper, 2016
[13] Serna Santiago, E., Passive Positioning Approaches in the future positioning systems, MSc. Thesis, Tampere University of Technology, May 2017
[14] Zhang, Z., Z. Tian, M. Zhou, Z. Li, Z. Wu, and Y. Jin, “WIPP: Wi-Fi Compass for Indoor Passive Positioning with Decimeter Accuracy,” MDPI Applied Sciences, Volume: 6, p. 108, 2016

The post Location Privacy Challenges and Solutions, Part 2 appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Table 1

Working Papers explore the technical and scientific themes that underpin GNSS programs and applications. This regular column is coordinated by Em. Univ.-Prof. Dr.-Ing. habil. Dr. h.c. Guenter W. Hein.

This is the first article in a series. For Part 2: Hybrid- and Non-GNSS Localization, see here.

Working Papers explore the technical and scientific themes that underpin GNSS programs and applications. This regular column is coordinated by Em. Univ.-Prof. Dr.-Ing. habil. Dr. h.c. Guenter W. Hein.

This is the first article in a series. For Part 2: Hybrid- and Non-GNSS Localization, see here.

Positioning (or localization) is a key component in many wireless devices and a key enabler and optimizer of many mobile applications, including transportation, smart cities, and ambient assisted living. For example, mobile wireless devices relying on a location component can be used as mobile assistants and wearable devices for the elderly, sick, or disabled, for traffic and environment monitoring, for green mobile crowd sensing, in crisis scenarios, for wildfire risk prediction, etc. (see I. Maglogiannis et alia and L. Skorin-Kapov et alia in Additional Resources). When the time dimension is added to the positioning information, we talk about user or device tracking.

To enable a large-scale uptake of the location-based and location-aware applications, one of the main barriers to overcome is finding solutions to the current vulnerabilities in wireless positioning. Such vulnerabilities exist with respect to the privacy, security, positioning reliability, robustness, and availability, especially in indoor environments, and to the acceptability and safety of tracking devices. Users are indeed, slowly, becoming aware of the potential vulnerabilities in making their minute-by-minute position known to the external world and legislation efforts all over the world are dedicated to build the legal frameworks covering tracking and location privacy (see L. Chen et alia and K. Pomfret). Operators and mobile manufacturers are collecting location-based data and possibly geo-tagged context information en masse from our mobile devices for the purpose of network and service optimization. Crowdsourcing, mobility sensing, and cloud storage processing are becoming default options. Many mobile devices can now be used as identifiers, and digital wallets and biometric data play a crucial role. Location is a key component in all of these aspects. A known location, or being able to fake a current location, could mean, in the near future, higher vulnerability to theft, privacy invasion, and increased stalking. Geo-located patterns can lead to the re-identification of individuals and thus could pose a risk to the right to a private life. All these vulnerabilities with respect to the acquisition, storage, and misuse of the users’ geospatial information are long-overlooked factors which need to be addressed in a systematic and dedicated manner. The promising potential of future prosperous wireless markets relying on some form of localization and geo-spatial information, such as Internet of Things (IoT), Industrial IoT (IIoT), 5G, Device-to-Device (D2D), or Vehicle-to-Anything (V2X) communications, means that the security, privacy, and transparency aspects in mobile positioning need to become a high priority in the world of mobile computing.

In traditional positioning approaches, such as those purely based on Global Navigation Satellite Systems (GNSS), the user device is a purely passive device, thus fully preserving the user’s privacy. Modern localization solutions, including those evolved from GNSS such as Cloud GNSS (C-GNSS) and Assisted GNSS (A-GNSS) involve smart processing of cloud-gathered data, inter-connectivity, and exchange of information between different stakeholders in the localization chain, and possibly geo-tagged content de-identification. Therefore, these are vulnerable to privacy breaches, whereas the user position is fully private in GNSS as its receiver acts only as a passive (receiving) device. This article sheds light on the challenges related to location privacy, emphasizing current user perception of location-based mobile applications, and discusses future research directions and solutions that can benefit the community at large.

Is Location Privacy Something We Should Worry About?
In order to better understand users’ concerns with regard to their location privacy and how much users would be willing to pay for preserving their location privacy, a Webropol web survey (see Additional Resources) was conducted from January to May 2017. The survey was initially built in English and then translated to Finnish and Romanian. The survey link was distributed on different social media channels (e.g., LinkedIn, Twitter, Facebook) and through various mailing lists in order to reach a wide audience with variable backgrounds. In total, 327 answers from respondents across 38 countries in four continents were obtained. 8.8% of the respondents did not answer the question about the country of residence. There were 208 answers in English, 79 in Finnish, and 40 in Romanian. The overall gender distribution is quite balanced: 46.3% male respondents, 49.4% female respondents, and 4.3% declined to state. The age and country distribution of respondents are shown in Figure 1, with Finland, Romania, and UK being the countries of residence for most of the respondents, and the majority of respondents being between 36 and 45 years old.

Figure 2 shows how the respondents are using their mobile phone’s navigation capabilities and Location Based Services (LBS) on their mobile devices. The left plot shows that the vast majority of users (86.6%) are using some form of navigation on their phone, among which 52% typically activate both the GNSS and the non-GNSS (e.g., WiFi and cellular) positioning engines on their phones when navigating. The center plot of Figure 2 describes how often a user reads the permissions before installing an LBS application on his/her phones. These permissions are more or less intrusive in terms of privacy, depending on the application provider and reading them already denotes some minimal concern with regard to the privacy of mobile data. The survey shows that 30.0% of the respondents always read the permissions, 35.49% only occasionally read the permissions, and 28.4% never read the permissions. A small amount of respondents (6.2%) did not know about these permissions.

The right plot of Figure 2 shows how many of the respondents allow the LBS provider to collect their location data. The vast majority of respondents (61.9%) allow their location information to be collected only if they cannot use a particular service otherwise, as is the case with many LBS providers, such as Google maps and HERE maps. 5.2% of respondents always allow the location application to collect the user location data and 9.6% of respondents allow the location application to collect such data from time to time, independently of whether or not the LBS application could have been used in “private” mode (i.e., no data collection). 23% of respondents answered that they had never allowed an application to collect their location data. However, one could also infer that it might be unclear for some users whether or not a certain LBS application collects location data and sends it to the cloud. This comes as a conclusion when comparing the left plot of Figure 2, where only 13.6% of the respondents wrote that they do not use any location engine on their phone, with the right plot of Figure 2, where 23% of respondents say that they never allow an application to collect their location data. Nevertheless, one has to keep in mind that the vast majority of current LBS mobile applications cannot run unless the user allows the application to collect his/her location data.

Figure 3 compares the level of concern of users with respect to their location privacy with other types of personal digital data, such as emails, documents, calls, phone contacts, or images/videos. If we look at the “Very high concern” bars, clearly the users are much more concerned with protecting the privacy of all other types of personal digital data than protecting the location privacy. However, “High” and “Moderate” concerns bars are rather similar for different types of data, which shows that users have significant concerns regarding the privacy of all their personal data, location data included. As for the “No concern” bars, privacy of pictures and videos are least worrisome to those in the survey, with 12.6% having no concern for the privacy of these items. For location privacy, 7.3% had no concern, 14.4% had little concern, 19% moderate concern, 24.5% high concern, and 29.4% very high concern.

How these concerns translate also in a willingness to pay extra for location privacy can be seen in Figure 4. Clearly, the vast majority of users (61.9%) are not yet ready to pay anything extra for a privacy-preserving location engine. It is interesting to see that, among those who are interested in paying something (23.2% of the total respondents), the majority (60.9% of the respondents willing to pay something) would opt to pay up to 15% more compared to their current monthly mobile fee, and no respondent opted to pay more than 20% of the current monthly fee.

The survey findings show that there is already a reasonable awareness about location privacy challenges and that such awareness could be capitalized upon to some extent in business, by offering users more privacy-aware location solutions. The next sections will focus first on some aspects regarding granularity of location estimation, and then on GNSS location technologies categories, and will point out if and how such technologies can better support location privacy.

Granularity of Location Estimates for Various LBS
When talking about location privacy, one refers to the capacity of preventing any third parties to learn anything about a device location in space and time. There is thus a quadruplet (x, y, z, t) characterizing the location, where x, y, z are the spatial coordinates of the mobile device and t is the time at which that location is valid. When time is also known, we often talk about the user or device tracking.

There are two ways of defining the granularity of a location estimate: one is from the point of view of an attacker and it refers to the accuracy level at which the attacker can detect the location information; the other is from the user’s point of view, and it refers to the Quality of Service (QoS) received from a Location Service Provider (LSP), knowing that there is an inherent tradeoff between preserving his/her own location privacy via, for example, some cloaking or obfuscation mechanisms, and the QoS of the LBS. For example, let’s assume that the user’s true position at time t is (x, y, z), but the location information sent to the LBS and/or accessed by an attacker is (x + Δx, y + Δy, z + Δz). Then, the location granularity g in this case is defined as

g = √Δx² + Δy² + Δz²,

which is basically the distance uncertainty in the location estimate.

Table 1 (see inset photo, above right) gives examples of how an attacker can make use of the user location, if the user location is known with a certain granularity. The last column also shows positive examples of how the location information of a certain granularity can serve the user. Typically, the location needs to be known at several moments in time, ranging from a few hours to several months, in order for an attacker to be able to act upon the knowledge, but sometimes even the knowledge of as little as four different locations in time can lead to personal identification (see De Montjoye et alia in Additional Resources). As shown in Table 1, while one may be completely unconcerned if his/her location is known within a kilometer of error, this might be enough for an attacker to establish if a family is away from their home and to organize a house burglary. The examples of attacks shown in all rows above the current row are also applicable to the current row. For example, if the location is known within a few tens of meters from the actual position, house burglary, car thefts, or stalking are also potential threats, in addition to terrorism or disclosures of unwanted personal information, which are enabled by a more precise location known to an attacker.

Location Privacy in GNSS-Based Positioning Cloud GNSS
In the coming years, the development of new GNSS-based applications will play a leading role in the context of urban environments, i.e., Smart Cities, where almost every object or device such as urban furniture or wearable items can be connected between themselves, i.e., Machine to Machine (M2M) or D2D, and to the internet. In this sense, IoT applications have triggered the use of GNSS technologies for retrieving the Position, Velocity, and Timing (PVT) of the devices. Nevertheless, GNSS was designed for outdoor applications, and its performance gets truncated in urban working conditions. Moreover, IoT devices cannot implement advanced computational tasks due to constraints on low energy consumption, thus hindering the use of GNSS in harsh working conditions such as urban canyons, indoors, etc. Computational constraints are not only circumscribed to GNSS-based IoT devices, but also to conventional GNSS receivers providing advanced features such as multi-constellation processing, signal authentication, or threat detection (e.g., interference or propagation effects such as multipath or NLOS).

To overcome this hurdle, the Cloud GNSS concept has recently been proposed as a disruptive approach for solving most of the current limitations of conventional GNSS receivers (see Additional Resources). In this paradigm, the GNSS signal processing tasks traditionally carried out in on-chip GNSS modules at the user terminal, are now relocated in a cloud server, as illustrated in Figure 5, where on-demand scalable computing capacity in terms of data storage and processing power is available. Thanks to this availability, the energy consumption and computational power required by the user terminal is significantly reduced, since its main function is now to gather raw GNSS samples and transfer them to the cloud. Thanks to the computing capacity provided by the cloud, sophisticated GNSS signal processing techniques can easily be performed, thus providing a wider range of use cases where the GNSS sensor can effectively operate. For instance, Cloud GNSS can be used in liability-critical and safety-critical applications, where the use of conventional GNSS receivers faces some limitations due to the stringent requirements imposed on the user terminal in terms of integrity, continuity and, in the future, authentication.

The transfer of information from the user terminal to the cloud may raise some concerns on the potential vulnerabilities of cloud GNSS signal processing in terms of privacy and security. From a high-level perspective, we can identify three different categories of vulnerabilities, explained below: i) at the user-to-cloud communication link; ii) on the cloud storage of personal digital data, such as identifiers or GNSS raw samples; iii) on the computation, and therefore knowledge, of users’ location by third-parties, for example at the Location Based Service Provider (LBSP) side.

User-to-Cloud Communication
During the transmission of raw GNSS samples from the user’s device to the cloud server, personal data may eventually be intercepted by attackers. Location may also be known by the service provider of the network infrastructure due to the identifier each device holds, e.g., IP or MAC address or International Mobile Station Equipment Identity (IMEI). However, communication privacy and security is already provided by wireless infrastructures through secure communication protocols and standards, e.g., user access authentication implemented in Long Term Evolution (LTE) or Narrow Band Internet of Things (NB-IoT). Hence, the security and privacy of the user-to-cloud communication link is achieved with state-of-the-art wireless communication standards. Besides that, some cloud providers also offer secure platforms to connect users’ devices with the cloud. For instance, Amazon Web Services (AWS) offers an IoT platform, which already provides traffic encryption over Transport Layer Security (TLS) by using different cryptography standards such as X.509 or the Signature Version 4 Signing Process (SigV4).

Cloud Storage of Personal Digital Data
Customers may worry about the security involving the raw GNSS samples and personal digital data they upload to the cloud, due to the possibility of it being read or analyzed by third-parties (or attackers) and thus being used in an unauthorized manner. Nine critical threats to cloud security are identified by the Top Threats Working Group (Additional Resources): data breaches, data loss, account hijacking, insecure APIs (Application Program Interface), denial of service, malicious insiders, abuse of cloud services, insufficient due diligence, and shared technology issues. To prevent many of these threats, current cloud providers such as AWS, Microsoft Azure, and Google Cloud provide high-security systems with ISO 27001 certification, thus assuring confidentiality, integrity, and availability. With regard to the stored data, cloud platforms do not distinguish between personal data and any other type of data. Therefore, by using certified cloud platforms, the security of personal data, which in this case would be the raw GNSS samples file, the device location and any other stored personal data, would be guaranteed. Users shall realize that the security policies of a cloud service may change depending on the legislation of the country in which the cloud server is allocated, and hence personal digital data may be accessed by the government.

User’s Location Calculation by Third-Parties
Device anonymization is needed when the user’s location is known to a third-party, either when the location is calculated by the cloud GNSS platform or when it is used by some LBS. If not, the cloud and the LBS server might know who the devices’ owner is, and use the personal data and location for their own benefit. For LBS, a k-anonymization model to deal with location privacy is presented by B. Gedik and L. Liu. In this approach, an anonymity server decrypts the data transferred from the device to the LBS and removes all the related identifiers (e.g., IP or MAC address, device, or customer identifier). Next, the location information is disrupted by means of spatio-temporal cloaking (i.e., hiding the true location information in a wide spatio-temporal area), and finally, the anonymized location is sent to the LBS server. Note that this approach may perturb the quality of service, and thus a tradeoff between the QoS and location privacy is faced.

Another alternative is to assign a random identifier to every device, which is then changed after a fixed time such as minutes, hours, or days depending on the application, in order to facilitate the anonymization. In this context, hash-based ID variation (see Additional Resources) can be used for enhanced location privacy. This process is often accomplished through two different and independent entities, the first one (e.g., a certification body) being in charge of randomly assigning identifiers to users, and the second one (e.g., the LBSP) being in charge of the exploitation of the randomized data. This scheme guarantees that the entity making use of the data has no access to the mechanism whereby the identifier was generated and assigned to the user. In this manner, users have a time-varying identifier with limited lifetime that thus cannot be tracked for a long period of time. Clearly, the shorter the identifier lifetime, the better the user privacy, since we prevent inferral of user identification via behavior pattern analysis.

In conclusion, there are many protection schemes that can be used to solve the potential vulnerabilities of cloud GNSS positioning in terms of location security and privacy. When it comes to strengthening the privacy requirements of the user’s location, this often translates into a tradeoff between privacy and QoS.

Assisted GNSS
In order to position itself using the signals from navigation satellites, the GNSS receiver needs to know the precise time and orbital parameters to compute the positions of the satellites. The GNSS satellites broadcast this information in their navigation messages. However, decoding the orbital information from navigation messages takes 30 seconds in good signal conditions, which is a significant Time-To-First-Fix (TTFF), i.e., delay in the starting of positioning. This time may be much longer in environments dense with buildings or foliage where these obstacles attenuate the satellite signals. If the signal power decreases further, the receiver cannot decode the navigation data even if it is still able to make the ranging measurements. In this case, without information on satellite orbits and precise time, the measurements are useless for the receiver and it cannot compute its position.

In A-GNSS, the functionalities of a GNSS receiver are enhanced through terrestrial communication networks to shorten the TTFF and to improve the sensitivity of the receiver, i.e., to allow positioning with weaker satellite signals (J. Syrjäinne; F. Van Diggelen, Additional Resources). In A-GNSS, the missing information is provided to the receiver by a server that is connected to the receiver that has good visibility to the satellites (Figure 6). In addition to the orbital information and time, the A-GNSS can also deliver the Differential GNSS (DGNSS) corrections which allow improvements of positioning accuracy even to the one meter level.

Two architectures were proposed for A-GNSS where the roles of the user terminal (mobile station, MS) and the server in the network are different. In MS-based A-GNSS (MS-Based Network-Assisted) the user receives assistance data from the server and makes the ranging measurements, possible DGNSS corrections, and positioning calculations by itself. In MS-assisted A-GNSS (MS-Assisted Network-Based) the user terminal makes the ranging measurements and sends them to the server. The server applies the possible DGNSS corrections to the measurements, computes the position, and sends it back to the user. To assist the user terminal in the positioning measurements, the server sends a small set of assistance data to the user to enable fast signal acquisition.

In MS-based A-GNSS, in good signal conditions the user terminal can also position itself without assistance from the server. That is to say, the network connection is not necessary. In MS-assisted A-GNSS, the positioning of the user terminal always requires two-way communication with the server. The best achievable accuracy in both A-GNSS modes is defined by the DGNSS, which allows accuracies on the level of one meter (see Additional Resources). However, both modes are susceptible to multipath and NLOS, and therefore the accuracy is not always as good as in clear LOS. Actually, in an MS-based approach, the positioning accuracy may deteriorate to hundreds of meters when assistance is needed due to bad signal conditions. When the satellite signal levels drop very low, e.g., in underground settings, the user devices also cannot make the measurements, and both A-GNSS modes fail.

While both MS-based and MS-assisted architectures require point-to-point communication, either in the control plane of a cellular network or in the user plane of a wireless internet, only in MS-assisted approach does the user terminal reveal its accurate position to the server. The functionalities of the current Cloud GNSS are very similar to MS-assisted A-GNSS, therefore the privacy threats are also similar. For A-GNSS, secure architectures exist (L. Wirola et alia), e.g., the Open Mobile Alliance Secure User Plane Location Protocol (OMA SUPL) which provides security and authentication services using Generic Bootstrapping Architecture (3GPP GBA) (please see Additional Resources).

Conclusions
Our studies shed more light on users’ perception of their location privacy and on the privacy threats and solutions in modern wireless localization. We learned that, in general, users are not yet particularly aware of location privacy threats and most would not be willing to pay much or anything for private or passive positioning. In addition, privacy of localization is not yet fully solved in many state-of-the-art GNSS localization systems, such as Cloud GNSS and Assisted GNSS.

Acknowledgements
The authors express their warm thanks to the Academy of Finland (Project 303576) for its financial support for this research work.

Additional Resources
[1] 3GPP TS 33.220 Generic Bootstrap Architecture
[2] Chen, L., Thombre, S., Järvinen, K., Lohan, E. S., Korpisaari, P., Kuusniemi, H., Leppäkoski, H., Honkala, S. , Bhuiyan, M. Z. H., Ruotsalainen, L., Ferrara, G. N., Bu-Pasha, S., “Robustness, Security, and Privacy in Location-Based Services for Future IoT,” IEEE Access, Vol. 5, pp. 8956-8977, 2017
[3] De Montjoye, Y. A. , Hidalgo, C. A., Verleysen, M., and Blondel., V. D., “Unique in the Crowd: The Privacy Bounds of Human Mobility,” Scientific Reports 3, Article number: 1376, 2013
[4] Gedik, B. and Liu, L., “Location Privacy in Mobile Systems: A Personalized Anonymization Model,” Proceedings of the 25th IEEE International Conference on Distributed Computing Systems, ICDCS, pp. 620-629, June 2005
[5] Gschwandtner, F. and Schindhelm, C. K., Spontaneous Privacy-Friendly Indoor Positioning using Enhanced WLAN Beacons, 2011
[6] Henrici, D. and Muller, P., “Hash-based Enhancement of Location Privacy for Radio-Frequency Identification Devices using Varying Identifiers,” Proceedings of the 2nd IEEE Annual Conference in Pervasive Computing and Communications Workshops, pp. 149-153, March 2004
[7] Li, M., Zhu, H., Gao, Z., Chen, S., Ren, K., Yu, L., and Hu, S., “All Your Location are Belong to Us: Breaking Mobile Social Networks for Automated User Location Tracking,” Proceedings of MobiHoc, ACM, pp. 43-52 2014
[8] Lucas-Sabola, V., Seco-Granados, G., López-Salcedo, J. A., García-Molina, J. A., and Crisci, M., “Cloud GNSS Receivers: New Advanced Applications Made Possible,” Proceedings of the International Conference in Localization and GNSS (ICL-GNSS), pp. 1-6, June 2016
[9] Maglogiannis, I., Kazatzopoulos, L., Delakouridis, K., and Hadjiefthymiades, S., “Enabling Location Privacy and Medical Data Encryption in Patient Telemonitoring Systems,” IEEE Transactions on Information Technology in Biomedicine, Vol. 13, No. 6, pp. 946-954, November 2009
[10] Mascetti, S., Bertolaja, L., and Bettini, C., “A Practical Location Privacy Attack in Proximity Services,” 2013 IEEE 14th International Conference on Mobile Data Management, Milan, pp. 87-96, 2013
[11] Misra, P. and Enge, P., Global Positioning System – Signals, Measurement and Performance, 2nd ed., Ganga-Jamuna Press, ISBN 0-9709544- 1-7, 2006
[12] OMA Secure User Plane Location 1.0, OMA-ERP-SUPL-V1_0-20070615-
[13] Pomfret, K., “Geolocation Privacy – Implications of Evolving Expectations in the United States,” Inside GNSS, September/October 2016
[14] Skorin-Kapov, L., Pripužić,K., Marjanović, M., Antonić, A., and Žarko, I. P., “nergy Efficient and Quality-Driven Continuous Sensor Management for Mobile IoT Applications,” 10th IEEE International Conference on Collaborative Computing: Networking, Applications, and Worksharing, Miami, FL, pp. 397-406, 2014
[15] Syrjärinne, J., Studies of Modern Techniques for Personal Positioning, Ph.D. Dissertation, Tampere University of Technology, 2001
[16] Top Threats Working Group, The Notorious Nine: Cloud Computing Top Threats in 2013, Cloud Security Alliance, 2013
[17] Van Diggelen, F., A-GPS : Assisted GPS, GNSS, and SBAS, Artech House, 2009
[18] Webropol web survey tool
[19] Wirola, L., Laine, T. A., and Syrjärinne, J., “Mass-Market Requirements for Indoor Positioning and Indoor Navigation,” Proceedings of the International Conference on Indoor Positioning and Indoor Navigation (IPIN), Zürich, Switzerland, 2010

The post Location Privacy Challenges and Solutions, Part 1 appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Working Papers explore the technical and scientific themes that underpin GNSS programs and applications. This regular column is coordinated by Prof. Dr.-Ing. Günter Hein, head of Europe’s Galileo Operations and Evolution.

Working Papers explore the technical and scientific themes that underpin GNSS programs and applications. This regular column is coordinated by Prof. Dr.-Ing. Günter Hein, head of Europe’s Galileo Operations and Evolution.

Several advanced services rely on Global Navigation Satellite System (GNSS) receivers as data providers. GNSS-derived position, velocity, and time (PVT) information enables applications such as proximity-based marketing, real-time travel services, traffic updates, precision farming, weather reports, and roadside assistance, to mention a few examples.

GNSS receivers also play a significant role in several regulated applications where security is an important aspect. In the road transportation sector, the new EU Regulation 165/2014 (see European Commission in Additional Resources) adopted in February 2014 by the European Parliament and the Council foresees the introduction of a new generation of Digital Tachographs (DTs), called “smart tachographs,” with increased security mechanisms, a GNSS component, and different communication interfaces. Tachographs record driving time and mitigate the risk of tired drivers having looser control of vehicles with higher risk of accidents. There are potential economic incentives for infringement of the regulation and tampering with the tachograph system. In this respect, the secure provision of PVT information from a trusted GNSS receiver is an important asset.

Integrated in smartphones, GNSS receivers can also be used to increase the security of mobile banking services (see A. Pujante in Additional Resources). In addition, there may be economic interests around smartphone usage to falsify the data provided by a GNSS receiver.

In this respect, GNSS receivers can be interpreted as nodes in a network where they provide location data to higher service levels. In the tachograph, the vehicle unit, i.e., the recording equipment installed in the commercial vehicle to monitor the driver behavior, implements and provides these higher service levels. In smartphones, these levels are the final user applications: electronic fraud can take advantage of possible vulnerabilities of the communication channel between GNSS receivers and higher service levels. In particular, GNSS Faking Software (GFS) applications can be installed on the smartphone to falsify the user position with the final goal of obtaining a personal or commercial benefit.

GNSS data faking consists of intercepting genuine GNSS data and replacing them with forged location information. Differently from jamming and spoofing, which operate at the Signal-in-Space (SiS) level, GNSS data faking operates at the receiver level. GNSS data faking tries to intercept and falsify the messages between the GNSS receiver and the application nodes.

In GNSS spoofing, an attack can be detected by exploiting SiS-specific features which are difficult to counterfeit (see A. Jafarnia-Jahromi et alia in Additional Resources). Similarly, a possible solution to GNSS data faking is the usage of device-specific features which are difficult to counterfeit. This approach is usually referred to as device fingerprinting and is defined as “the process of gathering device information to generate device-specific signatures using them to identify individual devices” (Q. Xu et alia, Additional Resources). Fingerprinting has gained significant interest in the field of wireless networks where node forgery or impersonation has become a threat. Node forgery consists of the acquisition of legitimate credentials by an adversary who will use them to conduct fraudulent activities. GNSS data faking is similar to node forgery in a wireless network.

In particular, a simulator or another device can be used to impersonate an actual GNSS receiver. In this way, misleading PVT information can be sent to the final PVT user. GNSS receiver fingerprinting can be adopted in security- enhanced applications that will be able, at least to a certain extent, to verify the authenticity of GNSS data. In such applications, the device which relies on GNSS data, such as the vehicle unit of the tachograph, will also extract from the received GNSS messages unique features which could be used to validate the identity of the GNSS receiver by comparing it to the previously recorded data. In a potential deployment scenario for the DT, the vehicle unit could record the fingerprints of the GNSS receiver in the initial installation phase or during the periodic calibration checks (e.g., every two years as defined by the regulation). The installation and calibration phases are executed in a controlled environment (e.g., workshop) where the identity of the GNSS receiver can be checked by the installer.

The first step in device fingerprinting is the selection of appropriate features, which should satisfy two basic properties: the features should be difficult to counterfeit and be stable with respect to environmental changes.

We investigate the selection of appropriate features for GNSS receiver fingerprinting. This process consists of considering, at first, a set of redundant metrics that have the potential to identify the receiver. A fingerprint, i.e., a subset of the original set of metrics, is then selected using a filtering approach.

We first investigate metrics related to the receiver clock, summarizing the results obtained by the authors in the paper presented at the 2016 ION GNSS+ conference and listed in Additional Resources. We then extend the analysis to clock-unrelated features.

Clock-Based Metrics
Fingerprinting of electronic devices is often based on distinctive imperfections such as the errors generated by the local oscillator of the device under test. In the context of wireless networks, Radio Frequency (RF) oscillator imperfections have been used as a source of reliable, forge-resistant features (see, for example, A. C. Polak and D. L. Goeckel in Additional Resources).

Consider for example, the normalized frequency error shown in Figure 1. The time series have been obtained by normalizing the receiver clock drift estimated as part of the navigation solution of a GNSS receiver and shows distinctive random effects with (possibly) stable characteristics. These characteristics must be identified and used as features.

We analyzed several metrics that are adopted in the literature to characterize the behavior of a time/frequency source.

The metrics considered are illustrated in Figure 2 that also describes the main elements of the methodology adopted for their evaluation. GNSS measurements are used to compute the user PVT solution. The normalized receiver frequency error, f_e[n], is then computed from the clock bias, dt_r[n], as 

Equation (1) (for equations, see inset photo, above right)

here n is the time index and Ts is the sampling rate. f_e[n] can also be computed by normalizing the clock drift by the GNSS center frequency, in this case f_L1=1575.42 MHz. The time series shown in Figure 1 have been obtained by normalizing the clock drift estimated during a static data collection. It is noted that the clock drift and the clock bias are computed from different observables, Doppler measurements, and pseudoranges. Thus, they have different characteristics. We showed in our paper presented at the ION 2016 GNSS+ conference that the normalized frequency error derived from Doppler measurements leads to the features that are more stable to environmental changes. Doppler measurements are less affected by the different error sources and thus should be preferred for the determination of receiver features.

The normalized frequency error is then used to compute different metrics such as the Allan Deviation defined as (see S. Bregni, Additional Resources):

Equation (2)

Equation (3)

The Allan Deviation is a curve which depends on the averaging time, τ. For this reason, it cannot be used directly as a feature for fingerprinting. Therefore, summary statistics, describing the behavior of the Allan Deviation are needed. We selected the Allan Deviations at τ = 1 second and at τ = 30 seconds, the curve slope between τ = 1 second and τ = 30 seconds, the minimum value, and the averaging time corresponding to the minimum Allan Deviation. In this way, five features where obtained from the Allan Deviation.

A similar process was undertaken for other performance curves that are generally used for characterizing time and frequency sources. We considered the Root Mean Square Time Interval Error (RMS-TIE), the Maximum Time Interval Error (MTIE), and the correlation between the samples of the normalized frequency error. As for the Allan Deviation, summary statistics were selected. In this way, a total of 13 features were determined. Additional details on the different features selected can be found in D. Borio et alia.

Clock-Unrelated Metrics
Many mass-market receivers only provide the user location and velocity. In this case, it is not possible to compute the clock-based metrics discussed above. For this reason, we considered clock-unrelated features for receiver identification. The term “clock-unrelated” is used to denote features derived from the position and velocity time series, i.e., from data that do not include the receiver clock bias and clock drift. The rationale behind the analysis conducted is that the errors affecting the clock components and the vertical components in the navigation solution should, in general, be highly correlated. In this way, it should also be possible to extract effective features for receiver fingerprinting from the spatial components of the navigation solution.

We followed an approach similar to that detailed for the clock-related features. In particular, the features described in the previous section were computed using velocity and position components. For example, the Allan Deviation is computed using the velocity time series. In this case, the Allan Deviation does not characterize the stability of the receiver oscillator but determines the quality of the velocity solution.

From the analysis conducted, it emerged that clock-unrelated features are not, in general, strongly related to their clock-based counterpart. Figure 3 compares the Allan Deviations computed using the different PVT components for two different receivers. The left column of the figure considers Allan Deviation curves computed using Doppler-based time series. Since velocity components and clock drifts have different normalizations, the curves have been shifted in order to make the initial point of each plot coincide. In particular, the Allan Deviations were shifted to start at one. A good match between Allan Deviations is found between the different curves for τ ∈ [1 – 100] for the one receiver considered in the top row of Figure 3. The same result, however, is not true for the other receiver considered in the bottom row. Although a better match is found when considering pseudorange-derived metrics (see right column of Figure 3), clock-unrelated metrics convey, in general, different information than their clock-based counterparts. Thus, the results obtained from the clock bias and drift cannot be directly applied to features extracted from position and velocity time series.

Filtering and Feature Selection
After selecting a redundant set of candidate features, it is necessary to apply a selection process in order to determine the most effective subset of features for classification. Feature selection algorithms are broadly classified as filter and wrapper methods (see the review paper from G. Chandrashekar and F. Sahin, Additional Resources). The former approaches use a cost function to rank the different subsets of features. The latter techniques wrap the selection process around a classifier/predictor, i.e., the final “user” of the subset of features selected. In particular, wrapper methods select the subset of features with the highest classification performance.

We adopted a filter approach as a compromise between complexity and performance. To apply the filtering approach, it is first necessary to preprocess the time series obtained from the GNSS receivers. The pre-processing applied here is briefly summarized in Figure 4. The time series collected for the feature computation are first segmented into data blocks of limited duration. Each segment of data will be used for computing a different realization of the metrics described above. In this way, several realizations of feature vectors are obtained. Note that several receivers of different models have been used for the analysis described in the next sections. Each receiver model represents a class. In this way, several realizations of the feature vectors are obtained for the different classes. The components of the feature vectors are heterogeneous and can assume significantly different values. Thus, a normalization is required. The following normalization is used here:

Equation (4)

where χ_j^k denotes the jth realization of the kth feature. The overline notation is used to denote normalized quantities. In the following, an additional index will be used to denote membership to a specific class or receiver type. The maximum and minimum values are obtained considering all the feature realizations from all receiver classes. Using Equation (4), normalized feature vectors are obtained where each component takes values within the [0, 1] range.

After data pre-processing, feature filtering is applied. The score function considered here is

Equation (5)

where F denotes the subset under analysis and d_i,j(F) is the inter-class distance between classes i and j. d_i,j(F) is the intra-class distance of the ith class. The intra- and inter-class distances are defined in terms of normalized features (4). In particular, the intra-class distance is defined as

Equation (6)

Equation (7)

and describes the average distance between two classes. Figure 5 provides a geometric interpretation of the different quantities defined here. It emerges that score function (5) is the ratio between the minimum distance between classes and the larger class size. Thus, subset F is selected in order to maximize the spread between classes and minimize the class dimensions.

Experimental Setup
The theoretical framework described in the previous sections has been implemented and tested using the data collected during two data collections. The tests were performed in different weeks and in different signal conditions. Two different scenarios were selected in order to evaluate the feature stability to environmental changes.

The first test was conducted using a geodetic antenna located on the European Microwave Signature Laboratory (EMSL) at the Joint Research Centre (JRC) premises in Ispra, Italy. The EMSL is the highest building in the area and no obstacles are present around the antenna. Hence, the first test was carried out in open-sky conditions.

The second test was performed using an antenna mounted on the rooftop of an office building in the JRC campus. In this case, the building is surrounded by taller constructions and by high trees which cause multipath and fading creating a disturbed signal environment.

The locations of the antennas used for the data collection are shown in Figure 6.

A common setup was designed and adopted for the two data collections. In each setup, several receivers were connected to the same antenna using an RF splitter and used to collect almost four days of data for each experiment. The length of each data collection justifies the data segmentation introduced in the previous section. The receivers logged raw GNSS observables, i.e., pseudoranges and Doppler shifts, with a 1 hertz data rate. Different types of receivers were used, including mass-market and professional multi-constellation receivers.

In order to have the same conditions, only GPS measurements were used for the data analysis. Moreover, a common set of ephemerides were adopted for all the receivers. In this way, the same operational conditions were adopted for the different receivers.

The list of receivers used in the two tests is provided in Table 1 along with the number of devices of the same type. The actual model of the devices can be found in the Manufacturers section.

Five GNSS timing modules were used for the two data collections. Among them, one was updated with the latest firmware that enabled the processing of Galileo signals. The update was performed to analyze the impact of firmware changes on devices of the same type.

Experimental Results
The data collected during the two tests described above were used for feature selection. In particular, subsets of two and three elements were considered. For each subset, score function (5) was computed. We considered only features derived from Doppler measurements, i.e., computed from the velocity/clock drift solution, because of the higher stability of these types of observables to errors and environmental changes. The features have been computed using data segments of one hour, i.e., 3,600 elements.

Subsets of three elements are analyzed in Figure 7 where both clock-based and clock-unrelated metrics are considered. In the clock-based case, features are computed from the receiver clock drift. In the clock-unrelated case, the up component of the velocity solution is used. Since 13 features were originally considered, a total of 286 subsets is found. The abscissa in Figure 7 is the index used to enumerate the different subsets of three elements. From the results reported in Figure 7, it clearly emerges that clock-based features significantly outperform their clock-unrelated counterparts. In the clock-based case, the maximum value of the score function is greater than six. This implies that, for the feature subset leading to the maximum of (5), the smallest inter-class distance is more than six times bigger than the largest inter-class distance. In this way, classes/receiver types are clearly separated and effective clustering can be performed.

This fact is further analyzed in Figure 8 showing the clusters formed using the three features leading to the maximum value of (5). These features are all derived from the Allan Deviation curve and are the Allan Deviations at τ = 1 second and τ = 30 seconds, and the averaging time leading to the minimum Allan Deviation value. The different receivers can be easily identified in the feature space depicted in Figure 8. The professional receivers from one manufacturer show enhanced performance in terms of Allan Deviation with respect to mass-market devices. This is expected given the different market segment, i.e., that of professional receivers. Mass-market receiver of type a is the only device showing significantly different behaviors in the two data collections. In the open-sky scenario, this receiver has features similar to those obtained for the timing modules mentioned above. Figure 8 also shows that firmware updates can affect the receiver behavior. This fact clearly emerges when considering the behavior of the one device updated with the Galileo firmware: the cluster defined by the features determined for this device is clearly distinct from that of the standard timing modules.

In the clock-unrelated case, the score function is always lower than 0.5. This implies a significant overlapping between classes in terms of clock-unrelated features. This fact is further investigated in Figure 9 showing feature selection results in the two-dimensional case. Two-dimensional feature vectors are considered here for clarity reasons. When the three-dimensional case is considered, the feature space representation is quite cluttered making the interpretation of the results more difficult. Moreover, the score function reported in the right part of Figure 9 shows that, in the clock-unrelated case, there is no significant gain when moving from fingerprints with two features to vectors with three elements.

The receiver classes represented in the left part of Figure 9 show that the one manufacturer’s receivers of different types have similar features. The overlapping between classes observed in Figure 9a compromises the overall score that does not increase even when an additional feature is included for fingerprinting. However, the results observed suggest that clock-unrelated features may allow for the identification of different receiver manufacturers. When considering receivers from the other manufacturer, the Allan Deviation at one second progressively decreases as a function of the receiver generation. This result reflects the fact that more recent receiver models have better Allan Deviations than older models.

Conclusion
This working paper provides initial results towards the fingerprinting of GNSS devices. The PVT solutions provided by GNSS receivers were considered as possible sources of features for fingerprints. It was shown that Doppler-derived time series, i.e., the three velocity components and the receiver clock drift, are more stable to environmental changes and thus should be preferred for receiver fingerprinting. Moreover, clock-related features, i.e., metrics derived from the receiver clock bias and drift, better discriminate the different receiver models. In this respect, a vector of three clock-derived features is sufficient to characterize a receiver model. Clock-unrelated features, i.e., based on the velocity time series, do not always allow for the identification of the receiver model. Despite this fact, experimental results indicate that manufacturer identification should at least be possible using clock-unrelated features.

Additional data collections will be performed as future work to confirm the preliminary results discussed here. A classification framework based on the features identified will also be implemented to demonstrate automatic receiver identification.

Additional Resources
[1] Borio, D., Gioia, C., Baldini, G., and Fortuny, J., “GNSS Receiver Fingerprinting for Security- Enhanced Applications,” Proceedings of the 29th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2016), Portland, OR, September 2016
[2] Bregni, S, Synchronization of Digital Telecommunications Networks, Wiley, June 2002
[3] Chandrashekar, G. and Sahin, F., “A Survey on Feature Selection Methods,” Computers & Electrical Engineering, Volume: 40, Issue: 1, 2014.
[4] European Commission, “Regulation (EU) No 165/2014 of the European Parliament and of the Council of 4 February 2014 on Tachographs in Road Transport,” on-line, 2014
[5] Jafarnia-Jahromi, A., Broumandan, A., Nielsen, J., and Lachapelle, G., “GPS Vulnerability to Spoofing Threats and a Review of Anti-Spoofing Techniques,” International Journal of Navigation and Observation, May 2012
[6] Polak, A. C. and Goeckel, D. L., “Wireless Device Identification based on RF Oscillator Imperfections,” IEEE Transactions on Information Forensics and Security, Volume: 10, December 2015
[7] Pujante, A., “Location Authentication, Enabling New Smartphone Apps,” Inside GNSS, Volume: 9, May-June 2014
[8] Xu, Q., Zheng, R., Saad, W., and Han, Z., “Device Fingerprinting in Wireless Networks: Challenges and Opportunities,” IEEE Communications Surveys and Tutorials, Volume: 18, First Quarter 2016

The post Feature Selection for GNSS Receiver Fingerprinting appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.