SparkPNT’s initial lineup includes four product families. Facet FP is an IP67-rated modular GNSS receiver line available in seven configurations, built for serviceability and long-term upgradeability. TX2 is a quadband GNSS receiver supporting RTK and Galileo HAS for centimeter-level positioning, aimed at surveying applications, with an IP67 enclosure and integrated antenna. The SXM-E Reference Station is a continuously operating reference station with a web-based control interface capable of acting as an NTRIP caster. SXT and SXT-D GNSSDO units are timing products designed to deliver sub-1ns accuracy with enhanced frequency stability.

The company is positioning the line around open-source and customizable architecture rather than the proprietary ecosystems that have historically dominated high-precision positioning and surveying.

“For over twenty years, SparkFun has made cutting-edge electronics more accessible. With SparkPNT, we are applying that exact same philosophy to precision positioning,” said Glenn Samala, CEO of SparkFun Electronics. “We aren’t just launching a new line of GNSS products, we are launching an adaptable, future-proof PNT platform that gives industrial, logistics, robotic, and agricultural sectors commercial-grade precision at a fraction of standard costs—fully backed by a mature manufacturing powerhouse that knows how to deliver at scale.”

SparkPNT founder Nathan Seidle said the company’s goal is to open up a market segment built on closed systems. “For decades, the high-precision positioning and surveying markets have been dominated by proprietary ecosystems. Our goal is to provide field-ready high-precision systems that utilize an open-source and customizable architecture, putting true ownership in the hands of the user.”

SparkPNT is based in Boulder, Colorado.

The post SparkFun Launches SparkPNT, a New Open-Source GNSS Receiver Subsidiary appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

SkyBarrier is designed to jam all four major global navigation satellite systems simultaneously: GPS, GLONASS, Galileo, and BeiDou. HENSOLDT states the jamming effect covers both civilian and military signal variants, including encrypted signals, across the full range of currently relevant frequency and coding variants.

The system is built around rapid deployment: HENSOLDT says two operators can complete setup — including mast assembly and cabling — within minutes, with activation via a mechanical front-panel switch requiring no software configuration. The complete system consists of a single portable electronics unit, an extendable telescopic mast, and associated accessories.

HENSOLDT designed SkyBarrier for incremental upgradability, stating that new signal types can be added by replacing individual components rather than the full system. The company also notes a minimal physical interface profile — three hardware interfaces with no external data communication pathways — as a deliberate cybersecurity measure.

The post HENSOLDT Introduces SkyBarrier GNSS Jamming System at Eurosatory appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

PANOSETI — Pulsed All-sky Near-infrared Optical SETI — is a multi-institutional program led by researchers at the University of California, Berkeley. The system requires extremely precise time coordination across widely separated telescope nodes to detect fast-transient optical and near-infrared signals. Traditionally that level of synchronization has depended on fiber-based infrastructure such as White Rabbit, which is costly and impractical to deploy at remote observatory sites.

Using the u-blox ZED-F9T, the PANOSETI team demonstrated approximately 0.7 nanosecond standard deviation between 1PPS signals over a 1-kilometer baseline, with performance improving to around 200 picoseconds using filtering techniques — meeting or exceeding the requirements for next-generation distributed sensing systems.

“Achieving this level of synchronization without fiber is a significant step forward for distributed instrumentation,” said Dan Werthimer, Chief Scientist of the PANOSETI project at UC Berkeley. “It allows us to achieve the timing precision we need for our telescope array in locations where traditional fiber-based systems are not feasible.”

The u-blox announcement frames the result as extending beyond scientific research, pointing to applications in distributed sensor networks, remote timing systems, and resilience of critical infrastructure.

The post u-blox GNSS Receiver Enables Sub-Nanosecond Sync for Optical SETI Array appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

The milestone centers on Qualinx’s QLX3xx — a reconfigurable GNSS SoC and Analog Front End targeting secure positioning, navigation, and timing applications, including resilient timing and synchronization networks and ultra-low-power GNSS receivers for connected edge deployments. The chip was designed, taped out, and manufactured entirely at GF’s Dresden fab using its FDX process technology. No design data or physical materials left the European Union at any stage of production.

“Our partnership with Qualinx marks the first operational milestone,” said Dr. Manfred Horstmann, SVP and General Manager at GF. “It shows that complex, security-relevant ASIC designs for aerospace, defense, and critical infrastructure can already be industrialized today using a fully European, trusted manufacturing path.”

Qualinx CEO Tom Trill characterized the flow as proof that full European manufacturing control is no longer theoretical. “This first secure product demonstrates that a fully European manufacturing path — from mask services to wafer production — is already a reality today,” he said, adding that the effort gives Qualinx complete control over IP, data, and supply chain within Europe.

The Dresden fab’s sovereign manufacturing capability is co-funded under the European Chips Act. GF says it aims to have a fully automated trusted European flow in place by end of 2026, with regular foundry engagements available to aerospace and defense customers starting in 2027. That roadmap will incorporate European IP partners, mask houses, and OSAT service providers.

GF is also working with Deutsche Telekom on a parallel effort to ensure that production data — from design and tape-out through manufacturing and quality — can be processed, transported, and stored entirely on European networks, cloud infrastructure, and data centers. The practices developed there are intended to feed directly into the scaling of the sovereign manufacturing model.

Qualinx, headquartered in Delft, Netherlands, was founded in 2015. The company’s proprietary Digital Radio Frequency technology implements traditional analog receive-chain functions in digital hardware, targeting GNSS, PNT, and PVT chipsets and modules for applications ranging from automotive and fleet to wearables and asset tracking.

The post GlobalFoundries, Qualinx Complete First All-European GNSS Chip Manufacturing Flow appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Murata had previously invested in Xona through WONDERSTONE Ventures, its corporate venture capital arm. The MOU moves the relationship downstream toward hardware, pairing Murata’s capabilities in high-frequency communications, sensors, timing devices and module design with Xona’s LEO-based PNT infrastructure.

Xona’s Pulsar service is built on a dedicated LEO constellation designed to deliver significantly stronger signals than conventional GNSS, with centimeter-level positioning accuracy, faster convergence times, reduced multipath error and improved performance in urban and indoor environments. Pulsar is designed for GNSS compatibility, enabling integration with existing user equipment as a complement rather than a replacement.

The two companies identified data centers and financial institutions requiring precise timing synchronization for 5G and 6G communications infrastructure, and off-road construction and agricultural machinery operating in environments where GNSS availability is limited, as near-term application targets.

Murata described the space domain as a new growth area, framing the partnership as part of a broader commitment to advancing positioning and timing synchronization as foundational technology across communications infrastructure, industrial equipment, mobility and consumer IoT. The company’s scale — it is among the world’s largest manufacturers of passive electronic components — gives the partnership potential reach across global industrial supply chains that few LEO PNT agreements to date have carried.

The announcement follows Xona’s appearance in GPS Innovation Alliance testimony before the House Energy and Commerce Subcommittee on Communications and Technology last week, where GPSIA executive director Lisa Dyer cited six Xona satellite launches planned for this fall and called on Congress to urge FCC approval of the company’s pending radionavigation-satellite service license application.

The post Murata Manufacturing, Xona Space Systems Sign MOU for LEO PNT Product Development appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

What emerged was a detailed picture of a system that remains the world’s gold standard for civil and military PNT—operationally reliable, economically indispensable—but one whose modernization has fallen behind the pace of threat, and whose complement architecture is now the subject of a spectrum dispute with consequences well beyond the PNT community.

This account is based on the written statements submitted to the subcommittee by the five witnesses.

The five witnesses were Lisa Dyer, executive director of the GPS Innovation Alliance (GPSIA); Sam Matheny, chief executive of the newly launched Merkhet Solutions; Mariam Sorond, CEO and board chair of NextNav; Harold Feld, senior vice president of Public Knowledge; and J. David Grossman, vice president for policy at the Consumer Technology Association.

The constellation: strong record, narrowing margins

Dyer’s written statement provided the most technically grounded account of GPS’s current status.

The constellation has not experienced a system-wide outage since achieving full operational capability in 1995. The FAA reports GPS system availability at 99.9999 percent. Thirty-two satellites are on orbit, eight above the 24-satellite minimum required for global coverage. The Wide Area Augmentation System extends accuracy and monitors signal integrity across the National Airspace System.

Against that record, Dyer placed a more pressing set of facts. Eight of the 32 satellites are operating on a single string—one subsystem failure each from becoming non-operational. More consequentially, on April 17, 2026, the Space Force terminated the GPS Next Generation Operational Control System program, the long-delayed ground-segment effort that had run more than a decade behind schedule and triggered a Nunn-McCurdy cost breach. Dyer framed the cancellation as an overdue clearing of the path for rapid modernization, and for what she described as a more deliberate integration of commercial satellite PNT data into military operations.

She also documented a capability asymmetry that the subcommittee has not previously examined at this level of specificity. GPS III satellites deliver eight times the anti-jamming protection for military users over their predecessors. GPS IIIF satellites, when fielded, will deliver 63 times. Neither generation extends those protections to civil, commercial or scientific signals. Dyer argued the civil-signal gap carries national security implications precisely because aviation, maritime and surface transportation operators—sectors that depend on civil GPS signals—provide mission-critical logistical support to the Defense Department.

GPSIA submitted formal recommendations on GPS modernization to the defense subcommittees of both Appropriations Committees and both Armed Services Committees the week of the hearing. In September 2025, the Alliance sent a letter to Secretaries Hegseth and Duffy outlining a range of whole-of-government options for addressing jamming and spoofing.

Interference: from conflict zone to domestic runway

Witnesses presented interference as a problem that has moved decisively from theoretical to operational. Sorond cited two 2022 incidents on U.S. soil: a jamming event of unknown origin that shut down a runway at Dallas–Fort Worth International Airport and disrupted roughly 40 miles of airspace for nearly two days, and a separate unauthorized transmitter that interfered with GPS operations at Denver International Airport, affecting both aircraft and air traffic control. Feld’s written statement pointed to a more recent example: Russia’s jamming of the GPS systems aboard the RAF aircraft carrying UK Defense Minister John Healey as he returned from a visit to Estonia. Dyer referenced third-party data aggregating more than 55,000 reported GPS interference events in commercial aviation in 2025—a 24 percent increase over 2024—noting that while the majority occurred overseas and near active conflict zones, a portion occurred within U.S. airspace or on approaches to U.S. destinations.

Dyer was pointed on enforcement. The legal framework is not the problem—federal law already prohibits the manufacture, sale and operation of jamming equipment that interferes with authorized radio communications. In her written statement, she argued that the FCC and the Department of Transportation lack the budget and personnel to enforce those laws, coordinate a whole-of-government response, or adequately address the growing volume of incidents. She called on Congress to provide both agencies with the resources to meet their existing mandates.

The complement landscape: consensus on need, but not on method

Where the panel converged on the modernization and interference questions, it divided sharply on the path to a resilient complementary architecture.

Matheny testified on behalf of Merkhet Solutions, an independent company launched June 2 to commercialize the Broadcast Positioning System (BPS), a terrestrial PNT technology developed at the National Association of Broadcasters starting in 2021. BPS embeds timing and tower-location data within ATSC 3.0 transmission signals. A single tower provides traceable time; multiple towers enable positioning by the same multilateration geometry as GPS. The system requires no internet, satellite or cellular connectivity, operates on existing licensed broadcast spectrum, and supports passive, unlimited simultaneous reception.

Matheny cited a 2025 peer-reviewed NIST finding—produced under a 2024 cooperative research and development agreement—that BPS time-transfer performance is “comparable to or better than GNSS” and constitutes a “viable complementary PNT solution.” A Department of Transportation field trial with Dominion Energy, contracted in August 2025, is underway at a major East Coast substation, assessing BPS performance for grid timing applications. Merkhet currently has deployments in Washington, D.C., Baltimore and Denver. ATSC 3.0 is live in 80 markets reaching more than 75 percent of the U.S. population.

NextNav’s position was presented by Sorond. The company’s Pinnacle vertical-location service is operational in more than 4,400 cities, serves more than 90 percent of U.S. commercial buildings taller than three stories, and provides commercial Z-axis with deployments on all three national wireless carriers and FirstNet. NextNav holds more than 150 patents and describes itself as the largest license holder in the only band the FCC has designated for ground-based positioning.

The company has a petition pending before the FCC that it characterizes as a modernization of its existing licenses in the 902–928 MHz band, to support what it describes as a 5G-based horizontal PNT complement and backup to GPS, deployable on existing wireless infrastructure at no direct cost to taxpayers. The band supports a wide range of licensed and unlicensed operations — among them electronic toll collection systems such as E-ZPass, utility smart meters, home security alarms, agricultural sensors, RFID inventory systems and medical alert devices — that collectively represent decades of investment built on the FCC’s existing coexistence framework.

On the question of modernization, Feld argued that the petition does not update existing rules but asks the FCC to eliminate them—specifically, the protective conditions the Commission attached to the M-LMS licenses when it created them in 1995. That order explicitly acknowledged that Part 15 unlicensed devices had “developed and proliferated in this band and are providing services that are valuable and in the public interest,” and conditioned the new licenses on field testing to demonstrate no unacceptable interference. Feld wrote that NextNav has since “consistently requested that the FCC eliminate the rules protecting unlicensed operations in the band” rather than pursue the cooperative coexistence the 1995 order envisioned.

On the cost question, Feld wrote that the proposed transaction would exchange roughly 14 MHz of shared, low-power spectrum with a partial national footprint for 15 MHz of full-power, flexible-use national spectrum—rights that would be worth billions of dollars if acquired at auction. Feld wrote that, based on the company’s filings, PNT would occupy a small fraction of the resulting network capacity, with the remainder available for mobile carrier use. On the question of deployability, Feld wrote that the proposal would require development of new chips and new 5G standards before any commercial deployment—a process that would take years and depends on wireless carrier adoption that has not been secured.

Grossman characterized the proposal as a structural reconfiguration of the band’s operating environment, not a marginal technical adjustment, and argued that the record of innovation built on existing rules must be weighed against claims of future benefit.

The LEO tier: commercial systems advancing without Washington

Running through the hearing but never its explicit focus was the accumulating progress in commercial low Earth orbit PNT—the tier that may ultimately prove most consequential for complementary architecture.

Dyer described three U.S. companies in various stages of deployment. Iridium operates the first commercial LEO PNT system in the United States, with more than 70 partners across 25 states. TrustPoint is developing a C-band constellation designed for orbital, signal and frequency diversity relative to L-band GPS; three satellites are on orbit, four more in development, with commercial service targeted for 2027. Xona is broadcasting a new signal designed for compatibility with existing GPS receiver infrastructure, scaling manufacturing in California with six launches planned this fall. GPSIA formally recommended that Congress urge FCC approval of Xona’s pending radionavigation-satellite service license application (ICFS File No. SAT-LOA-2023-0711-00165).

Feld anchored the panel’s broader policy argument in the GPS-as-public-good framing, warning against any architecture evolution that would introduce tiered access, impose new costs on agricultural and rural users who rely on free GPS today, or allow the existing system to degrade in favor of proprietary alternatives. He called for privacy-by-design principles to be incorporated into next-generation PNT at the system level rather than addressed through post-hoc regulation.

The record as it stands

The hearing did not resolve the FCC proceedings it illuminated. Its contribution was to put the state of the U.S. PNT posture on the legislative record at a moment when three distinct tracks—GPS modernization, interference enforcement and complement architecture—are simultaneously in motion, each with its own pending proceedings and its own constituency of stakeholders whose written positions now form part of the official record.

The post Congress Weighs the State of U.S. PNT: GPS Modernization, Interference Enforcement and the Search for Complementary Architecture appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

SÉBASTIEN TRILLES, THIERRY AUTHIÉ, XAVIER VASSEUR, MARIE ABBAL, THALES ALENIA SPACE, TOULOUSE, FRANCE

To use GNSS systems for air navigation, various civil aviation organizations have defined an augmentation system capable of fulfilling two primary missions. The first is to calculate correction messages that allow aviation users to exploit GNSS data for precise positioning, even if the GNSS system incorporates intentional or unintentional degradations affecting geolocation. The second mission is to monitor all navigation data broadcast by GNSS systems in real time to detect any anomalies and alert aviation users within a timeframe compatible with their flight phase. Given civil aviation’s need to cover a large area, typically on the scale of a continent, the dissemination of these messages has naturally been directed toward geostationary satellites known as Satellite Based Augmentation Systems (SBAS).

The role of an SBAS is to decompose the various contributors to measurement errors and broadcast, through dedicated augmentation messages, corrections associated with each error contributor to users. These corrections are reassembled by the user receiver according to their geographical position, improving positioning accuracy and helping to mitigate error sources that affect distance information related to satellite clocks, their positioning, and ionospheric effects. All SBAS are interoperable and standardized [1].

The classic functional architecture of an SBAS is composed of a network of ground reference stations that collect GNSS navigation measurements and data, a set of central processing facilities that compute corrections and constructs augmentation messages, and a set of transmission stations that broadcast the radiofrequency signal toward the geostationary satellite.

Current SBAS systems are designed for single constellation GPS, single-frequency L1 users, using the L/NAV navigation message. The augmentation signal is broadcast on the L1 frequency band, modulated by a dedicated PRN, and contains orbital corrections, clock corrections, and a model to correct ionospheric elongation.

Future SBAS, called Dual Frequency Multiple Constellations (DFMC), are dedicated to dual-frequency L1/E1 and L5/E5a users, using L/NAV navigation messages for GPS and F/NAV for Galileo. The augmentation signal is broadcast on the L5 frequency band, modulated by a dedicated PRN, and contains orbital and clock corrections for satellites from different constellations.

The main limitation of SBAS accuracy and availability performance lies in the regional coverage of the ground reference stations network, which does not allow continuous monitoring of the satellites in the navigation constellation. As a result, SBAS must continuously manage satellite visibility losses for several hours, requiring complex strategies to detect any satellite event such as manoeuvres, clock anomalies and hardware bias as soon as measurements become available again. The strong coupling that exists between material biases and ionospheric elongation adds difficulty in the case of satellite raising because it is often difficult to separate a hardware bias jump and an ionospheric event at the edge of the zone.

Furthermore, a geographically restricted network of reference stations does not allow for the correct decoupling of satellite orbits and clocks. This limitation is not a problem for a small service area because the clock error partially compensates for the orbit error. However, clock error is a scalar while orbit error is a three-dimensional vector, so how good the compensation of one error by the other depends on the size of the geographical area to be covered and the geographical position of the user within it. Consequently, a wide service area needs good decoupling between orbit and clock, which a network of regional stations does not provide.

This article studies the possibility of spatializing all the components of a classic SBAS. In this approach, the three main steps of SBAS processing, collecting GNSS data, calculating augmentation messages and disseminating those messages to users, must be carried out by components in free fall around the Earth.

Global SBAS Architecture Overview 

The first step in the SBAS spatialization process involves taking fixed reference stations on Earth and placing them in orbit, under navigation constellations, i.e., in low Earth orbit (LEO). There is no point in flying the stations in cluster formation, as this would not solve the regional problem and, moreover, the service would only be intermittent during the cluster’s orbital period. We immediately assume a uniformly distributed constellation as the geometry for the station distribution.

By doing this, LEO flying stations (LFS) can see GNSS constellations permanently, which is an undeniable advantage for increasing the accuracy of corrections and detecting critical events. Another benefit is SBAS has the capacity to be a global service, representing a significant paradigm shift. The spatialization of the stations also avoids the difficulties of defining a terrestrial network, which must satisfy geopolitical conditions, not to mention that the Earth is 70% covered by oceans, limiting the possible terrestrial sites to emerged geographical areas.

On the other hand, GNSS reference stations are no longer fixed points on Earth; they evolve over time. However, their trajectories remain predictable as their movements are well known and correctly modeled in the short term because they are governed by the laws of space mechanics. It is necessary to have accurate orbits for LFS. Several solutions exist for performing this calculation. Three approaches naturally emerge:

1. The calculation of LFS orbits is performed simultaneously and in the same process as the MEO orbits of the constellation satellites; 

2. LFS orbits are estimated using GNSS measurements through a separate process;

3. LFS orbits are calculated using independent means and independent measurements.

The first approach raises several questions regarding the commonality: LFS are devoted to monitor the GNSS constellation satellite. Using GNSS measurements for both LEO and MEO positioning in the same process brings significant 
algorithmic complexity and risk on the impact of a feared MEO satellite event on LEO position and detection capabilities. Thus, this approach is not discussed. 

The second approach decouples orbit calculations but requires implementing GNSS fault detection and exclusion techniques such as RAIM or ARAIM to make the position of the reference stations insensitive to failures of the constellation satellites.

The last approach offers the greatest possible independence because it is achieved using measurements from a positioning technique that is completely decoupled from GNSS. The Doppler Orbitography and Radiopositioning Integrated by Satellite (DORIS) system is an example of such an independent system. DORIS is a radio navigation and orbit determination system based on Doppler measurements of signals transmitted from the ground to satellites. It is developed and maintained by CNES, the French Space Agency, widely used for space geodesy, Earth observation, altimetry missions and achieving centimeter precision level. The onboard DORIS and GNSS receivers share the same clock. The clock is synchronized with System Network Time (SNT, the reference time of the globalized SBAS), so the orbit generated will be time tagged with respect to the SNT. We retain this for this framework.

At the planned altitude, the LFS are positioned above the area where the ionospheric plasma is most concentrated. The GNSS measurements collected on board shouldn’t be much affected by ionospheric delays. This also implies this type of system will not be able to develop an ionosphere model and calculate ionospheric corrections to single-frequency users. Thus, this framework is devoted for dual-frequencies users. According to this paradigm, the ionosphere model shall be elaborated by an external entity.

The local Earth environment or propagation effects (troposphere and ionosphere) no longer affect measurements collected by GNSS receivers. Therefore, the quality of the measurements is expected to be significantly improved compared to a ground-based system. This favorable environment, associated with a geodetic quality receiver, will improve the precision performance of augmentation navigation messages.

In this framework, the LFS move at a high speed, of the order of 7 km/s, which generates visibility durations for GNSS satellites of 30 minutes. These passage durations are much shorter than those observed from the ground by several hours, but they are long enough for floating ambiguity resolution. The rapid dynamic of the LFS generates high relative movement between LEO and MEO satellites, providing better decorrelation between orbits and clocks and improving SBAS augmentation message performance.

LFS Communicate Via Inter Satellite Links

The proposed architectural framework incorporates inter satellite links (ISL) between the LFS (Figure 1). Selecting optical or RF ISL is driven by the trade-off between ranging accuracy, security and volume of data to be transmitted versus satellite design complexity. Optical links are suitable for high bandwidth and security requirements but demand more advanced technology and precise alignment that affect satellite design. RF links represent a proven technology, simple to deploy and tolerant of inaccuracies, but limited in bandwidth and inherent security. 

ISL capability serves two functions:

• A communication function to share the information recorded by each satellite;

• A ranging measurement function to improve the algorithms for determining the orbits of LFS and to participate to generate the independent SNT.

The first is equivalent to the terrestrial network, the Wide Area Network (WAN), which ensures the transfer of information between SBAS elements. 

The second aims to improve the position calculation and prediction of LFS by feeding the precise orbit determination, initially based on the provision of DORIS measurements, with additional Inter Satellite Ranging (ISR) measurements. The geometry and the accuracy of these additional measurements will help, respectively:

• To improve accuracy positioning in normal and tangential directions;

• To precisely locate the phase center of GNSS signal reception;

• To cope with possible jamming or spoofing of the DORIS station by offering an independent set of measurements; 

• To connect LFS clocks between them to measure their desynchronization (Figure 1). 

Several approaches can be envisioned for forming the clock’s equations, in particular the classic method based on the dual one-way ranging that allows decoupling orbit and clock problems [4].

In this framework, ISL continuity is assumed to be maintained over time without interruption, which requires permanent precise pointing.

The Navigation Kernels are Decentralized

Navigation computations are no longer handled by a single element but are distributed. This distribution is either entrusted to an infrastructure external to the system, already in place and managed independently, or distributed among all LFS.

In the first option, the globalized SBAS has access to a space cloud that handles the entire computational load. The links between the LFS and the space cloud are provided by ISL.

In the second option, each satellite carries a shared computing capacity. The computations are decentralized: Each computing unit performs part of the workload and exchanges the results with each other. These results are assembled by each LFS to generate a common navigation context. 

Decoupling Differential Corrections Generation and Integrity Monitoring

According to the original SBAS architecture designed by Thales Alenia Space [2-3], the navigation processing facility is composed of two components to ensure the independence of integrity checks. The first one, the Processing Set (PS), calculates the SBAS corrections and generates the Navigation Overlay Frame (NOF) with respect to the message format and message sequence defined in the MOPS and SARPS. The Check Set (CS) is the second component responsible for checking the integrity of the corrections from the NOF received from the GEO satellite, using data from at least one other group of independent receivers from each RIMS. When needed, it generates alarms on satellites that are collected by the PS and injected inside the very next NOF in case an anomaly is detected. To ensure diversification, the set of RIMS is divided into two distinct groups: RIMS-A only feeds the PS and RIMS-B only feeds the CS. The rational of this “dual channels” architecture is to comply with the safety requirement stating no single or common mode of failure shall entail a non-integrity event.

The solution studied proposes maintaining this distinction between the roles of the sets, PS on one side and CS on the other, and further extending independence by specifically allocating the measurements collected by a LFS to the PS or the CS functions exclusively. This leads to two separate LFS fleets: one dedicated to fulfilling the PS functions (denoted LFS-A, and acting as RIMS-A) and one dedicated to fulfilling the CS functions (denoted LFS-B, and acting as RIMS-B). The CS can communicate with the PS at the minimum level of integrity parameters to fulfil integrity checks. 

With such separation, the globalized SBAS architecture guarantees complete diversity in the measurement geometry to fulfil the PS and CS functions: the measurements from LFS-A will capture a very different observation geometry from that captured by the LFS-B measurements to perform integrity monitoring. This capability represents a significant advancement over previously developed ground-based architectures (EGNOS and KASS, for example) that co-locate RIMS A and B (in reality these two stations are separated by a few dozen meters to diversify the local environment. However, both RIMS capture the same observation geometry).

An even stricter independence step is to dedicate one batch of LFS to perform only the PS function and the other batch to perform only the CS function. The constellation is divided into two sub-constellations: partition A and B. The first calculates the navigation message (partition A allocated to the PS) and the other monitors the integrity of the message (partition B allocated to the CS). Each partition implements the distributed calculation of the PS and CS functions.

The two partitions communicate with each other via ISL to construct the message to be broadcast: The PS communicates the NOF ready to be sent to the CS, and the CS returns the results of the independent integrity checks to the PS. Different combinations are possible on the geometric distribution of the PS and the CS. This article focuses on two options: partitions (A and B) evolve at the same altitude (Option-1), or the partitions are positioned at two different altitudes, one specific for A and another for B, (Option-2). 

System Time Scale Generation

A SBAS must generate its own time reference, the SNT, which must be parallel (as much as possible) to the TAI. All clock corrections are computed relative to this system time reference. Because the bandwidth of NOF messages is 
limited (currently 250 bits per second), the SNT is steered to GNSS time to limit the magnitude of the corrections.

Several techniques are possible to achieve this internal time scale. Conventional SBAS only have RIMS-GNSS satellite links; the links between RIMS clocks are only accessible from a common satellite visibility by simple difference. Some SBAS develop the SNT using only a set of RIMS (EGNOS), which requires the construction of simple difference measurements; others (KASS) construct the SNT using all available clocks, including those of the RIMS and those of the GNSS satellites.

The globalized SBAS allows SNT construction based solely on the LFS clocks thanks to the direct links that connect them. This architecture makes it possible to construct a timescale independent of the GNSS constellations. The dual one-way ranging technique allows measurement of clock differences over time between two satellites connected by a laser link:

where h_i and h_j are the clock desynchronization of LFS clocks i and j, H_ij is the dual one-way ranging measurement corrected by relativity effects, hardware delays (in meter) relative to the ISL antenna on the receiving chain and on the transmitting chain, and phase centre offset relating on both emitter and receiver satellite [4].

It is therefore possible to construct the clock problem and solve it using various techniques [5-8]. The high quality of the dual one-way ranging measurements, combined with high-quality atomic clocks, allows the construction of a composite timescale whose expected qualities have phase continuity, frequency continuity and high stability (measured by the Allan variance). The SNT is aligned with the GNSS constellation timescale in a conventional manner, either by calculating a timescale difference, a posteriori, or directly during SNT generation by adding constraint equations. This steering will be performed using navigation messages from the GNSS constellations.

The timescale obtained is implicit; it is a paper time because it is calculated as a “well-constructed” average of all the clocks contributing to the calculation. The result of the composite clock algorithms provides biases that represent the advances or delays of each of the LFS clocks relative to the SNT timescale. Once these biases are applied, each clock is assumed to represent a realization of the SNT. This process, therefore, enables the global synchronization of all the LFS in the SBAS system. It then becomes possible to transmit a signal to the constellation every second of the SNT time.

TTA Reduction

The classic implementation of an SBAS (like that of the EGNOS V2 and KASS operational systems) is designed to be a Periodic (repetitive cycle of operations), Synchronous (each operation is performed according to its own timing), and Pipelined (all operations are performed in series) system. Specifically, observations are performed simultaneously at all ground RIMS stations at the second round of GPS time. Data are then transmitted to the navigation cores, where the algorithms are executed at a frequency of 1 Hz as soon as almost all RIMS measurements are received. Each operation has a specific execution time allocation, and the entire system is designed to complete a cycle in 5.2 s.

In the globalized SBAS concept, the LFS also perform measurements in a synchronous manner, meaning all stations observe GNSS events at the same coordinated moment. However, unlike the classic implementation, the specific timing of these measurements is optimized. The synchronization point is not arbitrarily fixed to the second round of system time, but is strategically chosen. This optimization takes several constraints into account: the requirement for the NOF to be available for broadcast starting at a specific round of system time, the estimated data transmission time between LFS, and the computational resources needed to generate the NOF. By aligning the measurement moment with these operational constraints, the system can maximize efficiency and ensure timely availability of the SBAS corrections for end users.

Assuming measurements time is optimized, the time allocations in the different elements of the system would be [9]:

• 1,000 ms to acquire new measurements, due to the 1Hz frequency of NOF broadcasting;

• 200 ms to generate the raw measurements (150 ms) and to format them (50 ms);

• 150 ms to disseminate the data to all SV through the ISLs;

• 350 ms to process data in the DPS (200 ms for computation and 150 ms for exchange data between satellites).

At the end, the NOF ready for broadcast is available in less than 1 second (Figure 2).

The time to alert (TTA) corresponds to the maximum time elapsed between the moment an anomaly likely to compromise user safety is detected and the moment the user receives the corresponding alert, informing them to no longer trust the service. In other words, it is the maximum time for any fault/error detected or suspected by the system to be reported to users by an alarm message transmitted via the SBAS signal. TTA is a central criterion for safety-of-life applications. For vertical guidance approach services (APV-I / LPV-200 type), the international ICAO SARPS standard sets the maximum TTA at 6 seconds. If the SBAS detects a loss of integrity, the alert must reach the user within this time. A short TTA ensures users will be quickly informed of a loss of performance or an anomaly, and can react or interrupt critical procedures when service reliability cannot be guaranteed.

The TTA takes the duration of NOF transmission (1 s) into account and the time allocated to user processing (800 ms). The time of SBAS signal propagation from LEO to user is neglected in this first apportionment (around 3 ms). The complete SBAS cycle is completed in between 3 and 4 s (compared to 5.2 s in classic case). The TTA is then below 3.5 seconds, representing a reduction factor of two with respect to classic ground SBAS (Figure 3). 

Finally, the concept of fast alert, [9] would be enabled. Fast alert messages are broadcast using the Q-channel and contain the alert flags (alarm/no alarm) for all satellites set in the PRN mask. The complete SBAS cycle is completed in 1.5 s (compared to 5.2 s in a classic case). This operational flexibility would allow a TTA of 2.3 seconds (Figure 4). 

LFS Broadcast the NOF

In a conventional SBAS architecture, the NOF is transmitted to users by one or more geostationary satellites. This message is generated on the ground, so it must be encoded into a signal and transmitted by a dedicated RF ground up-link station to the GEO. Because the first bit of the NOF must be sent synchronously at the second round of SNT time (close to GNSS time by specification) at the phase center of the GEO satellite, conventional SBAS systems implement a long loop that controls the signal transmission time to the ground. The SBAS is also endowed with an “integrity box” that checks the NOF return link to ensure the NOF received by the user is the same as the one computed by the system. In most cases, both NOF are strictly equal; if a corruption is detected the integrity box cuts the emission at ground.

In the case of a space-based SBAS system, LFS are capable of transmitting the NOF. To be properly processed in the GNSS receiver computing chains, this signal must be modulated by a PRN code that will spread the carrier spectrum using the Code Division Multiple Access (CDMA) technique. For this signal to be correctly processed within GNSS receiver chains, it must be modulated using a Pseudo-Random Noise (PRN) code, effectively spreading the carrier spectrum via CDMA. There are two primary approaches for assigning PRN codes to the LFSs:

• All LFSs transmit using the same PRN code;

• Each LFS transmits using a dedicated PRN code.

In the first case, the globalized SBAS broadcast the NOF with a single, unique PRN for all LFS transmissions. When multiple LFS are within the receiver’s field of view, the receiver can typically differentiate between transmissions by exploiting distinct Doppler shifts, which result in separate correlation peaks in the time-frequency domain. However, the probability of collision between the two correlation peaks is significant. Assuming a Doppler shift of 50 kHz, a loop bandwidth of 5 MHz and a PRN code of length 1,023 chips, the probability of a collision between two peaks can be estimated as (5.10³/5.10⁵)×1/1,023≈10^-5 per millisecond, corresponding to roughly one collision per 100 seconds. If three satellites are in view, the likelihood of simultaneous collision among all three signals becomes negligible. Therefore, using a unique PRN for all LFS requires continuous visibility of at least three LFS. However, this approach implies LFS signals cannot be used for ranging: While the NOF message can be received, the receiver cannot distinguish which LFS transmitted it.

In the second approach, each LFS is assigned a distinct PRN code. Currently, GNSS receivers store the navigation contexts of NOF messages received from each GEO SBAS, identified by its dedicated PRN. Out of all recorded contexts, the user applies only one; when the receiver switches PRNs, it replaces the navigation context accordingly and the old one is purged. In the context of globalized SBAS, however, the visibility time of each LFS is very short, about a dozen minutes, which is insufficient for a receiver to fully update its navigation context. In this situation, the user must retain the navigation context when switching PRNs instead of purging it. This ensures seamless continuity for the user; the navigation solution remains coherent regardless of the current LFS because the integrity and accuracy information provided by each NOF is consistent across all LFS. This adaptation necessitates an evolution of SARPS and MOPS standards to accommodate the new PRN allocation schemes envisaged for global SBAS. This approach allows the ranging function to be achieved even if it involves a significant increase in the number of PRNs required. 

The NOF is transmitted synchronously at the second round of SNT time. In other words, all LFS transmit the NOF to users at the same second of SNT time. This approach removes the necessity and the complexity of the long loop.

Every second, the system broadcasts a single common NOF according to a fixed and predictive message-sequencing scheme, compliant with the requirements of the SARPS standard. This augmentation message is broadcast in L5-I signal frequency.

The constellation is designed so at least two LFS are visible beyond 5° elevations of any user on Earth. The LFS are assumed to be able to receive GNSS signals in the Radio Navigation Satellite Service (RNSS) band and emitting the Aeronautical Radio Navigation Service (ARNS) band without jamming between emission and reception.

Whereas in conventional systems two or three GEOs are active, the possible loss of a GEO has a direct and immediate impact on availability and service continuity performance over a sometimes large geographical area. This new approach multiplies the number of NOF emission points, which greatly increases the resilience of system performance to this type of failure, reducing the impact to only a few users. Different combinations are possible on the geometric distribution of NOF emission points: in Option-1 the two partitions broadcast the NOF, in Option-2 only one partition broadcasts the NOF (Figure 5).

In Option-1, the two fleets broadcast the NOF. A standard functional allocation would consist in apportioning the same number of satellites to partitions A and B. As the LFS A and B are placed at the same altitude, the LFS-B cannot treat the NOF received as the user will; LFS-B only checks the NOF the system is ready to send the user. As all LFS emit the NOF, the return link function is not possible. Detecting possible NOF corruption (a LFS emits a message not conformed to it specification) is then allocated to the user. If the NOFs are different, SBAS can no longer be used. 

In Option-2, partition A is placed above partition B: altitude of the PS function is higher altitude of the CS function and only partition A broadcasts the NOF. The two partitions remain connected by ISL. The difference is now the CS can receive and monitor the NOF messages being sent by partition A and identify whether corruption is possible. The CS identifies the LFS-A responsible for this corruption and sends it a command requiring it to stop sending the NOF. At the next second, this specific LFS-A will cease the emission. The redundancy of LFS-A is designed to limit the impact of this corruption at user level and to maximize the level of performance of availability and continuity.

A global SBAS should bring permanent continuity in GNSS satellite visibility so it can monitor, at any time, all GNSS satellites configured in the PRN mask. 

LEO Ranging Function

The realization of this function assume seach LFS transmits using a dedicated PRN code. LFS have an independent orbit estimate and are synchronized with each other, giving them the information necessary to fulfill the LEO ranging function (Figure 6). This consists of considering LFS as an additional ranging signal. Consequently, the globalized SBAS can naturally act as a LEO PNT system:

1. The satellite precisely synchronizes the start of a PRN code sequence transmitted in the signal with the start one second of SNT time, 

2. The satellite synchronizes the first bit of the navigation message with the second round of SNT time, 

3. The satellite maintains synchronization of the start of a navigation bit with the start of a PRN code sequence, 

4. The satellite maintains the code-carrier consistency.

The internal navigator of the LFS provides an orbit and a clock synchronization bias relative to the SNT. Orbitography algorithms also provide a variance-covariance matrix that can be used to provide URA data. A suitable ARAIM concept could provide the integrity of LEO satellite navigation data, allowing LEO ranging measurements to be incorporated into a safety-of-life solution. The LFS navigation message shall be encoded in the signal broadcast to the user.

In the classic SBAS paradigm, GEO-Ranging function is possible and GEO data navigation takes place inside the NOF itself (MT9 dedicated for GEO SBAS L1 ephemeris). In the spatialized SBAS paradigm, the number of transmitting satellites is increasing considerably and inserting LEO navigation data into the NOF would congest the available bandwidth. It is better to transmit the SIS ranging data in a dedicated message rather than the NOF. In this aspect, two options are envisioned: either LEO ephemeris are encoded in L5-Q signal frequency or L1-I signal frequency. The first is the most energy-efficient because one signal is generated on L5, which modulates the NOF on the I channel and the ephemeris on the Q channel. The second option requires generating and transmitting two signals on two different frequency bands, which consumes more energy and adds complexity. Users can leverage these two frequencies to form the iono-free combination, as is done with GNSS satellites, and improve their positioning.

Monitoring and Control

Classic SBAS provides system monitoring and control, which involves overseeing and managing the ground segment subsystems, supporting maintenance tasks—including configuration management—offering data archiving capabilities for offline activities, and enabling communication with external entities.

In spatialized SBAS, the need for the system monitoring and control function is still present: it is even mandatory to operate the system. The operator ensures operational management of the system, maintenance of the infrastructure and supervision of the service provided to users. Several Mission Control Centers (MCC) on ground are necessary for this. The MCC and the LFS constellation communicate with each other by classic TM/TC.

LEO Constellation Infrastructure 

Achieving a worldwide SBAS solely through ground stations is impractical due to the necessity of comprehensive global coverage, which would require an immense and continuously maintained network of ground infrastructure spread across the entire Earth’s surface. This makes it difficult to provide consistent, reliable augmentation signals everywhere. 

Deploying space-based stations in LEO orbits offers a more efficient and effective solution. LEO satellites can cover vast areas of the planet from orbit, overcoming environmental masking faced by ground stations. This space-based approach ensures continuous, global augmentation service with improved scalability, making it preferable for establishing a worldwide SBAS.

Another benefit of the LEO constellation, and a consequence of global coverage, is its unique capability to receive measurements from GNSS satellites throughout their entire orbits, regardless of the satellites’ position relative to the Earth’s surface. This comprehensive 
visibility enables LEO satellites to monitor GNSS signals continuously, eliminating geometrical blind spots that can occur when relying on ground stations. The estimation of GNSS satellite orbits and clock errors becomes more accurate and robust, leading to improved navigation performance. By providing consistent and diverse observational data from multiple vantage points in space, LEO constellations significantly expand the precision and reliability of GNSS orbit and clock determination. This visibility is the main driver of constellation size: ensuring at least one LEO satellite is visible at all times everywhere on Earth is required to receive the NOF message. Given the safety-of-life nature of the system, safety guidelines further recommend a minimum of two LEO satellites be visible at all times everywhere to cover a single satellite failure. Visibilities are considered when the satellite is above 5° of elevation above the horizon.

The characteristics of a LEO constellation satisfying this constraint mainly depends on altitude. For this study, two different altitudes are considered: 

• 750 km of altitude. This leads to a constellation made of 96 satellites.

• 1,200 km of altitude. This leads to a constellation made of 57 satellites.

These constellations are designed to ensure a minimum number of satellites to respect geometric constraints. They do not constitute the real constellation that will necessarily be sized to take into account failures, redundancy, etc.

These two LEO constellations are configured and represented in Figure 7. 

For each altitude considered, the constellation is minimal in terms of number of satellites. Any constellation with fewer satellites does not ensure at least two satellites in visibility at all times.

The visibility constraint can be verified by using a simple simulation. Visibilities are calculated for a grid of users on Earth. However, as the LEO satellites have an orbital period between an hour and a half and two hours, they make around 15 orbits on a single day. This means globally, the visibility statistics are the same for all users on a same latitude. Therefore, the results in Figure 8 show the minimum, average and maximum number of satellites in visibility as a function of latitude. 

The constraint of at least two satellites in visibility is satisfied everywhere. The statistics do not differ significantly between the two constellations, with visibilities being minimum at the equator, increasing for higher latitudes and decreasing near the poles.

A LEO satellite used for a safety-of-life system will have associated constraints in terms of certification and will be costly. So, the number of satellites should be minimized, making the constellation at 1,200 km the seemingly preferred option. However, this criterion should also be in balance with criteria related to the satellite payload, onboard available power, antenna design, launching constraints and end-of-life constraints. A higher altitude means satellite signals will have to be transmitted with a higher power. The launchers will need to reach a higher altitude, and deorbiting the satellites when they reach their end of life will require more manoeuvring capabilities. This all must be taken into account, but it is also very dependent on satellite platforms, payloads and launching capabilities.

Distributed Processing Facility 

Space-based computing

Space-based computing has been increasingly taken into consideration over the past few years. Among others, we mention the innovative EU-funded study Advanced Space Cloud for European Net zero emission and Data sovereignty (ASCEND) [10], which focuses on the feasibility of deploying space-based data centers and relying on space-based cloud based solutions [11].

In May 2025, China launched the first 12 satellites of a planned 2,800-strong orbital supercomputer satellite network. These satellites aim at performing calculations in space without relying on any ground-based computing facility.

Computing in space offers three major advantages compared to traditional ground-based systems:

• Reduced data transmission costs: Processing data locally in space reduces the need to downlink large volumes of data to Earth, saving bandwidth and costs;

• Low latency: The mutual proximity of satellites in the constellation reduces communication delays, enabling faster data processing;

• Scalability: Space-based cloud computing can potentially scale by deploying additional resources (later named spare satellites) and can be reconfigured dynamically.

A centralized space-based solution 

A straightforward route to designing an efficient space-based processing facility is to rely on a centralized space-based solution, where an independent and already in place infrastructure located in space hosts the entire calculation. This solution exploits already existing algorithms and relies on computing infrastructures currently used on ground-based systems. Nevertheless, this easy to follow route faces the following three main challenges:

• Single point of failure: The entire computing system relies on a single dedicated platform. This means any hardware or software failure can disable the entire computing capability, unless duplicate/diversified computing capabilities are incorporated into the constellation. This expensive solution makes the global infrastructure rather complex.

• Communication: All data must be routed to and processed by the centralized unit, which represents a major bottleneck in terms of communication and elapsed times before calculation. High communication loads may significantly reduce real-time responsiveness;

• Energy inefficiency: A centralized computing solution may require high power consumption for processing large data movement within the single dedicated infrastructure. This may create additional energy constraints.

A fully distributed space-based solution

For all these reasons, an alternative solution must be proposed. In a fully distributed space solution, each satellite in the LFS constellation corresponds to a specific node of the distributed computing facility. Each satellite of each subconstellation acts as a computational unit and communication between the different nodes is handled by ISL links. 

With at least two LFS visible beyond 5° elevations of any user on Earth, the estimated total number of satellites of the global constellation is bounded by 96. Because half of the LFS are attributed to the augmentation message, the total number of nodes of the computing facility is bounded by 48. This moderate network size for a distributed computing facility allows state-of-the-art parallel algorithms to be employed to compute and broadcast messages [12] [13]. At first sight, distributed computing offers immediate advantages over a centralized solution: 

• Efficiency: Multiple nodes can handle different computations concurrently. This speeds up the overall computation of navigation messages with respect to a centralized solution, where communications may become a significant bottleneck;

• Fault tolerance: Because processing is spread across multiple nodes, random failure of one node does not necessarily harm the entire navigation system. Other existing nodes of the LFS-A subconstellation may take over degraded tasks. This flexibility is one of the main advantages of the distributed computing solution. Additional spare satellites also may be incorporated into the LFS-A subconstellation to improve fault tolerance.

• Redundancy: Distributed systems can implement both hardware and software redundancy more naturally by duplicating specific critical functions across multiple nodes, reducing potential single points of failure resulting from random failure.

The distributed computing facility relies on the core idea that each node performs a specific part of the computational workload and exchanges messages (possibly with each other) through ISL links. At the end of the procedure, the results are gathered by each LFS to generate a common navigation context. This may induce a potentially high volume of point-to-point or collective communications between the nodes of the LFS-A constellation. Therefore, it is of outmost importance to rely on algorithms that minimize the global volume of communication. The computation of the state vector during the filtering process in the PS function provides an instructional example in this regard. Of interest is a parallel algorithm for the solution of least-squares problems that requires a low volume of communication. Does this orthogonal factorization distributed algorithm exist at all?

The answer to this question is positive if we rely on advanced numerical linear algebra methods for the solution of least-squares problems. In our context, a parallel algorithm named Communication-Avoiding QR (CAQR) is worth considering [14]. CAQR is a class of QR orthogonal factorization algorithms designed to minimize (and not avoid) the costly communication between nodes in distributed systems. Because data movement often dominates the energy consumption and runtime of numerical algorithms, CAQR aims at improving both performance and energy efficiency by reducing the communication overhead. Communication in our context includes data transfers, which are often more expensive (in time and energy) than arithmetic operations [12]. This reduction of communication overhead is obtained through a specific factorization: CAQR typically divides the matrix to be factorized into different panels (i.e. blocks of columns). Instead of applying the classical Householder QR method [15], [16] on the panel, CAQR applies Tall-Skinny QR (TSQR) [17] instead, a specific QR factorization. TSQR minimizes communication by recursively factorizing smaller blocks, using a reduction tree structure (e.g., a binary tree of partial QR factorizations) to combine results efficiently with limited data movement [18] [19]. In short, communication costs are reduced by organizing QR operations as tree-structured reductions rather than linear sequences. This algorithmic feature enables parallel processing of independent blocks, combining partial results with minimal communication steps. The number of communication steps is logarithmic in the number of panels [20].

By significantly reducing the volume of communication, CAQR delivers a reduced energy consumption while providing improved overall runtime [14]. CAQR maintains the numerical stability properties of classical Householder QR factorizations, ensuring accurate and reliable factorization results despite the communication optimizations. At the end of the algorithm, the solution of the least-squares problem is known on a leaf of the reduction tree and a single collective communication is used to share this information on the other nodes of the LFS-A subconstellation. This shows a distributed algorithm with a low overhead in terms of communications can be applied during the filtering process. 

Space-based distributed computing is a doable approach that introduces additional constraints to satisfy during the design of the architecture of the spatialized SBAS: 

• Limited computational resources: Each node has a specific limited CPU (or GPU) power, memory and energy compared to Earth-based computing centers. A key point is to optimize the global hardware resource efficiency with respect to the properties of the LFS-A subconstellation (number of satellites and total volume of communication essentially);

• Physical and environmental constraints: Space-based computing often meets challenging physical conditions (such as temperature extremes, vibration, radiation in space) that may affect hardware reliability. Hardware must be resilient against environmental factors. A key point is to overestimate the number of satellites in the LFS-A subconstellation to provide redundant calculations.

These additional constraints must be carefully considered when designing the global constellation and when performing the safety analysis.

Safety Dimensioning in New SBAS Architecture Concepts

When analyzing novel SBAS architectural concepts from a safety standpoint, it is imperative to recall the overarching safety dimensioning principles to guide the assessment of their compliance and the identification of associated constraints.

This analysis is framed within the context of civil aviation. At the system level, the primary safety-feared events and their corresponding severity classifications are defined as:

• Integrity is customarily established as the measure of the trust that can be placed in the correctness of the information supplied by a navigation system. Integrity includes the system’s ability to provide timely warnings to users when it should not be used for navigation. A failure in integrity, termed a “non-integrity event,” is linked to a hazardous severity classification [21].

• Continuity is the ability of the total system (comprising all elements necessary to maintain craft position within the defined area) to perform its function without interruption during the intended operation. More specifically, continuity is the probability the specified system performance will be maintained for the duration of a phase of operation, presuming the system was available at the beginning of that phase. A “non-continuity event” corresponds to a major severity classification [21].

Foundational Safety Engineering and Safety Assurance Principles

The applicable European Cooperation for Space Standardization (ECSS) standards in Europe stipulate that “no single system failure or single operator error (SPOF) shall have critical (i.e. hazardous) or catastrophic consequences.” This has profound architectural implications; it requires that any function whose failure could result in critical/hazardous consequences must be underpinned by a minimum of two independent components.

Development Assurance Level (DAL)

Given the safety-critical nature of civil aviation, software development is governed by rigorous standards. Safety analyses underpin the allocation of Development Assurance Levels (DAL) to various items in accordance with the architecture.

Development Assurance involves specific planned and systematic actions providing confidence that errors or omissions in requirements have been identified and corrected to the degree the system implemented satisfies the applicable safety requirements. System/sub-systems and products are assigned DALs based on failure condition classifications associated with system level functions implemented in the sub-systems and products. The rigor and discipline needed in performing the supporting processes vary corresponding to the assigned development assurance level.

The initial software DAL determined can be mitigated when considering the different kinds of protections or alternate potential design implemented into the architecture, with provision that evidence of full independence between involved software functions is provided. Finally, the DAL allocation is a consequence of the implemented architecture: The redundancy, independence, and segregation embedded within the architecture dictate the refinement of DAL assignments. DAL levels play a pivotal role in component selection and exert a significant influence on project costs. It is prudent to iteratively assess candidate architectures to converge upon an optimal solution.

Software failures with potential hazardous implications (e.g., non-integrity events in SBAS) necessitate DAL B [22]/SWAL 2 [23].

Software failures leading to major events (e.g., non-continuity events and Accuracy Major event in European SBAS) require DAL C [22] / SWAL 3 [23].

In typical SBAS architectures, functions contributing directly to the integrity check of augmentation messages and certain critical data dissemination tasks—those that guarantee the non-corruption of broadcast messages—are assigned DAL B, in recognition of their integrity-related criticality. Conversely, functions related to data collection and non-critical dissemination generally carry a DAL C assignment in Europe, reflecting their continuity focus.

Emitted SBAS Signal Monitoring

For any safety-critical system intended for safety-of-life applications, the following principle remains salient: Wherever possible, the SBAS system should internally monitor its own transmitted signal, permitting real-time awareness of failures (primarily those in the dissemination chain) and take adequate actions instead of relying on open-loop operation. While not a formal requirement provided other safety principles (in particular the SPOF principle) are observed, this best practice is inherent to the present concept.

Implementation of Safety Principles in Operational European SBAS EGNOS V2

These foundational safety principles are stringently applied in the operational European EGNOS system, with their fulfillment evidenced across the following major functions:

Data Collection: EGNOS V2 employs physically and logically separated RIMS A and B chains, both developed according to DAL C1.

• Augmentation Message Calculation and Integrity Checking: The Central Processing Facility (CPF), assigned DAL B1, comprises two independent units fed by independent data: the PS fed by RIMS-A and the CS fed by RIMS-B. In accordance with [22], the PS is allocated DAL C1 and the CS receives DAL B1. This dual-channel design directly supports enforcement of the SPOF principle.

• User Dissemination: The operational SBAS in Europe relies on NLES and GEO segments. Safety-critical integrity related functions—such as CPF selection and Integrity Check— are segregated and allocated DAL B. Functions that contribute primarily to continuity rather than integrity are assigned to DAL C1.

The integrity check function—which continuously verifies the fidelity of the broadcast NOF via the Integrity Box—effectively upholds the SPOF principle by precluding integrity events stemming from a single failure or corruption of the NOF within the dissemination chain. This mechanism ensures continuous monitoring of the emitted SBAS signal, empowering the system to respond appropriately in the event of any dissemination anomaly.

Complementing this capability, GEO signals as received at the RIMS, are relayed to the CPF, facilitating the prompt issuance of alarms or corrective actions whenever discrepancies are identified. Should a failure—specifically, NOF corruption—arise within the dissemination chain (in cases where the chain does not broadcast the information as instructed by the CPF), it is possible that, even if the CPF detects the anomaly and generates alarms, these messages might not be transmitted due to the compromised dissemination chain. The integrity check function is designed to address this scenario.

Compliance of the Fully Space-Based SBAS Concept with Safety Requirements

At the system level, from a safety perspective, the high-level architectural proposal is summarized in Figure 9. 

At the system level, the architecture preserves the logic of maintaining two independent channels—extending from data collection through correction computations and integrity checks. This dual-channel strategy ensures adherence to the SPOF principle at the highest level. Specifically, LFS-A is dedicated to feeding the PS, whereas LFS-B supplies the CS. The strict separation between LFS-A and LFS-B guarantees the independence of input data for each critical process. 

The correction PS, sourced from LFS-A, is entrusted with generating corrections and the associated integrity bounds. In parallel, the CS leverages independently sourced measurements from LFS-B to validate the corrections and their integrity parameters. This rigorous, independent, dual-channel design ensures a single fault or failure cannot compromise overall system integrity.

For data collection, several considerations stem from safety recommendations. Positioning GNSS data collection stations is critical for the calculations performed by the SBAS processing system. Leveraging mobile GNSS data collection stations introduces the necessity to strictly ensure the accuracy of their geospatial coordinates. To safeguard against error or bias propagation, the positioning solution for LFS stations should be established using means and data independent from those employed by the SBAS system itself. This mitigates the risk that systematic biases or errors could be inadvertently transmitted into the final positions computed by the SBAS. Solution 3 (“LFS orbits are calculated using independent means and independent measurements”) directly fulfills this requirement for independence. In addition, leveraging ISL connectivity with ranging capabilities further increases and consolidates the accuracy of LFS location estimates.

Deploying two distinct fleets—LFS-A and LFS-B—allows separation between correction computation and integrity verification channels. With their positioning, LFS-A and LFS-B will achieve substantially different observation geometries; the system hence ensures data streams used for corrections and integrity bound computations and those for integrity checks remain independent, enhancing the robustness of integrity check.

Analogously to the RIMS DAL C allocation within “terrestrial” SBAS systems—attributed for their respective contributions to continuity—the data collection function is designated a DAL C1.

With respect to data processing and integrity verification, the principle underpinning this architecture is to preserve complete independence between the PS and the CS, upholding the SPOF criterion. To this end, the PS and CS are provisioned with independent inputs from LFS-A and LFS-B respectively, each implementing diversified algorithms purposed to detect and mitigate feared events, initiate appropriate alarms when required, and compute/verify corrections and associated integrity bounds.

Drawing upon a safety monitoring principle [22] that’s applied within operational EGNOS V2, the PS is allocated DAL C1, whereas the CS receives a DAL B1 allocation. These designations impose considerable constraints on software development for the LEO satellite segment.

Both the PS and the CS are proposed under the paradigm of a “fully distributed space-based solution,” whereby the PS function (and likewise the CS function) is performed by an “active sub-pool” of LFS-A (and, correspondingly, of LFS-B). Owing to the permanent communication links established among all LFS units, any failure occurring within one of the active sub-pool LFS nodes is instantaneously propagated. This enables the swift activation and integration of a replacement LFS into the active sub-pool for a given PS/CS sub-function. Thanks to the scale of the constellation, the computational resources available to each LFS unit, and—critically—the capability afforded by the ISL that ensures all LFS nodes maintain an identical level of information, the system can exploit “hot redundancy” among LFS nodes for PS and CS sub-function. This design enhances the overall availability and continuity of the global system.

The concept’s reliance on transmitting a singular, uniquely defined NOF stream simplifies redundancy management across both user receivers and within the system’s own infrastructure.

It is noteworthy that the alternative logic of a “centralized space-based solution” is not inherently prohibitive from a safety perspective. While such an approach does introduce a central point of failure from a RAMS standpoint, this vulnerability can be mitigated by implementing robust redundancy architectures or, if needed, diversified processing chains. Such design adaptations could render the centralized solution sufficiently resilient, thereby restricting its adverse impact on system availability and continuity.

The dissemination of the NOF concept entrusts the LFS with dissemination responsibilities, diverging from the conventional reliance on GEO satellites typical of SBAS. 

Broadly, a failure within the dissemination chain may precipitate:

• A continuity event, triggered by loss of functional capability;

• An integrity event, arising from corruption of the NOF by the LFS.

In the first scenario, loss of a single LFS impacts availability and continuity, but these consequences are geographically constrained and limited to a small subset of users (in marked contrast to the loss of a GEO satellite), rendering such events generally acceptable.

Conversely, in the event of NOF corruption by an LFS, a potentially significant integrity event may ensue. Owing to the density of the LEO constellation, comprehensive real-time monitoring of all NOF transmissions from all LFS assets is unfeasible for the SBAS system. As a consequence, a single undetected failure could compromise system integrity. The safety concept herein articulated recommends users monitor at least two independent LFS sources and cease using the service if discrepancies are detected between the NOF received from these sources.

This mitigation is not considered fully satisfactory from a safety standpoint. First, it does not necessarily protect against all types of dissemination failures, such as systematic software faults affecting LFS-A, which could lead to correlated failures across seemingly independent units. Secondly, it places the burden of integrity monitoring on the user, exposing a fundamental limitation in the system’s intrinsic ability to autonomously detect and respond to dissemination failures—which is not optimal from a safety perspective.

Option-2 offers a different approach, whereby the NOF broadcast from LFS-A is subject to independent monitoring by a separate LFS-B asset, typically operating at a lower orbital altitude. In this arrangement, LFS-B would possess the authority to inhibit or terminate transmissions from LFS-A if an inconsistency or corruption in the NOF is detected. This monitoring of the LFS-A by the LFS-B would be DAL B allocated. 

Additional Safety Considerations and Way Forward

These safety considerations do not identify any fundamental showstoppers to the global SBAS concept using a fully space-based infrastructure. This concept eliminates de facto classic local ground effects such as multipath, interference, tropospheric delays, and tidal effects, improving performance. Nevertheless, several broader points must be explored: 

Applicable SBAS Regulatory Framework 

The safety reference framework and associated requirements considered are currently in force for SBAS within Europe. One major consequence of this regulatory baseline is the requirement for dual, fully independent “A” and “B” chains—most notably, the need for PS and CS functions to be separated and developed respectively to DAL C and DAL B. In particular, the imposition of DAL B on software development for LEO satellites may result in very significant development costs.

The SPOF principle for critical/hazardous events, as inherited mainly from ECSS, appears to be more stringent than those applied in the aeronautical domain. A review of [21] reveals:

• No explicit “no SPOF” criterion for hazardous failure conditions;

• No requirement that no combination of two independent system failures or operator errors should lead to catastrophic consequences (required by the ECSS). 

Notably, aeronautical standards demand the absence of SPOF only in the case of catastrophic consequences. In Europe for a SBAS, the requirement for no SPOF in critical/hazardous systems may be justified by the large number of aircraft potentially affected by any failure—a rationale that arguably holds even greater weight for a global system of this nature.

Applying the SPOF principle at the critical/hazardous level mandates the implementation of two independent chains for the CS and PS. It would be relevant to analyse this architecture and corresponding DAL allocation in light of the [24] guidelines (which are not part of the European baseline for SBAS). According to [24], if a hazardous failure condition could result from a combination of possible development errors between two items, either one should be allocated at least DAL B, or both should be assigned DAL C. This latter approach could offer a more balanced allocation of development assurance levels and potentially alleviate some of the stringent constraints currently imposed on LEO satellite software development. 

With regard to implementing the approach outlined in [24], the current concept involves exchanges between the PS and CS chains. In particular, the function responsible for generating corrections and integrity bounds is not fully duplicated across both PS and CS chains. Should the current level of independence between PS and CS be insufficient to comply with the principles set forth in [24], minor modifications to the concept could be considered. For instance, the PS functions could be integrated within the LFS-B, with dissemination of information also performed by the LFS-B (as in Option 2). In this case, two NOFs would be distributed, and a voting mechanism at the user level would help identify an erroneous NOF. However, this scenario would lack monitoring of the NOF broadcasted by the LFS-B to the user.

Identification of New Feared Events Arising from Spatialization 

Introducing “fully based” elements—specifically the implementation of ISL, using the DORIS system, and the spatialization of equipment that is traditionally ground-based in an SBAS—should lead to identifying new internal feared events to address in the system-level analysis.

Global System Considerations

The core strength, innovation and advantage of this concept lie in its potential to provide truly global coverage for integrity services. The positive implications of such an advancement would be substantial, but it’s necessary to address questions regarding responsibilities and roles among different countries, particularly given the safety-critical nature of the service on a worldwide scale.

Conclusions 

This article explores a groundbreaking shift in SBAS architecture by proposing the spatialization of its core components—data collection, augmentation message computation and dissemination—within a distributed network of LEO satellites. By moving reference stations into orbit as LFS, the system achieves global GNSS visibility, eliminates the constraints imposed by terrestrial station distribution, offers a worldwide service, and significantly enhances the accuracy and resilience of navigation augmentation data.

The architecture leverages advanced technologies like inter-satellite links and space-based distributed computing, enabling real-time data sharing, independent time scale generation, and robust integrity monitoring. The proposed partitioning of the constellation further meets stringent safety-of-life requirements, ensuring redundancy, diversity of observations, and fail-safe operations.

Simulation results demonstrate that appropriately sized LEO constellations can guarantee continuous visibility and redundancy for service availability, while the distributed processing facility uses state-of-the-art parallel algorithms to minimize communication overhead and maximize computational efficiency. While the technical feasibility is affirmed, the design must also accommodate the unique constraints of space infrastructure—including hardware resilience, energy consumption and operational safety.

Overall, this study shows that a globalized, space-based SBAS could offer transformative improvements in augmentation accuracy, reliability and scalability—paving the way for a next-generation system capable of meeting the demanding needs of civil aviation navigation on a truly worldwide scale. Future work will focus on refining the constellation design, optimizing system safety, and addressing the operational and certification challenges inherent to spaceborne navigation augmentation. 

Acknowledgment 

The authors thank Michel Monnerat for discussions regarding receiver signal processing and Celine Renazé for her useful advice and recommendations. 

References

[1] ICAO Standard and Recommended Practices (SARPs), Annex 10, Volume 1, up to Amendment 93

[2] D. Flament, J. Poumailloux, J-L. Damidaux, S. Lannelongue, J. Ventura-Traveset, P. Michel, C. Montefusco, “The EGNOS System Architecture Explained”, May 2011.

[3] User Guide for EGNOS application developers, Ed. 2.0, 15/12/2011, ISBN 978-92-79-20335-0 ESA.

[4] M. Laurenti, L. Maisonobe, P. Roldan, J. Anton, P. Guerin, S. Trilles, “Improving GNSS Navigation Messages Performance using Inter Satellite Links Technology”. Inside GNSS May/June 2024, pp 36-42

[5] Brown, K. R. (1992). The Theory of the GPS Composite Clocks, Proceedings of ION GPS-91, 11-13 September 1991, pp. 223-242.

[6] Greenhall, C. A. (2007). A Kalman filter clock ensemble algorithm that admits measurement noise: corrections and update, Metrologia, 44, 491-494, doi:10.1088/0026-1394/44/6/008

[7] Senior, K. L., & Coleman, M. J. (2017), The Next Generation GPS Time, NAVIGATION: Journal of The Institute of Navigation

[8] Roldan, P., Trilles, S., Serena, X., Tajdine, A., “Novel Composite Clock Algorithm for the Generation of Galileo Robust Timescale,” Proceedings of ION GNSS 2022, September 2022, pp. 2790-2799. https://doi.org/10.33012/2022.18521

[9] C. Renazé, C. Bourga, M. Clergeaud, J. Samson, “Reduction of system time to alert on SBAS”.  Inside GNSS, November-December 2023, pp 28-36

[10] https://ascend-horizon.eu/

[11] https://www.thalesaleniaspace.com/en/press-releases/thales-alenia-space-reveals-results-ascend-feasibility-study-space-data-centers-0

[12] G. Hager and G. Wellein, “Introduction to High Performance Computing for Scientists and Engineers”, CRC Press, 2011.

[13] P. Pacheco and M. Malensek, “An Introduction to Parallel Programming”, 2nd Edition, Morgan Kaufmann, 2021.

[14] J. Demmel, L. Grigori, M. F. Hoemmen, and J. Langou, “Communication-optimal parallel and sequential QR and LU factorizations”, SIAM Journal on Scientific Computing, Vol. 34, 1, pp. A206-A239, 2012, https://doi.org/10.1137/080731992

[15] Å. Björck, “Numerical Methods for Least Squares Problems”, 2nd Edition, SIAM, 2024.

[16] G. H. Golub and C. F. Van Loan, “Matrix Computations”, 4th Edition, Johns Hopkins University Press, 2013.

[17] M. F. Hoemmen, “Communication-avoiding Krylov subspace methods”, PhD thesis, University of California at Berkeley, 2010.

[18] E. Agullo, C. Coti, J. Dongarra, T. Hérault and J. Langou, “QR factorization of tall and skinny matrices in a grid computing environment,” 2010 IEEE International Symposium on Parallel & Distributed Processing (IPDPS), Atlanta, GA, USA, 2010, pp. 1-11,  https://doi.org/10.1109/IPDPS.2010.5470475.

[19] G. Ballard, J. Demmel, L. Grigori, M. Jacquelin, N. Knight, H.D. Nguyen, “Reconstructing Householder vectors from Tall-Skinny QR”, Journal of Parallel and Distributed Computing, Volume 85, pp. 3-31, 2015. https://doi.org/10.1016/j.jpdc.2015.06.003.

[20] J. Dongarra, L. Grigori and N. Higham, “Numerical algorithms for high-performance computational science”, Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences, 378(21666), 2020. https://doi.org/10.1098/rsta.2019.0066

[21] CS-25 – European Union Aviation Safety Agency Certification Specification for Large Aeroplanes.

[22] ED-12B/DO-178B – Software Considerations in Airborne Systems and Equipment Certification

[23] ED-109A/DO-278A Software Integrity Assurance Considerations for Communication, Navigation, Surveillance and Air Traffic Management (CNS/ATM) Systems

[24] ARP4754B – Guidelines for Development of Civil Aircraft and Systems

Authors

Sébastien Trilles is an expert in navigation algorithms and performances. He received his Ph.D. degree in Pure Mathematics from the Paul Sabatier University and an Advanced M.S.in Space Technology from ISAE-SUPAERO. He heads the Performance and Processing Department where high precise navigation algorithms are designed as orbitography, system reference time generation, clock synchronization and time transfer, integrity and ionosphere modeling.

Thierry Authié is a specialist in navigation algorithms at the Performance and Processing Department of Navigation Domain, Thales Alenia Space. He received his M.S in Applied Mathematics from the Institut National des Sciences Appliquées (INSA), Toulouse (France). He currently works as navigation specialist in Advanced Projects.

Xavier Vasseur is a specialist in scientific computing at the Performance and Processing Department of Navigation Domain, Thales Alenia Space. He received his M.Sc degree from Ecole Centrale de Nantes (France) and his Ph. D. degree in Computational Fluid Dynamics from University of Nantes.

Marie Abbal is safety manager of Advanced Projects in Navigation Domain. She received her M.Sc degree from Ecole des Mines de Paris. She worked from 2009 to 2016 at Electricité de France company (EDF), particularly in nuclear safety. She joined Thales Alenia Space in 2016 as a safety specialist in complex and critical space system

The post The Case for Spatializing Global SBAS appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

The system is embedded across critical civilian infrastructure as well, with approximately 90 percent of U.S. 911 call centers relying on Safran timing technology. On the defense side, the SecureSync supports applications ranging from GPS-disciplined synchronization in standard infrastructure to M-Code enabled timing for military operations requiring the highest levels of security and integrity — including the Sentinel A4 radar program, where M-Code SecureSync units were integrated to strengthen resilient PNT performance against jamming and spoofing threats. 

“Timing has been foundational to who we are since day one, and this milestone is a testament to the trust our customers have placed in SecureSync for nearly two decades,” said Trevor Dougherty, Vice President of Sales and Marketing at Safran Federal Systems. “In an environment where a fraction of a second can mean the difference between success and failure, we don’t just deliver precise time — we make it resilient.”

The announcement comes alongside continued development of next-generation timing capabilities. In April, Infleqtion announced availability of the first quantum-enabled precision timing solution developed in partnership with Safran Electronics and Defense, integrating Infleqtion’s Tiqker quantum optical clock with Safran’s White Rabbit and SecureSync systems. White Rabbit technology enables picosecond-level time distribution — approximately a thousand times more precise than nanosecond-class timing — positioning the SecureSync platform for the next tier of defense and infrastructure timing requirements as GPS-dependent architectures come under increasing pressure. 

The post Safran Federal Systems Delivers 50,000th SecureSync Timing System appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

The release enables integration of Iridium Satellite Time and Location signals directly into VectorNav’s INS architecture alongside inertial and GNSS data. In testing, STL-aided navigation demonstrated positioning performance within approximately 50 meters CEP in GNSS-denied conditions while maintaining continuous inertial position, velocity, and attitude outputs. The Iridium constellation’s 66 active satellites operate at roughly 780 kilometers — compared to approximately 20,000 kilometers for GPS — producing surface signals up to 1,000 times stronger than GPS, improving resistance to jamming, attenuation, and environmental obstruction.

The VN-210E provides four independent serial interfaces and a tightly coupled extended Kalman filter, allowing LEO-derived measurements to be incorporated alongside GNSS, M-Code, vision-based navigation, and other assured PNT inputs. The development kit includes the VN-210E, NAL Technologies’ ALTM Micro-D receiver, a one-year Iridium development license, and reference integration guidance and software tools.

“Inertial remains the foundation,” said Andrew Greer, Senior Director of Business Development at VectorNav. “LEO signals add another layer of resilience. By fusing multiple independent sources, we maintain a stable navigation solution when any single input is degraded or denied.”

Future development will focus on deeper hardware integration, reduced SWaP-C, and streamlined deployment for production programs.

The post VectorNav Adds Iridium STL Aiding to Inertial Navigation Systems in Collaboration with NAL Technologies appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

At the PNT Leadership Summit last September, Locata CEO Nunzio Gambale put a blunt question on the screen again and again: “What’s your replacement?”

He asked it over ports, offshore energy projects, precision agriculture systems and critical infrastructure sites operating in what his presentation called “red zones”—places where GNSS-dependent systems may fail, degrade or become unreliable because of jamming, spoofing or other forms of interference. Across those examples, the warning was the same: high-value civilian systems have been built around precision positioning, navigation and timing, but many still have no credible replacement when the signals they depend on are denied.

That argument has become progressively more difficult to dismiss.

Only months earlier, Gambale said, Ukraine’s June 1, 2025, Operation Spider Web demonstrated how low-cost, precisely coordinated stealth drone attacks could reach strategic targets far beyond the front lines. Ukraine said it used 117 drones, and the Council on Foreign Relations described the attack as evidence that low-cost precision strikes are becoming accessible to many state and non-state actors.

For Gambale, Operation Spider Web has forever changed the strategic logic of PNT. If the now ubiquitous drones can use satellite navigation to reach strategic assets, governments and operators defending those assets will have to increasingly jam, spoof or otherwise deny the signals those drones rely on. The result is a new kind of collateral damage: Civilian systems that depend on the same signals may be disrupted by the defensive measures intended to protect national infrastructure.

That was the September argument.

Since then, the jamming and spoofing environment has become more urgent, particularly around the Persian Gulf and the Strait of Hormuz. Meanwhile, in the Baltic area, Russian electronic warfare is already turning that risk into a live political and operational crisis. In May, Ukrainian officials said Russian electronic warfare had deliberately diverted Ukrainian drones into Latvian airspace, with repeated incursions culminating in explosions at an oil storage facility and contributing to the collapse of Latvia’s government. Inside GNSS+ reported that widespread GNSS interference in the Gulf and Strait of Hormuz region coincided with sharp disruption in commercial shipping, with maritime analytics providers documenting more than 1,100 vessels affected by GPS and AIS interference in a 24-hour period, including ships falsely positioned at airports, a nuclear power plant and on Iranian land.

That escalation makes Gambale’s question feel less like a conference provocation and more like an operational imperative.

The resulting challenge is more difficult than simply asking for a backup to GPS. For Gambale, that phrase is too vague to be useful. The real question is application-specific. 

“This isn’t simply about backing up GPS,” Gambale said. “The point of PNT is the outcome: What the application requires, and what can still deliver it when GPS is degraded, denied or no longer trusted.”

That is the core of his argument. The world did not adopt GNSS merely as a convenience; it built entire classes of infrastructure, automation and digital systems on top of it. Now the same signal dependency that enabled enormous economic value has also become a systemic vulnerability.

The Civilian Problem Has Changed 

For decades, GNSS interference was often framed as a military concern. Jamming and spoofing belonged to battlefields, contested borders and electronic warfare scenarios. Gambale believes that framing is “no longer even close to the reality.”

The drone era has changed the logic. If hostile drones use GNSS to navigate, then defending critical infrastructure absolutely demands the denial of that same signal locally. In other words, the jamming will not come only from the adversary; it will inevitably also come from the government or operator trying to protect its own critical assets.

“What’s the first thing you need to do for anti-drone systems?” Gambale said. “You need to jam the GPS, so that the enemy can’t use the same signal that you’re using. I can tell you categorically that in, say, the UAE, it’s not the U.S. or Israel or Iran that’s jamming Dubai or Abu Dhabi. It’s the UAE itself. We’ve heard credible reports that a GNSS jammer is now installed at the top of the Burj Khalifa. Think about that. It’s called ‘frequency fratricide’… and the Golden Dome, Drone Walls and many other national protection systems you see being built are now undeniable proof that ‘jam yourselves’ is the future.”

That creates what he sees as the new civilian crisis: The same denial zone meant to protect national strategic sites will inevitably disable the civilian systems built around satellite PNT.

“If you want to deny this magical capability to your enemy, you have to deny it to the areas around your critical infrastructure,” Gambale said. “However, you then jam the surveyors, you jam the harbor pilots bringing ships into port, you jam all of the autonomous systems, you jam the mobile phone technologies, you jam the timing for data centers, you jam the landing systems for aircraft. Uber Eats. Waymo. Google Maps.”

That argument is not merely a Locata argument. Gambale cites Doug Taggart, president of Overlook Systems Technologies and an ION Fellow, in the Spring 2026 ION Newsletter. Taggart argued that GPS now underpins transportation safety, economic activity, communication networks, precision agriculture and critical infrastructure, while the United States has spent more than 25 years struggling to identify a backup. Taggart’s conclusion was that resilient PNT capability should be understood as an inherently governmental responsibility, whether the physical systems are government-operated or commercially provided.

That framing shifts the debate from product or solution selection to public responsibility. The issue is not whether GPS remains essential. It does. The issue is whether critical systems can continue operating when GPS is unavailable, untrusted or locally denied.

The Port Test: What Happens When Precision Stops?

Gambale’s most concrete example, from Locata’s own experience in the jamming zones, is port automation. In his summit presentation, he used the Port of Gdańsk and major Baltic infrastructure projects to illustrate the new PNT reality. The point was not simply that ports use GNSS. It was that modern automation systems, such as in ports, logistics hubs, etc., all depend on very precise positioning—continuously and reliably.

The presentation described a $3 billion Port of Gdańsk expansion, with automation as a key part of Polish port infrastructure. It also described fully autonomous rubber-tired gantries—25 ordered, 26 meters high by 30 meters wide, $20 million each, using three RTK GNSS systems for autosteer and placement—with a requirement of less than 2 centimeters, 3 sigma, 24/7/365, without fail.

Large autonomous gantries and other automated systems do not need “some” positioning. They must have centimeter-level positioning, all day, every day. If the position solution degrades, the machine does not simply become less efficient. It stops dead.

“These machines are automated, and they’re stacking containers on top of one another autonomously, without any human in the loop,” Gambale said. “They must have two- to five-centimeter positioning, or else the entire system doesn’t work. This is not some academic argument. When an infrastructure site like Gdansk is jammed, the company literally owns $500 million dollars’ worth of ‘bricks.’ The company’s need for centimeter-level GNSS is dire. Jamming can cost millions per day. And that is a clear and existential threat to a business’ existence.”

He framed the problem in operational terms. A lower-accuracy backup may sound useful on a policy slide, but if it cannot support the application’s required precision, it does not solve the problem.

“If a ‘solution’ blows out past five centimeters, the machines must stop,” he said. “Something that gives you 2 meters of ‘GPS backup’ is of absolutely no use to that type of application.”

That distinction is central to his argument. The market does not need a generic conversation about backup. It needs a performance conversation: what accuracy, what timing, what integrity, what availability, what resilience under interference, and what happens when the system is spoofed?

If the answer does not meet the application requirements, then the infrastructure remains exposed, critically compromised and vulnerable.

Precision as Infrastructure

Gambale extends the same argument to offshore construction, surveying, logistics and warehousing sites, and precision agriculture. In each case, PNT is not a convenience layered onto the application. It is part of the operating system.

Gambale pointed out that view is strongly supported by ESA’s March 2024 NAVAC PNT Vision 2035 White Paper, produced under the guidance of NAVAC Chaiman, Luis Mayo. According to the report, more than 6.5 billion GNSS devices were already installed worldwide by 2021, with the installed base expected to grow to 10.6 billion by 2031. Also, according to the report, roughly 10% of EU GDP relies on GNSS to some degree, while consumer, IoT and automotive applications represent more than 90% of the market.

But the report’s most important point for Gambale’s thesis is not market size. It is dependency. NAVAC warns that as GNSS use spread across application domains, society built an increasingly deep dependence on these systems. The report identifies jamming, spoofing and interference as growing concerns, and specifically notes that accurate timing is the main critical use case for critical infrastructure.

That supports Gambale’s point: PNT is no longer a navigation feature. It is a dependency layer underneath automation, logistics, energy, telecom, finance, data centers, transportation and every nation’s digital economy and critical infrastructure.

The performance requirements for modern and emerging applications are also not abstract. Gambale points out that NAVAC’s 2035 requirements table points to centimeter-class horizontal and vertical accuracy requirements for many high-value applications: 2 to 15 cm for precision irrigation and cultivation, 4 to 6 cm for kinematic survey, and 10 cm for Level 3-and-above road autonomy and collision avoidance. For timing-dependent applications such as the coming 6G and DVB networks, the requirement moves from position into time, with NAVAC citing the need for 10-ns timing accuracy.

A backup that preserves rough continuity may be valuable for some applications. But it is not enough for a port that needs centimeters, a precision agriculture workflow that depends on corrected guidance, or a timing network that needs nanosecond-level synchronization.

In his PNT Leadership Summit presentation, Gambale cites Baltic offshore wind construction and a $5.1 billion Baltic Power project that is essential for Poland’s energy security and independence, including 76 Vestas 15 MW turbines. He also frames offshore construction requirements in hard operational terms: precision construction needs less than 5 centimeters at 3 sigma, 24/7/365, without fail; and ship dynamic position systems (which automatically maintains a vessel’s exact position and heading using its own propellers and thrusters) needs less than 10 centimeters at 3 sigma to work.

In agriculture, Gambale points out, interference does not need to jam an entire operating area to cause disruption. If today’s essential correction infrastructure is vulnerable, the precision layer then collapses.

“In the Ukraine, it’s now become even more trivial to jam a huge area of farmland,” he said. “You don’t have to try to jam the whole area. You just jam the local reference station, and that whole area is toast.”

That observation turns PNT into a food security issue, not simply a navigation issue. A tractor autosteer system, a surveyor, a road construction company, a port crane, an offshore construction vessel and a data center may appear to occupy different markets, but they all share the same dependency: high-confidence position and time.

Gambale’s message is that resilience must be judged against the actual application, not against a generic idea of signal continuity.

Do Not Deploy Your Grandfather’s GPS Backup

One of the strongest lines in Gambale’s presentation was: “Do not deploy your grandfather’s GPS backup.”

It is an intentionally provocative phrase, but the point is technical. Many valuable present-day applications—and most future applications—need high accuracy, high confidence and trusted timing. Systems that provide only low-accuracy continuity do have value for some uses, but they will not keep a modern autonomous port or logistics site, precision agriculture workflow, road construction site or high-value industrial operation running.

ESA’s NAVAC report reaches a similar conclusion from a different angle. It says future PNT will be delivered through a combination of alternative, independent and complementary sources: multiple GNSS in different orbits and frequencies, cellular networks, terrestrial systems such as eLoran, Wi-Fi and signals of opportunity, augmentation systems, inertial sensors, quantum sensors, magnetic sensors, miniature atomic clocks and digital maps. It also concludes that future systems will increasingly operate as “systems of systems” designed to meet the performance required for a given application.

That is very close to Gambale’s “what does your application need?” mantra. A technology is not useful because it belongs to a fashionable category. It is useful if it meets the required accuracy, timing, integrity and resilience for the mission.

And those requirements are getting more difficult, not easier.

NAVAC states that “accuracy is addictive,” that users will demand more robust solutions less susceptible to natural or man-made disruption, and that assured PNT demand will grow tenfold by 2035, including in physically challenging environments such as indoors, multi-story buildings, urban canyons and underground facilities.

That is why Gambale’s critique of low-performance complementary PNT is so sharp. “There is no point deploying technology that gets you three quarters of the way there, and the port is still stopped,” he said.

Positioning Depends on Timing

For Gambale, timing is the most underappreciated part of the PNT discussion. “PNT only exists because of the T,” he said.

That statement is more than a slogan. Positioning systems depend on timing. Digital infrastructure depends on timing. Telecom, financial systems, data centers, power grids, autonomous systems and distributed industrial operations all require trusted time at levels appropriate to their applications.

Taggart makes the same point in institutional terms. His ION Newsletter column notes that, through NIST, the Department of Commerce maintains the nation’s time and frequency standards, while NIST and the U.S. Naval Observatory provide official U.S. precise-time contributions to the Bureau International des Poids et Mesures, which calculates Coordinated Universal Time. He also notes that financial markets, telecommunications services, data networks, electric power grids, pipelines and SCADA services all depend on timing derived from GPS.

For Gambale, that dependency should drive a different standard of performance. He argues the industry too often talks about timing in terms of minimum standards rather than future capability.

“The world isn’t asking for worse timing,” he said. “As you get better and better timing, you get better and better positioning, and better and better digital capabilities. That’s why our Locata team has dedicated several decades of innovation to be able to deliver GNSS-free, sub-nanosecond synchronization and time transfer.”

He explains the issue in terms engineers understand: error budgets. Every system has a set of error sources—timing error, multipath, atmospheric effects, electronic variation, geometry, signal processing limits and more. If timing consumes too much of the error budget, there is less margin left for everything else.

“If the bucket is 75% full of timing error, that leaves them a lot less margin to play with,” Gambale said. “However, if we can reduce that timing error budget down to 10% of the bucket, then they’ve got a lot more leeway with the rest of the error budget.”

That is why he sees timing as a foundation, not a feature. Better timing does not merely improve clocks. It improves the ability to position, synchronize, automate and trust distributed systems.

NAVAC also emphasizes timing. The report states that accurate timing is the critical use case for communications and power distribution networks, and it identifies distributed and networked time-scale infrastructures as an important path toward resilient timing applications independent from GNSS.

Multipath, Trust and the Devil in the Real World

Gambale is equally forceful about multipath, explaining why Locata has spent years creating new technology to mitigate this obstacle. In terrestrial and obstructed environments, reflected signals can become one of the dominant sources of error. It is not enough to say a transmitter is nearby or a signal is stronger. The system must manage reflections, geometry and line-of-sight integrity.

“Multipath is the devil,” he said. “It is everywhere, and unless you deal with it, you will never be able to give an accurate position that’s reliable.”

This is where the conversation then turns from availability to trust.

Jamming denies. Spoofing deceives. Multipath corrupts. Each poses a different challenge. A receiver that produces an answer is not necessarily producing a trustworthy answer. In heavily automated systems, that distinction can become dangerous.

Gambale argues that users have become conditioned to trust the box. The receiver gives a position, and the system accepts it. That worked in an era when GNSS was generally available and interference was occasional. It becomes much more fragile in an environment of persistent jamming and spoofing.

“It’s all about trust,” Gambale said. “Even if GPS comes back, many huge companies no longer want to depend on it, because it is no longer trustworthy.”

That may be the most important transition in the PNT debate. Availability asks whether the signal exists. Trust asks whether the system should act on it.

From AIR to Sovereignty

In the summit presentation, Gambale framed the future of complementary PNT around three validated attributes: Accuracy, Integrity and Resilience—AIR.

Accuracy means the system can meet the application’s actual performance requirement. Integrity means the user can trust the answer, especially in safety-of-life or mission-critical applications. Resilience means the system continues to function—or recovers predictably—under real-world stress. Gambale stated: “Without AIR your application will die!”

Gambale has since added a fourth concept: sovereignty.

For him, sovereignty does not only mean national ownership in a political sense. It means control. Control over the PNT layer that critical systems depend on. Control over the ability to deploy, operate and trust the infrastructure required for the mission. Control over the destiny of an organization, business or site.

Gambale returns repeatedly to the idea that nations and critical infrastructure operators must stop thinking of PNT as an invisible utility that simply arrives from somewhere else. They must treat it as critical infrastructure. Lifeblood for their business.

“Electricity is wonderful,” he said. “It is distributed everywhere. But show me one critical infrastructure site that doesn’t have backup batteries or a generator.”

The analogy is simple and powerful. Critical sites rely on the grid, but they do not trust the grid alone. They build backup capability because the consequences of failure are too severe. Gambale believes PNT now requires the same mindset.

The Spectrum Sandbox

His policy prescription is equally direct: create a terrestrial PNT spectrum framework.

“The best thing that America can do to push real PNT resilience forward is to allocate a terrestrial spectrum for the job,” he said. “Give it a slice of spectrum that everybody can play in, if they wish.”

For Gambale, this would create a sandbox for innovation. Satellite systems have protected spectrum. Terrestrial PNT, if it is to become a serious resilience layer, needs a comparable policy foundation. Within that framework, industry, universities and government could build and test systems designed for specific application requirements.

“Allocate spectrum just like the satellites have got spectrum,” he said. “Allocate a terrestrial capability where you can determine what’s required for each application in an area. But give us the sandbox. Then let 1,000 innovations bloom, as was the case in the early days of GPS.”

That argument moves the discussion beyond individual products. It treats PNT resilience as an ecosystem problem. If the United States—or any sovereign nation—wants local, high-confidence PNT capability, then the nation must create the conditions for such systems to exist.

It also fits the broader direction of PNT architecture. NAVAC’s 2035 vision does not imagine one replacement for GNSS. It imagines combinations of systems: space-based, terrestrial, cellular, augmentation-based and sensor-based. It also warns that alternative systems must avoid hidden dependencies on GNSS itself, such as using GNSS as the time reference for supposedly independent ground networks, or as an essential reinitialization of an IMU system.

That warning is central to the Gambale thesis. A backup that depends on the system it is backing up is not a true replacement. A resilience layer that fails under the same conditions as GNSS may add complexity without adding survivability.

Gambale sees the spectrum sandbox as a chance not merely to protect infrastructure, but to create the next exportable PNT architecture.

“If America does it first, and you have all of your bright minds, and the universities, Silicon Valley, and everyone throws some real effort at it, you can do exactly what you do with GPS,” he said. “You can export it all over the world again.”

Then came the line he delivered with a laugh, but not entirely as a joke:

“Make PNT great again.”

The phrase works because the argument underneath it is serious. GPS was one of the United States’ greatest contributions to the modern world. It enabled entire industries. It created enormous civilian and commercial value. But the dependence it enabled has also become a 21st-century infrastructure vulnerability.

As Gambale put it: “The U.S. nation in the 1990s gave the world one of the greatest gifts of all time. That gift has now created one of the biggest problems for the 21st century. That problem must be solved. And Locata has created exceptional new high-accuracy technology that does not depend on GNSS at all. It delivers a level of control and sovereignty that will certainly be part of the ‘future of PNT.’”

For ports, farms, offshore energy projects, logistics hubs, construction sites, autonomous systems and critical infrastructure operators, the need for a solution—for AIR, for control and for sovereignty—is no longer theoretical. The jamming and spoofing environment is real and escalating. The performance requirements are not abstract. And the dependency on a signal that was never designed to carry this much weight is not going away on its own.

That is the state of play. 

The post The New PNT Reality appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.