SÉBASTIEN TRILLES, ODILE MALIET, JULIE ANTIC, KIN MIMOUNI, THALES ALENIA SPACE, FRANCE

In a broad sense, the notion of integrity refers to the level of confidence one can have in data obtained from a calculation result. In positioning systems, integrity is a measure of the trustworthiness a user can place in a position estimate. Geolocation would be perfect if measurements were error-free, but this is never the case as all device measurements inherently contain errors and noise. Hence, a discrepancy between the calculated position and the true (but unknown) one always exists. As errors and noise contains stochastic part, integrity is fundamentally grounded in probabilistic theory.

Mathematically expressed, integrity is equivalent to assigning a probability of the estimate being outside a defined confidence interval (protection level). The integrity of a positioning system is compromised when anomalies occur, leading to unexpected positioning errors beyond the operational protection level. These anomalies could persist for more than a few seconds within a specific time interval (T). In such cases, the integrity risk (IR) is defined as the probability the true position remains outside the protection level for a duration exceeding T.

For instance, in precision approach operations in aviation, the Standards And Recommended Practices (SARPs) set the IR at 2×10^-7 per approach (150s) and the specific time interval to T=6s. The computation of Protection Level (PL) consists of scaling position error variance to the integrity requirement using K-factors. The K-factors are derived from statistical laws and are critical for ensuring the system’s integrity in various operational conditions, taking into account the errors’ time-correlation [9] [10].

In practical applications, positioning is accomplished using measurements with well-known residual error structure and statistical distributions. Position and time errors are determined by linearly combining the residual errors of the measurements. The process starts with the GNSS navigation solution involving the estimation of a position-time correction x as a solution to the measurement equations linearized around a given position-time priori: WGx=Wb+ε, where G is a m×4 matrix with m the number of line of sight, ε is the measurement noises vector, W is a weight matrix and b is the residual measurements vector. The noises ε are assumed to follow a Normal centered law.

The so called design matrix G is defined as the matrix of partial derivatives of the measurement equations with respect to the parameters of position and time. The partial derivative of the pseudo range with respect to the position correction is obtained from the partial derivatives of the geometric distance D=||X^s-X_r || between satellite position X^s and (unknown) receiver position X_r. Re-writing the geometric distance as D=u_r^s∙(X^s-X_r), the partial derivative of with respect to the positions is the unit vector of the line of sight–u_r^s from receiver to satellite.

The weights per line of sight are built using different model variances related to various contributor to measurement errors: residual system errors (orbit and clock), propagation errors (ionosphere and troposphere), and local errors (multipath, thermal noise and interference). The maximum likelihood method provides the estimate =Sb, where S=(G^t W G)^-1G^t W is the 4×m sensitivity matrix expressed in the east (E), north (N), up (U) local frame and time.

The estimation positioning error e is given by 

The first three row components of S, respectively s_E,i, s_N,i and s_U,i correspond to the partial derivatives of position errors with respect to the east, north and up directions in relation to the measurement errors of the i-th satellite. The sensitivity matrix linearly projects the unmodeled residual measurement errors ε_i in a given direction.

For east direction:

for north:

and for up:

This process establishes a straightforward mathematical transfer that enables the projection of residual errors from the measurement domain to the position domain. Focusing on measurement domain, we seek sufficient properties regarding measurement errors distribution that ensure integrity in the domain of positions. These properties define integrity at the measurement level. If these properties are respected, integrity in the domain of positions is ensured, referred to as the transfer of integrity from the measurement domain to the position domain.

This article provides a comprehensive overview of the various concepts related to CDF overbounding. It aims to articulate each concept within a common framework, delineate their ranges and limitations, and ultimately present a methodology for creating protection volumes that reliably contain positioning errors with a high level of confidence.

MOPS Integrity Concept 

Initially, integrity concept was developed for aeronautical users and standardized by the Minimum Operational Performance Standards (MOPS) document [1] and is defined at position level. This standard deals with integrity parameters broadcasted by SBAS regarding ionosphere, orbit and clock corrections. In this aspect, MOPS considers the individual measurement error contributors as independent, making it possible to sum up all model variances in unique one σ_i² per line of sight. The weight matrix is defined as diagonal W=diag(w₁,…,w_m) where w_i=1⁄σ_i²).

Therefore, the measurement errors are assumed of white noise type, so their distributions have a zero expectation E[ε]=0, which implies the expectation of the identification error is also zero: E[e]=SE[ε]=0.

The covariance of the error is: cov(e)=E[(e-E[e]) (e-E[e])^t]=E[ee^t]SE[εε^t] S^t=Scov(ε)S^t. Therefore, the minimum covariance is reached by taking cov(ε)=W^-1, thus cov(e)=SW^-1S^t=(G^t WG)^-1. This refers to a four-dimensional symmetric positive-definite matrix whose are linear combinations of the measurement variances, as for instance:

The positioning error structure is then separated into horizontal errors e_H and vertical errors e_U, which amounts to considering the following extracted submatrices:

The MOPS specify the integrity risk IR as the maximum allowable probability for the navigation position error to exceed the alarm limit without the system alerting the user within the alert time. In the case of a standardized Normal distribution, such as N(0,1), the K-factor depends on the risk IR:

By making the change of variables t=√2u in Equation 2, we obtain an expression that depends on the complementary error function erfc:

and after inversion in Equation 3, we get the expression of the usual Gaussian K-factor:

Application to protection volumes: The MOPS standard define the vertical protection volume as:

Where the K-factor inflates the standard deviation d_U at a level compatible with integrity requirements. Because a linear combination of Gaussian-distributed vector is Gaussian-distributed, the residual position errors follow a Normal law. If Φ_eU denotes the cumulative distribution function (CDF) of this Normal law, defined by Φ_eU(x)=P(e_U≤x), we then have:

Equation 6 indicates that the absolute value of the error e_U is bounded by the confidence interval VPL defined in Equation 5 at the probability (1-IR).

The integrity MOPS concept does not mention any overbounding approach. It does not provide information regarding the shape of empirical residual errors distribution. It only mentions [1] the necessity from SBAS to broadcast two parameters, the first one being the variance of Normal distributions associated with the user differential range error for a satellite after application of corrections, and the second one associated with residual ionosphere vertical error at an ionospheric grid point for an L1 signal. The term “associated” as used by MOPS leaves room for several possible interpretations.

In fact, these definitions may give the impression that these Normal distributions represent the actual errors distribution. This interpretation has already been mentioned by several authors [5]. As a consequence, based on the stability of independent Normal distributions through linear combination, the position errors distribution is also represented by a Normal distribution. Unfortunately, the actual range errors are generally not Normal, especially in the tails.

In that context, it could be tempting to check integrity at the pseudorange level by making sure that, for all lines of sight i, the Normal distribution with standard deviation σ_i is conservative at the quantile equals to the integrity risk IR:

Non-intuitively, this naïve approach is not correct in general conditions. Annex A3 in [1] shows a toy example that satisfies Equation 7 for all lines of sight, and yet is not compliant with the integrity risk IR on position. This example clearly shows integrity transfer from range to position is not obvious and explains the emergence of overbounding concepts. 

CDF-Overbounding 

The CDF-overbounding concept has been introduced by [2] in the field of aeronautical users. The main idea is to overbound the empirical measurement error distribution, in the field of CDF, by a simpler one allowing to better control the integrity risk mainly in the tails, in the absence of faults. An overbound can be viewed as a statistic distribution that is a regular envelope of the empirical distribution. It is interesting to note the mathematical results presented in [2] were already known to the statistic community [14].

In the following, the CDF of a random variable X is denoted by F_X. According to [2], the random variable O_X is a CDF-overbound of the random variable X, and we note XO_X, if

The binary relationship (8) defines a partial order on the set of distributions. Indeed, the CDF-overbound relation is:

• Reflexive: XX
(every element is related to itself)

• Transitive: if XY and YZ then XZ
(the order is maintained through the chain)

• Antisymmetric: if XY and
YX then X=Y (two elements can’t mutually precede each other; they are considered equal)

Three graphical representations of CDF-overbounding are provided in Figure 1 for a Gaussian overbound with standard deviation equals to 0.7. The green area represents the domain for the CDF (respectively folded CDF and QQ plot) of X, that satisfies the CDF-overbounding of X by O_X. On the left, the CDF of the overbound O_X is represented in black. This representation is a direct illustration of the definition. The representation in the middle is based on the folded CDF that equals the CDF before the median and the survival function (1-CDF) after the median. This representation is handy to inspect the overbounding on the left and right tails thanks to the log-scale. The representation on the left is based on the Quantile-Quantile (QQ) plot for X and O_X. It permits inspecting both the core and the tails of the distribution.

Introducing the overbounding concept allows the following result: 

Theorem 1: If X and Y are two centered symmetric and unimodal distributions, and O_X and O_Y their respective overbounds are also symmetric and unimodal. Then for all α, β in , the linear combination αX+βY is CDF-overbounded by αO_X+βO_Y. In short, the overbounding property is stable by linear combination:

If the distribution of each residual measurement error is symmetric, unimodal and can be overbounded by a distribution that is also symmetric and unimodal, then the positioning errors are also overbounded by a known symmetric and unimodal distribution. Under this assumption, integrity in the pseudorange domain implies integrity in the position domain.

Proof:

Proof of stability by addition:

The proof is established in two steps. The first step is to prove that if 

The second step is a direct application of the previous statement: if

The sum of two independent symmetric and unimodal variables is itself symmetric and unimodal. The proof is detailed in the Appendix (see online version). This shows all the considered distributions have the right properties to be compared by CDF-overbounding.

Applying the definition of CDF-overbounding, proving (1) comes down to establishing that:

Let us fix z and compute F_X+OY(z)–F_X+Y(z) using the formula for the CDF of the sum of two independent random variables (the derivation of the formula is recalled in the Appendix):

We now split the integral of Equation 10 into two parts and make the change of variable x to -x for the negative part:

Recalling that by requirement of the CDF-overbounding both Y and O_Y distributions are symmetrical, which means F_Y(-x)=1-F_Y(x) and thus F_OY(-x)-F_Y(-x)=F_Y(x)-F_OY(x). Equation 11 becomes:

By definition of 

the right parenthesis of the integrand in Equation 12 is positive for all x. Because X is unimodal and symmetric by assumption, its PDF f_X peaks at f_X(0) and is decreasing on the positive and negative sides. Thus, the unimodality and symmetry implies that, for all x₁ and x₂, if |x₁|≤|x₂| then f_X(x₁)≥f_X(x₂). 

In our case of interest, if z is negative, we have for all positive x, |z+x|≤|z-x| and so f_X(z+x)≥ f_X(z-x), which means the left parenthesis of the previous integrand is also positive. We can deduce that

which is precisely the statement (A). On the other hand, if z is positive, |z+x|≥ |z-x| and so f_X(z+x)≤f_X(z-x) meaning that the integrand is negative and so

This proves (B) completing the proof that, if 

and the distributions X, Y, O_Y are symmetric unimodal, then

By applying the same reasoning, we get that if

and the distributions X, O_X, O_Y are symmetric unimodal, then

This finishes the proof of stability of CDF-overbounding by addition.

Proof of stability by multiplication by a scalar: for all real α,

Let X, O_X be two symmetric, unimodal random variables such that

First of all, αX and αO_X are also symmetric and unimodal. By symmetry of X and O_X, we can restrict ourselves to the case where α is strictly positive. According to the equality F_αX(x)=F_X(x⁄α) and similarly for O_X so the inequalities defining XO_X directly translate to αXαO_X.

Application to protection volumes: If X is the distribution of the residual error (symmetric and unimodal by assumption), then a CDF-overbound O_X allows us to put a lower bound on the probability of the error to be in a certain interval containing 0. More specifically, for a negative a and positive b, we have: . 

Usually, protection volumes are chosen to be symmetric, and thus for positive a,

and so any protection volume computed with the overbounding distribution is a conservative protection volume for the original distribution.

In practice, O_X is a Gaussian distribution, chosen for its stability by linear combinations. If in the total error

each error component ε_i is CDF-overbounded by a Gaussian distribution with standard deviation σ_i, then the total error e is CDF-overbounded by a Gaussian of standard deviation

Thus, the usual formula for the protection . Thus, the usual formula for the protection level can be used, with

Case of distributions with bias: The CDF-overbound theorem requires the distributions of error components to be centered. However, the absence of bias in residual measurement errors is never perfectly satisfied because of systematic errors due to troposphere, multipath inter-channel bias, etc.

These errors along the lines of sight are therefore composed of a random part, a noise ε_i with zero mean, plus an additional bias μ_i. If these biases were known, they would be integrated into the SBAS corrections, but this is not the case. However, we will assume we know a bound on their absolute values.

The absolute value of the position error along one coordinate is then given by:

We can build the protection volume that covers the suffered errors as follows:

where the factor K is computed according to the error distribution. In the Gaussian case, the multiplicative factor K is calculated using the inverse of the complementary function K=√2erfc^-1(IR).

The question of introducing biases as a multiplicative factor of the protection volume calculated with the classic formulation arises. To do this, we introduce the following calculation:

Here, the quantities

We then find the desired multiplicative factor:

This multiplicative factor ξ makes it possible to inflate the classic volumes of protections (expressed without bias) so as to encompass these residual biases:

This approach allows us to state the following result:

Theorem 1bis: If the distribution of each of the residual measurement errors is symmetric around its median, unimodal and can be overbounded by a Gaussian distribution with the same median (i.e. the mean of the Gaussian is equal to the median of the residual error distribution), then the protection level for the position error can be computed with the usual formula, provided we inflate the K-factor by the multiplicative factor ξ. Under these assumptions, integrity in the pseudorange domain imply integrity in the position domain.

The definition of coverage relative to a median is given by:

The concept of CDF-overbound requires the tails of the overbound cover the tails of the empirical distribution. In the case of a Gaussian overbound, we know the tails of the Gaussian distributions are very light and we will end up finding a quantile (even if it is very large) beyond which the tail of the Gaussian passes below the tail of the empirical distribution. This is why we set in practice a quantile q, beyond the specified integrity risk q>F^-1(IR⁄2N), within which, on the interval [-q,q], the overbound property is verified.

Paired Overbounding 

This concept was introduced in [3,4] to relax the strong assumptions of CDF-overbounding, namely that the distributions of the residual error components are centered, unimodal and symmetric.

Definition: The random variables L_X and R_X are a paired overbound of the random variable X, and we note X ⊆ [L_X, R_X] if 

The random variable L_X is said to be the left overbound and R_X is said to be the right overbound of the random variable X. Figure 2 displays three representations of paired overbounding by two Gaussian distributions with standard deviation 0.7 and bias equals to -/+ 0.3, adopting the same conventions as in Figure 1. 

Theorem 2a: For independent random variables X,Y, if X ⊆ [L_X,R_X] and Y ⊆ [L_Y,R_Y] then X+Y ⊆ [L_X+L_Y,R_X+R_Y]. In other words, the pair overbounding concept is stable by convolution. A priori the random variables X,Y and their overbounding pair are arbitrary; no particular assumption is necessary to demonstrate stability by convolution, which is the strength of the concept.

Proof:

We have, using the definition of the left-overbounding:

And so ∀z ε,F_X+Y(z)≤F_X+LY(z). Repeating the same argument:

Combining the two inequalities of Equations 25 and 26, we get: 

The proof of the inverse inequality is established in a similar way without difficulties. 

Theorem 2b: If X⊆[L_X,R_X], then for a positive real α we have αX⊆[αL_X,αR_X]. However, for a negative real α, we have αX⊆[αR_X,αL_X]. If we further require that the over-bounding pair is symmetric, meaning that L_X=-R_X, we can write the result as follows: for all α, if X⊆[-R_X,R_X], then αX⊆[–|α|R_X,|α|R_X].

Proof:

We have for positive α:

On the other hand, for a negative α, we have:

These theorems show the stability of linear combinations is satisfied with any pair of overbounds (possibility asymmetric or multi-modal) but only with positive coefficients. Unfortunately, this property is not sufficient to guarantee the integrity transfer from range to positioning domain (because the geometry coefficients are signed). The following Theorem permits to guarantee the stability of any linear combinations (with positive or negative coefficients) by adding a condition on the pair of overbounds that is L_X=–R_X.

Theorem 2c: If X⊆[–R_X,R_X] and Y⊆
[–R_Y,R_Y] then ∀(α,β)∈², αX+βY⊆
[–|α|R_X–|β|R_Y,|α|R_X+|β|R_Y]. If the distribution of each of the residual measurement errors is paired-overbounded by a symmetric pair, then the position errors are also paired-overbounded by a known pair. Under these conditions, integrity in the pseudorange domain imply integrity in the position domain.

This approach is useful for taking residual biases into acount. Consider a given line of sight and a contributor X to the residual errors on this line of sight. This contributor presents a residual bias for which a known bound is μ.

We construct a bounding of distribution X by two Normal laws with standard deviation σ, the left bound biased by -μ and the right bound biased by +μ, which form a symmetric pair:

If we collect all the lines of sight and each contributor to the measurement errors paired-overbounded, then the convolution property implies that the position error is also a paired-overbounded distribution with a variance and a bias given respectively by

The limiting aspect is the search for left and right bounds can bring conservatism in practice, knowing these boundaries must frame the entire empirical distribution.

Application to protection volumes: The pair overbounding X⊆[L_X,R_X] allows us to put a lower bound on the probability to be in a certain interval: for any a,b with a<b, we have:

In the case of an overbounding pair by two Gaussians of mean ±μ and variance σ², we have for a symmetric protection level:

and so the integrity condition P(X∈
[-PL,PL])≥1-IR can be ensured for

If in the total error 

 each error component ε_i is pair-overbounded by two Gaussian distribution with standard deviation σ_i and mean ±μ, then by the stability by linear combinations, the total error e is pair-overbounded by two Gaussians of standard deviation σ= and mean μ=. Thus, the formula for the protection level is identical to the formula in the previous section, but with different hypothesis on the original distributions. 

Core-Tail Overbounding 

In general, the empirical distribution of interest is obtained by collecting large volumes of data. This is sufficient to accurately represent the core of the distribution but there is always a point where the tail remains unknown because the collected samples are always finite. Therefore, how can we ensure the constructed overbounding distribution remains correct for the entire underlying distribution?

Furthermore, if the tail of the underlying distribution is known analytically or with good numerical precision, the overbounding theorems presented impose a condition on the entire distribution. When using Gaussian overbounds, which have very light tails, this can lead to excessive conservatism, for example to absorb some mass far in the tail, or can be mathematically impossible if the analytic expression of the underlying distribution falls slower than a Gaussian.

The strategy presented by [6] is a mean to deal with these two problems. It divides the cumulative distribution function F_OX of the overbound distribution into two parts: an explicit core and an implicit tail. The overbounding distribution is a mixture of both, and the value this function takes at a point is equal to the sum of the core cumulative distribution function F_OX,c and the tail cumulative distribution function F_OX,t, weighted by the probability P_t that the point is in the core or the tail:

The core distribution is explicit, meaning it can be expressed analytically and calculations performed. Most often, it is a Gaussian distribution. As for the tail, which poses the most problems, it is left completely arbitrary: We know it exists, but we do not wish to perform calculations with it. Instead, we will always consider the worst possible tail for the chosen application to constrain the maximum impact of the unknown tail.

This approach is valid for both CDF-overbounding and paired overbounding. The benefit of this decomposition is to be able to focus on the core overbound, while ensuring the unknown tail of X is defined such that F_OX(x) (defined by Equation 34) is an overbound of X, with the following approach of F_OX,t as a pseudo CDF:

Intuitively, inequality (24) means the worst tail for the CDF-overbounding is a probability weight of 1⁄2 localized at both infinities, whereas the worst tail for a left-overbound is to have all probability concentrated at minus infinity (plus infinity for the right overbound). Formally, the resulting overbounding function F_OX(x) is not a CDF (because its total weight is not 1) but as in the excess mass concept, all properties of the corresponding overbounding function remain unchanged.

In practice, a CDF-overbound in the core-tail overbounding concept consists of a (symmetric unimodal) function F_OX,c and a tail weight P_t such that F_OX=(1-P_t) F_OX,c+P_t⁄2 (because for CDF-overbounding the tail CDF is always chosen as a constant of value 1⁄2) is a CDF-overbound of the distribution of interest X. In other words, we need F_OX,c and P_t such XO_X. For pair-overbounding, the left and right bounds are split into core and tail. We need a left and right core overbounding distribution F_LX,c and F_RX,c and a tail weight P_t such that:

Graphical representations of core-tail overbounding is illustrated with P_t equals to 5×10^-2 in Figure 3 for CDF-overbounding by a Gaussian with standard deviation 0.7, and Figure 4 for paired overbounding by two Gaussian with biais +/- 0.3 and standard deviation 0.7. The green area represents the domain that satisfies the overbounding of X by O_X.

Note the core-tail overbounding is a weaker condition than the original overbounding condition, in the sense that any overbounding distribution (CDF or paired) can be seen as the core overbounding distribution with a tail weight P_t, whatever the value of P_t. The downside is the resulting protection volumes will be more conservative for larger tail weight, and can be undefined if the integrity risk is lower than the tail weight. This phenomenon allows for the following result as part of this new paradigm.

Theorem 4: Let X and Y be two random variables that admits a CDF-overbound (central or paired) that can be decomposed into a core part and a tail part with weight P_t,X and P_t,Y. Then the linear combination αX+βY admits a corresponding overbound with the core given by the theorem 1 or 2c, and with core weight (1-P_t,X)×(1-P_t,Y). Under these conditions, integrity in the pseudorange domain imply integrity in the position domain.

Proof:

We will first consider the framework of the central CDF-overbound and the overbounding of X+Y. Theorem 1 (stability by convolution) gives us X+Y is overbounded by O_X+O_Y (the core-tail overbound remains a centered symmetric and unimodal distributions):

We then inject into inequality (26) the decomposition of the overbounds of the random variables X and Y into core and tail.

By expanding expression (38), we get

On the other hand, the cumulative distribution function of the overbound of the sum is decomposed into core and tail parts:

By identification with Equations 38 and 39 we find that:

1-P_O,t=(1-P_t,X)(1-P_t,Y), which gives the weight of the core,

F_OX+O_Y,c=F_OX,c*f_OY,c, so the core of the sum is the convolution of the cores of each distribution,

The rest of the expression is considered as the tail and its explicit expression is not needed.

The last step is to prove by replacing the implicit tail part by the constant 1⁄2, we still have a CDF-overbounding of the sum. For x≤0, the three terms F_OX,t*f_OY,c(x), F_OX,c*f_OY,t (x), F_OX,t*f_OY,t (x) are smaller than 1⁄2 because each one is a symmetric CDF. Thus, for negative x, F_OX*f_OY(x)≤(1-P_O,t)×F_OX+O_Y,c+P_O,t⁄2. On the positive side, the equations are reversed, and we get a CDF-overbound of the sum by considering only the core part of the two distributions. We can replace the tail part by its generic value.

The multiplication by a scalar is treated as in Theorem 1 and does not change the weight of the core or tail. 

In the pair overbounding case, the resulting pair is symmetric if the core overbounding pair is symmetric, so formula of theorem 2c holds as long as each individual overbounding pair has the same core and tail weights for the left and right overbounding pair. The proof is very similar to the CDF-overbounding case.

The core-tail overbounding concepts allows us to manipulate a weaker form of CDF or paired-overbounding. It is weaker because the inequalities are not required on the entire CDF but only on the core part. The properties of stability by linear combination of the CDF and paired-overbounding are maintained but at the price of a small “contamination” of the tail for each added term. For each addition, the tail weight grows. An upper bound on the weight of the tail can easily be derived as follows: In the case where all weights are equal with tail weight P_t, we have P_O,t=1-(1-P_t )²<2P_t, and by recurrence on n sources of errors, we have P_O,t<nP_t.

Application to protection volumes: The protection volume formulas are identical to the CDF or paired-overbounding cases, with the replacement of the overbounding distribution by the core plus tail part. If we are working with Gaussian distributions, the properties of stability by linear combination allows us to use the same formulas by changing only the value of the K-factor, which now depends on the weight of the tail distribution. The compatible quantile K of a given integrity risk IR in the position domain is calculated by considering the CDF of the overbounding function and inverting it. The Gaussian K-factor changes for the CDF-overbound to:

For a protection volume to be calculable with the K-factor, it is necessary that IR-P_O,t>0 and thus that P_O,t<IR. Otherwise, the knowledge of the core distribution is not sufficient to build a suitable protection volume and the protection level goes to infinity, and gives no information in practice.

For the paired CDF-overbound the K-factor changes to:

Note the weight of the tail depends on the number of error contributors. If each error has an overbound tail weight P_t<<1, then the full error overbound has tail weight nP_t. This means the density of the tail distribution of each measurement error must be at least n times lower than the selected integrity risk for the position domain. In case this condition is not met, the protection volume is undefined (infinite) because the knowledge of the core distribution is not sufficient to guarantee a protection level at the given integrity risk.

If we have P_t<<IR, then we can use the usual K-factor formula (4).

The notion of core-tail overbounding is very important theoretically because it justifies the use of overbounding methods when the tail is not fully known, and it justifies the use of Gaussian overbounding even when the tail is heavier than a Gaussian. However, in practice, such conditions on P_t (P_t<IR⁄n or P_t<<IR) are challenging to verify because IR is already very low (usually about 10^-7). This requires a fine knowledge of the error distribution to go far in the tail, which means a large experimental sample of values that is quite difficult to achieve. Thus, the core-tail overbounding technique is rarely used, and the assumption that the overbounding is valid up to infinity is often made. 

Excess Mass for Paired Overbounding 

In practice, constructing pairs of overbounds can artificially increase biases or variances on each of the overbounds to correctly bound the empirical distribution function. While this operation is often necessary, it inevitably leads to conservatism and larger protection levels than needed.

The left bounding distribution must have a heavier tail on the left (on the negative side) than the original error distribution, while at the same time have a lighter tail on the right. Because Gaussian distributions are often used for overbounding, this double condition is difficult to achieve and is often met at the price of very large biases. This specific problem with the pair overbounding technique can be partially resolved by the concept of excess mass overbounding [5] (excess mass CDF method), which considers a distribution mass greater than 1, typically 1+ ε where ε is referred as excess mass.

With such mass, the pseudo CDF is allowed to pass either beyond +1 or below -1. With this flexibility, we only need to ensure the properties of the overbound on one side of the empirical distribution, knowing the other side is no longer constrained. For Gaussian pair-overbounds, this adds a third degree of freedom to the variance and the bias.

Formally, we consider f, a pseudo-PDF that is positive and integrable, but we do not impose that its total probability weight is 1. Instead, we allow a total mass 1+ε larger than one (Equation 43).

The associated left pseudo-CDF is defined as F_L(x)=(1+ε)×F~_L(x), where F~_L is a regular CDF with total weight equal to 1. This means F_L(x) tends to 0 as the variable x approaches negative infinity as a regular CDF, but tends to 1+ε as x approaches infinity, relaxing the overbounding constraint by the left overbounding on the right.

For the right overbound F_R(x), the excess mass is applied on the survival function: 1–F_R(x)=(1+ε)×(1–F~_R(x)), where F~_R(x) is a regular CDF, which leads to F_R(x)=(1+ε)×F~_R(x)-ε. Consequently, the right pseudo-CDF goes to 1 as x approaches infinity like a regular CDF but tends to a negative value when x goes to negative infinity.

With this definition, the concept of pairs of overbounds can be expressed in the same terms and exhibits the same properties, particularly the stability under convolution (the proof can be reproduced identically as it uses only the positivity of the PDF), noting the mass of the sum of random variables is the product of the masses of each variable. Specifically, if the variables X and Y have respectively masses 1+ε_X and 1+ε_Y, then the sum X+Y has a mass of (1+ε_X)×(1+ε_Y). 

Definition: L_X and R_X associated to the pseudo-PDF f_L and f_R define a paired overbound with excess mass ε of the random variable X, and we note X⊆[L_X,R_X] if 

where F_L(x) and F~_R(x) are regular CDF (with total probability weight equal to 1).

Theorem 3: If X and Y are paired-overbounded with excess mass by a symmetric pair then the linear combinations are also paired-overbounded by a known formula. If X⊆[–R_X,R_X] and Y⊆[–R_Y,R_Y] then ∀(α,β)∈², αX+βY ⊆[–|α|R_X–|β|R_Y,|α|R_X+|β|R_Y]. (Here –R_X is defined as having the pseudo-PDF f_R(-x) and the sum and multiplication by a scalar are defined as for regular random variables). The total mass of the overbounding of the linear combination is (1+ε_X)×(1+ε_Y). Under these conditions, integrity in the pseudorange domain imply integrity in the position domain.

The proof is the same as the equivalent proof for paired-overbounding. With each addition, the total weight of the excess mass overbounding pair grows as it is the product of all masses involved.

Figure 5 illustrates paired overbounding with excess mass ε equals to 2.5×10^–2. The overbounds are two Gaussian with bias –/+ 0.3 and standard deviation 0.7 and the green area represents the domain that satisfies the overbounding of X by L_X on the left and R_X on the right. The QQ plot representation is not applicable to excess mass because the overbounds has total weight greater than 1. The allowed green zone is much larger with excess mass than in Figure 2, making the condition easier to verify.

Application to protection volumes: In the case of overbounding by Gaussian pseudo–PDFs, all the convenient addition properties of the Gaussian-distributed vector are maintained. All the formulas derived for the protection volume build with pair-overbounding remain valid, with only a modification in the K-factor. Explicit calculations show the new expression of the K-factor is

Because the complementary error function erfc is decreasing, we see K increases with ε. Thus, a larger excess mass makes it easier to pair-overbound the distribution, but leads to larger protection volumes.

When all the error sources i are paired-overbounded with excess mass by Gaussian distributions of standard deviation σ_i, bias ±μ_i and excess mass ε_i,the calculation of the protection volume remains particularly simple. It is given by

Where 

ξ is the multiplicative factor defined by Equation 16 and inflating K-factor defined by Equation 46.

Note the excess mass, as proposed in [5] requires the true tail is Gaussian or lighter to the Gaussian, because the overbound must hold up to infinite. It is interesting to combine the excess mass with core-tail approaches. We propose to include the excess mass only on the core overbound. In this case, we have for each error contributor:

By projecting Equation 47 in position domain, we get:

Equation 48 can be arranged as:

By inverting the equation, we get, in Equation 50, the new formulation for K-factor:

Two Steps Overbounding 

The objective of the approach proposed in [7] is to mix the two concepts of central CDF-overbound and paired overbound. From the empirical distribution of an unmodelled residual error, the objective is to construct a weaker form of paired overbound by Gaussian distributions (the Gaussian distribution is chosen for computational simplicity).

We start by constructing an intermediate pair-overbound where each bound is unimodal and symmetrical around its mean, but not necessarily Gaussian. We know (Theorem 3) this paired overbound is stable by convolution. We impose the properties of symmetry and unimodality because they are part of the hypotheses of the CDF-overbound. The second step is to find a Gaussian distribution (necessarily symmetrical and unimodal around their mean) where CDF-overbounds the left and right distributions. The assumptions of the CDF-overbound are met and imply these pairs of Gaussians overbounds are stable by convolution.

The result of this method are the two Gaussian variables

which have the following property:

The resulting properties of the two-step overbounding are weaker than those of the pair-overbounding, but they are sufficient to build a protection volume as follows:

Where K is the usual factor computed with Gaussian distributions (Equation 4).

This protection level is correct because of

The goal is to build a Gaussian two-steps overbound defined by μ_X, σ_X that is stable by linear combination, making it possible to perform the overbounding at range level and to build a protection volume at position level.

Theorem 5: If μ_X, σ_X define a two-steps overbound of X and μ_Y, σ_Y define a two-steps overbound of Y, then the linear combination Z=αX+βY can be two-steps overbounded by a pair of Gaussians with bias μ_Z=|α| μ_X+|β| μ_Y and variance

Under this condition, integrity in the pseudorange domain imply integrity in the position domain.

Proof:

The proof makes extensive use of previous results. Let us start with stability by convolution and consider Z=X+Y. Can we build a two-steps overbound of Z from the two-steps overbounds of X and Y?

We know the intermediate paired overbounding is stable by convolution, and this step requires no particular assumption on the underlying distributions of X and Y:

Then we use that the CDF-overbounding is stable by convolution. This is where the unimodality and symmetry around the median of the intermediate distributions is essential:

Because the CDF-overbounds are Gaussian, we have O_LX+O_LY~N(μ_LX+μ_LY, σ²_LX+σ²_LY) and similarly for O_RX+O_RY.

Finally, μ_Z=μ_X+μ_Y, we have μ_Z≥ max (|μ_LX+μ_LY|,|μ_RX+μ_RY|) and also σ²_Z≥ max(σ²_LX+σ²_LY, σ²_RX+σ²_RY). Because the tail probability for a Gaussian distribution is an increasing function of the standard deviation and the mean, the previous inequalities ensures the two Gaussian variables

of mean ±μ_Z and variance σ²_Z have the following property:

which is the essential property for the protection level to be correct. 

Note these properties on the tails of the distributions are necessary for the protection level formula to be correct but are not in themselves sufficient for a two-steps overbound because they are not stable by convolution. The stability by addition comes from the intermediate paired-overbound constructed in the first step.

The multiplication by a scalar poses no additional difficulties: if Z=αX then Z ⊆ [αL_X,αR_X] if α if positive (and Z ⊆ [αR_X,αL_X] for the negative case). In both cases αL_XαO_LX and αR_XαO_RX because the considered distributions are unimodal and symmetric around their means. We have αO_LX~N(αμ_LX,α² σ²_LX) and αO_RX~N(αμ_RX, α² σ²_RX) and the choice μ_Z=|α|μ_X and σ_Z=α² σ²_X ensures μ_Z≥max (|αμ_LX|,|αμ_RX|) and σ²_Z≥max (α² σ²_LX, α² σ²_RX). 

The two-steps overbounding construction allows for the transfer of integrity from the measurement domain to the position domain without specific assumptions of symmetry, centering and unimodality of the empirical error distribution by transmitting only two Gaussian parameters per line-of-sight (namely μ_X and σ²_X). This approach is less conservative than the paired overbound by two symmetric Gaussians because the needed property concerns only the left tail

The stability by linear combination is guaranteed by the existence of the intermediate symmetric and unimodal paired-overbound, but the explicit knowledge of the intermediate distribution is not needed for protection volume calculation.

The limiting aspect of the two steps overbounding method is the quality of the final overbound is very dependent on the construction of the first paired overbounds (first step). This step requires a complex optimization algorithm, with one such algorithm described in [7]. Another drawback of the method is it is difficult for a user with knowledge of the original error distribution and the parameters μ_X and σ²_X to verify the received parameters effectively form a correct two-steps overbounding of the error distribution without the information of the algorithm used in the first step.

Wide Sense CDF-Overbounding 

The approach of Weak CDF-over-bounding is introduced in [11]. Similar to the two-step overbound concept, the approach aims at taking advantage of both the CDF-overbounding and pair-overbounding definitions: the simplicity of the first one and the robustness of the second. The main idea is to impose a condition equivalent to CDF-overbounding for biased distribution, but without the assumptions of symmetry and unimodality. When performing linear combinations, the stability of the protection volume formula is lost because of the dropped assumptions. However, it is possible to quantify and bound the worst deviations from the Gaussian distribution and encapsulate them in a suitable inflation factor in the protection volume formula to ensure integrity.

In more precise terms, let X be a distribution (typically the distribution of an error contributor in a GNSS pseudorange measurement) with median b. We do not require X to be unimodal nor symmetric around its median. A weak CDF-overbound is given by a pair of Gaussians with mean ±μ_X and identical variance σ² such that μ_X≥|b| and furthermore:

The condition is identical to the second step of the two-steps overbounding method, but without the first step guaranteeing the stability of the property under linear combinations. If our quantity of interest is given by

where all X_i are individually weakly CDF-overbounded by Gaussian pairs of parameters μ_i and σ_i and n being the number of each error source, it is shown in [11] that the weak CDF-overbounding condition is sufficient to build a protection volume for E. The protection level formula is:

In this formula, K is the usual Gaussian K-factor (σ is the usual Gaussian standard deviation) where

and the new term A_n,K is an inflation factor that takes into account the weaker assumptions taken in the definition. It quantifies somehow the worst deviations from the Gaussian distribution if each term follows the weak CDF-overbound condition. The inflation factor A_n,K depends on the value of the K-factor (and the required integrity risk) but also on the number of terms in the linear combination. The factor A_n,K has no simple analytical formula, but a table of values can be pre-computed and used as such in a given context.

Note the parameter n is the number of independent error contributors and can be larger than the number of satellites in view if there are several error sources for each line-of-sight.

In this method, the properties of CDF-overbounding cannot be used directly because important assumptions on the unknown distribution are not met. However, the conditions of CDF-overbounding by a Gaussian are equivalent to a pair-overbound by two symmetric distributions, the left and right half-Gaussian. Furthermore, the properties of pair-overbounding do not use the assumptions of symmetry and unimodality. One can build a pair-overbound of the final error distribution as linear combinations of half-Gaussians. The last step is to build a pair-overbounding distribution for all coefficients in the linear combinations of half-Gaussians, such that the result is independent of the geometry of the problem. This allows conservative protection volumes to be built for a specific integrity risk. These protection levels are then divided by the usual K-factor and interpreted as an inflation factor A_n,K integrated in the protection volume formula. Note the factors presented in Table 1 and [11] are upper-bounds and future improvements on the method may reduce the numerical values of the inflation factors and thus of the protection volumes.

The main advantage of weak CDF-overbounding is its simplicity. The condition to verify for weak CDF-overbounding is of the same complexity as usual CDF-overbounding, but fewer assumptions on the underlying distribution are needed. The user only needs to store a pre-computed table of values of inflation factors (computed for the required integrity risk) to use when computing its protection volume. On the other hand, weak CDF-overbounding can lead to large protection volumes if the number of contributors is large and the K-factor is low. 

Conclusion 

This article shows the overbounding concepts that play a crucial role in demonstrating integrity are neither intuitive nor straightforward. However, the overbounding concepts using Gaussian overbounds are designed to keep the procedure as simple as possible. Indeed, the stability by linear combination of the overbounding properties and of the Gaussian distribution allows the user to manipulate the range errors as if they were Gaussian (by adding their standard deviations in quadrature) and apply the protection volume formula that mostly differ by the K-factor. From the integrity system point of view, the advantage is to focus on monitoring range error distribution and to send few parameters to the user, allowing for the construction of correct protection volumes. 

Table 2 summarizes the main assumptions and implications of the different concepts applied to Gaussian overbounds.

Despite extensive work on the subject, several open points remain on overbounding. 

First of all, all the studied concepts consider independence between all contributions to the positioning errors, and consequently between line of sights (Table 1). In practice, a correlation between the lines of sight could be caused by the troposphere residual errors, multipath or ODTS algorithm. [12] introduced a Power Spectral Density (PSD) overbounding concept that can guarantee integrity transfer of correlated Gaussian errors (with unknown and arbitrary correlation pattern), using a Gauss-Markov processes that overbound the PSD. To our knowledge, this concept is not used for single point positioning but is key for the integrity demonstration for Kalman filter. Generalization of this concept to non-Gaussian distributions will be a key step both for single point positioning and Kalman filtering.

Secondly, the concepts of overbounding presented are adapted to one dimensional quantities only. For example, the protection level formulas should be applied direction by direction for the positioning solution. A theory of overbounding multidimensional distributions is missing to, for example, build a protection volume for the norm of the horizontal positioning error. One difficulty of such a theory is the norm of a vector is not a linear combination of its components, and thus all the properties presented do not apply to this problem [13]. 

Last, the practical evaluation of overbounding remains a challenge because it involves estimating quantiles with low probability. This requires collecting and analyzing huge quantities of experimental data, which is costly, cumbersome and generally unrealistic. A promising alternative could be to extrapolate the tails of the distributions beyond the available data based on extreme value theory. 

Appendix

CDF OF THE SUM OF TWO INDEPENDENT RANDOM VARIABLES

We start by formulating the expression for the CDF of the sum X+Y. By definition of the CDF, F_(X+Y) (z)=P(X+Y≤z). The probability P(X+Y≤z) is obtained by integrating the join density function f_(X,Y) (x,y) of the couple of random variables (X,Y) on the set of x,y respecting the inequality x+y≤z or equivalently y≤z-x. As the random variables X and Y are independent, the joint PDF is the product of the individual PDFs:

The PDF of the sum of the two independent variables X and Y is obtained by making, in Equation 59, the change of variable y=v-x, interchanging the order of integration, and derivating the CDF with respect to z:

Thus, the density f_(X+Y) appear as the classic convolution product Equation 61 of the densities, noted as f_(X+Y)=f_X*f_Y:

The CDF of the sum of the two variables X and Y is obtained by recognizing in Equation 59 the CDF of the random variable Y:

Injecting F_Y (z-x) given by Equation 62 in the expression of F_(X+Y) (z) in Equation 59, we then get:

By making the integral of the joint density function respecting now the inequality x≤z-y in Equation 59, it comes:

Therefore, the CDF of the sum of the two variables X and Y is the convolution of the CDF of the one with the PDF on the other indifferently:

SUM OF TWO SYMMETRIC UNIMODAL RANDOM VARIABLES

In this section, we want to prove the following: if X and Y are two independent, symmetric and unimodal random variables, then their sum X+Y is also symmetric and unimodal [8]. 

Let f_X, f_Y, be the PDFs of X and Y and f_(X+Y)=f_X*f_Y the PDF of X+Y. Then f_(X+Y) is symmetric because, for all x∈R:

In this manipulation, we have used the symmetry of f_X and f_Y and the change of variable t→-t.

Let us now fix two reals 0≤a≤b and prove that f_(X+Y) (a)≥f_(X+Y) (b). We have from the ordering of a and b that for all x, |x-a|≥|x-b| if x≥((a+b))⁄2 and |x-a|≤|x-b| if x≤((a+b))⁄2. From the unimodality and symmetry of Y, this implies that f_Y (x-a)≤f_Y (x-b) if x≥((a+b))⁄2 and the contrary if x≤((a+b))⁄2. Similarly, we have, for x≥((a+b))⁄2, |x|≥|x-a-b| and so f_X (x)≤f_X (x-a-b) and also, for x≤((a+b))⁄2, f_X (x)≥f_X (x-a-b).

This shows that for all x∈R, we have:

Because both terms are positive for x≤((a+b))⁄2, else both terms are negative.

Integrating the positive product defining by Equation 66 on x, and using the symmetry of f_X,f_Y we get:

And using the symmetry of f_(X+Y), right side of inequation 67 becomes:

Thus f_(X+Y) is decreasing for positive x, which proves the unimodality of X+Y.

A COUNTER EXAMPLE TO A NAÏVE APPROACH 

For a given integrity risk IR and associated Gaussian K-factor, it is tempting to check integrity at the pseudorange level by making sure that for all lines of sight:

However, the following example demonstrates this approach is not sufficient to guarantee the integrity at position level. The reason is this condition tests a certain quantile of the pseudorange error distribution, whereas the stability by linear combinations require criteria to be met across the entire distribution.

Let us use a numerical counterexample. We first take a geometry matrix (here corresponding to 7 GPS satellites above Toulouse  on September 3, 2002, 0h00 in ENU frame)

Let us consider the case where all error variances on the pseudorange errors σ_i^2 are equal to 1. Then we build the S matrix as S=(G^T G)^(-1) G^T. The third line of S is

The vertical protection volume VPL has radius given by Equation 69

with K_V=5.33 and σ_V=√(S_(3,i)^2 σ_i^2 )

If the vector of residual errors is

then each line of sight passes the integrity test (meaning that ∀i,b_i<K_V σ_i=5.33), but the vertical error is

which exceeds the protection level radius.

This counter-example does not question the principle of integrity transfers from pseudo distance to position, but the fact that it can be done by the sole definition of confidence intervals in the pseudo distance domain. To establish the equivalence between both realms, the property of overbounding must be verified across the entire distribution, at least up to the desired quantile.

Indeed, if the overbound is applicable for each line of sight, it is extremely improbable to obtain the vector  proposed in the example. In addition, if we only know the inequality is satisfied for each line of sight, we have no information about the probability of occurrence of the given vector  in the example, even though it leads to a lack of integrity in the domain of positions.

References 

[1] Minimum operational performance standards for Global positioning system/ wide area augmentation system airborne equipment, DO-229, RTCA ed. Washington, DC.

[2] B. DeCleene, Defining pseudorange integrity – Overbounding, In Proc. 13th Int. Techn. Meeting Satellite Div. Inst. Navigat., Salt Lake City, UT, USA, Sep. 2000, pp. 1916–1924.

[3] J. Rife , S. Pullen, B. Pervan, and P. Enge, Paired Overbounding and Application to GPS Augmentation, Proceedings IEEE Position, Location and Navigation Symposium, pp. 439-446, July 2004.

[4] J. Rife, S. Pullen, B. Pervan, and P. Enge, Paired Overbounding for Nonideal LAAS and WAAS Error Distributions, IEEE Trans. Aerosp. Electron. Syst., vol. 42, no. 4, pp. 1386–1395, Oct. 2006.

[5] J. Rife, J. Blanch and T. Walter, Overbounding SBAS and GBAS Error Distributions with Excess-Mass Functions, in Proceedings of the GNSS 2004 Internat. Symp. On GNSS/GPS, Sydney, Australia,6-8, Dec. 2004.

[6] J. Rife, S. Pullen, B. Pervan, Core Overbounding and its Implications for LAAS Integrity, Proceedings of the 17th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS 2004), Long Beach, CA, Sept. 2004, pp. 2810-2821.

[7] J. Blanch, T. Walter and P. Enge, Gaussian Bounds of Sample Distributions for Integrity Analysis, IEEE Trans. Aerosp. Electron. Syst., vol. 55, no. 4, pp 1806-1815, Aug. 2019.

[8] M. Earnest, link.

[9] J. Antic, O. Maliet, and S. Trilles, “SBAS Protection Levels with Gauss-Markov K-Factors for Any Integrity Target”; NAVIGATION: Journal of the Institute of Navigation September 2023, 70 (3) navi.594

[10] K. Mimouni, O. Maliet, J. Antic, “A simple and robust K-factor computation for GNSS integrity needs”. ION plan, pp 399-407, 2023

[11] Maliet, O., Mimouni, K., Antic, J., & Trilles, S. (2025). Wide-Sense CDF overbounding for GNSS integrity. NAVIGATION: Journal of the Institute of Navigation June 2025, 72 (2) navi.697; link

[12] Langel, S., Crespillo, O. G., & Joerger, M. (2020, April). “A new approach for modeling correlated Gaussian errors using frequency domain overbounding”. In 2020 IEEE/ION Position, Location and Navigation Symposium (PLANS) (pp. 868-876). IEEE.

[13] I. Nikiforov, “From pseudorange overbounding to integrity risk overbounding”, NAVIGATION, Vol 66, Issue 2, Summer 2019, pp 417-439.

[14] Z. W. Birnbaum, “On Random Variables with Comparable Peakedness”, The Annals of Mathematical Statistics, 19 (1), pp 76-81 doi:10.1214/aoms/1177730293

Authors

Julie Antic is a specialist in GNSS integrity algorithms and performances at Thales Alenia Space in Toulouse, France. She holds a Ph.D. in probability and Statistics from Paul Sabatier University, France, as well as an engineering degree in applied Mathematics from INSA in Toulouse, France. Her areas of activity include advanced GNSS augmentation systems for high accuracy and integrity, advanced receiver autonomous integrity monitoring and overbounding concepts.

Odile Maliet graduated from École Polytechnique and received her Ph.D. degree in Macroevolution from École Normale Supérieure (ENS), Paris in 2018. Between 2018 and 2020, she worked as a postdoc on the use of Bayesian techniques on phylogenetics empirical data at ENS, Paris. Since 2021 she has worked on integrity concepts in Advanced Projects at the Performance and Processing Department of Navigation Domain, Thales Alenia Space.

Kin Mimouni graduated from École Polytechnique, Paris, and received his Ph.D. in Theoretical Physics from École Polytechnique Fédérale de Lausanne (EPFL) in 2019. Since 2021 he has worked on GNSS algorithms and integrity concepts, first as a post-doc in the Télécommunications Spatiales et Aéronautiques (TéSA) laboratory in Toulouse, and since 2023 as an engineer in Advanced Projects at the Performance and Processing Department of Navigation Domain France, Thales Alenia Space.

Sébastien Trilles is an expert in orbitography and integrity algorithms at Thales Alenia Space in Toulouse, France. He holds a Ph.D. in Pure Mathematics from the Paul Sabatier University and an advanced master’s degree in Space Technology from ISAE-Supaero. He heads the Performance and Processing Department where high precise algorithms are designed as orbit determination, clock synchronization, time transfer, reference time generation, integrity and ionosphere modeling algorithms for GNSS systems and augmentation.

The post Working Papers: Overview of Overbounding Techniques for Integrity Purposes appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

JUDAH LEVINE, UNIVERSITY OF COLORADO, PASCALE DEFRAIGNE, ROYAL OBSERVATORY OF BELGIUM, ILARIA SESIA, ITALIAN METROLOGY INSTITUTE, GIULIO TAGLIAFERRO, INTERNATIONAL BUREAU OF WEIGHTS AND MEASURES, MICHAEL WOUTERS, NATIONAL MEASUREMENT INSTITUTE

Coordinated Universal Time (UTC) has been recommended as the unique time scale for international reference time stamps and is the basis for civil time in most countries [1]. Time zones, which are established by local administrations, are defined by an offset from UTC. Some applications are required to use time stamps based on UTC either by regulation or by statute [2-4]. There are advantages to the use of time stamps based on UTC, even when it is not required to do so, because this facilitates combining data from multiple sources or when international coordination is important.

Time signals from global navigation satellite systems (GNSS) are widely used as the reference time in many applications, and it is important to understand the requirements that ensure GNSS time stamps are traceable to UTC from both a technical and a regulatory perspective [5]. This article describes how UTC is defined and realized and how a prediction of UTC is included in GNSS data transmissions.

The Definition and Realization of UTC 

The UTC time scale is a paper time scale that has no physical realization. It is computed monthly by the International Bureau of Weights and Measures (BIPM) based on data from several hundred atomic clocks located at National Metrology Institutes (NMIs) and other time centers in various countries. Many laboratories operate local ensembles of atomic clocks and use the data from these ensembles to compute and disseminate a local UTC estimate. This local estimate is identified as UTC(k), where k is the acronym for the laboratory. The estimate of UTC computed by the U.S. Naval Observatory (USNO) is UTC(USNO) and the estimate computed by the National Institute of Standards and Technology (NIST) is UTC(NIST). 

The computation of UTC for any month is published in BIPM Circular T by the tenth day of the following month [6]. This circular tabulates UTC-UTC(k) every five days for every participating laboratory. A rapid version of UTC, called UTCr [7], is also published by the BIPM every Wednesday. It lists daily values of UTCr-UTC(lab) through the previous Sunday. These data are published on the BIPM website and are distributed by email (Figures 1 and 2). 

GNSS Time Signals

The system time of a GNSS constellation, GNSS_T, is generated by the ground segment from an ensemble of clocks located on the ground at the control center and tracking stations. It also can include the clocks in the satellites [8-11]. Each satellite in a constellation transmits a prediction of the offset between the time of the clock on the satellite and the system time of the constellation, which is uploaded to the satellites periodically. GNSS constellations also broadcast bUTC_GNSS, a prediction of the difference between GNSS_T and UTC (including a 3-hour offset for the GLONASS system) that is derived from the UTC prediction of timing laboratories. This prediction is transmitted in two parameters: an integer giving number of whole seconds difference between UTC and the GNSS system time, and a fractional part, which specifies the difference modulo 1 s. The first parameter changes only when a leap second is inserted into UTC and not at other times. (The GLONASS constellation uses UTC as the system time so only the fraction is transmitted in the navigation message.)

For the GPS constellation, this prediction is derived from UTC(USNO) maintained at the U.S. Naval Observatory. The GLONASS constellation broadcasts a prediction based on UTC(SU), which is realized at the Russian Metrology Institute of Technical Physics and Radio Engineering (FSUE, VNIFTRI). The Galileo constellation uses a prediction derived from a collaboration of five European National Metrology Institutes. The BeiDou system uses UTC(NTSC) realized at the National Time Service center of China and UTC(NIM) realized at the China National Institute of Metrology. Regional systems also broadcast similar messages. The formats of the respective messages are GNSS-specific and are documented in the respective Interface Control Documents.

The Role of the BIPM

In addition to computing UTC and publishing the differences of UTC-UTC(k), the BIPM evaluates the difference between UTC and the predictions of UTC broadcast by the various GNSS constellations, bUTC_GNSS. These differences are published in Section 4 of BIPM circular T [6]. This section lists the difference in ns between UTC computed by the BIPM and the prediction of UTC transmitted by the GPS, GLONASS, Galileo and BeiDou satellites for every day in the monthly reporting period for that issue of Circular T. Table 1 shows the values from the August 2025 editor of Circular T interpolated from the five-day reporting interval in Circular T to a daily value at 0 UTC [12]. 

Linking User Equipment to UTC

There are two common configurations that support a link between the user’s time reference and UTC(k) or UTC. In the first configuration, the user has a clock (or an ensemble of clocks) that provides the reference signal for a GNSS timing receiver. The receiver does not discipline the free-running local clock (or ensemble) in the short term, but measures its time with respect to the signal broadcast by the satellites of some constellation. These data are combined with the data in the navigation message to (1) correct for the transit time between the satellite and the receiver, (2) include the offset between the satellite clock and the GNSS system time, and (3) add the prediction of the offset between the system time and UTC. 

Most receivers can be configured to implement these calculations in firmware, and the output data gives the difference between the local reference and the broadcast prediction of UTC. The signal from this clock (or clock ensemble) can be used in the user’s application or the application’s clock can be compared to it. The system connected to the GNSS receiver may be completely free-running and not disciplined by the GNSS data; its offset is recorded and used to adjust the downstream data. In some configurations, the time or frequency of the local reference clock is adjusted from time to time so the measured time difference is kept within some administratively defined tolerance. The interval between adjustments depends on this tolerance and on the frequency stability of the local reference, and it can range from minutes for a rubidium-based reference to hours or days for a cesium-based device. 

The second configuration, which is much more common, combines a GNSS receiver and an oscillator in a single device. There are many commercial systems that realize this configuration and often provide several outputs (5 MHz, 10 MHz and 1 pps) that are disciplined by the data received from the GNSS constellation. The simpler systems use the code data transmitted on the L1 frequency, but dual-frequency receivers and more sophisticated carrier-phase analyses are possible. The first GNSS disciplined oscillators usually used signals from the GPS constellation, but newer systems can track satellites from more than one constellation simultaneously. The output signal might be based on only the satellites from one constellation at any time or on a combination of the data received from multiple constellations. Either solution can produce significant steps in the output signals, especially in the PPS data, when the reference constellation changes. The details of the disciplining algorithm are often proprietary; the output could be disciplined to GNSS system time or to the prediction of UTC, and traceability to UTC would require the additional adjustment that incorporated the data published in BIPM Circular T. This additional adjustment, based on data from Circular T, may be small enough to ignore in some applications. 

The first configuration is more flexible; the measurement process can accept data from multiple sources, including common-view data, and implement more sophisticated post-processing methods. The adjustment process for the local reference clock can be adjusted to meet the requirements of the user’s application. The second configuration, on the other hand, may provide adequate performance in many applications. It is much simpler to operate, and this simplicity may be the deciding factor for many users.

Combining Data from Multiple Constellations

Combining GNSS signals from multiple constellations can significantly improve the timing performance of a user’s receiver, especially in locations with limited visibility of the sky. This approach requires a knowledge of the offsets between different GNSS time scales, which are at the level of a few ns and vary in time. It is possible for a user to solve for the inter-system bias between constellations [13] if enough satellites from both constellations are visible at the same time, but this is not always the case, and the broadcast values must be used [14]. The broadcast of the predicted time difference between each GNSS system time and UTC greatly simplifies the job of combining signals from multiple constellations when only broadcast data are available. The use of UTC as the common reference time scale eliminates the need for maintaining multiple inter-system bias values.

Metrological Traceability

The International Vocabulary of Metrology (VIM) defines traceability as the “property of a measurement result whereby the result can be related to a reference through a documented unbroken chain of calibrations, each contributing to the measurement uncertainty” [15]. The International Telecommunications Union (ITU) [16] and the International Laboratory Accreditation Conference adopted the same definition and refer to the International Organization for Standardization (ISO/IEC) standard 17025 [17].

The signals transmitted by the GNSS constellations can be traceable to UTC. The broadcast signals are linked to UTC through the UTC(k) data of a timing laboratory, and the transmissions are monitored by the BIPM with results published in Circular T. A user can also establish a common-view relationship with a timing laboratory, which can provide a near-real-time estimate of the offset of the user’s timing system with respect to the UTC(k) of that laboratory. In either case, these data are processed by the receiving system at the user’s site, and the calibration and statistical characteristics of this system directly affect the accuracy and stability of the timing data that control the user’s application. 

Timing Receiver Calibration

The calibration of the user’s equipment that is required to complete the demonstration of traceability should be performed by a method validated by a National Metrology Institute or a Designated Institute that participates in the Mutual Recognition Agreements (MRA) and have their Calibration and Measurement Capabilities (CMC) published in the Key Comparison Database maintained by the BIPM [18]. The Key Comparison Database maintains the equivalency between different organizations and guarantees the international acceptance of calibrations performed by different agencies that participate in the MRA.

The manufacturer’s published specifications can be the basis for specifying the performance of a stand-alone GNSS receiver or a GNSS receiver and disciplined oscillator combination. These specifications should be based on a calibration of one example of a particular model with some allowance for the variation among devices of the same type. For applications that require only modest accuracy (not greater than about 1 µs) a statement by the manufacturer that the device has been type-approved to that level is sufficient. The transmission delay even through a very long antenna cable is unlikely to invalidate this assumption.

The use of “type approval” may not be adequate for applications that require sub-microsecond accuracy. One method of calibrating a receiving system is to compare the output of the system to a source of UTC(k) by using a time-interval counter to monitor the difference. This method depends on an independent source of UTC(k), which might be provided by a traveling calibrated receiver, by transporting a running clock from the UTC(k) source to the location of the receiver, or by operating the device to be calibrated at a laboratory where a source of UTC(k) is available. 

Using a traveling receiver is the best choice because it tests the receiving hardware with the antenna and cables in the environment where it will be used. The BIPM uses this option to calibrate the time-transfer equipment at timing laboratories. Although the traveling receiver is calibrated, it is operated at a location where its position may not be known accurately, and where it may be influenced by multipath effects that are not the same as the effects on the device under test. These considerations are usually not important unless the required accuracy must be better than about 50 ns.

A calibration based on carrying a running clock from the source of UTC(k) to the location of the user’s equipment is feasible if the distance is not too great and the required calibration accuracy is not too high. For example, the GPS receivers at the NIST radio station in Fort Collins, Colorado, are calibrated by carrying a rubidium oscillator from the source of UTC(NIST) in Boulder to Fort Collins, a distance of about 100 km by road. The calibration is repeated by carrying a calibrated GPS receiver between the two locations. The accuracy of either method is estimated to be about 15 ns, and the two methods agree within this uncertainty.

Transporting the device under test to a location where an independent source of UTC(k) is available is usually the most difficult solution. It may be impractical to disconnect the antenna cable at the site, so a different cable must be used for the calibration. The delay through the actual cable can be estimated with a time domain reflectometer, but this method tests the cable with signals that are not the same as signals from real satellites. The impedances at the end-points are also different. 

If the system to be calibrated provides the contribution of each satellite in view to the composite output, then the common-view method can be used to calibrate the receiver. (Unfortunately, many disciplined oscillators do not provide these data.) The system to be calibrated measures the difference between the local clock (or clock ensemble) and the system time of the constellation by using the data from each satellite in view. These data are compared, satellite by satellite, with the same measurements made at a location where UTC(k) is available. The common-view difference cancels or attenuates the contributions of the satellite clock and the orbital parameters, which are common to both data sets and cancel in the differences in first order. If the distance between the locations of the user and the UTC(k) laboratory is not too great, the contribution of the ionosphere may also be common to both measurements and cancel in the difference. A multiple-frequency measurement, which can correct for the contribution of the ionosphere, may not offer a significant improvement over a simple L1 comparison in this configuration, because the contribution of the ionosphere will be cancelled or attenuated in the common-view subtraction. The common-view method can operate continuously, and can also monitor the stability of the remote system.

Frequency Calibration

The techniques described for timing calibration can also calibrate the output frequency of the user’s system. A frequency calibration can be easier to realize than a time calibration because the absolute values of the delays in the equipment are not important, only the stability of these delays is. The stability of the output frequency of a quartz oscillator may be degraded by fluctuations in the ambient temperature, and the frequency estimated with a reference based on a rubidium or cesium device may be degraded by changes in the multipath contribution.

Specific Recommendations

The documentation from the manufacturer is the best source of information about a particular device. The following specifications provide general guidance on the methods to establish traceability [19].

1. If the application can accept a fractional frequency uncertainty of 10^-8 or greater with an averaging time of one day, or a time uncertainty of 1 µs or greater, then a certificate by the manufacturer that at least one unit of the model satisfies the requirement is adequate to establish traceability at this level. (A receiver used only as the reference for a server that supports NTP, the Network Time Protocol, may not require calibration, because the accuracy and stability of the NTP service is usually limited to not better than about 1 ms by the characteristics of the network connection between the server and the client systems.) 

2. If the application requires a fractional frequency uncertainty between 10^-8 and 10^-10 with an averaging time of one day or a time uncertainty between 100 ns and 1 µs, then the manufacturer should provide a certificate with every unit that satisfies the requirement. The manufacturer could validate the performance of each unit by comparing its output with a calibrated reference unit maintained at the manufacturer’s facility. 

3. If the application requires a fractional frequency uncertain of less than 10^-10 with an averaging time of one day or a time uncertainty of less than 100 ns, then the calibration can be challenging and should be performed at the user’s facility, if possible. 

4. If the application requires a fractional frequency stability of less than 10^-12 or a time uncertainty of less than 50 ns, then the calibration should be repeated periodically or the performance of the system should be monitored by common-view or an equivalent technique, which will require a dedicated GNSS timing receiver at the user’s site. The contributions of multipath reflections and the sensitivity of the equipment to fluctuations in the ambient temperature may be important. The impact of multipath reflections can be minimized by locating the antenna so it has an unobstructed view of the sky, and by using a directional “choke ring” antenna, which attenuates signals coming from low elevations. The sensitivity to fluctuations in the ambient temperature may be a problem if the local reference device is a simple quartz oscillator or if a long antenna cable is exposed to direct sunlight. 

It is important to maintain documentation that validates the traceability of any system. Configurations that support this capability are particularly useful.

Summary and Conclusion

Applications that use the timing data from GNSS systems often require legal and technical traceability to UTC. Even when traceability is not legally required, maintaining traceability to UTC simplifies combining the data from multiple constellations. The signals transmitted by GNSS systems are monitored by the BIPM and can be made traceable to UTC by the methods discussed. Ensuring the traceability of the timing data in a user application also depends on a calibration of the receiving equipment. The methods for realizing this calibration were presented and specific recommendations provided. Maintaining adequate documentation is important, and configurations that support real-time monitoring and log files are particularly useful. 

References 

(1) Conference generale des poids et mesures (CGPM) 2018 Resolution 2 of the 26th CGPM (2018), on the definition of time scales (https://bipm.org/en/committees/cg/cgpm/26-2018)

(2) MiFiR RTS 25: https://ec.europa.eu/finance/securities/docs/isd/mifid/rts/160607-rts-25_en.pdf

(3) Finra Rule 6820: https://www.finra.org/rules-guidance/rulebooks/finra-rules/6820

(4) IEEE Standard for Synchrophasor Measurement for Power Systems, IEEE C37.118.1-2011. https://standards.ieee.org/ieee/C37.118.1/4902.

(5) Dimetrios Matsakis, Judah Levine, and Michael Lombardi, Metrological and Legal Traceability of Time Signals, Inside GNSS, March/April 2019, pp. 48-58.

(6) https://www.bipm.org/en/time-ftp/circular-t

(7) https://www.bipm.org/en/time-ftp/utcr

(8) GPS system time: https://www.gps.gov/applications/timing

(9) Galileo system time: https://www.gsc-europa.eu/GST

(10) GLONASS system time: https://www.unoosa.org/documents/pdf/icg/2020/GLONASS_Time_2017_E.pdf

(11) BeiDou system time: http://en.beidou.gov.cn/SYSTEMS/Officialdocument/202001/P020231201549662978039.pdf

(12) https://webtai.bipm.org/ftp/pub/tai/other-products/notes/explanatory_supplement_v0.8.pdf

(13) G. Huang, Q. Zhang, W. Fu and G. Guo, GPS/GLONASS time offset monitoring based on combined precise point positioning approach, Advances in Space Research, Vol. 55, number 12, 15 June 2015, pp. 2950-2960. DOI: https://doi.org/10.1016/j.asr.2015.03.003. See also references in that text.

(14) GPS-Galileo Time Offset (GGTO): https://www.unoosa.org/documents/pdf/icg/2017/wgd/wgd4-2-2.pdf

(15) https://www.bipm.org/documents/20126/54295284/VIM4_CD_210111c.pdf

(16) ITU-R, TF-686-3, Glossary and Definitions of Time and Frequency Terms p 16. https://www.itu.int/dms_pubrec/itu-r/rec/tf/r-rec-tf.686-3-201312-i!!pdf-e.pdf

(17) SO 17025:2017, General requirements for the competence of testing and calibration laboratories, https://www.iso.org/ISO-IEC-17025-testing-and-calibration-laboratories.html

(18) https://www.bipm.org/en/cipm-mra

(19) P. Defraigne, J. Achkar, M. J. Coleman, M. Gertsvolv, R. Ichikawa, J. Levine, P. Uhrich, P. Whibberley, M. Wouters and A. Bauch, Achieving traceability to UTC through GNSS measurements, Metrologia, vol. 59, Number 6, October 2022. Metrologia, 59, 064001. DOI: 10.1088/1681-7575/ac98cb.

Authors

Judah Levine is on the faculty of the Department of Physics at the University of Colorado at Boulder. He recently retired from the Time and Frequency Division of NIST, where he worked on time scales and methods of distributing time and frequency information. He is continuing those projects at the University and is also a member of committees of the International Bureau 
of Weights studying the future of Coordinated Universal Time and possible time scales for the Moon.

Pascale Defraigne obtained her Ph.D. in Geophysics in 1995 at the Université Catholique de Louvain. Since 1997, she has managed the time and frequency activities at the Royal Observatory of Belgium, where the Belgian reference UTC (ORB) is maintained. Her research activities mainly concern the use of satellite navigation systems for time and frequency transfer. Pascale presently chairs the CCTF working group on GNSS time transfer, and contributes to the validation of Galileo timing signals.

Ilaria Sesia is a Senior Researcher and Head of the Time and Frequency Department at INRiM, where she works on time transfer, atomic clocks and time scales for satellite applications. Since 2004, she has been deeply involved in the design and development of the timing aspects of the Galileo System.

Giulio Tagliaferro received his Ph.D. in 2021 from Politecnico di Milano on precise GNSS measurement adjustment. He is currently a physicist at BIPM, where he works on GNSS time-transfer activities and receiver calibration supporting the realization of UTC.

Michael Wouters leads the time and frequency group at the National Measurement Institute in Sydney, Australia. His research focuses on using low-cost GNSS receivers for time-transfer. He chairs the Consultative Committee on Time and Frequency’s task group working on the traceability of GNSS timing signals to UTC.

The post Linking GNSS Data to UTC appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Agriculture has entered the era of continuous PNT.

Precision agriculture is moving toward full automation. Guidance systems once treated GNSS as the entire solution; today, the industry recognizes that satellite signals are necessary but insufficient. Farms have become complex RF environments. Tree canopy, terrain, outbuildings, seasonal geometry shifts, multipath near grain elevators, interference from adjacent equipment, and the simple reality that tractors roam in and out of open-sky visibility all challenge the idea that GNSS alone can sustain continuity.

OEMs are building guidance systems that must keep machines on path even when GNSS falters. Autonomy depends on uninterrupted perception of position, velocity and attitude. That means pairing GNSS with inertial systems engineered for agricultural machines, not adapted from other domains.

In a recent conversation with Inside GNSS, Tzeno Galchev, Director, Product Marketing and Applications Engineering for Analog Devices, Inc. (ADI), described how their inertial measurement units (IMUs) are being integrated into next-generation tractors, implements, drones and robotics platforms. ADI’s engineers are focused on what really matters in the field: disciplined inertial performance, controlled lifetime drift, rugged packaging and reliable sensor fusion with GNSS. The message was unambiguous: Autonomy in agriculture can scale rapidly when inertial becomes a baseline requirement. 

The Market Reality: Why Inertial Matters Now 

Precision agriculture has matured beyond the first decade of “straight-line” GNSS guidance. Machines now operate in a wider set of field geometries, crop types and environmental constraints. Several forces are converging:

Tractors are evolving from operator-assisted systems to autonomy-ready platforms. Implements are following, including precision planters, high-clearance sprayers, and robotic harvesters. Each requires continuous PNT. A single GNSS dropout during an autonomous end-of-row turn can result in overlap, missed coverage or unsafe behavior.

Agriculture spans open sky areas and GNSS-hostile corridors. Machines pass under tree rows, within orchard canopies, beside barns or silos, or along field edges lined with windbreaks. Modern high-value crops, such as vineyards, orchards and berries, introduce dense canopy that disrupts L-band signals. Even row crops can create directional multi-path in late summer.

OEM Pressure to Deliver “Always-on” Paths

Agricultural OEMs face customer expectations shaped by the automotive sector. The question is no longer whether GNSS can deliver accuracy; it is whether the total system delivers continuity. That continuity is now a competitive differentiator. Dead-reckoning performance, not positional Root Mean Square (RMS) in open sky, shapes the user experience.

Cost Realism and the Mid-Market Explosion

Farm sizes vary globally. Not every user can justify aerospace-tier inertial systems. ADI’s view is that precision agriculture needs inertial performance that respects cost boundaries while still meeting the dynamics of field machinery: vibration, temperature cycling and shock.

“The demand is there because there’s a shortage of workforce, especially in the developed countries, and these machines make a considerable difference in the cost and efficiency of farming operations,” Galchev said. “They are replacing and reducing the number of workers needed as well as putting workers out of harm’s way.” 

The Shift to Autonomy-Grade Attitude Estimation

GNSS provides position and velocity; but many operations require continuous knowledge of roll, pitch and yaw. Sprayers use boom leveling. Planters need implement attitude to maintain depth accuracy. Drones require stable orientation in low-signal environments. INS establishes those states even when GNSS is degraded.

THE RESULT: GNSS remains the reference, but inertial is now the mechanism that closes the reliability gap.

Inertial Basics for Agricultural Platforms 

Agricultural operators rarely see inertial systems directly. They see better lines, fewer skips, improved boom stability, and smoother turns. Under the hood:

• IMUs measure angular rate and acceleration along orthogonal axes.

• Sensor fusion in an inertial navigation system (INS) uses those measurements to propagate position, velocity and attitude during GNSS gaps.

• Drift is inherent, but it can be minimized, modeled and constrained with well-tuned sensor fusion.

• GNSS resets the INS, bounding cumulative error.

• Agricultural use-cases emphasize short-to-medium duration bridging, not long-haul independent navigation.

Modern MEMS technology has reduced noise, bias instability, and temperature sensitivity to levels appropriate for automotive-grade and robotic applications. ADI’s work has focused on improving consistency across production units, strengthening environmental robustness, and integrating compensation routines at the firmware level.

Agricultural machinery introduces several complicating factors that inertial systems must handle cleanly:

• High vibration environments from diesel engines, tillage tools, and PTO-driven implements.

• Complex motion during headland turns, uneven terrain and differential traction events.

• Thermal swings, from dawn cold starts to midday heat.

• Mechanical shock, especially on implements.

• Long duty cycles, including 14 to 18 hour days in planting or harvest season.

This environment is less deterministic than automotive and more dynamic than many robotics platforms. The IMU/INS must treat vibration as a feature of the mission, not a source of error.

ADI’s Technical Approach

ADI designs inertial solutions with a focus on predictable error behavior, rugged packaging and stable sensor fusion. The company emphasizes several technical principles:

VIBRATION TOLERANCE. Farm machinery produces persistent broadband vibration. ADI considers how vibration intrinsically disturbs the sensors and ADI engineers design mechanical structures that better suppress, cancel and otherwise reduce the effect of vibration directly into the MEMS structures themselves because once vibration is allowed to pollute the sensor signal, it is too late for the INS system to do anything about it. This ensures the INS maintains the correct angular-rate and acceleration signatures even when implements shake violently.

BIAS REPEATABILITY. This is the lifetime bias drift expectation that intends to capture all unmodeled error sources and is not commonly specified in MEMS IMU datasheets. It provides a single error window that will determine the convergence times for critical estimation/filter loops. For systems that need to turn and deploy quickly, failure to anticipate and quantify these errors can limit deployment time and degrade initial heading accuracy. In their latest products, ADI has expanded their Bias Repeatability definition to include turn-on drift/settling, drift from package stress relief, electronic drift and thermal hysteresis. In parallel with expanding the coverage of this specification, ADI has reduced this metric by an order of magnitude in recently-released devices, such as the ADIS16545 and ADIS16576. 

AXIS-TO-AXIS ALIGNMENT. With tight axis-to-axis alignment out of the box and calibrated through an extensive inertial routine over multiple temperature set-points, tight alignment can be achieved only using mechanical alignment features. For tighter alignment than 0.25° one could leverage the tight axis-to-axis alignment (along with excellent bias repeatability in the accelerometer) to greatly simplify the frame alignment process. 

LINEAR, TEMPERATURE-CONTROLLED BEHAVIOR. Temperature gradients on tractors and implements are large. ADI incorporates temperature compensation models enforced at both the sensor and system level. The goal is not perfect thermal invariance, which is unrealistic in cost-sensitive segments, but predictable behavior that fusion algorithms can model accurately.

FUSION-FIRST PHILOSOPHY. ADI treats the IMU as one component of a larger PNT solution. Their systems are designed for tight integration with GNSS receivers, wheel speed sensors, magnetometers, and vehicle CAN data. Robust synchronization and time-based alignment of the inertial output simplifies system coupling. This architecture enables robust attitude estimation and velocity smoothing, especially during headlands or canopy exposure.

PREDICTABLE LIFECYCLE PERFORMANCE. Agricultural platforms must last. ADI designs for multi-season reliability and bounded long-term drift. The objective is to ensure a machine equipped with an ADI IMU behaves the same in year four as it did in year one.

“You can’t calibrate a sensor’s inherent noise performance, its stability, or its response to vibration,” Galchev said. “These unmodeled error sources directly produce error at the output, and that’s where ADI focuses on innovating at the chip level.”

This technical discipline supports the system-level view: Inertial is not a premium feature; it is a foundation for reliable GNSS-enabled autonomy.

Integration in the Field: What Engineers Face

Engineers integrating inertial systems into agricultural machines confront real-world constraints that differ from lab conditions. ADI’s field experience highlights specific patterns.

Booms flex. Toolbars vibrate. Tractor frames twist. Sensor placement often becomes a compromise. An INS may be exposed to off-axis motion uncorrelated with actual vehicle trajectory. ADI mitigates this through calibration routines, filtering strategies, and noise modeling that treat flex and vibration as signal partitions.

Implements as Independent Dynamic Systems

The implement behind a tractor behaves differently from the tractor itself. For operations like variable-rate spraying or multi-row harvesting, implement attitude, even when decoupled from tractor motion, must be sensed accurately. IMUs can be mounted on booms or frames to track these dynamics.

Agricultural systems rely on multiple data streams: GNSS, wheel speed, steering angle, hydraulic cylinder positions, and sometimes LiDAR or camera inputs. INS integration requires precise timing alignment. ADI designs its systems for deterministic latency and reliable time stamping, which improves fusion accuracy.

The transition from row guidance to headland turns stresses both GNSS and INS. Machines accelerate, decelerate, rotate sharply, and pass through GNSS-obstructed corners. ADI’s inertial fusion helps maintain attitude and velocity states during these high-dynamic transitions.

Agricultural drones operate close to trees and terrain. Ground robots operate beneath canopy. INS solutions provide roll/pitch stability, altitude smoothing, and fallback motion propagation when GNSS is degraded.

Economics: Performance Within Reach

Precision agriculture is expanding beyond large, capital-intensive farms. The next wave of adoption will come from mid-market operations and mixed-crop geographies.

• Cost matters. Expensive IMUs are non-starters. ADI designs MEMS-based solutions that offer robust performance within an accessible cost envelope.

• Scalability drives OEM decisions. Manufacturers want sensors available in volume, with predictable lead times and long lifecycle commitments.

• Global adoption requires price/performance balancing. Emerging markets need PNT reliability but cannot bear aerospace-grade costs. Scalable, rugged MEMS solutions fill this gap.

• Autonomy ROI depends on continuity. If a machine can maintain guidance through GNSS disruptions, it can operate longer hours and at higher speeds, improving economics for both OEMs and end-users.

“Just because you go from a big tractor to a smaller tractor, the conditions don’t change that much,” Galchev said. “If you want to achieve the same mission profile, you still need the same performance level.”

As ADI brings cost-efficient inertial capability into mainstream ag equipment, the performance gap between high-end and mid-tier platforms narrows.

The Road Ahead: Multi-Sensor Fusion and Autonomy

Agriculture is evolving toward heterogeneous fleets: autonomous tractors, robotic harvesters, terrain-following sprayers, orchard drones, and edge-connected implements. All require resilient PNT.

End-of-row autonomy

Low-speed, high-precision maneuvers demand stable attitude estimation. INS ensures smooth transitions even in partial GNSS shadows.

Terrain-following and boom dynamics

Sprayers rely on roll/pitch estimates for boom control. IMU data supports rapid damping of boom oscillation, improving chemical placement, reducing drift, and lowering input costs.

Cooperative ground-air systems

Drones performing scouting missions must integrate with guidance systems on the ground. Consistent inertial performance across platforms enables better data fusion and farm-level coordination.

Resilience as a design requirement

Interference, accidental or intentional, is increasingly common. INS helps maintain continuity of operation when GNSS performance degrades. It stabilizes machine behavior during uncertainty and helps diagnostic systems detect anomalies.

Regulatory evolution

As autonomy expands, functional-safety requirements will increase. INS adds a measurable layer of redundancy and validation, supporting safety cases for next-generation machines.

“We have sensors that we released more than 20 years ago still being produced,” Galchev said, “because our customers’ systems have long lifespans and once something works, it can be very difficult and expensive to re-qualify and swap it out.”

As autonomy accelerates, the next decade of agriculture will be shaped by platforms that assume GNSS variability and engineer around it from day one. That shift elevates inertial from an add-on to a core requirement. ADI, with its long record of sensor innovation and system-level discipline, is positioned to anchor that transition. Their approach: predictable drift behavior, calibration at the silicon level, ruggedized packaging, and tight GNSS-INS fusion, gives OEMs a stable foundation to build autonomy across tractors, implements, drones, and emerging agricultural robots. The path forward is clear: Resilient PNT will define productivity, and ADI’s inertial technology will increasingly sit at the center of the autonomy stack, enabling machines that navigate, adapt and operate with confidence in the real conditions of the farm.

The post Precision Ag: From Field to Furrow appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

WAHYUDIN P. SYAM,* NABEEL ALI KHAN,* MICHAEL TURNER, LUIS ENRIQUE AGUADO, 
BEN WALES, LISA GUERRIERO, BARIS TOZ, INCHARA LAKSHMINARAYAN, TOM STACEY, 
MARIA IVANOVICI, TERRI RICHARDSON, GMV

GNSS has provided global positioning, navigation and time (PNT) solutions for many application domains covering safety critical, liability critical and commercial applications. However, because of the relatively low-power signal around -128 dBm and the openness of the signal structures, GNSS signals are vulnerable to jamming and spoofing attacks [1,2]. These attacks significantly disrupt GNSS services, making them unavailable or producing invalid PNT solutions that might cause severe impacts on assets or people using the services. There are various well-known interference and jamming attacks including broadband (such as CDMA) jamming, frequency-hopping jamming, narrow-band jammer, and frequency-sweep or chirp (and pulsed chirp) jamming attacks as well as spoofing attacks ranging from a brute force spoofer transmitting GNSS-like signals at higher power, to meaconing (replay), to aligned or overlapping and sophisticated spoofing attacks [3]. Interference could be non-intentional, such as frequency interference from communication signals, or intentional, such as chirp jamming. Spoofing attacks are most likely intentional. With the growing capability and affordability of software-defined radio (SDR) and advanced spoofing generation algorithms, spoofing attacks have become more significant. Because of this, there is a need to develop a receiver-agnostic and flexible signal cleaner system to increase the resilience of GNSS services in vulnerable environments threatened by GNSS interference and spoofing.

This article aims to develop and demonstrate a receiver-agnostic, real-time signal cleaner system that uses innovative and efficient algorithms for detecting, characterizing and mitigating jamming and spoofing signals. For spoofing, the mitigation focuses on overlapping (aligned) spoofing attacks on the GPS L1 C/A signal. Figure 1 shows the schematic view of the signal cleaner system. In this system, the developed jamming and spoofing detection and mitigation algorithms use optimized signal processing techniques and advanced machine learning algorithms. The system is configurable and uses commercial-off-the-shelf (COTS) components including a GNSS antenna, a high-performance computer for real-time jamming and spoofing detection and mitigation processing, a radio-frequency front-end to receive and transmit GNSS signals, and a downstream commercial receiver to receive and process the mitigated/cleaned signal from the system. The system can operate in real-time up to a 20MHz sampling rate and is designed for flexibility, allowing for seamless integration between a GNSS antenna and a receiver without modifications to the receiver’s existing infrastructure.

Jamming Detection and Mitigation 

The overall jamming detection and mitigation system is composed of two modules a) an interference detection module and b) an interference mitigation module (Figure 2). 

Jamming Detection and Characterization

The interference detection and characterization system extract a) periodicity detection feature and b) frequency modulation features from a segment of received signal to detect and characterize interference (Figure 3). 

Periodicity Detection Feature: The periodicity check is performed to analyze whether the interfering signal is periodic (x[n]=x[n+K]) or aperiodic. A chirping signal can become a periodic signal if the same sequence is repeated over time. However, this is not always the case. In periodic interference, the interfering signal becomes sparse in the frequency domain and appears as a train of impulses (Figure 4). 

To find out whether the interfering signal is periodic or non-periodic, we first transform a given signal of N_F samples in the frequency domain as X[k]=∑_nx[n]e. The parameter N_F is based on the periodicity interval, i.e., K of the interference signal. It should be at least 8 times the periodicity interval of the interference signal, N_F>8K. We detect a M number of strong peaks from the |X[k]|² and store them in Y[k]. The periodicity detection feature is defined as:

In case of periodic interference, F₁ has a higher value whereas for non-periodic interference or noise, F₁ has a lower value. 

Frequency Modulation Feature: Frequency modulated jammers are modeled as J(t)=Ae^{(j∫f(τ)dτ)}, where A is the signal amplitude and f(t) is the instantaneous frequency (IF). To extract the frequency modulation feature, we first employ the adaptive notch filter (ANF) to track the IF curve. The IF information is then used to de-chirp J(t) and the frequency modulation detection feature is extracted based on its covariance matrix. 

The steps to estimate the frequency modulation feature are:

IF estimation: The IF is defined as derivative of the phase of the incoming signal, implying it can be simply estimated as: f₀[n]=∠x[n]x^*[n-1]. The ANF based IF estimation method adopts a recursive approach where a past estimate of the IF is used as a predicted value and phase difference between the current sample of signal and past sample of its bandpass filtered version are employed to correct the predicted IF [4]:

Where u is update rate, x_r [n] is bandpass filtered signal obtained by placing pole close to f₀[n] that suppresses out of the band noise:

Where k_α is filter bandwidth of the control parameter.

Once crude IF is estimated, the refined estimate is obtained by using f₀[n] as the predicted value and performing correction based on the moving average of the phase differences of x[n] and x_r [n-1] as discussed in [4]:

Feature Extraction: Once the IF is estimated, the corresponding instantaneous phase is estimated as: . The estimated instantaneous phase is used to de-chirp the signal as x_c[n]=x[n] e^-j[n]. This de-chirped signal now has high temporal correlation (Figure 5). 

The covariance matrix of x_c[n] is computed as:

In case of a frequency modulated jamming signal, all the elements of R[n,m] will have values significantly greater than zero whereas for GNSS signals, non-diagonal elements would be close to zero. So, the ratio of the sum of diagonal elements of R[n,m] versus the sum of all the elements can be used as a test statistic [4] of F₂ and will have a higher value for pure GNSS signal and a lower value for GNSS signals corrupted by noise, as follows:

Decision Tree based Classification: We trained a machine learning classifier to solve a multi-class classification problem: detecting periodic and frequency modulated interferences. The training dataset is generated by adding interferences to recorded GNSS signals of 100ms duration and 15MHz bandwidth. The following type interferences are used to train the classifier, which are chirp type non-stationary interference and periodic interference. The decision tree is trained using the frequency modulation feature and periodicity feature for the following classes: (1) Periodic interference, (2) Frequency modulated interference and (3) Interference free GNSS signal. The decision tree is presented in Figure 6. 

Jamming Mitigation

The interference mitigation unit employs the outputs of the detection module to select the type of mitigation to be performed. If the interference is frequency modulated, then the IF-based interference mitigation is employed. However, if the interference is classified as periodic interference, e.g., narrow band or CDMA type, then the robust transform domain filtering is employed. If a signal is periodic in the time-domain, e.g., CDMA signal, with period T, then its frequency domain representation becomes sparse with frequency components appearing only at integer multiples of 1/T, (Figure 7). Such interference can be easily removed by applying non-linearity in the frequency domain.

The periodic interference mitigation methods are mentioned in the following steps: 

1. Transform a signal into frequency domain as

where NF is the number of samples in the signal. To effectively mitigate the interfering signal, NF needs to have a higher value as it provides higher frequency resolution to identify bins corresponding to interfering signal. 

2. Apply Huber’s non-linearity:

3. Inverse transform the signal into time domain as:

T_h is a data dependent threshold that is selected so most of the signal energy is passed undistorted and only bins corresponding to the interference are saturated. We know most of the desired signal energy is less than μ+2σ where μ is the mean of |X[k]| and σ is its standard deviation. The strong interference appears as spikes in frequency domain that may bias the estimate of μ and σ, so we use the median in place of mean and median absolute deviation in place of σ. So, the threshold is computed as: T=median (|X[k]|)+2 median (||X[k]|–median (|X[k]|)|).

Frequency modulated interference mitigation is as follows. If frequency modulated interference is detected, then zero-phase notched filter is applied as in [4]: 

• The signal is de-chirped as:

• The notch filter is applied as: g[n]=βg[n-1]+x_c[n]-x_c[n-1]

• The output of the notched filter is flipped: [n]=g[-n]

• The notch filter is applied again:
[n]=k_α[n-1]+[n]-[n-1].

• The output is flipped y_c[n]=[-n]

• The filtered signal is then chirped again: 

Note that unlike the conventional ANF that performs mitigation online on a sample-by-sample basis, this method processes stored buffer of sample in both directions. This forward and backward filtering overcomes the non-linear phase distortions common in the conventional ANF.

Spoofing Detection and Mitigation 

Spoofing Detection

The method of spoofing detection and mitigation focuses on overlapping or aligned spoofing attacks where spoofers code delay is within ±1chip with an authentic signal. This aligned spoofing will significantly degrade the correlator shape of authentic signals and its local pseudorange (PRN) code [6]. Figure 8 shows examples of the correlator shape of an authentic and spoofed GPS L1 C/A signal. When there are no spoofers, the correlator shape is a triangle (at epoch 40s). However, the correlator shape is significantly distorted when an aligned spoofer presents (at epoch 165s). The total correlator taps for spoofing detection and mitigation is selected to be 15-tap considering the correlation resolution for spoofer estimation as well as computational load to satisfy real-time processing. The 15-tap correlators consist of seven taps for both late and early chips, and one tap for the prompt chip. Ideally, correlator tap resolution should be as high as possible to accurately estimate spoofer code delay for spoofing detection and mitigation. Table 1 shows the 15-tap selected to calculate correlation between the GPS signal and its local PRN code.

Spoofing detection is performed using a deep neural network (DNN) model [7] that was selected following a trade-off analysis among support vector machines (SVM) and convolutional neural networks (CNNs). The number of parameters of the three evaluated models are 53, 8,418 and 211,437 for SVM, DNN and CNN, respectively. The SVM model has the smallest model size that cause limitations on spoofing detection accuracy [8]. Meanwhile, the CNN, although capable of automatic feature extraction, has a large number of parameters, making training difficult [7]. The DNN model architecture, shown in Figure 9, is a fully connected feed forward neural network with three-hidden layers with tanh activation functions. The selection of this architecture is to trade-off between detection accuracy and detection speed. These models have been trained and tested with the TEXBAT spoofing dataset [9]. Table 2
presents the details of the dataset for training and testing the three ML models. Ten signals cover the clean and spoofed GPS L1 C/A signal.

The inputs to the ML models are 50 calculated features extracted from the correlator outputs of both GNSS signals. These features include the ratio of partial data bits [10], slope-based ratios [11], simple ratios, sum ratios, difference ratios [12], residuals of correlation functions [6] and the skewness of correlator points. Table 3 details the description of the calculated features as inputs for the ML models.Figure 10 gives examples of the sensitivity of the features calculated on authentic signals and spoofed signals on the selected TEXBAT signal dataset. The calculated features can capture the degradation of correlator shapes calculated when overlapping or aligned spoofers exist (Figure 10).

Spoofing detection is classified into 2-class and 3-class detection. Figure 11 shows the 3-class classification where a correlator output is detected as clean (class 1), overlapping at prompt tap (class 2), and overlapping at non-prompt tap (class 3). Meanwhile, 2-class classification only differentiates between clean (class 1) and spoofed situation (class 2+ class 3). Results of spoofing detection (Table 4) show that 3-class classification has lower detection accuracy than 2-class classification. The DNN model performance, with 3-class training and test accuracy of 99.4% and 98.8% respectively, is the best compared to the SVM and CNN model performance. The CNN, especially for 3-class classification, has the worst performance of training and testing accuracy of only 67.4% and 67.7%, respectively. That may be caused by insufficient data to train CNN large model capacity. Note the data for overlapping at prompt tap is much smaller compared to the other class, clean and overlapping at non-prompt tap.

A total of 200s durations of the clean signal in the TEXBAT data set is used to assess the false alarm rate because the spoofing detection is performed per tracking epoch with 1ms coherent integration time. There is a total of 200,000 data points for the false alarm assessment. The spoofing alarm is raised when there are 30 consecutive spoofing detections. When there is a 10ms duration of spoofing detection, a spoofing alarm rises. The false alarm rate is 0.009 for an open-sky signal with no or minimal multipath effect. For a signal with heavy multipath impairments, such as in dense urban areas, the false alarm rate degraded to 0.015. That’s because the overlapping spoofing phenomenon is like multipath phenomenon in terms of degradations of correlator output shapes.

Spoofing Mitigation

The spoofing mitigation method focuses on recovering an authentic GPS L1 C/A signal from an aligned match-power spoofing attack instead of canceling the signal. The spoofing mitigation algorithm uses an impulse method to calculate the second gradient of correlator outputs of GNSS signals to estimate the code delay of authentic and spoofer signals based on the two largest gradient impulses. The final estimated second-gradient impulse is calculated as a weighted average of three neighbor impulses. In addition, using these impulses, the spoofer’s power and phase are estimated. Subsequently, a negative replica of the spoofer signal is generated and subtracted from the original signal (containing both the spoofer and authentic signals). This subtraction process effectively removes the spoofer signal, isolating the authentic signal component.

The impulse is the second gradient of correlator outputs. The first G¹ and second gradient G² (the impulse) are calculated as follows:

Where Δcorr is the difference between two consecutives correlator outputs and Δchip is the difference between the two consecutive chips. ΔG¹ is the difference between two consecutives first gradient G¹ outputs and Δchip¹ is the difference between the two consecutive chips after the G¹ calculation.

The accuracy of spoofer parameter estimation, especially the spoofer code delay, highly depends on the chip tap resolutions. Small chip tap distance will have high accuracy estimation. However, the smaller the chip tap distance (high accuracy detection), the higher the sampling frequency required. There is a trade-off between high accuracy spoofer parameter estimations and computational requirements to process the sampled signal. Because the numbers of 15-tap correlators are considered sparse, we need to improve and smooth the code-delay estimation by using a weighted-average method. The final estimated code delay (tap location) is:

Where I_i is the 2^nd gradient impulse at the i-th tap index and Tap_i is the i-th tap index. In short, the refined estimate of the code delay or tap location is based on the neighbor’s 2^nd gradient impulse at the tap location to be refined. The spoofer is identified as the largest impulse from the two largest gradient impulses.

From these two decomposed signals, we estimate the spoofer’s power and the IQ carrier phase rotation. The power and IQ rotation θ estimation are as follows:

Where I_p and Q_p are the I and Q correlator output at the p-th tap location (code delay) estimated by the weighted-average of the 2^nd gradient impulse. Power_adjustment is the adjusted power for each decomposed signal that is the ratio of its 2^nd gradient impulse over the total summation of the two highest 2^nd gradient impulse (impulse_i, impulse_j).

Figure 12 presents the impulse from 15-tap correlator outputs calculated from a nominal GPS L1 signal. In nominal conditions, the highest impulse (2^nd gradient) will be at the prompt tap. Simulations of impulse calculation from spoofed GPS signals at various spoofer delays and 60° carrier phase difference between the authentic and spoofer components are shown in Figure 13. The spoofer power is set to be 1.5 × the authentic signal’s power.

Figure 14 shows a simulated GPS L1 C/A spoofed signal, containing authentic and spoofer components, and the implementation of the spoofer mitigation (cleaner) processes where the spoofer component (red) is removed leaving only the authentic signal component (green). The effectiveness of the mitigation depends on how distorted the signal correlator is. To evaluate the mitigation performance, the mitigation method is applied to different tracking epoch (1ms) to TEXBAT dataset signals at different C/N₀. The C/N₀ is used as the signal quality measure. 

Figure 15 illustrates spoofing mitigation performance under different signal C/N₀. From performance test results, the spoofing mitigation can faithfully remove spoofer components and restore authentic components when the C/N₀ is > 40dB-Hz. When the signal has C/N₀ of < 40dB-Hz, the correlator shape distortion is too large, so we cannot faithfully estimate the spoofer parameters and remove the spoofer components.

Implementation of a Receiver-Agnostic, Real-Time Signal Cleaner 

Implementing the signal cleaner fully uses the real-time software approach under the Linux operating system. The main processing unit is a high-performance PC with a multi-core processor. A multi-threading method is used to increase computational speed. However, the processing limitation is the interconnection among multi-cores inside the processor that allows only 40% of the total cores (40 cores) to be used. These internal multicore bottlenecks limit the maximum sampling frequency to operate at 20MHz. Figure 16 shows the schematic view of the developed signal cleaner system. Two receivers are used: “system” and “reference” receivers. The “system” receiver receives the signal after it’s processed by the system and the “reference” signal receives the signal directly from the GNSS antenna used for comparison. A circular buffer system continuously receives (RF), processes (IQ signal) and re-transmits (RF). We use three memory pointers to locate received, processed and transmitted data. In this buffering system, the processing time should be faster than the transmission time to make sure transmitted signal to a downstream receiver is continuous. 

In summary, the final system building blocks consist of a GNSS RF antenna to capture RF GNSS signals (NavXperience 3G+C Reference with 49dB gain with power input < 50mA), RF front-end (RFFE) based on SDR USRP X410 for RF capture and RF reply of GNSS signals, a processing, including storage, unit to process GNSS signals and implement jamming and/or spoofing detections and mitigations (Intel® Core™ i7 20-Core Processor i7 and 64GB RAM) and a GNSS COTS receiver (Septentrio AsteRx SB3 Pro+) as the downstream receiver to process the cleaned signal and provide PVT solutions. 

Figure 17 shows the system’s real setup. After characterizing the RFFE device, an important component, the receiver noise is quantified to be 144.8dBm/Hz. The signal dynamic range of the RFEE is 65-75dB-Hz. Meanwhile, the input power dynamic range (where GNSS signal can be faithfully received) of the RFFE is about 85dBm=–50dBm to 135dBm. The transmitter power output is about 17dBm (at 50dB gain) and, by assuming linearity, the power output is –23dBm (at 10dB gain) and at –33dBm (at 0 dB gain).

Experiment Results 

The system is tested through experimental campaigns using real datasets obtained from Jammertest 2024 in Andøya, Norway (for jamming mitigation) and the TEXBAT dataset (for spoofing mitigation) by using a professional commercial GNSS receiver. The Jammertest dataset covers various types of jammers, including a low-powered chirp jammer, a ramp-up-and-down CDMA jammer, and a narrow-band jammer with a slow-varying center frequency. 

Low Powered Jammer Attack

A low powered pulsed jammer (0.2W) with a clean first 90 seconds is replayed using a Spirent transmitter to both reference and develop a system receiver. Reference receiver performance was tested in two modes: a) internal mitigation on and b) internal mitigation off. Figure 18 (left) illustrates the signal detection performance as well as the Spectrogram of the jammed signal. 

The interference observed in the given signal is pulsed interference. To evaluate the system’s interference characterization performance, we need to compare the system’s output with the ground truth. The interference appears only for a short duration and affects only a few samples, so we obtain the ground truth by dividing the signal into segments of 128 samples computing energy for each segment. If energy exceeds the manually adjusted threshold, interference is said to be detected in the segment. Otherwise, it’s not. The probability of detection by comparing the developed system output with an energy-based detector is 0.98 and the probability of false alarm is 0.08 if the complete signal is used for analysis. However, if we compute the probability of false alarm, the free part of the signal is 0.04. The performance comparison between the system and reference receiver is performed using average C/N₀ (Figure 18, right). 

The interference mitigation results in an approximate 5 dB-Hz gain in C/N₀. Results show internal mitigation offers a 0.25 dB advantage in terms of C/N₀ as compared to block-box during the interference part of the signal. The block-box system itself introduces approximately 1.5 dB distortion in interference in the free part so the block-box algorithm will give approximately 1.25 dB gain if the block-box algorithm is implemented within the GNSS receiver. Table 5 summarizes the impact of interference mitigation on a low powered jammer in terms of C/N₀.

Ramp-up Ramp-down jammer attack

A CDMA type ramp-up ramp-down jammer superimposed on GNSS signals was replayed through Spirent. The jammer power was increased from -37 dBm with a step size of 2dBm to 47 dBm and back. The interference mitigation is performed in real-time using the developed system. The impact of interference mitigation in terms of extraction of position error and average C/N₀ is illustrated in Figure 19. 

Block-box based interference mitigation allows the receiver to track up to power levels of 31 dBm and restarts tracking at 13 dBm. The reference receiver with no interference mitigation can track up to 19 dBm and regain tracking at -3 dBm. The reference receiver with interference mitigation on state loses track around the 15 dBm jammer power level. It restarts tracking at the same time as the block-box based receiver but with a large position error. 

Narrowband Interference

A jammer of power level 50W emitting a continuous wave that drifts from 1545 MHz to 1620 MHz in 15 minutes is added to a GNSS signal of a moving object. The instantaneous frequency of the jamming signal as it appears in the 10 MHz band is illustrated in Figure 20 (left). The developed system classifies the interference as periodic interference and detects it with the probability of detection equal to 0.99 with false alarm equal to 0.0023. The recorded signal is replayed through Spirent. The impact of interference mitigation in terms of the average C/N₀ is shown in Figure 20 (right).

After 14:16, the block box achieves significant improvement over the reference receiver, as the reference receiver fails to estimate C/N₀. The reference receiver’s performance deteriorates as the frequency of the interfering signal comes in the center of the L1 band. However, the GNSS receiver can effectively mitigate the interference and extract the position curve (Figure 21). Without interference mitigation, the complete path cannot be extracted.

Spoofing TEXBAT ds3 dataset

The spoofing mitigation experiments use the TEXBAT ds3 dataset [9], containing a spoofer with 1.3 dB higher power than the authentic signal. In this data set, a spoofer is injected from 120s and the spoofing starts approximately between 150 to 200s. This dataset contains spoofed GPS L1 signals, where a static receiver initially tracks an authentic signal before encountering a spoofer, resulting in a significant shift in the static location for approximately 50 seconds. Figure 22 shows the results of the spoofing mitigation by using the impulse method. The spoofing mitigation shows a reduction in static position error by up to 70% while also improving the duration of position availability. 

Results from both jamming and spoofing mitigation evaluations demonstrate the potential benefits of the developed system in providing clean signals to a wide range of receiver types.

Conclusion and Future Work 

We have demonstrated that the developed real-time and receiver-agnostic jamming and spoofing detection and mitigation system is effective on real-world data. Potential applications for the system include securing GNSS stations that require continuous, jamming- and spoofing-free GNSS signal recordings to provide publicly accessible data, as well as safeguarding receivers for critical assets. The system has been validated using a professional GNSS receiver and a software receiver (GNSS-SDR). The system is flexible and configurable and can be used with different radio frequency front-end and processing unit devices. A novel variant of the developed adaptive notch filter can track fast time-varying chirps because of an additional post-processing step and mitigates interferences without causing non-linear phase distortions by employing zero-phase filtering. The novel spoofer mitigation technique can remove the spoofer component from the TEXBAT ds3 signal. The developed system has certain limitations, including restricted computational speed due to CPU constraints, reduced effectiveness when mitigating interference from multiple equally powerful chirp jammers, and is dependent on the receiver’s ability to initially track authentic signals as well as on specific signal structures for successful mitigation. 

Future work will focus on testing with more spoofing scenarios to improve current mitigation algorithms, integrating feedback from receivers and other sources for spoofing detection and mitigation in wider scenarios and implementing jamming and spoofing detection and mitigation on field programmable grid array (FPGA) for fast processing to create a compact, portable system suitable for a wider range of applications including dynamic environments and moving assets. 

Acknowledgment

This work was funded by the European Space Agency (ESA) NAVISP program under the activity NAVISP-EL1-064: “Block-box for an optimized GNSS spectrum monitoring network using artificial intelligence.” We also acknowledge the support of ESA Technical Officer Luciano Musumeci for his contributions throughout the project. The views expressed can in no way be taken to reflect the official opinion of the ESA. 

This article is based on material presented in a technical paper at ION GNSS+ 2025, available at ion.org/publications/order-publications.cfm.

References

(1) Misra, P, Enge, P., “Global Positioning System: Signals, Measurement and Performance,” 2nd Edition, 2006, Ganga-Jamuna Press: USA.

(2) Kaplan, E.D. and Hegarty, C., “Understanding GPS/GNSS: principles and applications,” 2017. Artech house.

(3) Dovis, F., “GNSS interference threats and countermeasures,” 2015, Artech House.

(4) Khan, Nabeel Ali, and Luis Enrique Aguado. “Adaptive Notch Filter based Interference Characterization and Mitigation for GNSS Receivers.” Proceedings of the 37th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2024). 2024.

(5) Kormylo, J., & Jain, V., “Two-pass recursive digital filter with zero phase shift,” 1974 IEEE Transactions on Acoustics, Speech, and Signal Processing, 22(5), 384-387.

(6) Wesson, K.D., Shepard, D.P., Bhatti, J.A. and Humphreys, T.E., “An evaluation of the vestigial signal defense for civil GPS anti-spoofing.” In Proceedings of the 24th International Technical Meeting of the Satellite Division of the institute of navigation (ION GNSS 2011) (pp. 2646-2656) 2011, September.

(7) Goodfellow, I., Bengio, Y., Courville, A. and Bengio, Y., “Deep learning,” 2016, Cambridge: MIT press.

(8) Murphy, K.P., “Machine learning: a probabilistic perspective,” 2012. MIT press.

(9) Humphreys, T.E., Bhatti, J.A., Shepard, D. and Wesson, K., 2012. The Texas spoofing test battery: Toward a standard for evaluating GPS signal authentication techniques.

(10) Seco-Granados, G., Gómez-Casco, D., López-Salcedo, J.A. and Fernández-Hernández, I., “Detection of replay attacks to GNSS based on partial correlations and authentication data unpredictability,” 2021, Gps Solutions, 25(2), p.33.

(11) Khan, A.M., Iqbal, N., Khan, A.A., Khan, M.F. and Ahmad, A., “Detection of intermediate spoofing attack on global navigation satellite system receiver through slope-based metrics,” 2020, The Journal of Navigation, 73(5), pp.1052-1068.

(12) Negrinho, A., Boto, P., Fernandes, P., Mendonça, V., Nunes, F. and Sousa, F., “Signal Quality Monitoring Aspects in GNSS Signals Affected by Evil Waveforms,” In Proceedings of the 35th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2022) (pp. 3947-3958), 2022, September.

Authors

Wahyudin P. Syam has worked on several ESA projects related to end-to-end GNSS transceivers at low frequency, GNSS spoofing, and machine learning for GNSS applications. His main roles at GMV are GNSS-related system development, software engineering and machine learning.

Nabeel Ali Khan develops digital signal processing algorithms for applications involving signal detection, instantaneous frequency estimation, jammer interference characterization and mitigation, design of time-frequency representation, and positioning using signals of opportunity.

Michael Turner is the lead engineer on several timing and navigation projects. He has published several papers on GNSS spoofing detection techniques and has two related patents in this area.

Luis Enrique Aguado is a Section Head in the Assured and Resilient PNT Division at GMV. With a Ph.D. in digital communication from the University of Manchester, UK, he has been active
in GNSS technology developmentsince 2002.

Ben Wales is a technical expert on GNSS systems and related technologies at GMV. With 20 years of experience in the PNT industry, he has been the architect and lead developer on numerous initiatives covering advanced PNT, snapshot positioning, PPP and signals of opportunity, amongst others.

Lisa Guerriero has a BSc in Automation Engineering from Polytechnic of Milan. With over a decade of experience in embedded systems, she specializes in custom firmware development and real-time GNSS solutions. Since 2019, she has contributed to advanced PNT systems at GMV, with expertise in SDR technologies.

Baris Toz has a MEng in Electronic and Communications Engineering from the University of Nottingham and hands-on experience in embedded systems, software development, and IoT technologies. He is skilled in low-level C programming, hardware-software optimization and system testing.

Inchara Lakshminarayan is a navigation engineer at GMV and works on projects for ESA, DSTL, RSSB etc. on topics such as sensor fusion, integrity, reliability and safety. She holds a double master’s degree and a Ph.D. from the University of Minnesota and has previously worked for the location tech team at Qualcomm, USA.

Tom Stacey has a BEng in Electrical and Electronic Engineering from Newcastle, UK, with a background in hardware design and digital signal processing. Since 2018, he has worked on several ESA projects and contributed to GNSS related systems hardware development.

Maria Ivanovici is a Senior Project Manager at GMV. She is responsible for managing a variety of navigation related projects, ranging from product development to service delivery.

Terri Richardson is the CANS-UK Section Head at GMV, where she works on several projects related to advanced GNSS positioning and integrity for user applications. She received a B.Sc. and M.Phil. in Surveying and Land Information from the University of the West Indies and a Ph.D. in Civil Engineering and Geodetic Science from The Ohio State University. 

*EQUAL CONTRIBUTION

The post Leveraging Advanced ML to Detect and Mitigate Spoofing and Jamming appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Storytelling is the most powerful communication tool we have. Stories can inform and inspire. Stories can also mislead.

The biggest challenges to advancing PNT policy in the U.S. are false and misleading stories around the need for resilient PNT. These myths have frozen the nation in place for decades while our adversaries and allies have made tremendous advances. Here are some of the most pernicious and why they need to be eliminated from our discussions.

1. “GPS/GNSS is enough.” 

Of all the PNT policy myths, at least this one seems to be on the way to being dispelled.

It was certainly solidly in place in 2009. That’s when the National Space-based PNT Executive Committee’s decision to transform Loran-C to eLoran to meet a presidential mandate for a backup was overturned.

Bureaucrats, lobbyists and budgeteers refused to accept that the tens of billions of dollars invested in GPS, admittedly the most important, empowering and beneficial technology in the previous 40 years, hadn’t solved America’s utility-level PNT needs forever.

Today, most officials across the federal government familiar with the problem, including those in Congress, seem to have admitted the problem. Now, the challenges seem to be a lack of clarity about who is responsible for ensuring America has the resilient PNT it needs and how to get there.

This has likely been exacerbated by the abundance of non-GNSS PNT technologies developed in the last two decades. For some, more options seem to have made decisions more difficult.

2. “We have to (or ‘they want to’) replace GPS.”

Only someone deliberately trying to confuse things or who is entirely unfamiliar with the issues would propose “replacing GPS.”

GPS is an amazing system that will be the centerpiece of America’s PNT architecture for decades. There are an estimated 10 to 15 billion user devices across the world, far more than one for every person on the planet. GPS signals are an essential component of innumerable systems and applications. Not maintaining GPS for the foreseeable future is almost unimaginable, and certainly not practical.

Our efforts must be to complement and backup GPS/GNSS with other PNT. One or more widely adopted alternative sources will make GPS and other GNSS safer and more reliable in two ways.

First, it will “get the bullseye off GPS” by making satellites and signals much less desirable targets. If users are not impacted by interference, or impacts are greatly lessened, bad actors will have little reason to interfere. Over time, jamming and spoofing equipment will become less popular, less available and more expensive. A virtuous cycle will begin to nearly eliminate deliberate interference.

Second, users and their applications will be protected in the event of any interference with GPS/GNSS, malicious or not.

Ongoing non-malicious threats to GPS/GNSS also pose significant risk for users. 

Accidental interference, while often low level and benign, is commonplace. Europe’s STRIKE3 project detected more than 450,000 signals that could interfere with GNSS reception. Only about 10% were judged to be deliberate.

And while the probabilities of events like severe solar activity and Kessler syndrome debris damage are low, those probabilities are greater than zero.

Our efforts must be to complement and backup GPS/GNSS, not replace it.

3. “More study is needed.”

During World War II, America’s Office of Strategic Services published its “Simple Sabotage Manual” for agents embedded in adversary governments. It advised “Whenever possible refer all matters to committees for further study and consideration.”

While having more information is almost always good, looking for more when you already have enough is a classic way to avoid making decisions and taking action.

America’s growing over-dependence on GPS was formally recognized in a 1998 Presidential Decision Directive by President Bill Clinton. This resulted in the Department of Transportation’s Volpe Center producing a report in 2001 that validated a variety of concerns. It also predicted jamming and spoofing would be growing problems and recommended maintenance of terrestrial PNT capabilities.

Unfortunately, the report published only a few days before 9/11. So, it wasn’t until 2004 that President George W. Bush issued a mandate for a GPS backup. This, of course, generated another study. 

But rather than be guided by the results of that study and others and fulfilling the mandate, subsequent administrations have continued to admire the problem.

There have been more than enough studies of GPS’s vulnerabilities and technologies that can provide complementary and backup services. Major efforts have included DOT’s 2001 Volpe report, a paper by the Institute for Defense Analysis in 2009, an extensive DOD/DHS/DOT analysis in 2014 (never made public), and another report by DOT in 2021.

And yet government PNT studies and analyses continue.

Again, continually increasing our store of knowledge is good, if that is what’s happening. But merely understanding the problem better will not solve it.

Two and a half decades of studies with similar findings are enough to inform action. 

Leadership’s next steps must be establishing performance requirements for America’s resilient core PNT architecture and empowering an executive agent to ensure that architecture is put in place.

4. “It’s all about infrastructure protection.”

“Infrastructure protection” has been a buzz phrase for decades. Infrastructure is important and we must protect it with resilient PNT. That won’t do the whole job, however, because what we really want is a secure and prosperous nation.

National security means domestic resilient PNT to underpin non-
infrastructure applications like Golden Dome, UAS operations, Counter-UAS operations, the many applications used by the defense industrial base, first responders, and the list goes on. 

Likewise, there are far more contributors to the nation’s economy and prosperity beyond just infrastructure. Everything from the corner coffee shop and Uber drivers to complex factory SCADA systems need PNT.

Every American contributes to the economy in some way, and everyone needs PNT. If their PNT is not resilient, the economy and our prosperity are on a knife’s edge. 

Protecting infrastructure is necessary, but not sufficient.

5. “We just need to educate users.”

In 1964, the Surgeon General formally warned Americans about the dangers of smoking. At that time, 42% of Americans were smokers. In 1972, after eight years of warnings and education, 43% of Americans were smokers.

There is a big gap between knowing something and acting on that knowledge.

President Bush formally identified America’s lack of PNT resilience as a problem in December 2004 (and mandated a solution). President Trump issued Executive Order 13905 in February 2020 warning GPS users to get their own backup systems. Yet, in 2026 the nation’s PNT does not seem to be much more resilient.

Changing Americans’ PNT habits will require effort and expense, but most importantly leadership. Members of the National Space-based PNT Advisory Board, attendees of the September 2025 PNT Leadership Summit, and others have all concluded that leadership is the missing piece to addressing resilient PNT in the U.S.

6. “The government needs to build a GPS backup system.”

Nope. The government should not build anything. It should lead and, leveraging competition and America’s commercial sector to its best advantage, ensure something is built.

The government’s responsibility is to ensure Americans have easy access to a backup system and that it is widely adopted. There are several ways to do that including regulation, legislation, allowing public use of a system built to support government missions (ala GPS), and sponsoring a system in part or in whole.

If the latter method is selected, the process must include fair and open competition. 

There are numerous mature and commercially available PNT systems that can be had as services. Once the government establishes performance requirements, it will be a relatively simple matter to let a multi-year service contract. Competition against clear requirements will eliminate the need for endless studies and provide the best value for the public dollar. 

A long, expensive, and painful government major system acquisition must be avoided at all costs.

7. “The market will provide the GPS backup America needs. Government doesn’t need to do anything.”

This is probably the most insidious of all the myths because it speaks to traditional American values of limited government and market economics. Yet, it shows a fundamental misunderstanding of the nature of GPS and PNT.

Some misunderstanding might be due to the existing and thriving market in specialized PNT services for high demand users. When there is a business case, commercial users do regularly pay for resilient PNT. Farmers subscribe for precision agriculture. Day traders pay for resilient nano and picoseconds. Shipping terminals contract for systems that place containers within millimeters.

But GPS, while it began as a military weapons system, quickly became a public utility. One that is integrated with and benefits every aspect of the economy. Government-provided utilities are not easily subject to market forces.

Where is the business case? Why would a potential PNT provider build a national system and try to get consumers to purchase what the government is already giving them for free? 

And what would be the national benefit?

Even if such a company was to somehow survive, would enough Americans subscribe to really protect the economy from a long-term GPS outage? Would having a system that only a fraction of Americans accessed be enough to deter our adversaries from interfering or threatening to interfere with GPS and gain advantage over America?

The United States government has provided utility-level navigation since the formation of the Lighthouse Service in 1789. It has provided timing since the Naval Observatory began dropping a noon time-ball in 1845. Leaders understood that PNT is a fundamental economic driver. That’s why the Department of Commerce’s shield still features a lighthouse and why the department hosts the nation’s civil time scale at the National Institute of Standards and Technology. 

GPS is merely the most recent way the government has provided America with utility-level PNT, and it has been spectacularly successful at boosting the economy.

Claiming the government has no role or responsibility for providing a utility-level backup capability for GPS might be an honest misunderstanding.

It might also be a way some commercial interests are trying to advance their own fortunes. 

It might be how some government officials are trying to shirk what they see as difficult responsibilities.

Regardless, such claims are false and misleading. They continue to harm the nation and increase the risk to America’s security and prosperity.

The post 7 PNT Policy Myths  appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Today, the department may well be in the process of developing one or more resilient PNT systems to support defensive capabilities that will also benefit civil users.

Metro Golden Domes

In a recent paper [1],  the National Security Space Association (NSSA) outlined how resilient PNT is essential to the success of the President’s Golden Dome initiative. 

In the popular imagination, Golden Dome is a virtual shield of systems protecting the U.S. from intercontinental ballistic missiles, hypersonic drones and the like. Much less well known is the project’s “inner, limited area, layer” to protect against UAS launched from American soil or just beyond our borders. 

The NSSA paper describes this part of the project as “Metro Golden Domes.” They will be, according to many experts, much easier and less expensive to create than the system being designed to protect the whole county. Technologies to support these smaller scale systems are already commercially available, many from multiple vendors. While some integration of components may be required, protecting military bases and cities from drone attacks will not require the kinds of technological advances needed to “hit a bullet with a bullet” and reliably destroy incoming hypersonic missiles.

A Single Point of Failure

One challenge that must be overcome for all the nation’s Golden Dome efforts to succeed, according to the NSSA paper, is America’s over-reliance on GPS. 

The paper highlights three specific areas where more resilient, less deniable and less spoofable, PNT is required for Golden Dome success:

Intelligence, Surveillance and Reconnaissance (ISR) and Sensor Platforms. As outlined in the paper, “Detecting and tracking adversarial systems in-flight can be challenging, and PNT solutions are critical to determining the ‘where’ and ‘when’ vital in ensuring effective intercept information in all phases of potential adversarial attacks.”

Precision-Guided Interceptors. Whether it is a 100 foot-long Russian ICBM, or a 2 foot-wide drone with 10 pounds of explosive, defensive systems must strike difficult-to-hit targets. Precise timing is also essential to synchronizing various intercept system components.

Command and Control Systems. Communication systems rely on precise timing for multiplex operations. IT systems need timing for synchronization and data tagging. PNT is essential for common operational pictures and other situational awareness tools.

NSSA’s paper concludes with several recommendations for General Michael Guetlein, Space Force’s leader of Golden Dome. They include clearly articulating requirements, establishing an organization and leader for Golden Dome PNT, developing user equipment early, and establishing a “PNT improvement budget” with the goal of “deploying improvements within the next three years.”

The paper’s conclusion also pleads for a focus on integration, highlighting the interconnectedness of all components and their reliance on PNT as an invisible tech utility: 

“Integration across systems that Golden Dome is dependent upon, systems that protect Golden Dome, and Golden Dome specific systems are essential to avoid electronic fratricide, system interference, and degraded system performance. Each of these systems is dependent upon common PNT frequencies, signals and enablers that Golden Dome will also seek to defeat in an adversary system. The adversary will also be employing counter-PNT systems, and those adversary systems must be thwarted.”

A National Core Resilient PNT Architecture

GPS and one or two easily adoptable complementary and backup PNT systems could constitute a national core resilient PNT architecture. Senior administration officials and policy documents have periodically called for systems to complement and back up GPS for the last two decades. In 2018, Congress enacted legislation requiring the Department of Transportation to establish a terrestrial timing system to help back up GPS.  

Yet, highly diffused responsibility for civil PNT within the administration and the absence of a broad public demand for solutions has meant little progress. At the same time, America’s principal adversary, China, has established a highly effective and resilient PNT architecture that includes multiple satellite constellations, terrestrial broadcast, and hundreds of synchronized timing stations connected by 20,000 kilometers of fiber. 

Golden Dome may provide the opportunity to overcome America’s bureaucratic challenge with PNT. The DoD is not responsible, nor does it budget for, systems to benefit and protect domestic infrastructure and applications. Yet a defense capability, like GPS, can also support civil users. 

Highly resilient PNT is a key enabler for Golden Dome and for making a host of civil applications—autonomy, transportation, IT, telecom, and the like—more reliable and scalable. As Golden Dome solves its resilient PNT needs, it should also benefit civil users, making America even more efficient, safe and secure. 

References 

1. “Resilient PNT is Vital to Golden Dome Success” https://www.c4isrnet.com/opinion/2020/07/20/gps-interference-crashed-a-survey-drone-in-the-uk-will-the-debate-resonate-in-the-us/

The post Golden Dome and PNT  appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

In Ernest Hemingway’s “The Sun Also Rises” Mike is asked how he went bankrupt. His response: “Two ways, gradually and then suddenly.”

It is increasingly obvious that GPS is falling behind when compared with the European Union’s (EU) Galileo and China’s BeiDou Navigation Satellite System (BDS). There are many opinions as to why, but one theme echoed by many is it’s because GPS was first. It has the least modern signal designs and therefore has the least capabilities. 

Requirements to maintain backward compatibility impose heavy burdens on any attempts at modernization and so, we fail to progress, weighed down by a half century of legacy baggage. The opportunity costs are immense. The L1 C/A signal was designed 53 years ago, has numerous deficiencies, and still, a 45-year-old receiver will operate with current broadcast signals (or spoofing variants). I’m of the opinion that software defined radio (SDR) architectures present an opportunity to escape the tyranny of unbounded backwards compatibility—but only if carefully managed. 

The SDR Opportunity 

At this year’s ION GNSS+ plenary, the European Space Agency’s (ESA) Marco Falcone, when asked about future directions for Galileo, observed that ESA needs to better coordinate with receiver manufacturers. Thinking about it more deeply, when both satellites and receivers are SDR, it presents important opportunities to better manage the retirement of obsolescent or failed signals and, instead, move toward a paradigm of continual and planned improvement cycles. Installed hardware can stay the same because signal upgrades are software upgrades. This is particularly true with civil signals, as the associated receivers are mostly connected, minimally via a USB port. The “PNT solver” in your cell phone is mostly an SDR.

Using the PC industry as a parallel, specific signals might have minimum required SDR capability. Think of minimum A/D conversion rate, minimum number of correlators, minimum required RF memory, etc. And of course, there needs to be requirements for hardware authentication of software loads and machine-readable signal specifications [1] using an industry standard like the trusted platform module (TPM). Similarly, like an OS, generous advance warning as to when support for a particular signal release is ending, such as we are turning it off or we are upgrading the message format, and so forth. 

A Different Approach 

Looking toward the cellular industry for inspiration, they recognized they had a serious innovation problem more than 30 years ago. Two important outcomes were the genesis of SDR and the standardization of release cycles. Every 2 years, there is a “major release” where specifications for new capabilities are rolled out. The process has been phenomenally successful, leading to several orders of magnitude improvements in data rates. The 3G signal, state of the art in 2001 when first broadcast, was decommissioned in 2022. Staged improvements within each generation pay more attention to backwards compatibility but again, the lifetime of a signal is limited. Each generation is an opportunity to revitalize the enterprise.

At this point, many of you may be thinking this approach may work for cellular but not for safety critical PNT systems requiring onerous certifications. Think of commercial aviation. A 2-year major release cadence is probably too fast, but what about 5 years or 10 years? I think it is doable but requires a considered approach. 

Toward this end, signal modifications fall into roughly 3 categories:

1. Backwards Compatible: These are modifications that are fully backwards compatible with receivers designed to use prior signal generations. Examples include new message types for data authentication, code puncturing for range authentication ala. Chimera, emergency warning services ala. Galileo’s Emergency Warning Satellite Service, and so forth. 

2. Digital Impact: This is where digital aspects of a signal are redesigned to achieve an important objective but with the caveat that the modulation format is not changed. A BPSK(1) signal remains BPSK(1), but without the burden of backwards compatibility. Using GPS as an exemplar: 

• Except for L1C, the forward error correction (FEC) on civil signals is antiquated. L1 C/A doesn’t have FEC at all and the non-interleaved convolutional codes used on L2C and L5 offer greatly inferior performance when compared with 4G and 5G FEC standards (TS36.212 and TS38.212 respectively). Substantial performance gains in scintillation, rapid fading, pulsed interference and in Eb/No are possible. Bit rates can be increased to support enhanced message content. 

• The Keplerian curve fit representations developed in the 1970s provides point solutions for satellite position given time. Much better, bit-efficient, long-term orbit representations are now available [2] where medium Earth orbits (MEO) can be accurately conveyed for up to a week with less than 1-meter errors at the end of the week. Propagating the orbit forward in time requires more computations, but when combined with active clock steering on the satellite, using such a representation can have major impacts on receiver power consumption because regular data reading is not required. Occasional snapshots collecting a few milliseconds of RF are fine for many applications, such as asset monitoring, IoT applications and hiking.

• Short code sequences have been good for acquisition but bad for structured interference response. L1 C/A code is efficiently jammed using structured Gold code jamming. Longer codes and/or concatenated secondary sequences offer major improvements and can be handled readily by modern receiver designs.

3. Analog Impact: Changes to a signal’s modulation format or its center frequency have direct impacts on a receiver or transmitter’s interaction with the signal and with the environment. Multipath characteristics shift. Filter effects shift. Antenna effects on observables like carrier phase and pseudorange also shift, especially when using CRPAs. Any changes to a signal’s format that impact analog characteristics need to be considered very carefully but not out of hand rejected. OFDM, CPM and multi-h formats[3]have great merit, but tread cautiously. 

Returning to a prior point, what is a failed signal? L2C was first broadcast in 2005 with CNAV messaging starting in 2014. It has seen limited adoption mainly because it is in a less protected frequency band and because the L5 signal is more capable in dual frequency applications. L2C is not a bad design, it just doesn’t provide a distinct capability. Rather than continue with L2C, I would argue for an L2 signal that does something different. For example, a secure ranging signal for civil users to use in spoofing mitigation, authentication and proofs of location.

I would also add there is no substitute for live sky testing. SDR development paradigms have repeatedly shown the power of being able to fix design flaws by changing the signal structure. Operational SDR satellites can broadcast experimental and regional signals as part of their transmit portfolio. Design flaws can be worked out in the laboratory of real life. Without SDR, it can take years to fully understand operational weakness in a signal’s design. With SDR, you can fly it before you buy it.

Future Proofing 

GNSS operators must find a way to provision for continual improvement. The ideas presented here are in nascent form, but I do believe they point toward a way to break the tyranny of backwards compatibility. The GPS Block III satellites are expected to be 35 years on orbit. Needs and requirements change much faster, witness the “sudden need” for civil signal authentication. SDR offers a mechanism for future proofing, but only if we employ carefully engineered approaches for managing and fielding innovation. We must adapt, or face technical bankruptcy, first gradually, then suddenly. 

References 

(1) Sanjeev Gunawardena “A High Performance Easily Configurable Satnav SDR for Advanced Algorithm Development and Rapid Capability Deployment,” ION ITM 2021 https://doi.org/10.33012/2021.17808.

(2) Oliver Montenbruck et.al. 2020, DOI: 10.1002/navi.404 “A long-term broadcast ephemeris model for extended operation of GNSS satellites.”

(3) Logan Scott, “Continuous Phase Modulation for Navigation” ION JNC2017.

Author

Logan Scott has over 45 years of military and civil GPS systems engineering experience. He is a consultant specializing in radio frequency signal processing and waveform design. Logan has been an active advocate for improved civil GPS location assurance for over 20 years and was the first to describe how civil navigation signals could be authenticated using delayed key concepts central to the Chimera signal. For the past 10 years, he has been developing advanced signal concepts, including Chimera for NTS-3, AFRL and the University of Colorado. He is a Fellow of the Institute of Navigation and a Senior Member of IEEE. He received ION’s Weems award in 2022 and the Kepler award in 2025 and is a member of the National PNT Advisory Board. He is the author of “Interference: Origins, Effects, and Mitigation in PNT21” and holds 46 U.S. patents.

The post Thoughts on Leadership: Escaping the Trap of Backwards Compatibility appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Forty miles from the nation’s Capital, a closed-door convening of operators, engineers, program leaders and policy architects from both sides of the Atlantic arrived at a shared conclusion: The United States must stop defending a single PNT source and begin stewarding a resilient architecture. That shift—from reliance to resilience—demands governance that certifies trust, authentication embedded within both data and devices, and layered modalities proven to coexist in the real world. It also calls for coordinated integration steps that operators can advance now.

The inaugural PNT Leadership Summit, co-hosted by Inside GNSS+ and the Resilient Navigation and Timing Foundation, gave industry thought leaders an opportunity to openly discuss the many challenges facing PNT and how to best address them—urgently. This is the PNT Leadership Summit’s record in full: what participants agreed upon, what operators require and how strategic posture becomes operational practice.

Setting the Scene: When Confidence Slips, Systems Stall

It did not look like catastrophe. It looked like drift—at scale.

On an ordinary weekday over Europe, dispatchers watched confidence margins ripple across air routes. No airport went dark; instead, trust eroded—quietly, then widely. Crews re-briefed arrivals, spacing widened, alternates were opened. 

In the Baltics, autonomous rubber-tired gantries at the Port of Gdańsk—core assets in a multi-billion dollar modernization—dropped out of precision modes in bursts that operators associated with activity out of Kaliningrad. Offshore, a wind-farm contractor halted survey and cable-lay work because five-centimeter tolerances dissolved into guesswork. These were not headline “outages.” They were worse for business: degraded confidence. In time-synchronized, safety critical industries, degraded confidence is outage.

“Availability is not the bar anymore,” an airline systems engineer told the room during the summit. “Trusted availability is.”

The summit returned to the same fulcrum: Single-source certainty has collapsed. Threats are cheap, clever and deniable. Dependencies have deepened into automation and synchronization. Stewardship is fragmented. The remedy is not to declare GPS “broken,” but to stop asking a single modality to carry national trust alone. The United States must move from defending a signal to assuring a system—a layered architecture blending protected and modernized GNSS, authenticated messages, terrestrial timing, inertial continuity, low Earth orbit (LEO) signals, and operator-visible monitoring.

This architecture already exists in pieces. The task is to knit it into practice—quickly enough that ports, airlines, rail operators, telecoms, emergency services and national security customers can run on confidence they can demonstrate, not merely assume.

Why Now: The Transition from Dependence to Resilience

For decades, GPS was both capability and assumption. The comfort of ubiquity displaced the discipline of resilience. Researchers at the summit noted European interference events—well-known and long-standing—have increased in both frequency and duration, with degradations reaching up to 10 dB and showing patterns consistent with sustained jamming and intermittent spoofing activity. Whether accidental or deliberate, the operational effect was the same: confidence dropped, and the costs cascaded into scheduling, safety buffers and throughput.

A port automation executive put it plainly: “We either make layered assurance boring and baseline, or we keep treating risk as a surprise.”

Across multiple sessions during the summit, practitioners reframed the problem. The nation is not defending signals; it is defending a dependency. That dependency runs through aviation separation minimums, rail signaling, port logistics, grid operations, wireline and wireless synchronization, public safety dispatch, financial sector time-stamping, and even basic intermodal 
logistics. You don’t solve it by hardening a single source; you reduce the operational damage from jamming and spoofing by embedding diversity beneath trust.

During the summit, seven strategic pillars emerged that can serve as guidance as we move from a single-modality system to an assured architecture with multiple layers of resilience. 

STRATEGIC PILLAR 1: Recognizing the Inflection Point

Summit participants discussed the three forces that have converged to put an end to single-modality comfort: 

1. Threat accessibility has collapsed. It no longer takes a national lab to trigger operational disruption: jammers are inexpensive, spoofing tools are portable, and on-orbit anomalies propagate through the same timing chains that sustain modern infrastructure. Yet, the burden of proof in live operations remains uncomfortably high. Before classifying an event as interference, operators must rule out equipment faults, atmospheric effects or coincidence—an analysis requiring multi-sensor data and time they rarely have. Declaring a jamming or spoofing incident carries operational and political consequences, so confirmation thresholds remain higher than the pace of impact. The result is a paradox: Disruption is easy to cause, but difficult to prove quickly enough to act on.

2. Dependency has deepened. Precision and synchronization are no longer enhancements; they are the substrate of modern operations. Throughput, safety and efficiency across sectors now depend on continuous, trusted time and position. The models behind these systems presume stability—and when that stability falters, delays, buffers and uncertainty ripple through everything built upon it.

3. Stewardship has fragmented. The responsibility to sustain confidence has diffused across agencies, sectors and vendors—each accountable for its own slice of performance, but not for the coherence of the whole. Aviation, maritime, telecom, energy and defense each buy to their own standards, test to their own tolerances, and report to their own regulators. The result is a patchwork of compliant subsystems that do not add up to an assured architecture. When governance is scattered, trust becomes everyone’s assumption and no one’s assignment.

The inflection point is not rhetorical. It is operational. A breakdown in availability is no longer required to create national risk; a breakdown in trust is sufficient. In real fleets, real towers and real control rooms, trust is the throttle.

“If confidence dips, we slow,” a tower manager said. “Slow is safer. Slow is also expensive.”

STRATEGIC PILLAR 2: Governance as the Foundation of Resilience

The summit’s most surprising agreement was not technical. It was institutional. The gap is less about invention and more about locus. When responsibility is scattered, risk is inherited rather than reduced. Participants converged around a governance spine with three parts:

1. A Clearinghouse that certifies trust, not brands. The Department of Transportation’s (DOT) complementary PNT action plan lays out a pragmatic arc: stakeholder engagement; specifications and standards; instrumented field test ranges (rapid → continuity → gap-fill); and a federal PNT Services Clearinghouse that lets agencies and critical infrastructure buyers procure fitness-for-purpose solutions against actual operating profiles and threat models.

The first tranche of rapid testing covered mature satellite- and ground-based offerings. A follow-on tranche adds modalities such as ELORAN and additional timing systems. Measures of effectiveness are sharpened with each run. Results feed the Clearinghouse first as a government resource; industry visibility will grow as standards and formats harden.

A government program lead summarized the intent: 

“Normalize claims into comparable evidence. Tie standards to tested behaviors. Give buyers a map.”

2. Centralized test and certification that travels. Participants argued for a certification regime that is mission-tiered rather than monolithic: certify to the threat model, the use case, and the failure consequences—not to the most exacting edge case. Standards bodies like the Society of Automotive Engineers (SAE) and others are already active; the ask is to couple standards work to test ranges and a government-facing database so procurement offices can act on schedules that make sense.

An industry veteran put it in old-school terms: 

“Underwriters Laboratories changed product safety by testing to standards, not slogans. Do that for PNT.”

3. A portfolio-based governance and an escalation path—not a czar. This point required deliberate clarification during the summit. The group agreed: A “PNT czar” is a quick-fix temptation that historically fails. It centralizes symbolic responsibility without structural authority, invites bureaucratic resistance, and creates a sense among senior leaders that the problem has been “assigned” rather than addressed. But a governance home—an accountable locus—is essential.

A collaborative leader with authority, funding and an interagency mandate is necessary to:

• maintain the portfolio of complementary PNT systems,

• adjudicate interagency conflicts,

• escalate through the National Space Council or National Security Council when needed, and

• synchronize standards, funding and release cadence across departments.

The resolution is simple: Avoid the czar model, but establish a empowered stewardship—multi-agency, portfolio-based, and backed by budget signals that endure.

Policy Reality 

Inside the Executive Branch, the real levers are familiar: NSpC, NSC, OSTP, OMB, and cross-council groups that blend security, commerce and infrastructure. The advice from those who have worked inside these bodies was blunt: arrive with a plan, certification evidence, and a budget number that signals seriousness.

On Capitol Hill, churn and committee fragmentation dilute long-term memory. Vehicles like the NDAA can carry language, but only if the ask is unified, costed and tied to mission need. The National Timing Resilience and Security Act is a cautionary tale: mandates without champions, authority and funding fade into reports.

Governance, in other words, is the foundation. Everything else depends on getting it right here.

STRATEGIC PILLAR 3: Architecture Over Capability

A backup you cannot compose operationally is theater. The architecture view treats diverse sources as composable trust, not ornamental redundancy.

Authenticate the Data

Europe’s Open Service Navigation Message Authentication (OSNMA) is now operational for Galileo’s open service. The next step—Signal Authentication Service (SAS) on E6—aims to extend authenticated signaling further. One EC engineer cautioned that receiver makers must implement authentication correctly: “Do it poorly and you’ve bought false security. You’ll feel safer but won’t be.”

Harden GPS Receivers Via Data Rails

Summit participants pointed to Europe’s authentication service as a model. A comparable service for GPS, they argued, could raise robustness, accuracy and spoof resistance even for civil receivers. Such authenticated data rails form the connective tissue of an architectural approach—linking satellites, networks and receivers through verifiable trust. The U.S.’s National Space-based Positioning, Navigation and Timing Advisory Board has been advocating for such a system for years. In 2023 they even produced a white paper “GPS High Accuracy and Robustness Service (HARS),” outlining how it could be done using exisiting government data and resources. The obstacle is the needed data and resources exist across several government departments. Without an effective advocate, breaking the stovepipes has been impossible.The call from the room was clear: “Someone in government needs to stand it up and make it happen.”

Diversity as Architecture, Not Redundancy

LEO PNT improves signal strength through geometry and refresh; terrestrial time delivers provenance and independence; inertial continuity bridges gaps; signals of opportunity (SOOP) complicate jammers’ lives; cross-links and optical links raise integrity and monitoring. All of them protect it by making it less of a desirable target while protecting users by ensuring loss (or doubt) in any one source does not collapse the system.

“Continuity arises from plurality, not reinforcement,” a national-lab engineer said. “If the architecture does its job, no single path carries trust alone.”

STRATEGIC PILLAR 4: Integration as Invention

The bottleneck is not ingenuity. It is integration—and much of what matters can move now. Summitt participants called to:

• Set L5 healthy and move through aviation certification. Multiple voices labeled L5 a near-term priority for both performance and resilience. Aviation wants a clean path to operational use.

• Unrestrict nulling/multi-element antennas. A 19-element array that can dull multiple jammers is not science fiction. Several attendees urged removing remaining civil constraints so high-exposure sectors can field proven anti-jam techniques legally and at scale.

• Finish and field the Operational Control Segment (Next Generation GPS Control System), known as OCX. Program leaders described formal test phases under way. The goal is a seamless command-and-control cutover with better integrity behaviors and modern cybersecurity—so end-users notice nothing except improved assurance.

• Stand up an augmentation server. One architect priced a backbone network—feeding sovereign ephemeris—at roughly $25 million to stand up and $15 million per year to operate. That’s compared to $400 million for a single satellite block and about $6 billion for a control segment. For a fraction of the cost of a next-generation satellite, a modest terrestrial backbone could deliver years of measurable resilience and interoperability.

• Adopt software defined receivers (SDR)—with discipline. Software-defined architectures plus satellite cross-links make the system more updateable, monitorable and integrity-aware. They also require governance guardrails—version control, conformance testing, provenance for updates—so agility does not become chaos.

A participant from the user community offered the cultural nudge the program world needed: “Behave like the cellular industry—major releases on a cadence. No more learned helplessness.”

STRATEGIC PILLAR 5: Adoption as Infrastructure

Resilience is real where operations live. Three adoption vectors dominated the discussion:

1. Build the common operating picture. DOT elements, Space Force teams and the FAA are knitting data and tools—National PNT Architecture Synchronization (NPAS), the GNSS Operational Awareness Tool (GOAT), academic toolchains like SkAI—toward a picture operators can actually use. A retired official urged the group to “call the GOAT team—keep it moving toward a public-facing view.” The idea is simple: Give ports, railroads, airlines, and telcos visibility into the environment they operate in—interference seen, anomalies flagged, confidence quantified—so they can adjust before incident reviews.

2. Map your dependencies; rehearse your response. Critical National Infrastructure (CNI) owners were told to build connectivity maps showing exactly where and how GNSS/PNT enters systems, and then to write mitigation playbooks for each failure mode: jam, spoof, degrade, ambiguous confidence, loss of authentication, and so on. Color-code by severity and time-to-response. Then run fire drills—tabletop and live—annually. 

3. Sector exemplars (the difference between theory and practice)

• Aviation is framing continuity and authentication as safety properties: If confidence dips below well-understood thresholds, the system responds automatically.

• Ports/maritime are shifting from vessel-only augmentation to port-scale assurance, treating timing as throughput infrastructure. Yard management systems, quay cranes and autonomous vehicles all need synchronized trust.

• Rail/surface operators are pairing inertial with terrestrial timing to stabilize signaling and automation during RF anomalies.

• Telecom is formalizing multi-sourced time and provenance in contracts, audits and change-control practices. In several cases, time Service Level Agreements (SLAs) are being written in language that chief risk officers can live with.

“Expectation—not mandate—is what converts resilience into default behavior,” a port CTO said. “But nothing changes until the cost of fragility is visible.”

STRATEGIC PILLAR 6: Making Resilience Routine

Pillar 6 is where governance becomes practice—the point at which layered assurance stops being innovative and starts being expected. If Pillar 2 builds the spine, Pillar 6 establishes the behaviors that run along it.

• Certification that travels. A government-facing Clearinghouse, fed by instrumented ranges and linked to consensus standards, provides portable, comparable evaluations. Procurement officers can specify mission-tiered requirements and reference actual performance, not marketing claims. This reduces bespoke one-offs and shortens time to field.

• Tailored requirements. Stop forcing every system to meet the highest-consequence use case.

• Timing distribution for the grid

• Sub-meter positioning for ports

• Centimeter-class precision for aviation or robotics

Each has different threat models and failure consequences. Mission-tiered certification acknowledges this and lowers barriers to adoption.

• Public-private collaboration that accelerates scale. Venture-backed firms and new entrants need clear on-ramps—evaluation tiers, reciprocal testing windows, and export-control relief where appropriate—to turn innovation into infrastructure.

• Insurance and risk pools. Insurers and reinsurers remain largely unaware of PNT fragility because losses have not been priced. Engagement with Lloyd’s and others—paired with operator attestations (dependency maps, drill logs, provenance checks)—can shift behavior faster than statute. If a port can prove layered continuity and rehearsed response, its premiums, covenants and board expectations change. 

Normalization happens when:

• Certification is portable

• Provenance is contractual

• Integrity is measurable

• Dependencies and drills are expected

This is where continuity stops being exceptional and becomes the baseline.

A broadcast executive in the room volunteered airtime for public education and incident reporting. “Awareness follows consequence,” he said. “Let’s show the public what resilience looks like before the teachable moment.”

STRATEGIC PILLAR 7: Securing Long-Term Resilience

Pillar 7 is about durability—ensuring resilience can’t be unwound without re-creating systemic risk. Governance builds the structure; normalization creates the habit; institutionalization embeds both into policy, budgets and operational identity. 

1. Sustain governance through long-term budget commitments. 

Governance establishes responsibility, authority and structure. Long-term resilience requires stable, multi-year funding so the governance functions created in Pillar 2—testing, certification, monitoring and integration—remain viable across budget cycles. Recurring appropriations prevent core resilience mechanisms from eroding or reverting to discretionary status.

2. Maintain plurality as policy.

Plurality—independent and diverse sources of timing, position, authentication and monitoring—must be maintained as an ongoing policy requirement. This prevents the system from drifting back to single-modality dependence as programs change or budgets tighten.

3. Align resilience with legislative and regulatory windows. 

Several resilience actions depend on timing. Effective institutionalization requires aligning PNT initiatives with specific legislative or regulatory windows, such as air-traffic-control modernization or sector rulemaking cycles, so that durable language and requirements can be incorporated when those windows open.

4. Apply international models where relevant. 

Other nations provide working examples of how institutional resilience can be maintained. The UK’s National PNT Office, national timing center, multi-year performance targets, vendor-interrogation tools, and structured Prepare→Act →Recover framework demonstrate practical approaches for embedding resilience in operations and governance.

International Lessons

Brexit forced the UK to reset. Out of Galileo and the European Geostationary Navigation Overlay Service (EGNOS), they stood up an in-government National PNT Office, partnered with the Royal Institute of Navigation, and funded a national timing center—“hundreds of millions,” one official said—with a three-year horizon to sub-five-meter performance. They coupled policy with working tools:

• A three-phase Prepare → Act → Recover best-practices guide with a strong bias toward testing in “Prepare.”

• A 10-point questionnaire CNI buyers can use to interrogate vendors’ resilience claims—what’s your authenticated path, your inertial continuity story, your timing provenance, your failure modes?

• Workshops that build muscle memory: mapping dependencies, running drills, writing playbooks, and—crucially—sharing mistakes after incidents so others improve.

The tone was never triumphalist. It was practical. “We’ll bring the training,” the UK team said. “You bring the process owners and a whiteboard.”

Modernization, Authentication and Partnership

No one argued to “out Galileo.” The argument was for assurance and partnerships. Participants want to: 

• Use Galileo’s global monitoring to authenticate GPS L1 C/A data—technical readiness near 2027, subject to coordination.

• Define and budget a Resilient GPS (RGPS) concept that includes modern civil signals and yields early benefits even as requirements mature. Today, there is no dedicated RGPS line; tomorrow there should be a plan that starts small, proves value, and expands in annual releases.

• Keep L5 on a glidepath to “healthy” and move through aviation certification steps.

• Harden the user segment without delay—multi-element antennas, practical anti-jam measures, authentication support in receivers—legally available to civil sectors that need them most.

An architect made the analogy many found helpful: “Think of GPS as the core stack. Authentication, terrestrial time, LEO geometry, inertial continuity—these are the libraries you link. The outcome isn’t a prettier core; it’s a system where no single import can crash the program.”

Terrestrial, LEO and Time: Widening the Trust Base

The most encouraging technical trend was the breadth of credible contributors to trust:

• ELORAN has moved from panel talk to projects. Miniaturized receivers were demoed in Singapore; a standardization push for aviation and maritime is under way; transportable systems are being invited to ranges for testing.

• LEO PNT efforts emphasized inner-satellite and optical links as enablers of timing and ephemeris robustness. Allied partners—Canada, Austria, Australia—are treating LEO not as a novelty but as a backbone element for integrity.

• National timing cells bring timing provenance into the same sentence as safety and throughput. In the UK case, sustained funding and a three-year target forced clarity: who operates it, who certifies it, how it’s measured in daily service, and how it fails safe.

These contributions are not about showcasing superiority; they are about minimizing shared modes of failure. By diversifying geometry, timing and authentication paths, we make adversaries’ work harder and our own systems more sustainable.

Transition to Execution: Build → Normalize → Institutionalize

The PNT Leadership Summit closed with an implementation arc designed to be simple yet difficult to derail: Build what already works, normalize it into expectation and institutionalize it so it can’t be unwound without re-creating systemic risk.

PHASE 1—Build

• Flip L5 to healthy status and push through the aviation steps.

• Remove civil constraints on nulling/multi-element antennas in high-exposure sectors; publish guidance on configurations and legal use.

• Stand up the augmentation server (the inexpensive backbone that feeds sovereign ephemeris and “safe use” rails for foreign GNSS).

• Advance GOAT/NPAS toward a public common operating picture that operators can actually action.

• Start authentication at scale (use OSNMA where available; prepare receivers and operations for E6 SAS).

PHASE 2—Normalize

• Launch the central test and certification facility; publish mission-tiered certification tracks that align to sector safety cases and threat models.

• Require dependency maps and annual fire-drills in regulated CNI (ports, telecom, aviation first), with reporting that insurers and auditors can rely on.

• Bake provenance and integrity SLAs into public procurement and regulated-vendor contracts; make “multi-sourced time” and “authenticated position” measurable.

• Align insurer and lender covenants to reward layered deployments and penalize opaque dependencies and untested plans.

PHASE 3—Institutionalize

• Create (or designate) a federal stewardship structure—portfolio-based, with budget and acquisition authority—to sustain architectural resilience across domains.

This is not a “czar” model; it requires coordinated, long-term leadership backed by senior officials and durable funding to ensure resilience remains a standing national requirement.

Closing Synthesis: Resilience Becomes Imperative

The PNT Leadership Summit did not diminish GPS; it clarified its position as essential but insufficient. The system the nation depends on is broader than any single signal or constellation. Confidence will grow only when trust is distributed, authentication is routine, time is verified, continuity is assured, testing is standardized, guidance is clear, and funding is stable. The community is not satisfied with the current state, nor should it be. Yet the alignment of views expressed throughout the summit reflects a rare moment of clarity. Resilience has shifted from concern to obligation. The task now is to deliver it—deliberately, transparently and with long-term responsibility. 

The post PNT Summit Report 2025: Tackling Urgent PNT Challenges appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

In many situations, the biggest threat is not the biggest risk. Failure to understand that and focusing on what appears to be the most pressing concern can lead to disaster.

A classic example is flood preparedness in New Orleans before Hurricane Katrina. 

The biggest flood threat to the city has always been frequent intense rains from tropical and other storms. These often overwhelm the city’s stormwater management system. Streets and low-lying areas typically flood for a few hours, though sometimes it takes a day or more for the system’s pumps and drains to catch up. This happens so frequently it has become a fact of life. Residents have adapted by avoiding low areas and protecting their property as much as possible.

Yet, New Orleans’ biggest flood risk has always been a Category 5 Hurricane overtopping and destroying levees. While these storms only strike once every hundred years, their impact is devastating. 

Before Katrina, New Orleans had guarded against its greatest flood threat, but not its greatest risk. When Katrina struck, that error cost 3,000 lives and $125 billion in property damage.

PNT Threats and Risks 

Localized GPS jamming and spoofing is the biggest threat to PNT services in America and Europe. Local and regional jamming and spoofing has become a fact of life and users are adapting by altering their behavior and, in some cases, upgrading equipment. 

The biggest risk to PNT services is by most reckonings some form of long-term GNSS denial. Not the widespread, relatively low impact interference seen today. Yet, it’s been a challenge for Western governments to act to avoid a Katrina-like PNT disaster spread across multiple continents, a disaster it will take decades or more to recover from. 

Risk Assessment

Structured risk assessments are one way to help leaders and their support staff focus on these kinds of issues.

At a high level, most methodologies assess risk from a potential adverse event as the product of threat: the probability of the adverse event; vulnerability, or the degree the impacted system or population is likely to suffer damage; and consequence, which is the amount of damage likely to occur if no mitigations are in place. Expressed as an equation:

The risk equation for potential malicious acts is slightly more complex. Threat is defined as the probability a bad actor can commit the act (capability) multiplied by the probability the bad actor will actually carry out the act (intent). This makes the risk equation for malicious acts:

Risk Assessment Challenges

Barriers to risk assessment include: 

Estimating consequences. A significant obstacle to analyzing larger potential events is the difficulty of predicting consequences. For example, the pre-Katrina estimate of potential storm damage was less than 10% of what actually occurred.

Widespread, long-term GNSS denial is a much larger potential event and estimating consequence is much more problematic. 

A good example of this is a 2019 study sponsored by the U.S. government examining the economic impact of losing GPS. It found an outage would cost the national economy $1 billion per day. While, at first glance, that seems a large number, it represented less than a 1.7% reduction in Gross Domestic Product (GDP). This is a very low consequence for a technological utility described by a member of the U.S. National Security Council as “a single point of failure” for the nation. By comparison (though admittedly not entirely analogous), a 2021 power outage in Texas cost $28 billion a day and 57 lives over a week. 

It may not be possible to accurately predict and quantify the damage major societal disruptions cause. Multiple types of impacts, the interconnectedness of infrastructures, and the variety of human responses are highly complex and may be unknowable. 

Non-quantifiable consequences. The biggest challenge, perhaps, is many impactful consequences can’t be quantified. What cost can be assigned to a government collapsing, to a nation being coerced, or the loss of prestige and influence with other nations?

These challenges might make risk assessment seem not worth it, but it is. The more impactful the potential outcomes, the more important it is for leaders to take a deliberate, thoughtful approach. 

PNT Risk: Long Term GNSS Denial

The risk of long term GNSS denial is such a case. While good quantitative data may not be available or very difficult to obtain, there are things we know about the different elements of this risk equation. These help tell an impactful story and should inform decision-making.

Threat: Various possible adverse events can result in GNSS not being available to Western nations for extended periods or indefinitely. They include: 

Severe Solar Activity: Researchers predict powerful solar events that can disrupt signals for days or destroy satellites occur once every 200 to 300 years. While these events are very low probability, the probability is greater than zero. 

Electronic Warfare/ Cyber: The West’s adversaries have impressive terrestrial electronic warfare and cyber capabilities and are demonstrating them every day. These capabilities are also being moved into spaces where they are even more impactful. The non-zero probability of long-term GNSS denial to the West as the result of heightened world tensions, an autocrat’s whim, or open conflict amongst world powers must be considered.

Kinetic+: Several nations have or are developing capabilities to damage or destroy GNSS satellites. Press reports about Russian space-based nuclear weapons, Chinese satellite proximity operations, directed energy weapons, and the like show these must be considered in the overall risk.

Western Weakness: In November 2021, while preparing to invade Ukraine, Russia destroyed one if its defunct satellites with a ground-based missile. The next day, state media claimed that if NATO crossed Russia’s “red line,” Moscow would shoot down all 32 GPS satellites and blind the alliance. This may or may not have influenced U.S. policy and subsequent actions. Shortly after Russia’s public statement, though, the U.S. administration announced it would not send certain types of aid to Ukraine to “avoid provoking a Russian invasion.” A continued lack of PNT resilience in the West opens the door to further attempts at coercion. 

Vulnerability: Most Western nations have no systemic PNT alternatives and are vulnerable to the loss of GNSS. While some alternate timing and location capabilities are in place for some applications, widely available, easily adoptable alternatives are not. If access to GNSS was denied long term, the probability of significant damage is very high.

Consequence: The impact of long-term GNSS denial on Western nations would be severe. GNSS signals have been incorporated into virtually every infrastructure and most IT applications. Dependencies and linkages are so numerous, complex and intricate, a complete quantitative assessment of impacts is likely unattainable.

Qualitative consequences would almost certainly include severe economic disruption, civil unrest, and greatly reduced ability to field and support military operations—all contributing to domestic instability and enabling adversaries to dictate terms and otherwise influence events on the global stage.

What’s it Worth?

The threat of long-term GNSS denial to the West is greater than zero. Deciding how much greater is a matter of subjective judgement that will vary from person to person depending on their knowledge, background and biases. Yet, all must agree the probability must be considered.

Vulnerability is also a subjective and difficult judgement. How do we estimate the degree infrastructure, individual users, security forces and economies, are already protected? Is the West 90% vulnerable? Perhaps 80%? It is another unknowable number, but thinking about it and testing some hypotheses is important.

Consequence may be the most difficult element of the equation. What are the monetary and non-monetary costs of major societal disruptions? Are there meaningful ways to express them?

Perhaps a better way to look at the public policy question is to ask “what’s it worth?” How much are we willing to spend to reduce this risk? How should we spend it to get the maximum reduction? 

Some companies say they can provide a national terrestrial PNT system to complement and backup GPS for less than $90 million a year. Presumably, the government could then better encourage and, perhaps in some cases, mandate greater resilience. What would the risk reduction be? Is it worth the cost?

Mitigation: No silver bullet

It is never possible to eliminate risk, but there are ways to reduce it. Users can purchase better equipment and access alternative sources of time and location when able. Companies can better understand the criticality of PNT, their use of GNSS, and try to improve resilience. 

At the national level, we all must help leaders understand PNT is essential. Over-relying on GNSS poses unacceptable risk, setting the stage for disaster. 

A former boss of mine once said, “Good public policy is hard work…but only if you do it.” We need to get busy and do it.

The post Washington View: PNT Threats, Risks and Disaster  appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

KEIDAI IIYAMA, SAM PULLEN AND GRACE GAO, STANFORD UNIVERSITY

Interest in establishing a sustainable human presence on the Moon has grown significantly in the last 20 years, with more than 200 missions planned over the next decade. To support these activities, robust positioning, navigation and timing (PNT) services are essential both on the lunar surface and in orbit. NASA and its international partners are developing a “network of networks” known as LunaNet designed to provide communications, PNT, detection and science services across the lunar environment [1].

This article reviews current proposals for LunaNet and its international partners: Moonlight (ESA) and LNSS (JAXA). It examines the technical challenges faced by lunar PNT and highlights emerging solutions from Stanford’s Navigation and Autonomous Vehicles (NAV) Lab, including orbit determination and time synchronization (ODTS) algorithms, spreading code design, differential carrier-phase techniques, rover navigation, and autonomous fault monitoring.

LunaNet PNT Services

LunaNet envisions two classes of PNT services:

• Point-to-Point (P2P) Navigation, which delivers PNT through direct communication links between a provider and user. 

• Lunar Augmented Navigation Service (LANS), which broadcasts navigation signals—augmented forward signals (AFS)—to lunar users. LANS is the lunar counterpart to terrestrial GNSS.

To provide these services, a lunar system must overcome fundamental challenges in constellation design, ODTS, and navigation message definition. 

Key Challenges in Lunar PNT

Lunar PNT systems must address several unique challenges compared with terrestrial GNSS:

Orbital Dynamics and Satellite Geometry

Terrestrial GNSS relies on circular orbits that provide stable, global coverage. Around the Moon, however, strong third-body perturbations from Earth destabilize most circular orbits, requiring frequent station-keeping. Early deployments will also prioritize coverage of the lunar South Pole. Elliptical Lunar Frozen Orbits (ELFOs), which offer long-term stability under three-body perturbations and continuous South Pole visibility, are strong candidates for navigation satellites.

Satellite Orbit Determination and Time Synchronization (ODTS)

Accurate ODTS is essential for LANS, as errors directly propagate into user equivalent range error (UERE). Current requirements specify 40 m (95%) for position and 10 mm/s (95%) for velocity. Terrestrial GNSS achieves ODTS using ground monitoring stations distributed worldwide, but establishing an equivalent network on the Moon is prohibitively expensive in the early stages of LunaNet. Alternative frameworks must therefore rely on Earth-based ground stations or onboard ODTS approaches (e.g., exploiting GNSS sidelobe signals).

Ephemeris Message Definition

Navigation satellites broadcast orbital parameters (ephemerides) that allow users to compute satellite positions at any desired epochs. Terrestrial GNSS ephemerides are based on Keplerian elements with harmonic corrections. For lunar orbits, however, more appropriate parameterizations are required to accurately capture elliptical, perturbed trajectories while minimizing ephemeris message size. 

Reference Frames and Time Scales

Terrestrial GNSS is referenced to Earth’s geoid and GPS time. Lunar PNT requires definitions of both a geodetic reference frame and a standard time scale. Two frames are currently in use—the Mean Earth (ME) frame and the Principal Axis (PA) frame—but a single standard must be adopted or a new one established. For time reference, LunaNet proposes to define LunaNet Reference Time (LRT), aligned with the AFS signals, which will link to Coordinated Lunar Time (LTC) referenced to the lunar geoid.

Operation and Integrity Monitoring

Navigation services for safety-critical applications, such as lunar landings and human surface operations, require robust integrity monitoring. As with terrestrial GNSS, signal quality can degrade due to satellite clock drift, unflagged maneuvers, payload failures, or code–carrier incoherence. These anomalies may be detected at surface monitoring stations, onboard satellites, or by receivers using Receiver Autonomous Integrity Monitoring (RAIM). However, in the near term, lunar systems will face limited surface stations and sparse satellite visibility, complicating the application of existing integrity monitoring methods.

Receiver-Side Algorithms

Receivers must also adapt to lunar constraints. With only one or two satellites visible during early deployments, rovers cannot rely on standard snapshot solutions requiring four or more signals. Instead, receiver algorithms must integrate navigation signals with onboard sensors (e.g., IMUs, cameras) to achieve reliable localization.

Satellite Navigation Systems under Development: LCRNS (NASA), LCNS (ESA) and LNSS (JAXA)

Lunar navigation capability is being advanced in parallel by NASA, ESA and JAXA. Each agency is preparing to deploy satellites broadcasting Augmented Forward Signals (AFS) in support of the LANS. NASA’s Lunar Communication Relay and Navigation System (LCRNS), ESA’s Lunar Communications and Navigation System (LCNS) under the Moonlight program, and JAXA’s Lunar Navigation Satellite System (LNSS) will serve as the first AFS providers under the LunaNet framework.

To ensure interoperability, the agencies are coordinating through the LunaNet Interoperability Specification (LNIS), which defines common standards for service interfaces, navigation messages, and time references. The most recent update, LNIS Version 5, establishes the baseline requirements for interoperable lunar PNT services [2].

Satellite Orbits: Initial Focus on Lunar South Pole

The first operational service volume targets latitudes south of 70° up to an altitude of 200 km, reflecting the high-priority needs of lunar South Pole missions. To minimize satellite numbers while maintaining coverage and long-term orbital stability, LCRNS and LNSS plan to deploy spacecraft in elliptical lunar frozen orbits (ELFOs). ESA’s first Moonlight satellite, Lunar Pathfinder, will also be positioned in ELFO to provide early relay and navigation services.

Assets for Operation

Each agency is developing supporting infrastructure for orbit determination (OD), time synchronization (TS), and system operation:

NASA (LCRNS): 

LCRNS satellites will carry the LCRNS PNT Instrument (LPI), consisting of a GPS receiver, stable clock, and an onboard ODTS filter that estimates position, velocity and clock offset. In May, the LuGRE mission successfully demonstrated the tracking of GPS and Galileo signals in lunar orbit and on the lunar surface. NASA also plans to establish three Lunar Earth Ground Stations (LEGS) at White Sands Missile Range (WSMR) in the U.S., South Africa and Western Australia, enabling direct-to-Earth communication. With pseudorandom noise ranging and 1-/2-way X-band Doppler tracking, LEGS will support both user services and ODTS of lunar satellites.

ESA (LCNS): 

ESA has proposed ATLAS (Advanced Tracking and Location Architecture for the Moon), a dedicated tracking and timing network that integrates ground and potential lunar assets. ATLAS aims to deliver orbit and clock accuracy at the tens-of-meters and nanosecond levels, respectively. ESA also plans NOVAMOON, a differential reference station near the lunar South Pole, designed to provide decimeter-level accuracy across the region. Equipped with a Mini-RAFS clock and laser retroreflector, NOVAMOON will also serve as a lunar time and geodetic reference.

JAXA (LNSS):

JAXA plans to leverage GNSS sidelobe signals for orbit determination and synchronization, reducing ground dependency and enabling autonomous navigation in cislunar space.

Signal Design

According to the LunaNet Signal-in-Space Standard (LSIS) [3], the AFS will be broadcast at 2,492.028 MHz (2,436 times the GPS L1 C/A-code signal chipping rate), harmonized with legacy GNSS frequencies. The AFS comprises two channels:

In-phase (I) channel: A 1.023 Mcps Gold-coded BPSK sequence of length 2046, carrying data for low-complexity access. Compared with GPS C/A code, it offers an acquisition gain of ~3 dB and a tracking gain of ~1 dB.

Quadrature (Q) channel: A 5.115 Mcps BPSK pilot (no data) using a Weil sequence of length 10,230, optimized for high-precision tracking and applications such as lunar landing and surface navigation.

The navigation message uses a 250-bps data rate (5 × GPS C/A) with 1,200-bit blocks (4 × GPS C/A), providing greater flexibility for future integrity and safety-of-life services and supporting diverse lunar ephemeris representations.

Research Efforts at the Stanford NAV Lab

Lunar PNT is an active research area across many groups in academia, government and industry. Here, we focus on our ongoing research at the Stanford NAV Lab led by Prof. Grace Gao.

ODTS

NAV Lab has investigated time transfer and orbit determination algorithms for lunar navigation satellites using GNSS sidelobe signals. These signals offer a way to reduce reliance on terrestrial ground stations, but their performance is limited by (1) poor geometry (signals arriving from nearly the same direction), (2) unmodeled biases from Earth’s ionosphere and plasmasphere, and (3) large thermal noise on pseudorange measurements. To overcome these challenges, NAV Lab has pursued the following research directions:

• Feasibility study of using GNSS signals: Bhamidipati et al. first showed it is feasible to use GNSS signals for lunar satellite time transfer by developing a timing filter to correct clock estimates via intermittently available terrestrial-GPS signals [4]. She then performed case studies to analyze trade-offs among various grades of clocks and lunar orbits [5]. This enabled her to conceptualize the design of a SmallSat-based Lunar Navigation and Communication Satellite System (LNCSS) with GPS time-transfer that provides navigation and communication services near the lunar South Pole [6]. 

• Time-differential carrier phase (TDCP): TDCP measurements can cancel most slowly varying delays and provide millimeter-level range-rate accuracy. Iiyama et al. demonstrated that, by jointly processing pseudorange and TDCP with adaptive state noise compensation and a cycle slip detector, significant performance improvements were achieved [7].

• Sensor fusion with complementary measurements: Vila et al. investigated fusing GNSS sidelobe signals with inter-satellite ranging and optical navigation (horizon detection from onboard cameras). This diversifies measurement geometry and reduces dilution of precision [8].

• Modeling ionospheric and plasmaspheric delays: Iiyama et al. analyzed GNSS signal delays in lunar orbit using the Global Core Plasma Model (GCPM). Results show that main-lobe signals grazing Earth’s ionosphere (tangential altitudes below ~1,000 km) can experience delays up to 100 to 200 m, highlighting the importance of bias mitigation [9].

Ephemeris Design

Ephemeris parameterization for lunar navigation satellites must strike a balance between high-accuracy orbital representation and compact message size. The latest LSIS requirements specify 40 m (95%) position accuracy and 10 mm/s (95%) velocity accuracy, with about 900 bits available for ephemeris data in each navigation frame.

We presented one of the earliest studies on ephemeris parameterization for lunar orbits (ELFO and LLO), proposing Chebyshev polynomial representations [10]. By tuning the polynomial degree, the trade-off between fitting accuracy and message size can be optimized. The study showed feasible representations covering more than half an ELFO orbital period exist, particularly near apoapsis, making Chebyshev polynomials a strong candidate for operational ephemeris encoding.

Spreading Code Design

We developed efficient methods for designing families of binary spreading codes [11]. We cast code design as minimizing a convex function of the codes’ auto- and cross-correlation values, subject to constraints. We propose a bit-flip descent algorithm capable of quickly finding codes with good correlation properties. We also show the problem of optimizing over subsets of code entries while keeping others fixed can be formulated as a mixed-integer program. This approach enables block coordinate descent methods that can, in each iteration, simultaneously optimize over tens of code entries more quickly than brute force search. 

We also extended this approach to account for Doppler effects by optimizing an expected objective over a continuous frequency distribution. We evaluated our methods on examples that include Lunar ELFO constellations. Our methods matched or exceeded more sophisticated baselines, including natural evolution strategies, genetic algorithms, and classical Gold/Weil codes. 

Single-Satellite Doppler-Based Positioning (Endurance Mission)

For missions preceding full deployment of LANS AFS, alternative navigation strategies are required. One case is NASA’s Endurance rover, which will traverse ~2,000 km across the lunar far side. Coimbra et al. investigated rover localization by opportunistically exploiting Doppler shifts from the Lunar Pathfinder’s communication downlink, despite the spacecraft lacking a dedicated navigation payload [12]. Results showed that with Doppler-only navigation, the Endurance rover can achieve sub-10 m average positioning accuracy (when stationary) within two orbital periods of Lunar Pathfinder, providing a promising solution for early surface missions.

Clock Fault Detection Using Rigid Graphs

Integrity monitoring is critical for lunar navigation systems, which must detect and exclude faulty satellites. In [13], NAV Lab designed a clock fault detection algorithm using inter-satellite ranging, independent of prior ephemeris or lunar surface monitoring (both of which may be unavailable in early deployments). The method models the constellation as a graph, where satellites are vertices and inter-satellite links are edges. A malfunctioning onboard clock’s phase jump introduces range biases that make the graph unrealizable in 3D space. By searching for redundantly rigid subgraphs (rigid even after removing any vertex) and evaluating the singular values of Euclidean distance matrices from measured ranges, faulted satellites can be isolated and excluded.

Mapping and Path Planning for Lunar Rovers

Lunar rovers face hazardous, unstructured terrain and extreme lighting conditions that degrade perception. To advance autonomous navigation, NAV Lab participated in the NASA Lunar Autonomy Challenge managed by APL under the Lunar Surface Innovation Initiative (LSII). The challenge used a high-fidelity simulator (Unreal Engine + CARLA) with realistic rover dynamics and photorealistic lunar terrain. NAV Lab developed a full-stack autonomous agent integrating semantic perception, stereo visual odometry, pose-graph SLAM with loop closures, and hierarchical path planning [14]. The system achieved robust mapping and localization across diverse simulated conditions, culminating in a first-place finish in the final competition evaluation.

Open-Source Simulator Development (LuPNT)

To support the growing lunar PNT research community, NAV Lab has developed LuPNT, a comprehensive open-source simulation framework [15]. Implemented primarily in C++ for efficiency and with Python bindings for usability, LuPNT integrates astrodynamics, communication, and PNT modules in a unified platform. Key capabilities include ODTS of lunar satellites using GNSS signals, lunar constellation and contact-plan design, inter-satellite link analysis, and surface navigation simulation via Unreal Engine. LuPNT provides a flexible, extensible toolset to accelerate algorithm development and mission design for LunaNet and future lunar PNT systems.

Summary

A reliable lunar PNT system is rapidly becoming a necessity as space agencies and industry plan hundreds of missions to the Moon. NASA, ESA and JAXA are leading with early deployments of interoperable LANS providers under the LunaNet framework, standardized through the LunaNet Interoperability Specification (LNIS). These initial constellations—leveraging elliptical frozen orbits, ground stations, GNSS receivers, and new signal designs—represent the first steps toward a sustainable lunar navigation architecture.

At the Stanford NAV Lab, research is addressing the core technical challenges of this emerging system: orbit determination and time synchronization, ephemeris representation, autonomous fault detection, and rover navigation. Open-source simulation efforts such as LuPNT further support algorithm development and mission design. Together, these deployments and academic innovations are laying the foundation for a robust lunar PNT infrastructure to enable sustained human presence on the Moon. A future column will provide more details on several of these research efforts. 

References 

[1] D. J. Israel, et al., “LunaNet: a Flexible and Extensible Lunar Exploration Communications and Navigation Infrastructure,” 2020 IEEE Aerospace Conference, Big Sky, MT, USA, 2020, pp. 1-14, doi: 10.1109/AERO47225.2020.9172509.

[2] LunaNet Interoperability Specification, Version 5, February 2025. https://www.nasa.gov/directorates/somd/space-communications-navigation-program/lunanet-interoperability-specification/

[3] LunaNet Signal-in-Space Recommended Standard, February 2025.  https://www.nasa.gov/wp-content/uploads/2025/02/lunanet-signal-in-space-recommended-standard-augmented-forward-signal-vol-a.pdf?emrc=0f6993

[4] Sriramya Bhamidipati, Tara Mina and Grace Gao, Time Transfer from GPS for Designing a SmallSat-Based Lunar Navigation Satellite System, Navigation: Journal of the Institute of Navigation. September 2022, 69 (3); DOI: 10.33012/navi.535. 

[5] Sriramya Bhamidipati, Tara Mina and Grace Gao, A Case Study Analysis for Designing a Lunar Navigation Satellite System with Time-Transfer from Earth-GPS, Navigation: Journal of the Institute of Navigation. December 2023, 70 (4); DOI: 10.33012/navi.599.

[6] Sriramya Bhamidipati, Tara Mina, Alana Sanchez, and Grace Gao, Satellite Constellation Design for a Lunar Navigation and Communication System, Navigation: Journal of the Institute of Navigation. December 2023, 70 (4); DOI: 10.33012/navi.613.

[7] K. Iiyama, S. Bhamidipati, and G. Gao, Precise Positioning and Timekeeping in Lunar Orbit via Terrestrial GPS Time-Differenced Carrier-Phase Measurements, Navigation: Journal of the Institute of Navigation. March 2024, 71(1); DOI: 10.33012/navi.635.

[8] G. C. Vila and G. Gao, Sensor Fusion for Autonomous Orbit Determination and Time Synchronization in Lunar Orbit, IEEE Aerospace Conference, Big Sky, MT, March 2025

[9] K. Iiyama and G. Gao, Plasmaspheric Delay Characterization and Comparison of Mitigation Methodologies for Lunar Terrestrial GNSS Receivers, Proceedings of the Institute of Navigation GNSS+ conference (ION GNSS+ 2025).

[10] M. Cortinovis, K. Iiyama, and G. Gao, Satellite Ephemeris Parameterization Methods to Support Lunar Positioning, Navigation, and Timing Services, Navigation: Journal of the Institute of Navigation. December 2024, 71 (4) ; DOI: 10.33012/navi.664. 

[11] A. Yang, T. Mina, and G. Gao, Spreading Code Sequence Design via Mixed-Integer Convex Optimization, Navigation: Journal of the Institute of Navigation. September 2025, 72 (3); DOI: 10.33012/navi.706.

[12] K.  M. Y. Coimbra, M. Cortinovis, T. Mina, and G. Gao, Single-Satellite Lunar Navigation via Doppler Shift Observables for the NASA Endurance Mission, Navigation: Journal of the Institute of Navigation. September 2025, 72 (3); DOI: 10.33012/navi.710.

[13] K. Iiyama, Daniel Neamati, and Grace Gao, Autonomous Constellation Fault Monitoring with Inter-satellite Links: A Rigidity-Based Approach, Proceedings of the Institute of Navigation GNSS+ conference (ION GNSS+ 2024), Baltimore, MD, Sep 2024.

[14]  A. Dai, A. Wu, K. Iiyama, G. C. Vila, K. M. Y. Coimbra, A. Carlhammar, B. Wu, and G. Gao, Full Stack Navigation, Mapping, and Planning for the Lunar Autonomy Challenge, Proceedings of the Institute of Navigation GNSS+ conference (ION GNSS+ 2025), Baltimore, MD, Sep 2025.

[15] G. C. Vila*, K. Iiyama*, and G. Gao, LuPNT: An Open-Source Simulator for Lunar Communications, Positioning, Navigation, and Timing, IEEE Aerospace Conference, Big Sky, MT, March 2025.

Authors

Keidai Iiyama is a Ph.D. candidate in the Department of Aeronautics and Astronautics at Stanford University advised by Prof. Grace Gao. He received his M.E. degree in Aerospace Engineering in 2021 from the University of Tokyo, where he also received his B.E. in 2019. His research is on positioning, navigation and timing of lunar space- craft and rovers, and system designs for lunar navigation systems. 

Grace Gao is an associate professor in the Department of Aeronautics and Astronautics at Stanford University, leading the Navigation and Autonomous Vehicles Laboratory (NAV Lab). Her research is on robust and secure positioning, navigation and timing with applications to manned and unmanned aerial vehicles, autonomous driving cars, as well as space robotics.

The post Can Satellite-based Radionavigation be Extended to the Moon and Other Extraterrestrial Bodies? appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.