Cold War shortwave numbers stations broadcast strings of digits to anonymous listeners, content that’s meaningless to anyone without a matching one-time pad. They still operate today.

As it turns out, GPS broadcasts in much the same way.

Buried in every L1 C/A navigation message is Subframe 4, Page 17—a 176-bit field that IS-GPS-200 reserves for “special messages with the specific contents at the discretion of the Operating Command.” Every satellite broadcasts it. Every receiver decodes the subframe that contains it. And for nearly two decades, no one has publicly explained what it contains.

We analyzed 12.16 million observations in this field from 2007 through early 2026. The content is not text. It is encrypted material consistent with the military’s Over-the-Air Distribution (OTAD) global rekeying network. For 19 years, every operational GPS satellite has been a numbers station—broadcasting ciphertext on a public channel, to billions of receivers, in plain sight.

If you build receivers, write firmware, run signal monitoring, or care about the gap between civil and military signal transparency, this is your field too. You just have not been reading it.

What follows is the story of how a forgotten 176-bit slot in the world’s most successful navigation signal turned out to be its quietest and most consequential broadcast—and how a few weeks of analysis on a laptop, applied to 19 years of public archive data, was enough to read its operational history off the bytes.

176 Bits, Eight Words, One Forgotten Page

The L1 C/A signal carries 50 bits per second. Every bit must earn its place. The Legacy Navigation message organizes those bits into 1,500-bit frames, each frame into five 300-bit subframes, each subframe into ten 30-bit words. Subframes 1 to 3 carry the heavy work—clock corrections, ephemeris, the data your receiver needs every few seconds. Subframes 4 and 5 multiplex 25 rotating pages. A receiver sees Page 17 of Subframe 4 every 12.5 minutes.

Across 32 satellites, that is roughly 3,700 special-message payloads per day, fleet-wide. Multiplied across 19 years and the global ground-station archive, the figure climbs to 12.16 million observations.

176 bits is barely enough for a few floating-point numbers, but in a 50 bps signal, it is roughly 12% of every Subframe 4 broadcast. For the control segment to use that bandwidth consistently for two decades implies the content matters—even if no civilian receiver has ever rendered it.

Figure 1 shows how the bits are arranged. The 176-bit payload is fragmented across Words 3 to 10 of Subframe 4, Page 17: 16 data bits in Word 3 (after eight bits of Data ID and SV ID = 55, the marker that identifies Page 17), 24 data bits in each of Words 4 to 9, and 16 data bits in Word 10. The final six bits of every word carry the parity bits. After parity stripping and reassembly, the 22 bytes of payload are decoded under a subset of Code Page 437.

Mining 19 Years of Navbits

The corpus comes from the GFZ Potsdam open archive GNSS recordings collected from a wide network of ground stations, dating back to 2007. After extraction, the numbers settle: 12.16 million observations of Subframe 4, Page 17, drawn from every operational PRN, spanning 19 years, yielding 3,994 unique 176-bit messages.

Initial Python implementations needed hours to process a single year. To make iterative analysis practical, we wrote a Julia pipeline: NetCDF source files are converted to Apache Arrow, then thread-parallel bit extraction is performed into a DuckDB database. The full 19-year corpus extracts in seconds on a laptop. SQL across the lot returns in milliseconds.

With 12.16 million payloads in a queryable database, the question becomes: What does this field actually contain?

It Is Not Text. It Never Was.

The first thing a researcher tries in an unknown field is the obvious one: maybe it is text in a different encoding. We computed the frequency of each of the 45 alphabet symbols defined by IS-GPS-200 across all 12.16 million observations. In English, frequencies have a fingerprint—E and T are common, J and Z are rare, spaces and full stops are more common than digits. In a uniform random stream, each of the 45 symbols should appear with probability one in 45—about 2.22%.

The observed frequencies tracked the uniform baseline with remarkable precision. A chi-squared test against uniform yielded a z-score of 1.84, well inside the range where we cannot reject the null hypothesis of randomness. Across 12.16 million observations, the distribution is statistically indistinguishable from random data.

A stronger test asks the same question from a compression angle: How much information does each unique message contribute, given the others? An order-8 PPM-D compression model trained on the full corpus measures the marginal entropy of each payload—the additional cost, in bits, of encoding that message given everything else the model has seen. Real text would compress: Any recurring phrase, formatting block, or repeated formula would become almost free to code. Random data would not. Figure 2 plots the resulting distribution alongside a synthetic random baseline of 3,994 messages drawn uniformly from the 45-symbol alphabet and scored against the same model. The two distributions overlap almost perfectly, with means within half a bit of each other. By every available statistical lens, the GPS messages are almost indistinguishable from random, but there are intriguing outliers. At the lower end, messages are much more predictable than you would expect from random data; at the higher end, sentinels stand out from the rest. 

In Figure 2, blue indicates the marginal coding cost of each of the 3,994 unique 22-byte payloads under an order-8 PPM-D model trained on the corpus (μ≈131.5 bits per message≈6.0 bits per byte, σ≈7.6). Red indicates the same model scored against a synthetic baseline of 3,994 messages drawn uniformly from the 45-symbol GPS alphabet (μ≈132.0 bits, σ≈3.8). The two distributions overlap almost perfectly—the GPS messages are indistinguishable from random under the model. 

The next issue is that high-entropy output can come from encryption, compression or genuine randomness, and entropy alone cannot tell us which. This is correct. It is also the entry point to the rest of the article. If the field is encrypted, the protocol shape may still leave traces—placeholders where no payload is loaded, regime changes where policy shifts. In these structural metadata, the cipher does not reach. Encryption doesn’t hide “traffic data” of when and how often messages are sent and from which satellites. Each of those is a crack in the randomness, and the rest of this story walks through them in order.

What the entropy result does close off is the comfortable interpretation. Between 2007 and late 2023, no readable English appears anywhere in the dataset. No call signs, no acknowledgments, no test patterns of “the quick brown fox” variety. The field has not carried text in any conventional sense for the entire archived history of the GPS constellation.

For an engineer, that absence is itself information. The interface specification says this field is for text from the control segment. The bytes flatly disagree, and they have done so consistently, across every satellite, for 19 years.

High entropy on its own tells us only what the field is not. To learn what it is, we had to look for the cracks in the randomness.

A Single Byte, Repeated 22 Times, for 10 Years

The first crack in the randomness is also the most visible. Three messages, out of 3,994, have Shannon entropy of exactly zero. They are sentinels: 22 consecutive identical bytes broadcast as a single repeating pattern across the full payload.

• All-spaces—22 of byte 0x20.

• All-NUL—22 of byte 0x00.

• All-¬—22 of byte 0xAA, the CP437 negation glyph.

The all-¬ pattern is the longest-lived artifact in the dataset. It first appears on PRN 25 in February 2010, and quickly becomes the dominant default for the constellation, persisting intermittently across all 32 satellites for more than a decade.

The choice of byte 0xAA is not accidental. In binary, it is the perfectly alternating bit pattern 10101010—the canonical test sequence for bit synchronization, parity verification, and frame-alignment checks in receiver hardware. A satellite broadcasting all-¬ is broadcasting the protocol equivalent of a tone: present, parseable and intentionally empty. It is also outside of the characters permitted in the special message field, causing receivers to flag up data validation errors.

That intentionality matters. Encryption alone does not produce a constant. A genuinely random stream visits all-0xAA with negligible probability. The sentinels are placeholders by design—slots in the protocol marked as “no operational payload loaded.”

Their behavior fits that reading. Cross-referencing with GPS status reports (Notice Advisory to Navstar Users—NANU) shows satellites often enter sentinel states during commissioning and decommissioning. PRN 25 itself is the textbook case. The Block IIA satellite using that slot was decommissioned in December 2009. By February 2010, the slot was broadcasting all-¬. Its replacement, the first Block IIF, launched in May 2010, began pre-commissioning tests in August and also broadcast the all-¬ sentinel for several days before being declared fully operational on August 27. The pattern is unambiguous: When no operational payload is loaded, the field broadcasts the sentinel.

In a corpus where messages are replaced and never repeated, the sentinels are the only payloads that recur. Every other unique 176-bit message in the dataset appears in fewer than two calendar months for any given PRN. The sentinels persist for years. So, messages are replaced, never repeated—except the sentinels.

Why a system would broadcast a no payload loaded placeholder at all, and to what kind of receiver, needs the operational context that the rest of this article rests on.

Why GPS Carries Encrypted Signals—and What That Costs to Run

GPS broadcasts more than the open civilian C/A code. Since the activation of Anti-Spoofing on January 31, 1994, the constellation has carried encrypted military signals on the same frequencies: the Y-Code (the encrypted form of the precision P-Code on L1 and L2) and, on modernized satellites, the newer M-Code introduced with the GPS IIR-M block from 2005 onwards. These signals provide authorized receivers with jamming and spoofing resistance that civilian users do not have. The separation between open and encrypted signals also allows the operator to degrade the accuracy of civilian receivers while maintaining the precision of authorized ones. 

Encrypted signals need keys. Authorized receivers built since the late 1990s integrate a tamper-resistant cryptographic module called the Selective Availability Anti-Spoofing Module (SAASM)—the cryptographic basis of in-service infantry units such as the Defense Advanced GPS Receiver (DAGR). The SAASM holds a cryptographic key that lets the receiver lock onto the encrypted signal; without a current key, the receiver falls back to the unencrypted C/A code that anyone can track.

Keys do not sit still. To limit the damage from any single compromise, operational keys rotate on a schedule that, depending on the key class, can be as short as a single day. Every receiver in service—and the U.S. military operates them in the hundreds of thousands, across every theatre, vehicle platform, weapon system, and aircraft—needs each new key before its current one expires.

For most of GPS’s history, that meant physical key-fill: specialized loader devices had to be carried to each receiver, plugged in, and used to push the new key into the SAASM module. The keys themselves were distributed through NSA secure-courier channels. The logistics were demanding even in peacetime; in deployment, units that missed a key-fill window lost access to the encrypted signal until they could be reached again.

Over-the-Air Distribution (OTAD) and the closely related Over-the-Air Rekeying (OTAR) were the answer to that logistics problem. The principle is straightforward. A receiver that is powered on and already holds a valid current key can have its next key delivered via the GPS navigation message itself—encrypted under the current key and decoded within the SAASM module—without physical contact, a courier chain, or missed-window failures. The OTAD payload, the “next black key” in military parlance (where “black” denotes encrypted-at-rest), is what the GPS control segment must deliver to every authorized receiver on a schedule, via a public broadcast channel.

That delivery mechanism is what we believe Subframe 4, Page 17 has been carrying since at least 2007. If so, the constellation should reveal somewhere in its 19-year broadcast history the moment the delivery system went operational. And it does.

May 26, 2011: The Day the Constellation Spoke in Unison

May 26, 2011. Above the Earth, 31 active GPS satellites in 12-hour MEO orbits, each in its own slot, each broadcasting its own special message. By the end of the day, every one of them was broadcasting the same one.

Within a window of a few hours, all 31 operational satellites switched to the all-¬ sentinel. Every active PRN. Same payload. Same byte. Same coordinated event.

Figure 3 shows the 48-hour per-PRN timeline of the transition. It reads as a vertical bar slicing across the constellation: a step change so sharp and so simultaneous that no observational artifact can explain it. The data come from multiple receivers, ruling out a station-side glitch. Every PRN is involved, ruling out a single-satellite anomaly. No NANU was issued announcing a fleet-wide event of this kind.

In Figure 3, the Per-PRN broadcast state across a 48-hour window is centered on the transition. Each row corresponds to one of the 31 active GPS satellites; time runs from left to right in UTC. Within a few hours, every PRN switches to the all-¬ sentinel (red), holds it for between three and 24 hours, and exits to a new operational message at the end of the day. No publicly recorded NANU announces a fleet-wide event of this kind in the surrounding window. The transition coincides with the operational activation of the U.S. Over-the-Air Distribution rekeying network.

What remains is a coordinated, control-segment-driven blanking of the field across the entire operational constellation—the kind of thing that happens once, when an underlying system goes operational.

Declassified documentation places such a milestone in this exact period. A 2015 briefing by Maj Scott Tyley of the Space and Missile Systems Center describes the operational rollout of the U.S. OTAD system and its companion OTAR. The briefing identifies March 2011 as the start of continuous operational U.S. OTAD on all space vehicles.

Temporal alignment is not enough on its own to prove the connection; operational systems achieve operational status every year, and most of them do not announce themselves on L1 C/A. What raises the alignment from coincidence to causation is what happened next.

In the pre-OTAD era of 2007 to 2010, the constellation rotated unique payloads on average every 3.4 days; the 2007 to 2008 sub-period averaged about 2.3 days. In the operational era of 2012 to 2021, that rate jumped to once every 0.9 days, with a median message duration of 23 hours—almost exactly once a day. The H1 2011 period itself shows a cascade of four coordinated change points (January, February, May, June) culminating in the May 26 fleet flash, consistent with a phased activation rather than a single instantaneous transition. The result is consistent with the field being switched from a pre-operational test mode to an automated daily key-distribution cadence—exactly the operational tempo OTAD requires to deliver “next black keys” to SAASM-equipped receivers in the field.

Within a single 24-hour window, every operational GPS satellite switched to the same value.

From One Message a Week to One a Day, and Back Again

The 2011 flash drew a line through the dataset. Looking across the full 19 years, the field exhibits three behavioral regimes, each separated by a coordinated change point detected by Cumulative Sum (CUSUM) analysis applied to per-PRN message rotation rates.

The Pre-Operational Era, 2007 to 2011: A new payload per satellite roughly every 3.7 days on average. The rotation is irregular, the diversity is low, and the sentinel fractions are high. The pattern is consistent with field testing, including the 2010 coalition key transition exercises described in Tyley’s briefing. The system existed but was not yet running at operational tempo, or perhaps a predecessor system was in operation.

The Operational Era, 2011 to 2022: A new payload per satellite roughly every 1.8 days, fleet-wide, with median per-message duration of 23 hours. Daily cadence is the lifetime of a tactical cryptographic key; daily replacement of the field’s content is the operational signature of automated key distribution. The sentinels recede into the background; unique payloads dominate, with 162 to 381 distinct messages per year. For 11 years, the GPS constellation has operated the most widely used automated rekeying network on Earth.

The Modern Era, 2022 to Present: In May 2022, there is a sharp coordinated change point. The rotation rate drops to one payload every 4.3 days at the regime boundary, then keeps slowing. By 2025, it is approximately one payload per 6 days, and by early 2026 it is closer to one per 6.8. The shift is fleet-wide, simultaneous across 17 to 32 satellites, depending on which metric is examined, and again unaccompanied by a publicly recorded NANU.

Three rates: 3.7, 1.8, 4.3+ days per payload (the third era’s rate is not stable and has continued to slow). Three regimes: pre-operational, operational, post-2022. Figure 4 shows them as three plateaus separated by sharp coordinated transitions.

The fleet-mean per-message duration in days is plotted across the full 19 years of the corpus in Figure 4. The pre-OTAD era (2007 to 2010) cycles roughly every 3.7 days. From May 2011 the rotation accelerates to one payload every 1.8 days, sustained for 11 years and consistent with daily tactical key distribution. In May 2022, a coordinated change point detected by CUSUM analysis reverses the trend on roughly 30 satellites simultaneously; rotation slows to 4.3 days per payload at the boundary and continues to slow within the era — to 6.8 days by early 2026. Vertical lines mark coordinated change points (≥ 8 PRNs within ± 3 days).

The 2022 reversion is the most interesting open question in the dataset. Several readings are consistent with the data, and none are conclusive.

It could mark the migration of OTAD traffic from L1 C/A to a different signal, most plausibly M-Code on L1/L2, where modernized military receivers have been operating since the GPS III deployments began.

It could reflect a change in cryptographic policy: longer key lifetimes, fewer rotations, more reliance on session-key derivation at the receiver.

It could be the first visible footprint of the recently terminated Next Generation Operational Control System (OCX) ground segment, whose deliberate, staged rollout was a public program for years.

What the data say definitively is that whatever the explanation, it was a single decision applied across the entire fleet at once, and the public record contains no notification of the kind we would expect.

A field that announces operational changes by the cadence of its own ciphertext is a field worth watching.

When Encrypted Messages Share Their Spelling

If the messages were genuinely random—random or properly encrypted with independent keys, padding, and initialization vectors—then no two unique payloads should share any meaningful structure. Each 176-bit message would be statistically independent of every other.

They are not.

A Prediction by Partial Matching (PPM-D) order-8 compression model, trained over the full 3,994-message corpus, identifies pairs and small groups of unique messages that share long, identical substrings at the same byte positions. Examples from the catalog:

• Two messages broadcast on October 8, 2014, share 10 identical characters in identical positions.

• A message from June 2021 and a message from September 2020 share a 9-character substring at the same offset.

• A pair of late-2019 messages, broadcast three weeks apart, share eight characters at identical byte positions.

• The substring LY47IRP16—9 bytes—appears in messages broadcast nine months apart.

• S°6L.D°—7 bytes—recurs three months apart.

The probability that any given pair of 22-character messages drawn independently from a 45-symbol alphabet would share a nine-character substring at the same offset by chance is negligible. Across the full corpus, the matches are not coincidental; they are structured. 

In Figure 5, five message pairs are identified by an order-8 PPM-D compression model as sharing long substrings at identical byte positions, despite being broadcast days, weeks or months apart. Each pair is shown one above the other, with shaded cells highlighting the matching bytes. The remainder of each message is the high-entropy ciphertext that fills almost the entire corpus.

The most likely explanation is protocol metadata leaking through. Every cryptographic transport protocol wraps its payload in headers—key identifiers, sequence numbers, etc. However, this alone is not a sufficient explanation because these values are encrypted and should therefore differ for every message. In addition to fixed metadata, there would need to be re-use of a key, whether due to operational error or exceptional circumstances. In such a scenario, we would expect to see partial matches between two different messages.

There is a practical consequence. If the substring matches are protocol metadata, they offer an external observer something the cryptography was meant to deny: a way to fingerprint and track individual key-distribution events from public signal data. A monitoring receiver, watching a small set of fixed byte positions across the entire constellation, could, in principle, detect when a particular key identifier or routing header is reused, retired or correlated with a NANU-announced operation. Cryptographically, the keys remain secure. Operationally, the metadata is loud.

In a stream that should be indistinguishable from noise, the protocol left a fingerprint.

The First Readable Bytes in 19 Years

In the corpus that runs from 2007 to mid-2023, no payload anywhere contains a recognizable word from any language that’s intended for direct human consumption. Then, on December 13, 2023, PRN 8 broadcasts a message that begins with the literal four-byte string TEXT.

After 16 years of pure ciphertext, the field has begun to use the format the standard always described. 

The migration is both staged and deliberate, reading like a deployment plan rather than just a casual flip of a switch.

• December 13, 2023—first appearance, on PRN 8 alone.

• March 18, 2024—the same TEXT-prefixed message broadcast on 10 PRNs simultaneously: a one-day fleet-wide distribution event.

• July 31, 2024—a second TEXT message, on PRN 3 alone.

• October 10, 2024—a four-PRN distribution.

• December 29, 2024—January 13, 2025—daily TEXT messages on PRN 1, with a different payload each day.

• March, June 2025—the daily-broadcast PRN moves to PRN 21.

• July–August 2025—the daily-broadcast PRN moves to PRN 20.

Each TEXT-prefixed message rotates daily and carries an 18-byte payload following the prefix. The payload itself remains high-entropy—by every statistical measure indistinguishable from the ciphertext that preceded it. The format has changed. The content shape has not.

The most plausible reading is a generational upgrade. OCX is rolling out. GPS III satellites are operational and growing as a fraction of the constellation. A new variant of OTAD, or a new auxiliary use of the field bolted alongside it, is being commissioned by PRN.

For receiver firmware, the migration matters in a way the previous 19 years did not. A field containing static-looking ciphertext is one that most parsers ignore. A field that apparently carries a structured type identifier followed by a payload must be parsed correctly.

The September 2020 SVN 74 anomaly is a cautionary tale, even though it concerns a different field: an ICD-defined alarm pattern transmitted as prescribed, with a minority of commercial receivers failing to handle it correctly and pushing bad positions to ADS-B users. The TEXT-prefix migration is an analogous situation—content that finally matches the special-message field’s standard format, arriving on receivers that may have spent two decades treating this field as static or ignored. Either direction of mismatch, content the standard did not describe, or content that suddenly does, can produce the same kind of outcome.

For the receiver and firmware teams, the practical action is short. Audit any code path that touches Subframe 4, Page 17. If the field is currently being skipped, logged as static, or assumed to be text, that assumption now has an expiration date. The TEXT prefix suggests the message is intended for human consumption; the trailing 18 bytes are the payload, which the standard has always permitted. Code that handles both is forward-compatible. Code that handles only one is the next September 2020 waiting to happen.

The migration is happening now. As of early 2026, only a handful of satellites have broadcast TEXT-prefixed messages, and the rest of the fleet continues to use the unstructured format. Which PRN converts next, and what its first TEXT-formatted message says, is the most accessible real-time measurement of GPS ground-segment evolution available to anyone with a receiver and patience.

Figure 6 plots every TEXT-prefix broadcast event in the corpus, satellite by satellite.

It shows 26 unique messages, 38 (PRN, day) combinations and 2,398 total observations. Marker size scales with daily observation count. Five distinct phases are visible. The first TEXT message appears on PRN 8 on December 13, 2023 (red). Three multi-PRN distribution events follow in 2024 (teal): a 10-PRN event on March 18, 2024, a single-PRN appearance on July 31, and a four-PRN distribution on October 10. From December 29, 2024, the protocol stabilizes into bursts of consecutive daily broadcasts that migrate between satellites: first PRN 1 (dark grey, December 2024 to January 2025), then PRN 21 (purple, March and June 2025), then PRN 20 (amber, July to August 2025). The migration looks far more like a staged deployment than an organic spread.

The Bottom of the Rabbit Hole, Or the Top of It

For nearly two decades, every operational GPS satellite has broadcast an encrypted stream consistent with the backbone of the U.S. military’s global cryptographic key distribution system.

The 2011 fleet flash was the constellation-wide synchronization that brought the system to operational capability. The 0xAA sentinel is the protocol’s no payload loaded marker. The shared substrings are the structural fingerprints of an OTAD frame leaking through the cipher. The 2022 reversion is the system in transition. The TEXT prefix is the system in renewal.

This matters in three ways:

• For signal authentication. OTAD is the proven, decades-long predecessor to civilian schemes like Galileo OSNMA and GPS CHIMERA. Its operational history, until now invisible, is data that the authentication community can study.

• For operational transparency. Both the 2011 flash and the 2022 reversion happened without the kind of public NANU record one might expect for a fleet-wide operational change. The methodology in this article, open archives, off-the-shelf tooling, 18k lines of Julia, gives the GNSS community the means to monitor the constellation’s internal states for itself.

• For pure engineering curiosity. Every receiver in the world decodes Subframe 4, Page 17. Almost none of them have ever looked at it. The lesson generalizes: There is more to learn from the bytes already arriving at our antennas than from the bytes we wish were specified differently.

The data are publicly available. The signal is overhead, twice a day, every day. We invite the GNSS engineering community to join the audit for L1 C/A and the newer signals that will inherit its role.

Every GPS satellite is a numbers station. The receivers were always listening. We just had not been. 

Acknowledgements 

This article is based on a project developed by Ahmed Kamruddin during his MSc studies at University College London. Thanks also to Ramsey Faragher and Markus Kuhn for valuable comments on this work. The initial stages of the work were performed within the Trusted Innovative GNSS receivER (TIGER) project, co-funded by the European GNSS Agency (GSA) under grant agreement 228443. Source code supporting this project can be found at https://doi.org/10.5281/zenodo.20073222.

Author

Steven J. Murdoch is Professor of Security Engineering, head of the Information Security Research Group and lead for the Foundational Computer Science section in University College London. His research encompasses payment system security, privacy enhancing technologies, online safety, and the intersection of computer science and law. He teaches on the UCL MSc in Information Security. He has worked with the OpenNet Initiative, investigating Internet censorship, and for the Tor Project, on improving the security and usability of the Tor anonymity system. His current research focuses on how computer systems can generate evidence to facilitate fair and efficient dispute resolution. He is a member of REPHRAIN, the National Research Centre on Privacy, Harm Reduction and Adversarial Influence Online and co-leads the CRANE NetworkPlus on Cybersecurity. He is a director of the Open Rights Group, a UK-based digital campaigning organization that works to protect rights to privacy and free speech online. He is also a Fellow of the IET and BCS.

The post The Empty Field that Wasn’t: GPS, OTAD and Two Decades of Encrypted Broadcasts appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

SÉBASTIEN TRILLES, THIERRY AUTHIÉ, XAVIER VASSEUR, MARIE ABBAL, THALES ALENIA SPACE, TOULOUSE, FRANCE

To use GNSS systems for air navigation, various civil aviation organizations have defined an augmentation system capable of fulfilling two primary missions. The first is to calculate correction messages that allow aviation users to exploit GNSS data for precise positioning, even if the GNSS system incorporates intentional or unintentional degradations affecting geolocation. The second mission is to monitor all navigation data broadcast by GNSS systems in real time to detect any anomalies and alert aviation users within a timeframe compatible with their flight phase. Given civil aviation’s need to cover a large area, typically on the scale of a continent, the dissemination of these messages has naturally been directed toward geostationary satellites known as Satellite Based Augmentation Systems (SBAS).

The role of an SBAS is to decompose the various contributors to measurement errors and broadcast, through dedicated augmentation messages, corrections associated with each error contributor to users. These corrections are reassembled by the user receiver according to their geographical position, improving positioning accuracy and helping to mitigate error sources that affect distance information related to satellite clocks, their positioning, and ionospheric effects. All SBAS are interoperable and standardized [1].

The classic functional architecture of an SBAS is composed of a network of ground reference stations that collect GNSS navigation measurements and data, a set of central processing facilities that compute corrections and constructs augmentation messages, and a set of transmission stations that broadcast the radiofrequency signal toward the geostationary satellite.

Current SBAS systems are designed for single constellation GPS, single-frequency L1 users, using the L/NAV navigation message. The augmentation signal is broadcast on the L1 frequency band, modulated by a dedicated PRN, and contains orbital corrections, clock corrections, and a model to correct ionospheric elongation.

Future SBAS, called Dual Frequency Multiple Constellations (DFMC), are dedicated to dual-frequency L1/E1 and L5/E5a users, using L/NAV navigation messages for GPS and F/NAV for Galileo. The augmentation signal is broadcast on the L5 frequency band, modulated by a dedicated PRN, and contains orbital and clock corrections for satellites from different constellations.

The main limitation of SBAS accuracy and availability performance lies in the regional coverage of the ground reference stations network, which does not allow continuous monitoring of the satellites in the navigation constellation. As a result, SBAS must continuously manage satellite visibility losses for several hours, requiring complex strategies to detect any satellite event such as manoeuvres, clock anomalies and hardware bias as soon as measurements become available again. The strong coupling that exists between material biases and ionospheric elongation adds difficulty in the case of satellite raising because it is often difficult to separate a hardware bias jump and an ionospheric event at the edge of the zone.

Furthermore, a geographically restricted network of reference stations does not allow for the correct decoupling of satellite orbits and clocks. This limitation is not a problem for a small service area because the clock error partially compensates for the orbit error. However, clock error is a scalar while orbit error is a three-dimensional vector, so how good the compensation of one error by the other depends on the size of the geographical area to be covered and the geographical position of the user within it. Consequently, a wide service area needs good decoupling between orbit and clock, which a network of regional stations does not provide.

This article studies the possibility of spatializing all the components of a classic SBAS. In this approach, the three main steps of SBAS processing, collecting GNSS data, calculating augmentation messages and disseminating those messages to users, must be carried out by components in free fall around the Earth.

Global SBAS Architecture Overview 

The first step in the SBAS spatialization process involves taking fixed reference stations on Earth and placing them in orbit, under navigation constellations, i.e., in low Earth orbit (LEO). There is no point in flying the stations in cluster formation, as this would not solve the regional problem and, moreover, the service would only be intermittent during the cluster’s orbital period. We immediately assume a uniformly distributed constellation as the geometry for the station distribution.

By doing this, LEO flying stations (LFS) can see GNSS constellations permanently, which is an undeniable advantage for increasing the accuracy of corrections and detecting critical events. Another benefit is SBAS has the capacity to be a global service, representing a significant paradigm shift. The spatialization of the stations also avoids the difficulties of defining a terrestrial network, which must satisfy geopolitical conditions, not to mention that the Earth is 70% covered by oceans, limiting the possible terrestrial sites to emerged geographical areas.

On the other hand, GNSS reference stations are no longer fixed points on Earth; they evolve over time. However, their trajectories remain predictable as their movements are well known and correctly modeled in the short term because they are governed by the laws of space mechanics. It is necessary to have accurate orbits for LFS. Several solutions exist for performing this calculation. Three approaches naturally emerge:

1. The calculation of LFS orbits is performed simultaneously and in the same process as the MEO orbits of the constellation satellites; 

2. LFS orbits are estimated using GNSS measurements through a separate process;

3. LFS orbits are calculated using independent means and independent measurements.

The first approach raises several questions regarding the commonality: LFS are devoted to monitor the GNSS constellation satellite. Using GNSS measurements for both LEO and MEO positioning in the same process brings significant 
algorithmic complexity and risk on the impact of a feared MEO satellite event on LEO position and detection capabilities. Thus, this approach is not discussed. 

The second approach decouples orbit calculations but requires implementing GNSS fault detection and exclusion techniques such as RAIM or ARAIM to make the position of the reference stations insensitive to failures of the constellation satellites.

The last approach offers the greatest possible independence because it is achieved using measurements from a positioning technique that is completely decoupled from GNSS. The Doppler Orbitography and Radiopositioning Integrated by Satellite (DORIS) system is an example of such an independent system. DORIS is a radio navigation and orbit determination system based on Doppler measurements of signals transmitted from the ground to satellites. It is developed and maintained by CNES, the French Space Agency, widely used for space geodesy, Earth observation, altimetry missions and achieving centimeter precision level. The onboard DORIS and GNSS receivers share the same clock. The clock is synchronized with System Network Time (SNT, the reference time of the globalized SBAS), so the orbit generated will be time tagged with respect to the SNT. We retain this for this framework.

At the planned altitude, the LFS are positioned above the area where the ionospheric plasma is most concentrated. The GNSS measurements collected on board shouldn’t be much affected by ionospheric delays. This also implies this type of system will not be able to develop an ionosphere model and calculate ionospheric corrections to single-frequency users. Thus, this framework is devoted for dual-frequencies users. According to this paradigm, the ionosphere model shall be elaborated by an external entity.

The local Earth environment or propagation effects (troposphere and ionosphere) no longer affect measurements collected by GNSS receivers. Therefore, the quality of the measurements is expected to be significantly improved compared to a ground-based system. This favorable environment, associated with a geodetic quality receiver, will improve the precision performance of augmentation navigation messages.

In this framework, the LFS move at a high speed, of the order of 7 km/s, which generates visibility durations for GNSS satellites of 30 minutes. These passage durations are much shorter than those observed from the ground by several hours, but they are long enough for floating ambiguity resolution. The rapid dynamic of the LFS generates high relative movement between LEO and MEO satellites, providing better decorrelation between orbits and clocks and improving SBAS augmentation message performance.

LFS Communicate Via Inter Satellite Links

The proposed architectural framework incorporates inter satellite links (ISL) between the LFS (Figure 1). Selecting optical or RF ISL is driven by the trade-off between ranging accuracy, security and volume of data to be transmitted versus satellite design complexity. Optical links are suitable for high bandwidth and security requirements but demand more advanced technology and precise alignment that affect satellite design. RF links represent a proven technology, simple to deploy and tolerant of inaccuracies, but limited in bandwidth and inherent security. 

ISL capability serves two functions:

• A communication function to share the information recorded by each satellite;

• A ranging measurement function to improve the algorithms for determining the orbits of LFS and to participate to generate the independent SNT.

The first is equivalent to the terrestrial network, the Wide Area Network (WAN), which ensures the transfer of information between SBAS elements. 

The second aims to improve the position calculation and prediction of LFS by feeding the precise orbit determination, initially based on the provision of DORIS measurements, with additional Inter Satellite Ranging (ISR) measurements. The geometry and the accuracy of these additional measurements will help, respectively:

• To improve accuracy positioning in normal and tangential directions;

• To precisely locate the phase center of GNSS signal reception;

• To cope with possible jamming or spoofing of the DORIS station by offering an independent set of measurements; 

• To connect LFS clocks between them to measure their desynchronization (Figure 1). 

Several approaches can be envisioned for forming the clock’s equations, in particular the classic method based on the dual one-way ranging that allows decoupling orbit and clock problems [4].

In this framework, ISL continuity is assumed to be maintained over time without interruption, which requires permanent precise pointing.

The Navigation Kernels are Decentralized

Navigation computations are no longer handled by a single element but are distributed. This distribution is either entrusted to an infrastructure external to the system, already in place and managed independently, or distributed among all LFS.

In the first option, the globalized SBAS has access to a space cloud that handles the entire computational load. The links between the LFS and the space cloud are provided by ISL.

In the second option, each satellite carries a shared computing capacity. The computations are decentralized: Each computing unit performs part of the workload and exchanges the results with each other. These results are assembled by each LFS to generate a common navigation context. 

Decoupling Differential Corrections Generation and Integrity Monitoring

According to the original SBAS architecture designed by Thales Alenia Space [2-3], the navigation processing facility is composed of two components to ensure the independence of integrity checks. The first one, the Processing Set (PS), calculates the SBAS corrections and generates the Navigation Overlay Frame (NOF) with respect to the message format and message sequence defined in the MOPS and SARPS. The Check Set (CS) is the second component responsible for checking the integrity of the corrections from the NOF received from the GEO satellite, using data from at least one other group of independent receivers from each RIMS. When needed, it generates alarms on satellites that are collected by the PS and injected inside the very next NOF in case an anomaly is detected. To ensure diversification, the set of RIMS is divided into two distinct groups: RIMS-A only feeds the PS and RIMS-B only feeds the CS. The rational of this “dual channels” architecture is to comply with the safety requirement stating no single or common mode of failure shall entail a non-integrity event.

The solution studied proposes maintaining this distinction between the roles of the sets, PS on one side and CS on the other, and further extending independence by specifically allocating the measurements collected by a LFS to the PS or the CS functions exclusively. This leads to two separate LFS fleets: one dedicated to fulfilling the PS functions (denoted LFS-A, and acting as RIMS-A) and one dedicated to fulfilling the CS functions (denoted LFS-B, and acting as RIMS-B). The CS can communicate with the PS at the minimum level of integrity parameters to fulfil integrity checks. 

With such separation, the globalized SBAS architecture guarantees complete diversity in the measurement geometry to fulfil the PS and CS functions: the measurements from LFS-A will capture a very different observation geometry from that captured by the LFS-B measurements to perform integrity monitoring. This capability represents a significant advancement over previously developed ground-based architectures (EGNOS and KASS, for example) that co-locate RIMS A and B (in reality these two stations are separated by a few dozen meters to diversify the local environment. However, both RIMS capture the same observation geometry).

An even stricter independence step is to dedicate one batch of LFS to perform only the PS function and the other batch to perform only the CS function. The constellation is divided into two sub-constellations: partition A and B. The first calculates the navigation message (partition A allocated to the PS) and the other monitors the integrity of the message (partition B allocated to the CS). Each partition implements the distributed calculation of the PS and CS functions.

The two partitions communicate with each other via ISL to construct the message to be broadcast: The PS communicates the NOF ready to be sent to the CS, and the CS returns the results of the independent integrity checks to the PS. Different combinations are possible on the geometric distribution of the PS and the CS. This article focuses on two options: partitions (A and B) evolve at the same altitude (Option-1), or the partitions are positioned at two different altitudes, one specific for A and another for B, (Option-2). 

System Time Scale Generation

A SBAS must generate its own time reference, the SNT, which must be parallel (as much as possible) to the TAI. All clock corrections are computed relative to this system time reference. Because the bandwidth of NOF messages is 
limited (currently 250 bits per second), the SNT is steered to GNSS time to limit the magnitude of the corrections.

Several techniques are possible to achieve this internal time scale. Conventional SBAS only have RIMS-GNSS satellite links; the links between RIMS clocks are only accessible from a common satellite visibility by simple difference. Some SBAS develop the SNT using only a set of RIMS (EGNOS), which requires the construction of simple difference measurements; others (KASS) construct the SNT using all available clocks, including those of the RIMS and those of the GNSS satellites.

The globalized SBAS allows SNT construction based solely on the LFS clocks thanks to the direct links that connect them. This architecture makes it possible to construct a timescale independent of the GNSS constellations. The dual one-way ranging technique allows measurement of clock differences over time between two satellites connected by a laser link:

where h_i and h_j are the clock desynchronization of LFS clocks i and j, H_ij is the dual one-way ranging measurement corrected by relativity effects, hardware delays (in meter) relative to the ISL antenna on the receiving chain and on the transmitting chain, and phase centre offset relating on both emitter and receiver satellite [4].

It is therefore possible to construct the clock problem and solve it using various techniques [5-8]. The high quality of the dual one-way ranging measurements, combined with high-quality atomic clocks, allows the construction of a composite timescale whose expected qualities have phase continuity, frequency continuity and high stability (measured by the Allan variance). The SNT is aligned with the GNSS constellation timescale in a conventional manner, either by calculating a timescale difference, a posteriori, or directly during SNT generation by adding constraint equations. This steering will be performed using navigation messages from the GNSS constellations.

The timescale obtained is implicit; it is a paper time because it is calculated as a “well-constructed” average of all the clocks contributing to the calculation. The result of the composite clock algorithms provides biases that represent the advances or delays of each of the LFS clocks relative to the SNT timescale. Once these biases are applied, each clock is assumed to represent a realization of the SNT. This process, therefore, enables the global synchronization of all the LFS in the SBAS system. It then becomes possible to transmit a signal to the constellation every second of the SNT time.

TTA Reduction

The classic implementation of an SBAS (like that of the EGNOS V2 and KASS operational systems) is designed to be a Periodic (repetitive cycle of operations), Synchronous (each operation is performed according to its own timing), and Pipelined (all operations are performed in series) system. Specifically, observations are performed simultaneously at all ground RIMS stations at the second round of GPS time. Data are then transmitted to the navigation cores, where the algorithms are executed at a frequency of 1 Hz as soon as almost all RIMS measurements are received. Each operation has a specific execution time allocation, and the entire system is designed to complete a cycle in 5.2 s.

In the globalized SBAS concept, the LFS also perform measurements in a synchronous manner, meaning all stations observe GNSS events at the same coordinated moment. However, unlike the classic implementation, the specific timing of these measurements is optimized. The synchronization point is not arbitrarily fixed to the second round of system time, but is strategically chosen. This optimization takes several constraints into account: the requirement for the NOF to be available for broadcast starting at a specific round of system time, the estimated data transmission time between LFS, and the computational resources needed to generate the NOF. By aligning the measurement moment with these operational constraints, the system can maximize efficiency and ensure timely availability of the SBAS corrections for end users.

Assuming measurements time is optimized, the time allocations in the different elements of the system would be [9]:

• 1,000 ms to acquire new measurements, due to the 1Hz frequency of NOF broadcasting;

• 200 ms to generate the raw measurements (150 ms) and to format them (50 ms);

• 150 ms to disseminate the data to all SV through the ISLs;

• 350 ms to process data in the DPS (200 ms for computation and 150 ms for exchange data between satellites).

At the end, the NOF ready for broadcast is available in less than 1 second (Figure 2).

The time to alert (TTA) corresponds to the maximum time elapsed between the moment an anomaly likely to compromise user safety is detected and the moment the user receives the corresponding alert, informing them to no longer trust the service. In other words, it is the maximum time for any fault/error detected or suspected by the system to be reported to users by an alarm message transmitted via the SBAS signal. TTA is a central criterion for safety-of-life applications. For vertical guidance approach services (APV-I / LPV-200 type), the international ICAO SARPS standard sets the maximum TTA at 6 seconds. If the SBAS detects a loss of integrity, the alert must reach the user within this time. A short TTA ensures users will be quickly informed of a loss of performance or an anomaly, and can react or interrupt critical procedures when service reliability cannot be guaranteed.

The TTA takes the duration of NOF transmission (1 s) into account and the time allocated to user processing (800 ms). The time of SBAS signal propagation from LEO to user is neglected in this first apportionment (around 3 ms). The complete SBAS cycle is completed in between 3 and 4 s (compared to 5.2 s in classic case). The TTA is then below 3.5 seconds, representing a reduction factor of two with respect to classic ground SBAS (Figure 3). 

Finally, the concept of fast alert, [9] would be enabled. Fast alert messages are broadcast using the Q-channel and contain the alert flags (alarm/no alarm) for all satellites set in the PRN mask. The complete SBAS cycle is completed in 1.5 s (compared to 5.2 s in a classic case). This operational flexibility would allow a TTA of 2.3 seconds (Figure 4). 

LFS Broadcast the NOF

In a conventional SBAS architecture, the NOF is transmitted to users by one or more geostationary satellites. This message is generated on the ground, so it must be encoded into a signal and transmitted by a dedicated RF ground up-link station to the GEO. Because the first bit of the NOF must be sent synchronously at the second round of SNT time (close to GNSS time by specification) at the phase center of the GEO satellite, conventional SBAS systems implement a long loop that controls the signal transmission time to the ground. The SBAS is also endowed with an “integrity box” that checks the NOF return link to ensure the NOF received by the user is the same as the one computed by the system. In most cases, both NOF are strictly equal; if a corruption is detected the integrity box cuts the emission at ground.

In the case of a space-based SBAS system, LFS are capable of transmitting the NOF. To be properly processed in the GNSS receiver computing chains, this signal must be modulated by a PRN code that will spread the carrier spectrum using the Code Division Multiple Access (CDMA) technique. For this signal to be correctly processed within GNSS receiver chains, it must be modulated using a Pseudo-Random Noise (PRN) code, effectively spreading the carrier spectrum via CDMA. There are two primary approaches for assigning PRN codes to the LFSs:

• All LFSs transmit using the same PRN code;

• Each LFS transmits using a dedicated PRN code.

In the first case, the globalized SBAS broadcast the NOF with a single, unique PRN for all LFS transmissions. When multiple LFS are within the receiver’s field of view, the receiver can typically differentiate between transmissions by exploiting distinct Doppler shifts, which result in separate correlation peaks in the time-frequency domain. However, the probability of collision between the two correlation peaks is significant. Assuming a Doppler shift of 50 kHz, a loop bandwidth of 5 MHz and a PRN code of length 1,023 chips, the probability of a collision between two peaks can be estimated as (5.10³/5.10⁵)×1/1,023≈10^-5 per millisecond, corresponding to roughly one collision per 100 seconds. If three satellites are in view, the likelihood of simultaneous collision among all three signals becomes negligible. Therefore, using a unique PRN for all LFS requires continuous visibility of at least three LFS. However, this approach implies LFS signals cannot be used for ranging: While the NOF message can be received, the receiver cannot distinguish which LFS transmitted it.

In the second approach, each LFS is assigned a distinct PRN code. Currently, GNSS receivers store the navigation contexts of NOF messages received from each GEO SBAS, identified by its dedicated PRN. Out of all recorded contexts, the user applies only one; when the receiver switches PRNs, it replaces the navigation context accordingly and the old one is purged. In the context of globalized SBAS, however, the visibility time of each LFS is very short, about a dozen minutes, which is insufficient for a receiver to fully update its navigation context. In this situation, the user must retain the navigation context when switching PRNs instead of purging it. This ensures seamless continuity for the user; the navigation solution remains coherent regardless of the current LFS because the integrity and accuracy information provided by each NOF is consistent across all LFS. This adaptation necessitates an evolution of SARPS and MOPS standards to accommodate the new PRN allocation schemes envisaged for global SBAS. This approach allows the ranging function to be achieved even if it involves a significant increase in the number of PRNs required. 

The NOF is transmitted synchronously at the second round of SNT time. In other words, all LFS transmit the NOF to users at the same second of SNT time. This approach removes the necessity and the complexity of the long loop.

Every second, the system broadcasts a single common NOF according to a fixed and predictive message-sequencing scheme, compliant with the requirements of the SARPS standard. This augmentation message is broadcast in L5-I signal frequency.

The constellation is designed so at least two LFS are visible beyond 5° elevations of any user on Earth. The LFS are assumed to be able to receive GNSS signals in the Radio Navigation Satellite Service (RNSS) band and emitting the Aeronautical Radio Navigation Service (ARNS) band without jamming between emission and reception.

Whereas in conventional systems two or three GEOs are active, the possible loss of a GEO has a direct and immediate impact on availability and service continuity performance over a sometimes large geographical area. This new approach multiplies the number of NOF emission points, which greatly increases the resilience of system performance to this type of failure, reducing the impact to only a few users. Different combinations are possible on the geometric distribution of NOF emission points: in Option-1 the two partitions broadcast the NOF, in Option-2 only one partition broadcasts the NOF (Figure 5).

In Option-1, the two fleets broadcast the NOF. A standard functional allocation would consist in apportioning the same number of satellites to partitions A and B. As the LFS A and B are placed at the same altitude, the LFS-B cannot treat the NOF received as the user will; LFS-B only checks the NOF the system is ready to send the user. As all LFS emit the NOF, the return link function is not possible. Detecting possible NOF corruption (a LFS emits a message not conformed to it specification) is then allocated to the user. If the NOFs are different, SBAS can no longer be used. 

In Option-2, partition A is placed above partition B: altitude of the PS function is higher altitude of the CS function and only partition A broadcasts the NOF. The two partitions remain connected by ISL. The difference is now the CS can receive and monitor the NOF messages being sent by partition A and identify whether corruption is possible. The CS identifies the LFS-A responsible for this corruption and sends it a command requiring it to stop sending the NOF. At the next second, this specific LFS-A will cease the emission. The redundancy of LFS-A is designed to limit the impact of this corruption at user level and to maximize the level of performance of availability and continuity.

A global SBAS should bring permanent continuity in GNSS satellite visibility so it can monitor, at any time, all GNSS satellites configured in the PRN mask. 

LEO Ranging Function

The realization of this function assume seach LFS transmits using a dedicated PRN code. LFS have an independent orbit estimate and are synchronized with each other, giving them the information necessary to fulfill the LEO ranging function (Figure 6). This consists of considering LFS as an additional ranging signal. Consequently, the globalized SBAS can naturally act as a LEO PNT system:

1. The satellite precisely synchronizes the start of a PRN code sequence transmitted in the signal with the start one second of SNT time, 

2. The satellite synchronizes the first bit of the navigation message with the second round of SNT time, 

3. The satellite maintains synchronization of the start of a navigation bit with the start of a PRN code sequence, 

4. The satellite maintains the code-carrier consistency.

The internal navigator of the LFS provides an orbit and a clock synchronization bias relative to the SNT. Orbitography algorithms also provide a variance-covariance matrix that can be used to provide URA data. A suitable ARAIM concept could provide the integrity of LEO satellite navigation data, allowing LEO ranging measurements to be incorporated into a safety-of-life solution. The LFS navigation message shall be encoded in the signal broadcast to the user.

In the classic SBAS paradigm, GEO-Ranging function is possible and GEO data navigation takes place inside the NOF itself (MT9 dedicated for GEO SBAS L1 ephemeris). In the spatialized SBAS paradigm, the number of transmitting satellites is increasing considerably and inserting LEO navigation data into the NOF would congest the available bandwidth. It is better to transmit the SIS ranging data in a dedicated message rather than the NOF. In this aspect, two options are envisioned: either LEO ephemeris are encoded in L5-Q signal frequency or L1-I signal frequency. The first is the most energy-efficient because one signal is generated on L5, which modulates the NOF on the I channel and the ephemeris on the Q channel. The second option requires generating and transmitting two signals on two different frequency bands, which consumes more energy and adds complexity. Users can leverage these two frequencies to form the iono-free combination, as is done with GNSS satellites, and improve their positioning.

Monitoring and Control

Classic SBAS provides system monitoring and control, which involves overseeing and managing the ground segment subsystems, supporting maintenance tasks—including configuration management—offering data archiving capabilities for offline activities, and enabling communication with external entities.

In spatialized SBAS, the need for the system monitoring and control function is still present: it is even mandatory to operate the system. The operator ensures operational management of the system, maintenance of the infrastructure and supervision of the service provided to users. Several Mission Control Centers (MCC) on ground are necessary for this. The MCC and the LFS constellation communicate with each other by classic TM/TC.

LEO Constellation Infrastructure 

Achieving a worldwide SBAS solely through ground stations is impractical due to the necessity of comprehensive global coverage, which would require an immense and continuously maintained network of ground infrastructure spread across the entire Earth’s surface. This makes it difficult to provide consistent, reliable augmentation signals everywhere. 

Deploying space-based stations in LEO orbits offers a more efficient and effective solution. LEO satellites can cover vast areas of the planet from orbit, overcoming environmental masking faced by ground stations. This space-based approach ensures continuous, global augmentation service with improved scalability, making it preferable for establishing a worldwide SBAS.

Another benefit of the LEO constellation, and a consequence of global coverage, is its unique capability to receive measurements from GNSS satellites throughout their entire orbits, regardless of the satellites’ position relative to the Earth’s surface. This comprehensive 
visibility enables LEO satellites to monitor GNSS signals continuously, eliminating geometrical blind spots that can occur when relying on ground stations. The estimation of GNSS satellite orbits and clock errors becomes more accurate and robust, leading to improved navigation performance. By providing consistent and diverse observational data from multiple vantage points in space, LEO constellations significantly expand the precision and reliability of GNSS orbit and clock determination. This visibility is the main driver of constellation size: ensuring at least one LEO satellite is visible at all times everywhere on Earth is required to receive the NOF message. Given the safety-of-life nature of the system, safety guidelines further recommend a minimum of two LEO satellites be visible at all times everywhere to cover a single satellite failure. Visibilities are considered when the satellite is above 5° of elevation above the horizon.

The characteristics of a LEO constellation satisfying this constraint mainly depends on altitude. For this study, two different altitudes are considered: 

• 750 km of altitude. This leads to a constellation made of 96 satellites.

• 1,200 km of altitude. This leads to a constellation made of 57 satellites.

These constellations are designed to ensure a minimum number of satellites to respect geometric constraints. They do not constitute the real constellation that will necessarily be sized to take into account failures, redundancy, etc.

These two LEO constellations are configured and represented in Figure 7. 

For each altitude considered, the constellation is minimal in terms of number of satellites. Any constellation with fewer satellites does not ensure at least two satellites in visibility at all times.

The visibility constraint can be verified by using a simple simulation. Visibilities are calculated for a grid of users on Earth. However, as the LEO satellites have an orbital period between an hour and a half and two hours, they make around 15 orbits on a single day. This means globally, the visibility statistics are the same for all users on a same latitude. Therefore, the results in Figure 8 show the minimum, average and maximum number of satellites in visibility as a function of latitude. 

The constraint of at least two satellites in visibility is satisfied everywhere. The statistics do not differ significantly between the two constellations, with visibilities being minimum at the equator, increasing for higher latitudes and decreasing near the poles.

A LEO satellite used for a safety-of-life system will have associated constraints in terms of certification and will be costly. So, the number of satellites should be minimized, making the constellation at 1,200 km the seemingly preferred option. However, this criterion should also be in balance with criteria related to the satellite payload, onboard available power, antenna design, launching constraints and end-of-life constraints. A higher altitude means satellite signals will have to be transmitted with a higher power. The launchers will need to reach a higher altitude, and deorbiting the satellites when they reach their end of life will require more manoeuvring capabilities. This all must be taken into account, but it is also very dependent on satellite platforms, payloads and launching capabilities.

Distributed Processing Facility 

Space-based computing

Space-based computing has been increasingly taken into consideration over the past few years. Among others, we mention the innovative EU-funded study Advanced Space Cloud for European Net zero emission and Data sovereignty (ASCEND) [10], which focuses on the feasibility of deploying space-based data centers and relying on space-based cloud based solutions [11].

In May 2025, China launched the first 12 satellites of a planned 2,800-strong orbital supercomputer satellite network. These satellites aim at performing calculations in space without relying on any ground-based computing facility.

Computing in space offers three major advantages compared to traditional ground-based systems:

• Reduced data transmission costs: Processing data locally in space reduces the need to downlink large volumes of data to Earth, saving bandwidth and costs;

• Low latency: The mutual proximity of satellites in the constellation reduces communication delays, enabling faster data processing;

• Scalability: Space-based cloud computing can potentially scale by deploying additional resources (later named spare satellites) and can be reconfigured dynamically.

A centralized space-based solution 

A straightforward route to designing an efficient space-based processing facility is to rely on a centralized space-based solution, where an independent and already in place infrastructure located in space hosts the entire calculation. This solution exploits already existing algorithms and relies on computing infrastructures currently used on ground-based systems. Nevertheless, this easy to follow route faces the following three main challenges:

• Single point of failure: The entire computing system relies on a single dedicated platform. This means any hardware or software failure can disable the entire computing capability, unless duplicate/diversified computing capabilities are incorporated into the constellation. This expensive solution makes the global infrastructure rather complex.

• Communication: All data must be routed to and processed by the centralized unit, which represents a major bottleneck in terms of communication and elapsed times before calculation. High communication loads may significantly reduce real-time responsiveness;

• Energy inefficiency: A centralized computing solution may require high power consumption for processing large data movement within the single dedicated infrastructure. This may create additional energy constraints.

A fully distributed space-based solution

For all these reasons, an alternative solution must be proposed. In a fully distributed space solution, each satellite in the LFS constellation corresponds to a specific node of the distributed computing facility. Each satellite of each subconstellation acts as a computational unit and communication between the different nodes is handled by ISL links. 

With at least two LFS visible beyond 5° elevations of any user on Earth, the estimated total number of satellites of the global constellation is bounded by 96. Because half of the LFS are attributed to the augmentation message, the total number of nodes of the computing facility is bounded by 48. This moderate network size for a distributed computing facility allows state-of-the-art parallel algorithms to be employed to compute and broadcast messages [12] [13]. At first sight, distributed computing offers immediate advantages over a centralized solution: 

• Efficiency: Multiple nodes can handle different computations concurrently. This speeds up the overall computation of navigation messages with respect to a centralized solution, where communications may become a significant bottleneck;

• Fault tolerance: Because processing is spread across multiple nodes, random failure of one node does not necessarily harm the entire navigation system. Other existing nodes of the LFS-A subconstellation may take over degraded tasks. This flexibility is one of the main advantages of the distributed computing solution. Additional spare satellites also may be incorporated into the LFS-A subconstellation to improve fault tolerance.

• Redundancy: Distributed systems can implement both hardware and software redundancy more naturally by duplicating specific critical functions across multiple nodes, reducing potential single points of failure resulting from random failure.

The distributed computing facility relies on the core idea that each node performs a specific part of the computational workload and exchanges messages (possibly with each other) through ISL links. At the end of the procedure, the results are gathered by each LFS to generate a common navigation context. This may induce a potentially high volume of point-to-point or collective communications between the nodes of the LFS-A constellation. Therefore, it is of outmost importance to rely on algorithms that minimize the global volume of communication. The computation of the state vector during the filtering process in the PS function provides an instructional example in this regard. Of interest is a parallel algorithm for the solution of least-squares problems that requires a low volume of communication. Does this orthogonal factorization distributed algorithm exist at all?

The answer to this question is positive if we rely on advanced numerical linear algebra methods for the solution of least-squares problems. In our context, a parallel algorithm named Communication-Avoiding QR (CAQR) is worth considering [14]. CAQR is a class of QR orthogonal factorization algorithms designed to minimize (and not avoid) the costly communication between nodes in distributed systems. Because data movement often dominates the energy consumption and runtime of numerical algorithms, CAQR aims at improving both performance and energy efficiency by reducing the communication overhead. Communication in our context includes data transfers, which are often more expensive (in time and energy) than arithmetic operations [12]. This reduction of communication overhead is obtained through a specific factorization: CAQR typically divides the matrix to be factorized into different panels (i.e. blocks of columns). Instead of applying the classical Householder QR method [15], [16] on the panel, CAQR applies Tall-Skinny QR (TSQR) [17] instead, a specific QR factorization. TSQR minimizes communication by recursively factorizing smaller blocks, using a reduction tree structure (e.g., a binary tree of partial QR factorizations) to combine results efficiently with limited data movement [18] [19]. In short, communication costs are reduced by organizing QR operations as tree-structured reductions rather than linear sequences. This algorithmic feature enables parallel processing of independent blocks, combining partial results with minimal communication steps. The number of communication steps is logarithmic in the number of panels [20].

By significantly reducing the volume of communication, CAQR delivers a reduced energy consumption while providing improved overall runtime [14]. CAQR maintains the numerical stability properties of classical Householder QR factorizations, ensuring accurate and reliable factorization results despite the communication optimizations. At the end of the algorithm, the solution of the least-squares problem is known on a leaf of the reduction tree and a single collective communication is used to share this information on the other nodes of the LFS-A subconstellation. This shows a distributed algorithm with a low overhead in terms of communications can be applied during the filtering process. 

Space-based distributed computing is a doable approach that introduces additional constraints to satisfy during the design of the architecture of the spatialized SBAS: 

• Limited computational resources: Each node has a specific limited CPU (or GPU) power, memory and energy compared to Earth-based computing centers. A key point is to optimize the global hardware resource efficiency with respect to the properties of the LFS-A subconstellation (number of satellites and total volume of communication essentially);

• Physical and environmental constraints: Space-based computing often meets challenging physical conditions (such as temperature extremes, vibration, radiation in space) that may affect hardware reliability. Hardware must be resilient against environmental factors. A key point is to overestimate the number of satellites in the LFS-A subconstellation to provide redundant calculations.

These additional constraints must be carefully considered when designing the global constellation and when performing the safety analysis.

Safety Dimensioning in New SBAS Architecture Concepts

When analyzing novel SBAS architectural concepts from a safety standpoint, it is imperative to recall the overarching safety dimensioning principles to guide the assessment of their compliance and the identification of associated constraints.

This analysis is framed within the context of civil aviation. At the system level, the primary safety-feared events and their corresponding severity classifications are defined as:

• Integrity is customarily established as the measure of the trust that can be placed in the correctness of the information supplied by a navigation system. Integrity includes the system’s ability to provide timely warnings to users when it should not be used for navigation. A failure in integrity, termed a “non-integrity event,” is linked to a hazardous severity classification [21].

• Continuity is the ability of the total system (comprising all elements necessary to maintain craft position within the defined area) to perform its function without interruption during the intended operation. More specifically, continuity is the probability the specified system performance will be maintained for the duration of a phase of operation, presuming the system was available at the beginning of that phase. A “non-continuity event” corresponds to a major severity classification [21].

Foundational Safety Engineering and Safety Assurance Principles

The applicable European Cooperation for Space Standardization (ECSS) standards in Europe stipulate that “no single system failure or single operator error (SPOF) shall have critical (i.e. hazardous) or catastrophic consequences.” This has profound architectural implications; it requires that any function whose failure could result in critical/hazardous consequences must be underpinned by a minimum of two independent components.

Development Assurance Level (DAL)

Given the safety-critical nature of civil aviation, software development is governed by rigorous standards. Safety analyses underpin the allocation of Development Assurance Levels (DAL) to various items in accordance with the architecture.

Development Assurance involves specific planned and systematic actions providing confidence that errors or omissions in requirements have been identified and corrected to the degree the system implemented satisfies the applicable safety requirements. System/sub-systems and products are assigned DALs based on failure condition classifications associated with system level functions implemented in the sub-systems and products. The rigor and discipline needed in performing the supporting processes vary corresponding to the assigned development assurance level.

The initial software DAL determined can be mitigated when considering the different kinds of protections or alternate potential design implemented into the architecture, with provision that evidence of full independence between involved software functions is provided. Finally, the DAL allocation is a consequence of the implemented architecture: The redundancy, independence, and segregation embedded within the architecture dictate the refinement of DAL assignments. DAL levels play a pivotal role in component selection and exert a significant influence on project costs. It is prudent to iteratively assess candidate architectures to converge upon an optimal solution.

Software failures with potential hazardous implications (e.g., non-integrity events in SBAS) necessitate DAL B [22]/SWAL 2 [23].

Software failures leading to major events (e.g., non-continuity events and Accuracy Major event in European SBAS) require DAL C [22] / SWAL 3 [23].

In typical SBAS architectures, functions contributing directly to the integrity check of augmentation messages and certain critical data dissemination tasks—those that guarantee the non-corruption of broadcast messages—are assigned DAL B, in recognition of their integrity-related criticality. Conversely, functions related to data collection and non-critical dissemination generally carry a DAL C assignment in Europe, reflecting their continuity focus.

Emitted SBAS Signal Monitoring

For any safety-critical system intended for safety-of-life applications, the following principle remains salient: Wherever possible, the SBAS system should internally monitor its own transmitted signal, permitting real-time awareness of failures (primarily those in the dissemination chain) and take adequate actions instead of relying on open-loop operation. While not a formal requirement provided other safety principles (in particular the SPOF principle) are observed, this best practice is inherent to the present concept.

Implementation of Safety Principles in Operational European SBAS EGNOS V2

These foundational safety principles are stringently applied in the operational European EGNOS system, with their fulfillment evidenced across the following major functions:

Data Collection: EGNOS V2 employs physically and logically separated RIMS A and B chains, both developed according to DAL C1.

• Augmentation Message Calculation and Integrity Checking: The Central Processing Facility (CPF), assigned DAL B1, comprises two independent units fed by independent data: the PS fed by RIMS-A and the CS fed by RIMS-B. In accordance with [22], the PS is allocated DAL C1 and the CS receives DAL B1. This dual-channel design directly supports enforcement of the SPOF principle.

• User Dissemination: The operational SBAS in Europe relies on NLES and GEO segments. Safety-critical integrity related functions—such as CPF selection and Integrity Check— are segregated and allocated DAL B. Functions that contribute primarily to continuity rather than integrity are assigned to DAL C1.

The integrity check function—which continuously verifies the fidelity of the broadcast NOF via the Integrity Box—effectively upholds the SPOF principle by precluding integrity events stemming from a single failure or corruption of the NOF within the dissemination chain. This mechanism ensures continuous monitoring of the emitted SBAS signal, empowering the system to respond appropriately in the event of any dissemination anomaly.

Complementing this capability, GEO signals as received at the RIMS, are relayed to the CPF, facilitating the prompt issuance of alarms or corrective actions whenever discrepancies are identified. Should a failure—specifically, NOF corruption—arise within the dissemination chain (in cases where the chain does not broadcast the information as instructed by the CPF), it is possible that, even if the CPF detects the anomaly and generates alarms, these messages might not be transmitted due to the compromised dissemination chain. The integrity check function is designed to address this scenario.

Compliance of the Fully Space-Based SBAS Concept with Safety Requirements

At the system level, from a safety perspective, the high-level architectural proposal is summarized in Figure 9. 

At the system level, the architecture preserves the logic of maintaining two independent channels—extending from data collection through correction computations and integrity checks. This dual-channel strategy ensures adherence to the SPOF principle at the highest level. Specifically, LFS-A is dedicated to feeding the PS, whereas LFS-B supplies the CS. The strict separation between LFS-A and LFS-B guarantees the independence of input data for each critical process. 

The correction PS, sourced from LFS-A, is entrusted with generating corrections and the associated integrity bounds. In parallel, the CS leverages independently sourced measurements from LFS-B to validate the corrections and their integrity parameters. This rigorous, independent, dual-channel design ensures a single fault or failure cannot compromise overall system integrity.

For data collection, several considerations stem from safety recommendations. Positioning GNSS data collection stations is critical for the calculations performed by the SBAS processing system. Leveraging mobile GNSS data collection stations introduces the necessity to strictly ensure the accuracy of their geospatial coordinates. To safeguard against error or bias propagation, the positioning solution for LFS stations should be established using means and data independent from those employed by the SBAS system itself. This mitigates the risk that systematic biases or errors could be inadvertently transmitted into the final positions computed by the SBAS. Solution 3 (“LFS orbits are calculated using independent means and independent measurements”) directly fulfills this requirement for independence. In addition, leveraging ISL connectivity with ranging capabilities further increases and consolidates the accuracy of LFS location estimates.

Deploying two distinct fleets—LFS-A and LFS-B—allows separation between correction computation and integrity verification channels. With their positioning, LFS-A and LFS-B will achieve substantially different observation geometries; the system hence ensures data streams used for corrections and integrity bound computations and those for integrity checks remain independent, enhancing the robustness of integrity check.

Analogously to the RIMS DAL C allocation within “terrestrial” SBAS systems—attributed for their respective contributions to continuity—the data collection function is designated a DAL C1.

With respect to data processing and integrity verification, the principle underpinning this architecture is to preserve complete independence between the PS and the CS, upholding the SPOF criterion. To this end, the PS and CS are provisioned with independent inputs from LFS-A and LFS-B respectively, each implementing diversified algorithms purposed to detect and mitigate feared events, initiate appropriate alarms when required, and compute/verify corrections and associated integrity bounds.

Drawing upon a safety monitoring principle [22] that’s applied within operational EGNOS V2, the PS is allocated DAL C1, whereas the CS receives a DAL B1 allocation. These designations impose considerable constraints on software development for the LEO satellite segment.

Both the PS and the CS are proposed under the paradigm of a “fully distributed space-based solution,” whereby the PS function (and likewise the CS function) is performed by an “active sub-pool” of LFS-A (and, correspondingly, of LFS-B). Owing to the permanent communication links established among all LFS units, any failure occurring within one of the active sub-pool LFS nodes is instantaneously propagated. This enables the swift activation and integration of a replacement LFS into the active sub-pool for a given PS/CS sub-function. Thanks to the scale of the constellation, the computational resources available to each LFS unit, and—critically—the capability afforded by the ISL that ensures all LFS nodes maintain an identical level of information, the system can exploit “hot redundancy” among LFS nodes for PS and CS sub-function. This design enhances the overall availability and continuity of the global system.

The concept’s reliance on transmitting a singular, uniquely defined NOF stream simplifies redundancy management across both user receivers and within the system’s own infrastructure.

It is noteworthy that the alternative logic of a “centralized space-based solution” is not inherently prohibitive from a safety perspective. While such an approach does introduce a central point of failure from a RAMS standpoint, this vulnerability can be mitigated by implementing robust redundancy architectures or, if needed, diversified processing chains. Such design adaptations could render the centralized solution sufficiently resilient, thereby restricting its adverse impact on system availability and continuity.

The dissemination of the NOF concept entrusts the LFS with dissemination responsibilities, diverging from the conventional reliance on GEO satellites typical of SBAS. 

Broadly, a failure within the dissemination chain may precipitate:

• A continuity event, triggered by loss of functional capability;

• An integrity event, arising from corruption of the NOF by the LFS.

In the first scenario, loss of a single LFS impacts availability and continuity, but these consequences are geographically constrained and limited to a small subset of users (in marked contrast to the loss of a GEO satellite), rendering such events generally acceptable.

Conversely, in the event of NOF corruption by an LFS, a potentially significant integrity event may ensue. Owing to the density of the LEO constellation, comprehensive real-time monitoring of all NOF transmissions from all LFS assets is unfeasible for the SBAS system. As a consequence, a single undetected failure could compromise system integrity. The safety concept herein articulated recommends users monitor at least two independent LFS sources and cease using the service if discrepancies are detected between the NOF received from these sources.

This mitigation is not considered fully satisfactory from a safety standpoint. First, it does not necessarily protect against all types of dissemination failures, such as systematic software faults affecting LFS-A, which could lead to correlated failures across seemingly independent units. Secondly, it places the burden of integrity monitoring on the user, exposing a fundamental limitation in the system’s intrinsic ability to autonomously detect and respond to dissemination failures—which is not optimal from a safety perspective.

Option-2 offers a different approach, whereby the NOF broadcast from LFS-A is subject to independent monitoring by a separate LFS-B asset, typically operating at a lower orbital altitude. In this arrangement, LFS-B would possess the authority to inhibit or terminate transmissions from LFS-A if an inconsistency or corruption in the NOF is detected. This monitoring of the LFS-A by the LFS-B would be DAL B allocated. 

Additional Safety Considerations and Way Forward

These safety considerations do not identify any fundamental showstoppers to the global SBAS concept using a fully space-based infrastructure. This concept eliminates de facto classic local ground effects such as multipath, interference, tropospheric delays, and tidal effects, improving performance. Nevertheless, several broader points must be explored: 

Applicable SBAS Regulatory Framework 

The safety reference framework and associated requirements considered are currently in force for SBAS within Europe. One major consequence of this regulatory baseline is the requirement for dual, fully independent “A” and “B” chains—most notably, the need for PS and CS functions to be separated and developed respectively to DAL C and DAL B. In particular, the imposition of DAL B on software development for LEO satellites may result in very significant development costs.

The SPOF principle for critical/hazardous events, as inherited mainly from ECSS, appears to be more stringent than those applied in the aeronautical domain. A review of [21] reveals:

• No explicit “no SPOF” criterion for hazardous failure conditions;

• No requirement that no combination of two independent system failures or operator errors should lead to catastrophic consequences (required by the ECSS). 

Notably, aeronautical standards demand the absence of SPOF only in the case of catastrophic consequences. In Europe for a SBAS, the requirement for no SPOF in critical/hazardous systems may be justified by the large number of aircraft potentially affected by any failure—a rationale that arguably holds even greater weight for a global system of this nature.

Applying the SPOF principle at the critical/hazardous level mandates the implementation of two independent chains for the CS and PS. It would be relevant to analyse this architecture and corresponding DAL allocation in light of the [24] guidelines (which are not part of the European baseline for SBAS). According to [24], if a hazardous failure condition could result from a combination of possible development errors between two items, either one should be allocated at least DAL B, or both should be assigned DAL C. This latter approach could offer a more balanced allocation of development assurance levels and potentially alleviate some of the stringent constraints currently imposed on LEO satellite software development. 

With regard to implementing the approach outlined in [24], the current concept involves exchanges between the PS and CS chains. In particular, the function responsible for generating corrections and integrity bounds is not fully duplicated across both PS and CS chains. Should the current level of independence between PS and CS be insufficient to comply with the principles set forth in [24], minor modifications to the concept could be considered. For instance, the PS functions could be integrated within the LFS-B, with dissemination of information also performed by the LFS-B (as in Option 2). In this case, two NOFs would be distributed, and a voting mechanism at the user level would help identify an erroneous NOF. However, this scenario would lack monitoring of the NOF broadcasted by the LFS-B to the user.

Identification of New Feared Events Arising from Spatialization 

Introducing “fully based” elements—specifically the implementation of ISL, using the DORIS system, and the spatialization of equipment that is traditionally ground-based in an SBAS—should lead to identifying new internal feared events to address in the system-level analysis.

Global System Considerations

The core strength, innovation and advantage of this concept lie in its potential to provide truly global coverage for integrity services. The positive implications of such an advancement would be substantial, but it’s necessary to address questions regarding responsibilities and roles among different countries, particularly given the safety-critical nature of the service on a worldwide scale.

Conclusions 

This article explores a groundbreaking shift in SBAS architecture by proposing the spatialization of its core components—data collection, augmentation message computation and dissemination—within a distributed network of LEO satellites. By moving reference stations into orbit as LFS, the system achieves global GNSS visibility, eliminates the constraints imposed by terrestrial station distribution, offers a worldwide service, and significantly enhances the accuracy and resilience of navigation augmentation data.

The architecture leverages advanced technologies like inter-satellite links and space-based distributed computing, enabling real-time data sharing, independent time scale generation, and robust integrity monitoring. The proposed partitioning of the constellation further meets stringent safety-of-life requirements, ensuring redundancy, diversity of observations, and fail-safe operations.

Simulation results demonstrate that appropriately sized LEO constellations can guarantee continuous visibility and redundancy for service availability, while the distributed processing facility uses state-of-the-art parallel algorithms to minimize communication overhead and maximize computational efficiency. While the technical feasibility is affirmed, the design must also accommodate the unique constraints of space infrastructure—including hardware resilience, energy consumption and operational safety.

Overall, this study shows that a globalized, space-based SBAS could offer transformative improvements in augmentation accuracy, reliability and scalability—paving the way for a next-generation system capable of meeting the demanding needs of civil aviation navigation on a truly worldwide scale. Future work will focus on refining the constellation design, optimizing system safety, and addressing the operational and certification challenges inherent to spaceborne navigation augmentation. 

Acknowledgment 

The authors thank Michel Monnerat for discussions regarding receiver signal processing and Celine Renazé for her useful advice and recommendations. 

References

[1] ICAO Standard and Recommended Practices (SARPs), Annex 10, Volume 1, up to Amendment 93

[2] D. Flament, J. Poumailloux, J-L. Damidaux, S. Lannelongue, J. Ventura-Traveset, P. Michel, C. Montefusco, “The EGNOS System Architecture Explained”, May 2011.

[3] User Guide for EGNOS application developers, Ed. 2.0, 15/12/2011, ISBN 978-92-79-20335-0 ESA.

[4] M. Laurenti, L. Maisonobe, P. Roldan, J. Anton, P. Guerin, S. Trilles, “Improving GNSS Navigation Messages Performance using Inter Satellite Links Technology”. Inside GNSS May/June 2024, pp 36-42

[5] Brown, K. R. (1992). The Theory of the GPS Composite Clocks, Proceedings of ION GPS-91, 11-13 September 1991, pp. 223-242.

[6] Greenhall, C. A. (2007). A Kalman filter clock ensemble algorithm that admits measurement noise: corrections and update, Metrologia, 44, 491-494, doi:10.1088/0026-1394/44/6/008

[7] Senior, K. L., & Coleman, M. J. (2017), The Next Generation GPS Time, NAVIGATION: Journal of The Institute of Navigation

[8] Roldan, P., Trilles, S., Serena, X., Tajdine, A., “Novel Composite Clock Algorithm for the Generation of Galileo Robust Timescale,” Proceedings of ION GNSS 2022, September 2022, pp. 2790-2799. https://doi.org/10.33012/2022.18521

[9] C. Renazé, C. Bourga, M. Clergeaud, J. Samson, “Reduction of system time to alert on SBAS”.  Inside GNSS, November-December 2023, pp 28-36

[10] https://ascend-horizon.eu/

[11] https://www.thalesaleniaspace.com/en/press-releases/thales-alenia-space-reveals-results-ascend-feasibility-study-space-data-centers-0

[12] G. Hager and G. Wellein, “Introduction to High Performance Computing for Scientists and Engineers”, CRC Press, 2011.

[13] P. Pacheco and M. Malensek, “An Introduction to Parallel Programming”, 2nd Edition, Morgan Kaufmann, 2021.

[14] J. Demmel, L. Grigori, M. F. Hoemmen, and J. Langou, “Communication-optimal parallel and sequential QR and LU factorizations”, SIAM Journal on Scientific Computing, Vol. 34, 1, pp. A206-A239, 2012, https://doi.org/10.1137/080731992

[15] Å. Björck, “Numerical Methods for Least Squares Problems”, 2nd Edition, SIAM, 2024.

[16] G. H. Golub and C. F. Van Loan, “Matrix Computations”, 4th Edition, Johns Hopkins University Press, 2013.

[17] M. F. Hoemmen, “Communication-avoiding Krylov subspace methods”, PhD thesis, University of California at Berkeley, 2010.

[18] E. Agullo, C. Coti, J. Dongarra, T. Hérault and J. Langou, “QR factorization of tall and skinny matrices in a grid computing environment,” 2010 IEEE International Symposium on Parallel & Distributed Processing (IPDPS), Atlanta, GA, USA, 2010, pp. 1-11,  https://doi.org/10.1109/IPDPS.2010.5470475.

[19] G. Ballard, J. Demmel, L. Grigori, M. Jacquelin, N. Knight, H.D. Nguyen, “Reconstructing Householder vectors from Tall-Skinny QR”, Journal of Parallel and Distributed Computing, Volume 85, pp. 3-31, 2015. https://doi.org/10.1016/j.jpdc.2015.06.003.

[20] J. Dongarra, L. Grigori and N. Higham, “Numerical algorithms for high-performance computational science”, Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences, 378(21666), 2020. https://doi.org/10.1098/rsta.2019.0066

[21] CS-25 – European Union Aviation Safety Agency Certification Specification for Large Aeroplanes.

[22] ED-12B/DO-178B – Software Considerations in Airborne Systems and Equipment Certification

[23] ED-109A/DO-278A Software Integrity Assurance Considerations for Communication, Navigation, Surveillance and Air Traffic Management (CNS/ATM) Systems

[24] ARP4754B – Guidelines for Development of Civil Aircraft and Systems

Authors

Sébastien Trilles is an expert in navigation algorithms and performances. He received his Ph.D. degree in Pure Mathematics from the Paul Sabatier University and an Advanced M.S.in Space Technology from ISAE-SUPAERO. He heads the Performance and Processing Department where high precise navigation algorithms are designed as orbitography, system reference time generation, clock synchronization and time transfer, integrity and ionosphere modeling.

Thierry Authié is a specialist in navigation algorithms at the Performance and Processing Department of Navigation Domain, Thales Alenia Space. He received his M.S in Applied Mathematics from the Institut National des Sciences Appliquées (INSA), Toulouse (France). He currently works as navigation specialist in Advanced Projects.

Xavier Vasseur is a specialist in scientific computing at the Performance and Processing Department of Navigation Domain, Thales Alenia Space. He received his M.Sc degree from Ecole Centrale de Nantes (France) and his Ph. D. degree in Computational Fluid Dynamics from University of Nantes.

Marie Abbal is safety manager of Advanced Projects in Navigation Domain. She received her M.Sc degree from Ecole des Mines de Paris. She worked from 2009 to 2016 at Electricité de France company (EDF), particularly in nuclear safety. She joined Thales Alenia Space in 2016 as a safety specialist in complex and critical space system

The post The Case for Spatializing Global SBAS appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

“How was the weather up there?” my friend asked.

I had just finished chairing the last session of the 2026 Munich Space Summit. The final question from the audience was in the nature of “why don’t we have a terrestrial system across most of the globe to back up GNSS and make the world safer?”

That triggered my “preacher mode.” I had mounted my soap box (hence the question about the weather up there) and given a version of my favorite sermon:

“Water and electricity are essential utilities. Today, PNT is also an essential utility, but it is invisible to almost everyone. This invisibility, especially among political leaders and other decision 
makers, is a big obstacle to implementing complementary and backup systems for GNSS. Folks here at the summit are respected experts. You have a duty to share your knowledge and understanding with others, especially national governments. Go forth and tell the story.”

It was very much like the message I offered in 2017, but, nine years later, was a bit more urgent. While the West has seen some movement toward greater resilience since then, one wonders if it is commensurate with the increases in obvious threats and risks.

By the way, to answer my friend’s question—the weather on top of my soapbox usually seems clear. But there is always a chance of rant.

Munich 2017: Admitting a Solvable Problem

The 2026 event was my second time at the Munich summit. The first was in 2017. That year’s theme was “GNSS—Time for a Backup?”

Spoiler alert: The resounding answer from all was “yes!”

I was privileged to chair a distinguished panel asked to discuss the summit’s theme question. The “set up” in the program was:

The Challenge: GNSS has been described as “…a single point of failure for critical infrastructure.” Free and available anywhere with a view of the sky, GNSS timing and location signals have been incorporated into virtually every technology. GNSS service disruptions are caused by natural events, accidents and equipment malfunctions. Malicious acts by nation states, terrorists, organized crime, and “privacy seekers” are a widespread and increasing problem. Many nations are considering establishing terrestrial PNT systems to complement GNSS, or encouraging industry to establish such systems as a partly commercial enterprise. Members of the panel will be asked to describe desirable characteristics of such systems.

Definitions: For the purpose of this panel, “Backup” will be understood to mean one or more PNT systems to complement GNSS services. Complementary systems continuously operate alongside and seamlessly with GNSS and can be integrated in the same timing and navigation receivers.

While it was nine long years ago, the set up and panelists’ observations seem as on point today as they were then. Here is what the experts said nine years ago:

• Dominic Hayes (European Commission) discussed a project that at that point had collected the electronic signatures of over 100,000 jammers in Europe. He called for a comprehensive approach and said more than one complementary system would likely be needed if everyone was to be protected.

• Gian-Gherardo Calini (European GNSS Agency) agreed that more than one backup was needed and urged users to protect themselves.

• Francis Zachariae (IALA) asked who was responsible for protecting GNSS services. He opined that a big obstacle to progress was that we have not had a major failure event. 

• Tony Flavin (Chronos) agreed the lack of a major failure had led to complacency. Also, using multiple GNSS did not provide much protection as most jammers hit all the systems simultaneously.

• Guy Buesnel (Spirent) discussed how spoofing was getting easier and cheaper, and that users need a warning when GNSS is not reliable. He also said spoofing and jamming were impacting aviation safety and operations.

• Professor Per Hoeg (Technical Institute of Denmark) cautioned that not all threat vectors were malicious. Solar activity can also profoundly impact GNSS signals.

• John Fischer (Orolia-Spectracom) discussed the importance of networks and the danger of over-dependence on space-based timing for synchronization.

• Harold “Stormy” Martin (U.S. National Coordination Office) said the U.S. President directed action on a GPS backup in 2004 and Congress had recently reinforced the need. His government was developing system requirements. It was long past time for a backup, he said.

Side discussions (often the most productive at such events) focused on technical mitigations and solutions. Galileo’s Public Regulated Service (PRS) service, ideas for low Earth Orbit (LEO) PNT, and terrestrial systems.

One attendee, Reelektronika’s Durk Van Willigen, even showed off an integrated GNSS/eLoran/Chayka receiver only 6 cm long. His company had developed it to meet what they saw as an emerging need.

The mood at and coming out of Munich 2017 was one of concern and expectation. The issues were clear and well understood. Yet, this was a solvable problem. Importantly, leadership in the European Union (EU) and U.S. were working on it. 

Munich 2026: “How Do We Get There?”

Concerns expressed in 2017 were well represented and amplified at this year’s Munich Space Summit. Mentions of jamming, spoofing and other interference were ubiquitous and almost offhand. In 2026, disruption is no longer unusual. It is a normal part of the environment.

Yet, the agenda did not address the question of whether one or more complementary systems were needed to protect GNSS and users. It was an assumption in nearly every panel, every presentation, and every comment. 

Panel topics included phrases like “resilient navigation, “multi-layer PNT” and “multi-faceted PNT.” Difficult times and the need for trust were regularly mentioned.

And, in a surprising parallel to 2017, an attendee at the event’s grand evening reception had his newest micro receiver with him to show around. Trevor Landon gave me a look at the new Iridium ASIC. 

Recognition of the need for complements and alternatives to GNSS was universal. There was less agreement on which systems should be implemented.

But this was to be expected. Many, if not most, attendees have already decided on their favorite system. They’ve dedicated years of effort to developing and understanding their technology, have a substantial financial interest in its success, or both. And the systems discussed were overwhelmingly space-based or space-dependent. Which made perfect sense. It was the Munich Space Summit, after all. 

Progress Since 2017

The last day, last panel, and last question of the summit was why, nine years later, we have not done more about complementing and backing up GNSS. 

For the previous two and a half days, incredibly intelligent and capable people had affirmed the need and demonstrated that a wealth of solutions are available. 

Private and government studies in the West have shown the value of combining signals from space, terrestrial broadcast, and fiber-based timing. This “resilient triad” can create a national PNT architecture that is very difficult to disrupt. Extant systems in China, Russia, South Korea, and elsewhere are exemplars of what’s possible.

Many rightly question why the West hasn’t made more of a start. In fairness, some projects are underway, and others are emerging.

The EU is exploring LEO PNT and launched the first two Celeste satellites the day after the summit closed. U.S. companies Xona Space Systems and TrustPoint have made their business cases and are in the early stages of building their constellations. 

Scandinavia is building out a fiber timing network connecting Sweden, Finland and Norway. There are papers and proposals for the EU to do the same thing on the continent.

Baltic nations have extensively tested R-mode for maritime. The European Aviation Safety Agency has issued an action that suggests examining additional navigation sources, though such a study would be done in the distant future.

More proactively, the United Kingdom is the first Western nation that’s committed to establishing a coherent and integrated resilient PNT triad. A fiber timing network with three centers spread across Britain is being implemented. It will feed users directly and support a terrestrial broadcast eLoran network that will serve the entire nation and most of the North Sea. The UK government is also investing in LEO PNT. 

While less public about its plans, France has recently joined the UK in its eLoran project. Depending on the scope of the French effort, the two systems could provide high-power terrestrial broadcast time to most of Western Europe. This signal at 100kHz would presumably complement France’s existing 162kHz time signal. Also, the Paris Observatory has been forward leaning on international time synchronization over fiber. It has established synchronizing optical fiber links with laboratories in the United Kingdom, Italy and Germany.

But Is It Enough?

One can rightly ask if enough has been done in enough places. 

Has Europe progressed far enough and in enough ways to mitigate the risk of daily minor disruptions and the much greater risk of PNT denial in struggles between major powers?

And what of the inter-dependent world writ large? 

Major economies in the United States, Japan, India, Brazil, Canada, Australia, and Mexico seem to still be overwhelmingly dependent on highly vulnerable signals from space. For smaller economies, the idea of sovereign, resilient PNT to complement GNSS may not even be a “someday” vision.

Yet, there are very, very few among the world’s eight billion people who don’t depend on uninterrupted PNT service in their daily lives. For many, the possibility of a major GNSS disruption is an invisible sword of Damocles.

And let’s all remember, as those who understand the issues, our duty to speak up and share our knowledge and concern. Too often I hear that such issues are “above my paygrade.” If your boss doesn’t know the problem and isn’t concerned and involved, then this issue is exactly at your pay grade. You have a duty to speak out.

Let’s strive to ensure the next nine years see more progress instituting widely adopted resilient PNT than we saw in the last nine. We owe it to ourselves and the world we serve.

OK, now the weather atop the soap box seems like it is turning to rant. So, as they say in church, here endeth the sermon. Go in peace. 

The post Munich 9 Years On: Same Message, More Urgency appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Attacks on GNSS are no longer simply a nuisance or a trivial disruption we can afford to ignore. Spoofing and jamming have become increasingly widespread, driving economic losses and costing lives, both in military operations and in civilian settings. Now, more than ever, we need to look closely at backup and complementary solutions that can fill the voids when GNSS falls short.

I recognize this may come across as cliché; however, in this case, it is not. The threat is real. The urgency is real. And the consequences of inaction are becoming harder to ignore.

Low Earth orbit, or LEO, positioning, navigation and timing (PNT) may be one of the most important answers. Commercial companies are creating mega-constellations to harness the many advantages of LEO, and it has become clear that LEO satellites could play a major role in future PNT architectures. In some applications, LEO could complement GNSS. In others, it may provide a space-based alternative when GNSS is degraded, manipulated or denied altogether. There is a lot of interest and excitement around LEO in the industry, and for good reason. It is an emerging area that many of us are studying with intensity and enthusiasm. But there are different schools of thought on how best to leverage LEO PNT, and the path forward comes with its own technical, operational, commercial and regulatory challenges.

That is why this column is born and will exist in every edition. 

Inside LEO will explore how LEO systems are reshaping PNT, communications, resilience and the broader architecture of space based services. LEO is not just another orbit. It changes the signal environment, the economics, the business model and, potentially, the way users think about trust in PNT.

But let’s be clear: LEO PNT is not a new, revolutionary concept. In fact, the first satellite navigation system, Transit, was a LEO system developed in the 1960s. Through Transit, we learned that LEO PNT is both a blessing and a curse.

It is a blessing because of speed, geometry and signal strength. LEO satellites are closer to Earth and move quickly across the sky. Those characteristics can be extremely useful for navigation. But LEO is also a curse because it requires a large number of satellites to provide persistent, useful coverage. During the Transit era, users often had to wait an hour or more to get a position fix. That was not exactly ideal then, and it is certainly not acceptable for the world we live in today.

To address the LEO curse, we needed a very large number of satellites, which was not feasible given launch capabilities in the 1960s. That is why GPS quickly became the dominant PNT system. A medium Earth orbit (MEO) architecture, where GPS operates, achieves comparable performance with an order-of-magnitude fewer satellites than would be needed in LEO. GPS’s design mitigated the problem of slow position fixes while still delivering high accuracy and continuous global coverage. Yes, GPS had limitations, particularly in urban canyons and indoors, but those were limitations users could often live with or augment using localized sensors.

For decades, GPS and then GNSS were enough for many applications.

In an ideal world, it might have stayed that way. But times have changed. GNSS alone is no longer enough.

The Emergence of LEO PNT

Two things happened simultaneously and independently: the rapid development of autonomous systems and continuous, escalating attacks on GNSS. Autonomous platforms exposed the limits of GPS alone in safety critical, dynamic environments. At the same time, spoofing and jamming became easier, more accessible and more prevalent, both in military theaters and in civilian life.

The PNT community realized something had to change. The search for complementary and backup solutions became urgent. LEO PNT emerged as one of the most intriguing options.

Although satellites started to launch into LEO in significant numbers in the late 1990s, interest in LEO PNT did not really accelerate until around 2017 or 2018. That was when Starlink announced plans to put nearly 12,000 satellites into LEO. This was significant because, at the time, there were not even close to 12,000 satellites in all of LEO combined.

Many people thought that target number was wishful thinking. I took it seriously and started studying LEO PNT with existing constellations [1].

My lab started with Orbcomm satellites and developed the simultaneous tracking and navigation (STAN) approach to address their poorly known signal, ephemerides and timing [2, 3]. In 2018, we conducted the first post-Transit LEO PNT experimental demonstration with non-cooperative satellites, where we navigated an unmanned aerial vehicle (UAV) by exploiting Orbcomm LEO signals of opportunity. We experienced first hand experimentally the curse that had plagued LEO in the past. Our navigation solution began to degrade after about 30 seconds (Figure 1) [4]. We also drove a vehicle in Southern California for a few kilometers. The errors were on the order of hundreds of meters (Figure 2) [1].

So, yes, LEO can give you a navigation solution. But with sparse constellations and limited observability, it is not necessarily accurate enough for many modern applications. That changes when you add satellites. Many satellites (Figure 3).

When there are thousands of satellites in LEO, the geometry, availability and signal opportunities begin to change dramatically (Figure 4). You start to get performance that can become comparable to GNSS in certain respects and potentially superior in others. That is what makes mega constellations a game changer for LEO PNT.

Right now, GNSS is the only truly global sensor. LiDAR, vision and radar are powerful, but they are proximity sensors. They can help keep you from colliding with a car or a building, but they do not readily place you directly in a global reference frame. They also do not work equally well in every environment. If you are in an aircraft at 38,000 feet or flying over an ocean with no features, how much can vision help you? If you are operating in a feature poor, denied or degraded environment, what sensor gives you global context?

That is the promise of space based PNT. And LEO, if we learn how to use it properly, can provide a new and powerful layer in that architecture.

The Reason LEO is so Compelling Starts with Physics

LEO satellites are much closer to Earth than GNSS satellites in MEO. Because they are closer, their signals are generally received at higher power. That matters. Higher received power can make a signal more useful and more resilient, particularly in difficult environments.

LEO satellites also move much faster across the sky than GNSS satellites. This faster motion means Doppler becomes highly informative for positioning and navigation. With GPS, Doppler can be useful, but the system is primarily built around pseudorange and carrier phase. With LEO, the fast motion of the satellite itself becomes a major source of navigation information.

Then there is bandwidth. Some LEO communication signals are much wider than traditional civilian GNSS signals. Wider bandwidth can provide better resolution and more precise time estimation. When higher bandwidth is combined with higher received power, fast satellite motion and large numbers of satellites, the PNT opportunity becomes very interesting.

LEO also changes the frequency picture. GNSS is concentrated in the L band. LEO systems operate across a much more diverse set of frequencies. Some are in VHF. Some are in L band. Some are in C band. Many are in Ku and Ka band. This matters because frequency diversity can contribute to resilience. If we limit ourselves to one band, we leave one of LEO’s great advantages on the table.

This is an important point. Many people involved in LEO PNT also worked on GNSS, and there is a natural tendency to duplicate as much of the GNSS model as possible while fixing the most obvious shortcomings. I understand that instinct. But if we are starting fresh, why limit ourselves to one band? Why ignore the signal diversity that LEO offers?

Which band is best? That is hard to say. Some companies favor C band. Others favor L band because it allows users to leverage GNSS antenna infrastructure. Ku and Ka band systems are seeing enormous growth because so many broadband satellites operate there. Whether you like those bands or not, they are going to be a force to be reckoned with.

That is the beauty of LEO. It gives us options. It gives us signal diversity. It gives us Doppler. It gives us stronger signals. It gives us large numbers of satellites. And, used intelligently, it can provide a much needed layer of resilience.

But LEO PNT is not one thing. That is where the taxonomy matters.

The Various Schools of Thought

There are several schools of thought on how LEO should be used for PNT: dedicated, dual purpose, augmented and opportunistic.

The first is dedicated LEO PNT. These are constellations designed specifically to provide PNT from low Earth orbit. Companies such as TrustPoint and Xona are examples. Their systems are built around navigation as the primary mission. This approach has the advantage of intentional design. The signals, payloads, constellation architecture and user equipment can be optimized for PNT. The challenge is scale, adoption, service continuity and the need to build an ecosystem from the ground up.

The second model is dual purpose LEO PNT. In this approach, PNT is paired with another primary service, such as communications. A satellite may be transmitting a communication signal that can also support positioning, navigation or timing. Iridium and Globalstar are examples of constellations that dual-purposed their satellites for PNT. Starlink and Amazon LEO appear to be headed that way. The attraction is obvious: If the satellite infrastructure is already being deployed for communications, perhaps PNT can ride along. The challenge is the signal, business model and operational priorities may not be designed for PNT users first.

The third model is augmented LEO PNT, where LEO is not necessarily a standalone replacement for GNSS. It is part of a multilayer architecture that works with GNSS and other PNT sources. This is where Europe is headed with Celeste, an in orbit demonstrator mission that will feature an 11 satellite constellation. Celeste helps when she can, but she is not positioned as a full standalone global replacement for GNSS. This model may be especially important because the future is unlikely to be one system replacing another. It is more likely to be layered, hybrid and context dependent.

The fourth model is opportunistic LEO PNT. This is the broadest and, in some ways, the most interesting category. Opportunistic PNT can include dedicated, dual purpose or augmented systems, but it can also include signals that were never designed for PNT at all. A communications satellite constellation may not transmit anything intended for navigation, but its signals can still be leveraged for positioning and timing if we know how to use them. Starlink and OneWeb are examples often studied in this context.

A New Way of Thinking About PNT

The shift to LEO also introduces complications GNSS users are not accustomed to thinking about. GPS is a government system. It is offered as a free service. It is mature, open, globally integrated and deeply embedded into receivers, systems, standards, operations and user expectations. GPS is also self contained. A user can wake up a receiver and obtain the information needed to use the constellation. LEO is a different ball game.

Many LEO PNT approaches are commercial or non governmental. That changes the landscape from the user’s point of view. What happens if your subscription lapses? What guarantees do you have that the company providing your PNT service will still exist in five years? What if it is acquired? What if prices rise? What if the service changes? What service level commitments are available? What happens in safety critical applications? How will spectrum licensing work? What does signal access look like? How will standards and interoperability evolve?

These are not side issues. They are central to the future of LEO PNT.

The transition from government provided GNSS to commercial or hybrid LEO services is not only a technical shift. It is an institutional shift. Users who have spent decades relying on open GNSS signals will now have to think about contracts, subscriptions, service guarantees, business continuity, liability, receiver access and long term trust.

Commercial LEO PNT remains a compelling and necessary part of the future PNT landscape. But the industry must be clear-eyed about what changes when PNT becomes part of a commercial service architecture.

Where Will LEO PNT be Used First?

It will first be leveraged where the loss of GNSS hurts the most. Defense, safety-of-life and mission critical applications will be major drivers of adoption, although some sectors, such as aviation, will be difficult to change because of certification, regulation and long equipment cycles.

Drones represent lower hanging fruit. They are critical systems, but they can be adapted more quickly than legacy aviation systems. The market is still developing. Many platforms and operational models are still being built. I expect to see meaningful adoption there, and not just in small drones. Larger unmanned aircraft will also begin leveraging LEO PNT. Some defense applications are already moving in this direction, and that will rapidly grow.

Maritime is another important area. It is heavily regulated, but the need is clear. GNSS interference at sea is already a serious problem, and maritime users need resilient alternatives that can support navigation, timing and situational awareness.

The next wave will likely include autonomous systems and self driving vehicles, although I do not see automotive adoption as immediate. The need will grow as autonomy matures and as platforms require resilient global positioning beyond what proximity sensors can provide.

Eventually, LEO PNT will be integrated into smartphones. There will also be a major push through 6G to make positioning and communications more deeply intertwined. That convergence is coming, and LEO will be part of it.

Regardless of how adoption unfolds, the need is clear. GNSS jamming and spoofing are becoming more sophisticated and more prevalent in Ukraine, the Middle East and other regions. Organized crime and other nefarious actors are capitalizing on GNSS vulnerabilities in the civilian world. Unintentional interference is also a growing problem. Lives are being lost. Damage is being done. And the situation will only get worse if we do not act.

Autonomous systems first forced the PNT community to confront the limitations of GNSS alone. Jamming, spoofing and interference then exposed vulnerabilities that can no longer be treated as rare exceptions. We need complementary systems. We need backups. We need resilience. We need architectures that do not fail catastrophically when GNSS is denied or manipulated.

Why LEO, Why Now 

LEO has been born again at the right moment. The surge in satellites has made LEO an attractive option for space based PNT. The signals are stronger. The satellites move faster. The bandwidths can be much wider. The frequencies are more diverse. The number of potential signals is growing dramatically. And unlike terrestrial alternatives, LEO has the potential to provide broad, space based coverage that can complement GNSS at scale.

The question is simple: We have mega constellations in LEO. Why not use them?

LEO PNT is an emerging area, and it is changing constantly. Inside LEO will help readers understand what is real, what is hype, what is technically possible and what still needs to be solved. In future columns, I will dive deeper into LEO fundamentals, deployment models, the current state of LEO, user demand, operational adoption, signal design, standards, interoperability and the future of resilient PNT.

GNSS transformed the world. But the world GNSS helped create now demands more than GNSS alone can provide.

That is why LEO matters. And that is why we need to understand it now. 

References

(1) Z. Kassas, J. Morales, and J. Khalife, “New-age satellite-based navigation—STAN: simultaneous tracking and navigation with LEO satellite signals,” Inside GNSS Magazine, Vol. 14, Issue 4, Aug. 2019, pp. 56-65.

(2) J. Khalife and Z. Kassas, “Receiver design for Doppler positioning with LEO satellites,” Proceedings of IEEE International Conference on Acoustics, Speech, and Signal Processing, 2019, pp. 5506-5510.

(3) J. Morales, J. Khalife, and Z. Kassas, “Simultaneous tracking of Orbcomm LEO satellites and inertial navigation system aiding using Doppler measurements,” Proceedings of IEEE Vehicular Technology Conference, 2019, pp. 1-6.

(4) J. Morales, J. Khalife, A. Abdallah, C. Ardito, and Z. Kassas, “Inertial navigation system aiding with Orbcomm LEO satellite Doppler measurements,” Proceedings of ION GNSS+ Conference, 2018, pp. 2718-2725.

ZAHER (ZAK) M. KASSAS is a global leader in resilient and alternative PNT. He is the TRC Endowed Chair in Intelligent Transportation Systems and a Professor at The Ohio State University. He is the Director of the U.S. Department of Transportation Center for Automated Vehicle Research with Multimodal AssurEd Navigation (CARMEN+) and Director of the Autonomous Systems Perception, Intelligence & Navigation (ASPIN) Lab. A Fellow of IEEE and ION, he has authored over 200 publications and holds multiple patents. He was awarded by President Biden the Presidential Early Career Award for Scientists and Engineers (PECASE), the highest honor bestowed by the U.S. government on outstanding scientists and engineers; the IEEE AESS Richard Kershner Award for pioneering contributions to the theory and practice of PNT with terrestrial and non-terrestrial signals of opportunity; and more than 60 scientific and governmental awards. He was ranked as the top scholar globally in the field of Navigation. His research has attracted more than $28 million in competitive grants; has been featured in dozens of international media outlets; and has shaped government programs, policies and investments.

The post Inside LEO: LEO PNT – Why Now? appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Twenty years on, Galileo stands as both a major European achievement and a hard-won lesson in what it takes to build sovereign, resilient and globally relevant navigation infrastructure. Hein will examine the decisions, compromises and challenges that shaped the system, offering readers a rare behind-the-scenes perspective on Europe’s strategic choice to move from dependence to capability—and why that story still matters now.

Highs and lows in the development of the European Satellite Navigation System, Galileo. 

For much of the late 20th century, the world had access to only one fully operational global satellite navigation system: the United States’ Global Positioning System (GPS). Conceived in the 1970s as a military asset and declared fully operational in 1995, GPS had by the mid-1990s become indispensable to civilian users worldwide—from pilots and ship captains to farmers, surveyors and ordinary motorists. Yet, beneath the convenience of free, open signals lay a profound strategic vulnerability: GPS was owned, operated and controlled exclusively by the United States Department of Defense (DoD). Washington could, in principle, degrade or deny the signal at will.

This dependency troubled European policymakers and military planners throughout the 1990s. The concern was not merely theoretical. During the Gulf War of 1991, the United States deliberately degraded GPS accuracy through a technique known as Selective Availability, limiting civilian precision to roughly 100 meters. Although Selective Availability was switched off in May 2000, the capability to reinstate it remained. European governments, aerospace industries, and transport authorities recognized that building critical infrastructure—aviation, rail, maritime, precision agriculture, financial timing networks—on a foreign-controlled system was a risk that strategic autonomy could not tolerate.

Early Studies and the Political Will to Act

European interest in an independent navigation capability had simmered since the 1980s. The European Space Agency (ESA) had developed NAVSAT and GRANAS concept studies, and various national programs explored augmentation systems. A concrete step came with the European Geostationary Navigation Overlay Service (EGNOS), developed jointly by ESA, the European Commission (EC), and Eurocontrol from the mid-1990s. EGNOS, which became operational in 2009, could improve GPS accuracy and provide integrity signals for safety-critical applications, but it remained dependent on the underlying GPS constellation. It was a patch, not a solution.

The decisive political turn came in the second half of the 1990s. The European Commission’s 1999 communication, “Galileo: Involving Europe in a New Generation of Satellite Navigation Services,” laid out the case openly: Europe needed its own system, civilian-controlled and commercially oriented, interoperable with GPS but independent of it. The name Galileo, a tribute to Galileo Galilei, an Italian astronomer who made foundational contributions to the science of motion and observation, was chosen to signal both scientific heritage and a new era of European technological ambition. (I believe Kepler would have been the better name. But politics had decided, not technology!)

The Early Days of Galileo: 1999-2000 Political Launch and National Ambitions

The story of Galileo’s political birth is, in many respects, the story of a European pilgrimage. This was the first generated “income” of Galileo: however, not for the space system but for the Galileo Travel Agency! In 1999 and 2000, delegations, lobbyists, industry representatives, and national officials from across the continent converged on Brussels with a shared ambition but—as would quickly become apparent—with rather different ideas about what that ambition should deliver. The atmosphere was one of excitement tinged with opportunism: here was a major program taking shape, and every stakeholder wanted a seat at the table. 

The process generated what insiders sometimes called national “wish lists”—catalogues of desired outcomes, preferred industrial workshares, and projected economic benefits that each member state hoped to extract from the new system. These lists were gathered under various headings and studies. The Galileo Overall Architecture Definition (GALA) study was among the most prominent. GALA was intended to define the overall system architecture, but it also became a vehicle through which competing national interests were channelled into the technical debate. The result was a negotiating process as much as an engineering one.

The official justifications advanced for building Galileo were numerous and, on close inspection, of uneven quality. Safety of life, employment creation, industrial spin-offs, enhanced road and rail navigation, search and rescue improvements, integrity, public-private partnership—all were cited, sometimes with statistics that did not survive scrutiny. Several of the arguments were, frankly, either misconceived or greatly exaggerated, and those with a critical eye could see the economic forecasts in particular owed more to political necessity than to rigorous analysis. The need to justify a multi-billion-euro public investment demanded a compelling narrative, and not every element of that narrative was equally well-founded.

Beneath the rhetoric, however, two motivations stood out as genuinely sound. The first was the desire to break the GPS monopoly. At the turn of the millennium, the entire world depended on a single navigation system owned and operated by the United States DoD. The vulnerabilities this created—strategic, commercial and operational—were real, and no amount of goodwill between allies could fully substitute for an independent capability. The second motivation was equally clear-eyed: Galileo was to be Europe’s ticket into the front rank of high-technology infrastructure. Satellite navigation was not merely a useful service; it was becoming the invisible foundation of the digital economy, and Europe’s long-term competitiveness depended on being a provider rather than merely a user of that foundation. These two reasons, strategic independence and technological leadership, were, in the end, the ones that mattered, and they were sufficient.

An American colleague told me: “I thank Europe for the decision to build up its own satellite navigation system: This was the best investment in GPS. We have never seen so many improvements in GPS after a while of stagnation.”

The Lisbon Treaty and European Space Governance

Before continuing the discussion about the early days of Galileo, I must mention an important political move of the European Union (EU) and its Member States. The Lisbon Treaty, which entered into force in December 2009, marked a turning point in European space governance by providing, for the first time, an explicit legal basis for space activities at the Union level. The key instrument is Article 189 of the Treaty on the Functioning of the European Union (TFEU), which authorizes the EU to develop a European Space Policy aimed at promoting scientific and technological progress, strengthening industrial competitiveness, and supporting the implementation of broader Union policies.

On this basis, the EU may establish a European Space Programme and adopt the necessary legislative measures (regulations, directives and decisions) through the ordinary legislative procedure. In terms of the division of competences, however, space occupies a carefully circumscribed position. Although it falls within the category of shared competences, it is in practice treated as a “support or coordination competence.” The Treaty explicitly prohibits the harmonization of national laws and regulations, preserving the legislative autonomy of Member States in the field.

The Treaty recognizes the security and defense dimensions inherent in space activities. Because space infrastructure is frequently dual-use in nature, serving both civilian and military purposes, the Treaty permits, and in certain respects requires, the EU to address these dimensions as part of a comprehensive space policy. This provision has taken on growing practical significance as Europe’s dependence on space-based services for defense, border management, and crisis response has deepened.

Finally, the Treaty also mandates that the Union establish appropriate relations with the ESA, acknowledging ESA’s longstanding role as Europe’s principal space organization and the need for coherent institutional cooperation between the two bodies.

The Treaty also codifies, at least implicitly (and theoretically), a division of labor between the EU and ESA that has evolved over decades of institutional practice. The EU concentrates on space policy, program funding, and the demand side of the equation, defining what services are needed and ensuring they are delivered to users. ESA, by contrast, remains primarily responsible for the supply side: the engineering, infrastructure, and technical development that make those services possible. The two organizations should be complementary rather than competing.

My impression is the ESA underestimated the implications that were arising over the following years and remained silent. At first glance, it seems quite natural for the EU to be responsible for space policy, taking up the needs of the European community and preparing funding for space activities, while the ESA takes responsibility for technical realization. Unfortunately, the boundary between their respective roles has not always been free of friction and has led many people to a perceived disempowerment of ESA in some directories. I will later come back in detail what is meant with this statement.

One of the Treaty’s most consequential constraints is precisely what it does not permit. The EU has no power to impose harmonized space regulations on its Member States: national space law remains firmly within the sovereign remit of each country. This limitation reflects the broader constitutional settlement of the Lisbon Treaty, which sought to expand Union competence in space while simultaneously protecting the regulatory independence of member governments. The practical effect is a patchwork of national licensing regimes and liability frameworks sitting alongside, but not superseded by, European-level policy. In fact, one can still observe space activities in the Member States, which are duplicating efforts of the EC or even competing by building up similar satellite navigation or satellite communication systems.

Since 2009, the EU’s engagement with space has also acquired a markedly more security-oriented character. The dual-use nature of space infrastructure—navigation, Earth observation, and satellite communications all serving both civilian and defense purposes—has increasingly drawn space policy into the orbit of broader strategic autonomy debates. Protecting European space assets from jamming, spoofing, cyber intrusion, and anti-satellite threats has moved from the margins to the mainstream of EU space thinking, reflecting a wider recognition that space is no longer a benign domain but a contested one in which Europe’s ability to act independently depends on the resilience and security of its own infrastructure.

According to its convention, the ESA is limited to “exclusively peaceful purposes.” However, under pressure from the EU, this term has increasingly been interpreted to also allow for “defensive” military aspects (e.g., surveillance or encrypted communications).

The Decision to Build Galileo

The formal decision to proceed with Galileo was taken by the European Council in March 2002, when EU transport ministers gave their approval for the development and deployment phase of the system. This followed years of preparatory studies, feasibility assessments, and political negotiation, and it represented a definitive commitment by the Union to invest in an independent satellite navigation capability. The EC and the ESA were tasked with jointly overseeing the program, with ESA taking the lead on the technical and procurement side while the EC held overall political authority. A dedicated management structure, the Galileo Joint Undertaking, was established in 2002 to coordinate the two institutions and to manage the program’s early phases.

Costs and Funding

The original cost estimates for Galileo were, in retrospect, optimistic. The development and in-orbit validation phase was initially budgeted at approximately €1.1 billion, with overall deployment costs for the full constellation estimated at around €3.2 billion. These figures reflected the assumptions of the early 2000s, including the expectation that a substantial share of the funding would come from private industry through a public-private partnership (PPP) model. Under this model, a private concession holder was to operate the system commercially and recover costs through service revenues, with public funds covering only a portion of the investment.

I live in a town south of Munich. At the same time as the Galileo decision, a family-owned pharmaceutical company that produced generic medical drugs and had about 100 employees was sold to a multinational medical company for more than 6 billion Euro—just two Galileo systems (cost assumption early 2000s)!

Civil Control, Military Reality and the Question of Dual Use

One of the most deliberate and politically significant design choices made for Galileo was the insistence that it be a civilian system under civilian control. This was not merely a technical or administrative detail; it was a statement of principle, and it was intended to distinguish Galileo fundamentally from GPS. The United States’ system had been conceived as a military asset, and its civilian use, however widespread, remained conditional on the goodwill of the U.S. DoD. Galileo, by contrast, was to be governed by the EC, a civilian institution, and its primary purpose was defined in terms of civilian applications: transport, agriculture, timing, search and rescue, and commercial services.

This civilian identity was not, however, synonymous with exclusion of the military. European policymakers were candid from the outset that defense and security forces would be entitled to use Galileo signals, including the encrypted Public Regulated Service (PRS) reserved for government-authorized users. The formulation that became standard in policy documents was straightforward: Galileo is a civil system under civil control, and the military may use it. This formula allowed Europe to maintain its civilian branding while acknowledging the inescapable reality that any global navigation system is of strategic value, and that European armed forces and security agencies would naturally make use of a European system. 

What happens to the civil control of Galileo in times of crisis? Most European Member States have a Radionavigation Plan that makes clear that, when it comes to the crunch, the military has the final say. The tension between Galileo’s civilian identity and the realities of national security has therefore never been fully resolved; it has merely been deferred.

The PRS was conceived as a government-controlled, encrypted service for authorized institutions—customs agencies, specialized police units, border control, and similar bodies—with strictly limited access. Some nations, however, lobbied for PRS access to be extended to fire brigades and other local emergency services, apparently overlooking the fact that the number of simultaneous users the system can support is not unlimited, and a large number of users might create a problem for security. The military, meanwhile, was not explicitly named among the intended users—the working formula remained the familiar one: they may use it—even though the PRS was developed to a specification, and at a cost, that closely mirrors a military-grade service. The omission was not accidental; it reflected the political sensitivity of departing too visibly from Galileo’s declared civilian character.

Adding a further layer of complexity, most European nations had already concluded Memoranda of Understanding with the United States for the use of GPS, particularly within the NATO framework. Against that background, Galileo’s PRS was initially regarded by many European military establishments as superfluous—a costly duplication of a capability they already accessed through their American alliance commitments.

The world has changed substantially since those early design decisions were made. The conflicts and wars of recent years and today have made clear Europe can no longer take its security for granted and must rebuild defense capabilities that were allowed to atrophy significantly after the end of the Cold War. In that context, an independent, European-owned global satellite navigation system such as Galileo is plainly a major strategic asset for modern defense—essential for the guidance and operation of aircraft, naval vessels, armoured vehicles, and precision weapons alike. 

It is, therefore, even more remarkable that Galileo has not yet been officially designated as a dual-use GNSS. Every other global and regional satellite navigation system—GPS, GLONASS, BeiDou, NavIC—carries an explicit dual-use status. Galileo’s continued omission from that category is increasingly difficult to justify, and the argument for formally recognizing what has always been true in practice grows stronger with every passing year.

A further technical observation is warranted in the context of the PRS. Given that the PRS encryption is not watertight, the signal can be tracked without knowledge of the access code, so-called codeless tracking. One is therefore entitled to ask: What is the justification for the extraordinarily expensive and complex national access key schemes, which differ from country to country? I hope the second generation of Galileo will overcome that problem.

Opening Galileo to the World: International Partners

From an early stage, the EC pursued an active strategy of inviting third countries to join Galileo as partner nations and stakeholders. The rationale was partly financial—contributions from partner countries would help share the costs of development—and partly strategic. A system with broad international participation would be more difficult to challenge or marginalize, and would generate a larger global user base, strengthening the commercial case for European industry.

China was among the earliest countries to engage substantively with the program: A cooperation agreement with the Chinese government was signed in 2003, and China initially contributed funding and participated in technical working groups, though its involvement later diminished as Beijing’s own BeiDou navigation system matured. Israel signed a cooperation agreement with the EU in 2004, becoming one of the first non-European partners to formalize its engagement with the program. Ukraine, Morocco and South Korea also concluded first political agreements in the mid-2000s, each bringing different motivations—industrial participation, regional positioning, or access to high-accuracy services. However, it did not come to the second agreement defining the operational engagement in Galileo. India entered into discussions with the EU during the same period, reflecting the interest of major spacefaring nations in securing a stake in the emerging global navigation landscape. 

Together, these early partnerships gave Galileo an international footprint from the outset and underscored the EC’s ambition to build not merely a regional system, but a genuinely global one. 

PROF. DR.-ING. HABIL. DR. H. C. GÜENTER W. HEIN, Emeritus of Excellence at Bundeswehr University Munich, draws on more than two decades of first-hand experience to recount the development of Galileo, the European satellite navigation system. His involvement began with national research conducted between 1995 and 2008 at his former Institute of Geodesy and Navigation at Bundeswehr University Munich, funded by the Deutsches Zentrum für Luft- und Raumfahrt (DLR, German Aerospace Center). From 2000 onwards, he represented Germany in various EC Galileo study groups, including the Galileo Signal Task Force, and took part in the EU-US negotiations on GPS/Galileo interoperability from 2000 to 2005. He subsequently joined the European Space Agency as Head of the EGNOS and Galileo Evolution Programme Department from 2008 to 2014. He later served as a member of the Executive Board of Munich Aerospace e. V. and has provided consultancy to leading European satellite navigation companies. Güenter W. Hein is the founder of the Munich Satellite Navigation Summit and the Munich New Space Summit, which were merged in 2026 to form the Munich Space Summit. Through all these roles, he has played a central part in shaping European satellite navigation over the past 20 years.

The post Inside Galileo: Europe Decides to Build Up its Own Global Satellite Navigation System appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

While GNSS remains the backbone of positioning, its limitations can’t be ignored. GNSS signals are vulnerable to multipath interference, while spoofing and jamming attacks that render GNSS unreliable continue to grow in number and sophistication. Urban canyons, tunnels and indoor transitions also remain a challenge for GNSS and the users who require access to accurate positioning in these environments.

This reality, combined with the rise in autonomous solutions across various industries from agriculture to defense, makes closing the growing gaps in GNSS mission critical. Reliable, backup 
solutions are a must. Inertial navigation systems (INS) are a natural complement, providing continuous, high-rate propagation through GNSS outages. 

The push for autonomy has ushered in a new era of GNSS-INS integration, making this combined approach mainstream rather than exotic. Inside GNSS, along with Hexagon | NovAtel and Inertial Sense, explored this critical integration in a recent webinar. James Chan, business unit lead, INS, Aerospace & Defence Division, Hexagon, provided the system-level perspective, while Walt Johnson, founder and CTO of Inertial Sense, focused on low-SWaP-C tactical grade MEMS implementation.

IMU Fundamentals and the Cost–Accuracy Ladder

Chan gave us a look inside what makes up inertial measurement units (IMUs), the core of an INS. IMUs come in different options and grades, but all 
leverage various sensors to measure an object’s movement and orientation. Accelerometers measure linear acceleration, while gyroscopes measure rotational acceleration. Both typically operate on three axes, giving the IMU six degrees of freedom (DoF).

Many IMUs now also include magnetometers to measure magnetic fields, which can be translated into a heading, Chan said, and barometers to measure atmospheric pressure, which can be translated into an altitude. IMUs that include a three axis magnetometer have 9 DoF, while those that also have a barometer achieve 10 DoF. Magnetometers typically require calibration to account for local interference and magnetic declination. 

It’s important to note that every IMU has drift, Chan said, which leads to accumulating errors in the IMU data. These errors will continue to grow if there’s no external input to correct them. The drift rate is also dependent on sensor stability. 

“Nearly all inertial navigation systems will run some kind of filter, usually an Extended Kalman Filter or EKF, and that’ll have the INS solution running and take in GNSS updates to help compensate for any errors in the IMU measurements,” Chan said. “In between updates, the inertial solution will bridge the gap and continue to offer position, velocity and attitude at times when GNSS isn’t available.” 

An IMU’s accuracy, Chan said, is driven by the gyroscope, with three main types available: Ring laser gyroscope (RLG), fiber optic (FOG) gyroscope and Microelectromechanical Systems (MEMS). The RLG, the oldest, features two counter-propogating lasers that travel within a closed space, using a system of mirrors to “effectively bounce those lasers.” When the system rotates, one beam travels a longer path than the other. The detector picks that up and calculates the rotation rate based on the time difference of when the two lasers arrive. 

The newer FOGs also measure two beams of light, but do so by traveling around a closed fiber optic coil and measuring the difference of when the beams arrive back. Increasing the coil length changes the resolution on what a FOG can measure. 

FOGs tend to be smaller and cheaper than RLGs, but typically aren’t as accurate, Chan said, though the technology continues to improve. 

These days, most people use MEMS gyroscopes. There’s different types of MEMS for various applications, but all basically look at how a silicon structure behaves after some sort of force is applied. Compact MEMS gyroscopes have the lowest SWaP-C and can be found on anything from cell phones to UAS. 

Regardless of type, IMUs come in different classification grades: consumer, industrial, tactical and navigation. Gyro in-run bias stability is how a gyroscope bias drifts over time during operation at a given temperature. It is also referred to as bias instability. The higher the value, the more unstable the bias drift will be, and the worse the results you’ll get. 

Angular Random Walk (ARW) is another key metric, measuring the signal noise to indicate what the angular error could look like as it accumulates over time. 

“These values are determined by doing an Allan Variance Plot, and it’s a critical metric for determining gyroscope accuracy,” Chan said. “Smaller values indicate the random noise associated with the signal will have less of an impact on your angular measurements.” 

Quantum IMUs are also on the horizon, Chan said. These next generation navigation sensors will use atom interferometry to measure acceleration and rotation, measuring how lasers interact with cooled down atoms. 

“These sensors can be nearly 1,000 times as accurate as standard MEMS sensors,” Chan said, “but it’s currently limited by a low output rate and a very high power draw with no real commercial products yet.”

From Satellite Fixes to Continuous Navigation

GNSS requires visibility of the sky, with accuracy dependent on the satellites’ track, Chan said, one of its limitations. Still, there is “no better system to provide an absolute position that has zero infrastructure requirements needed on the user side besides an antenna and receiver.” Tightly integrated GNSS-INS adds an important layer. GNSS is absolute but vulnerable and lower rate, while INS is relative, drifting but high-rate and immune to interference. 

Chan provided a real-world example of how IMUs make navigation more resilient, showing a NovAtel receiver moving through downtown Calgary. GNSS was pulled in multiple directions, leading to an inaccurate trajectory. When the team incorporated an IMU into the solution and ran NovAtel SPAN software, there was a “remarkable improvement” in the positioning domain due to the relative accuracy of INS while also taking in the absolute accuracy of GNSS, which helps constrain error growth.

Of course, the ranges of IMUs that can be incorporated into these systems offer varying levels of performance at different price points. There’s a fit for every application, whether mid-grade or high-grade performance is required. Key performance metrics for integrated systems include position accuracy under nominal conditions and through outages; attitude; and robustness to shock and vibration in real platforms. 

What customers are most interested in, Chan said, is position, velocity and attitude (PVA) requirements. 

“Customers will look at whether an IMU will be able to deliver in this department first,” Chan said. “On NovAtel SPAN products, we break this apart by outage duration. Customers have an easy way to understand what performance they can expect.” 

The next consideration is SWaP-C. Most want smaller IMUs that draw less power, Chan said. And as the technology matures, IMUs are naturally becoming smaller, lighter and more efficient. 

Detailed technical requirements include bias, stability, ARW and dynamic range. 

“The dynamic range for an accelerometer is measured in Gs, the gravitational unit,” Chan said. “This indicates the acceleration value the accelerometer is capable of handling and shouldn’t be confused with shock or survival ratings.” 

Then there’s velocity random walk (VRW), similar to ARW, which is a “very good indicator of how noisy the signals will be when you do integrate them.” 

There’s demand for accurate IMUs with small footprints and low weight that draw minimal power, have a wide dynamic range and a low ARW. The performance required is somewhere between industrial and tactical. 

Delivering Tactical-Grade Performance in MEMS Form Factors

Inertial Sense is focused on democratizing tactical grade GNSS-INS navigation, Johnson said, developing low SWaP-C solutions for autonomous platforms and defense applications. The company’s mission is to make effective tactical grade navigation technology accessible for platforms that are constrained by size, weight and power. 

“We deliver a multi-GNSS and MEMS IMU sensor fusion architecture that delivers tactical grade attitude, centimeter-level RTK positioning and modules that weigh less than one gram,” Johnson said. “Our systems emphasize low SWaP-C, high rate estimation and robust operation in GPS-denied environments.” 

That technology is leveraged across a range of applications, including UAS, robotic systems, maritime and precision stabilization platforms. These days, Inertial Sense is seeing increased demand driven by emerging applications like loitering munitions, engagement systems, commercial autonomous 
vehicles and humanoid robots. Such applications “require tactical grade navigation performance, but they also require mass market pricing.” Navigation grade or military grade IMUs that provide the highest performance typically cost $100,000 or more.

“The fundamental problem to the market today is tactical grade navigation systems are too expensive for large scale deployment,” Johnson said. “Our solution is to deliver industry leading navigation performance at a disruptive price performance point. This enables our customers to deploy navigation autonomy at whatever scale they require.”

The Inertial Sense product portfolio consists of compact IMX tactical grade IMUs and INS navigation modules, and the GPX series of multi-GNSS receivers. The receivers support several configurations, raw measurement output, centimeter-level positioning and dual antenna heading. Both product families are available in OEM surface modules and rugged, enclosed systems. 

Cost optimization is a key differentiator for the IMX line, Johnson said. Inertial Sense focuses on keeping tactical grade sensors to between $5,000 and $25,000, targeting low cost hardware and sensors and selecting the optimal algorithms to deliver tactical rate performance on that hardware.

“Our systems are built using off-the- shelf components,” Johnson said, “but combined with proprietary design and calibration processes that enable us to create high precision performance.”

The navigation systems also run on single precision floating point unit microcontrollers; Inertial Sense doesn’t use double precision hardware. 

“Part of what we do to maintain numerical stability is use a square root extended Kalman filter that uses UD factorization,” Johnson said. “And this approach enables stable estimation high rate updates and then efficient computation on low cost processors.” 

To maintain accuracy during high dynamic motions, Inertial Sense implemented coning and sculling compensation. The algorithm prevents systematic integration of errors, such as attitude errors caused by oscillatory rotations between gyro samples and velocity errors caused by simultaneous rotation and linear acceleration. These techniques prevent motion and oscillation vibrations from degrading the tightly integrated solution. 

Inertial Sense also offers a lightweight, multi-band RTK engine that’s optimized for low SWaP GNSS receivers and processors. A modular GNSS architecture makes it easy to integrate the IMUs with multiple receivers, including the u-blox F9 and X20. There are also plans to release firmware that supports integration with the Septentrio mosaic-G5. 

Johnson shared real-world examples of the IMU in use, with one demonstrating IMX in ground vehicle dead reckoning mode. The vehicle overcame a 105 second GNSS outage in a parking structure, driving about 350 meters and experiencing about 6% drift. In ground vehicle mode drift is “more of a function of distance traveled than time.” 

Other tests compared IMX against established systems like NovAtel SPAN, with the IMUs achieving comparable results. 

Roadmap: Pushing GNSS-INS Further for Autonomy

The latest IMX model, the IMX-6, is scheduled for release this year and represents a 30% improvement in attitude and accuracy over the IMX-5. It will support a 500 Hz output rate and will feature enhanced roll and pitch accuracy, improved heading accuracy, reduced gyro bias stability, lower ARW and lower acceleration bias instability. It also has an increased sensing range and improved sensory redundancy. 

IMX-6 will be able to handle higher acceleration ranges, with proprietary processes allowing high volume precision calibration across temperature.

As vibration performance is critical, the sensor is undergoing shock and vibration testing as well as dynamic frequency response characterization. 

“Each IMX is fully calibrated during manufacturing across a temperature range of negative 40 to 85 degrees Celsius,” Johnson said. “This includes bias calibration, cross axis alignment and scale factor calibration.” 

There are also plans to add temperature compensation for scale factor modeling.

In-field calibration procedures and guidance are also available for IMX sensors. Customers with smaller devices can place them on a precision level surface and, depending on the level of alignment needed, calibrate in a few seconds. 

“It may be that they tip it on multiple sides, or it may be that they just level it in the normal operating direction, and then they inform the system that it needs to be calibrated in what mode,” Johnson said. “There’s different modes to put it in, and it doesn’t require much space at all.”

Customers with large vehicles can use GPS to similarly inform the system of sensor alignment. Inertial Sense can guide customers through both processes. 

Enhancements to the IMX-6 allow for easier drop-in upgrades, enhanced dynamic behavior, more predictable performance across temperature, broader GNSS ecosystem coverage and smoother field maintenance for end users.

Real-World Programs and What Buyers Should Ask 

IMX sensors are making an impact across various industries. Customer case studies include: 

• A global satellite communication provider. This ongoing customer needed an INS system that could deliver a fraction of a degree of orientation accuracy for satellite tracking on moving vessels. Existing solutions were too expensive for the market they were targeting. Inertial Sense delivered a solution that integrated tactical inertial grade navigation with low SWaP GNSS receivers. They also adapted manufacturing process to support the customer’s delivery schedule. 

• A defense technology company. The unmanned systems developer needed a lower ARW and bias instability than the IMX-5 could provide. In response, Inertial Sense collaborated with the customer to develop the IMX-6, which meets both their performance and SWaP-C requirements. This opened up other opportunities with the customer. 

• An autonomous landscaping developer. This customer required high precision navigation compatible with the commercial mower equipment market. Inertial Sense worked closely with the engineering team to integrate an IMX into their autonomous platform. 

With every case study, peformance for low SWaP applications was a key consideration. Inertial Sense was able to deliver tactical-grade metrics without navigation-grade prices. The company also offers integration, support and environmental robustness. 

Before investing in a GNSS-INS solution, it’s important to know what to ask. Manufacturer data sheets differ, making it critical to understand the most important metrics and how they could impact your solution. Key areas to consider include: 

• Performance 

• Real-world testing results 

• Outage behavior 

• Calibration 

• The product roadmap and expected future updates 

GNSS-INS as Autonomy Infrastructure

Autonomy needs more than GNSS. To meet that need, GNSS-INS integration has evolved from niche, high-end avionics to a foundational technology for mainstream autonomous systems. Advances in MEMS IMUs, fusion algorithms and integration ecosystems are making tactical-grade performance accessible at scale. 

Visit insidegnss.com to access the webinar, data sheets and white papers from Hexagon | NovAtel and Inertial Sense.

The post Integrating GNSS and Inertial: Tactical Grade Performance for Modern Autonomous Applications appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Since 2004, the primary goal of America’s national PNT policy and governance structure has been to maintain United States leadership in space-based positioning, navigation and timing (PNT). While GPS remains an outstanding system, it has been surpassed in many ways by Europe’s Galileo and China’s BeiDou.

Perhaps more significantly, while China, Russia and other nations have or are building complementary and backup systems for space-based PNT, the U.S. has no deployed capability or plans for any. This, despite a presidential mandate for such a system that stood from 2004 to 2021, and senior leaders in the current administration citing the need.

When asked why the nation has fallen behind in both space-based and alternative PNT, many experts often give a one word answer: governance. 

Governance is often defined as the process by which leaders make decisions. In the U.S., the current process for PNT was established in 2004 by President George W. Bush in National Security Presidential Directive 4. It was later slightly updated in the waning days of the first Trump administration by Space Policy Directive 7 (SPD 7), issued January 15, 2021. 

America’s PNT governance structure is complicated. One in which responsibility is shared and authority is diffuse.

A Fragmented System 

Leadership of PNT issues is assigned to two departments: The Department of Defense/War (DOD/W) for military uses and users and The Department of Transportation (DOT) for civil users.

Each department has its own internal governance processes, its own priorities, and its own bureaucratic machinery. 

Inside DOT: Many Duties, Lots of Collaboration

The DOT lead for PNT is the Assistant Secretary for Research and Technology (OST-R). But PNT is only one of many responsibilities, which also include spectrum management and overseeing the Advanced Research Projects Agency, the Bureau of Transportation Statistics, the Highly Automated Systems Safety Center of Excellence, the Intelligent Transportation Systems Joint Program Office, the Office of Research, Development & Technology, the Transportation Safety Institute, the Volpe National Transportation Center, and the Strengthening Mobility and Revolutionizing Transportation (SMART) grant program.

For PNT issues, OST-R coordinates 10 internal DOT organizations and a group of 10 organizations outside DOT. Together, these groups advise the Deputy Secretary and Secretary of Transportation.

Inside DOD/W: A Heavyweight Process with Lots of Players

On the defense side, the Chief Information Officer (CIO) is the Secretary’s principal staff assistant for PNT. But again, PNT is only one of many duties—others include information technology, cybersecurity, spectrum policy, communications, command and control, and SATCOM.

The CIO follows an iterative process that feeds into the DoD PNT Oversight Council, a body of 19 senior leaders—service secretaries, combatant commanders, undersecretaries, and intelligence chiefs. Very senior, very busy people who lead large and important organizations.

All must work together to advise the Deputy Secretary and Secretary of Defense.

When Issues Cross Departments: The EXCOM 

For national PNT issues that fall outside the authority of either DOT or DoD/W, governance shifts to the National Space Based PNT Executive Committee (EXCOM), co-led by the deputy secretaries of Transportation and Defense/War.

SPD-7 tasks the EXCOM to “…make recommendations on sustainment, modernization, and policy matters regarding United States space-based PNT services to its member agencies, and to the President, through the Assistant to the President for National Security Affairs, or the Executive Secretary of the National Space Council, as appropriate.”

Not visible in the formal process is the Office of Management and Budget (OMB). Yet, OMB is arguably the most important and powerful component of the executive branch. The office drives budgets, oversees the President’s Management Agenda, and adjudicates cross-department issues and priorities. Without OMB support, department initiatives die on the vine.

The EXCOM meets once or twice a year and serves primarily as a coordinating body. Despite the many people involved, or perhaps because of it, the United States has:

• Lost its place as the leader in space-based PNT, and

• Failed to safeguard national and economic security with long called for alternative PNT capabilities

What About Leadership?

Bureaucracy is inherent in government. Strong leadership can often cut through it—especially in times of crisis—and overcome obstacles that stall progress.

Leadership, in fact, is an essential element of good governance. It is the energy that powers structures, processes and institutions. But governance structures matter as well. They can nurture and enable leadership, or they can constrain and frustrate it.

If no crisis demands action and authorities and responsibilities are unclear, initiatives become vulnerable to criticism or outright veto from those wary of change or protective of their organizational “lane.” 

Too many stakeholders can make collaboration unwieldy and give de facto veto power to individuals or groups who should not have it. And without a clear mandate from the top to achieve specific goals, even capable and determined leaders can find themselves blocked at every turn by an unwieldy governance structure and process. 

Time for a Reset 

Disruptions to GPS and other GNSS signals are increasing daily and are being seen more frequently in the homeland. Protecting the satellites, signals and their users is a national security and economic imperative. 

America has an abundance of technical expertise and commercially avail-able PNT products and services that can enable it to regain world leadership while guarding its national and economic security. 

It is time to reset our PNT governance and put these advantages to use. 

But this effort can’t be one of just “rearranging the deck chairs on the Titanic.” We need a whole new ship. 

America’s new PNT policy and governance must:

• Be about more than space. The need for one or more widely available backup and complementary sources of PNT for GPS in America is widely accepted. In a January 2021 report, the DOT found that combining signals from space with terrestrial broadcast and timing over fiber would constitute a core national resilient PNT architecture. That could be a great starting point.

• Identify and empower a “trail boss” or “first among equals.” Someone responsible for ensuring policies and plans are executed, timelines are met, and those responsible for action are held to account. Not a “czar,” but a champion tasked with bringing key actors and stakeholders together, developing a national plan, then ensuring it is executed.

• Establish specific goals and requirements for national PNT resilience. An updated policy and governance document doesn’t necessarily need to state accuracy, integrity, availability, and continuity requirements. But it should describe a resilient end state and draw the line between what utility-level services America’s national PNT architecture will provide, and what higher demand users must source for themselves. The core national resilient PNT architecture must be a backbone that other PNT systems and providers can leverage and build upon.

• A timeline to achieve the goals. For over two decades, national PNT policy has listed a variety of general and specific goals. None have had associated timelines and few have been achieved. A minimal resilient national PNT architecture of space, terrestrial broadcast, and fiber—the “resilient triad”—could be easily and quickly implemented. Mature technologies exist and can be available as products or performance-based service contracts. A target of five years would not be unreasonable for terrestrial components.

• Include OMB as an essential player. While SPD-7, and perhaps other national policy documents, discuss recommendations being submitted to the president, as a practical matter, that rarely happens, if ever. Instead, recommendations go to his personal management and budget staff—OMB. Unless they are on board, nothing happens.

Today’s PNT policy was published in the last few days of the first Trump administration. Its governance structure and processes are nearly identical to those used by the previous two administrations. In the five years since SPD-7 was published, the risk to the nation from over-dependence on GPS has increased significantly. It is time for this administration to break from its predecessors, forge a new path, and make America safer.

The post PNT Governance: Time for a Reset appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

SÉBASTIEN TRILLES, ODILE MALIET, JULIE ANTIC, KIN MIMOUNI, THALES ALENIA SPACE, FRANCE

In a broad sense, the notion of integrity refers to the level of confidence one can have in data obtained from a calculation result. In positioning systems, integrity is a measure of the trustworthiness a user can place in a position estimate. Geolocation would be perfect if measurements were error-free, but this is never the case as all device measurements inherently contain errors and noise. Hence, a discrepancy between the calculated position and the true (but unknown) one always exists. As errors and noise contains stochastic part, integrity is fundamentally grounded in probabilistic theory.

Mathematically expressed, integrity is equivalent to assigning a probability of the estimate being outside a defined confidence interval (protection level). The integrity of a positioning system is compromised when anomalies occur, leading to unexpected positioning errors beyond the operational protection level. These anomalies could persist for more than a few seconds within a specific time interval (T). In such cases, the integrity risk (IR) is defined as the probability the true position remains outside the protection level for a duration exceeding T.

For instance, in precision approach operations in aviation, the Standards And Recommended Practices (SARPs) set the IR at 2×10^-7 per approach (150s) and the specific time interval to T=6s. The computation of Protection Level (PL) consists of scaling position error variance to the integrity requirement using K-factors. The K-factors are derived from statistical laws and are critical for ensuring the system’s integrity in various operational conditions, taking into account the errors’ time-correlation [9] [10].

In practical applications, positioning is accomplished using measurements with well-known residual error structure and statistical distributions. Position and time errors are determined by linearly combining the residual errors of the measurements. The process starts with the GNSS navigation solution involving the estimation of a position-time correction x as a solution to the measurement equations linearized around a given position-time priori: WGx=Wb+ε, where G is a m×4 matrix with m the number of line of sight, ε is the measurement noises vector, W is a weight matrix and b is the residual measurements vector. The noises ε are assumed to follow a Normal centered law.

The so called design matrix G is defined as the matrix of partial derivatives of the measurement equations with respect to the parameters of position and time. The partial derivative of the pseudo range with respect to the position correction is obtained from the partial derivatives of the geometric distance D=||X^s-X_r || between satellite position X^s and (unknown) receiver position X_r. Re-writing the geometric distance as D=u_r^s∙(X^s-X_r), the partial derivative of with respect to the positions is the unit vector of the line of sight–u_r^s from receiver to satellite.

The weights per line of sight are built using different model variances related to various contributor to measurement errors: residual system errors (orbit and clock), propagation errors (ionosphere and troposphere), and local errors (multipath, thermal noise and interference). The maximum likelihood method provides the estimate =Sb, where S=(G^t W G)^-1G^t W is the 4×m sensitivity matrix expressed in the east (E), north (N), up (U) local frame and time.

The estimation positioning error e is given by 

The first three row components of S, respectively s_E,i, s_N,i and s_U,i correspond to the partial derivatives of position errors with respect to the east, north and up directions in relation to the measurement errors of the i-th satellite. The sensitivity matrix linearly projects the unmodeled residual measurement errors ε_i in a given direction.

For east direction:

for north:

and for up:

This process establishes a straightforward mathematical transfer that enables the projection of residual errors from the measurement domain to the position domain. Focusing on measurement domain, we seek sufficient properties regarding measurement errors distribution that ensure integrity in the domain of positions. These properties define integrity at the measurement level. If these properties are respected, integrity in the domain of positions is ensured, referred to as the transfer of integrity from the measurement domain to the position domain.

This article provides a comprehensive overview of the various concepts related to CDF overbounding. It aims to articulate each concept within a common framework, delineate their ranges and limitations, and ultimately present a methodology for creating protection volumes that reliably contain positioning errors with a high level of confidence.

MOPS Integrity Concept 

Initially, integrity concept was developed for aeronautical users and standardized by the Minimum Operational Performance Standards (MOPS) document [1] and is defined at position level. This standard deals with integrity parameters broadcasted by SBAS regarding ionosphere, orbit and clock corrections. In this aspect, MOPS considers the individual measurement error contributors as independent, making it possible to sum up all model variances in unique one σ_i² per line of sight. The weight matrix is defined as diagonal W=diag(w₁,…,w_m) where w_i=1⁄σ_i²).

Therefore, the measurement errors are assumed of white noise type, so their distributions have a zero expectation E[ε]=0, which implies the expectation of the identification error is also zero: E[e]=SE[ε]=0.

The covariance of the error is: cov(e)=E[(e-E[e]) (e-E[e])^t]=E[ee^t]SE[εε^t] S^t=Scov(ε)S^t. Therefore, the minimum covariance is reached by taking cov(ε)=W^-1, thus cov(e)=SW^-1S^t=(G^t WG)^-1. This refers to a four-dimensional symmetric positive-definite matrix whose are linear combinations of the measurement variances, as for instance:

The positioning error structure is then separated into horizontal errors e_H and vertical errors e_U, which amounts to considering the following extracted submatrices:

The MOPS specify the integrity risk IR as the maximum allowable probability for the navigation position error to exceed the alarm limit without the system alerting the user within the alert time. In the case of a standardized Normal distribution, such as N(0,1), the K-factor depends on the risk IR:

By making the change of variables t=√2u in Equation 2, we obtain an expression that depends on the complementary error function erfc:

and after inversion in Equation 3, we get the expression of the usual Gaussian K-factor:

Application to protection volumes: The MOPS standard define the vertical protection volume as:

Where the K-factor inflates the standard deviation d_U at a level compatible with integrity requirements. Because a linear combination of Gaussian-distributed vector is Gaussian-distributed, the residual position errors follow a Normal law. If Φ_eU denotes the cumulative distribution function (CDF) of this Normal law, defined by Φ_eU(x)=P(e_U≤x), we then have:

Equation 6 indicates that the absolute value of the error e_U is bounded by the confidence interval VPL defined in Equation 5 at the probability (1-IR).

The integrity MOPS concept does not mention any overbounding approach. It does not provide information regarding the shape of empirical residual errors distribution. It only mentions [1] the necessity from SBAS to broadcast two parameters, the first one being the variance of Normal distributions associated with the user differential range error for a satellite after application of corrections, and the second one associated with residual ionosphere vertical error at an ionospheric grid point for an L1 signal. The term “associated” as used by MOPS leaves room for several possible interpretations.

In fact, these definitions may give the impression that these Normal distributions represent the actual errors distribution. This interpretation has already been mentioned by several authors [5]. As a consequence, based on the stability of independent Normal distributions through linear combination, the position errors distribution is also represented by a Normal distribution. Unfortunately, the actual range errors are generally not Normal, especially in the tails.

In that context, it could be tempting to check integrity at the pseudorange level by making sure that, for all lines of sight i, the Normal distribution with standard deviation σ_i is conservative at the quantile equals to the integrity risk IR:

Non-intuitively, this naïve approach is not correct in general conditions. Annex A3 in [1] shows a toy example that satisfies Equation 7 for all lines of sight, and yet is not compliant with the integrity risk IR on position. This example clearly shows integrity transfer from range to position is not obvious and explains the emergence of overbounding concepts. 

CDF-Overbounding 

The CDF-overbounding concept has been introduced by [2] in the field of aeronautical users. The main idea is to overbound the empirical measurement error distribution, in the field of CDF, by a simpler one allowing to better control the integrity risk mainly in the tails, in the absence of faults. An overbound can be viewed as a statistic distribution that is a regular envelope of the empirical distribution. It is interesting to note the mathematical results presented in [2] were already known to the statistic community [14].

In the following, the CDF of a random variable X is denoted by F_X. According to [2], the random variable O_X is a CDF-overbound of the random variable X, and we note XO_X, if

The binary relationship (8) defines a partial order on the set of distributions. Indeed, the CDF-overbound relation is:

• Reflexive: XX
(every element is related to itself)

• Transitive: if XY and YZ then XZ
(the order is maintained through the chain)

• Antisymmetric: if XY and
YX then X=Y (two elements can’t mutually precede each other; they are considered equal)

Three graphical representations of CDF-overbounding are provided in Figure 1 for a Gaussian overbound with standard deviation equals to 0.7. The green area represents the domain for the CDF (respectively folded CDF and QQ plot) of X, that satisfies the CDF-overbounding of X by O_X. On the left, the CDF of the overbound O_X is represented in black. This representation is a direct illustration of the definition. The representation in the middle is based on the folded CDF that equals the CDF before the median and the survival function (1-CDF) after the median. This representation is handy to inspect the overbounding on the left and right tails thanks to the log-scale. The representation on the left is based on the Quantile-Quantile (QQ) plot for X and O_X. It permits inspecting both the core and the tails of the distribution.

Introducing the overbounding concept allows the following result: 

Theorem 1: If X and Y are two centered symmetric and unimodal distributions, and O_X and O_Y their respective overbounds are also symmetric and unimodal. Then for all α, β in , the linear combination αX+βY is CDF-overbounded by αO_X+βO_Y. In short, the overbounding property is stable by linear combination:

If the distribution of each residual measurement error is symmetric, unimodal and can be overbounded by a distribution that is also symmetric and unimodal, then the positioning errors are also overbounded by a known symmetric and unimodal distribution. Under this assumption, integrity in the pseudorange domain implies integrity in the position domain.

Proof:

Proof of stability by addition:

The proof is established in two steps. The first step is to prove that if 

The second step is a direct application of the previous statement: if

The sum of two independent symmetric and unimodal variables is itself symmetric and unimodal. The proof is detailed in the Appendix (see online version). This shows all the considered distributions have the right properties to be compared by CDF-overbounding.

Applying the definition of CDF-overbounding, proving (1) comes down to establishing that:

Let us fix z and compute F_X+OY(z)–F_X+Y(z) using the formula for the CDF of the sum of two independent random variables (the derivation of the formula is recalled in the Appendix):

We now split the integral of Equation 10 into two parts and make the change of variable x to -x for the negative part:

Recalling that by requirement of the CDF-overbounding both Y and O_Y distributions are symmetrical, which means F_Y(-x)=1-F_Y(x) and thus F_OY(-x)-F_Y(-x)=F_Y(x)-F_OY(x). Equation 11 becomes:

By definition of 

the right parenthesis of the integrand in Equation 12 is positive for all x. Because X is unimodal and symmetric by assumption, its PDF f_X peaks at f_X(0) and is decreasing on the positive and negative sides. Thus, the unimodality and symmetry implies that, for all x₁ and x₂, if |x₁|≤|x₂| then f_X(x₁)≥f_X(x₂). 

In our case of interest, if z is negative, we have for all positive x, |z+x|≤|z-x| and so f_X(z+x)≥ f_X(z-x), which means the left parenthesis of the previous integrand is also positive. We can deduce that

which is precisely the statement (A). On the other hand, if z is positive, |z+x|≥ |z-x| and so f_X(z+x)≤f_X(z-x) meaning that the integrand is negative and so

This proves (B) completing the proof that, if 

and the distributions X, Y, O_Y are symmetric unimodal, then

By applying the same reasoning, we get that if

and the distributions X, O_X, O_Y are symmetric unimodal, then

This finishes the proof of stability of CDF-overbounding by addition.

Proof of stability by multiplication by a scalar: for all real α,

Let X, O_X be two symmetric, unimodal random variables such that

First of all, αX and αO_X are also symmetric and unimodal. By symmetry of X and O_X, we can restrict ourselves to the case where α is strictly positive. According to the equality F_αX(x)=F_X(x⁄α) and similarly for O_X so the inequalities defining XO_X directly translate to αXαO_X.

Application to protection volumes: If X is the distribution of the residual error (symmetric and unimodal by assumption), then a CDF-overbound O_X allows us to put a lower bound on the probability of the error to be in a certain interval containing 0. More specifically, for a negative a and positive b, we have: . 

Usually, protection volumes are chosen to be symmetric, and thus for positive a,

and so any protection volume computed with the overbounding distribution is a conservative protection volume for the original distribution.

In practice, O_X is a Gaussian distribution, chosen for its stability by linear combinations. If in the total error

each error component ε_i is CDF-overbounded by a Gaussian distribution with standard deviation σ_i, then the total error e is CDF-overbounded by a Gaussian of standard deviation

Thus, the usual formula for the protection . Thus, the usual formula for the protection level can be used, with

Case of distributions with bias: The CDF-overbound theorem requires the distributions of error components to be centered. However, the absence of bias in residual measurement errors is never perfectly satisfied because of systematic errors due to troposphere, multipath inter-channel bias, etc.

These errors along the lines of sight are therefore composed of a random part, a noise ε_i with zero mean, plus an additional bias μ_i. If these biases were known, they would be integrated into the SBAS corrections, but this is not the case. However, we will assume we know a bound on their absolute values.

The absolute value of the position error along one coordinate is then given by:

We can build the protection volume that covers the suffered errors as follows:

where the factor K is computed according to the error distribution. In the Gaussian case, the multiplicative factor K is calculated using the inverse of the complementary function K=√2erfc^-1(IR).

The question of introducing biases as a multiplicative factor of the protection volume calculated with the classic formulation arises. To do this, we introduce the following calculation:

Here, the quantities

We then find the desired multiplicative factor:

This multiplicative factor ξ makes it possible to inflate the classic volumes of protections (expressed without bias) so as to encompass these residual biases:

This approach allows us to state the following result:

Theorem 1bis: If the distribution of each of the residual measurement errors is symmetric around its median, unimodal and can be overbounded by a Gaussian distribution with the same median (i.e. the mean of the Gaussian is equal to the median of the residual error distribution), then the protection level for the position error can be computed with the usual formula, provided we inflate the K-factor by the multiplicative factor ξ. Under these assumptions, integrity in the pseudorange domain imply integrity in the position domain.

The definition of coverage relative to a median is given by:

The concept of CDF-overbound requires the tails of the overbound cover the tails of the empirical distribution. In the case of a Gaussian overbound, we know the tails of the Gaussian distributions are very light and we will end up finding a quantile (even if it is very large) beyond which the tail of the Gaussian passes below the tail of the empirical distribution. This is why we set in practice a quantile q, beyond the specified integrity risk q>F^-1(IR⁄2N), within which, on the interval [-q,q], the overbound property is verified.

Paired Overbounding 

This concept was introduced in [3,4] to relax the strong assumptions of CDF-overbounding, namely that the distributions of the residual error components are centered, unimodal and symmetric.

Definition: The random variables L_X and R_X are a paired overbound of the random variable X, and we note X ⊆ [L_X, R_X] if 

The random variable L_X is said to be the left overbound and R_X is said to be the right overbound of the random variable X. Figure 2 displays three representations of paired overbounding by two Gaussian distributions with standard deviation 0.7 and bias equals to -/+ 0.3, adopting the same conventions as in Figure 1. 

Theorem 2a: For independent random variables X,Y, if X ⊆ [L_X,R_X] and Y ⊆ [L_Y,R_Y] then X+Y ⊆ [L_X+L_Y,R_X+R_Y]. In other words, the pair overbounding concept is stable by convolution. A priori the random variables X,Y and their overbounding pair are arbitrary; no particular assumption is necessary to demonstrate stability by convolution, which is the strength of the concept.

Proof:

We have, using the definition of the left-overbounding:

And so ∀z ε,F_X+Y(z)≤F_X+LY(z). Repeating the same argument:

Combining the two inequalities of Equations 25 and 26, we get: 

The proof of the inverse inequality is established in a similar way without difficulties. 

Theorem 2b: If X⊆[L_X,R_X], then for a positive real α we have αX⊆[αL_X,αR_X]. However, for a negative real α, we have αX⊆[αR_X,αL_X]. If we further require that the over-bounding pair is symmetric, meaning that L_X=-R_X, we can write the result as follows: for all α, if X⊆[-R_X,R_X], then αX⊆[–|α|R_X,|α|R_X].

Proof:

We have for positive α:

On the other hand, for a negative α, we have:

These theorems show the stability of linear combinations is satisfied with any pair of overbounds (possibility asymmetric or multi-modal) but only with positive coefficients. Unfortunately, this property is not sufficient to guarantee the integrity transfer from range to positioning domain (because the geometry coefficients are signed). The following Theorem permits to guarantee the stability of any linear combinations (with positive or negative coefficients) by adding a condition on the pair of overbounds that is L_X=–R_X.

Theorem 2c: If X⊆[–R_X,R_X] and Y⊆
[–R_Y,R_Y] then ∀(α,β)∈², αX+βY⊆
[–|α|R_X–|β|R_Y,|α|R_X+|β|R_Y]. If the distribution of each of the residual measurement errors is paired-overbounded by a symmetric pair, then the position errors are also paired-overbounded by a known pair. Under these conditions, integrity in the pseudorange domain imply integrity in the position domain.

This approach is useful for taking residual biases into acount. Consider a given line of sight and a contributor X to the residual errors on this line of sight. This contributor presents a residual bias for which a known bound is μ.

We construct a bounding of distribution X by two Normal laws with standard deviation σ, the left bound biased by -μ and the right bound biased by +μ, which form a symmetric pair:

If we collect all the lines of sight and each contributor to the measurement errors paired-overbounded, then the convolution property implies that the position error is also a paired-overbounded distribution with a variance and a bias given respectively by

The limiting aspect is the search for left and right bounds can bring conservatism in practice, knowing these boundaries must frame the entire empirical distribution.

Application to protection volumes: The pair overbounding X⊆[L_X,R_X] allows us to put a lower bound on the probability to be in a certain interval: for any a,b with a<b, we have:

In the case of an overbounding pair by two Gaussians of mean ±μ and variance σ², we have for a symmetric protection level:

and so the integrity condition P(X∈
[-PL,PL])≥1-IR can be ensured for

If in the total error 

 each error component ε_i is pair-overbounded by two Gaussian distribution with standard deviation σ_i and mean ±μ, then by the stability by linear combinations, the total error e is pair-overbounded by two Gaussians of standard deviation σ= and mean μ=. Thus, the formula for the protection level is identical to the formula in the previous section, but with different hypothesis on the original distributions. 

Core-Tail Overbounding 

In general, the empirical distribution of interest is obtained by collecting large volumes of data. This is sufficient to accurately represent the core of the distribution but there is always a point where the tail remains unknown because the collected samples are always finite. Therefore, how can we ensure the constructed overbounding distribution remains correct for the entire underlying distribution?

Furthermore, if the tail of the underlying distribution is known analytically or with good numerical precision, the overbounding theorems presented impose a condition on the entire distribution. When using Gaussian overbounds, which have very light tails, this can lead to excessive conservatism, for example to absorb some mass far in the tail, or can be mathematically impossible if the analytic expression of the underlying distribution falls slower than a Gaussian.

The strategy presented by [6] is a mean to deal with these two problems. It divides the cumulative distribution function F_OX of the overbound distribution into two parts: an explicit core and an implicit tail. The overbounding distribution is a mixture of both, and the value this function takes at a point is equal to the sum of the core cumulative distribution function F_OX,c and the tail cumulative distribution function F_OX,t, weighted by the probability P_t that the point is in the core or the tail:

The core distribution is explicit, meaning it can be expressed analytically and calculations performed. Most often, it is a Gaussian distribution. As for the tail, which poses the most problems, it is left completely arbitrary: We know it exists, but we do not wish to perform calculations with it. Instead, we will always consider the worst possible tail for the chosen application to constrain the maximum impact of the unknown tail.

This approach is valid for both CDF-overbounding and paired overbounding. The benefit of this decomposition is to be able to focus on the core overbound, while ensuring the unknown tail of X is defined such that F_OX(x) (defined by Equation 34) is an overbound of X, with the following approach of F_OX,t as a pseudo CDF:

Intuitively, inequality (24) means the worst tail for the CDF-overbounding is a probability weight of 1⁄2 localized at both infinities, whereas the worst tail for a left-overbound is to have all probability concentrated at minus infinity (plus infinity for the right overbound). Formally, the resulting overbounding function F_OX(x) is not a CDF (because its total weight is not 1) but as in the excess mass concept, all properties of the corresponding overbounding function remain unchanged.

In practice, a CDF-overbound in the core-tail overbounding concept consists of a (symmetric unimodal) function F_OX,c and a tail weight P_t such that F_OX=(1-P_t) F_OX,c+P_t⁄2 (because for CDF-overbounding the tail CDF is always chosen as a constant of value 1⁄2) is a CDF-overbound of the distribution of interest X. In other words, we need F_OX,c and P_t such XO_X. For pair-overbounding, the left and right bounds are split into core and tail. We need a left and right core overbounding distribution F_LX,c and F_RX,c and a tail weight P_t such that:

Graphical representations of core-tail overbounding is illustrated with P_t equals to 5×10^-2 in Figure 3 for CDF-overbounding by a Gaussian with standard deviation 0.7, and Figure 4 for paired overbounding by two Gaussian with biais +/- 0.3 and standard deviation 0.7. The green area represents the domain that satisfies the overbounding of X by O_X.

Note the core-tail overbounding is a weaker condition than the original overbounding condition, in the sense that any overbounding distribution (CDF or paired) can be seen as the core overbounding distribution with a tail weight P_t, whatever the value of P_t. The downside is the resulting protection volumes will be more conservative for larger tail weight, and can be undefined if the integrity risk is lower than the tail weight. This phenomenon allows for the following result as part of this new paradigm.

Theorem 4: Let X and Y be two random variables that admits a CDF-overbound (central or paired) that can be decomposed into a core part and a tail part with weight P_t,X and P_t,Y. Then the linear combination αX+βY admits a corresponding overbound with the core given by the theorem 1 or 2c, and with core weight (1-P_t,X)×(1-P_t,Y). Under these conditions, integrity in the pseudorange domain imply integrity in the position domain.

Proof:

We will first consider the framework of the central CDF-overbound and the overbounding of X+Y. Theorem 1 (stability by convolution) gives us X+Y is overbounded by O_X+O_Y (the core-tail overbound remains a centered symmetric and unimodal distributions):

We then inject into inequality (26) the decomposition of the overbounds of the random variables X and Y into core and tail.

By expanding expression (38), we get

On the other hand, the cumulative distribution function of the overbound of the sum is decomposed into core and tail parts:

By identification with Equations 38 and 39 we find that:

1-P_O,t=(1-P_t,X)(1-P_t,Y), which gives the weight of the core,

F_OX+O_Y,c=F_OX,c*f_OY,c, so the core of the sum is the convolution of the cores of each distribution,

The rest of the expression is considered as the tail and its explicit expression is not needed.

The last step is to prove by replacing the implicit tail part by the constant 1⁄2, we still have a CDF-overbounding of the sum. For x≤0, the three terms F_OX,t*f_OY,c(x), F_OX,c*f_OY,t (x), F_OX,t*f_OY,t (x) are smaller than 1⁄2 because each one is a symmetric CDF. Thus, for negative x, F_OX*f_OY(x)≤(1-P_O,t)×F_OX+O_Y,c+P_O,t⁄2. On the positive side, the equations are reversed, and we get a CDF-overbound of the sum by considering only the core part of the two distributions. We can replace the tail part by its generic value.

The multiplication by a scalar is treated as in Theorem 1 and does not change the weight of the core or tail. 

In the pair overbounding case, the resulting pair is symmetric if the core overbounding pair is symmetric, so formula of theorem 2c holds as long as each individual overbounding pair has the same core and tail weights for the left and right overbounding pair. The proof is very similar to the CDF-overbounding case.

The core-tail overbounding concepts allows us to manipulate a weaker form of CDF or paired-overbounding. It is weaker because the inequalities are not required on the entire CDF but only on the core part. The properties of stability by linear combination of the CDF and paired-overbounding are maintained but at the price of a small “contamination” of the tail for each added term. For each addition, the tail weight grows. An upper bound on the weight of the tail can easily be derived as follows: In the case where all weights are equal with tail weight P_t, we have P_O,t=1-(1-P_t )²<2P_t, and by recurrence on n sources of errors, we have P_O,t<nP_t.

Application to protection volumes: The protection volume formulas are identical to the CDF or paired-overbounding cases, with the replacement of the overbounding distribution by the core plus tail part. If we are working with Gaussian distributions, the properties of stability by linear combination allows us to use the same formulas by changing only the value of the K-factor, which now depends on the weight of the tail distribution. The compatible quantile K of a given integrity risk IR in the position domain is calculated by considering the CDF of the overbounding function and inverting it. The Gaussian K-factor changes for the CDF-overbound to:

For a protection volume to be calculable with the K-factor, it is necessary that IR-P_O,t>0 and thus that P_O,t<IR. Otherwise, the knowledge of the core distribution is not sufficient to build a suitable protection volume and the protection level goes to infinity, and gives no information in practice.

For the paired CDF-overbound the K-factor changes to:

Note the weight of the tail depends on the number of error contributors. If each error has an overbound tail weight P_t<<1, then the full error overbound has tail weight nP_t. This means the density of the tail distribution of each measurement error must be at least n times lower than the selected integrity risk for the position domain. In case this condition is not met, the protection volume is undefined (infinite) because the knowledge of the core distribution is not sufficient to guarantee a protection level at the given integrity risk.

If we have P_t<<IR, then we can use the usual K-factor formula (4).

The notion of core-tail overbounding is very important theoretically because it justifies the use of overbounding methods when the tail is not fully known, and it justifies the use of Gaussian overbounding even when the tail is heavier than a Gaussian. However, in practice, such conditions on P_t (P_t<IR⁄n or P_t<<IR) are challenging to verify because IR is already very low (usually about 10^-7). This requires a fine knowledge of the error distribution to go far in the tail, which means a large experimental sample of values that is quite difficult to achieve. Thus, the core-tail overbounding technique is rarely used, and the assumption that the overbounding is valid up to infinity is often made. 

Excess Mass for Paired Overbounding 

In practice, constructing pairs of overbounds can artificially increase biases or variances on each of the overbounds to correctly bound the empirical distribution function. While this operation is often necessary, it inevitably leads to conservatism and larger protection levels than needed.

The left bounding distribution must have a heavier tail on the left (on the negative side) than the original error distribution, while at the same time have a lighter tail on the right. Because Gaussian distributions are often used for overbounding, this double condition is difficult to achieve and is often met at the price of very large biases. This specific problem with the pair overbounding technique can be partially resolved by the concept of excess mass overbounding [5] (excess mass CDF method), which considers a distribution mass greater than 1, typically 1+ ε where ε is referred as excess mass.

With such mass, the pseudo CDF is allowed to pass either beyond +1 or below -1. With this flexibility, we only need to ensure the properties of the overbound on one side of the empirical distribution, knowing the other side is no longer constrained. For Gaussian pair-overbounds, this adds a third degree of freedom to the variance and the bias.

Formally, we consider f, a pseudo-PDF that is positive and integrable, but we do not impose that its total probability weight is 1. Instead, we allow a total mass 1+ε larger than one (Equation 43).

The associated left pseudo-CDF is defined as F_L(x)=(1+ε)×F~_L(x), where F~_L is a regular CDF with total weight equal to 1. This means F_L(x) tends to 0 as the variable x approaches negative infinity as a regular CDF, but tends to 1+ε as x approaches infinity, relaxing the overbounding constraint by the left overbounding on the right.

For the right overbound F_R(x), the excess mass is applied on the survival function: 1–F_R(x)=(1+ε)×(1–F~_R(x)), where F~_R(x) is a regular CDF, which leads to F_R(x)=(1+ε)×F~_R(x)-ε. Consequently, the right pseudo-CDF goes to 1 as x approaches infinity like a regular CDF but tends to a negative value when x goes to negative infinity.

With this definition, the concept of pairs of overbounds can be expressed in the same terms and exhibits the same properties, particularly the stability under convolution (the proof can be reproduced identically as it uses only the positivity of the PDF), noting the mass of the sum of random variables is the product of the masses of each variable. Specifically, if the variables X and Y have respectively masses 1+ε_X and 1+ε_Y, then the sum X+Y has a mass of (1+ε_X)×(1+ε_Y). 

Definition: L_X and R_X associated to the pseudo-PDF f_L and f_R define a paired overbound with excess mass ε of the random variable X, and we note X⊆[L_X,R_X] if 

where F_L(x) and F~_R(x) are regular CDF (with total probability weight equal to 1).

Theorem 3: If X and Y are paired-overbounded with excess mass by a symmetric pair then the linear combinations are also paired-overbounded by a known formula. If X⊆[–R_X,R_X] and Y⊆[–R_Y,R_Y] then ∀(α,β)∈², αX+βY ⊆[–|α|R_X–|β|R_Y,|α|R_X+|β|R_Y]. (Here –R_X is defined as having the pseudo-PDF f_R(-x) and the sum and multiplication by a scalar are defined as for regular random variables). The total mass of the overbounding of the linear combination is (1+ε_X)×(1+ε_Y). Under these conditions, integrity in the pseudorange domain imply integrity in the position domain.

The proof is the same as the equivalent proof for paired-overbounding. With each addition, the total weight of the excess mass overbounding pair grows as it is the product of all masses involved.

Figure 5 illustrates paired overbounding with excess mass ε equals to 2.5×10^–2. The overbounds are two Gaussian with bias –/+ 0.3 and standard deviation 0.7 and the green area represents the domain that satisfies the overbounding of X by L_X on the left and R_X on the right. The QQ plot representation is not applicable to excess mass because the overbounds has total weight greater than 1. The allowed green zone is much larger with excess mass than in Figure 2, making the condition easier to verify.

Application to protection volumes: In the case of overbounding by Gaussian pseudo–PDFs, all the convenient addition properties of the Gaussian-distributed vector are maintained. All the formulas derived for the protection volume build with pair-overbounding remain valid, with only a modification in the K-factor. Explicit calculations show the new expression of the K-factor is

Because the complementary error function erfc is decreasing, we see K increases with ε. Thus, a larger excess mass makes it easier to pair-overbound the distribution, but leads to larger protection volumes.

When all the error sources i are paired-overbounded with excess mass by Gaussian distributions of standard deviation σ_i, bias ±μ_i and excess mass ε_i,the calculation of the protection volume remains particularly simple. It is given by

Where 

ξ is the multiplicative factor defined by Equation 16 and inflating K-factor defined by Equation 46.

Note the excess mass, as proposed in [5] requires the true tail is Gaussian or lighter to the Gaussian, because the overbound must hold up to infinite. It is interesting to combine the excess mass with core-tail approaches. We propose to include the excess mass only on the core overbound. In this case, we have for each error contributor:

By projecting Equation 47 in position domain, we get:

Equation 48 can be arranged as:

By inverting the equation, we get, in Equation 50, the new formulation for K-factor:

Two Steps Overbounding 

The objective of the approach proposed in [7] is to mix the two concepts of central CDF-overbound and paired overbound. From the empirical distribution of an unmodelled residual error, the objective is to construct a weaker form of paired overbound by Gaussian distributions (the Gaussian distribution is chosen for computational simplicity).

We start by constructing an intermediate pair-overbound where each bound is unimodal and symmetrical around its mean, but not necessarily Gaussian. We know (Theorem 3) this paired overbound is stable by convolution. We impose the properties of symmetry and unimodality because they are part of the hypotheses of the CDF-overbound. The second step is to find a Gaussian distribution (necessarily symmetrical and unimodal around their mean) where CDF-overbounds the left and right distributions. The assumptions of the CDF-overbound are met and imply these pairs of Gaussians overbounds are stable by convolution.

The result of this method are the two Gaussian variables

which have the following property:

The resulting properties of the two-step overbounding are weaker than those of the pair-overbounding, but they are sufficient to build a protection volume as follows:

Where K is the usual factor computed with Gaussian distributions (Equation 4).

This protection level is correct because of

The goal is to build a Gaussian two-steps overbound defined by μ_X, σ_X that is stable by linear combination, making it possible to perform the overbounding at range level and to build a protection volume at position level.

Theorem 5: If μ_X, σ_X define a two-steps overbound of X and μ_Y, σ_Y define a two-steps overbound of Y, then the linear combination Z=αX+βY can be two-steps overbounded by a pair of Gaussians with bias μ_Z=|α| μ_X+|β| μ_Y and variance

Under this condition, integrity in the pseudorange domain imply integrity in the position domain.

Proof:

The proof makes extensive use of previous results. Let us start with stability by convolution and consider Z=X+Y. Can we build a two-steps overbound of Z from the two-steps overbounds of X and Y?

We know the intermediate paired overbounding is stable by convolution, and this step requires no particular assumption on the underlying distributions of X and Y:

Then we use that the CDF-overbounding is stable by convolution. This is where the unimodality and symmetry around the median of the intermediate distributions is essential:

Because the CDF-overbounds are Gaussian, we have O_LX+O_LY~N(μ_LX+μ_LY, σ²_LX+σ²_LY) and similarly for O_RX+O_RY.

Finally, μ_Z=μ_X+μ_Y, we have μ_Z≥ max (|μ_LX+μ_LY|,|μ_RX+μ_RY|) and also σ²_Z≥ max(σ²_LX+σ²_LY, σ²_RX+σ²_RY). Because the tail probability for a Gaussian distribution is an increasing function of the standard deviation and the mean, the previous inequalities ensures the two Gaussian variables

of mean ±μ_Z and variance σ²_Z have the following property:

which is the essential property for the protection level to be correct. 

Note these properties on the tails of the distributions are necessary for the protection level formula to be correct but are not in themselves sufficient for a two-steps overbound because they are not stable by convolution. The stability by addition comes from the intermediate paired-overbound constructed in the first step.

The multiplication by a scalar poses no additional difficulties: if Z=αX then Z ⊆ [αL_X,αR_X] if α if positive (and Z ⊆ [αR_X,αL_X] for the negative case). In both cases αL_XαO_LX and αR_XαO_RX because the considered distributions are unimodal and symmetric around their means. We have αO_LX~N(αμ_LX,α² σ²_LX) and αO_RX~N(αμ_RX, α² σ²_RX) and the choice μ_Z=|α|μ_X and σ_Z=α² σ²_X ensures μ_Z≥max (|αμ_LX|,|αμ_RX|) and σ²_Z≥max (α² σ²_LX, α² σ²_RX). 

The two-steps overbounding construction allows for the transfer of integrity from the measurement domain to the position domain without specific assumptions of symmetry, centering and unimodality of the empirical error distribution by transmitting only two Gaussian parameters per line-of-sight (namely μ_X and σ²_X). This approach is less conservative than the paired overbound by two symmetric Gaussians because the needed property concerns only the left tail

The stability by linear combination is guaranteed by the existence of the intermediate symmetric and unimodal paired-overbound, but the explicit knowledge of the intermediate distribution is not needed for protection volume calculation.

The limiting aspect of the two steps overbounding method is the quality of the final overbound is very dependent on the construction of the first paired overbounds (first step). This step requires a complex optimization algorithm, with one such algorithm described in [7]. Another drawback of the method is it is difficult for a user with knowledge of the original error distribution and the parameters μ_X and σ²_X to verify the received parameters effectively form a correct two-steps overbounding of the error distribution without the information of the algorithm used in the first step.

Wide Sense CDF-Overbounding 

The approach of Weak CDF-over-bounding is introduced in [11]. Similar to the two-step overbound concept, the approach aims at taking advantage of both the CDF-overbounding and pair-overbounding definitions: the simplicity of the first one and the robustness of the second. The main idea is to impose a condition equivalent to CDF-overbounding for biased distribution, but without the assumptions of symmetry and unimodality. When performing linear combinations, the stability of the protection volume formula is lost because of the dropped assumptions. However, it is possible to quantify and bound the worst deviations from the Gaussian distribution and encapsulate them in a suitable inflation factor in the protection volume formula to ensure integrity.

In more precise terms, let X be a distribution (typically the distribution of an error contributor in a GNSS pseudorange measurement) with median b. We do not require X to be unimodal nor symmetric around its median. A weak CDF-overbound is given by a pair of Gaussians with mean ±μ_X and identical variance σ² such that μ_X≥|b| and furthermore:

The condition is identical to the second step of the two-steps overbounding method, but without the first step guaranteeing the stability of the property under linear combinations. If our quantity of interest is given by

where all X_i are individually weakly CDF-overbounded by Gaussian pairs of parameters μ_i and σ_i and n being the number of each error source, it is shown in [11] that the weak CDF-overbounding condition is sufficient to build a protection volume for E. The protection level formula is:

In this formula, K is the usual Gaussian K-factor (σ is the usual Gaussian standard deviation) where

and the new term A_n,K is an inflation factor that takes into account the weaker assumptions taken in the definition. It quantifies somehow the worst deviations from the Gaussian distribution if each term follows the weak CDF-overbound condition. The inflation factor A_n,K depends on the value of the K-factor (and the required integrity risk) but also on the number of terms in the linear combination. The factor A_n,K has no simple analytical formula, but a table of values can be pre-computed and used as such in a given context.

Note the parameter n is the number of independent error contributors and can be larger than the number of satellites in view if there are several error sources for each line-of-sight.

In this method, the properties of CDF-overbounding cannot be used directly because important assumptions on the unknown distribution are not met. However, the conditions of CDF-overbounding by a Gaussian are equivalent to a pair-overbound by two symmetric distributions, the left and right half-Gaussian. Furthermore, the properties of pair-overbounding do not use the assumptions of symmetry and unimodality. One can build a pair-overbound of the final error distribution as linear combinations of half-Gaussians. The last step is to build a pair-overbounding distribution for all coefficients in the linear combinations of half-Gaussians, such that the result is independent of the geometry of the problem. This allows conservative protection volumes to be built for a specific integrity risk. These protection levels are then divided by the usual K-factor and interpreted as an inflation factor A_n,K integrated in the protection volume formula. Note the factors presented in Table 1 and [11] are upper-bounds and future improvements on the method may reduce the numerical values of the inflation factors and thus of the protection volumes.

The main advantage of weak CDF-overbounding is its simplicity. The condition to verify for weak CDF-overbounding is of the same complexity as usual CDF-overbounding, but fewer assumptions on the underlying distribution are needed. The user only needs to store a pre-computed table of values of inflation factors (computed for the required integrity risk) to use when computing its protection volume. On the other hand, weak CDF-overbounding can lead to large protection volumes if the number of contributors is large and the K-factor is low. 

Conclusion 

This article shows the overbounding concepts that play a crucial role in demonstrating integrity are neither intuitive nor straightforward. However, the overbounding concepts using Gaussian overbounds are designed to keep the procedure as simple as possible. Indeed, the stability by linear combination of the overbounding properties and of the Gaussian distribution allows the user to manipulate the range errors as if they were Gaussian (by adding their standard deviations in quadrature) and apply the protection volume formula that mostly differ by the K-factor. From the integrity system point of view, the advantage is to focus on monitoring range error distribution and to send few parameters to the user, allowing for the construction of correct protection volumes. 

Table 2 summarizes the main assumptions and implications of the different concepts applied to Gaussian overbounds.

Despite extensive work on the subject, several open points remain on overbounding. 

First of all, all the studied concepts consider independence between all contributions to the positioning errors, and consequently between line of sights (Table 1). In practice, a correlation between the lines of sight could be caused by the troposphere residual errors, multipath or ODTS algorithm. [12] introduced a Power Spectral Density (PSD) overbounding concept that can guarantee integrity transfer of correlated Gaussian errors (with unknown and arbitrary correlation pattern), using a Gauss-Markov processes that overbound the PSD. To our knowledge, this concept is not used for single point positioning but is key for the integrity demonstration for Kalman filter. Generalization of this concept to non-Gaussian distributions will be a key step both for single point positioning and Kalman filtering.

Secondly, the concepts of overbounding presented are adapted to one dimensional quantities only. For example, the protection level formulas should be applied direction by direction for the positioning solution. A theory of overbounding multidimensional distributions is missing to, for example, build a protection volume for the norm of the horizontal positioning error. One difficulty of such a theory is the norm of a vector is not a linear combination of its components, and thus all the properties presented do not apply to this problem [13]. 

Last, the practical evaluation of overbounding remains a challenge because it involves estimating quantiles with low probability. This requires collecting and analyzing huge quantities of experimental data, which is costly, cumbersome and generally unrealistic. A promising alternative could be to extrapolate the tails of the distributions beyond the available data based on extreme value theory. 

Appendix

CDF OF THE SUM OF TWO INDEPENDENT RANDOM VARIABLES

We start by formulating the expression for the CDF of the sum X+Y. By definition of the CDF, F_(X+Y) (z)=P(X+Y≤z). The probability P(X+Y≤z) is obtained by integrating the join density function f_(X,Y) (x,y) of the couple of random variables (X,Y) on the set of x,y respecting the inequality x+y≤z or equivalently y≤z-x. As the random variables X and Y are independent, the joint PDF is the product of the individual PDFs:

The PDF of the sum of the two independent variables X and Y is obtained by making, in Equation 59, the change of variable y=v-x, interchanging the order of integration, and derivating the CDF with respect to z:

Thus, the density f_(X+Y) appear as the classic convolution product Equation 61 of the densities, noted as f_(X+Y)=f_X*f_Y:

The CDF of the sum of the two variables X and Y is obtained by recognizing in Equation 59 the CDF of the random variable Y:

Injecting F_Y (z-x) given by Equation 62 in the expression of F_(X+Y) (z) in Equation 59, we then get:

By making the integral of the joint density function respecting now the inequality x≤z-y in Equation 59, it comes:

Therefore, the CDF of the sum of the two variables X and Y is the convolution of the CDF of the one with the PDF on the other indifferently:

SUM OF TWO SYMMETRIC UNIMODAL RANDOM VARIABLES

In this section, we want to prove the following: if X and Y are two independent, symmetric and unimodal random variables, then their sum X+Y is also symmetric and unimodal [8]. 

Let f_X, f_Y, be the PDFs of X and Y and f_(X+Y)=f_X*f_Y the PDF of X+Y. Then f_(X+Y) is symmetric because, for all x∈R:

In this manipulation, we have used the symmetry of f_X and f_Y and the change of variable t→-t.

Let us now fix two reals 0≤a≤b and prove that f_(X+Y) (a)≥f_(X+Y) (b). We have from the ordering of a and b that for all x, |x-a|≥|x-b| if x≥((a+b))⁄2 and |x-a|≤|x-b| if x≤((a+b))⁄2. From the unimodality and symmetry of Y, this implies that f_Y (x-a)≤f_Y (x-b) if x≥((a+b))⁄2 and the contrary if x≤((a+b))⁄2. Similarly, we have, for x≥((a+b))⁄2, |x|≥|x-a-b| and so f_X (x)≤f_X (x-a-b) and also, for x≤((a+b))⁄2, f_X (x)≥f_X (x-a-b).

This shows that for all x∈R, we have:

Because both terms are positive for x≤((a+b))⁄2, else both terms are negative.

Integrating the positive product defining by Equation 66 on x, and using the symmetry of f_X,f_Y we get:

And using the symmetry of f_(X+Y), right side of inequation 67 becomes:

Thus f_(X+Y) is decreasing for positive x, which proves the unimodality of X+Y.

A COUNTER EXAMPLE TO A NAÏVE APPROACH 

For a given integrity risk IR and associated Gaussian K-factor, it is tempting to check integrity at the pseudorange level by making sure that for all lines of sight:

However, the following example demonstrates this approach is not sufficient to guarantee the integrity at position level. The reason is this condition tests a certain quantile of the pseudorange error distribution, whereas the stability by linear combinations require criteria to be met across the entire distribution.

Let us use a numerical counterexample. We first take a geometry matrix (here corresponding to 7 GPS satellites above Toulouse  on September 3, 2002, 0h00 in ENU frame)

Let us consider the case where all error variances on the pseudorange errors σ_i^2 are equal to 1. Then we build the S matrix as S=(G^T G)^(-1) G^T. The third line of S is

The vertical protection volume VPL has radius given by Equation 69

with K_V=5.33 and σ_V=√(S_(3,i)^2 σ_i^2 )

If the vector of residual errors is

then each line of sight passes the integrity test (meaning that ∀i,b_i<K_V σ_i=5.33), but the vertical error is

which exceeds the protection level radius.

This counter-example does not question the principle of integrity transfers from pseudo distance to position, but the fact that it can be done by the sole definition of confidence intervals in the pseudo distance domain. To establish the equivalence between both realms, the property of overbounding must be verified across the entire distribution, at least up to the desired quantile.

Indeed, if the overbound is applicable for each line of sight, it is extremely improbable to obtain the vector  proposed in the example. In addition, if we only know the inequality is satisfied for each line of sight, we have no information about the probability of occurrence of the given vector  in the example, even though it leads to a lack of integrity in the domain of positions.

References 

[1] Minimum operational performance standards for Global positioning system/ wide area augmentation system airborne equipment, DO-229, RTCA ed. Washington, DC.

[2] B. DeCleene, Defining pseudorange integrity – Overbounding, In Proc. 13th Int. Techn. Meeting Satellite Div. Inst. Navigat., Salt Lake City, UT, USA, Sep. 2000, pp. 1916–1924.

[3] J. Rife , S. Pullen, B. Pervan, and P. Enge, Paired Overbounding and Application to GPS Augmentation, Proceedings IEEE Position, Location and Navigation Symposium, pp. 439-446, July 2004.

[4] J. Rife, S. Pullen, B. Pervan, and P. Enge, Paired Overbounding for Nonideal LAAS and WAAS Error Distributions, IEEE Trans. Aerosp. Electron. Syst., vol. 42, no. 4, pp. 1386–1395, Oct. 2006.

[5] J. Rife, J. Blanch and T. Walter, Overbounding SBAS and GBAS Error Distributions with Excess-Mass Functions, in Proceedings of the GNSS 2004 Internat. Symp. On GNSS/GPS, Sydney, Australia,6-8, Dec. 2004.

[6] J. Rife, S. Pullen, B. Pervan, Core Overbounding and its Implications for LAAS Integrity, Proceedings of the 17th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS 2004), Long Beach, CA, Sept. 2004, pp. 2810-2821.

[7] J. Blanch, T. Walter and P. Enge, Gaussian Bounds of Sample Distributions for Integrity Analysis, IEEE Trans. Aerosp. Electron. Syst., vol. 55, no. 4, pp 1806-1815, Aug. 2019.

[8] M. Earnest, link.

[9] J. Antic, O. Maliet, and S. Trilles, “SBAS Protection Levels with Gauss-Markov K-Factors for Any Integrity Target”; NAVIGATION: Journal of the Institute of Navigation September 2023, 70 (3) navi.594

[10] K. Mimouni, O. Maliet, J. Antic, “A simple and robust K-factor computation for GNSS integrity needs”. ION plan, pp 399-407, 2023

[11] Maliet, O., Mimouni, K., Antic, J., & Trilles, S. (2025). Wide-Sense CDF overbounding for GNSS integrity. NAVIGATION: Journal of the Institute of Navigation June 2025, 72 (2) navi.697; link

[12] Langel, S., Crespillo, O. G., & Joerger, M. (2020, April). “A new approach for modeling correlated Gaussian errors using frequency domain overbounding”. In 2020 IEEE/ION Position, Location and Navigation Symposium (PLANS) (pp. 868-876). IEEE.

[13] I. Nikiforov, “From pseudorange overbounding to integrity risk overbounding”, NAVIGATION, Vol 66, Issue 2, Summer 2019, pp 417-439.

[14] Z. W. Birnbaum, “On Random Variables with Comparable Peakedness”, The Annals of Mathematical Statistics, 19 (1), pp 76-81 doi:10.1214/aoms/1177730293

Authors

Julie Antic is a specialist in GNSS integrity algorithms and performances at Thales Alenia Space in Toulouse, France. She holds a Ph.D. in probability and Statistics from Paul Sabatier University, France, as well as an engineering degree in applied Mathematics from INSA in Toulouse, France. Her areas of activity include advanced GNSS augmentation systems for high accuracy and integrity, advanced receiver autonomous integrity monitoring and overbounding concepts.

Odile Maliet graduated from École Polytechnique and received her Ph.D. degree in Macroevolution from École Normale Supérieure (ENS), Paris in 2018. Between 2018 and 2020, she worked as a postdoc on the use of Bayesian techniques on phylogenetics empirical data at ENS, Paris. Since 2021 she has worked on integrity concepts in Advanced Projects at the Performance and Processing Department of Navigation Domain, Thales Alenia Space.

Kin Mimouni graduated from École Polytechnique, Paris, and received his Ph.D. in Theoretical Physics from École Polytechnique Fédérale de Lausanne (EPFL) in 2019. Since 2021 he has worked on GNSS algorithms and integrity concepts, first as a post-doc in the Télécommunications Spatiales et Aéronautiques (TéSA) laboratory in Toulouse, and since 2023 as an engineer in Advanced Projects at the Performance and Processing Department of Navigation Domain France, Thales Alenia Space.

Sébastien Trilles is an expert in orbitography and integrity algorithms at Thales Alenia Space in Toulouse, France. He holds a Ph.D. in Pure Mathematics from the Paul Sabatier University and an advanced master’s degree in Space Technology from ISAE-Supaero. He heads the Performance and Processing Department where high precise algorithms are designed as orbit determination, clock synchronization, time transfer, reference time generation, integrity and ionosphere modeling algorithms for GNSS systems and augmentation.

The post Working Papers: Overview of Overbounding Techniques for Integrity Purposes appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

JUDAH LEVINE, UNIVERSITY OF COLORADO, PASCALE DEFRAIGNE, ROYAL OBSERVATORY OF BELGIUM, ILARIA SESIA, ITALIAN METROLOGY INSTITUTE, GIULIO TAGLIAFERRO, INTERNATIONAL BUREAU OF WEIGHTS AND MEASURES, MICHAEL WOUTERS, NATIONAL MEASUREMENT INSTITUTE

Coordinated Universal Time (UTC) has been recommended as the unique time scale for international reference time stamps and is the basis for civil time in most countries [1]. Time zones, which are established by local administrations, are defined by an offset from UTC. Some applications are required to use time stamps based on UTC either by regulation or by statute [2-4]. There are advantages to the use of time stamps based on UTC, even when it is not required to do so, because this facilitates combining data from multiple sources or when international coordination is important.

Time signals from global navigation satellite systems (GNSS) are widely used as the reference time in many applications, and it is important to understand the requirements that ensure GNSS time stamps are traceable to UTC from both a technical and a regulatory perspective [5]. This article describes how UTC is defined and realized and how a prediction of UTC is included in GNSS data transmissions.

The Definition and Realization of UTC 

The UTC time scale is a paper time scale that has no physical realization. It is computed monthly by the International Bureau of Weights and Measures (BIPM) based on data from several hundred atomic clocks located at National Metrology Institutes (NMIs) and other time centers in various countries. Many laboratories operate local ensembles of atomic clocks and use the data from these ensembles to compute and disseminate a local UTC estimate. This local estimate is identified as UTC(k), where k is the acronym for the laboratory. The estimate of UTC computed by the U.S. Naval Observatory (USNO) is UTC(USNO) and the estimate computed by the National Institute of Standards and Technology (NIST) is UTC(NIST). 

The computation of UTC for any month is published in BIPM Circular T by the tenth day of the following month [6]. This circular tabulates UTC-UTC(k) every five days for every participating laboratory. A rapid version of UTC, called UTCr [7], is also published by the BIPM every Wednesday. It lists daily values of UTCr-UTC(lab) through the previous Sunday. These data are published on the BIPM website and are distributed by email (Figures 1 and 2). 

GNSS Time Signals

The system time of a GNSS constellation, GNSS_T, is generated by the ground segment from an ensemble of clocks located on the ground at the control center and tracking stations. It also can include the clocks in the satellites [8-11]. Each satellite in a constellation transmits a prediction of the offset between the time of the clock on the satellite and the system time of the constellation, which is uploaded to the satellites periodically. GNSS constellations also broadcast bUTC_GNSS, a prediction of the difference between GNSS_T and UTC (including a 3-hour offset for the GLONASS system) that is derived from the UTC prediction of timing laboratories. This prediction is transmitted in two parameters: an integer giving number of whole seconds difference between UTC and the GNSS system time, and a fractional part, which specifies the difference modulo 1 s. The first parameter changes only when a leap second is inserted into UTC and not at other times. (The GLONASS constellation uses UTC as the system time so only the fraction is transmitted in the navigation message.)

For the GPS constellation, this prediction is derived from UTC(USNO) maintained at the U.S. Naval Observatory. The GLONASS constellation broadcasts a prediction based on UTC(SU), which is realized at the Russian Metrology Institute of Technical Physics and Radio Engineering (FSUE, VNIFTRI). The Galileo constellation uses a prediction derived from a collaboration of five European National Metrology Institutes. The BeiDou system uses UTC(NTSC) realized at the National Time Service center of China and UTC(NIM) realized at the China National Institute of Metrology. Regional systems also broadcast similar messages. The formats of the respective messages are GNSS-specific and are documented in the respective Interface Control Documents.

The Role of the BIPM

In addition to computing UTC and publishing the differences of UTC-UTC(k), the BIPM evaluates the difference between UTC and the predictions of UTC broadcast by the various GNSS constellations, bUTC_GNSS. These differences are published in Section 4 of BIPM circular T [6]. This section lists the difference in ns between UTC computed by the BIPM and the prediction of UTC transmitted by the GPS, GLONASS, Galileo and BeiDou satellites for every day in the monthly reporting period for that issue of Circular T. Table 1 shows the values from the August 2025 editor of Circular T interpolated from the five-day reporting interval in Circular T to a daily value at 0 UTC [12]. 

Linking User Equipment to UTC

There are two common configurations that support a link between the user’s time reference and UTC(k) or UTC. In the first configuration, the user has a clock (or an ensemble of clocks) that provides the reference signal for a GNSS timing receiver. The receiver does not discipline the free-running local clock (or ensemble) in the short term, but measures its time with respect to the signal broadcast by the satellites of some constellation. These data are combined with the data in the navigation message to (1) correct for the transit time between the satellite and the receiver, (2) include the offset between the satellite clock and the GNSS system time, and (3) add the prediction of the offset between the system time and UTC. 

Most receivers can be configured to implement these calculations in firmware, and the output data gives the difference between the local reference and the broadcast prediction of UTC. The signal from this clock (or clock ensemble) can be used in the user’s application or the application’s clock can be compared to it. The system connected to the GNSS receiver may be completely free-running and not disciplined by the GNSS data; its offset is recorded and used to adjust the downstream data. In some configurations, the time or frequency of the local reference clock is adjusted from time to time so the measured time difference is kept within some administratively defined tolerance. The interval between adjustments depends on this tolerance and on the frequency stability of the local reference, and it can range from minutes for a rubidium-based reference to hours or days for a cesium-based device. 

The second configuration, which is much more common, combines a GNSS receiver and an oscillator in a single device. There are many commercial systems that realize this configuration and often provide several outputs (5 MHz, 10 MHz and 1 pps) that are disciplined by the data received from the GNSS constellation. The simpler systems use the code data transmitted on the L1 frequency, but dual-frequency receivers and more sophisticated carrier-phase analyses are possible. The first GNSS disciplined oscillators usually used signals from the GPS constellation, but newer systems can track satellites from more than one constellation simultaneously. The output signal might be based on only the satellites from one constellation at any time or on a combination of the data received from multiple constellations. Either solution can produce significant steps in the output signals, especially in the PPS data, when the reference constellation changes. The details of the disciplining algorithm are often proprietary; the output could be disciplined to GNSS system time or to the prediction of UTC, and traceability to UTC would require the additional adjustment that incorporated the data published in BIPM Circular T. This additional adjustment, based on data from Circular T, may be small enough to ignore in some applications. 

The first configuration is more flexible; the measurement process can accept data from multiple sources, including common-view data, and implement more sophisticated post-processing methods. The adjustment process for the local reference clock can be adjusted to meet the requirements of the user’s application. The second configuration, on the other hand, may provide adequate performance in many applications. It is much simpler to operate, and this simplicity may be the deciding factor for many users.

Combining Data from Multiple Constellations

Combining GNSS signals from multiple constellations can significantly improve the timing performance of a user’s receiver, especially in locations with limited visibility of the sky. This approach requires a knowledge of the offsets between different GNSS time scales, which are at the level of a few ns and vary in time. It is possible for a user to solve for the inter-system bias between constellations [13] if enough satellites from both constellations are visible at the same time, but this is not always the case, and the broadcast values must be used [14]. The broadcast of the predicted time difference between each GNSS system time and UTC greatly simplifies the job of combining signals from multiple constellations when only broadcast data are available. The use of UTC as the common reference time scale eliminates the need for maintaining multiple inter-system bias values.

Metrological Traceability

The International Vocabulary of Metrology (VIM) defines traceability as the “property of a measurement result whereby the result can be related to a reference through a documented unbroken chain of calibrations, each contributing to the measurement uncertainty” [15]. The International Telecommunications Union (ITU) [16] and the International Laboratory Accreditation Conference adopted the same definition and refer to the International Organization for Standardization (ISO/IEC) standard 17025 [17].

The signals transmitted by the GNSS constellations can be traceable to UTC. The broadcast signals are linked to UTC through the UTC(k) data of a timing laboratory, and the transmissions are monitored by the BIPM with results published in Circular T. A user can also establish a common-view relationship with a timing laboratory, which can provide a near-real-time estimate of the offset of the user’s timing system with respect to the UTC(k) of that laboratory. In either case, these data are processed by the receiving system at the user’s site, and the calibration and statistical characteristics of this system directly affect the accuracy and stability of the timing data that control the user’s application. 

Timing Receiver Calibration

The calibration of the user’s equipment that is required to complete the demonstration of traceability should be performed by a method validated by a National Metrology Institute or a Designated Institute that participates in the Mutual Recognition Agreements (MRA) and have their Calibration and Measurement Capabilities (CMC) published in the Key Comparison Database maintained by the BIPM [18]. The Key Comparison Database maintains the equivalency between different organizations and guarantees the international acceptance of calibrations performed by different agencies that participate in the MRA.

The manufacturer’s published specifications can be the basis for specifying the performance of a stand-alone GNSS receiver or a GNSS receiver and disciplined oscillator combination. These specifications should be based on a calibration of one example of a particular model with some allowance for the variation among devices of the same type. For applications that require only modest accuracy (not greater than about 1 µs) a statement by the manufacturer that the device has been type-approved to that level is sufficient. The transmission delay even through a very long antenna cable is unlikely to invalidate this assumption.

The use of “type approval” may not be adequate for applications that require sub-microsecond accuracy. One method of calibrating a receiving system is to compare the output of the system to a source of UTC(k) by using a time-interval counter to monitor the difference. This method depends on an independent source of UTC(k), which might be provided by a traveling calibrated receiver, by transporting a running clock from the UTC(k) source to the location of the receiver, or by operating the device to be calibrated at a laboratory where a source of UTC(k) is available. 

Using a traveling receiver is the best choice because it tests the receiving hardware with the antenna and cables in the environment where it will be used. The BIPM uses this option to calibrate the time-transfer equipment at timing laboratories. Although the traveling receiver is calibrated, it is operated at a location where its position may not be known accurately, and where it may be influenced by multipath effects that are not the same as the effects on the device under test. These considerations are usually not important unless the required accuracy must be better than about 50 ns.

A calibration based on carrying a running clock from the source of UTC(k) to the location of the user’s equipment is feasible if the distance is not too great and the required calibration accuracy is not too high. For example, the GPS receivers at the NIST radio station in Fort Collins, Colorado, are calibrated by carrying a rubidium oscillator from the source of UTC(NIST) in Boulder to Fort Collins, a distance of about 100 km by road. The calibration is repeated by carrying a calibrated GPS receiver between the two locations. The accuracy of either method is estimated to be about 15 ns, and the two methods agree within this uncertainty.

Transporting the device under test to a location where an independent source of UTC(k) is available is usually the most difficult solution. It may be impractical to disconnect the antenna cable at the site, so a different cable must be used for the calibration. The delay through the actual cable can be estimated with a time domain reflectometer, but this method tests the cable with signals that are not the same as signals from real satellites. The impedances at the end-points are also different. 

If the system to be calibrated provides the contribution of each satellite in view to the composite output, then the common-view method can be used to calibrate the receiver. (Unfortunately, many disciplined oscillators do not provide these data.) The system to be calibrated measures the difference between the local clock (or clock ensemble) and the system time of the constellation by using the data from each satellite in view. These data are compared, satellite by satellite, with the same measurements made at a location where UTC(k) is available. The common-view difference cancels or attenuates the contributions of the satellite clock and the orbital parameters, which are common to both data sets and cancel in the differences in first order. If the distance between the locations of the user and the UTC(k) laboratory is not too great, the contribution of the ionosphere may also be common to both measurements and cancel in the difference. A multiple-frequency measurement, which can correct for the contribution of the ionosphere, may not offer a significant improvement over a simple L1 comparison in this configuration, because the contribution of the ionosphere will be cancelled or attenuated in the common-view subtraction. The common-view method can operate continuously, and can also monitor the stability of the remote system.

Frequency Calibration

The techniques described for timing calibration can also calibrate the output frequency of the user’s system. A frequency calibration can be easier to realize than a time calibration because the absolute values of the delays in the equipment are not important, only the stability of these delays is. The stability of the output frequency of a quartz oscillator may be degraded by fluctuations in the ambient temperature, and the frequency estimated with a reference based on a rubidium or cesium device may be degraded by changes in the multipath contribution.

Specific Recommendations

The documentation from the manufacturer is the best source of information about a particular device. The following specifications provide general guidance on the methods to establish traceability [19].

1. If the application can accept a fractional frequency uncertainty of 10^-8 or greater with an averaging time of one day, or a time uncertainty of 1 µs or greater, then a certificate by the manufacturer that at least one unit of the model satisfies the requirement is adequate to establish traceability at this level. (A receiver used only as the reference for a server that supports NTP, the Network Time Protocol, may not require calibration, because the accuracy and stability of the NTP service is usually limited to not better than about 1 ms by the characteristics of the network connection between the server and the client systems.) 

2. If the application requires a fractional frequency uncertainty between 10^-8 and 10^-10 with an averaging time of one day or a time uncertainty between 100 ns and 1 µs, then the manufacturer should provide a certificate with every unit that satisfies the requirement. The manufacturer could validate the performance of each unit by comparing its output with a calibrated reference unit maintained at the manufacturer’s facility. 

3. If the application requires a fractional frequency uncertain of less than 10^-10 with an averaging time of one day or a time uncertainty of less than 100 ns, then the calibration can be challenging and should be performed at the user’s facility, if possible. 

4. If the application requires a fractional frequency stability of less than 10^-12 or a time uncertainty of less than 50 ns, then the calibration should be repeated periodically or the performance of the system should be monitored by common-view or an equivalent technique, which will require a dedicated GNSS timing receiver at the user’s site. The contributions of multipath reflections and the sensitivity of the equipment to fluctuations in the ambient temperature may be important. The impact of multipath reflections can be minimized by locating the antenna so it has an unobstructed view of the sky, and by using a directional “choke ring” antenna, which attenuates signals coming from low elevations. The sensitivity to fluctuations in the ambient temperature may be a problem if the local reference device is a simple quartz oscillator or if a long antenna cable is exposed to direct sunlight. 

It is important to maintain documentation that validates the traceability of any system. Configurations that support this capability are particularly useful.

Summary and Conclusion

Applications that use the timing data from GNSS systems often require legal and technical traceability to UTC. Even when traceability is not legally required, maintaining traceability to UTC simplifies combining the data from multiple constellations. The signals transmitted by GNSS systems are monitored by the BIPM and can be made traceable to UTC by the methods discussed. Ensuring the traceability of the timing data in a user application also depends on a calibration of the receiving equipment. The methods for realizing this calibration were presented and specific recommendations provided. Maintaining adequate documentation is important, and configurations that support real-time monitoring and log files are particularly useful. 

References 

(1) Conference generale des poids et mesures (CGPM) 2018 Resolution 2 of the 26th CGPM (2018), on the definition of time scales (https://bipm.org/en/committees/cg/cgpm/26-2018)

(2) MiFiR RTS 25: https://ec.europa.eu/finance/securities/docs/isd/mifid/rts/160607-rts-25_en.pdf

(3) Finra Rule 6820: https://www.finra.org/rules-guidance/rulebooks/finra-rules/6820

(4) IEEE Standard for Synchrophasor Measurement for Power Systems, IEEE C37.118.1-2011. https://standards.ieee.org/ieee/C37.118.1/4902.

(5) Dimetrios Matsakis, Judah Levine, and Michael Lombardi, Metrological and Legal Traceability of Time Signals, Inside GNSS, March/April 2019, pp. 48-58.

(6) https://www.bipm.org/en/time-ftp/circular-t

(7) https://www.bipm.org/en/time-ftp/utcr

(8) GPS system time: https://www.gps.gov/applications/timing

(9) Galileo system time: https://www.gsc-europa.eu/GST

(10) GLONASS system time: https://www.unoosa.org/documents/pdf/icg/2020/GLONASS_Time_2017_E.pdf

(11) BeiDou system time: http://en.beidou.gov.cn/SYSTEMS/Officialdocument/202001/P020231201549662978039.pdf

(12) https://webtai.bipm.org/ftp/pub/tai/other-products/notes/explanatory_supplement_v0.8.pdf

(13) G. Huang, Q. Zhang, W. Fu and G. Guo, GPS/GLONASS time offset monitoring based on combined precise point positioning approach, Advances in Space Research, Vol. 55, number 12, 15 June 2015, pp. 2950-2960. DOI: https://doi.org/10.1016/j.asr.2015.03.003. See also references in that text.

(14) GPS-Galileo Time Offset (GGTO): https://www.unoosa.org/documents/pdf/icg/2017/wgd/wgd4-2-2.pdf

(15) https://www.bipm.org/documents/20126/54295284/VIM4_CD_210111c.pdf

(16) ITU-R, TF-686-3, Glossary and Definitions of Time and Frequency Terms p 16. https://www.itu.int/dms_pubrec/itu-r/rec/tf/r-rec-tf.686-3-201312-i!!pdf-e.pdf

(17) SO 17025:2017, General requirements for the competence of testing and calibration laboratories, https://www.iso.org/ISO-IEC-17025-testing-and-calibration-laboratories.html

(18) https://www.bipm.org/en/cipm-mra

(19) P. Defraigne, J. Achkar, M. J. Coleman, M. Gertsvolv, R. Ichikawa, J. Levine, P. Uhrich, P. Whibberley, M. Wouters and A. Bauch, Achieving traceability to UTC through GNSS measurements, Metrologia, vol. 59, Number 6, October 2022. Metrologia, 59, 064001. DOI: 10.1088/1681-7575/ac98cb.

Authors

Judah Levine is on the faculty of the Department of Physics at the University of Colorado at Boulder. He recently retired from the Time and Frequency Division of NIST, where he worked on time scales and methods of distributing time and frequency information. He is continuing those projects at the University and is also a member of committees of the International Bureau 
of Weights studying the future of Coordinated Universal Time and possible time scales for the Moon.

Pascale Defraigne obtained her Ph.D. in Geophysics in 1995 at the Université Catholique de Louvain. Since 1997, she has managed the time and frequency activities at the Royal Observatory of Belgium, where the Belgian reference UTC (ORB) is maintained. Her research activities mainly concern the use of satellite navigation systems for time and frequency transfer. Pascale presently chairs the CCTF working group on GNSS time transfer, and contributes to the validation of Galileo timing signals.

Ilaria Sesia is a Senior Researcher and Head of the Time and Frequency Department at INRiM, where she works on time transfer, atomic clocks and time scales for satellite applications. Since 2004, she has been deeply involved in the design and development of the timing aspects of the Galileo System.

Giulio Tagliaferro received his Ph.D. in 2021 from Politecnico di Milano on precise GNSS measurement adjustment. He is currently a physicist at BIPM, where he works on GNSS time-transfer activities and receiver calibration supporting the realization of UTC.

Michael Wouters leads the time and frequency group at the National Measurement Institute in Sydney, Australia. His research focuses on using low-cost GNSS receivers for time-transfer. He chairs the Consultative Committee on Time and Frequency’s task group working on the traceability of GNSS timing signals to UTC.

The post Linking GNSS Data to UTC appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Agriculture has entered the era of continuous PNT.

Precision agriculture is moving toward full automation. Guidance systems once treated GNSS as the entire solution; today, the industry recognizes that satellite signals are necessary but insufficient. Farms have become complex RF environments. Tree canopy, terrain, outbuildings, seasonal geometry shifts, multipath near grain elevators, interference from adjacent equipment, and the simple reality that tractors roam in and out of open-sky visibility all challenge the idea that GNSS alone can sustain continuity.

OEMs are building guidance systems that must keep machines on path even when GNSS falters. Autonomy depends on uninterrupted perception of position, velocity and attitude. That means pairing GNSS with inertial systems engineered for agricultural machines, not adapted from other domains.

In a recent conversation with Inside GNSS, Tzeno Galchev, Director, Product Marketing and Applications Engineering for Analog Devices, Inc. (ADI), described how their inertial measurement units (IMUs) are being integrated into next-generation tractors, implements, drones and robotics platforms. ADI’s engineers are focused on what really matters in the field: disciplined inertial performance, controlled lifetime drift, rugged packaging and reliable sensor fusion with GNSS. The message was unambiguous: Autonomy in agriculture can scale rapidly when inertial becomes a baseline requirement. 

The Market Reality: Why Inertial Matters Now 

Precision agriculture has matured beyond the first decade of “straight-line” GNSS guidance. Machines now operate in a wider set of field geometries, crop types and environmental constraints. Several forces are converging:

Tractors are evolving from operator-assisted systems to autonomy-ready platforms. Implements are following, including precision planters, high-clearance sprayers, and robotic harvesters. Each requires continuous PNT. A single GNSS dropout during an autonomous end-of-row turn can result in overlap, missed coverage or unsafe behavior.

Agriculture spans open sky areas and GNSS-hostile corridors. Machines pass under tree rows, within orchard canopies, beside barns or silos, or along field edges lined with windbreaks. Modern high-value crops, such as vineyards, orchards and berries, introduce dense canopy that disrupts L-band signals. Even row crops can create directional multi-path in late summer.

OEM Pressure to Deliver “Always-on” Paths

Agricultural OEMs face customer expectations shaped by the automotive sector. The question is no longer whether GNSS can deliver accuracy; it is whether the total system delivers continuity. That continuity is now a competitive differentiator. Dead-reckoning performance, not positional Root Mean Square (RMS) in open sky, shapes the user experience.

Cost Realism and the Mid-Market Explosion

Farm sizes vary globally. Not every user can justify aerospace-tier inertial systems. ADI’s view is that precision agriculture needs inertial performance that respects cost boundaries while still meeting the dynamics of field machinery: vibration, temperature cycling and shock.

“The demand is there because there’s a shortage of workforce, especially in the developed countries, and these machines make a considerable difference in the cost and efficiency of farming operations,” Galchev said. “They are replacing and reducing the number of workers needed as well as putting workers out of harm’s way.” 

The Shift to Autonomy-Grade Attitude Estimation

GNSS provides position and velocity; but many operations require continuous knowledge of roll, pitch and yaw. Sprayers use boom leveling. Planters need implement attitude to maintain depth accuracy. Drones require stable orientation in low-signal environments. INS establishes those states even when GNSS is degraded.

THE RESULT: GNSS remains the reference, but inertial is now the mechanism that closes the reliability gap.

Inertial Basics for Agricultural Platforms 

Agricultural operators rarely see inertial systems directly. They see better lines, fewer skips, improved boom stability, and smoother turns. Under the hood:

• IMUs measure angular rate and acceleration along orthogonal axes.

• Sensor fusion in an inertial navigation system (INS) uses those measurements to propagate position, velocity and attitude during GNSS gaps.

• Drift is inherent, but it can be minimized, modeled and constrained with well-tuned sensor fusion.

• GNSS resets the INS, bounding cumulative error.

• Agricultural use-cases emphasize short-to-medium duration bridging, not long-haul independent navigation.

Modern MEMS technology has reduced noise, bias instability, and temperature sensitivity to levels appropriate for automotive-grade and robotic applications. ADI’s work has focused on improving consistency across production units, strengthening environmental robustness, and integrating compensation routines at the firmware level.

Agricultural machinery introduces several complicating factors that inertial systems must handle cleanly:

• High vibration environments from diesel engines, tillage tools, and PTO-driven implements.

• Complex motion during headland turns, uneven terrain and differential traction events.

• Thermal swings, from dawn cold starts to midday heat.

• Mechanical shock, especially on implements.

• Long duty cycles, including 14 to 18 hour days in planting or harvest season.

This environment is less deterministic than automotive and more dynamic than many robotics platforms. The IMU/INS must treat vibration as a feature of the mission, not a source of error.

ADI’s Technical Approach

ADI designs inertial solutions with a focus on predictable error behavior, rugged packaging and stable sensor fusion. The company emphasizes several technical principles:

VIBRATION TOLERANCE. Farm machinery produces persistent broadband vibration. ADI considers how vibration intrinsically disturbs the sensors and ADI engineers design mechanical structures that better suppress, cancel and otherwise reduce the effect of vibration directly into the MEMS structures themselves because once vibration is allowed to pollute the sensor signal, it is too late for the INS system to do anything about it. This ensures the INS maintains the correct angular-rate and acceleration signatures even when implements shake violently.

BIAS REPEATABILITY. This is the lifetime bias drift expectation that intends to capture all unmodeled error sources and is not commonly specified in MEMS IMU datasheets. It provides a single error window that will determine the convergence times for critical estimation/filter loops. For systems that need to turn and deploy quickly, failure to anticipate and quantify these errors can limit deployment time and degrade initial heading accuracy. In their latest products, ADI has expanded their Bias Repeatability definition to include turn-on drift/settling, drift from package stress relief, electronic drift and thermal hysteresis. In parallel with expanding the coverage of this specification, ADI has reduced this metric by an order of magnitude in recently-released devices, such as the ADIS16545 and ADIS16576. 

AXIS-TO-AXIS ALIGNMENT. With tight axis-to-axis alignment out of the box and calibrated through an extensive inertial routine over multiple temperature set-points, tight alignment can be achieved only using mechanical alignment features. For tighter alignment than 0.25° one could leverage the tight axis-to-axis alignment (along with excellent bias repeatability in the accelerometer) to greatly simplify the frame alignment process. 

LINEAR, TEMPERATURE-CONTROLLED BEHAVIOR. Temperature gradients on tractors and implements are large. ADI incorporates temperature compensation models enforced at both the sensor and system level. The goal is not perfect thermal invariance, which is unrealistic in cost-sensitive segments, but predictable behavior that fusion algorithms can model accurately.

FUSION-FIRST PHILOSOPHY. ADI treats the IMU as one component of a larger PNT solution. Their systems are designed for tight integration with GNSS receivers, wheel speed sensors, magnetometers, and vehicle CAN data. Robust synchronization and time-based alignment of the inertial output simplifies system coupling. This architecture enables robust attitude estimation and velocity smoothing, especially during headlands or canopy exposure.

PREDICTABLE LIFECYCLE PERFORMANCE. Agricultural platforms must last. ADI designs for multi-season reliability and bounded long-term drift. The objective is to ensure a machine equipped with an ADI IMU behaves the same in year four as it did in year one.

“You can’t calibrate a sensor’s inherent noise performance, its stability, or its response to vibration,” Galchev said. “These unmodeled error sources directly produce error at the output, and that’s where ADI focuses on innovating at the chip level.”

This technical discipline supports the system-level view: Inertial is not a premium feature; it is a foundation for reliable GNSS-enabled autonomy.

Integration in the Field: What Engineers Face

Engineers integrating inertial systems into agricultural machines confront real-world constraints that differ from lab conditions. ADI’s field experience highlights specific patterns.

Booms flex. Toolbars vibrate. Tractor frames twist. Sensor placement often becomes a compromise. An INS may be exposed to off-axis motion uncorrelated with actual vehicle trajectory. ADI mitigates this through calibration routines, filtering strategies, and noise modeling that treat flex and vibration as signal partitions.

Implements as Independent Dynamic Systems

The implement behind a tractor behaves differently from the tractor itself. For operations like variable-rate spraying or multi-row harvesting, implement attitude, even when decoupled from tractor motion, must be sensed accurately. IMUs can be mounted on booms or frames to track these dynamics.

Agricultural systems rely on multiple data streams: GNSS, wheel speed, steering angle, hydraulic cylinder positions, and sometimes LiDAR or camera inputs. INS integration requires precise timing alignment. ADI designs its systems for deterministic latency and reliable time stamping, which improves fusion accuracy.

The transition from row guidance to headland turns stresses both GNSS and INS. Machines accelerate, decelerate, rotate sharply, and pass through GNSS-obstructed corners. ADI’s inertial fusion helps maintain attitude and velocity states during these high-dynamic transitions.

Agricultural drones operate close to trees and terrain. Ground robots operate beneath canopy. INS solutions provide roll/pitch stability, altitude smoothing, and fallback motion propagation when GNSS is degraded.

Economics: Performance Within Reach

Precision agriculture is expanding beyond large, capital-intensive farms. The next wave of adoption will come from mid-market operations and mixed-crop geographies.

• Cost matters. Expensive IMUs are non-starters. ADI designs MEMS-based solutions that offer robust performance within an accessible cost envelope.

• Scalability drives OEM decisions. Manufacturers want sensors available in volume, with predictable lead times and long lifecycle commitments.

• Global adoption requires price/performance balancing. Emerging markets need PNT reliability but cannot bear aerospace-grade costs. Scalable, rugged MEMS solutions fill this gap.

• Autonomy ROI depends on continuity. If a machine can maintain guidance through GNSS disruptions, it can operate longer hours and at higher speeds, improving economics for both OEMs and end-users.

“Just because you go from a big tractor to a smaller tractor, the conditions don’t change that much,” Galchev said. “If you want to achieve the same mission profile, you still need the same performance level.”

As ADI brings cost-efficient inertial capability into mainstream ag equipment, the performance gap between high-end and mid-tier platforms narrows.

The Road Ahead: Multi-Sensor Fusion and Autonomy

Agriculture is evolving toward heterogeneous fleets: autonomous tractors, robotic harvesters, terrain-following sprayers, orchard drones, and edge-connected implements. All require resilient PNT.

End-of-row autonomy

Low-speed, high-precision maneuvers demand stable attitude estimation. INS ensures smooth transitions even in partial GNSS shadows.

Terrain-following and boom dynamics

Sprayers rely on roll/pitch estimates for boom control. IMU data supports rapid damping of boom oscillation, improving chemical placement, reducing drift, and lowering input costs.

Cooperative ground-air systems

Drones performing scouting missions must integrate with guidance systems on the ground. Consistent inertial performance across platforms enables better data fusion and farm-level coordination.

Resilience as a design requirement

Interference, accidental or intentional, is increasingly common. INS helps maintain continuity of operation when GNSS performance degrades. It stabilizes machine behavior during uncertainty and helps diagnostic systems detect anomalies.

Regulatory evolution

As autonomy expands, functional-safety requirements will increase. INS adds a measurable layer of redundancy and validation, supporting safety cases for next-generation machines.

“We have sensors that we released more than 20 years ago still being produced,” Galchev said, “because our customers’ systems have long lifespans and once something works, it can be very difficult and expensive to re-qualify and swap it out.”

As autonomy accelerates, the next decade of agriculture will be shaped by platforms that assume GNSS variability and engineer around it from day one. That shift elevates inertial from an add-on to a core requirement. ADI, with its long record of sensor innovation and system-level discipline, is positioned to anchor that transition. Their approach: predictable drift behavior, calibration at the silicon level, ruggedized packaging, and tight GNSS-INS fusion, gives OEMs a stable foundation to build autonomy across tractors, implements, drones, and emerging agricultural robots. The path forward is clear: Resilient PNT will define productivity, and ADI’s inertial technology will increasingly sit at the center of the autonomy stack, enabling machines that navigate, adapt and operate with confidence in the real conditions of the farm.

The post Precision Ag: From Field to Furrow appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.