An unusual thing is happening in the navigation community. Almost everyone now believes in low Earth orbit positioning, navigation and timing (LEO PNT). Governments are studying it. Startups are building it. Researchers are publishing it. Investors are funding it. Satellite operators are discussing it (Figure 1). Even the GNSS community, historically cautious about claims of disruption, increasingly accepts that LEO will play some role in the future of PNT.

For years, the central challenge surrounding LEO PNT was whether it could work. Today, that challenge is increasingly getting addressed. Dedicated LEO constellations have transmitted navigation signals from orbit. Opportunistic approaches have demonstrated PNT with signals never intended for navigation. Governments have initiated national LEO PNT programs, while commercial companies are investing billions of dollars in satellite infrastructure that may ultimately support PNT.

LEO PNT is entering an uncomfortable phase of maturity. The debates are shifting from technical to operational. Can LEO PNT be trusted? Can it scale? Can it integrate? Can it survive commercially? Can it become infrastructure? What role will it play? Who will pay for it? And perhaps most importantly, what problem is it actually solving?

The questions are shifting from “Can LEO PNT work?” to “Can LEO PNT become trusted infrastructure?” The answers depend, in part, on which vision of LEO PNT one adopts.

As discussed in last issue’s column, LEO PNT: Why Now?, four schools of thought have emerged: dedicated, dual-purposed, augmented and opportunistic LEO PNT. Each starts from a different premise about what problem LEO should solve and how it should fit into the broader PNT ecosystem.

Dedicated providers such as Xona, TrustPoint, Centispace and others are building navigation-first systems. Dual-purposed systems such as Iridium combine communications and PNT. Augmented architectures, exemplified by ESA’s Celeste vision, view LEO as an additional layer that complements GNSS. Opportunistic approaches exploit them all. Anything that can be tracked is fair game—it becomes a potential navigation source.

Although these four approaches differ substantially in architecture, economics and operational assumptions, they ultimately encounter the same three questions.

QUESTION 1: How Close are We to Operational LEO PNT?

This may be the most misunderstood question in the field. The answer depends on which school of thought you examine.

A dedicated constellation, a dual-purposed communications system, an augmented GNSS architecture, and an opportunistic navigation system do not become operational in the same way. Each follows a different path from demonstration to utility, and each encounters different technical, economic and operational challenges along the way.

This distinction is important because discussions of LEO PNT often treat the field as if it was a single technology moving toward a common destination. In reality, the various LEO PNT approaches may be solving different problems, serving different users, and operating under different definitions of success.

Dedicated systems are transitioning from demonstration to infrastructure. They arguably face the most difficult transition because they must simultaneously build a constellation, a timing architecture, a monitoring network, a receiver ecosystem, and a customer base. Launching satellites is difficult. Building infrastructure that users trust for decades may prove even harder.

Some dual-purposed systems are already operational. Ironically, the school closest to operational maturity may not be the dedicated providers that receive the greatest attention. Iridium PNT already operates from an existing communications infrastructure and currently represents the most mature example of operational LEO PNT. The space segment exists. The ground segment exists. The satellites have demonstrated years of operation. The challenge is, therefore, less about deployment and more about expanding capability.

Augmented systems may face the lowest adoption barrier because they do not need to displace GNSS. Their value proposition is incremental rather than revolutionary. If a LEO layer improves availability, shortens precise point positioning (PPP) convergence, strengthens resilience, or improves urban performance, then it can justify deployment without ever becoming a standalone navigation system.

Opportunistic systems are another beast, presenting a different definition of operational. What does it mean for a navigation system to become operational when the underlying infrastructure belongs to someone else? In one sense, opportunistic systems are already operational because the satellites, signals and user communities already exist. In another sense, they remain developmental because the navigation capability depends on extracting observables from infrastructures whose operators make no formal navigation commitments.

Despite their differences, all four schools eventually encounter the same challenge. Demonstrations answer whether navigation is possible. Operational services answer whether navigation can be trusted.

A single satellite can demonstrate ranging. A handful of satellites can demonstrate positioning. A constellation can demonstrate coverage. But infrastructure requires something more. We should stop asking whether satellites have launched. Instead, we should ask whether orbit determination is operational, whether time synchronization is operational, whether monitoring and integrity frameworks are operational, whether continuity targets are being met, and whether performance commitments are backed by demonstrated capability.

The greatest risk facing many LEO PNT initiatives may no longer be technical failure. It may be the assumption that technical success automatically leads to operational adoption. 

QUESTION 2: What Can One Satellite or a Small Constellation Contribute?

One of the most common misconceptions surrounding LEO PNT is that value emerges only after a constellation achieves continuous global coverage.

History suggests otherwise. Some in the navigation community often think in binary terms. A system is either operational or it is not. A constellation either provides continuous positioning or it does not. Yet, many of the most important capabilities emerge long before full operational capability is reached.

This is not unique to LEO PNT. GPS itself began creating value well before the constellation reached full operational capability. The same was true for communications constellations, Earth observation systems, and timing infrastructures. Early deployments rarely deliver the final service. Instead, they reveal which capabilities become useful first.

A single LEO satellite cannot provide continuous global positioning. That much is obvious. What is less obvious is how much useful information a single satellite can provide. At the most basic level, a single satellite can support timing-transfer experiments, receiver development, orbit and clock estimation validation, signal authentication concepts, and resilience demonstrations. More interestingly, the high dynamics of LEO satellites create large Doppler frequency that can become valuable navigation measurements. Long before a constellation can provide continuous and instantaneous positioning, it can contribute observability.

This observation is particularly important for opportunistic LEO PNT. The earliest post-Transit demonstrations with Orbcomm did not rely on dedicated navigation signals [1]. They relied on extracting useful navigation information from sparse, non-cooperative communications signals [2]. The positioning performance was limited, but the demonstrations established something far more important: navigation observables could exist even when navigation services did not (Figure 2).

That distinction continues to shape opportunistic LEO PNT today. A Starlink or OneWeb signal does not necessarily need to become a navigation service to create navigation value [3],[4]. If the signal provides useful Doppler, timing, carrier-phase, or ranging information, it can contribute to a navigation solution even when the constellation operator has made no formal commitment to navigation [5],[6]. In this sense, opportunistic systems may not be trying to become navigation infrastructure. They may instead become sources of observability that strengthen broader PNT architectures.

As additional satellites are added, the value increases considerably. Not necessarily because the system suddenly becomes a GPS replacement, but because it becomes a powerful augmenter. Several emerging architectures suggest that even modest LEO deployments can improve positioning performance when combined with GNSS. Benefits may include faster PPP convergence, improved velocity estimation, enhanced measurement diversity, increased resilience to GNSS disruptions, and improved performance in challenging urban environments where traditional satellite geometries are degraded.

This point is worth emphasizing. Many discussions implicitly assume LEO PNT must eventually replace GNSS to justify its existence. Yet, some of the strongest value propositions emerge when LEO and GNSS work together. The bar for becoming useful is much lower than the bar for becoming a global standalone navigation system.

In fact, timing users may become significant beneficiaries before positioning users. A positioning solution generally requires multiple observations. Timing applications often require less. For telecommunications networks, financial infrastructure, power grids, and data centers, the value proposition may not be a position solution at all. It may be access to an additional timing reference capable of constraining oscillator drift, improving holdover performance, or providing an independent source of synchronization. This possibility receives less attention than positioning, but it could prove commercially important. Some users may be willing to adopt LEO-derived timing services long before continuous global positioning services become available. 

The implications differ across the four schools of thought. For dedicated systems, early satellites provide opportunities to validate signals, timing architectures, user equipment, and operational concepts. For dual-purposed systems, they demonstrate how navigation can leverage existing communications infrastructure. For augmented architectures, even limited deployments may improve GNSS performance and resilience. For opportunistic systems, the first satellites are often enough to demonstrate the central premise that useful navigation information can be extracted from signals that were never designed for navigation in the first place.

The broader lesson is that constellations should not be judged exclusively on their ability to provide continuous positioning. They should also be judged on the value they create before continuous positioning becomes possible. A navigation service may require hundreds of satellites. A useful capability often requires far fewer.

QUESTION 3: What Must Happen Before Users Trust LEO PNT?

This is arguably the most difficult question facing the LEO PNT industry.

The navigation community often speaks about accuracy. Many users, especially in safety-critical systems, care just as much about trust.

A navigation solution can be extraordinarily accurate and still be unsuitable for operational use if users do not understand when it is wrong. In fact, one of the defining characteristics of navigation infrastructure is not that it always performs well. It is that users understand how well it is performing, when it is degraded, and when it should not be trusted.

Trust begins with signals. But it does not end there. Much of the public discussion surrounding LEO PNT focuses on waveforms, frequencies, signal power, and receiver sensitivity. These are important topics. Yet, navigation systems are not built on signals alone. Every satellite navigation solution depends fundamentally on three things: signal, satellite orbit and satellite clock.

Signals create measurements. Orbit and clock knowledge create meaning. A receiver must know where the satellite was when a signal was transmitted. A receiver must know what time the satellite thought it was. Without both, ranging becomes geometry without a reference.

This reality is particularly important in LEO. Unlike GNSS satellites residing in medium Earth orbit (MEO), LEO satellites experience significant atmospheric drag, more dynamic orbital environments, and rapidly evolving states. Orbital maneuvers will get more frequent and severe as LEO becomes more congested. Orbit determination is, therefore, not merely a technical detail. It is a foundational requirement for navigation performance.

The same is true for timing. Traditional GNSS achieves remarkable timing performance through sophisticated atomic clocks supported by extensive control infrastructures developed over decades. Most emerging LEO providers are pursuing different approaches. Some rely heavily on GNSS-derived synchronization. Others emphasize ground synchronization networks, optical inter-satellite links, distributed timing architectures, miniaturized atomic clocks, or combinations thereof. Each approach represents a different answer to a fundamental question: How does a LEO constellation know what time it is? That question may ultimately prove as important as signal design itself. 

Yet, even orbit and clock knowledge are only part of the trust equation. Evolving a demonstration to a service hinges on monitoring. A demonstration shows that a navigation solution can be produced. A service continuously evaluates whether that solution should be trusted. This distinction is often overlooked. Users frequently focus on positioning performance while paying less attention to monitoring infrastructure, anomaly detection, fault isolation, and quality assurance. Operational systems cannot afford such a luxury. The question is not whether a system works on a good day. The question is whether the system knows when it is having a bad day.

This is where integrity enters the discussion. Integrity is one of the most frequently used but least appreciated concepts in navigation. At its core, integrity addresses a simple question: Can the system detect and communicate when it should not be trusted?

For many applications, this question matters more than another meter of positioning accuracy. A highly accurate solution whose failures are invisible may be less valuable than a less accurate solution whose limitations are clearly understood. Integrity becomes particularly important as LEO PNT moves beyond demonstrations and into operational applications. Autonomous systems, critical infrastructure operators, timing users, aviation stakeholders, and defense users all require more than position estimates. They require confidence estimates. They need to know not only where they are, but how much they should trust where they are.

Closely related is continuity. Continuity turns a technical capability into infrastructure. A navigation demonstration may succeed one day, one week, or one month at a time. Infrastructure must succeed continuously. Satellites must be monitored. Clocks must remain synchronized. Orbit products must remain accurate. Service disruptions must be detected and managed.

This is one reason the path from demonstration to utility is often much longer than the path from concept to demonstration. The transition is not simply about launching more satellites. It is about institutionalizing trust (Figure 3).

When evaluating emerging LEO PNT systems, we should ask questions that receive far less attention than launch announcements:

• How are satellite orbits determined?

• How are clocks synchronized?

• How is integrity quantified?

• How are anomalies detected?

• How quickly are users alerted?

• What continuity targets are being met?

• What performance commitments are being made?

These questions may seem mundane compared with new signals, new satellite, and new constellation announcements. In reality, they are far more important. History suggests that navigation systems succeed not because they occasionally perform well, but because users know when they can trust them. Or, perhaps more importantly, when they cannot.

From Possibility to Infrastructure

The first era of LEO PNT asked whether navigation from LEO was possible. The second era asked whether useful observables could be extracted from dedicated and non-dedicated signals. The third era, the one we’re entering now, is asking something much harder: Can LEO PNT become trusted infrastructure?

That question extends far beyond satellites. It encompasses trust, integrity, timing, monitoring, economics, standards, governance, receiver ecosystems, and business continuity. Dedicated systems must prove they can scale. Dual-purpose systems must prove they can prioritize navigation when needed. Augmented systems must prove they add measurable value. Opportunistic systems must prove they can deliver robust performance despite relying on infrastructures they do not control.

The most interesting question in LEO PNT is therefore no longer: Can it work? The most interesting question is becoming: What must happen before users trust it?

The answer to that question will determine whether LEO PNT becomes a niche technology, a valuable augmentation layer, or one of the foundational pillars of the next generation PNT ecosystem. 

References

(1) J. Khalife and Z. Kassas, “Receiver design for Doppler positioning with LEO satellites,” IEEE International Conference on Acoustics, Speech, and Signal Processing, May 12-17, 2019, Brighton, UK, pp. 5506-5510.

(2) J. Khalife, M. Neinavaie, and Z. Kassas, “Navigation with differential carrier phase measurements from megaconstellation LEO satellites,” IEEE/ION Position, Location, and Navigation Symposium, Apr. 22-24, 2020, pp. 1393-1404

(3) Z. Kassas, M. Neinavaie, J. Khalife, N. Khairallah, S. Kozhaya, J. Haidar-Ahmad, and Z. Shadram, Enter LEO on the GNSS stage: navigation with Starlink satellites, Inside GNSS Magazine, Vol. 16, Issue 6, Dec. 2021, pp. 42-51.

(4) Z. Kassas, S. Kozhaya, J. Saroufim, H. Kanj, and S. Hayek, “A look at the stars: navigation with multi-constellation LEO satellite signals of opportunity,” Inside GNSS Magazine, Vol. 18, Issue 4, Aug. 2023, pp. 38-47.

(5) S. Kozhaya, J. Saroufim, and Z. Kassas, “Unveiling Starlink for PNT,” NAVIGATION, Journal of the Institute of Navigation, 2025, Vol. 72, no. 1, pp. 1-35.

(6) S. Kozhaya and Z. Kassas, “A first look at the OneWeb LEO constellation: beacons, beams, and positioning,” IEEE Transactions on Aerospace and Electronic Systems, 2024, Vol. 60, no. 5, pp. 7528-7534.

The post Beyond the Demonstration: The Hard Questions LEO PNT Must Answer appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

he Galileo satellite navigation program required far more than engineering ingenuity to reach operational status. Among the most consequential challenges facing the European Commission (EC) was securing internationally recognized radio frequency allocations—and, critically, the negotiation of compatibility and interoperability arrangements with the United States’ Global Positioning System (GPS). The main reason for that: The L-band was almost fully occupied.

This column chronicles the full arc of those consultations, from the early work of the EC Signal Task Force through four years of intensive EC-U.S. bilateral dialogue, culminating in two landmark agreements. 

Compatibility and Interoperability

These two terms stood at the center of every meeting, every technical analysis, and every diplomatic exchange throughout the GPS-Galileo process. Their precise meaning was not merely semantic: The definitions determined what obligations each party had accepted and what performance guarantees users could expect.

Compatibility: The ability of GPS and Galileo services to be used separately or together without one system causing unacceptable interference to the other system and without other satellite navigation systems causing unacceptable interference to GPS and Galileo.

In technical terms, compatibility analysis asks: When both constellations transmit simultaneously in overlapping frequency bands, does the aggregate interference power remain below a threshold that degrades each system’s effective carrier-to-noise density ratio (C/N₀) by more than an agreed maximum? At that time, the International Telecommunication Union (ITU) did not show a number for a Medium Earth Orbit (MEO) signal, only for Geostationary Earth Orbit, or GEO, (0,3 dB). The threshold negotiated between the European Commission and the United States for the shared E1/L1 band centered at 1,575.42 MHz was a C/N₀ degradation not exceeding 0.1 dB for the worst-case user scenario. 

Achieving compatibility required detailed modeling of the interference environment. Key parameters included the number of visible satellites from each constellation, the transmitted signal power levels, and the spectral separation coefficients between competing signals. The frequency spectrum revealed only very small unoccupied slots of 4 MHz in the L-band. Because the ranging performance of a signal is proportional to its bandwidth, Galileo never could have achieved an accuracy comparable to GPS. Although new research at the European Space Agency (ESA) demonstrated approximately 50% higher accuracy could be extracted from these small 4 MHz slots than the bandwidth-proportionality rule would predict, it still could not match the accuracy of GPS. This prompted intensive research into how to place new modulations onto existing and partly occupied L-band slots, thereby achieving compatibility. 

Interoperability: The ability of global and regional navigation satellite systems and augmentations to be used together to provide better capabilities at the user level than would be achieved by relying solely on one system or signal.

Where compatibility is essentially a constraint—a requirement not to cause harm— interoperability is an aspiration: the positive design goal of enabling combined GPS-Galileo receivers to outperform either system alone. The practical manifestation of interoperability in the E1/L1 band is signal design. If GPS and Galileo transmit signals with a common power spectral density (PSD) structure at the same center frequency of 1,575.42 MHz, a single receiver correlator can track both signals without requiring fundamentally different hardware for each. Interoperability thus drives down the cost of multi-constellation receivers, accelerates market adoption, and ultimately benefits users worldwide by providing more ranging observations, improved dilution of precision (DOP) geometry, and enhanced integrity monitoring. 

Studies conducted during the negotiation process estimated that dual-constellation receivers could achieve positioning accuracy improvements of 25% to 40% compared to single-constellation receivers in degraded signal environments such as urban settings. We found that an attractive feature for all users and looked to achieve interoperability with all satellite navigation systems providers. However, there is one drawback that may impact the signal acquisition of the receivers: The noise floor is increasing!

The EC Signal Task Force

As Galileo transitioned from political ambition to technical design in 2001 to 2002, the European Commission established the EC Signal Task Force (STF) to define the system’s signal architecture. The Task Force operated at the intersection of signal engineering and international telecommunications law, bringing together experts from the ESA, national agencies, universities and industry. Its mandate covered the selection of modulation schemes, center frequencies, bandwidth allocations, and power levels for all planned Galileo signals across the E5a (1,176.45 MHz), E5b (1,207.14 MHz), E6 (1,278.75 MHz), and E1 (1,575.42 MHz) frequency bands.

The Task Force’s primary regulatory obligation was to comply with ITU Radio Regulations, which require that newly deployed systems demonstrate non-interference with existing allocations and submit frequency coordination requests before commencing transmissions. For Galileo, the relevant ITU filings covered the frequency bands assigned to the Radio Navigation Satellite Service (RNSS). Within this framework, two immediate objectives dominated the Task Force’s early work: securing frequency rights through actual signal transmissions before the ITU “bring into use” deadline, and developing the analytical tools needed to assess compatibility with GPS.

The STF brought excellent experts from European nations together. From the human point-of-view, friendships developed through the many meetings complemented by corresponding national research and exchange between the research organizations. Nevertheless, occasionally harsh arguments were exchanged between the UK and the French representatives. I am grateful to the DLR for supporting that research at my university, the Institute of Geodesy and Navigation. 

GIOVE-A and GIOVE-B

Under ITU Radio Regulations Article 11, a frequency notification lapses if the notified system fails to bring the relevant frequencies into use within prescribed deadlines. At the time of Galileo’s filing, this period was seven years from the date of receipt of the coordination request. For Galileo’s most critical filings, the deadline fell in 2006. Failure would have stripped Europe of its priority rights in the E1, E5 and E6 bands, potentially forcing a fundamental redesign of the system’s signal plan. Galileo In-Orbit Validation Element A (GIOVE-A), built by Surrey Satellite Technology Ltd, was launched on December 28, 2005, from the Baikonur Cosmodrome. 

GIOVE-A was never intended as a navigation satellite in the operational sense. Its primary mission was regulatory: transmit Galileo signals in the E1, E5a, E5b and E6 frequency bands before the ITU deadline expired, thereby preserving Europe’s priority rights to those allocations. GIOVE-A began transmitting on January 12, 2006—just in time—and continued to operate until July 2012, accumulating a signals-in-space dataset of enormous value for signal design and interference analysis. 

GIOVE-B followed on April 27, 2008, launched by a Soyuz rocket from Baikonur. Built by a European industrial consortium, GIOVE-B carried a passive hydrogen maser clock achieving a frequency stability of approximately 1 × 10^-14 over 10,000 seconds—the most stable atomic clock flown in space up to that time. It also carried a radiation monitoring payload and transmitted an expanded range of signal types, including early implementations of the Binary Offset Carrier (BOC) modulations that would eventually be standardized for the operational system. 

Development of a New Compatibility and Interoperability Methodology 

No established international methodology existed for assessing compatibility between two GNSS constellations sharing overlapping frequency bands. The ITU coordination framework, designed for traditional radiofrequency services such as fixed-satellite and broadcasting-satellite services, was not suited to the statistical, spread-spectrum interference environment of GNSS. The EC Signal Task Force and its American counterparts were therefore required to build a new analytical framework from the ground up.

The core metric of the new methodology was the effective C/N₀ degradation, computed across a population of user scenarios and receiver configurations. For each scenario, the analysis required knowledge of: (a) the aggregate interference power spectral density produced by all in-view satellites of the competing constellation; (b) the spectral separation coefficient (SSC) between the desired and interfering signals, which quantifies how effectively the spreading codes and modulations separate the two signals in the correlation domain; and (c) the receiver’s pre-correlation bandwidth, which determines how much of the interference power spectrum falls within the signal processing chain.

These quantitative results—derived from thousands of simulation runs and validated against GIOVE measurement campaigns—provided the evidentiary basis for the key technical decisions of the negotiations. They demonstrated, for instance, that the BOC(6,1) component of MBOC did not worsen GPS C/A compatibility beyond the agreed 0.1 dB C/N₀ degradation threshold, a result that was essential to securing American acceptance of the final signal design.

Four Years of Negotiations with the United States

Formal bilateral negotiations between the European Commission and the United States government commenced in 2002 and continued until the conclusion of the first agreement in June 2004. The process was conducted through a series of bilateral working group meetings, supplemented by extensive written exchanges and informal technical workshops. 

The working group met approximately twice per year in formal session, with meetings alternating between Washington D.C. and European capitals. Each formal session was preceded and followed by extended technical exchanges in which both delegations submitted written analyses—often running to dozens of pages—addressing the outstanding issues identified at the previous meeting. The total volume of technical documentation exchanged over the course of the negotiations ran to several thousand pages. We often left the meetings very frustrated. 

The central technical dispute concerned the choice of modulation for the Galileo E1 Open Service signal, whose center frequency of 1,575.42 MHz coincided precisely with the GPS L1 frequency—the most congested and commercially critical frequency in the GNSS spectrum. The original Galileo signal plan (Official Journal of the European Communities, C 248, 15 October 2002) called for a PRS L1 signal using BOC(10,5) or BOC(14,2). BOC (10,5) modulation involves a full overlay with one of the two GPS code M signals which was not accepted. The United States objected that the BOC(14,2) component would cause unacceptable interference to military GPS receivers operating at the same frequency and produced detailed analyses showing C/N₀ degradations potentially exceeding 0.5 dB in worst-case scenarios.

We on the European side responded with a sequence of alternative proposals; some of them were very innovative, never used, each accompanied by new compatibility analyses, showing sometimes very small fractions < 0,1 dB (although receivers with a bad antenna would lose of the order of 10 dB). These included modified power levels for various components, alternative chip rates, and alternative modulation families. 

Each proposal was subjected to detailed scrutiny by American analysts, who raised concerns about phase errors, cross-correlation properties, and the adequacy of the analytical assumptions. The investigation of phase errors proved particularly contentious: The two delegations initially used different mathematical conventions for computing the complex cross-correlation between BOC signals, leading to discrepancies of up to 0.3 dB in their respective estimates of C/N₀ degradation—a gap that required resolution through a dedicated technical reconciliation process spanning multiple meeting cycles.

The First GPS-Galileo Agreement (2004)

The Agreement on the Promotion, Provision and Use of Galileo and GPS Satellite-Based Navigation Systems and their Applications was signed on June 26, 2004, at the EU-US Summit in Shannon, Ireland, by United States Secretary of State Colin Powell and EU External Relations Commissioner Chris Patten. It was the first formal international agreement between any two GNSS operators and established both the principles and the institutional machinery that would govern all subsequent cooperation.

The 2004 Agreement established the compatibility and interoperability definitions described as binding principles for both parties. It committed both the United States and the European Union to ensuring GPS and Galileo open service signals at the E1/L1 frequency of 1,575.42 MHz would share a common power spectral density, thereby enabling interoperable receiver designs. It also created a bilateral Working Group on GPS and Galileo Compatibility and Interoperability, mandated to meet regularly, resolve emerging technical issues, and oversee the implementation of agreed signal specifications. 

From a technical standpoint, the 2004 Agreement codified the key outcomes of the preceding two years of negotiation: the adoption of BOC(1,1) as the interim common signal baseline, and the establishment of the new compatibility methodology as the agreed analytical framework for assessing any future signal changes. The agreement also addressed Galileo’s Public Regulated Service (PRS) (on L1 the BOCcos(15,2.5)) and Safety-of-Life (SoL) signals, establishing principles for their coordination with corresponding GPS military and safety signals.

However, we, the European side, were not entirely satisfied with BOC(1,1) as the final outcome. The Agreement, therefore, explicitly opened the door to further refinement: the Parties shall work together without delay toward achieving optimization of that modulation for their respective systems. This clause reflected the European understanding that BOC(1,1), while sufficient to guarantee coexistence, did not yet exploit the full ranging and multipath performance that could be obtained from the available L1 spectrum. Extensive research started on the European side to find a superior modulation.

The Munich Meeting (2006) and the MBOC Agreement (2006) 

Let me explain how my team and I, together with CNES, arrived at the new optimized signal. We knew a combination of two BOC spectra would yield better accuracy than BOC(1,1) alone. We, therefore, wrote a complex program that combined two, three and four BOC spectra with varying parameters, taking into account the relevant quality criteria for the new signal—multipath performance, ranging accuracy, and so on—as well as the European security constraints. 

After running for more than a day, the computer produced a clear result: MBOC(6,1,1/11), a signal whose power spectral density (PSD) is a weighted mixture of the BOC(1,1) and BOC(6,1) spectra in a 10:1 power ratio, centered at 1,575.42 MHz within a transmission bandwidth of approximately 24.552 MHz (i.e. 24×1.023 MHz). 

The question then became: How could we convince the U.S. to adopt our new optimized signal? With the permission of the EC, I proposed to our American counterparts a “non-meeting” (without EC colleagues): a decisive informal technical exchange to be hosted at my Institute of Geodesy and Navigation at the Bundeswehr University, a natural venue for such a discussion. The gathering, held in March 2006, was deliberately structured as a workshop rather than a formal diplomatic session. No official minutes were kept, and the proceedings were not entered into the Working Group’s documentary record. This informality was intentional: It created an environment in which leading signal design experts from both sides—including members of the Signal Task Force and U.S. GPS program engineers—could engage in the kind of unconstrained technical dialogue that formal settings preclude. Although the meeting had been scheduled for a full week, we convinced our U.S. colleagues after the first day, and they agreed to adopt our new signal.

The final touch to the Galileo signal plan came in 2006, when the Working Group on GPS and Galileo Compatibility and Interoperability formally agreed upon the Multiplexed Binary Offset Carrier (MBOC) modulation as the common power spectral density for the E1/L1 Open Service signals of both systems.

The key insight that made this second agreement possible was the flexibility of allowing each party to implement the MBOC PSD through different time-domain waveforms—the decoupling of the spectral specification from its time-domain implementation. Both parties could thus claim their preferred implementation while committing to a common PSD that guaranteed interoperability.

The significance of the 2006 agreement can only be understood against the context of what MBOC replaced. BOC(1,1), the 2004 baseline, achieves a root-mean-square tracking error of approximately 0.1 m at C/N₀ = 45 dB-Hz with a 1 MHz discriminator early-minus-late spacing. MBOC(6,1,1/11) reduces this to about 0.06 m under the same conditions: a 40% improvement, while the multipath error envelope is reduced by 30% to 40% in the 0-300 ns reflector delay range most relevant to urban navigation. These performance gains, achieved at the cost of modest additional receiver complexity, justified the four years of analytical and diplomatic effort required to reach agreement.

Patent Filing and Controversy

The MBOC agreement was barely consolidated before it became the subject of a significant and contentious intellectual property dispute. Two British engineers who had participated in the GPS-Galileo Signal Task Force filed a series of patents covering the MBOC modulation concept. The assignee named in the patents was the UK Secretary of State for Defence. The patents were subsequently commercialized by a British company that began approaching receiver manufacturers and satellite system operators—including companies in both the United States and Europe—requesting royalty payments for use of the GPS L1C and Galileo E1 OS signals. 

The controversy raised immediate questions about the circumstances of the patent filing. The inventors were serving members of the signal task force at the time the MBOC concept was developed collaboratively by the joint EU-US working group. The U.S. Department of State and the European Commission were both made aware of the dispute. The primary U.S. application encountered a non-final rejection notice at the United States Patent and Trademark Office, leaving its status uncertain for an extended period.

The dispute had practical consequences beyond the legal proceedings. Receiver manufacturers, facing potential royalty demands, were reluctant to commit to MBOC-based product designs until the intellectual property situation was resolved. This uncertainty threatened to undermine the commercial benefits the entire GPS-Galileo interoperability exercise had been designed to deliver. Several industry voices warned that an adverse outcome could force a reversion to a pure BOC(1,1) signal structure—losing the hard-won performance gains of MBOC entirely. Luckily, the dispute was solved some years later by the EC and the UK government. The use of MBOC was no longer in danger.

CBOC, TMBOC, QMBOC: Three Implementations of One Spectrum

A crucial feature of the MBOC agreement—and one that emerged directly from the informal Munich discussions—was its definition in the frequency domain rather than the time domain. MBOC(6,1,1/11) specifies that the power spectral density of the combined pilot and data channels must equal a weighted mixture of BOC(1,1) and BOC(6,1) PSDs in the ratio 10:1 but leaves each party free to choose how to produce that PSD through its time-domain signal waveform. This flexibility led to distinct implementations, one adopted by each party (EU, U.S., China).

Composite Binary Offset Carrier (CBOC) is the implementation selected by the European Union for the Galileo E1 Open Service signal. In CBOC, the ranging code is modulated by a weighted combination of a BOC(1,1) sub-carrier and a BOC(6,1) sub-carrier on each channel, with the two components added in anti-phase between the data and pilot channels. The CBOC was then patented by my team and CNES and later transferred to the EC.

Time-Multiplexed Binary Offset Carrier (TMBOC) is the implementation adopted by the United States for the modernized GPS L1 open signal they call L1C. Rather than blending the two sub-carriers on each chip, TMBOC assigns individual chips alternately to BOC(1,1) and BOC(6,1) modulation in a specific time-multiplexed pattern. The GPS L1C pilot channel uses TMBOC(6,1,4/33), in which four chips out of every 33 are modulated with BOC(6,1), and the remaining 29 chips use BOC(1,1).

Chinese researchers at Tsinghua University responded by developing a variant modulation specifically designed to achieve MBOC-equivalent performance while constituting an independent intellectual property right. Their solution, published in 2010 in Electronics Letters, was Quadrature Multiplexed BOC (QMBOC). The QMBOC approach modulates the BOC(1,1) and BOC(6,1) sub-carrier components on two quadrature phases of the carrier signal—using the in-phase (I) and quadrature-phase (Q) channels—rather than combining them on a single phase as in CBOC or interleaving them in time as in TMBOC. The QMBOC design was explicitly motivated by the need to avoid the MBOC patent claims: Chinese technical documentation from the BeiDou signal design process describes QMBOC as providing the “same receiving performance as TMBOC and CBOC, while avoiding MBOC patent risk.”

Setting the Standard

The GPS-Galileo frequency consultations left a lasting imprint on the global GNSS landscape. The compatibility and interoperability framework, the analytical methodology covering spectral separation coefficients, C/N₀ degradation thresholds, phase error analysis, and multipath envelopes, have been adopted as the standard approach for GNSS signal coordination internationally. The International Committee on GNSS (ICG), established under UN auspices in 2005 partly in response to the proliferation of GNSS systems, uses this methodology as the basis for its inter-system compatibility assessments. MBOC and its implementations—Galileo’s CBOC and GPS’s TMBOC, as well as BeiDou’s QMBOC—are now the reference modulations for the world’s two leading GNSS constellations and China’s system, collectively serving over five billion users. 

The patent controversy, while damaging to the collaborative spirit of the GPS-Galileo process, ultimately did not prevent the widespread adoption of MBOC-based signals, and the combined GPS L1C, Galileo E1 OS, and BeiDou B1C infrastructure has delivered the positioning performance improvements that the original negotiators envisaged. I am glad and honored that I could attend and shape the Galileo signals and related meetings with my team on behalf of Germany.

The GIOVE-A and GIOVE-B satellites, modest in mass and modest in mission scope, saved the entire program from regulatory extinction. The four years of negotiations, with their thousands of pages of technical analyses, their contested phase error calculations, their multipath simulation campaigns, and their informal workshop in Munich, produced a signal design framework that has proved more durable than any of us could have foreseen. The second agreement—reached without minutes, in my academic institute in Bavaria—may be the most consequential undocumented meeting in the history of satellite navigation.

The post Inside Galileo: Signal Design, International Diplomacy and the Birth of MBOC appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

In 2026, the key topics for the European space community remain: Galileo, IRIS², launch capabilities, Earth observation, connectivity and industrial competitiveness. But the old continent is not discussing these old familiar themes in the same old familiar ways. No longer are these matters purely economic or technological. Instead, many at this year’s European Space Forum were asking how Europe can build space capabilities that are capable of surviving conflict.

The question was broached repeatedly, and the addition of a dedicated European Space Security and Defense Forum on day three confirmed the new fixation. Security is no longer a parallel discussion. It is one of the main organizing principles around which Europe’s future space architecture will be designed.

Russia’s invasion of Ukraine formed the dark backdrop to the conference. Speakers repeatedly pointed to the war as the clearest demonstration yet that modern military operations depend on space-based services. Satellite communications, positioning, navigation and timing (PNT), Earth observation and space domain awareness have become operational necessities and, increasingly, strategic vulnerabilities.

“Today, we operate in Europe in a fragmented and hyper-competitive environment where non-European LEO constellations have reshaped global markets, innovation cycles outpace procurement cycles.”

Aarti Holla-Maini, Director, United Nations Office for Outer Space Affairs (UNOOSA)

Straight Talk

Belgian Defense Minister Theo Francken offered a stark assessment of Europe’s current position. “The Ukraine war has taught us many lessons,” he said. “One of them is that all our radio communication has become increasingly vulnerable due to intensive jamming and other interference. Satellite communication has come to the rescue, to an extent. Starlink now provides the backbone of Ukrainian military connectivity, enabling command and control and deep strike missions.”

But Francken cautioned against drawing the wrong conclusion. “The success of Starlink in Ukraine is indeed spectacular,” he said, “but it should not blind us to its weaknesses.” Russia, he noted, rapidly adapted, first by exploiting Starlink before access controls were tightened, then by accelerating development of its own large satellite communications constellation.

“Just last month,” Francken said, “researchers from the University of Texas published compelling evidence that Russian military satellites have been transmitting GPS interference from orbit. If these findings are confirmed, they mark a profound shift in electronic warfare. A space-based jammer can project interference across vast areas while remaining safely in orbit, making it far more difficult to detect, attribute and counter.

“It is fair to say that the United States took space security matters far more seriously than Europe did,” Francken said. “Over the past two decades, the U.S. has spent more than $25 billion on a comprehensive ecosystem of three military satellite communications constellations. Together, they provide resilience and global military communications to the United States and its closest allies. We don’t have that. Yes, Europe also invested heavily in satellites, but our priorities lay elsewhere. To monitor climate change, ESA, the European Space Agency, spent close to €10 billion on the Copernicus system alone.”

Across Europe, governments are reassessing decades of assumptions that collective security could continue to rely principally on American capabilities. No one at the Space Forum advocated strategic separation from the United States. Rather, the prevailing view was that stronger European capabilities would strengthen the Alliance.

“We are under attack in Europe, and monitoring and alerting governmental services to jamming and spoofing is becoming part of our responsibility.”

Eric Guyader, Engineer, Galileo Program, European Commission DG DEFIS

Germany’s State Secretary Jens Plötner argued that Europe’s objective should not be independence for its own sake, but a more balanced partnership. “We need to be realistic,” he said. “Europe should not seek to replace the U.S. Even if we could, this should not be our goal. But Europe must develop capabilities that complement American strengths, fill gaps where they exist or grow, and provide resilience to American assets when they are stretched.

“Galileo provides this capability,” Plötner said, “but only if we invest in military receivers, integrate Galileo into our defense system, and exercise with it on a regular basis. The same logic applies across the board, in reconnaissance, communication and early warning. Not to decouple, but to build a partnership with greater balance and strength should be our goal.”

Rules of the Road, in Competition and Cooperation

Regulation emerged as the other key theme at this year’s Space Forum. Europe has propounded of late the need for greater strategic autonomy, but speakers repeatedly stressed that autonomy cannot come at the expense of openness, innovation or international cooperation.

Aarti Holla-Maini, Director of the United Nations Office for Outer Space Affairs (UNOOSA), reflected on how dramatically Europe’s priorities have shifted since the Forum first convened. “Since the first edition five years ago, the world has completely changed,” she said. “Today, we operate in Europe in a fragmented and hyper-competitive environment where non-European LEO constellations have reshaped global markets, innovation cycles outpace procurement cycles, Europe’s strategic dependencies have been fully exposed, and space security risks have multiplied.”

Europe has proven that it can build world-class public infrastructure, Holla-Maini argued: “Copernicus is the world’s most comprehensive civilian Earth observation program. Galileo is the world’s first major civilian-controlled GNSS system. Both are used every day by billions of people.”

The proposed EU Space Act, she said, is the logical next step. “The Act provides a single, predictable regulatory environment for all operators, ensuring that European values of safety, sustainability and responsible behavior are not just words, but principles required of all players wishing to operate in the European market.”

“Autonomy does not mean acting alone. Space has always been built on partnerships.”

Laurent Jaffart, Director of Connectivity and Secure Communications, European Space Agency (ESA)

The proposed legislation, unveiled by the European Commission in June 2025, would replace today’s patchwork of national rules with a common framework covering safety, cyber resilience and sustainability. Just as significantly, its provisions would apply to all operators serving the European market, making it an instrument of international standard-setting as well as internal regulation.

Industry broadly welcomed that ambition, while warning against unnecessary complexity. Adel Al-Saleh, Group CEO of SES and Vice-Chair of the Global Satellite Operators Association (GSOA), described regulation as one of the industry’s biggest concerns. “Europe has a unique opportunity with the European Space Act and the new Digital Networks Act to do something very special,” he said. “However, there are also concerns. Investors want predictability. They want something they can count on and understand. And these regulations have got to be non-discriminatory. Innovation is global in nature.”

Through Thick and Thin

Those concerns were echoed, in measured terms, from Washington. Caitlin Poling, Foreign Affairs Officer at the U.S. Department of State, made clear that the United States recognizes Europe’s desire to strengthen its own capabilities. “When we discuss European strategic autonomy, just like when we say ‘America first’, it doesn’t mean ‘America alone.’ European nations and organizations, as well as the United States, are smart to ensure that we all have the capabilities we need. Strategic redundancies are vital. If we think about them in that context, the conversation about strategic autonomy moves away from exclusion and toward cooperation.”

Poling’s concern, she said, is not the objective of the Space Act, but its implementation. “We’ve consulted with more than 100 U.S. and international space companies over the past year and a half,” she said. “We support the goal of a coherent framework to simplify civil, commercial and security cooperation. We just don’t want to see regulatory barriers erected to keep out existing and longstanding partners.”

The United States, Poling said, hopes the legislation will preserve a six decades-long history of transatlantic cooperation while avoiding unintended consequences that make it harder for governments and companies on either side of the Atlantic to work together.

Galileo’s Next Chapter

While the wider conference established Europe’s strategic direction, the dedicated Galileo session examined what it all means for Europe’s flagship PNT program. Galileo is clearly a major success, but how does it need to evolve to remain resilient in a contested operational environment?

Ennio Guarino, Head of the Galileo and EGNOS Program Department at ESA, argued that evolution is already underway. “Galileo is one of the most accurate and reliable GNSS systems in the world,” he said. “Galileo Second Generation, which we are now working on, will provide even more flexibility, additional levels of resilience and secure solutions, together with additional functionalities and services.”

But, Guarino said, “In the last decades there was an assumption that resilience meant additional redundancy, either in space or on the ground. Today, for ESA it means something more. It’s a matter of diversification. I believe Europe is now in the right position to evolve toward a multi-layer ecosystem.

“There is no more room for static systems. We are subject to jamming and spoofing every single day.”

Ennio Guarino, Head of the Galileo and EGNOS Program Department, European Space Agency (ESA)

“EGNOS V3 will provide secure-by-design services and process both GPS and Galileo. And since the 2022 ESA Ministerial Council, the Agency has been moving forward with its LEO PNT initiative, with the in-orbit demonstration satellite already flying. The latest Ministerial Council approved substantial further funding to move toward the initial operational phase. So, we are working hand in hand with the Commission on what will become the future EU PNT architecture. It’s a matter of aggregating and finding the complementarity among all these layers to provide resilient services for European citizens.”

Marco Caparrini, Galileo Open Service Manager at EUSPA, argued that resilience extends beyond satellites and ground infrastructure to the user segment itself. “One additional layer we should consider is the user segment. Galileo was created to give Europe autonomy, and it has done that. We own the system. But in reality, you can exploit that autonomy only as long as the user is able to use the service, even when somebody is trying to deny the service, disrupt operations or even attack the system.”

Caparrini pointed to Open Service Navigation Message Authentication (OSNMA) as a practical example. “Galileo is delivering OSNMA, a new layer of security that we provide to users, but only to users who are able to exploit it. The key point is translating those capabilities into receivers across all markets. Otherwise, we don’t get the benefit of what the system is providing.” For Caparrini, the accuracy of the service is no longer the sole issue. “The question now is how trustworthy it is, how available, how robust it is.”

The Best Bettered

Eric Guyader, Engineer, Galileo Program at European Commission DG DEFIS, turned to what many regard as Galileo’s most strategically significant capability: the Public Regulated Service (PRS). “PRS is the most robust service we are delivering in Galileo. It exists today and we are developing a new version of PRS within Galileo Second Generation with unprecedented capabilities. Of course, we cannot discuss those capabilities because they are classified, but from the point of view of resilience, I think we are in a very good position.”

The challenge, Guyader argued, is to get people using it. “What matters now is that our governments start implementing the service. If it is not used, if it is not fully integrated into national capabilities, then we are missing something and we are not resilient. That transition, he said, will take time. “We have depended on the Americans, once again, with military-grade GPS services, for decades. It takes time to change defense capabilities and operational procedures. But now that we have PRS, and now that we are looking toward the second generation of PRS, it’s high time governments started taking action.”

Looking further ahead, Guyader highlighted several priorities now being considered for the next European space program. “We are introducing new elements related to terrestrial PNT. It may sound strange when we’re talking about satellites, but in the next 10 to 20 years, we believe we will need terrestrial back-ups in carefully selected areas. We are also considering new capabilities to monitor interference. We are under attack in Europe, and monitoring and alerting governmental services to jamming and spoofing is becoming part of our responsibility.”

He also identified a less obvious vulnerability. “We need new engineers to develop, manufacture and operate these systems. If we lack knowledge or have to rely on industries outside Europe, I think we have a problem. That’s part of our autonomy and resilience too.”

Representing industry, Miguel Romay, Head of Navigation Systems at GMV, argued that Europe’s greatest achievement is also its greatest responsibility. “Today we have excellent PNT systems in Europe,” he said. “Galileo and EGNOS are working very, very well and the user community is using them widely. What we have to do over the next 10 years is not lose what we have achieved. If we do nothing, if we keep the systems as they are, the risks keep increasing. That’s why we need continuous evolution of the system. That evolution has to be supported by the institutions and implemented by industry.”

Romay welcomed Galileo Second Generation and the emergence of LEO PNT, while stressing that resilience extends well beyond satellites. “Europe is moving in the right direction. But we also need complementary technologies: terrestrial positioning, inertial sensors, visual sensors and probably artificial intelligence at receiver level to discriminate good signals from jamming and spoofing. It’s like cybersecurity. You have to keep improving all the time.”

Guarino agreed: “There is no more room for static systems. We are subject to jamming and spoofing every single day. We need to design Galileo, EGNOS and future LEO PNT with the capability to evolve progressively and continuously. Continuous improvement is no longer optional. It is one of the main system requirements.”

“Europe’s space infrastructure has become critical infrastructure, and we have to protect it as such.”

Christophe Morand, Director for Space, Connectivity and Secure Communications, European Commission DG DEFIS

Make it Last

No one should underestimate the potential long-term impact of what’s playing out today on the European Union’s eastern border. But looking beyond the immediate geopolitical moment, can Europe build a space sector capable of sustaining real strategic autonomy over decades rather than across a few political cycles? For Christophe Morand, Director for Space, Connectivity and Secure Communications at the European Commission’s DG DEFIS, that means thinking about Europe’s space programs as a single strategic ecosystem rather than a collection of individual projects.

“Europe has built exceptional assets,” Morand said, citing Galileo, Copernicus, GOVSATCOM and IRIS². “The question now is how we ensure they work together and into the future to provide the resilience Europe needs. For that, the next Multiannual Financial Framework will be a key moment. We need continuity. Space programs cannot stop and start every seven years. Industry needs predictability. Innovation needs predictability. Our strategic autonomy depends on predictability.”

Morand said resilience must be designed into every program. “Security is not something you bolt on at the end of a program. It has to be designed in from the beginning. Cyber resilience, physical resilience, supply-chain resilience, operational resilience, they all have to be considered together. Europe’s space infrastructure has become critical infrastructure, and we have to protect it as such.”

Laurent Jaffart, Director of Connectivity and Secure Communications at ESA, argued Europe already possesses the required technologies. “What we need now is speed,” he said. “We need to move faster from demonstration to operational systems. We need to shorten development cycles while maintaining the quality and reliability that Europe is known for.”

Jaffart cautioned against equating strategic autonomy with isolation. “Autonomy does not mean acting alone. Space has always been built on partnerships. We will continue working with international partners wherever it serves our mutual interests. But Europe must be able to act whenever necessary using its own capabilities.”

So, Europe is not retreating from international cooperation. Rather, it is redefining its role within it, seeking to become a stronger and more capable partner while reducing the strategic dependencies exposed by recent crises.

Francken returned to that theme. “For decades, we treated space as an enabler. Today, it has become an operational domain in its own right. Europe cannot afford to be dependent where space is concerned. We need our own capabilities, we need trusted partners and we need the political will to invest in both.”

The post European Space Forum Breaks New Ground appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

These events can now be visualized within a day or two of occurrence at websites that use ADS-B transmissions to infer the locations and types of jamming and spoofing, such as [2]. Real-time detection, mitigation and avoidance of these events is now one of the most active areas of GNSS research.

Users with the most demanding accuracy and integrity requirements, such as civil aviation, typically rely on differential corrections and integrity information provided by services such as Satellite and Ground-based Augmentation Systems (SBAS and GBAS, respectively). Corruption of the transmissions providing this information (“message spoofing”) is another means of generating misleading information (large, unbounded errors) and is a particularly concerning threat, as it can be done using a single PRN and need not overpower any existing signals. Further, it can introduce a bias on the position without affecting the GNSS-derived velocity or acceleration, making comparisons against other sensors for these elements ineffective.

The best way to prevent malicious alternation of GNSS corrections is to provide a means to authenticate the information in these messages so users can be assured the received data comes from the intended source. A simple message authentication protocol is included in the GBAS VHF Data Broadcast (VDB) between ground systems and users [3] but is limited to indicating which message slots should contain information from a given ground station. A more advanced cryptographic authentication technique is being developed for SBAS that is backward-compatible with legacy signals and should prevent any receiver from accepting SBAS information from anyone aside from the actual SBAS provider [4,5], but the work needed to standardize and implement it is expected to take several more years. 

To provide some level of SBAS message spoofing mitigation before cryptographic authentication is available, simple methods have been proposed in [1] to limit the magnitude of errors that could be generated by message spoofing. This column explains one of these methods, the background behind it, and its projected effectiveness in limiting worst-case errors from SBAS spoofing.

SBAS Correction Magnitudes and Spoofing Potential

When GBAS and SBAS were first conceived, GPS implemented a deliberate range-domain degradation called Selective Availability (SA). To counter the effects of SA, SBAS correction limits were made quite large: more than 250 m for clock errors and over 128 m in each of three orbital axes. However, in 2001, GPS eliminated SA and has subsequently committed to maintain significantly smaller errors [6]. But the L1 SBAS and GBAS standards were set prior to SA’s removal, and the potential to introduce large errors through erroneous corrections remains a part of the legacy L1 standards.

SBAS corrections can be used to create pseudorange errors that are up to about 160 m on L5 [7] or over 600 m on L1 [8]. L5 corrections only contain satellite clock and orbit values that are limited to ~64 m on adjustments to the clock and the three cartesian orbital coordinates. Cartesian (XYZ) orbital adjustments can be mapped into radial, along-track, and cross-track (RAX) adjustments whose upper values are dependent on satellite location. At least 97% of the radial error maps into user pseudorange error, while no more than 24% of the along-track and cross-track errors map into user pseudorange error. L1 corrections are larger, as they were designed to handle selective availability and ionospheric corrections. Fast Correction (FC) clock corrections can be as large as 256 m, while Long-Term Corrections (LTC) include orbital XYZ terms that can reach 128 m along with a clock term that can be as large as 143 m. Depending on satellite location and elevation angle, the projected pseudorange errors can range from 530 m to 675 m if using only FCs and LTCs.

In addition, the SBAS rate correction terms could make these correction errors more than an order of magnitude larger by making the time of applicability hours in the past. This undesirable property was recently recognized, and the SBAS Minimum Operational Performance Standards (MOPS) [7,8] are being changed to have the receiver limit the time period over which the rate terms could apply. Rather than potentially creating kilometers of error, they will be limited to roughly half the magnitude of the above correction terms. Altogether, the pseudorange errors from the satellite clock and orbit correction and correction rates can be of the order of 250 m on L5 and 650 m on L1.

An SBAS spoofer would also have control over which satellites the receiver uses and what their confidence values are, so they could create geometries with worse properties than commonly experienced. Typically, pseudorange error will be multiplied by a value less than three when mapped into position error. However, the spoofer can significantly increase this factor by controlling which satellites are used in the position solution and how much weight is assigned to each. 

Figure 1 shows the results of a GPS satellite geometry simulation using the default 24 satellite constellation [6] and users located around North America over 24 hours. The spoofer can control the magnitude and sign of each satellite measurement as well as maximize the projection along any position axis. By maximizing the error magnitudes for each satellite and the sum of the absolute values of the projection matrix (S) elements corresponding to a particular direction, the spoofer would maximize the error it can create along that direction [1]. For each user location and time step, every subset geometry that could support a 50 m Vertical Alert Limit (VAL) and 40 m Horizontal Alert Limit (HAL) were evaluated. This simulation can choose User Differential Range Errors (UDREs) and Grid Ionospheric Vertical Errors (GIVEs) for L1 or Dual Frequency Range Errors (DFREs) for L5. Low values for these parameters allow the alert limits to be made quite small for geometries ordinarily not available for use. 

Figure 1 shows histograms of the sum of the absolute value of the vertical-axis (Up) projection matrix values across all satellites in view for L1 users (left) and L5 users (right) (the histograms for East and North directions look nearly identical). Note that pseudorange errors could be multiplied by factors of order 10 to 50 for L1 or from 5 to 25 for L5 in the position domain depending on the underlying GPS satellite geometry. This means a spoofer could create position errors as large as 32 km for L1 and up to 6 km for L5. This clearly shows the need for some level of mitigation of SBAS message spoofing.

Correction Magnitude Limits and GNSS Commitments 

SBAS and GBAS messages include corrections for errors highly correlated between reference stations and users that are the primary means of improving accuracy beyond uncorrected (“standalone”) GNSS. The corrections computed by SBAS and GBAS must be checked in real time to confirm they fall within the limits of their message fields (i.e., the largest values that can be accommodated). To avoid failing this check, these message fields were designed to allow for correction magnitudes as large as could be envisioned during early system design in the early-to-mid 1990s. However, during subsequent development, it was realized that setting tighter limits helped detect and exclude system anomalies that were difficult to detect otherwise. For example, tighter limits on pseudorange correction and correction rate message parameters were shown in [9] to detect certain types of ephemeris anomalies arising from unannounced satellite maneuvers that are difficult to detect with other monitors.

In the last few years, each GNSS Constellation Service Provider (CSP) has made certain commitments about their constellation performance to enable their use by the aviation community [6,10,11,13]. Table 1 contains the commitments for four core constellations: GPS, GLONASS, Galileo and BeiDou (BDS). The most relevant parameters are σ_URA, a zero mean Gaussian overbound of nominal signal in space ranging errors; P_sat, the probability that a satellite has a fault, defined here as an error not overbounded by σ_URA independently of all other satellites; P_const, the probability that a single fault will affect more than one satellite within the constellation; and MFD, the mean fault duration.

GPS satellites broadcast their own σ_URA values, which can change over time, particularly if the satellite ephemeris has not been refreshed for many hours. It is most often set to 2.4 m. Figure 2 shows a histogram of the frequency of occurrence of the broadcast URA values from 2008 through 2025. A value of 2.4 meters was sent 91.8% of the time, while a value larger than 4.85 m was sent slightly more than 0.1% of the time. Note that GPS has set P_const to be 10^-8 or less. Thus, it is extremely unlikely GPS will have two or more faulty satellites at any given time. The definition of a fault for GPS is that the satellite clock and ephemeris errors together project to an error greater than 4.42 times σ_URA for any user. This corresponds to a 10.6 m upper limit most of the time (when σ_URA is 2.4 m). Unfortunately, none of the other constellations have made such a strong commitment.

Observed Constellation Performance

The left side of Figure 3 shows observed GPS constellation performance from 2008 through 2025. It shows the maximum projected clock and ephemeris errors for the satellite with the largest absolute errors at each time epoch in blue and the satellite with the second largest concurrent error in red. On June 17, 2012, the maximum error grew to 448 m, which is off the top of the plot. All other maximum projected errors over this period have been below 50 m. The second largest concurrent error observed in that time frame was 5.64 m. Note that in early 2024, GPS operational changes significantly improved its overall accuracy. 

The right side of Figure 3 shows the same data normalized (divided) by the broadcast value of σ_URA. Only rarely are the blue values greater than 4.42, which is the value that, when exceeded, is declared a GPS fault. All data is shown except for the June 17, 2012, fault, which corresponded to 187 times σ_URA. These instances correspond to the nine fault events that have occurred over this 18-year period. No simultaneous faults have been observed, confirming the extreme rarity of simultaneous faults, and the number of independent faults is well below the expected number corresponding to the GPS commitment for P_sat in Table 1 (10^-5).

Figure 4 shows the same results for Galileo. The left side of Figure 4 shows observed Galileo constellation performance from 2020 through 2025. It shows the largest and second largest projected errors in blue and red, respectively. There were five errors over this period that were larger than 18 m. They occurred on January 21, 2021; September 5, 2021; April 29, 2022; August 31, 2022; and July 21, 2024. All other projected errors have been below 18 m. The second largest concurrent error observed in that time frame was 1.85 m.

The right side of Figure 3 shows the same data normalized (divided) by the broadcast value of σ_URA. Only rarely are the blue values greater than 4.42, which is the value that, when exceeded, is declared a GPS fault. All data is shown except for the June 17, 2012, fault, which corresponded to 187 times σ_URA. These instances correspond to the nine fault events that have occurred over this 18-year period. No simultaneous faults have been observed, confirming the extreme rarity of simultaneous faults, and the number of independent faults is well below the expected number corresponding to the GPS commitment for P_sat in Table 1 (10^-5).

Figure 4 shows the same results for Galileo. The left side of Figure 4 shows observed Galileo constellation performance from 2020 through 2025. It shows the largest and second largest projected errors in blue and red, respectively. There were five errors over this period that were larger than 18 m. They occurred on January 21, 2021; September 5, 2021; April 29, 2022; August 31, 2022; and July 21, 2024. All other projected errors have been below 18 m. The second largest concurrent error observed in that time frame was 1.85 m. 

The right side of side of Figure 4 shows the same data but now divided by the fixed Galileo σ_URA value of 6 meters from Table 1. The largest fault occurred in September 2021 and corresponded to a 540 m fault, or 90 times σ_URA. There were five fault events observed in this five-year period. No simultaneous faults have been observed, and the number of independent faults is well below the expected number corresponding to the committed value of P_sat.

SBAS Correction Limitation Algorithm

These results show that both GPS and Galileo meet their respective performance commitments with margin. Based on this, [1] proposes monitoring for large SBAS corrections on multiple GPS satellites to serve as an indication of a potentially spoofed signal. In the inequality in Equation 1, the projected clock and ephemeris correction for satellite j to the user receiver is labeled as ∆y_j. A common SBAS time offset component is removed by differencing each projected correction with the median value from all such projected corrections. The median is chosen as it is robust to a small number of outliers. This difference is compared against the expected uncertainty in the GPS error magnitude according to σ_URA and the uncertainty in the SBAS correction accuracy according to σ_UDRE. For dual frequency evaluations σ_UDRE is replaced by σ_DFRE.

Because σ_URA and σ_UDRE represent conservative overbounds on the expected errors, it is exceedingly rare for 4.42 multiplied by either term to fail to bound their respective errors. Therefore, it is unlikely that more than one GPS satellite exceeds the inequality in Equation 1 at any given time (indeed, it will be very uncommon for even one to do so). Thus, if two or more projected GPS corrections exceed this threshold, the user should deselect this SBAS signal and use a different one or, if another SBAS is unavailable, conclude that SBAS corrections can no longer be trusted. 

When σ_URA and σ_UDRE are small, this constraint places much tighter limits on the correction magnitudes than the existing message structure allows. Assuming the GPS signals are genuine, Figure 2 shows that the GPS σ_URA is below 4.85 m nearly 99.9% of the time. The σ_UDRE can be much larger, but if it is made larger than 4.6 m, it cannot be used for vertical guidance per requirement [R229-227] of [8]. Further, increases in σ_UDRE will be reflected in increased protection levels and decreased availability. Therefore, Equation 1 effectively limits the correction error magnitude to 

This approach still leaves one satellite vulnerable to the possibility of a much larger spoofing error. This motivates a further condition: if a GPS satellite has a correction value that satisfies Equation 1, and its correction magnitude is greater than 30 m, that GPS satellite should be excluded from the SBAS position solution. This additional constraint can be expressed as:

Based on the data in Figure 3, there have only been four events in the last 18 years where a GPS satellite could have met the conditions of Equations 1 and 2 and was then excluded. It is very likely that the affected satellite would have also been set unusable by SBAS during these events due to the sudden large changes in the clock or orbital behavior. Thus, excluding a GPS satellite based on Equations 1 and 2 would not have any noticeable effect on availability.

Given a 30 m upper bound on GPS correction error, this method would place an upper limit on the position error due to erroneous corrections caused by spoofing ranging from roughly 300 to 1,500 m for L1 and 150 to 750 m for L5. A limitation of this approach is that it does not address the risk erroneous ionospheric corrections may pose for the L1 service nor the risk erroneous Galileo corrections may pose for the L5 service. Further, the spoofer may still introduce arbitrarily large errors if it exploits GEO/SBAS satellite ranging. Still, the algorithm is very simple and does usefully limit the potential impact of SBAS spoofing despite not providing complete protection.

Observed SBAS Behavior

This section examines the observed behavior of the existing SBAS services to ensure the risk of false alarms (when spoofing is not present) would be sufficiently low. The left side of Figure 5 shows the largest (blue) and second largest (red) normalized projected corrections for WAAS on a typical day (May 31, 2025). The right side of Figure 5 shows the second largest normalized projected corrections for other SBAS (EGNOS, MSAS, GAGAN, KASS and SouthPAN). The plotted data is described by the ratio of the left and right-hand sides of the inequality in Equation 1 without the 4.42 multiplier. These values are across all possible users that can see a given satellite above 5°, whether the user is within the visibility footprint of the SBAS GEO satellite or not. Further, the two data points for the same time step in the left plot are not necessarily at the same location (i.e., the user location that sees the maximum second largest value likely sees a smaller largest value).

In the left-hand plot in Figure 5, both the largest and the second largest terms are well below the suggested threshold of 4.42. The second largest value is below 1.3 for WAAS. In the right-hand plot, GAGAN’s second largest value was just above 2.0, while the others are all below 1.5. 

Other days, including the rare days with GPS faults, have been examined and show very similar upper limits on the observed second largest normalized projected error. The possibility of false alarms from unnecessarily large SBAS corrections appears to be very small, with all SBAS having values less than half of the 4.42 threshold required to violate the inequality in Equation 1. Note that, for the purposes of this monitor, there is nothing sacrosanct about the 4.42 multiplier in Equation 1 or the constellation commitments shown in Table 1. Taken together, Figures 3, 4 and 5 suggest the commitments for GPS and Galileo are conservative, as expected. Therefore, while these commitments should be the basis of an algorithm standardized in the SBAS MOPS, a multiplier significantly smaller than 4.42 could be used by receiver manufacturers to further limit the magnitude of undetected SBAS spoofing errors.

Position Domain Algorithm Using ARAIM

This simple correction-domain monitor algorithm seeks to avoid the user receiver calculating two separate position solutions, as doing so had been identified as computationally undesirable. However, should the receiver have the capability to calculate both SBAS and RAIM/ARAIM solutions at once, a direct comparison between the two can be very effective. RAIM/ARAIM (based on standalone GNSS without differential corrections [12]) is suggested as the basis for comparison because it also produces a trusted position estimate and associated protection levels. 

A detailed algorithm using ARAIM is defined in [1]. Results show it produces lower limits on undetected SBAS message spoofing errors than the correction-domain algorithm, particularly if dual-frequency ARAIM is applied. 

Conclusion

This article reviews the key results in [1] regarding simple techniques to detect and limit the potential errors caused by SBAS message spoofing. The correction-domain monitor proposed is very simple and can be easily added to existing user receivers with a very low likelihood of false alerts. The ARAIM-based position-domain monitor proposed in more detail in [1] further limits the potential errors but requires significantly more calculations in user receivers. While imperfect, one or both of these monitors should be implemented in current receivers to mitigate SBAS message spoofing risk prior to the introduction of cryptographic authentication in SBAS in the coming years. 

Acknowledgements

The authors gratefully acknowledge the support by the U.S. Federal Aviation Administration (FAA) for this work under MOA 693KA8-22-N-00015.

References 

(1) T. Walter, et al., “Limiting the Potential Impact of SBAS Spoofing,” Proc. ION Pacific PNT 2026, Honolulu, HI, April 2026. http://web.stanford.edu/group/scpnt/gpslab/pubs/papers/Walter_ION_PPNT_2026_Limiting_SBAS_Spoofing.pdf.

(2) “GNSS Interference Detection Using ADS-B” (website). https://rfi.stanford.edu/.

(3) GNSS-Based Precision Approach Local Area Augmentation System (LAAS) Signal-in-Space Interface Control Document (ICD), RTCA SC-159, DO-246E, July 2017.

(4) J. Dennis, et al. (2024). “SBAS Authentication Standards,” Proc. ION GPS/GNSS 2024, Baltimore, MD, Sept. 2024. http://web.stanford.edu/group/scpnt/gpslab/pubs/papers/Dennis_ION_GNSS_2024_SBAS_Authentication_Standards.pdf.

(5) J. Anderson, Designing Cryptography Systems for GNSS Data and Ranging Authentication, Ph.D. Dissertation, Stanford University, Dec. 2024. http://web.stanford.edu/group/scpnt/gpslab/pubs/theses/JasonAndersonThesis2024.pdf.

(6) Global Positioning System Standard Positioning Service Performance Standard. U.S. Dept. of Defense, 5th Ed 2020. https://www.gps.gov/sites/default/files/2025-07/2020-SPS-performance-standard.pdf.

(7) Minimum Operational Performance Standard for Galileo/Global Positioning System / Satellite-Based Augmentation System Airborne Equipment. EUROCAE WG-62, ED-259A, June 2023.

(8) Minimum Operational Performance Standards (MOPS) for Global Positioning System/Satellite-Based Augmentation System Airborne Equipment. RTCA SC-159, DO-229F, June 2020.

(9) H. Tang, et al., “Ephemeris Type A Fault Analysis and Mitigation for LAAS,” Proc. IEEE/ION PLANS 2012. Indian Wells, CA, April 2010. http://web.stanford.edu/group/scpnt/gpslab/pubs/papers/Tang_IEEEIONPLANS_2010_EphemerisTypeAFaultMitigationforLAAS.pdf.

(10) Galileo Open Service—Service Definition Document (OS SDD) (Issue 1.3). European GNSS Service Centre, Nov. 2023. https://www.gsc-europa.eu/sites/default/files/sites/all/files/Galileo-OS-SDD_v1.3.pdf.

(11) ICAO Standards and Recommended Practices, Annex 10—Aeronautical Communications, Vol. 1. International Civil Aviation Organization, 8th Ed., July 2023.

(12) J. Blanch, et al., “Baseline Advanced RAIM User Algorithm: Proposed Updates,” Proc. ION ITM 2022, Long Beach, CA, Jan. 2022. http://web.stanford.edu/group/scpnt/gpslab/pubs/papers/blanch_ION_ITM_2022_ARAIM.pdf.

(13) J. Dennis, et al., “Draft Vertical ARAIM Standards,” International Civil Aviation Organization, Navigation Systems Panel (NSP) JWGs/12, WP 12, May 2024.

Authors

Todd Walter received his Ph.D. in applied physics from Stanford University in 1993. He is a research professor in the Department of Aeronautics and Astronautics at Stanford University. His research focuses on implementing high-integrity air navigation systems. He has received the ION Thurlow and Kepler awards. He is also a fellow of ION and has served as its president. 

Rebecca Wang is a graduate student in the GPS Research Laboratory working under the guidance of Professor Todd Walter in the Department of Aeronautics and Astronautics at Stanford University. Prior to joining the lab, Rebecca received her B.S. in Aerospace Engineering at the University of Texas at Austin. Her research interests include multi-GNSS integrity for aviation and high-accuracy navigation.

 Juan Blanch is a senior research engineer at Stanford University, where he works on integrity algorithms for Satellite-based Augmentation Systems and on Receiver Autonomous Integrity Monitoring. A graduate of Ecole Polytechnique in France, he holds an MS in Electrical Engineering and a Ph.D. in Aeronautics and Astronautics from Stanford University. He received the 2004 ION Parkinson Award for his Ph.D. dissertation and the 2010 ION Early Achievement Award.

The post What Simple Measures Can Be Taken to Limit the Potential Impact of Spoofing of Differential GNSS Correction Messages? appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Cold War shortwave numbers stations broadcast strings of digits to anonymous listeners, content that’s meaningless to anyone without a matching one-time pad. They still operate today.

As it turns out, GPS broadcasts in much the same way.

Buried in every L1 C/A navigation message is Subframe 4, Page 17—a 176-bit field that IS-GPS-200 reserves for “special messages with the specific contents at the discretion of the Operating Command.” Every satellite broadcasts it. Every receiver decodes the subframe that contains it. And for nearly two decades, no one has publicly explained what it contains.

We analyzed 12.16 million observations in this field from 2007 through early 2026. The content is not text. It is encrypted material consistent with the military’s Over-the-Air Distribution (OTAD) global rekeying network. For 19 years, every operational GPS satellite has been a numbers station—broadcasting ciphertext on a public channel, to billions of receivers, in plain sight.

If you build receivers, write firmware, run signal monitoring, or care about the gap between civil and military signal transparency, this is your field too. You just have not been reading it.

What follows is the story of how a forgotten 176-bit slot in the world’s most successful navigation signal turned out to be its quietest and most consequential broadcast—and how a few weeks of analysis on a laptop, applied to 19 years of public archive data, was enough to read its operational history off the bytes.

176 Bits, Eight Words, One Forgotten Page

The L1 C/A signal carries 50 bits per second. Every bit must earn its place. The Legacy Navigation message organizes those bits into 1,500-bit frames, each frame into five 300-bit subframes, each subframe into ten 30-bit words. Subframes 1 to 3 carry the heavy work—clock corrections, ephemeris, the data your receiver needs every few seconds. Subframes 4 and 5 multiplex 25 rotating pages. A receiver sees Page 17 of Subframe 4 every 12.5 minutes.

Across 32 satellites, that is roughly 3,700 special-message payloads per day, fleet-wide. Multiplied across 19 years and the global ground-station archive, the figure climbs to 12.16 million observations.

176 bits is barely enough for a few floating-point numbers, but in a 50 bps signal, it is roughly 12% of every Subframe 4 broadcast. For the control segment to use that bandwidth consistently for two decades implies the content matters—even if no civilian receiver has ever rendered it.

Figure 1 shows how the bits are arranged. The 176-bit payload is fragmented across Words 3 to 10 of Subframe 4, Page 17: 16 data bits in Word 3 (after eight bits of Data ID and SV ID = 55, the marker that identifies Page 17), 24 data bits in each of Words 4 to 9, and 16 data bits in Word 10. The final six bits of every word carry the parity bits. After parity stripping and reassembly, the 22 bytes of payload are decoded under a subset of Code Page 437.

Mining 19 Years of Navbits

The corpus comes from the GFZ Potsdam open archive GNSS recordings collected from a wide network of ground stations, dating back to 2007. After extraction, the numbers settle: 12.16 million observations of Subframe 4, Page 17, drawn from every operational PRN, spanning 19 years, yielding 3,994 unique 176-bit messages.

Initial Python implementations needed hours to process a single year. To make iterative analysis practical, we wrote a Julia pipeline: NetCDF source files are converted to Apache Arrow, then thread-parallel bit extraction is performed into a DuckDB database. The full 19-year corpus extracts in seconds on a laptop. SQL across the lot returns in milliseconds.

With 12.16 million payloads in a queryable database, the question becomes: What does this field actually contain?

It Is Not Text. It Never Was.

The first thing a researcher tries in an unknown field is the obvious one: maybe it is text in a different encoding. We computed the frequency of each of the 45 alphabet symbols defined by IS-GPS-200 across all 12.16 million observations. In English, frequencies have a fingerprint—E and T are common, J and Z are rare, spaces and full stops are more common than digits. In a uniform random stream, each of the 45 symbols should appear with probability one in 45—about 2.22%.

The observed frequencies tracked the uniform baseline with remarkable precision. A chi-squared test against uniform yielded a z-score of 1.84, well inside the range where we cannot reject the null hypothesis of randomness. Across 12.16 million observations, the distribution is statistically indistinguishable from random data.

A stronger test asks the same question from a compression angle: How much information does each unique message contribute, given the others? An order-8 PPM-D compression model trained on the full corpus measures the marginal entropy of each payload—the additional cost, in bits, of encoding that message given everything else the model has seen. Real text would compress: Any recurring phrase, formatting block, or repeated formula would become almost free to code. Random data would not. Figure 2 plots the resulting distribution alongside a synthetic random baseline of 3,994 messages drawn uniformly from the 45-symbol alphabet and scored against the same model. The two distributions overlap almost perfectly, with means within half a bit of each other. By every available statistical lens, the GPS messages are almost indistinguishable from random, but there are intriguing outliers. At the lower end, messages are much more predictable than you would expect from random data; at the higher end, sentinels stand out from the rest. 

In Figure 2, blue indicates the marginal coding cost of each of the 3,994 unique 22-byte payloads under an order-8 PPM-D model trained on the corpus (μ≈131.5 bits per message≈6.0 bits per byte, σ≈7.6). Red indicates the same model scored against a synthetic baseline of 3,994 messages drawn uniformly from the 45-symbol GPS alphabet (μ≈132.0 bits, σ≈3.8). The two distributions overlap almost perfectly—the GPS messages are indistinguishable from random under the model. 

The next issue is that high-entropy output can come from encryption, compression or genuine randomness, and entropy alone cannot tell us which. This is correct. It is also the entry point to the rest of the article. If the field is encrypted, the protocol shape may still leave traces—placeholders where no payload is loaded, regime changes where policy shifts. In these structural metadata, the cipher does not reach. Encryption doesn’t hide “traffic data” of when and how often messages are sent and from which satellites. Each of those is a crack in the randomness, and the rest of this story walks through them in order.

What the entropy result does close off is the comfortable interpretation. Between 2007 and late 2023, no readable English appears anywhere in the dataset. No call signs, no acknowledgments, no test patterns of “the quick brown fox” variety. The field has not carried text in any conventional sense for the entire archived history of the GPS constellation.

For an engineer, that absence is itself information. The interface specification says this field is for text from the control segment. The bytes flatly disagree, and they have done so consistently, across every satellite, for 19 years.

High entropy on its own tells us only what the field is not. To learn what it is, we had to look for the cracks in the randomness.

A Single Byte, Repeated 22 Times, for 10 Years

The first crack in the randomness is also the most visible. Three messages, out of 3,994, have Shannon entropy of exactly zero. They are sentinels: 22 consecutive identical bytes broadcast as a single repeating pattern across the full payload.

• All-spaces—22 of byte 0x20.

• All-NUL—22 of byte 0x00.

• All-¬—22 of byte 0xAA, the CP437 negation glyph.

The all-¬ pattern is the longest-lived artifact in the dataset. It first appears on PRN 25 in February 2010, and quickly becomes the dominant default for the constellation, persisting intermittently across all 32 satellites for more than a decade.

The choice of byte 0xAA is not accidental. In binary, it is the perfectly alternating bit pattern 10101010—the canonical test sequence for bit synchronization, parity verification, and frame-alignment checks in receiver hardware. A satellite broadcasting all-¬ is broadcasting the protocol equivalent of a tone: present, parseable and intentionally empty. It is also outside of the characters permitted in the special message field, causing receivers to flag up data validation errors.

That intentionality matters. Encryption alone does not produce a constant. A genuinely random stream visits all-0xAA with negligible probability. The sentinels are placeholders by design—slots in the protocol marked as “no operational payload loaded.”

Their behavior fits that reading. Cross-referencing with GPS status reports (Notice Advisory to Navstar Users—NANU) shows satellites often enter sentinel states during commissioning and decommissioning. PRN 25 itself is the textbook case. The Block IIA satellite using that slot was decommissioned in December 2009. By February 2010, the slot was broadcasting all-¬. Its replacement, the first Block IIF, launched in May 2010, began pre-commissioning tests in August and also broadcast the all-¬ sentinel for several days before being declared fully operational on August 27. The pattern is unambiguous: When no operational payload is loaded, the field broadcasts the sentinel.

In a corpus where messages are replaced and never repeated, the sentinels are the only payloads that recur. Every other unique 176-bit message in the dataset appears in fewer than two calendar months for any given PRN. The sentinels persist for years. So, messages are replaced, never repeated—except the sentinels.

Why a system would broadcast a no payload loaded placeholder at all, and to what kind of receiver, needs the operational context that the rest of this article rests on.

Why GPS Carries Encrypted Signals—and What That Costs to Run

GPS broadcasts more than the open civilian C/A code. Since the activation of Anti-Spoofing on January 31, 1994, the constellation has carried encrypted military signals on the same frequencies: the Y-Code (the encrypted form of the precision P-Code on L1 and L2) and, on modernized satellites, the newer M-Code introduced with the GPS IIR-M block from 2005 onwards. These signals provide authorized receivers with jamming and spoofing resistance that civilian users do not have. The separation between open and encrypted signals also allows the operator to degrade the accuracy of civilian receivers while maintaining the precision of authorized ones. 

Encrypted signals need keys. Authorized receivers built since the late 1990s integrate a tamper-resistant cryptographic module called the Selective Availability Anti-Spoofing Module (SAASM)—the cryptographic basis of in-service infantry units such as the Defense Advanced GPS Receiver (DAGR). The SAASM holds a cryptographic key that lets the receiver lock onto the encrypted signal; without a current key, the receiver falls back to the unencrypted C/A code that anyone can track.

Keys do not sit still. To limit the damage from any single compromise, operational keys rotate on a schedule that, depending on the key class, can be as short as a single day. Every receiver in service—and the U.S. military operates them in the hundreds of thousands, across every theatre, vehicle platform, weapon system, and aircraft—needs each new key before its current one expires.

For most of GPS’s history, that meant physical key-fill: specialized loader devices had to be carried to each receiver, plugged in, and used to push the new key into the SAASM module. The keys themselves were distributed through NSA secure-courier channels. The logistics were demanding even in peacetime; in deployment, units that missed a key-fill window lost access to the encrypted signal until they could be reached again.

Over-the-Air Distribution (OTAD) and the closely related Over-the-Air Rekeying (OTAR) were the answer to that logistics problem. The principle is straightforward. A receiver that is powered on and already holds a valid current key can have its next key delivered via the GPS navigation message itself—encrypted under the current key and decoded within the SAASM module—without physical contact, a courier chain, or missed-window failures. The OTAD payload, the “next black key” in military parlance (where “black” denotes encrypted-at-rest), is what the GPS control segment must deliver to every authorized receiver on a schedule, via a public broadcast channel.

That delivery mechanism is what we believe Subframe 4, Page 17 has been carrying since at least 2007. If so, the constellation should reveal somewhere in its 19-year broadcast history the moment the delivery system went operational. And it does.

May 26, 2011: The Day the Constellation Spoke in Unison

May 26, 2011. Above the Earth, 31 active GPS satellites in 12-hour MEO orbits, each in its own slot, each broadcasting its own special message. By the end of the day, every one of them was broadcasting the same one.

Within a window of a few hours, all 31 operational satellites switched to the all-¬ sentinel. Every active PRN. Same payload. Same byte. Same coordinated event.

Figure 3 shows the 48-hour per-PRN timeline of the transition. It reads as a vertical bar slicing across the constellation: a step change so sharp and so simultaneous that no observational artifact can explain it. The data come from multiple receivers, ruling out a station-side glitch. Every PRN is involved, ruling out a single-satellite anomaly. No NANU was issued announcing a fleet-wide event of this kind.

In Figure 3, the Per-PRN broadcast state across a 48-hour window is centered on the transition. Each row corresponds to one of the 31 active GPS satellites; time runs from left to right in UTC. Within a few hours, every PRN switches to the all-¬ sentinel (red), holds it for between three and 24 hours, and exits to a new operational message at the end of the day. No publicly recorded NANU announces a fleet-wide event of this kind in the surrounding window. The transition coincides with the operational activation of the U.S. Over-the-Air Distribution rekeying network.

What remains is a coordinated, control-segment-driven blanking of the field across the entire operational constellation—the kind of thing that happens once, when an underlying system goes operational.

Declassified documentation places such a milestone in this exact period. A 2015 briefing by Maj Scott Tyley of the Space and Missile Systems Center describes the operational rollout of the U.S. OTAD system and its companion OTAR. The briefing identifies March 2011 as the start of continuous operational U.S. OTAD on all space vehicles.

Temporal alignment is not enough on its own to prove the connection; operational systems achieve operational status every year, and most of them do not announce themselves on L1 C/A. What raises the alignment from coincidence to causation is what happened next.

In the pre-OTAD era of 2007 to 2010, the constellation rotated unique payloads on average every 3.4 days; the 2007 to 2008 sub-period averaged about 2.3 days. In the operational era of 2012 to 2021, that rate jumped to once every 0.9 days, with a median message duration of 23 hours—almost exactly once a day. The H1 2011 period itself shows a cascade of four coordinated change points (January, February, May, June) culminating in the May 26 fleet flash, consistent with a phased activation rather than a single instantaneous transition. The result is consistent with the field being switched from a pre-operational test mode to an automated daily key-distribution cadence—exactly the operational tempo OTAD requires to deliver “next black keys” to SAASM-equipped receivers in the field.

Within a single 24-hour window, every operational GPS satellite switched to the same value.

From One Message a Week to One a Day, and Back Again

The 2011 flash drew a line through the dataset. Looking across the full 19 years, the field exhibits three behavioral regimes, each separated by a coordinated change point detected by Cumulative Sum (CUSUM) analysis applied to per-PRN message rotation rates.

The Pre-Operational Era, 2007 to 2011: A new payload per satellite roughly every 3.7 days on average. The rotation is irregular, the diversity is low, and the sentinel fractions are high. The pattern is consistent with field testing, including the 2010 coalition key transition exercises described in Tyley’s briefing. The system existed but was not yet running at operational tempo, or perhaps a predecessor system was in operation.

The Operational Era, 2011 to 2022: A new payload per satellite roughly every 1.8 days, fleet-wide, with median per-message duration of 23 hours. Daily cadence is the lifetime of a tactical cryptographic key; daily replacement of the field’s content is the operational signature of automated key distribution. The sentinels recede into the background; unique payloads dominate, with 162 to 381 distinct messages per year. For 11 years, the GPS constellation has operated the most widely used automated rekeying network on Earth.

The Modern Era, 2022 to Present: In May 2022, there is a sharp coordinated change point. The rotation rate drops to one payload every 4.3 days at the regime boundary, then keeps slowing. By 2025, it is approximately one payload per 6 days, and by early 2026 it is closer to one per 6.8. The shift is fleet-wide, simultaneous across 17 to 32 satellites, depending on which metric is examined, and again unaccompanied by a publicly recorded NANU.

Three rates: 3.7, 1.8, 4.3+ days per payload (the third era’s rate is not stable and has continued to slow). Three regimes: pre-operational, operational, post-2022. Figure 4 shows them as three plateaus separated by sharp coordinated transitions.

The fleet-mean per-message duration in days is plotted across the full 19 years of the corpus in Figure 4. The pre-OTAD era (2007 to 2010) cycles roughly every 3.7 days. From May 2011 the rotation accelerates to one payload every 1.8 days, sustained for 11 years and consistent with daily tactical key distribution. In May 2022, a coordinated change point detected by CUSUM analysis reverses the trend on roughly 30 satellites simultaneously; rotation slows to 4.3 days per payload at the boundary and continues to slow within the era — to 6.8 days by early 2026. Vertical lines mark coordinated change points (≥ 8 PRNs within ± 3 days).

The 2022 reversion is the most interesting open question in the dataset. Several readings are consistent with the data, and none are conclusive.

It could mark the migration of OTAD traffic from L1 C/A to a different signal, most plausibly M-Code on L1/L2, where modernized military receivers have been operating since the GPS III deployments began.

It could reflect a change in cryptographic policy: longer key lifetimes, fewer rotations, more reliance on session-key derivation at the receiver.

It could be the first visible footprint of the recently terminated Next Generation Operational Control System (OCX) ground segment, whose deliberate, staged rollout was a public program for years.

What the data say definitively is that whatever the explanation, it was a single decision applied across the entire fleet at once, and the public record contains no notification of the kind we would expect.

A field that announces operational changes by the cadence of its own ciphertext is a field worth watching.

When Encrypted Messages Share Their Spelling

If the messages were genuinely random—random or properly encrypted with independent keys, padding, and initialization vectors—then no two unique payloads should share any meaningful structure. Each 176-bit message would be statistically independent of every other.

They are not.

A Prediction by Partial Matching (PPM-D) order-8 compression model, trained over the full 3,994-message corpus, identifies pairs and small groups of unique messages that share long, identical substrings at the same byte positions. Examples from the catalog:

• Two messages broadcast on October 8, 2014, share 10 identical characters in identical positions.

• A message from June 2021 and a message from September 2020 share a 9-character substring at the same offset.

• A pair of late-2019 messages, broadcast three weeks apart, share eight characters at identical byte positions.

• The substring LY47IRP16—9 bytes—appears in messages broadcast nine months apart.

• S°6L.D°—7 bytes—recurs three months apart.

The probability that any given pair of 22-character messages drawn independently from a 45-symbol alphabet would share a nine-character substring at the same offset by chance is negligible. Across the full corpus, the matches are not coincidental; they are structured. 

In Figure 5, five message pairs are identified by an order-8 PPM-D compression model as sharing long substrings at identical byte positions, despite being broadcast days, weeks or months apart. Each pair is shown one above the other, with shaded cells highlighting the matching bytes. The remainder of each message is the high-entropy ciphertext that fills almost the entire corpus.

The most likely explanation is protocol metadata leaking through. Every cryptographic transport protocol wraps its payload in headers—key identifiers, sequence numbers, etc. However, this alone is not a sufficient explanation because these values are encrypted and should therefore differ for every message. In addition to fixed metadata, there would need to be re-use of a key, whether due to operational error or exceptional circumstances. In such a scenario, we would expect to see partial matches between two different messages.

There is a practical consequence. If the substring matches are protocol metadata, they offer an external observer something the cryptography was meant to deny: a way to fingerprint and track individual key-distribution events from public signal data. A monitoring receiver, watching a small set of fixed byte positions across the entire constellation, could, in principle, detect when a particular key identifier or routing header is reused, retired or correlated with a NANU-announced operation. Cryptographically, the keys remain secure. Operationally, the metadata is loud.

In a stream that should be indistinguishable from noise, the protocol left a fingerprint.

The First Readable Bytes in 19 Years

In the corpus that runs from 2007 to mid-2023, no payload anywhere contains a recognizable word from any language that’s intended for direct human consumption. Then, on December 13, 2023, PRN 8 broadcasts a message that begins with the literal four-byte string TEXT.

After 16 years of pure ciphertext, the field has begun to use the format the standard always described. 

The migration is both staged and deliberate, reading like a deployment plan rather than just a casual flip of a switch.

• December 13, 2023—first appearance, on PRN 8 alone.

• March 18, 2024—the same TEXT-prefixed message broadcast on 10 PRNs simultaneously: a one-day fleet-wide distribution event.

• July 31, 2024—a second TEXT message, on PRN 3 alone.

• October 10, 2024—a four-PRN distribution.

• December 29, 2024—January 13, 2025—daily TEXT messages on PRN 1, with a different payload each day.

• March, June 2025—the daily-broadcast PRN moves to PRN 21.

• July–August 2025—the daily-broadcast PRN moves to PRN 20.

Each TEXT-prefixed message rotates daily and carries an 18-byte payload following the prefix. The payload itself remains high-entropy—by every statistical measure indistinguishable from the ciphertext that preceded it. The format has changed. The content shape has not.

The most plausible reading is a generational upgrade. OCX is rolling out. GPS III satellites are operational and growing as a fraction of the constellation. A new variant of OTAD, or a new auxiliary use of the field bolted alongside it, is being commissioned by PRN.

For receiver firmware, the migration matters in a way the previous 19 years did not. A field containing static-looking ciphertext is one that most parsers ignore. A field that apparently carries a structured type identifier followed by a payload must be parsed correctly.

The September 2020 SVN 74 anomaly is a cautionary tale, even though it concerns a different field: an ICD-defined alarm pattern transmitted as prescribed, with a minority of commercial receivers failing to handle it correctly and pushing bad positions to ADS-B users. The TEXT-prefix migration is an analogous situation—content that finally matches the special-message field’s standard format, arriving on receivers that may have spent two decades treating this field as static or ignored. Either direction of mismatch, content the standard did not describe, or content that suddenly does, can produce the same kind of outcome.

For the receiver and firmware teams, the practical action is short. Audit any code path that touches Subframe 4, Page 17. If the field is currently being skipped, logged as static, or assumed to be text, that assumption now has an expiration date. The TEXT prefix suggests the message is intended for human consumption; the trailing 18 bytes are the payload, which the standard has always permitted. Code that handles both is forward-compatible. Code that handles only one is the next September 2020 waiting to happen.

The migration is happening now. As of early 2026, only a handful of satellites have broadcast TEXT-prefixed messages, and the rest of the fleet continues to use the unstructured format. Which PRN converts next, and what its first TEXT-formatted message says, is the most accessible real-time measurement of GPS ground-segment evolution available to anyone with a receiver and patience.

Figure 6 plots every TEXT-prefix broadcast event in the corpus, satellite by satellite.

It shows 26 unique messages, 38 (PRN, day) combinations and 2,398 total observations. Marker size scales with daily observation count. Five distinct phases are visible. The first TEXT message appears on PRN 8 on December 13, 2023 (red). Three multi-PRN distribution events follow in 2024 (teal): a 10-PRN event on March 18, 2024, a single-PRN appearance on July 31, and a four-PRN distribution on October 10. From December 29, 2024, the protocol stabilizes into bursts of consecutive daily broadcasts that migrate between satellites: first PRN 1 (dark grey, December 2024 to January 2025), then PRN 21 (purple, March and June 2025), then PRN 20 (amber, July to August 2025). The migration looks far more like a staged deployment than an organic spread.

The Bottom of the Rabbit Hole, Or the Top of It

For nearly two decades, every operational GPS satellite has broadcast an encrypted stream consistent with the backbone of the U.S. military’s global cryptographic key distribution system.

The 2011 fleet flash was the constellation-wide synchronization that brought the system to operational capability. The 0xAA sentinel is the protocol’s no payload loaded marker. The shared substrings are the structural fingerprints of an OTAD frame leaking through the cipher. The 2022 reversion is the system in transition. The TEXT prefix is the system in renewal.

This matters in three ways:

• For signal authentication. OTAD is the proven, decades-long predecessor to civilian schemes like Galileo OSNMA and GPS CHIMERA. Its operational history, until now invisible, is data that the authentication community can study.

• For operational transparency. Both the 2011 flash and the 2022 reversion happened without the kind of public NANU record one might expect for a fleet-wide operational change. The methodology in this article, open archives, off-the-shelf tooling, 18k lines of Julia, gives the GNSS community the means to monitor the constellation’s internal states for itself.

• For pure engineering curiosity. Every receiver in the world decodes Subframe 4, Page 17. Almost none of them have ever looked at it. The lesson generalizes: There is more to learn from the bytes already arriving at our antennas than from the bytes we wish were specified differently.

The data are publicly available. The signal is overhead, twice a day, every day. We invite the GNSS engineering community to join the audit for L1 C/A and the newer signals that will inherit its role.

Every GPS satellite is a numbers station. The receivers were always listening. We just had not been. 

Acknowledgements 

This article is based on a project developed by Ahmed Kamruddin during his MSc studies at University College London. Thanks also to Ramsey Faragher and Markus Kuhn for valuable comments on this work. The initial stages of the work were performed within the Trusted Innovative GNSS receivER (TIGER) project, co-funded by the European GNSS Agency (GSA) under grant agreement 228443. Source code supporting this project can be found at https://doi.org/10.5281/zenodo.20073222.

Author

Steven J. Murdoch is Professor of Security Engineering, head of the Information Security Research Group and lead for the Foundational Computer Science section in University College London. His research encompasses payment system security, privacy enhancing technologies, online safety, and the intersection of computer science and law. He teaches on the UCL MSc in Information Security. He has worked with the OpenNet Initiative, investigating Internet censorship, and for the Tor Project, on improving the security and usability of the Tor anonymity system. His current research focuses on how computer systems can generate evidence to facilitate fair and efficient dispute resolution. He is a member of REPHRAIN, the National Research Centre on Privacy, Harm Reduction and Adversarial Influence Online and co-leads the CRANE NetworkPlus on Cybersecurity. He is a director of the Open Rights Group, a UK-based digital campaigning organization that works to protect rights to privacy and free speech online. He is also a Fellow of the IET and BCS.

The post The Empty Field that Wasn’t: GPS, OTAD and Two Decades of Encrypted Broadcasts appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

SÉBASTIEN TRILLES, THIERRY AUTHIÉ, XAVIER VASSEUR, MARIE ABBAL, THALES ALENIA SPACE, TOULOUSE, FRANCE

To use GNSS systems for air navigation, various civil aviation organizations have defined an augmentation system capable of fulfilling two primary missions. The first is to calculate correction messages that allow aviation users to exploit GNSS data for precise positioning, even if the GNSS system incorporates intentional or unintentional degradations affecting geolocation. The second mission is to monitor all navigation data broadcast by GNSS systems in real time to detect any anomalies and alert aviation users within a timeframe compatible with their flight phase. Given civil aviation’s need to cover a large area, typically on the scale of a continent, the dissemination of these messages has naturally been directed toward geostationary satellites known as Satellite Based Augmentation Systems (SBAS).

The role of an SBAS is to decompose the various contributors to measurement errors and broadcast, through dedicated augmentation messages, corrections associated with each error contributor to users. These corrections are reassembled by the user receiver according to their geographical position, improving positioning accuracy and helping to mitigate error sources that affect distance information related to satellite clocks, their positioning, and ionospheric effects. All SBAS are interoperable and standardized [1].

The classic functional architecture of an SBAS is composed of a network of ground reference stations that collect GNSS navigation measurements and data, a set of central processing facilities that compute corrections and constructs augmentation messages, and a set of transmission stations that broadcast the radiofrequency signal toward the geostationary satellite.

Current SBAS systems are designed for single constellation GPS, single-frequency L1 users, using the L/NAV navigation message. The augmentation signal is broadcast on the L1 frequency band, modulated by a dedicated PRN, and contains orbital corrections, clock corrections, and a model to correct ionospheric elongation.

Future SBAS, called Dual Frequency Multiple Constellations (DFMC), are dedicated to dual-frequency L1/E1 and L5/E5a users, using L/NAV navigation messages for GPS and F/NAV for Galileo. The augmentation signal is broadcast on the L5 frequency band, modulated by a dedicated PRN, and contains orbital and clock corrections for satellites from different constellations.

The main limitation of SBAS accuracy and availability performance lies in the regional coverage of the ground reference stations network, which does not allow continuous monitoring of the satellites in the navigation constellation. As a result, SBAS must continuously manage satellite visibility losses for several hours, requiring complex strategies to detect any satellite event such as manoeuvres, clock anomalies and hardware bias as soon as measurements become available again. The strong coupling that exists between material biases and ionospheric elongation adds difficulty in the case of satellite raising because it is often difficult to separate a hardware bias jump and an ionospheric event at the edge of the zone.

Furthermore, a geographically restricted network of reference stations does not allow for the correct decoupling of satellite orbits and clocks. This limitation is not a problem for a small service area because the clock error partially compensates for the orbit error. However, clock error is a scalar while orbit error is a three-dimensional vector, so how good the compensation of one error by the other depends on the size of the geographical area to be covered and the geographical position of the user within it. Consequently, a wide service area needs good decoupling between orbit and clock, which a network of regional stations does not provide.

This article studies the possibility of spatializing all the components of a classic SBAS. In this approach, the three main steps of SBAS processing, collecting GNSS data, calculating augmentation messages and disseminating those messages to users, must be carried out by components in free fall around the Earth.

Global SBAS Architecture Overview 

The first step in the SBAS spatialization process involves taking fixed reference stations on Earth and placing them in orbit, under navigation constellations, i.e., in low Earth orbit (LEO). There is no point in flying the stations in cluster formation, as this would not solve the regional problem and, moreover, the service would only be intermittent during the cluster’s orbital period. We immediately assume a uniformly distributed constellation as the geometry for the station distribution.

By doing this, LEO flying stations (LFS) can see GNSS constellations permanently, which is an undeniable advantage for increasing the accuracy of corrections and detecting critical events. Another benefit is SBAS has the capacity to be a global service, representing a significant paradigm shift. The spatialization of the stations also avoids the difficulties of defining a terrestrial network, which must satisfy geopolitical conditions, not to mention that the Earth is 70% covered by oceans, limiting the possible terrestrial sites to emerged geographical areas.

On the other hand, GNSS reference stations are no longer fixed points on Earth; they evolve over time. However, their trajectories remain predictable as their movements are well known and correctly modeled in the short term because they are governed by the laws of space mechanics. It is necessary to have accurate orbits for LFS. Several solutions exist for performing this calculation. Three approaches naturally emerge:

1. The calculation of LFS orbits is performed simultaneously and in the same process as the MEO orbits of the constellation satellites; 

2. LFS orbits are estimated using GNSS measurements through a separate process;

3. LFS orbits are calculated using independent means and independent measurements.

The first approach raises several questions regarding the commonality: LFS are devoted to monitor the GNSS constellation satellite. Using GNSS measurements for both LEO and MEO positioning in the same process brings significant 
algorithmic complexity and risk on the impact of a feared MEO satellite event on LEO position and detection capabilities. Thus, this approach is not discussed. 

The second approach decouples orbit calculations but requires implementing GNSS fault detection and exclusion techniques such as RAIM or ARAIM to make the position of the reference stations insensitive to failures of the constellation satellites.

The last approach offers the greatest possible independence because it is achieved using measurements from a positioning technique that is completely decoupled from GNSS. The Doppler Orbitography and Radiopositioning Integrated by Satellite (DORIS) system is an example of such an independent system. DORIS is a radio navigation and orbit determination system based on Doppler measurements of signals transmitted from the ground to satellites. It is developed and maintained by CNES, the French Space Agency, widely used for space geodesy, Earth observation, altimetry missions and achieving centimeter precision level. The onboard DORIS and GNSS receivers share the same clock. The clock is synchronized with System Network Time (SNT, the reference time of the globalized SBAS), so the orbit generated will be time tagged with respect to the SNT. We retain this for this framework.

At the planned altitude, the LFS are positioned above the area where the ionospheric plasma is most concentrated. The GNSS measurements collected on board shouldn’t be much affected by ionospheric delays. This also implies this type of system will not be able to develop an ionosphere model and calculate ionospheric corrections to single-frequency users. Thus, this framework is devoted for dual-frequencies users. According to this paradigm, the ionosphere model shall be elaborated by an external entity.

The local Earth environment or propagation effects (troposphere and ionosphere) no longer affect measurements collected by GNSS receivers. Therefore, the quality of the measurements is expected to be significantly improved compared to a ground-based system. This favorable environment, associated with a geodetic quality receiver, will improve the precision performance of augmentation navigation messages.

In this framework, the LFS move at a high speed, of the order of 7 km/s, which generates visibility durations for GNSS satellites of 30 minutes. These passage durations are much shorter than those observed from the ground by several hours, but they are long enough for floating ambiguity resolution. The rapid dynamic of the LFS generates high relative movement between LEO and MEO satellites, providing better decorrelation between orbits and clocks and improving SBAS augmentation message performance.

LFS Communicate Via Inter Satellite Links

The proposed architectural framework incorporates inter satellite links (ISL) between the LFS (Figure 1). Selecting optical or RF ISL is driven by the trade-off between ranging accuracy, security and volume of data to be transmitted versus satellite design complexity. Optical links are suitable for high bandwidth and security requirements but demand more advanced technology and precise alignment that affect satellite design. RF links represent a proven technology, simple to deploy and tolerant of inaccuracies, but limited in bandwidth and inherent security. 

ISL capability serves two functions:

• A communication function to share the information recorded by each satellite;

• A ranging measurement function to improve the algorithms for determining the orbits of LFS and to participate to generate the independent SNT.

The first is equivalent to the terrestrial network, the Wide Area Network (WAN), which ensures the transfer of information between SBAS elements. 

The second aims to improve the position calculation and prediction of LFS by feeding the precise orbit determination, initially based on the provision of DORIS measurements, with additional Inter Satellite Ranging (ISR) measurements. The geometry and the accuracy of these additional measurements will help, respectively:

• To improve accuracy positioning in normal and tangential directions;

• To precisely locate the phase center of GNSS signal reception;

• To cope with possible jamming or spoofing of the DORIS station by offering an independent set of measurements; 

• To connect LFS clocks between them to measure their desynchronization (Figure 1). 

Several approaches can be envisioned for forming the clock’s equations, in particular the classic method based on the dual one-way ranging that allows decoupling orbit and clock problems [4].

In this framework, ISL continuity is assumed to be maintained over time without interruption, which requires permanent precise pointing.

The Navigation Kernels are Decentralized

Navigation computations are no longer handled by a single element but are distributed. This distribution is either entrusted to an infrastructure external to the system, already in place and managed independently, or distributed among all LFS.

In the first option, the globalized SBAS has access to a space cloud that handles the entire computational load. The links between the LFS and the space cloud are provided by ISL.

In the second option, each satellite carries a shared computing capacity. The computations are decentralized: Each computing unit performs part of the workload and exchanges the results with each other. These results are assembled by each LFS to generate a common navigation context. 

Decoupling Differential Corrections Generation and Integrity Monitoring

According to the original SBAS architecture designed by Thales Alenia Space [2-3], the navigation processing facility is composed of two components to ensure the independence of integrity checks. The first one, the Processing Set (PS), calculates the SBAS corrections and generates the Navigation Overlay Frame (NOF) with respect to the message format and message sequence defined in the MOPS and SARPS. The Check Set (CS) is the second component responsible for checking the integrity of the corrections from the NOF received from the GEO satellite, using data from at least one other group of independent receivers from each RIMS. When needed, it generates alarms on satellites that are collected by the PS and injected inside the very next NOF in case an anomaly is detected. To ensure diversification, the set of RIMS is divided into two distinct groups: RIMS-A only feeds the PS and RIMS-B only feeds the CS. The rational of this “dual channels” architecture is to comply with the safety requirement stating no single or common mode of failure shall entail a non-integrity event.

The solution studied proposes maintaining this distinction between the roles of the sets, PS on one side and CS on the other, and further extending independence by specifically allocating the measurements collected by a LFS to the PS or the CS functions exclusively. This leads to two separate LFS fleets: one dedicated to fulfilling the PS functions (denoted LFS-A, and acting as RIMS-A) and one dedicated to fulfilling the CS functions (denoted LFS-B, and acting as RIMS-B). The CS can communicate with the PS at the minimum level of integrity parameters to fulfil integrity checks. 

With such separation, the globalized SBAS architecture guarantees complete diversity in the measurement geometry to fulfil the PS and CS functions: the measurements from LFS-A will capture a very different observation geometry from that captured by the LFS-B measurements to perform integrity monitoring. This capability represents a significant advancement over previously developed ground-based architectures (EGNOS and KASS, for example) that co-locate RIMS A and B (in reality these two stations are separated by a few dozen meters to diversify the local environment. However, both RIMS capture the same observation geometry).

An even stricter independence step is to dedicate one batch of LFS to perform only the PS function and the other batch to perform only the CS function. The constellation is divided into two sub-constellations: partition A and B. The first calculates the navigation message (partition A allocated to the PS) and the other monitors the integrity of the message (partition B allocated to the CS). Each partition implements the distributed calculation of the PS and CS functions.

The two partitions communicate with each other via ISL to construct the message to be broadcast: The PS communicates the NOF ready to be sent to the CS, and the CS returns the results of the independent integrity checks to the PS. Different combinations are possible on the geometric distribution of the PS and the CS. This article focuses on two options: partitions (A and B) evolve at the same altitude (Option-1), or the partitions are positioned at two different altitudes, one specific for A and another for B, (Option-2). 

System Time Scale Generation

A SBAS must generate its own time reference, the SNT, which must be parallel (as much as possible) to the TAI. All clock corrections are computed relative to this system time reference. Because the bandwidth of NOF messages is 
limited (currently 250 bits per second), the SNT is steered to GNSS time to limit the magnitude of the corrections.

Several techniques are possible to achieve this internal time scale. Conventional SBAS only have RIMS-GNSS satellite links; the links between RIMS clocks are only accessible from a common satellite visibility by simple difference. Some SBAS develop the SNT using only a set of RIMS (EGNOS), which requires the construction of simple difference measurements; others (KASS) construct the SNT using all available clocks, including those of the RIMS and those of the GNSS satellites.

The globalized SBAS allows SNT construction based solely on the LFS clocks thanks to the direct links that connect them. This architecture makes it possible to construct a timescale independent of the GNSS constellations. The dual one-way ranging technique allows measurement of clock differences over time between two satellites connected by a laser link:

where h_i and h_j are the clock desynchronization of LFS clocks i and j, H_ij is the dual one-way ranging measurement corrected by relativity effects, hardware delays (in meter) relative to the ISL antenna on the receiving chain and on the transmitting chain, and phase centre offset relating on both emitter and receiver satellite [4].

It is therefore possible to construct the clock problem and solve it using various techniques [5-8]. The high quality of the dual one-way ranging measurements, combined with high-quality atomic clocks, allows the construction of a composite timescale whose expected qualities have phase continuity, frequency continuity and high stability (measured by the Allan variance). The SNT is aligned with the GNSS constellation timescale in a conventional manner, either by calculating a timescale difference, a posteriori, or directly during SNT generation by adding constraint equations. This steering will be performed using navigation messages from the GNSS constellations.

The timescale obtained is implicit; it is a paper time because it is calculated as a “well-constructed” average of all the clocks contributing to the calculation. The result of the composite clock algorithms provides biases that represent the advances or delays of each of the LFS clocks relative to the SNT timescale. Once these biases are applied, each clock is assumed to represent a realization of the SNT. This process, therefore, enables the global synchronization of all the LFS in the SBAS system. It then becomes possible to transmit a signal to the constellation every second of the SNT time.

TTA Reduction

The classic implementation of an SBAS (like that of the EGNOS V2 and KASS operational systems) is designed to be a Periodic (repetitive cycle of operations), Synchronous (each operation is performed according to its own timing), and Pipelined (all operations are performed in series) system. Specifically, observations are performed simultaneously at all ground RIMS stations at the second round of GPS time. Data are then transmitted to the navigation cores, where the algorithms are executed at a frequency of 1 Hz as soon as almost all RIMS measurements are received. Each operation has a specific execution time allocation, and the entire system is designed to complete a cycle in 5.2 s.

In the globalized SBAS concept, the LFS also perform measurements in a synchronous manner, meaning all stations observe GNSS events at the same coordinated moment. However, unlike the classic implementation, the specific timing of these measurements is optimized. The synchronization point is not arbitrarily fixed to the second round of system time, but is strategically chosen. This optimization takes several constraints into account: the requirement for the NOF to be available for broadcast starting at a specific round of system time, the estimated data transmission time between LFS, and the computational resources needed to generate the NOF. By aligning the measurement moment with these operational constraints, the system can maximize efficiency and ensure timely availability of the SBAS corrections for end users.

Assuming measurements time is optimized, the time allocations in the different elements of the system would be [9]:

• 1,000 ms to acquire new measurements, due to the 1Hz frequency of NOF broadcasting;

• 200 ms to generate the raw measurements (150 ms) and to format them (50 ms);

• 150 ms to disseminate the data to all SV through the ISLs;

• 350 ms to process data in the DPS (200 ms for computation and 150 ms for exchange data between satellites).

At the end, the NOF ready for broadcast is available in less than 1 second (Figure 2).

The time to alert (TTA) corresponds to the maximum time elapsed between the moment an anomaly likely to compromise user safety is detected and the moment the user receives the corresponding alert, informing them to no longer trust the service. In other words, it is the maximum time for any fault/error detected or suspected by the system to be reported to users by an alarm message transmitted via the SBAS signal. TTA is a central criterion for safety-of-life applications. For vertical guidance approach services (APV-I / LPV-200 type), the international ICAO SARPS standard sets the maximum TTA at 6 seconds. If the SBAS detects a loss of integrity, the alert must reach the user within this time. A short TTA ensures users will be quickly informed of a loss of performance or an anomaly, and can react or interrupt critical procedures when service reliability cannot be guaranteed.

The TTA takes the duration of NOF transmission (1 s) into account and the time allocated to user processing (800 ms). The time of SBAS signal propagation from LEO to user is neglected in this first apportionment (around 3 ms). The complete SBAS cycle is completed in between 3 and 4 s (compared to 5.2 s in classic case). The TTA is then below 3.5 seconds, representing a reduction factor of two with respect to classic ground SBAS (Figure 3). 

Finally, the concept of fast alert, [9] would be enabled. Fast alert messages are broadcast using the Q-channel and contain the alert flags (alarm/no alarm) for all satellites set in the PRN mask. The complete SBAS cycle is completed in 1.5 s (compared to 5.2 s in a classic case). This operational flexibility would allow a TTA of 2.3 seconds (Figure 4). 

LFS Broadcast the NOF

In a conventional SBAS architecture, the NOF is transmitted to users by one or more geostationary satellites. This message is generated on the ground, so it must be encoded into a signal and transmitted by a dedicated RF ground up-link station to the GEO. Because the first bit of the NOF must be sent synchronously at the second round of SNT time (close to GNSS time by specification) at the phase center of the GEO satellite, conventional SBAS systems implement a long loop that controls the signal transmission time to the ground. The SBAS is also endowed with an “integrity box” that checks the NOF return link to ensure the NOF received by the user is the same as the one computed by the system. In most cases, both NOF are strictly equal; if a corruption is detected the integrity box cuts the emission at ground.

In the case of a space-based SBAS system, LFS are capable of transmitting the NOF. To be properly processed in the GNSS receiver computing chains, this signal must be modulated by a PRN code that will spread the carrier spectrum using the Code Division Multiple Access (CDMA) technique. For this signal to be correctly processed within GNSS receiver chains, it must be modulated using a Pseudo-Random Noise (PRN) code, effectively spreading the carrier spectrum via CDMA. There are two primary approaches for assigning PRN codes to the LFSs:

• All LFSs transmit using the same PRN code;

• Each LFS transmits using a dedicated PRN code.

In the first case, the globalized SBAS broadcast the NOF with a single, unique PRN for all LFS transmissions. When multiple LFS are within the receiver’s field of view, the receiver can typically differentiate between transmissions by exploiting distinct Doppler shifts, which result in separate correlation peaks in the time-frequency domain. However, the probability of collision between the two correlation peaks is significant. Assuming a Doppler shift of 50 kHz, a loop bandwidth of 5 MHz and a PRN code of length 1,023 chips, the probability of a collision between two peaks can be estimated as (5.10³/5.10⁵)×1/1,023≈10^-5 per millisecond, corresponding to roughly one collision per 100 seconds. If three satellites are in view, the likelihood of simultaneous collision among all three signals becomes negligible. Therefore, using a unique PRN for all LFS requires continuous visibility of at least three LFS. However, this approach implies LFS signals cannot be used for ranging: While the NOF message can be received, the receiver cannot distinguish which LFS transmitted it.

In the second approach, each LFS is assigned a distinct PRN code. Currently, GNSS receivers store the navigation contexts of NOF messages received from each GEO SBAS, identified by its dedicated PRN. Out of all recorded contexts, the user applies only one; when the receiver switches PRNs, it replaces the navigation context accordingly and the old one is purged. In the context of globalized SBAS, however, the visibility time of each LFS is very short, about a dozen minutes, which is insufficient for a receiver to fully update its navigation context. In this situation, the user must retain the navigation context when switching PRNs instead of purging it. This ensures seamless continuity for the user; the navigation solution remains coherent regardless of the current LFS because the integrity and accuracy information provided by each NOF is consistent across all LFS. This adaptation necessitates an evolution of SARPS and MOPS standards to accommodate the new PRN allocation schemes envisaged for global SBAS. This approach allows the ranging function to be achieved even if it involves a significant increase in the number of PRNs required. 

The NOF is transmitted synchronously at the second round of SNT time. In other words, all LFS transmit the NOF to users at the same second of SNT time. This approach removes the necessity and the complexity of the long loop.

Every second, the system broadcasts a single common NOF according to a fixed and predictive message-sequencing scheme, compliant with the requirements of the SARPS standard. This augmentation message is broadcast in L5-I signal frequency.

The constellation is designed so at least two LFS are visible beyond 5° elevations of any user on Earth. The LFS are assumed to be able to receive GNSS signals in the Radio Navigation Satellite Service (RNSS) band and emitting the Aeronautical Radio Navigation Service (ARNS) band without jamming between emission and reception.

Whereas in conventional systems two or three GEOs are active, the possible loss of a GEO has a direct and immediate impact on availability and service continuity performance over a sometimes large geographical area. This new approach multiplies the number of NOF emission points, which greatly increases the resilience of system performance to this type of failure, reducing the impact to only a few users. Different combinations are possible on the geometric distribution of NOF emission points: in Option-1 the two partitions broadcast the NOF, in Option-2 only one partition broadcasts the NOF (Figure 5).

In Option-1, the two fleets broadcast the NOF. A standard functional allocation would consist in apportioning the same number of satellites to partitions A and B. As the LFS A and B are placed at the same altitude, the LFS-B cannot treat the NOF received as the user will; LFS-B only checks the NOF the system is ready to send the user. As all LFS emit the NOF, the return link function is not possible. Detecting possible NOF corruption (a LFS emits a message not conformed to it specification) is then allocated to the user. If the NOFs are different, SBAS can no longer be used. 

In Option-2, partition A is placed above partition B: altitude of the PS function is higher altitude of the CS function and only partition A broadcasts the NOF. The two partitions remain connected by ISL. The difference is now the CS can receive and monitor the NOF messages being sent by partition A and identify whether corruption is possible. The CS identifies the LFS-A responsible for this corruption and sends it a command requiring it to stop sending the NOF. At the next second, this specific LFS-A will cease the emission. The redundancy of LFS-A is designed to limit the impact of this corruption at user level and to maximize the level of performance of availability and continuity.

A global SBAS should bring permanent continuity in GNSS satellite visibility so it can monitor, at any time, all GNSS satellites configured in the PRN mask. 

LEO Ranging Function

The realization of this function assume seach LFS transmits using a dedicated PRN code. LFS have an independent orbit estimate and are synchronized with each other, giving them the information necessary to fulfill the LEO ranging function (Figure 6). This consists of considering LFS as an additional ranging signal. Consequently, the globalized SBAS can naturally act as a LEO PNT system:

1. The satellite precisely synchronizes the start of a PRN code sequence transmitted in the signal with the start one second of SNT time, 

2. The satellite synchronizes the first bit of the navigation message with the second round of SNT time, 

3. The satellite maintains synchronization of the start of a navigation bit with the start of a PRN code sequence, 

4. The satellite maintains the code-carrier consistency.

The internal navigator of the LFS provides an orbit and a clock synchronization bias relative to the SNT. Orbitography algorithms also provide a variance-covariance matrix that can be used to provide URA data. A suitable ARAIM concept could provide the integrity of LEO satellite navigation data, allowing LEO ranging measurements to be incorporated into a safety-of-life solution. The LFS navigation message shall be encoded in the signal broadcast to the user.

In the classic SBAS paradigm, GEO-Ranging function is possible and GEO data navigation takes place inside the NOF itself (MT9 dedicated for GEO SBAS L1 ephemeris). In the spatialized SBAS paradigm, the number of transmitting satellites is increasing considerably and inserting LEO navigation data into the NOF would congest the available bandwidth. It is better to transmit the SIS ranging data in a dedicated message rather than the NOF. In this aspect, two options are envisioned: either LEO ephemeris are encoded in L5-Q signal frequency or L1-I signal frequency. The first is the most energy-efficient because one signal is generated on L5, which modulates the NOF on the I channel and the ephemeris on the Q channel. The second option requires generating and transmitting two signals on two different frequency bands, which consumes more energy and adds complexity. Users can leverage these two frequencies to form the iono-free combination, as is done with GNSS satellites, and improve their positioning.

Monitoring and Control

Classic SBAS provides system monitoring and control, which involves overseeing and managing the ground segment subsystems, supporting maintenance tasks—including configuration management—offering data archiving capabilities for offline activities, and enabling communication with external entities.

In spatialized SBAS, the need for the system monitoring and control function is still present: it is even mandatory to operate the system. The operator ensures operational management of the system, maintenance of the infrastructure and supervision of the service provided to users. Several Mission Control Centers (MCC) on ground are necessary for this. The MCC and the LFS constellation communicate with each other by classic TM/TC.

LEO Constellation Infrastructure 

Achieving a worldwide SBAS solely through ground stations is impractical due to the necessity of comprehensive global coverage, which would require an immense and continuously maintained network of ground infrastructure spread across the entire Earth’s surface. This makes it difficult to provide consistent, reliable augmentation signals everywhere. 

Deploying space-based stations in LEO orbits offers a more efficient and effective solution. LEO satellites can cover vast areas of the planet from orbit, overcoming environmental masking faced by ground stations. This space-based approach ensures continuous, global augmentation service with improved scalability, making it preferable for establishing a worldwide SBAS.

Another benefit of the LEO constellation, and a consequence of global coverage, is its unique capability to receive measurements from GNSS satellites throughout their entire orbits, regardless of the satellites’ position relative to the Earth’s surface. This comprehensive 
visibility enables LEO satellites to monitor GNSS signals continuously, eliminating geometrical blind spots that can occur when relying on ground stations. The estimation of GNSS satellite orbits and clock errors becomes more accurate and robust, leading to improved navigation performance. By providing consistent and diverse observational data from multiple vantage points in space, LEO constellations significantly expand the precision and reliability of GNSS orbit and clock determination. This visibility is the main driver of constellation size: ensuring at least one LEO satellite is visible at all times everywhere on Earth is required to receive the NOF message. Given the safety-of-life nature of the system, safety guidelines further recommend a minimum of two LEO satellites be visible at all times everywhere to cover a single satellite failure. Visibilities are considered when the satellite is above 5° of elevation above the horizon.

The characteristics of a LEO constellation satisfying this constraint mainly depends on altitude. For this study, two different altitudes are considered: 

• 750 km of altitude. This leads to a constellation made of 96 satellites.

• 1,200 km of altitude. This leads to a constellation made of 57 satellites.

These constellations are designed to ensure a minimum number of satellites to respect geometric constraints. They do not constitute the real constellation that will necessarily be sized to take into account failures, redundancy, etc.

These two LEO constellations are configured and represented in Figure 7. 

For each altitude considered, the constellation is minimal in terms of number of satellites. Any constellation with fewer satellites does not ensure at least two satellites in visibility at all times.

The visibility constraint can be verified by using a simple simulation. Visibilities are calculated for a grid of users on Earth. However, as the LEO satellites have an orbital period between an hour and a half and two hours, they make around 15 orbits on a single day. This means globally, the visibility statistics are the same for all users on a same latitude. Therefore, the results in Figure 8 show the minimum, average and maximum number of satellites in visibility as a function of latitude. 

The constraint of at least two satellites in visibility is satisfied everywhere. The statistics do not differ significantly between the two constellations, with visibilities being minimum at the equator, increasing for higher latitudes and decreasing near the poles.

A LEO satellite used for a safety-of-life system will have associated constraints in terms of certification and will be costly. So, the number of satellites should be minimized, making the constellation at 1,200 km the seemingly preferred option. However, this criterion should also be in balance with criteria related to the satellite payload, onboard available power, antenna design, launching constraints and end-of-life constraints. A higher altitude means satellite signals will have to be transmitted with a higher power. The launchers will need to reach a higher altitude, and deorbiting the satellites when they reach their end of life will require more manoeuvring capabilities. This all must be taken into account, but it is also very dependent on satellite platforms, payloads and launching capabilities.

Distributed Processing Facility 

Space-based computing

Space-based computing has been increasingly taken into consideration over the past few years. Among others, we mention the innovative EU-funded study Advanced Space Cloud for European Net zero emission and Data sovereignty (ASCEND) [10], which focuses on the feasibility of deploying space-based data centers and relying on space-based cloud based solutions [11].

In May 2025, China launched the first 12 satellites of a planned 2,800-strong orbital supercomputer satellite network. These satellites aim at performing calculations in space without relying on any ground-based computing facility.

Computing in space offers three major advantages compared to traditional ground-based systems:

• Reduced data transmission costs: Processing data locally in space reduces the need to downlink large volumes of data to Earth, saving bandwidth and costs;

• Low latency: The mutual proximity of satellites in the constellation reduces communication delays, enabling faster data processing;

• Scalability: Space-based cloud computing can potentially scale by deploying additional resources (later named spare satellites) and can be reconfigured dynamically.

A centralized space-based solution 

A straightforward route to designing an efficient space-based processing facility is to rely on a centralized space-based solution, where an independent and already in place infrastructure located in space hosts the entire calculation. This solution exploits already existing algorithms and relies on computing infrastructures currently used on ground-based systems. Nevertheless, this easy to follow route faces the following three main challenges:

• Single point of failure: The entire computing system relies on a single dedicated platform. This means any hardware or software failure can disable the entire computing capability, unless duplicate/diversified computing capabilities are incorporated into the constellation. This expensive solution makes the global infrastructure rather complex.

• Communication: All data must be routed to and processed by the centralized unit, which represents a major bottleneck in terms of communication and elapsed times before calculation. High communication loads may significantly reduce real-time responsiveness;

• Energy inefficiency: A centralized computing solution may require high power consumption for processing large data movement within the single dedicated infrastructure. This may create additional energy constraints.

A fully distributed space-based solution

For all these reasons, an alternative solution must be proposed. In a fully distributed space solution, each satellite in the LFS constellation corresponds to a specific node of the distributed computing facility. Each satellite of each subconstellation acts as a computational unit and communication between the different nodes is handled by ISL links. 

With at least two LFS visible beyond 5° elevations of any user on Earth, the estimated total number of satellites of the global constellation is bounded by 96. Because half of the LFS are attributed to the augmentation message, the total number of nodes of the computing facility is bounded by 48. This moderate network size for a distributed computing facility allows state-of-the-art parallel algorithms to be employed to compute and broadcast messages [12] [13]. At first sight, distributed computing offers immediate advantages over a centralized solution: 

• Efficiency: Multiple nodes can handle different computations concurrently. This speeds up the overall computation of navigation messages with respect to a centralized solution, where communications may become a significant bottleneck;

• Fault tolerance: Because processing is spread across multiple nodes, random failure of one node does not necessarily harm the entire navigation system. Other existing nodes of the LFS-A subconstellation may take over degraded tasks. This flexibility is one of the main advantages of the distributed computing solution. Additional spare satellites also may be incorporated into the LFS-A subconstellation to improve fault tolerance.

• Redundancy: Distributed systems can implement both hardware and software redundancy more naturally by duplicating specific critical functions across multiple nodes, reducing potential single points of failure resulting from random failure.

The distributed computing facility relies on the core idea that each node performs a specific part of the computational workload and exchanges messages (possibly with each other) through ISL links. At the end of the procedure, the results are gathered by each LFS to generate a common navigation context. This may induce a potentially high volume of point-to-point or collective communications between the nodes of the LFS-A constellation. Therefore, it is of outmost importance to rely on algorithms that minimize the global volume of communication. The computation of the state vector during the filtering process in the PS function provides an instructional example in this regard. Of interest is a parallel algorithm for the solution of least-squares problems that requires a low volume of communication. Does this orthogonal factorization distributed algorithm exist at all?

The answer to this question is positive if we rely on advanced numerical linear algebra methods for the solution of least-squares problems. In our context, a parallel algorithm named Communication-Avoiding QR (CAQR) is worth considering [14]. CAQR is a class of QR orthogonal factorization algorithms designed to minimize (and not avoid) the costly communication between nodes in distributed systems. Because data movement often dominates the energy consumption and runtime of numerical algorithms, CAQR aims at improving both performance and energy efficiency by reducing the communication overhead. Communication in our context includes data transfers, which are often more expensive (in time and energy) than arithmetic operations [12]. This reduction of communication overhead is obtained through a specific factorization: CAQR typically divides the matrix to be factorized into different panels (i.e. blocks of columns). Instead of applying the classical Householder QR method [15], [16] on the panel, CAQR applies Tall-Skinny QR (TSQR) [17] instead, a specific QR factorization. TSQR minimizes communication by recursively factorizing smaller blocks, using a reduction tree structure (e.g., a binary tree of partial QR factorizations) to combine results efficiently with limited data movement [18] [19]. In short, communication costs are reduced by organizing QR operations as tree-structured reductions rather than linear sequences. This algorithmic feature enables parallel processing of independent blocks, combining partial results with minimal communication steps. The number of communication steps is logarithmic in the number of panels [20].

By significantly reducing the volume of communication, CAQR delivers a reduced energy consumption while providing improved overall runtime [14]. CAQR maintains the numerical stability properties of classical Householder QR factorizations, ensuring accurate and reliable factorization results despite the communication optimizations. At the end of the algorithm, the solution of the least-squares problem is known on a leaf of the reduction tree and a single collective communication is used to share this information on the other nodes of the LFS-A subconstellation. This shows a distributed algorithm with a low overhead in terms of communications can be applied during the filtering process. 

Space-based distributed computing is a doable approach that introduces additional constraints to satisfy during the design of the architecture of the spatialized SBAS: 

• Limited computational resources: Each node has a specific limited CPU (or GPU) power, memory and energy compared to Earth-based computing centers. A key point is to optimize the global hardware resource efficiency with respect to the properties of the LFS-A subconstellation (number of satellites and total volume of communication essentially);

• Physical and environmental constraints: Space-based computing often meets challenging physical conditions (such as temperature extremes, vibration, radiation in space) that may affect hardware reliability. Hardware must be resilient against environmental factors. A key point is to overestimate the number of satellites in the LFS-A subconstellation to provide redundant calculations.

These additional constraints must be carefully considered when designing the global constellation and when performing the safety analysis.

Safety Dimensioning in New SBAS Architecture Concepts

When analyzing novel SBAS architectural concepts from a safety standpoint, it is imperative to recall the overarching safety dimensioning principles to guide the assessment of their compliance and the identification of associated constraints.

This analysis is framed within the context of civil aviation. At the system level, the primary safety-feared events and their corresponding severity classifications are defined as:

• Integrity is customarily established as the measure of the trust that can be placed in the correctness of the information supplied by a navigation system. Integrity includes the system’s ability to provide timely warnings to users when it should not be used for navigation. A failure in integrity, termed a “non-integrity event,” is linked to a hazardous severity classification [21].

• Continuity is the ability of the total system (comprising all elements necessary to maintain craft position within the defined area) to perform its function without interruption during the intended operation. More specifically, continuity is the probability the specified system performance will be maintained for the duration of a phase of operation, presuming the system was available at the beginning of that phase. A “non-continuity event” corresponds to a major severity classification [21].

Foundational Safety Engineering and Safety Assurance Principles

The applicable European Cooperation for Space Standardization (ECSS) standards in Europe stipulate that “no single system failure or single operator error (SPOF) shall have critical (i.e. hazardous) or catastrophic consequences.” This has profound architectural implications; it requires that any function whose failure could result in critical/hazardous consequences must be underpinned by a minimum of two independent components.

Development Assurance Level (DAL)

Given the safety-critical nature of civil aviation, software development is governed by rigorous standards. Safety analyses underpin the allocation of Development Assurance Levels (DAL) to various items in accordance with the architecture.

Development Assurance involves specific planned and systematic actions providing confidence that errors or omissions in requirements have been identified and corrected to the degree the system implemented satisfies the applicable safety requirements. System/sub-systems and products are assigned DALs based on failure condition classifications associated with system level functions implemented in the sub-systems and products. The rigor and discipline needed in performing the supporting processes vary corresponding to the assigned development assurance level.

The initial software DAL determined can be mitigated when considering the different kinds of protections or alternate potential design implemented into the architecture, with provision that evidence of full independence between involved software functions is provided. Finally, the DAL allocation is a consequence of the implemented architecture: The redundancy, independence, and segregation embedded within the architecture dictate the refinement of DAL assignments. DAL levels play a pivotal role in component selection and exert a significant influence on project costs. It is prudent to iteratively assess candidate architectures to converge upon an optimal solution.

Software failures with potential hazardous implications (e.g., non-integrity events in SBAS) necessitate DAL B [22]/SWAL 2 [23].

Software failures leading to major events (e.g., non-continuity events and Accuracy Major event in European SBAS) require DAL C [22] / SWAL 3 [23].

In typical SBAS architectures, functions contributing directly to the integrity check of augmentation messages and certain critical data dissemination tasks—those that guarantee the non-corruption of broadcast messages—are assigned DAL B, in recognition of their integrity-related criticality. Conversely, functions related to data collection and non-critical dissemination generally carry a DAL C assignment in Europe, reflecting their continuity focus.

Emitted SBAS Signal Monitoring

For any safety-critical system intended for safety-of-life applications, the following principle remains salient: Wherever possible, the SBAS system should internally monitor its own transmitted signal, permitting real-time awareness of failures (primarily those in the dissemination chain) and take adequate actions instead of relying on open-loop operation. While not a formal requirement provided other safety principles (in particular the SPOF principle) are observed, this best practice is inherent to the present concept.

Implementation of Safety Principles in Operational European SBAS EGNOS V2

These foundational safety principles are stringently applied in the operational European EGNOS system, with their fulfillment evidenced across the following major functions:

Data Collection: EGNOS V2 employs physically and logically separated RIMS A and B chains, both developed according to DAL C1.

• Augmentation Message Calculation and Integrity Checking: The Central Processing Facility (CPF), assigned DAL B1, comprises two independent units fed by independent data: the PS fed by RIMS-A and the CS fed by RIMS-B. In accordance with [22], the PS is allocated DAL C1 and the CS receives DAL B1. This dual-channel design directly supports enforcement of the SPOF principle.

• User Dissemination: The operational SBAS in Europe relies on NLES and GEO segments. Safety-critical integrity related functions—such as CPF selection and Integrity Check— are segregated and allocated DAL B. Functions that contribute primarily to continuity rather than integrity are assigned to DAL C1.

The integrity check function—which continuously verifies the fidelity of the broadcast NOF via the Integrity Box—effectively upholds the SPOF principle by precluding integrity events stemming from a single failure or corruption of the NOF within the dissemination chain. This mechanism ensures continuous monitoring of the emitted SBAS signal, empowering the system to respond appropriately in the event of any dissemination anomaly.

Complementing this capability, GEO signals as received at the RIMS, are relayed to the CPF, facilitating the prompt issuance of alarms or corrective actions whenever discrepancies are identified. Should a failure—specifically, NOF corruption—arise within the dissemination chain (in cases where the chain does not broadcast the information as instructed by the CPF), it is possible that, even if the CPF detects the anomaly and generates alarms, these messages might not be transmitted due to the compromised dissemination chain. The integrity check function is designed to address this scenario.

Compliance of the Fully Space-Based SBAS Concept with Safety Requirements

At the system level, from a safety perspective, the high-level architectural proposal is summarized in Figure 9. 

At the system level, the architecture preserves the logic of maintaining two independent channels—extending from data collection through correction computations and integrity checks. This dual-channel strategy ensures adherence to the SPOF principle at the highest level. Specifically, LFS-A is dedicated to feeding the PS, whereas LFS-B supplies the CS. The strict separation between LFS-A and LFS-B guarantees the independence of input data for each critical process. 

The correction PS, sourced from LFS-A, is entrusted with generating corrections and the associated integrity bounds. In parallel, the CS leverages independently sourced measurements from LFS-B to validate the corrections and their integrity parameters. This rigorous, independent, dual-channel design ensures a single fault or failure cannot compromise overall system integrity.

For data collection, several considerations stem from safety recommendations. Positioning GNSS data collection stations is critical for the calculations performed by the SBAS processing system. Leveraging mobile GNSS data collection stations introduces the necessity to strictly ensure the accuracy of their geospatial coordinates. To safeguard against error or bias propagation, the positioning solution for LFS stations should be established using means and data independent from those employed by the SBAS system itself. This mitigates the risk that systematic biases or errors could be inadvertently transmitted into the final positions computed by the SBAS. Solution 3 (“LFS orbits are calculated using independent means and independent measurements”) directly fulfills this requirement for independence. In addition, leveraging ISL connectivity with ranging capabilities further increases and consolidates the accuracy of LFS location estimates.

Deploying two distinct fleets—LFS-A and LFS-B—allows separation between correction computation and integrity verification channels. With their positioning, LFS-A and LFS-B will achieve substantially different observation geometries; the system hence ensures data streams used for corrections and integrity bound computations and those for integrity checks remain independent, enhancing the robustness of integrity check.

Analogously to the RIMS DAL C allocation within “terrestrial” SBAS systems—attributed for their respective contributions to continuity—the data collection function is designated a DAL C1.

With respect to data processing and integrity verification, the principle underpinning this architecture is to preserve complete independence between the PS and the CS, upholding the SPOF criterion. To this end, the PS and CS are provisioned with independent inputs from LFS-A and LFS-B respectively, each implementing diversified algorithms purposed to detect and mitigate feared events, initiate appropriate alarms when required, and compute/verify corrections and associated integrity bounds.

Drawing upon a safety monitoring principle [22] that’s applied within operational EGNOS V2, the PS is allocated DAL C1, whereas the CS receives a DAL B1 allocation. These designations impose considerable constraints on software development for the LEO satellite segment.

Both the PS and the CS are proposed under the paradigm of a “fully distributed space-based solution,” whereby the PS function (and likewise the CS function) is performed by an “active sub-pool” of LFS-A (and, correspondingly, of LFS-B). Owing to the permanent communication links established among all LFS units, any failure occurring within one of the active sub-pool LFS nodes is instantaneously propagated. This enables the swift activation and integration of a replacement LFS into the active sub-pool for a given PS/CS sub-function. Thanks to the scale of the constellation, the computational resources available to each LFS unit, and—critically—the capability afforded by the ISL that ensures all LFS nodes maintain an identical level of information, the system can exploit “hot redundancy” among LFS nodes for PS and CS sub-function. This design enhances the overall availability and continuity of the global system.

The concept’s reliance on transmitting a singular, uniquely defined NOF stream simplifies redundancy management across both user receivers and within the system’s own infrastructure.

It is noteworthy that the alternative logic of a “centralized space-based solution” is not inherently prohibitive from a safety perspective. While such an approach does introduce a central point of failure from a RAMS standpoint, this vulnerability can be mitigated by implementing robust redundancy architectures or, if needed, diversified processing chains. Such design adaptations could render the centralized solution sufficiently resilient, thereby restricting its adverse impact on system availability and continuity.

The dissemination of the NOF concept entrusts the LFS with dissemination responsibilities, diverging from the conventional reliance on GEO satellites typical of SBAS. 

Broadly, a failure within the dissemination chain may precipitate:

• A continuity event, triggered by loss of functional capability;

• An integrity event, arising from corruption of the NOF by the LFS.

In the first scenario, loss of a single LFS impacts availability and continuity, but these consequences are geographically constrained and limited to a small subset of users (in marked contrast to the loss of a GEO satellite), rendering such events generally acceptable.

Conversely, in the event of NOF corruption by an LFS, a potentially significant integrity event may ensue. Owing to the density of the LEO constellation, comprehensive real-time monitoring of all NOF transmissions from all LFS assets is unfeasible for the SBAS system. As a consequence, a single undetected failure could compromise system integrity. The safety concept herein articulated recommends users monitor at least two independent LFS sources and cease using the service if discrepancies are detected between the NOF received from these sources.

This mitigation is not considered fully satisfactory from a safety standpoint. First, it does not necessarily protect against all types of dissemination failures, such as systematic software faults affecting LFS-A, which could lead to correlated failures across seemingly independent units. Secondly, it places the burden of integrity monitoring on the user, exposing a fundamental limitation in the system’s intrinsic ability to autonomously detect and respond to dissemination failures—which is not optimal from a safety perspective.

Option-2 offers a different approach, whereby the NOF broadcast from LFS-A is subject to independent monitoring by a separate LFS-B asset, typically operating at a lower orbital altitude. In this arrangement, LFS-B would possess the authority to inhibit or terminate transmissions from LFS-A if an inconsistency or corruption in the NOF is detected. This monitoring of the LFS-A by the LFS-B would be DAL B allocated. 

Additional Safety Considerations and Way Forward

These safety considerations do not identify any fundamental showstoppers to the global SBAS concept using a fully space-based infrastructure. This concept eliminates de facto classic local ground effects such as multipath, interference, tropospheric delays, and tidal effects, improving performance. Nevertheless, several broader points must be explored: 

Applicable SBAS Regulatory Framework 

The safety reference framework and associated requirements considered are currently in force for SBAS within Europe. One major consequence of this regulatory baseline is the requirement for dual, fully independent “A” and “B” chains—most notably, the need for PS and CS functions to be separated and developed respectively to DAL C and DAL B. In particular, the imposition of DAL B on software development for LEO satellites may result in very significant development costs.

The SPOF principle for critical/hazardous events, as inherited mainly from ECSS, appears to be more stringent than those applied in the aeronautical domain. A review of [21] reveals:

• No explicit “no SPOF” criterion for hazardous failure conditions;

• No requirement that no combination of two independent system failures or operator errors should lead to catastrophic consequences (required by the ECSS). 

Notably, aeronautical standards demand the absence of SPOF only in the case of catastrophic consequences. In Europe for a SBAS, the requirement for no SPOF in critical/hazardous systems may be justified by the large number of aircraft potentially affected by any failure—a rationale that arguably holds even greater weight for a global system of this nature.

Applying the SPOF principle at the critical/hazardous level mandates the implementation of two independent chains for the CS and PS. It would be relevant to analyse this architecture and corresponding DAL allocation in light of the [24] guidelines (which are not part of the European baseline for SBAS). According to [24], if a hazardous failure condition could result from a combination of possible development errors between two items, either one should be allocated at least DAL B, or both should be assigned DAL C. This latter approach could offer a more balanced allocation of development assurance levels and potentially alleviate some of the stringent constraints currently imposed on LEO satellite software development. 

With regard to implementing the approach outlined in [24], the current concept involves exchanges between the PS and CS chains. In particular, the function responsible for generating corrections and integrity bounds is not fully duplicated across both PS and CS chains. Should the current level of independence between PS and CS be insufficient to comply with the principles set forth in [24], minor modifications to the concept could be considered. For instance, the PS functions could be integrated within the LFS-B, with dissemination of information also performed by the LFS-B (as in Option 2). In this case, two NOFs would be distributed, and a voting mechanism at the user level would help identify an erroneous NOF. However, this scenario would lack monitoring of the NOF broadcasted by the LFS-B to the user.

Identification of New Feared Events Arising from Spatialization 

Introducing “fully based” elements—specifically the implementation of ISL, using the DORIS system, and the spatialization of equipment that is traditionally ground-based in an SBAS—should lead to identifying new internal feared events to address in the system-level analysis.

Global System Considerations

The core strength, innovation and advantage of this concept lie in its potential to provide truly global coverage for integrity services. The positive implications of such an advancement would be substantial, but it’s necessary to address questions regarding responsibilities and roles among different countries, particularly given the safety-critical nature of the service on a worldwide scale.

Conclusions 

This article explores a groundbreaking shift in SBAS architecture by proposing the spatialization of its core components—data collection, augmentation message computation and dissemination—within a distributed network of LEO satellites. By moving reference stations into orbit as LFS, the system achieves global GNSS visibility, eliminates the constraints imposed by terrestrial station distribution, offers a worldwide service, and significantly enhances the accuracy and resilience of navigation augmentation data.

The architecture leverages advanced technologies like inter-satellite links and space-based distributed computing, enabling real-time data sharing, independent time scale generation, and robust integrity monitoring. The proposed partitioning of the constellation further meets stringent safety-of-life requirements, ensuring redundancy, diversity of observations, and fail-safe operations.

Simulation results demonstrate that appropriately sized LEO constellations can guarantee continuous visibility and redundancy for service availability, while the distributed processing facility uses state-of-the-art parallel algorithms to minimize communication overhead and maximize computational efficiency. While the technical feasibility is affirmed, the design must also accommodate the unique constraints of space infrastructure—including hardware resilience, energy consumption and operational safety.

Overall, this study shows that a globalized, space-based SBAS could offer transformative improvements in augmentation accuracy, reliability and scalability—paving the way for a next-generation system capable of meeting the demanding needs of civil aviation navigation on a truly worldwide scale. Future work will focus on refining the constellation design, optimizing system safety, and addressing the operational and certification challenges inherent to spaceborne navigation augmentation. 

Acknowledgment 

The authors thank Michel Monnerat for discussions regarding receiver signal processing and Celine Renazé for her useful advice and recommendations. 

References

[1] ICAO Standard and Recommended Practices (SARPs), Annex 10, Volume 1, up to Amendment 93

[2] D. Flament, J. Poumailloux, J-L. Damidaux, S. Lannelongue, J. Ventura-Traveset, P. Michel, C. Montefusco, “The EGNOS System Architecture Explained”, May 2011.

[3] User Guide for EGNOS application developers, Ed. 2.0, 15/12/2011, ISBN 978-92-79-20335-0 ESA.

[4] M. Laurenti, L. Maisonobe, P. Roldan, J. Anton, P. Guerin, S. Trilles, “Improving GNSS Navigation Messages Performance using Inter Satellite Links Technology”. Inside GNSS May/June 2024, pp 36-42

[5] Brown, K. R. (1992). The Theory of the GPS Composite Clocks, Proceedings of ION GPS-91, 11-13 September 1991, pp. 223-242.

[6] Greenhall, C. A. (2007). A Kalman filter clock ensemble algorithm that admits measurement noise: corrections and update, Metrologia, 44, 491-494, doi:10.1088/0026-1394/44/6/008

[7] Senior, K. L., & Coleman, M. J. (2017), The Next Generation GPS Time, NAVIGATION: Journal of The Institute of Navigation

[8] Roldan, P., Trilles, S., Serena, X., Tajdine, A., “Novel Composite Clock Algorithm for the Generation of Galileo Robust Timescale,” Proceedings of ION GNSS 2022, September 2022, pp. 2790-2799. https://doi.org/10.33012/2022.18521

[9] C. Renazé, C. Bourga, M. Clergeaud, J. Samson, “Reduction of system time to alert on SBAS”.  Inside GNSS, November-December 2023, pp 28-36

[10] https://ascend-horizon.eu/

[11] https://www.thalesaleniaspace.com/en/press-releases/thales-alenia-space-reveals-results-ascend-feasibility-study-space-data-centers-0

[12] G. Hager and G. Wellein, “Introduction to High Performance Computing for Scientists and Engineers”, CRC Press, 2011.

[13] P. Pacheco and M. Malensek, “An Introduction to Parallel Programming”, 2nd Edition, Morgan Kaufmann, 2021.

[14] J. Demmel, L. Grigori, M. F. Hoemmen, and J. Langou, “Communication-optimal parallel and sequential QR and LU factorizations”, SIAM Journal on Scientific Computing, Vol. 34, 1, pp. A206-A239, 2012, https://doi.org/10.1137/080731992

[15] Å. Björck, “Numerical Methods for Least Squares Problems”, 2nd Edition, SIAM, 2024.

[16] G. H. Golub and C. F. Van Loan, “Matrix Computations”, 4th Edition, Johns Hopkins University Press, 2013.

[17] M. F. Hoemmen, “Communication-avoiding Krylov subspace methods”, PhD thesis, University of California at Berkeley, 2010.

[18] E. Agullo, C. Coti, J. Dongarra, T. Hérault and J. Langou, “QR factorization of tall and skinny matrices in a grid computing environment,” 2010 IEEE International Symposium on Parallel & Distributed Processing (IPDPS), Atlanta, GA, USA, 2010, pp. 1-11,  https://doi.org/10.1109/IPDPS.2010.5470475.

[19] G. Ballard, J. Demmel, L. Grigori, M. Jacquelin, N. Knight, H.D. Nguyen, “Reconstructing Householder vectors from Tall-Skinny QR”, Journal of Parallel and Distributed Computing, Volume 85, pp. 3-31, 2015. https://doi.org/10.1016/j.jpdc.2015.06.003.

[20] J. Dongarra, L. Grigori and N. Higham, “Numerical algorithms for high-performance computational science”, Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences, 378(21666), 2020. https://doi.org/10.1098/rsta.2019.0066

[21] CS-25 – European Union Aviation Safety Agency Certification Specification for Large Aeroplanes.

[22] ED-12B/DO-178B – Software Considerations in Airborne Systems and Equipment Certification

[23] ED-109A/DO-278A Software Integrity Assurance Considerations for Communication, Navigation, Surveillance and Air Traffic Management (CNS/ATM) Systems

[24] ARP4754B – Guidelines for Development of Civil Aircraft and Systems

Authors

Sébastien Trilles is an expert in navigation algorithms and performances. He received his Ph.D. degree in Pure Mathematics from the Paul Sabatier University and an Advanced M.S.in Space Technology from ISAE-SUPAERO. He heads the Performance and Processing Department where high precise navigation algorithms are designed as orbitography, system reference time generation, clock synchronization and time transfer, integrity and ionosphere modeling.

Thierry Authié is a specialist in navigation algorithms at the Performance and Processing Department of Navigation Domain, Thales Alenia Space. He received his M.S in Applied Mathematics from the Institut National des Sciences Appliquées (INSA), Toulouse (France). He currently works as navigation specialist in Advanced Projects.

Xavier Vasseur is a specialist in scientific computing at the Performance and Processing Department of Navigation Domain, Thales Alenia Space. He received his M.Sc degree from Ecole Centrale de Nantes (France) and his Ph. D. degree in Computational Fluid Dynamics from University of Nantes.

Marie Abbal is safety manager of Advanced Projects in Navigation Domain. She received her M.Sc degree from Ecole des Mines de Paris. She worked from 2009 to 2016 at Electricité de France company (EDF), particularly in nuclear safety. She joined Thales Alenia Space in 2016 as a safety specialist in complex and critical space system

The post The Case for Spatializing Global SBAS appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

“How was the weather up there?” my friend asked.

I had just finished chairing the last session of the 2026 Munich Space Summit. The final question from the audience was in the nature of “why don’t we have a terrestrial system across most of the globe to back up GNSS and make the world safer?”

That triggered my “preacher mode.” I had mounted my soap box (hence the question about the weather up there) and given a version of my favorite sermon:

“Water and electricity are essential utilities. Today, PNT is also an essential utility, but it is invisible to almost everyone. This invisibility, especially among political leaders and other decision 
makers, is a big obstacle to implementing complementary and backup systems for GNSS. Folks here at the summit are respected experts. You have a duty to share your knowledge and understanding with others, especially national governments. Go forth and tell the story.”

It was very much like the message I offered in 2017, but, nine years later, was a bit more urgent. While the West has seen some movement toward greater resilience since then, one wonders if it is commensurate with the increases in obvious threats and risks.

By the way, to answer my friend’s question—the weather on top of my soapbox usually seems clear. But there is always a chance of rant.

Munich 2017: Admitting a Solvable Problem

The 2026 event was my second time at the Munich summit. The first was in 2017. That year’s theme was “GNSS—Time for a Backup?”

Spoiler alert: The resounding answer from all was “yes!”

I was privileged to chair a distinguished panel asked to discuss the summit’s theme question. The “set up” in the program was:

The Challenge: GNSS has been described as “…a single point of failure for critical infrastructure.” Free and available anywhere with a view of the sky, GNSS timing and location signals have been incorporated into virtually every technology. GNSS service disruptions are caused by natural events, accidents and equipment malfunctions. Malicious acts by nation states, terrorists, organized crime, and “privacy seekers” are a widespread and increasing problem. Many nations are considering establishing terrestrial PNT systems to complement GNSS, or encouraging industry to establish such systems as a partly commercial enterprise. Members of the panel will be asked to describe desirable characteristics of such systems.

Definitions: For the purpose of this panel, “Backup” will be understood to mean one or more PNT systems to complement GNSS services. Complementary systems continuously operate alongside and seamlessly with GNSS and can be integrated in the same timing and navigation receivers.

While it was nine long years ago, the set up and panelists’ observations seem as on point today as they were then. Here is what the experts said nine years ago:

• Dominic Hayes (European Commission) discussed a project that at that point had collected the electronic signatures of over 100,000 jammers in Europe. He called for a comprehensive approach and said more than one complementary system would likely be needed if everyone was to be protected.

• Gian-Gherardo Calini (European GNSS Agency) agreed that more than one backup was needed and urged users to protect themselves.

• Francis Zachariae (IALA) asked who was responsible for protecting GNSS services. He opined that a big obstacle to progress was that we have not had a major failure event. 

• Tony Flavin (Chronos) agreed the lack of a major failure had led to complacency. Also, using multiple GNSS did not provide much protection as most jammers hit all the systems simultaneously.

• Guy Buesnel (Spirent) discussed how spoofing was getting easier and cheaper, and that users need a warning when GNSS is not reliable. He also said spoofing and jamming were impacting aviation safety and operations.

• Professor Per Hoeg (Technical Institute of Denmark) cautioned that not all threat vectors were malicious. Solar activity can also profoundly impact GNSS signals.

• John Fischer (Orolia-Spectracom) discussed the importance of networks and the danger of over-dependence on space-based timing for synchronization.

• Harold “Stormy” Martin (U.S. National Coordination Office) said the U.S. President directed action on a GPS backup in 2004 and Congress had recently reinforced the need. His government was developing system requirements. It was long past time for a backup, he said.

Side discussions (often the most productive at such events) focused on technical mitigations and solutions. Galileo’s Public Regulated Service (PRS) service, ideas for low Earth Orbit (LEO) PNT, and terrestrial systems.

One attendee, Reelektronika’s Durk Van Willigen, even showed off an integrated GNSS/eLoran/Chayka receiver only 6 cm long. His company had developed it to meet what they saw as an emerging need.

The mood at and coming out of Munich 2017 was one of concern and expectation. The issues were clear and well understood. Yet, this was a solvable problem. Importantly, leadership in the European Union (EU) and U.S. were working on it. 

Munich 2026: “How Do We Get There?”

Concerns expressed in 2017 were well represented and amplified at this year’s Munich Space Summit. Mentions of jamming, spoofing and other interference were ubiquitous and almost offhand. In 2026, disruption is no longer unusual. It is a normal part of the environment.

Yet, the agenda did not address the question of whether one or more complementary systems were needed to protect GNSS and users. It was an assumption in nearly every panel, every presentation, and every comment. 

Panel topics included phrases like “resilient navigation, “multi-layer PNT” and “multi-faceted PNT.” Difficult times and the need for trust were regularly mentioned.

And, in a surprising parallel to 2017, an attendee at the event’s grand evening reception had his newest micro receiver with him to show around. Trevor Landon gave me a look at the new Iridium ASIC. 

Recognition of the need for complements and alternatives to GNSS was universal. There was less agreement on which systems should be implemented.

But this was to be expected. Many, if not most, attendees have already decided on their favorite system. They’ve dedicated years of effort to developing and understanding their technology, have a substantial financial interest in its success, or both. And the systems discussed were overwhelmingly space-based or space-dependent. Which made perfect sense. It was the Munich Space Summit, after all. 

Progress Since 2017

The last day, last panel, and last question of the summit was why, nine years later, we have not done more about complementing and backing up GNSS. 

For the previous two and a half days, incredibly intelligent and capable people had affirmed the need and demonstrated that a wealth of solutions are available. 

Private and government studies in the West have shown the value of combining signals from space, terrestrial broadcast, and fiber-based timing. This “resilient triad” can create a national PNT architecture that is very difficult to disrupt. Extant systems in China, Russia, South Korea, and elsewhere are exemplars of what’s possible.

Many rightly question why the West hasn’t made more of a start. In fairness, some projects are underway, and others are emerging.

The EU is exploring LEO PNT and launched the first two Celeste satellites the day after the summit closed. U.S. companies Xona Space Systems and TrustPoint have made their business cases and are in the early stages of building their constellations. 

Scandinavia is building out a fiber timing network connecting Sweden, Finland and Norway. There are papers and proposals for the EU to do the same thing on the continent.

Baltic nations have extensively tested R-mode for maritime. The European Aviation Safety Agency has issued an action that suggests examining additional navigation sources, though such a study would be done in the distant future.

More proactively, the United Kingdom is the first Western nation that’s committed to establishing a coherent and integrated resilient PNT triad. A fiber timing network with three centers spread across Britain is being implemented. It will feed users directly and support a terrestrial broadcast eLoran network that will serve the entire nation and most of the North Sea. The UK government is also investing in LEO PNT. 

While less public about its plans, France has recently joined the UK in its eLoran project. Depending on the scope of the French effort, the two systems could provide high-power terrestrial broadcast time to most of Western Europe. This signal at 100kHz would presumably complement France’s existing 162kHz time signal. Also, the Paris Observatory has been forward leaning on international time synchronization over fiber. It has established synchronizing optical fiber links with laboratories in the United Kingdom, Italy and Germany.

But Is It Enough?

One can rightly ask if enough has been done in enough places. 

Has Europe progressed far enough and in enough ways to mitigate the risk of daily minor disruptions and the much greater risk of PNT denial in struggles between major powers?

And what of the inter-dependent world writ large? 

Major economies in the United States, Japan, India, Brazil, Canada, Australia, and Mexico seem to still be overwhelmingly dependent on highly vulnerable signals from space. For smaller economies, the idea of sovereign, resilient PNT to complement GNSS may not even be a “someday” vision.

Yet, there are very, very few among the world’s eight billion people who don’t depend on uninterrupted PNT service in their daily lives. For many, the possibility of a major GNSS disruption is an invisible sword of Damocles.

And let’s all remember, as those who understand the issues, our duty to speak up and share our knowledge and concern. Too often I hear that such issues are “above my paygrade.” If your boss doesn’t know the problem and isn’t concerned and involved, then this issue is exactly at your pay grade. You have a duty to speak out.

Let’s strive to ensure the next nine years see more progress instituting widely adopted resilient PNT than we saw in the last nine. We owe it to ourselves and the world we serve.

OK, now the weather atop the soap box seems like it is turning to rant. So, as they say in church, here endeth the sermon. Go in peace. 

The post Munich 9 Years On: Same Message, More Urgency appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Attacks on GNSS are no longer simply a nuisance or a trivial disruption we can afford to ignore. Spoofing and jamming have become increasingly widespread, driving economic losses and costing lives, both in military operations and in civilian settings. Now, more than ever, we need to look closely at backup and complementary solutions that can fill the voids when GNSS falls short.

I recognize this may come across as cliché; however, in this case, it is not. The threat is real. The urgency is real. And the consequences of inaction are becoming harder to ignore.

Low Earth orbit, or LEO, positioning, navigation and timing (PNT) may be one of the most important answers. Commercial companies are creating mega-constellations to harness the many advantages of LEO, and it has become clear that LEO satellites could play a major role in future PNT architectures. In some applications, LEO could complement GNSS. In others, it may provide a space-based alternative when GNSS is degraded, manipulated or denied altogether. There is a lot of interest and excitement around LEO in the industry, and for good reason. It is an emerging area that many of us are studying with intensity and enthusiasm. But there are different schools of thought on how best to leverage LEO PNT, and the path forward comes with its own technical, operational, commercial and regulatory challenges.

That is why this column is born and will exist in every edition. 

Inside LEO will explore how LEO systems are reshaping PNT, communications, resilience and the broader architecture of space based services. LEO is not just another orbit. It changes the signal environment, the economics, the business model and, potentially, the way users think about trust in PNT.

But let’s be clear: LEO PNT is not a new, revolutionary concept. In fact, the first satellite navigation system, Transit, was a LEO system developed in the 1960s. Through Transit, we learned that LEO PNT is both a blessing and a curse.

It is a blessing because of speed, geometry and signal strength. LEO satellites are closer to Earth and move quickly across the sky. Those characteristics can be extremely useful for navigation. But LEO is also a curse because it requires a large number of satellites to provide persistent, useful coverage. During the Transit era, users often had to wait an hour or more to get a position fix. That was not exactly ideal then, and it is certainly not acceptable for the world we live in today.

To address the LEO curse, we needed a very large number of satellites, which was not feasible given launch capabilities in the 1960s. That is why GPS quickly became the dominant PNT system. A medium Earth orbit (MEO) architecture, where GPS operates, achieves comparable performance with an order-of-magnitude fewer satellites than would be needed in LEO. GPS’s design mitigated the problem of slow position fixes while still delivering high accuracy and continuous global coverage. Yes, GPS had limitations, particularly in urban canyons and indoors, but those were limitations users could often live with or augment using localized sensors.

For decades, GPS and then GNSS were enough for many applications.

In an ideal world, it might have stayed that way. But times have changed. GNSS alone is no longer enough.

The Emergence of LEO PNT

Two things happened simultaneously and independently: the rapid development of autonomous systems and continuous, escalating attacks on GNSS. Autonomous platforms exposed the limits of GPS alone in safety critical, dynamic environments. At the same time, spoofing and jamming became easier, more accessible and more prevalent, both in military theaters and in civilian life.

The PNT community realized something had to change. The search for complementary and backup solutions became urgent. LEO PNT emerged as one of the most intriguing options.

Although satellites started to launch into LEO in significant numbers in the late 1990s, interest in LEO PNT did not really accelerate until around 2017 or 2018. That was when Starlink announced plans to put nearly 12,000 satellites into LEO. This was significant because, at the time, there were not even close to 12,000 satellites in all of LEO combined.

Many people thought that target number was wishful thinking. I took it seriously and started studying LEO PNT with existing constellations [1].

My lab started with Orbcomm satellites and developed the simultaneous tracking and navigation (STAN) approach to address their poorly known signal, ephemerides and timing [2, 3]. In 2018, we conducted the first post-Transit LEO PNT experimental demonstration with non-cooperative satellites, where we navigated an unmanned aerial vehicle (UAV) by exploiting Orbcomm LEO signals of opportunity. We experienced first hand experimentally the curse that had plagued LEO in the past. Our navigation solution began to degrade after about 30 seconds (Figure 1) [4]. We also drove a vehicle in Southern California for a few kilometers. The errors were on the order of hundreds of meters (Figure 2) [1].

So, yes, LEO can give you a navigation solution. But with sparse constellations and limited observability, it is not necessarily accurate enough for many modern applications. That changes when you add satellites. Many satellites (Figure 3).

When there are thousands of satellites in LEO, the geometry, availability and signal opportunities begin to change dramatically (Figure 4). You start to get performance that can become comparable to GNSS in certain respects and potentially superior in others. That is what makes mega constellations a game changer for LEO PNT.

Right now, GNSS is the only truly global sensor. LiDAR, vision and radar are powerful, but they are proximity sensors. They can help keep you from colliding with a car or a building, but they do not readily place you directly in a global reference frame. They also do not work equally well in every environment. If you are in an aircraft at 38,000 feet or flying over an ocean with no features, how much can vision help you? If you are operating in a feature poor, denied or degraded environment, what sensor gives you global context?

That is the promise of space based PNT. And LEO, if we learn how to use it properly, can provide a new and powerful layer in that architecture.

The Reason LEO is so Compelling Starts with Physics

LEO satellites are much closer to Earth than GNSS satellites in MEO. Because they are closer, their signals are generally received at higher power. That matters. Higher received power can make a signal more useful and more resilient, particularly in difficult environments.

LEO satellites also move much faster across the sky than GNSS satellites. This faster motion means Doppler becomes highly informative for positioning and navigation. With GPS, Doppler can be useful, but the system is primarily built around pseudorange and carrier phase. With LEO, the fast motion of the satellite itself becomes a major source of navigation information.

Then there is bandwidth. Some LEO communication signals are much wider than traditional civilian GNSS signals. Wider bandwidth can provide better resolution and more precise time estimation. When higher bandwidth is combined with higher received power, fast satellite motion and large numbers of satellites, the PNT opportunity becomes very interesting.

LEO also changes the frequency picture. GNSS is concentrated in the L band. LEO systems operate across a much more diverse set of frequencies. Some are in VHF. Some are in L band. Some are in C band. Many are in Ku and Ka band. This matters because frequency diversity can contribute to resilience. If we limit ourselves to one band, we leave one of LEO’s great advantages on the table.

This is an important point. Many people involved in LEO PNT also worked on GNSS, and there is a natural tendency to duplicate as much of the GNSS model as possible while fixing the most obvious shortcomings. I understand that instinct. But if we are starting fresh, why limit ourselves to one band? Why ignore the signal diversity that LEO offers?

Which band is best? That is hard to say. Some companies favor C band. Others favor L band because it allows users to leverage GNSS antenna infrastructure. Ku and Ka band systems are seeing enormous growth because so many broadband satellites operate there. Whether you like those bands or not, they are going to be a force to be reckoned with.

That is the beauty of LEO. It gives us options. It gives us signal diversity. It gives us Doppler. It gives us stronger signals. It gives us large numbers of satellites. And, used intelligently, it can provide a much needed layer of resilience.

But LEO PNT is not one thing. That is where the taxonomy matters.

The Various Schools of Thought

There are several schools of thought on how LEO should be used for PNT: dedicated, dual purpose, augmented and opportunistic.

The first is dedicated LEO PNT. These are constellations designed specifically to provide PNT from low Earth orbit. Companies such as TrustPoint and Xona are examples. Their systems are built around navigation as the primary mission. This approach has the advantage of intentional design. The signals, payloads, constellation architecture and user equipment can be optimized for PNT. The challenge is scale, adoption, service continuity and the need to build an ecosystem from the ground up.

The second model is dual purpose LEO PNT. In this approach, PNT is paired with another primary service, such as communications. A satellite may be transmitting a communication signal that can also support positioning, navigation or timing. Iridium and Globalstar are examples of constellations that dual-purposed their satellites for PNT. Starlink and Amazon LEO appear to be headed that way. The attraction is obvious: If the satellite infrastructure is already being deployed for communications, perhaps PNT can ride along. The challenge is the signal, business model and operational priorities may not be designed for PNT users first.

The third model is augmented LEO PNT, where LEO is not necessarily a standalone replacement for GNSS. It is part of a multilayer architecture that works with GNSS and other PNT sources. This is where Europe is headed with Celeste, an in orbit demonstrator mission that will feature an 11 satellite constellation. Celeste helps when she can, but she is not positioned as a full standalone global replacement for GNSS. This model may be especially important because the future is unlikely to be one system replacing another. It is more likely to be layered, hybrid and context dependent.

The fourth model is opportunistic LEO PNT. This is the broadest and, in some ways, the most interesting category. Opportunistic PNT can include dedicated, dual purpose or augmented systems, but it can also include signals that were never designed for PNT at all. A communications satellite constellation may not transmit anything intended for navigation, but its signals can still be leveraged for positioning and timing if we know how to use them. Starlink and OneWeb are examples often studied in this context.

A New Way of Thinking About PNT

The shift to LEO also introduces complications GNSS users are not accustomed to thinking about. GPS is a government system. It is offered as a free service. It is mature, open, globally integrated and deeply embedded into receivers, systems, standards, operations and user expectations. GPS is also self contained. A user can wake up a receiver and obtain the information needed to use the constellation. LEO is a different ball game.

Many LEO PNT approaches are commercial or non governmental. That changes the landscape from the user’s point of view. What happens if your subscription lapses? What guarantees do you have that the company providing your PNT service will still exist in five years? What if it is acquired? What if prices rise? What if the service changes? What service level commitments are available? What happens in safety critical applications? How will spectrum licensing work? What does signal access look like? How will standards and interoperability evolve?

These are not side issues. They are central to the future of LEO PNT.

The transition from government provided GNSS to commercial or hybrid LEO services is not only a technical shift. It is an institutional shift. Users who have spent decades relying on open GNSS signals will now have to think about contracts, subscriptions, service guarantees, business continuity, liability, receiver access and long term trust.

Commercial LEO PNT remains a compelling and necessary part of the future PNT landscape. But the industry must be clear-eyed about what changes when PNT becomes part of a commercial service architecture.

Where Will LEO PNT be Used First?

It will first be leveraged where the loss of GNSS hurts the most. Defense, safety-of-life and mission critical applications will be major drivers of adoption, although some sectors, such as aviation, will be difficult to change because of certification, regulation and long equipment cycles.

Drones represent lower hanging fruit. They are critical systems, but they can be adapted more quickly than legacy aviation systems. The market is still developing. Many platforms and operational models are still being built. I expect to see meaningful adoption there, and not just in small drones. Larger unmanned aircraft will also begin leveraging LEO PNT. Some defense applications are already moving in this direction, and that will rapidly grow.

Maritime is another important area. It is heavily regulated, but the need is clear. GNSS interference at sea is already a serious problem, and maritime users need resilient alternatives that can support navigation, timing and situational awareness.

The next wave will likely include autonomous systems and self driving vehicles, although I do not see automotive adoption as immediate. The need will grow as autonomy matures and as platforms require resilient global positioning beyond what proximity sensors can provide.

Eventually, LEO PNT will be integrated into smartphones. There will also be a major push through 6G to make positioning and communications more deeply intertwined. That convergence is coming, and LEO will be part of it.

Regardless of how adoption unfolds, the need is clear. GNSS jamming and spoofing are becoming more sophisticated and more prevalent in Ukraine, the Middle East and other regions. Organized crime and other nefarious actors are capitalizing on GNSS vulnerabilities in the civilian world. Unintentional interference is also a growing problem. Lives are being lost. Damage is being done. And the situation will only get worse if we do not act.

Autonomous systems first forced the PNT community to confront the limitations of GNSS alone. Jamming, spoofing and interference then exposed vulnerabilities that can no longer be treated as rare exceptions. We need complementary systems. We need backups. We need resilience. We need architectures that do not fail catastrophically when GNSS is denied or manipulated.

Why LEO, Why Now 

LEO has been born again at the right moment. The surge in satellites has made LEO an attractive option for space based PNT. The signals are stronger. The satellites move faster. The bandwidths can be much wider. The frequencies are more diverse. The number of potential signals is growing dramatically. And unlike terrestrial alternatives, LEO has the potential to provide broad, space based coverage that can complement GNSS at scale.

The question is simple: We have mega constellations in LEO. Why not use them?

LEO PNT is an emerging area, and it is changing constantly. Inside LEO will help readers understand what is real, what is hype, what is technically possible and what still needs to be solved. In future columns, I will dive deeper into LEO fundamentals, deployment models, the current state of LEO, user demand, operational adoption, signal design, standards, interoperability and the future of resilient PNT.

GNSS transformed the world. But the world GNSS helped create now demands more than GNSS alone can provide.

That is why LEO matters. And that is why we need to understand it now. 

References

(1) Z. Kassas, J. Morales, and J. Khalife, “New-age satellite-based navigation—STAN: simultaneous tracking and navigation with LEO satellite signals,” Inside GNSS Magazine, Vol. 14, Issue 4, Aug. 2019, pp. 56-65.

(2) J. Khalife and Z. Kassas, “Receiver design for Doppler positioning with LEO satellites,” Proceedings of IEEE International Conference on Acoustics, Speech, and Signal Processing, 2019, pp. 5506-5510.

(3) J. Morales, J. Khalife, and Z. Kassas, “Simultaneous tracking of Orbcomm LEO satellites and inertial navigation system aiding using Doppler measurements,” Proceedings of IEEE Vehicular Technology Conference, 2019, pp. 1-6.

(4) J. Morales, J. Khalife, A. Abdallah, C. Ardito, and Z. Kassas, “Inertial navigation system aiding with Orbcomm LEO satellite Doppler measurements,” Proceedings of ION GNSS+ Conference, 2018, pp. 2718-2725.

ZAHER (ZAK) M. KASSAS is a global leader in resilient and alternative PNT. He is the TRC Endowed Chair in Intelligent Transportation Systems and a Professor at The Ohio State University. He is the Director of the U.S. Department of Transportation Center for Automated Vehicle Research with Multimodal AssurEd Navigation (CARMEN+) and Director of the Autonomous Systems Perception, Intelligence & Navigation (ASPIN) Lab. A Fellow of IEEE and ION, he has authored over 200 publications and holds multiple patents. He was awarded by President Biden the Presidential Early Career Award for Scientists and Engineers (PECASE), the highest honor bestowed by the U.S. government on outstanding scientists and engineers; the IEEE AESS Richard Kershner Award for pioneering contributions to the theory and practice of PNT with terrestrial and non-terrestrial signals of opportunity; and more than 60 scientific and governmental awards. He was ranked as the top scholar globally in the field of Navigation. His research has attracted more than $28 million in competitive grants; has been featured in dozens of international media outlets; and has shaped government programs, policies and investments.

The post Inside LEO: LEO PNT – Why Now? appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Twenty years on, Galileo stands as both a major European achievement and a hard-won lesson in what it takes to build sovereign, resilient and globally relevant navigation infrastructure. Hein will examine the decisions, compromises and challenges that shaped the system, offering readers a rare behind-the-scenes perspective on Europe’s strategic choice to move from dependence to capability—and why that story still matters now.

Highs and lows in the development of the European Satellite Navigation System, Galileo. 

For much of the late 20th century, the world had access to only one fully operational global satellite navigation system: the United States’ Global Positioning System (GPS). Conceived in the 1970s as a military asset and declared fully operational in 1995, GPS had by the mid-1990s become indispensable to civilian users worldwide—from pilots and ship captains to farmers, surveyors and ordinary motorists. Yet, beneath the convenience of free, open signals lay a profound strategic vulnerability: GPS was owned, operated and controlled exclusively by the United States Department of Defense (DoD). Washington could, in principle, degrade or deny the signal at will.

This dependency troubled European policymakers and military planners throughout the 1990s. The concern was not merely theoretical. During the Gulf War of 1991, the United States deliberately degraded GPS accuracy through a technique known as Selective Availability, limiting civilian precision to roughly 100 meters. Although Selective Availability was switched off in May 2000, the capability to reinstate it remained. European governments, aerospace industries, and transport authorities recognized that building critical infrastructure—aviation, rail, maritime, precision agriculture, financial timing networks—on a foreign-controlled system was a risk that strategic autonomy could not tolerate.

Early Studies and the Political Will to Act

European interest in an independent navigation capability had simmered since the 1980s. The European Space Agency (ESA) had developed NAVSAT and GRANAS concept studies, and various national programs explored augmentation systems. A concrete step came with the European Geostationary Navigation Overlay Service (EGNOS), developed jointly by ESA, the European Commission (EC), and Eurocontrol from the mid-1990s. EGNOS, which became operational in 2009, could improve GPS accuracy and provide integrity signals for safety-critical applications, but it remained dependent on the underlying GPS constellation. It was a patch, not a solution.

The decisive political turn came in the second half of the 1990s. The European Commission’s 1999 communication, “Galileo: Involving Europe in a New Generation of Satellite Navigation Services,” laid out the case openly: Europe needed its own system, civilian-controlled and commercially oriented, interoperable with GPS but independent of it. The name Galileo, a tribute to Galileo Galilei, an Italian astronomer who made foundational contributions to the science of motion and observation, was chosen to signal both scientific heritage and a new era of European technological ambition. (I believe Kepler would have been the better name. But politics had decided, not technology!)

The Early Days of Galileo: 1999-2000 Political Launch and National Ambitions

The story of Galileo’s political birth is, in many respects, the story of a European pilgrimage. This was the first generated “income” of Galileo: however, not for the space system but for the Galileo Travel Agency! In 1999 and 2000, delegations, lobbyists, industry representatives, and national officials from across the continent converged on Brussels with a shared ambition but—as would quickly become apparent—with rather different ideas about what that ambition should deliver. The atmosphere was one of excitement tinged with opportunism: here was a major program taking shape, and every stakeholder wanted a seat at the table. 

The process generated what insiders sometimes called national “wish lists”—catalogues of desired outcomes, preferred industrial workshares, and projected economic benefits that each member state hoped to extract from the new system. These lists were gathered under various headings and studies. The Galileo Overall Architecture Definition (GALA) study was among the most prominent. GALA was intended to define the overall system architecture, but it also became a vehicle through which competing national interests were channelled into the technical debate. The result was a negotiating process as much as an engineering one.

The official justifications advanced for building Galileo were numerous and, on close inspection, of uneven quality. Safety of life, employment creation, industrial spin-offs, enhanced road and rail navigation, search and rescue improvements, integrity, public-private partnership—all were cited, sometimes with statistics that did not survive scrutiny. Several of the arguments were, frankly, either misconceived or greatly exaggerated, and those with a critical eye could see the economic forecasts in particular owed more to political necessity than to rigorous analysis. The need to justify a multi-billion-euro public investment demanded a compelling narrative, and not every element of that narrative was equally well-founded.

Beneath the rhetoric, however, two motivations stood out as genuinely sound. The first was the desire to break the GPS monopoly. At the turn of the millennium, the entire world depended on a single navigation system owned and operated by the United States DoD. The vulnerabilities this created—strategic, commercial and operational—were real, and no amount of goodwill between allies could fully substitute for an independent capability. The second motivation was equally clear-eyed: Galileo was to be Europe’s ticket into the front rank of high-technology infrastructure. Satellite navigation was not merely a useful service; it was becoming the invisible foundation of the digital economy, and Europe’s long-term competitiveness depended on being a provider rather than merely a user of that foundation. These two reasons, strategic independence and technological leadership, were, in the end, the ones that mattered, and they were sufficient.

An American colleague told me: “I thank Europe for the decision to build up its own satellite navigation system: This was the best investment in GPS. We have never seen so many improvements in GPS after a while of stagnation.”

The Lisbon Treaty and European Space Governance

Before continuing the discussion about the early days of Galileo, I must mention an important political move of the European Union (EU) and its Member States. The Lisbon Treaty, which entered into force in December 2009, marked a turning point in European space governance by providing, for the first time, an explicit legal basis for space activities at the Union level. The key instrument is Article 189 of the Treaty on the Functioning of the European Union (TFEU), which authorizes the EU to develop a European Space Policy aimed at promoting scientific and technological progress, strengthening industrial competitiveness, and supporting the implementation of broader Union policies.

On this basis, the EU may establish a European Space Programme and adopt the necessary legislative measures (regulations, directives and decisions) through the ordinary legislative procedure. In terms of the division of competences, however, space occupies a carefully circumscribed position. Although it falls within the category of shared competences, it is in practice treated as a “support or coordination competence.” The Treaty explicitly prohibits the harmonization of national laws and regulations, preserving the legislative autonomy of Member States in the field.

The Treaty recognizes the security and defense dimensions inherent in space activities. Because space infrastructure is frequently dual-use in nature, serving both civilian and military purposes, the Treaty permits, and in certain respects requires, the EU to address these dimensions as part of a comprehensive space policy. This provision has taken on growing practical significance as Europe’s dependence on space-based services for defense, border management, and crisis response has deepened.

Finally, the Treaty also mandates that the Union establish appropriate relations with the ESA, acknowledging ESA’s longstanding role as Europe’s principal space organization and the need for coherent institutional cooperation between the two bodies.

The Treaty also codifies, at least implicitly (and theoretically), a division of labor between the EU and ESA that has evolved over decades of institutional practice. The EU concentrates on space policy, program funding, and the demand side of the equation, defining what services are needed and ensuring they are delivered to users. ESA, by contrast, remains primarily responsible for the supply side: the engineering, infrastructure, and technical development that make those services possible. The two organizations should be complementary rather than competing.

My impression is the ESA underestimated the implications that were arising over the following years and remained silent. At first glance, it seems quite natural for the EU to be responsible for space policy, taking up the needs of the European community and preparing funding for space activities, while the ESA takes responsibility for technical realization. Unfortunately, the boundary between their respective roles has not always been free of friction and has led many people to a perceived disempowerment of ESA in some directories. I will later come back in detail what is meant with this statement.

One of the Treaty’s most consequential constraints is precisely what it does not permit. The EU has no power to impose harmonized space regulations on its Member States: national space law remains firmly within the sovereign remit of each country. This limitation reflects the broader constitutional settlement of the Lisbon Treaty, which sought to expand Union competence in space while simultaneously protecting the regulatory independence of member governments. The practical effect is a patchwork of national licensing regimes and liability frameworks sitting alongside, but not superseded by, European-level policy. In fact, one can still observe space activities in the Member States, which are duplicating efforts of the EC or even competing by building up similar satellite navigation or satellite communication systems.

Since 2009, the EU’s engagement with space has also acquired a markedly more security-oriented character. The dual-use nature of space infrastructure—navigation, Earth observation, and satellite communications all serving both civilian and defense purposes—has increasingly drawn space policy into the orbit of broader strategic autonomy debates. Protecting European space assets from jamming, spoofing, cyber intrusion, and anti-satellite threats has moved from the margins to the mainstream of EU space thinking, reflecting a wider recognition that space is no longer a benign domain but a contested one in which Europe’s ability to act independently depends on the resilience and security of its own infrastructure.

According to its convention, the ESA is limited to “exclusively peaceful purposes.” However, under pressure from the EU, this term has increasingly been interpreted to also allow for “defensive” military aspects (e.g., surveillance or encrypted communications).

The Decision to Build Galileo

The formal decision to proceed with Galileo was taken by the European Council in March 2002, when EU transport ministers gave their approval for the development and deployment phase of the system. This followed years of preparatory studies, feasibility assessments, and political negotiation, and it represented a definitive commitment by the Union to invest in an independent satellite navigation capability. The EC and the ESA were tasked with jointly overseeing the program, with ESA taking the lead on the technical and procurement side while the EC held overall political authority. A dedicated management structure, the Galileo Joint Undertaking, was established in 2002 to coordinate the two institutions and to manage the program’s early phases.

Costs and Funding

The original cost estimates for Galileo were, in retrospect, optimistic. The development and in-orbit validation phase was initially budgeted at approximately €1.1 billion, with overall deployment costs for the full constellation estimated at around €3.2 billion. These figures reflected the assumptions of the early 2000s, including the expectation that a substantial share of the funding would come from private industry through a public-private partnership (PPP) model. Under this model, a private concession holder was to operate the system commercially and recover costs through service revenues, with public funds covering only a portion of the investment.

I live in a town south of Munich. At the same time as the Galileo decision, a family-owned pharmaceutical company that produced generic medical drugs and had about 100 employees was sold to a multinational medical company for more than 6 billion Euro—just two Galileo systems (cost assumption early 2000s)!

Civil Control, Military Reality and the Question of Dual Use

One of the most deliberate and politically significant design choices made for Galileo was the insistence that it be a civilian system under civilian control. This was not merely a technical or administrative detail; it was a statement of principle, and it was intended to distinguish Galileo fundamentally from GPS. The United States’ system had been conceived as a military asset, and its civilian use, however widespread, remained conditional on the goodwill of the U.S. DoD. Galileo, by contrast, was to be governed by the EC, a civilian institution, and its primary purpose was defined in terms of civilian applications: transport, agriculture, timing, search and rescue, and commercial services.

This civilian identity was not, however, synonymous with exclusion of the military. European policymakers were candid from the outset that defense and security forces would be entitled to use Galileo signals, including the encrypted Public Regulated Service (PRS) reserved for government-authorized users. The formulation that became standard in policy documents was straightforward: Galileo is a civil system under civil control, and the military may use it. This formula allowed Europe to maintain its civilian branding while acknowledging the inescapable reality that any global navigation system is of strategic value, and that European armed forces and security agencies would naturally make use of a European system. 

What happens to the civil control of Galileo in times of crisis? Most European Member States have a Radionavigation Plan that makes clear that, when it comes to the crunch, the military has the final say. The tension between Galileo’s civilian identity and the realities of national security has therefore never been fully resolved; it has merely been deferred.

The PRS was conceived as a government-controlled, encrypted service for authorized institutions—customs agencies, specialized police units, border control, and similar bodies—with strictly limited access. Some nations, however, lobbied for PRS access to be extended to fire brigades and other local emergency services, apparently overlooking the fact that the number of simultaneous users the system can support is not unlimited, and a large number of users might create a problem for security. The military, meanwhile, was not explicitly named among the intended users—the working formula remained the familiar one: they may use it—even though the PRS was developed to a specification, and at a cost, that closely mirrors a military-grade service. The omission was not accidental; it reflected the political sensitivity of departing too visibly from Galileo’s declared civilian character.

Adding a further layer of complexity, most European nations had already concluded Memoranda of Understanding with the United States for the use of GPS, particularly within the NATO framework. Against that background, Galileo’s PRS was initially regarded by many European military establishments as superfluous—a costly duplication of a capability they already accessed through their American alliance commitments.

The world has changed substantially since those early design decisions were made. The conflicts and wars of recent years and today have made clear Europe can no longer take its security for granted and must rebuild defense capabilities that were allowed to atrophy significantly after the end of the Cold War. In that context, an independent, European-owned global satellite navigation system such as Galileo is plainly a major strategic asset for modern defense—essential for the guidance and operation of aircraft, naval vessels, armoured vehicles, and precision weapons alike. 

It is, therefore, even more remarkable that Galileo has not yet been officially designated as a dual-use GNSS. Every other global and regional satellite navigation system—GPS, GLONASS, BeiDou, NavIC—carries an explicit dual-use status. Galileo’s continued omission from that category is increasingly difficult to justify, and the argument for formally recognizing what has always been true in practice grows stronger with every passing year.

A further technical observation is warranted in the context of the PRS. Given that the PRS encryption is not watertight, the signal can be tracked without knowledge of the access code, so-called codeless tracking. One is therefore entitled to ask: What is the justification for the extraordinarily expensive and complex national access key schemes, which differ from country to country? I hope the second generation of Galileo will overcome that problem.

Opening Galileo to the World: International Partners

From an early stage, the EC pursued an active strategy of inviting third countries to join Galileo as partner nations and stakeholders. The rationale was partly financial—contributions from partner countries would help share the costs of development—and partly strategic. A system with broad international participation would be more difficult to challenge or marginalize, and would generate a larger global user base, strengthening the commercial case for European industry.

China was among the earliest countries to engage substantively with the program: A cooperation agreement with the Chinese government was signed in 2003, and China initially contributed funding and participated in technical working groups, though its involvement later diminished as Beijing’s own BeiDou navigation system matured. Israel signed a cooperation agreement with the EU in 2004, becoming one of the first non-European partners to formalize its engagement with the program. Ukraine, Morocco and South Korea also concluded first political agreements in the mid-2000s, each bringing different motivations—industrial participation, regional positioning, or access to high-accuracy services. However, it did not come to the second agreement defining the operational engagement in Galileo. India entered into discussions with the EU during the same period, reflecting the interest of major spacefaring nations in securing a stake in the emerging global navigation landscape. 

Together, these early partnerships gave Galileo an international footprint from the outset and underscored the EC’s ambition to build not merely a regional system, but a genuinely global one. 

PROF. DR.-ING. HABIL. DR. H. C. GÜENTER W. HEIN, Emeritus of Excellence at Bundeswehr University Munich, draws on more than two decades of first-hand experience to recount the development of Galileo, the European satellite navigation system. His involvement began with national research conducted between 1995 and 2008 at his former Institute of Geodesy and Navigation at Bundeswehr University Munich, funded by the Deutsches Zentrum für Luft- und Raumfahrt (DLR, German Aerospace Center). From 2000 onwards, he represented Germany in various EC Galileo study groups, including the Galileo Signal Task Force, and took part in the EU-US negotiations on GPS/Galileo interoperability from 2000 to 2005. He subsequently joined the European Space Agency as Head of the EGNOS and Galileo Evolution Programme Department from 2008 to 2014. He later served as a member of the Executive Board of Munich Aerospace e. V. and has provided consultancy to leading European satellite navigation companies. Güenter W. Hein is the founder of the Munich Satellite Navigation Summit and the Munich New Space Summit, which were merged in 2026 to form the Munich Space Summit. Through all these roles, he has played a central part in shaping European satellite navigation over the past 20 years.

The post Inside Galileo: Europe Decides to Build Up its Own Global Satellite Navigation System appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

While GNSS remains the backbone of positioning, its limitations can’t be ignored. GNSS signals are vulnerable to multipath interference, while spoofing and jamming attacks that render GNSS unreliable continue to grow in number and sophistication. Urban canyons, tunnels and indoor transitions also remain a challenge for GNSS and the users who require access to accurate positioning in these environments.

This reality, combined with the rise in autonomous solutions across various industries from agriculture to defense, makes closing the growing gaps in GNSS mission critical. Reliable, backup 
solutions are a must. Inertial navigation systems (INS) are a natural complement, providing continuous, high-rate propagation through GNSS outages. 

The push for autonomy has ushered in a new era of GNSS-INS integration, making this combined approach mainstream rather than exotic. Inside GNSS, along with Hexagon | NovAtel and Inertial Sense, explored this critical integration in a recent webinar. James Chan, business unit lead, INS, Aerospace & Defence Division, Hexagon, provided the system-level perspective, while Walt Johnson, founder and CTO of Inertial Sense, focused on low-SWaP-C tactical grade MEMS implementation.

IMU Fundamentals and the Cost–Accuracy Ladder

Chan gave us a look inside what makes up inertial measurement units (IMUs), the core of an INS. IMUs come in different options and grades, but all 
leverage various sensors to measure an object’s movement and orientation. Accelerometers measure linear acceleration, while gyroscopes measure rotational acceleration. Both typically operate on three axes, giving the IMU six degrees of freedom (DoF).

Many IMUs now also include magnetometers to measure magnetic fields, which can be translated into a heading, Chan said, and barometers to measure atmospheric pressure, which can be translated into an altitude. IMUs that include a three axis magnetometer have 9 DoF, while those that also have a barometer achieve 10 DoF. Magnetometers typically require calibration to account for local interference and magnetic declination. 

It’s important to note that every IMU has drift, Chan said, which leads to accumulating errors in the IMU data. These errors will continue to grow if there’s no external input to correct them. The drift rate is also dependent on sensor stability. 

“Nearly all inertial navigation systems will run some kind of filter, usually an Extended Kalman Filter or EKF, and that’ll have the INS solution running and take in GNSS updates to help compensate for any errors in the IMU measurements,” Chan said. “In between updates, the inertial solution will bridge the gap and continue to offer position, velocity and attitude at times when GNSS isn’t available.” 

An IMU’s accuracy, Chan said, is driven by the gyroscope, with three main types available: Ring laser gyroscope (RLG), fiber optic (FOG) gyroscope and Microelectromechanical Systems (MEMS). The RLG, the oldest, features two counter-propogating lasers that travel within a closed space, using a system of mirrors to “effectively bounce those lasers.” When the system rotates, one beam travels a longer path than the other. The detector picks that up and calculates the rotation rate based on the time difference of when the two lasers arrive. 

The newer FOGs also measure two beams of light, but do so by traveling around a closed fiber optic coil and measuring the difference of when the beams arrive back. Increasing the coil length changes the resolution on what a FOG can measure. 

FOGs tend to be smaller and cheaper than RLGs, but typically aren’t as accurate, Chan said, though the technology continues to improve. 

These days, most people use MEMS gyroscopes. There’s different types of MEMS for various applications, but all basically look at how a silicon structure behaves after some sort of force is applied. Compact MEMS gyroscopes have the lowest SWaP-C and can be found on anything from cell phones to UAS. 

Regardless of type, IMUs come in different classification grades: consumer, industrial, tactical and navigation. Gyro in-run bias stability is how a gyroscope bias drifts over time during operation at a given temperature. It is also referred to as bias instability. The higher the value, the more unstable the bias drift will be, and the worse the results you’ll get. 

Angular Random Walk (ARW) is another key metric, measuring the signal noise to indicate what the angular error could look like as it accumulates over time. 

“These values are determined by doing an Allan Variance Plot, and it’s a critical metric for determining gyroscope accuracy,” Chan said. “Smaller values indicate the random noise associated with the signal will have less of an impact on your angular measurements.” 

Quantum IMUs are also on the horizon, Chan said. These next generation navigation sensors will use atom interferometry to measure acceleration and rotation, measuring how lasers interact with cooled down atoms. 

“These sensors can be nearly 1,000 times as accurate as standard MEMS sensors,” Chan said, “but it’s currently limited by a low output rate and a very high power draw with no real commercial products yet.”

From Satellite Fixes to Continuous Navigation

GNSS requires visibility of the sky, with accuracy dependent on the satellites’ track, Chan said, one of its limitations. Still, there is “no better system to provide an absolute position that has zero infrastructure requirements needed on the user side besides an antenna and receiver.” Tightly integrated GNSS-INS adds an important layer. GNSS is absolute but vulnerable and lower rate, while INS is relative, drifting but high-rate and immune to interference. 

Chan provided a real-world example of how IMUs make navigation more resilient, showing a NovAtel receiver moving through downtown Calgary. GNSS was pulled in multiple directions, leading to an inaccurate trajectory. When the team incorporated an IMU into the solution and ran NovAtel SPAN software, there was a “remarkable improvement” in the positioning domain due to the relative accuracy of INS while also taking in the absolute accuracy of GNSS, which helps constrain error growth.

Of course, the ranges of IMUs that can be incorporated into these systems offer varying levels of performance at different price points. There’s a fit for every application, whether mid-grade or high-grade performance is required. Key performance metrics for integrated systems include position accuracy under nominal conditions and through outages; attitude; and robustness to shock and vibration in real platforms. 

What customers are most interested in, Chan said, is position, velocity and attitude (PVA) requirements. 

“Customers will look at whether an IMU will be able to deliver in this department first,” Chan said. “On NovAtel SPAN products, we break this apart by outage duration. Customers have an easy way to understand what performance they can expect.” 

The next consideration is SWaP-C. Most want smaller IMUs that draw less power, Chan said. And as the technology matures, IMUs are naturally becoming smaller, lighter and more efficient. 

Detailed technical requirements include bias, stability, ARW and dynamic range. 

“The dynamic range for an accelerometer is measured in Gs, the gravitational unit,” Chan said. “This indicates the acceleration value the accelerometer is capable of handling and shouldn’t be confused with shock or survival ratings.” 

Then there’s velocity random walk (VRW), similar to ARW, which is a “very good indicator of how noisy the signals will be when you do integrate them.” 

There’s demand for accurate IMUs with small footprints and low weight that draw minimal power, have a wide dynamic range and a low ARW. The performance required is somewhere between industrial and tactical. 

Delivering Tactical-Grade Performance in MEMS Form Factors

Inertial Sense is focused on democratizing tactical grade GNSS-INS navigation, Johnson said, developing low SWaP-C solutions for autonomous platforms and defense applications. The company’s mission is to make effective tactical grade navigation technology accessible for platforms that are constrained by size, weight and power. 

“We deliver a multi-GNSS and MEMS IMU sensor fusion architecture that delivers tactical grade attitude, centimeter-level RTK positioning and modules that weigh less than one gram,” Johnson said. “Our systems emphasize low SWaP-C, high rate estimation and robust operation in GPS-denied environments.” 

That technology is leveraged across a range of applications, including UAS, robotic systems, maritime and precision stabilization platforms. These days, Inertial Sense is seeing increased demand driven by emerging applications like loitering munitions, engagement systems, commercial autonomous 
vehicles and humanoid robots. Such applications “require tactical grade navigation performance, but they also require mass market pricing.” Navigation grade or military grade IMUs that provide the highest performance typically cost $100,000 or more.

“The fundamental problem to the market today is tactical grade navigation systems are too expensive for large scale deployment,” Johnson said. “Our solution is to deliver industry leading navigation performance at a disruptive price performance point. This enables our customers to deploy navigation autonomy at whatever scale they require.”

The Inertial Sense product portfolio consists of compact IMX tactical grade IMUs and INS navigation modules, and the GPX series of multi-GNSS receivers. The receivers support several configurations, raw measurement output, centimeter-level positioning and dual antenna heading. Both product families are available in OEM surface modules and rugged, enclosed systems. 

Cost optimization is a key differentiator for the IMX line, Johnson said. Inertial Sense focuses on keeping tactical grade sensors to between $5,000 and $25,000, targeting low cost hardware and sensors and selecting the optimal algorithms to deliver tactical rate performance on that hardware.

“Our systems are built using off-the- shelf components,” Johnson said, “but combined with proprietary design and calibration processes that enable us to create high precision performance.”

The navigation systems also run on single precision floating point unit microcontrollers; Inertial Sense doesn’t use double precision hardware. 

“Part of what we do to maintain numerical stability is use a square root extended Kalman filter that uses UD factorization,” Johnson said. “And this approach enables stable estimation high rate updates and then efficient computation on low cost processors.” 

To maintain accuracy during high dynamic motions, Inertial Sense implemented coning and sculling compensation. The algorithm prevents systematic integration of errors, such as attitude errors caused by oscillatory rotations between gyro samples and velocity errors caused by simultaneous rotation and linear acceleration. These techniques prevent motion and oscillation vibrations from degrading the tightly integrated solution. 

Inertial Sense also offers a lightweight, multi-band RTK engine that’s optimized for low SWaP GNSS receivers and processors. A modular GNSS architecture makes it easy to integrate the IMUs with multiple receivers, including the u-blox F9 and X20. There are also plans to release firmware that supports integration with the Septentrio mosaic-G5. 

Johnson shared real-world examples of the IMU in use, with one demonstrating IMX in ground vehicle dead reckoning mode. The vehicle overcame a 105 second GNSS outage in a parking structure, driving about 350 meters and experiencing about 6% drift. In ground vehicle mode drift is “more of a function of distance traveled than time.” 

Other tests compared IMX against established systems like NovAtel SPAN, with the IMUs achieving comparable results. 

Roadmap: Pushing GNSS-INS Further for Autonomy

The latest IMX model, the IMX-6, is scheduled for release this year and represents a 30% improvement in attitude and accuracy over the IMX-5. It will support a 500 Hz output rate and will feature enhanced roll and pitch accuracy, improved heading accuracy, reduced gyro bias stability, lower ARW and lower acceleration bias instability. It also has an increased sensing range and improved sensory redundancy. 

IMX-6 will be able to handle higher acceleration ranges, with proprietary processes allowing high volume precision calibration across temperature.

As vibration performance is critical, the sensor is undergoing shock and vibration testing as well as dynamic frequency response characterization. 

“Each IMX is fully calibrated during manufacturing across a temperature range of negative 40 to 85 degrees Celsius,” Johnson said. “This includes bias calibration, cross axis alignment and scale factor calibration.” 

There are also plans to add temperature compensation for scale factor modeling.

In-field calibration procedures and guidance are also available for IMX sensors. Customers with smaller devices can place them on a precision level surface and, depending on the level of alignment needed, calibrate in a few seconds. 

“It may be that they tip it on multiple sides, or it may be that they just level it in the normal operating direction, and then they inform the system that it needs to be calibrated in what mode,” Johnson said. “There’s different modes to put it in, and it doesn’t require much space at all.”

Customers with large vehicles can use GPS to similarly inform the system of sensor alignment. Inertial Sense can guide customers through both processes. 

Enhancements to the IMX-6 allow for easier drop-in upgrades, enhanced dynamic behavior, more predictable performance across temperature, broader GNSS ecosystem coverage and smoother field maintenance for end users.

Real-World Programs and What Buyers Should Ask 

IMX sensors are making an impact across various industries. Customer case studies include: 

• A global satellite communication provider. This ongoing customer needed an INS system that could deliver a fraction of a degree of orientation accuracy for satellite tracking on moving vessels. Existing solutions were too expensive for the market they were targeting. Inertial Sense delivered a solution that integrated tactical inertial grade navigation with low SWaP GNSS receivers. They also adapted manufacturing process to support the customer’s delivery schedule. 

• A defense technology company. The unmanned systems developer needed a lower ARW and bias instability than the IMX-5 could provide. In response, Inertial Sense collaborated with the customer to develop the IMX-6, which meets both their performance and SWaP-C requirements. This opened up other opportunities with the customer. 

• An autonomous landscaping developer. This customer required high precision navigation compatible with the commercial mower equipment market. Inertial Sense worked closely with the engineering team to integrate an IMX into their autonomous platform. 

With every case study, peformance for low SWaP applications was a key consideration. Inertial Sense was able to deliver tactical-grade metrics without navigation-grade prices. The company also offers integration, support and environmental robustness. 

Before investing in a GNSS-INS solution, it’s important to know what to ask. Manufacturer data sheets differ, making it critical to understand the most important metrics and how they could impact your solution. Key areas to consider include: 

• Performance 

• Real-world testing results 

• Outage behavior 

• Calibration 

• The product roadmap and expected future updates 

GNSS-INS as Autonomy Infrastructure

Autonomy needs more than GNSS. To meet that need, GNSS-INS integration has evolved from niche, high-end avionics to a foundational technology for mainstream autonomous systems. Advances in MEMS IMUs, fusion algorithms and integration ecosystems are making tactical-grade performance accessible at scale. 

Visit insidegnss.com to access the webinar, data sheets and white papers from Hexagon | NovAtel and Inertial Sense.

The post Integrating GNSS and Inertial: Tactical Grade Performance for Modern Autonomous Applications appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.