Starting with this SDX update is an upgraded paradigm for managing receiver antennas: SDX now supports the management of multiple vehicle antennas within a single scenario. Antennas can now be defined, named, and exported as antenna files that can be re-imported back into other scenarios. This handy feature will speed up antenna reuse and multi-scenario workflows for users managing numerous antenna models in GNSS simulation scenarios.

The new antenna model UI maintains the previous SDX paradigm whereby antenna patterns can be defined for gain and phase offsets.

Moreover, SDX now provides a simple and powerful sequencer for switching from one antenna pattern to another at specific times during a scenario. The antenna sequencer is said to be simple to use and will be useful for those who need to toggle antennas at various points in the simulation to replicate a real-world scenario.

As with all new features added by Skydel, the SDX API is updated—and documented—to reflect these latest changes, and these new features can be used in the programming of your automated scenarios.

IQ File as a Jammer Type
In addition, with release 18.10, users can now add IQ File playback as a jammer type in SDX. This feature, combined with the IQ File generation capability already available in SDX, opens a new range of possibilities.Users who already have the advanced jamming option installed and are eligible for this SDX upgrade can benefit from this new feature immediately by upgrading to SDX release 18.10.

Just One of Many Releases
So far in 2018, SDX has seen the support of anechoic chambers, the support for multiple GPUs, the addition of SBAS support among many other new features in the summer release, and now SDX release 18.10 that brings a new way to manage and sequence vehicle antennas.

According to Skydel, more announcements are just around the corner. New custom simulation solutions based on SDX are coming soon, along with new features and GNSS constellation support.

The post SDX 18.10 Now Available From Skydel appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

A: As of today, all open civil GNSS signals are transmitted in the clear, conforming to interface specifications that are fully available in the public domain. Receivers will accept any input that conforms to the specifications and treat it as if it came from a GNSS satellite. Combined with the extremely low power levels of GNSS signals this makes it almost trivially simple to spoof a GNSS receiver.

As early as 2003, Logan Scott proposed a number of techniques that could be implemented at the satellite level to “harden” the civil GNSS signals against spoofing attacks. The first and most straightforward amongst these was NMA.

Message Authentication is a concept that has a long history in digital communications, the basic idea being that the receiver of a message would like to ensure that the message they receive: 1) is identical to the message that was transmitted; 2) was generated by a trusted source. NMA is, unsurprisingly, the application of the Message Authentication concept to the navigation messages generated by GNSS satellites.

So How Does NMA Work?
Message authentication has been referred to as the “second face” of cryptology, and it uses many of the same tools and techniques as the more well-known first face of cryptology: cryptography, or data secrecy. In message authentication the sender uses a secret key to generate an authentication signature from the original message. Both message and signature are then transmitted to the receiver, which uses a key (potentially different to that used by the transmitter) to verify that the message and authentication signature correspond.

When the received message is authenticated the receiver can conclude that:

1. The transmitted and received message are the same

2. Only someone with access to the transmitter’s secret key could have generated the authentication message

There are two different ways to generate authentication signatures:

1. Using symmetric key techniques in which both transmitter and receiver share a secret key

2. Using asymmetric key techniques in which the secret key is split into two parts, a “private” key, known only to the transmitter, and a public key which can be distributed publicly. The private key is used to generate the authentication message, while the public key is used in the verification step.

There are some issues associated with each of the two techniques. In the symmetric key case the most difficult issue is how to distribute the “private” key to all users, without also giving the spoofer access to this key. Similarly, for the asymmetric case, the receiver needs some mechanism to ensure that the “public” key does indeed come from the trusted transmitter (the GNSS system operator in the case of NMA). This problem is usually solved using a Public Key Infrastructure (PKI) consisting of a trusted authority that manages the certification that public keys do indeed belong to the organization that claims them.

So it would appear that the asymmetric approach is superior, as the infrastructure is simplified and the “secret” key can remain secret. However, asymmetric encryption has two major drawbacks: firstly, it is much more computationally intensive than symmetric key encryption; secondly, much longer keys are required for the same level of security.

Interestingly, both symmetric and asymmetric NMA approaches have been proposed for GPS (on the new L1C signal) and Galileo (on the E1 Open Service signal), as discussed below.

The GPS Approach – Asymmetric NMA
The Chips-Message Robust Authentication (Chimera) is a hybrid NMA and spreading code authentication technique proposed for use with the GPS L1C signal. The NMA portion of this scheme is based on the asymmetric elliptic curve digital signature algorithm (ECDSA) P-224, which is a well-established standard. The public key is 448-bits long for an equivalent security of about 112 bits (i.e., it is equivalent to a 112-bit symmetric key system).

The Chimera proposal uses two Subframe 3 pages of the C/NAV message to transmit each digital signature, with a repetition rate of at most once every three minutes. In this way a receiver can verify that the navigation message is authentic every three minutes.

The ECDSA scheme is a well-established Federal Information Processing Standard (FIPS) standard and is implemented in most Open Source and commercially available cryptographic libraries, which simplifies the integration of the scheme into existing GNSS receivers.

Chimera requires receivers to have occasional access, via non-GPS channels, to infrastructure to provide authenticated GPS system public keys. This Public Key Infrastructure (PKI) is essential to any asymmetric crypto-system, including the Transport Layer Security (TLS) system used in securing websites. In this system, each entity that wishes to provide an authenticated public key obtains a signed certificate from a trusted Certification Authority (CA). A user can then verify that the public key provided corresponds to that in the signed certificate. Reusing this certification process should be straightforward in the GNSS context.

The Galileo Approach – Hybrid Symmetric/Asymmetric NMA
The proposal for Galileo Open Service Navigation Message Authentication (OSNMA) differs from Chimera in that it is based on a hybrid symmetric/ asymmetric key approach known as the Timed Efficient Streamed Loss-Tolerant Authentication (TESLA) scheme.

TESLA addresses the issue of symmetric key distribution as follows. First, a Message Authentication Code (MAC) is generated using the message and the private key. Both the message and the MAC are transmitted and then, sometime later, the private key is broadcast. This delayed release mechanism should ensure that the key used to generate the MAC is not known until after the message and MAC are already received. However, this does not prevent a spoofer from simply generating their own messages, keys and MACs and broadcasting them in a manner compliant with the specifications.

To address this latter issue, TESLA uses the concept of a chain of keys. An initial key K₀ is randomly selected. Each subsequent key in the chain K_i+1 is generated from the previous key K_i using a one way function: K_i+1 = f(K_i). A one way function is a mathematical transformation that is easy to compute but very difficult to invert. Thus, given K_i it is easy to compute K_i+1, but given K_i+1 it is computationally infeasible to establish K_i. In TESLA the system generates a chain of length N, then transmits the Nth key (called the root key) along with a digital signature generated using a standard asymmetric scheme, such as ECDSA. The chain keys are then used in reverse order to generate the MACs. Knowing the one-way function, the receiver can verify that each chain key is from the same chain as the digitally signed root key, but cannot predict “future” chain keys.

Once a TESLA chain has been established by asymmetric cryptographic means, the satellites begin transmitting messages, MACs and keys using the delayed release mechanism. The receiver extracts the messages and MACs and stores them until the key is received. The key is first checked to ensure that it is part of the TESLA chain in force using the known one way function. If the key passes this test, it is then used to verify that the MAC and the message correspond.

There is one absolutely critical assumption that must be made for the TESLA-based scheme to work: the receiver must have an authenticated time synchronization that is at least better than the key delay (in TESLA nomenclature this is referred to as the security condition). Without this assurance, the receiver cannot be certain that the navigation message has not been generated by a spoofer that has already received the perfectly valid signing key from a live satellite signal. This naturally raises the question as to how the receiver can “bootstrap” — if it does not have authenticated coarse synchronization how does it go about achieving it?

The OSNMA proposal is currently in draft form and subject to change. As it stands it uses 40 bits every two seconds of the Galileo E1b I/NAV message. The data are grouped into subframes of 30 seconds duration, and each MAC is only 10 to 32 bits in length, while key sizes range from 80 to 256 bits. This enables OSNMA to sign many more messages per second than Chimera, enabling such features as cross-satellite and even cross-system authentication. The receiver side computation cost of this high authentication rate remains to be seen, as it includes both MAC computation and key validation through the evaluation of the one way function. Similar to Chimera, the OSNMA scheme is built from a number of standard cryptographic building blocks, facilitating its implementation in receivers. However, unlike ECDSA the TESLA scheme itself is not a standard implementation and therefore will require more effort to integrate into GNSS receivers.

As with Chimera, the problem of Public Key Infrastructure (PKI) arises for OSNMA. In this case, the receiver must have access to known, trusted public keys in order to authenticate the digitally signed root keys. At present the OSNMA proposal envisages two public key distribution mechanisms: 1) the receiver can be initialized with a valid Galileo system public key in the factory; 2) new public keys can be transmitted over the E1b navigation message, a process known as Over the Air Rekeying (OTAR). In the current draft neither of these techniques are defined, though signal bandwidth is available for the OTAR mechanism. Of course, with OTAR new higher level public keys are required in order to authenticate the root key signing public keys broadcast from the satellites. Ultimately a PKI similar to that used for authenticating public keys used by commercial websites must be put in place to support public key distribution for both OSNMA and Chimera.

What Does This Mean For Users?
NMA is not a panacea, and by itself does not solve the spoofing problem. In Scott’s terminology, this is but Level 1 of a series of three system-side, signal level defenses. On the other hand, an NMA scheme that is correctly implemented in the receiver does constrain the spoofer’s “attack space” — essentially the spoofer is constrained to only broadcast valid navigation messages.

From the user’s perspective, the desired outcome is most likely to obtain an authenticated PVT, or at the very least, to be able to detect a spoofing attack. NMA on its own is insufficient for PVT authentication since this requires both the navigation message and range measurements from each satellite, and NMA does not authenticate the range. However, certain types of spoofing attack are detectable when NMA is implemented.

Over the last number of months two different “spoofing” attacks have been reported in this magazine (see Additional Resources). The first, almost certainly a repeater, affected a number of ships in the Black Sea in June 2017. The second, not technically spoofing as it was unintentional, was due to a GNSS simulator operating in the exhibition hall at the ION GNSS+ 2017 conference in Portland, Oregon in September 2017.

NMA on its own would have been of no assistance whatsoever in the Black Sea case, assuming that this was in fact a repeater, as this simple attack involves re-broadcast of live GNSS signals in near real-time. The navigation message broadcast by the spoofer would have been identical to that broadcast by the satellites, and hence would have passed the authentication verification step. Such an attack can only be detected by careful monitoring of various signal parameters and looking for sudden, physically impossible jumps, a process known as consistency checking.

The simulator incident is an interesting case, as it shows really how vulnerable many receivers are to spoofing. The cause of the incident appears to have been an improperly terminated output port on a GNSS simulator that was running a demonstration in the exhibition hall. The energy radiated from this port was sufficient to capture the GNSS receivers in many attendees’ smartphones. The simulated scenario was located somewhere in Europe and set in January 2014. Clearly, again simply monitoring the existing signal parameters available in the receivers should have provided some indication that there was a problem; jumping across continents or back in time is not something most receivers are capable of. But could NMA have helped in this situation? The short answer is yes, as the simulator would either have generated invalid signatures, or re-used out of date messages. However, in truth, the onus should really be on the receiver to detect sudden, physically impossible jumps in space or time.

In short, for the scenarios considered above, the most reliable test for spoofing is the receiver consistency check.

Summary
Navigation Message Authentication is coming to both Galileo and GPS in the next few years, which demonstrates that the system operators are serious about the civil spoofing threat. Other system level protection measures are also under development: Chimera implements secure spreading sequences for some signal level protection, while Galileo provides fully encrypted spreading codes in its Commercial Service.

NMA is but one tool in the arsenal that GNSS receivers can deploy against spoofing, but is certainly a step in the right direction. However, such efforts on the part of the system providers must be matched by the receiver manufacturers for there to be any benefit to the end user. Many receiver level defenses can, and should, be implemented today without waiting for the arrival of NMA.

Further Reading
Logan Scott’s paper on how to harden GNSS receivers:

• Scott, L. (2003) “Anti-Spoofing & Authenticated Signal Architectures for Civil Navigation Systems”, ION GNSS 2003.

Details about the proposed GPS and Galileo NMA proposals:

• Anderson, J. L.; Carroll, K. L.; DeVilbiss, N. P.; Gillis, J. T.; Hinks, J. C.; O’Hanlon, B. W.; Rushanan, J. J; Scott, L.; Yazdi, R.A (2017) “Chips-Message Robust Authentication (Chimera) for GPS Civilian Signals”, ION GNSS+ 2017.

• Fernandez, I; Rijmen, V.; Ashur, T.: Walker, P.; Seco, G.; Simon, J.; Sarto, C.; Burkey, D.; Pozzobon, O., “Galileo Navigation Message Authentication Specification for Signal-In-Space Testing”, Version 1.0, November 2016.

Additional Reading on the TESLA Scheme:

• Perrig, A.; Canetti, R.; Tygar, J.D.; Song, D., “Efficient Authentication and Signing of Multicast Streams over Lossy Channels”, Proceedings of the IEEE Symposium on Security and Privacy, 2000.

Additional Resources
[1] Goff, S. “Reports of Mass GPS Spoofing Attack in the Black Sea Strengthen Calls for PNT Backup”, Inside GNSS, 24 July 2017.
[2] Scott, L. “Spoofing Incident Report: An Illustration of Cascading Security Failure” Inside GNSS, 9 October 2017.

The post What is navigation message authentication? appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Q: Do modern multi-frequency civil receivers eliminate the ionospheric effect?

Q: Do modern multi-frequency civil receivers eliminate the ionospheric effect?

A: It is common knowledge in the GNSS community that the ionosphere is dispersive in the L-band, meaning the refractive effects on the carrier phases are proportional to the wavelengths of the carriers, in turn causing differential variation in the measured codes and phases of the various navigation signals transmitted by the satellites. Use of multiple signals of distinct center frequency transmitted from the same GNSS satellite allows direct observation and removal of the great majority of the ionospheric delay, and gives the impression to users that the ionosphere may not be a problem for modernized receivers. While the general assumption of nearly perfect correlation between the effects measured on multiple independent signals is correct in normal conditions, it does not appear to hold in the presence of ionospheric scintillation.

High and Low Latitude Scintillation Effects
Scintillation refers to random fluctuations in the received wave field strength (“signal fading”), as well as phase and group delay caused by the irregular structure of the propagation medium. Ionospheric scintillations are random rapid variations in the intensity and phase of the received signals resulting from plasma density irregularities in the ionosphere.

Many of the important contributors to ionospheric scintillation are already known, such as the variation of scintillation activity with magnetic activity, geographic location, local time, season, and the 11-year solar cycle.

The most significant and frequent scintillation activity including both phase and amplitude variations is observed in low latitude regions within about 15° of the Earth’s magnetic equator, particularly in the hours after local sunset. In high latitude regions scintillation is frequent but generally less severe in terms of signal tracking disruptions than that in the equatorial regions. The high-latitude environment can be divided into two subregions, the polar caps (regions around the magnetic poles) and the auroral zones (approximately circular regions around the two geomagnetic poles located at about 67° north and south geographic latitudes, and about 3° to 6° wide). Of these, the polar cap experiences both amplitude as well as phase scintillation activity, while mainly phase scintillation is observed at high latitude auroral regions.

In mid-latitude regions scintillation is rarely observed, but during intense ionospheric storm conditions phenomena can extend into the mid-latitudes.

Figures 1 and 2 (see inset photo, above right, for all figures) show examples of ionospheric scintillation as observed on the detrended signal intensity (effectively power) and detrended carrier phase measurements at 69.5° latitude (Tromsø, Norway) and 21° latitude (Hanoi, Vietnam), respectively. In the particular event shown in Figure 2 the depth of fades reaches 43 decibels (dB) on L1CA which is severe by any metric, and is a substantial qualitative difference from the high-latitude phase scintillation events where only very weak fading activity is typically observed. It should be noted that ionospheric activity is more dependent on the geomagnetic latitude of the user than the geographic latitude. While it might be clear that Tromsø station is located in the auroral region, the Hanoi station has somewhat lower geomagnetic latitude than geographic latitude and is in fact located within the equatorial zone.

Since ionospheric scintillation is essentially a rapid variation in the apparent ionosphere it is easy to assume that the typical approaches applied for removing ionospheric influence will be effective during scintillation.

Ionosphere-Free Combination
The advantage of multi-frequency GNSS receivers in terms of handling the ionospheric error is that they can combine carrier phase measurements at different frequencies to cancel out the first order effect due to ionospheric refraction. The receiver does not typically measure the ionospheric delay directly, but is using the so-called ionosphere-free linear combination of the observables. Consider generalized versions of carrier phase measurements on two frequencies, i and j, expressed in meters:

Φ_Li = ρ + λ_iN_i − I_i     (1)
Φ_Lj = ρ + λ_jN_j − I_j

where ρ is the geometric range between the satellite and the receiver; λ_i and λ_j are the wavelengths, N_i and N_j are the integer ambiguity terms, I_i and I_j are the ionospheric propagation delay errors. For simplicity, the receiver noise and multipath errors are not included. The expression for an arbitrary linear combination of two carrier phase measurements can be written as follows: (For more on this topic, read the GNSS Solutions column from January/February 2009).

Φ_ij = αΦ_Li + βΦ_Lj     (2)

where α and β are constants. This allows one to model a linear combination of phases in the same way as the individual observables:

Φ_ij = ρ + λ_ijN_ij − I_ijη     (3)

In (3), λ_ij is the wavelength, N_ij is the integer ambiguity term, and I_ij is the ionospheric propagation delay error for the linear combination. In order to remove the ionospheric error (η = 0), but leave the geometric portion unchanged and the resulting ambiguity still an integer, the ionosphere-free combination has been proposed:

Φ_IFree = f_i²Φ_Li − f_j²Φ_Lj  ∕ f_i² − f_j²     (4)

where f_i and f_j are the carrier frequencies expressed in hertz. The phase scintillation is, however, caused by both refractive and diffractive effects. The diffractive effects cause rapid transitions in the phase which do not scale with the carrier wavelength resulting in a residual error in the ionosphere-free linear combination (4) of phase measurements.

While this correction term is for most purposes considered complete, there are factors that can cause apparent deviation between the two carriers including multipath, receiver noise, and un-modelled terms in (4). Corrections produced using (4) will have a residual error due to second and third order dispersion effects, which are conservatively bounded to 0–2 centimeters and 0–2 millimeters at zenith respectively, under an assumption of a 100 TECU (total electron content unit; 1 TECU ≈ 16 cm at GPS L1) background ionosphere. Since 100 TECU is a high value for zenith ionosphere the value of the higher order terms will often be well below 2 centimeters instantaneously, and will vary by only a small fraction of this amount over short time periods.

Although some recent findings have shown that magnitudes of 3 centimeters referenced to L1 are possible due to the higher order terms, it has also been shown that the variation rate is typically limited to the level of centimeters per hour.

During phase scintillation events it is possible that the multiple carriers of a given satellite will (when scaled for frequency as in Figure 3) track each other within the margins of error expected when accounting for thermal and oscillator phase noise on each channel. However, it is also possible that near total de-correlation of the phases will occur during phase scintillation accompanied by fading events as is depicted in Figure 4 where the detrended scaled carrier phase observables from L1, L2 and L5 transmitted by a block IIF GPS satellite visibly deviate from one another. Even the closely-spaced L2 and L5 carriers exhibit substantial decorrelation, equivalent at times to a full L1 carrier cycle of nearly 20 centimeters, well outside of the level which could be plausibly attributed to higher order terms ignored by (4).

On close inspection, the data shown in Figure 4 does not appear to contain any stepwise transitions of a magnitude commensurate with a full or half cycle slip on any of the carriers, meaning that this decorrelation is unlikely to be a signal tracking error. Unlike static group delay errors, it is not possible to measure and estimate this error contribution a priori. It is effectively an additional noise source present only during scintillation. Since it will influence the magnitude of the residual error in the case of multi/dual frequency processing it is interesting to analyze this phenomena and attempt to quantify its expected magnitude by considering the level of correlation between carriers during a cross section of scintillation events affecting modernized civil signals believed to be free of cycle slips.

To quantify the correlation level between the scintillation effects on GNSS frequencies, the phase correlation coefficient can be calculated for the observed scintillation events according to the following relationship:

ρ_δφ = ⟨δφ₁δφ₂⟩/(⟨δφ₁²δφ₂²⟩)^1/2, −1 < ρ_δφ < 1     (5)

where the terms δφ₁ and δφ₂ represent epoch to epoch changes in the detrended phases. Figures 5 and 6 show the results for the events observed at 69.5° latitude (Tromsø, Norway) and 21° latitude (Hanoi, Vietnam). In Figure 6 the level of correlation versus the intensity of the phase variation is plotted for L1CA vs. L2CM, and in contrast to the high latitude example shown in Figure 5, where increasing phase instability leads to an increasing level of phase correlation between the two carriers, for the Hanoi data the outcome is entirely different. Indeed, the phase correlation between the two carriers appears to be nearly non-existent on average, as the distribution of correlation measures is bifurcated with half the distribution tending towards higher positive correlation levels, while the other half of the sampled distribution tends towards anti-correlated results.

Ionosphere-free Residual
When scaled by their wavelengths, the carrier phase measurements on different GNSS frequencies appear to match closely when the scintillation effect is weak or moderate, but diverge from one another when the scintillation effect is strong regardless of whether the dominant scintillation effect is on the phase or amplitude of the signal. It is believed that these divergences occur when diffraction alters the phases by a factor that is not proportional to the wavelengths of their carriers leading to a residual in the ionosphere-free phase combination. An example of this phenomena is the so-called “canonical fade”, which may be the cause of the decorrelation events presented here. Figure 7 shows the average absolute L1/L2 ionosphere-free combination residual from Tromsø (69.5° N) observations, whereas results generated based on the data from Hanoi (21° N) are illustrated in Figures 8, 9 and 10.

Noting that the range of carrier phase standard deviation considered in Figures 8, 9 and 10 is smaller than that considered in the high latitude plot, it is clear that the level of ionosphere-free residual present in the Hanoi data increases much more rapidly with rising phase standard deviation than was the case with the high latitude observations.

While it is not unexpected that the L1/L5 combination residual is also substantial, as indicated in Figure 9, the more interesting observation is that the L2C and L5 signals also have considerable levels of decorrelation despite their relatively small 51 megahertz of spectral separation, compared to the nearly 350 megahertz of spectral separation between L1 and L2. In Figure 10, it is seen that for one of the tracked satellites during this event, the level of ionosphere-free residual in the L2CM/L5Q combination seems to exceed one meter even while the underlying data shows no signs of cycle slips.

Conclusion
To summarize, it has been demonstrated that ionospheric scintillation phenomena tend to cause an additional measurement residual in the nominal ionosphere-free combinations that greatly exceeds the expected value of the neglected higher order terms and may be a substantial or dominant nuisance term in some applications. While the residual is present with both phase and amplitude scintillation, and is more pronounced with strong scintillation to a point, the relationship appears stochastic and not deterministic.

It is tempting to assume that concerns about ionospheric effects during all but deep amplitude fades would disappear when users had switched from semi-codeless multi-frequency observables to the use of modernized civil signals due to their much higher tracking robustness. Instead, it seems that even with the modernized signals there is a measurable and occasionally meter level sense in which the ionosphere-free observables are not at all free of ionospheric influence.

Additional Resources

For additional information about ionospheric scintillation:
[1] Conker, R.S., M.B. El-Arini, C.J. Hegarty and T. Hsiao (2003) “Modelling the effects of ionospheric scintillation on GPS/Satellite-Based Augmentation System Availability”, Radio Science, vol.38, no.1.
[2] Carrano, C. S., K. M. Groves, W. J. McNeil, and P. H. Doherty (2013), Direct measurement of the residual in the ionosphere-free linear combination during scintillation, Proceedings of the 2013 Institute of Navigation ION NTM meeting, San Diego, CA, January 28-30, 2013.

For additional information on higher-order ionospheric effects:
[3] Hoque, M.M., and N. Jankowski (2007), “Higher order ionospheric effects in precise GNSS positioning,” Journal of Geodesy number 81, pp 259-268
[4] Liu, Z., Y. Li, J. Guo, and F. Li (2016) “Influence of higher-order ionospheric delay correction on GPS precise orbit determination and precise positioning,” Geodesy and Geodynamics, Volume 7, Issue 5, September 2016, pp 369-376

For information about canonical fades:
[5] Liu, Z., Y. Li, J. Guo, and F. Li (2016) “Influence of higher-order ionospheric delay correction on GPS precise orbit determination and precise positioning,” Geodesy and Geodynamics, Volume 7, Issue 5, September 2016, pp 369-376.

The post Do modern multi-frequency civil receivers eliminate the ionospheric effect? appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

GNSS SDRs are a rapidly advancing area in GNSS receiver research and design. The last few years have brought tremendous growth in this field. Universities and other research institutions have developed and demonstrated advanced capabilities, particularly with respect to multi-constellation GNSS and GNSS-plus-multi-sensor navigation processing for challenging environments. The recent commercial availability of multi-sensor data collection equipment, development platforms and open-source software projects have catalyzed this rapid pace of innovation. Indeed, SDR will likely become a significant commercial GNSS receiver architecture by the end of this decade due to today’s ongoing deployment of multiple global and regional satnav constellations with their diverse signal structures, and rapid advancements in parallel low-power processors and inexpensive sensors.

Non-realtime SDR operational scenarios involve storage and post-processing of samples. These sampled data files can also be used in radio frequency (RF) playback systems for GNSS receiver test and evaluation in the lab. Post-processing and/or playback requires several generic front-end parameters such as RF and intermediate frequency (IF) center frequencies, sample rate, file format, as well as GNSS-specific information such as antenna location and type. We define this information as GNSS SDR metadata. Manual transfer of metadata is the method predominantly used today – a process that is cumbersome and error prone to say the least. No established method exists to exchange this metadata automatically.

During the ION GNSS+ 2013 conference, a group of attendees discussed the need for a formal standard for the exchange of GNSS SDR metadata. This group identified the following benefits of engaging in this activity at the present:

• It identifies and brings the international GNSS SDR community together as a working group. This collaboration is critical in order to get broad acceptance and usage.
• Standardization will help to avoid technology segmentation issues while promoting the pace of innovation by standard practices and compliant tools. 
• The formal standard, if widely adopted, will help ensure compatibility and interoperability of future GNSS SDRs. Specifically, front-end agnostic “plug-and-play” SDRs are envisioned. These have the potential for revolutionizing positioning, navigation, and timing (PNT) systems of the future.

Most authors of significant GNSS SDR publications and contributions over the past two decades are ION members and frequent meeting attendees. Hence, we decided to pursue this standard through ION sponsorship. During the January 2014 Council Meeting in San Diego, ION approved the process for establishing a formal standard. The ION GNSS SDR Metadata Working Group (WG) was formed in April 2014. Membership represents academia, industry (including GNSS SDR product vendors as well as traditional GNSS equipment manufacturers), non-profit research entities, and government agencies spanning countries in America, Europe, Asia and Australia.

Justification for GNSS Metadata Standardization
Figure 1 (see inset photo, above right, for all figures) shows the metadata transfer scheme mainly used in today’s GNSS SDR systems. The top row depicts data collection system (DCS) A, producing an SDR file of format A, consumed by SDR processor A. This may represent an end-to-end solution provided by a vendor or a system that was initially developed around a specific hardware platform. In any case, assume that the metadata for decoding Format A is hard-coded into the processor. Consequently, supporting other file formats involves extensive software revisions on a case-by-case basis. One group may want to share SDR files from DCS A with other groups using SDRs X and Y for research collaboration. This involves conveying the file format and other relevant information accurately to these other groups. Today, this metadata transfer occurs in an ad-hoc way that is prone to interpretation errors.

The second row depicts multi-stream DCS B that produces files with a more complicated format. SDR processors X and Y represents more flexible SDRs that are able to support multiple file formats. However, the data/metadata association requires manual intervention.

DCS C multiplexes other data (such as sensor data) along with multiple GNSS sample streams in the same file. This type of multiplexed collection has the potential to become more common with emerging SDR-related data streaming standards such as VITA-49 (See T. Cooklev et alia, Additional Resources). In this case, custom-designed processor C represents an SDR that fully supports multi-sensor integration capabilities. Because DCS C’s GNSS stream parameters are open, SDR Y is also able to support GNSS-only processing using an ad-hoc metadata transfer scheme. The sensor data parameters in Format C may or may not be open.

As clear from Figure 1, today’s ad hoc methods of metadata exchange do not encourage interoperability and instead cultivates potential for technology segmentation (i.e., various groups developing their own stove-piped solutions and technologies).

Figure 2 shows the same systems of Figure 1 that have adopted a metadata standard. As shown, each DCS produces a compliant metadata file along with the SDR file. The metadata file is read-in by the compliant SDR processor to correctly decode and process files seamlessly.

Adoption of a metadata standard benefits DCS developers because their systems become applicable to a much wider group of users. Similarly, an SDR processor’s utility is extended when it is capable of supporting many file formats from multiple sources seamlessly. Thus, metadata standardization promotes interoperability of GNSS SDR systems and greatly simplifies the exchange of files between groups.

Metadata standardization also benefits other use cases beyond post-processing GNSS SDRs. For example, consider the use of the metadata specification to synthesize compliant SDR files for use in RF playback systems. Additionally, libraries of compliant SDR file sets containing various real-world scenarios could be used interchangeably in compliant RF playback simulators for repeatable and consistent testing of GNSS receivers.

SDR Data Collection Topologies
The ION Executive Committee stipulated that this standardization activity shall not create an unfair advantage or disadvantage to any entity. Specifically, the standard shall not require any existing system to undergo data format changes to achieve compliance. This “do no harm” stipulation implies that the standard be designed such that it supports all current and future SDR file formats. This also means that the WG must “get it right the first time” since major revisions to the standard would be undesirable and adverse to the goal of widespread adoption. Hence, we considered the entire space of possible GNSS SDR data collection topologies. Figure 3 illustrates these topologies.

Figure 3.a illustrates the simplest data collection topology that can exist. This is when a single swath of RF spectrum (referenced henceforth as a “band”) is down-converted and sampled to produce a single data stream. The stream, which may be IF sampled (real samples) or baseband sampled (complex samples) is written to disk as a single file.

Figure 3b represents a DCS that writes parts of a single data stream across multiple files. This may be done to reduce the sustained write performance requirement of storage drives (similar to striping mode in RAID systems).

Figure 3.c is similar to Figure 3.a, except that the data stream represents more than one RF band. An example of this topology is a direct RF sampling front-end architecture that intentionally aliases multiple bands to fall next to each other at baseband. Some bands may be spectrally inverted as a result of the digital down-conversion process.

A DCS may produce multiple data streams. Each stream may contain information from one of many antenna elements (as shown in Figure 3.d, where each stream may also encompass multiple bands as in Figure 3.c). Alternatively, a stream may be sampling one of several bands received by a single wideband antenna, where the multiplexed streams written to file represents channelized samples. Combinations of the above are also possible.

Each stream may also be sampled at different rates and bit depths. For example, consider a civilian GPS L1, L2, L5 system. In this case, the L1 and L2 streams may be sampled at rate f₀ and the L5 stream at 10·f₀ (since the L5 signal’s null-to-null bandwidth is 10 times wider than L1 C/A and L2C), where f₀ represents the base sample rate. Figure 3.d may also represent how these multiple streams are multiplexed into a single lane of packed binary data and written to a single file.

Similar to Figure 3.d, Figure 3.e illustrates a GNSS data stream multiplexed with other data that is written to a single file. This non-GNSS SDR data may be from additional sensors (as shown), and may be written in a proprietary format that may or may not be known.

The specification of metadata parameters for non-GNSS data is outside the scope of the present standardization effort. However, the standard must support adequate information to skip over such non-GNSS data bytes. Since the metadata schema is extensible, it can cover the description of non-GNSS SDR data as needed by specific users.

It is important to note that although we use the term “GNSS SDR data” in this article to generally refer to the type of sampled data for which metadata parameters are defined in the standard, the samples need not correspond to GNSS frequency bands. For example, frequency bands containing RF signals of opportunity are supported as long as they can be represented by the standard’s metadata parameters.

Due to the typically high data rate of GNSS SDRs, some DCSs write data as temporally split files, as illustrated in Figure 3.f. This allows for efficient data management through multiple smaller files compared to a single large file. The metadata for each file must associate the previous and next files in order to represent the sequence. Note that the DCS block shown in Figure 3.f could represent any of those described in topologies a, c, d, and e of Figure 3.

Figure 3.g illustrates spatial splitting of files. Here, the binary data lanes from two or more DCSs are written to separate files. These files may be written by different computer systems. In this case, a non-zero inter-system timing offset, Δt, may exist and must be supported in the standard. Since Δt may or may not be known at time of collection, it represents an example metadata parameter that may be back-annotated into the metadata file after an initial pass of SDR data processing.

Multi-lane DCSs that write each lane to a separate file may also implement temporal file splitting according to 3.f. We call this “spatial-temporal splitting”, and is illustrated in Figure 3.h.

Since multi-stream-multi-file data collection topologies (i.e., (g) and (h) in Figure 3) produce multiple data files applicable to a given time interval, the SDR processor must be “introduced” to the full or partial set of lanes associated with the topology. This is covered by lane selection parameters in the standard.

Metadata Parameters
The metadata standard enables a user to specify a wide range of properties of the binary data file. Some of these properties relate to the data collection scenario itself, such as the time and location, and the type of scenario. Other properties of the dataset relate to the particular RF data that is captured as IF samples, including center frequency and bandwidth. Yet other details such as the IF digitization configuration and data packing can be specified. These are briefly summarized below. Some of the parameters are free-form text, others are integer or floating point variables, and others are enumerations. The primary classes are shown in Figure 4.

The metadata “session” class holds details such as the time, the position, the measurement campaign, and the type of scenario. The “file” class contains a path to the corresponding binary data file, time-stamp info, and a reference to the contained “lane” (described below). A “system” class contains details of the data recording equipment, such as the equipment name, the reference clock frequency, and the antenna details/specifications. The metadata standard allows for the specification of a variety of RF bands, each “band” class includes details of the band’s center frequency, intermediate frequency, bandwidth and group-delay bias.

The actual format of the binary data is detailed in the “lane” class, which allows for the specification of a hierarchy of binary data packing patterns, entitled “blocks”, “chunks” and “lumps”. These classes specify the arrangement of the packed IF data and optional additional data such as sensor measurements or configuration information, and further specify the arrangement of data relative to the standard word-sizes (arrays of byte, short integers, integers, long integers, etc.). The arrangement of the raw IF samples within these blocks is specified by the “stream” class. This class specifies the associated RF band, the sample rate, the quantization, the sample format (real/complex), the encoding of the binary data and the arrangement/alignment of the samples. Together these classes contain sufficient information to unambiguously interpret the packed binary data.

Normative Reference Software
The primary responsibilities of the Normative Reference Implementation Subcommittee are to reduce to practice the conceptual design developed through consensus by the WG into an appropriate set of schema (according to industry best practices) and to develop a compliant software library implementation. The WG was fortunate to receive voluntary participation for this task from individuals representing established commercial GNSS SDR vendors.

The WG decided to work on a publicly available reference software library to be released with the standard. The goal of this effort is to promote early and widespread adoption of the standard by making it easy for vendors and researchers to integrate standard-compliance by integrating the library into their existing software. The scope of this effort is twofold, to develop a metadata interpreter, and to develop a binary data converter using this metadata interpreter.

The first contribution was a library that would produce standard-compliant metadata files from an appropriately-populated data structure, a library capable of reading the content of such files back to a data structure. The second contribution was in the form of a library capable of parsing and converting binary IF data based on an associated metadata description. When combined, it is hoped that these two libraries offer sufficient functionality to enable adoption of the metadata standard in SDRs, or to serve as a benchmark against which implementations of the standard can be validated.

The software is written in C++ and managed using CMake. It has been divided into two libraries, “apilib” implementing the Metadata Interpreter and “converterlib” implementing the binary data conversion, and is accompanied by a selection of utilities, including a data-converter application and a simple test application. The software is available on the Institute of Navigation’s GitHub account here.

The Metadata Interpreter library includes a reader functionality that can parse a metadata file and populate a corresponding metadata object that can then be queried through a selection of member-function calls. Similarly, a metadata object can be instantiated and configured through a selection of member functions and, subsequently, it can be instructed to write a corresponding metadata file.

The converter library can be used for parsing binary data files and interpreting the data according to a metadata file. The basic converter can be adapted to support processing of the converted data streams, and two such adaptations have been implanted in the reference software. The first functionality is depicted in Figure 5, where the data-converter is embedded in a file-converter. The file-converter configures the embedded data-converter using a Metadata Interpreter object, and is capable of parsing a packed binary input file and producing one file per IF data stream in a user-specified data type (int8, int16, float, double, etc.).

A second functionality has been implemented by embedding the data converter in a “front-end”, as depicted in Figure 6. This front-end offers a means of loading short portions of the binary data file and converting them to a user-specified data type (int8, int16, float, double, etc.) while handling details such as sample alignment, when different streams are sampled at different rates.

The software suite includes a selection of example binary datasets and associated metadata files along with a simple MATLAB/Octave script to test the build against reference datasets. To date five different file formats have been included in the repository including a wide range of front-end configurations and data packing variations.

A number of working group members volunteered to perform “blind testing” of SDR data files against draft specifications. This involves exchanging SDR data files and associated metadata specifications among parties and verifying that the files can be fully decoded without additional information. Working group members participating in this activity will comprise the Compliance Verification Subcommittee.

SDR Data Repository
As with most standards and programming projects, they are best understood through good examples. Thus, this page has been created and contains several binary sample files together with metadata files. All file sets have been tested to follow the standard and to be readable by the normative reference software. The binary files typically contain samples over a duration of more than 60 seconds and position fixes have been obtained by at least one software receiver implementation.

Further examples will be added, not only emphasizing new data recording systems but also illustrating different SDR applications such as antenna arrays, reflectometry or ionospheric scintillation analysis. Further, data from GNSS seen only at certain locations of the Earth (e.g., Quasi-Zenith Satellite System [QZSS]) are being considered.

Organizations are encouraged to contact the working group if they have files with formats that are currently not adequately represented in the repository or represent use cases so far not considered. The respective point of contact is given on the web page. The working group will then take care of creating a metadata file (if not yet available), check the correctness and organize the upload.

Additional Resources
[1] Cooklev, T., R. Normoyle, and D. Clendenen, “The Vita49 Analog RF-Digital Interface,” IEEE Circuits and Systems Magazine, Q4 2012.
[2] Favenza, A., and N. Linty, “Exploiting Standardized Metadata for GNSS SDR Remote Processing: a Case Study”, ION GNSS+ 2016, Portland, Oregon (USA), 09/2016.
[3] Lucas-Sabola, V., G. Seco-Granados, J. A. López-Salcedo, J. A. García-Molina, M. Crisci, “Cloud GNSS receivers: New advanced applications made possible”, Proc. Int. Conf. Localization GNSS (ICL-GNSS), pp. 1-6, 2016.
[4] Lucas-Sabola, V., Seco-Granados, G., López-Salcedo, J.A., García-Molina, J.A., Crisci, M., “Demonstration of Cloud GNSS Signal Processing,” Proceedings of the 29th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS+ 2016), Portland, Oregon, September 2016, pp. 34-43.

The post GNSS SDR Metadata Standard appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

There are many good reasons for getting excited about highly automated vehicles, or HAVs, which is the acronym used by the National Highway Traffic Safety Administration (NHTSA). HAVs can make driving more fuel- and time-efficient. They can significantly reduce traffic congestion and emissions by driving a precise speed, minimizing lane changes, and maintaining an exact distance to neighboring cars. They can also increase accessibility and mobility for disabled and elderly persons.

There are many good reasons for getting excited about highly automated vehicles, or HAVs, which is the acronym used by the National Highway Traffic Safety Administration (NHTSA). HAVs can make driving more fuel- and time-efficient. They can significantly reduce traffic congestion and emissions by driving a precise speed, minimizing lane changes, and maintaining an exact distance to neighboring cars. They can also increase accessibility and mobility for disabled and elderly persons.

Sharing an HAV instead of owning is projected to dramatically reduce a household’s yearly transportation budget, which currently ranges between approximately $8,000 and $11,000 per car. HAVs carry promises not only in improved road mobility, and accessibility, but also in producing architectural and societal changes that can make mass parking spaces and personal car ownership obsolete in urban areas. Above all, HAVs can help improve road safety by preventing car accidents that cause more than 30,000 deaths/year in the United States alone, cost approximately $230 billion/year in medical and work loss costs, and are caused by humans 90% of the time.

Press articles in the 1950s and 1960s predicted that autonomous cars and “electronic highways” would become widely available by 1975. Major milestones in the use of new sensor, computation, and communication technology have recently reenergized the eagerness for HAVs. This first started with the 2005 “DARPA Grand Challenge”, where four different HAVs designed by teams of engineers from industry and academia completed a 132-mile trip across the Mohave desert in less than 7.5 hours with no human intervention. The 2007 DARPA “Urban Challenge” saw six teams autonomously complete a 60-mile course in an urban environment, while following traffic laws. Most teams used a combination of LiDAR, cameras, differential GPS, and computation power that is multiple orders of magnitude higher than what is typically needed for a commercial passenger vehicle. In 2009, Google (now Waymo) began designing and testing “self-driving” cars, which have since accumulated more than three million miles in autonomous mode.

Currently, most car manufacturers have HAV prototype systems and Google, Uber, NuTonomy have HAV pilot testing programs, including fully autonomous systems for public transportation, which, for now, are confined to segregated lanes and geo-fenced areas. Multiple Tier-2 supplier companies have emerged, which specialize in autonomous car technology. In early 2017, 36 companies were registered to test prototype HAV systems on public roads in the state of California.

However, in Figure 1 (for all figures, see inset photo, above right), Gartner’s “2016 Hype Cycle for Emerging Technologies” shows that HAV technology might be at the “peak of inflated expectations”, approaching the “trough of disillusionment”. Hype cycle curves are non-scientific tools that have been empirically verified for multiple example technologies over many years. Two example emerging technologies, commercial unmanned aircraft systems (UAS) and virtual reality, are included in Figure 1 for illustration purposes. The curve’s time scale may differ for each technology. One of many indicators of decreasing expectations on HAVs include a reduction in press coverage and the emergence of first negative news stories, in particular following the May 2016 crash of a Tesla Model S whose autopilot failed to distinguish a white trailer truck from the bright Florida sky. The Model S ran under the trailer causing its roof to be torn off and the operator to lose its life. The car kept going full speed on the side of the road through two fences until it hit a pole and came to a stop.

In parallel, until the end of 2016, Google was providing detailed reports of their self-driving car performance, which were designed to operate in real-world urban environments. These reports contain records of millions of miles driven autonomously, but also acknowledge “disengagements”, i.e., where the operator needed to take over control to avoid collisions. The data shows that HAVs are much more likely to be involved in collisions, even though these collisions are often of lower severity than in conventional human driving [HAVs typically get rear-ended because of their unusual road behavior] (see B. Schoettle, and M. Sivak, “A Preliminary Analysis of Real-World Crashes Involving Self-Driving Vehicles,” Additional Resources). Also, Uber’s autonomous taxis in Pittsburg have a reported rate of one disengagement per mile autonomously driven.

Moreover, the first fielded autonomous systems have revealed new safety threats. In particular, the technology’s functionality, as perceived by the human operator, does not always match the intended operational domain: for example, there have been cases of highway autopilots being used in urban areas and passing red lights without slowing down. In addition, human-machine interaction is at the heart of role confusion (is the operator or the HAV in charge?) of mode confusion (is the HAV in autonomous or manual mode?) and of the operator’s trust in this multimodal system. Misinterpretation may grow even wilder because a given functionality will not achieve the same level of performance across models and manufacturers, and operators may not be aware of the systems’ independently verified safety ratings. And, within the next few years, operators will be expected to anticipate hazardous situations and take over control. Thus, operating an HAV may require more education and different training than driving a car manually.

Current Safety Assessment Efforts
To focus this article, first consider the Society of Automotive Engineer (SAE) International’s classification of driving autonomy levels in Table 1 (see inset photo, above right). Under Levels 0 to 2, the human driver is responsible at all times, either for driving by himself, or for supervising the HAV in autonomous mode and taking control if needed. Under Levels 3 to 5, the system is self-monitoring and the driver is expected to take control, but only if requested by the system. Levels 0-4 provide partial automation under predefined driving modes and circumstances, whereas Level 5 is full autonomy.

The most advanced private car systems are currently Level 2, and pilot programs aim at achieving Level 3, although the mere presence of a kill-switch would imply that the system is actually Level 2. The transition from Level 2 to 3 is a remarkable leap that has significant implications on trust and comfort of human-machine interactions, on legal responsibility allocation between system and driver, and on technical challenges to overcome to guarantee passenger safety.

Over the past four years, the most publicized approaches to demonstrate Level 2 HAV safety have been experimental testing campaigns by Google, Tesla and Uber. Google’s approach to have HAVs drive millions of miles with minimal human intervention has been documented up until 2015. At this time, Google cars have autonomously travelled an impressive three million miles. Tesla’s autopilot is reported to have driven more than 130 million miles – on highways only – before it caused a fatality in May 2016.

In parallel, NHTSA reports about 3,000 billion miles travelled each year on U.S. highways by human drivers, with 30,000 deaths caused by traffic accidents; this corresponds to about one fatality in traffic accidents per 100 million miles driven in the U.S. But, this number accounts for incidents on all roads, in all weather conditions, and for all vehicle ages and types. Thus, a purely experimental, complete proof that HAVs match the level of safety of human driving would take about 400 years at Google’s current testing rate (of approximately 250,000 test miles per year), and would still take many decades if the testing rate increased exponentially. This is assuming that no fatalities occur during that time, that no major HAV upgrade is performed, and that the testing environment is representative of all U.S. roads. Thus, while an experimental proof is conclusive, it is not practical. Other, analytical, methods must be employed to ensure HAV safety.

Research Challenges In HAV Navigation Safety
Multiple technical aspects developed over decades for automated flying could serve as starting points for automated driving systems. Figure 2 shows research areas with overlap between aircraft (in blue) and car (in yellow) applications. Figure 2 is not intended to give a comprehensive list of all aspects of automation, but instead, it shows example technical areas that can be addressed using similar methods in aviation and automotive applications (in the green area). For example:

• performance standards set for software, communication, and electronic equipment are already being compared for aircraft versus cars in the NHTSA report by Q. D. Van Eikema Hommes, Additional Resources.
• the design of aircraft cockpit has been continuously improved over the past few decades, especially for highly-automated Unmanned Air Systems (UAS) with a remote pilot “in-the-box”; few car manufacturers envision futuristic car interiors where humans do not participate in driving, but as long as human-machine interactions are needed, lessons learned in cockpit design to avoid information overload are key. 
• while Automatic Dependent Surveillance-Broadcast (ADS-B) will be mandatory on all aircraft by 2020, a petition for proposed rule making has been issued to mandate Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) by the same date. (ADS-B is a situational awareness system for collision avoidance, through which aircraft share their positions with Air Traffic Control and with other aircraft.) 
• GNSS/INS navigation systems, which are extensively used in safety-critical aircraft navigation, are also being investigated for HAVs.
• overall safety standards also have similarities for aircraft and HAVs, which are discussed again below.

The focus of this article is on navigation safety. In aviation navigation, safety is assessed in terms of integrity (as well as accuracy, continuity, and availability, which are not discussed for brevity). Integrity is a measure of trust in sensor information: integrity risk is the probability of undetected sensor errors causing unacceptably large positioning uncertainty (See RTCA Special Committee 159, “Minimum Aviation System Performance Standards for the Local Area Augmentation System (LAAS), Additional Resources”). This top-level quantifiable performance metric is sensor- and platform-independent, and can thus be used to set certifiable requirements on individual system components to achieve and prove an overall level of safety.

The multiple separate efforts towards achieving Levels 3-to-5 HAVs reveal a compelling lack of coordination towards a common, uniform, quantifiable safety goal. Integrity can be used as an objective performance metric for open, transparent comparison and categorization across manufacturers. It can also provide a governmental regulating agency performance and testing standards for HAV certification, which would help accelerate the development, growth, and maturation of such HAVs, as displayed in Figure 3.

Moreover, the Federal Aviation Administration (FAA) has developed analytical methods to evaluate integrity. This provides the means to:

• quantify safety of existing multi-sensor systems under a variety of operating environments, thereby reducing the need for experimental testing
• allocate safety requirements to individual system components to achieve an overall target level of safety, thereby enabling design for safety 
• perform risk prediction, which is a key operational feature to enable hazard avoidance maneuvers

Several methods have been established to predict the integrity risk in GNSS-based aviation applications, which are instrumental in ensuring the safety of pilots and crew. As an example, Figure 4 illustrates a simplified definition of the integrity risk for aircraft landing applications. The aircraft positioning prediction is uncertain because of sensor measurement noise. An alert limit (AL) requirement box is represented around the predicted aircraft position. This AL is set by the certification authority, i.e., by the FAA in this application. Simply put, the risk of the actual aircraft position being outside the AL box is the integrity risk. (In practice, the most challenging part of risk prediction is to account for potentially undetected sensor faults, such as excessive GNSS satellite clock drift.)

Unfortunately, the same methods do not directly apply to HAVs, because ground vehicles operate under sky-obstructed areas where GNSS signals can be altered or blocked by buildings and trees. In general, the HAV environment is much more unpredictable than the aircraft’s, for reasons that include:

• a changing environment: traffic lights, construction, impact of rain on road adherence, sensor masking and occlusions,
• environmental diversity: intersection topography, road conditions, markings on ground, various traffic signs 
• road users that may interfere with HAV motion: other cars, trucks, pedestrians, bicyclists, etc. 
• comparatively large number of car manufacturers, equipment suppliers, and vehicle models, as well as with shorter model cycles than aircraft, causing wide variations in vehicle age and maintenance levels 
• non-uniform vehicle and road regulations at both the state and federal levels in the U.S. coupled with different international standardization processes.

Thus, HAVs require sensors in addition to GNSS, including laser scanners, radars, cameras, and odometers.

The parallel between aircraft and car applications in Figure 4 illustrates the significant challenge that lies ahead when bringing aviation safety standards to HAVs. It took decades of research and considerable resources to bring the alert limit requirement box down to 10 meters above and below the aircraft using the FAA’s GPS augmentation systems (the Wide-Area Augmentation System and the Local Area Augmentation System). For a car to stay in its lane, the alert limit requirement box must be an order of magnitude smaller, and has to maintain this level of safety in a more dynamic and unpredictable environment.

HAV Taxonomy
Creating a path to successful automated navigation requires an overall methodology to prioritize on imminently achievable objectives, and then expand to more challenging missions. First in this HAV taxonomy, a classification using six SAE autonomy levels has been presented in Table 1. This classification is further refined by segmenting a car’s trip into basic driving competencies, and by specifying the conditions under which a given HAV shall achieve these competencies. A similar classification was made in the early days of GPS-based commercial aircraft navigation safety analysis, where distinctions were made between different phases of flight, weather conditions, vehicle equipment, and airport infrastructure capabilities.

For example, in the early 1990’s, 40% of aircraft accidents were occurring during final approach and landing, and 26% during take-off and initial climb, which only represented an average of 4% and 2% of flight time, respectively. The FAA therefore concentrated their efforts on improving safety during these phases of flight. GPS augmentation systems were designed, with varying capabilities depending on airborne equipment and airport infrastructure, to guide the aircraft under the cloud ceiling, or to bring it all the way to touch-down. Similarly, the “first and last mile” are identified as the most challenging parts of HAV operations, whereas highway auto-drive systems have already been developed and implemented. In its 2016 Federal Automated Vehicles Policy, NHTSA identifies 28 HAV behavioral competencies, which are particularly challenging to meet in the first and last miles of a typical trip. These competencies are basic abilities that an HAV must have to complete nominal driving tasks; they include, for example, lane keeping, obeying traffic laws, and responding to other road users.

To better describe an HAV’s ability, the Federal Automated Vehicles Policy further specifies that basic driving competencies should be available under an HAV’s predefined Operational Design Domain (ODD), described by its geographical location, road type and condition, weather and lighting condition, vehicle speed, etc. The ODD captures the circumstances under which an HAV is supposed to operate safely.

Such classification is key to safety analysis. It can allow HAVs at different stages of their development to be simultaneously fielded, and for them to evolve by expanding their ODDs. The classification can also help in identifying geographical areas where improved road infrastructure is needed for automated operation, similar to airports requiring equipment for instrument navigation to deal with higher traffic density.

Furthermore, standards for electronic equipment, measured by Automotive Safety Integrity Levels, have been issued and compared with the aviation’s Design Assurance Levels (DAL). And, overall system safety levels have been codified, which in aviation account for both the severity and probability of occurrence of an incident, and in automotive applications account, in addition, for “controllability”, which is a measure of how likely an average driver is to maneuver out of a given imminent danger.

All of the above elements: (a) HAV autonomy level, (b) basic driving competency, (c) operation design domain, (d) vehicle electronic equipment, and (e) overall safety risk requirement must be specified to carry out a formal HAV safety analysis. Still missing from the HAV documents are clear guidelines, or example methods, on how to implement these safety requirements.

A Path Towards HAV Navigation Safety
When quantifying the safety of HAV navigation systems, such as in the example displayed in Figure 5, every component of the system including raw sensors, estimator and integrity monitor, and safety predictor, can potentially introduce risk. Unlike aircraft, HAVs require multiple and varied sensors to compensate for GPS signal blockages caused by buildings and trees. These sensor types must be integrated, and new methods to evaluate the integrity of multi-sensor systems must be developed. Furthermore, HAVs must have the ability to continuously predict integrity in a dynamic HAV environment.

In general, research on analytical evaluation of HAV navigation safety is sparse. For example, J. Lee et alia, Additional Resources use the concept of a “safe driving envelope,” but the approach focuses mostly on collision avoidance. The paper by O. Le Marchand, et alia, evaluates ground vehicle navigation, but shows an “approximate radial-error” of tens of meters, far exceeding the necessary sub-meter alert limit. A multi-sensor augmented-GPS/IMU system is used in the paper by R. Toledo-Moreo, et alia with “horizontal trust levels” of 7 meters to 10 meters, still an order-of-magnitude higher than the required HAV alert limit.

Multi-sensor integrity is addressed by M. Brenner, Additional Resources, but for a sensor combination specific to aviation and insufficient for terrestrial mobile robots. Other approaches to multi-sensor integration show promise, but do not provide rigorous proof of integrity. In fact, most publications use pose estimation error covariance as a measure of performance, which is understood as not being sufficient, but is the only metric currently available. Most critically, the metric does not account for fault modes introduced by feature extraction and data association, two algorithms commonly used in mobile robot localization (and discussed again below).

Unlike GPS, which gives absolute position fixes, IMUs, LiDAR, radar, and cameras provide relative displacements with respect to a previous time-step, or with respect to a map. Thus, measurement time-filtering is required, which makes integrity risk evaluation more challenging since past-time sensor errors and undetected faults can now impact current-time safety.

Example LiDAR Navigation Safety Evaluation
While safety quantification for GNSS and GNSS/INS has been rigorously performed for aviation applications, and is being researched for HAVs, navigation safety for LiDAR, radar, camera, and multi-sensor navigation is a widely unexplored research area. To provide a specific example on the research work that lies ahead, we have started developing safety risk evaluation methods for LiDARs. We selected LiDARs because of their prevalence in HAVs, of their market availability, and because of our prior experience. However, the techniques we are developing are general enough that radar, cameras, or any future sensor that returns range data can be substituted.

Raw range data must be processed before it can be used for navigation. One technique, visual odometry, establishes correlations between successive scans to estimate sensor changes in pose (i.e., position and orientation). These processes are highly computationally intensive, and have the same problems as other dead-reckoning techniques, such as wheel odometry over time. Thus, they can become inaccurate or cumbersome for HAVs moving over multiple time epochs. Although proprietary information regarding the use of visual odometry by HAV manufacturers is unavailable, the research literature suggests that it is only used for short time scale operations. A second class of algorithms provides sensor localization by extracting static features from the raw sensor data and associating those features to a map. This is typically done in two steps, as illustrated in Figure 6: feature extraction (FE) and data association (DA). The resulting information can then be iteratively processed using sequential estimators (e.g., Extended Kalman filter or EKF), which has been readily used in many practical applications.

There are several problems that the FE and DA algorithms are addressing. First, landmarks in the environment are unidentified, and their observations are not tagged in a manner similar to a GNSS satellite signal’s Pseudo Random Noise (PRN) number. Thus, the feature extraction algorithm must isolate the few most consistently identifiable, viewpoint-invariant landmarks in the raw sensor data. These features must be identifiable over repeated observations and distinguishable from one landmark to another. Features that are difficult to distinguish from each other can be found easily, but the possibility that the association is incorrect will greatly negatively impact the integrity risk.

Second, range data based on extracted features must match those features with those from a feature database or map. Data association algorithms accomplish this; however, incorrect associations commonly occur. These can lead to large navigation errors, as illustrated in Figure 6, thereby representing a threat to navigation integrity.

FE and DA can be challenging in the presence of sensor uncertainty. This is why many sophisticated algorithms have been devised. But, how can we prove whether these FE and DA methods are safe for life-critical HAV navigation applications, and under what circumstances? These research questions are currently unanswered. The most relevant publications on DA risk are found in literature on multi-target tracking. For example, in the paper Y. Bar-Shalom and T. E. Fortmann, an innovation-based nearest-neighbor DA criterion is introduced, which serves as basis in many practical implementations. The article by Y. Bar-Shalom, et alia, “The Probabilistic Data Association Filter,” provides a detailed derivation of the probability of correct association given measurements. However, this Bayesian approach is not well suited for safety-critical applications due to the lack of risk prediction capability, and to the problem of bounding the a-posteriori probability of association (a similar issue is encountered in the paper by F.C. Chan, et alia. Another insightful approach is followed in the paper by J. Areta, et alia). However, it makes approximations that do not necessarily upper-bound risks, hence do not guarantee safe operation, and it presents exact solutions that can only be evaluated using computationally expensive numerical methods, not adequate for real-time navigation. Also, the risk of FE is not addressed.

In response, we have been developing a new, computationally-efficient integrity risk prediction method to ensure safety of localization using LiDAR-based FE and DA. We have derived a multiple-hypothesis innovation-based DA method that provides the means to predict the probability of incorrect associations considering all potential landmark permutations. (For more details on these methods, see the following four papers in Additional Resources, Nos. 31, 49, 50 and 51.) We also determined a probabilistic lower bound on the minimum feature separation, which is guaranteed at FE, with pre-defined integrity risk allocation. The separation bound can be incorporated in an overall integrity risk equation. This new method was analyzed and tested to quantify the impact of incorrect associations on integrity risk. It showed that the positioning error covariance can be a misleading safety performance metric since cases were found where the contributions of incorrect associations to integrity risk far surpassed that of nominal errors accounted for in the positioning error covariance. In addition, the following key safety-tradeoff was illustrated: the more measurements are extracted, the lower the integrity risk contribution is under the correct association hypothesis, but the higher the other integrity risk contributions become because the risk of incorrect associations increases in the presence of cluttered, poorly-distinguishable landmarks. Finally, being surrounded by many landmarks increases the probability of continuous, uninterrupted navigation. The next step of this research aims at dealing with unmapped and non-static obstacles, and at quantifying the continuity risk of FE and DA.

Conclusion
Looking at the emergence of future HAV technology with the prior experience of aircraft navigation safety provides the means to scale up the challenges that lie ahead in the development of fully autonomous (Level 4 and 5) driverless cars. Many parallels can already be drawn between aviation safety requirements and early HAV standards and regulations. Still, the methods to fulfill these standards and regulations have to be established. If analytical methods are pursued, the following tasks need to be accomplished: (1) establish high-integrity raw sensor measurement error and fault models for non-GPS sensors; (2) develop analytical methods to quantify the safety risk of feature extraction and data association algorithms required in LiDAR, radar, and other pre-processing steps in camera-based localization; (3) design multi-sensor pose estimators and integrity monitors to evaluate the impact of undetected sensor faults on safety risk; and (4) derive, analyze, and experimentally implement integrity risk prediction in dynamic environments.

If these challenges are overcome, one will be able to quantify and prove the performance of an HAV’s navigation system — an essential part of safety. Proving navigation system integrity will also help give humans more confidence to trust HAVs, thus further developing the symbiotic relationship between humans and co-robots. Finally, as HAV technology progresses from driver’s aids such as active brake assist to full autonomous driving, this research is relevant now and will remain essential throughout the evolution of HAV technology.

Additional Resources
[1] Abuhashim, T.S., M.F. AbdelHafez, and M.-A. AlJarrah. Building a robust integrity monitoring algorithm for a low cost gps-aided-ins system. International Journal of Control, Automation, and Systems, 8(5):11081122, 2010.
[2] Ackerman , E., “Self-Driving Cars Were Just Around the Corner—in 1960”, IEEE Spectrum, September 2016
[3] Ackerman, E., “After Mastering Singapore’s Streets, NuTonomy’s Robo-taxis Are Poised to Take on New Cities,” IEEE Spectrum, 2016.
[4] Areta, J., Y. Bar-Shalom, and R. Rothrock, “Misassociation Probability in M2TA and T2TA,” J. of Advances in Information Fusion, Vol. 2, No. 2, 2007, pp. 113-127.
[5] Bailey, T., Mobile Robot Localization and Mapping in Extensive Outdoor Environments. PhD thesis, The University of Sydney, 2002.
[6] Bailey, T., and J. Nieto. Scan-slam: Recursive mapping and localization with arbitrary-shaped landmarks. In Workshop at the Institute of Electrical and Electronics Engineers Robotics Science and Systems (IEEE RSS), 2008.
[7] Bakhache, B., A Sequential RAIM Based on the Civil Aviation Requirements. In Proceedings of the 12th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GPS 1999), pages 1201–1210, 1999.
[8] Basnayake, C., M. Joerger, and J. Aulde, “Safety-Critical Positioning for Automotive Applications”, Inside GNSS Webinar, 2016.
[9] Bar-Shalom, Y., F. Daum, and J. Huang, “The Probabilistic Data Association Filter,” IEEE Control Systems Magazine, 2009, pp. 82-100.
[10] Bar-Shalom, Y., and T. E. Fortmann. Mathematics in Science and Engineering, chapter Tracking and Data Association. Academic Press, 1988.
[11] Bengtsson, O., and A.J. Baerveldt, “Robot localization based on scan-matching-estimating the covariance matrix for the IDC algorithm,” Robotics and Autonomous Systems, Vol. 44, 2003, pp. 29–40.
[12] Bonanni, R., “WAAS – LPV Airport and Aeronautical Surveys”, ANM Airports Conference, 2006.
[13] Bhuiyan, J., “Uber’s autonomous cars drove 20,354 miles and had to be taken over at every mile, according to documents,” available online here, 2016
[14] Blom, H.A.P., and Y. Bar-Shalom. The interacting multiple model algorithm for systems with markovian switching coefficients. IEEE Transactions on Automatic Control, 33(8):780783, 1988.
[15] Brenner, M., Integrated GPS/Inertial Fault Detection Availability. NAVIGATION, Journal of The Institute of Navigation, 43(2):111–130, 1996.
[16] Chan, F.C., M. Joerger, S. Khanafseh, and B. Pervan, “Bayesian Fault-Tolerant Position Estimator and Integrity Risk Bound for GNSS Navigation,” Journal of Navigation of the RIN, available on CJO2014, doi:10.1017/S0373463314000241, 2014.
[17] Chow, E., and A. Willsky. Analytical redundancy and the design of robust failure detection systems. IEEE Transactions on Automatic Control, 29(7):603614, 1984.
[18] Choukroun, D., and J. Speyer. Mode estimation via conditionally linear filtering: Application to gyro failure monitoring. AIAA Journal of Guidance, Control, and Dynamics, 65(2):632644, 2012.
[19] Clot, A., C. Macabiau, I. Nikiforov, and B. Roturier. Sequential RAIM Designed to Detect Combined Step Ramp Pseudo-Range Error. In Proceedings of the 19th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS 2006), page 26212633, 2006.
[20] ooper, A.J., A Comparison of Data Association Techniques for Simultaneous Localization and Mapping. PhD thesis, Massachusetts Institute of Technology, 2005.
[21] DARPA, “The Six Finishers of the DARPA Urban Challenge,” available online here, 2007.
[22] Defense Advanced Research Projects Agency (DARPA), “Robots conquer DARPA Grand Challenge,” Press Release, U.S. Department of Defense (DoD), 2005.
[23] Department of Transportation (DOT) National Highway Traffic Safety Administration (NHTSA) “Federal Automated Vehicles Policy: Accelerating the Next Revolution In Roadway Safety,” 2016
[24] Diesel, J., and S. Luu. GPS/IRS AIME: Calculation of Thresholds and Protection Radius Using Chi-Square Methods. In Proceedings of the 8th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS 1995), page 19591964, 1995.
[25] Dionne, D., Y. Oshman, and D. Shinar. Novel adaptive generalized likelihood ratio detector with application to maneuvering target tracking. AIAA Journal of Guidance, Control, and Dynamics, 29(2):465474, 2006.
[26] Diosi, A., and L. Kleeman, “Laser scan matching in polar coordinates with application to SLAM,” Proc. IEEE/RSJ IROS, 2005.
[27] Dissanayake, G., P. Newman, S. Clark, H. Durrant-Whyte, and M. Csorba. A Solution to the Simultaneous Localization and Map Building (SLAM) Problem. IEEE Transactions on Robotics Automation, 17(3):229–241, 2001.
[28] Dougherty, M., “Caltrans Leadership in Automated Vehicle Research,” Automated Vehicles Symposium 2017 (AVS2017), San Francisco, CA, 2017.
[29] Dragalin, V.P., A.G. Tartakovsky, and V.V. Veeravalli. The interacting multiple model algorithm for systems with markovian switching coefficients. IEEE Transactions on Information Theory, 45(7):24482461, 1999.
[30] Dragalin, V.P., A.G. Tartakovsky, and V.V. Veeravalli. Multihypothesis sequential probability ratio tests. ii. accurate asymptotic expansions for the expected sample size. IEEE Transactions on Information Theory, 46(4):13661383, July 2000.
[31] Duenas-Arana, G., M. Joerger, and M. Spenko, “Minimizing Integrity Risk via Landmark Selection in Mobile Robot Localization,” submitted to IEEE TRA, 2017.
[32] FAA, “System Design and Analysis,” Advisory Circular AC 25.1309-1A, 1988.
[33] FAA, “System Safety Design and Analysis for Part 23 Airplanes”, Advisory Circular AC 23.1309-1E, 2011.
[34] fars.NHTSA.dot.gov, “Fatality analysis reporting system,” Technical report, NHTSA, 2014.
[35] Federal Aviation Administration (FAA), “Automatic Dependent Surveillance-Broadcast Operations,” Advisory Circular AC No: 90-114A, DoT FAA, 2016.
[36] Federal Highway Administration (FHWA), “Vehicle Positioning Trade Study for ITS Applications”, FHWAJPO-12-064, 2012.
[37] Fenton, R. E., and K. W. Olson “The electronic highway” IEEE Spectrum, 1969.
[38] Forsberg, “NovAtel Establishes Advanced Research Partnership with Illinois Institute of Technology and the University of Arizona,” press release, 2016, available here.
[39] Gartner’s “2016 Hype Cycle for Emerging Technologies” available online here.
[40] Gertler, J., A survey of model based failure detection and isolation in complex plants. IEEE Control Systems Magazine, 8(6):3–11, 1988.
[41] Gitlin, J., “Prepare for the part-time self-driving car,” online at arstechnica.com, 2014.
[42] Google, “Google self-driving car testing report on disengagements of autonomous mode”, available online here, December 2015.
[43] Greenblatt, J. B., and S. Saxena, “Autonomous taxis could greatly reduce greenhouse-gas emissions of us light-duty vehicles,” Nature Climate Change, 5:860–863, 2015.
[44] Greiling Keane, A., “U.S. highway deaths decline for a fifth year, longest streak since 1899,” Bloomberg, Published December 08, 2011.
[45] Halsey III, A., and M. Laris, “Blind man sets out alone in Google’s driverless car,” The Washington Post, 2016.
[46] Hewitson, S., and J. Wang. Extended Receiver Autonomous Integrity Monitoring (eRAIM) for GNSS/INS Integration. Journal of Surveying Engineering, 136(1):13–22, 2010.
[47] Hype cycle curves available online here.
[48] International Organization for Standardization (ISO), “Road vehicles – Functional safety”, ISO 26262, 2011.
[49] Joerger, M., “Carrier Phase GPS Augmentation Using Laser Scanners and Using Low Earth Orbiting Satellites,” Ph.D. Dissertation, Illinois Institute of Technology, 2009.
[50] Joerger, M., M. Jamoom, M. Spenko, and B. Pervan, “Integrity of Laser-Based Feature Extraction and Data Association,” Proc. IEEE/ION PLANS 2016, Savannah, GA, 2016, pp. 557-571.
[51] Joerger, M., B. Pervan, “Continuity Risk of Feature Extraction for Laser-Based Navigation,” Proceedings of the 2017 International Technical Meeting of The Institute of Navigation, Monterey, California, January 2017, pp. 839-855.
[52] Joerger, M., and B. Pervan, “Quantifying Safety for Laser-based Navigation,” submitted to IEEE TAES, 2017.
[53] Kalra, N., and S. Paddock, “Driving to safety: How many miles of driving would it take to demonstrate autonomous vehicle reliability?” Technical Report RR-1478-RC, Rand Corporation, 2016.
[54] Kavanaugh-Brown, J., “Where the Research Meets the Road: Automated Highway Passes the Test ”, Government Technology, 1997. available here.
[55] Kelly, R., and J. Davis, “Required Navigation Performance (RNP) for Precision Approach and Landing with GNSS Application,” NAVIGATION, 1994.
[56] Lee, Y.C., “Analysis of Range and Position Comparison Methods as a Means to Provide GPS Integrity in the User Receiver,” Proc. of the 42nd Annual Meeting of The Institute of Navigation, Seattle, WA, 1986.
[57] Lee, J., B. Kim, J. Seo, K. Yi, J. Yoon, and B. Ko. Automated driving control in safe driving envelope based on probabilistic prediction of surrounding vehicle behaviors. Society of Automotive Engineers International Journal of Passenger Cars – Electronic and Electrical Systems, 8(1):207–218, 2015.
[58] Le Marchand, O., Philippe Bonnifait, Javier Ibaez-Guzmn, and David Btaille. Vehicle Localization Integrity Based on Trajectory Monitoring. In IEEE/RSJ International Conference on Intelligent Robots and Systems, pages 3453–3458, 2009.
[59] Leonard, J., and H. Durrant-Whyte. Directed Sonar Sensing for Mobile Robot Navigation. Kluwer Academic Publishers, 1992.
[60] Li, Y., and Olson E.B. A general purpose feature extractor for light detection and ranging data. Sensors, 10(11), 2010.
[61] Lorden, G., Procedures for reacting to a change in distribution. The Annals of Mathematical Statistics, 42(6):18971908, 1971.
[62] Lu, F., and E. Milios, “Globally Consistent Range Scan Alignment for Environment Mapping,” Autonomous Robots 4, 1997, pp. 333-349.
[63] Madhavan, R., H. Durrant-Whyte, and G. Dissanayake. Natural landmark-based autonomous navigation using curvature scale space. In Proceedings of the Institute of Electrical and Electronics Engineers International Conference on Robotics and Automation (IEEE ICRA), 2002.
[64] Malladi, D. P., and J. L. Speyer. A generalized shiryayev sequential probability ratio test for change detection and isolation. IEEE Transactions on Automatic Control, 44(8):1522–1534, 1999.
[65] Maksarov, D., and H. Durrant-Whyte. Mobile Vehicle Navigation in Unknown environments: a Multiple Hypothesis Approach. In IEEE Proceedings on Control Theory Applications, volume 142, pages 385–400, 1995.
[66] National Transport Safety Board (NSTB), “Preliminary Report, Highway HWY16FH018,” Accident Report ID: HWY16FH018, 2016. available online here.
[67] Neville, K., and K. Williams, “Integrating Remotely Piloted Aircraft Systems into the National Airspace System,” Remotely Piloted Aircraft Systems: A Human Systems Integration Perspective, Wiley, 2017.
[68] Nguyen, V., A. Martinelli, N. Tomatis, and R. Siegwart. A comparison of line extraction algorithms using 2d laser rangefinder for indoor mobile robotics. In Proceedings of the Institute of Electrical and Electronics Engineers/Robotics Society of Japan International Conference on Intelligent Robots and Systems (IEEE/RSJ IROS), 2005.
[69] NHTSA “National motor vehicle crash causation survey: Report to congress,” Technical Report DOT HS 811 059, U.S. Department of Transportation, 2008.
[70] NHTSA, “Federal Motor Vehicle Safety Standards; V2V Communications, Notice of Proposed Rulemaking (NPRM),” DoT NHTSA, 49 CFR Part 571, RIN 2127-AL55, 2016, available online here.
[71] NHTSA “Assessment of Safety Standards for Automotive Electronic Control Systems”, DOT HS 812 285, 2016.
[72] Nikiforov, I., New Optimal Approach to Global Positioning System/Differential Global Positioning System Integrity Monitoring. AIAA Journal of Guidance, Control, and Dynamics, page 10231033, 1996.
[73] Nunez, P., R. Vazquez-Martin, J.C. del Toro, and A. Bandera. Feature extraction from laser scan data based on curvature estimation for mobile robotics. In Proceedings of the Institute of Electrical and Electronics Engineers International Conference on Robotics and Automation (IEEE ICRA), 2006.
[74] Othman, N.A., and H. Ahmad. The analysis of covariance matrix for kalman filter based slam with intermittent measurement. In Proceedings of the 2013 International Conference on Systems, Control and Informatics, 2013.
[75] Page, E.S., Continuous inspection schemes. Biometrika, 41(1-2):100–115, 1954.
[76] Parkinson, B.W., and P. Axelrad, “Autonomous GPS Integrity Monitoring Using the Pseudorange Residual,” NAVIGATION, Vol. 35, No. 2, 1988.
[77] Pfister, S.T., K.L. Kriechbaum, S.I. Roumeliotis, and J.W. Burdick. Weighted range sensor matching algorithms for mobile robot displacement estimation. In Proceedings of the Institute of Electrical and Electronics Engineers International Conference on Robotics and Automation (IEEE ICRA), 2002.
[78] Pfister, S.T., S.I. Roumeliotis, and J.W. Burdick. Weighted line fitting algorithms for mobile robot map building and efficient data representation robotics and automation. In Proceedings of the Institute of Electrical and Electronics Engineers International Conference on Robotics and Automation (IEEE ICRA), 2003.
[79] Radio Technical Commission for Aeronautics (RTCA), “Minimum Operating Performance Standards (MOPS) for Universal Access Transceiver (UAT) Automatic Dependent Surveillance – Broadcast (ADS-B),” RTCA, Washington DC, 2009.
[80] RTCA Special Committee 159, “Minimum Aviation System Performance Standards for the Local Area Augmentation System (LAAS),” RTCA/DO-245, 2004.
[81] RTCA Special Committee 159, “Minimum Operational Performance Standards for Global Positioning System/Wide Area Augmentation System Airborne Equipment,” RTCA/DO-229C, 2001.
[82] Reimer, B., “Revisiting the Topic – The Future is Autonomous Driving – But Are “We” on a Near Term Collision Course?” Automated Vehicle Symposium 2017, (AVS2017), San Francisco, CA, 2017.
[83] Röfer, T., “Using Histogram Correlation to Create Consistent Laser Scan Maps,” Proc. IEEE IROS-2002, Lausanne, Switzerland, 2002, pp. 625-630.
[84] Rogowsky, M., “The Truth About Tesla’s Autopilot Is We Don’t Yet Know How Safe It Is”, Forbes, 2016.
[85] SAE International, “Surface Vehicle Recommended Practice: Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles,” SAE Standard J3016, 2016.
[86] Schoettle, B., and M. Sivak, “A Preliminary Analysis of Real-World Crashes Involving Self-Driving Vehicles,” Report No. UMTRI-2015-34, October 2015.
[87] Sobel, M., and A.Wald. A sequential decision procedure for choosing one of three hypotheses concerning the unknown mean of a normal distribution. The Annals of Mathematical Statistics, 20(4):502522, 1949.
[88] Soloviev, A., D. Bates, and F. van Graas. Tight Coupling of Laser Scanner and Inertial Measurements for a Fully Autonomous Relative Navigation Solution. NAVIGATION, Journal of The Institute of Navigation, 54(3):189 – 205, 2007.
[89] Soloviev, A., Multi-Sensor Fusion for Navigation of Autonomous Vehicles. In Proceedings of the 26th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS+ 2013), pages 3615 – 3632, 2013.
[90] Soloviev, A., C. Yang, M. Veth, and C. Taylor. Assured Vision Aided Inertial Localization. In Proceedings of the 27th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS+ 2014), pages 2160 – 2173, 2014.
[91] Sukkarieh, S., E.M. Nebot, and H.F. Durrant-Whyte. A high integrity imu/gps navigation loop for autonomous land vehicle applications. IEEE Transactions on Robotics and Automation, 51(3):572578, 1999.
[92] Toledo-Moreo, R., M. A. Zamora-Izquierdo, B. beda Miarro, and A. F. Gmez-Skarmeta. High-Integrity IMMEKF-Based Road Vehicle Navigation With Low-Cost GPS/SBAS/INS. IEEE Transactions on Aerospace and Electronic Systems, 8(3):491–511, 2007.
[93] Tena Ruiz, I., Y. Petillot, D.M. Lane, and C. Salson. Feature extraction and data association for AUV concurrent mapping and localization. In Proceedings of the Institute of Electrical and Electronics Engineers International Conference on Robotics and Automation (IEEE ICRA), 2001.
[94] Thrun, S., W. Burgard, and D. Fox. A probabilistic approach to concurrent mapping and localization for mobile robots. Machine Learning and Autonomous Robots, 31(5):1–25, 1998.
[95] Thrun, S., W. Burgard, and D. Fox. A real-time algorithm for mobile robot mapping with applications to multi-robot and 3d mapping. In Proceedings of the Institute of Electrical and Electronics Engineers International Conference on Robotics and Automation (IEEE ICRA), 2000.
[96] Thrun, S., “Robotic Mapping: A Survey,” Exploring Artificial Intelligence in the New Millenium. Morgan Kaufmann Publishers Inc., 2003.
[97] Thrun, S., “National Highway Traffic Safety Administration (NHTSA),” keynote presentation, ION GNSS 2007, Fort Worth, TX, 2007.
[98] Van Eikema Hommes, Q. D., “Assessment of safety standards for automotive electronic control systems,” NHTSA Report No. DOT HS 812 285, Washington, DC, 2016.
[99] Waymo, “We’ve reached 3 million miles of selfdriving on public roads! That’s 1 million miles in just 7 months,” available online here, 2017.
[100] White, N. A., P.S. Maybeck, and S.L. DeVilbiss. Detection of interference/jamming and spoofing in a dgps-aided inertial system. IEEE Transactions on Aerospace and Electronic Systems, 34(4):12081217, 1998.
[101] Wikipedia , “Automotive Safety Integrity Level,” 2017. available here.
[102] Williams, S.B., G. Dissanayake, and H. Durrant-Whyte. An efficient approach to the simultaneous localization and mapping problem. In Proceedings of the Institute of Electrical and Electronics Engineers International Conference on Robotics and Automation (IEEE ICRA), 2002.
[103] Willsky, A. S., A Survey of Design Methods for Failure Detection in Dynamic Systems. Automatica, 12:601–611, 1976.
[104] Working Group C ARAIM Technical Subgroup, “Milestone 3 Report,” Technical report, EU-US Cooperation on Satellite Navigation, 2015.
[105] Yoshida, J., “Another Tesla Crash, What It Teaches Us,” EE Times, 2016.

The post Towards Navigation Safety for Autonomous Cars appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Today’s headlines frame my thoughts about securing GNSS assets, which one expert has characterized as our “least visible and most vulnerable infrastructure.”

In the Columbia River Gorge, a National Scenic Area spanning the Washington-Oregon border, a 15-year-old boy has been accused of intentionally tossing fireworks into tinder-dry grass thereby starting a (thus far) 33,000-acre forest fire that has devastated a natural treasure. Meanwhile, in the latest incident of large-scale identity theft, credit-rating agency Equifax has belatedly acknowledged a months-long breach of its database in which 143 million personal records were reportedly accessed.

In one case, an individual — obliviously or purposefully — creates outsized havoc, in the other, a skilled team of professional thieves disrupt a global enterprise and endanger the financial well-being of millions.

Of course, we have headlines closer to the point, such as “Reports of Mass GPS Spoofing Attack in the Black Sea,” or “South Korea developing eLoran Network to Protect Ships” from North Korean GPS jamming.

These latter incidents, of course, arise from state-sponsored or –enabled actions. But, as with the Columbia gorge fire, personal behaviors — often harder to detect and prevent — can similarly afflict GNSS capabilities. In recent years, considerable attention has focused on the use of small GNSS jammers, also known as “personal privacy devices.” Perhaps the best-known case is that of a trucker trying to jam his vehicle’s own receiver who interrupted GPS-aided landing operations at Newark International Airport.

As the articles on jamming and spoofing mitigation in this issue of Inside GNSS reflect, the motives and methods of perpetrators vary. But, given the natural progression of information-sharing and widening expertise in GNSS — along with our cultural soft spot for making heroes out of rebels and outlaws — we can probably assume that the trend toward disruption will only get worse.

Some GNSS user groups have struck out on their own to ensure the security of their constituencies and their particular needs. Military users benefit from a variety of alternative PNT technologies such as geomagnetic mapping, vision- and image-based navigation, and chip-scale atomic clocks and inertial measurement units. The U.S. Federal Aviation Administration has decided to retain, for the time being, a minimum operational network of VHF omnidirectional range (VOR) facilities originally planned to be phased out with the introduction of GNSS.

Over time, some of these alternatives may migrate into the commercial and professional space — then again, they may not. And the vast majority of individual GNSS consumers have no organizations to advocate for their needs.

So, what is to be done? How can we ensure that the positioning, navigation, and timing (PNT) utility is available to all users, and not just those sectors with the resources to develop solutions for themselves? The future of location-based applications and enterprise — and the associated economic benefits — depend on a satisfactory answer to that question.

Multi-level threats clearly require multi-tiered responses that fit the corresponding scope and scale of different domains. At the system level, GNSS providers are exploring such measures as encryption, signal authentication, stronger signal power, and advanced signal designs.

National and international legal/initiatives include such efforts as regulating the sale and use of GNSS jammers and spoofers. Alternative PNT systems — for example, enhanced Loran (eLoran) — represent a potential multinational approach to the problem.

At the level of user equipment, several GNSS manufacturers are incorporating interference detection and mitigation (IDM) and antispoofing capabilities into proprietary products.

The variety of these initiatives and their advocates illustrates the breadth of concern about assured PNT, but also reflect the fractured nature of responses to the threats to GNSS. The situation calls for leadership with the expertise and stature to bring comprehensive solutions before the wider GNSS community.

The International Committee on GNSS has the membership and forum, if not yet the clear mandate, to impose such solutions globally. At the national level, the U.S. Space-Based PNT Executive Committee assisted by its expert advisory panel seems the most likely candidate for this role.

The post Ensuring PNT for All appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Q: How do you use GNSS to compute the attitude of an object?

A: GNSS technology is used to support a wide range of position, velocity and time applications across numerous platforms. One of the lesser-known applications of GNSS is its ability to determine the attitude, or orientation, of an object. Such systems can be made to be quite small and can yield accurate solutions that operate in virtually any environment in which GNSS satellite visibility is reasonable. The only requirement from a GNSS receiver perspective is that the receiver be able to provide reliable carrier phase measurements.

This article begins with a brief summary of how the attitude of a vehicle is determined and then explains how GNSS can be used. It wraps up with a brief discussion about attainable accuracies.

Attitude Determination
Attitude determination is the process of determining the rotation angles that relate two different coordinate frames. Although any two coordinate frames can be used, we herein consider the rotation between a local-level frame (e.g., North, East, Up or East, North, Down, etc.) and the body frame. The body frame is a frame attached to the object (“body”) whose attitude is desired (an example body frame is given later).

With this in mind, we present the following key relationship

r⃗^l = R^l_br⃗^b     (1) 

where r⃗ is a vector parameterized in the local-level (superscript l) or body (superscript b) frame and R^l_b is the rotation matrix (or direction cosine matrix) from the body frame to the local-level frame.

The rotation matrix between any two frames can be defined using three consecutive rotations about the three coordinates axes — these are called Euler angles. For the case under consideration, since one of the frames is the local-level frame, the Euler angles can be expressed as familiar roll, pitch and azimuth angles.

To compute the rotation matrix, one needs to know or measure at least two vectors in each coordinate frame. These vectors could be anything including velocity, rotation rates, etc., as long as they are non-collinear (i.e., not parallel). It is possible to use a single vector, but then you cannot determine all three Euler angles; more on this later.

GNSS Attitude System Setup
For GNSS attitude determination systems, the vectors used in equation (1) are relative position vectors. The question, of course, is: where do these come from?

Before answering this question, let’s clarify what constitutes a GNSS attitude system. To determine the full attitude, at least three GNSS receivers are needed. The only other requirement is some software to process the data from these receivers.

Returning to the question that opened this section, the body frame vectors are defined by the location of the receivers (actually the antennas; denoted A ‒ C) on the object whose attitude is desired. Assuming a three-antenna system, a common (if not easy to understand) configuration is to mount the antennas such that two antennas fall along the direction of travel, and the third one is 90 degrees offset. One possible setup is illustrated in Figure 1 (see inset photo, above right) for the case of a road vehicle.

Once installed, the body frame coordinates are defined by measuring the position of the antennas relative to the coordinate frame of the vehicle. The coordinate frame of the vehicle can be arbitrarily defined but is usually selected such that one axis is along the direction of travel, one lateral to the direction of travel, and the third axis completes on orthogonal frame (e.g., forward, right, down).

As might be expected, these same vectors in the local-level frame are determined from GNSS measurements. Once computed, the rotation matrix between the body and local-level frames can then be determined. Both of these steps are accomplished by the processing software and are discussed in the next section.

Data Processing
As mentioned, the inter-antenna vectors in the local-level frame are computed from GNSS. For an N-antenna system, only N-1 independent vectors need to be solved. Although not required, this is commonly done by selecting one antenna/receiver as the “base” and then computing the vector to each of the other antennas/receivers in the system.

Continuing with the three-receiver example in Figure 1, we select antenna A as the base and compute vectors ray AB and ray BC. Of course, if there are other antennas, the vector from Point A to each point would also be computed.

To be more specific, the inter-receiver vectors are computed using standard differential carrier phase processing. Because the inter-antenna spacing is typically limited to a few meters, the spatially-correlated orbit, ionosphere and troposphere errors are virtually zero. This dramatically simplifies the ambiguity resolution process, since the only errors that need to be handled are multipath, noise and antenna phase center variation, which are generally small, as discussed later.

It is also possible to use the known baseline length between the receivers (as measured in the body frame), or any a priori attitude information to make the ambiguity resolution process even more robust.

Some of you might be wondering why I have not mentioned the requirement for a base station. The reason is precisely because we are estimating relative, not absolute, position vectors. By definition, differential data processing yields a relative position vector. If the location of the base station is known in an absolute sense — this is the most common use of a base station — then the resulting solution of the rover is also absolute.

For attitude determination, absolute location is not important. As such, the location of the base receiver (Point A in the above example) can be computed from a standalone (single point) solution. Even absolute positioning errors of 100 meters (which would be extremely large if the carrier phase data needed for attitude determination is still available) will be buried by the other errors in the system, and thus can be ignored.

The only other effect that might be important here is the timing accuracy of each receiver. As discussed in the March/April 2011 GNSS Solutions column, “GNSS Receiver Clocks,” a relative timing error of Δt between the receivers will result in a relative position error of s · Δt, where s is the speed of the vehicle. Assuming a timing error of 2 milliseconds (most receivers limit timing errors to ±1 milliseconds) and a vehicle traveling at 100 kilometers per hour, the relative positioning error would be approximately 5.6 centimeters. As discussed below, this would dominate the error budget and would therefore have to be properly accounted for.

The outputs of the GNSS processing are the vectors in the local-level frame; these can be computed directly in that frame or can be computed from vectors in an Earth-Centered Earth-Fixed (ECEF) frame. Mathematically, this is written as

r⃗^GNSS = r⃗^l + n⃗^GNSS
= R^l_br⃗^b + n⃗^GNSS     (2)

where r⃗^GNSS is the GNSS-derived vector in the local-level frame, n⃗^GNSS is the measurement noise, and equation (1) was used to get from the first to second line. Equation (2) is written in parametric form and can thus be used as input to any standard least-squares or Kalman filtering estimation algorithm to estimate the Euler angles embedded in R^l_b.

Two-Antenna Systems
Until now, we have only considered systems consisting of three or more receivers in order to estimate the full attitude of an object. However, two-receiver systems can be used to estimate rotations orthogonal to the vector connecting the two antennas.

The most common two-receiver system is one where the two receivers are set up parallel (or orthogonal) to the direction of travel. This allows for estimation of the azimuth and pitch (or roll) of the vehicle; the third angle is unobservable.

Expected Accuracy
As discussed above, the GNSS measurement errors are limited to multipath (2‒3 centimeters), noise (less than 1 millimeter) and phase center variation (1‒2 centimeters or less) (all values quoted as one standard deviation values). Assuming the measurement geometry is reasonable (HDOP ≈ 1 and VDOP ≈ 1.5), the main factor affecting accuracy is the length of the inter-antenna vectors.

To illustrate, let’s consider a two-receiver system with the understanding that there is an analogous relationship for three-plus receiver systems. Specifically, for the setup in Figure 2 (see inset photo, above right), for an inter-receiver separation of d, the pitch (ϕ) and azimuth (α) can be computed as

(see inset photo, above right for equations)

where σ_EIN is the North/East relative positioning uncertainty, σ_U is the vertical relative positioning accuracy, and d_h is the horizontal distance between the receivers. In other words, the longer the inter-receiver separation the better the attitude accuracy.

To give some numbers, for the lower- end measurement errors and DOP values listed at the start of this section, and nominal horizontal receiver separation of 1 meter, the pitch and azimuth accuracy would be 1.3 and 1.9 degrees, respectively. This is a one-off accuracy estimate and further filtering/ averaging would yield even better performance.

Summary
This article has given an overview of how GNSS can be used to determine the attitude of an object. Although reliant on ambiguity resolution, the short baselines involved make the process quite robust. The result can be highly accurate attitude estimates that can be applied to a wide range of applications.

The post How do you use GNSS to compute the attitude of an object? appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

GNSS is the technology of choice in most applications due to its dedicated infrastructure, Earth coverage, medium to high accuracy, and large market penetration. Most of the applications, including those we download on our smartphones, are in the category of Location Based Services (LBS). However, there are many other services and businesses that rely heavily on GNSS performance and reliability. For instance, Intelligent Transportation Systems (ITS) make extensive use of GNSS technology and this dependence will only grow in the future.

It’s not just that GNSS has become ubiquitous in our daily life, but many critical infrastructures worldwide have some sort of reliance on it. In addition to the already mentioned transportation systems, GNSS plays a significant role in synchronization in the power grid, high frequency trading operations, and synchronization of distant wireless communications towers.

This growing dependence on GNSS within critical (and non-critical) infrastructures has posed some concerns on the potential vulnerabilities of GNSS (see Amin et alia, “Guest Editorial: Vulnerabilities, threats, and authentication in satellite-based navigation systems,” in Additional Resources). As a consequence, there is a need for protecting GNSS against intentional and unintentional interference sources since disruption of GNSS can lead to catastrophic consequences.

The jamming threat, a specific form of intentional interference, is real and its occurrence has been documented in many occasions. Jamming devices are illegal in most (not all) countries, yet they are very easy and cheap to buy. Simple jammers can disrupt GNSS-based services in wide geographical areas (even in several kilometers), a fact that has certainly triggered research into anti-jamming techniques. Not only is jamming a threat, but other sources of unintentional interference can severely compromise GNSS performance.

This article aims at providing a discussion of classical mitigation techniques, while providing links to the field of robust statistics. This link provides a principled way of analyzing existing mitigation techniques, as well as conceiving new methodologies that rely on solid statistical principles. Purposely, we do not discuss interference detection techniques, leaving all the discussion to interference mitigation. Finally, the article introduces Transform Domain (TD) techniques and their robust versions, which are compared against time domain techniques using real data gathered in an experimental test.

The IC Principle
In this article, we are interested in both intentional and unintentional interference and, in either situations, the signal at the receiver antenna can be modeled as

y(t) = x_θ(t) + i(t) + w(t)     (1)

where x_θ(t) is the legitimate signal, made of different components coming from the visible GNSS satellites, i(t) represents the interference signal, and w(t) is the random contribution of the thermal noise. Notice that x_θ(t) is parameterized by θ, a vector containing the unknown parameters of the received signals such as their amplitude, time-delay, Doppler-shift, or carrierphase. For the i-th satellite signal, we define the parameters as A_i, τ_i, f_d,i, and φ_i respectively. Roughly speaking, the estimates of θ are used to solve for the position at the receiver side. Most of the commercial jamming devices transmit rather simple periodic signals whose frequency is time-varying, f_I(t). Therefore, a rather simple but general model is

i(t) = A_I cos(2π(f_RF + f_I)t + φ_I)     (2)

where A_I is the amplitude of the interfering signal, f_RF is the central Radio Frequency (RF), f_I(t) is the time-varying interference frequency, and φ_I represents its phase. Depending on the behavior of f_I(t) different jamming signals can be conceived such as Continuous Wave (CW) jammers when f_I(t) = f_I is a constant, or chirp-like jamming signals when f_I(t) evolves over time following a saw-tooth pattern. Intuitively, the faster the variability and transitions of f_I(t), the harder it is to mitigate interference at the receiver side. At the receiver, we are interested in digital signal processing methods to counteract interferences, therefore we assume that y(t) is sampled at a rate (f_s = 1/T_s) satisfying the Nyquist criterion to yield its discrete-time version:

y[n] = x_θ[n] + i[n] + w[n]     (3)

A common approach to interference mitigation is to formulate it, statistically speaking, as an estimation problem. After detecting the interference, the set of unknown parameters characterizing the interfering signal needs to be estimated to enable Interference Cancellation (IC) at the receiver. A reconstructed version of the interference term, î[n], is subtracted from the observations such that a clean signal version is used afterwards by the receiver, ỹ[n] = y[n] – î[n]. The principle is depicted in Figure 1.

In the context of the standard operations of a GNSS receiver, IC can be better understood as the modification of the objective function in acquisition and tracking. Typically, GNSS receivers estimate the parameters of the received signals using a variety of methods that implement a Least Squares (LS) solution, where the input samples are compared with locally generated signal replicas. In particular, code delay, Doppler frequency and carrier phase are estimated as:

Equation (4) (see inset photo, above right, for equations)

Equation (5)

Notice that the subindex i denoting the satellite signal is hereafter omitted since we consider independent acquisition/tracking among satellites. c(·) denotes the spreading sequence for the satellite of interest and N the total number of samples used in the process. Cost function (5) can be minimized independently from A which can be estimated in a separate step. For this reason, the determination of A is not explicitly indicated in (4). In particular, it is possible to show that the minimization of (5) is equivalent to the maximization of the absolute value of the Cross-Ambiguity Function (CAF) defined as

Equation (6) 

In the IC case, the cost function is modified after gaining knowledge of the interference. More precisely, the signal model is extended in order to account for the interference term and the cost function is rewritten as

Equation (7)

where î[n] is the reconstructed version of the interference, which requires detection and estimation as for Figure 1.

Using these definitions, the main IC techniques can be defined. For instance, a popular method for pulsed interference mitigation, due its simplicity, is pulse blanking (see article by Borio, 2016, Additional Resources). At a glance, pulse blanking detects the presence of interference by identifying abnormally large values in the pre-correlation samples. This can be easily achieved by comparing |y[n]| to a predefined threshold T_PB. Then, the interfered samples are set to zero such that they are not used throughout the receiver. Mathematically, the estimated interference is

Equation (8)

which can be plugged in cost function (7) to understand how pulse blanking operates.

Robust Estimation
When the IC principle is used, the interfering term is treated as a signal component whose parameters should be estimated. A different approach for the design of interference mitigation techniques can be derived from the theory of robust statistics (see, for example, Huber and Ronchetti, Additional Resources). In this case, the receiver does not try to estimate the jamming signal but adopts processing strategies which can produce reasonable results even in the presence of interference.

The term “robust” is often used in the literal sense, in many cases just according to the definition provided by the dictionary. This has often generated confusion and algorithms defined as “robust” are not actually “statistically robust”. Robustness has to be intended here as a mathematical property of a system and can be assessed using rigorous criteria. An analogy can be made with the concept of Bounded Input Bounded Output (BIBO) stability: a system is BIBO stable if a bounded output is obtained for every bounded input. In a similar way, Qualitative Robustness states that a robust estimator is such that bounded departures from the assumed model do not cause it to provide aberrant results (see Hampel in Additional Resources). For instance, if an estimator assumes a Gaussian model for the observations, but outliers — which break the Gaussian assumption — are received and used, we expect the estimator to be relatively insensitive to them if claimed to be robust. For location estimators of the type

Equation (9)

i.e. that depend on a linear combination of input samples, y[n], processed by the non-linearity, ρ(·), robustness is obtained when ρ(·) is bounded. When pulse blanking is used, the CAF of the input samples is computed as:

Equation (10)

where, in accordance to (8), the non-linearity is

Equation (11)

is clearly a bounded function of the input samples. In this way, pulse blanking is not only a form of IC but is also a robust estimator for the CAF.

Although techniques implementing the IC principle can be robust, robust statistics provides, in general, a shift in the design paradigm for interference/jamming mitigation techniques. In particular, the focus is no longer in the definition of the most appropriate model for the interfering term, i(t), but on the search for robust procedures that allow the estimators to combat i(t) without actually estimating (or even detecting) it. A possible design strategy is to reformulate model (3) as

y[n] = x_θ[n] + w′[n]     (12)

where interference and noise are grouped together, with

w′[n] = i[n] + w[n]

In the robust estimation framework the goal is to adopt models for the aggregate term, w′{n}, which lead to robust estimators. In robust statistics, a model is considered as well, but its statistical assumptions are relaxed such that the estimators have some flexibility to process outlier measurements, which otherwise would make non-robust estimators diverge. In this respect, there exist several noise models which lead to robust estimators in classical robust statistical problems. It turns out that these models are also effective in the context of jamming mitigation in GNSS receivers. These models, which mainly characterize the statistics of w′{n}, include:

• Laplacian model: the aggregate noise term is assumed to follow a Laplace distribution.
• Cauchy model: the aggregate noise term is assumed to follow a Cauchy distribution.
• Student’s t model: the aggregate noise term is assumed to follow a t-distribution.

Other noise models could be considered for the design of different jamming mitigation techniques. Notice that, typically these distributions exhibit heavy-tail behavior, as opposite to the standard Gaussian assumption. From the aggregate noise model, robust mitigation techniques are finally obtained. We recently considered (see the paper presented by one of the authors at the 2017 European Navigation Conference and listed in Additional Resources):

• The usage of Zero-Memory Non-Linear (ZMNL) functions to pre-process the input samples.
• Non-linear correlators based, for example, on the median (which results from the Laplace noise assumption) and on the sample myriad (from the assumption of Cauchy noise).

The sample myriad is a location estimator, as the mean and the median, and it is defined, for real input samples, as

Equation (13)

where K is the linearity parameter of the Cauchy distribution (this is better explained in the following). A clear parallelism with the sample mean can be made: the mean is the argument which minimizes the sum of squares of the residuals, y[n]-μ. Additional details on the sample myriad can be found, for example, in the book by G. R. Arce listed in Additional Resources.

ZMNL functions can be directly obtained from the aggregate noise model as

ρ(y[n]) = –log f(y[n])     (14)

where f(y) is the probability density function (pdf) adopted to describe w′{n}. In this case, alternative versions of (10) are obtained by replacing ρ_PB(·) with ρ(·). In the ZMNL function case, the input samples are simply pre-processed using ρ(·) before being used by the standard correlator blocks. In this way, a robust CAF similar to (10) is obtained. In the second approach, it is recognized that the CAF is a weighted mean. The mean is inherently non-robust and thus, it can be replaced by robust operators such as the median and the myriad. For example, in the median case, the CAF in (6) becomes:

C_R(τ,f_d) = MEDIAN(y[n]c(nT_s – τ)e^{–j2πf_dnT_s}|n=0,1,…,N – 1).     (15)

Note that the samples at the input of the MEDIAN operator in (15) are complex. In this case, it is assumed that two independent medians are computed on the real and imaginary parts of the samples. These approaches introduce significant robustness in the case of pulsed jamming and allow receiver operations even in the close proximity of a jammer.

Time, Frequency, Scale and All the Others
By representing the input samples in a different domain, an advanced class of interference mitigation techniques arises. A classic example is the usage of the Discrete Fourier Transform (DFT) and its fast implementation, the Fast Fourier Transform (FFT), to project the input samples, y[n], into the frequency domain. In this way, a new set of samples, Y(k), is obtained. Here, the index, k, is used to denote the set of discrete frequencies. The rationale of operating in a different domain is that, in such domain, the interfering term, i[n], admits a sparse representation. This implies that, I(k), the TD representation of i[n], is significantly different from zero only for a relatively small number of values of k. I(k) will thus appear as a set of pulses which can be easily blanked in the TD.

Depending on the domain of the transformation, it is possible to classify the different interference mitigation techniques as in Figure 2. The figure also takes into account the receiver stages where the techniques are actually implemented. In particular, interference mitigation techniques are classified according to their implementation with respect to the correlation operation as

• Pre-correlation: the algorithm operates before the correlation process takes place. In this way, mitigation is performed for all the processing channels at once and the characteristics of the useful received signals are not taken into account.
• In-correlation: mitigation is performed by modifying the standard correlation process.
• Post-correlation: mitigation is applied at the output of the correlators. In this case, different processing can be applied to the signals from different channels.

Time domain techniques are those that do not require a preliminary transformation to bring the input samples in a different domain. In this respect, adaptive notch filtering and pulse blanking are time domain techniques commonly used for interference mitigation, both implementing the IC principle. Adaptive notch filtering is an effective technique where the instantaneous frequency of the jamming signal is continuously estimated. The region of the spectrum occupied by the jamming signal is then removed through filtering. Although notch filtering performs the excision of a narrow frequency band, it is implemented using a recurrence equation in the time domain and thus it does not require a signal transformation. Alternative classifications can be adopted. Pulse blanking can be seen as a robust technique (as discussed earlier), whereas notch filtering is very sensitive to model mismatches. The notch filter can only operate if the interfering signal is instantaneously narrowband and if its center frequency is slowly varying with time. Other examples of time domain approaches used for interference mitigation are the usage of ZMNL functions, as described above, and the adoption of a Kalman Filter (see Mitch et alia in Additional Resources) to track and reconstruct the jamming signal. This latter approach is, in general, non-robust and sensitive to deviations from the model adopted for the design of the Kalman Filter.

Time domain pre-correlation techniques are, in general, low-complexity and approaches such as pulse blanking and notch filtering are now commonly implemented in professional and mass-market receivers. Time domain processing can be integrated with the correlator and, for example, robust correlators discussed in the previous section can be adopted. The complexity depends on the approach adopted. The median can be implemented in a quite efficient way and its complexity is comparable with that of the mean performed in standard correlators. The computation of the sample myriad requires an iterative procedure which can be computationally expensive.

Post-correlation mitigation techniques are not explicitly indicated in Figure 2. Techniques operating at this stage tend to be “mixed” in the sense that post-correlation information is used to drive pre-correlation processing. Moreover, after correlation, the input samples are significantly down-sampled and, for this reason, adoption of different domains is usually not considered. Remarkably, post-correlation techniques are typically ineffective in terms of jamming suppression, the main reason being that correlation with the local code causes a spread out of the (uncorrelated) interference, which makes it harder to be mitigated. Degradations in post-correlation products, such as the estimated Carrier-to- Noise power spectral density ratio (C/N₀), can, however, be exploited for jamming detection.

In TD approaches, considered in the bottom row of Figure 2, the input signal, y[n], is projected into a different domain in the first place. These domains include frequency, with the usage of the DFT/FFT; joint time-frequency representations based, for example, on the Short Time Fourier Transform (STFT) or on the Wigner- Ville distribution; and joint timescale representations based on the Discrete Wavelet Transform (DWT). The Karhunen-Loeve Transform (KLT) has also been considered as a possible tool to obtain TD representations of the received GNSS signal, y[n]. Once in the TD, it is possible to apply techniques similar to those adopted in the time domain. TD excision is probably the most commonly adopted approach and it operates in a way analog to pulse blanking. If the absolute value of a sample in the TD is larger than a threshold, it is blanked and set to zero. Robust techniques can be also implemented in the TD, both at the pre- and in-correlation level. This topic is discussed in more detail in the next section. Although TD techniques are usually computationally demanding, several high-end professional receivers implement FFT-based algorithms and are able to perform interference detection and mitigation in the frequency domain.

In hybrid approaches the complexity of TD techniques is reduced using, for example, a bank of filters. The time domain signal is not transformed but split into several streams. Each stream is obtained using a separate filter which captures the content of the original signal on a specific frequency sub-band. This is a hybrid approach in the sense that each stream is a time domain representation of the frequency content of the original signal on a specific sub-band. Here, we referred to “frequency”, but other representation domains such as scale can be adopted for the design of the filter bank used for the signal decomposition. Approaches such as pulse blanking and the usage of ZMNL functions can then be implemented on the individual streams.

Finally, we would like to comment on spatial domain techniques, which can be used complementarily to the previously mentioned approaches. In this case, the time domain signal is not explicitly transformed but, instead, the signal is recorded using a multi-antenna receiver, which confers it with spatial discrimination capabilities. Conceptually, one can point to desired directions-of-arrival, while nulling the radiation pattern of the antenna at directions where an interference is detected. A detailed discussion is out of the scope of this article, but it suffices to say that pre- and postcorrelation techniques can be considered. Beamforming design can follow a plethora of options, being classified into temporal-, spatial-, or hybrid-reference beamforming techniques depending on the knowledge assumed for the desired and interfering signals. Typically, array processing techniques involve demanding computational resources and precise hardware designs.

Some general considerations on the properties of interference mitigation techniques are provided in Figure 3. In particular, the impact of model specification is analyzed. Strong model specifications reduce, in general, the flexibility and robustness of estimation methods to cope with (non-nominal) interference situations. This is the case of adaptive notch filters which can only deal with frequency modulated signals with slowly varying central frequencies. On the other hand, precise model specifications can significantly reduce the computational complexity of the technique and lead to optimal performance when the design conditions are met. For instance, notch filtering is computationally efficient and achieves performance comparable to that of TD techniques when dealing, for example, with CW interference.

TD techniques usually make only weak assumptions on the interference model. In particular, the underlying assumption is that the interfering signal admits a sparse representation in the TD. This corresponds to assuming that the interfering signals can be effectively described by a linear combination of few functions from a basis of the TD. For example, when the FFT/DFT is adopted, it is implicitly assumed that the interfering signal can be effectively described as the linear combination of few complex sinusoids. In general, weak assumptions on the interference model lead to flexible techniques which can operate in a wide range of conditions.

As a general principle, the increase of computational load should yield to performance improvements. When this improvement does not occur or it is limited, the mitigation technique should be re-considered. This phenomenon may occur for example when considering new TDs: the computational load of the transform required to project the input signal in the new TD might not be justified by the improvement of performance, for example, with respect to other TD techniques which can be implemented using fast algorithms such as the FFT.

Robust TD Approaches
Finally, we consider a new class of TD approaches which is based on the usage of ZMNL functions in the TD. More specifically, we assume that a linear transform, such as the DFT and the DWT, has been applied to the input signal and that the following TD samples have been obtained:

Y(k) = X_θ(k) + I(k) + W(k) = X_θ(k) + W′(k)     (16)

Since linear transforms are used, the superposition principle applies and the different components in (12) have a corresponding term in (16). In particular, it is possible to identify the useful signal components, the interference term and the noise term. In this approach, we propose to model the received signal directly in the TD rather than in the time domain. In particular, we focus on different noise models for the aggregate TD noise term, W′(k). As discussed in the section on robust estimation, the model does not need to be accurate but should be selected in order to obtain robustness. In other words, in robust statistics, optimality is sacrificed in favor of robustness. In this case, we considered two non-Gaussian noise models: the complex Laplace and the complex Cauchy distributions for W′(k).

Following an approach similar to that developed for the time domain (see article by Borio, 2017, in Additional Resources), robust TD interference mitigation techniques can be obtained by processing the TD samples using a ZMNL function. Figure 4.a provides a schematic representation of TD approaches implemented at the pre-correlation level. The input samples are projected into the TD, processed and used to reconstruct a clean version of the time domain input signal, y′[n]. In the approach proposed here, the processed samples, Y′(k), are given by

Y′(k) = ρ(Y(k))     (17)

where ρ(·) is the non-linearity defined by (14). In this case, f(y) has to be interpreted as the pdf of the aggregate noise in the TD. If a Laplacian model is adopted, the following non-linearity is obtained:

Equation (18)

This implies that the TD components of the input signal are normalized by their amplitude and only the phase information is retained. Eq. (18) leads to a normalization of the different TD components: when frequency is considered, the spectrum of the output signal, Y′(k), has a constant unit amplitude. In this respect, the ZMNL function defined by (18) acts as a Zero-Forcing (ZF) equalizer. In common ZF equalizer implementations, however, several time samples are used to estimate the signal spectrum and determine the impulse response of the equalizer. In this case, a direct normalization is implemented in the TD. This, apparently simple processing, provides the receiver with remarkable interference mitigation capabilities.

Alternatively, if a Cauchy model is considered, the following processed signal is obtained:

Equation (19)

where K is the linearity parameter introduced in the robust estimation section when defining the sample myriad. This name is justified by the fact that K controls the “linearity” of (19): as K goes to infinity, non-linearity (19) becomes the identity. K should be set as a function of the variance of the non-interfered input noise. The determination of K is out of the scope of this paper.

Figure 4.b shows the in-correlator implementation of the TD processing. In particular, due to the Plancherel theorem, it is possible to show that unitary transforms preserve the scalar product and correlation operations. Examples of unitary transforms are the DFT and DWT (when properly scaled). In these cases, it is possible to compute the correlator directly in the TD. In some cases, this design choice allows significant computational load reduction. A well-known approach is, for example, the parallel code acquisition algorithm based on the usage of the FFT. In the parallel code acquisition algorithm, the FFT is already used for the computation of the correlators: the usage of nonlinearities in the frequency domain can be efficiently adopted without requiring additional operations.

A schematic representation of the parallel code acquisition algorithm is shown Figure 5. As already mentioned, the algorithm foresees the transposition in the frequency domain of the input signal, y[n], thus it can be easily modified by introducing an additional processing block. This block is the light green box labelled “Additional Processing” in Figure 5. This block simply implements the ZMNL functions in Eqs. (18) and (19). In this case, robustness can be introduced with limited additional computational requirements.

In order to demonstrate the effectiveness of RTD approaches, we used the data available here and previously used to evaluate the behavior of an adaptive notch filter. The data contain a short dataset with GNSS data affected by jamming. In the archive, basic code allowing the acquisition of the GNSS signals present in the dataset is also provided. Without interference mitigation, it is not possible to detect the useful signal and the CAF shown in Figure 6 is obtained. Secondary peaks caused by the jamming signal are clearly present. RTD has been implemented by modifying the parallel code acquisition algorithm as indicated in Figure 5. Parallel code acquisition is implemented in the “DftParallelCodePhaseAcquisition.m” Matlab function and it is included in the archive indicated above.

Significant robustness can be introduced by adding a single line of code which implements normalization (18). We invite the readers to experiment with the code and add the following line of code

X = X ./ ( abs( X ) );

in the “DftParallelCodePhaseAcquisition.m” script. This line should be inserted in the “for” loop, before the computation of the inverse IFFT. With this modification, the impact of jamming is significantly reduced and it is possible to effectively acquire the useful GNSS signal. In particular, the CAF shown in Figure 7 is obtained: the signal peak clearly emerges from the noise floor and the secondary peaks due to the jamming signal are strongly attenuated.

The effectiveness of the proposed approach is further analyzed in Figure 8 which shows the C/N₀ estimated for a signal affected by jamming under different conditions. In this experiment, the jammer was connected to a variable attenuator. The attenuation was progressively reduced leading to an increasing jamming power. In particular, the received jamming power was increased with steps of 2 decibels. This fact is reflected by the C/N₀ values shown in Figure 8. After 1,200 seconds, the attenuation reaches its minimum value before being increased again. TD processing was implemented using the architecture depicted in Figure 4a and non-linearity (18) was adopted. TD processing significantly outperforms the notch filter used in Figure 8 for comparison. More specifically, a gain of more than 5 decibels is achieved for strong jamming signals. The considered notch filter implements interference detection and it is activated only when significant jamming power is sensed.

Conclusions and the Future of (Anti-) Jamming
Interference mitigation, in the context of GNSS receiver design, has been an active topic for research for several lustrums. It is likely to keep its good pace towards securing GNSS receivers — and the growing list of facilities and infrastructures depending on GNSS — from malicious jamming or unintentional interference. The field has indeed made substantial progress, mainly leveraging on advanced signal processing techniques. In this article we have covered classical time domain methods, but also discussed TD techniques that exploit sparsity of interference in other domains besides time. Additionally, the use of robust statistics was seen to provide interesting results and is a way forward for research. Anti-jamming is advancing, so are the capabilities of jammers to cause damage to GNSS receivers. Besides spoofing — which is probably one of the most complicated interference signals to generate — and jamming — probably the simplest — there is a middle ground. For instance, deceptive jamming, where a simple pulsed-jamming signal is disciplined to target specific parts of the navigation message. It was shown (see Curran et alia, “On the Threat of Systematic Jamming of GNSS”, Additional Resources) that deceptive jamming is not only feasible, but hardly detectable. It is foreseen that this, and other threats, will spur research in the area of antijamming.

Additional Resources
[1] Amin, M. G., P. Closas, A. Broumandan, J. Volakis, “Guest Editorial: Vulnerabilities, threats, and authentication in satellite-based navigation systems,” Proceedings of the IEEE, 104(6), pp. 1302-1317, 2016.
[2] Amin, M. G., X. Wang, Y.D. Zhang, F. Ahmad, and E. Aboutanios, “Sparse arrays and sampling for interference mitigation and DOA estimation in GNSS,” Proceedings of the IEEE, 104(6), pp. 1169-1173, 2016.
[3] Arce, G. R., Nonlinear Signal Processing: A Statistical Approach. Wiley-Interscience, Nov. 2004.
[4] Borio, D., “Swept GNSS Jamming Mitigation through Pulse Blanking” Proc. of the 2016 European Navigation Conference (ENC), Helsinki, Finland, June 2016, pp. 1-8.
[5] Borio, D., “Robust Signal Processing for GNSS,” Proc. of the 2017 European Navigation Conference (ENC), Lausanne, Switzerland, May 2017, pp. 150- 158.
[6] Curran, J. T., M. Bavaro, P. Closas, M. Navarro, “On the Threat of Systematic Jamming of GNSS,” Proceedings of the 29th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS+ 2016), Portland, OR, September 2016.
[7] Fernández-Prades, C., J. Arribas, P. Closas, “Robust GNSS receivers by array signal processing: theory and implementation,” Proceedings of the IEEE, 104(6), pp.1207-1220, 2016.
[8] Hampel, F. R., “A general definition of qualitative robustness,” The Annals of Mathematical Statistics, vol. 42, pp. 1887-1896, 1971.
[9] Huber, P. J., and E. M. Ronchetti, “Robust Statistics,” Wiley, second edition, February 2009.

The post A Fresh Look at GNSS Anti-Jamming appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

The vulnerability of GNSS to various forms of malicious interference have been widely discussed in recent years, and have considered a wide range of both real and potential attacks. Some of these have included extensive studies of commercially available jamming devices, while others have considered the more comprehensive case of spoofing, where the interference takes the form of genuine GNSS signals (For details, see papers listed in Additional Resources, including M. G. Amin et alia).

The vulnerability of GNSS to various forms of malicious interference have been widely discussed in recent years, and have considered a wide range of both real and potential attacks. Some of these have included extensive studies of commercially available jamming devices, while others have considered the more comprehensive case of spoofing, where the interference takes the form of genuine GNSS signals (For details, see papers listed in Additional Resources, including M. G. Amin et alia).

Studies of simple jamming attacks have demonstrated that it is relatively easy, given sufficient broadcast power, to deny the use of GNSS to many commercial receivers (For details, see papers listed in Additional Resources, including M. Johnson and R. Erlandson). However, it has also been shown that given the easily identifiable or periodic nature of simple jamming signals, a receiver can often mitigate the threat, for example, via the use of adaptive filtering or pulse blanking (F. Dovis, Additional Resources). Furthermore, it has been demonstrated that the jamming signal itself can be readily exploited to identify and locate the jamming source. On the other hand, recent work on GNSS spoofing has shown that current receivers are vulnerable to a well calibrated spoofing attack (T. E. Humphreys, et alia), and it is clear that many receivers can be manipulated without arousing any suspicion. However, such attacks are highly complicated and require knowledge of the GNSS signals, and the attack scenario, including precise timing and positioning.

It is highlighted here that a middle ground exists between the simple jammer and the spoofer, and it is the most likely “next step” for the malicious adversary. A typical jammer is blind to the GNSS signals it overwhelms, and simply relies on power and spectral occupation to deny the GNSS signals. In contrast, a spoofing device must faithfully replicate the characteristics of genuine GNSS signals. As such, spoofing is highly sensitive to alignment of time, phase and power of the spoofing signals with respect to the genuine signals. It is suggested that it is possible to create a device, only slightly more complex than a simple jammer, that can increase the efficiency of a jamming-based denial-of-service (DOS) attack.

Specifically, this work introduces the concept of systematic jamming: where a simple jammer might be combined with information of the GNSS signals to produce a more sophisticated jamming signal. For example, a jammer may be equipped with a simple low-cost commercial GNSS receiver, providing accurate position, time and satellite ephemerides. With this information, it might be possible to trigger short and sparse bursts of interference, such as to deny GNSS to a nearby receiver with a very low average power. In this manner, a receiver might be unable to: reliably detect that a jamming attack was ongoing; to effectively mitigate the jamming attack; or to identify or localize the jamming source. In the work that follows, we consider what form such a jammer might take, what the implications for the nearby target receiver might be, and how a target receiver might be equipped to thwart such an attack.

The basic principle is that for standalone GNSS, the position, velocity and time (PVT) can be denied by either: denying the physical layer, on which the ranging measurements are made; or by denying the data layer, prohibiting the recovery of ephemeris or transmit time; or both. Because the data layer need only be sporadically interrupted to completely deny the message recovery, it represents the weakest link in the PVT generation. It is therefore the obvious target, particularly when channel coding is not present in the jammed signal.

Problem Definition
This work considers the threat that might be posed if a malicious adversary were to add a small amount of added complexity to the typical GNSS jammer, with the intention of providing bursts of interference at specific epochs. A modification to the typical GNSS jammer is envisaged, which includes an on/ off keying driven by a micro-controller, as depicted in Figure 1 (for all figures, tables and equations, please see inset photo, above right). The algorithm controlling the keying employs position and timing information sourced from a simple, low-cost GNSS consumer-grade receiver (naturally, care must be taken to avoid self-interference). Using the GNSS measurements, accurate estimates of the transmit-time observed on GNSS signals seen in the vicinity of the jammer can be computed.

It is proposed that this information might be exploited by an adversary to trigger short pulses of interference which are tightly aligned with specific portions of the navigation message of each satellite. Previous work has demonstrated that a low duty-cycle pulsed interference, appropriately synchronized with the navigation message, can cause disruption to the receiver data recovery process, equivalent to that of an always-on interference (J. Curran et alia, Additional Resources). This process requires that the pulse pattern be designed to specifically target weaknesses in the navigation message coding scheme, and it has been shown that a malicious adversary might inflict a DOS upon a naïve receiver, using an average interference power 10 to 20 decibels lower than continuous interference.

Naturally, this offers some distinct advantages to the adversary: a given broadcast power might impose a DOS over a wider geographical area; by broadcasting short sporadic bursts of interference, it may be more difficult for an authority to detect or locate the jamming source; it may also be possible that the interference pattern can be made sufficiently sparse that the target receiver, although experiencing a DOS, might not reliably assert that it is experiencing interference.

Here, the current Galileo E1BC and GPS L1C/A signals are studied, seeking to identify how the adversary might target these signals, and will then analyze to what extent a DOS might be conducted.

Systematic Interference and Denial of Service Attacks
The methodology chosen for the generation of harmful pulse-patterns is based on denying navigation capability of the receiver, rather than denying the signal itself. To produce a PVT solution, a receiver generally needs to extract the ephemeris from each satellite and the time-of-week (TOW) from at least one satellite. This work examined the design of interference pulse patterns which might disrupt this process.

Sensitive navigation data
A TOW message is broadcast by all GNSS signals at regular intervals, and generally occupies a very small portion of the overall navigation message. In the case of GPS L1 C/A the TOW is broadcast in an unencoded form once per subframe, whereas for Galileo E1B, it is encoded, and broadcast once per pair of pages. Thus, the denial of TOW for the GPS L1 C/A signals requires either the denial of the subframe synchronization, or denial of the raw data itself. In the case of Galileo, the TOW might be denied by either denying page synchronization, or by inducing errors in the symbol decoding process. The basic details of the navigation messages, as shown in Figure 2, are as follows.

GPS: The L1 C/A preamble is an 8 bit sequence (160 milliseconds) transmitted every 6 seconds. The GPS parity is composed of 6 bit (120 milliseconds) transmitted every 600 milliseconds (navigation data word). Checking the consistency of two subsequent preambles, as well as the 10 parity checks in between, is a commonly accepted mean of synchronizing to the 6 seconds boundary.

Galileo: The E1B signal transmits a plain 10 symbol synchronization sequence (40 milliseconds) every second. It is interesting to see that GPS and Galileo synchronization sequences hardly overlap in time. The Galileo message CRC is FEC encoded and then spread by an interleaver. The E1B receiver deinterleaves the data and runs a Viterbi decoder to retrieve the 120 bit/sec of I/ NAV. The identification of a word results in resolving a 2 seconds time ambiguity, where certain words contain the time of week and/or week number.

Considerations for Navigation Message Authentication: Although the example examined here is that of denial of the PVT through the denial of the TOW, there are many other parts of the navigation message that could be targeted. In particular, it is worth mentioning the recent interest in the use of cryptographic methods for the protection of the navigation data. These methods typically require the inclusion of a significant number of cryptographic data bits in the navigation message, either as additional navigation data words or pages. This cryptographic data can be the order of several hundred bits, and generally has an all-or-nothing property, where any single bit error can render the entire message useless. For example, cryptographic keys can be several hundred bits in length, and digital signatures can be 300 to 600 bits in length. In both these cases, a single bit error is sufficient to corrupt them.

At present, data such as the ephemeris is broadcast piecewise, in short packets (words or pages), and repeated very frequently. Each ephemeris can be recovered piece-by-piece over time. In contrast, many proposals for GNSS message authentication have suggested that the cryptographic data be nonrepeating, in order that it provide some secondary spoofing-detection, or “carry-off” protection. Following these recommendations might render the message authentication data highly sensitive to systematic-jamming, where even very sparse interference might render the authentication function unavailable. If the availability or validity of the PVT is then associated with, or conditioned upon the correct verification of the navigation message authenticity, then this PVT might be denied quite easily, and covertly. This might compare very poorly with the resilience enjoyed by current receivers, especially those that utilize extended ephemeris or assistance data.

Design of Interference Pulse Patterns
The object of this section is to identify an interference signal that will deny the extraction of the TOW from the above signals using the least amount of energy possible such that the target receiver either remain unaware of the jamming attack; might be unable to effectively mitigate the jamming signal. To simplify the problem somewhat, the jamming signal is restricted to be an on-off-keying of a chirp interference signal, transmitting pulses of fixed duration equal to some integer milliseconds.

Two particular examples are explored here: GPS L1 C/A which is subjected to pulsed interference across the broadcast TOW, and the case of Galileo E1B, which is subject to pulsed interference across a series of symbols spaced according to the symbol interleaver, and are depicted in Figure 3. The GPS pulse pattern has been aligned with the 17-bit TOW and consists of six 20-millisecond pulses evenly spaced across a period of 240 milliseconds. The Galileo pulse pattern consists of fifteen 4-millisecond pulses, spaced according to the Galileo 8 °— 30 block interleaver, such that all 12 pulses appear consecutively once the received symbol stream has been deinterleaved.

This particular choice of pulse patterns is somewhat arbitrary, and has been selected based on some simple experiments. A more thorough design might carefully weigh the choice of number of pulses, pulse duration, and instantaneous interference power, to find a pattern which provides the highest probability of inducing bit errors, with the minimum probability of being detected. This will depend on the monitoring techniques of the receiver – including the carrier-to-noise density (C/N₀) estimator and tracking loop design.

To align these pulse patterns with the received GNSS signals, they are broadcast with a delay relative to the edge of a GPS 6 second boundary. All GNSS satellites broadcast their messages in synchronous, and all have a range between 18,000 and 24,000 kilometers, depending azimuth and elevation, this fixed delay was set to 67 milliseconds, or approximately 20,000 kilometers.

Note that the maximum variation between nearest and furthest satellite results in a misalignment of less than 20 milliseconds, and so the pulse pattern applied to the GPS L1 C/A message will still overlap completely with the 17 bit TOW message. Similarly, owing to the nature of the block interleaver used for Galileo E1B, when the pulse pattern is shifted relative to the encoded symbols, provided they still overlap with a single page, the receiver will deinterleave to a continuous stream.

Anatomy of a Systematic Jammer
Central to any jamming device is the interference generator. In the systematic jamming device envisaged here, the key to its effectiveness is the interference pulse pattern, rather than the modulation of the interference signal itself, and so it is assumed that the source is similar to a typical chirp jammer, as depicted in Figure 4. These devices are remarkably simple, consisting of little more than a crystal, a VCO and a power amplifier. As can be seen from the exploded view in Figure 4, the device comprises only a handful of discrete components. Elaboration to a systematic jammer would involve on-off-keying the output of such a device. This suggests that the cost and complexity of a systematic-jammer would be driven by the inclusion of a GNSS receiver, rather than the actual generation of interference.

Figure 5 shows the measured spectrum of the jammer depicted in Figure 4. The interference signal has a chirp modulation with a bandwidth of approximately 40 megahertz centered at L1. The amplitude varies slightly with frequency such that the chirp period can be clearly identified as approximately 20 microseconds. Even a very small device such as this is capable of creating a powerful wideband interference that poses a significant threat to typical GNSS receivers.

Until very recently, the only widely available transceiver option existing for radio amateurs and navigation/telecommunication engineers was the Ettus product line: the USRPs. More recently the technological advances in the integration of RF components into single multi-modal chips (mostly driven by the 3G/4G and DTV market) have enabled the design of relatively simple, highly versatile low cost SDR peripherals. A comprehensive review of such hardware is not appropriate here. Two commercially available transceivers were used in laboratory experiments. The most relevant specifications for these two devices are presented in Table 1.

Rather than develop and integrate the hardware required for a systematic- jammer, an equivalent model was developed based on the PPS-triggered broadcast of a pre-generation of an intermediate- frequency dataset containing the required pulse-patterns. This offered a very simple means of experimenting with the concept, however a practical device would simply implement an on-off- keying of a jammer similar to that shown in Figure 4.

Synchronization of the Jammer with GNSS-Time
A trigger for transceiver two was added to the stock firmware released on June 2016. At the time of writing, however, transceiver one did not support triggering but, as it is an open hardware and software design, this feature was implemented. Testing for synchronization of two transmitters was performed by generating a simulated single GPS L1 C/A signal (for a satellite that was not visible at the time), and triggering its broadcast using a PPS edge, as shown in Figure 6. This simulated signal was then combined with live signals from the rooftop antenna and processed by a GNSS receiver. By examining the pseudorange difference between the simulated and live GNSS signals it was possible to assess the accuracy of the PPS-triggered broadcast. It was observed that the start of the broadcast was accurate to within a few hundred microseconds, but the range diverged rapidly due to the poor clock quality of the transmitter. This indicated that it would be necessary to periodically re-synchronize the transmission with GPS time.

Live Testing with a COTS Receiver
This section briefly describes results of a simple systematic interference test conducted on a COTS GNSS receiver. The prototype systematic jammer was constructed using a single open source SDR platform, which derived synchronization with GPS time via a timing receiver, which delivered a rising edge on a trigger once every 30 seconds, as depicted in Figure 6. Note that although this device delivered a very precise timing reference, the systematic jamming attack does not necessarily require such accuracy, indeed the GNSS propagation delay is approximated with an error of up to 10 milliseconds. Therefore, a 1 to 10 millisecond accurate reference derived from a wired or wireless network, being WiFi or a 3G mobile network, would suffice. The test consisted of a conductive combination of a live GNSS feed from a roof mounted antenna with a systematic interference signal. The receiver under test was configured to deliver raw observations to a host PC for post processing.

Denial of GPS L1 C/A PVT
In the first test, the ability of the systematic jammer to deny observations and a PVT from GPS L1 C/A was examined. The experimental setup described above was used, and the pulse pattern depicted in Figure 3 (top) was used. The prototype jammer was powered up and allowed to initialize and align with GNSS time. Next the receiver under test was issued a cold-start command and its behavior was observed. The test was repeated with progressively increasing interference power until a power level was established at which the receiver was unable to produce a PVT, which was observed to occur at an instantaneous interference to noise floor level of approximately 30 decibels.

A trace of the 11 GPS satellites being tracked by the receiver are shown in Figure 7, where it can be seen that the received C/N₀ for the L1 C/A signal ranges from 49 to 35 decibel-hertz, but experiences brief reductions in power of approximately 6 decibels. During the entire test, the receiver was unable to provide a sufficient set of observations and ephemerides such that a PVT could be computed. Unfortunately, it was not possible to gain enough visibility into the internal receiver functionality to determine exactly which information was successfully extracted. It would have been helpful to understand whether ephemeris, almanac, health status and other variables were available, or whether the annihilation of the TOW and subsequent CRC failure rendered all data unavailable. Nonetheless, the results confirm that it is possible to deny a GPS L1 C/A based PVT via the targeted jamming of just a small portion of the navigation message. Beyond the results presented here, a similar systematic interference test was conducted and configured to run continuously over a 24-hour period, such that the receiver experienced a complete change in the visible constellation. Again, it was found that the receiver was unable at any point to provide a PVT despite the fact that the receiver was capable of acquiring and tracking all signals visible with only a minor degradation to the C/N₀.

Denial of Galileo E1B PVT
The second test conducted was designed to assess the ability of the systematic jammer to deny observations and a PVT from the Galileo E1B signals. The pulse pattern was further changed to that of Figure 3 (bottom) and an experimental setup similar to the GPS case was used. However, due to the low availability of healthy Galileo satellites, the live GNSS feed from the roof antenna was replaced with a simulated signal sourced from a multi-constellation simulator. In this case the pulse pattern significantly more distributed in time, being spread relatively evenly across the I/NAV odd page. This particular pulse pattern was shaped according to the interleaving pattern, rather than being aligned with a particular data word, with the intention that once it is deinterleaved, it will appear as a continuous stream of symbol errors arriving at the decoder.

Interestingly, the ability of this approach to deny the navigation message is relatively insensitive to its alignment with the beginning of the page. Provided the complete set of pulses are received within one page, they will be de-interleaved into a continuous stream.

A screenshot from one of the tests is shown in Figure 8 which includes a trace from eight Galileo and nine GPS satellites. As expected, the Galileo E1B message has been denied by the systematic interference, as indicated by the blue color-coding of the figure. Two interesting observations were made during this test. First, it was noted that the reception of the GPS L1 C/A signal was relatively unaffected. Eight of the nine GPS satellites report useful observations, and the receiver steadily provided a GPS-based PVT. The second particularly striking observation is that the C/N₀ reported by the receiver under test does not exhibit any significant variation either for GPS or for the Galileo satellites. A C/N₀ in the range of 48 to 49 decibel-hertz was reported for all Galileo satellites, yet the receiver was unable to extract navigation data from any of them. One reason for this is that the interference is relatively sparse in time and its effect is smoothed by the C/N₀ estimation process.

A few interesting conclusions are drawn from these results. We note that is possible to deny the use of one kind of GNSS signal, in this case, Galileo E1B, while leaving the other, in this case GPS L1 C/A, relatively unaffected, even when they occupy the same RF band. This appears to be due to the relative orthogonality of the navigation message structures, owing to their significantly different symbol periods, 4 milliseconds and 20 milliseconds, and the fact that one employs FEC while the other does not. It is also clear that the observation of C/N₀ may not be a useful means of interference detection, given that the C/N₀ level observed on the GPS and Galileo signals was virtually identical, yet the impact of the interference on the receiver’s ability to process the signal is drastically different.

Power, Energy and Synchronization
The probability of a bit or symbol error occurring is a very nonlinear function of the instantaneous interference power, however this probability of error saturates at 0.5. To achieve a more reliable denial of the navigation message, more symbols must be targeted, where the probability that the message is corrupted is given by:

P_Err = 1 − 0.5^N_Pulse     (1)

where N_Pulse denotes the number of corrupted symbols. This probability tends to unity quite rapidly. Naturally, the total interference energy required increases as a linear function of the number of symbols:

E_Int = P_Ind N_Pulse T_Pulse     (2)

where T_Pulse the pulse periods, being equal to the symbol or bit period. An astute adversary will tune this energy effecting a trade-off between the probability that the navigation message is denied, and the probability that the interference power will alert the receiver to the attack. In effect, by using a systematic interference, an adversary can reduce the total interference energy, or average interference power required to render the PVT unavailable. The reduction can be computed relative to a continuous interference signal, by expressing the average duty-cycle of the interference:

Equation (3) (see inset photo, above right)

where T_Patt is the repetition period of the interference pattern, being 6 seconds for GPS L1 C/A and 2 seconds for Galileo E1 B. The interference configuration for both the GPS L1 C/A and Galileo E1B are summarized in Table 2, where it is suggested that the effective gain of applying systematic jamming, as opposed to continuously broadcast jamming, is in the region of 15 to 17 decibels. Moreover, although the results here have been generated using a tightly synchronized transmitter, the principle of operation of the systematic jammer would permit synchronization errors in the region of 1 to 10 milliseconds. Notably, at this level of timing error, the jammer may no longer need to avail of position information.

Conclusion
The literature to date has primarily considered the two extremes of GNSS vulnerability, being either a very simple jamming attack, or a very complicated spoofing attack. Simple jamming, as we know it today, is a very easy attack to launch, but it is also very easily detected, readily localized, and often relatively easily mitigated. Spoofing, although very possible, and not necessarily difficult, is considerably more difficult than jamming. In the short term, if denial of service through simple jamming becomes non-viable, it is not unreasonable to expect this threat to evolve. There appears to be a middle-ground between jamming and spoofing, that might thwart current detection, localization and mitigation techniques. It appears to be very accessible to a malicious attacker, as it only requires commercial, off-the-shelf components, and some basic integration; yet it can pose a significant threat to a naïve receiver implementation. This increased threat comes at a very small increased attack cost and complexity, and has the potential to disrupt many location-based services, by imposing an undetectable partial (data recovery) or full (position and timing) denial-of-service. Preliminary results suggest that this attack methodology is feasible and, under certain conditions, may be quite effective when targeting a naïve receiver.

It is interesting to note that through interference signal design, it is possible to deny signals from one constellation why not negatively impacting signals from another, even when these signals share the same spectrum. Because this is achieved by carefully choosing the on-off-keying pattern, it is likely that this technique can be extended to target specific satellites from a given constellation.

This work represents only a very preliminary examination of the concept, but does seem to highlight the fact that it may be naïve to assume that the jamming threat will not evolve in reaction to anti-jamming technology. The notion that jamming devices might be designed in direct response to anti-jamming techniques might open a new avenue of research into the more game-theoretic aspects of resilient GNSS receivers. It might further invigorate the use of technologies such as antenna diversity, or synthetic aperture antennas, or adaptive interference mitigation techniques.

Additional Resources
[1] Amin, M. G., and P. Closas, A. Broumandan, and J. L. Volakis. “Vulnerabilities, threats, and authentication in satellite-based navigation systems [scanning the issue].” Proceedings of the IEEE, 104(6):1169- 1173, 2016.
[2] Curran, J., M. Navarro, M. Anghileri, P. Closas, and S. Pfletschinger. “Coding aspects of secure GNSS receivers.” Proceedings of the IEEE, 104(6):1271- 1287, 2016.
[3] Dovis, F., “GNSS Interference Threats and Countermeasures.” Artech House, Boston, 2015.
[4] Fontanella, D., R. Bauernfeind, and B. Eissfeller. “In-car GNSS jammer localization with a vehicular ad-hoc network.” In Proceedings of the 25th International Technical Meeting of The Satellite Division of the Institute of Navigation, pages 2885-2893, September 2012.
[5] Humphreys, T. E., J. Bhatti, D. Shepard, and K. Wesson. “The Texas spoofing test battery: Toward a standard for evaluating GPS signal authentication techniques.” In Proceedings of the 25th International Technical Meeting of The Satellite Division of the Institute of Navigation, pages 3569-3583, September 2012.
[6] Humphreys, T. E., B. M. Ledvina, M. L. Psiaki, B. W. O’Hanlon, and P. M. Kintner. “Assessing the spoofing threat: Development of a portable GPS civilian spoofer.” In Proceedings of the 21st International Technical Meeting of the Satellite Division of The Institute of Navigation, pages 2314-2325, September 2008.
[7] Johnson, M., and R. Erlandson. “GNSS receiver interference: Susceptibility and civil aviation impact.” In Proceedings of the 8th International Technical Meeting of the Satellite Division of The Institute of Navigation, pages 781-791, September 1995.
[8] Kraus, T., R. Bauernfeind, and B. Eissfeller. “Survey of in-car jammers – analysis and modeling of the RF signals and IF samples (suitable for active signal cancellation).” In Proceedings of the 24th International Technical Meeting of The Satellite Division of the Institute of Navigation, pages 430-435, September 2011.
[9] Mitch, R. H., R. C. Dougherty, M. L. Psiaki, S. P. Powell, B. W. O’Hanlon, B. W. Bhatti, and T. E. Humphreys. “Signal characteristics of civil GPS jammers.” In Proceedings of the 24th International Technical Meeting of The Satellite Division of the Institute of Navigation, pages 1907-1919, September 2011.
[10] Motella, B., S. Savasta, D. Margaria, and F. Dovis. “An interference impact assessment model for GNSS signals.” In Proceedings of the 21st International Technical Meeting of the Satellite Division of The Institute of Navigation, pages 900-908, September 2008.
[11] NSL, Spirent, “Detector”, Accessed 2016. [12] Psiaki, M. L., and T. E. Humphreys. “GNSS Spoofing and Detection.” Proceedings of the IEEE, 104(6):1258-1270, 2016.
[13] Pozzobon, O., C. Sarto, A. Dalla Chiara, S. Pozzobon, G. Gamba, M. Crisci, and R. T. Ioannides. “Developing a GNSS position and timing authentication testbed GNSS vulnerability and mitigation techniques.” In Inside GNSS article, January 2013.
[14] Samson, J., L. Musumeci, and F. Dovis. “Performance assessment of pulse blanking mitigation in presence of multiple distance measuring equipment/ tactical air navigation interference on global navigation satellite systems signals.” IET Radar, Sonar and Navigation, 8(6):647-657, July 2014.
[15] Spirent, “Simsafe”, Accessed 2016.
[16] Wildemeersch M., and J. Fortuny-Guasch. “A laboratory testbed for GNSS interference impact assessment.” In Proceedings of the 22nd International Technical Meeting of The Satellite Division of the Institute of Navigation, pages 49-54, September 2009.
[17] Curran, James T., Bavaro, Michele, Closas, Pau, Navarro, Monica, “On the Threat of Systematic Jamming of GNSS,” Proceedings of the 29th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS+ 2016), Portland, Oregon, September 2016, pp. 313-321.

The post Systemic Jamming appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Enrico Salvatori, Qualcomm Europe

Carlo Bagnoli, STMicroelectronics

Carlo Bagnoli is Director of Infotainment BU System and Applications at STMicroelectronics. The company is a global semiconductor leader focusing on smart driving and the internet of things, creating intelligent and energy-efficient products that enable intelligent transport as well as smarter factories, cities and homes.

Within the infotainment business unit, Bagnoli and his team work to develop positioning receivers, broadcast receivers and communication processors for the automotive market. Doing so means gathering GNSS signals from far and wide.

Carlo Bagnoli is Director of Infotainment BU System and Applications at STMicroelectronics. The company is a global semiconductor leader focusing on smart driving and the internet of things, creating intelligent and energy-efficient products that enable intelligent transport as well as smarter factories, cities and homes.

Within the infotainment business unit, Bagnoli and his team work to develop positioning receivers, broadcast receivers and communication processors for the automotive market. Doing so means gathering GNSS signals from far and wide.

Once upon a time, Bagnoli says, “everybody thought GPS was enough. Now it’s the multi-constellation system that is a sort of de facto requirement.”

Coming Up
Early believers in the power of multiconstellation in situations such as urban canyons STMicroelectronics beat all major competitors to the punch when it unveiled its dual-constellation, GPS+Glonass receiver in 2011. But in fact the company had already been working for years on blending GPS+Galileo signals.

“We started in 2004 with some high-level exploratory work,” Bagnoli explained, “ and then we did our first funded research under the European Union’s FP7 Program, working to develop a Galileo-ready positioning terminal. Based on the outcome of that research we created the navigation CPU CartesioPlus product.”

So Galileo was already present in ST’s GPS/GNSS receiver hardware by the mid-2000s, with a new RF and an FPGA-based baseband. A production version of CartesioPlus followed in high volume from 2009, but it was in reality still a GPS-only chipset, because there were not yet any operational Galileo satellites in orbit.

“We were still looking into increasing the number of supporting constellations,” Bagnoli said, “So with Galileo still under development, we began working on a new product that could also support Glonass, called ‘Teseo’, which we completed and launched in 2011.”

By then, he said, the rest of the mobile industry had already understood that Glonass was quite relevant for improving the user experience in urban canyons. However, he said, the rest of the automotive mission-critical industry was late: “With Teseo, putting together the first multi-constellation chip, we anticipated the work of the others by 12-24 months.”

Today, Bagnoli says, the accuracy of Glonass has improved, through better geometry, but not because of the accuracy of the actual signal, which is still a problem.

Galileo is Born
For STMicroelectronics, the launch of Galileo initial services in December 2016 was a real breakthrough, Bagnoli said: “For a GNSS receiver company, the birth of any new Open Service GNSS system has to be considered an opportunity for new integration as it improves the user experience with no major steady-state cost added.”

The case for Galileo, he said, was a no-brainer. “ST decided to include Galileo from its inception and we have had it both in our CartesioPlus navigation CPUs and in our dedicated standalone Teseo receivers. And we are completely committed to including it on our next-generation multi-band precise positioning platforms.

“With Galileo there is no major cost of development; the development applies to multiple system-on-chip platforms, so the relative effort of adding Galileo to a set of already -supported constellations is very manageable.”

Bagnoli said the his company definitely made the right decision in preparing for Galileo early: “ST is focused on automotive and ITS and in these markets research and development cycles take significant time. Thanks to foresight, we now have two mature product families and we are looking forward to the business development of our Galileo-capable receivers.”

Multi, Multi, Multi…
Everyone seems to agree; a new type of mission-critical GNSS receiver is now needed, one that can work in conjunction with correction data available from multiple sources, ultimately providing sub-meter accuracy.

To this end, Bagnoli said, STMicroelectronics is looking at ways to combine all the functional GNSS constellations: “Finally, as we have more and more automotive ITS, integrity is becoming more and more important, so redundancy is useful and, for example, cooperative multi-constellation anti-spoofing is something that we have already worked on.

“We now have a solution where we do very fine monitoring of the different systems in order to provide more integrity beyond the accuracy dimension, and this is going to be particularly relevant for regulated services and so on.”

Indeed, while these single- frequency, multi-constellation GNSS solutions are still viable for traditional Infotainment applications, emerging intelligent transportation systems (ITS) and liability- and safety-critical applications such as advanced driver assistance systems (ADAS) are raising performance and integrity requirements for GNSS receivers, creating demand for new and even more advanced GNSS solutions.

Bagnoli describes the clear advantages of a rapidly maturing Galileo system in terms of its high accuracy and high integrity, the latter of which he says has been an overlooked aspect in many markets. “If your aim is to increase accuracy, augmenting GPS through a multi-constellation configuration, then Galileo is really the best way to go, particularly for automotive and ITS systems; And its integrity features will serve well in support of regulated services.

“Right now, with Beidou3 still under construction, GPS+Galileo is going to be a very solid mode, and this is the only harmonized pure L1 receiver combination available.”

Again, Bagnoli says, for his company the key market for the Galileo open service is ITS, including liability- and safety-critical applications. “STMicroelectronics is focusing to this market and aiming to be a key player there,” he said. “Further, we expect that this will become a multi-frequency as well as a multi-constellation equation, as more augmented driving applications arrive, and we are excited by the challenge and the business opportunity.”

The post GSA’s GNSS Opinion Leaders for August 2017 appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.