“Chasing Lightning: Detecting, Characterizing, and Identifying a Powerful Space-Based GNSS Interference Source” is the title of a new paper Zachary Clements, Argyris Kriezis, and Prof Todd Humphreys. It details how, after almost two years of effort, they were able to identify a constellation of Russian early warning satellites in Molniya (“lightning”) orbits as the source of a series of difficult-to-detect disruptions to GPS signals. 

The paper identified 75 events over a seven-year period in which terrestrial reference stations operated by the International GNSS Service in Europe, Greenland and Canada recorded simultaneous and significant drops in carrier to noise ratio (CNR). 

The story of this jammer hunt in space began in September 2024. During a presentation to the Civil GPS Service Interface Committee  in Baltimore, Humphreys opined “There is every reason to believe China’s BeiDou global navigation satellite system has the ability to imitate American GPS signals and those of Europe’s Galileo,” His remarks were reported in SpaceNews along with speculation about Russia’s capabilities.

The SpaceNews article prompted a call to the Resilient Navigation and Timing Foundation from a researcher in the United Kingdom. The researcher reported that deliberate disruption from space was not just speculation – he had observed it. While the researcher did not want to be publicly identified, he was happy to provide the data and allow others to confirm his findings.

With the researcher’s permission, the Foundation connected him with several GNSS experts who could confirm his findings and met with U.S. government officials to convey the extensive data package.

Clements and Humphreys reported on their initial findings in the paper “Transient Space-Based GNSS Interference: Observations and Analysis” at the Institute of Navigation Conference in September 2025. At that point they had not yet identified the source of the interference.

In the new paper the researchers outline how they accessed data from 165 reference stations. Seventy-five simultaneous drops in CNR across multiple stations, with at least one station recording a drop of 5 dB or more, were identified. 

Humphreys is confident that the interference is purposeful, not hardware malfunctions or accidental emissions. 

“The pattern is far too consistent for this to be accidental. In fact, our data shows it has to be intentional.” 

The interference:

• Has almost always been on a weekday – usually Tuesday through Thursday,
• Events are not regularly spaced out and are transient (less than 10 seconds) rather than periodic or continuous as would be expected from an equipment malfunction,
• Events are quite powerful. CNR drops of up to 10 dB have been observed in some cases, and 
• Impacts are to the most commonly used GPS frequency, L1, but don’t affect other GPS bands like L5.

Also, the signals interfering with GPS are not exactly astride the L1 frequency but are slightly offset. They are centered at 1577.5 MHz, about 2 MHz above the GPS L1 center frequency. This may be an effort to test the capability while avoiding detection.

Perhaps most damning, Humphreys’ team has found that the same Russian constellation has been impacting signals from China’s Bei Dou satellite navigation system in an almost identical way since June 2020.

It is clear that one of this constellation’s primary capabilities is disruption and denial of America’s GPS and China’s Bei Dou navigation systems, should the Kremlin decide to do so. A slight change in frequency and an increase in transmitted power is all that is needed to prevent reception across continental size areas.

The new paper provides six insights for GNSS experts and observers. It:

• Provides measurement models and a detection framework for transient wide area interference,
• Details the spatial, temporal, and spectral properties of multiple wide-area GNSS outage events from the space-based interference source and distinguishes these from a naturally occurring solar radio burst,
• Presents a basic satellite identification strategy to narrow the candidate satellites and estimate the minimum satellite altitude at apogee,
• Presents an advanced satellite associate framework using the generalized likelihood ratio test (GRLT) and applies the framework to a test scenario, 
• Details a framework for instantaneously identifying an interference satellite based on a brief time history of TDOA measurements, and gives an error sensitivity analysis, and 
• Combines IGS CNR data and raw wideband samples from two additional receivers in Europe to confidently identify the source, which is revealed to be a small constellation of Russian satellites in Molniya (“lightning”) orbit.

The paper reveals a significant threat to GPS and other GNSS that has heretofore been unknown to the general public. Findings have already been reported by the New York Times and a video about the discovery has been posted on YouTube by the science education channel Veritasium. 

Many in the community expect that it will increase already high levels of concern about the vulnerability of GPS and other GNSS and how it is used as a tool in great power competition. 

Russia has been particularly open about its use interference from terrestrial sources to punish its neighbors in the Baltic and eastern Europe for growing closer to the West. 

In November 2021 as it prepared to invade Ukraine, Russia shot down one of its defunct satellite with a ground-based missile. The following day state-sponsored media threatened that if NATO got in its way in Ukraine, Russia would shoot down all 32 GPS satellites.

While Russia many not have had the capability to destroy all GPS satellites, it is now clear they had the ability to prevent reception of signals across very wide areas of the globe. 

It is unknown how Russia’s threat influenced the West’s actions in Ukraine. Or how Russia’s ability to turn off reception of GPS and other GNSS with the flip of the switch will impact international relations and actions in the future.

What we do know is that Russia and China have terrestrial PNT systems to complement and backup their systems in space. 

Unlike the United Kingdom and France which are building such systems, and South Korea and Saudi Arabia which have them already in place, the United States has yet to act.

GPS is an amazing and priceless asset. Yet without the protection of a robust and resilient complementary and backup system it remains, as a member of the National Security Council once said, “a single point of failure” for America.

The post Russia Has Been Jamming GPS from Space Since 2019 appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

What emerged was a detailed picture of a system that remains the world’s gold standard for civil and military PNT—operationally reliable, economically indispensable—but one whose modernization has fallen behind the pace of threat, and whose complement architecture is now the subject of a spectrum dispute with consequences well beyond the PNT community.

This account is based on the written statements submitted to the subcommittee by the five witnesses.

The five witnesses were Lisa Dyer, executive director of the GPS Innovation Alliance (GPSIA); Sam Matheny, chief executive of the newly launched Merkhet Solutions; Mariam Sorond, CEO and board chair of NextNav; Harold Feld, senior vice president of Public Knowledge; and J. David Grossman, vice president for policy at the Consumer Technology Association.

The constellation: strong record, narrowing margins

Dyer’s written statement provided the most technically grounded account of GPS’s current status.

The constellation has not experienced a system-wide outage since achieving full operational capability in 1995. The FAA reports GPS system availability at 99.9999 percent. Thirty-two satellites are on orbit, eight above the 24-satellite minimum required for global coverage. The Wide Area Augmentation System extends accuracy and monitors signal integrity across the National Airspace System.

Against that record, Dyer placed a more pressing set of facts. Eight of the 32 satellites are operating on a single string—one subsystem failure each from becoming non-operational. More consequentially, on April 17, 2026, the Space Force terminated the GPS Next Generation Operational Control System program, the long-delayed ground-segment effort that had run more than a decade behind schedule and triggered a Nunn-McCurdy cost breach. Dyer framed the cancellation as an overdue clearing of the path for rapid modernization, and for what she described as a more deliberate integration of commercial satellite PNT data into military operations.

She also documented a capability asymmetry that the subcommittee has not previously examined at this level of specificity. GPS III satellites deliver eight times the anti-jamming protection for military users over their predecessors. GPS IIIF satellites, when fielded, will deliver 63 times. Neither generation extends those protections to civil, commercial or scientific signals. Dyer argued the civil-signal gap carries national security implications precisely because aviation, maritime and surface transportation operators—sectors that depend on civil GPS signals—provide mission-critical logistical support to the Defense Department.

GPSIA submitted formal recommendations on GPS modernization to the defense subcommittees of both Appropriations Committees and both Armed Services Committees the week of the hearing. In September 2025, the Alliance sent a letter to Secretaries Hegseth and Duffy outlining a range of whole-of-government options for addressing jamming and spoofing.

Interference: from conflict zone to domestic runway

Witnesses presented interference as a problem that has moved decisively from theoretical to operational. Sorond cited two 2022 incidents on U.S. soil: a jamming event of unknown origin that shut down a runway at Dallas–Fort Worth International Airport and disrupted roughly 40 miles of airspace for nearly two days, and a separate unauthorized transmitter that interfered with GPS operations at Denver International Airport, affecting both aircraft and air traffic control. Feld’s written statement pointed to a more recent example: Russia’s jamming of the GPS systems aboard the RAF aircraft carrying UK Defense Minister John Healey as he returned from a visit to Estonia. Dyer referenced third-party data aggregating more than 55,000 reported GPS interference events in commercial aviation in 2025—a 24 percent increase over 2024—noting that while the majority occurred overseas and near active conflict zones, a portion occurred within U.S. airspace or on approaches to U.S. destinations.

Dyer was pointed on enforcement. The legal framework is not the problem—federal law already prohibits the manufacture, sale and operation of jamming equipment that interferes with authorized radio communications. In her written statement, she argued that the FCC and the Department of Transportation lack the budget and personnel to enforce those laws, coordinate a whole-of-government response, or adequately address the growing volume of incidents. She called on Congress to provide both agencies with the resources to meet their existing mandates.

The complement landscape: consensus on need, but not on method

Where the panel converged on the modernization and interference questions, it divided sharply on the path to a resilient complementary architecture.

Matheny testified on behalf of Merkhet Solutions, an independent company launched June 2 to commercialize the Broadcast Positioning System (BPS), a terrestrial PNT technology developed at the National Association of Broadcasters starting in 2021. BPS embeds timing and tower-location data within ATSC 3.0 transmission signals. A single tower provides traceable time; multiple towers enable positioning by the same multilateration geometry as GPS. The system requires no internet, satellite or cellular connectivity, operates on existing licensed broadcast spectrum, and supports passive, unlimited simultaneous reception.

Matheny cited a 2025 peer-reviewed NIST finding—produced under a 2024 cooperative research and development agreement—that BPS time-transfer performance is “comparable to or better than GNSS” and constitutes a “viable complementary PNT solution.” A Department of Transportation field trial with Dominion Energy, contracted in August 2025, is underway at a major East Coast substation, assessing BPS performance for grid timing applications. Merkhet currently has deployments in Washington, D.C., Baltimore and Denver. ATSC 3.0 is live in 80 markets reaching more than 75 percent of the U.S. population.

NextNav’s position was presented by Sorond. The company’s Pinnacle vertical-location service is operational in more than 4,400 cities, serves more than 90 percent of U.S. commercial buildings taller than three stories, and provides commercial Z-axis with deployments on all three national wireless carriers and FirstNet. NextNav holds more than 150 patents and describes itself as the largest license holder in the only band the FCC has designated for ground-based positioning.

The company has a petition pending before the FCC that it characterizes as a modernization of its existing licenses in the 902–928 MHz band, to support what it describes as a 5G-based horizontal PNT complement and backup to GPS, deployable on existing wireless infrastructure at no direct cost to taxpayers. The band supports a wide range of licensed and unlicensed operations — among them electronic toll collection systems such as E-ZPass, utility smart meters, home security alarms, agricultural sensors, RFID inventory systems and medical alert devices — that collectively represent decades of investment built on the FCC’s existing coexistence framework.

On the question of modernization, Feld argued that the petition does not update existing rules but asks the FCC to eliminate them—specifically, the protective conditions the Commission attached to the M-LMS licenses when it created them in 1995. That order explicitly acknowledged that Part 15 unlicensed devices had “developed and proliferated in this band and are providing services that are valuable and in the public interest,” and conditioned the new licenses on field testing to demonstrate no unacceptable interference. Feld wrote that NextNav has since “consistently requested that the FCC eliminate the rules protecting unlicensed operations in the band” rather than pursue the cooperative coexistence the 1995 order envisioned.

On the cost question, Feld wrote that the proposed transaction would exchange roughly 14 MHz of shared, low-power spectrum with a partial national footprint for 15 MHz of full-power, flexible-use national spectrum—rights that would be worth billions of dollars if acquired at auction. Feld wrote that, based on the company’s filings, PNT would occupy a small fraction of the resulting network capacity, with the remainder available for mobile carrier use. On the question of deployability, Feld wrote that the proposal would require development of new chips and new 5G standards before any commercial deployment—a process that would take years and depends on wireless carrier adoption that has not been secured.

Grossman characterized the proposal as a structural reconfiguration of the band’s operating environment, not a marginal technical adjustment, and argued that the record of innovation built on existing rules must be weighed against claims of future benefit.

The LEO tier: commercial systems advancing without Washington

Running through the hearing but never its explicit focus was the accumulating progress in commercial low Earth orbit PNT—the tier that may ultimately prove most consequential for complementary architecture.

Dyer described three U.S. companies in various stages of deployment. Iridium operates the first commercial LEO PNT system in the United States, with more than 70 partners across 25 states. TrustPoint is developing a C-band constellation designed for orbital, signal and frequency diversity relative to L-band GPS; three satellites are on orbit, four more in development, with commercial service targeted for 2027. Xona is broadcasting a new signal designed for compatibility with existing GPS receiver infrastructure, scaling manufacturing in California with six launches planned this fall. GPSIA formally recommended that Congress urge FCC approval of Xona’s pending radionavigation-satellite service license application (ICFS File No. SAT-LOA-2023-0711-00165).

Feld anchored the panel’s broader policy argument in the GPS-as-public-good framing, warning against any architecture evolution that would introduce tiered access, impose new costs on agricultural and rural users who rely on free GPS today, or allow the existing system to degrade in favor of proprietary alternatives. He called for privacy-by-design principles to be incorporated into next-generation PNT at the system level rather than addressed through post-hoc regulation.

The record as it stands

The hearing did not resolve the FCC proceedings it illuminated. Its contribution was to put the state of the U.S. PNT posture on the legislative record at a moment when three distinct tracks—GPS modernization, interference enforcement and complement architecture—are simultaneously in motion, each with its own pending proceedings and its own constituency of stakeholders whose written positions now form part of the official record.

The post Congress Weighs the State of U.S. PNT: GPS Modernization, Interference Enforcement and the Search for Complementary Architecture appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

SÉBASTIEN TRILLES, THIERRY AUTHIÉ, XAVIER VASSEUR, MARIE ABBAL, THALES ALENIA SPACE, TOULOUSE, FRANCE

To use GNSS systems for air navigation, various civil aviation organizations have defined an augmentation system capable of fulfilling two primary missions. The first is to calculate correction messages that allow aviation users to exploit GNSS data for precise positioning, even if the GNSS system incorporates intentional or unintentional degradations affecting geolocation. The second mission is to monitor all navigation data broadcast by GNSS systems in real time to detect any anomalies and alert aviation users within a timeframe compatible with their flight phase. Given civil aviation’s need to cover a large area, typically on the scale of a continent, the dissemination of these messages has naturally been directed toward geostationary satellites known as Satellite Based Augmentation Systems (SBAS).

The role of an SBAS is to decompose the various contributors to measurement errors and broadcast, through dedicated augmentation messages, corrections associated with each error contributor to users. These corrections are reassembled by the user receiver according to their geographical position, improving positioning accuracy and helping to mitigate error sources that affect distance information related to satellite clocks, their positioning, and ionospheric effects. All SBAS are interoperable and standardized [1].

The classic functional architecture of an SBAS is composed of a network of ground reference stations that collect GNSS navigation measurements and data, a set of central processing facilities that compute corrections and constructs augmentation messages, and a set of transmission stations that broadcast the radiofrequency signal toward the geostationary satellite.

Current SBAS systems are designed for single constellation GPS, single-frequency L1 users, using the L/NAV navigation message. The augmentation signal is broadcast on the L1 frequency band, modulated by a dedicated PRN, and contains orbital corrections, clock corrections, and a model to correct ionospheric elongation.

Future SBAS, called Dual Frequency Multiple Constellations (DFMC), are dedicated to dual-frequency L1/E1 and L5/E5a users, using L/NAV navigation messages for GPS and F/NAV for Galileo. The augmentation signal is broadcast on the L5 frequency band, modulated by a dedicated PRN, and contains orbital and clock corrections for satellites from different constellations.

The main limitation of SBAS accuracy and availability performance lies in the regional coverage of the ground reference stations network, which does not allow continuous monitoring of the satellites in the navigation constellation. As a result, SBAS must continuously manage satellite visibility losses for several hours, requiring complex strategies to detect any satellite event such as manoeuvres, clock anomalies and hardware bias as soon as measurements become available again. The strong coupling that exists between material biases and ionospheric elongation adds difficulty in the case of satellite raising because it is often difficult to separate a hardware bias jump and an ionospheric event at the edge of the zone.

Furthermore, a geographically restricted network of reference stations does not allow for the correct decoupling of satellite orbits and clocks. This limitation is not a problem for a small service area because the clock error partially compensates for the orbit error. However, clock error is a scalar while orbit error is a three-dimensional vector, so how good the compensation of one error by the other depends on the size of the geographical area to be covered and the geographical position of the user within it. Consequently, a wide service area needs good decoupling between orbit and clock, which a network of regional stations does not provide.

This article studies the possibility of spatializing all the components of a classic SBAS. In this approach, the three main steps of SBAS processing, collecting GNSS data, calculating augmentation messages and disseminating those messages to users, must be carried out by components in free fall around the Earth.

Global SBAS Architecture Overview 

The first step in the SBAS spatialization process involves taking fixed reference stations on Earth and placing them in orbit, under navigation constellations, i.e., in low Earth orbit (LEO). There is no point in flying the stations in cluster formation, as this would not solve the regional problem and, moreover, the service would only be intermittent during the cluster’s orbital period. We immediately assume a uniformly distributed constellation as the geometry for the station distribution.

By doing this, LEO flying stations (LFS) can see GNSS constellations permanently, which is an undeniable advantage for increasing the accuracy of corrections and detecting critical events. Another benefit is SBAS has the capacity to be a global service, representing a significant paradigm shift. The spatialization of the stations also avoids the difficulties of defining a terrestrial network, which must satisfy geopolitical conditions, not to mention that the Earth is 70% covered by oceans, limiting the possible terrestrial sites to emerged geographical areas.

On the other hand, GNSS reference stations are no longer fixed points on Earth; they evolve over time. However, their trajectories remain predictable as their movements are well known and correctly modeled in the short term because they are governed by the laws of space mechanics. It is necessary to have accurate orbits for LFS. Several solutions exist for performing this calculation. Three approaches naturally emerge:

1. The calculation of LFS orbits is performed simultaneously and in the same process as the MEO orbits of the constellation satellites; 

2. LFS orbits are estimated using GNSS measurements through a separate process;

3. LFS orbits are calculated using independent means and independent measurements.

The first approach raises several questions regarding the commonality: LFS are devoted to monitor the GNSS constellation satellite. Using GNSS measurements for both LEO and MEO positioning in the same process brings significant 
algorithmic complexity and risk on the impact of a feared MEO satellite event on LEO position and detection capabilities. Thus, this approach is not discussed. 

The second approach decouples orbit calculations but requires implementing GNSS fault detection and exclusion techniques such as RAIM or ARAIM to make the position of the reference stations insensitive to failures of the constellation satellites.

The last approach offers the greatest possible independence because it is achieved using measurements from a positioning technique that is completely decoupled from GNSS. The Doppler Orbitography and Radiopositioning Integrated by Satellite (DORIS) system is an example of such an independent system. DORIS is a radio navigation and orbit determination system based on Doppler measurements of signals transmitted from the ground to satellites. It is developed and maintained by CNES, the French Space Agency, widely used for space geodesy, Earth observation, altimetry missions and achieving centimeter precision level. The onboard DORIS and GNSS receivers share the same clock. The clock is synchronized with System Network Time (SNT, the reference time of the globalized SBAS), so the orbit generated will be time tagged with respect to the SNT. We retain this for this framework.

At the planned altitude, the LFS are positioned above the area where the ionospheric plasma is most concentrated. The GNSS measurements collected on board shouldn’t be much affected by ionospheric delays. This also implies this type of system will not be able to develop an ionosphere model and calculate ionospheric corrections to single-frequency users. Thus, this framework is devoted for dual-frequencies users. According to this paradigm, the ionosphere model shall be elaborated by an external entity.

The local Earth environment or propagation effects (troposphere and ionosphere) no longer affect measurements collected by GNSS receivers. Therefore, the quality of the measurements is expected to be significantly improved compared to a ground-based system. This favorable environment, associated with a geodetic quality receiver, will improve the precision performance of augmentation navigation messages.

In this framework, the LFS move at a high speed, of the order of 7 km/s, which generates visibility durations for GNSS satellites of 30 minutes. These passage durations are much shorter than those observed from the ground by several hours, but they are long enough for floating ambiguity resolution. The rapid dynamic of the LFS generates high relative movement between LEO and MEO satellites, providing better decorrelation between orbits and clocks and improving SBAS augmentation message performance.

LFS Communicate Via Inter Satellite Links

The proposed architectural framework incorporates inter satellite links (ISL) between the LFS (Figure 1). Selecting optical or RF ISL is driven by the trade-off between ranging accuracy, security and volume of data to be transmitted versus satellite design complexity. Optical links are suitable for high bandwidth and security requirements but demand more advanced technology and precise alignment that affect satellite design. RF links represent a proven technology, simple to deploy and tolerant of inaccuracies, but limited in bandwidth and inherent security. 

ISL capability serves two functions:

• A communication function to share the information recorded by each satellite;

• A ranging measurement function to improve the algorithms for determining the orbits of LFS and to participate to generate the independent SNT.

The first is equivalent to the terrestrial network, the Wide Area Network (WAN), which ensures the transfer of information between SBAS elements. 

The second aims to improve the position calculation and prediction of LFS by feeding the precise orbit determination, initially based on the provision of DORIS measurements, with additional Inter Satellite Ranging (ISR) measurements. The geometry and the accuracy of these additional measurements will help, respectively:

• To improve accuracy positioning in normal and tangential directions;

• To precisely locate the phase center of GNSS signal reception;

• To cope with possible jamming or spoofing of the DORIS station by offering an independent set of measurements; 

• To connect LFS clocks between them to measure their desynchronization (Figure 1). 

Several approaches can be envisioned for forming the clock’s equations, in particular the classic method based on the dual one-way ranging that allows decoupling orbit and clock problems [4].

In this framework, ISL continuity is assumed to be maintained over time without interruption, which requires permanent precise pointing.

The Navigation Kernels are Decentralized

Navigation computations are no longer handled by a single element but are distributed. This distribution is either entrusted to an infrastructure external to the system, already in place and managed independently, or distributed among all LFS.

In the first option, the globalized SBAS has access to a space cloud that handles the entire computational load. The links between the LFS and the space cloud are provided by ISL.

In the second option, each satellite carries a shared computing capacity. The computations are decentralized: Each computing unit performs part of the workload and exchanges the results with each other. These results are assembled by each LFS to generate a common navigation context. 

Decoupling Differential Corrections Generation and Integrity Monitoring

According to the original SBAS architecture designed by Thales Alenia Space [2-3], the navigation processing facility is composed of two components to ensure the independence of integrity checks. The first one, the Processing Set (PS), calculates the SBAS corrections and generates the Navigation Overlay Frame (NOF) with respect to the message format and message sequence defined in the MOPS and SARPS. The Check Set (CS) is the second component responsible for checking the integrity of the corrections from the NOF received from the GEO satellite, using data from at least one other group of independent receivers from each RIMS. When needed, it generates alarms on satellites that are collected by the PS and injected inside the very next NOF in case an anomaly is detected. To ensure diversification, the set of RIMS is divided into two distinct groups: RIMS-A only feeds the PS and RIMS-B only feeds the CS. The rational of this “dual channels” architecture is to comply with the safety requirement stating no single or common mode of failure shall entail a non-integrity event.

The solution studied proposes maintaining this distinction between the roles of the sets, PS on one side and CS on the other, and further extending independence by specifically allocating the measurements collected by a LFS to the PS or the CS functions exclusively. This leads to two separate LFS fleets: one dedicated to fulfilling the PS functions (denoted LFS-A, and acting as RIMS-A) and one dedicated to fulfilling the CS functions (denoted LFS-B, and acting as RIMS-B). The CS can communicate with the PS at the minimum level of integrity parameters to fulfil integrity checks. 

With such separation, the globalized SBAS architecture guarantees complete diversity in the measurement geometry to fulfil the PS and CS functions: the measurements from LFS-A will capture a very different observation geometry from that captured by the LFS-B measurements to perform integrity monitoring. This capability represents a significant advancement over previously developed ground-based architectures (EGNOS and KASS, for example) that co-locate RIMS A and B (in reality these two stations are separated by a few dozen meters to diversify the local environment. However, both RIMS capture the same observation geometry).

An even stricter independence step is to dedicate one batch of LFS to perform only the PS function and the other batch to perform only the CS function. The constellation is divided into two sub-constellations: partition A and B. The first calculates the navigation message (partition A allocated to the PS) and the other monitors the integrity of the message (partition B allocated to the CS). Each partition implements the distributed calculation of the PS and CS functions.

The two partitions communicate with each other via ISL to construct the message to be broadcast: The PS communicates the NOF ready to be sent to the CS, and the CS returns the results of the independent integrity checks to the PS. Different combinations are possible on the geometric distribution of the PS and the CS. This article focuses on two options: partitions (A and B) evolve at the same altitude (Option-1), or the partitions are positioned at two different altitudes, one specific for A and another for B, (Option-2). 

System Time Scale Generation

A SBAS must generate its own time reference, the SNT, which must be parallel (as much as possible) to the TAI. All clock corrections are computed relative to this system time reference. Because the bandwidth of NOF messages is 
limited (currently 250 bits per second), the SNT is steered to GNSS time to limit the magnitude of the corrections.

Several techniques are possible to achieve this internal time scale. Conventional SBAS only have RIMS-GNSS satellite links; the links between RIMS clocks are only accessible from a common satellite visibility by simple difference. Some SBAS develop the SNT using only a set of RIMS (EGNOS), which requires the construction of simple difference measurements; others (KASS) construct the SNT using all available clocks, including those of the RIMS and those of the GNSS satellites.

The globalized SBAS allows SNT construction based solely on the LFS clocks thanks to the direct links that connect them. This architecture makes it possible to construct a timescale independent of the GNSS constellations. The dual one-way ranging technique allows measurement of clock differences over time between two satellites connected by a laser link:

where h_i and h_j are the clock desynchronization of LFS clocks i and j, H_ij is the dual one-way ranging measurement corrected by relativity effects, hardware delays (in meter) relative to the ISL antenna on the receiving chain and on the transmitting chain, and phase centre offset relating on both emitter and receiver satellite [4].

It is therefore possible to construct the clock problem and solve it using various techniques [5-8]. The high quality of the dual one-way ranging measurements, combined with high-quality atomic clocks, allows the construction of a composite timescale whose expected qualities have phase continuity, frequency continuity and high stability (measured by the Allan variance). The SNT is aligned with the GNSS constellation timescale in a conventional manner, either by calculating a timescale difference, a posteriori, or directly during SNT generation by adding constraint equations. This steering will be performed using navigation messages from the GNSS constellations.

The timescale obtained is implicit; it is a paper time because it is calculated as a “well-constructed” average of all the clocks contributing to the calculation. The result of the composite clock algorithms provides biases that represent the advances or delays of each of the LFS clocks relative to the SNT timescale. Once these biases are applied, each clock is assumed to represent a realization of the SNT. This process, therefore, enables the global synchronization of all the LFS in the SBAS system. It then becomes possible to transmit a signal to the constellation every second of the SNT time.

TTA Reduction

The classic implementation of an SBAS (like that of the EGNOS V2 and KASS operational systems) is designed to be a Periodic (repetitive cycle of operations), Synchronous (each operation is performed according to its own timing), and Pipelined (all operations are performed in series) system. Specifically, observations are performed simultaneously at all ground RIMS stations at the second round of GPS time. Data are then transmitted to the navigation cores, where the algorithms are executed at a frequency of 1 Hz as soon as almost all RIMS measurements are received. Each operation has a specific execution time allocation, and the entire system is designed to complete a cycle in 5.2 s.

In the globalized SBAS concept, the LFS also perform measurements in a synchronous manner, meaning all stations observe GNSS events at the same coordinated moment. However, unlike the classic implementation, the specific timing of these measurements is optimized. The synchronization point is not arbitrarily fixed to the second round of system time, but is strategically chosen. This optimization takes several constraints into account: the requirement for the NOF to be available for broadcast starting at a specific round of system time, the estimated data transmission time between LFS, and the computational resources needed to generate the NOF. By aligning the measurement moment with these operational constraints, the system can maximize efficiency and ensure timely availability of the SBAS corrections for end users.

Assuming measurements time is optimized, the time allocations in the different elements of the system would be [9]:

• 1,000 ms to acquire new measurements, due to the 1Hz frequency of NOF broadcasting;

• 200 ms to generate the raw measurements (150 ms) and to format them (50 ms);

• 150 ms to disseminate the data to all SV through the ISLs;

• 350 ms to process data in the DPS (200 ms for computation and 150 ms for exchange data between satellites).

At the end, the NOF ready for broadcast is available in less than 1 second (Figure 2).

The time to alert (TTA) corresponds to the maximum time elapsed between the moment an anomaly likely to compromise user safety is detected and the moment the user receives the corresponding alert, informing them to no longer trust the service. In other words, it is the maximum time for any fault/error detected or suspected by the system to be reported to users by an alarm message transmitted via the SBAS signal. TTA is a central criterion for safety-of-life applications. For vertical guidance approach services (APV-I / LPV-200 type), the international ICAO SARPS standard sets the maximum TTA at 6 seconds. If the SBAS detects a loss of integrity, the alert must reach the user within this time. A short TTA ensures users will be quickly informed of a loss of performance or an anomaly, and can react or interrupt critical procedures when service reliability cannot be guaranteed.

The TTA takes the duration of NOF transmission (1 s) into account and the time allocated to user processing (800 ms). The time of SBAS signal propagation from LEO to user is neglected in this first apportionment (around 3 ms). The complete SBAS cycle is completed in between 3 and 4 s (compared to 5.2 s in classic case). The TTA is then below 3.5 seconds, representing a reduction factor of two with respect to classic ground SBAS (Figure 3). 

Finally, the concept of fast alert, [9] would be enabled. Fast alert messages are broadcast using the Q-channel and contain the alert flags (alarm/no alarm) for all satellites set in the PRN mask. The complete SBAS cycle is completed in 1.5 s (compared to 5.2 s in a classic case). This operational flexibility would allow a TTA of 2.3 seconds (Figure 4). 

LFS Broadcast the NOF

In a conventional SBAS architecture, the NOF is transmitted to users by one or more geostationary satellites. This message is generated on the ground, so it must be encoded into a signal and transmitted by a dedicated RF ground up-link station to the GEO. Because the first bit of the NOF must be sent synchronously at the second round of SNT time (close to GNSS time by specification) at the phase center of the GEO satellite, conventional SBAS systems implement a long loop that controls the signal transmission time to the ground. The SBAS is also endowed with an “integrity box” that checks the NOF return link to ensure the NOF received by the user is the same as the one computed by the system. In most cases, both NOF are strictly equal; if a corruption is detected the integrity box cuts the emission at ground.

In the case of a space-based SBAS system, LFS are capable of transmitting the NOF. To be properly processed in the GNSS receiver computing chains, this signal must be modulated by a PRN code that will spread the carrier spectrum using the Code Division Multiple Access (CDMA) technique. For this signal to be correctly processed within GNSS receiver chains, it must be modulated using a Pseudo-Random Noise (PRN) code, effectively spreading the carrier spectrum via CDMA. There are two primary approaches for assigning PRN codes to the LFSs:

• All LFSs transmit using the same PRN code;

• Each LFS transmits using a dedicated PRN code.

In the first case, the globalized SBAS broadcast the NOF with a single, unique PRN for all LFS transmissions. When multiple LFS are within the receiver’s field of view, the receiver can typically differentiate between transmissions by exploiting distinct Doppler shifts, which result in separate correlation peaks in the time-frequency domain. However, the probability of collision between the two correlation peaks is significant. Assuming a Doppler shift of 50 kHz, a loop bandwidth of 5 MHz and a PRN code of length 1,023 chips, the probability of a collision between two peaks can be estimated as (5.10³/5.10⁵)×1/1,023≈10^-5 per millisecond, corresponding to roughly one collision per 100 seconds. If three satellites are in view, the likelihood of simultaneous collision among all three signals becomes negligible. Therefore, using a unique PRN for all LFS requires continuous visibility of at least three LFS. However, this approach implies LFS signals cannot be used for ranging: While the NOF message can be received, the receiver cannot distinguish which LFS transmitted it.

In the second approach, each LFS is assigned a distinct PRN code. Currently, GNSS receivers store the navigation contexts of NOF messages received from each GEO SBAS, identified by its dedicated PRN. Out of all recorded contexts, the user applies only one; when the receiver switches PRNs, it replaces the navigation context accordingly and the old one is purged. In the context of globalized SBAS, however, the visibility time of each LFS is very short, about a dozen minutes, which is insufficient for a receiver to fully update its navigation context. In this situation, the user must retain the navigation context when switching PRNs instead of purging it. This ensures seamless continuity for the user; the navigation solution remains coherent regardless of the current LFS because the integrity and accuracy information provided by each NOF is consistent across all LFS. This adaptation necessitates an evolution of SARPS and MOPS standards to accommodate the new PRN allocation schemes envisaged for global SBAS. This approach allows the ranging function to be achieved even if it involves a significant increase in the number of PRNs required. 

The NOF is transmitted synchronously at the second round of SNT time. In other words, all LFS transmit the NOF to users at the same second of SNT time. This approach removes the necessity and the complexity of the long loop.

Every second, the system broadcasts a single common NOF according to a fixed and predictive message-sequencing scheme, compliant with the requirements of the SARPS standard. This augmentation message is broadcast in L5-I signal frequency.

The constellation is designed so at least two LFS are visible beyond 5° elevations of any user on Earth. The LFS are assumed to be able to receive GNSS signals in the Radio Navigation Satellite Service (RNSS) band and emitting the Aeronautical Radio Navigation Service (ARNS) band without jamming between emission and reception.

Whereas in conventional systems two or three GEOs are active, the possible loss of a GEO has a direct and immediate impact on availability and service continuity performance over a sometimes large geographical area. This new approach multiplies the number of NOF emission points, which greatly increases the resilience of system performance to this type of failure, reducing the impact to only a few users. Different combinations are possible on the geometric distribution of NOF emission points: in Option-1 the two partitions broadcast the NOF, in Option-2 only one partition broadcasts the NOF (Figure 5).

In Option-1, the two fleets broadcast the NOF. A standard functional allocation would consist in apportioning the same number of satellites to partitions A and B. As the LFS A and B are placed at the same altitude, the LFS-B cannot treat the NOF received as the user will; LFS-B only checks the NOF the system is ready to send the user. As all LFS emit the NOF, the return link function is not possible. Detecting possible NOF corruption (a LFS emits a message not conformed to it specification) is then allocated to the user. If the NOFs are different, SBAS can no longer be used. 

In Option-2, partition A is placed above partition B: altitude of the PS function is higher altitude of the CS function and only partition A broadcasts the NOF. The two partitions remain connected by ISL. The difference is now the CS can receive and monitor the NOF messages being sent by partition A and identify whether corruption is possible. The CS identifies the LFS-A responsible for this corruption and sends it a command requiring it to stop sending the NOF. At the next second, this specific LFS-A will cease the emission. The redundancy of LFS-A is designed to limit the impact of this corruption at user level and to maximize the level of performance of availability and continuity.

A global SBAS should bring permanent continuity in GNSS satellite visibility so it can monitor, at any time, all GNSS satellites configured in the PRN mask. 

LEO Ranging Function

The realization of this function assume seach LFS transmits using a dedicated PRN code. LFS have an independent orbit estimate and are synchronized with each other, giving them the information necessary to fulfill the LEO ranging function (Figure 6). This consists of considering LFS as an additional ranging signal. Consequently, the globalized SBAS can naturally act as a LEO PNT system:

1. The satellite precisely synchronizes the start of a PRN code sequence transmitted in the signal with the start one second of SNT time, 

2. The satellite synchronizes the first bit of the navigation message with the second round of SNT time, 

3. The satellite maintains synchronization of the start of a navigation bit with the start of a PRN code sequence, 

4. The satellite maintains the code-carrier consistency.

The internal navigator of the LFS provides an orbit and a clock synchronization bias relative to the SNT. Orbitography algorithms also provide a variance-covariance matrix that can be used to provide URA data. A suitable ARAIM concept could provide the integrity of LEO satellite navigation data, allowing LEO ranging measurements to be incorporated into a safety-of-life solution. The LFS navigation message shall be encoded in the signal broadcast to the user.

In the classic SBAS paradigm, GEO-Ranging function is possible and GEO data navigation takes place inside the NOF itself (MT9 dedicated for GEO SBAS L1 ephemeris). In the spatialized SBAS paradigm, the number of transmitting satellites is increasing considerably and inserting LEO navigation data into the NOF would congest the available bandwidth. It is better to transmit the SIS ranging data in a dedicated message rather than the NOF. In this aspect, two options are envisioned: either LEO ephemeris are encoded in L5-Q signal frequency or L1-I signal frequency. The first is the most energy-efficient because one signal is generated on L5, which modulates the NOF on the I channel and the ephemeris on the Q channel. The second option requires generating and transmitting two signals on two different frequency bands, which consumes more energy and adds complexity. Users can leverage these two frequencies to form the iono-free combination, as is done with GNSS satellites, and improve their positioning.

Monitoring and Control

Classic SBAS provides system monitoring and control, which involves overseeing and managing the ground segment subsystems, supporting maintenance tasks—including configuration management—offering data archiving capabilities for offline activities, and enabling communication with external entities.

In spatialized SBAS, the need for the system monitoring and control function is still present: it is even mandatory to operate the system. The operator ensures operational management of the system, maintenance of the infrastructure and supervision of the service provided to users. Several Mission Control Centers (MCC) on ground are necessary for this. The MCC and the LFS constellation communicate with each other by classic TM/TC.

LEO Constellation Infrastructure 

Achieving a worldwide SBAS solely through ground stations is impractical due to the necessity of comprehensive global coverage, which would require an immense and continuously maintained network of ground infrastructure spread across the entire Earth’s surface. This makes it difficult to provide consistent, reliable augmentation signals everywhere. 

Deploying space-based stations in LEO orbits offers a more efficient and effective solution. LEO satellites can cover vast areas of the planet from orbit, overcoming environmental masking faced by ground stations. This space-based approach ensures continuous, global augmentation service with improved scalability, making it preferable for establishing a worldwide SBAS.

Another benefit of the LEO constellation, and a consequence of global coverage, is its unique capability to receive measurements from GNSS satellites throughout their entire orbits, regardless of the satellites’ position relative to the Earth’s surface. This comprehensive 
visibility enables LEO satellites to monitor GNSS signals continuously, eliminating geometrical blind spots that can occur when relying on ground stations. The estimation of GNSS satellite orbits and clock errors becomes more accurate and robust, leading to improved navigation performance. By providing consistent and diverse observational data from multiple vantage points in space, LEO constellations significantly expand the precision and reliability of GNSS orbit and clock determination. This visibility is the main driver of constellation size: ensuring at least one LEO satellite is visible at all times everywhere on Earth is required to receive the NOF message. Given the safety-of-life nature of the system, safety guidelines further recommend a minimum of two LEO satellites be visible at all times everywhere to cover a single satellite failure. Visibilities are considered when the satellite is above 5° of elevation above the horizon.

The characteristics of a LEO constellation satisfying this constraint mainly depends on altitude. For this study, two different altitudes are considered: 

• 750 km of altitude. This leads to a constellation made of 96 satellites.

• 1,200 km of altitude. This leads to a constellation made of 57 satellites.

These constellations are designed to ensure a minimum number of satellites to respect geometric constraints. They do not constitute the real constellation that will necessarily be sized to take into account failures, redundancy, etc.

These two LEO constellations are configured and represented in Figure 7. 

For each altitude considered, the constellation is minimal in terms of number of satellites. Any constellation with fewer satellites does not ensure at least two satellites in visibility at all times.

The visibility constraint can be verified by using a simple simulation. Visibilities are calculated for a grid of users on Earth. However, as the LEO satellites have an orbital period between an hour and a half and two hours, they make around 15 orbits on a single day. This means globally, the visibility statistics are the same for all users on a same latitude. Therefore, the results in Figure 8 show the minimum, average and maximum number of satellites in visibility as a function of latitude. 

The constraint of at least two satellites in visibility is satisfied everywhere. The statistics do not differ significantly between the two constellations, with visibilities being minimum at the equator, increasing for higher latitudes and decreasing near the poles.

A LEO satellite used for a safety-of-life system will have associated constraints in terms of certification and will be costly. So, the number of satellites should be minimized, making the constellation at 1,200 km the seemingly preferred option. However, this criterion should also be in balance with criteria related to the satellite payload, onboard available power, antenna design, launching constraints and end-of-life constraints. A higher altitude means satellite signals will have to be transmitted with a higher power. The launchers will need to reach a higher altitude, and deorbiting the satellites when they reach their end of life will require more manoeuvring capabilities. This all must be taken into account, but it is also very dependent on satellite platforms, payloads and launching capabilities.

Distributed Processing Facility 

Space-based computing

Space-based computing has been increasingly taken into consideration over the past few years. Among others, we mention the innovative EU-funded study Advanced Space Cloud for European Net zero emission and Data sovereignty (ASCEND) [10], which focuses on the feasibility of deploying space-based data centers and relying on space-based cloud based solutions [11].

In May 2025, China launched the first 12 satellites of a planned 2,800-strong orbital supercomputer satellite network. These satellites aim at performing calculations in space without relying on any ground-based computing facility.

Computing in space offers three major advantages compared to traditional ground-based systems:

• Reduced data transmission costs: Processing data locally in space reduces the need to downlink large volumes of data to Earth, saving bandwidth and costs;

• Low latency: The mutual proximity of satellites in the constellation reduces communication delays, enabling faster data processing;

• Scalability: Space-based cloud computing can potentially scale by deploying additional resources (later named spare satellites) and can be reconfigured dynamically.

A centralized space-based solution 

A straightforward route to designing an efficient space-based processing facility is to rely on a centralized space-based solution, where an independent and already in place infrastructure located in space hosts the entire calculation. This solution exploits already existing algorithms and relies on computing infrastructures currently used on ground-based systems. Nevertheless, this easy to follow route faces the following three main challenges:

• Single point of failure: The entire computing system relies on a single dedicated platform. This means any hardware or software failure can disable the entire computing capability, unless duplicate/diversified computing capabilities are incorporated into the constellation. This expensive solution makes the global infrastructure rather complex.

• Communication: All data must be routed to and processed by the centralized unit, which represents a major bottleneck in terms of communication and elapsed times before calculation. High communication loads may significantly reduce real-time responsiveness;

• Energy inefficiency: A centralized computing solution may require high power consumption for processing large data movement within the single dedicated infrastructure. This may create additional energy constraints.

A fully distributed space-based solution

For all these reasons, an alternative solution must be proposed. In a fully distributed space solution, each satellite in the LFS constellation corresponds to a specific node of the distributed computing facility. Each satellite of each subconstellation acts as a computational unit and communication between the different nodes is handled by ISL links. 

With at least two LFS visible beyond 5° elevations of any user on Earth, the estimated total number of satellites of the global constellation is bounded by 96. Because half of the LFS are attributed to the augmentation message, the total number of nodes of the computing facility is bounded by 48. This moderate network size for a distributed computing facility allows state-of-the-art parallel algorithms to be employed to compute and broadcast messages [12] [13]. At first sight, distributed computing offers immediate advantages over a centralized solution: 

• Efficiency: Multiple nodes can handle different computations concurrently. This speeds up the overall computation of navigation messages with respect to a centralized solution, where communications may become a significant bottleneck;

• Fault tolerance: Because processing is spread across multiple nodes, random failure of one node does not necessarily harm the entire navigation system. Other existing nodes of the LFS-A subconstellation may take over degraded tasks. This flexibility is one of the main advantages of the distributed computing solution. Additional spare satellites also may be incorporated into the LFS-A subconstellation to improve fault tolerance.

• Redundancy: Distributed systems can implement both hardware and software redundancy more naturally by duplicating specific critical functions across multiple nodes, reducing potential single points of failure resulting from random failure.

The distributed computing facility relies on the core idea that each node performs a specific part of the computational workload and exchanges messages (possibly with each other) through ISL links. At the end of the procedure, the results are gathered by each LFS to generate a common navigation context. This may induce a potentially high volume of point-to-point or collective communications between the nodes of the LFS-A constellation. Therefore, it is of outmost importance to rely on algorithms that minimize the global volume of communication. The computation of the state vector during the filtering process in the PS function provides an instructional example in this regard. Of interest is a parallel algorithm for the solution of least-squares problems that requires a low volume of communication. Does this orthogonal factorization distributed algorithm exist at all?

The answer to this question is positive if we rely on advanced numerical linear algebra methods for the solution of least-squares problems. In our context, a parallel algorithm named Communication-Avoiding QR (CAQR) is worth considering [14]. CAQR is a class of QR orthogonal factorization algorithms designed to minimize (and not avoid) the costly communication between nodes in distributed systems. Because data movement often dominates the energy consumption and runtime of numerical algorithms, CAQR aims at improving both performance and energy efficiency by reducing the communication overhead. Communication in our context includes data transfers, which are often more expensive (in time and energy) than arithmetic operations [12]. This reduction of communication overhead is obtained through a specific factorization: CAQR typically divides the matrix to be factorized into different panels (i.e. blocks of columns). Instead of applying the classical Householder QR method [15], [16] on the panel, CAQR applies Tall-Skinny QR (TSQR) [17] instead, a specific QR factorization. TSQR minimizes communication by recursively factorizing smaller blocks, using a reduction tree structure (e.g., a binary tree of partial QR factorizations) to combine results efficiently with limited data movement [18] [19]. In short, communication costs are reduced by organizing QR operations as tree-structured reductions rather than linear sequences. This algorithmic feature enables parallel processing of independent blocks, combining partial results with minimal communication steps. The number of communication steps is logarithmic in the number of panels [20].

By significantly reducing the volume of communication, CAQR delivers a reduced energy consumption while providing improved overall runtime [14]. CAQR maintains the numerical stability properties of classical Householder QR factorizations, ensuring accurate and reliable factorization results despite the communication optimizations. At the end of the algorithm, the solution of the least-squares problem is known on a leaf of the reduction tree and a single collective communication is used to share this information on the other nodes of the LFS-A subconstellation. This shows a distributed algorithm with a low overhead in terms of communications can be applied during the filtering process. 

Space-based distributed computing is a doable approach that introduces additional constraints to satisfy during the design of the architecture of the spatialized SBAS: 

• Limited computational resources: Each node has a specific limited CPU (or GPU) power, memory and energy compared to Earth-based computing centers. A key point is to optimize the global hardware resource efficiency with respect to the properties of the LFS-A subconstellation (number of satellites and total volume of communication essentially);

• Physical and environmental constraints: Space-based computing often meets challenging physical conditions (such as temperature extremes, vibration, radiation in space) that may affect hardware reliability. Hardware must be resilient against environmental factors. A key point is to overestimate the number of satellites in the LFS-A subconstellation to provide redundant calculations.

These additional constraints must be carefully considered when designing the global constellation and when performing the safety analysis.

Safety Dimensioning in New SBAS Architecture Concepts

When analyzing novel SBAS architectural concepts from a safety standpoint, it is imperative to recall the overarching safety dimensioning principles to guide the assessment of their compliance and the identification of associated constraints.

This analysis is framed within the context of civil aviation. At the system level, the primary safety-feared events and their corresponding severity classifications are defined as:

• Integrity is customarily established as the measure of the trust that can be placed in the correctness of the information supplied by a navigation system. Integrity includes the system’s ability to provide timely warnings to users when it should not be used for navigation. A failure in integrity, termed a “non-integrity event,” is linked to a hazardous severity classification [21].

• Continuity is the ability of the total system (comprising all elements necessary to maintain craft position within the defined area) to perform its function without interruption during the intended operation. More specifically, continuity is the probability the specified system performance will be maintained for the duration of a phase of operation, presuming the system was available at the beginning of that phase. A “non-continuity event” corresponds to a major severity classification [21].

Foundational Safety Engineering and Safety Assurance Principles

The applicable European Cooperation for Space Standardization (ECSS) standards in Europe stipulate that “no single system failure or single operator error (SPOF) shall have critical (i.e. hazardous) or catastrophic consequences.” This has profound architectural implications; it requires that any function whose failure could result in critical/hazardous consequences must be underpinned by a minimum of two independent components.

Development Assurance Level (DAL)

Given the safety-critical nature of civil aviation, software development is governed by rigorous standards. Safety analyses underpin the allocation of Development Assurance Levels (DAL) to various items in accordance with the architecture.

Development Assurance involves specific planned and systematic actions providing confidence that errors or omissions in requirements have been identified and corrected to the degree the system implemented satisfies the applicable safety requirements. System/sub-systems and products are assigned DALs based on failure condition classifications associated with system level functions implemented in the sub-systems and products. The rigor and discipline needed in performing the supporting processes vary corresponding to the assigned development assurance level.

The initial software DAL determined can be mitigated when considering the different kinds of protections or alternate potential design implemented into the architecture, with provision that evidence of full independence between involved software functions is provided. Finally, the DAL allocation is a consequence of the implemented architecture: The redundancy, independence, and segregation embedded within the architecture dictate the refinement of DAL assignments. DAL levels play a pivotal role in component selection and exert a significant influence on project costs. It is prudent to iteratively assess candidate architectures to converge upon an optimal solution.

Software failures with potential hazardous implications (e.g., non-integrity events in SBAS) necessitate DAL B [22]/SWAL 2 [23].

Software failures leading to major events (e.g., non-continuity events and Accuracy Major event in European SBAS) require DAL C [22] / SWAL 3 [23].

In typical SBAS architectures, functions contributing directly to the integrity check of augmentation messages and certain critical data dissemination tasks—those that guarantee the non-corruption of broadcast messages—are assigned DAL B, in recognition of their integrity-related criticality. Conversely, functions related to data collection and non-critical dissemination generally carry a DAL C assignment in Europe, reflecting their continuity focus.

Emitted SBAS Signal Monitoring

For any safety-critical system intended for safety-of-life applications, the following principle remains salient: Wherever possible, the SBAS system should internally monitor its own transmitted signal, permitting real-time awareness of failures (primarily those in the dissemination chain) and take adequate actions instead of relying on open-loop operation. While not a formal requirement provided other safety principles (in particular the SPOF principle) are observed, this best practice is inherent to the present concept.

Implementation of Safety Principles in Operational European SBAS EGNOS V2

These foundational safety principles are stringently applied in the operational European EGNOS system, with their fulfillment evidenced across the following major functions:

Data Collection: EGNOS V2 employs physically and logically separated RIMS A and B chains, both developed according to DAL C1.

• Augmentation Message Calculation and Integrity Checking: The Central Processing Facility (CPF), assigned DAL B1, comprises two independent units fed by independent data: the PS fed by RIMS-A and the CS fed by RIMS-B. In accordance with [22], the PS is allocated DAL C1 and the CS receives DAL B1. This dual-channel design directly supports enforcement of the SPOF principle.

• User Dissemination: The operational SBAS in Europe relies on NLES and GEO segments. Safety-critical integrity related functions—such as CPF selection and Integrity Check— are segregated and allocated DAL B. Functions that contribute primarily to continuity rather than integrity are assigned to DAL C1.

The integrity check function—which continuously verifies the fidelity of the broadcast NOF via the Integrity Box—effectively upholds the SPOF principle by precluding integrity events stemming from a single failure or corruption of the NOF within the dissemination chain. This mechanism ensures continuous monitoring of the emitted SBAS signal, empowering the system to respond appropriately in the event of any dissemination anomaly.

Complementing this capability, GEO signals as received at the RIMS, are relayed to the CPF, facilitating the prompt issuance of alarms or corrective actions whenever discrepancies are identified. Should a failure—specifically, NOF corruption—arise within the dissemination chain (in cases where the chain does not broadcast the information as instructed by the CPF), it is possible that, even if the CPF detects the anomaly and generates alarms, these messages might not be transmitted due to the compromised dissemination chain. The integrity check function is designed to address this scenario.

Compliance of the Fully Space-Based SBAS Concept with Safety Requirements

At the system level, from a safety perspective, the high-level architectural proposal is summarized in Figure 9. 

At the system level, the architecture preserves the logic of maintaining two independent channels—extending from data collection through correction computations and integrity checks. This dual-channel strategy ensures adherence to the SPOF principle at the highest level. Specifically, LFS-A is dedicated to feeding the PS, whereas LFS-B supplies the CS. The strict separation between LFS-A and LFS-B guarantees the independence of input data for each critical process. 

The correction PS, sourced from LFS-A, is entrusted with generating corrections and the associated integrity bounds. In parallel, the CS leverages independently sourced measurements from LFS-B to validate the corrections and their integrity parameters. This rigorous, independent, dual-channel design ensures a single fault or failure cannot compromise overall system integrity.

For data collection, several considerations stem from safety recommendations. Positioning GNSS data collection stations is critical for the calculations performed by the SBAS processing system. Leveraging mobile GNSS data collection stations introduces the necessity to strictly ensure the accuracy of their geospatial coordinates. To safeguard against error or bias propagation, the positioning solution for LFS stations should be established using means and data independent from those employed by the SBAS system itself. This mitigates the risk that systematic biases or errors could be inadvertently transmitted into the final positions computed by the SBAS. Solution 3 (“LFS orbits are calculated using independent means and independent measurements”) directly fulfills this requirement for independence. In addition, leveraging ISL connectivity with ranging capabilities further increases and consolidates the accuracy of LFS location estimates.

Deploying two distinct fleets—LFS-A and LFS-B—allows separation between correction computation and integrity verification channels. With their positioning, LFS-A and LFS-B will achieve substantially different observation geometries; the system hence ensures data streams used for corrections and integrity bound computations and those for integrity checks remain independent, enhancing the robustness of integrity check.

Analogously to the RIMS DAL C allocation within “terrestrial” SBAS systems—attributed for their respective contributions to continuity—the data collection function is designated a DAL C1.

With respect to data processing and integrity verification, the principle underpinning this architecture is to preserve complete independence between the PS and the CS, upholding the SPOF criterion. To this end, the PS and CS are provisioned with independent inputs from LFS-A and LFS-B respectively, each implementing diversified algorithms purposed to detect and mitigate feared events, initiate appropriate alarms when required, and compute/verify corrections and associated integrity bounds.

Drawing upon a safety monitoring principle [22] that’s applied within operational EGNOS V2, the PS is allocated DAL C1, whereas the CS receives a DAL B1 allocation. These designations impose considerable constraints on software development for the LEO satellite segment.

Both the PS and the CS are proposed under the paradigm of a “fully distributed space-based solution,” whereby the PS function (and likewise the CS function) is performed by an “active sub-pool” of LFS-A (and, correspondingly, of LFS-B). Owing to the permanent communication links established among all LFS units, any failure occurring within one of the active sub-pool LFS nodes is instantaneously propagated. This enables the swift activation and integration of a replacement LFS into the active sub-pool for a given PS/CS sub-function. Thanks to the scale of the constellation, the computational resources available to each LFS unit, and—critically—the capability afforded by the ISL that ensures all LFS nodes maintain an identical level of information, the system can exploit “hot redundancy” among LFS nodes for PS and CS sub-function. This design enhances the overall availability and continuity of the global system.

The concept’s reliance on transmitting a singular, uniquely defined NOF stream simplifies redundancy management across both user receivers and within the system’s own infrastructure.

It is noteworthy that the alternative logic of a “centralized space-based solution” is not inherently prohibitive from a safety perspective. While such an approach does introduce a central point of failure from a RAMS standpoint, this vulnerability can be mitigated by implementing robust redundancy architectures or, if needed, diversified processing chains. Such design adaptations could render the centralized solution sufficiently resilient, thereby restricting its adverse impact on system availability and continuity.

The dissemination of the NOF concept entrusts the LFS with dissemination responsibilities, diverging from the conventional reliance on GEO satellites typical of SBAS. 

Broadly, a failure within the dissemination chain may precipitate:

• A continuity event, triggered by loss of functional capability;

• An integrity event, arising from corruption of the NOF by the LFS.

In the first scenario, loss of a single LFS impacts availability and continuity, but these consequences are geographically constrained and limited to a small subset of users (in marked contrast to the loss of a GEO satellite), rendering such events generally acceptable.

Conversely, in the event of NOF corruption by an LFS, a potentially significant integrity event may ensue. Owing to the density of the LEO constellation, comprehensive real-time monitoring of all NOF transmissions from all LFS assets is unfeasible for the SBAS system. As a consequence, a single undetected failure could compromise system integrity. The safety concept herein articulated recommends users monitor at least two independent LFS sources and cease using the service if discrepancies are detected between the NOF received from these sources.

This mitigation is not considered fully satisfactory from a safety standpoint. First, it does not necessarily protect against all types of dissemination failures, such as systematic software faults affecting LFS-A, which could lead to correlated failures across seemingly independent units. Secondly, it places the burden of integrity monitoring on the user, exposing a fundamental limitation in the system’s intrinsic ability to autonomously detect and respond to dissemination failures—which is not optimal from a safety perspective.

Option-2 offers a different approach, whereby the NOF broadcast from LFS-A is subject to independent monitoring by a separate LFS-B asset, typically operating at a lower orbital altitude. In this arrangement, LFS-B would possess the authority to inhibit or terminate transmissions from LFS-A if an inconsistency or corruption in the NOF is detected. This monitoring of the LFS-A by the LFS-B would be DAL B allocated. 

Additional Safety Considerations and Way Forward

These safety considerations do not identify any fundamental showstoppers to the global SBAS concept using a fully space-based infrastructure. This concept eliminates de facto classic local ground effects such as multipath, interference, tropospheric delays, and tidal effects, improving performance. Nevertheless, several broader points must be explored: 

Applicable SBAS Regulatory Framework 

The safety reference framework and associated requirements considered are currently in force for SBAS within Europe. One major consequence of this regulatory baseline is the requirement for dual, fully independent “A” and “B” chains—most notably, the need for PS and CS functions to be separated and developed respectively to DAL C and DAL B. In particular, the imposition of DAL B on software development for LEO satellites may result in very significant development costs.

The SPOF principle for critical/hazardous events, as inherited mainly from ECSS, appears to be more stringent than those applied in the aeronautical domain. A review of [21] reveals:

• No explicit “no SPOF” criterion for hazardous failure conditions;

• No requirement that no combination of two independent system failures or operator errors should lead to catastrophic consequences (required by the ECSS). 

Notably, aeronautical standards demand the absence of SPOF only in the case of catastrophic consequences. In Europe for a SBAS, the requirement for no SPOF in critical/hazardous systems may be justified by the large number of aircraft potentially affected by any failure—a rationale that arguably holds even greater weight for a global system of this nature.

Applying the SPOF principle at the critical/hazardous level mandates the implementation of two independent chains for the CS and PS. It would be relevant to analyse this architecture and corresponding DAL allocation in light of the [24] guidelines (which are not part of the European baseline for SBAS). According to [24], if a hazardous failure condition could result from a combination of possible development errors between two items, either one should be allocated at least DAL B, or both should be assigned DAL C. This latter approach could offer a more balanced allocation of development assurance levels and potentially alleviate some of the stringent constraints currently imposed on LEO satellite software development. 

With regard to implementing the approach outlined in [24], the current concept involves exchanges between the PS and CS chains. In particular, the function responsible for generating corrections and integrity bounds is not fully duplicated across both PS and CS chains. Should the current level of independence between PS and CS be insufficient to comply with the principles set forth in [24], minor modifications to the concept could be considered. For instance, the PS functions could be integrated within the LFS-B, with dissemination of information also performed by the LFS-B (as in Option 2). In this case, two NOFs would be distributed, and a voting mechanism at the user level would help identify an erroneous NOF. However, this scenario would lack monitoring of the NOF broadcasted by the LFS-B to the user.

Identification of New Feared Events Arising from Spatialization 

Introducing “fully based” elements—specifically the implementation of ISL, using the DORIS system, and the spatialization of equipment that is traditionally ground-based in an SBAS—should lead to identifying new internal feared events to address in the system-level analysis.

Global System Considerations

The core strength, innovation and advantage of this concept lie in its potential to provide truly global coverage for integrity services. The positive implications of such an advancement would be substantial, but it’s necessary to address questions regarding responsibilities and roles among different countries, particularly given the safety-critical nature of the service on a worldwide scale.

Conclusions 

This article explores a groundbreaking shift in SBAS architecture by proposing the spatialization of its core components—data collection, augmentation message computation and dissemination—within a distributed network of LEO satellites. By moving reference stations into orbit as LFS, the system achieves global GNSS visibility, eliminates the constraints imposed by terrestrial station distribution, offers a worldwide service, and significantly enhances the accuracy and resilience of navigation augmentation data.

The architecture leverages advanced technologies like inter-satellite links and space-based distributed computing, enabling real-time data sharing, independent time scale generation, and robust integrity monitoring. The proposed partitioning of the constellation further meets stringent safety-of-life requirements, ensuring redundancy, diversity of observations, and fail-safe operations.

Simulation results demonstrate that appropriately sized LEO constellations can guarantee continuous visibility and redundancy for service availability, while the distributed processing facility uses state-of-the-art parallel algorithms to minimize communication overhead and maximize computational efficiency. While the technical feasibility is affirmed, the design must also accommodate the unique constraints of space infrastructure—including hardware resilience, energy consumption and operational safety.

Overall, this study shows that a globalized, space-based SBAS could offer transformative improvements in augmentation accuracy, reliability and scalability—paving the way for a next-generation system capable of meeting the demanding needs of civil aviation navigation on a truly worldwide scale. Future work will focus on refining the constellation design, optimizing system safety, and addressing the operational and certification challenges inherent to spaceborne navigation augmentation. 

Acknowledgment 

The authors thank Michel Monnerat for discussions regarding receiver signal processing and Celine Renazé for her useful advice and recommendations. 

References

[1] ICAO Standard and Recommended Practices (SARPs), Annex 10, Volume 1, up to Amendment 93

[2] D. Flament, J. Poumailloux, J-L. Damidaux, S. Lannelongue, J. Ventura-Traveset, P. Michel, C. Montefusco, “The EGNOS System Architecture Explained”, May 2011.

[3] User Guide for EGNOS application developers, Ed. 2.0, 15/12/2011, ISBN 978-92-79-20335-0 ESA.

[4] M. Laurenti, L. Maisonobe, P. Roldan, J. Anton, P. Guerin, S. Trilles, “Improving GNSS Navigation Messages Performance using Inter Satellite Links Technology”. Inside GNSS May/June 2024, pp 36-42

[5] Brown, K. R. (1992). The Theory of the GPS Composite Clocks, Proceedings of ION GPS-91, 11-13 September 1991, pp. 223-242.

[6] Greenhall, C. A. (2007). A Kalman filter clock ensemble algorithm that admits measurement noise: corrections and update, Metrologia, 44, 491-494, doi:10.1088/0026-1394/44/6/008

[7] Senior, K. L., & Coleman, M. J. (2017), The Next Generation GPS Time, NAVIGATION: Journal of The Institute of Navigation

[8] Roldan, P., Trilles, S., Serena, X., Tajdine, A., “Novel Composite Clock Algorithm for the Generation of Galileo Robust Timescale,” Proceedings of ION GNSS 2022, September 2022, pp. 2790-2799. https://doi.org/10.33012/2022.18521

[9] C. Renazé, C. Bourga, M. Clergeaud, J. Samson, “Reduction of system time to alert on SBAS”.  Inside GNSS, November-December 2023, pp 28-36

[10] https://ascend-horizon.eu/

[11] https://www.thalesaleniaspace.com/en/press-releases/thales-alenia-space-reveals-results-ascend-feasibility-study-space-data-centers-0

[12] G. Hager and G. Wellein, “Introduction to High Performance Computing for Scientists and Engineers”, CRC Press, 2011.

[13] P. Pacheco and M. Malensek, “An Introduction to Parallel Programming”, 2nd Edition, Morgan Kaufmann, 2021.

[14] J. Demmel, L. Grigori, M. F. Hoemmen, and J. Langou, “Communication-optimal parallel and sequential QR and LU factorizations”, SIAM Journal on Scientific Computing, Vol. 34, 1, pp. A206-A239, 2012, https://doi.org/10.1137/080731992

[15] Å. Björck, “Numerical Methods for Least Squares Problems”, 2nd Edition, SIAM, 2024.

[16] G. H. Golub and C. F. Van Loan, “Matrix Computations”, 4th Edition, Johns Hopkins University Press, 2013.

[17] M. F. Hoemmen, “Communication-avoiding Krylov subspace methods”, PhD thesis, University of California at Berkeley, 2010.

[18] E. Agullo, C. Coti, J. Dongarra, T. Hérault and J. Langou, “QR factorization of tall and skinny matrices in a grid computing environment,” 2010 IEEE International Symposium on Parallel & Distributed Processing (IPDPS), Atlanta, GA, USA, 2010, pp. 1-11,  https://doi.org/10.1109/IPDPS.2010.5470475.

[19] G. Ballard, J. Demmel, L. Grigori, M. Jacquelin, N. Knight, H.D. Nguyen, “Reconstructing Householder vectors from Tall-Skinny QR”, Journal of Parallel and Distributed Computing, Volume 85, pp. 3-31, 2015. https://doi.org/10.1016/j.jpdc.2015.06.003.

[20] J. Dongarra, L. Grigori and N. Higham, “Numerical algorithms for high-performance computational science”, Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences, 378(21666), 2020. https://doi.org/10.1098/rsta.2019.0066

[21] CS-25 – European Union Aviation Safety Agency Certification Specification for Large Aeroplanes.

[22] ED-12B/DO-178B – Software Considerations in Airborne Systems and Equipment Certification

[23] ED-109A/DO-278A Software Integrity Assurance Considerations for Communication, Navigation, Surveillance and Air Traffic Management (CNS/ATM) Systems

[24] ARP4754B – Guidelines for Development of Civil Aircraft and Systems

Authors

Sébastien Trilles is an expert in navigation algorithms and performances. He received his Ph.D. degree in Pure Mathematics from the Paul Sabatier University and an Advanced M.S.in Space Technology from ISAE-SUPAERO. He heads the Performance and Processing Department where high precise navigation algorithms are designed as orbitography, system reference time generation, clock synchronization and time transfer, integrity and ionosphere modeling.

Thierry Authié is a specialist in navigation algorithms at the Performance and Processing Department of Navigation Domain, Thales Alenia Space. He received his M.S in Applied Mathematics from the Institut National des Sciences Appliquées (INSA), Toulouse (France). He currently works as navigation specialist in Advanced Projects.

Xavier Vasseur is a specialist in scientific computing at the Performance and Processing Department of Navigation Domain, Thales Alenia Space. He received his M.Sc degree from Ecole Centrale de Nantes (France) and his Ph. D. degree in Computational Fluid Dynamics from University of Nantes.

Marie Abbal is safety manager of Advanced Projects in Navigation Domain. She received her M.Sc degree from Ecole des Mines de Paris. She worked from 2009 to 2016 at Electricité de France company (EDF), particularly in nuclear safety. She joined Thales Alenia Space in 2016 as a safety specialist in complex and critical space system

The post The Case for Spatializing Global SBAS appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

The system is embedded across critical civilian infrastructure as well, with approximately 90 percent of U.S. 911 call centers relying on Safran timing technology. On the defense side, the SecureSync supports applications ranging from GPS-disciplined synchronization in standard infrastructure to M-Code enabled timing for military operations requiring the highest levels of security and integrity — including the Sentinel A4 radar program, where M-Code SecureSync units were integrated to strengthen resilient PNT performance against jamming and spoofing threats. 

“Timing has been foundational to who we are since day one, and this milestone is a testament to the trust our customers have placed in SecureSync for nearly two decades,” said Trevor Dougherty, Vice President of Sales and Marketing at Safran Federal Systems. “In an environment where a fraction of a second can mean the difference between success and failure, we don’t just deliver precise time — we make it resilient.”

The announcement comes alongside continued development of next-generation timing capabilities. In April, Infleqtion announced availability of the first quantum-enabled precision timing solution developed in partnership with Safran Electronics and Defense, integrating Infleqtion’s Tiqker quantum optical clock with Safran’s White Rabbit and SecureSync systems. White Rabbit technology enables picosecond-level time distribution — approximately a thousand times more precise than nanosecond-class timing — positioning the SecureSync platform for the next tier of defense and infrastructure timing requirements as GPS-dependent architectures come under increasing pressure. 

The post Safran Federal Systems Delivers 50,000th SecureSync Timing System appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

The release enables integration of Iridium Satellite Time and Location signals directly into VectorNav’s INS architecture alongside inertial and GNSS data. In testing, STL-aided navigation demonstrated positioning performance within approximately 50 meters CEP in GNSS-denied conditions while maintaining continuous inertial position, velocity, and attitude outputs. The Iridium constellation’s 66 active satellites operate at roughly 780 kilometers — compared to approximately 20,000 kilometers for GPS — producing surface signals up to 1,000 times stronger than GPS, improving resistance to jamming, attenuation, and environmental obstruction.

The VN-210E provides four independent serial interfaces and a tightly coupled extended Kalman filter, allowing LEO-derived measurements to be incorporated alongside GNSS, M-Code, vision-based navigation, and other assured PNT inputs. The development kit includes the VN-210E, NAL Technologies’ ALTM Micro-D receiver, a one-year Iridium development license, and reference integration guidance and software tools.

“Inertial remains the foundation,” said Andrew Greer, Senior Director of Business Development at VectorNav. “LEO signals add another layer of resilience. By fusing multiple independent sources, we maintain a stable navigation solution when any single input is degraded or denied.”

Future development will focus on deeper hardware integration, reduced SWaP-C, and streamlined deployment for production programs.

The post VectorNav Adds Iridium STL Aiding to Inertial Navigation Systems in Collaboration with NAL Technologies appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

At the PNT Leadership Summit last September, Locata CEO Nunzio Gambale put a blunt question on the screen again and again: “What’s your replacement?”

He asked it over ports, offshore energy projects, precision agriculture systems and critical infrastructure sites operating in what his presentation called “red zones”—places where GNSS-dependent systems may fail, degrade or become unreliable because of jamming, spoofing or other forms of interference. Across those examples, the warning was the same: high-value civilian systems have been built around precision positioning, navigation and timing, but many still have no credible replacement when the signals they depend on are denied.

That argument has become progressively more difficult to dismiss.

Only months earlier, Gambale said, Ukraine’s June 1, 2025, Operation Spider Web demonstrated how low-cost, precisely coordinated stealth drone attacks could reach strategic targets far beyond the front lines. Ukraine said it used 117 drones, and the Council on Foreign Relations described the attack as evidence that low-cost precision strikes are becoming accessible to many state and non-state actors.

For Gambale, Operation Spider Web has forever changed the strategic logic of PNT. If the now ubiquitous drones can use satellite navigation to reach strategic assets, governments and operators defending those assets will have to increasingly jam, spoof or otherwise deny the signals those drones rely on. The result is a new kind of collateral damage: Civilian systems that depend on the same signals may be disrupted by the defensive measures intended to protect national infrastructure.

That was the September argument.

Since then, the jamming and spoofing environment has become more urgent, particularly around the Persian Gulf and the Strait of Hormuz. Meanwhile, in the Baltic area, Russian electronic warfare is already turning that risk into a live political and operational crisis. In May, Ukrainian officials said Russian electronic warfare had deliberately diverted Ukrainian drones into Latvian airspace, with repeated incursions culminating in explosions at an oil storage facility and contributing to the collapse of Latvia’s government. Inside GNSS+ reported that widespread GNSS interference in the Gulf and Strait of Hormuz region coincided with sharp disruption in commercial shipping, with maritime analytics providers documenting more than 1,100 vessels affected by GPS and AIS interference in a 24-hour period, including ships falsely positioned at airports, a nuclear power plant and on Iranian land.

That escalation makes Gambale’s question feel less like a conference provocation and more like an operational imperative.

The resulting challenge is more difficult than simply asking for a backup to GPS. For Gambale, that phrase is too vague to be useful. The real question is application-specific. 

“This isn’t simply about backing up GPS,” Gambale said. “The point of PNT is the outcome: What the application requires, and what can still deliver it when GPS is degraded, denied or no longer trusted.”

That is the core of his argument. The world did not adopt GNSS merely as a convenience; it built entire classes of infrastructure, automation and digital systems on top of it. Now the same signal dependency that enabled enormous economic value has also become a systemic vulnerability.

The Civilian Problem Has Changed 

For decades, GNSS interference was often framed as a military concern. Jamming and spoofing belonged to battlefields, contested borders and electronic warfare scenarios. Gambale believes that framing is “no longer even close to the reality.”

The drone era has changed the logic. If hostile drones use GNSS to navigate, then defending critical infrastructure absolutely demands the denial of that same signal locally. In other words, the jamming will not come only from the adversary; it will inevitably also come from the government or operator trying to protect its own critical assets.

“What’s the first thing you need to do for anti-drone systems?” Gambale said. “You need to jam the GPS, so that the enemy can’t use the same signal that you’re using. I can tell you categorically that in, say, the UAE, it’s not the U.S. or Israel or Iran that’s jamming Dubai or Abu Dhabi. It’s the UAE itself. We’ve heard credible reports that a GNSS jammer is now installed at the top of the Burj Khalifa. Think about that. It’s called ‘frequency fratricide’… and the Golden Dome, Drone Walls and many other national protection systems you see being built are now undeniable proof that ‘jam yourselves’ is the future.”

That creates what he sees as the new civilian crisis: The same denial zone meant to protect national strategic sites will inevitably disable the civilian systems built around satellite PNT.

“If you want to deny this magical capability to your enemy, you have to deny it to the areas around your critical infrastructure,” Gambale said. “However, you then jam the surveyors, you jam the harbor pilots bringing ships into port, you jam all of the autonomous systems, you jam the mobile phone technologies, you jam the timing for data centers, you jam the landing systems for aircraft. Uber Eats. Waymo. Google Maps.”

That argument is not merely a Locata argument. Gambale cites Doug Taggart, president of Overlook Systems Technologies and an ION Fellow, in the Spring 2026 ION Newsletter. Taggart argued that GPS now underpins transportation safety, economic activity, communication networks, precision agriculture and critical infrastructure, while the United States has spent more than 25 years struggling to identify a backup. Taggart’s conclusion was that resilient PNT capability should be understood as an inherently governmental responsibility, whether the physical systems are government-operated or commercially provided.

That framing shifts the debate from product or solution selection to public responsibility. The issue is not whether GPS remains essential. It does. The issue is whether critical systems can continue operating when GPS is unavailable, untrusted or locally denied.

The Port Test: What Happens When Precision Stops?

Gambale’s most concrete example, from Locata’s own experience in the jamming zones, is port automation. In his summit presentation, he used the Port of Gdańsk and major Baltic infrastructure projects to illustrate the new PNT reality. The point was not simply that ports use GNSS. It was that modern automation systems, such as in ports, logistics hubs, etc., all depend on very precise positioning—continuously and reliably.

The presentation described a $3 billion Port of Gdańsk expansion, with automation as a key part of Polish port infrastructure. It also described fully autonomous rubber-tired gantries—25 ordered, 26 meters high by 30 meters wide, $20 million each, using three RTK GNSS systems for autosteer and placement—with a requirement of less than 2 centimeters, 3 sigma, 24/7/365, without fail.

Large autonomous gantries and other automated systems do not need “some” positioning. They must have centimeter-level positioning, all day, every day. If the position solution degrades, the machine does not simply become less efficient. It stops dead.

“These machines are automated, and they’re stacking containers on top of one another autonomously, without any human in the loop,” Gambale said. “They must have two- to five-centimeter positioning, or else the entire system doesn’t work. This is not some academic argument. When an infrastructure site like Gdansk is jammed, the company literally owns $500 million dollars’ worth of ‘bricks.’ The company’s need for centimeter-level GNSS is dire. Jamming can cost millions per day. And that is a clear and existential threat to a business’ existence.”

He framed the problem in operational terms. A lower-accuracy backup may sound useful on a policy slide, but if it cannot support the application’s required precision, it does not solve the problem.

“If a ‘solution’ blows out past five centimeters, the machines must stop,” he said. “Something that gives you 2 meters of ‘GPS backup’ is of absolutely no use to that type of application.”

That distinction is central to his argument. The market does not need a generic conversation about backup. It needs a performance conversation: what accuracy, what timing, what integrity, what availability, what resilience under interference, and what happens when the system is spoofed?

If the answer does not meet the application requirements, then the infrastructure remains exposed, critically compromised and vulnerable.

Precision as Infrastructure

Gambale extends the same argument to offshore construction, surveying, logistics and warehousing sites, and precision agriculture. In each case, PNT is not a convenience layered onto the application. It is part of the operating system.

Gambale pointed out that view is strongly supported by ESA’s March 2024 NAVAC PNT Vision 2035 White Paper, produced under the guidance of NAVAC Chaiman, Luis Mayo. According to the report, more than 6.5 billion GNSS devices were already installed worldwide by 2021, with the installed base expected to grow to 10.6 billion by 2031. Also, according to the report, roughly 10% of EU GDP relies on GNSS to some degree, while consumer, IoT and automotive applications represent more than 90% of the market.

But the report’s most important point for Gambale’s thesis is not market size. It is dependency. NAVAC warns that as GNSS use spread across application domains, society built an increasingly deep dependence on these systems. The report identifies jamming, spoofing and interference as growing concerns, and specifically notes that accurate timing is the main critical use case for critical infrastructure.

That supports Gambale’s point: PNT is no longer a navigation feature. It is a dependency layer underneath automation, logistics, energy, telecom, finance, data centers, transportation and every nation’s digital economy and critical infrastructure.

The performance requirements for modern and emerging applications are also not abstract. Gambale points out that NAVAC’s 2035 requirements table points to centimeter-class horizontal and vertical accuracy requirements for many high-value applications: 2 to 15 cm for precision irrigation and cultivation, 4 to 6 cm for kinematic survey, and 10 cm for Level 3-and-above road autonomy and collision avoidance. For timing-dependent applications such as the coming 6G and DVB networks, the requirement moves from position into time, with NAVAC citing the need for 10-ns timing accuracy.

A backup that preserves rough continuity may be valuable for some applications. But it is not enough for a port that needs centimeters, a precision agriculture workflow that depends on corrected guidance, or a timing network that needs nanosecond-level synchronization.

In his PNT Leadership Summit presentation, Gambale cites Baltic offshore wind construction and a $5.1 billion Baltic Power project that is essential for Poland’s energy security and independence, including 76 Vestas 15 MW turbines. He also frames offshore construction requirements in hard operational terms: precision construction needs less than 5 centimeters at 3 sigma, 24/7/365, without fail; and ship dynamic position systems (which automatically maintains a vessel’s exact position and heading using its own propellers and thrusters) needs less than 10 centimeters at 3 sigma to work.

In agriculture, Gambale points out, interference does not need to jam an entire operating area to cause disruption. If today’s essential correction infrastructure is vulnerable, the precision layer then collapses.

“In the Ukraine, it’s now become even more trivial to jam a huge area of farmland,” he said. “You don’t have to try to jam the whole area. You just jam the local reference station, and that whole area is toast.”

That observation turns PNT into a food security issue, not simply a navigation issue. A tractor autosteer system, a surveyor, a road construction company, a port crane, an offshore construction vessel and a data center may appear to occupy different markets, but they all share the same dependency: high-confidence position and time.

Gambale’s message is that resilience must be judged against the actual application, not against a generic idea of signal continuity.

Do Not Deploy Your Grandfather’s GPS Backup

One of the strongest lines in Gambale’s presentation was: “Do not deploy your grandfather’s GPS backup.”

It is an intentionally provocative phrase, but the point is technical. Many valuable present-day applications—and most future applications—need high accuracy, high confidence and trusted timing. Systems that provide only low-accuracy continuity do have value for some uses, but they will not keep a modern autonomous port or logistics site, precision agriculture workflow, road construction site or high-value industrial operation running.

ESA’s NAVAC report reaches a similar conclusion from a different angle. It says future PNT will be delivered through a combination of alternative, independent and complementary sources: multiple GNSS in different orbits and frequencies, cellular networks, terrestrial systems such as eLoran, Wi-Fi and signals of opportunity, augmentation systems, inertial sensors, quantum sensors, magnetic sensors, miniature atomic clocks and digital maps. It also concludes that future systems will increasingly operate as “systems of systems” designed to meet the performance required for a given application.

That is very close to Gambale’s “what does your application need?” mantra. A technology is not useful because it belongs to a fashionable category. It is useful if it meets the required accuracy, timing, integrity and resilience for the mission.

And those requirements are getting more difficult, not easier.

NAVAC states that “accuracy is addictive,” that users will demand more robust solutions less susceptible to natural or man-made disruption, and that assured PNT demand will grow tenfold by 2035, including in physically challenging environments such as indoors, multi-story buildings, urban canyons and underground facilities.

That is why Gambale’s critique of low-performance complementary PNT is so sharp. “There is no point deploying technology that gets you three quarters of the way there, and the port is still stopped,” he said.

Positioning Depends on Timing

For Gambale, timing is the most underappreciated part of the PNT discussion. “PNT only exists because of the T,” he said.

That statement is more than a slogan. Positioning systems depend on timing. Digital infrastructure depends on timing. Telecom, financial systems, data centers, power grids, autonomous systems and distributed industrial operations all require trusted time at levels appropriate to their applications.

Taggart makes the same point in institutional terms. His ION Newsletter column notes that, through NIST, the Department of Commerce maintains the nation’s time and frequency standards, while NIST and the U.S. Naval Observatory provide official U.S. precise-time contributions to the Bureau International des Poids et Mesures, which calculates Coordinated Universal Time. He also notes that financial markets, telecommunications services, data networks, electric power grids, pipelines and SCADA services all depend on timing derived from GPS.

For Gambale, that dependency should drive a different standard of performance. He argues the industry too often talks about timing in terms of minimum standards rather than future capability.

“The world isn’t asking for worse timing,” he said. “As you get better and better timing, you get better and better positioning, and better and better digital capabilities. That’s why our Locata team has dedicated several decades of innovation to be able to deliver GNSS-free, sub-nanosecond synchronization and time transfer.”

He explains the issue in terms engineers understand: error budgets. Every system has a set of error sources—timing error, multipath, atmospheric effects, electronic variation, geometry, signal processing limits and more. If timing consumes too much of the error budget, there is less margin left for everything else.

“If the bucket is 75% full of timing error, that leaves them a lot less margin to play with,” Gambale said. “However, if we can reduce that timing error budget down to 10% of the bucket, then they’ve got a lot more leeway with the rest of the error budget.”

That is why he sees timing as a foundation, not a feature. Better timing does not merely improve clocks. It improves the ability to position, synchronize, automate and trust distributed systems.

NAVAC also emphasizes timing. The report states that accurate timing is the critical use case for communications and power distribution networks, and it identifies distributed and networked time-scale infrastructures as an important path toward resilient timing applications independent from GNSS.

Multipath, Trust and the Devil in the Real World

Gambale is equally forceful about multipath, explaining why Locata has spent years creating new technology to mitigate this obstacle. In terrestrial and obstructed environments, reflected signals can become one of the dominant sources of error. It is not enough to say a transmitter is nearby or a signal is stronger. The system must manage reflections, geometry and line-of-sight integrity.

“Multipath is the devil,” he said. “It is everywhere, and unless you deal with it, you will never be able to give an accurate position that’s reliable.”

This is where the conversation then turns from availability to trust.

Jamming denies. Spoofing deceives. Multipath corrupts. Each poses a different challenge. A receiver that produces an answer is not necessarily producing a trustworthy answer. In heavily automated systems, that distinction can become dangerous.

Gambale argues that users have become conditioned to trust the box. The receiver gives a position, and the system accepts it. That worked in an era when GNSS was generally available and interference was occasional. It becomes much more fragile in an environment of persistent jamming and spoofing.

“It’s all about trust,” Gambale said. “Even if GPS comes back, many huge companies no longer want to depend on it, because it is no longer trustworthy.”

That may be the most important transition in the PNT debate. Availability asks whether the signal exists. Trust asks whether the system should act on it.

From AIR to Sovereignty

In the summit presentation, Gambale framed the future of complementary PNT around three validated attributes: Accuracy, Integrity and Resilience—AIR.

Accuracy means the system can meet the application’s actual performance requirement. Integrity means the user can trust the answer, especially in safety-of-life or mission-critical applications. Resilience means the system continues to function—or recovers predictably—under real-world stress. Gambale stated: “Without AIR your application will die!”

Gambale has since added a fourth concept: sovereignty.

For him, sovereignty does not only mean national ownership in a political sense. It means control. Control over the PNT layer that critical systems depend on. Control over the ability to deploy, operate and trust the infrastructure required for the mission. Control over the destiny of an organization, business or site.

Gambale returns repeatedly to the idea that nations and critical infrastructure operators must stop thinking of PNT as an invisible utility that simply arrives from somewhere else. They must treat it as critical infrastructure. Lifeblood for their business.

“Electricity is wonderful,” he said. “It is distributed everywhere. But show me one critical infrastructure site that doesn’t have backup batteries or a generator.”

The analogy is simple and powerful. Critical sites rely on the grid, but they do not trust the grid alone. They build backup capability because the consequences of failure are too severe. Gambale believes PNT now requires the same mindset.

The Spectrum Sandbox

His policy prescription is equally direct: create a terrestrial PNT spectrum framework.

“The best thing that America can do to push real PNT resilience forward is to allocate a terrestrial spectrum for the job,” he said. “Give it a slice of spectrum that everybody can play in, if they wish.”

For Gambale, this would create a sandbox for innovation. Satellite systems have protected spectrum. Terrestrial PNT, if it is to become a serious resilience layer, needs a comparable policy foundation. Within that framework, industry, universities and government could build and test systems designed for specific application requirements.

“Allocate spectrum just like the satellites have got spectrum,” he said. “Allocate a terrestrial capability where you can determine what’s required for each application in an area. But give us the sandbox. Then let 1,000 innovations bloom, as was the case in the early days of GPS.”

That argument moves the discussion beyond individual products. It treats PNT resilience as an ecosystem problem. If the United States—or any sovereign nation—wants local, high-confidence PNT capability, then the nation must create the conditions for such systems to exist.

It also fits the broader direction of PNT architecture. NAVAC’s 2035 vision does not imagine one replacement for GNSS. It imagines combinations of systems: space-based, terrestrial, cellular, augmentation-based and sensor-based. It also warns that alternative systems must avoid hidden dependencies on GNSS itself, such as using GNSS as the time reference for supposedly independent ground networks, or as an essential reinitialization of an IMU system.

That warning is central to the Gambale thesis. A backup that depends on the system it is backing up is not a true replacement. A resilience layer that fails under the same conditions as GNSS may add complexity without adding survivability.

Gambale sees the spectrum sandbox as a chance not merely to protect infrastructure, but to create the next exportable PNT architecture.

“If America does it first, and you have all of your bright minds, and the universities, Silicon Valley, and everyone throws some real effort at it, you can do exactly what you do with GPS,” he said. “You can export it all over the world again.”

Then came the line he delivered with a laugh, but not entirely as a joke:

“Make PNT great again.”

The phrase works because the argument underneath it is serious. GPS was one of the United States’ greatest contributions to the modern world. It enabled entire industries. It created enormous civilian and commercial value. But the dependence it enabled has also become a 21st-century infrastructure vulnerability.

As Gambale put it: “The U.S. nation in the 1990s gave the world one of the greatest gifts of all time. That gift has now created one of the biggest problems for the 21st century. That problem must be solved. And Locata has created exceptional new high-accuracy technology that does not depend on GNSS at all. It delivers a level of control and sovereignty that will certainly be part of the ‘future of PNT.’”

For ports, farms, offshore energy projects, logistics hubs, construction sites, autonomous systems and critical infrastructure operators, the need for a solution—for AIR, for control and for sovereignty—is no longer theoretical. The jamming and spoofing environment is real and escalating. The performance requirements are not abstract. And the dependency on a signal that was never designed to carry this much weight is not going away on its own.

That is the state of play. 

The post The New PNT Reality appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

For decades, timing has been the least visible element of positioning, navigation and timing. Positioning and navigation tend to draw the operational attention. Timing sits deeper in the architecture, synchronizing networks, aligning systems and enabling the data flows modern missions require. But in contested environments, where GNSS signals can be jammed, spoofed or lost, timing is no longer a background utility. It becomes a measure of resilience.

That is the market Oscilloquartz is addressing. The company has more than 75 years of timing heritage and a long record in telecom synchronization, but its current strategy is aimed at a defense market that is beginning to treat trusted time as a core requirement for resilient PNT.

Gil Biran, who leads Oscilloquartz, describes the company’s position directly. “We are the timing enabler for any PNT mission-critical defense network,” he said. That statement reflects both technical confidence and strategic ambition. Oscilloquartz wants to be understood not simply as a supplier of clocks, but as a provider of timing architectures for defense users operating in degraded and contested environments, including mobile deployments.”

The shift builds on the company’s experience in mobile networks. When Biran took over the business after its acquisition from the Swatch Group, Oscilloquartz had lost ground in what had become one of the most demanding timing markets. The company refocused on systems rather than components and built an NTP and PTP portfolio around the synchronization needs of mobile operators. Oscilloquartz, Biran said, moved from roughly 20% share in mobile operators globally to about 80%.

That experience matters because telecom forced the company to solve timing as a network problem with accuracy that was measured in nanoseconds. Mobile operators needed synchronization at scale, across large distributed networks, with high availability, resiliency and standards-based performance. Defense users need many of the same fundamentals, but under more severe conditions.

FROM TELECOM SYNCHRONIZATION TO DEFENSE TIMING

“The foundational requirements for PNT are the same across mission-critical networks, whether it’s a mobile operator, power utility or defense organization,” Biran said. “Now, we have to focus on the differences.”

Those differences are significant. In telecom, timing equipment is generally installed in fixed sites. In defense, timing has to operate across ground, airborne, maritime and mobile applications. Systems may be mounted in vehicles, deployed in command centers, integrated into shelters, placed on platforms or connected to legacy infrastructure.

Biran identifies two immediate translation points from telecom to defense: physical interfaces and ruggedization. Defense networks retain large amounts of legacy infrastructure, and timing systems must connect to what is already fielded. “Defense is all about legacy,” he said. “It’s all about equipment that is sitting there for tens of years, and nobody’s going to touch.” To participate in those architectures, Oscilloquartz has had to support specialized physical interfaces that are uncommon in commercial telecom networks.

The second requirement is ruggedization. “In the telecom space everything is on the ground, everything is in a fixed location,” Biran said. “When you move to defense, you have ground applications, you have airborne applications, you have maritime applications, and now in most of these applications you are on the move.” That reality is behind the launch of the ruggedSync™ Series OSA 5510, which Biran describes as a rugged clock unit designed to bring Oscilloquartz’s timing capabilities into defense environments without rebuilding the entire product concept.

The deeper defense requirement is not only rugged hardware. It is trust.

For years, many timing architectures treated GNSS as the primary source and internal oscillators or network references as backups. Biran argues that this model no longer fits the threat environment. “The primary is GNSS,” he said. “Why set the least reliable source as the primary? That was good for the old days, not today.”

ZERO-TRUST TIMING IN A GNSS-DENIED WORLD

That observation leads directly to Oscilloquartz’s view of zero-trust timing. In practical terms, zero trust means no single timing source is accepted without evaluation. A defense node should be able to compare multiple timing inputs, assign different levels of confidence to each source depending on its reliability, detect anomalies and continue distributing trusted time. The issue is not whether GNSS remains useful. It does. The issue is whether the architecture depends on GNSS as an unquestioned authority.

“Every node in the network should have as many as possible sources, and the focus should be on diversified sources,” Biran said. In that model, GNSS may be one input, but it is not the only one. Other sources may include LEO-based timing, terrestrial RF sources, NIST references, PTP, White Rabbit and local atomic clocks. Biran compares the architecture to a recipe in which different sources receive different weights according to their reliability. Cesium, because it does not depend on an external signal, carries a different weight than a satellite signal that can be denied or manipulated.

This is where Oscilloquartz sees cesium and optical pumping as central to defense timing resilience. Holdover is often discussed as a clock specification, but in defense it is better understood as the last line of defense. If a system can maintain trusted time after GNSS is lost, it can continue operating. If it cannot, the network and the mission begin to degrade.

Biran points to submarines as a clear example. “Why do submarines need the cesium clock? Because if you’re underwater for two months, you will not know where you are unless you have a reliable, accurate clock source,” he said. The same principle extends beyond the undersea domain. As defense systems become more mobile and as GNSS denial becomes more common, the ability to maintain time without external reference becomes a strategic capability.

Oscilloquartz has invested in optical pumping technology for cesium clocks for much more than a decade, work Biran links to both performance and size. He said the company can hold 100 nanoseconds for up to 150 days, a figure he contrasts with rubidium-class holdover at far shorter durations. “Even if GNSS will disappear for six months, we can still maintain the mission critical network with this level of accuracy,” he said. He also makes clear that this is not only about duration. Airborne and mobile systems impose constraints on size, weight and stability under vibration. “You have lasers inside the box,” Biran said. “How do you make sure that the laser is stable enough when the unit is moving, is under vibration? This is not a simple challenge.”

The larger point is that defense organizations should not think about timing as a collection of individual devices. They need to think about time as a distributed system-level resource. A high-stability core clock is important, but it is not enough. Trusted time has to move across networks, reach edge nodes, be monitored, compared, managed and protected.

“Our solution is not just a box,” Biran said. “It’s a networking solution.” He points to White Rabbit technology as one path for distributing high-accuracy timing over fiber, and to management systems that allow operators to see and control timing across the network. In a contested environment, that visibility matters. Operators need to know which sources are available, which nodes are degraded, where timing quality is changing and when the system has shifted into holdover.

ASSURED TIME AS A NETWORK ARCHITECTURE

The company is also watching a broader shift toward distributed timescale solutions. Historically, national timing could be delivered from a small number of sites. That model becomes harder as users need tighter timing closer to the mission. “You need to bring the time scale source close to the customer,” Biran said. He sees defense organizations moving toward more localized time sources, including service-level or agency-level timescales that can support operational networks without depending entirely on distant infrastructure.

For Oscilloquartz, the technical strategy is now being matched by a go-to-market shift. Biran is direct about the distinction: selling into defense is not the same as selling into telecom. The company has added sales talent with defense-sector experience, expanded its U.S. channel through representation firms focused on defense markets, and is building out value-added reseller relationships with defense expertise in EMEA and APAC. The customer path is different as well.

“We are not selling the full defense solution,” Biran said. “We are providing the timing that enables these vendors and system integrators to provide a full end-to-end defense solution.”

That distinction is important for the U.S. DoD market. Timing is rarely purchased in isolation. It is specified into systems, integrated into platforms and evaluated as part of larger mission 
architectures. Oscilloquartz’s near-term task is therefore as much educational as commercial. It must show defense users that the “T” in PNT is not a supporting detail. It is a foundation for network resilience, autonomy and operational continuity.

How will Oscilloquartz know it has succeeded? Biran points to revenue mix, defense leads, pipeline growth and program wins. The company, he said, has already won major defense projects, including in the United States, though he does not name them, due to the confidential nature of the business. The broader milestone will be market recognition: when Oscilloquartz is seen not only as a telecom synchronization company, but as a global defense timing provider.

For defense users, the underlying issue is clear. GNSS will remain essential, but it cannot be the only trusted source of time. The next phase of PNT will depend on architectures that can evaluate, preserve and distribute time even when the external environment is compromised. Oscilloquartz is betting that its telecom-scale experience, rugged timing portfolio, cesium technology and zero-trust approach position it for that shift.

In Biran’s words, “The baseline is to have the right solution.” In defense timing, that baseline is moving quickly from accurate clocks to assured and resilient time.

The post The “T” in Contested PNT appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

Electronic warfare is reshaping the PNT problem on today’s battlefield. Jamming, spoofing, meaconing and sustained RF pressure are now part of the operational reality that warfighters must plan for and operate through. The war in Ukraine has made that reality highly visible, with each new reported incident reinforcing the same point: the threat is no longer episodic or theoretical. It is an operational condition that is likely to persist and expand.

That reality has senior officials across the Department of War (DoW) urgently looking for practical solutions, with growing emphasis on getting advanced, modernized military GPS capabilities such as M-Code more widely fielded. The objective is not to abandon GPS. It is to strengthen it.

MODERN MILITARY GPS VS. LEGACY SYSTEMS 

Even in this new landscape, military GPS remains the most mature and protected source of precision, absolute PNT available to authorized users, said Luke Bishop, Product Line Director at BAE Systems. The right response is not to replace GPS, but to field modern military GPS, protect it, toughen it and augment it with additional sensors that can fill specific mission gaps.

“People are worried that GPS doesn’t work anymore and that we have to find an alternative,” BAE Ground Products Portfolio Director Zack Hamilton said. “The GPS capabilities they’ve enjoyed for the last 40 years is still what they want—absolute, precise PNT—they just want it to work all the time, even inside a threat environment.”

The lesson is not that GPS has lost its relevance. The lesson is that assured PNT must start with the most protected form of GPS available to the warfighter, then build outward through anti-jam, anti-spoof, integrity monitoring and mission-specific complementary sensors.

Some describe the current challenge as a GPS-denied problem, but that characterization can be too broad and too simplistic. “GPS denied” is not a requirement; it is a condition that must be defined. What kind of jamming? What level of spoofing? What platform? What altitude? What mission duration? What SWaP-C limit? What level of integrity is required? Without that specificity, platforms risk treating very different PNT problems as though they are the same.

It is also important to remember that GPS user equipment is not created equal. Many publicly discussed examples of GPS failure in contested environments involve unaided commercial GPS, legacy systems or insufficiently hardened architectures—not modern military GPS protected by M-Code, anti-jam/anti-spoof capability and complementary sensors. Many civil solutions used in contested environments do not provide the same level of protection, authentication or threat-informed hardening as modern military GPS.

The same distinction applies inside the military GPS community. Legacy Selective Availability Anti-Spoofing Module (SAASM) equipment is not the same as modern M-Code systems with advanced anti-jam and anti-spoof protection and increased cyber resilience.

“It’s important to understand a lot of the platforms and systems out there today have yet to be upgraded to M-Code or the most cutting-edge anti-jam technology,” Bishop said. “People see some of these performance challenges out in the field and they draw incorrect conclusions and therefore assume these challenges apply to all user equipment configurations.”

For years, BAE Systems has built hardened military GPS solutions with M-Code as the primary PNT source, supplementing that core capability with what Bishop described as “world class anti-jam and anti-spoof.” Though adoption remains a challenge, M-Code solutions and complementary APNT architectures are available today. The issue is not whether the capability exists. It is how quickly the defense community can move through integration, certification and fielding pathways to get that capability into warfighters’ hands.

M-Code is ready. This is a fielding problem.

“By maximizing the protection of M-Code, system designers can focus on lower cost sensors for the complementary parts of PNT,” Bishop said. “So, it brings the overall system cost down and gives system designers the ability to tailor solutions to the needs of each mission and platform.”

MILITARY GPS REMAINS THE APNT FOUNDATION

Military GPS remains indispensable because it provides precise absolute position (World Geodetic Survey 1984 (WGS84), precise time (Coordinated Universal Time (UTC), global availability and decades of threat-informed hardening. It is also a capability that many current military personnel have relied on throughout their entire careers. To operate successfully in the contested environments warfighters now face, DoW must more widely field systems equipped to handle the modernized M-Code signal, then toughen that military GPS layer with anti-jam/anti-spoof and augment it with other sensors in layered, mission-specific APNT architectures.

There are few sensors that provide absolute position, said Matt Bousselot, a technical fellow in PNT at BAE Systems, and absolute time is even more difficult. That makes military GPS especially compelling. APNT is not a choice between “GPS” and “alternatives.” Military GPS provides the trusted core; complementary sensors fill specific mission gaps.

There is also no signal, Bousselot said, that has been as thoroughly toughened, protected and hardened as military GPS.

“We’ve had multiple decades of dealing in the threat mitigation business,” Bousselot said, “so we have countermeasures to those threats, and countermeasures to the countermeasures that have been built into the user equipment for the last 20, 30 years.”

When new signals come online, he said, it is not just the signal in space that matters. It is also the user equipment development that has happened around that signal to counter evolving threats. Military GPS has benefited from decades of operational feedback, technical iteration and threat-specific mitigation. That is difficult for newer signals or sensor approaches to replicate quickly.

That distinction is central to the current APNT debate. Modern military GPS is not static. It continues to evolve as users encounter new threat conditions and feed those lessons back into the system. Contested GPS performance is not a reason to move away from GPS. It is a reason to continue improving and fielding the most protected GPS user equipment available.

“Right now,” Bousselot said, “GPS is easily the primary in any PNT PACE plan.”

LAYERED APNT, NOT SINGLE-SENSOR REPLACEMENT

There is no magic bullet, and there is no one-size-fits-all solution. The EW threat will not be solved with one untoughened sensor, one alternative technology or one universal replacement for GPS.

Inertial sensors, clocks, RF alternatives, vision navigation and emerging technologies all play important roles. Each can add value in the right context. But each also has weaknesses and limitations. When it comes to providing absolute precision time and position, Hamilton said, “GPS is easily the toughest thing going.”

To achieve APNT resilience, the solution must be a mission-driven architecture built around complementary, not alternative, PNT. Military GPS remains the foundation. Other sensors are selected and integrated based on the mission, the threat environment, the platform and the level of trust required. GPS and other sensors degrade for different reasons, which is precisely why they must be combined intelligently.

“It’s not about GPS versus something else,” Bishop said. “It’s about the right blend. And if I can toughen GPS sufficiently, I can save money on these other sensors that go with it. It may not be wise to invest huge dollars into a vis nav-only solution that has its own weaknesses. The focus should be on creating an APNT system that gets me the best cost per successful mission.”

That idea—cost per successful mission—is important because the real measure of an APNT architecture is not the unit cost of any individual sensor. It is whether the complete system can complete the mission in the threat environment it is expected to face.

An inexpensive system that fails in the intended environment is not a low-cost solution. Likewise, an exquisite sensor that exceeds the mission need may drive unnecessary cost and complexity. The APNT challenge is to match the solution to the mission, the threat and the platform.

Mission success is what matters. It does not help to deploy an inexpensive system that is ineffective in the environment where it is expected to operate, Bishop said. Solutions must be tailored to the mission and the EW environment.

By strengthening the core GPS layer, M-Code can reduce the burden placed on other sensors and help control total system cost. It can also allow designers to use complementary sensors more selectively and more intelligently, rather than trying to force any one sensor to solve the entire navigation problem.

For example, upgrading to a modernized GPS receiver and anti-jam antenna in an APNT system substantially reduces the area of impact for electronic threats to GPS. This reduces the amount of time the system must rely on alternate, contingency and emergency methods of navigation, and enables the use of much lower cost alternate sensors to achieve mission success. The cost reduction of alternate sensors often more than offsets the cost of the upgrade.

So, the question is not which sensor replaces GPS. The question is which architecture gives the mission the highest confidence of success.

INTEGRITY: VERIFY, DO NOT JUST FUSE

Adding sensors is not enough. The APNT system must know which inputs are trustworthy, when they are degrading and how much confidence should be assigned to them. That is especially critical in contested environments, where a sensor can continue producing data even when that data is compromised, degraded or misleading.

The central issue is not simply availability. It is trust.

In an effort to improve availability, many systems look to additional signals and sensors. But redundancy does not automatically create integrity. Additional sensors improve the solution only if the system understands when and how to trust them.

“What we worry about when we start pulling other signals into our solution is how can we trust them,” Bousselot said. “It’s actually possible to bring other signals into an M-Code based solution that make the entire system less effective for the mission because those signals were added in a way that isn’t trustworthy.”

Additional signals must either be protected to the level the military GPS signal is protected, Bousselot said, or their limitations must be understood so they can be incorporated “in a smart way.”

Integrity is a top priority for customers. In many cases, users would rather have no solution than a solution they cannot trust. That is why sensor credibility must be verified, not simply fused into the navigation solution.

With its Integrity Ring concept, BAE Systems does not simply fuse data from multiple sensors. Each sensor’s input is actively evaluated before being included in the final PNT solution. If a sensor begins to diverge from the consensus or behave inconsistently with the expected mission environment, it can be excluded or weighted differently. Mike Shepherd, Director of APNT Strategy at BAE’s Navigation and Sensor System’s Business, has likened the concept to a courtroom: each sensor provides testimony, and the integrity function serves as the judge.

This allows for multi-sensor PNT integrity, which means available signals and sensors can be used while maintaining high trust in the final PNT solution.

But customers cannot afford to put the most premium solution on every platform, Bousselot said, so integrity also must scale. As with anti-jam performance, there is always a trade-off around integrity, SWaP-C and mission need. A baseline level of integrity comes with modern military GPS user equipment, but higher levels of integrity and anti-spoofing capability can require additional processing, hardware or system complexity.

That means customers must make choices around cost versus performance even as it relates to integrity.

“Some of the interactions we’ve had with customers and potential partners recently have been, how do we relay the information to them as to what level of integrity they’re getting so they can make good decisions on that data,” Bousselot said, “versus just trying to get them the best integrity that exists, which may not be able to fit on their platform.”

That nuance matters. Not every platform needs or can afford the most exquisite APNT suite. But every platform needs an architecture appropriate to its mission, threat environment and trust requirements. Integrity must be engineered into that architecture from the start.

M-CODE FIELDING URGENCY

Relying on legacy systems or insufficiently protected PNT architectures increases risk for warfighters operating in contested environments. The message is direct: M-Code is ready. This is a fielding problem.

The issue is not whether modernized military GPS capability exists. The issue is how quickly program offices, integrators and platform owners can move through integration, qualification, adoption and fielding pathways.

M-Code adds important protections, but adoption has lagged threat environment demands. There has been movement, however. Senior DoW leaders increasingly recognize the urgency of fielding M-Code and reducing reliance on waivers or legacy approaches that leave platforms without the most modern military GPS capability available.

To push M-Code adoption forward, program offices must distinguish between availability, obsolescence and fielding timelines. One issue the market raises involves concern about supply availability and whether programs should wait for later technology increments. Fieldable M-Code solutions are available now, and waiting can become its own source of operational risk.

M-Code is available across domains. BAE Systems is already shipping M-Code solutions for ground, weapons and airborne applications. This is not primarily an availability or production-capacity issue. It is a matter of accelerating platform integration, adoption and fielding.

There is also a perception challenge. Recent GAO reporting on GPS modernization, for example, has focused on the progress of M-Code capable user equipment in Programs of Record (POR), Bishop said. That is an important piece of the puzzle, but it is not the whole picture. Industry has also moved forward with commercial M-Code solutions that are available today and ready for authorized users outside of PORs.

A casual reader of modernization reporting could come away with the impression that the M-Code universe is limited to a small number of formal program-of-record products, Bishop said, when the actual set of industry-developed capabilities is broader.

“Don’t just focus on the Programs of Record,” Bishop said. “When you think about M-Code, focus on what the industry has come forward with as a whole.”

This is where the current moment becomes urgent. The threat environment has changed. The operational need is visible. The technology is ready. The industrial base exists. The next challenge is fielding.

LESSONS FROM WEAPONS—AND IMPLICATIONS FOR UAS

Precision weapons have long had to operate in severe threat environments under extreme SWaP-C constraints. As a result, the weapons community has already matured around architectures that protect military GPS, toughen it with anti-jam and anti-spoof capability, and augment it with inertial sensing to achieve precise absolute PNT.

That history matters because weapons have been forced to solve the problem many other platforms are now confronting. They have had to operate in contested environments, under severe size, weight, power and cost pressure, while still delivering the mission outcome.

Weapons, Shepherd said, show the value of M-Code-centered APNT in some of the hardest operating environments. The weapons community understands M-Code as a core capability for reaching targets with high accuracy, and it has leaned heavily into military GPS protection, anti-jam/anti-spoof toughening and inertial augmentation.

The lessons learned are increasingly relevant to small UAS and launched effects, which face many similar constraints: contested environments, high-volume production, rapid design cycles, mission consequences and severe SWaP-C pressure.

Small UAS and launched effects may have more to learn from the weapons community than from traditional aviation modernization models. Manned aviation follows a different and often slower modernization path because of long aircraft life cycles, certification requirements, safety considerations, block upgrade structures and the cost of modifying large installed fleets.

“They’re likely not going to ground an airplane and send it back to the depot just for an M-Code upgrade,” Bishop said. “It will be part of block upgrades. So, there’s that reality of how the aircraft lifecycle works, versus I’m going to build a new munition instead of retrofitting an existing one. It’s just a very different model on how the fielding occurs.”

When aircraft updates are made, there is often a focus on provisioning as much as possible for future agility, Bishop said. That can work against SWaP-C goals and add complexity to the problem, making airborne modernization different from weapons or smaller UAS markets.

There is also a class of aircraft, he said, that must address additional safety-of-life requirements, adding more complexity and feeding into the broader system safety architecture. The cost and complexity of safety certification can slow adoption, and can encourage programs to bundle many requirements into larger modernization efforts rather than fielding a single capability quickly.

Small UAS and launched effects are different. Their design cycles are shorter. Their SWaP-C constraints are more severe. Their production tempo is faster. Their architectures can evolve more rapidly. In many ways, they resemble the weapons market more than the manned aircraft market.

That creates both a risk and an opportunity. If UAS developers treat GPS as a fragile commercial input or assume that alternative sensors can replace a protected military GPS core, they may under-equip their systems for the threat environments they will face. If they learn from the weapons community, however, they can build around M-Code protection, anti-jam/anti-spoof toughening, integrity and mission-specific augmentation from the start.

“This is still an emerging, young market and I feel like they could learn a lot of lessons from the weapons space,” Hamilton said. “Drone manufacturers are under equipping their PNT systems right now and we believe, over time, they will mature and adopt a lot of similar technologies to include M-Code with proper AJ and the right kind of augmentation.”

The point is not to dismiss other sensors or emerging approaches. Vision navigation, inertial sensing, timing technologies and other complementary capabilities all have a role. The point is that those technologies should be integrated into a trusted APNT architecture, not treated as universal replacements for GPS.

Integrating M-Code into small UAS and launched effects early in the design cycle can help manufacturers bring more mission-capable systems to the warfighter. Because those design cycles more closely resemble munitions than manned aircraft, and because they share similar SWaP-C constraints that the weapons community has already confronted, the opportunity to apply those lessons is immediate.

SCALE, INSERTION AND INDUSTRIAL READINESS

M-Code GPS-based APNT is no longer only a future concept problem. It is a fielding and architecture discipline problem that can be acted on today. BAE Systems is positioned to scale to meet demand without requiring significant new capital investment. As Bishop put it, “We’re ready to go.”

That readiness is partly the result of BAE Systems’ broad customer footprint, Bishop said, and the market cycles the company is already set up to support. BAE Systems also describes its military GPS business as operating with a commercial-style investment model, giving the company flexibility to move quickly, invest ahead of demand and support customer needs on relevant timelines.

“It’s very much a commercial business where we invest, we take the risk,” he said. “That incentivizes us to drive efficiencies and compete more on commercial terms.”

In many traditional government contracting models, vendors wait until after receiving a contract to invest in materials from the supply chain. BAE Systems often leans forward, buying materials well in advance of the contract award. That approach gives the company a level of agility more commonly associated with commercial markets—an approach that aligns with DoW’s increasing interest in speed, scalability and fieldable capability.

That is the way BAE Systems Navigation & Sensor Systems product line has operated for years, Bishop said, giving the company the ability to “surge and get these products done on a relevant timeline.” The Cedar Rapids facility represents a mature military GPS production base, and that production foundation positions the company to support fielding at scale.

“We’ve been asked in every senior leader meeting, if we surge, if we come to you and say we’re going to buy two to three times above what we normally do, is there any investment we need to provide to you to expand your facility,” Shepherd said. “There’s no investment. We can scale. We’re set up to do that.”

The same fielding logic applies to integration. Backward-compatible and lower-burden insertion paths are central to accelerating adoption, and BAE Systems has made that a key focus. The goal is to reduce integration pain wherever possible, especially for platforms that need modernized military GPS capability quickly.

“You’re going to disconnect, pull the old one out, put the new one in,” Shepherd said. “The same cable, the same antenna. We think about that pain, and then we try to take it away.”

That does not mean every integration challenge disappears. Certification, platform-specific requirements and program timing still matter. But modernization does not always have to be treated as a distant, bespoke, high-friction upgrade. In many cases, practical insertion paths exist today.

KEEPING UP WITH THE THREAT

Slogans, single sensors and delayed modernization will not solve the APNT challenge. Nor will treating GPS and resilience as opposing ideas. PNT starts by fielding the most protected military GPS layer available (M-Code), then building around it with anti-jam, anti-spoof, integrity monitoring and mission-specific complementary sensors.

Replacing GPS with so-called alternative solutions is not the answer. The stronger approach is to field hardened military GPS and incorporate the right complementary sensors to fill the remaining gaps.

“When you start trying to do worldwide precision absolute navigation and timing with anything besides GPS, the job gets really, really hard,” Hamilton said. “What GPS brings to the table in our APNT model is it reduces their problem set to a small space where, in the worst conditions, GPS, or maybe toughened GPS, needs some help, but now they have to solve a half a mile or a mile or a five mile problem, not a 25,000 mile problem.”

That idea captures the practical value of military GPS-centered APNT. GPS does not have to solve every problem alone. But when protected and integrated properly, it reduces the size of the problem other sensors must solve. It gives the architecture a trusted foundation. It narrows the gaps. It helps bound error. It gives complementary sensors a more realistic role.

Layered architectures are understood. Integrity principles are mature. One APNT architecture, with M-Code at its core, can scale across domains, with the sensor mix varying by mission and platform. The technology is there and ready to be leveraged.

M-Code is ready. This is a fielding problem.

The task now is to field modern military GPS-based APNT at the speed and scale the threat environment demands. And like Bishop said, BAE Systems is ready for it. 

The post Military GPS at the Core appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

In many small-UAS architectures, positioning, heading, inertial sensing, corrections, estimation, and control are still distributed across separate modules with different assumptions, update rates, and confidence models. That approach can work in nominal conditions, but it also creates more places for latency, inconsistency, and error propagation to enter the stack.

Hyfix is positioning the H1 as an architectural response to that problem. The company’s core argument is that too much uncertainty is still being passed across subsystem boundaries, making autonomous behavior harder to model and trust. Its answer is what can be described as stack compression: bringing positioning, timing, estimation, compute, and communications into a single co-designed architecture so the system error model can be treated more coherently. The claim is not simply that more functions reside on one device, but that tighter integration can constrain error earlier, improve confidence modeling, and reduce the disconnect between navigation and control.

WHY STACK COMPRESSION MATTERS

In a conventional architecture, each subsystem is optimized largely for itself. The GNSS receiver solves for position and time. The flight controller solves for attitude and control. The IMU supplies motion data to the flight stack. A companion computer handles heavier autonomy logic. Corrections arrive as an external service. Radios handle their own timing and links. Integration is required at every layer, and much of that integration is repeated from one platform program to the next.

The result is not just complexity. It is an error-modeling challenge. If a system begins to behave badly, the root cause can sit anywhere: a timing mismatch between modules, an IMU limitation inside the autopilot stack, a corrupted GNSS solution presented with misleading confidence, or a mismatch between what one module thinks “good data” means and what another assumes it means. From an engineering standpoint, each interface creates another place where error can be delayed, transformed, or misinterpreted. That is why Hyfix emphasizes that the challenge in autonomy is not simply getting a better measurement. It is understanding where error comes from, keeping it inside known bounds, and preventing it from cascading into bad decisions or unstable control.

This is the real significance of stack compression. The H1 is intended to bring those functions inside one architecture so timing, corrections, estimation, and control operate on a shared state rather than across loosely coupled interfaces. In that model, data stays on-chip instead of moving across boards, reducing delay and limiting opportunities for timing drift or interpretation error.

TIGHT COUPLING AND THE ESTIMATOR PROBLEM

Hyfix says every H1 runs the NuttX operating system and is loaded with the PX4 stack natively. That is significant because it changes where the integration occurs. Traditional flight controllers such as PX4 and ArduPilot are strong on attitude estimation, but their GPS-denied inertial navigation performance is often limited by the IMUs typically integrated on standard boards. More advanced fusion frequently gets pushed to the integrator, who must add a companion computer such as a Raspberry Pi or Nvidia Jetson. GNSS modules may also include embedded fusion, but those algorithms are often built around 2-D or low-dynamic ground-vehicle assumptions and may not translate well to flying vehicles. 

The architectural problem is that flight controllers and GNSS receivers are usually separate physical items. Position data arrives over a serial bus at perhaps 1 to 10 Hz as a simple PVT input, while the IMU is directly connected to the flight controller rather than to the GNSS engine. That separation makes it difficult to build tightly coupled filters that can work directly with raw satellite measurements such as code, Doppler, and carrier phase. By integrating GNSS and flight control in one system, Hyfix asserts that the H1 opens the door to tighter coupling at the estimator layer. 

Tight coupling is not simply a buzzword here. It changes what the estimator can see and when it can see it. Instead of consuming a downstream position fix as a finished product, the filter can work closer to the raw measurement layer and keep timing, inertial data, and satellite observations inside one architecture. That is a fundamentally different proposition from a serially connected PVT-based design. It is also better aligned with flying vehicles, where attitude, heading, velocity, and control interact on faster, more dynamic timescales than they typically do in ground systems. 

TIME SYNCHRONIZATION AS A HIDDEN SYSTEMS BURDEN

GNSS often provides the master clock in autonomous systems through PPS. But once sensors and subsystems are spread across multiple boards, maintaining good time synchronization becomes a material integration chore. Timing drift or inconsistent timestamping across modules can quietly degrade estimator performance even when each subsystem appears healthy in isolation. Hyfix’s position is that bringing more of the navigation, fusion and control chain inside one architecture reduces that burden and makes time coherence easier to preserve. 

DUAL-ANTENNA HEADING MOVES DOWNMARKET

One of the clearest technical examples is heading.

Traditionally, small drones have relied on geomagnetic sensors to estimate heading. That solution is cheap and compact, but it comes with familiar drawbacks. Magnetometers require hard-iron and soft-iron calibration to account for disturbances from batteries, motors, payloads, and surrounding structures. In highly supervised operations, calibration can be managed. In autonomous operations—especially swarms or drone-in-a-box deployments—it becomes much harder to do consistently. The vehicle may also operate near dynamic magnetic disturbances such as cars, bridges, or industrial infrastructure, where no amount of prior calibration completely solves the problem. 

Dual-antenna heading offers a more geometric alternative, but it has historically been reserved for larger and more expensive aircraft because it often required two receiver chains and a longer baseline between antennas. Hyfix’s claim is that H1 changes that trade. The chip includes dual RF input ports and can compute heading directly. Mike Horton, founder and CEO, said H1’s resolution and noise performance are sufficient to achieve heading accuracy on par with a geomagnetic sensor using only a 0.2-meter baseline between antennas—small enough to fit on a sub-250 g mini-drone. 

That detail matters because it brings dual-antenna heading into a class of aircraft where it has not been easy to justify. If the baseline requirement drops enough to fit small airframes, then dual-antenna heading is no longer a large-UAV luxury. It becomes an architectural option for the very aircraft that struggle most with reliable magnetic calibration. Horton’s practical summary is blunt: dual antenna can replace the compass, and even with a short baseline it should be “far better and far more repeatable than a compass.”

From a control standpoint, that has implications beyond heading accuracy alone. But the more important implication may be integrity.

GEOMETRY AS AN INTEGRITY CONSTRAINT

The H1’s dual-antenna architecture is also presented as a built-in check on whether the GNSS solution is believable.

Multipath remains one of the hardest real-world problems in GNSS-enabled autonomy. Signals reflecting from buildings, terrain, vehicles, or industrial structures can produce position solutions that appear plausible while being materially wrong. In loosely coupled architectures, those solutions may be passed downstream with a reassuring figure of merit, such as DOP, even when the data should not be trusted. The fusion engine then weights the wrong input too heavily.

A dual-antenna system introduces another measurement constraint. The physical distance between the antennas is fixed and known. In the positioning engine, that baseline can be computed via moving-base RTK. If the signals entering one or both antennas are distorted by multipath or interference, the measured baseline will deviate from the known geometry.

That inconsistency becomes an integrity signal. It does not eliminate the error source, but it gives the system another reason to suspect that the GNSS-derived solution is slipping. 

Instead of only accepting a single-antenna PVT solution at face value, the system can compare geometry against measurement behavior and ask whether the result is self-consistent. In practice, that is what makes predictable degradation a measurable system behavior.

CORRECTIONS AS PRECISION AND TRUST INFRASTRUCTURE

The H1 treats corrections as more than an accuracy service.

The H1, Horton said, can receive network data for two purposes. The first is familiar: traditional RTK corrections for higher accuracy and ephemeris support for faster convergence. The second is more interesting: network navigation messages can also be used as a check against spoofed navigation data. In other words, corrections are not only there to improve precision. They can also act as a trust layer. 

A receiver that can compare received navigation content against trusted network-delivered ephemeris is in a stronger position to detect inconsistency before it turns into corrupted state estimation. That reframes corrections architecture as part of the system’s integrity design, not just its accuracy budget. 

THE TACTICAL EDGE AND GRACEFUL DEGRADATION

Hyfix places much of this discussion at what it calls the tactical edge: environments with limited power, constrained bandwidth, denser RF conditions, degraded GNSS, and less room for recovery from mistakes. In those settings, the system’s real value lies not only in accuracy but in how well it detects and responds to uncertainty. The ability to constrain error at the source should allow the vehicle to degrade more predictably, relying more intelligently on inertial, visual, or other supporting inputs as conditions change.

Horton describes the handoff in practical terms. The fixed baseline between the two antennas becomes “another very powerful constraint” that helps the system “switch over your sensor fusion, to use IMU, to use camera, to use whatever.” That is a significant observation because it makes clear that the dual-antenna design is not only about heading or RTK. It is part of the trigger logic that helps the fusion engine decide when to trust GNSS less and trust other sources more. 

LEO PNT AND THE NEXT TIMING LAYER

Hyfix points to LEO PNT integration, including Xona, as part of the resilience path. Horton goes further: GEODNET is already tracking Xona signals on base stations around the world, and those signals are said to be 40 to 100 times stronger than traditional GNSS, improving jamming resistance and indoor penetration. The first commercial service from Xona is expected to be a precision timing signal in 2027. 

The most interesting part is not simply signal strength. It is what trusted timing might enable. Horton suggests that a high-power precision timing signal could allow a drone and controller to share nanosecond-accurate time even in the presence of GNSS jamming. That shared time could then be used to do ranging over the data link, adding another range source to help correct visual-odometry errors in GPS-denied environments. When Xona reaches full constellation, the system would also gain a stronger additional resistance to jamming. 

If that model matures, the first major LEO contribution to small-aircraft autonomy may not be position in the classic sense. It may be trusted time, and from trusted time, better synchronization and ranging across the broader autonomy stack.

A DIFFERENT PNT ARCHITECTURE FOR SMALL AUTONOMOUS AIRCRAFT

What H1 ultimately proposes is a reframing of the PNT problem for small autonomous aircraft. The question the industry has been asking—how to add more capable components to the stack—may be less important than the question Hyfix is now pressing: how to build a navigation and control architecture where fewer boundaries between systems means fewer opportunities for hidden error to become visible failure. Tight coupling, dual-antenna integrity, coherent timing, trusted corrections, and LEO-derived resilience are not independent features. They are expressions of the same architectural logic—that autonomy becomes more trustworthy when confidence is modeled as a system property, not assembled from loosely connected parts. That is not a modest claim. But the technical case behind it is serious, and for a PNT community already moving toward assured, layered and application-integrated architectures, it is exactly the right direction to be pushing.

The post From Stack Compression to Trusted Autonomy: The PNT Case Behind Hyfix H1 appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

The conversation around resilient positioning, navigation and timing has changed. Not long ago, much of the discussion centered on architectures, roadmaps and the strategic rationale for bringing timing, inertial navigation, sensor fusion and signal intelligence into a single operational framework. Today, the question is more immediate: How do fielded platforms continue to navigate, synchronize and operate when GPS is jammed, spoofed, degraded or unavailable?

For VIAVI Solutions, that question is no longer theoretical. With its acquisitions of Jackson Labs Technologies and Inertial Labs, VIAVI has assembled a portfolio that spans precision timing, holdover, inertial navigation, sensor fusion and communications-domain expertise. But the clearest expression of that strategy may be a product designed not to replace every system on a vehicle, but to make existing systems more resilient: the VIAVI RSR Transcoder 2.0. 

In an interview with Inside GNSS+, Andrew Popp, Sr. Director of PNT Product Line Management at VIAVI, described a market shift that is moving the transcoder from an innovative retrofit concept into an increasingly adopted solution for military platforms operating in contested environments. The product, he said, is now on 18 different vehicle platforms within the U.S. military, with adoption moving quickly as customers look for practical ways to upgrade navigation resilience without redesigning entire vehicles.

BUILT FOR TODAY’S EW INTENSITY 

That momentum reflects a core reality of modern defense operations. The electronic warfare environment is no longer an occasional complicating factor; it is a baseline condition. Jamming and spoofing are persistent, adaptive and widespread. The result is a growing need for systems that can preserve trusted PNT even when conventional GPS signals cannot be fully trusted—a concern that extends well beyond the battlefield to transportation networks, power grids, financial systems and emergency services that depend on precise timing and geolocation.

The transcoder addresses that need by acting as an interpretive layer between new sources of navigation or timing data and legacy onboard systems. It can accept multiple types of inputs, including NMEA input, ICD-GPS-153 type input, LEO receiver data, inertial navigation inputs and M-Code-capable sources. It then outputs signals that existing vehicle systems already understand, including GPS L1 C/A and L2 P-code.

Rather than forcing a platform owner to rip out existing receivers, rewire a vehicle or wait for a new program of record to deliver a clean-sheet solution, the transcoder allows new PNT capabilities to be introduced through a familiar interface. Existing equipment sees what looks like a GPS signal. Behind that signal, however, may be a more diverse blend of inputs drawn from inertial navigation, military GPS, alternate satellite sources or other aiding systems.

“It works today,” Popp said. That point is central to VIAVI’s positioning. The transcoder is not framed as a long-range development promise or a future architecture dependent on new acquisition cycles. It is a pluggable solution designed for equipment already fielded, already wired and already operating in demanding environments.

That practicality matters because many defense platforms were not built for today’s EW intensity. Legacy navigation systems may still perform well under normal conditions, but they were not designed for a battlespace in which GPS denial can be expected and spoofing can be sophisticated. The challenge is not only to add resilience, but to add it in a way that respects the cost, complexity and readiness constraints of existing fleets.

Popp emphasized that VIAVI paid close attention to integration details. The cabling, power and physical integration were designed to match the realities of the vehicles and systems already in use. In simple terms, the product is meant to fit into the operational environment, not force the operational environment to conform to the product.

That design philosophy helps explain why adoption has extended beyond initial expectations. The transcoder’s value is not limited to a single vehicle class or a narrow set of requirements. While current deployments are land-based, Popp noted the same approach can extend to rotorcraft and other platforms. The key is not the vehicle type; it is the need to translate trusted PNT inputs into a form that onboard systems can use immediately.

The timing element is especially important. In PNT, timing is often less visible than positioning and navigation, but it is foundational to both. Without trusted time, position and navigation degrade quickly. VIAVI’s Jackson Labs heritage gives the company a deep base in precision timing, synchronization and holdover performance, and that expertise is built into the transcoder family.

MISSION MATCHED RESILIENCE 

The transcoder is available in multiple configurations to match different mission needs. Popp described modules that can be embedded into larger solutions, ruggedized enclosure versions, and options with different holdover oscillator capabilities. For critical holdover requirements, VIAVI offers a CSAC option. Other configurations use MEMS-based or OCXO-class approaches, while some versions can operate without an onboard oscillator when a larger vehicle already has a high-quality clock available.

That configurability is not an afterthought. It reflects VIAVI’s view that resilience should be mission-matched rather than overbuilt. Some customers need the highest holdover performance available. Others already have timing assets onboard and simply need the transcoder to ingest and distribute that trusted timing. Still others may want a board-level module to embed inside a broader PNT or navigation solution.

The result is a family of options rather than a one-size-fits-all architecture. That is significant in defense procurement, where over-specifying a solution can be as damaging as under-specifying it. The right answer for a heavy ground vehicle may not be the right answer for a smaller platform, an unmanned system or a contractor-developed navigation suite. VIAVI’s goal is to meet the customer at the level of capability required by the mission.

The same modular thinking applies to sources of position and time. Popp described VIAVI’s posture as source-agnostic. The objective is to use the best available source in the operating environment and deliver that information in a usable form. Today, that can include satellite-based timing sources, Iridium-based services, inertial inputs and M-Code-capable GPS. VIAVI is also evaluating additional sources of opportunity and terrestrial timing approaches as part of a broader strategy to avoid dependence on any single point of failure.

That future-facing design is essential because the PNT landscape is changing quickly. LEO constellations, signals of opportunity, terrestrial timing networks, visual navigation, map matching and other techniques are gaining attention. But each new source creates an integration challenge. New navigation technology is only useful if it can be consumed by the platform that needs it.

This is where the transcoder’s role becomes broader than a single VIAVI product. It can serve as an enabling component for other companies developing more sophisticated INS, visual navigation, north-finding or sensor-fusion systems. If those systems can provide the right input, the transcoder can help translate that capability into a signal format that legacy onboard systems can accept.

A PLATFORM ENABLER 

The transcoder is not only a solution; it is a platform enabler. It allows contractors and integrators to bring new PNT technologies to existing vehicles without requiring each new capability to be deeply integrated into every onboard navigation subsystem. The transcoder becomes the bridge between innovation and adoption.

That bridge is important as operational requirements evolve faster than platform refresh cycles. A vehicle may remain in service for decades, while the threat environment changes in months. Operators need a way to insert new resilience layers quickly, affordably and with minimal disruption. The transcoder provides a path to do that by preserving the installed base while upgrading what the installed base receives.

This also connects the transcoder to VIAVI’s larger PNT strategy. An earlier Inside GNSS+ feature on VIAVI’s integrated PNT vision described a layered ecosystem built from precision timing, inertial navigation, signal awareness, validation and modular integration. The transcoder is one of the most practical expressions of that ecosystem. It turns architectural resilience into something that can be used by systems already in place.

The urgency is being driven by real-world conditions. Customers are responding to the severity, frequency and operational consequences of jamming and spoofing. They are not merely planning for future contested environments; they are trying to operate in them now. That makes ease of integration more than a convenience. It becomes a readiness issue.

The transcoder’s adoption across 18 vehicle platforms suggests the market is responding to that need. VIAVI is also pursuing an NSN number for the product, which would make acquisition easier for government customers. Rapid operational adoption depends not only on technical capability, but on procurement accessibility.

The long-term opportunity may be larger still. NATO-aligned and allied markets face many of the same EW and GNSS-denial challenges as the U.S. military. Because the transcoder is built around accepting diverse inputs and outputting standardized signals, it is not limited to a narrow domestic configuration. Its versatility could make it relevant across allied land, air and integrated defense applications where legacy equipment needs to be upgraded for modern PNT threats.

The counter-UAS mission also underscores the importance of resilient PNT. ISR, targeting, object detection, classification and counter-drone operations all depend on trusted georeferencing. If the platform cannot trust its position, timing or navigation data, downstream mission systems suffer. A resilient PNT layer therefore becomes part of the broader mission chain, not merely a navigation accessory.

ACCELERATING ADOPTION 

VIAVI’s transcoder does not require customers to choose between legacy systems and next-generation navigation. It allows the two to work together. It gives existing platforms a way to consume resilient PNT inputs while giving new technology providers a path into fielded systems.

VIAVI’s message is simple: Customers should not have to replace everything to become more resilient. They should be able to use the best available sources of time and position, combine them as the mission requires, and deliver them to existing systems in a form those systems can trust.

In a battlespace defined by jamming, spoofing and uncertainty, that is powerful. Resilience is no longer just about having more sensors or more expensive clocks. It is about integration, translation and flexibility. It is about ensuring when one source is degraded or denied, another can be used.

VIAVI’s transcoder sits precisely at that intersection. It connects old and new, GPS and non-GPS, timing and navigation, platform constraints and mission urgency. For military users confronting today’s EW environment, that may be the difference between a promising PNT architecture and a capability that can be fielded now. 

The post VIAVI’s Transcoder Moves Resilient PNT From Architecture to Adoption appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.