Robust PNT – Effect & Mitigation flip the navigation data bits to induce an error so that the...

1Spirent Communications PROPRIETARY AND CONFIDENTIAL

Robust PNT – Effect & Mitigation

Canada - 2016


Agenda

Intro to various threats Impact of Interference/Jamming Details of Spirent Test pack / Tools to

improve robustness Q&A Summary


GNSS Environment

Constellation:• Almanac• Signal Outputs• Data Messages

IonosphereTroposphere

Atmosphere:• Ionosphere• Troposphere

Obscuration

Local Obscuration:•Buildings etc

Multipath

Multipath Effects:•From buildings etc

Error Sources:• Clock Errors• Atmosphere• Positional

Antenna Parameters:• Gain / Phase pattern


Broad Classification of Interferences

Continuous white noise

Pulsed white noise

Modulated waveforms

Narrow BandWide BandContinuous

Wave

Class II: Chirp signal with one saw-tooth

function

Class III: Chirp signal with multi saw-tooth

functions

Class IV: Chirp signal with frequency

bursts

Narrow Band


PPD

Most car jammers are Narrow band Jammers (Continuous or Chirped with various signatures)

PPDs can broadcast RF noise over a range of up to 500m from the vehicle

Source: “Effects of GNSS jammers and potential mitigation approaches”, Dr. Heidi Kuusniemi, Finnish Geodetic Institute - link

http://www.unoosa.org/documents/pdf/psa/activities/2012/un-latvia/ppt/3-14.pdf


Effect of Jammers

Deteriorates signals –quality & strength

Accuracy of Positioning

solution gets worst

Receiver Loses lock

Effect of jamming could be similar to effect of

Multipath in dense urban environment

Source: “Effects of GNSS jammers and potential mitigation approaches” link



Tests by Finnish Geodetic Institute

The effects of the jammers on consumer grade GPS receivers were analyzed in a confined navigation laboratory at the Finnish Geodetic Institute

Positioning solutions were analyzed with and without the jammers on 24 hours consecutively in the single frequency case, and in shorter time steps with a dual frequency receiver

The maximum J/S ratios of around 15 and 25 dB were utilized in two test cases in addition to a no jamming test scenario

uBlox 5H and 5T

Fastrax IT500 and IT600

GPS inside Nokia N8

NovAtel OEM4 (L1/L2)




Results from the Finnish Research - 2012




Mitigation Techniques Multi-frequency receivers

Multi-constellation GNSS receivers

Improved antenna

Comparing against ground-based

reference source

Using Receiver Autonomous

Integrity Monitoring

(RAIM) techniques

Using innovative

Digital Signal Processing

technology in the receiver


Introducing the Spirent Interference Detector

The Spirent Interference Detector is a fixed listening device

that monitors the RF environment in the GPS bands, over a

rangeof approx. 500m, for potential sources of

interference to the GPS signal.


Summary of Tests in V1 Test Pack (1 of 2)

Threat Type Scenario description Test system Interference with static PPD

Includes a wide range of typical static jammer types:- tone, pulsed, chirp triangular, chirp saw tooth, chirp sinusoidal

Requires SimGEN & GSS7765 hardware

Interference with moving PPD

Simulates PPD chirp jammers (triangular, saw tooth, sinusoidal) moving past GPS receiver. Received jammer power to -40dBm

Requires SimGEN & GSS7756 hardware

GNSS segment error

Corrupted ephemeris information uploaded to GLONASS satellites

Requires SimGEN

GNSS segment error

Satellite ephemeris corrupted to put one satellite “inside” the Earth

Requires SimGEN


Summary of Tests in V1 Test Pack (2 of 2)

Threat Type Scenario description Test system GNSS segment error

Unhealthy satellite set to test receiver rejection

Requires SimGEN

GNSS segment error

Nav data bit error with wrong parity, to test receiver rejection

Requires SimGEN

GNSS segment

Leap second event warning flag, totest receiver treatment of this

Requires SimGEN

Degradation Simulation of poor antenna installation with 50% sky obscured

Requires SimGEN

Degradation Simulation of receiver transitions at poles, date line, equator

Requires SimGEN


Interference

Interference Scenario suite - Scenario name: RFI_0000n_static_jamming_v1-00

The aim of this test is to replicate the effect where an automotive cigarette lighter 12 volt socket PPD is used to jam the in car navigation system using a rooftop patch antenna to receive the GNSS signals. Assuming,

SimGEN scenario description:

In this scenario Sim GEN will transmit fixed GNSS signals at -120dBm for an initial period of 10 minutes. 15 minutes into the run a jammer with fixed power level at -45dBm will be turned on for 2 minutes and then turned off for the rest of the scenario.

Single Tone

Pulsed Single tone

2MHz, 20MHz and 50 MHz Noise

2MHz Pulsed Noise

20MHz and 50 MHz Pulsed Noise

Saw tooth, triangular and sinusoidal

The nominal signal power level transmitted by a PPD is 20mW (13

dBm).

Its helical monopole antenna gain is 8dBi.

The jamming signal is received through the patch antenna backlobe

which has a -30dBi gain.

Both antennas are spaced 1 meter apart (36.39dB free space path loss

(fspl).

The jamming signal observed at the GNSS has a power level of -45.39dBm


InterferenceDynamic Interference Scenarios : RFI_0000n_moving_jamming_v1-00

The aim of this test scenario is to simulate a moving jammer source. A ‘white van’ having a PPD transmitting 13dBm of jamming signal with a 0dBi antenna gain is moving past the GPS receiver with a 3dBi antenna gain. Their closest range is 10 meters which translate to a free space path loss of 56.4dB.


Instead of having a moving PPD, the scenario is emulated by using a static receiver and a power varying static jammer with all GNSS signals in view. The jammer signal power level will vary from -130dBm to -40dBm then back to -130dBm at a rate of 1dB per second. The jammer signal type used for this test consists of:

1. Saw tooth, triangular and sinusoidal chirps sweep for ±10MHz centered on all GNSS center frequencies with 100μs period.

2. 2MHz, 20MHz and 50MHz Swept CW centered on all GNSS center frequencies.

. The maximum jamming signal power level receiver by the GNSS receiver will

be about -40dBm.

The jamming signal observed at the GNSS has a power level of -45.39dBm


Segment Errors

Corrupted Ephemeris Information uploaded to GLONASS Satellites in April 2014 On April 1, 2014, at 21:15 UTC, all GLONASS satellites started to transmit wrong Broadcast Messages

(BM) as previously reported by GPS World. The satellite positions derived from these BM were wrong by up to ± 200 kilometers in each of the three coordinates x, y, and z of the Earth-fixed, geocentric, equatorial coordinate system. The problem disappeared after an hour (after two erroneous BM) for two GLONASS satellites; for other satellites, the problem lasted much longer: up to 10 hours

It was reported that some Multi-Constellation, Multi-frequency GNSS Receivers that also were able to receive GPS signals, failed to operate during the period when GLONASS satellites were transmitting the wrong broadcast messages

Satellite positions were wrong by about ±200 Kms in each of the 3 axes


Segment Errors

Segment Error Scenario 1: Scenario name: GSE_00001_GLO_corrupted_ephemeris_v1-00

Aim of the test:

The aim of this test scenario is to replicate the situation when wrong Kepler orbital parameter in the navigation message was broadcast by the GLONASS satellites during April 2014.


SimGEN is used to generate the truth ephemeris message in UDD format. The scenario started at 12 Nov 2015 22:00:00 (TOW is 424800s) and lasted for 6 hours. The navigation data cutover occurs every 2 hours. The logged UDD time for the simulation versus TOE were listed in Table 3 1. A portion of the UDD truth data for all satellites from 13 Nov 2015 00:00:00 (TOW is 432000) to 02:00:00 (TOW is 439200) are converted from Kepler orbital parameter to ECI. The z-axis was rotated clockwise by 0.50 and then converted the ephemeris back to Kepler. This piece of data was then merged with the truth data to form the modified UDD ephemeris data. In SimGEN the simulation was performed with the modified UDD data to emulate the error in the transmit Broadcast Messages (BM).

UDD Time, s TOE, s Data status 424800 432000 Truth 432000 439184 Modified 439200 446348 Truth


Segment Errors

Segment Error Scenario 2: Scenario name:GSE_00002_GPS_sv_inside_the_earth_v1-00

Aim of the test:

The aim of this test is to replicate the situation where the ephemeris information is hacked, situating one of the GPS satellites at a fictional location beneath the Earth’s surface.


SimGEN is used to generate the truth ephemeris message in UDD format for GPS constellation. The square root semi major axis distance of the satellite with the highest elevation (SV24) is altered to 2358.0992450m in the UDD file.

In 2014, there was instance where hacker corrupted the satellite ephemeris to put satellite/ satellites inside the Earth – they did this to evaluate the effect of this on consumer devices using GPS. This caused several well known makes of mobile phone equipped

with GPS Receivers to crash.


Segment Errors

Segment Error scenario 3: Scenario name: GSE_00003_GPS_sv_set_unhealthy_v1-00

Aim of the test:

The aim of the test is to find out whether the receiver is capable to decode satellite health bit and opt out unhealthy satellite in navigation solution computation.

Unhealthy GPS Satellite status caused problems in May 2014 User equipment incorrectly interpreting data from a satellite set

“unhealthy” led to an apparent constellation outage for roughly 1,000 fleet vehicles across Australia in April.

The U.S. Air Force GPS Operations Centre reported that in mid-May tests, “PRN 30 [was] broadcasting almanac datasets that do not reflect constellation changes that occurred since it was last uploaded with navigation message data. the current week increases.”


Segment Errors

Segment Error Scenario 4: Scenario name: GSE_00004_GPS_L1_CA_nav_data_bit_errors_v1-00

Aim of the test:

Purposely flip the navigation data bits to induce an error so that the parity bits do not match up with its content to test the receiver’s fault detection/correction and exclusion ability.SimGEN scenario description:

SimGEN , uses ‘Navigation data error’ to flip bit 1, 4 and 6 in Word 2 (Time of week-count message in HOW) for all subframe for GPS L1 legacy navigation data.

Bit errors are known to occur from time to time. This scenario simulates a bit error in GPS L1 data.


Segment Errors

Segment Error Scenario 5: Scenario name: GSE_00005_leap_second_event_v1-00

Aim of the test:

This test is to ensure that the receiver is able to acquire the upcoming leap second event but does not implement it immediatelySimGEN scenario description:

The SimGEN scenario has all GNSS signals in view. This enables the leap second to occur on the 30th June 2015 23:59:59.

In early 2015 the message warning of a leap second event in June 2015 was broadcast. It is known that some receivers implemented the leap

second immediately.


Degradation

Obscuration Poor installation is a known problem – quite often this is caused by poor siting of the GPS Antenna

Whilst poor installation is not a specific GNSS vulnerability, often the issues experienced by the user are blamed on jamming/interference or other issues.

This test pack masks half of the sky to replicate an antenna installed on the side of a tall building – this allows the user to evaluate a sub-optimal installation and compare with an ideal case


Degradation

Degradation Scenario 1: Scenario name: DEG_00001_building_obscuration_v1-00

Aim of the test:

Simulation of an installation issue – installation at location where the antenna has a poor sky viewSimGEN scenario description:

A SimGEN scenario has been created with all GNSS signals in view. A static vehicle and the land mobile multipath option has been used to mask half of the sky with ‘Category Mask’ editor to replicate antenna installed on the side of a tall building.

Obscuration caused by sub-optimal antenna placement is a known problem for some users in some locations. This scenario allows the

effects of sky obscuration to be evaluated for an antenna that has been mounted on the side of a tall building.


Degradation

Unusual locations Test receiver positioning abilities at poles, Equator and International Date Line

It is known that some receivers have experienced problems coping with unusual locations as above. This test pack allows users to evaluate their device at known problem locations.

http://www.google.co.uk/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjThZOogM_JAhXJ6xQKHRjGB7gQjRwIBw&url=http://therucksack.tripod.com/MiBSAR/LandNav/LatLon/LatLon.htm&psig=AFQjCNEXDrkqtzKrwjvMHdsFJXzgyKnJfw&ust=1449758182699610

http://www.google.co.uk/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjThZOogM_JAhXJ6xQKHRjGB7gQjRwIBw&url=http://therucksack.tripod.com/MiBSAR/LandNav/LatLon/LatLon.htm&psig=AFQjCNEXDrkqtzKrwjvMHdsFJXzgyKnJfw&ust=1449758182699610


Degradation

Degradation Scenario 2: Scenario name: DEG_00002_unusual_location_static_v1-00

Aim of the test:

Simulation of a GNSS receiver sited in locations that have been known to cause problems with receivers.SimGEN scenario description:

A SimGEN scenario is created with all GNSS signals and places a static vehicle at the following locations:

1. North Pole.

2. South Pole.

3. 00 Latitude, 00 Longitude & 0 meter height.

This scenario addresses Test receiver positioning abilities at poles, Equator and International Date Line. It is known that some receivers

have experienced problems coping with unusual locations. This test pack allows users to evaluate their device at known problem locations


Degradation

Degradation Scenario 3: Scenario name: DEG_00003_vehicle_crossing_equator_and_idl_v1-00

Aim of the test:

This test simulates a land vehicle driving past the International Date Line at midnight. This is a scenario that is known to have caused receiver problems in the past.SimGEN scenario description:

A SimGEN scenario has been created with all GNSS signals and puts a land vehicle at 00 Latitude and 179055.1491’ E. The vehicle is moved along the Equator heading to the International Date Line at a speed of 10m/s. The vehicle will cross the International Date Line at exactly 12 o’clock midnight.


Spirent Threat Test Pack - SummaryCollected threats representing actual events and vulnerabilities

Latest pack

Static and moving personal protection device (PPD) in car-jammer profiles

System errors April 2014 GLONASS outage, corrupt ephemeris data

Bit error & leap second events

Obscuration example Simulating poor antenna installation

Cross-over locations Dateline, equator, poles

new threats soon

A selection from actual events, for example:

New interference events observed from Spirent’s network

Atmospheric effects

System events

+


GNSS Constellation Update

40 % Receivers are Galileo Ready [1]

Source: GPS World, May 2016


Advantages of Interoperable GNSS

Adding new interoperable GNSS signals with improved modulations, signal carriers with subcarriers, longer codes and higher transmission power will improve the availability as well as the accuracy of satellite positioning

Better resistance to cross-correlation

Better opportunities for weak signal acquisition with longer integration

Better resistance to interference

Better multipath mitigation properties

In the future, all the available navigation

signal frequencies(L1/E1, L2, L5/E5,

E6) are more difficult to be jammed

simultaneously


R&D Integration Verification Production

GSS9000 GSS6700 GSS6425 GSS6300 (M)

Testing toolsSpirent simulators and RPS

Processes Application examples


PT TestBenchSpirent’s PT TestBench is an automation and reporting software tool, which provides you with an integrated test solution, enabling characterisation and vulnerability assessment of GNSS receivers using pre-defined Test Cases.


PT TestBench：User Interface

Use chart or table to show the key data extracted from the test, store the

data into external database for later usage

编辑

iTest Activities streamline testing efforts around the

most common automation tasks

Quickly add automated test steps through

capture and analysis. Easily execute your test and view test

reports or share result with others

Create & edit test cases in an easy to edit format

that doesn’t requirement scripting

Add analysis to create robust test cases. Responses can be abstracted to allow test case portability and ease of

maintenance


Sample Reports


Q & A


SummaryWhat did we learn today?

Understand your application and GNSS related use cases There are no defined standards for GPS/GNSS testing,

but there are common tests effective for defining performance Understand the results For more information visit:

www.spirent.com Follow us on LinkedIn : Spirent Communications / Spirent Positioning and Navigation

Please provide feedback and complete brief survey Contact us for more info:

[email protected] [email protected]

http://www.spirent.com/

mailto:[email protected]

Robust PNT – Effect & Mitigation flip the navigation data bits to induce an error so that the...

Documents

Transcript of Robust PNT – Effect & Mitigation flip the navigation data bits to induce an error so that the...