Computer engineering dissertation: Robust signal processing techniques for modern gnss receivers

Therefore, goal of this work is to propose techniques to overcome the existing limitations in antenna array processing and snapshot processing for modern GNSS receivers. The proposed techniques not only reduce the implementation cost but also leverage the distributed data processing ability.

MINISTRY OF EDUCATION AND TRAINING

HANOI UNIVERSITY OF SCIENCE AND TECHNOLOGY

NGUYEN DINH THUAN

ROBUST SIGNAL PROCESSING TECHNIQUES FOR MODERN

1 Assoc Prof Ta Hai Tung

2 Prof Letizia Lo Presti

Hanoi - 2019

1

STATEMENT OF ORIGINALITY AND AUTHENTICITY

I confirm that my dissertation is an original and authentic piece of work written by myself The data, results in the thesis is reliable and has never been published by others I further confirm that I have fully referenced and acknowledged all material incorporated as secondary resources in accordance with the regulations

Hanoi,

Prof Letizia Lo Presti

2

ACKNOWLEDGEMENTS

I would like to express my gratitude to Hanoi University of Technology, Graduate School, School of Information and Communication Technology, Department of Computer Engineering and Politecnico di Torino, NavSaS group for creating favorable conditions for me to work and study

I would like to express my special thanks to my supervisors, Assoc Ta Hai Tung and Prof Letizia Lo Presti The supervisors have always been helpful, giving great advice, scientific orientations so that I can develop and complete my research

Sincerely thank the lecturers, colleagues in the Department of Computer Engineering, School of Information and Communication Technology, Hanoi University of Science and Technology where I work, study and carry out research projects for the enthusiastic in helping and encouraging me during the research

With gratitude to teachers, scientists, colleagues and close friends for encouraging and supporting me in the research process

Finally, I would like to express my deep gratitude to my family for encouraging me

to overcome all obstacles to complete this thesis

Nguyen Dinh Thuan

3

TABLE OF CONTENTS

STATEMENT OF ORIGINALITY AND AUTHENTICITY 1

ACKNOWLEDGEMENTS 2

TABLE OF CONTENTS 3

LIST OF ACRONYMS 6

LIST OF TABLES 8

LIST OF FIGURES 9

INTRODUCTION 13

1 FUNDAMENTAL BACKGROUND 18

1.1 GNSS positioning principle 18

1.2 History and development of GNSS 19

1.3 GNSS Threats 20

1.3.1 Multipath 21

1.3.2 Atmosphere 21

1.3.3 Interference 21

1.3.4 Spoofing 21

1.3.5 GNSS Segment errors 21

1.3.6 Cyber Attacks 22

1.4 GNSS Receiver Architecture 22

1.4.1 Signal Conditioning and Sampling 22

1.4.2 Acquisition 23

1.4.3 Tracking and Data Demodulation 23

1.4.4 Positioning Computation 24

1.5 Countermeasures to GNSS Threats 25

1.5.1 Antenna array processing techniques 25

1.5.2 Frontend and Digital Signal Conditioning based techniques 28

1.5.3 Correlator/Tracking and PVT based techniques 29

1.6 GNSS Simulator and effect of sampling frequency 30

2 GNSS SIGNAL SIMULATOR DESIGN AND IMPLEMENTATION 32

2.1 Modeling methodology 32

4

2.2 Overview of the modeling of antenna array signals in GNSS receivers 32

2.2.1 General model of the received signal in GNSS receivers 33

2.2.2 Interference 37

2.2.3 Multipath 38

2.2.4 Noise 39

2.3 Effect of sampling frequency on the positioning performance 39

2.3.1 Residual code phase estimation 40

2.3.2 Correlation output calculation 40

2.3.3 Effect of sampling frequency on correlation shape and DLL discriminator function 42 2.3.4 Effect of the sampling frequency and the integration period selection 42

2.3.5 Effect on the presence of Doppler and local oscillator (LO) clock drift 45

2.3.6 Theoretical code tracking loop error estimate 46

2.3.7 Theoretical results evaluation by simulated, and numerical models 49

2.3.8 Effect of Doppler and coherent integration period 50

2.4 Sampling Frequency Effect Mitigation Technique 53

2.4.1 Receiver implementation 55

2.5 Performance verification 57

2.5.1 Verification of the simulated antenna array signals 58

2.5.2 Antenna distortion simulation 64

2.5.3 Verification of multipath simulation 66

2.6 Conclusion 67

3 ANTENNA ARRAY PROCESSINGS FOR GNSS RECEIVERS 69

3.1 The proposed solution for synchronizing separated antenna array element 69

3.1.1 Determining the samples difference 70

3.1.2 Determining the clock phase shift 71

3.2 Implementation a low-cost antenna array 75

3.3 Antenna array frontend verification 76

3.3.1 Phase difference between frontends 76

3.3.2 Carrier to noise ration improvement 77

5

3.4 Conclusion 78

4 GNSS SNAPSHOT PROCESSING TECHNIQUE FOR GNSS RECEIVERS 80

4.1 Proposed Design of GNSS Snapshot Receiver 80

4.1.1 GNSS Grabber 80

Implementation of GNSS Grabber 80

Firmware Architecture 81

4.2 Server Software 81

4.2.1 GNSS signal acquisition 81

4.2.2 Combined Doppler and Snapshot Algorithm 84

4.3 Loosely coupled Snapshot GNSS/INS 89

4.4 Tightly coupled Snapshot GNSS/INS 96

4.5 Results 97

4.5.1 Standalone Snapshot GNSS Receiver 97

4.5.2 Snapshot GNSS/INS Integration 102

4.6 Conclusion 104

CONCLUSIONS AND FUTURE WORKS 105

PUBLICATIONS 107

REFERENCES 109

APPENDIX 116

A Correlation output calculation 116

B Error analysis for coherent early minus late DLL 117

6

LIST OF ACRONYMS

ADC Analog to Digital Converter

AWGN Additive White Gaussian Noise

BPSK Binary Phase Shift Keying

C/N0 Carrier-to-Noise-Density Ratio

CDC Conventional Differential Combination

CDMA Code Division Multiple Access

DFT Discrete Fourier Transform

DSP Digital Signal Processor

EGNOS European Geostationary Navigation

Overlay Service

FEC Forward Error Correction

FPGA Field Programmable Gate Array

7

FOC Full Operational Capability

GLONASS Global Orbiting Navigation Satellite

System

8

LIST OF TABLES

Table 2.1: GNSS Simulator Features 57Table 2.2: The coordinate of 4 elements 58Table 2.3: The direction of 6 visible satellites 59Table 2.4: The carrier phase relative to the first element of each satellite at the four elements

of the array 59Table 2.5: The simulation scenario 60Table 2.6: Estimated carrier phase using the post-correlator beamforming tracking loop 62Table 4.1: Configuration of the GPS grabber 97Table 4.2: Information of acquired satellites 99

9

LIST OF FIGURES

Figure 1.1: Satellite navigation principle 18

Figure 1.2: Typical GNSS Threats 20

Figure 1.3: Signal conditioning and sampling stage 22

Figure 1.4: Acquisition Architecture 23

Figure 1.5: Tracking Architecture 23

Figure 1.6: Transmission time estimation in GNSS receivers 24

Figure 1.7: Interference mitigation techniques in GNSS receivers 25

Figure 1.8: The traditional low-cost architecture of antenna array for GNSS applications 27 Figure 1.9: The correlation between 2 GPS signal grabbed by antenna array 28

Figure 1.10: Spectrum and histogram of GNSS signal in the absence of interference 28

Figure 1.11: Snapshot positioning architecture 29

Figure 2.1: Geometry of antenna array 33

Figure 2.2: The model of the received signal for a single antenna 33

Figure 2.3: GPS multi-antenna frontend 34

Figure 2.4: Flowchart of the simulator 35

Figure 2.5: Bandlimited Gaussian interference model 38

Figure 2.6: Multipath model 38

Figure 2.7: Effect of sampling frequency on the positioning performance 39

Figure 2.8: Residual code phases versus the number of samples per code chip with 4fc < fs < 5fc 40

Figure 2.9: Normalised correlator and EML discriminator functions for different sampling frequencies Results are obtained by correlating the incoming signal with various local generated replica signals that have the time delay from−Tc to Tc with step = 10-2Tc 42 Figure 2.10: Correlation shapes for 1 ms integration with various sampling frequencies 43

Figure 2.11: Ambiguous synchronization between a local PRN code and two different incoming analog signals of the same PRN sequence, but with slightly differing code phase offset 43

Figure 2.12: Correlation shapes and their errors with respect to the ideal correlation at a sampling frequency fs =16.3676 MHz using various coherent integration periods 44

Figure 2.13: Representation of code tracking loop [54] 46

10

Figure 2.14: DLL jitter versus different sampling frequencies (step=fc) for a GPS L1 C/A

with C/N0=40 dB-Hz, BL=0.5 Hz, T=1 ms, and fixed BW βr = 2fc 48

Figure 2.15: Upper bound and lower bound of the DLL jitter versus different sampling frequencies (step = 5∗10-2 fc) for a GPS L1 C/A with C/N0=45 dB-Hz, BL=0.5 Hz, T=1 ms, and βr = fs 49

Figure 2.16: Mean values of two error bounds σs1 and σs2 versus different sampling frequencies (step = 10-1 fc) for a GPS L1 C/A with C/N0=45 dB-Hz, BL=0.5 Hz, T=1 ms, and βr = fs 49

Figure 2.17: DLL tracking error comparison among the simulated, numerical and theoretical models (step = 10-1 fc) for a GPS L1 C/A with T=1 ms, and βr = fs 50

Figure 2.18: DLL tracking error versus Doppler frequencies fD for different integration periods T when the sampling frequency is an integer multiple of the nominal code rate (ns=4), in which the blue dotted lines indicate the typical Doppler range 51

Figure 2.19: DLL tracking error versus integration periods T GPS L1 C/A is used with fs = 4.092 MHz (ns=4), C/N0=40 dB-Hz, BL=0.5 Hz, T=1 ms, and βr = fs 52

Figure 2.20: DLL tracking error versus Doppler frequencies fD for different integration periods T when the sampling frequency is a non-integer multiple of the nominal code rate 52

Figure 2.21: Code chip selection versus jitter values with M=4, where Triangle, circle, and diamond dots indicate samples belonging to (k−1)th, kth , and (k+1)th chips, respectively 54

Figure 2.22: Correlator shapes versus different jitter techniques for GPS L1 C/A signal, where τ runs in the range [−Tc,Tc] with step interval =10−3Tc, fs=4.092 MHz, fD = 0 Hz, βr = fs and θNCO(0) = 0.125 55

Figure 2.23: Pseudo-code algorithm that can be used to implement jittering solution on SDR receiver 56

Figure 2.24: The results after applying the mitigation technique 57

Figure 2.25: Antenna array configuration 59

Figure 2.26: Post-correlator beamforming receiver architecture [30] 61

Figure 2.27: Scatter diagram of the tracking output of the satellite PRN01 at 4 elements 62 Figure 2.28: Estimated position of elements (East-North) 64

Figure 2.29: Estimated position of elements (Up) 64

Figure 2.30: Element patterns utilized for simulation (East-North) 65

Figure 2.31: The C/N0 of the satellite PRN 1 65

11

Figure 2.32: Multipath error 67

Figure 3.1: The architecture of antenna array based GNSS receiver 69

Figure 3.2: Time difference between 2 elements 71

Figure 3.3: Navigation message 71

Figure 3.4: The architecture of the system to determine the phase offset 72

Figure 3.5: The impact of clock phase shift 73

Figure 3.6: The loop filter using for estimating the clock drift 74

Figure 3.7: The estimated frequency shift using the loop filter 74

Figure 3.8: The scatter plot of the signal after mitigating clock phase shift 75

Figure 3.9: The 3-elements antenna array frontend modified from turner RTL2832Us 76

Figure 3.10: The setup of the verification of the frontend using a GPS simulator 77

Figure 3.11: Tracking output of satellites in view 77

Figure 3.12: 𝑪/𝑵𝟎 of the satellite PRN 09 for the received signal at every element and beamed signal 78

Figure 4.1: The architecture of the GNSS grabber 80

Figure 4.2: The flowchart of the grabber firmware 81

Figure 4.3: Acquisition search space 82

Figure 4.4: Probability of Detection w.r.t 𝑪/𝑵𝟎 with 𝑷𝒇𝒂 = 𝟏𝟎 − 𝟑 84

Figure 4.5: FFT-based acquisition 84

Figure 4.6: Snapshot solution diagram 88

Figure 4.7: Traditional loosely-coupled GPS/INS integration 90

Figure 4.8: INS mechanization [3] 94

Figure 4.9: Tightly-coupled integration scheme 96

Figure 4.10: The prototype of GNSS grabber 98

Figure 4.11: Acquisition result of the grabbed signal 98

Figure 4.12: The position converged after 7 iterations 100

Figure 4.13: The positioning accuracy of the proposed solution 101

Figure 4.14: Power consumption comparison of our proposed solution and Ublox LEA 6T 102

Figure 4.15: The experiment setup 102

12

Figure 4.16: GNSS Snapshot/INS integration result 103Figure 4.17: Positioning performance between GNSS Snapshot and GNSS Snapshot/INS Integration 103

13

INTRODUCTION

Nowadays, GNSS receivers have become core components in many applications ranging from vehicle navigation to unmanned vehicle guidance, from location-based services to environment monitoring Besides providing position information for many applications, GNSS services also provide a highly precise timescale for synchronizing systems such as telecommunication and network Hence, the performance of GNSS which have considerable influence on the operation of these services must be guaranteed In [1] a list of four parameters of GNSS performance is reported: accuracy, availability, continuity, and integrity Recently, the accuracy of GNSS has been significantly improved with the development of new navigation systems (Galileo-European system and BEIDOU-Chinese system) and the modernization of the existing navigation systems GPS and GLONASS However, GNSS services are seriously being threatened by the emergence of jamming and spoofing threats

Because GNSS signals are buried under ambient noise, the signals and services of GNSS systems are highly sensitive to interference such as radio frequency interference, jamming and spoofing; meanwhile, the quality of such services is not guaranteed to the conventional users Technically, the GNSS signal is transmitted from satellites away from Earth (about 20.000 km), so when it comes to receivers, the signal power is smaller than the background noise about 1024 times (26dB) [2] Therefore, any source of interference (jammer, digital terrestrial communication systems, ionosphere scintillation) may reduce the quality of the received signal, which in turn can disable the operation of the receiver In addition, because the GNSS systems are often under the management of military based organizations [3] [4] [5], the open services (e.g., GPS L1 C/A, Beidou B1, GLONASS L1OF) are provided to users without any guarantee of their reliability and continuity However, ensuring reliable and continuous position and time information is essential in modern GNSS receivers To meet these requirements, receivers must make use of advanced techniques to detect and mitigate interferences so that they can provide the requested continuous position and time information These techniques are called “interference mitigation techniques”

In recent studies [6] [7] reflecting the state of the art, interference mitigation techniques can

be classified according to the position of the algorithm within the processing stages of GNSS

receiver chain In short, they are classified into three groups namely antenna array

processing techniques, frontend and digital signal conditioning-based techniques, and correlator/tracking and PVT based techniques

Antenna array signal processing technique: A popular method for robust GNSS receiver

performance consists in using multiple physical antenna elements which constitute a called antenna array This technique has been studied since the 1940’s and has been widely used in radar and telecommunications applications [8] [9] [10] [11] Recent studies exploited this technique for GNSS applications considering it as an effective method to mitigate

so-14

interference However, conventional antenna array-based processing leads to complicated and expensive systems, and it is not suitable for mobile receivers [12] [13] [14] Although there are several efforts to design low-cost antenna array for GNSS applications [9] [10], issues involved to the implementation in a GNSS receiver still exist While 2 bits of quantization in ADC, have been proved to be enough for GNSS receivers [15], however it makes the GNSS receivers less robust to threats due to the saturation of the ADC against the high power of the interference Also, expanding the number of antenna elements is a challenge due to the limited interface bandwidth To overcome those limitations, the signal from elements can be independently grabbed first and then their signals are synchronized In this approach, synchronization becomes the vital process to be performed before combining the signals from the array Thus, the design of robust calibration algorithms that corrects for the time, phase and frequency mismatch among array data becomes a necessity To estimate the phase difference between elements, we can use least squares and maximum likelihood such as [16] [17] Phase calibration of antenna arrays can also use the live-sky GNSS signal [18] [11] Regarding time offset estimation, there are some studies in telecommunication field which address the issue using the correlation technique [41] [42] However, those studies assume that the power of the interested signal is much higher than ambient noise Therefore, the assumption may not hold true when GNSS signals are involved

Frontend and Digital Signal Conditioning based techniques: In this second group of

interference mitigation techniques, some unusual properties of interference signals such as high power, spectrum shape, raw sample distributions are used for interference detection While [19] proposed the use of AGC to detect jamming signal, [15] uses this information to

detect a spoofing repeater Although this is considered as a promising technique in detecting

jamming and simplistic spoofing, the information needed for its implementation is not always available in commercial frontends On top of this, for what concerns the application

to spoofing detection, since this technique observes the sudden change in the receiver power,

it is useful only if it monitors the signal before the occurrence of a spoofing attack In more complicated spoofing scenarios, the technique cannot differentiate the spoofed signal from the real signals because the spoofed signals are mimicking the properties of the authentic signals While the frontend-based techniques are only for interference detection, the digital signal conditioning-based techniques are useful in minimizing the effect of interference Among the techniques of this second group, pulse blanker and notch filter have shown that they can improve several dB after jamming mitigation [20] [21] However, as mentioned above, this technique cannot apply to spoofing mitigation because spoofing signal properties

are analogous to those of authentic signals

Correlator/Tracking and PVT based techniques: Like the second group of interference

mitigation techniques, these techniques rely on the detection of abnormal outputs in correlator or PVT in order to identify the presence of interference Take C/N0 monitoring

15

technique as an example This technique is based on the abnormal power of the interference However, it uses the carrier to noise ratio information instead of absolute received signal power using in the second group of interference mitigation techniques In PVT based techniques, the consistent check or cross check will guarantee the reliable information in PVT stages (i.e., pseudorange, ephemeris data) A typical technique in this group is Receiver Autonomous Integrity Monitoring (RAIM) Although it is proved to be effective to detect failures in pseudorange measurement [22] [23], the measurement is available only if the tracking stage is without loss of lock The requirement cannot be guaranteed under powerful jamming attack which aims to cause the receiver complete loss of lock Therefore, to guarantee the availability of a PVT solution, recent studies have suggested to adopt a coarse time positioning solution for coping with environments affected by interference It is considered as an efficient method that can be applied to an area where the continuous GNSS signal tracking is not guaranteed due to interference [24] [25] Compared to traditional receiver, the positioning performance of this technique is less precise Recent studies have been improving its positioning performance on the GPS L1 snapshot receiver [26] [27] [28] but the use of multi-constellation and INS integration in snapshot receiver has not been explored sufficiently in previous works

Another difficulty during the design and implementation of interference mitigation techniques is the performance evaluation and verification process Currently, these processes can be done using either live-sky GNSS signal [29] or GNSS simulator signal [30] The first approach is straightforward to implement, but it is difficult to control the environments along with GNSS signals Therefore, the latter is the method being used favorite now However, there are existing limitations with the use of GNSS simulators available in the market for SDR based study Because the input data of the study is the digitalized IF signal, in order to grab such kind of data we need to use a grabber frontend which may include unavoidable errors, moreover, the performance of the SDR based receiver are strongly affected by the sampling frequency so the chosen value should be considered carefully during simulation

Motivation

From the above analysis, advanced processing techniques for resilient positioning and timing are essential in modern GNSS receivers Therefore, goal of this work is to propose techniques to overcome the existing limitations in antenna array processing and snapshot processing for modern GNSS receivers The proposed techniques not only reduce the implementation cost but also leverage the distributed data processing ability

Scope of Research

The work mainly focusses on antenna array processing technique and snapshot technique for modern multi-GNSS receivers While the first technique enables designing and implementing a low-cost antenna array for GNSS applications, the second technique can provide reliable position and time information in strongly interfered environment Remark

16

also that all the simulations through the dissertation are performed with the data generated from a software-based GNSS simulator The design and implementation of this simulator are also part of this thesis The approach to these techniques is based on SDR technology where the signal processing chains are implemented by means of software on a personal computer before deploying to the FPGA

Methodology

For this study, the following approach is adopted First, relevant literature and studies are reviewed to get in-depth knowledge of interference mitigation techniques Also, the processing chains in GNSS receivers (i.e., acquisition, tracking and PVT computation) are reviewed Second, solutions are proposed to address the existing issues in the implementation of modern GNSS receivers Finally, the obtained result is analyzed, processed and checked against information obtained from literature and previous studies

Contribution

As mentioned above, the study focuses on proposing solutions to address the two main issues: the use of low-cost antenna array to detect GNSS threats and the use of multi-GNSS snapshot positioning technique for discontinuous GNSS signal environment

Regarding antenna array signal processing technique, the work has proposed the synchronization mechanism that enables the use of low-cost antenna array processing in GNSS field Theoretical and empirical results show that this is a promising solution that will not only reduce deployment costs but also be a flexible solution for expanding the number

of antenna elements

As for the second issue addressed, the thesis proposes an integrated model of a multi-system snapshot receiver with an inertial positioning system (INS) Theoretical and experimental results have shown the superiority of performance of this solution over the use of solutions exploiting only single GNSS systems This integrated model is particularly suitable for environments where GNSS signals are intermittent

The results presented in this thesis have been published in 6 conferences and 5 journals as listed in the attachment The works have been carried on at Hanoi University of Science and Technology (Vietnam) and at Politecnico di Torino (Italy)

Thesis outline

The thesis is organized in 4 chapters as follows:

Chapter 1 – Fundamental Background: In this chapter, the background knowledge related to the stages of GNSS receiver architecture including acquisition, tracking and data demodulation, and position computation are revised Also, this chapter show state of the art

of the interference mitigation techniques The limitations of existing works in the

a solution enabling the extension of the number of elements and the quantization bits It is applied in a low-cost antenna array for detecting the source of spoofing and interference Chapter 4 – Snapshot Signal Processing for GNSS Receivers: This chapter shows how the multi-constellation snapshot technique can be effectively implemented In addition, to improve positioning performance, the snapshot GNSS/INS integration is proposed

18

1 FUNDAMENTAL BACKGROUND

This chapter provides the overview of relevant theory for the thesis As pointed out in the previous sections, the thesis mainly focuses on the array processing and Snapshot positioning for modern GNSS receivers under threats Therefore, this chapter first provides the principle

of GNSS positioning and history and development of existing GNSSes Then, the brief introduction of emerging threats is provided Finally, the processing chains in GNSS receivers are fully described

1.1 GNSS positioning principle

This section will explain the general principle of GNSS navigation Basically, GNSS positioning is based on trilateration techniques In this technique, the receiver firstly determines the distance from its position to at least three known points After that, the receiver’s position is determined by the intersection of 3 spheres (Figure 1.1)

Figure 1.1: Satellite navigation principle

Let 𝐮 = [𝑥𝑢 𝑦𝑢 𝑧𝑢] and 𝐱𝑖 = [𝑥𝑖 𝑦𝑖 𝑧𝑖] be the position of the receiver and of the satellite i The geometry distance from the receiver to satellite is defined as 𝑟𝑖 = ||𝐮 − 𝐱𝑖|| Clearly, the vector 𝐮 can be determined if we know the satellite position 𝐱𝐢 and the distance

𝑟𝑖 with i=1,2,3

In GNSS receivers, the distance cannot be measured directly but it uses the transmission time from satellite to receiver Unfortunately, the receiver clock is not synchronized with the atomic clocks onboard of GNSS satellites As a result, we have one more unknown variable 𝛿𝑡𝑢 besides 3 unknown elements of 𝒖 With 4 satellites, the equations in these four unknowns are as follows:

CHAPTER 1

where c is the speed of light

When considering the other errors (e.g., ionospheric, tropospheric), we have the complete form of the equations [31]

Denote vector solution 𝒙 = [𝒙𝒖 𝒚𝒖 𝒛𝒖 𝜹𝒕𝒖] and using the first order of Taylor expansion as an approximate for every equation as follows:

1.2 History and development of GNSS

The first GNSS is the Global Positioning System (GPS) The project was approved by the United States Department of Defense in 1973 When the system was fully operational in

1995, its constellation consisted of 24 satellites spreading in 6 orbit planes The current

With the objective of being the first civilian GNSS, Galileo project was approved by European Space Agency in 2002 When fully deployed, the system will consist of 27 operational and 3 spares satellites in 3 circular Medium Earth Orbit (MEO) Galileo signals are transmitted in 4 frequency bands: E1 (1575.42MHz), E5 (1191.795 MHz), E5a (1176.45 MHz), E5b (1207.14 MHz) and E6 (1276.75 MHz) [32]

In 2000, China launched the first satellite of Chinese satellite navigation system (Beidou-1) The coverage of the system was limited to China and neighboring regions The second generation Beidou system became operational in 2011 with 10 satellites in orbit It is designed to have 5 geostationary Earth Orbit (GEO) satellites, 27 Medium Earth Orbit (MEO) satellites, and 3 inclined geosynchronous satellite orbit (IGSO) satellites The Beidou signals are transmitted in three bands: B1 (1559.052 – 1591.788 MHz), B2 (1166.22 – 1217.37 MHz), and B3 (1250.618 – 1286.423 MHz) [4]

1.3 GNSS Threats

To operate GNSS services in a reliable way, understanding the growing threats to satellite navigation signals is essential Since the signal power is extremely weak, GNSS signals can easily be disrupted by emerging threats which can be divided into 2 categories: natural (i.e., multipath and atmosphere) and man-made threats (interference, spoofing, GNSS segment errors, and cyber-attacks) [33] (see Figure 1.2)

Figure 1.2: Typical GNSS Threats

21

1.3.1 Multipath

The error is well-known and is source of problems not only in GNSS but also in the radio telecommunication field It is caused by reflection: the GNSS signals are reflected by high building or objects and cause large error if the receiver tracks the reflected signal instead of the line-of-sight signal Multipath is one of the most significant challenges amongst natural threats and can cause errors of several to hundreds of meters in positioning performance

1.3.2 Atmosphere

Before reaching GNSS receivers, GNSS signals must pass through the atmosphere with all its variations While the troposphere layer only causes small changes in signal phase and amplitude, the ionosphere causes more serious errors, particularly during periods of intense solar activity Perturbation in the ionosphere around the equator and the two poles, which is the so-called scintillation - can cause GNSS signal disruptions or very rapid changes in phase and amplitude of the signal Thus, a GNSS receiver will be loss of lock if it has not a robust engine

1.3.3 Interference

The simplest form of jamming consists in transmitting a specific signal or noise to cause GNSS receiver overload or loss of lock The attack is sometimes unintentional High power harmonics from radar systems, TV radios, VHFs, mobile satellite services and personal electronics can inadvertently interfere with the GNSS signal

Recently, with the advent of hand-held GNSS jammers, GNSS signals within a radius of a some tens of meters are completely disrupted The operating principle of these devices is to use a chirp signal to intervene in the operating frequency range of the GNSS signal There are currently no effective methods to minimize the impact of this type of attack

1.3.4 Spoofing

GNSS spoofing is a kind of attack that deceives a GNSS receiver by transmitting a fake GNSS signal with false information or by transmitting the genuine signal grabbed elsewhere

or at another time These counterfeit signals modify the navigation message and code phase

in such a way that the receiver estimates its position somewhere else than in its actual position, or in the correct position but at another time A common form of GNSS spoofing attacks begins broadcasting signals synchronized with the genuine signals The power of the counterfeit signal is then gradually increased to dominate the genuine signal As a result, the GNSS receiver cannot realize the change and completely tracks the counterfeit signals

1.3.5 GNSS Segment errors

The GNSS system can fail even without human intervention The satellite onboard atomic clocks sometimes generates cumulative errors before informing users On 1st January 2004, the error on GPS SVN-23 satellite caused a range error of up to 300 km

1.4 GNSS Receiver Architecture

1.4.1 Signal Conditioning and Sampling

The architecture of the signal conditioning and sampling is illustrated as in Figure 1.3

In this stage, the received signal is conditioned to meet the requirement of the sampling process For simplicity, consider the GPS L1 signal from a satellite:

23

1.4.2 Acquisition

The acquisition stage is aimed to roughly estimate the code phase and Doppler shift of visible GNSS satellites In fact, the stage performs correlation with every Doppler frequency and code phase bin in the search space (Figure 1.4) A satellite is considered as visible if there is the value of a cell in the search space higher than a specified threshold The code and frequency corresponding to the cell is the output of the acquisition The selected threshold must be considered carefully because it is related to the number of satellite in use that is proportional to the accuracy of the solution

coherent Integration FFT-based Acquisition

Non-Carrier NCO

90

Code NCO FFT ()*

x[n]

*j

Figure 1.4: Acquisition Architecture

1.4.3 Tracking and Data Demodulation

After the acquisition, the receiver has roughly code phase and Doppler frequency of every satellite in view However, those parameters are changing over time due to the change of the relative position between the satellite and receiver The tracking stage is aimed to keep track the replica local code and carrier and the received signal with the Delay Lock Loop (DLL) and Phase Lock Loop (PLL)

Figure 1.5: Tracking Architecture

24

Similar to acquisition stage it performs mixing the received signal with the replica code and carrier The PLL wipes off the carrier [31] and the DLL align the local and incoming PRN codes The signal after the direct digital frequency synthesizer (DDFS) is down-converted

to baseband and is ideally contained in only the in-phase (I) channel The DLL tracks the time delay of the incoming PRN The baseband signal is correlated with 3 local replica code-taps: Early (E), Prompt (P), and Late (L), through multiplication and integration, usually over an integer PRN code period (T0) Discriminator feedbacks adjust the Code NCO, which fluctuates the local replica code rate to synchronize with the incoming code [34]

1.4.4 Positioning Computation

Positioning computation is performed with the assumption that the received signal is acquired and tracked successfully from a minimum of four satellites in view After navigation message demodulation, the receiver can determine the received time and the position of all satellites in view To apply (1.1), the receiver needs to measure the distance from the receiver to all satellites In GNSS receivers, the quantity cannot be directly calculated but it is derived through the transmission time It is worthy to note that the convergence solution of (1.6) will not change if a constant value is added to all pseudoranges Therefore, the receiver will calculate the difference between transmission time instead of the absolute value The differences are computed by counting the number of sample intervals since the receiver started to the preamble bits in the same subframe for all satellites (Figure 1.6)

Figure 1.6: Transmission time estimation in GNSS receivers

25

1.5 Countermeasures to GNSS Threats

This section presents the state of the art of antenna array processing techniques, frontend

and digital signal conditioning-based techniques, and correlator/tracking and PVT based techniques (see Figure 1.7) The implementation of antenna array and snapshot positioning

are more emphasized because they are main focuses of the dissertation

Figure 1.7: Interference mitigation techniques in GNSS receivers

1.5.1 Antenna array processing techniques

With the spatial diversity setting by multiple elements, antenna array processing techniques are considered as a powerful tool for interference mitigation in GNSS applications [35] [36] [37] [38] From an application point of view, the antenna array processing techniques can be used to either suppress interference effect or localize the interference source

Regarding interference mitigation, although the specific implementation varies between techniques, the existing methods in this group can be classified based on the optimization criteria for calculating optimal weights

Minimum Mean Square Error Criterion: The technique was first proposed by [39] and aims

to minimize the mean square error between the output of the array 𝒙(𝑡) and the interested signal 𝑑(𝑡)

where 𝒘 is the weighting coefficients vector, 𝒙(𝑡) is the vector of the received array signals

It is straightforward to derive the solution to the problem in (1.9)

26

In the implementation the referent signal is actually the local code and the navigation bits in the tracking stage [30] However, the navigation bits are not available under strong interference Hence, this technique is suitable for weak interference environment

Signal to Interference plus Noise Ratio Criterion:

Problem

max𝒘

𝒘𝑇𝑹𝑠𝑠𝒘∗

𝒘𝑇𝑹𝑖𝑖𝒘∗+ 𝒘𝑇𝑹𝑛𝑛𝒘∗

(1.11)

Power Inversion Criterion:

With the assumption that the received signal is weaker than the interference, this technique

is proposed to null the stronger signal [40]

𝒘 𝐸{[𝒘𝑇𝒙(𝑡)]} subject to 𝒘𝑇𝒇 = 1 (1.13)

Beam Steering Criterion:

This technique merely maximizes the array gain following the direction of the interested signals

Null Steering Criterion:

Similarly, the null steering will minimize the gain in the direction of interference In [41], this technique can be used to suppress GNSS interference effectively The optimal criterion and weight vector is given as follows:

27

In principle, the implementation of those frontends relies on the traditional architecture for digital antenna array shown in Figure 1.8

Figure 1.8: The traditional low-cost architecture of antenna array for GNSS applications

In this implementation, raw samples are interleaved into a packet and transfer to signal processing chains Clearly, the raw samples from elements are synchronized and they just need a little effort in calibration to make the frontend work properly However, due to the limitation of the interface bandwidth, both the number of elements and quantization bits are limited Take [43] as an example, a packet sent to the signal processing chains is formed as shown in the right plot of Figure 1.8 and the sampling frequency is set to 16.368MSps and using USB 2.0 with 60 MB/s of bandwidth As a result, the frontend will be limited to maximum 15 elements In addition, the implementation requires a powerful PC for grabbing raw samples from the frontend Therefore, the solution is not very appropriate for mobile receivers

Another approach is to utilize the separated frontends with a common oscillator In this approach, the synchronization process is moved to the signal processing chains Besides, the solution leverages the power of the distributed data processing In other words, the solution relaxes the dependence of the element properties (i.e., sampling frequency, quantization bits)

on the interface Consequently, it enables expanding the number of elements to infinite number theoretically However, the greatest challenge in implementing this solution is how

to effectively synchronize elements In telecommunication, there are some efforts to address the issues with the correlation technique [44] [45] The correlation in time domain is used for delay analysis The function plots the similarity between signals for all possible lags

28

However, due to the unique properties of GNSS signals (i.e., using spreading code, weak received power), the technique cannot be applied in those signals Figure 1.9 shows the correlation of received signals between 2 elements Although the time lag is set to zero in this experiment, there is no visible peak at 0 in time lag

Figure 1.9: The correlation between 2 GPS signal grabbed by antenna array

Hence, one of the main focuses of this dissertation is to propose an effective technique to self-synchronize the elements without the use of any external sources

1.5.2 Frontend and Digital Signal Conditioning based techniques

The frontend-based techniques utilize the abnormal characteristics of interference such as

high power, spectrum shape, raw sample distributions for interference detection There are several studies exploited AGC information for detecting jamming and simplistic spoofing attacks [15] [19]

Figure 1.10: Spectrum and histogram of GNSS signal in the absence of interference

29

However, such information is not always available in commercial frontends Therefore, several works proposed the use of spectrum and histogram of raw samples in detecting interference In interference absence condition, GPS signal spectrum is shaped by the frontend filter and the histogram shape is like a Gaussian distribution (see Figure 1.10) The shape of the histogram is related to the fact that the received signal is dominated by white ambient noise [34]

While the frontend-based techniques are only for interference detection, the digital signal conditioning-based techniques are effective in minimizing the effect of interference Among the techniques of the second group, pulse blanker and notch filter have shown that they can improve several dB after jamming mitigation [20] [21] However, the technique is not effective in spoofing mitigation because the counterfeit signals are analogous to the authentic ones

1.5.3 Correlator/Tracking and PVT based techniques

Like the above techniques, the correlator-based techniques (e.g., C/N0 monitoring) is also based on the unusual properties of the received signal However, it uses the carrier to noise ratio information instead of absolute received signal power

In PVT based techniques, Receiver Autonomous Integrity Monitoring (RAIM) is proved to

be effective to detect failures in pseudorange measurement [22] [23] However, the measurement is available only if the tracking stage is without loss of lock The requirement cannot be guaranteed under jamming attack which aims to cause the receiver loss of lock Therefore, recent studies have devoted some efforts to adopt the coarse time positioning for interference environment

Figure 1.11: Snapshot positioning architecture

[27] introduces a technique, namely snapshot positioning In this technique, a user is equipped with a GNSS data grabber, which collect GNSS signal on site The dataset is then transmitted to a server (see Figure 1.11) At the server side, the available GPS data (provided

by another GPS receiver) and the received dataset are used together to compute the position

of the user In this technique, the most difficult tasks – signal synchronization and position computation – are performed at the server side, whereas on the user side, only a simple GPS data grabber with a communication modem is needed By this way, the computational requirement at the user side is relaxed, and eventually, the power consumption is reduced significantly Although snapshot receiver was first proposed by NASA [27] in 1997, it has

To overcome that distance limitation, recent studies, which propose feasible designs of snapshot receivers for mobile computing [46] [47] use the position of the base stations of the cellular network as the prior solution However, due to the policy of telecommunication companies, that information of base stations is also not always provided The work in [3] uses the Doppler positioning method in order to provide the prior solution for the snapshot positioning Although the Doppler positioning is not so precise, however, that level of accuracy already satisfies the 150-km-requirement However, the architecture in [28] requires the fine estimation of code delay Therefore, the tracking process is mandatory, this leads to power consumption due to the correlation computation

Besides the signal processing part which is already relaxed by the snapshot technique, the communication part needs to control the power consumption also Therefore, the size of the dataset must be reduced as much as possible to meet that requirement In literature, the GPS data grabbers use 2 bits for quantization, with the sampling frequency of 2.046 MHz The sampling frequency has an important impact to the accuracy of the positioning and cannot

be reduced due to the Nyquist criterion Meanwhile, the number of quantization bits has impact on the sensitivity of the positioning, which can be compensated by extending the integration time In addition, in the viewpoint of hardware design and implementation, the 1-bit data stream is much simpler and more stable than the 2-bit one since the Serial Peripheral Interface (SPI) interface, which is a fast data transfer protocol, can be used directly in 1-bit stream to facilitate the data transfer between the frontend and the microprocessor

1.6 GNSS Simulator and effect of sampling frequency

As mentioned in section Scope of Research, this work focuses on software-based processing techniques Therefore, all research starts from the digitalized intermediate frequency signal Compared to hardware-based simulator, a software simulator is an efficient way to generate the input signal to the software receiver First, it allows creating various signal conditions for simulation Second, it enables to add new signal features

Several software-based GNSS signal simulators have been developed as reported in the literature [48] proposed the first MATLAB based GPS signal simulator which can provide

a complete GPS signal simulation ranging from signal properties (e.g., signal power, pseudorange, Doppler) to satellite constellation However, the solution is very computational expensive due to the simulation of RF signals with the very high sampling frequency

31

Other works related to software-based GNSS simulator do not generate the complete signal waveforms but generate the analytical I and Q samples basing on the assumption that the incoming code and carrier align with the local ones [49] [50] The approach may reduce the computational burden but is less accurate in generating reliable signals for long periods Hence, the development of the GNSS simulator is also carefully considered in this study Amongst the signal parameters, sampling frequency is directly related to the computational burden of the software-based simulator Unfortunately, the sampling frequency is not proportional to the accuracy of the simulated signal from the positioning performance point

of view The effect of sampling frequency on the positioning performance was first mentioned in [51] If the sampling frequency is an integer multiple of the nominal code rate,

it leads to the distortion of the correlation shape and a significant accuracy degradation However, still more efforts are needed to generalize the effects of sampling frequency on GNSS code tracking

32

2 GNSS SIGNAL SIMULATOR DESIGN AND IMPLEMENTATION

Stemming from the need of a flexible simulator which can simulate reliable emerging threats

in GNSS fields (i.e., jamming, spoofing, and interference) beside the properties of a conventional simulator, this chapter presents the design and implementation of a software-based simulator In addition, the chapter generalizes the effect of sampling frequency on the positioning performance to suggest the suitable sampling frequency for simulations Deriving from the mathematical analysis, a proposed mitigation solution is also provided in this chapter and verified with both simulation and live sky signal

Firstly, this chapter will present the modeling methodology of GNSS simulation Then, the effect of sampling frequency and a simple mitigation technique is analyzed carefully from the accuracy performance point of view Moreover, some experiments conducted on both the software receiver and a commercial receiver (i.e., Ublox) will be given in the result section, so validating the adopted models and the simulator performance The achieved results reported in this chapter show that the developed simulator can be considered as a low-cost solution to simulate not only single antenna signals but also antenna array signals The simulator has been used for reliable simulating spoofing and interference (e.g., multipath) [52]

2.1 Modeling methodology

2.2 Overview of the modeling of antenna array signals in GNSS receivers

To model antenna array signals, we assume that a far-field signal (a GNSS signal or narrowband interference) impinges a GNSS receiver in the direction expressed by the azimuth and elevation angles (𝜙, 𝜃) Thus, the unit vector of the incoming signal can be written as:

𝒂𝑠 = [sin(𝜃) cos(𝜙) sin(𝜃) sin(𝜙) cos(𝜃)] (2.1)

We also assume that the first element of the array is at the origin of the coordinate system

(Figure 2.1) Hence, the delay between the mth element and the first element can be

expressed as the propagation delay in the direction of the incoming signal from the origin to

the wavefront passing through the mth element [53] The delay in meters is

Δ𝜌𝑚 = 𝒑𝑚⋅ 𝒂𝑠(𝜃, 𝜙) = 𝑋𝑚sin(𝜃) cos(𝜙) + 𝑌𝑚sin(𝜃) sin(𝜙) + 𝑍𝑚cos(𝜃) (2.2)

where 𝒑𝑚 = (𝑋𝑚, 𝑌𝑚, 𝑍𝑚) is the position of the 𝑚th element

CHAPTER 2

where c is the speed of light

2.2.1 General model of the received signal in GNSS receivers

Figure 2.2: The model of the received signal for a single antenna

The received signal at the 𝑚th element can be considered as the combination of the sight (LOS) signals, multipath signals, ambient noise and interferences (intentional or unintentional) (Figure 2.2) It can be expressed as

line-of-𝑅𝐿1𝑚(𝑡) = ∑ 𝑆𝐿1,𝑘𝑚 (𝑡)

𝑁

𝑘=1

+ ∑ 𝑆𝑀𝑃,𝑘𝑚 (𝑡)𝑀

34

where:

𝑅𝐿1𝑚(𝑡) is the composite signal at the element m

N, M and K are respectively the number of LOS signals, multipath signals and interferences

𝑆𝐿1,𝑘𝑚 (𝑡) is the L1 LOS GPS signal of the 𝑘th satellite at the element m

𝑆𝑀𝑃,𝑘𝑚 (𝑡) is the multipath signal of the 𝑘th satellite at the element m

𝜂𝑚(𝑡) is the ambient noise at the element m

𝐼𝑘𝑚(𝑡) is the kth interference signal at the element m

The received signal is then down-converted to an intermediate frequency and sampled at 𝐹𝑠frequency Such operations are performed by the receiver frontend, whose scheme is shown

in Figure 2.3

Note that, as shown in Figure 2.3, the local oscillators are shared among the channels in order to synchronize them

Figure 2.3: GPS multi-antenna frontend

The developed simulator is able to generate GNSS signals along with the operations of the multi-antenna frontend Therefore, the input of the simulator contains the user trajectory, the navigation files, the filter characteristics, and the profiles of signal power, multipath, and interference The output of the simulator is the digitalized signals at each element of the antenna array The flowchart of the simulator’s operation is shown in Figure 2.4

35

Figure 2.4: Flowchart of the simulator

As illustrated in Figure 2.4, the simulator contains three main processing blocks, namely: propagation delay computation, navigation message encoding, and digitalized signal generation The first block computes the propagation delay between the visible satellites and the receiver, and the ionospheric and tropospheric delays The second block encodes the navigation messages The last block synthesizes the given information data and generates the LOS and NLOS signals, interference, and noise

GPS signals

The analytical model of the 𝑘th GPS signal at the 𝑚th element can be written as follows:

𝑠𝑘𝑚(𝑡) = √𝑃𝑠,𝑘𝑚𝐶(𝑡 − 𝜏𝑘)𝐷(𝑡 − 𝜏𝑘) × exp (𝑗(2𝜋(𝑓𝐿1+ 𝑓𝑑,𝑘)𝑡 + Φ𝑘+ Φ𝑘𝑚)) (2.5)

where:

𝑃𝑠,𝑘𝑚 is the received signal power of the 𝑘th satellite at the element m

𝜏𝑘 is the propagation delay of the satellite k

𝑓𝑑,𝑘 is the Doppler frequency of the satellite k

Φ𝑘 is the initial carrier phase of the satellite k

Φ𝑘𝑚 is the carrier phase difference between the 𝑚th element and the first element

The quantification of such parameters is given in the following subsections

36

The delay at the 𝑚𝑡ℎ element, expressed as 𝛷𝑘𝑚, is present only in the carrier, since this delay can be neglected in the baseband signals C(t) and D(t) This is resulted from the propagation delay difference between elements that is much smaller than the C/A code length and data bit length

Signal power

According to [30], the gain and phase of each array element depend on the incoming signal direction and frequency However, in the simulator, the gain and phase is expressed as a function of the direction of arrival (DOA) Therefore, the power of the received signal at the 𝑚th element in term of antenna gain can be written as:

where:

𝒂𝑠 is the DOA of the incoming signal,

𝑔𝑚(𝒂𝑠) is the antenna gain corresponding to the DOA of the incoming signal The notation

𝑔𝑚(𝒂𝑠) indicates that the antenna element gain is a function of the signal direction (𝒂𝑠),

𝑃𝑠,𝑘 is the signal power of the 𝑘th satellite in the ideal condition (𝑔𝑚(𝒂𝑠) = 1, ∀𝒂𝑠) The no distortion GPS power (𝑃𝑠,𝑘) can be written in term of 𝐶/𝑁0 as:

𝑃𝑠,𝑘 = 10((𝐶/𝑁0 )𝑘+𝑁 0 )/10 (2.7)

where:

𝑃𝑠,𝑘 is the signal power (W) of the 𝑘th satellite

(𝐶/𝑁 0 )𝑘 is the carrier to noise ratio (dBHz) of the 𝑘th satellite

𝑁 0 is the noise power density (dBW/Hz)

𝑓𝑑,𝑘 is the Doppler frequency of the kth satellite

𝒗𝑘 is the velocity vector of the kth satellite

𝒗𝑢 is the velocity vector of the user

𝟏𝑘 is the LOS vector

where 𝑇𝑘 is the propagation delay taking into account the earth rotation

𝛿𝑡𝑖𝑜𝑛𝑜 is the delay due to the ionospheric layer

𝛿𝑡𝑡𝑟𝑜𝑝𝑜 is the delay due to the tropospheric layer

Initial carrier phase

The carrier phase difference between the element 𝑚 and the first element is as follows:

(2.11)

where:

𝝆𝑚 is the antenna location of the element 𝑚

𝒂𝑘 is the incident angle of the satellite k

2.2.2 Interference

Any signal with frequency components in the GNSS band represents a radio frequency interference (RFI) Many types of RFI signals exist (continuous waves, narrow-band, pulses,

etc ) In the simulator two types of RFI can be selected: continuous wave interference and

band-limited Gaussian interference

A continuous wave interference (CWI), which is one of the simplest forms of interference, can be expressed as follows:

𝐼𝑘𝑚(𝑡) = √𝑃𝑖,𝑘𝑚exp (𝑗(2𝜋𝑓𝑖,𝑘𝑡 + 𝜙𝑖,𝑘 + Φ𝑖𝑚)) (2.12)

where:

𝑃𝑖,𝑘𝑚 is the power of the 𝑘th interference

38

𝑓𝑖,𝑘 is the frequency of the 𝑘th interference

𝜙 𝑖,𝑘 is the initial phase of the 𝑘th interference

𝜙 𝑖,𝑘𝑚 is the phase of the 𝑘𝑡ℎ interference at the 𝑚th element

Note that the phase is evaluated as the GPS signal phase

The limited Gaussian interference can be modelled as a Gaussian noise through a limited filer (Figure 2.5)

ℎ is the receiver altitude concerning the reflected plane

𝐸 is the angle shown in Figure 2.6

2.2.4 Noise

Although the noise may arise from various sources, it mainly depends on the front-end circuitry It is generally modeled as white Gaussian In the case of an array, each front-end introduces an independent white Gaussian noise

2.3 Effect of sampling frequency on the positioning performance

Figure 2.7 visualizes the effect of sampling frequency on the positioning performance In the example, we use 2 GPS datasets with 4.092MSps and 4.093MSps in sampling frequency They are both processed with the modified software receiver from Akos [2] The positioning error much higher with 4.092MSps in sampling frequency compared to that of 4.093MSps

In this section, we will characterize the effect of sampling frequency on the positioning error through mathematic expression

Figure 2.7: Effect of sampling frequency on the positioning performance