Detection And Localisation Of Radio Frequency

Transcript

Detection and Localisation of Radio Frequency Interference to GNSS Reference Stations By Ryan James Richard Thompson A thesis submitted to The University of New South Wales in partial fulfilment of the requirements for the degree of Doctor of Philosophy School of Electrical Engineering and Telecommunications Faculty of Engineering The University of New South Wales Australia March 2013 1 i Abstract Global Navigation Satellite Systems (GNSS) are increasingly being relied upon in many applications. Reference stations provide corrections to errors inherent in GNSS processing, allowing GNSS to be used in more applications. The GNSS satellite signals are relatively weak and receivers are susceptible to Radio-Frequency Interference (RFI). To maintain the integrity of these reference stations any RFI must be detected and localised quickly. The research presented in this thesis investigates the detection and localisation of RFI using a sensor network. The first part of this thesis investigates RFI detection. For stationary receivers located in a stable environment, variations in the Carrier-to-Noise Density Ratio (C/No) can be used for detection. Weaker RFI can be detected if variations due to multipath are removed as they repeat with each satellite groundtrack. Issues associated with using the Automatic-Gain-Control (AGC) for RFI detection are also investigated. The drift in the AGC due to temperature is characterised and it could be reduced using a gain/temperature model, allowing the AGC to be used for detecting weaker RFI. The second part of this thesis investigates RFI localisation. An analysis using Dilution-ofPrecision (DOP) showed that the Received-Signal-Strength (RSS) technique has potential. RSS performance was evaluated using simulations and real measurements and was found to suffer degradation due to the presence of ground reflections, resulting in the concluding that RSS is not appropriate. Time-Difference-Of-Arrival (TDOA) is another potential localisation method. Different aspects that affect TDOA were investigated, including time synchronization and effect of GNSS satellite cross-correlations. It was found that a number of time-delay measurements could be made before the timing from jammed GPS timing receivers degraded significantly, and that the GNSS satellite cross-correlation peaks make detecting and localising weaker RFI difficult. The explored C/No and AGC techniques are suitable for implementation into a sensor network and could detect weaker RFI using methods proposed in this thesis. For RFI localisation, TDOA was found superior to the RSS but some issues were found concerning weak RFI. The effectiveness of TDOA was demonstrated in a prototype system with real RFI and performance could be improved through an offline time synchronisation technique. ii Acknowledgements My greatest thanks go to my supervisor Andrew Dempster who sparked my initial interest in this research area as an undergraduate student and gave me the opportunity to pursue my interest further. Next my thanks go to my co-supervisors Asghar Tabatabaei Balaei and Ediz Cetin who have provided close supervision and motivation over the course of my PhD. Thanks are also be given to Jinghui Wu for co-supervision during an interim part of the thesis. This research was undertaken as part of a partnership with the University of Adelaide and an industrial sponsor GPSat Systems. At the University of Adelaide I would like to thank Doug Gray and Mathew Trinkle. Special thanks are given to Mathew Trinkle for his supervision and motivation during the parts of this thesis undertaken in Adelaide. Gratitude is also given to Mark Knight for giving me the opportunity to collect real field trial data with live signals while in Adelaide. I would also like to thank Graeme Hooper and GPSat Systems for their contributions to the project and their willingness to provide equipment for use during experimentation. During my studies there have been a number of other people I must thank for support with theory and experimentation during this project, including Peter Mumford, Binghao Li, Eammon Glennon, Nima Alam, and Peter Leech from the School of Surveying and Geospatial Engineering. I would also like to thank the many members of the SNAP group for their friendship and support during my studies. My work was sponsored through an APAI-Linkage scheme so I give thanks to the Australian Government, the University of New South Wales, the University of Adelaide, and the industrial sponsor GPSat Systems, for providing funding to cover my research and living costs. I am also grateful for the funding I received to attend a number of conferences, including IGNSS 2009, IGNSS 2011, PLANS 2012, and ION 2012. Finally I would like to thank my family and all of my other friends for their support, without which I would not have been able to complete this thesis. iii Table of Contents Abstract ............................................................................................................................................ ii Acknowledgements ......................................................................................................................... iii Table of Contents ............................................................................................................................ iv List of Figures .................................................................................................................................. x List of Tables ................................................................................................................................. xx List of Abbreviations .................................................................................................................... xxi Chapter 1 Introduction ..................................................................................................................... 1 1.1 Vulnerability of Civilian Infrastructure to GNSS outages ..................................................... 1 1.2 Research Motivation .............................................................................................................. 2 1.3 Contributions ......................................................................................................................... 3 1.3.1 Carrier-to-Noise Density Ratio (C/No) ........................................................................... 3 1.3.2 Automatic Gain Control (AGC)...................................................................................... 3 1.3.3 Cross-Correlation ............................................................................................................ 3 1.3.4 Received Signal Strength (RSS) ..................................................................................... 4 1.3.5 Time Difference of Arrival (TDOA) .............................................................................. 4 1.4 Thesis Structure ..................................................................................................................... 5 1.5 List of Publications ................................................................................................................ 6 Chapter 2 Background ..................................................................................................................... 9 2.1 Introduction ............................................................................................................................ 9 2.2 Global Navigation Satellite Systems...................................................................................... 9 2.2.1 Ground-Based Reference Stations .................................................................................... 11 2.3 The Threat of Radio-Frequency Interference....................................................................... 13 2.3.1 Sources of Interference ................................................................................................. 14 2.3.2 Case Studies of Interference ......................................................................................... 16 2.3.3 Interference Effects ....................................................................................................... 17 iv Table of Contents 2.4 Interference Detection .......................................................................................................... 21 2.4.1 Hardware Techniques ................................................................................................... 21 2.4.2 Pre-Correlation .............................................................................................................. 23 2.4.3 Post-Correlation ............................................................................................................ 24 2.5 Interference Mitigation ........................................................................................................ 25 2.5.1 Hardware Techniques ................................................................................................... 25 2.5.2 Pre-Correlation .............................................................................................................. 26 2.5.3 Baseband Processing ..................................................................................................... 27 2.5.4 Post-Correlation ............................................................................................................ 27 2.5.5 System-Level ................................................................................................................ 28 2.6 Interference Localisation ..................................................................................................... 28 2.6.1 Network-based Localisation ......................................................................................... 29 2.6.1.2 Time Difference of Arrival ........................................................................................ 32 2.6.1.3 Received Signal Strength ........................................................................................... 34 2.7 Summary and Conclusion .................................................................................................... 36 Chapter 3 Detection of RFI to GNSS Using C/No differences...................................................... 37 3.1 Introduction .......................................................................................................................... 37 3.2 Carrier to Noise Density Ratio (C/No) ................................................................................ 38 3.2.1 C/No Estimation............................................................................................................ 39 3.2.2 Noise Density Estimation ............................................................................................. 40 3.3 Comparison between pre-No and post-No with RFI............................................................ 43 3.3.1 Effect of Integration Time............................................................................................. 44 3.3.2 Noise-Density With Synthetic Data .............................................................................. 45 3.4 Detection of RFI using C/No. .............................................................................................. 47 3.4.1 ∆C/No Detection ........................................................................................................... 47 3.5 UNSW Experiment .............................................................................................................. 54 3.5.1 C/No Repeatability........................................................................................................ 54 v Table of Contents 3.5.2 Statistical Properties of ∆C/No Measurements ............................................................. 55 3.5.3 Day Separation .............................................................................................................. 56 3.5.5 False Alarm Performance.............................................................................................. 57 3.5.5 Receiver Response to RFI ............................................................................................. 58 3.5.5 Experiment Results with added RFI. ................................................................................ 60 3.6 ∆C/No for Multi-GNSS ....................................................................................................... 63 3.6.1 C/No for GPS ................................................................................................................ 63 3.6.2 C/No quantization effects ............................................................................................. 64 3.6.3 False Alarm Performance.............................................................................................. 65 3.6.5 C/No for GLONASS ..................................................................................................... 66 3.6.7 Comparison between GPS and GLONASS .................................................................. 68 3.6.8 Minimum Detectable J/N .............................................................................................. 69 3.7. Summary and Conclusion ................................................................................................... 70 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control .................................................................................................................................. 71 4.1 Introduction .......................................................................................................................... 71 4.2 AGC Operation .................................................................................................................... 72 4.3 Estimation of jammer to noise ratio using AGC values....................................................... 75 4.3.1 σ-sensing AGC.............................................................................................................. 75 4.3.2 Histogram sensing AGC ............................................................................................... 76 4.3.3 Correlation Losses ............................................................................................................ 79 4.4 AGC Stability ...................................................................................................................... 80 4.5 Noise-Floor Estimation ........................................................................................................ 83 4.6 Detection Performance......................................................................................................... 86 4.7 Summary and Concluding Remarks .................................................................................... 88 Chapter 5 Dilution of Precision for Interference Localisation ....................................................... 89 5.1 Introduction .......................................................................................................................... 89 vi Table of Contents 5.2 Dilution of Precision ............................................................................................................ 90 5.3 DOP for Satellite Navigation Systems ................................................................................. 92 5.4 Maximum Likelihood Estimation (MLE) ............................................................................ 95 5.5 Interference Localisation Using DRSS ................................................................................ 97 5.6 Comparison of DOPs ......................................................................................................... 101 5.6.1 Linear Array of Sensors .............................................................................................. 101 5.6.2 Four sensor arrays ....................................................................................................... 107 5.6.3 Five sensor arrays ....................................................................................................... 110 5.7 Summary and Concluding Remarks .................................................................................. 112 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas ............................... 113 6.1 Introduction ........................................................................................................................ 113 6.2 Path loss Models in Range-Based RSS positioning ........................................................... 115 6.2.1 Log-normal shadowing model .................................................................................... 115 6.2.2 Two-ray reflection model............................................................................................ 115 6.3 Position Estimation ............................................................................................................ 117 6.3.1 Position Solution by Least-Squares ............................................................................ 118 6.3.2 Path loss exponent....................................................................................................... 120 6.3.3 Least-squares solver .................................................................................................... 121 6.4 Measuring path loss using Wi-Fi ....................................................................................... 122 6.4.1 Logging RSS from Wi-Fi Devices .............................................................................. 122 6.4.2 Dynamic Test .............................................................................................................. 123 6.4.4 Characterising RSSI Values ........................................................................................ 125 6.5 Field Experiment................................................................................................................ 127 6.5.1 Path loss behaviour ..................................................................................................... 128 6.5.2 Positioning Results...................................................................................................... 130 6.5.3 Comparison of position error with CRLB................................................................... 132 6.5.4 Divergent points .......................................................................................................... 134 vii Table of Contents 6.5.5 Optimal path loss value ............................................................................................... 135 6.5.5 Different Sensor Sets .................................................................................................. 137 6.6 Performance at GPS L1-band ............................................................................................ 138 6.6.1 Path loss comparison between GPS L1 and Wi-Fi ..................................................... 138 6.6.2 Simulations at GPS L1 Band ...................................................................................... 139 6.7 Summary and Conclusions ................................................................................................ 143 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements ................... 145 7.1 Introduction ........................................................................................................................ 145 7.2 Time-delay estimation ....................................................................................................... 147 7.3 GNSS signal cross-correlations ......................................................................................... 148 7.4 Impact on detection ............................................................................................................ 151 7.5 Adaptive detection technique ............................................................................................. 153 7.6 Behaviour for different baselines ....................................................................................... 154 7.6.1 Very small (0.38m) baseline ....................................................................................... 154 7.6.2 Short (100m) baseline. ................................................................................................ 155 7.6.3 Moderate (500m) baseline. ......................................................................................... 156 7.6.4 Long (5km) baseline. .................................................................................................. 157 7.7 Impact on time-delay estimation ........................................................................................ 159 7.8 Summary and concluding remarks. .................................................................................... 161 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions ................................ 163 8.1 Introduction ........................................................................................................................ 163 8.2 Effect of timing errors........................................................................................................ 165 8.3 GPS timing receiver evaluation ......................................................................................... 166 8.4 Performance of timing receivers under jamming ............................................................... 169 8.4.1 Performance under jammers of different types and power ......................................... 170 8.5 Post-processed timing synchronisation .............................................................................. 173 8.6 Clock drift behaviour ......................................................................................................... 178 viii Table of Contents 8.6.1 Potential TCXO holdover ........................................................................................... 179 8.7 Field trial experiment ......................................................................................................... 181 8.7.1 Real-time synchronisation performance ..................................................................... 182 8.7.2 Post-processed timing corrections .............................................................................. 183 8.8 Summary and Conclusions ................................................................................................ 186 Chapter 9 Conclusions and Future Work .................................................................................... 189 9.1 Introduction ........................................................................................................................ 189 9.2 Summary and Concluding Remarks .................................................................................. 189 9.3 Future Work ....................................................................................................................... 191 Appendix A Response of Timing Receivers to Different Jammer Types and Power Levels ...... 197 A.1 Wideband Noise (2MHz) .................................................................................................. 197 A.2 Wideband Noise (10MHz) ................................................................................................ 198 A.3 Swept CW (2MHz) ........................................................................................................... 198 A.4 CW on L1 .......................................................................................................................... 198 A.5 AM .................................................................................................................................... 199 A.6 FM ..................................................................................................................................... 199 A.7 Pulsed Type 1 (4ms duty cycle every 20ms) .................................................................... 200 A.8 Pulsed Type 2 (200ms every 1 second)............................................................................. 200 References .................................................................................................................................... 203 ix List of Figures Figure 2.1. GPS L1 C/A code signal modulation .......................................................................... 10 Figure 2.2. The calculation of position from the intersection of ranges to a receiver.................... 11 Figure 2.3. The IGS tracking network [28].................................................................................... 12 Figure 2.4. Examples of areas with an increasing dependency on GNSS products [34]. .............. 14 Figure 2.5. Generic band-pass sampling GNSS receiver architecture. .......................................... 17 Figure 2.6. Losses for GPS and GLONASS with a CW at L1+10.5kHz. ...................................... 19 Figure 2.7. The fall in the equivalent C/No from the presence of a wideband Gaussian interferer using (2.2) [60]. ............................................................................................................................. 20 Figure 2.8. A network of sensors placed around the runway at an airport for localising interference sources. ...................................................................................................................... 30 Figure 2.9. The intersecting lines of an AOA localisation system................................................. 31 Figure 2.10. The intersecting hyperbolas of a TDOA localisation system .................................... 33 Figure 2.11. The intersecting circles of a RSS localisation system. .............................................. 35 Figure 3.1. Generic receiver front-end. .......................................................................................... 39 Figure 3.2. C/No values of an observable satellite using a pre-correlation estimation of the noise density. ........................................................................................................................................... 41 Figure 3.3. Close-up of multipath oscillations as the satellite moves through different parts of the sky with a pre-correlation estimation of the noise density (zoom of Figure 3.2). ......................... 41 Figure 3.4. C/No values of an observable satellite using a post-correlation estimation of the noise density. ........................................................................................................................................... 43 Figure 3.5. Close-up of multipath oscillations as the satellite moves through different parts of the sky with a post-correlation estimation of the noise density (close-up of Figure 3.4). ................... 43 Figure 3.6. Comparison of effective C/No with increasing J/N..................................................... 44 Figure 3.7. Comparison of effective C/No with increasing Doppler. ............................................ 44 Figure 3.8. Effect of integration time on C/No losses for a GPS satellite in the presence of CW RFI. ................................................................................................................................................ 45 Figure 3.9. Comparison of dips with GPS and GLONASS in the presence of CW RFI (10ms integration time). ............................................................................................................................ 45 Figure 3.10. C/No estimated from synthetic data showing how a post-correlation estimation of the noise density reveals falls as the CW RFI crosses spreading code spectral lines. ......................... 46 Figure 3.11. Correlator outputs from synthetic data (same data as used for Figure 3.10) revealing the increase in tracking loop variance as the CW RFI crosses spreading code spectral lines. ...... 46 x List of Figures Figure 3.12. A plot of the C/No values (using pre-No) versus elevation for a satellite. The threshold is made using (3.13). ...................................................................................................... 47 Figure 3.13. A plot of the C/No values (using pre-No) over time during a flyover. The threshold is made using (3.13)........................................................................................................................... 47 Figure 3.14. The C/No values from a satellite one day after another. The satellite groundtrack repeats approximately 240 seconds earlier each day. .................................................................... 48 Figure 3.15. Two consecutive days of C/No values with the last day values corrected for groundtrack repeat time. The C/No values now align.................................................................... 48 Figure 3.16. The ∆C/No values using a pre-correlation noise density estimate. ........................... 49 Figure 3.17. The ∆C/No values using a post-correlation noise density estimate. .......................... 49 Figure 3.18. Standard deviation for C/No techniques (pre-No). .................................................... 50 Figure 3.19. Standard deviation for C/No techniques (post-No). .................................................. 50 Figure 3.20. Kernel density estimate of ∆C/No in different elevation windows for pre-No. ........ 50 Figure 3.21. Kernel density estimate of ∆C/No in different elevation windows for post-No. ....... 50 Figure 3.22. ∆C/No values with and without RFI.......................................................................... 51 Figure 3.23. The number of detections as RFI power is increased. ............................................... 51 Figure 3.24. The repetition of the post-No C/No values after averaging every 30 seconds. ......... 52 Figure 3.25. The post-No ∆C/No values and the detection threshold after averaging every 30 seconds. .......................................................................................................................................... 52 Figure 3.26. ∆C/No (post-No) values with and without the effect of RFI using (3.8)................... 53 Figure 3.27. The number of detections (post-No) as the power of a CW RFI at different frequency offsets is increased. ........................................................................................................................ 53 Figure 3.28. The drops from all visible satellites (post-No). ......................................................... 54 Figure 3.29. The number of detections as RFI power is increased (post-No)................................ 54 Figure 3.30. Large-scale variations in multipath that repeats day-to-day from the NordNav C/No measurements................................................................................................................................. 55 Figure 3.31. The ∆C/No values corresponding to the C/No values shown in Figure 3.30, with the variations from multipath reduced. ................................................................................................ 55 Figure 3.32. A strong oscillation in the C/No caused by multipath that repeats day-to-day. ........ 55 Figure 3.33. The ∆C/No values corresponding to the C/No values shown in Figure 3.32, with the multipath variations effectively removed. ..................................................................................... 55 Figure 3.34. The standard deviation of ∆C/No for different satellites over a number of day pairs. ....................................................................................................................................................... 56 Figure 3.35. The mean of ∆C/No for different satellites over a number of day pairs. ................... 56 xi List of Figures Figure 3.36. Standard deviation for PRN27................................................................................... 57 Figure 3.37. Standard deviation for PRN2..................................................................................... 57 Figure 3.38. The number of detections over time using the ∆C/No values over a number of day pairs................................................................................................................................................ 58 Figure 3.39. The number of satellites with simultaneous detections using the ∆C/No values over a number of day pairs. ...................................................................................................................... 58 Figure 3.40. The tracking problems during acquisition for PRN1 which caused a number of false alarms. ............................................................................................................................................ 58 Figure 3.41. The tracking problems during acquisition for PRN5 which caused a number of false alarms. ............................................................................................................................................ 58 Figure 3.42. The fall in C/No for the different C/No estimators for a wideband RFI. .................. 59 Figure 3.43. The fall in C/No for the different C/No estimators for a CW RFI at different frequencies. .................................................................................................................................... 59 Figure 3.44. The response of the NordNav C/No for a CW Sweep. .............................................. 60 Figure 3.45. The response of the C/No using a post-correlation estimate of the noise density for a CW Sweep. .................................................................................................................................... 60 Figure 3.46. Experimental Setup. .................................................................................................. 61 Figure 3.47. The C/No from the NordNav over a number of days, with a CW of J/N -8.751dB added on the last. ........................................................................................................................... 62 Figure 3.48. The ∆C/No and detection threshold corresponding to the C/No values from Figure 3.47. ............................................................................................................................................... 62 Figure 3.49. The C/No from the NordNav over a number of days, with a CW of J/N -21.751dB added on the last. ........................................................................................................................... 63 Figure 3.50. The ∆C/No and detection threshold corresponding to the C/No values from Figure 3.49. ............................................................................................................................................... 63 Figure 3.51. The C/No values extracted from a number of days of RINEX data (GPS) from an IGS reference station...................................................................................................................... 64 Figure 3.52. An exampling of the repeating multipath behaviour in the C/No values extracted from RINEX data (close-up from Figure 3.51).............................................................................. 64 Figure 3.53. The ∆C/No and resulting detection threshold without dithering added. ................... 64 Figure 3.54. The ∆C/No and resulting detection threshold with dithering added, eliminating the problems from the quantisation of the C/No.................................................................................. 64 Figure 3.55. The number of detections in 500s windows over time (GPS). .................................. 65 Figure 3.56. The number of effected satellites in 500s windows over time (GPS). ...................... 65 xii List of Figures Figure 3.57. The C/No anomaly during day pair 2 (GPS) which caused a number of detections. 65 Figure 3.58. The C/No anomaly during day pair 4 (GPS) which caused a number of detections. 65 Figure 3.59. The C/No anomaly during day pair 7 on PRN11 (GPS) which caused a number of detections. ...................................................................................................................................... 66 Figure 3.60. The C/No anomaly during day pair 7 on PRN23 (GPS) which caused a number of detections. ...................................................................................................................................... 66 Figure 3.61. C/No values from the IGS RINEX data (GLONASS). ............................................. 67 Figure 3.62. Close-up of repeating multipath behaviour (GLONASS). ........................................ 67 Figure 3.63. The number of detections in 500s over time (GLONASS). ...................................... 67 Figure 3.64. The number of effected satellites in 500s windows over time (GLONASS). ........... 67 Figure 3.65. The C/No anomaly during day pair 7 on PRN7 (GLONASS). ................................. 68 Figure 3.66. The C/No anomaly during day pair 7 on PRN1 (GLONASS). ................................. 68 Figure 3.67. Comparison of the standard deviation for ∆C/No values over a 24 hour period. ...... 68 Figure 3.68. Kernel density estimate of satellite elevations over a 24 hour period. ...................... 68 Figure 3.69. The minimum J/N that would cause detections for at least 3 satellites (1s windows). ....................................................................................................................................................... 69 Figure 3.70. Kernel density estimate of minimum J/N for detection (1s windows). ..................... 69 Figure 3.71. The minimum J/N that would cause detections for at least 3 satellites (500s windows)........................................................................................................................................ 70 Figure 3.72. Kernel density estimate of minimum J/N for detection (500s windows). ................. 70 Figure 4.1. The encoding behaviour of a 2-bit sign and magnitude ADC. .................................... 73 Figure 4.2. The ideal AGC control loop. ....................................................................................... 73 Figure 4.3. The simulated response of the AGC gain voltage to an added RFI of J/N -6 dB ........ 74 Figure 4.4. AGC loop that uses the quantised samples to estimate the rms level. ......................... 75 Figure 4.5. The σ-sensing AGC behaviour for different RFI types: CW and WB. ...................... 76 Figure 4.6. Increasing the number of quantisation bits makes the AGC gain behave closer to the ideal................................................................................................................................................ 76 Figure 4.7. AGC loop that uses the histogram of the incoming samples to control the gain. ........ 77 Figure 4.8. The normalised result of the numerical convolution to calculate the probability density function of noise plus CW RFI, with J/N = 7.8 dB........................................................................ 78 Figure 4.9. The change in gain for a histogram counting AGC with MAG set high 33% of the time. ............................................................................................................................................... 78 Figure 4.10. The impact of changing the MAG high % on the sensitivity and response of the AGC gain to CW RFI. ............................................................................................................................. 79 xiii List of Figures Figure 4.11. The SNR loss as a function of L/σ for 2-bit quantisation. ......................................... 79 Figure 4.12. Photograph of the USB temperature logger and the GPS receiver. ........................... 81 Figure 4.13. The AGC values over a 1380 second period. ............................................................ 81 Figure 4.14. The variation of the AGC PulseWidth and temperature for a GPS receiver in an environment with mild exposure to the outside environment. ....................................................... 82 Figure 4.15. A plot of the temperature versus AGC PulseWidth for the recorded data set. .......... 83 Figure 4.16. After being corrected by (4.8) the majority of the variation in the AGC value can be removed, leading to improved detection and J/N estimation of jammers. ..................................... 83 Figure 4.17. The overlapping of the histogram bin percentages for determining the noise floor of the Novatel receiver. ...................................................................................................................... 84 Figure 4.18. The response of the AGC to CW RFI of increasing J/N. .......................................... 85 Figure 4.19. The change in the AGC PulseWidth compared with the expected change in gain.... 86 Figure 4.20. The difference in 6σ thresholds before and after temperature compensation. ........... 86 Figure 4.21. The measured response of the AGC to CW RFI and the 6-σ detection thresholds with and without temperature compensation. ........................................................................................ 87 Figure 5.1. A 2D TOA positioning system using 3 satellites. ....................................................... 92 Figure 5.2. An example of good DOP performance for TOA. ...................................................... 94 Figure 5.3. An example of poor DOP performance for TOA. ....................................................... 95 Figure 5.4. The distribution of position estimates for a TOA scenario with added measurement noise. .............................................................................................................................................. 96 Figure 5.5. The error ellipse calculated for the measurement noise as used in Figure 5.4. ........... 96 Figure 5.6. The difference of two RSS equations creating a DRSS equation, eliminating Po. ...... 98 Figure 5.7. The circles of position for DRSS for sources (stars) placed along the x-axis. ............ 98 Figure 5.8. The error ellipses for DRSS with and without solving for n. .................................... 101 Figure 5.9. The linear-array topology with interferer fixed at x=0, with TDOA hyperbolas shown for a possible interferer location. ................................................................................................. 101 Figure 5.10. The GDOP (scaled by 1/c) for TDOA along the y-axis for a linear array of sensors with different sensor spacing. ...................................................................................................... 104 Figure 5.11. The GDOP for AOA along the y-axis for a linear array of sensors with different sensor spacing. ............................................................................................................................. 104 Figure 5.12. The GDOP for DRSS along the y-axis for a linear array of sensors with different sensor spacing. ............................................................................................................................. 105 Figure 5.13. The DRSS circles for a position with infinite DOP. ................................................ 106 xiv List of Figures Figure 5.14. A plot of the least-squares cost function for the dashed circles of position in Figure 5.13. ............................................................................................................................................. 106 Figure 5.15. For collinear arrays there are always solutions on either side of the baselines for TDOA and DRSS......................................................................................................................... 107 Figure 5.16. Potential four sensor network topologies ................................................................ 108 Figure 5.17. The PDOP surface for DRSS in a 4 sensor square. ................................................. 108 Figure 5.18. The PDOP surface for DRSS in a 4 sensor triangle network. ................................. 108 Figure 5.19. The DOP surface for DRSS in a square network (solving for n). ........................... 109 Figure 5.20. The DOP surface for DRSS in a triangle network (solving for n)........................... 110 Figure 5.21. A star array of sensors which has good DOP performance for all three methods. .. 110 Figure 5.22. The DOP surface for DRSS in a star network. ........................................................ 110 Figure 5.23. The DOP surface for DRSS in a star network (solving for n). ................................ 111 Figure 5.24. DOP comparison of different methods for a star array with spacing of 50m using some typical noise variances. ....................................................................................................... 111 Figure 6.1. The geometry used for the two-ray reflection model. ............................................... 116 Figure 6.2. A comparison between the path loss for the log-normal (LN) and two-ray reflection model (2RM)................................................................................................................................ 117 Figure 6.3. The lines of position for RSS and DRSS equations for a transmitter. ....................... 119 Figure 6.4. The least-squares cost function (in dB) for the DRSS lines of position. ................... 119 Figure 6.5. The path loss behaviour at 10m and 1m heights using the two-ray model. ............... 121 Figure 6.6. The position estimation technique for DRSS. ........................................................... 121 Figure 6.7. The client-server interchange of packets when measuring RSSI in 'active' scanning mode............................................................................................................................................. 123 Figure 6.8. The monitoring of the broadcast beacons from access-points in 'passive' scanning mode............................................................................................................................................. 123 Figure 6.9. A photograph of the USB Wi-Fi adapter used in the experiments. ........................... 124 Figure 6.10. The RSSI (in dBm) values from the Windows Network Driver Interface Specification (NDIS) interface while rotating the USB adapter’s antenna.................................. 124 Figure 6.11. The RSSI (unitless) values from the modified zd1211rw Linux drivers while rotating the USB adapter’s antenna. .......................................................................................................... 124 Figure 6.12. The setup for characterising the RSSI from the USB Wi-Fi dongle. ...................... 125 Figure 6.13. The RSSI (unitless) values at different attenuations............................................... 126 Figure 6.14. The spline fit of the histogram of RSSI at different attenuations ............................ 126 Figure 6.15. The fall in RSSI before and after the spline calibration technique. ........................ 126 xv List of Figures Figure 6.16. The USB Wi-Fi adapter and antenna used as a sensor node. .................................. 127 Figure 6.17. The rover with RTK GPS and a Wi-Fi access point. ............................................... 127 Figure 6.18. Sensor network setup. .............................................................................................. 128 Figure 6.19 The RSSI values measured at different sensor nodes #1, #2, and #3, over time with the transmitter located at one of the test points ............................................................................ 128 Figure 6.20. The test locations where path loss was measured for the 1.05m data set. ............... 129 Figure 6.21. The path loss behaviour for the 1.05m data set. ...................................................... 129 Figure 6.22. The test locations where path loss was measured for the 1.55m data set. ............... 130 Figure 6.23. The path loss behaviour for the 1.55m data set. ..................................................... 130 Figure 6.24. The ECDF comparison of positioning results at heights of 1.05m and 1.55m. ....... 131 Figure 6.25. The vectors of the position errors for the 1.05m height data. .................................. 132 Figure 6.26. The vectors of the position errors for the 1.55m height data. .................................. 132 Figure 6.27. The error ellipses for different sets of parameters being estimated. ........................ 133 Figure 6.28. A comparison of the position error and CRLB for the 1.05m data. ........................ 134 Figure 6.29. A comparison of the position error and CRLB for the 1.55m data. ........................ 134 Figure 6.30. The position error for test point 2 in the 1.55m data set. ......................................... 134 Figure 6.31. The path loss models for test point 2 in the 1.55m data set. .................................... 134 Figure 6.32. The position error for test point 31 in the 1.55m data set. ....................................... 135 Figure 6.33. The path loss models for test point 2 in the 1.55m data set. .................................... 135 Figure 6.34. The 67th percentile position error for different fixed path loss exponent values for the 1.05m data set. ....................................................................................................................... 137 Figure 6.35. The 67th percentile position error for different fixed path loss exponent values for the 1.55m data set. ....................................................................................................................... 137 Figure 6.36. The DRSS lines of position with all sensor node measurements for test point 14 in the 1.55m data set. ....................................................................................................................... 138 Figure 6.37. The DRSS lines of position with sensor node 4 excluded from the measurements for test point 14 in the 1.55m data set................................................................................................ 138 Figure 6.38. The path loss using the two-ray model. ................................................................... 139 Figure 6.39. The distribution of the position estimates for a number of simulation runs with transmitter at (250,250)................................................................................................................ 140 Figure 6.40. The distribution of the position estimates for a number of simulation runs with transmitter at (750,750)................................................................................................................ 140 Figure 6.41. The path loss behaviour at the different simulation heights for the transmitter at (250,250). ..................................................................................................................................... 141 xvi List of Figures Figure 6.42. The path loss behaviour at the different simulation heights for the transmitter at (750,750). ..................................................................................................................................... 141 Figure 6.43. The distribution of the position estimates for a number of simulation runs with transmitter at (2500,2500)............................................................................................................ 142 Figure 6.44. The distribution of the position estimates for a number of simulation runs with transmitter at (7500,7500)............................................................................................................ 142 Figure 7.1. Possible signals present at two sensor nodes in the L1 band. .................................... 148 Figure 7.2. 10ms of IF data cross-correlated together for sensor nodes separated by 100m. ...... 149 Figure 7.3. Close-up of the cross-correlation peak at zero-delay for sensor nodes separated by 100m. ........................................................................................................................................... 149 Figure 7.4. 10ms of IF data cross-correlated together for sensor nodes separated by 5km. ........ 150 Figure 7.5. Close-up of the cross-correlation peak at zero-delay for sensor nodes separated by 5km. ............................................................................................................................................. 150 Figure 7.6. View of peaks around zero-delay with different front-end filter bandwidths. .......... 151 Figure 7.7. View of a side peak with different front-end filter bandwidths................................. 151 Figure 7.8. Circular cross-correlation output with and without GPS signals............................... 152 Figure 7.9. Histogram of the correlator output with and without GPS signals. ........................... 152 Figure 7.10. Output of the correlator near zero-delay for a baseline of 100m over 10 seconds. . 153 Figure 7.11. Output of the correlator along zero-delay for a baseline of 100m. .......................... 153 Figure 7.12. Block diagram of the mean change detection algorithm. ........................................ 153 Figure 7.13. Figure 13. Output of the correlator for the 0.38m baseline with RFI added. .......... 154 Figure 7.14. Response of the detection technique, with the outputs breaching the threshold causing a detection. ...................................................................................................................... 154 Figure 7.15. Output of the correlator for the 100m baseline with RFI added. ............................. 155 Figure 7.16. Magnitude of the correlator along zero delay with no obvious crossing of the thresholds when RFI is added ...................................................................................................... 155 Figure 7.17. The real part of the correlator showing crossing of the detection threshold............ 156 Figure 7.18. The imaginary part of the correlator. ....................................................................... 156 Figure 7.19. Output of the correlator for the 500m baseline with RFI added. ............................. 157 Figure 7.20. The magnitude of the correlator output along zero delay ........................................ 157 Figure 7.21. The correlator output for the 5km baseline.............................................................. 157 Figure 7.22. The magnitude along a delay bin containing on a single satellite with RFI added after 5 seconds ...................................................................................................................................... 158 xvii List of Figures Figure 7.23. The magnitude along a delay bin containing two satellites with RFI added after 5 seconds ......................................................................................................................................... 158 Figure 7.24. The individual components for the single satellite at a delay of -146. .................... 159 Figure 7.25. A sum of sines fit used to model the output at a delay of 86. .................................. 159 Figure 7.26. An example of an anomaly error introduced by the GPS cross-correlations........... 160 Figure 7.27. An example of bias introduced by the GPS cross-correlations. .............................. 160 Figure 7.28. Location of the peak in the correlation function over 15 seconds of data for added RFI of different power. ................................................................................................................ 161 Figure 7.29. The number of anomalous time-delay estimates as a function of effective J/N. ..... 161 Figure 7.30. RMSE for anomaly free time-delays as a function of effective J/N. ....................... 161 Figure 7.31. Bias for anomaly free time-delays as a function of effective J/N............................ 161 Figure 8.1. GPS time transfer testing setup. ................................................................................ 167 Figure 8.2. The behaviour of the error in the baseline length and the timing offset with the timing receivers operating in navigation mode for the North-South baseline test. ................................. 167 Figure 8.3. The time-series of the timing offset between the timing receivers for the Zero and North-South baselines in hold mode. ........................................................................................... 168 Figure 8.4. Jammer testing configuration. ................................................................................... 169 Figure 8.5. Response of the timing offset in the PPS outputs between the timing receivers to a jamming signal being turned on and off over time. ..................................................................... 170 Figure 8.6. Response of frequency offset in the 30.72MHz outputs between the timing receivers to a jamming signal being turned on and off over time. .............................................................. 170 Figure 8.7. The different power levels used for the jamming signals over time. ......................... 171 Figure 8.8. The response of the timing offset and the number of satellites used for the 2MHz noise jammer. ............................................................................................................................... 171 Figure 8.9. Response of reported C/No for a satellite during the jammer testing. ....................... 172 Figure 8.10. Geometry of satellite time-delays between sensor nodes during common-view of a GPS satellite. ................................................................................................................................ 174 Figure 8.11. The relationship between the locations of the TOW messages and absolute samples betweens the two sensor nodes. ................................................................................................... 175 Figure 8.12. Setup for testing long baseline synchronisation using postprocessing between unsynchronised front-ends. .......................................................................................................... 176 Figure 8.13. An example of the sample offsets calculated between two unsynchronised IF data sets. .............................................................................................................................................. 177 Figure 8.14. Setup for testing long baseline synchronisation using postprocessing. ................... 178 xviii List of Figures Figure 8.15. Sample offsets between two files. ........................................................................... 178 Figure 8.16. The clock drift in receiver 1 over time. ................................................................... 179 Figure 8.17. The clock drift in receiver 2 over time. ................................................................... 179 Figure 8.18. The relative clock drift between the two independent GPS receivers with a shared antenna. ........................................................................................................................................ 179 Figure 8.19. The ambient temperature recorded next to the two GPS receivers.......................... 179 Figure 8.20. Best case performance of a linear fit holdover technique during a simulated outage due to jamming. ........................................................................................................................... 180 Figure 8.21. Worst case performance of a linear fit holdover technique during a simulated outage due to jamming. ........................................................................................................................... 180 Figure 8.22. The resulting timing offset caused by the error in the clock drift fit over the outage period. .......................................................................................................................................... 181 Figure 8.23. The field trial experimental setup [18]. ................................................................... 181 Figure 8.24. Sensor node and timing architecture. ...................................................................... 181 Figure 8.25. The difference between the delay of the satellites from the tracking outputs and the true delay...................................................................................................................................... 183 Figure 8.26. The timing offset measured between the different sensor node pairs using the GPS satellites in the captured IF data for TDOA processing. .............................................................. 183 Figure 8.27. Cross-correlation peaks before correction. .............................................................. 186 Figure 8.28. Cross-correlation peaks after correction. ................................................................. 186 Figure 8.29. TDOA performance before and after timing corrections for data block 4. ............. 186 Figure A.1. Timing degradation in the presence of a 2MHz Gaussian noise signal. ................... 197 Figure A.2. Timing degradation in the presence of a 10MHz Gaussian noise signal. ................. 198 Figure A.3. Timing degradation in the presence of a 2MHz swept CW. ..................................... 198 Figure A.4. Timing degradation in the presence of a CW on L1. ................................................ 199 Figure A.5. Timing degradation in the presence of an AM signal............................................... 199 Figure A.6. Timing degradation in the presence of a FM signal. ................................................ 200 Figure A.7. Timing degradation in the presence of a pulse signal. .............................................. 200 Figure A.8. Timing degradation in the presence of a pulse signal............................................... 201 xix List of Tables Table 2.1. Different types of RF interference and potential sources [41] ...................................... 15 Table 3.1. Detection performance for ∆C/No from the NordNav receiver.................................... 62 Table 5.1. DOPs for a linear array of sensors. ............................................................................. 103 Table 6.1. The positioning results from the experiments at 1.05m and 1.55m heights. .............. 130 Table 6.2. Positioning results with different strategies for the path loss exponent (1.05m data set). ..................................................................................................................................................... 136 Table 6.3. Positioning results with different strategies for the path loss exponent (1.55m data set). ..................................................................................................................................................... 136 Table 6.4. The positioning performance when excluding a sensor node. .................................... 137 Table 6.5. First Fresnel zone distance comparison between Wi-Fi and GPS. ............................. 138 Table 6.6. Simulated Positioning Results for a small area network............................................. 140 Table 6.7. Simulated Positioning Results for a wide area sensor network. ................................. 142 Table 8.1. Relative timing synchronisation performance between the timing receivers. ............ 168 Table 8.2. The minimum/maximum number of satellites used in the timing solution during jamming. ...................................................................................................................................... 173 Table 8.3. Timing and position error in meters at location 3. ...................................................... 184 Table 8.4. RMSE with and without timing corrections. .............................................................. 185 xx List of Abbreviations 2RM Two-ray model ADC Analogue to Digital Converter AGC Automatic Gain Control AM Amplitude Modulation AOA Angle of Arrival ARC Australian Research Council ASC Active Signal Cancellation AWGN Additive White Gaussian Noise bps bits per second BPSK Binary Phase Shift Keying BW Bandwidth CDMA Code Division Multiple Access CFAR Constant False Alarm Rate CORS Continuously Operating Reference Station COTS Commercial of the Shelf CRLB Cramer-Rao Lower Bound CW Continuous Wave C/A Coarse/Acquisition Code C/No Carrier to Noise Density Ratio DGPS Differential GPS DF Direction Finding DME Distance Measuring Equipment DOP Dilution of Precision DSPN Direct Sequence Pseudorandom Noise DRSS Difference of RSS ECDF Cumulative Distribution Functions FDMA Frequency Division Multiple Access FDOA Frequency Difference of Arrival FM Frequency Modulation FIM Fisher Information Matrix FIR Finite Impulse Response FPGA Field Programmable Gate Array xxi List of Abbreviations GAMES GPS Anomaly Monitoring Equipment Suite GD Gradient Descent GN Gauss-Newton GBAS Ground-Based Augmentation System GEMS GNSS Environmental Monitoring System GIMOS GNSS Interference Monitoring System GLONASS Global Navigation Satellite System GNSS Global Navigation Satellite System GPS Global Positioning System GPSDO GPS Disciplined Oscillator GRAS Ground-Base Regional Augmentation System IF Intermediate Frequency IGS International GNSS Service INS Inertial Navigation System I-P In-Phase J/N Jammer to Noise Ratio J/S Jammer to Signal Ratio LBS Location-Based Services LM Levenberg-Marquardt LN Log-normal LNA Low Noise Amplifier LORAN LOng RAnge Navigation MAC Media Access Control MAG Magnitude NB Narrowband Mc/s Mega chips per second MCDD Multi-Correlation Differential Detection MLE Maximum Likelihood Estimator MM Method of Moments MOPS Minimum Operational Performance Standards MSS Mobile Satellite Services NDIS Network Driver Interface Specification NLOS Non Line of Sight NMEA National Marine Electronics Association xxii List of Abbreviations OCXO Oven Controlled Crystal Oscillator N0 Noise Density Pd Probability of Detection PDOP Position Dilution of Precision PNT Position Navigation Timing post-N0 Post-Correlation Noise Density pre-N0 Pre-Correlation Noise Density PPD Privacy Protection Device PPS Pulse Per Second PRN Pseudo random Noise P(Y) Precision Code Q-P Quadrature-Phase QZSS Quazi-Zenith Satellite System RAIM Receiver Autonomous Integrity Monitoring RF Radio Frequency RFI Radio Frequency Interference RMSE Root Mean Square Error ROC Receiver Operating Characteristic RSS Received Signal Strength RTCA Radio Technical Commission for Aeronautics RINEX Receiver Independent Exchange Format RSSI Received Signal Strength Indication RTK Real Time Kinematic SATCOM SATellite COMmunications SBAS Space-Based Augmentation System SSC Spectral Separation Coefficient SCW Swept Continuous Wave SNR Signal to Noise Ratio SNReff Effective SNR SPS Standard Positioning Service SQM Signal Quality Monitoring SSIS Service Set Identifiers SUI Stanford University Interim S/N Signal to Noise xxiii List of Abbreviations TCXO Temperature Compensated Crystal Oscillator TDOA Time Difference of Arrival TOA Time of Arrival TOW Time of Week US United States WB Wideband WMI Windows Management Instrumentation UAV Unmanned Aerial Vehicle UWB Ultra Wideband UNSW University of New South Wales VGA Variable Gain Amplifier ∆C/No C/No difference xxiv List of Abbreviations xxv Chapter 1 Introduction 1.1 Vulnerability of Civilian Infrastructure to GNSS outages The term Global Navigation Satellite System (GNSS) encompasses a range of systems that provide Position, Navigation, and Timing (PNT) capabilities through transmitted satellite signals. When the first fully functioning GNSS, the NAVSTAR Global Positioning System (GPS), was originally developed by the United States Department of Defense it was intended to provide these capabilities to authorised military users only. After a Korean passenger jet was shot down by a Soviet fighter while travelling over restricted airspace a directive was made by the then US President Ronald Reagan that the capabilities provided by GPS should be available to civilians so that such a tragedy could be avoided in the future [1]. Since that time GPS has been developed as a system for both civilian and military users. Over time, through advances in GNSS technology, and the removal of selective availability [2], the performance of the PNT solutions that GNSS has provided has greatly surpassed its original specification. At the same time the price of GNSS receivers has decreased substantially and GNSS services are now commonly available in consumer products, creating a growing industry based on Location-Based Services (LBS). Its global coverage, good performance, and good 1 Chapter 1 Introduction reliability record has also allowed GNSS to become increasingly relied upon in a number of applications. The signals transmitted by GNSS satellites are relatively weak by the time they reach the user and as a result GNSS receivers are susceptible to either intentional or un-intentional jamming from Radio Frequency Interference (RFI). As society becomes more reliant on the services provided by GNSS, parts of critical civilian infrastructure are becoming vulnerable to GNSS outages caused by RFI [3]. There have been a number of real world examples of RFI disrupting GNSS, including a malfunctioning television antenna amplifier that jammed Differential GPS (DGPS) service in a harbour [4], military jamming exercises disrupting a hospital paging system which relied on telecommunications networks using GPS [5], harmonics from a high powered television broadcast tower [6] affecting nearby GNSS receivers, and a Privacy Protection Device (PPD) from a truck driver disrupting the Ground-Based Augmentation System (GBAS) at an airport [7]. An example of an augmentation that increases the capability of GNSS is ground-based reference stations. These are used to augment the integrity, utility, and performance of GNSS [8]. The improvements to integrity rely on the monitoring of the satellites signals by the reference station for signal faults and distortions. The improvements in performance rely on corrections to many of the errors inherent in GNSS processing, and these corrections can be provided to users in an area. Scenarios where these corrections are important include vertical aiding for aircraft landing, navigation in sea-ports, and precision agriculture. These scenarios are particularly vulnerable if the availability of corrections is lost during a critical time due to the presence of RFI. 1.2 Research Motivation There is uncertainty surrounding the ability to deal with the threat of RFI that leaves a number of GNSS users vulnerable and holds back its adoption by others. This is delaying the potential cost reductions and productivity increases that GNSS can provide. One example is the aviation industry where traditional landing aids are expensive to maintain and are inflexible in relation to flight paths and ability to operate in different weather conditions, and this capability can be provided more economically using GNSS. The cost of a failure of a GNSS landing aid in terms of life and economics in an aviation scenario could be catastrophic in the worst case. This uncertainty and vulnerability is the driving motivation for the research undertaken in this thesis. One potential solution to the problem of RFI is to deploy a network of permanent sensor stations to monitor for the presence of RFI and quickly localise it once detected. The use of a permanent sensor network has potential advantages over traditional detection and localisation 2 Chapter 1 Introduction methods which can take some time to track down RFI sources [4],[7]. This thesis will look at potential detection and localisation techniques which are facilitated by a permanent sensor network. This research is undertaken as part of Australia Research Council (ARC) Linkage grant LP0882191 led by the University of New South Wales with partners the University of Adelaide and GPSat Systems, Australia. The ultimate goal is integration of the results of this thesis into the second phase of the GNSS Environment Monitoring System (GEMS), a network of sensors that provides integrity monitoring of GNSS signals over an area, to provide the capability of being able to detect and localise any RFI in a precise and timely manner. 1.3 Contributions This work has contributed to the detection and localisation of RFI sources to GNSS receivers and reference stations as outlined in this section. In terms of detection, three different techniques have been investigated and research produced concerning the following: 1.3.1 Carrier-to-Noise Density Ratio (C/No) • In GNSS receiver operation, the C/No is an important metric for evaluating the quality of the tracking outputs from satellites. The C/No can be used for the detection of RFI but is generally a noisy measurement because of variations caused by multipath. In Chapter 3 it is shown that these variations repeat with a satellite’s ground-track and by taking the difference of C/No between ground-tracks, much of this variation can be removed allowing C/No to be used more effectively for detecting RFI. 1.3.2 Automatic Gain Control (AGC) • In the RF front-end of a GNSS receiver, an AGC is required to minimize quantisation losses. The AGC gain can be used for detecting RFI as it reflects the power at the receiver's antenna. This is limited by how the AGC drifts over time. In Chapter 4 it is shown that this drift is highly correlated with temperature and can be effectively removed after modelling the change in the AGC gain with respect to temperature over a couple of days. 1.3.3 Cross-Correlation • Although cross-correlation is important for calculating time-delays in a TDOA localisation system, it can also be used for detecting the presence of RFI. The GNSS 3 Chapter 1 Introduction signals captured with the RFI will also create peaks in the cross-correlation function. In Chapter 7 it is found that these cross-correlation peaks do make detection more difficult with a loss in the minimum detectable RFI power. The results prompt investigation into the removal of these GNSS signals to improve performance. In terms of localisation, aspects of two different methodologies have been investigated and research produced concerning the following: 1.3.4 Received Signal Strength (RSS) • Although this work is motivated by GPS L1, it is generally not legal to transmit in the L1 band. To explore RSS Commercial of the Shelf (COTS) Wi-Fi devices were used. A common issue with these devices is the dependability of the RSSI provided. In Chapter 6 it is shown that in combination with a variable attenuator and an access point with fixed power a spline fit could be used to deal with the problem of outliers in the RSS measurements from Wi-Fi adapters. • In theoretical works the log-normal path loss model is typically used. The theoretical analysis of the performance of RSS was found to be good through evaluation of DOP in Chapter 5. In Chapter 6 RSS was evaluated in a field trial using Wi-Fi devices. The lognormal model does not account for ground reflections, which caused a significant degradation in the path loss as the heights of the transmitter and receivers were increased. As a result RSS was found not to be a robust localisation method, even for a network with sensor spaced close together. • The AGC can be used for providing RSS measurements. The influence of the AGC methodology on the behaviour of RSS was investigated in Chapter 4 and it was found that the response of the AGC depends on quantisation error and the probability density function of the RFI. For an AGC that uses the histogram of the quantised samples, the difference in the response could be removed by changing the desired number of samples in the different histogram bins. 1.3.5 Time Difference of Arrival (TDOA) • In the TDOA methodology, strong time synchronisation is required between sensor nodes. An economical method for providing this synchronisation is to use GPS timing 4 Chapter 1 Introduction receivers, but in the presence of RFI their performance will degrade. In Chapter 8 the performance of timing is evaluated under jamming conditions and it is found that a number of TDOA measurements can be taken before it degrades too much. It is also found that the position performance using TDOA can be improved by post-processing the GNSS signals captured in the data and applying timing corrections to the time-delay estimates. • The data captured at sensor nodes for a GNSS interference localisation system will contain any GNSS satellites and pseudo-lites transmitting in the same band as the unwanted RFI. The power of the combination of all of these signals is not negligible and the effect of these signals on distorting the cross-correlation is explored in Chapter 7. Any distortion will increase the error in the time-delay estimates, resulting in an overall decrease in the accuracy of the TDOA localisation system. The results demonstrated that the removal of the GNSS signals will improve the ability to localise weaker, but easily detectable RFI. Concurrent with the research undertaken during this thesis, a prototype of the GEMS system operating in real-time was demonstrated to participants at the IGNSS 2011 conference, and a field trial using a network of GEMS nodes placed in an area with live interferers was performed under the supervision of the Australian Department of Defence. 1.4 Thesis Structure This thesis is structured in nine chapters with one appendix. In Chapter 1, an introduction is given describing the problem area dealt with in this thesis and thesis contributions. Chapter 2 provides a background on the previous research and challenges involved with dealing with the threat of RF interference to GNSS. In Chapter 3, the concept of C/No differences is introduced and evaluated for the detection of RFI. In Chapter 4, the detection and power estimation of RFI to GNSS using the AGC is explored. In Chapter 5, different potential passive localisation methodologies for GNSS RFI are explored using the Dilution of Precision metric. In Chapter 6, the passive localisation of unknown sources is explored using the RSS technique. In Chapter 7, the influence of GNSS cross-correlations on detection and time-delay estimation is explored in the context of a TDOA localisation system. In Chapter 8, an evaluation of GPS timing under jamming conditions is given, with extended results given in Appendix A. The thesis concludes with a summary and an outline of potential future work in Chapter 9. 5 Chapter 1 Introduction 1.5 List of Publications Research undertaken during this thesis has been published in the following journal publications: [9] Cetin E, Thompson RJR, Dempster AG, (2013) "Passive Interference Localization within the GNSS Environmental Monitoring System (GEMS) – TDOA Aspects", GPS Solutions. Accepted for publication pending modifications. Research undertaken during this thesis has been published in the following peer-reviewed conference proceedings: [10] Thompson RJR, Cetin E, Dempster AG, (2011) "Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control", IGNSS2011 Symposium on GPS/GNSS, Sydney, Australia, November 2011. [11] Thompson RJR, Cetin E, Dempster AG, (2011) "Influence of GPS Satellites CrossCorrelation on the TDOA Measurements within the GNSS Environmental Monitoring System (GEMS)", IGNSS2011 Symposium on GPS/GNSS, Sydney, Australia, November 2011. Research undertaken during this thesis has been published in the following conference proceedings: [12] Thompson RJR, Balaei AT, Dempster AG, (2009) "Dilution of precision for GNSS interference localisation systems", European Navigation Conference (ENC GNSS), Naples, Italy, 2009. [13] Thompson RJR, Balaei AT, Dempster AG, (2009) "Outdoor localization of a WiFi source with unknown transmission power. IGNSS2009 Symposium on GPS/GNSS, Gold Coast, Australia, December 2009. [14] Thompson RJR, Balaei AT, Dempster AG, (2010) "Detection of RF interference to GPS using day-to-day C/No differences", 2010 International Symposium on GPS/GNSS, Taipei, Taiwan, October 2010. [15] Cetin E, Thompson RJR, Dempster AG, (2011) "Interference Localisation within the GNSS Environmental Monitoring System (GEMS)", IGNSS2011 Symposium on GPS/GNSS, Sydney, Australia, November 2011. 6 Chapter 1 Introduction [16] Thompson RJR, Cetin E, Dempster AG, (2012) "Unknown Source Localization using RSS in Open Areas in the Presence of Ground Reflections", ION/IEEE PLANS 2012, Myrtle Beach, USA, April 2012. [17] Thompson RJR, Cetin E, Dempster AG, (2012) "Evaluation of Relative GPS Timing Under Jamming Conditions," Proceedings of the 25th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS 2012), Nashville, TN, September 2012, pp. 717-730. [18] Trinkle M, Cetin E, Thompson RJR, Dempster AG, (2012) "Interference Localisation within the GNSS Environmental Monitoring System (GEMS) - Initial Field Test Results" Proceedings of the 25th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS 2012), Nashville, TN, September 2012. 7 Chapter 1 Introduction 8 Chapter 2 Background 2.1 Introduction In the following chapter an overview is provided of the background and challenges related with dealing with threat of RF interference to GNSS systems. This includes a brief outline of the technical details associated with potential detection, mitigation, and localisation techniques and how the research undertaken in this thesis attempts to addresses some of the issues. 2.2 Global Navigation Satellite Systems The term Global Navigation Satellite System (GNSS) encompasses a range of satellite based systems that can be used for determining a user's position at any location at any time around the world [19]. Along with position, the technology also provides a number of other products, such as timing and frequency information. Using these products the GNSS signals have been used for a seemingly endless number of applications, from protecting assets from theft [20], to monitoring changes in the ionosphere [21]. At the moment there are two fully operational GNSS systems that provide global coverage, the United State's GPS [22] and the Russian Federation's GLONASS [23]. 9 Chapter 2 Background The NAVSTAR Global Positioning System was developed by the United States Department of Defense and became fully operational in 1995. It consists of a nominal constellation of 24 operational satellites that transmit ranging signals on two frequencies at L1 (1575.42MHz) and L2 (1227.60MHz). On the L1 band a Coarse-acquisition (C/A) code is broadcast for civilian use along with an encrypted Precision P(Y) code for military use. The encrypted P(Y) code is also broadcast on the L2 band which forms a dual-frequency use system for authorised users. The military codes provide better accuracy and anti-jamming performance then the civilian codes. The development of codeless and semi-codeless tracking techniques [24] have allowed civilian users to take advantage of the encrypted signal on L2 but its use is not guaranteed by the US military. In GPS each satellite broadcasts on the same frequency and uses Code Division Multiple Access (CDMA) modulation to distinguish between them. The CDMA spreading code consists of special 'Gold codes' encoded on the carrier frequency using Binary-phase-shift-keying (BPSK) with a chipping rate of 1.023Mcps (chips per second) and a data rate of 50bps. An overview of the encoding scheme is shown in Figure 2.1. The spreading code is used as the ranging signal and the encoded data contains all of the satellite ephemeris data required to calculate a position. Figure 2.1. GPS L1 C/A code signal modulation To acquire and track these signals a GPS receiver down-converts the incoming RF signal to a baseband frequency and then performs a search in Doppler frequency and code offset. To estimate the distance between the satellite and the receiver the code phase between a downconverted satellite signal and a locally generated replica is used to calculate a “pseudorange”. The 10 Chapter 2 Background term pseudorange is used because the distance measurement includes an offset due to receiver clock error. Using four satellites it is then possible to calculate for position and the receiver clock error using the intersection of spheres using these pseudoranges. Although only three satellites are required to solve for position in three dimensions a fourth pseudorange is required to estimate the timing offset of the receiver clock which is typically of lesser quality than the atomic clocks used on the GPS satellite vehicles. The geometry of the Time of Arrival (TOA) localisation methodology that GPS employs is shown in Figure 2.2 and the true receiver position lies at the intersection of the three shown ranges. r2 r3 r1 Receiver Figure 2.2. The calculation of position from the intersection of ranges to a receiver. The potential of the capabilities provided by a GNSS are used in a variety of applications outside of traditional navigation. A majority of the world's telecommunications and power networks now rely on GPS for timing synchronisation. The increased reliance is now starting to cause alarm at the potential for significant outages in everyday services if there is a fault with the GPS system [25]. 2.2.1 Ground-Based Reference Stations In its basic form the standard positioning service (SPS) provided by GPS to civilian users is capable of providing accuracy at best up to 3-5m [26]. Using differential GPS (DGPS) and real- 11 Chapter 2 Background time kinematic (RTK) techniques it is possible to significantly improve this accuracy by using corrections from a base-station with a known location. These corrections are typically provided by a network of reference stations and there are a number of such networks in the world servicing public and private users. An example of such a network is the International GNSS service (IGS) tracking network [27]. This service provides high quality GPS and GLONASS products which facilities a variety of geodetic and research uses. There are also a number of Continuously Operating Reference Station (CORS) networks for providing real-time access to geodetic level positioning for applications such as surveying and precision agriculture. These networks can consist of many hundreds of tracking stations as shown by an outline of the locations of the reference stations used in the IGS tracking network in Figure 2.3. These networks represent a significant investment in terms of hardware as well as a means of accessing the reference data in a timely manner. Figure 2.3. The IGS tracking network [28]. In certain applications, along with improved positioning accuracy, a degree of integrity is also required about the signals being used for navigation. A good example of such an application is precision guided aircraft landings where safety-of-life is an issue. In terms of integrity a network of ground stations is required to continually monitor the satellite signals to detect any faults and to flag an alarm quickly if any faults are detected. On a large scale this integrity is often provided by a Space-Based Augmentation System (SBAS) but it may not respond quickly enough or provide coverage for all applications and users. To ensure the safety of the service a local 12 Chapter 2 Background network which can respond faster is required. SBAS is also unable to detect the presence of any local disturbances or RFI which may deny integrity in a given area. In Australia there are two kinds of augmentation systems that are being developed for the purpose of aviation by Airservices and Honeywell, the Ground-Based Augmentation System (GBAS) and the Ground-Based Regional Augmentation System (GRAS) [29]. Recently the Honywell GBAS system was approved by the Australia Civil Aviation Authority to begin performing Cat-I precision landings at Sydney Airport [30]. The accuracy of the corrections provided by the reference stations used in the GBAS and GRAS systems however is dependent on the GPS receiver operating in an environment where there is no radio-frequency interference to jam or degrade its positioning solution. The usefulness of these reference and augmentations systems will degrade in the presence of radiofrequency interference in the GNSS bands [31]. 2.3 The Threat of Radio-Frequency Interference The signals transmitted by the GNSS satellites are relatively weak [25] by the time they reach the receivers on the ground. They are broadcast by satellites orbiting at a nominal range of 24,000km and the minimum received signal power on the surface of the Earth is -160dBW [22]. This makes GNSS receivers vulnerable to even weak sources of radio-frequency interference (RFI) that overpowers the already weak GNSS signals. In 2002 in the United States something as innocent as a malfunctioning television antenna amplifier was able to jam GPS service in a 1km area at a harbour [32]. Intentional jamming tests in the United Kingdom have shown that a 1.5W noise source can jam over 25nm [33] from transmitter source. In 2010 a small personal jammer used in a delivery van was capable of disrupting the GBAS system at Newark Airport while driving on a nearby highway [7]. The threat of RFI presents a worrying problem to those responsible for maintaining infrastructure that is increasingly relying on the services provided by GNSS for day to day operation. In 2011 the United State's National PNT Advisory Board released a report [34] detailing the extent to which infrastructure has become dependent on GPS and examples are shown in Figure 2.4 . One of the biggest uses of GNSS outside of traditional navigation is the ability to provide timing and frequency transfer and a large dependency on GPS as a time source exists in the electric power and telecommunications industries [35]. Strong timing synchronisation is required in power generation networks for maintaining a reliable power supply as the monitoring requirements increases as the networks become ever more complicated. In telecommunications networks 13 Chapter 2 Background timing requirements are becoming tighter as the number of users and data rates is increasing. A real world example of the vulnerability of telecommunications to jamming event was a hospital's paging system which was disrupted in San Diego in 2008. Commerce Power Grids Defense Transport GNSS Scientific Research Comms. Networks Law Enforcement Emergency Services Figure 2.4. Examples of areas with an increasing dependency on GNSS products [34]. Not only is the reliance on GNSS increasing as industries take advantage of the services they provide the reliance is also increasing as a number of traditional systems that provide similar services are being shut down. In 2010 the LORAN-C system which can provide a backup of timing and positioning capabilities [36] to GNSS was planned to be dismantled [37]. In order to save costs it is also being proposed to decommission the more traditional aircraft landing aids and replace them with GNSS-based systems. Without suitable backups a way to protect these systems that relies on GNSS, a way of detecting, mitigating, and localising any interferers in a timely manner is needed [38]. 2.3.1 Sources of Interference In the context of GNSS vulnerability RFI can be defined as any unwanted signal that is picked up by the GNSS receiver hardware while attempting to process the available satellite or augmentation signals. The structure of the RFI signal could be of a variety of different types and modulations, and could be being transmitted intentionally or unintentionally. With the increase in spectrum congestion and the increasing proliferation of GPS jammer products the number and sources and occurrences of RFI can be expected to increase. Designs for GPS jammers are readily 14 Chapter 2 Background available [39] or can be purchased complete online [40]. In this thesis the following definitions below and as shown in Table 2.1 of interference are used: Continuous Wave (CW) Interference: A single un-modulated carrier. Narrow Band (NB) Interference: Interference with discrete frequency spectra. Wide Band (WB) Interference: Interference that has spectral energy spread over a wider area but the majority is captured by the receiver front-end. Ultra Wide Band (UWB) Interference: Interference that has spectral energy over a very large range (multiple bands), of which only a small percentage is captured by the receiver front-end. In-Band Interference: Interference that is broadcast in the frequency allotments used for GNSS receivers Out-of-Band Interference: Interference that is broadcast in the frequency allotments next to the GNSS bands that is powerful enough to be mixed in-band by the receiver front-end components. Intermodulation Interference: Interfering components resulting from the interaction of two or more spectral components passing through a device with nonlinear behaviour. Table 2.1. Different types of RF interference and potential sources [41] Type Example sources: Wideband Gaussian Intentional jammers. Wideband phase/frequency modulation Television transmitter harmonics, microwave and satellite communication links. Wideband spread-spectrum Intentional jammers, microwave and satellite communication links, pseudo-lites. Wideband pulse Aviation DME, radar transmitters. Narrowband phase/frequency modulation Intentional jammers, AM and FM radio transmitter harmonics. Narrowband swept continuous wave Intentional jammers or FM station harmonics. Narrowband continuous wave Intentional jammers, unmodulated carriers and intermodulation products. A great deal of study into the effects of interference on GNSS receivers has been motivated by the potential of GNSS as a navigation aid in aviation. Guidelines have been given by the RTCA 15 Chapter 2 Background for minimum operating standards (MOPS) for receivers in the presence of RFI [42]. These guidelines have been formulated by evaluating the effect of different types of RFI on the performance of receivers and the powers at which they begin to degrade performance. In the following section a number of real-world examples of RFI is be presented. 2.3.2 Case Studies of Interference One of the first identified threats to GPS was from aeronautical satellite communications (SATCOM) and mobile satellite services (MSS) equipment operating close to GPS receivers in aircraft [43]. These devices broadcast in frequencies surrounding GNSS bands (MSS up to 1567MHz and SATCOM down to 1626.5075MHz) and with broadcast antennas co-located close to GPS antennas it can be expected that some power will end up in the pass-band of the GPS receivers due to the weakness of the GPS front-end filters and from spurious harmonics that result in-band. A number of different portable electronic devices have also been known to emit RF energy in the GNSS bands [43]. Reported cases such as a personal laptop computer transmitting large amounts of RF energy in the GNSS bands have prompted guidelines for switching off of such devices during critical times in aircraft ascent and descent. A great deal of interest in the effect of strong out-of-band signals occurred in 2011 due to the proposal of Lightsquared, a terrestrial wireless broadband network operating close to the GNSS bands, with ground stations with signal strengths significantly stronger than GNSS signals [44]. The spectrum which Lightsquared was to occupy was used for ground-to-satellite communications, with transmit powers significantly lower to what was proposed by the Lightsquared network. The filters used in the RF front-ends of many GPS receivers were found to be vulnerable to strong out-of-band signals close to the GNSS bands in experiments which simulated the signals from the Lightsquared basestations. In-band interference will also be a problem for receivers that track the newer GNSS signals. Unlike the L1 and L2 bands which are protected, it is expected that GNSS receivers operating in the L5 band will need to be able to tolerate operating in the presence of other strong signals such as distance measuring equipment (DME) [45]. In the literature there are a number of reported cases of interference coming from television broadcast towers which have higher order harmonics which end up in GNSS bands. Cases have been reported in Australia [46] and Italy [47] and at these locations the RFI was strong enough to disrupt receiver performance. 16 Chapter 2 Background The other significant source of RFI reported in the literature has been from purpose built GPS jammers. Original public available designs consisted of either a strong CW or wideband (12MHz) noise signal in the GPS bands [39]. The majority of commercially available GPS jammers transmit swept CW signals [48] over the GNSS bands and such a device was responsible for the disruption of the GBAS installation at Newark Airport [7]. Another type of RFI that has been gaining significant attention is spoofing signals. A spoofing signal is a counterfeit GNSS signal with the intent of capturing and misleading the GNSS receiver for nefarious purposes [49]. It has been rumoured that a military drone was captured in the Middle East through the use of a spoofer to trick the drone into landing in enemy territory [50]. Proof of this concept has been recently demonstrated with a spoofer signal taking control of a UAV [51]. 2.3.3 Interference Effects The primary reason for GNSS receivers being so vulnerable to RFI is that the satellites signals are so weak by the time they reach the receiver. A typical GPS receiver with a 2MHz bandwidth will have a noise-floor of approximately -110dBm. The GPS signals arriving at a receiver antenna located on the surface of the Earth will have a nominal power level of -130dBm [22] , which is 20dB below the noise level. This low power level means that only a relatively weak RFI signal is needed to jam operation of the receiver. In this section the effects of interference on the typical elements of a GPS receiver as shown in Figure 2.5 are described. Active antenna analogue signal digital signal GPS receiver AGC LNA position LNA filter filter ADC navigation baseband processor processor correlator outputs ∿ Figure 2.5. Generic band-pass sampling GNSS receiver architecture. In a typical GNSS receiver system the satellite signals are first captured by an active antenna. An active antenna is required to overcome any losses due to cabling between the antenna and the GPS receiver hardware. As the satellite signals already arrive weak, any losses due to cabling 17 Chapter 2 Background need to be avoided. At this stage degradation due to RFI occurs when the LNA in the antenna oversaturates. Once the signal enters the GPS receiver hardware it is usually amplified by another LNA to overcome mixing and filtering losses. As with the previous stage the hardware elements are vulnerable to oversaturation. It is at this stage that the receiver is also vulnerable to strong out-ofband signals which the front-end filters cannot attenuate sufficiently. The non-linear nature of oversaturation presents difficulty in modelling the effect and is explored in [52]. Distortion and intermodulation of strong signals due to oversaturation in the mixing components decreases the effective Signal to Noise Ratio (SNR) of the GNSS signals. After down-conversion the signal is then sampled by an Analogue-to-Digital Converter (ADC). For ADCs with more than 1 bit sampling an automatic gain control (AGC) is required to set the power level at the input to the ADC as to minimise quantisation losses. The variable gain amplifier (VGA) in the AGC will have limited dynamic range (typically in the range of 50dB [53]) so RFI that is too strong will oversaturate at the input to the ADC. The quantisation process performed by the ADC is also vulnerable to RFI due to the low number of bits typically used in GNSS receivers [54]. Due to the low dynamic range of the ADCs used there is also significant loss of SNR in the presence of CW interference as more of the RFI signal is captured at the expense of the underlying noise signal where the GNSS signals lie [55]. After quantisation by the ADC the signal is now in the digital domain and is sent to the baseband processor to perform acquisition and tracking of satellites. At this stage the threat of the RFI occurs where the spectrum of the RFI overlaps with the spectrum of the GNSS signals [56]. This disrupts the correlation process and increases the variance of the tracking loops. In the acquisition and tracking process the increase in variance can result in losing lock of the satellite or the loop could begin tracking the RFI. Loss of lock of all visible satellites will deny operation of the receiver and leakage of the interferer into the tracking loops will degrade the positioning solution as the resulting pseudoranges will be noisier. For a CW interferer the fall in the Carrier-to-Noise density ratio C / N 0 as it crosses the different spectral lines of the PRN spreading used can be found using the following equation [57]:  C  N  0  (Td R0 (τ )sinc(∆f c Td )) 2  =  2  CW Ln N 0 + J (Td C j sinc(Td ∆f i )) (2.1) where N 0 is the thermal noise power, Ln is the processing gain in the noise, Td is the integration 18 Chapter 2 Background duration time, τ is the signal-reference code phase different in code chips, fˆc is the estimate of carrier frequency estimate, ∆f c = f c − fˆc , ∆f i = f i − fˆc , J is the interference power, C j is the j th spectral line coefficient, and R0 (τ ) is the cross-correlation of the received C/A code and the receiver replica. In Figure 2.6 the falls in C / N 0 are shown calculated using (2.1) for a CW at different Doppler offsets to a GPS and GLONASS satellite. Although the GNSS signals typically have an overall sinc-shaped spectrum due to the use of finite length codes the spectrum resolves to line components with longer integration times because the codes repeat at a fixed frequency. C/No (dB/Hz) 45 40 GLN GPS 35 30 25 2.1 2.2 2.3 Doppler Frequency (Hz) 4 x 10 Figure 2.6. Losses for GPS and GLONASS with a CW at L1+10.5kHz. Two important metrics for the performance of GPS receivers are the acquisition/tracking thresholds and the variance of the delay lock loop. The acquisition threshold is the minimum C / N 0 level where the receiver can reliably acquire satellite signals (~36dB/Hz [58]) and the tracking threshold is the minimum C / N 0 level where the receiver can reliably track the satellite signals (~32 dB/Hz for precise positioning [59]). In the presence of RFI the C / N 0 will be reduced and a simplified expression for the C / N 0 in the presence of interference is given by [60]:  10 ( J / S ) / 10  [C / N 0 ]eq = −10 log10 −(C / N 0 ) / 10 +  QRc   (2.2) where C / N 0 is the Carrier-to-Noise Density ratio with no interference, J/S is the Jammer-toSignal ratio, Q is the spread spectrum processing gain (1 for narrowband, 2 for wideband Gaussian), and Rc is the PRN code chipping rate. In Figure 2.7 the fall in the equivalent C / N 0 is shown for different J/S for different satellite SNR. At a J/S of -24.74dB the C / N 0 for the satellite with a S/N of -30dB falls below the tracking threshold which will result in a loss of lock. The 19 Chapter 2 Background acquisition threshold is higher than the tracking threshold so for higher J/S the receiver will eventually be prevented from tracking any satellites as lock is lost and it is unable to acquire new satellites. 50 S/N=-30dB S/N=-20dB S/N=-10dB Acquisition Threshold Tracking Threshold C/Noeq (dB/Hz) 45 40 35 30 25 20 10 15 20 25 J/S ratio (dB) 30 35 40 Figure 2.7. The fall in the equivalent C/No from the presence of a wideband Gaussian interferer using (2.2) [60]. This delay-lock loop is used for tracking the code-phase of the incoming GPS satellite signal and the variance of this will be proportional to the variance of the pseudorange measurements. Consider the variance for an Early-minus-late power tracking loops [61]: σ T2 = BL d 2C / N 0   2 1 +   T (2 − d )C / N 0  (2.3) where σ T2 is the tracking error variance in units of PRN chips, B L is the code tracking loop bandwidth in Hz, d is the early-to-late correlator spacing, C / N 0 is the carrier-to-noise value in units of ratio-Hz, and T is the pre-detection integration interval in seconds. It is clear from (2.3) that the variance of the tracking loop will increase as the C/No decreases and as shown by (2.2) RFI will cause this. 20 Chapter 2 Background 2.4 Interference Detection In order to ensure the integrity of systems relying on the services provided by GNSS infrastructure, any RFI source must be detected quickly and at power levels low enough so that it can be detected before it disrupts the operation of the GNSS equipment. There are a number of systems in development for detection such as the Patriot Watch [34] from the United States, the Sentinel Project [62] from the United Kingdom, and the GNSS Interference Monitoring System (GIMOS) [63] from Germany. The RTCA provides specifications for receiver susceptibility when operating as part of aviation equipment [42] and it is this guideline which the different detection techniques are typically compared against. There are a number of different interference detection techniques that have been reported in the literature and they can be broken down into the following three categories: o Hardware o Pre-correlation o Post-correlation The hardware category describes techniques use parts of the hardware chain such as the antenna or RF front-end, the pre-correlation category describes techniques which perform signal processing on the incoming samples before any GNSS baseband processing, and the postcorrelation category describes the techniques that use many of the parameters and observables that are part of GNSS baseband processing. 2.4.1 Hardware Techniques RFI affects many of the components in the RF analogue front-end and these effects can be exploited for the purpose of detection. The automatic gain control (AGC) is a very important component in a GNSS receiver which can be used to monitor for changes in the power level at the receiver antenna [64]. In the case of a multi-bit ADC it is also possible to detect RFI by monitoring the histogram of the incoming samples. The AGC is required in GNSS receivers where more than one bit is used during quantisation to minimise quantisation losses from the ADC. In GNSS receivers, where the signal power of the received satellites arrives below the thermal noise floor, the AGC is usually driven by the ambient noise. In the presence of RFI the power level at the input to the ADC will increase and the AGC will reduce the gain. This sudden change in the gain level can be used for detecting the appearance of interference. An AGC-based approach not only provides a fast method for detecting interference, but is also able to achieve 21 Chapter 2 Background this with no additional hardware overhead by exploiting an existing receiver component in the RF front-end. The use of the AGC for detection has been investigated by a number of authors. In [65] the AGC was evaluated in the context of receiver autonomous monitoring for interference detection. Changes in the AGC gain were found to be correlated with pseudorange error as the power of the interference signals was increased. The variation in the AGC gain in the presence of pulsed-RFI also allows it to provide an ability to partially characterise the type of RFI. In [64] the AGC was evaluated for detecting interference with specific attention given to the L5 band where future GNSS receivers will have to operate in the presence of other aviation equipment. The AGC gain was found to vary over time related to changes in ambient temperature which will limit its effectiveness for detecting weak interferences. In [66] it was also noted that the AGC gain moved with temperature. • One difficulty with using the AGC for detection of GPS interference is that its value changes in time. In Chapter 4 it is shown that this drift is highly correlated with temperature and can be effectively removed after measuring the change in the AGC gain with respect to temperature over a couple of days. Applying this correction allows the AGC to detect interference sources down to a J/N of -8dB. A number of authors have demonstrated the use of the AGC for detecting real unknown signals in the GNSS bands. In [46] the AGC showed variation in the presence of interfering signals from a television tower in Sydney, Australia. In another case in Italy [47] the AGC was also affected due to spurious transmissions from a television tower. In [67] it was shown that the AGC could be used for finding potential sources when placed in a moving vehicle. In [68] the AGC values from a RF front-end were recorded along with IF samples at an airport and a number of interference events were detected. Analysis of IF samples during these events showed that the AGC was responding to unknown CWI signal sources. Overall in the literature the AGC can be used for detecting down to moderate levels of interference. In [60] the AGC crossed their detection thresholds at a power of -111.5 dBm in a 1MHz bandwidth. By itself, the AGC appears capable of detecting at interference power levels which satisfy the RTCA requirements for wideband RFI; however it is not able to satisfy the requirements for narrowband RFI which is as low as -120.5dBm. 22 Chapter 2 • Background Through simulations using a model of an ADC and AGC it was found that the AGC gain will respond differently to different types of interference based on the interferer’s probability density function. This is explored in Chapter 4 and it is shown that through adjusting the design and control of the AGC gain loop the difference can be minimised. This has implications when determining the minimum detectable interference levels for different RFI types. 2.4.2 Pre-Correlation In the pre-correlation category, there are a number of detection techniques that perform signal processing on the samples coming from the RF front-end. The most effective are those that perform statistical inference testing techniques on the incoming signals [69][70][71]. With these approaches, the incoming signal is broken down into small blocks and inference tests are carried out in the time and frequency domains to detect the presence of an interferer by looking for changes in signal power. Assessment windows are used a priori to characterise the statistical properties of the incoming signal in the absence of RFI and this is compared with the statistical properties of an evaluation window. Using these techniques [72] was able to detect a CW source down to -137dBm and a wideband source down to -127dBm. In [70] a statistical inference technique was able to detect a CW source down to -133.2dBm and also detect a real interferer at powers below the receiver's noise floor. These statistical techniques that perform signal processing on the raw IF samples are able to meet the RTCA guidelines for receiver susceptibility, but have the highest hardware and computational requirements. The techniques in [70] were implemented on a FPGA hardware platform to facilitate interference detection in real time [73]. • In a multiple antenna system it is possible to detect interference sources by crosscorrelating sets of data together. Theoretically cross-correlation should be able to detect wideband interference sources down to significantly lower levels than those that use a single antenna. However along with the RFI and thermal noise there will also be the signals from the GNSS satellites themselves. In Chapter 7 the use of cross-correlation for detecting RFI in the presence of the GNSS signals is explored. The cross-correlation function is found to vary as the antennas are moved further apart. Antennas placed close together allow an easy method for detecting wideband interference to below the RTCA requirements. 23 Chapter 2 Background 2.4.3 Post-Correlation It is possible to detect the presence of RFI by monitoring the behaviour of many of the observables that are produced during the GNSS tracking and navigation process. In the presence of RFI the variance of many of these observables can be expected to increase as the RFI degrades the performance of the receivers tracking loops. Examples of such observables include the correlator outputs, the effective C/No, the pseudorange error, the position error, and so on. A simple technique looking for any sudden outages or degradation in the position solution was used to demonstrate a near real-time GNSS interference detection system in the United States using the observables from national CORS network data [74]. From experimental results in [60] the AGC and C/No were found to be the most sensitive to RFI, although the hardware indicator of input signal power given by the AGC was a more reliable indicator as a whole. One of the post-correlation observables that are commonly used in GNSS processing is the carrier-to-noise density ratio (C/No). This is the ratio of the RF carrier power C to the noise power density No (the noise power N in 1Hz) and is used to evaluate the quality of the signal tracking. Under normal operating conditions this parameter is used for setting acquisition and tracking thresholds and for scaling the weighting given to different satellites when solving for position. If the C/No value is below a certain threshold it may be preferable to exclude it in the navigation process, or if the value deviates suddenly it may indicate the presence of interference. • The C/No has a reputation as a noisy measurement for RFI detection [72][75]. In this thesis in Chapter 3 it is shown how that the majority of the variations in the C/No repeats with the satellite ground-tracks in a similar way to how multipath repeats. By taking the difference between C/No measurements between ground-tracks most of the variation can be removed allowing C/No to be used for detecting weaker levels of interference with less false alarms. To ensure integrity in critical applications, Signal Quality Monitoring (SQM) has been developed to detect anomalies in the signals transmitted from the GNSS satellites due to hardware and other failures [76]. Once an anomaly is detected with a particular satellite, data from this satellite is excluded from the position solution calculation. These techniques work by taking advantage of multiple correlators [77] to monitor the shape of the correlation triangle from the tracking process. Although analysis of the correlation triangle was originally intended for detecting anomalies, the presence of RFI will also distortion the correlation triangle. Receivers utilising SQM require large receiver front-end bandwidth and increased computational overhead as more 24 Chapter 2 Background correlators are needed. As a result its availability is typically limited to more expensive or survey grade receivers. 2.5 Interference Mitigation The vulnerability of GNSS receivers can be reduced by implementing techniques to mitigate the presence of any RFI [78]. RFI mitigation in the GNSS context is also referred to as anti-jam technologies [79]. There are a number of different interference mitigation techniques that been reported in the literature and can be broken down into the following categories: o Hardware o Pre-correlation o Baseband processing o Post-correlation o System-level 2.5.1 Hardware Techniques In all GNSS receivers an antenna is required to pick up the signals transmitted by the satellites. The RFI can be expected to come from the ground so antennas with low gain along the horizontal designed for mitigating against multipath [80] can provide some protection against ground-based transmitters of RFI. Antennas with choke-rings or multiple elements to achieve low gain along the horizon can be expensive and weighty. This kind of antenna is not suitable for all applications where weight is an issue and a radiation pattern with some gain below the horizontal is desirable, such as a banking aircraft. In the RF front-end, the shape of the filters will have an influence on the receiver’s susceptibility to interference [81]. Filters with sharp roll-offs around the GNSS signal bands will mitigate the effect [52] of near and out-of-band interference sources which are strong enough to pass through less effective filters. As spectral congestion increases it can be expected that the problems with near and out-of-band interference will increase. An example of this was a planned ground transmitter based wireless broadband network called Lightsquared which was to broadcast next to the GPS bands which was found to degrade the performance of some GNSS receivers during testing [82]. This problem will motivate the need for stronger standards for front-end filter designs in new GNSS receivers. 25 Chapter 2 Background A common hardware-based approach to mitigating interference is the use of a multi-element antenna array [78]. Using a multitude of different techniques such as beam-steering [83] and nullsteering [84], it is possible to give different weights and phase to the incoming signals from the different antenna elements to improve the signal strength of the GNSS satellites and attenuate the interfering signal. Another advantage of these arrays is that the nulling process will give an indication of the bearing of the RFI which can aid in its geo-location. A disadvantage of these techniques are the increased cost, weight, and size of the hardware. Although the antenna array systems can be expensive they are very effective and there are commercial solutions available [85]. In the RF front-end, the AGC and ADC can be used for mitigating the effect of interference. In general the more bits used in the ADC the less vulnerable the receiver will be to RFI [54]. The use of more bits will increase the effectiveness of the other mitigation techniques but comes at the expense of increased memory and hardware requirements. With the use of a multi-bit ADC the effect of CW interference can be reduced by placing the cusp of the incoming signal over the lower thresholds in the ADC [86]. This ensures that the SNR of the incoming satellites is maximised while minimising the power of CW. The AGC can also be used to mitigate the effect of pulsed-RFI. For strong pulsed RFI pulse-blanking techniques allow the RFI signal to be removed with only a small reduction in the effective SNR as long as the pulse-width of the RFI is not too long compared with the GNSS signal code period [87]. 2.5.2 Pre-Correlation The pre-correlation mitigation of RFI refers to techniques that perform signal processing on the samples coming out of the RF front-end before it is processed by the receiver baseband. The most effective pre-correlation mitigation techniques attempt to remove the interfering signal from samples while preserving as much of the GNSS signals as possible. For CW or narrowband signals different types of notch filters have been used effectively for removing RFI [88]. As the processing power available increases filters can be designed that minimise the effect on the phase of the incoming signal which will reduce the error introduced in the position solution [89]. The use of adaptive notch filters has been demonstrated to deal with RFI which was disrupting the use of precision farming equipment. For wideband RFI more advanced interference cancellation techniques are required to preserve the spectrum of the underlying GNSS signals. The wavelet transform can be used for removing more complicated forms of interference [90]. Active signal cancellation (ASC) is also possibility 26 Chapter 2 Background for RFI with known structure [91]. The ASC technique has been demonstrated for removing swept-CW signals which are used in jammers that have a wideband bandwidth which can significantly degrade the performance of the GNSS receiver but have a known signal structure. 2.5.3 Baseband Processing The effects of RFI can be reduced by modifying how the correlators and tracking loops operate in the GNSS base-band processing blocks. Techniques such as assisted-GPS [92] which facilitate longer integration times traditionally used for weak signal acquisition and tracking will improve robustness in the presence of RFI. A vector tracking loop used for tracking of weak signals [93] will also improve tracking performance in the presence of RFI [94]. Modifications of tracking loop parameters in traditional tracking loop designs can also be used to improve tracking under low SNR [95]. In [96] using a technique called MCDD improved acquisition performance in the presence of CW and narrowband interference could be achieved through the use of differential detectors and modified correlators. For multi-user interference and strong signals from pseudolites interference cancellation techniques can be used, as well as for CW type RFI [97]. 2.5.4 Post-Correlation If RFI is degrading the quality of measurements the effect on the resulting position solution can be reduced by excluding the effected satellites. These techniques are only effective if only a couple of satellites are affected by the RFI over time so that enough satellites can still be tracked to provide a position solution. In the RAIM technique redundant satellites are used for detecting faulty measurements or outliers in receiver measurements [98]. In the presence of RFI that only affects a low number of satellites over time the RAIM technique will exclude measurements from these effected satellites. The SQM technique will also flag satellites for exclusion that have distorted correlation triangles due to the RFI. If the spectral properties of the RFI can be estimated in the pre-correlation domain a more advanced technique [99] excludes satellites where the RFI is interfering with the GPS spreading code signal [56]. This technique is most effective against narrowband RFI where it is only likely to affect a low number of satellites. For a single tone CW the chances of it impacting all of the visible satellites are low as the satellites will have different Doppler frequencies. 27 Chapter 2 Background 2.5.5 System-Level At a system level there are a number of different techniques that can be used for mitigating RFI and improving the robustness in the presence of RFI. In a multi-GNSS [100] context signal frequency diversity can be achieved by using a receiver that can track a variety of satellite signals on a variety of frequencies. A number of geodetic and increasingly civilian receivers now provide the ability to track GPS and GLONASS which operate on different frequencies. GLONASS also provides an open civilian signal in the L2 band, and in modernised plans GPS provides an open civilian signal in the L2 band called L2C, and on L5. The disadvantage of this approach is that the costs of adding multi-GNSS capability are significant while the costs of a jammer that can cover multiple frequencies are lower. The level of robustness of the GPS receiver to jamming can be improved through the integration with inertial navigation system (INS) devices. For short-periods of outages the INS can be used to provide navigational capabilities until the GPS signal is restored [101]. The performance of the carrier-tracking loops in the presence of RFI can also be improved through tight-coupling with an INS allowing for narrower noise bandwidths [102]. In applications where GPS is used for timing synchronisation the robustness of the overall system to a jamming event can be improved by using a clock reference which can provide a long holdover period. Once a GPS Disciplined Oscillator (GPSDO) loses lock of the satellites the timing and frequency outputs will drift over time depending on the quality of its clock reference [103]. Cheaper reference clocks such as a Temperature Compensated Crystal Oscillator (TCXO) will drift quicker than ones which use an atomic standard. A GPSDO with a TCXO could fail the requirements for CDMA base station synchronisation within a number of hours [103]. A rubidium-based standard had a predicted holdover period of weeks. The disadvantage of using a better reference is the costs with clocks with the most stability costing many thousands of dollars [104]. 2.6 Interference Localisation Once the presence of RFI has been detected it can be dealt with by geo-locating and disabling it. The traditional method for tracking down unwanted RFI has been to use a directional antenna and move to different locations to create bearing lines that intersect where the RFI lies. This can be time consuming, and in the past it has taken months to find sources that have disrupted GNSS sources at a harbour [32] and at an airport [7]. As the direction finding equipment is moved to different locations it must be orientated correctly to minimise the errors in the bearing 28 Chapter 2 Background measurements. The source might also be intermittent, reducing the ability to make a number of bearing measurements at different locations if the source stops transmitting after the equipment is set up. In electronic warfare scenarios DF has been demonstrated to be effective in localising GPS jammers when used in UAVs [105]. Placing the direction finding equipment on an airborne moving platform overcomes many of the shortcomings of a ground-based platform that needs to be moved to different locations, which can take time. The cost of such projects will limit the use of UAVs in practice to military organisations with large budgets, or in scenarios where a case of civilian GPS jamming poses a threat to national security. 2.6.1 Network-based Localisation The problems with traditional direction finding leads to the development of network-based systems that can detect and localise RFI quickly. In a network-based solution, a permanent installation of sensor nodes is used with hardware and software specialised for localising an interference source as shown in Figure 2.8. The GNSS Environmental Monitoring System (GEMS) that was originally designed for fault detection and integrity monitoring [15] is being improved to provide this capability. Adding this capability to GEMS is a leading motivation for the research undertaken in this thesis. Another example of a proposed networked system under development that is capable of both localisation and detection is the GPS Anomaly Monitoring Equipment Suite (GAMES) [38]. For localisation purposes in a network different sensor nodes take samples of RF data which contain the signals of interference source and this is processed for use with different localisation techniques, such as angle-of-arrival (AOA), frequency difference of arrival (FDOA), time-difference-of-arrival (TDOA), received-signal-strength (RSS), etc. The implementation of a real-time network based detection and localisation system presents many research and practical challenges. 29 Chapter 2 Background Network Sensor Network Sensor Interferer Network Sensor Figure 2.8. A network of sensors placed around the runway at an airport for localising interference sources. • The work undertaken in this thesis concentrates on detection and localisation techniques which can be implemented in such a network-based system. Concerning localisation methodologies, the Dilution of Precision (DOP) of different passive localisation techniques is compared in Chapter 5 to explore the theoretical performance of each method using typical propagation models and noise values. 2.6.1.1 Angle-of-arrival In the angle-of-arrival (AOA) technique the angle at which the interfering signal arrives at different sensor nodes is used to create bearing lines which intersect at the location where the transmitter lies [106]. Digital beam-forming has been used in GNSS for improving the SNR of satellites in the presence of RFI as a mitigation technique. As well as improving the SNR by steering beams at the satellites and by nulling out the RFI the information from the beam-steering process can also be used for estimating the angle at which the RFI hits the antenna for use in a localisation system. In traditional beam-forming each channel is added together with different phase and weight in order to maximise the gain of the antenna array in different directions. The computational load from beam- forming comes from the greater amount of data used from the multiple channels in the antenna array and the need to steer beams in multiple directions. The direction of the interference source is then taken as the angle at which the received power at the beam-former is maximised. 30 Chapter 2 Background A major advantage of the AOA technique is that it does not require strong timing synchronisation between each sensor node, which is necessary for other techniques. The multiple antenna hardware also provides the added benefit of allowing the implementation of the different mitigation techniques to allow the continued operation of GNSS equipment under jamming conditions. For the geo-location scenario in Figure 2.9, demonstrated in 2D for simplicity, the AOA equations take the following form: tan(θ i ) = yi − y xi − x (2.4) where θi is the bearing measurement to sensor i, {xi,yi} is the location of the sensor i, and {x,y} is the location of the interference source. Sensor Source 10 y (metres) θ3=90° 5 θ2=180° 0 -10 -5 θ1=0° 0 x (metres) 5 10 Figure 2.9. The intersecting lines of an AOA localisation system. The Cramer-Rao Lower Bound (CRLB) can be used for determining the factors which will influence the quality of the angle estimates from an antenna array. In [107] it is used to provide a statistical lower bound on the variance when estimating the AOA of a sinusoidal signal in the presence of additive white Gaussian noise (AWGN) for a linear array of antennas, and is given by: var(θˆ) ≥ 12 (2π )2 SNR M + 1 M L  M −1 λ 31 2 sin 2θ (2.5) Chapter 2 Background where SNR is the signal to noise ratio, M is the number of antenna elements, λ is the wavelength of the signal, L is the length of the array. Looking at (2.5) the variance strongly depends on the SNR, the number of array elements, the length of the array and the angle between the source and the array. To improve the variance more array elements spread further apart can be used, but this will increase the size of the array, the time needed to calibrate the array and the computation power required to generate the bearing estimates. An adaptive antenna array for localising GPS interference [108] was developed in 2001 by the University of Adelaide in Australia. In their system an 8-element antenna array was used along with beam-forming signal processing to estimate the bearings to interference sources. The platform which was located on a van was moved to another location to create another bearing measurement to make localisation possible. The accuracy of the bearing measurements was found to be within 1-2 degrees of the true bearing measurement and the system worked well even at low SNR. Systematic biases in the phase and amplitude calibration of the antenna array limited the overall accuracy. 2.6.1.2 Time Difference of Arrival In the time-difference of arrival (TDOA) technique [109], the time-delays of the interfering signal between different pairs of sensor nodes are used to create intersecting hyperboloids in 3D or hyperbolae in 2D where the transmitter may lie. In order to calculate the time-delay, data between sensor nodes is typically cross-correlated together [110]. For the scenario in Figure 2.10 the TDOA equations take the following form: 1 c τ i − j = (ri − rj ) (2.6) where τ i− j is the time-delay of the interference signal between sensors i and j, c is the propagation constant (taken as the speed of light in a vacuum for this application) and ri is the 32 Chapter 2 Background range between the interference source and sensor i. Sensor Source y (metres) 10 5 τ1-3=0 τ2-3=0 0 -10 -5 0 x (metres) 5 10 Figure 2.10. The intersecting hyperbolas of a TDOA localisation system The lower bound on the variance of the time-delay (TDOA) measurements found through crosscorrelation is given by [107]: var(τˆ) ≥ 1 2π 2 BRMS BT × SNR eff (2.7) where BRMS is the Root Mean Square (RMS) bandwidth of the interference source, B is the noise bandwidth of the sensor nodes, T is the integration time, and SNReff is the effective SNR between the sensor nodes. A critical result for the lower bound on the variance for the time-delay estimates is that it is inversely proportional to the rms bandwidth of the interference source. For a good estimate the bandwidth of the signal should be wideband. This limits the effectiveness of a localisation system that uses TDOA to being suitable for wideband interference only. In practice CW interference cannot be ignored as it severely degrades the performance of GPS receivers [57] and any robust localisation system will need another methodology capable of localising it. A practical limiting factor in the accuracy of the time-delay measurements is the timesynchronisation between the sensors. For accurate cross-correlation the time synchronisation between each sensor needs to be as close as possible. An error of 100ns in the time transfer between each sensor will introduce an error of 30m in the equivalent range measurement. GPS is commonly used in time transfer applications but in the presence of RF interference the timing synchronisation is known to degrade [111]. A method of time synchronisation independent of GPS with accuracy in the low ns will be required which presents a serious challenge. One 33 Chapter 2 Background possible solution is the use of Locata, which claims timing synchronisation in the picoseconds [112]. • One drawback to the use of the TDOA technique is that it requires strong time and frequency synchronisation between sensor nodes. The effect of interference on timing receivers is explored in the work of this thesis in Chapter 8 in the context of a TDOA localisation system. Through the use of post-processing of captured GNSS data it is possible to do timing synchronisation offline as well. • The CRLB given by (2.7) assumes that the signal for which the time-delay is to be estimated is present along with noise only. In reality the data captured at the sensor nodes will also contain any GNSS satellites and pseudo-lites transmitting in the same band. The power of the combination of all of these signals is not negligible and the effect of these signals on distorting the cross-correlation is explored in Chapter 7. There have been a number of demonstrations of TDOA-based systems for localising RFI in the GPS L1 band. In [113] a hardware platform was developed to measure the signal propagation delay along the baseline of two antennas to create a hyperbolic positioning system similar to TDOA. This system consisted of a number of sensor nodes time synchronised to a master clock by cables. For large baselines over a large area connecting all of the sensor nodes together by cable is impractical for time synchronisation. In this system only broadband interference sources were used. In [67] a number of cheap unsynchronised RF front-ends were used to calculate TDOA measurements of a wideband interference source. The navigational data obtained from the GPS satellites contained in the data was used to time-synchronise the network of sensors when the interference source was not jamming the signal. In [114] a system was demonstrated that used GPS to provide timing to perform TDOA localisation of CDMA signals in another band. 2.6.1.3 Received Signal Strength In a Received Signal Strength (RSS) localisation system, the measured power of the interferer at each sensor node is used to create circles (or spheres in 3D) which intersect where the transmitter lies [115] as shown in Figure 2.11. The rate at which the power level falls is referred to as the path-loss and is well studied as it is important in designing communication links. The log-normal shadowing path-loss model takes the form: RSS i = P0 − 10 nlog 10 ( di ) + σi d0 34 (2.8) Chapter 2 Background where P0 is a reference power level measured at a distance d0, n is the path-loss exponent, di is the distance between the transmitter and receiver, and σi is the standard deviation of the shadowing. y (metres) Sensor Source RSS3=1 10 RSS2=1 RSS1=1 5 0 -10 -5 0 x (metres) 5 10 Figure 2.11. The intersecting circles of a RSS localisation system. Considering the example of estimating the amplitude (A) of a sinusoidal signal in the presence of AWGN, under the assumption that the frequency of the sinusoid is not near 0 or 1/2, the CRLB gives the following lower bound [107]: var( Aˆ ) ≥ 2σ 2 N (2.9) where σ2 is the variance of the AWGN and N is the data length. The lack of a bandwidth term shows that like AOA, RSS accuracy does not depend on the bandwidth of the signal. This is not the same as TDOA, suggesting that RSS could be a useful alternative for narrowband signals. A difficulty with using RSS is that the path-loss exponent n can differ significantly depending on the surrounding environment and the height of the transmitter and receiver pair [116]. In free space it falls at n=2 but in denser areas where there are a lot of blockages and multipath n can increase to higher values, and be lower where the environment behaves as a waveguide. In areas such as this the value of the shadowing σ can also be expected to increase. Without taking a detailed survey of the environment the path-loss exponent will need to solved along with the position of the transmitter which increases the complexity of the RSS approach. 35 Chapter 2 • Background Outside of the GNSS context, the RSS is an extensively used parameter in wireless networks for measuring signal quality. The common availability of the RSS value in WiFi equipment makes it a good candidate for doing real-world path-loss measurements. In Australia where the research in this thesis was undertaken it is not legal to broadcast in the GNSS bands, so experimentation was undertaken using devices operating in the 2.4GHz ISM band. In Chapter 6 the performance and suitability of using Wi-Fi devices for measuring path-loss was evaluated. • In the majority of the literature for RSS localisation the path-loss environment is assumed to be log-normal however this was not found to be the case depending on the heights of the transmitter and receivers. In Chapter 6 simulations and real experiments are performed at two heights to explore the practical considerations of using RSS localisation in the presence of a ground reflection which makes the path-loss noisy. In a GNSS context, the AGC in the GNSS receiver can be used for estimating the RSS of the interference. Initial results using the AGC for interference localisation was explored in [117]. In this system measured changes in the AGC value due to the switching on-off of an interference source is used to estimate its power. A grid-search is then used to find the location that best satisfies the AGC power estimates from each sensor node. The accuracy in the setup was found to be within a few meters of the true location. On a wider scale approach a system was proposed that used the AGC to form a J/N meter which could be used in a crowd-sourcing approach using mobile phones with GPS receivers to get a large number of measurements [118]. Other localisation systems have used changes in the C/No output of GPS satellites [119] to get an indication of the power of the RFI. The advantage of these techniques is that they are relatively easy and cheap to implement in GNSS hardware. • In Chapter 4 the process of estimating the RSS from changes in the AGC gain is explored. The AGC methodology was found to introduce some bias into RSS estimates and this could be corrected by changing the way the AGC operates. 2.7 Summary and Conclusion This chapter has introduced a number of issues concerning the detection, mitigation, and localisation of RFI to GNSS. Potential avenues for research are highlighted and at the appropriate parts a brief description of how the work undertaken in this thesis addresses these, along with the relevant research chapter. 36 Chapter 3 Detection of RFI to GNSS Using C/No differences 3.1 Introduction There are a number of different techniques that can be used for GNSS interference detection. Techniques which perform statistical testing on the time and frequency domain properties of signals incoming to an RF front-end have the best performance and can meet the susceptibility thresholds set by the RTCA [72],[70]. A drawback to these techniques is that they require access to the raw ADC samples and the digital signal processing needs to be implemented in hardware to perform detection in real-time [120]. Another common technique used for detecting RFI is by monitoring for changes in the AGC [64]. In practice, access to the AGC level is generally not available from commercial GPS equipment and the effect of temperature on the hardware components and the gain level also needs to be compensated in order to maximize detection performance and reduce false alarms [121]. An alternative approach that doesn't require special hardware is to use the observables that are a product of the satellite navigation process. Some of these observables, such as the carrier-to-noise ratio (C/No), can be output to the user and are available as parts of the RINEX, NMEA, and other proprietary status messages. In this chapter the interference detection performance using C/No (or the closely related SNR) measurements is investigated. 37 Chapter 3 Detection of RFI to GPS using C/No differences Traditionally C/No measurements are seen as noisy measurements for interference detection [72],[75]. Due to multipath and blockages, the C/No values vary greatly as the satellites go through their orbits, thus making an elevation vs. C/No model require relatively large detection thresholds to minimise false alarms [122]. In this chapter, using recorded C/No values from real stationary antennas and receivers, it is shown that the C/No values generally repeat with the satellite groundtrack in the same way that multipath does. By taking advantage of this observation it is possible to have tighter detection thresholds as the variations in C/No due to multipath repeat and can be differenced away. In the first part of this chapter the C/No is detailed and the influence of the estimation of the noise density (No) on the resultant C/No value is explored analytically. These results are then compared with synthetic data tracked with a software GPS receiver to get an idea of what to expect from C/No values in the presence of interference. The C/No values were then recorded for a number of days using a stationary antenna and RFI of different powers was added to the data from the last day to determine experimental detection performance. To gain an insight into the detection and false alarm rates in a true GNSS context, C/No values are then extracted from the RINEX data from an IGS station that provides useable GPS and GLONASS observables. An experiment is then performed with a real CW RFI added in the RF path to a GPS receiver. Parts of the work shown in this chapter have been published in the following conference proceedings [14]: Thompson RJR, Wu J, Balaei AT, Dempster AG, (2010) Detection of RF interference to GPS using day-to-day C/No differences. Proceedings of the 2010 International Symposium on GPS/GNSS, Taipei, Taiwan, October 2010. 3.2 Carrier to Noise Density Ratio (C/No) In GPS baseband processing the C/No value in dB/Hz is used for assessing the signal quality of tracked satellites and can be defined as [123]: C = 10 log 10 ( SNR • β r ) N0 (3.1) where C is the power of the GPS carrier, N0 is the receiver noise density in a 1Hz bandwidth, SNR is the signal-to-noise ratio, and βr is the receiver's equivalent pre-correlation bandwidth. For 38 Chapter 3 Detection of RFI to GPS using C/No differences a typical GPS receiver with a 2MHz bandwidth the noise power N will be equal to -111dBm. Nominally GPS signals arrive at a signal power of about -131dBm. This is 20 dB below the noise floor in a 2MHz bandwidth, making the SNR equal to -20 dB, resulting in a nominal C/No value of a GPS satellite of 43dB/Hz. The lower the C/No value the lower the quality of the pseudo-range and phase measurements can that be expected and the observations should be weighted appropriately while calculating the position solution. In the NMEA standard, C/No values are available as part of the GSV (satellites in view) message. In the RINEX standard, C/No values are available as part of the S1 observable. One problem with using the C/No values from GPS receivers for detection of RFI is that there is generally no information on how the value was calculated. There is no set standard for the calculation of C/No values specified in the NMEA and RINEX standards. In order to estimate the fall in C/No in the presence of interference this needs to be known as well as the receiver's precorrelation bandwidth. 3.2.1 C/No Estimation In Figure 3.1 an outline is given of a generic RF front-end for a band-pass sampling GPS receiver. The RF input from the antenna consisting of the GPS carrier power C and the interference power Cl first passes through an LNA. The RF signal is filtered, down-converted, and filtered again. The bandwidth of the filters determines the noise bandwidth and can vary from 2MHz for a typical commercial GPS receiver to 88MHz for a receiver used in geodetic applications [124]. RF LNA RF Filter IF Filter input: BW: ∿ x(t) C, Cl, N -βr/2 to βr/2 Figure 3.1. Generic receiver front-end. Following the working in [56], the signal x(t) after down-conversion to baseband and filtering can be represented by: x (t ) = eiθ s (t ) + w(t ) 39 (3.2) Chapter 3 Detection of RFI to GPS using C/No differences where θ is the phase of the s(t), s(t) is the GPS signal and w(t) is the interference plus noise signal. In this work it is assumed that all of the power of C and Cl pass through the front-end filters. In receiver operation this signal x(t) is then correlated with a replica signal for acquisition and to determine the time of arrival of the satellite signal for use in the navigation process: ck (τ ) = 1 T ( k +1)T ∫ x (t ) r (t − τ ) e * − iθ dt (3.3) kT where τ is the time delay of the replica signal, θ is the phase, and T is the integration time. Hardware consisting of a number of correlators and tracking loops are used to find and track the values of the time delay and phase that maximise the value of (3.3). Assuming that the tracking loop is properly tracking the satellite signal and K is large, the carrier power of the satellite signal can be estimated by taking the average of the prompt (τ=0) in-phase correlator output: K  1  Cˆ =  ℜ{c k (0 )} K  k =1  ∑ (3.4) 3.2.2 Noise Density Estimation In this work the two different methodologies for estimating the noise-density will be investigated: the pre-correlation method that uses the power of x(t), and the post-correlation method that uses the variance of the correlator outputs. 3.2.2.1 Pre-correlation Noise Density (pre-No) In the pre-correlation method the noise density is estimated without using the outputs of the correlation process. Rather than reflecting the variance of the tracking loops it reflects the power of the input signal after filtering:  C  N  0   =   pre C βr / 2 N 0 + Cl ∫G (f ) β (3.5) l − r /2 where Gl ( f ) is the power spectral density of the RFI normalized to 1. The value of the noise density plus the RFI power can be estimated from the power of the incoming signal: 40 Chapter 3 Detection of RFI to GPS using C/No differences ( ) Nˆ 0 pre 1 = β r LT LT ∫ x(t ) 2 dt (3.6) 0 This leads to the following estimate of the C/No using a pre-correlation noise density estimate:  Cˆ   Nˆ  0   =   pre 1 K  K   ℜ{c k (0 )}  k =1  ∑ 1 (3.7) LT ∫ x (t ) 1 β r LT 2 dt 0 In many commercial receiver designs an Automatic Gain Control (AGC) is used to keep the power level at the input to the Analogue to Digital Converter (ADC) at a constant level that minimizes the quantization loss. If the AGC is operating correctly the power level at the input to the ADC should be constant, so x(t) will be constant and as a result the N0 estimate can be set to a constant value. In Figure 3.2, C/No values using pre-No are shown for the satellite pass of PRN 28 recorded from an antenna on the rooftop of the Electrical Engineering building at the University of New South Wales (UNSW). IF data was collected using a NordNav R30 software receiver on 6/9/2011 and the C/No calculated using the raw correlator outputs using (3.7). As the elevation increases the C/No value increases as expected and the values look relatively clean. The C/No values are not entirely smooth and at lower elevations there are visible oscillations caused by multipath as shown in Figure 3.3. 46 45 C/No (dB/Hz) C/No (dB/Hz) 50 40 35 44 42 40 38 30 4 4.05 4.1 4.15 Time (s) 4.18 4.2 5 x 10 Figure 3.2. C/No values of an observable satellite using a pre-correlation estimation of the noise density. 4.19 4.2 Time (s) 4.21 5 x 10 Figure 3.3. Close-up of multipath oscillations as the satellite moves through different parts of the sky with a pre-correlation estimation of the noise density (zoom of Figure 3.2). 41 Chapter 3 Detection of RFI to GPS using C/No differences As the pre-correlation method does not need to estimate the variance of the correlator outputs the number of computations required is minimized. An issue with the pre-correlation method is that it does not give any indication to the variance of the correlator output. An increase in tracking loop variance could be evidence of many things that disrupt receiver operation, including the presence of narrowband RFI, ionospheric scintillation, spoofing attacks, multi-user interference, Doppler collision, and short-time multipath. 3.2.2.2 Post-Correlation Noise Density (post-No) In the post-correlation noise density estimate the noise density reflects the power of the signal that enters the tracking loops:  C  N  0   =   post C βr / 2 N0 βr / 2 ∫ G ( f )df + C β∫ G ( f )G ( f )df β s − r l l − /2 r (3.8) s /2 where Gs ( f ) is the normalized power spectrum of the GNSS signal and Gl ( f ) is the normalized power spectrum of the RFI. The Gl ( f ) · Gs ( f ) term corresponds to the spectral intersection of the GNSS signal and the RFI and is referred to as the Spectral Separation Coefficient (SSC) [125]. There are a number of different ways of estimating the noise density from the tracking outputs. One possibility is to use the sample variance from the prompt quadrature-phase (imaginary part of (3.3)) correlator output: K  1  2  (ℑ{ck (0)})  C K  k =1  ∑ (N 0 )post = 2Tˆ (3.9) Depending on the desired statistical properties of the C/No there are many different techniques which can be used for its estimation. In this work the Moments Method (MM) is chosen due to it being unbiased [126]. MM uses the second and fourth order moments of the received constellation noise in order to estimate the signal to noise ratio: 1 Mˆ 2 = N 1 Mˆ 4 = N K ∑ ℜ{c (0)} + ℑ{c (0)} k 2 k (3.10) k =1 K ∑ ℜ{c (0)} + ℑ{c (0)} k k k =1 42 4 (3.11) Chapter 3 Detection of RFI to GPS using C/No differences 2 Mˆ 22 − Mˆ 42 Pˆd = Pˆn Mˆ − 2 Mˆ 2 − Mˆ 2 2 2 4 (3.12) In Figure 3.4 the C/No with a post-correlation noise density estimate are shown estimated using (3.12). Although from the same set of raw correlator values as the pre-No estimates shown in Figure 3.2, the C/No values are a lot noisier. At a number of different elevations there are locations where there are dips and an increase in variance which could indicate events that cause tracking quality to degrade. Long-term variations due to multipath can be seen in Figure 3.5 as well. 50 C/No (dB/Hz) C/No (dB/Hz) 50 45 40 35 45 40 35 30 30 5.5 6 6.5 Time (s) 7 4.18 7.5 4.19 4 x 10 Figure 3.4. C/No values of an observable satellite using a post-correlation estimation of the noise density. 4.2 Time (s) 4.21 4.22 5 x 10 Figure 3.5. Close-up of multipath oscillations as the satellite moves through different parts of the sky with a post-correlation estimation of the noise density (close-up of Figure 3.4). 3.3 Comparison between pre-No and post-No with RFI The way the receiver estimates the noise power will have the most dramatic effect on the C/No estimate in the presence of interference. According to the analysis in [56] the estimation of noise density using the variance of the correlator outputs results in the C/No being more sensitive in the detection of narrowband interference then estimating it using the power of the incoming samples. In Figure 3.6 the drops in C/No are shown in the presence of a CW RFI of increasing Jammer-toNoise ratio (J/N) using (3.5) and (3.8). In this work the value of N is set equal to (3.6), the power of the down-converted signal after filtering. The fall in C/No (pre-No) is the same regardless of the frequency of the CW, while for the post-No it is different. The C/No values using precorrelation noise density estimate cause a constant fall in C/No with increasing Jammer to Noise ratio (J/N) while at some frequencies there is no drop for the post-No. 43 Chapter 3 Detection of RFI to GPS using C/No differences In Figure 3.7 the C/No is shown for a CW RFI with changing frequency. A 20ms integration time is used and the receiver bandwidth is set equal to 2MHz. The CW has a J/N of -5dB and a Jammer-to-Signal ratio (J/S) of 15dB. The C/No values using the post-correlation noise density estimate falls only when the CW crosses the power spectrum of the GPS signal. Away from the spectral lines the CW is effectively suppressed and no falls in C/No are observed. The normalized power spectrum Gs ( f ) was calculated using a real GPS spreading code to demonstrate that the use of the short finite length code (1023 chips every 1ms) does not result in a smooth sinc-shaped spectrum but a line spectrum that follows a sinc-shaped envelope. Longer modern codes such as L2C-M (10230 chips every 20ms) do not resolve as sharply and have a more ideal sinc-shape, 42 40 35 C/No (dB/Hz) C/No (dB/Hz) even for long integration times. Nopost+30.5kHz Nopost+31kHz 40 Post No Pre No No RFI 38 pre-No 30 -30 -20 -10 J/N (dB) 0 3.2 10 Figure 3.6. Comparison of effective C/No with increasing J/N. 3.25 3.3 3.35 Doppler (Hz) 3.4 4 x 10 Figure 3.7. Comparison of effective C/No with increasing Doppler. 3.3.1 Effect of Integration Time The length of the integration time used in the correlators will have an effect on the drop in C/No in the presence of RFI [57]. In Figure 3.8 the dips in C/No are shown for a GPS spreading code with different integration times. Using a longer integration time makes the spectrum of the spreading codes resolve into finer lines, resulting in falls in C/No only as the CW crosses these lines. Due to the encoding of a data-bit the longest coherent integration time for GPS without aiding such as data wipe-off is 20ms. It is evident that using a longer integration time will allow some satellites to continue tracking in the presence of even a strong CW RFI as long as it does not cross these spectral lines. This can be used to provide some mitigation against CW RFI as the Doppler values of visible satellites are varied and it is unlikely that all satellites will be affected. Also, prior knowledge of the CW frequency can be used to exclude such satellites so it doesn't degrade the navigation solution [99]. 44 Chapter 3 Detection of RFI to GPS using C/No differences GLONASS also uses a spreading code for ranging but uses different carriers for different satellites in a Frequency Division Multiple Access (FDMA) system, not different spreading codes for different satellites in a Code Division Multiple Access (CDMA) system as used by GPS. The spreading code for GLONASS is 511 chips long with a chipping rate of 511 Mchips/s. Although the GLONASS code is shorter than the GPS codes it still resolves into 1kHz spectral lines as it repeats every 1ms. In Figure 3.9 the fall in C/No is shown for a particular GPS spreading code and the GLONASS spreading code. The comparison is made using a 10ms integration time as data-bits for GLONASS are encoded every 10ms, not 20ms like GPS. The dips for GPS show variation in the magnitude of the spectral lines as a result of design for good cross-correlation properties. The GLONASS code has been designed for an optimal autocorrelation function (no cross-correlation triangles) and as a result the dips are more regular and strongly follow a sincshaped envelope. This difference in the drops in C/No between GPS and GLONASS, along with the different satellite orbit behaviour, means that they will have different vulnerability and 42 42 40 40 C/No (dB/Hz) C/No (dB/Hz) detectability performance over time in the presence of RFI. 38 36 1ms 5ms 10ms 34 32 1.1 1.15 1.2 1.25 Doppler(Hz) 38 36 GPS GLONASS 34 32 1.3 1.1 4 x 10 Figure 3.8. Effect of integration time on C/No losses for a GPS satellite in the presence of CW RFI. 1.2 1.3 Doppler(Hz) 1.4 4 x 10 Figure 3.9. Comparison of dips with GPS and GLONASS in the presence of CW RFI (10ms integration time). 3.3.2 Noise-Density With Synthetic Data The different methods for estimating the noise density will have different properties. In Figure 3.10 the C/No values are shown using IF data generated in MATLAB for the scenario shown above. The data is generated in MATLAB at a sampling rate of 5.714MHz and an IF frequency of 4.309MHz. The frequency plan and quantization used matches that of a popular commercial GPS front-end [127], the Zarlink GP2015. A CW RFI is added starting at a Doppler offset of 10.5kHz with frequency increasing at 10Hz/s. The data is then tracked using the NordNav software receiver with a coherent integration time of 20ms and the correlator outputs recorded at 50Hz. 45 Chapter 3 Detection of RFI to GPS using C/No differences The commercial software receiver was used to verify the correctness of the synthetically generated data. The pre-No C/No values are estimated using (3.7) with the noise power equal to a constant and the post-No C/No values are estimated using (3.12). As can be seen in Figure 3.10 the size and locations of the dips in C/No (post-No) closely match the analytical results shown in previously in Figure 3.8 using (3.8). The C/No values from the post-correlation method are noisier but show a better indication of the quality of receiver tracking in the presence of RFI. Insights into why the behaviour of the C/No estimates are different can be found by examining the values of the absolute value of the in-phase (I-P) and quadrature-phase (Q-P) correlator outputs from the data in Figure 3.11 with the corresponding C/No values shown Figure 3.10. The pre-No method estimates the carrier power by averaging the value of the I-P channel over time and dividing by a constant estimate of the noise density from the power of quantized samples. This will smooth out the increase in the variance that is visible in Figure 3.11 in the I-P channel as the CW RFI crosses the GPS line spectrum and none of the variance from the Q-P channel is used for estimating the noise density. The post-No method on the other hand uses the variance of the tracking outputs in order to estimate the noise density. As a result, using the post-No will give detection performance similar to monitoring the 'correlator output variance' as investigated in [128]. Using the post-No method results in noisier C/No values which is one reason it might not be used in many commercial receivers. 50 Correlator Output C/No (dB/Hz) 15000 45 40 35 30 post-No pre-No 10000 0 100 200 300 400 Time (s) 500 600 Figure 3.10. C/No estimated from synthetic data showing how a post-correlation estimation of the noise density reveals falls as the CW RFI crosses spreading code spectral lines. I-P Q-P 5000 0.5 1 1.5 2 2.5 Time (20ms) 3 4 x 10 Figure 3.11. Correlator outputs from synthetic data (same data as used for Figure 3.10) revealing the increase in tracking loop variance as the CW RFI crosses spreading code spectral lines. 46 Chapter 3 Detection of RFI to GPS using C/No differences 3.4 Detection of RFI using C/No. A common method for the detection of RFI using the C/No is to record the values when a satellite is visible and fit a polynomial model of the C/No versus elevation [63],[122]. A threshold can be chosen based on the standard deviation of the fit at different elevations and the presence of RFI is detected when the C/No goes below this threshold. This can be written as:  C  C C (θ ) > mean (θ ) − 6 ⋅ σ  (θ )  ? N0 N0 N  0  (3.13) where θ is the elevation angle and σ is the standard deviation calculated from previous C/No data. Using the pre-No values from the previous section a detection threshold calculated using the mean and standard deviation of the C/No values (in 5 degree elevation windows) using a quadratic fit is shown in Figure 3.12 and Figure 3.13. At low elevations the detection threshold grows significantly as the standard deviation of the quadratic fit increases due to multipath. On the right side of the ground track (shown in Figure 3.13) below 20 degrees elevation the C/No falls suddenly and even with the six sigma threshold there are still false alarms. This could be because of a signal blockage. 50 C/No (dB/Hz) C/No (dB/Hz) 50 45 40 C/No Threshold 35 45 40 35 C/No Threshold 30 30 20 30 40 50 Elevation (degrees) 5.5 60 Figure 3.12. A plot of the C/No values (using pre-No) versus elevation for a satellite. The threshold is made using (3.13). 6 6.5 Time (s) 7 7.5 4 x 10 Figure 3.13. A plot of the C/No values (using pre-No) over time during a flyover. The threshold is made using (3.13). 3.4.1 ∆C/No Detection Previous work has shown that multipath repeats with the satellites groundtrack for GPS from day to day [129]. This has been used to detect and remove multipath at stationary receivers such as at GNSS reference stations. This multipath is also responsible for the majority of the variations in C/No as the signal reflections combine additively and subtractively with the line-of-sight signal. 47 Chapter 3 Detection of RFI to GPS using C/No differences These kinds of variations could also cause false alarms with techniques that only look at the timeseries of C/No values [72],[75]. In Figure 3.14 the C/No values (using pre-No estimation) are shown for a GPS satellite over two groundtrack repetitions (one day after another). The plot for the second day is shifted to the left as GPS satellites appear in the same place in the sky approximately 4 minutes earlier each day. In Figure 3.15 the C/No values are shown with the groundtrack repeat time added to the time-stamps of the previous day. This shifts the previous day plot to the right and the C/No values match up closely. 50 50 C/No (dB/Hz) 48 46 45 44 42 40 C/No(d-1,t) C/No(d,t) C/No(d-1,t-244) C/No(d,t) 40 38 4.16 4.17 4.18 4.19 4.2 4.21 5 Time (s) x 10 4.16 4.17 4.18 4.19 4.2 4.21 x 10 Figure 3.14. The C/No values from a satellite one day after another. The satellite groundtrack repeats approximately 240 seconds earlier each day. 5 Figure 3.15. Two consecutive days of C/No values with the last day values corrected for groundtrack repeat time. The C/No values now align. The majority of C/No variations caused by multipath can be removed by taking differences between the C/No values between these two groundtrack repetitions. These measurements have been named ∆C/No with the units of dB and are calculated using: ∆ C C C (d , t ) = (d , t ) − ( d − 1, t − τ ) N0 N0 N0 (3.14) where d is the day of observation, t is the time in seconds, and τ is the groundtrack repeat time. The value of τ is different for each individual satellite and should be calculated with each groundtrack repetition due to changes in the satellite motion over time. For GPS this value is approximately 240 seconds, but is different for each individual satellite. This value can be derived from the orbit model in the ephemeris data. In this work the repeat time was found using the International GNSS Service (IGS) precise ephemeris data by finding the point in time which the position of the satellite is closest between two groundtrack repetitions. 48 Chapter 3 Detection of RFI to GPS using C/No differences As the C/No values repeat the presence of RFI can be detected by looking for any unusual changes. In Figure 3.16 the ∆C/No value is shown for a satellite's groundtrack. As can be seen much of the variation has been removed and the ∆C/No has near zero-mean. For the pre-No estimate this works well and significantly reduces the standard deviation at times where multipath is prominent compared with the elevation fit models. A disadvantage of this technique is that it assumes that the multipath environment doesn't change over time so is only suitable for stationary receivers in environments that don't change very much. It also assumes no interference in the original data. In Figure 3.17 the ∆C/No is shown for the post-No estimates. These values are a lot noisier and will be less effective for RFI detection. 5 1 ∆ C/No (dB) ∆ C/No (dB) 2 0 -1 0 -5 -2 4 4.05 4.1 4.15 Time (s) 4 4.2 5 x 10 4.05 4.1 4.15 Time (s) 4.2 5 x 10 Figure 3.17. The ∆C/No values using a postcorrelation noise density estimate. Figure 3.16. The ∆C/No values using a precorrelation noise density estimate. 3.4.1.1 Statistical properties of ∆C/No To examine the potential performance improvement using ∆C/No, the standard deviation was calculated in windows of 5 degrees on the resulting ∆C/No using (3.14) as well as the polynomial fit using (3.13). The results are shown in Figure 3.18 and Figure 3.19. For the pre-No values taking the ∆C/No significantly reduces the standard deviation at all elevations for this particular satellite. The improvement is less significant for the post-No values and even increases the standard deviation at certain elevations. 49 Chapter 3 Detection of RFI to GPS using C/No differences 5 Standard deviation Standard deviation C/No 4 ∆ C/No 3 2 1 0 5 C/No 4 ∆ C/No 3 2 1 0 20 30 40 50 Elevation (deg) 60 Figure 3.18. Standard deviation for C/No techniques (pre-No). 20 30 40 50 Elevation (degrees) 60 Figure 3.19. Standard deviation for C/No techniques (post-No). To examine the behaviour of ∆C/No with elevation the kernel density estimates of the standard deviation in 20 degree elevation windows are shown in Figure 3.20 and Figure 3.21. The pre-No values resemble a Laplace or Gumbel distribution. There is a noticeable shift in the mean and change in kurtosis at different elevations. This may be because the satellite signal travels through more of the atmosphere at lower elevations which has changing propagation properties with weather, or changes in the efficiency of the receiver components over time due to temperature. The post-No values resemble a Gaussian distribution. As the post-No values are dominated by the variance of the tracking loops the ∆C/No values can be interpreted as the difference of two Gaussian distributions with similar mean and standard deviation that doesn't vary much with elevation. Density 0-20 20-40 40-60 60-80 3 2 Density 0.3 4 0-20 20-40 40-60 60-80 0.2 0.1 1 0 -1 -0.5 0 x 0.5 0 1 -5 0 5 x Figure 3.20. Kernel density estimate of ∆C/No in different elevation windows for pre-No. Figure 3.21. Kernel density estimate of ∆C/No in different elevation windows for post-No. 50 Chapter 3 Detection of RFI to GPS using C/No differences 3.4.1.2 Detection Performance (pre-No) As with the C/No versus elevation fit, a six-sigma threshold of the previous day's ∆C/No values can be used to create a detection threshold. This requires at least two days of training C/No values. For the ∆C/No values the standard deviation was calculated in 100 second steps and multiplied by six to form a detection threshold. This window size was found to give a low number of false alarms while being able to detect interference to a low J/N. The detection performance could be improved with more methodological tuning of the parameters of window size and threshold on each satellite individually and is left as potential future work. In Figure 3.22 an example detection threshold is shown using ∆C/No values. The threshold increases when the satellite is at lower elevations due to the multipath. Even though taking the ∆C/No does reduce the effect of the multipath it does not remove it completely. To get an idea of the detection performance possible with this set of data the theoretical fall in the C/No was calculated using (3.5) and added to the C/No data on the chosen day of observation. The receiver bandwidth is assumed to be 2MHz resulting in a noise power of -110dBm. This section will concentrate on CW type RFI. The number of detections was recorded with a number of different J/Ns. In Figure 3.22 the theoretical fall in ∆C/No is shown for an RFI with a J/N=10dB in comparison to when no RFI is present. In Figure 3.23 the number of detections as the J/N of the RFI is increased is shown. At a J/N of -15dB the number of detections begins to increase noticeable. For a receiver with a narrow bandwidth this technique can detect RFI at low power levels but as the bandwidth increases the absolute minimum detectable interference in terms of absolute power decreases. For example for a 2MHz BW (N=-110dBm) this equates to a 1500 0 Detections ∆ C/No (dB) J/N of -125dBm, but with a 20MHz BW this equates to a J/N of -115dBm. -2 J/N=-10dB No RFI Threshold -4 1000 500 0 5.5 6 6.5 Time (s) 7 7.5 x 10 -25 4 Figure 3.22. ∆C/No values with and without RFI. -20 J/N (dB) -15 -10 Figure 3.23. The number of detections as RFI power is increased. 51 Chapter 3 Detection of RFI to GPS using C/No differences 3.4.1.3 Detection Performance (post-No) The C/No and resultant ∆C/No values have a much higher variance when post-No estimation is used. Although undesirable in terms of time to detection the variance can be reduced by averaging the C/No values. A 30 second averaging period was found to reduce the standard deviation to a level similar to that which was found with the pre-No values. The smoothed data has a standard deviation of 0.3356 compared with 1.4979 for the unsmoothed data. The use of averaging or smoothing can be undesirable as short bursts of RFI may be smoothed out and a delay is added to the detection time. The averaged C/No values are shown in Figure 3.24. Unlike the pre-No values there are noticeable variations in the C/No even at high elevations. Overall the averaged C/No values still repeat each day and can be used for detection. In Figure 3.25 the ∆C/No values are shown along with the six-sigma detection threshold. Unlike the pre-No there are large jumps in the detection threshold at certain times. This is because of sudden large dips at a high elevation of short duration in one of the training data sets. This would have caused false alarms if it was in the day that was being checked for RFI. The cause of these dips is not known, but there are a number of effects that could increase the variance of the tracking loops. ∆ C/No Threshold 50 ∆C/No (dB) C/No (dB/Hz) 2 45 Dayn-1 Dayn 40 5.5 6 6.5 Time (s) 0 -2 -4 7 6 4 x 10 Figure 3.24. The repetition of the post-No C/No values after averaging every 30 seconds. 6.5 Time (s) 7 7.5 x 10 4 Figure 3.25. The post-No ∆C/No values and the detection threshold after averaging every 30 seconds. Measuring the detection performance for the post-No estimates is more complicated as the drop in C/No will depend on the spectral properties of the RFI and the spectral separation coefficient at a particular point in time. If a receiver is using a long integration time in the presence of even a strong CW RFI there may be no immediately fall in C/No depending on the SSC. If the CW 52 Chapter 3 Detection of RFI to GPS using C/No differences crosses a strong spectral line there could be a large fall in C/No even if the CW has low power. In Figure 3.26 the fall in ∆C/No is shown calculated using (3.8). The natural rate of change of Doppler for satellites is slow (in the range of 0.1Hz/s) so the 30s averaging process does not significantly reduce the magnitude of the dips. In Figure 3.27 the number of detections is shown with a CW RFI at two different frequencies. At L1+10.5kHz there is a strong spectral line so over this satellite's groundtrack the CW could be detected at a J/N of -25dB. At L1+33kHz there is no strong spectral line and the RFI is detected at a J/N of -15dB. IF+33kHz IF+10.5kHz 2 1500 -2 -4 -130dB No RFI Threshold -6 -8 5.5 6 6.5 Time (s) 7 7.5 Detections ∆ C/No (dB) 0 1000 500 0 -30 -20 -10 0 J/N (dB) 4 x 10 Figure 3.26. ∆C/No (post-No) values with and without the effect of RFI using (3.8). Figure 3.27. The number of detections (post-No) as the power of a CW RFI at different frequency offsets is increased. The probability of detecting narrowband RFI improves over time as the chance of the CW crossing a strong spectral line increases, and due to each satellite having a different spreading code the number of detections will be different. To explore the detection performance over 24 hours with all satellites for a single CW the fall in C/No was calculated using (3.8) for all the visible satellites over 24 hours. As the real ∆C/No values were not available a fixed threshold was used based on the standard deviation of the ∆C/No for the available values for the satellite shown in Figure 3.25. In Figure 3.28 all of the dips in ∆C/No are shown for the visible satellites (elevation > 5 degrees) for a CW with J/N of -20dB over an 11000 second period. In Figure 3.29 the number of detections over 24 hours are shown for CWs at two different frequencies. The performance is about the same over 24 hours and the CWs can be detected down to a J/N of 22.5dB. With a realistic threshold based on all of the visible satellites if the real data was available the real-world performance would be better than this. The histogram of the detections will also give some insight into the type of interference. For a CW interferer the hits will occur at multiples of 1kHz as it crosses different spectral lines as the satellite Doppler changes. 53 Detection of RFI to GPS using C/No differences 0 5000 -1 4000 Detections ∆ C/No (dB) Chapter 3 -2 -3 -4 IF+33kHz IF+10.5kHz 3000 2000 1000 -5 2 2.2 2.4 2.6 Time (s) 2.8 0 -30 3 4 x 10 Figure 3.28. The drops from all visible satellites (post-No). -25 -20 J/N (dB) -15 -10 Figure 3.29. The number of detections as RFI power is increased (post-No). 3.5 UNSW Experiment In the previous section the analysis was performed with real C/No values for only one satellite. This was due to technical limitations with the NordNav receiver not being able to reliably output the raw correlator values at 50Hz in real-time. In order to get the raw correlator values the IF data was recorded to disk while the chosen satellite was visible for three days and post-processed. To get a better idea of the behaviour and detection performance of using ∆C/No measurements over time the C/No values given by the NordNav at 1Hz was recorded to RINEX format in real-time over a number of days and processed. 3.5.1 C/No Repeatability It is not known what specific C/No estimation algorithm is being used by the NordNav software but it does have similar behaviour to the pre-No technique discussed previously. In Figure 3.30 the C/No and repeatability is shown for a certain satellite over 3 days. In Figure 3.31 the ∆C/No values are shown along with the threshold from the two previous day's data. Again using ∆C/No removes the variations due to multipath. There is a gap in the data caused by the instability of the NordNav software due to overflows in the USB transfer buffer. Although the C/No values from the NordNav appear noisier the ∆C/No technique is able to produce a usable detection threshold with 100s standard deviation estimation windows without requiring any averaging. 54 Chapter 3 Detection of RFI to GPS using C/No differences Day 2-1 42 ∆C/No (dB) C/No (dB/Hz) 2 40 38 Day n-2 36 Day n-1 34 Day n 2.2 2.3 2.4 Time (s) 0 -2 -4 2.5 Threshold 2.6 2.2 4 2.3 2.4 Time (s) 2.5 2.6 4 x 10 x 10 Figure 3.31. The ∆C/No values corresponding to the C/No values shown in Figure 3.30, with the variations from multipath reduced. Figure 3.30. Large-scale variations in multipath that repeats day-to-day from the NordNav C/No measurements. Observing the 7 days worth of data revealed some unusually strong multipath. An example of such event is shown in Figure 3.32. These strong multipaths were present even at higher elevations. The ∆C/No technique is able to deal with this as seen in Figure 3.33 with no unreasonable increase in the detection threshold. Day 2-1 2 ∆C/No (dB) C/No (dB/Hz) 44 42 Day n 40 Day n-1 38 2.8 1 0 -1 -2 Day n-2 2.78 2.785 2.79 2.795 Time (s) Threshold -3 2.805 2.78 2.785 2.79 2.795 Time (s) 4 x 10 2.8 2.805 4 x 10 Figure 3.33. The ∆C/No values corresponding to the C/No values shown in Figure 3.32, with the multipath variations effectively removed. Figure 3.32. A strong oscillation in the C/No caused by multipath that repeats day-today. 3.5.2 Statistical Properties of ∆C/No Measurements In Figure 3.34 the standard deviation of all the ∆C/No values is shown for different satellites for different day pairs. A day pair refers to the ∆C/No taken on the days n and n-1. The standard deviation doesn't vary much between the day pairs. In Figure 3.35 the mean of all of the ∆C/No 55 Chapter 3 Detection of RFI to GPS using C/No differences values is shown for different satellites for different day pairs. Weather was found to have a noticeable effect on the ∆C/No. On the first day pair there was a storm later in the day which caused a fall in the mean of the ∆C/No. PRN 1 does not follow the same trend as the other satellites and this is because it was visible before the storm and as a result didn't show a decrease. As changes in AGC values have been shown to be correlated with changes in temperature this could be having an effect on the resulting C/No values as well. Over time the ∆C/No trend is similar over satellites that have similar visibility times. An unusually large change in temperature or other weather effect could potentially cause false alarms if the detection threshold is set too tightly and doesn't take this into account. It would be difficult to distinguish between a fall due to weather and a weak wideband RFI without another detection technique and information regarding the environment the receiver is in. 0.2 #1 #9 #12 #27 0.45 0.4 0.1 mean(∆ C/No) Standard deviation 0.5 0.35 0 #1 #9 #12 #27 -0.1 -0.2 -0.3 1 2 3 Day pair 4 5 1 2 3 Day pair 4 5 Figure 3.35. The mean of ∆C/No for different satellites over a number of day pairs. Figure 3.34. The standard deviation of ∆C/No for different satellites over a number of day pairs. 3.5.3 Day Separation In certain situations it will be necessary to take the ∆C/No after more than just a single groundtrack repetition. This will be important for the use of other GNSS that have different groundtrack repetition rates (such as 8 days for GLONASS) and for having a clean set of C/No values in case one day is already affected by RFI and shouldn't be used to form detection thresholds. The impact of increasing the day separation will be examined by looking at the standard deviation over time for the ∆C/No as the day separation is increased. In Figure 3.36 the standard deviation is shown for PRN27 calculated in 300 second windows. As the day separation increases so does the standard deviation. After 5 days there are small numbers and a dramatic increase when the satellite is at low elevations due to multipath. After a number of days the 56 Chapter 3 Detection of RFI to GPS using C/No differences multipath does not repeat each day as closely. In Figure 3.37 standard deviation for increasing day separation is shown for PRN2. For this satellite there is a spike in the standard deviation that increases with increasing day separation. At that time a strong multipath as shown in Figure 3.32 was visible. For multipath of this type the ∆C/No could be a useful detection technique without the need of processing the pseudorange and carrier-phase data as is typically used in multipath 1.5 1 day 3 days 5 days 1 0.8 Standard deviation Standard deviation detection techniques [129]. 0.6 0.4 0.2 2.5 3 Time (s) 1 0.5 0 2.5 3.5 4 x 10 Figure 3.36. Standard deviation for PRN27. 1 day 3 days 5 days 3 3.5 Time (s) 4 4.5 4 x 10 Figure 3.37. Standard deviation for PRN2. 3.5.5 False Alarm Performance The ∆C/No detection technique was run over 6 day pairs of collected data to get an insight into the false alarm performance that can be expected. This is the kind of information that will be useful to the people monitoring the health of a GNSS reference stations and the results can be interpreted to detect the presence of anomalies in the C/No values which would be from RFI. The results of the ∆C/No detection technique in terms of detections every 500s are shown in Figure 3.38 and in terms of effected satellites every 500s in Figure 3.39. This data was collected when no RFI was present so there should be no detections. During some of the day pairs there are a noticeable number of false alarms. Looking at Figure 3.39 though there is only at most two effected satellites at a time. If there was a real interference source causing a noticeable degradation in C/No it would be expected that multiple satellites would be affected given a long enough observation time. In these cases where only a single satellite is being affected could mean that the satellite is malfunctioning, experiencing multipath or a local atmospheric effect. One way to improve the false alarm performance would be to require at least 2 or 3 satellites to be affected at once. In the rest of this work the heuristic of at least 3 satellites having detections at a time will be used. 57 Chapter 3 Detection of RFI to GPS using C/No differences 2 # of effected Satellites 400 Detections 300 200 100 0 1.5 1 0.5 0 1 2 3 4 Day Pair (days) 5 6 Figure 3.38. The number of detections over time using the ∆C/No values over a number of day pairs. 1 2 3 4 Day Pair (days) 5 6 Figure 3.39. The number of satellites with simultaneous detections using the ∆C/No values over a number of day pairs. During the second day pair the noticeable jumps in detection have been observed. This is due to the NordNav software reporting observables from satellites that have not been acquired properly yet. Examples of this are shown in Figure 3.40 and Figure 3.41 and shows why there would be a number of false alarms if there are tracking problems as the satellite is just becoming visible. These could be removed with the use of a higher acquisition threshold or a better lock detector in the NordNav software. Day n-2 C/No (dB/Hz) C/No (dB/Hz) Day n-1 40 Day n-2 50 Day n 35 Day n-1 45 Day n 40 35 30 30 3.72 3.73 3.74 Time (s) 3.75 3.76 5.5 4 x 10 Figure 3.40. The tracking problems during acquisition for PRN1 which caused a number of false alarms. 5.55 5.6 Time (s) 5.65 4 x 10 Figure 3.41. The tracking problems during acquisition for PRN5 which caused a number of false alarms. 3.5.5 Receiver Response to RFI Although not specified, insights into the C/No estimation algorithm used by the NordNav can be gained by tracking synthetic data with added RFI. In MATLAB a GPS signal was generated at 20dB below a noise level at a sampling rate of 5.714MHz. The RFI of different types was then 58 Chapter 3 Detection of RFI to GPS using C/No differences added and the signal was quantized to 2-bit sign and magnitude and saved to disk to be processed by the NordNav software. In Figure 3.42 the fall in C/No is shown from the NordNav along with the expected fall from (3.5) for an added wideband RFI increasing in power. There is a noticeable bias between the two plots, most likely due to a different scale term applied to the noise power, but they both follow the same trend. The same set of data was also tracked using the software receiver of Borre et. al [130] and using the raw in-phase correlator values the C/No was calculated using the pre-No estimation method (3.7). The NordNav C/No values also look noisier compared with the values calculated using (3.7). In Figure 3.43 the fall in C/No for CW RFI at different frequencies with increasing power is shown. For CW RFI the NordNav C/No values behave differently depending on the frequency and the power level. These results imply that the in calculating the noise density, the NordNav software is doing something more complicated than just assuming it is equal to the power of the incoming samples. C/No (dB/Hz) C/No (dB/Hz) 40 40 35 KaiBorre Pre-No Eq. NordNav 30 0 20 35 30 IF IF+20500 IF+100125 25 20 40 0 60 20 40 60 J/N J/N Figure 3.42. The fall in C/No for the different C/No estimators for a wideband RFI. Figure 3.43. The fall in C/No for the different C/No estimators for a CW RFI at different frequencies. To explore the behaviour of the NordNav C/No output further, a CW RFI of changing frequency was added in synthetic data. In Figure 3.44 the C/No values are shown for a CW with frequency changing at a rate of 4Hz/s with the CW added 200s into the data. There is a noticeable drop in the C/No similar to what would be expected from using a pre-No technique but there is also a noticeable ripple as the frequency of the CW changes. This would suggest that the NordNav uses a more complicated technique in estimating the No than just using the power of the incoming 59 Chapter 3 Detection of RFI to GPS using C/No differences samples. In Figure 3.45 the C/No using post-No is shown calculated from the same set of raw correlator values (20ms integration time). As expected from (3.8) there was no sudden drop in the C/No as the CW was not intersecting with any GPS code spectral lines at that particular time. C/No (dB/Hz) There is a dip in C/No when the CW crosses a spectral line as time moves on. 48 48 46 46 44 44 42 42 40 40 RFI on 38 RFI on 38 36 36 0 100 200 Time (s) 300 0 Figure 3.44. The response of the NordNav C/No for a CW Sweep. 100 200 300 Figure 3.45. The response of the C/No using a post-correlation estimate of the noise density for a CW Sweep. These results imply that the NordNav is using a special technique for estimating the noise density which is unrelated to the variance in the correlator outputs. One possibility includes power spectrum estimation looking at the power in particular frequency bins depending on the Doppler frequency of the tracked satellite. In practice this technique gives a good compromise between the less noisy C/No values from a pre-No method while still showing some variation over time in the presence of a CW as does the post-No method. 3.5.5 Experiment Results with added RFI. To investigate the performance of RFI detection using ∆C/No with real signals a signal generator was combined with the satellite signals from the same rooftop antenna at UNSW and connected to a GPS receiver. An overview of the experimental setup is shown in Figure 3.46. The NordNav R30 was used which generated RINEX data with C/No values at 1Hz. Two consecutive days of RINEX data was recorded with no RFI present to create the ∆C/No detection thresholds with RFI added on the third day. 60 Chapter 3 Detection of RFI to GPS using C/No differences Signal Mounted antenna Generator RF combiner NordNav R30 RINEX (1Hz) Figure 3.46. Experimental Setup. As the RF signal from the antenna has been amplified by an LNA it is necessary to calibrate the power levels with the combined signal from the signal generator. To determine the J/N and calibrate the power measurements a weak CW was injected that did not change the AGC value of the receiver but created a noticeable peak in the power spectrum of the IF samples recorded by the NordNav receiver. It is assumed that the power of the samples without the CW is equal to the receiver's thermal noise. The NordNav was found to have a 3dB bandwidth of 2.7MHz resulting in an effective noise floor of -109.69dBm, and the values from the signal generator were adjusted to match this. On the third day of measurements, a CW interferer on the L1 band center frequency was added at different powers using the signal generator. To simulate a wideband interferer a 3dB attenuator was placed at the input to the NordNav receiver. This will attenuate the incoming signal and the AGC will increase its gain to compensate and in the process amplify the receiver's thermal noise, increasing the effective noise floor. The detection results are shown in Table 3. The ∆C/No technique was able to detect CW interference down to a J/N of -16.75dB, or -126.44dBm, using the heuristic of requiring at least 3 satellites having detections in the observation time. 61 Chapter 3 Detection of RFI to GPS using C/No differences Table 3.1. Detection performance for ∆C/No from the NordNav receiver J/N Observations 0^ -1.751 -6.751 -11.751 -16.751 -21.751 17306 25126 36836 27223 33022 41058 Detections Number of simultaneously effected satellites in a 500 second window 7744 6 24419 5 31940 6 2846 5 1182 4 6 1 Probability of detection (Pd) 0.4475 0.9719 0.8671 0.1045 0.0358 0.0001 ^wideband RFI test with 3dB attenuator. In Figure 3.47 an example of the fall and distortion of the C/No values is shown when a CW was present. At this power level a constant drop is visible as well as dips which change over time. In Figure 3.48 the ∆C/No is shown. The dips which are an artefact of the NordNav's C/No estimation algorithm increases the number of detections in this example. In Figure 3.49 the fall is shown when the CW is present and the probability of detection was insignificant. At this power only 1 satellite was affected in a 500s window. There were only 6 detections and it would be difficult to distinguish between RFI, multipath, or tracking problems. 0 Day n-1 45 ∆C/No (dB/Hz) C/No (dB/Hz) Day n-2 Day n 40 -2 -4 -6 ∆C/No Threshold 35 2.05 2.1 2.15 Time (s) -8 2.2 4 x 10 2.05 2.1 2.15 Time (s) 2.2 4 x 10 Figure 3.48. The ∆C/No and detection threshold corresponding to the C/No values from Figure 3.47. Figure 3.47. The C/No from the NordNav over a number of days, with a CW of J/N 8.751dB added on the last. 62 Chapter 3 Detection of RFI to GPS using C/No differences 0 ∆ C/No (dB/Hz) C/No (dB/Hz) 45 44 43 Day n-2 42 Day n-1 41 Day n 7.5 7.6 Time (s) -1 -2 ∆C/No -3 Threshold 7.7 7.5 4 x 10 7.6 Time (s) 7.7 7.8 4 x 10 Figure 3.50. The ∆C/No and detection threshold corresponding to the C/No values from Figure 3.49. Figure 3.49. The C/No from the NordNav over a number of days, with a CW of J/N 21.751dB added on the last. 3.6 ∆C/No for Multi-GNSS To explore the possible detection performance using ∆C/No in a GNSS context the detection technique was used on data from a receiver with GPS and GLONASS observables. Nine groundtrack pairs of 1Hz RINEX data were downloaded from the IGS reference station PDEL located on an island off Portugal. The station uses a Leica 1200 which is a popular receiver used in a number of IGS and Continuously Operating Reference Station (CORS) networks and as a survey grade receiver. No specification is given as to the C/No estimation method that the receiver in question uses. In this work it is assumed that it uses a pre-correlation noise density estimate. 3.6.1 C/No for GPS In Figure 3.51 and Figure 3.52 the behaviour of the C/No is shown for three days and it resembles values used with pre-No noise density estimates. This model of receiver has also been used for measuring the power of signal reflections which implies that the C/No are proportional to the signal power at the antenna. 63 Chapter 3 Detection of RFI to GPS using C/No differences Day n-2 45 C/No (dB/Hz) C/No (dB/Hz) 50 Day n-2 Day n-1 40 Day n-1 46 Day n 44 42 Day n 6.5 7 7.5 Time (s) 8 40 2.06 2.08 2.1 2.12 2.14 2.16 2.18 4 Time (s) x 10 8.5 4 x 10 Figure 3.51. The C/No values extracted from a number of days of RINEX data (GPS) from an IGS reference station. Figure 3.52. An exampling of the repeating multipath behaviour in the C/No values extracted from RINEX data (close-up from Figure 3.51). 3.6.2 C/No quantization effects The C/No values in the RINEX data from PDEL are quantised to 0.25dB. Quantization to 1dB is common depending on the type and setup of the receiver and newer receivers typically have finer resolutions. This quantisation results in the standard deviation of the ∆C/No in certain windows being equal to zero and breaks the detection algorithm. To overcome this, dither can be added and this improves the behaviour of the detection threshold. For the data a dither of random noise with variance equal to 0.08 was added to the ∆C/No values and found to give good detection performance. The improvement can be seen by comparing the detection thresholds in Figure 3.53 and Figure 3.54. For receivers which output C/No values rounded more coarsely (such as to an integer for NMEA) more dithering will be needed. 2 ∆C/No (dB) ∆C/No (dB) 2 0 -2 ∆C/No -4 6 6.5 Time (s) 7 -2 ∆ C/No -4 Threshold 5.5 0 7.5 Threshold 5.5 4 x 10 Figure 3.53. The ∆C/No and resulting detection threshold without dithering added. 6 6.5 Time (s) 7 7.5 Figure 3.54. The ∆C/No and resulting detection threshold with dithering added, eliminating the problems from the quantisation of the C/No. 64 4 x 10 Chapter 3 Detection of RFI to GPS using C/No differences 3.6.3 False Alarm Performance The ∆C/No detection technique was applied to a week of data from day 170 to 179 in 2010. In the chosen days of data to be processed there were a small but noticeable number of false alarms. In Figure 3.55 and Figure 3.56 the number of detections are shown along with the number of satellites affected at the same time with the results grouped into 500s blocks. 3 # of effected Satellites Detections 30 20 10 0 2 4 6 Day Pair (days) 2 1 0 8 Figure 3.55. The number of detections in 500s windows over time (GPS). 2 4 6 Day Pair (days) 8 Figure 3.56. The number of effected satellites in 500s windows over time (GPS). In Figure 3.57 and Figure 3.58 examples of the false alarms during the 3rd and 4th day pair are shown. The majority of these detections occurred at lower elevations and looked like multipath. This promotes the need for classification or detection heuristics for distinguishing between C/No anomalies that could be caused by multipath, satellite malfunctions, etc, with RFI. The false alarms due to acquisition problems in the NordNav were not present, but with the ability of the higher quality receiver to track weaker signals at lower elevations the number of false alarms due 44 Day n-2 46 Day n-1 44 C/No (dB/Hz) C/No (dB/Hz) to multipath has increased. Day n 42 40 38 Dayn-2 Dayn-1 Dayn 42 40 38 36 7.62 7.63 7.64 Time (s) 7.65 3.3 4 x 10 Figure 3.57. The C/No anomaly during day pair 2 (GPS) which caused a number of detections. 3.32 3.34 Time (s) 3.36 4 x 10 Figure 3.58. The C/No anomaly during day pair 4 (GPS) which caused a number of detections. 65 Chapter 3 Detection of RFI to GPS using C/No differences Returning to Figure 3.56 there is a peak in the number of satellites affected during an observation window on the 7th day pair. It looks out of the ordinary because it affects 3 satellites at the same time and could be a genuine RFI event. The fall in C/No from two of these satellites is shown in Figure 3.59 and Figure 3.60. The nature of the falls look like they could be caused by a genuine RFI event but the three satellites are at lower elevations and the other tracked satellites at higher elevations are not affected. This cause of this anomaly is unknown and should be investigated in future work. 44 40 C/No (dB/Hz) 42 40 Day n-2 38 36 Day n-1 34 Day n 2.05 2.1 38 36 Day n-2 34 Day n-1 32 Day n 30 2.15 2.2 2.1 4 x 10 Figure 3.59. The C/No anomaly during day pair 7 on PRN11 (GPS) which caused a number of detections. 2.15 2.2 Time (s) 2.25 2.3 4 x 10 Figure 3.60. The C/No anomaly during day pair 7 on PRN23 (GPS) which caused a number of detections. 3.6.5 C/No for GLONASS So far this work has only concentrated on using ∆C/No for GPS. GLONASS observables are also available from RINEX data and are becoming more popular as the constellation is restored and modernized. For ∆C/No detection the critical difference between GPS and GLONASS is that the GLONASS groundtracks repeat every 8 days. For the GPS data collected with the NordNav receiver at UNSW, the standard deviation of the ∆C/No increased as the number of days taken between the measurements was increased. If the standard deviation increases too much ∆C/No will be less effective. In Figure 3.61 and Figure 3.62 the repeating behaviour of the C/No is shown for a typical GLONASS satellite. The behaviour is similar to what is typical of GPS satellites and good detection thresholds can be created without needing modification of window sizes or sigma values. 66 Chapter 3 Detection of RFI to GPS using C/No differences 49 48 C/No (dB/Hz) C/No (dB/Hz) 50 Day n-16 45 Day n-8 40 Day n 47 46 Day n-16 45 Day n-8 44 Day n 35 3 3.5 Time (s) 2.76 4 2.78 2.8 Time (s) 4 x 10 Figure 3.61. C/No values from the IGS RINEX data (GLONASS). 2.82 2.84 4 x 10 Figure 3.62. Close-up of repeating multipath behaviour (GLONASS). The detection technique was run over the same time as the GPS data and the results are shown in Figure 3.63 and Figure 3.64. The number of detections is fewer than the GPS data although it is noted that there are less GLONASS satellites visible so the number of observations is lower. During the 7th day pair there is a noticeable jump in the number of detections which occurs at the same time as the jumps seen in the results from GPS shown in Figure 3.55 and Figure 3.56, indicating an external event caused it. 2 # of effected Satellites Detections 150 100 50 0 2 4 6 Day Pair (days) 1.5 1 0.5 0 8 Figure 3.63. The number of detections in 500s over time (GLONASS). 2 4 6 Day Pair (days) 8 Figure 3.64. The number of effected satellites in 500s windows over time (GLONASS). In Figure 3.65 and Figure 3.66 the fall in C/No is shown for the satellites affected on the 7th day pair. The behaviour is similar to the GPS satellites. On the other tracked GLONASS satellites at the same time that were at higher elevations there was no drop in the C/No values. As these anomalies in C/No occurred for satellites at low elevations and for both GPS and GLONASS it is likely that it was caused by some obstruction of the receivers antenna. Looking at the data for 67 Chapter 3 Detection of RFI to GPS using C/No differences GPS and GLONASS simultaneously adds the ability to monitor the health and behaviour of the antenna and for any problems with the receiver hardware that cause a systematic fall in C/No. Day n-16 Day n-8 Day n 46 44 42 2.1 2.15 2.2 Time (s) Day n-16 50 C/No (dB/Hz) C/No (dB/Hz) 48 Day n-8 Day n 48 46 44 2.05 2.25 2.1 4 x 10 Figure 3.65. The C/No anomaly during day pair 7 on PRN7 (GLONASS). 2.15 2.2 Time (s) 2.25 2.3 4 x 10 Figure 3.66. The C/No anomaly during day pair 7 on PRN1 (GLONASS). 3.6.7 Comparison between GPS and GLONASS In Figure 3.67 the standard deviation is shown between 24 hours of ∆C/No values calculated from the RINEX data. The behaviour of the standard deviation is similar between the two systems, although at higher elevations it is lower for GPS. The difference is small considering the groundtrack repeat time for GLONASS is 8 times longer than GPS. In Figure 3.68 the distribution of the elevations for both systems is shown. The difference in the elevations at the receiver location can be seen. GLONASS has fewer satellites at higher elevations and appear to be concentrated in a set of elevations at 10, 30, and 50 degrees. The elevation profile of the GPS satellites is smoother with a peak at 70 degrees. GPS GLONASS GLONASS GPS 0.6 0.02 Density Standard Deviation 0.8 0.4 0.2 0.015 0.01 0.005 20 40 60 Elevation (deg) 0 80 Figure 3.67. Comparison of the standard deviation for ∆C/No values over a 24 hour period. 0 20 40 60 80 x Figure 3.68. Kernel density estimate of satellite elevations over a 24 hour period. 68 Chapter 3 Detection of RFI to GPS using C/No differences 3.6.8 Minimum Detectable J/N This section examines the minimum detectable RFI in terms of J/N between GPS and GLONASS. To determine this, the minimum J/N was calculated that would cause at least 3 satellites to have detections at once. This was determined numerically by calculating the C/No values with RFI added using (3.5) for each satellite for a particular day, and incrementally increasing the J/N of the RFI until at least 3 satellites crossed the ∆C/No detection threshold. In Figure 3.69 the minimum detectable J/N is shown for the GPS and GLONASS data over 24 hours using 1 second detection windows. The kernel density of the minimum J/N over 24 hours is shown in Figure 3.70. At some locations there are gaps and sudden jumps which are caused by gaps in the RINEX data. Over a 24 hour period GPS is able to detect RFI down to a J/N of -9dB and GLONASS down to a J/N of -10dB. Compared with GPS, there are times when the minimum J/N for GLONASS increases significantly. This is because the number of visible satellites at high elevations, which would have a tight detection threshold, is lower with GLONASS as the constellation has fewer satellites. The probability of at least 3 satellites crossing the detection threshold is significantly lower at these times. As the GLONASS constellation is completed better detection can be expected. However due to the use of FDMA in GLONASS, it may not be able to match GPS because of the technical limit on the number of satellites that it can broadcast at once. GLONASS GPS GPS GLONASS 0.5 0 Density Minimum J/N (dB) 5 -5 0.4 0.3 0.2 0.1 -10 2 4 Time (s) 6 0 8 -8 4 x 10 Figure 3.69. The minimum J/N that would cause detections for at least 3 satellites (1s windows). -6 -4 -2 J/N (dB) 0 2 Figure 3.70. Kernel density estimate of minimum J/N for detection (1s windows). Determining the minimum J/N every second results in a noisy value over time. The value can be smoothed out by looking for at least three satellites having a single detection in a 500 second window. This will also improve the ability to detect weaker RFI but the time to detection will be increased. In Figure 3.71 the minimum detectable J/N is shown for the GPS and GLONASS data over 24 hours using the 500 second windows. The kernel density of the minimum J/N over 24 69 Chapter 3 Detection of RFI to GPS using C/No differences hours is shown in Figure 3.72. Over 24 hours a J/N of -11.7dB can be detected by GPS and a J/N of -12.2dB by GLONASS. At some locations GLONASS can detect at a lower J/N then GPS but due to the less number of satellites visible at different times of the day the required J/N for GLONASS is significantly larger than GPS. GLONASS GPS -4 0.4 -6 Density Minimum J/N (dB) -2 -8 -10 0.3 0.2 0.1 -12 -14 GPS GLONASS 2 4 6 0 8 4 x 10 Figure 3.71. The minimum J/N that would cause detections for at least 3 satellites (500s windows). -12 -10 -8 -6 J/N (dB) -4 -2 Figure 3.72. Kernel density estimate of minimum J/N for detection (500s windows). 3.7. Summary and Conclusion In this work the ability to detect the presence of RFI was investigated using C/No measurements. The way the receiver estimates the noise-density was found to have a major impact on the detection performance. In the context of a stationary receiver in a surrounding environment which doesn't change, taking the difference of C/No measurements between groundtracks allows much of the variation in C/No to be removed. Over long observation times the post correlation noisedensity estimate allows for the detection of much weaker narrowband interferers. Depending on the frequency offset of the RFI, the post-correlation method may not detect the presence of even a relatively strong RFI if its spectrum does not overlay with the GNSS signal spectrum, while the pre-correlation method will detect it instantly. In experimental data the ∆C/No technique was able to detect RFI down to a J/N of -16.8dB. The technique was also found to be suitable for GLONASS even with its different groundtrack repetition time. In practical receiver implementation, it would be beneficial to calculate C/No using pre-No and post-No separately so that the variance of the tracking loops could be monitored as well as an overall indication of the power at the input to the baseband correlator which may not immediately enter the tracking loops when RFI is present. 70 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control 4.1 Introduction The Automatic Gain Control (AGC) is an important element in Global Navigation Satellite System (GNSS) receivers which contain multi-bit Analogue-to-Digital Converters (ADC). The AGC is needed to set the root mean square (rms) voltage level at the input to the ADCs in the RF front-end at a level that minimises losses from the quantisation process [131]. Due to differences in gain from different antenna and front-end components the rms voltage level before the AGC will be different for each individual receiver and antenna setup. In the presence of Radio Frequency Interference (RFI), the rms voltage level will increase and as a result the AGC will reduce its gain, attenuating the combination of the RFI and GNSS signals. As the response of the AGC gain is proportional to the power at the input to the receiver, it can be used for detecting RFI and for estimating the Jammer-to-Noise Ratio (J/N) [86]. As AGCs are an existing part of most GNSS receivers they present an inexpensive method for detecting RFI. Furthermore, as J/N measurements can be used as Received Signal Strength (RSS) measurements, the AGC can be used for localising RFI if used in a sensor network [117],[118]. 71 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control The way AGC is implemented influences the J/N estimation. In [86] one type of J/N meter is described that uses an AGC that estimates the rms level at the input to the ADC using the rms value of the quantised samples. In [118] another type of J/N meter is described that uses an AGC that estimates the rms level at the input to the ADC from the histogram of the incoming samples. Due to the nonlinear behaviour of quantisation noise and the way that probability density functions mix differently for different types of RFI, the J/N estimates from these methods may have biases. This behaviour is investigated and a way to overcome this is presented in the first part of this chapter. Another issue with using the AGC for RFI detection is that the AGC gain values measured over a period of time appear to drift with a noticeable diurnal pattern. In [64] measurements taken from a GPS receiver operating in the L1 band over 2 days showed that the value of the AGC gain varied by about +/- 0.5 dB and appeared to be correlated with ambient temperature. The presence of these variations will limit the possible detection performance when using the AGC and this is investigated in the second part of this chapter. This chapter is structured as follows: In section 4.2 the theoretical operation of the AGC is described. In section 4.3 the estimation of the J/N using the AGC is explored along with the biases introduced by two different possible AGC implementations. In section 4.4, the stability of the AGC values over time is explored and a method for calibrating the drift due to changes in temperature is presented. In section 4.5, a technique for estimating the noise-floor of the GPS receiver under test is described and used to characterise the response of the AGC to RFI in terms of J/N ratio. In section 4.6, the RFI detection performance using AGC is explored with and without calibrating for the drift due to temperature. Concluding remarks are given in section 4.7. Parts of the work presented in this chapter have been published in the following peer-reviewed conference proceeding: [10] RJR Thompson, E Cetin, and AG, Dempster, "Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control," in IGNSS2011 Symposium on GPS/GNSS, Sydney. 4.2 AGC Operation The purpose of the AGC is to adjust the voltage or power level of the IF signal at the input to the ADC of a GNSS receiver to minimise the quantisation loss [132]. The aim is to place the 72 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control threshold levels in the ADC at locations relative to the probability density function of the incoming signal as to capture the most of the satellite signals. This optimal level is generally described in terms of L/σ, where L is the maximum threshold or voltage level in the ADC and σ is the rms noise level at the input to the ADC. An example of a 2-bit encoding strategy is shown in Figure 4.1. +3 +L +1 0 -1 -L -3 Figure 4.1. The encoding behaviour of a 2-bit sign and magnitude ADC. Using a probabilistic model of the output of the correlator in a generic Direct Sequence Pseudorandom Noise (DSPN) receiver [131] the optimum value of L/σ can be found. For 2-bit sign and magnitude encoding/quantisation, the quantisation loss is minimal when L/σ = 0.996. With the maximum threshold L fixed at 2V (arbitrarily) the incoming rms noise level σIF should be equal to 2/0.996 = 2.00. As shown in Figure 4.2, in ideal operation the AGC loop would adjust the gain g of the Variable Gain Amplifier (VGA) until σIF is equal to σIDEAL = 2.00. RF input Downconversion and filtering VGA AGC gain voltage ADC + σIF − σIDEAL Figure 4.2. The ideal AGC control loop. Ideally the AGC gain will change linearly with the rms level of the incoming IF signal and as described can be used for the detection and estimation of J/N: 73 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control g.σIF = σIDEAL (4.1) By monitoring the behaviour of the AGC gain g in the absence of RFI the relative noise level at the receiver in normal operating conditions can be estimated. If this value changes abruptly it can be used for detecting RFI and estimating the J/N if RFI is detected. Assuming that the noise and RFI are independent the J/N can be calculated from the change in the AGC gain as follows: g1.σIF = σIDEAL g2.√(σ2IF+ σ2RFI) = σIDEAL J/N = (g1/g2)2-1 (4.2) (4.3) (4.4) where g1 is the gain before the RFI appears and g2 is the gain after the RFI appears, and σ2RFI is the variance of the RFI at the input to the ADC. Assuming that the response of the VGA is linear, the use of J/N allows relative powers of RFI to be calculated without needing knowledge of the absolute noise floor in the receiver. In Figure 4.3 the response of an AGC is shown for a simulated receiver that samples the AGC gain every 1 ms in the presence of Additive White Gaussian Noise (AWGN) only. RFI is added 2.5 seconds into the simulation and the fall in the AGC gain value can be observed. It is important to note that the calculation of J/N is undertaken after down-conversion and filtering by the RF front-end. The characteristics of the front-end down-conversion and filtering can have an impact on the J/N calculation if they are different between the receivers being used in a geo-location scenario. AGC control voltage (v) 4.2 4 RFI on 3.8 RFI off 3.6 3.4 0 1000 2000 3000 Time (1ms) 4000 5000 Figure 4.3. The simulated response of the AGC gain voltage to an added RFI of J/N -6 dB 74 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control 4.3 Estimation of jammer to noise ratio using AGC values 4.3.1 σ-sensing AGC In practice the AGC in a GNSS receiver cannot directly measure the true input rms level at the input to the ADC. Instead it can make an estimate of the input rms level by taking the expected value of the quantised samples. The operation of this kind of AGC is shown in Figure 4.4. In [86], a practical implementation of a J/N meter is described where the rms. level of the incoming signal is monitored in this way. RF input Downconversion and filtering ADC VGA AGC gain voltage + − 1 N ∑ (•)2 N σˆ IF σIDEAL Figure 4.4. AGC loop that uses the quantised samples to estimate the rms level. To explore the impact the quantisation noise has on the behaviour of the σ-sensing AGC a simulation setup was created in MATLAB. In this setup AWGN and RFI of different powers were added together and then quantised. A minimisation function was used to find the AGC gain that set the estimate of σIF closest to σIDEAL. In the simulation the wideband (WB) RFI is modelled as AWGN with bandwidth equal to half the sampling rate, the continuous-wave (CW) RFI is modelled as a single-tone at the intermediate frequency. In this simulation the intermediate frequency is 4.309MHz and the sampling frequency is 5.714MHz, based on the GP2015 chipset [127]. The simulation results are shown in Figure 4.5 when 2-bit sign and magnitude quantisation is used. As the J/N increases the difference between the change in AGC gain grows depending on the type of RFI. As mentioned previously this is because the amount of quantisation noise changes with signal type and power. At a J/N of 20 dB this difference is equal to 1.14 dB. Depending on the Geometric Dilution of Precision (GDOP) of the sensor network used in a Received Signal Strength (RSS) localisation system, a small error in the power measurement (in this case relative J/N between sensor nodes) can cause a large error in the final position estimate as explored in Chapter 6. 75 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control 0 AGC gain (dB) -2 -4 -6 -8 -10 -12 -20 WB CW -10 0 J/N (dB) 10 Figure 4.5. The σ-sensing AGC behaviour for different RFI types: CW and WB. In Figure 4.6 the behaviour of the AGC gain is compared for the ideal case (no quantisation) and for different numbers of quantisation bits. As the number of quantisation bits increases the response of the AGC for CW RFI increasingly matches the ideal response. As the number of bits increases the quantisation error decreases and the estimate of σIF becomes more accurate. For this type of AGC the only way to improve the consistency of the J/N estimates for different types of RFI would be to increase the number of bits. This is because the dynamic range of the rms level measurement (σNOISE+σRFI) will be small when a small number of bits are used [133] and the power measurement will be biased due to quantisation noise [134]. 0 AGC gain (dB) -2 -4 -6 2-bit 4-bit Ideal -8 -10 -12 -20 -10 0 J/N (dB) 10 Figure 4.6. Increasing the number of quantisation bits makes the AGC gain behave closer to the ideal. 4.3.2 Histogram sensing AGC In practice, adjusting the AGC gain based on the power of the quantised samples is a technique not used in GNSS receivers that are inexpensive with a small number of quantisation bits. 76 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control Another more common way of setting the AGC gain in GPS receivers [127],[53] is to compute the histogram of the incoming samples and then adjust the gain so that the number of samples in particular bins matches the optimum value. This is shown in Figure 4.7. For 2-bit sign and magnitude encoding/quantisation this corresponds to setting the magnitude bit (+3,-3) high 33% of the time. This type of AGC will respond differently to RFI with different probability density functions. To explore this difference the behaviour of the AGC gain will again be compared in the presence of CW RFI and wideband RFI. RF input Downconversion and filtering ADC VGA AGC gain voltage + − ADC Bin Histogram Counter Bin X(%) Ideal Bin X(%) Figure 4.7. AGC loop that uses the histogram of the incoming samples to control the gain. The pdf of the incoming IF signal can be determined from the pdfs of the receiver thermal noise and the pdf of the RFI. Assuming that the thermal noise (X) is independent of the RFI signal (Y) the resultant pdf can be calculated by taking the convolution of X and Y [135]: Z = ( X ∗ Y )( x ) (4.5) The pdf of the thermal noise can be modelled using the normal distribution: f ( x) = 1 2πσ 2 − e x2 2σ 2 (4.6) If the RFI is wideband noise, equation (4.6) can be used. The pdf for a CW interferer (sinusoidal) is given by: 1   2 2 f ( x) = π A − x   0,  if x ≤ A,     otherwise. (4.7) where A is the CW amplitude. The values of (4.5) are calculated numerically using MATLAB 77 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control and these are used to calculate what the AGC gain would be to maintain the set L/σ value. The magnitude of the noise is set to 20 dB in the following calculations. Figure 4.8 depicts the results and the plots are normalised to the maximum value of each pdf, where Y is the pdf of the CW and X is the pdf of the thermal noise. The resultant pdf of the addition of the two incoming signals is shown by Z. f(x)/max(f(x)) 1 Y X Z 0.8 0.6 0.4 0.2 -50 0 x 50 Figure 4.8. The normalised result of the numerical convolution to calculate the probability density function of noise plus CW RFI, with J/N = 7.8 dB. The behaviour of the gain for the histogram counting AGC, which keeps the Magnitude (MAG) bit high 33% of the time, is shown in Figure 4.9. It is noticeable that the behaviour is different for the CW and WB interference types in a similar way to the findings for the σ-sensing AGC. As the J/N increases the difference in gain between the two RFI types increases, and is equal to 0.82 dB at J/N = 20 dB. This difference is less than that found for the σ-sensing AGC. 0 AGC gain (dB) -2 -4 -6 -8 WB CW -10 -12 -20 -10 0 J/N (dB) 10 20 Figure 4.9. The change in gain for a histogram counting AGC with MAG set high 33% of the time. By changing the MAG bit high percentage, the sensitivity of the AGC gain to the CW RFI can be changed. Adjusting this percentage does not change the response of AGC to WB interference. This is because the pdfs change differently for CW and WB RFI. Running the calculations 78 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control numerically over a range of percentage values, a value of 18% was found to give the smallest difference between the CW and WB interference cases. Using higher percentage values, such as 80%, increases the sensitivity of the AGC gain to the CW, as can be seen in Figure 4.10. 0 AGC gain (dB) -2 -4 -6 WB CW 80% -8 -10 CW 18% -12 -10 0 J/N (dB) 10 20 Figure 4.10. The impact of changing the MAG high % on the sensitivity and response of the AGC gain to CW RFI. 4.3.3 Correlation Losses The percentage of samples with the MAG bit high that gives the best J/N estimation for the CW and WB is different from the value that minimises the correlation loss for Gaussian noise only. In [131] an expression is given for calculating the correlation loss depending on the placement of the ADC threshold levels. For 2-bit quantisation the results are shown in Figure 4.11. For values of L/σ too large and too small the loss in SNR approaches the loss for the 1-bit quantisation case [136]. SNR loss (dB) -0.5 -1 -1.5 -2 0 1 2 L/sigma 3 Figure 4.11. The SNR loss as a function of L/σ for 2-bit quantisation. A value of MAG bit high = 33% corresponds to L/σ = 0.996. A value of MAG bit high = 18% corresponds to L/σ = 1.29. As can be observed from Figure 4.11, at L/σ = 0.996 the SNR loss is 79 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control 0.54 dB. At L/σ = 1.29 the SNR loss is 0.64 dB. The cost in operating the AGC to give the best estimate of J/N for CW is only a marginal drop in SNR of 0.1 dB for the case where interference is absent. 4.4 AGC Stability In order to be used as a sensitive J/N meter and detect weak RFI, the stability of the AGC needs to be monitored and variations caused by environmental and other effects calibrated out. As noted in [64],[122], for measurements with real GNSS receivers there appears to be a strong correlation between changes in temperature and changes in the AGC gain level. Changes in the AGC gain will add a bias to the J/N estimate as well impact the detection reliability of RFI. It is interesting to note that from [64] that the AGC gain actually increases with temperature. This would appear somewhat contradictory, as the thermal noise should increase as temperature increases as given by the Johnson-Nyquist noise formula [137],[138], resulting in a reduction in gain. In practice the efficiency of the electronic components reduces with increases in temperature. As a result the gain of the AGC must be increased to compensate for the fall in effective gain of the receiver components. The gain stability of components in the signal path of receivers is of great concern in radio astronomy and has been studied previously in this context. The effects of slow variations in ambient temperature are seen as a low frequency component in the noise output of radiometers [139]. In [140], for discrete components including mixers and amplifiers, gain/temperature gradients of between -0.005dB/deg. C to -0.01dB/deg. C were observed for individual components at microwave frequencies, and the overall drift of the system was -0.027dB/deg C. To explore this behaviour a USB temperature logger was attached to a Novatel OEM6 GPS receiver with an antenna connected and the AGC values recorded over a couple of days. The receiver was placed in a backyard shed to increase the exposure to the outside temperature changes. A photograph of the USB temperature logger and the Novatel receiver is shown in Figure 4.12. The receiver was in a sealed weatherproof enclosure with power supply conditioning provided by GPSat Systems. 80 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control Temperature logger GPS receiver Figure 4.12. Photograph of the USB temperature logger and the GPS receiver. The 'AGC PulseWidth' values recorded from the receiver over a 1380 second period are shown in Figure 4.13. The receiver used does not directly output an AGC gain voltage; instead it outputs AGC PulseWidth values. In these values there are two kinds of noise that are visible, a highfrequency component and a low frequency random walk or drift, similar to what has been observed in the output of radiometers [141]. Further analysis using the Allan deviation may AGC PulseWidth present useful detection techniques in this kind of behaviour [142]. 4530 4525 4520 3.32 3.34 3.36 Time (s) 3.38 3.4 4 x 10 Figure 4.13. The AGC values over a 1380 second period. The results of the observations over a number of days are shown in Figure 4.14. The response of the AGC PulseWidth appears closely correlated with changes in the temperature of the GPS receiver. 81 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control AGC PulseWidth Chapter 4 4600 4550 4500 Temperature (C) 0.5 1 1.5 2 Time (s) 2.5 3 5 x 10 25 20 15 10 0 1 2 Time (s) 3 5 x 10 Figure 4.14. The variation of the AGC PulseWidth and temperature for a GPS receiver in an environment with mild exposure to the outside environment. A direct characterisation of the effect of temperature on each of the individual components in the RF front-end would be difficult to measure. Instead the response of the receiver as a whole can be modelled. In Figure 4.15 the relationship between temperature and AGC PulseWidth is shown. As can be observed the relationship appears to be linear in the temperate and gain ranges that occurred during the measurement period. The response of the AGC can be modelled using the following equation: AGCPulseWidth = 6.73 ⋅ x + 4411.22 (4.8) where x is the temperature in deg. C. Taking the derivative of (4.8) reveals that for 1 deg. C change in temperature there will be a 6.73 change in the value of the AGC PulseWidth. The fit has an RMSE of 4.39 AGC PulseWidths. For a receiver being used outdoors in sunlight and with exposure to the outside environment the variations in temperature can be expected to be much greater. 82 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control Measurements Linear Fit AGC PulseWidth 4600 4550 4500 10 15 20 Temperature (C) 25 Figure 4.15. A plot of the temperature versus AGC PulseWidth for the recorded data set. If no RFI is present, the receiver could continually monitor the AGC value and the temperature to continually self-calibrate and improve the model in (4.8) over time. In Figure 4.16 the response of the AGC is shown before and after corrected for the variations due to temperature. There are still periodic slight trends visible which may be related to the changes in power level from the visible satellites and other ambient signals. The amount of variation is drastically reduced, however, AGC PulseWidth which will allow for detection of much weaker RFI. 4600 4550 4500 0.5 1 1.5 2 Time (s) 2.5 3 5 x 10 Figure 4.16. After being corrected by (4.8) the majority of the variation in the AGC value can be removed, leading to improved detection and J/N estimation of jammers. 4.5 Noise-Floor Estimation To evaluate the RFI detection and J/N estimation performance using the AGC PulseWidth on the Novatel receiver, the relative noise-floor of the receiver needs to be estimated. The IF signal at the input of the ADC is not directly accessible hence the noise floor cannot be measured directly. However, the Novatel receiver used also outputs the histogram of the samples out of the ADC along with the AGC PulseWidth and this can be used for estimating the noise-floor. 83 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control The receiver uses 2.5-bit sign and magnitude quantisation with 6 output levels. In the encoding behaviour shown in Figure 4.1 this corresponds to output levels of (-5,-3,-1,1,3,5). The use of these extra levels (compared with the 2 bit case) allows the detection and mitigation of CW RFI [143], using the AGC and ADC. According to the methodology presented previously [131], the quantisation loss for 2.5 bits is minimised when the +/- 1 sample bins occur 53.26% of the time. The histogram message from the receiver indicates that the output of the +/- 1 bits occurred 48.92% of the time. This is close to optimal and the difference is most likely due to different assumptions and operating requirements being made by the manufacturer. Assuming that the addition of a CW RFI to the antenna input of the receiver along with the thermal noise can be modelled using equation (4.5), the expected histogram percentage for each ADC bin can be calculated for a given J/N ratio. Using a signal generator, a CW at different power levels was combined with the output of a GPS simulator and the histogram percentages from the ADC of the receiver were recorded. To estimate the noise floor, the change in the +3/-3 sample bin percentage from the receiver was compared with the expected result from (4.5). The +3/-3 bin was used specifically as it was the most sensitive to changes in the CW power. The comparison of the response of the receiver and the theoretical response is shown in Figure 4.17. The theoretical and recorded curves match up closely except at low J/N values. Using this method the noise floor was found to be -90dBm. This value may initially appear high, but is close to the value found in [144] for a similar setup with another Novatel receiver. Although the front-end bandwidth of the receiver is not known, it does support the Omnistar DGPS service therefore if a single RF front-end channel is used for sampling the Omnistar and GPS signals the bandwidth can be assumed to be greater than 60MHz [145]. Another example of a receiver that supports Mobile Satellite Services (MSS), of which Omnistar is one example, has a L1 RF front-end bandwidth of 88MHz [124]. 0.26 Bin3 (%) 0.24 0.22 0.2 Simulation Novatel 0.18 0.16 -10 0 10 J/N (dB) 20 Figure 4.17. The overlapping of the histogram bin percentages for determining the noise 84 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control floor of the Novatel receiver. In Figure 4.18 the response of the AGC PulseWidth is shown for different power levels for the injected CW RFI in terms of J/N measured during the noise-floor experiment. The shape of the curve is similar to the theoretical result shown in Figure 4.9 and the AGC PulseWidth appears to follow a dB scale. 4800 AGC PulseWidth 4600 4400 4200 4000 3800 3600 -10 0 10 J/N (dB) 20 Figure 4.18. The response of the AGC to CW RFI of increasing J/N. In Figure 4.19 the change in the AGC PulseWidth is plotted against the expected change in gain from an ideal AGC, along with a linear fit with a resulting equation of AGCPulseWidth = 4773 + y ⋅ 86.69 (4.9) where y is the expected change in gain in dB. The fit has a RMSE equivalent to 0.19dB. This confirms that the AGC PulseWidth is proportional to a dB scale. Using (4.8) and (4.9) it is also possible to determine the gain-temperature gradient of the receiver being tested, and the receiver has a value of -0.0776dB/deg. C. This is somewhat higher than the value of -0.027dB/deg. C observed in [140] for a microwave radiometer, but minimisation of this property may not have been a design consideration for this GPS receiver as the AGC would easily compensate for this when used in standard GNSS operation. 85 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control AGC PulseWidth 5000 Measurements Linear Fit 4500 4000 3500 -15 -10 -5 Gain (dB) 0 Figure 4.19. The change in the AGC PulseWidth compared with the expected change in gain. 4.6 Detection Performance The variation in the AGC due to temperature makes setting a tight RFI detection threshold difficult without correction. A mean-change detection algorithm would be vulnerable to RFI that ramps up slowly over time (such as a moving source that gradually gets closer). Setting an absolute threshold based on the previous day’s data would also be vulnerable to false alarms if the temperature varied by a large amount from day-to-day. In Figure 4.20 the 6-σ detection thresholds are shown for the uncorrected and corrected AGC fits from the data recorded in section 4.4. In Figure 4.21 the 6-σ detection thresholds are shown in terms of the change in the AGC from a CW RFI of different powers. With the corrections and using a 6-σ threshold the technique can detect a CW RFI down to a J/N of -8dB. Without correction and again using a 6σ threshold the technique can detect a CW RFI down to only a J/N of 2 dB. AGC PulseWidth 4800 4700 4600 4500 4400 4300 0.5 1 1.5 2 Time (s) 2.5 3 5 x 10 Figure 4.20. The difference in 6σ thresholds before and after temperature compensation. 86 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control {red lines: uncompensated, blue lines: compensated}. ∆AGC PulseWidth 0 -200 -400 -600 -800 -10 0 J/N (dB) 10 Figure 4.21. The measured response of the AGC to CW RFI and the 6-σ detection thresholds with and without temperature compensation. {green line: compensated, blue line: uncompensated}. Considering a typical GPS receiver with a noise floor of -111 dBm the AGC could be used for detecting CW RFI down to -119 dBm. The RTCA defines minimum susceptibility requirements for GPS receivers operating in the presence of RFI [146]. The required RFI mask for a CW interferer on L1 is -120.5 dBm and for a wideband interferer (2 MHz) is -107.2 dBm. The use of the AGC in a front-end with a 2 MHz bandwidth would only be able to achieve the detection requirements for wideband interferences. For RF front-ends with wider bandwidths, which as a result have higher thermal noise powers, the AGC will be less effective. This is a concern for modern geodetic receivers, some of which have front-end bandwidths as high as 88MHz to maximise positioning performance and support MSS services [124]. At 88MHz the resulting noise floor is -94.56dBm and detection would only be possible for RFI power greater than -102.56dBm. The performance is also not as good as the specialised interference detection techniques [72], [70] but the complexity and cost of a receiver that only needs to record its AGC value will be a lot less than one that needs to perform custom digital signal processing on IF samples. For receivers that already sample the AGC gain but do not output it to the user a firmware change is all that would be needed to make it available for use with RFI detection and J/N estimation. 87 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control 4.7 Summary and Concluding Remarks In this work two important elements that impact the detection and J/N estimation of RFI using the AGC have been investigated. By observing and characterizing how the AGC responds differently to different types of RFI, the bias in the J/N estimates can be reduced by adjusting the (+3,-3) histogram with only a small loss in SNR. The change in temperature was found to have a large influence on the drift of the AGC values over time. A linear model was found to be appropriate for modelling this change and by compensating for it the detection level of RFI using the AGC could be improved from a J/N of -2 dB to a J/N of -8dB. Even with this compensation for scenarios requiring integrity such as those outlined by the RTCA more robust techniques such as those that do signal processing on the quantised samples will still be required. For use in crowdsourced scenarios and where the requirement for integrity is reduced the AGC still presents an attractive option. Future work will investigate the effects of environment such as heavy rainfall and lightning on the AGC, as well as the response in environments where the receiver will be in the near-field of many objects and transmitters such as personal computers and mobile phones which generate spurious emissions in the L1 band. 88 Chapter 5 Dilution of Precision for Interference Localisation 5.1 Introduction One potential source of disruption to GNSS is from Radio-Frequency Interference (RFI) that degrades or jams the operation of a GNSS receiver. In order to maintain the integrity of GNSS in an area, once a RFI source is detected it needs to be localised so that it can be dealt with accordingly. For RFI, the source must be located passively. Two of the most widely used methods for passively localising unknown or "uncooperative" sources are Angle-Of-Arrival (AOA), which uses bearing measurements, and Time Difference of Arrival (TDOA) [109], which uses time delay measurements. An issue with the use of AOA is that antenna arrays are required and the hardware and computing requirements are significant. An issue with TDOA is that the variance of the time-delay measurements increases as the bandwidth of the unknown source reduces [107], so it is difficult to use TDOA to localise a narrowband source. GPS is susceptible to all types of RFI including narrowband. Another issue with TDOA is that it requires tight timing synchronisation between each of the sensor nodes. A potential alternative to using AOA and TDOA is using the Received Signal Strength (RSS) of the RFI measured at different locations. 89 Chapter 5 Dilution of Precision for Interference Localisation In the context of GNSS receivers, RSS has the advantage that measurements can be made using existing hardware so the cost is reduced [118]. In a traditional RSS localisation scheme the transmit power of the source is assumed to be known, while for unknown sources it is not known. The work in this chapter investigates the use of RSS in this scenario. By taking the differences of RSS measurements, Difference of RSS (DRSS) measurements are formed [147], where the transmit power term is removed so it doesn’t need to be estimated, and lines of position can be drawn. Localisation systems that use the differences of cellular signal attenuations [148] and gains ratios [149] which are similar to DRSS have been presented in the past in hybrid systems. The work in this chapter is different from these in that it considers the use of the DRSS measurements alone without aiding from TDOA. The performance of using DRSS will be investigated and compared to TDOA and AOA through the Dilution of Precision (DOP) metric. This initial investigation will reveal the potential of DRSS for use in the localisation of RFI to GNSS using typical positioning models and measurement errors found in the literature. This chapter is structured as follows: In section 5.2, an introduction to DOP and how it is derived for positioning systems is given. In section 5.3, DOP as it is used in the traditional GPS context is shown. In section 5.4, the performance of a Maximum Likelihood Estimator (MLE) is compared to the results from the DOP equations. In section 5.5 the DOP concept is applied to RSS/DRSS. In section 5.6 the behaviour of the DOP for DRSS is investigated for different sensor topologies and the positioning performance compared with AOA and TDOA. A summary and concluding remarks are given in section 5.7. Parts of this chapter have been publishing in the following conference proceedings: [12] RJR Thompson, AT Balaei, and AG Dempster, "Dilution of precision for GNSS interference localisation systems," in European Navigation Conference (ENC GNSS), Naples, Italy, 2009. 5.2 Dilution of Precision The Dilution of Precision (DOP) is an important metric for evaluating the effect of geometry on the positioning accuracy of localisation systems. DOP is closely related to the Cramer-Rao Lower Bound (CRLB), which is used to give a lower bound on the variance possible from any unbiased estimator [149]: σ θ2ˆ (θ) > CRLB ˆ (θ ) θ 90 (5.1) Chapter 5 Dilution of Precision for Interference Localisation where θ is the vector of parameters being estimated and σ θ2ˆ (θ) is the variance of the estimation of these parameters. This is a commonly used method for analysing the performance of different localisation systems and algorithms [106],[150],[107]. In the calculation of the CRLB the general additive noise vector model of the positioning measurements with noise takes the form dˆ = f (θ) + ε (5.2) ˆ =[d1,d2,…,dN]T is the vector of noisy measurements, f(θ)=[f1(θ),f2(θ),…,fN(θ)]T is the where d vector of positioning equations evaluated at the user position θ, and ε=[ ε1, ε2,..., εN]T is the vector of the independent Gaussian additive noise for each measurement. In matrix-vector form the CRLB covariance matrix is defined as the inverse of the Fisher Information Matrix (FIM) [107] and is as follows: ( CRLB = H T C −1 H ) −1 (5.3) where H corresponds to the Jacobian of the set of positioning equations f with respect to the vector of parameters being estimated θ, and C=E[εTε] is the covariance matrix of the measurements. If the noise in each measurement is assumed to be uncorrelated Gaussian noise of equal magnitude, the covariance matrix takes the form C = σ m2 I where σ m2 is the variance of measurements. In the GNSS context DOP is used to show the ratio of positioning error to the pseudorange error [151]. The DOP equations are derived in a similar way to the CRLB except that the covariance matrix is taken out, i.e. C is replaced by C/ σ m2 in assuming (5.3). This makes DOP independent of the absolute magnitude of the variance of the measurement error, but still reflects the correlation of the noise between the positioning equations as can occur in TDOA. DOP can therefore be derived from the CRLB if C is Toeplitz and symmetric along its diagonal: Q= 1 σm CRLB 91 (5.4) Chapter 5 Dilution of Precision for Interference Localisation leading to the expression of DOP as the ratio of the positioning error σ p in terms of the measurement noise σ m : σ p = DOPσ m (5.5) where DOP contains the elements of interest from Q. Taking the trace of Q gives the Geometric Dilution of Precision (GDOP). 5.3 DOP for Satellite Navigation Systems The localisation system used in GNSS finds the location of a receiver by finding the intersection of spheres. The radius of these spheres is found by making pseudorange measurements between the satellite and a receiver. The positioning equations are Time of Arrival (TOA) [26] and accounting for receiver clock bias takes the form: ti = 1 c (xi − xu )2 + ( yi − yu )2 + (zi − zu )2 + bu (5.6) for N number of satellites, where i=1..N, ti is the TOA measurement from the ith satellite, ( xi , yi , zi ) is the co-ordinate of the satellite, ( xu , yu , zu ) is the user position, c is the speed of light, and bu is the receiver clock bias. The geometry of TOA simplified in 2D is shown in Figure 5.1. y Satellite Receiver TOA1 TOA2 TOA3 x Figure 5.1. A 2D TOA positioning system using 3 satellites. 92 Chapter 5 Dilution of Precision for Interference Localisation There are 4 parameters for which to solve in this estimation problem, the user position (xu , yu , zu ) and the receiver clock bias bu. Taking the partial derivatives with respect to these parameters forms the Jacobian matrix H for this system of equations which can be calculated as: y − yi y − yi  1  x − xi df TOA i =  dx + dy + dz  + 1dbu c  ri ri ri  (5.7) H TOA =  x1 − xu  r 1  x 2 − xu  1  r2 c M x − x N u   rN y1 − yu r1 y 2 − yu r2 M y N − yu rN z1 − z u r1 z 2 − zu r2 M z N − zu rN  c  c  c  c  (5.8) where ri = ( x i − x u ) 2 + ( y i − y u ) 2 + ( z i − z u ) 2 If the measurements are assumed to have uncorrelated independent Gaussian noise of equal 2 I variance, the covariance matrix takes the form C = σ TOA . Using (5.3) and (5.8) the CRLB matrix takes the form:  σ 2xˆ  2 σ xˆyˆ CRLB =  2 σ xˆzˆ σ 2 ˆ  xˆb σ 2xˆyˆ σ 2xˆzˆ σ 2yˆ σ 2yˆzˆ σ 2yˆzˆ σ 2zˆ σ 2yˆbˆ σ z2ˆ bˆ σ x2ˆ bˆ   σ 2yˆbˆ   σ z2ˆ bˆ  σ 2bˆ   (5.9) 2 The first term σxˆ represents the lower bound on the variance of the estimation of the x term. By taking different combinations of the diagonal elements of the CRLB matrix and dividing by σm, different types of DOPs can be defined. For example the commonly used GDOP, which expresses the estimation error in terms of the geometry of the satellites, can be calculated by: GDOP = 1 σm trace (CRLB ) 93 (5.10) Chapter 5 Dilution of Precision for Interference Localisation and using (5.9) and (5.10): GDOP = 1 σm σ 2xˆ + σ 2yˆ + σ 2zˆ + σ 2bˆ (5.11) The GDOP term includes the error in the estimation of the receiver clock bias term as well as the error in position. The clock bias term is a nuisance parameter, and of greater interest is the Position Dilution of Precision (PDOP) which gives the lower bound on the root mean square error of the position estimate in metres in the form PDOP = 1 σm σ 2xˆ + σ 2yˆ + σ 2zˆ (5.12) For a simplified 2D system with two satellites the DOP is shown geometrically in Figure 5.2. The true circles of position are plotted along with the circles of position with ± σ of noise added. On average the estimated position will be inside the area enclosed by the ± σ circles of position. In Figure 5.3 the DOP is shown again geometrically but with the satellites in different positions. The area enclosed by the ± σ circles of position is much larger for this second example, and the corresponding DOP value would be greater. 10 y (metres) 8 6 4 2 0 0 2 4 6 x (metres) 8 10 Figure 5.2. An example of good DOP performance for TOA. {white dot: true position; black dots: transmitter} 94 Chapter 5 Dilution of Precision for Interference Localisation 10 y (metres) 8 6 4 2 0 0 2 4 6 x (metres) 8 10 Figure 5.3. An example of poor DOP performance for TOA. {black dot: true position; white dots: sensors} 5.4 Maximum Likelihood Estimation (MLE) In order to attain the CRLB an efficient estimator is required. Under certain conditions [152] the MLE can be efficient and asymptotically approach the CRLB. For finite measurements the MLE is not efficient although but can be used to provide a good estimate of parameters in many cases. To calculate the MLE position estimate the least-squares cost function of the positioning equations can be minimised [153]: ε = (dˆ − f (θˆ )) T C−1 (dˆ − f (θˆ )) T (5.13) θˆ = argθ min(ε ) (5.14) ˆ again is the vector of measurements with additive noise, f(θ) is the vector of positioning where d equations evaluated at θ, and C is the covariance matrix. As this system is non-linear, an iterative method such as Gauss-Newton [154] is required that linearises the system around an initial guess and continues until a minimum in the cost function is found. In Figure 5.4 the solutions found by the Gauss-Newton method are plotted for 50 simulation runs of measurements with added Gaussian noise with variance 1. In an attempt to ensure convergence 95 Chapter 5 Dilution of Precision for Interference Localisation the true location is used as the initial guess. The calculated GDOP at this point is 1.32. The mean value of the estimated positions for the simulations is (4.89,-4.9), close to the true position (5,-5). The Root-Mean-Square-Error (RMSE) of the estimates is 1.12m which is close to the PDOP value. As the number of simulation runs to infinity the RMSE will asymptotically approach the DOP value if the position estimator is efficient. It can be seen in Figure 5.4 that the spread of the estimated positions is not normally distributed around the true position of the source, there is some correlation between x and y. A technique to show this interaction is to plot an error ellipse [107] from the CRLB matrix. In Figure 5.5 the error ellipse is shown which illustrates the distribution of the estimates in a way that just the single GDOP value can't. 0 y (metres) −2 −4 −6 −8 −10 0 2 4 6 x (metres) 8 10 Figure 5.4. The distribution of position estimates for a TOA scenario with added measurement noise. {white dot: sensors; black dots: true position, star: position estimates} 0 y (metres) −2 −4 −6 −8 −10 0 2 4 6 x (metres) 8 10 Figure 5.5. The error ellipse calculated for the measurement noise as used in Figure 5.4. 96 Chapter 5 Dilution of Precision for Interference Localisation {white dot: sensors; black dot: true position, star: position estimates} 5.5 Interference Localisation Using DRSS In a traditional RSS localisation system using the log-normal fading path-loss model [115] the transmit power of the source is assumed to be known. For RFI the transmit power is not known. This term represents a nuisance parameter that needs to be solved along with the position parameters. In this work it is assumed that the transmitter and receiver antennas are isotropic and the propagation constant is equal in all directions. In this work the hardware and software measuring the RSS are assumed to be ideal, so effects such as non-linearity and saturation in analogue parts of a potential receiver for example are ignored. One way to remove the need to solve for transmit power is to take Difference of RSS (DRSS) measurements. For the positioning system shown in Figure 5.6, the circles created by sensors 1 and 2 are represented by RSS equations [115] d RSS1 = P0 − 10 nlog 10  1  d0  +σ   (5.15) d RSS 2 = P0 − 10 nlog 10  2  d0  +σ   (5.16) where RSSi is the received signal strength of the source measured at sensor i, Po is a reference transmit power measured at distance d0, di is the distance between the sensor and the source, n is the path-loss exponent of the propagation environment and σi is standard deviation of the shadowing noise. In dense outdoor suburban environments the value of σi can be as high as 9dB, and the value of n can vary from 2 to 5. The difference of (5.15) and (5.16) eliminates the transmit power variable: d DRSS 1,2 = RSS 1 − RSS 2 = 10 nlog 10  2  d1   + σ 1 + σ 2  (5.17) Constant Differences-of-Received-Signal-Strength (DRSS) represent circles as shown in Figure 5.7, in the same way that constant TDOA represent hyperbolas [148]. If the individual variances of the shadowing are equal and independent then the variance of one DRSS measurement is 2σ2. In practical situations this value is likely to be lower due to correlated shadowing [148] but is 97 Chapter 5 Dilution of Precision for Interference Localisation assumed to be 2σ2 to make the covariance matrix simpler to calculate. This value also represents the worst case scenario when there is no correlation between the shadowing. The number of sensors needed to solve for position for RSS and DRSS remains the same but the computational complexity of solving for position is reduced in DRSS because the transmit power parameter is removed. This reduces the number of columns in the Jacobian matrix by 1 and opens up the possibility of using closed-form position estimation algorithms [155]. y DRSS1-2 d2 Interferer d1 Sensor 2 Sensor 1 RSS1 RSS2 x Figure 5.6. The difference of two RSS equations creating a DRSS equation, eliminating Po. 10 y (metres) 8 6 4 2 0 0 2 4 6 x (metres) 8 10 Figure 5.7. The circles of position for DRSS for sources (stars) placed along the x-axis. The analysis of the DOP for DRSS will begin with assuming that the path loss exponent is known. In this scenario the parameters to be estimated are θ=(x,y). There are 2 parameters to be estimated so a minimum of 3 sensors are required to create two independent positioning equations. Starting with (5.17) for an arbitrary sensor i and reference sensor j, and taking the partial derivatives with respect to θ we get: 98 Chapter 5 Dilution of Precision for Interference Localisation  10 n x − x j 10 n x − x i  df DRSS i − j =  ⋅ − ⋅  dx ln(10) ri 2  r j2  ln(10 ) (5.18)  10n y − y j 10n y − yi  + ⋅ − ⋅  dy ln(10) ri2  rj2  ln(10) where ri = ( x i − x ) 2 + ( y i − y ) 2 As the partial derivatives are from DRSS measurements there are more places where the value of (5.18) can become zero compared to RSS, where the transmit power is known. If the value of a partial derivative does become zero it provides no information for the estimation process at that point. Taking j=2 as a reference sensor in a i=1..N sensor setup  x − x1  r2  1 x−x 10n  2 3 H DRSS ( x, y) =  r ln(10)  3 x − x  2N  rN x − x2 r22 x − x2 − r22 M x − x2 − r22 − y − y1 y − y2  − r12 r22   y − y3 y − y 2  − r32 r22   M y − y N y − y2   − rN2 r22  (5.19) The covariance matrix is given by: 2 1 L 1 1 O O M   C =σ 2  M O O 1   1 L 1 2  (5.20) There is covariance between each of the measurements because the noise from the reference sensor j is common to all the DRSS measurements. Along with power, another nuisance parameter that may need to be solved is the path-loss exponent n. The impact of this nuisance parameter on RSS localisation is covered thoroughly in [115] and in Chapter 7 of this thesis with real experimental data. It can be expected to have similarly detrimental effect in DRSS. Although n can be found by taking a path-loss survey of the 99 Chapter 5 Dilution of Precision for Interference Localisation environment, it may not be possible to cover all areas to a high degree of accuracy, or it could change over time. Taking the partial derivatives again but this time with respect to n also leads to:  10 n x − x j 10 n x − xi  df DRSS i− j =  ⋅ 2 − ⋅  dx ln(10 ) ri2   ln(10 ) r j  10 n y − y j 10 n y − yi  + ⋅ − ⋅ 2  dy [log10 rj − log10 ri ]dn 2 ln(10) rj ri   ln(10) (5.21) Again taking j=2 as the reference sensor in a 1..N sensor setup  log 10 r2 − log 10 r1   log r − log r  10 3  H DRSS ( n) = 10  10 2   M   log 10 r2 − log 10 rN  (5.22) Looking at (5.22), problems will arise when the ranges between the sensors and transmitter become equal. An example of where this can happen is when the source is located in the centre of a square sensor network as was observed in RSS [115], where the partial derivatives with respect to n becomes zero. The impact on DOP of n in the square array is explored further in section 5.6.2. For a derivation of the Jacobian matrices for AOA and TDOA used in the proceeding parts of this chapter see [106],[154]. The DOP behaviour with n known and unknown is shown in Figure 5.8, where a scenario similar to what was used in [115] is recreated but this time the error ellipses for DRSS are plotted. Looking at Figure 5.8, it can be seen that when the transmitter is located inside the area of the sensor network the difference in the DOP when n is known and unknown is minimal. However the further away from the sensors the faster the difference in DOP grows when n is unknown. For the point (140, 30) which is inside the area of the sensors there is only a slight increase in DOP when solving for n. At the point (195, 10) which is outside the area of the sensors there is a large increase in DOP when solving for n. This result shows that the need to solve for n makes using DRSS for localisation more difficult as the transmitter is moved away from the sensor network. 100 Chapter 5 Dilution of Precision for Interference Localisation 200 y (metres) 150 100 50 0 0 50 100 x (metres) 150 200 Figure 5.8. The error ellipses for DRSS with and without solving for n. {dots: test points, crosses: fixed monitors, solid line: error ellipse when solving for n} 5.6 Comparison of DOPs 5.6.1 Linear Array of Sensors To gain an understanding of how DRSS performs, a simple linear array [107] is used to calculate the DOP terms for AOA, TDOA and DRSS. The position of the transmitter is fixed on the x-axis at x=0 and moves along the y-axis. By keeping the position on the x-axis fixed the geometry simplifies to the form shown in Figure 5.9. Interferer Sensor TDOA y r1 r2 90⁰ α 0 r1 α x Figure 5.9. The linear-array topology with interferer fixed at x=0, with TDOA hyperbolas shown for a possible interferer location. Beginning with the Jacobian and covariance matrices for AOA [106], the calculation of the DOP for the scenario in Figure 5.9 is as follows: 101 Chapter 5 Dilution of Precision for Interference Localisation  y − y1 − r12   y − y2 H AOA = − r22  − y − y3  r12  x − x1   − sin α   r12   r1 x − x2   1 = −r 2 r2  2  x − x3   − sin α r12   r1 − cos α   r1  0   cos α  r1  (5.23) with the following covariance matrix: H AOA = C = σ 2AOA 1 0 0  0 1 0    0 0 1  . (5.24) Continuing with the Jacobian matrix for DRSS (with the path-loss exponent assumed to be known): H DRSS  x − x1 x − x 2 − 10 n  r12 r22  = ln(10)  x − x3 − x − x 2  r2 r22  1 y − y1 y − y 2  − r12 r22  y − y3 y − y 2  − r12 r22  sin α 1  − 2 r12 r2  sin α 1  − 2 r12 r2   − cos α 10n  r12  = ln(10)  cos α  r12  (5.25) with the following covariance matrix: 2 1  C = σ 2DRSS   1 2 . (5.26) Next, calculating the Jacobian matrix for TDOA: H TDOA  x − x1 x − x 2 −  1  r1 r2 = x − x x − x2 c 3 −  r r2  1 y − y1 r1 y − y3 r1 y − y2   r2  1  − cos α = y − y 2  c  cos α − r2  − with the following covariance matrix: 102 sin α − 1  sin α − 1 (5.27) Chapter 5 Dilution of Precision for Interference Localisation 2 1  2 CTDOA = σ TDOA 1 2  . (5.28) The x-DOPs and y-DOPs are found by taking the σ2xˆ and σ2y terms from the CRLB matrix calculated using (5.9) and dividing them by σ 2m , and are shown in Table 5.1. From the y-DOPs both AOA and DRSS are noticeably more sensitive to measurement error than TDOA because of the extra range terms in the numerators. The different interactions between the range terms in the DOPs reveal that they will behave differently. The DOPs for TDOA and DRSS are dependent on the constant parameters n and c. Typically n will have a value of 2 and c is taken as the speed of light in a vacuum. Table 5.1. DOPs for a linear array of sensors. (x-DOP)2 AOA r12 r22 r12 DRSS (y-DOP)2 + r22 − r22 ln(10) 2 1 r12 2 cos 2 α cos 2α r12 ln(10 ) 2 10 2 n 2 2 cos 2 α TDOA [107] c2 r12 10 2 n 2 2( r1 − r2 sin α ) 2 1 1 2 cos 2 α c2 3 1 2 (1 − sin α ) 2 As the TDOA DOPs do not have a range term in their numerator their performance can be improved by increasing the length of its baselines. This can be seen in Figure 5.10 where increasing the baseline spacing does not cause an overall increase in the GDOP (scaled by 1/c) values for TDOA, but stretches the curve along the horizontal axis. This is not the case for DRSS and AOA which have squared range terms in their numerators. For best performance DRSS and AOA sensors will need to be placed closer together and need to be not too far from the transmitter compared with TDOA. This can be seen in Figure 5.11 and Figure 5.12 where increasing the baseline spacing between sensors not only stretches the curve along the horizontal as with TDOA, but the magnitude of the GDOP values increase as well. The increase in DOP from increasing baseline length is greater for AOA than with DRSS. 103 Chapter 5 Dilution of Precision for Interference Localisation 350 10m 45m 100m 300 GDOP 250 200 150 100 50 0 0 50 100 y (metres) 150 200 Figure 5.10. The GDOP (scaled by 1/c) for TDOA along the y-axis for a linear array of sensors with different sensor spacing. 350 10m 45m 100m 300 GDOP 250 200 150 100 50 0 0 50 100 y (metres) 150 200 Figure 5.11. The GDOP for AOA along the y-axis for a linear array of sensors with different sensor spacing. 104 Chapter 5 Dilution of Precision for Interference Localisation 350 10m 45m 100m 300 GDOP 250 200 150 100 50 0 0 50 100 y (metres) 150 200 Figure 5.12. The GDOP for DRSS along the y-axis for a linear array of sensors with different sensor spacing. If a transmitter is placed along the baseline of the array of sensors the GDOP becomes infinite for all the localisation methods. For DRSS and TDOA this is because the y-yi terms in the Jacobian matrices become equal (and in this case zero) and the resulting FIM becomes rank deficient. When the FIM is inverted to form the CRLB its elements take on infinite values. This implies that there is an ambiguity [156] in the solution and in the case of the linear array, the solution can take on more than 1 possible value on the y-axis. An example scenario is shown in Figure 5.13. The plot reveals that along the baselines of the sensors the true DRSS circles of position (solid) only touch at a single point. This is the worst case scenario for positioning equations. For the best DOP the lines of position need to intersect at right-angles. In Figure 5.14 the cost function (5.13) surface is plotted for the dashed lines of position which have added error. In attempting to minimise the least-squares cost function to solve for position the Gauss-Newton method will break down due to the rank deficiency and become divergent. As can be seen in Figure 5.14 there are two possible global minima, so the solution is not unique. 105 Chapter 5 Dilution of Precision for Interference Localisation 6 y (metres) 4 2 0 −2 −4 −6 −6 −4 −2 0 2 x (metres) 4 6 Figure 5.13. The DRSS circles for a position with infinite DOP. {dashed: lines of position with added error} log10(ε) 1.5 1 0.5 0 40 0 20 x (metres) 0 40 20 y (metres) Figure 5.14. A plot of the least-squares cost function for the dashed circles of position in Figure 5.13. {stars: possible position solutions} One aspect that DOP does not show is another type of ambiguity that is created in DRSS and TDOA [157] which is present in linear arrays. In Figure 5.15 a scenario is shown where there are two equal global minima of the cost function on opposite sides of the sensor array. This kind of ambiguity is different to the previous type discussed as the DOPs do not become infinite, but some kind of prior information will be required about the location of the interferer to constrain it to a side of the array. The Gauss-Newton method could converge to either solution depending on where it is initialised. An AOA system does not have the same issue with ambiguities on either side of a linear array as do TDOA and DRSS. 106 Chapter 5 Dilution of Precision for Interference Localisation 0 y (metres) −2 −4 −6 −8 −10 0 2 4 6 x (metres) 8 10 Figure 5.15. For collinear arrays there are always solutions on either side of the baselines for TDOA and DRSS. 5.6.2 Four sensor arrays DRSS has poor DOP in a square-array of sensors such as {(0,0),(0,5),(-5,5),(5,0)} shown in Figure 5.16(a), as the DOP becomes infinite along a circle which passes through each of the sensors. This contrasts with TDOA and AOA which exhibit no strong divergent behaviour in this setup. The DOP surface for DRSS (not solving for n) is shown in Figure 5.17 and the DOP becomes infinite because the FIM becomes rank deficient at these points. Moving one of the sensors to form a triangle as shown in Figure 5.16(b), such as moving a sensor to the origin, removes this divergent behaviour as shown by the DOP surface in Figure 5.18. If 4 sensors are to be used this triangle network has been found to have the best DOP surface for DRSS through Monte-Carlo simulations. In this setup however, TDOA now exhibits divergent behaviour at different points. (a) Square 107 Chapter 5 Dilution of Precision for Interference Localisation (b) Triangle Figure 5.16. Potential four sensor network topologies 8 GDOP 6 4 2 0 6 4 2 y (metres) 0 −6 −2 −4 0 −2 x (metres) 2 Figure 5.17. The PDOP surface for DRSS in a 4 sensor square. GDOP {black dots: sensor nodes; the broken sections of the mesh are places where the GDOP exceeds a threshold – it diverges to infinity in these regions} 2 0 6 4 2 y (metres) 0 −2 0 −2 −4 x (metres) −6 2 Figure 5.18. The PDOP surface for DRSS in a 4 sensor triangle network. {black dots: sensor nodes} 108 Chapter 5 Dilution of Precision for Interference Localisation Adding the requirement to solve for the path-loss exponent n in the square-array leads to an even worse DOP surface, and in practice n will typically need to be solved. As was shown in [115], solving for n introduces places where the DOP becomes formally infinite where in the previous case the DOP was well behaved. As shown in Figure 5.19, the DOP surface while solving for n becomes divergent along the middle of the baselines of the sensors and at the centre. Moving the array into a triangle formation does not totally eliminate all of the divergent behaviour but the useable area for positioning is significantly larger as show in Figure 5.20. These results show that even with 4 sensors the choice of sensor geometry is critical for DRSS and TDOA. Their geometrical requirements would appear to be opposite to each other in this case. In the 4 sensor case solving for n there is no sensor placement where the DOP doesn’t become divergent somewhere for DRSS, although it is well behaved inside the area of the sensor nodes if a triangle shape is used. GDOP 100 50 0 6 4 2 0 y (metres) −2 −2 −6 0 2 −4 x (metres) Figure 5.19. The DOP surface for DRSS in a square network (solving for n). {black dots: sensor nodes} GDOP 30 20 10 0 6 4 2 y (metres) 0 −2 −6 −2 109 −4 x (metres) 0 2 Chapter 5 Dilution of Precision for Interference Localisation Figure 5.20. The DOP surface for DRSS in a triangle network (solving for n). {black dots: sensor nodes} 5.6.3 Five sensor arrays Through the use of Monte-Carlo simulations the star-array as shown in Figure 5.21 was found to be the best sensor geometry to minimise the DOP surface with 5 sensors for DRSS. Figure 5.21. A star array of sensors which has good DOP performance for all three methods. Unlike in the 4 sensor square array example, there are no problems with DRSS diverging to infinity when the path-loss exponent is solved along with position. Placing a sensor node in the middle of the square solves the divergence problems. A plot of the DOP surface is shown in Figure 5.22 and a plot of the DOP surface when solving for n also is shown in Figure 5.23. By comparing the two plots it can be seen that inside the sensor array there is only a slight increase in the DOP values. Outside the sensor array the DOP values while solving for n increases at a faster GDOP rate. 2 1 2 0 0 6 4 y (metres) −2 2 −4 0 −2 −6 x (metres) Figure 5.22. The DOP surface for DRSS in a star network. {black dots: sensor nodes} 110 Dilution of Precision for Interference Localisation GDOP Chapter 5 2 2 0 0 6 4 y (metres) 2 0 −2 −2 −4 −6 x (metres) Figure 5.23. The DOP surface for DRSS in a star network (solving for n). {black dots: sensor nodes} With a suitable geometry found for the practical use of DRSS, some typical values for noise variances have been chosen to compare the DOP between localisation methods. For TDOA, the c=3x108 and σm=10ns [158]. For DRSS, n=2 and σm=3dB [115]. For AOA σm=2⁰ [159]. The plots in Figure 5.24 show that inside the area enclosed by the sensor network DRSS is a suitable alternative to AOA even if the true value of n is unknown. It is important to note that TDOA is not appropriate for narrowband interference sources and is shown to illustrate how DOP behaves differently compared to other localisation methods. Positioning error (metres) 100 inside sensor array 80 AOA DRSS DRSS+n TDOA 60 40 20 0 −50 0 50 y (metres) 100 Figure 5.24. DOP comparison of different methods for a star array with spacing of 50m using some typical noise variances. {σTDOA=10ns, σDRSS=3dB, σAOA=2⁰, the area between y=0 and y=50 is inside the area enclosed by the sensor array.} 111 Chapter 5 Dilution of Precision for Interference Localisation 5.7 Summary and Concluding Remarks Through an investigation of the different passive localisation methods the TDOA technique was found to have the best performance in terms of the DOP metric. The extra range term in the denominators for the Jacobian matrices for AOA and DRSS results in a rapid increase in DOP as the interference source moves away from the sensor nodes. The introduced DRSS technique was found to be significantly more sensitive to network geometry, especially if the path-loss exponent is unknown and the source is located outside the sensor network. At least 5 sensor nodes are required for DRSS so that there are no locations with infinite DOP inside the area enclosed by the sensor network whereas only 3 are required for the TDOA and AOA methods. Using typical measurement noise values found in the literature DRSS was found to be a suitable alternative to TDOA and AOA in a square sensor network with spacing of 50m. The rapid increase in positioning error for sources located outside this sensor network was significant for the DRSS and AOA, and is more so if the path-loss exponent needs to be solved for. In the context of this square network used for the localisation of RFI to GNSS based on these DOP comparisons, TDOA will be superior for broadband interferers in all cases. For narrowband interferers, which TDOA has difficultly localising, DRSS will be superior to AOA both inside and outside the sensor network if the path-loss exponent is known. If the path-loss exponent is not known, DRSS is superior inside the sensor array and AOA is superior for sources outside the sensor network. 112 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 6.1 Introduction In order to ensure the integrity of systems that rely on the products that GNSS services provide any RFI source that can disrupt its operation must be localised quickly. Traditionally there are two methodologies for localising unknown sources such as RFI [109]: those that use the AngleOf-Arrival (AOA) of the incoming RFI signals to triangulate the transmitter position, and those that use the Time-Difference-Of-Arrival (TDOA) of the incoming RFI signals in multi-lateration. Although these techniques provide good localisation performance they have some drawbacks. Systems that use AOA will have higher hardware and computational requirements due to the need of antenna arrays and for the associated spatial signal processing [108]. A localisation system that uses TDOA requires precise timing synchronisation between sensor nodes [160] and is less able to localise narrowband-type interferers as the signals need to be wideband for achieving good estimation of time-delays [107]. 113 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas An alternative to AOA and TDOA is to use the Received Signal Strength (RSS) of the incoming RFI signal to define radii which intersect at the source location. The benefits of RSS compared with AOA and TDOA are that it is cheaper to implement in terms of computation and hardware requirements and the measurements can be made using elements of existing GNSS receivers [118],[117]. The drawbacks to RSS are that its positioning accuracy is strongly dependent on the surrounding path loss behaviour and is less effective in the presence of many Non Line-of-Sight (NLOS) signals. The work presented in this chapter concentrates on the use of the log-normal shadowing model to model the path loss for localising unknown RF sources in open outdoor areas where there may be a ground reflection that causes variations in the path loss behaviour [116]. Relatively good accuracy can be achieved using RSS measurements in a fingerprinting methodology [161], but for a large outdoor environment where a localisation network is likely to be set up it may not be possible to build the fingerprint database economically and it may change over time. This work contrasts with previous work done using RSS for localisation in that the unknown source scenario is explored along with the effect of the height and frequency on the path loss behaviour. This is done with experimental results using Wi-Fi devices at 2.4GHz and simulations at the GPS L1band at 1.57542GHz. This chapter is structured as follows: in section 6.2, the two path loss models typically used for RSS positioning are explored. In section 6.3, a strategy for solving for position using the lognormal shadowing model in the case of unknown sources is explored. In section 6.4, the RSS output from the Wi-Fi devices that were used in the field experimentation are characterised. In section 6.5, the results of the field experiments are presented and analysed. In section 6.6, simulation results at the GPS L1 frequencies are explored. Summary and concluding remarks are given in section 6.7. Parts of the work detailed in this chapter have been published in the following conference proceedings: [13] RJR Thompson, A Tabatabaei Balaei, and AG Dempster, "Outdoor localization of a WiFi source with unknown transmission power," in IGNSS Symp. , Gold Coast, Australia, 2009, pp. CD-ROM procs. 114 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas [16] RJR Thompson, E Cetin, and AG Dempster, "Unknown source localization using RSS in open areas in the presence of ground reflections," in IEEE/ION PLANS, Myrtle Beach, South Carolina, 2012, pp. 1018-1027. 6.2 Path loss Models in Range-Based RSS positioning In ranging-based RSS methods, a path loss model is used to relate the RSS to a range measurement. There are two commonly used path loss models: the log-normal shadowing model, and the two-ray or ground reflection model that takes into account the influence of a reflected signal from the ground. With a number of RSS measurements equal to or greater than the number of unknown parameters to be solved it is then necessary to minimise the system of equations to find a position solution. 6.2.1 Log-normal shadowing model In the log-normal shadowing model a path loss exponent is used to characterise the fall in signal strength as a transmitter and receiver are separated and the variance, or shadowing, of the path loss values with distance is modelled as a log-normal distribution [115]:  d Pd = P0 − 10n log10   d0   +σ   (6.1) where P0 is the reference transmit power measured at a reference distance d0, Pd is the power measured at a distance d, n is the path loss exponent, and σ2 is the variance of the shadowing. In free space the value of n is equal to 2, and in practice can vary depending on the surrounding environment [162]. The variance of the shadowing is also dependant on the surrounding environment and can increase significantly in complex environments where there are multiple blockages between the transmitter and receiver [163]. 6.2.2 Two-ray reflection model Another model that can be used to define path loss is the two-ray reflection model which takes into account the impact a reflected signal from the ground has on the received signal power. This model fits observations taken in Line-Of-Sight (LOS) of the transmitter in open areas [164]. It can be defined as [165]: j 2π Pd = P0 − 10 log10 δd λ 1 e +Γ d d +δd 115 (6.2) Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas where P0 is the transmit power, d is the distance between the transmitter and the receiver, λ is the wavelength of the transmitted signal, d+δd is the distance of the reflected path: δ d = (ht + hr )2 + d 2 − (ht − hr )2 + d 2 (6.3) Γ is the reflection coefficient, and ht and hr are the transmitter and receiver heights. The reflection coefficient is different depending on whether the transmitted signal is vertically or horizontally polarised. In this work the transmitted signal is assumed to be vertically polarised and the reflection coefficient is given by Γ= sin(θ ) − ( ε r − cos(θ ) 2 ) (6.4) sin(θ ) + ( ε r − cos(θ ) 2 ) where θ is the incident angle of the ground reflection and εr is the relative permittivity of the ground material. An example value of εr for surfaces includes 6.0 for dry asphalt [166]. Typically the reflection coefficient is approximated to be -1; in this work it is calculated explicitly. The geometry of the two-ray reflection model is shown in Figure 6.1. Transmitter d d1 ht Receiver d2 hr εr θ θ Figure 6.1. The geometry used for the two-ray reflection model. The plots in Figure 6.2 show the RSS values using (6.1) and (6.2) for a transmitter with P0 = 0dBm, n=2, εr=9, at a frequency of 1575.42MHz, with receiver and transmitter heights of 1m. The RSS values given by the two-ray model move above and below the values given by the lognormal model as the reflected signal constructively and destructively combines with the LOS signal. Also shown in Figure 6.2 as a blue dot, is the distance of the first Fresnel zone. The first Fresnel zone distance can be defined as [116]: 116 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas df = 1 λ (Σ 2 ) ( ) 2 2 λ λ + ∆2 − 2 Σ 2 + ∆2 ⋅   +   2 2 4 (6.5) where Σ = ht + hr and ∆ = ht − hr , and can be used to describe where the path loss will begin to monotonically decrease. After this distance there are no longer dips caused by the ground reflection and in this case the distance is about 20m or 100 wavelengths. 0 2RM LN RSS (dBm) -10 -20 -30 -40 1 10 Distance (m) 2 10 Figure 6.2. A comparison between the path loss for the log-normal (LN) and two-ray reflection model (2RM). {circle: first Fresnel zone distance} 6.3 Position Estimation If the path loss behaves as the two-ray model suggests, it would be ideal to solve for position using it directly. Doing this requires knowledge of a number of parameters which may not be known for an unknown source over a large area, including the height of the transmitter and the relative permittivity of the ground surface. Solving this directly has been demonstrated when these parameters are known for use in close proximity mining safety [167]. In larger outdoor environments where the permittivity could vary and in the unknown source scenario where the transmitter height is unknown, solving for position this way is expected to be difficult due to the number of unknowns. 117 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas For these reasons the log-normal shadowing model will be used here and this work will explore its use when the path loss does follow the two-ray reflection model. Using this model the RSS measured by receiver i is related to the range to the transmitter by: RSS i = P0 − 10nlog10 ( where d i = (x − xi )2 + ( y − yi )2 di ) + σi d0 (6.6) is the distance of the transmitter to the receiver, (x,y) is the transmitter position, and (xi,yi) is the receiver position. The Differences of RSS (DRSS) measurements may be taken between two receivers i and j to remove the transmit power term from (6), reducing the number of unknowns to be solved and allowing lines of position to be visualised. If the path loss exponent is known, DRSS can be expressed as: DRSS i- j = RSS i − RSS j = 10nlog10 ( dj di ) + σi + σ j (6.7) 6.3.1 Position Solution by Least-Squares With a number of RSS measurements that is equal to or greater than the number of unknowns the transmitter position can now be solved. Simplifying to 2 dimensions, the parameters to be solved in RSS positioning are x and y so at least two sensor nodes are required. If the transmit power is unknown the parameters to be solved are [P0,x,y], requiring at least three sensors. If the path loss exponent is unknown the parameters to be solved are [P0,x,y,n], requiring at least four sensors. The need to solve for more parameters will decrease the positioning performance that can be expected as explored in Chapter 5 through analysis of the Cramer-Rao Lower Bound (CRLB), and with a low number of sensors and poor geometry there may be some locations where positioning performance will be poor. In matrix-vector form the system of positioning equations can be represented by dˆ = f (θ) + e (6.8) ˆ where d is the vector of noisy measurements, f (θ) is the vector of positioning equations, such as (6), evaluated at θ ={P0,x,y,n}, the true location and transmit power and path loss exponent, and e is the vector of measurement noise. The RSS equations are non-linear in nature and need to be 118 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas solved iteratively. One method to solve them is to minimise the least-squares cost-function [153] defined as ε = (dˆ − f (θˆ )) T C −1 (dˆ − f (θˆ )) T (6.9) ˆ where θ is the estimate of the parameters. It is assumed that there is no correlated shadowing between the RSS measurements for the open area scenario explored in this chapter. Correlated shadowing [168] may improve the results as explored in other works concerning techniques where RSS measurements are differenced [147]. With no correlated shadowing the covariance matrix takes a similar form that is used in TDOA equations, and takes the form: 2 1 L 1 1 O O M   C = σ2   M O O 1   1 L 1 2  (6.10) In Figure 6.3 the lines of position are shown for a transmitter in a sensor network consisting of four sensor nodes. In Figure 6.4 the least-squares cost-function (6.9) that corresponds to the scenario in Figure 6.3 is shown. The cost-function is significantly less convex than for other localisation methods such as TDOA and AOA due to the logarithmic terms in the RSS positioning equations. 40 30 20 20 ε y (metres) 30 10 10 0 40 0 40 0 10 20 30 x (metres) 20 y (metres) 40 Figure 6.3. The lines of position for RSS and DRSS equations for a transmitter. {solid: DRSS lines, dashed: RSS lines, circles: sensor nodes, square: transmitter location}. 20 0 0 x (metres) Figure 6.4. The least-squares cost function (in dB) for the DRSS lines of position. 119 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 6.3.2 Path loss exponent Along with the transmit power and position, the path loss exponent may also need to be solved in (6.6) depending on the knowledge of the terrain and heights of the transmitter and receivers in the sensor network. One example of a large-scale empirical path loss study in telecommunications is the Stanford University Interim (SUI) model [169] where the path loss exponent is given by γ = a − bhb + c / hb (6.11) where a, b, and c are dependent on the terrain and hb is the base-station height. In this model, along with others such as the COST-231 Hata model and ECC-33 model [169], the base-station height has an influence on the path loss exponent. In the unknown transmitter case, such as a GPS jammer which motivates this work, the height of the transmitter is unknown so the path loss exponent will need to be solved along with transmit power and position. In the open outdoor scenario it could be expected that the terrain would have less influence on the path loss and there will be a LOS path between the transmitter and receiver. Due to the ground reflections however the value of n will still vary depending on the location and antenna heights. To explore this behaviour simulation results will be used for an example sensor network: Considering an array of sensor nodes in a star formation of radius 75m, with nodes located at (0,75),(75,0),(0,-75),(-75,0),(0,0) the path loss exponent was calculated based on fits of RSS values for each sensor node using (6.2). This was done for transmitters located at different points in an area of interest equally spaced between x=[-100, 100] and y=[-100,100] in and around the sensor network and different heights. For an effective height of 10m, the average value of n over the area was 2.05, and varied from -0.2616 to 4.5652. For an effective height of 1m, the average value of n over the area of interest was 2.9138 and varied from 1.80 to 3.16. The difference in the path loss behaviour for the two effective heights is shown in Figure 6.5. As a result of the different path loss exponent values it again should be solved along with transmit power and position especially in the presence of ground-reflections. 120 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Power (dBm) -20 10m 1m -40 -60 -80 0 10 2 10 Distance (m) Figure 6.5. The path loss behaviour at 10m and 1m heights using the two-ray model. 6.3.3 Least-squares solver Due to the non-linear nature of the RSS positioning equations they cannot be solved directly to find the transmitter position. It is necessary to solve by choosing an initial guess and using an iterative technique such as the Gauss-Newton (GN) or the Levenberg-Marquardt (LM) techniques [154]. A direct implementation of the Taylor-series expansion in the GN technique can diverge quite easily due to the logarithmic terms and risk of rank deficiency in the matrix of RSS positioning equations. To overcome this the LM algorithm is recommended as it combines the GN technique with the Gradient Descent (GD) technique which can be used where the Taylorseries expansion begins to diverge. One problem with the iterative solver is that an initial guess is required. If the initial guess is in the wrong place the solver may converge to a local minima. To overcome this a coarse gridsearch can be used to calculate (6.9) at a number of different values and the minimum used as the initial guess. The use of DRSS equations means that only different values of (x,y,n) need to be searched and P can be ignored, significantly reducing the computational burden. An overview of the position estimation process is shown in Figure 6.6. Grid-search over [x,y,n] Initial guess LevenburgMardquart Position estimate Figure 6.6. The position estimation technique for DRSS. 121 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas An alternative to overcome these problems is to linearise the positioning equations using an intermediate variable and solving for position directly [155]. This is not used here since they require: at least 5 RSS measurements, the path loss exponent to be known, and the positioning performance is significantly below the iterative techniques. 6.4 Measuring path loss using Wi-Fi The work presented in this section is motivated by RFI localisation in the GPS L1 band. However, the GPS bands are protected and it is generally not legal to transmit in these bands. An alternative approach to evaluate the performance of the RSS-based localisation is to measure the path loss in another band such as the "nearby" ISM band using IEEE802.11 Wi-Fi devices. These devices provide Received Signal Strength Indication (RSSI) outputs, which can be equivalent to RSS measurements, which have been used by a number of authors for path loss measurement and positioning purposes [165],[170]. The quality of the RSSI values given by these devices can be variable, however [171]. After an initial evaluation of a number of different Wi-Fi adapters with different chipsets, one based on the ZyDAS 1211b chipset [172] was found to give the best RSSI output for the purpose of measuring path loss in this scenario. The other chipsets tested included the Realtek 8187L and the Ralink RT2860, and in terms of the histogram and number of outliers in the RSSI from the ZyDAS 1211b chipset performed the best. An investigation of the performance of the RSSI output of the ZyDAS 1211b is described in the following sections. 6.4.1 Logging RSS from Wi-Fi Devices The most common method for making RSSI measurements is through measuring the signal strength of packets sent by access points in response to probe requests. This is called ‘active scanning’ [173] as the Wi-Fi client device is actively requesting probe responses from surrounding access points on different channels. This is shown in Figure 6.7. However, this method can suffer from coverage and latency problems, as the probe request sent by the client must be strong enough to be decoded by the access point, and the access point must reply in time. Another method for making RSSI measurements is by placing the Wi-Fi device in a ‘passive’ [173] or ‘promiscuous’ monitoring mode. In normal operation, a Wi-Fi device is programmed to make available packets that are addressed to its particular Media Access Control (MAC) address. In passive mode however, the device can decode all incoming packets. As an access point 122 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas transmits beacon packets periodically (up to 20Hz) for infrastructure purposes, the RSSI measurements can be taken from these instead. This method is shown in Figure 6.8. Probe Requests Broadcast Beacons Probe Responses Figure 6.7. The client-server interchange of packets when measuring RSSI in 'active' scanning mode. Figure 6.8. The monitoring of the broadcast beacons from access-points in 'passive' scanning mode. To compare the coverage performance of the active and passive scanning modes, a USB Wi-Fi dongle with a ZyDAS 1211b chipset with a detachable antenna was placed in both active and passive modes one after another and 5 minutes of data recorded. An image of this device is shown in Figure 6.9. For active scanning, the manufacturer's drivers for Windows XP were used along with the application Network Stumbler [174] to record the RSSI values. For passive scanning mode, a modified version of the zd1211rw [175] drivers was used under Ubuntu 9.04 along with the aircrack-ng package [176], and tcpdump was used to capture the radiotap headers of the incoming Wi-Fi packets. Over 5 minutes, the active scanning technique was able to make RSSI measurements on 10,471 probe responses from 11 unique Service Set Identifiers (SSIDs). Over 5 minutes, the passive scanning technique on the other hand was able to make RSSI measurements on 4,958 packets from 11 unique SSIDs. 6.4.2 Dynamic Test As part of the Windows Management Instrumentation (WMI) interface [177] it is possible to poll the Wi-Fi chipset driver at a periodic rate to get the RSSI of the access point that the device is currently connected to. Using this technique it is theoretically possible to get more RSSI measurements from an access point than when using the probe request/response technique, which generally provides an RSSI measurement every 2 seconds. To evaluate the dynamic response of the Windows and Ubuntu based measurements the RSSI was measured as the antenna shown in Figure 6.9 was rotated 90 degrees and back again. 123 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Rotation Figure 6.9. A photograph of the USB Wi-Fi adapter used in the experiments. The change in RSSI as the antenna was rotated is shown in Figure 6.10 and Figure 6.11. In both figures the measurement rate is 20ms. As can be observed, the response in the RSSI is markedly different between the Windows and Linux based set-ups. Another difference is that the WMI interface provides the RSSI value in dBm. The Windows based RSSI value measurement values appears to be filtered whereas the Linux based ones appear to be change rapidly. As shown in Figure 6.11, the RSSI values measured in passive mode under Ubuntu change almost instantly. The RSSI values taken using the Windows driver are slow to react with some sudden jumps and appear filtered. It takes almost 10 seconds for the RSSI values to settle. From these results the use of passive mode is recommended for this chipset, and will be used in the field experiments which are described in the proceeding sections. 70 -30 RSSI RSSI ver. horizontal -40 60 vertical 55 vertical -45 -50 horizontal 65 -35 vertical 10 20 30 Time (s) 40 50 45 50 Figure 6.10. The RSSI (in dBm) values from the Windows Network Driver Interface Specification (NDIS) interface while rotating the USB adapter’s antenna. 5 10 15 Time (s) 20 Figure 6.11. The RSSI (unitless) values from the modified zd1211rw Linux drivers while rotating the USB adapter’s antenna. 124 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 6.4.4 Characterising RSSI Values To characterise how RSSI changes with RF power the USB Wi-Fi adapter was connected directly to an access point through a variable attenuator as shown in Figure 6.12. The access point was set to transmit beacon packets every 20ms, allowing 50 RSSI measurements to be taken per second. The modified zd1211rw drivers provide the RSSI as an unsigned integer with values ranging from 0 to 128. The attenuation was varied from 3 to 89dB and the RSSI measured at each step. Wi-Fi Access Point Variable attenuator USB Wi-Fi dongle Figure 6.12. The setup for characterising the RSSI from the USB Wi-Fi dongle. The values of the measured RSSI are shown over time at two different attenuation levels in Figure 6.13. The RSSI appears to follow a Gaussian distribution but there are also outliers and unexpected behaviour which has been observed from the RSSI values from various different WiFi chipsets [171]. This behaviour occurred with the Windows based setup as well. As the Wi-Fi device is connected directly to the access-point these variations must be caused by the device itself and not from a shadowing effect or from the access point, as the outliers only occur when the attenuation is high. Analysing how the histogram of the RSSI changes with attenuation, it is apparent that the highest RSSI values correspond to the true value, and the others are anomalous. The anomalous values do not occur as regularly as the true values. In order to find the true RSSI value, a spline fit is applied to the histogram of the RSSI values over an observation period and the location of the global maximum is used as the true RSSI value. In Figure 6.14 the shape of the spline fit is shown for the values corresponding to the attenuation of 16dB shown in Figure 6.13. 125 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 80 16dB 59dB 39dB 1500 Counts RSSI 60 40 500 16dB 39dB 59dB 20 600 650 700 Time (20ms) 1000 0 40 750 50 60 RSSI 70 80 Figure 6.14. The spline fit of the histogram of RSSI at different attenuations Figure 6.13. The RSSI (unitless) values at different attenuations. In Figure 6.15 the response of the RSSI as the attenuation is increased is shown before and after using the spline fit of the histogram for 10 seconds of RSSI values. The RSSI falls linearly as the attenuation is increased and can be fit with a linear model: RSSI ( x) = 101.114 − 1.072( x) (6.12) where x is the amount of attenuation in dBs. As can be observed in Figure 6.15, the fall in dB is slightly steeper than what would be expected at 1.072dB per dB of attenuation, and the fit has an RMSE of 1.022dB. For the averaged RSSI values taking the mean, at higher power levels the RSSI begins to jump around significantly. With the spline fit, the RSSI can be used for taking reliable measurements of the signal strength even at the higher power levels. Without this fix, the RSSI will not be accurate for strong signal strengths, which would be when the access point is located within a close distance. 100 Mean Spline Linear Fit (Spline) RSSI 80 60 40 20 20 40 60 Attenuation (dB) 80 Figure 6.15. The fall in RSSI before and after the spline calibration technique. 126 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 6.5 Field Experiment To explore the path loss behaviour and localisation performance for RSS in an open outdoor environment a sensor network of 5 sensor nodes was set-up using laptops with Wi-Fi adapters and an access point (operating at 2.412MHz) used as a rover. The experiment took place on the Village Green at UNSW, which is a circular field, over an area of 150m2. The devices were the same as analysed in section 6.4 and attached to 1/4 wavelength dipole antennas of the same make in an attempt to normalise the antenna radiation patterns. In practice for unknown sources there will be no control over the radiation pattern of the transmitter which will be a further challenge for RSS positioning because there is no guarantee that the transmitter will radiate equally in all directions. In this work it is assumed that the transmitter radiates equally in all directions. RTK GPS was used to measure the positions of the sensors and the rover at different positions around the oval. At survey marks located around the field, the RTK GPS provided positioning accuracy in the range of 10-30cm. The rover was moved to different locations and the RSS values were collected at a number of test points with the transmitters and receivers at a height of 1.05m. A photograph of a sensor node is shown in Figure 6.16 and of the rover in Figure 6.17. Figure 6.16. The USB Wi-Fi adapter and antenna used as a sensor node. Figure 6.17. The rover with RTK GPS and a Wi-Fi access point. In Figure 6.18 an overheard image of where the experiment was conducted is shown. The green markers are the locations of the sensor nodes and the southernmost sensor node was placed closer to the centre to allow test points outside the geometry of the sensor network to be taken. RSS measurements were taken with transmitter and receiver heights of 1.05 and 1.55m. In Figure 6.19 the value of the RSS measured at three of the sensor nodes is shown at one of the rover test locations. Although noisier than the measurements taken when the devices were connected to the 127 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas access point through an attenuator, the values did not drift over short periods of time. The passive monitoring and spline fit technique described in section 6.4 were used to find the mean RSS values at each location. The only modification was that the wireless driver was updated to give RSS values in dBm instead of an RSSI. #3 #2 -35 RSS (dBm) #4 S1 S2 S3 #1 -40 -45 -50 -55 #5 1.256 Figure 6.18. Sensor network setup. {Green arrows = sensor nodes}. Imagery (C) 2012 DigitalGlobe, GeoEye, Sinclair Knight Merz, Cnes/Spot Image; Map data (C) 2012 Google, Whereis(R). Sensis Pty Ltd 1.256 1.256 Time (s) 1.256 9 x 10 Figure 6.19 The RSSI values measured at different sensor nodes #1, #2, and #3, over time with the transmitter located at one of the test points During the experiment care was taken to ensure that the transmitter was always in line-of-sight of all the sensor nodes in the network. In a large real world environment in practice the transmitter and sensor nodes may not have line of sight to each other due to obstructions such as buildings. The scenario that drives this research is the localisation of an interference source that is interfering with the Ground-Based Augmentation System (GBAS) at an airport. In a large open area like an airport runway there are expected to be fewer obstructions between the interference source and the sensor nodes than in a built-up urban environment, where localisation of a cellular handset is performed for example. In a GBAS setup the GPS stations are usually placed together, each having line of site with each other at an open location at an airport [178]. 6.5.1 Path loss behaviour The RSS values taken at different points at a height of 1.05m were used to create a log-normal model of the path loss. The rover locations used are shown in Figure 6.20. The resulting equation to describe the path loss was: 128 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Pd = 2.809 − 10 ⋅ 3.041 ⋅ log10 (d ) + σ (6.13) where σ is equal to 2.964dB. The RSS at each test point, along with the log-normal fit, and the path loss given by the two-ray model (with heights equal to 1.05m and εr=9) are shown in Figure 6.21. In general the RSS values fall linearly with distance. The path loss falls at a faster rate than expected under the two-ray model and the cause of this is not known, but may be due to the ground surface not being perfectly flat or the steeper than theoretical slope found in the RSSI output in (6.12). Points 2RM LN -30 RSS (dBm) y (meters) 50 0 -40 -50 -60 -50 1 -50 0 x (meters) 2 10 50 10 Distance (m) Figure 6.20. The test locations where path Figure 6.21. The path loss behaviour for the loss was measured for the 1.05m data set. 1.05m data set. {circles: sensor nodes, squares: test locations}. After the measurements were taken at 1.05m, the heights of the antennas were raised to 1.55m. The rover was moved to the different locations shown in Figure 6.22 and the RSS values recorded. The resulting equation that describes the path loss was: Pd = 16.93 − 10 ⋅1.846 ⋅ log10 (d ) + σ (6.14) where σ is equal to 3.063dB. The RSS at each test point, along with the log-normal fit, and the path loss given by the two-ray model (with heights equal to 1.55m and εr=9) are shown in Figure 6.23. Due to the increased height of the transmitter and receivers, a number of RSS measurements were taken within the first Fresnel zone. A large dip is visible at a distance of 35m in the test point data and this matches the dip given by the two-ray reflection model. Although the error of the fit for 1.55m is of similar magnitude to the fit for the 1.05m data, the distribution of the residuals is not as normally distributed. Similar to the data at 1.05m, the data at 1.55m also begins to fall at a faster rate than the two-ray model implies. Nonetheless, the Wi-Fi devices used are 129 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas able to give a good indication of the path loss and show variations as expected from the two-ray model when taking RSS measurements in open outdoor areas. -30 Points 2RM LN RSS (dBm) y (meters) 50 0 -50 -40 -50 -60 -50 0 x (meters) 1 2 10 50 10 Distance (m) Figure 6.22. The test locations where path loss was measured for the 1.55m data set. {circles: sensor nodes, squares: test locations}. Figure 6.23. The path loss behaviour for the 1.55m data set. 6.5.2 Positioning Results The technique outlined in section 6.3 was used to estimate the position of the transmitter at test point using the recorded RSS values, using the grid-search to initialise the LM technique solving using the log-normal path loss model. The initial guess was found using a grid search of 200,000 points in [x,y,n] with values uniformly distributed between x=[-200,200], y=[-200,200], and n=[5,5]. The number of points chosen is not coarse and a large number of points were chosen to ensure that the global minimum could be found. The positioning results using the log-normal model are shown in Table 6.1 and the Empirical Cumulative Distribution Functions (ECDF) of the position errors shown in Figure 6.24. The Cramer-Rao Lower Bound (CRLB) was calculated using the value of n and σ that fits each individual test point using its true location with the workings from Chapter 5, with P0 and n added as unknowns along with position. Table 6.1. The positioning results from the experiments at 1.05m and 1.55m heights. Effective Height 67th percentile 95th percentile Mean 1.05m Position √CRLB Error* 9.70 14.78 42.92 26.68 15.70 15.71 * Solving for P and n. 130 1.55m Position Error* 53.87 183.92 502.70 √CRLB 56.52 214.90 96.36 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas As can be observed from Table 6.1, the positioning error significantly increases when the height of the transmitter and receivers are increased to the height of 1.55m, with an error of 9.70m at the 67th percentile for the 1.05m data compared with an error of 53.87m at the 67th percentile for the 1.55m data. This is caused by the dips in the path from the ground reflections. At the height of 1.05m the first Fresnel zone distance is small and the path loss values fall monotonically for most of the recorded data points. At this height, the positioning performance is good. At the height of 1.55m the distance of the first Fresnel zone is larger and there are visible dips in the path loss due to the ground reflections. For the 1.55m data the mean error of all of the points was equal to 502.70m demonstrating that a number of points also had divergent behaviour with large position errors. Looking at the ECDFs in Figure 6.24 there are certain percentiles where the positioning error increases rapidly. For the 1.05m data this occurs at the 84th percentile. For the 1.55m data this occurs much earlier at the 54th percentile and begins to increase again at the 77th percentile. It could be expected that for test points located further away from the sensor network the positioning error would increase rapidly as suggested by the CRLB. For the 1.55m data the increase at the 84th percentile is caused by a small number of points that have divergent behaviour. Cumulative Probability 1 0.8 0.6 h=1.05m h=1.55m 0.4 0.2 0 0 50 100 Position Error (m) Figure 6.24. The ECDF comparison of positioning results at heights of 1.05m and 1.55m. In Figure 6.25 and Figure 6.26 the behaviour of the position estimates relative to the true position is shown. At nearby test points the position solutions appear to point in the same direction, and 131 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas could evidence of correlated shadowing. For the 1.05m data there is only one noticeably divergent point when the transmitter is located inside or close to the sensor network. For the locations outside the sensor network the position error tends to increase, as expected, given the behaviour of the CRLB. For the 1.55m data, the number of divergent points is greater and divergence occurs at locations within the sensor network. At locations within the sensor network where the positioning error is large, typically at least one sensor node is within the first Fresnel zone. Under the same conditions and using the same equipment increasing the height of the transmitter and receivers dramatically increased the error of the position estimates. The lognormal shadowing model was not as effective at the 1.55m height due to the ground reflections. 50 y (m) y (m) 50 0 0 -50 -50 -50 0 -50 50 0 50 x (m) x (m) Figure 6.25. The vectors of the position errors for the 1.05m height data. Figure 6.26. The vectors of the position errors for the 1.55m height data. {arrow: position estimate vectors, circles: sensor nodes, square: true locations}. {arrow: position estimate vectors, circles: sensor nodes, square: true locations}. 6.5.3 Comparison of position error with CRLB The CRLB provides a lower bound on the variance of any unbiased estimator [107]. In Chapter 5 it was used to compare the performance of different localisation methods with typical noise variances. In summary, it can be calculated from the inverse of the Fisher Information Matrix (FIM) I(θ): I (θ) = H (θ)C −1H (θ) (6.15) σθ2ˆ (θ) ≥ CRLBθˆ (θ) = [I(θ)]−1 (6.16) where H(θ) corresponds to the Jacobian matrix of the set of positioning equations f(θ). For RSS equations the maximum likelihood estimator has been shown to be biased [179]. As a result the 132 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas CRLB may not always give a useful indication of the positioning performance that could be expected. For the sensor network used in field experiment the error ellipses based on the CRLB are shown for different points when different unknowns are solved for in Figure 6.27. 60 40 y (m) 20 0 -20 n and P0 known -40 n and P0 unknown -60 P0 unknown -120 -100 -80 -60 -40 -20 x (m) 0 20 40 60 80 Figure 6.27. The error ellipses for different sets of parameters being estimated. {circles: sensor nodes, dots: test locations}. The CRLB increases rapidly as the transmitter moves further away from the sensor network when P and n are unknown. In the experimental results the error did tend to increase at locations further away from the sensor network, but most of the time not at the rate suggested by the CRLB. In Figure 6.28 and Figure 6.29 the ECDF of the position errors are shown along with the CRLB for the 1.05m and 1.55m data. At the 67th percentile for both data sets the CRLB overestimates the position error. The CRLB overestimation is greater for the 1.05m than for the 1.55m data. At higher percentiles the empirical position error begins to overtake the CRLB and for the 1.55m significantly so. The rapid increase in the CRLB for locations outside the sensor network may be hinting at the greater chance of divergent points which were observed in the experimental data. 133 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 1 Cumulative Probability Cumulative Probability 1 0.8 Results 0.6 √CRLB 0.4 0.2 0 0.8 10 20 30 40 Position Error (m) 0.2 50 Figure 6.28. A comparison of the position error and CRLB for the 1.05m data. √CRLB 0.4 0 0 Results 0.6 50 100 150 200 250 Position Error (m) 300 Figure 6.29. A comparison of the position error and CRLB for the 1.55m data. 6.5.4 Divergent points The apparent 'divergent' behaviour where the position error is large at some test points, especially for the 1.55m data, is a concern if there are to be requirements on the robustness of the localisation system. In Figure 6.30 the position error for test point 2 in the 1.55m data set is shown and the associated path loss behaviour is shown in Figure 6.31. At this location the true fit of the log-normal model has a transmit power of -70.04dBm and a path loss exponent of -1.12. The position estimation technique finds a transmit power of 63.37dBm and a path loss exponent of 4.67, and the path loss model given by this solution is shown by the "Minima" line in Figure 6.31. Although this solution appears divergent, it is in fact the global minimum of the leastsquares cost-function (6.9). 2RM Minima True Fit -20 0 RSS (dBm) y (meters) 100 -100 -30 -40 -50 -60 -200 -100 -50 0 x (meters) 2 50 Figure 6.30. The position error for test point 2 in the 1.55m data set. {arrow: position estimate vector, circles: sensor nodes, square: true location}. 10 Distance (m) Figure 6.31. The path loss models for test point 2 in the 1.55m data set. 134 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Another example of divergent behaviour occurred at test point 31 in the 1.55m data set as shown by the position error in Figure 6.32 and the path loss models in Figure 6.33. The true fit has a transmit power of -29.23dBm and a path loss exponent of 1.24. The position estimation algorithm finds a solution with transmit power of -137.34 and a path loss exponent of -3.77. These are unrealistic values as the power increases with distance, but again it is the minimum of the leastsquares cost function found by the position estimation algorithm. In these cases the requirement to solve for P and n increases the chance of a solution outside the network with unrealistic P and n values. 2RM Minima True Fit -40 RSS (dBm) y (meters) 150 100 50 0 -45 -50 -55 -60 -50 -65 -50 0 x (meters) 2 10 Distance (m) 50 Figure 6.32. The position error for test point 31 in the 1.55m data set. {arrow: position estimate vector, circles: sensor nodes, square: true location}. Figure 6.33. The path loss models for test point 2 in the 1.55m data set. 6.5.5 Optimal path loss value Solving for P and n introduces divergent-like behaviour at certain data points as shown in the previous section with some points also having unrealistic path loss exponent values. If some information about the heights and path loss environment was available an alternative approach may be to use a fixed value of n to reduce this problem. To examine how the choice of the path loss exponent impacts the positioning performance the positions equations were solved using fixed values of n and the results shown in Table 6.2 for the 1.05m height data and in Table 6.3 for the 1.55m height data. For the 1.05m data set using a fixed path loss value of 3.75 had the best performance while a value of 1.75 had the best performance for the 1.55m data set. The position error was noticeably reduced at the 95th percentile at both heights compared with solving for n as using a fixed value for the path loss exponent reduces the divergent behaviour. 135 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Table 6.2. Positioning results with different strategies for the path loss exponent (1.05m data set). 67th percentile 95th percentile Mean n=3 n=3.75 √CRLB* 11.52 9.47 14.78 solve n 9.70 n=2 18.778 42.92 32.00 22.62 20.33 26.68 15.70 15.66 10.57 9.07 15.71 *solving for P and n Table 6.3. Positioning results with different strategies for the path loss exponent (1.55m data set). 67th percentile 9th percentile Mean solve n 53.87 183.92 502.70 n = 2 n=1.75 n=1.25 √CRLB 45.96 42.49 39.01 56.52 108.61 39.76 83.38 36.01 61.67 33.20 214.90 96.36 In Figure 6.34 and Figure 6.35 the position error at the 67th percentile is shown for the 1.05m and 1.55m data respectively for different path loss exponent values. It is interesting to note that the value that minimises the error is different to the value given by the path loss models found in (6.13) and (6.14). For the 1.55m data using a fixed value of n of almost any value between 0.25 and 2.75 outperforms solving for n. For values of n above 2.75 the positioning performance begins to degrade. For the 1.05m data the ideal value of n lies between 3 and 4. Although using fixed values of n does reduce the positioning error, the choice of n would not be clear to best cover both the 1.05m and 1.55m data sets. A value of n=1.25 that suits the 1.55m data would significantly increase the positioning error for the 1.05m where a better value is 3.75. As a result it is recommended that the path loss exponent be solved when the transmitter height is unknown. It is also noted that in general from examining the distribution of the position errors, underestimating the path loss exponent causes the position solution to become biased towards the sensor node nearest to the transmitter, and overestimating the value causes the position solution to move outside the sensor network and become increasingly divergent. 136 Passive Source Localisation Using RSS in Open Outdoor Areas 80 Position Error (67%) Position Error (67%) Chapter 6 60 40 20 1 2 3 n 4 5 200 150 100 50 1 6 Figure 6.34. The 67th percentile position error for different fixed path loss exponent values for the 1.05m data set. 2 3 n 4 5 6 Figure 6.35. The 67th percentile position error for different fixed path loss exponent values for the 1.55m data set. 6.5.5 Different Sensor Sets In the field experiment five sensor nodes were deployed. Only four sensor nodes are required to solve for all the unknowns in the position equations. Although the CRLB shows that the position performance will improve with more sensors, due to the dips in the path loss it may be beneficial to exclude a sensor node if it is within the first Fresnel zone of the transmitter, or for some reason if that sensor node had noisier RSS measurements than the others. The positioning results with different sensor nodes excluded are shown in Table 6.4. At the 67th percentile the use of all five sensor nodes has improved the position performance for the 1.05m data set. For the 1.55m dataset the removal of sensor node 2 slightly improves the position error at the 67th percentile and has lower mean error. Table 6.4. The positioning performance when excluding a sensor node. Excluded sensor node (Figure 6.18): * All 5 used 1 2 3 4 5 67th 9.70 22.57 22.73 16.77 31.27 23.61 1.05m 95th 42.92 96.17 31.39 155.47 1604.47 50.52 Mean 15.70 24.39 22.00 28.27 276.27 21.08 67th 53.87 107.53 53.25 63.73 66.42 60.18 1.55m 95th 183.92 11773.97 185.38 159.96 18846.59 173.37 Mean 502.70 2570.61 71.57 93.64 2639.99 665.64 An example of where removing a measurement from a sensor node reduces the position error is shown in Figure 6.36 and Figure 6.37 for test point 14 in the 1.55m data set. With all 5 the 137 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas position error is 48.34m and the transmit power is estimated as 44.86dBm with a path loss exponent of 4.66. With sensor node 4 removed, the position error is 14.80m and the transmit power is estimated as -3.73dBm with a path loss exponent of 2.52. Further investigation of choosing different sets of sensors to improve positioning presents useful future work if a metric can be devised to decide whether a certain measurement is located within the Fresnel zone or not. #3 #3 50 #2 #1 y (meters) y (meters) #4 50 0 #5 -50 -100 -100 -50 0 x (meters) #2 #5 -50 -100 -100 50 Figure 6.36. The DRSS lines of position with all sensor node measurements for test point 14 in the 1.55m data set. {star: position estimate, circles: sensor nodes, square: true location}. #1 0 -50 0 x (meters) 50 Figure 6.37. The DRSS lines of position with sensor node 4 excluded from the measurements for test point 14 in the 1.55m data set. {star: position estimate, circles: sensor nodes, square: true location}. 6.6 Performance at GPS L1-band 6.6.1 Path loss comparison between GPS L1 and Wi-Fi In the GEMS system [15], the unknown signals will be at the GPS L1 frequency of 1575.42GHz, not at the 2.4GHz frequency of the Wi-Fi used in the field experiment. The different frequencies will have an impact on the path loss behaviour and the distance of the first Fresnel zone. The distance of the first Fresnel zone at different heights and wavelengths is shown in Table 6.5. Table 6.5. First Fresnel zone distance comparison between Wi-Fi and GPS. Heights ht hr 1.55m 3.0m 10m 1.55m 1.55m 1.55m Distance Wi-Fi (2.412GHz) 76.97m 148.67m 476.98m GPS L1 (1.5752GHZ) 50.01m 96.34m 291.61m In Figure 6.38 the path loss is shown for Wi-Fi and GPS L1 for transmitter and receivers at a height of 1.55m. At this height the first Fresnel zone distance is 16.96 meters longer for Wi-Fi 138 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas than for GPS L1. As a result, positioning with RSS will perform better at GPS L1 when compared with Wi-Fi. WiFI GPS L1 RSS (dBm) -30 -40 -50 -60 1 2 10 10 Distance (m) Figure 6.38. The path loss using the two-ray model. {circles – first Fresnel zone distances}. 6.6.2 Simulations at GPS L1 Band In this section the positioning performance will be explored in the GPS L1 band through MonteCarlo simulations. The two-ray model is used to generate the RSS values at different locations for a specified sensor network and noise is added to the measurements. The set of position equations is then solved using the position estimation algorithm used previously and the value of the shadowing noise added (modelled as white Gaussian noise with zero mean) is equal to 2dB. 6.6.2.1 Small Area Sensor Network In a GBAS installation at one particular airport [178] the antennas for the reference stations have a height of 1.55m and have typical separations of 100m. One possible topology for an interference localisation network is to have 6 sensors in a star configuration with one sensor located in the center that closely surrounds the GBAS reference antennas. The radius of the network is set to 500m and is shown in Figure 6.39. In Table 6.6 the positioning performance after 100,000 simulation runs is shown for different transmitter locations and heights, with the receiver heights fixed at 1.55m. Even for this closely spaced sensor network the positioning error is large. With 67th percentile values in the range of 44.03 to 127.36m, RSS is not suitable in this scenario if robust localisation performance is required. The aim of the GEMS system for localisation is position error in the range of 5-10m. 139 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Table 6.6. Simulated Positioning Results for a small area network. Height 10m 3m 1.55m 10m 3m 1.55m Position (250,250) (250,250) (250,250) (750,750) (750,750) (750,750) 67th 380.99 106.55 139.95 530.91 688.27 820.21 √CRLB 95th 486.94 143.48 209.55 721.36 1062.92 1220.56 Mean 339.05 97.43 123.77 480.42 622.71 766.63 67th 127.36 44.03 49.8 562.95 657.22 1065.49 Simulations 95th 146.46 88.71 99.47 1766.65 4670.44 12763.89 Mean 184.81 46.93 54.47 512.90 1469.72 2574.03 In Figure 6.39 and Figure 6.40 the distribution of the position estimates are shown for the initial 50 simulation runs with the transmitter height of 1.55m At the transmitter location of (250,250) with a height of 1.55m, the position estimates are located around the true location with only a few divergent solutions producing outliers. In Figure 6.40 the distribution of the position estimates is shown for 50 simulation runs for a point located outside the sensor network at (750,750). The transmitter again has a height of 1.55m. At this location, the distribution of the position estimates is more spread out and there are more divergent points. It is also becoming difficult to determine whether the transmitter is located inside or outside although the distribution of the solutions is providing information on the potential bearing of the transmitter. The spread of the position estimates at (750,750) is also large as suggested by the CRLB for points outside the sensor network as shown previously in Figure 6.27. 1000 500 500 y (m) y (m) 1000 0 -500 -500 0 0 500 -500 -500 1000 x (m) 0 500 1000 x (m) Figure 6.39. The distribution of the position estimates for a number of simulation runs with transmitter at (250,250). Figure 6.40. The distribution of the position estimates for a number of simulation runs with transmitter at (750,750). {star: position estimate, circles: sensor nodes, square: actual position}. {star: position estimate, circles: sensor nodes, square: actual position}. 140 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Looking at Table 6.6, at the (250,250) location the position error is actually smallest at the 3m height compared with the 1.55m height, and at the (750,750) location the 10m height has the smallest position error. At this location the slope of the path loss is larger for the 3m height that at 1.55m. The greater the slope the better the positioning results are expected to be as there is greater fall with distance. In Figure 6.41 the path loss models are shown for the position at (250,250), at 3.0m the path loss exponent is 2.93, at 10m the path loss exponent is 1.862. At (750,750) the best positioning is at a transmitter height of 10m, with the path loss in relation to the sensor positions shown in Figure 6.42. Power (dBm) -50 -60 -70 1.55m 3m 10m -50 Power (dBm) 1.55m 3m 10m -40 -60 -70 -80 -80 2 10 Distance (m) 3 2 10 10 3 10 Distance (m) Figure 6.41. The path loss behaviour at the different simulation heights for the transmitter at (250,250). Figure 6.42. The path loss behaviour at the different simulation heights for the transmitter at (750,750). 6.6.2.3 Wide-Area Sensor Network The small area topology described in the previous section has trouble localising transmitters located outside the sensor network. The area of an airport is large and the interference source is likely to be located away from the GBAS reference antennas, such as from a nearby highway. To provide greater coverage the sensor nodes can be placed further apart. To explore this scenario the radius is increased to 5000m with one sensor located in the center. The results of the simulation runs are shown in Table 6.7 for different transmitter heights and positions. At these distances the transmitter is far outside the first Fresnel zone of all the sensor nodes for both locations. As shown previously in Figure 6.42 the gradient of the path loss is greater for the 10m height transmitter so the positioning error is marginally better. 141 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Table 6.7. Simulated Positioning Results for a wide area sensor network. Height 10m 3m 1.55m 10m 3m 1.55m Position (2500,2500) (2500,2500) (2500,2500) (7500,7500) (7500,7500) (7500,7500) 67th 1409.07 1514.13 1632.87 7003.86 7567.59 9133.36 √CRLB 95th 2247.37 2106.62 2142.46 14427.41 12480.67 14768.00 Mean 67th 1261.93 611.48 1360.41 699.05 1423.84 669.02 7189.91 6938.97 7199.13 7300.22 8049.92 7384.09 Simulations 95th Mean 3170.62 744.58 4293.42 1037.07 1153.96 822.05 42604.15 41728.77 69851.90 32049.59 87577.90 62187.09 In Figure 6.43 and Figure 6.44 the distribution of the position estimates are shown for a test point at (2500,2500) and (7500,7500). The distribution of the position estimates in the simulation runs look similar to the results found for the small area sensor network with a radius of 500m, after being scaled by a factor of 10, but there are more divergent points. Again the sensor network has large position errors but is still providing some information about the location and bearing of the transmitter relative to the sensor network. 10000 5000 5000 y (m) y (m) 10000 0 0 -5000 -5000 0 5000 x (m) 10000 -5000 -5000 15000 0 5000 x (m) 10000 15000 Figure 6.43. The distribution of the position estimates for a number of simulation runs with transmitter at (2500,2500). Figure 6.44. The distribution of the position estimates for a number of simulation runs with transmitter at (7500,7500). {star: position estimate, circles: sensor nodes, square: actual position}. {star: position estimate, circles: sensor nodes, square: actual position}. 142 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 6.7 Summary and Conclusions The choice of path loss model is an important part of RSS positioning and the two-ray reflection model shows that there will be large variations with distance due to ground reflections. The influence of the ground reflection on positioning performance when using the log-normal shadowing model to solve the positioning equations was explored through a field trial with Wi-Fi devices and Monte-Carlo simulations. With proper characterisation, Wi-Fi devices were found to be an effective tool for measuring path loss behaviour in an outdoor area. In terms of positioning performance, the use of RSS for localising RFI sources with unknown power and path loss exponent can have problems for the less dense networks explored here if the source is located too close or too far from the sensor nodes. If the transmitter is located too close to the sensor nodes the RSS measurements could be taken within the first Fresnel zone. Within this zone it is difficult to fit the log-normal path loss model when solving for position due to the dips in the path loss from the ground reflection. If the transmitter is located too far from the geometry of the sensor network the CRLB begins to increase rapidly resulting in poor position estimates. It is shown through real experiments that the heights of the transmitter and receiving nodes affect the position accuracy immensely. At a height of 1.05m the positioning performance was found to be good but at a height of 1.55 it is degraded significantly. Monte-Carlo simulations at GPS L1 also showed large positioning errors when using RSS over large areas. The results from this chapter demonstrates that it is difficult to have a robust localisation system using RSS for unknown sources, such as RFI, when the log-normal path loss model is used to solve the positioning equations. For robust localisation to be achieved other alternatives such as AOA or TDOA are required or a better way of solving the positioning equations that take ground reflections into account is needed. 143 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 144 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements 7.1 Introduction The results of chapter 6 showed that, due to the presence of ground reflections, the localisation of a transmitter using the Received Signal Strength (RSS) technique can suffer from large position errors, even in a sensor network over a small area. This was due to ground reflections increasing the variability of the path-loss behaviour as the effective heights of the transmitter and receivers increased. Another technique that can be used for passively localising unknown sources is Time Difference of Arrival (TDOA) [109]. In TDOA, data sets between sensor nodes are crosscorrelated and the peak in the cross-correlation function is used to estimate the time-delay of the unknown signal, and can be used for detection as well [110]. A number of time-delays from different baselines of sensors can be used to form hyperbolas which intersect at the location of the unknown source. The performance of time-delay estimation is dependent on a number of factors, including the time synchronisation between nodes [160], the bandwidth and effective Signal to Noise Ratio (SNR) of the signal [107], and the properties of the underlying background noise at each sensor node [180]. 145 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements The work in this chapter investigates the behaviour of this underlying noise and the impact it has on cross-correlation in a GNSS context. If the noise at each sensor node is statistically independent, then weaker sources can be detected compared with detection techniques that using single signal paths, with the improvements in detection proportional to the observation time [181]. Furthermore, the time-delay estimate will not be distorted by the presence of any spatially correlated signals. In the context of a GNSS RFI localisation system, along with the RFI there will also be the signals from any visible GNSS satellites that are transmitting in the bandwidth of each sensor node. As a result the “background noise” at each sensor node will not be statistically independent and will be spatially correlated. The GNSS signals are wideband and will create narrow cross-correlation peaks which may be mistaken for a wideband RFI, increasing the number of false alarms and reducing the ability to detect weaker unwanted signals. The presence of the GNSS signals will also distort the shape of the cross-correlation peak from the RFI, increasing the error in the time-delay measurements in a similar way to the effect of multipath, resulting in a less accurate position estimates. The aim of this chapter is to explore the influence that these GNSS satellite cross-correlation peaks have on cross-correlation and how it impacts the detection and time-delay estimation of RFI. To explore the effect of these cross-correlation peaks, GNSS satellite signals generated in software, from live antennas, and from GPS simulators, will be used in different scenarios with synthetically added wideband RFI of different power levels. This chapter is structured as follows: in section 7.2, time-delay estimation using cross-correlation is introduced. In section 7.3, the behaviour of the GNSS signals cross-correlation peaks are explored. In section 7.4, the impact of the cross-correlations on detection over time is explored. In section 7.5, an adaptive detection technique is introduced to overcome some of the issues found in section 7.4. In section 7.6, the behaviour of the detection technique for different baseline lengths is explored. In section 7.7 the effect of the cross-correlations on the estimation of timedelay is explored. A summary and concluding remarks are given in section 7.8. The work in this chapter has been published in the following peer reviewed conference proceeding: 146 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements [11] RJR Thompson, E Cetin, and AG Dempster, "Influence of GPS Satellites Cross-Correlation on the TDOA Measurements within the GNSS Environmental Monitoring System (GEMS)," in IGNSS2011 Symposium on GPS/GNSS, Sydney, 2011. 7.2 Time-delay estimation In the TDOA localization technique the relative time-delays of a signal between a number of spatially separated sensor nodes are used to construct intersecting hyperbolas (for initial simplicity a 2D, constant height system is assumed). In the presence of no noise these hyperbolas will intersect at the location of the source and can be solved using closed form or iterative search algorithms [153]. The received signals of a source s1 at two locations x1 and x2 can be modelled as [110]: x1 (t ) = s1 (t ) + n1 (t ) (7.1) x 2 (t ) = α ⋅ s1 (t + D ) + n 2 (t ) (7.2) where α describes the difference in amplitude of the signal at the two locations, n1 and n2 is uncorrelated white noise, and D is the time-delay of the source signal between the locations x1 and x2. An estimate of the time-delay D between these two signals can be found using an estimate of the cross-correlation function: Rˆ x1 x2 = 1 T −τ T ∫τ x1 (t ) x 2 (t − τ )dτ (7.3) Alternatively the cross-correlation function can be calculated by taking advantage of the Discrete Fourier Transform of the sampled data and using the cross power spectral density: N −1 Rˆ x1x2 (τ ) = ∑ Rx1x2 ( f )e j ( 2πnk / N ) (7.4) k =0 The time-delay estimate Dˆ can then be found by taking the value of τ that maximizes the crosscorrelation function: Dˆ = arg max R x1 x2 (τ ) (7.5) Along with time-delay estimation, the cross-correlation function can also be used for the detection of unknown signals such as the RFI source. If the properties of the background noise at 147 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements each location n1 and n2 are known then the output of the correlation function (7.3) can be modelled. In the presence of an interferer the behaviour of the correlation function will change and monitoring this change can be used for detection. 7.3 GNSS signal cross-correlations In practice any sensor nodes used for detecting and calculating the time-delays of RFI in the L1 band will also pick up the legitimate GNSS signals that are being transmitted in the same band. An overview of some potential sources of signals is shown in Figure 7.1. There are many GNSS satellites from different constellations (GPS, GLONASS, Galileo, Beidou, etc) transmitting civilian and military codes with different frequencies, signal powers, bandwidths, codes, and code repetition rates [182]. The cross-correlation peak from a single satellite common to both sensors nodes with a power of -130dBm will only create a small peak in the cross-correlation function. However there will be many satellites visible at one time so the correlation peaks will add together. As the potential number of GNSS satellites increases [100] the issues explored in this chapter can be expected to get worse. Satellites Pseudolites RFI (node 1) (node 2) Figure 7.1. Possible signals present at two sensor nodes in the L1 band. To explore the behaviour of the GNSS signal cross-correlation peaks, 10ms of GNSS data was generated in MATLAB (including the P-code, but left unencrypted) at two locations. The IF data was generated at a high sampling rate (40.92MHz) and then filtered to the desired pre-correlation bandwidth. The ephemeris used to generate the data included all of the GPS satellites that were transmitting (including the unhealthy satellite) as well as the Satellite Based Augmentation System (SBAS) satellites transmitting on L1 C/A only, and a Quazi-Zenith Satellite System (QZSS) satellite which broadcasts on L1 C/A. The L1C signal on the QZSS satellite was omitted along with any potential Galileo GIOVE satellites. The signal strengths of each satellite were 148 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements modelled using an elevation fit from C/No values extracted from RINEX data from a CORS station. At the locations and times chosen (near the Electrical Engineering building at UNSW, on 11/7/2011 at 13:00) there were 15 satellites visible, 12 GPS satellites, 2 SBAS satellites and a QZSS satellite. In Figure 7.2 and Figure 7.3 the output of 10ms of cross-correlated (downconverted and filtered to baseband) data is shown for two sensor nodes separated by 100m. There are peaks every 1ms due to the code repetition rate of the satellites transmitting the C/A code. Due to the variation in the phase and Doppler of the satellites the distribution of the peaks is not uniform. The large peak near zero-delay will present problems with detection and time-delay estimation if RFI is present and doesn't have a peak large enough to go above the GPS crosscorrelation peaks. In Figure 7.4 and Figure 7.5 the cross-correlation peaks are shown for 10ms of data for two sensor nodes separated by 5km. The greater variation in the phase and Doppler frequencies of the satellites increases the non-uniformity of the peaks that repeat every 1ms compared with the 100m case. In Figure 7.5 the cross-correlation peaks have spread out and the individual peaks from satellites are visible. 5 10 8 |Correlator Output| |Correlator Output| 10 5 x 10 6 4 2 0 8 6 4 2 0 -1 0 Delay (samples) 1 5 x 10 -100 -50 0 50 Delay (samples) 100 x 10 Figure 7.2. 10ms of IF data cross-correlated together for sensor nodes separated by 100m. 149 Figure 7.3. Close-up of the crosscorrelation peak at zero-delay for sensor nodes separated by 100m. Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements 5 5 6 |Correlator Output| |Correlator Output| 6 x 10 4 2 0 -1 0 Delay (samples) 4 2 0 1 5 x 10 Figure 7.4. 10ms of IF data cross-correlated together for sensor nodes separated by 5km. x 10 -400 -200 0 200 Delay (samples) 400 Figure 7.5. Close-up of the crosscorrelation peak at zero-delay for sensor nodes separated by 5km. A civilian GPS receiver typically has a RF front-end with a 2MHz pre-correlation bandwidth [183]. An RF front-end used for localization purposes will typically have a wider bandwidth such as 8MHz for detection and localising wideband or out-of-band RFI and for better time-delay accuracy. For the protection of receivers that use semi-codeless techniques to use encrypted signals an even wider bandwidth greater then 20MHz will be required [24]. In Figure 7.6 and Figure 7.7 the behaviour of the cross-correlation peaks is shown with a 2MHz and 8MHz frontend filter. For the 8MHz filter a significant part of the energy of the P-code is passed resulting in higher and sharper peaks near the zero-delay. However as the code repetition rate of the P-code is practically infinite there is little change in the behaviour of one of the group of side peaks that repeat every 1ms. The peaks in Figure 7.7 are from the C/A code only and increasing the frontend filter bandwidth makes them sharper. Using interference cancellation techniques [184],[185]; it may be possible to remove the crosscorrelation peaks if the GNSS signals can be replicated. This will be computationally intensive and as shown in Figure 7.6 the encrypted P(Y)-code signals will appear in the correlator outputs. With this computational complexity and encrypted signals in mind, the remainder of this work will explore what can be done in terms of detection and time-delay estimation assuming that these GNSS signals are not removed. 150 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements 5 5 8MHz 2MHz 4 |Correlator Output| |Correlator Output| 5 5 x 10 3 2 1 0 4 0 50 Delay (samples) Figure 7.6. View of peaks around zero-delay with different front-end filter bandwidths. 8MHz 2MHz 3 2 1 0 -50 x 10 -1.65 -1.645 -1.64 -1.635 -1.63 4 Delay (samples) x 10 Figure 7.7. View of a side peak with different front-end filter bandwidths. 7.4 Impact on detection The detection of unknown signals using cross-correlation is a commonly used technique in radio astronomy [186]. An RFI or unknown signal of sufficient power will cause a change in the crosscorrelation function from the background noise and this can be used for detection. To investigate the behaviour of the cross-correlation peaks with real hardware a NordNav R30 multi-frontend [187] was used to capture data from real antennas and from two Spirent GPS simulators running in sync. The use of the multi-frontend running off the same frequency reference and sampling clock removes the synchronization problems that occur when using independent frontends. With thermal noise present only the output of the correlation function will have a probability distribution that doesn't change much over time, with slow variations due to changes in temperature and surface brightness. Using the histogram of the correlator output from previous data with no interferer it would be possible to determine a detection threshold with a fixed probability of false alarm that covers all the sample delay bins. However when the GPS signals are present there will be a number of delay bins that are above this threshold due to the satellite signal cross-correlations. To explore the thermal noise only case, 10ms of IF data from two antenna inputs to the multifrontend receiver with no antennas connected was recorded from each and then correlated together at baseband. The behaviour of the correlator in the presence of no GPS signals can be seen in the red line in Figure 7.8. 10ms of IF samples was then recorded from two synchronized GPS simulators running a scenario with 8 visible satellites. The magnitude of the circular 151 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements correlator output is shown by the blue line in Figure 7.8. In Figure 7.9 the histogram is shown of the output of the correlator. In the presence of the GPS signals there are a number of outliers visible which would cause false alarms if a detection threshold was used based on the case of thermal noise only. 4 abs(Correlator Output) 5 x 10 GPS No GPS 4 2500 2000 3 1500 2 1000 1 500 0 GPS No GPS 5 10 Sample delay 0 15 4 0.5 1 1.5 2 2.5 4 x 10 x 10 Figure 7.8. Circular cross-correlation output with and without GPS signals. Figure 7.9. Histogram of the correlator output with and without GPS signals. Another problem that the GPS cross-correlations introduce is that the magnitude of the peaks and sample delay bins they appear in will change over time as the satellites move and different satellites become visible. If the sensor stations used for detection are close together and the signals from the satellites arrive at similar time-delays the cross-correlations from the satellites will overlap. This is demonstrated in Figure 7.10 which shows the output of the cross-correlator around the zero-delay point for two receivers separated by a distance of 100m observed in 10ms intervals over a period of 10 seconds. In the data there are 8 satellites with various phases and Dopplers that are adding and cancelling each other out over time. In Figure 7.11 the magnitude of the correlator output is shown along the 0 delay bin. Without any knowledge of the GPS signals an adaptive threshold technique would be required to keep the number of false alarms low and the detection performance good for this 100m baseline. 152 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements 4 x 10 |Correlator Output| 3 2 1 0 200 Figure 7.10. Output of the correlator near zero-delay for a baseline of 100m over 10 seconds. 400 600 800 Time in file (10ms) Figure 7.11. Output of the correlator along zero-delay for a baseline of 100m. 7.5 Adaptive detection technique To overcome the problems shown in the previous section an adaptive detection threshold is needed. One approach is to use a mean-change detection technique that tries to characterize the behaviour of the cross-correlation peaks in each delay bin over time and look for any sudden unusual changes. An overview of the developed adaptive threshold technique is shown in Figure 7.12. Correlation outputs at sample delay n σ = Examination Cells Guard Cells Test Cell E1 E2 E... EN1 G1 G2 G... GN2 Y ∑ (X −X) 2 i N1 1 X = ∑ Xi N1 Find T and N2 for desired Pfa X σ * Tσ Decision: ± Y > X ±Tσ? T Figure 7.12. Block diagram of the mean change detection algorithm. The algorithm is inspired by Constant False Alarm Rate (CFAR) detection [188] and works by calculating the mean and standard deviation from a window of previous correlator outputs (called examination cells) along a particular sample delay and determines if the correlator value in the current test cell exceeds a threshold. A number of guard cells (outputs before the test cell that are ignored) are chosen to provide some protection against RFI that ramps up over time. Due to the unknown variability of the correlator outputs for different baselines the values of T (σ threshold 153 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements multiplier) and N2 (number of guard cells) need to be tuned beforehand from previous data to provide a low probability of false alarm. For the following analysis of data for different baselines the values of T and N2 were found numerically by searching for values over clean sets of data until the false alarm rate is 0%. As the search over the parameters is 2D, the point in [T,N2] is chosen which has 0 false alarms with the biggest N2 value. 7.6 Behaviour for different baselines 7.6.1 Very small (0.38m) baseline For very small baselines the satellites will all have close relative phases and Doppler frequencies and the correlator output will behave smoothly over time. To explore this scenario real IF data was recorded from two antennas separated by 0.38m connected to the multi-frontend receiver. The IF data was then cross-correlated together in 10ms blocks at baseband over 10 seconds. In Figure 7.13 the cross-correlation peak from the real GPS signals can be seen, along with a wideband (2MHz, J/N=-12.5dB) interferer which was added to the recorded samples offline after 5 seconds at a sample delay of 0. The slow variation in the correlator output can be seen before the RFI is added, allowing a relatively tight 5σ threshold to be used along with 2 seconds of guard cells. 4 x 10 |Correlator Output 4 3 2 1 0 200 400 600 800 Time in file (10ms) 1000 Figure 7.13. Figure 13. Output of the correlator for the 0.38m baseline with RFI added. Figure 7.14. Response of the detection technique, with the outputs breaching the threshold causing a detection. There is a noticeable jump when the RFI is added 5 seconds into the data. {red line: threshold, blue points: test points}. 154 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements The RTCA defines minimum susceptibility requirements for GPS receivers operating in the presence of RFI [146]. The adaptive threshold technique described above was able to meet the required RFI mask for a CW interferer (-120.5dBm) and a wideband interferer (-107.2dBm in a 2MHz bandwidth) when the RFI was added to the recorded data, with the assumption that the thermal noise power at each sensor node was equal to -111dBm. For the detection of RFI the use of two antennas close together such as in an antenna array in AOA [189] can provide a useful option. 7.6.2 Short (100m) baseline. For longer baselines it begins to become impractical to connect multiple antennas to a single front-end. To explore the behaviour of the cross-correlation peaks for longer baselines the multifrontend was connected to two Spirent GPS simulators running in sync to repeat the scenario shown in Figure 7.10. As shown in Figure 7.15 for the 100m baseline, the magnitude of the correlation peak at zero-delay varies much more rapidly in time than for the 0.38m baseline shown in Figure 7.13. To prevent false alarms the threshold T was increased to 8.5σ and the number of guard cells N2 reduced to 65. The same wideband interference source used for the previous baseline was again added 5 seconds into the data files. As can be seen in Figure 7.15 and Figure 7.16 the change in the magnitude of the correlator output is not as large as for the case of the 0.38m baseline and the RFI is not detected. 4 x 10 |Correlator Output 3 2 1 0 -1 Figure 7.15. Output of the correlator for the 100m baseline with RFI added. 0 200 400 600 800 Time in file (10ms) 1000 Figure 7.16. Magnitude of the correlator along zero delay with no obvious crossing of the thresholds when RFI is added {red line: threshold, blue dots: test points}. 155 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements To understand why this occurs it is necessary to look at the real and imaginary parts of the correlator outputs as shown in Figure 7.17 and Figure 7.18. In this case due to the phase of the added RFI at zero-delay, all of RFI power ends up in the real part. This is a consequence of doing the time-delay processing at baseband. The change in the real part of the correlator output is large and is easily detectable by the proposed detection technique when run on the real part of the correlator alone. For robust detection using the correlator output for data that has been converted to baseband the magnitude of the output along with the real and imaginary parts should be processed independently. 4 4 4 x 10 x 10 |Correlator Output |Correlator Output 2 2 0 -2 1 0 -1 -2 0 200 400 600 800 Time in file (10ms) 0 1000 Figure 7.17. The real part of the correlator showing crossing of the detection threshold. 200 400 600 800 Time in file (10ms) 1000 Figure 7.18. The imaginary part of the correlator. {red line: threshold}. {red line: thresholds}. 7.6.3 Moderate (500m) baseline. The previous scenario is repeated for a baseline of 500m. In Figure 7.19 and Figure 7.20 the correlator output is shown. As can be seen in Figure 7.19, the surface of the correlation function before and after RFI is added is not smooth and the location of the peaks varies in magnitude and sample delay. At a baseline of 500m the individual satellites are beginning to resolve in the correlation space and the variations becoming more rapid. To maintain the desired false alarm rate of 0% the threshold T was increased to 11σ and the number of guard cells N2 reduced to 25. This sharp decrease in the number of guard cells is due to the increasingly sinusoidal behaviour of the cross-correlation peak. For this baseline, the detection of interference that ramps up over time becomes difficult as the cross-correlation peaks are beginning to move rapidly with time. 156 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements 4 real(Correlator Output) x 10 6 4 2 0 -2 0 Figure 7.19. Output of the correlator for the 500m baseline with RFI added. 200 400 600 800 Time in file (10ms) 1000 Figure 7.20. The magnitude of the correlator output along zero delay {red line: threshold, blue points: test points}. 7.6.4 Long (5km) baseline. The scenario is again repeated for a baseline of 5km. For this scenario the correlation peaks from individual satellites resolve. In Figure 7.21 individual satellites can be seen at sample delays of 246, -146, and -176. At delays of 7 and 86 there are locations where two satellites which have close time-delays and beating of the correlation peak is visible. Figure 7.21. The correlator output for the 5km baseline. In the magnitude output of the correlator, satellites which do not overlap appear as constant peaks as can be seen in Figure 7.22. The presented detection technique begins to struggle with the rapid 157 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements variations at locations where the cross-correlation peaks appear to be beating. A more advanced detection technique would be required for robust performance in this scenario. In Figure 7.22 the behaviour of the detection technique is shown along a delay (-146) where only one satellite is located. There is no variation in the magnitude of the correlation peak and a tight 4.5σ threshold and 200 guard cells can be used. However after the RFI is added sinusoidal movement can be seen in the correlation peak due to the single satellite interfering with the RFI. In Figure 7.23 the behaviour of the detection technique is shown with a 9σ threshold and 25 guard cells for the satellite cross-correlation peaks which show beating at a delay of 86 samples. 4 4 abs(Correlator Output) abs(Correlator Output) 6 x 10 x 10 4 2 0 -2 0 200 400 600 800 Time in file (10ms) 1000 6 4 2 0 -2 0 200 400 600 800 Time in file (10ms) 1000 Figure 7.22. The magnitude along a delay bin containing on a single satellite with RFI added after 5 seconds Figure 7.23. The magnitude along a delay bin containing two satellites with RFI added after 5 seconds {red line: threshold, blue points: test points}. {red line: threshold, blue points: test points}. The beating of the two satellites in Figure 7.23 shows strong sinusoidal behaviour. In Figure 7.24 the magnitude, real, and imaginary parts of the correlator output are shown for the peak from a single satellite along a delay of -146 in Figure 7.21. The constant magnitude peak is made up of a sine and cosine component in the real and imaginary parts. Through this behaviour it can be reasoned that the cross-correlation of a single satellite at two locations is made up of a sine and cosine wave with a particular phase and frequency. In Figure 7.25 the real part of the correlator output is shown for two satellites beating at a delay of 86. As can be seen in Figure 7.25 a sum of sines fit (2 sines used) is able to fit the beating exactly. Taking advantage of a sum of sines fit to compensate for the beating presents useful future work for detection and time-delay estimation in the presence of the GNSS signals. 158 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements 4 real(Correlator Output) Correlator Output x 10 5000 0 -5000 50 1 0.5 0 -0.5 -1 100 100 150 200 Time in file (10ms) 150 200 250 300 Time in file (10ms) 350 Figure 7.24. The individual components for Figure 7.25. A sum of sines fit used to the single satellite at a delay of -146. model the output at a delay of 86. 7.7 Impact on time-delay estimation Once an interferer is detected it is then necessary to estimate the time-delay so that it can be used in the TDOA positioning algorithm. The GPS cross-correlation peaks will have a number of different effects on time-delay estimation performance. Depending on the phase of the RFI it may add to or cancel out the peaks from the GPS signals. In some cases the correlation function will be heavily distorted as shown in Figure 7.26. Instead of a peak at zero-delay there are three different distinct peaks. The maximum of the correlation function occurs at a delay of 11 samples, not at the true delay of 0 samples. The behaviour of the peaks in this scenario is similar to those found in reverberant room environments where echoes and other spatially correlated noise sources disrupt the time-delay estimation of speakers in a noisy room. In [190] the performance of different time-delay estimators was evaluated in terms of the number of anomalous time-delays, the bias, and the Root-Mean-Square Error (RMSE) in a reverberant environment. For simplicity in this scenario an anomalous time-delay estimate is defined as one where the estimate is more than 3 samples away from the true estimate. For the sampling rate used in the multi-frontend receiver (16.3676 MHz) this equates to a time-delay error of more than 55m. The GPS cross-correlations will also have an effect on the bias and RMSE of the time-delay estimates. The peaks from the GPS crosscorrelations can have a multipath-like effect on the output as is demonstrated in Figure 7.27. The true delay of the added RFI in Figure 7.27 is 0 but has been distorted by 2 samples. 159 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements 4 4 2.5 |Correlator Output| |Correlator Output| 2 x 10 1.5 1 0.5 0 -20 -10 0 10 Delay (samples) 2 1.5 1 0.5 0 -20 20 Figure 7.26. An example of an anomaly error introduced by the GPS crosscorrelations. x 10 -10 0 10 Delay (samples) 20 Figure 7.27. An example of bias introduced by the GPS cross-correlations. To explore the impact of the GPS cross-correlation peaks on time-delay estimation a 2MHz wideband RFI was added to the data files for three different baselines at zero-delay for 15 seconds and processed in 10ms blocks. The wideband RFI was also added to 15 seconds of data recorded with no GPS signals present, representing the scenario if the GNSS signals could be effectively removed. The delay estimate was taken as the maximum of the cross-correlation function. In Figure 7.28 the delay of the maximum in the cross-correlation function is shown for the 200m baseline with the RFI added at different powers. At an effective SNR (SNReff) of -12.5dB (1/SNReff = 1/SNR1+1/SNR2) at each location a number of anomalies can be seen as well as a noticeable bias that shifts over time. During the 15 seconds of data over 25% of the measurements have a time-delay error of more than 55m. For the 100m baseline over 40% of the measurements have a time-delay error of more than 55m. In Figure 7.29 it can be seen that it is not until a J/N of -6.5dB that the anomaly rates begin to approach that of the GPS signal free case. The number of anomalies with no GPS signals present is zero for all the J/N values tested. The bias is also significantly reduced when no GPS signals are present as can be seen in Figure 7.31 and the RMSE is significantly lower for the no GPS signals case as can be seen in Figure 7.30. The degradation in the quality of the time-delay estimates for lower effective SNRs promotes the use of techniques to remove the GPS signals from the correlation function. 160 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements 40 10 Anomalies (%) Peak location (delay) 15 5 0 -5 -12.5dB -9.5dB -6.5dB -10 -15 500 1000 Time in file (10ms) Figure 7.28. Location of the peak in the correlation function over 15 seconds of data for added RFI of different power. 0.6 0.4 0.2 0 -12 -11 -10 -9 J/N (dB) -8 10 -12 -11 -10 -9 J/N (dB) -8 0.8 Bias (samples) RMSE (samples) 0.8 20 -7 Figure 7.29. The number of anomalous time-delay estimates as a function of effective J/N. 500m 200m 100m No GPS 1 30 0 1500 500m 200m 100m No GPS 0.6 0.4 0.2 0 -7 Figure 7.30. RMSE for anomaly free timedelays as a function of effective J/N. 500m 200m 100m No GPS -12 -11 -10 -9 J/N (dB) -8 -7 Figure 7.31. Bias for anomaly free timedelays as a function of effective J/N. 7.8 Summary and concluding remarks. Through experiments with simulated and real data with synthetically added RFI it has been found that the cross-correlation peaks from GNSS signals do impact the effectiveness in detecting and estimating time-delays of interferers in a TDOA localisation system. The increase in the errors of the time-delay estimates due to the GNSS signal cross-correlation peaks will reduce the effective range of a TDOA localisation system that uses these estimates to geo-locate interference sources. Depending on the Geometric Dilution of Precision (GDOP) the errors in the time-delays from a single baseline can add a significant error to the overall position estimate [107]. The number of anomalous time-delay estimates did not begin to approach the GPS signal free case until the effective SNR of the RFI approached a J/N of -6.5dB. Current detection techniques for wideband RFI are able to detect RFI down to a J/N of -16.4dB [72] at each receiver. As a consequence the 161 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements area of detection coverage will be much greater than the area where reliable RFI localisation using TDOA is possible. To ensure localisation coverage matches detection coverage without needing an excessive number of additional baselines, the GNSS signals will need to be removed or mitigated with further processing and this presents interesting future work in this research area. 162 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions 8.1 Introduction An example of the growing reliance on GNSS outside of traditional navigation is time synchronisation. The synchronisation capability provided by GNSS time transfer is being increasingly relied upon in a number of different applications, such as telecommunications and power generation. In telecommunications it is needed to allow for new techniques for increasing uplink and downlink capacity [191]. In power generation it is required to detect and localise faults in smart grids to maintain reliability [192]. In the presence of RFI the time synchronisation provided by GNSS signals will degrade [111]. Time synchronisation is also important for sensor networks that aim to detect and localise interference sources to GPS [15],[114] that use the TDOA technique discussed in this thesis. The quality of the time-delay measurements produced between pairs of sensor nodes using TDOA will degrade in the presence of timing errors which will result in a degraded position estimate [160] of the RFI source. In the presence of GPS jamming in a timing application, one mitigation option is to use a more stable clock, such as an Oven Controlled Crystal Oscillator (OCXO) or atomic clock (such as a 163 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions Rubidium standard), which can provide longer hold-over than the satellite-disciplined Temperature Compensated Crystal Oscillators (TCXOs) typically used in less expensive timing receivers. The drawback to this is the increased cost and power requirements which may not be suitable for use in localisation network with a large number of nodes. Another potential option is to use other signals to provide timing. One demonstrated option in the context of GPS jammer localisation using TDOA is the use of CDMA signals from cellular networks [114]. There is also the potential for frequency diversity in the GNSS bands such as the use of GLONASS signals on either L1 or L2 [100] bands. However, adding the capability to use multiple timing signals results in increased cost and power requirements of a sensor network. A number of jammers available already provide the capability to jam GPS, Wi-Fi, and cellular signals in a single unit hence reducing the effectiveness of adding capability for processing extra signals for timing. Furthermore, testing of civilian GPS jammers also showed that a number already output interference over multiple GNSS bands [193]. As a result, the work in this chapter concentrates on establishing how long GPS timing receivers with relatively inexpensive TXCOs can be reliably used in the presence of jamming before their performance degrades. This work contrasts with that done previously in [111] in that specific attention is given to the rate of change of the random walk nature of the clock drift. With this knowledge an indication of the length of time that TDOA can be performed after the timing receivers are jammed without large position errors is gained. To gain further insight into the timing performance that can be expected in real-time and with post-processing [67] the relative clock drift between two GPS receivers with TCXOs was recorded for a period of time and analysed. Finally the timing performance of a prototype jammer localisation system is analysed from a field-trial [18] where three sensor nodes were placed over an area to localise a real interference source in the GPS band. This chapter is structured as follows: In section 8.2, an introduction to the importance of time synchronisation for the time-delay estimation in TDOA localisation systems is given. In sections 8.3 and 8.4, the performance of a pair of GPS timing receivers is evaluated under ideal conditions and under jamming conditions respectively. In section 8.5, how the GPS satellite signals can be used for time synchronisation is presented as a post-processing technique. In section 8.6, the behaviour of the clock drift between two GPS receivers is analysed to gain insight into the potential holdover performance for timing techniques which rely on receivers with TCXOs. In section 8.7, the performance of timing receivers in the field from a real experiment is then given as well as the improvements that can be gained from applying corrections based on the post164 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions processed timing technique in TDOA localisation. A summary and conclusions are given in section 8.8. Parts of the work described in this chapter have been published in the following journal article conference proceedings: [9] E Cetin, RJR Thompson, and AG Dempster, "Passive Interference Localization within the GNSS Environmental Monitoring System (GEMS) – TDOA Aspects," GPS Solutions, Accepted for publication pending modifications, 2013, Accepted for publication pending modifications. [17] RJR Thompson, E Cetin, and AG Dempster, "Evaluation of Relative GPS Timing Under Jamming Conditions," in International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS 2012), Nashville, 2012. [18] M Trinkle, E Cetin, RJR Thompson, and AG Dempster, "Interference Localisation within the GNSS Environmental Monitoring System (GEMS) - Initial Field Test Results," in Proceedings of the 25th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS 2012), Nashville, 2012. 8.2 Effect of timing errors Due to the drifting nature of oscillators, especially TCXOs, the absolute or universal time at each sensor node will be different. The local time of a clock read at time t can be modelled as [194]: t T (t ) = T0 + ∫ ε (t ) dt t0 (8.1) where T0 is the clock bias or timing offset at universal time t0, and ε(t) is the oscillator’s instantaneous clock drift. The clocks at each sensor node will have different timing offsets and clock drift rates and this will influence the error in the time-delay estimate. The error in the timedelay estimate will depend on how closely each clock is synchronised to the universal time of the sensor network. In the presence of clock offsets, the cross-correlation function will have the following form: 165 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions Rˆ r1r2 = 1 T −τ T ∫τ r1 (t )e − j 2πf1 (t ) r2 (t − τ + ∆t )e − j 2πf 2 (t ) dτ (8.2) where ∆t = T1 − T 2 is the relative clock bias or timing offset between the two sensor nodes, and ∆ f i = ε i (t ) ⋅ f L1 corresponds to the offset in the frequency of each sensor node, and fL1 is the frequency of the signal of interest s(t), which in this case is at GPS L1. If there is a relative frequency offset ∆f1,2=f1-f2 between the sensor nodes greater than 1/T, where T is the integration time, the magnitude of the cross-correlation peak will be greatly reduced [195]. It is possible to overcome the frequency offset by searching for frequency along with timedelay. This is effectively the same as evaluating the complex ambiguity function. The timing offset between the two sensor nodes, ∆t is of greater significance. For example, if there is a 100ns timing offset this will result in a 30m bias in the time-delay estimate. The timedelay estimate will become biased by the value of the timing offset between the sensor nodes: τˆ d + ∆ t = arg max Rˆ r r (τ , f 1 , f 2 ) 1 2 (8.3) The presence of such timing offsets will degrade the localisation solution [160] and also limit the effective range of the system due to Geometric-Dilution-Of-Precision (GDOP) [107]. 8.3 GPS timing receiver evaluation One option to time-synchronise the sensor nodes in a TDOA system is to use GPS timing receivers. In this section the performance of a GPS timing receiver based on SigNav uTevo Timing Micro Modules will be evaluated. These timing receivers provide a 30.72MHz frequency reference and a Pulse Per Second (PPS) which are synchronised to GPS time. To evaluate the performance, an Agilent Universal Frequency Counter/Timer (53130A) was used with the timing boards connected to the same antenna (Zero Baseline) and also to two separate antennas (NorthSouth Baseline). An outline of the experimental setup is shown in Figure 8.1. The North-South Baseline setup refers to two antennas placed 10.78m apart on the roof of the Electrical Engineering building at UNSW. Each pillar uses a high-quality choke-ring antenna. The locations of these antennas have also been surveyed to geodetic accuracy and the North pillar antenna is 166 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions used as part of the SydNET CORS network [196]. The measurements were taken with the timing boards operating in two modes: ‘navigation’ mode where the position is solved along with the receiver clock offset, and ‘hold’ mode [197] where the position is fixed and only the receiver clock offset is solved for. This mode has the advantage that only a single satellite is required to provide a timing solution. South Pillar North Pillar passive splitter uTevo PPS / 30.72MHz Counter switch uTevo PPS / 30.72MHz Figure 8.1. GPS time transfer testing setup. In navigation mode the performance in the timing offset (PPS synchronisation) was similar to what would be expected from GPS L1 C/A positioning. If the relative position error from the timing receivers given in the NMEA messages was equal to 10m then the timing offset was close to 10m. In Figure 8.2 the time-series of the error in the relative position (XYZ) is shown along with the timing offset (PPS). In the PPS line there is a bias which is believed to be caused by the difference in the physical lengths of the paths between each antenna to the timing receivers. The timing receivers have commands that can be used for calibrating for this out. 20 Error (m) 15 10 XYZ PPS 5 0 200 400 600 Time (s) 800 Figure 8.2. The behaviour of the error in the baseline length and the timing offset with the timing receivers operating in navigation mode for the North-South baseline test. 167 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions -8 x 10 Timing Offset (s) 6 4 Zero Baseline North-South Baseline 2 0 -2 200 400 600 Time (s) 800 Figure 8.3. The time-series of the timing offset between the timing receivers for the Zero and North-South baselines in hold mode. The frequency references provided at 30.72MHz were found to be equal to within a standard deviation of 0.04Hz. The standard deviation was similar irrespective of the baseline or the operation mode of the receivers. In the GEMS system [15] the frequency reference is used for down-converting the received RF signals containing the GPS and jammer signals. This equates to a standard deviation of 2.05Hz after down-conversion. This is good enough so that a search in frequency when determining the time-delay should not be required for integration times shorter than 488ms. In Figure 8.3 the time-series of the timing offset is shown when the timing receivers are placed in the hold mode. As can be observed there is less variation over time in comparison to navigation mode which is as expected as only the receiver clock offset needs to be solved for. As shown in Table 8.1 the standard deviation is also lower in hold mode when compared with the navigation mode. Table 8.1. Relative timing synchronisation performance between the timing receivers. Baseline Zero (hold mode) North-South (hold mode) Zero (nav. mode) North-South (nav. mode) Timing Offset (PPS) Mean -13.40ns (-4.02m) Std. dev 1.78ns (0.53m) Frequency reference Std. Dev. 0.04Hz 57.10ns (17.13m) 2.62ns (0.79m) 0.04Hz 3.05ns (-0.92m) 58.07ns (17.42m) 3.08ns (0.92m) 7.43ns (2.23m) 0.04Hz 0.04Hz 168 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions 8.4 Performance of timing receivers under jamming To evaluate the performance of the timing receivers in the presence of jamming, jammer signals from a GSS STR2765 Interference Simulator were combined with the GPS signals from antennas. An overview of the configuration is shown in Figure 8.4. In this setup, care was taken to ensure that the cables connected to each receiver were of the same length after the splitter so that any bias in the timing due to different physical paths was reduced. South Pillar uTevo PPS / 30.72MHz Counter Jammer uTevo PPS / 30.72MHz Figure 8.4. Jammer testing configuration. To explore the timing synchronisation in the presence of total jamming, a CW signal at a power of -50dBm was combined with the GPS signals and turned on and off for different periods of time. At this power level, the receivers lose lock of all satellites instantly and go into a holdover mode. The response of the timing offset and frequency offset between the timing receivers is shown in Figure 8.5 and Figure 8.6. As can be seen from these figures, after jamming the timing and frequency offsets do not drift immediately. After a number of seconds the outputs do start to drift and this is most likely due to short-term stability of the TCXOs used in the timing receivers. However, this length of time is long enough to estimate some time-delays in a TDOA system or to switch to another of timing source without suffering any degradation. The jammer on-off process was repeated a number of times and it was observed that in the worst case the timing offset began to drift 3 seconds after the jammer was turned on and the maximum drift rate observed was 1.2m/s. After the jammer is turned off there is some transient behaviour in the time and frequency offsets as can be seen in Figure 8.5 and Figure 8.6. This occurs when the timing receiver begins using satellites that were lost due to jamming in its timing solution and begins re-disciplining the oscillator. The re-disciplining of the oscillator in finite frequency steps can also be observed in the frequency offsets. During these transient periods the magnitude of the cross-correlation output 169 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions could reduce significantly as the offsets of almost 1.5Hz recorded in the frequency references equates to approximately a 77Hz offset at RF. 1.5 Frequency Offset (Hz) Timing Offset (m) 5 0 -5 Offset Jammer On 40 60 80 100 Time (s) Offset Jammer On 1 0.5 0 -0.5 400 120 Figure 8.5. Response of the timing offset in the PPS outputs between the timing receivers to a jamming signal being turned on and off over time. 600 800 1000 Time (100ms) 1200 Figure 8.6. Response of frequency offset in the 30.72MHz outputs between the timing receivers to a jamming signal being turned on and off over time. 8.4.1 Performance under jammers of different types and power To get an overview of the behaviour of the timing receivers under different jamming conditions the GSS STR2675 Interference Simulator was used to generate jammer signals of different types and powers. As real GPS signals were used, their power levels have been amplified by the Low Noise Amplifier (LNA) at the antenna and attenuated by the cabling and combiner/splitter. There are also losses that affect the signal output from the signal generator as well. In order to calibrate the power of the jammer signals with the noise floor at the input to the timing receivers a spectrum analyser was used. The noise power in a 2MHz bandwidth at GPS L1 at the input to the timing receivers was measured to be -97.6dBm. There was a loss of 10.57dB on the signal from the jammer. The noise power in 2MHz was used as the reference and the power from the signal generator was scaled accordingly. In Figure 8.7 the different jammer power levels and the times when the jammer was turned on and off are shown for testing the response of the timing receivers for the different jammer types. The power levels were varied between -106.97 to -71.97dBm in 5dB steps, with the jammer turned on for 45 seconds, and then turned off for 25 seconds to allow the timing receiver to recover. Although CW type jammers can cause problems with tracking at even low power levels [99] if the CW crosses GPS code spectral lines this was not tested in these tests. In Figure 8.7 and Figure 8.8 only powers of -96.97dBm onwards are shown as at the lower power levels there was typically no effect on the number of satellites being used or the timing and frequency offsets. 170 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions In Figure 8.8 the response of the timing offset to the jammer power levels given in Figure 8.7 for a 2MHz wideband noise signal is shown along with the number of satellites one of the timing receivers was using in its timing solution. The receivers were placed in hold mode during these tests. In hold mode the receiver only requires a single satellite to provide a timing solution and it is expected that it will tolerate more RFI than when operating in navigating mode. During the testing the fall in the number of satellites being used in the navigation solution (from the GSA NMEA message) gave the best indication of the degradation in the timing solution. As the power of the jammer is increased the number of satellites used in the timing solution falls. In Figure 8.9 the C/No response under the jamming is shown for a strong satellite signal. For moderate power levels the receiver is able to reacquire satellites over time. For the jamming event at 400 seconds the receiver momentarily loses almost all satellites and the offset begins to drift quickly. As satellites are reacquired, the offset stops drifting and returns to its nominal value over time. For power levels of -76.97dBm and above, all the satellites are jammed and significant drift is observed. Jammer Power (dBm) -70 Jammer On -80 -90 -100 200 300 400 Time (s) 500 Timing Offset No. of used sats. 20 10 10 0 0 Number of Satellites Timing Offset (m) Figure 8.7. The different power levels used for the jamming signals over time. -10 200 300 400 Time (s) 500 Figure 8.8. The response of the timing offset and the number of satellites used for the 2MHz noise jammer. 171 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions C/No (dB/Hz) 50 40 30 20 200 300 400 Time (s) 500 Figure 8.9. Response of reported C/No for a satellite during the jammer testing. This process was repeated for a number of different jammer types. The response of the timing receivers to the different jammer types for the experiment runs is given in Appendix A. In general, when no satellites can be used, the timing offset begins to drift rapidly. A significant change in the number of satellites can also cause some oscillation in the timing offset. With at least 1 satellite, the drift tends to stop and begins to return to zero. The more satellites that can be used the faster the offset returns to zero. The timing receivers showed differing vulnerability to different jammer types. These results are summarised in Table 8.2 which shows the minimum and maximum number of satellites used by one of the timing receivers over the 45 second jamming period. This demonstrates the ability of the receiver to re-acquire and track satellites after the jammer is turned on. The results in Table 8.2 show that the receivers are most susceptible to AM and FM type interference. At a power level of -81.97dBm, for example, for the CW, SCW, and 2M (2MHz wideband noise) type jammers the receiver is able to begin using a couple of satellites. At this power level for the AM type the receiver is unable to re-acquire any satellites and for the FM type only a single satellite is re-acquired. 172 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions Table 8.2. The minimum/maximum number of satellites used in the timing solution during jamming. Jammer Power -106.97 dBm -101.97 dBm -96.97 dBm -91.97 dBm -86.97 dBm -81.97 dBm -76.97 dBm -71.97 dBm Jammer Type CW SCW AM FM P1 P2 2M 10M 10/10 9/9 10/10 8/9 9/10 10/10 9/9 10/10 10/10 9/9 8/8 8/8 8/10 7/10 9/9 10/10 9/10 8/9 6/6 5/7 9/10 9/10 8/9 10/10 6/8 6/9 6/5 0/6 9/9 9/10 7/8 10/10 1/6 2/6 0/3 0/3 9/9 9/10 4/7 7/9 0/4 0/4 0/0 0/1 9/9 8/9 1/5 3/8 0/3 0/1 0/0 0/0 9/10 5/8 0/1 0/5 0/0 0/0 0/0 0/0 0/9 4/9 0/0 0/3 JAMMER TYPES: SCW: A swept CW with +/- 1MHz sweep around GPS L1 with a sweep repetition rate of 1kHz, similar waveform to what has been seen in many GPS jammers [193]. 2M: Gaussian noise with a bandwidth of 2MHz. 10M: Gaussian noise with a bandwidth of 10MHz. CW: A single tone on GPS L1. AM: An AM signal with a 100kHz modulating frequency and 50% depth rate. FM: FM with a 100kHz modulating frequency and 100kHz deviation. P2: Pulses of CW with a duty cycle of 4ms repeating every 20ms. P1: Pulses of CW with a duty cycle of 200ms repeating every second. 8.5 Post-processed timing synchronisation The use of the timing receivers facilitates the synchronised sampling of data for TDOA processing in real time [15]. An alternative that is not real-time is to record longer sets of data and process them offline [67]. A system for localizing jammers in the GPS band has the advantage in that it will also capture embedded GPS signals which can be processed for timing off-line. The post-processed methodologies track the GPS signals in the data and use the resulting navigation data to determine the time and frequency offsets between sensor nodes. This could be the fallback method if localisation was not possible before the synchronisation given by the timing receivers degraded too much. In a TDOA setup, the location of the sensor nodes is typically known beforehand. As a result it is not necessary to perform the entire GPS navigation process to derive timing. For TDOA the sensor nodes will generally need to be spaced relatively close together so that the jammer signal 173 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions is of high enough effective SNR for time-delay estimation to have a detectable cross-correlation peak. As a result some GPS satellites can be assumed to be visible at the same time at many sensor node locations. This scenario is shown in Figure 8.10. Using the common-view satellite time transfer technique [198] it is possible to determine the time offset ∆ t r 1, r 2 between two sensor nodes r1 and r2 using: ∆tr1, r 2 = (tr1 − τ r1 ) − (tr 2 − τ r 2 ) = (tr1 − tr 2 ) − (τ r1 − τ r 2 ) (8.4) where tr1 and tr2 are the local measured times of arrival for a satellite signal at each sensor node, and τr1 and τr2 is the actual time taken by the satellite signal to reach each sensor node. The value of (tr1 - tr2) can be found in the receiver tracking data by taking the difference of the sample locations of the correlation peak of the same Time-Of-Week (TOW) message. The relationship between the TOW locations and the sample locations are shown in Figure 8.11. The value of (τr1 τr2) which is the time-delay of the satellite signal at the specific TOW can be found using ephemeris data to calculate the range rr1 and rr2 of the satellite signal between the sensor nodes and dividing it by the speed of light: τr1 = rr1/c and τr2 = rr2/c. (Satellite) rr1 rr2 (Node 1) (Node 2) Figure 8.10. Geometry of satellite time-delays between sensor nodes during common-view of a GPS satellite. TOW 1 TOW 2 τr1:1 τr1:2 TOW 3 node 1: TOW 1 τr1:3 TOW 2 TOW node 2: τr2:1 τr2:2 174 τr2:3 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions Figure 8.11. The relationship between the locations of the TOW messages and absolute samples betweens the two sensor nodes. Due to the drifting nature of the oscillators at each sensor node the time offset will not be constant. The clock drift rate can be found by calculating the rate of change between successive time offset measurements: ε r1, r 2 (t ) = d ∆t r1, r 2 dt (8.5) Using the time offsets ∆ t r 1, r 2 the specific samples to be read from the data files that correspond to the same GPS time can be found. With a number of these time offsets ∆ t r 1, r 2 and the corresponding sample offsets s r1, r 2 , a linear model can be used to fit and interpolate over the period of interest: s r1, r 2 (k ) = α + β ⋅ k (8.6) where k is the sample number in the file from node 1, s r1,r 2 (k ) is the sample offset of the node 2 file from the node 1 file at sample k, α is a constant offset between the files and β is the sample drift rate in units of k/k or samples per sample. A linear fit works well over short durations (~15s) but for longer periods where clock drift variations become an issue a polynomial fit may be more appropriate. Since a fit is used, the sample offset may be a non-integer value. In this case the remainder term needs to be corrected in the time-delay for TDOA as well. Depending on the length of the integration time used for estimating the time-delay, the clock drift rate may become significant. For example if the relative clock drift between the two sensor nodes is equal to 100m/s then for a 100ms integration time the clocks would have drifted by 10m. This clock drift needs to be corrected in the time-delay measurements: τˆd corrected = τˆd − t ∫ ε (t )dt t0 175 (8.7) Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions The relative frequency offset, ∆f, of the clocks between the two sensor nodes also needs to be calculated for use in (8.5) to ensure a significant magnitude in the cross-correlation output. This can be calculated from the clock drift rate ε(t) using the following: ∆f1, 2 = ε r1,r 2 (t ) ⋅ f L1 (8.8) where fL1 is the centre frequency of the signal of interest s(t), which in this case is the GPS L1 frequency of 1575.42MHz. To explore the synchronisation of the clock drift between two independent GPS receivers, IF data was recorded from two NordNav front-ends with the setup shown in Figure 8.12. The "Old Multi" and "New Multi" refer to two different models of the NordNav frontends each with 4 RF inputs, with a single input on each being used in this experiment. The sample offset fit for two unsynchronised data sets tracking the same satellite is shown in Figure 8.13. From the fit of the sample offsets the value of α is -8458607.58 samples. The data has a sampling rate of 16.3676MHz so this corresponds to a time offset of 516.78ms. The value of β is equal to a drift rate of 348.37m/s which corresponds to a frequency offset of 1829.41Hz. RF Spirent GSS6560 NordNav Old Multi IF 2-bit Postprocess timing shared clock Spirent GSS6560 RF NordNav New Multi IF 2-bit Figure 8.12. Setup for testing long baseline synchronisation using postprocessing between unsynchronised front-ends. 176 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions 6 Offset to Node 2 (samples) x 10 -8.4575 -8.458 f=α+β·k -8.4585 2 4 6 8 10 Node 1 sample (samples) 12 8 x 10 Figure 8.13. An example of the sample offsets calculated between two unsynchronised IF data sets. To evaluate the performance of this technique the approach was coded in MATLAB based on the software receiver of Borre et al. [130]. A NordNAV multi-frontend was used for sampling IF data along with two Spirent GPS simulators also running off a shared clock. An outline of the test setup is shown in Figure 8.14. A number of different baseline lengths between 50 and 5km were tested. The use of the multi-frontend running off the same clock ensures that the recorded sets of IF data should already be perfectly synchronised. Using the two synchronised GPS simulators allows the testing of variable baseline lengths. In the technique a TOW message was found that was common to the tracking results from both files to find a correlation peak to begin synchronizing the data. After that the sample offset was determined using the corresponding correlation peaks every 500ms and a linear fit using 3 satellites was used to model the drift of the sample offsets over time. The behaviour of the computed offsets for each satellite is shown in Figure 8.15. There is no noticeable drift although there is some variance in the sample offsets for individual satellites. The technique as coded was able to time synchronise to within +/-0.2 samples and frequency synchronise to within +/-1 Hz. This was determined from the values of α and β from the fit, which were not exactly zero as expected. It is expected that these results could be improved by using a more advanced tracking technique for measuring locations of the correlation peaks for the satellite signals. 177 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions RF IF 2-bit Spirent GSS6560 NordNav Multi shared clock Postprocess timing Spirent GSS6560 IF 2-bit RF Offset to Node 2 (samples) Figure 8.14. Setup for testing long baseline synchronisation using postprocessing. Sat 1 2 Sat 2 Sat 3 1 0 -1 2 3 4 5 Node 1 sample (samples) 6 7 8 x 10 Figure 8.15. Sample offsets between two files. To evaluate the performance in the presence of jamming, jammers of different types were then added to the IF data in software. Signals of CW and wideband (WB) noise were added with increasing power. There was no noticeable increase in the variance of the sample offsets until the satellite C/No was below 32dB/Hz. Problems with synchronisation began to occur when tracking errors (equivalent to bit decoding errors) began to occur. 8.6 Clock drift behaviour Under jamming conditions the drift in the time and frequency offsets for both the real-time and post-processed techniques will depend on the stability of the local oscillators at each sensor node. To examine this behaviour the clock drift was measured from two NordNav GPS receivers with TCXOs. The GPS receivers were placed in the same room and used the same antenna. The individual clock drifts for the receivers are shown over an 11 hour period in Figure 8.16 and Figure 8.17. In Figure 8.18 the relative clock drift as recorded between the two GPS receivers is shown. These relative clock drift values correspond to εr1,r2(t) in (8.5). The drift varies between 330-350m/s which correspond to a frequency offset between 1732.96-1837.99Hz at GPS L1. The rate of change is not constant over time although does show some correlation with temperature as 178 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions shown by measurements of the ambient room temperature in Figure 8.19. The 'stuck' behaviour at 25.44°C in the plot is due to a bug in the temperature sensor. The TCXO in one of the timing receivers showed a sharp change in drift rate at certain temperatures. This is typical of some TCXO designs and although that particular TCXO showed such variations, the magnitude of the total drift over the 11 hour period was smaller than the TCXO in the other receiver whose drift correlated more closely with temperature. Clock drift (m/s) Clock drift (m/s) 110 450 445 440 435 100 95 430 4.7 4.8 4.9 5 5.1 GPS Time (s) 5.2 4.7 4.8 5 x 10 Figure 8.16. The clock drift in receiver 1 over time. 4.9 5 5.1 GPS Time (s) 5.2 5 x 10 Figure 8.17. The clock drift in receiver 2 over time. 28 345 Temperature (C) Relative clock drift (m/s) 105 340 335 4.7 4.8 4.9 5 GPS Time (s) 5.1 27 26 25 1 5.2 5 x 10 Figure 8.18. The relative clock drift between the two independent GPS receivers with a shared antenna. 2 3 Time (s) 4 5 4 x 10 Figure 8.19. The ambient temperature recorded next to the two GPS receivers. 8.6.1 Potential TCXO holdover Under jamming conditions a prediction must be made of the clock drift in order to determine the time and frequency offsets. In this work a simple holdover technique of taking the last 10 seconds of clock drift values to create a linear model is used. To examine the best and worst case scenarios for the linear fit of the clock drift values shown in Figure 8.18, the timing error that 179 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions would have accumulated during a GPS outage of 100 seconds was calculated. This was done at every point in time for the 11 hours of relative clock drift recordings and the timing offset calculated by integrating over the error of the fit. Over the 11 hours of data the best and worst cases are shown in Figure 8.20 and Figure 8.21. At some locations the linear fit works well but at other locations it does not. The behaviour of the timing offset over time is shown in Figure 8.22 for the best and worst cases. The maximum drift rate seen was 1m/s which is close to the rate of 1.2m/s that was observed for the timing receivers during testing. In the worst case scenario the timing offset is small for only a number of seconds. It may be possible to extend this period by using more advanced clock prediction techniques such as FiniteImpulse-Response (FIR) and Kalman filtering [199]. With the addition of temperature monitoring, it may also be possible to reduce the variations in the clock drift over time by modelling the effect. For a jammer localisation system with a number of nodes operating continuously over time the potential for modelling the relative clock drifts should be explored and Relative Clock Drift (m/s) Relative Clock Drift (m/s) promotes useful future work. HO Fit 348.2 348 347.8 HO Fit 341 340.5 340 339.5 x 10 4.85984.864.86024.86044.86064.8608 5 GPS Time(s) x 10 Figure 8.20. Best case performance of a linear fit holdover technique during a simulated outage due to jamming. Figure 8.21. Worst case performance of a linear fit holdover technique during a simulated outage due to jamming. 4.792 4.7925 GPS Time(s) 5 0 Timing Offset (m) 4.7915 -5 -10 -15 Best Worst -20 20 40 60 Time (s) 180 80 100 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions Figure 8.22. The resulting timing offset caused by the error in the clock drift fit over the outage period. 8.7 Field trial experiment This evaluation of GPS timing under jamming conditions is motivated by its use to synchronise sensor nodes to perform TDOA localisation of GPS jammers. To explore the localisation performance possible in real-world conditions a field test was undertaken with a working prototype GEMS system in [18]. In this section an evaluation of the timing performance of this set-up is given in more detail. In the field trial, a network of three GEMS nodes was setup in a paddock with an interference source moved to different locations. An overview of the setup is shown in Figure 8.23. Each node consisted of an 8 element circular antenna array with a corresponding 8-channel RF frontend with a FPGA sampling board and GPS timing receiver. The timing receivers are the same type that was evaluated previously and was used to provide a 30.72MHz sampling clock for the ADCs and a PPS to trigger the sampling of IF data at the same time between sensor nodes. The 30.72MHz was also used for mixing in the RF front-end. An overview of the coupling of the timing receiver at each node is shown in Figure 8.24. A wideband interference source was used with a power of 25nW (-76 dBW) in the GPS bandwidth (2MHz). The jammer was moved to different locations and the FPGAs at each node were set to record 133ms of IF data from each antenna element every 30 seconds. Due to network and computational constraints the data was stored and the TDOA processing was performed off-line. Figure 8.23. The field trial experimental setup [18]. Figure 8.24. Sensor node and timing architecture. 181 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions 8.7.1 Real-time synchronisation performance It is possible to examine the timing synchronisation between the sensor nodes used in the field trial setup by applying the post-processing time transfer technique from section 8.5 to the embedded GPS satellite signals in the data blocks recorded by the GEMS nodes for TDOA processing. Again the difference between the observed time-delay of the satellite signals and the expected time-delay of the satellite signals can be used. In this context however it is not necessary to find TOW messages to initially synchronise the correlation peaks that correspond to the sample locations in the data files. Assuming that the sensor network was already operating before any jamming, in the field test the nodes are already time synchronised to the PPS to within a number of nanoseconds. Under jamming conditions the time offset will not drift to the point where the time of transmit for each correlation peak in the data becomes ambiguous for a long period of time. This will occur when the time offset becomes greater than half a millisecond. During the tests detailed in the previous section a maximum drift rate of 1.2m/s was observed after jamming and this corresponds to over 34 hours of time before this ambiguity occurs. After this point of time some additional aiding will be required to overcome this ambiguity or the time-delay estimate could be out by multiples of 1ms. Another concern of using the post-processing is the inability to acquire and track the GPS signals in data blocks in the presence of jamming signals. In this scenario the anti-jam capabilities of the 8 element antenna array of each GEMS node can be used to mitigate the jammer by placing a null in its direction and by placing beams at the GPS satellites to improve the SNR [200]. As this technique is performed in post-processing it is possible to steer beams at each GPS satellite individually. An example of the timing offset observed in a block of GEMS data is shown in Figure 8.25. The difference in the time-delay of the satellite extracted from the tracking data is shown along with the actual time delay calculated using ephemeris data. To evaluate the level of the synchronisation being achieved between the sensor nodes in the field trial the timing offsets were calculated using the post-processed technique for over 60 data blocks taken every 30 seconds. In Figure 8.26 the timing offsets between each sensor node baseline is shown. The standard deviation for each of the baselines was equal to 9m. This is larger than what was found in lab testing under ideal conditions. It was expected that the timing behaviour be similar to what was seen in Figure 8.2. The peak to peak variation in the timing offset in the field 182 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions trial data is over 40m whereas in the bench testing with the North-South Baseline the peak to peak variation was only 12.5m. This may be due to a number of factors such as the use of lowcost patch antennas placed on the ground during the trial, the use of a GPS L1 C/A receiver to survey the locations, or some jitter in the FPGA trigger mechanism when latching onto the PPS. -40 40 ∆tr1,r Timing Offset (m) Time-delay (m) -35 -45 -50 Actual Delay Tracked Delay -55 -60 20 R1,2 R2,3 20 0 -20 40 60 80 100 120 Integration (1ms) 10 Figure 8.25. The difference between the delay of the satellites from the tracking outputs and the true delay. R1,3 20 30 40 Data block (30s) 50 60 Figure 8.26. The timing offset measured between the different sensor node pairs using the GPS satellites in the captured IF data for TDOA processing. 8.7.2 Post-processed timing corrections Along with monitoring the performance of the time synchronisation it is also possible to improve the performance of the TDOA localisation by using the measured time offsets as corrections for the time-delay estimates. In TDOA localisation a number of intersecting hyperbolas are used to determine the source location. The TDOA positioning equation takes the form τ d i, j = (xi − x )2 + ( yi − y )2 c − (x j − x)2 + (y j − y )2 (8.9) c where τdi,j is the time-delay of the signal of interest between sensor nodes i and j, (xi,yi) is the position of sensor node i, and c is the speed of light. Using the non-linear least-squares technique a position estimate can be found from the positioning equations by minimizing the least-squares cost-function ξ : ξ = [d − f (θ)]T C−1[d − f (θ)] (8.10) θˆ = argθ min(ξ ) (8.11) 183 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions where d is the vector of noisy time-delay estimates, f(θ θ) is the system of TDOA positioning equations, C is the covariance matrix of the time-delay estimates, and θ is the vector of parameters to be estimated, in this case the position of the source (x,y). The timing offsets to be used as corrections which are found using the post-processing technique can be applied to the time-delay estimates: (τˆd )corrected = τˆd − ∆t ri ,rj (8.12) where ∆tri,rj is the timing offset between nodes i and j, found using the common-view satellite time transfer technique. For the data blocks taken at interference position 3 as shown in Figure 8.23, the timing offsets for each baseline and the localisation results with and without the timing corrections is shown in Table 8.3. For the first two points the timing synchronisation error in the baselines is small. As a result the position estimates of the TDOA processing are good even without the timing correction. Applying the timing correction based on the post-processing technique actually degrades the position estimates slightly in this case. This is most likely due to the coarseness of the time-delay of the post-processing technique which only estimates the tracked delays to a sample (~10m), whereas the timing receivers are able to perform better than that. For block numbers 2 and 3, larger timing errors are found with the post-processing technique on the 2nd and 3rd baseline. As a result the positioning error increases. Applying the correction is able to significantly improve the positioning result by as much as 26.9m. In Figure 8.29 the improvement in the intersection of the TDOA hyperbolae and the resulting position estimate with the timing correction is shown. Table 8.3. Timing and position error in meters at location 3. Block # 1 2 3 4 RMSE Base-line 1 3.77 -0.98 -0.59 -0.52 1.99 Base-line 2 -0.85 1.94 9.72 -13.51 8.39 Base-line 3 -4.63 2.93 10.32 -12.99 8.34 No fixes 2.74 4.88 10.96 30.51 16.45 With fixes 5.91 5.98 3.88 3.61 4.98 The effect of the timing corrections can also be seen by looking at the behaviour of the correlator 184 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions outputs for each block of data. In Figure 8.27 the correlator outputs are shown for each baseline without timing corrections. It can be seen that there is a noticeable jitter in the locations of the correlation peaks which correspond to the measured errors in the time-delays of the GPS satellites in Table 8.3. The correlation peaks with the corrections added are shown in Figure 8.28. After the corrections the cross-correlation peaks line up closer together. The RMSE positioning error for the data blocks at each location is shown in Table 8.4. For the first three locations applying the timing correction improves the overall RMSE of the position estimates. There is an increase in the error in one of the data blocks at position #4. Applying the timing corrections increased the position error in the last data-block from 4.44m to 13.32m. The reason for this is not known although it might be due to the implementation of the timing correction technique in the software receiver. With a more sophisticated way of determining the code-phases of the satellites the performance is expected to increase. Table 8.4. RMSE with and without timing corrections. Position #1 #2 #3 #4 Mean Position Error (m) Without With Timing Timing Corrections 8.90 7.81 16.45 5.80 185 3.34 2.99 4.97 7.84 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions x 10 Baseline 1 6 Correlator Output Correlator Output x 10 Baseline 2 Baseline 3 4 2 0 4 2 0 -100 0 100 200 Time delay (metres) Figure 8.27. Cross-correlation peaks before correction. Baseline 1 Baseline 2 Baseline 3 6 -100 0 100 Time delay (m) 200 Figure 8.28. Cross-correlation peaks after correction. y (metres) 50 0 -50 -80 -60 -40 -20 x (metres) 0 Figure 8.29. TDOA performance before and after timing corrections for data block 4. {circles: sensor nodes, square: true location, dashed lines: hyperbolae, solid lines: corrected hyperbolae} 8.8 Summary and Conclusions An important application of GNSS is providing synchronised timing between locations and in this work the behaviour of relative GPS timing under jamming conditions was evaluated. In the presence of jamming the timing synchronisation began to degrade between two receivers and were found to be most susceptible to AM and FM type interferences. For a period after jamming of a few seconds, depending on the clock drift of the timing receivers, it is possible to switch to a backup timing source, or to measure a number of time-delays in a TDOA system, for a short time before the degradation becomes significant. It is also possible to perform time synchronisation using a post-processed software technique that characterises the clock drift before the jamming outages occur and it was found that the potential holdover time was limited due to the variable nature of the TCXOs used in the receivers tested. 186 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions The research undertaken in this chapter is motivated by the use of GPS timing receivers in a GPS interference localisation system. In a jammer localisation field trial using a network of sensor nodes synchronised using GPS timing receivers, the timing performance was found to be below what was expected mainly due to the synchronisation errors between the sensor nodes. This could be overcome, however, by post-processing the GPS signals embedded in the data captured for TDOA processing using a software GPS receiver. The use of the embedded GPS signals in the data used for TDOA processing provides an alternative to the timing boards and antenna array at each GEMS node provides strong anti-jam capability. The potential for future work in this area could involve the integration of the antenna array and timing processing for use in real-time and using a more sophisticated way of measuring the time-delays between the satellite signals to improve the post-processed timing performance. 187 Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions 188 Chapter 9 Conclusions and Future Work 9.1 Introduction The aim of the research undertaken in this thesis was to investigate and progress the detection and localisation of RFI to GNSS reference stations. This was motivated by the vulnerability of vital infrastructure to GNSS outages, and the development of the second phase of GEMS, a network of sensors for detecting and localising RFI to GPS in a precise and timely manner. The work in this thesis has led to the following conclusions and possible avenues for future work. 9.2 Summary and Concluding Remarks At the beginning of this thesis two techniques which make use of observables available as part of a standard GNSS receiver operation were investigated for detecting RFI: C/No in Chapter 3 and the AGC in Chapter 4. Both of these techniques have problems which lead to them being noisy measurements, but in this thesis it was shown that variations in the C/No could be removed in stationary receivers by taking the difference of C/No between ground-tracks, and that variations in the AGC due to changes in temperature could be characterised and fit with a simple linear model and removed. The results allow the C/No and AGC to be used for detecting RFI at weaker 189 Chapter 9 Conclusions and Future Work levels at stationary receivers, such as the GNSS reference stations that motivated this work. The AGC technique could detect RFI down to a J/N of -8dB, and for the ∆C/No technique the detection performance changes over time with the satellites orbits, with a worst case detectable J/N of -6.5dB. In order to maintain integrity of GNSS over an area, once RFI is detected it must be localised quickly so that it can be removed. The next part of this thesis explored the localisation of the RFI using different passive source localisation methodologies in Chapter 5. Through an analysis of the DOP metric using typical measurement errors found in the literature, the RSS technique was found to be a suitable candidate, especially for sensor networks with nodes located relatively close together. To verify the conclusions regarding RSS given by the DOP comparison, RSS was investigated in Chapter 6 with a real experiment using Wi-Fi devices and through Monte Carlo simulations at GPS L1 band. It was found that the localisation performance degraded significantly when the heights of the transmitter and receivers were increased from 1.05m to 1.55m, with an increase in position error of 44.17m at the 67th percentile. This was due to the presence of ground reflections within the first Fresnel zone, which are present even in an open outdoor area. For an unknown source such as RFI there is no control over the height of the transmitter, so there is no way to guarantee that the transmitter is near the ground and ground reflections will not cause significant position error. The results from the experiment and simulations with RSS showed that it would not be a robust and reliable method for localising RFI by itself, as some of the position errors were of the order of 100m, while the target accuracy for GEMS II is 10m. As a result, focus shifted to another potential technique, TDOA. In Chapter 7 using real and synthetic data it was found that the GNSS signals present (which are being protected) in the same band as the interferer which are being protected) that would be recorded by sensor nodes in a TDOA system will degrade the detection and time-delay estimation performance. The use of cross-correlation in TDOA can have benefits when used for detection but the presence of the GNSS signals reduced this. The GNSS signals also distorted the cross-correlation peak from the RFI which increases the error in the resultant TDOA position estimate. In the results it was not until the J/N of the RFI was above -6.5dB that the number of anomalous and bias free time-delay estimates begins to approach the GNSS signal free case. This will limit the effectiveness of TDOA for localising weak, but detectable, interferences. 190 Chapter 9 Conclusions and Future Work Another issue with TDOA is that good time and frequency synchronisation is required between the sensor nodes. The most economical method for providing this is from GPS, but in the presence of RFI the quality of GPS degrades. This degradation was investigated in Chapter 8 with GPS timing receivers operating in real time and for a post-processing technique. It was found that after a significant reduction in the number of satellites used by the receivers the synchronisation began to drift. Even so, this drift was found not to become significant until after a couple of seconds, which is enough time to perform a number of time-delay estimates for TDOA or switch to a backup timing. As part of this thesis a field trial of a prototype GEMS II system was performed under the supervision of the Australian Department of Defence. This allowed for the evaluation of the GPS timing receivers and the post-processed timing technique with real RFI as demonstrated in Chapter 8. In the field the performance of the timing receivers was below what was expected but this could be overcome by using the post-processed technique. This was further enhanced by taking advantage of the 8-element antenna array at each GEMS II sensor node to place a null in the direction of the RFI and steer a beam at each satellite to improve the tracking performance. At one of the emitter test locations the use of the post-processing timing corrections was able to improve the mean square error of the position estimates from 16.45m to 4.97m. This thesis was motivated by the detection and localisation of RFI to GNSS using a permanent network of sensors, with the resulting research to be implemented in GEMS II being developed by GPSat Systems. The presented detection techniques using the AGC and ∆C/No are ideal for implementation in stationary receivers, such as the timing receivers which are a key component to GEMS II nodes. Although the RSS localisation methodology looked promising, it was found unable to provide the desired precision and accuracy for GEMS and as a result attention in the thesis shifted to TDOA. Issues related to TDOA were investigated and its capability to localise a real RFI was demonstrated in a field trial with a prototype GEMS II network. The antenna array at each GEMS II node, which was designed to facilitate AOA localisation, provided substantial anti-jam capability and could be used to provide timing for TDOA even in the presence of RFI. 9.3 Future Work The work in this thesis highlighted a number of areas of potential future work which are detailed in this section. 191 Chapter 9 Conclusions and Future Work Concerning the detection of RFI using the C/No there are a number of avenues for future work: • A single multiplier of the standard deviation of previous days C/No values was used to set the detection threshold. This single multiplier is chosen to minimise the number of false alarms over the whole ground-track, but is not ideal because it has to take into account the standard deviation for all of the satellite’s elevations. The detection performance could be improved by finding this multiplier over individual windows of previous C/No values, allowing for a smaller multiplier when the satellite is at higher elevations and the standard deviation is lower. • The detection performance using ∆C/No was not compared with other techniques which use C/No, such as the elevation fit model technique. In this thesis only the standard deviation was compared at different elevations where ∆C/No were found to be superior. A thorough comparison using detection theory techniques such as Receiver Operating Characteristic (ROC) diagrams should further illustrate the benefits of the proposed ∆C/No technique. • The evaluation of ∆C/No was done using C/No data collected at only two locations and over a relatively short time period. At different locations the C/No values may be more or less noisy, depending on the surrounding environment, weather conditions, geomagnetic activity. A long term analysis of the detection performance at different locations and local conditions will provide further insights into the applicability of the ∆C/No technique. • In the recordings of C/No values there were a number of false alarms even though it was assumed no RFI as present. These artefacts appear to be due to multipath or tracking problems and some had distinct properties. An analysis of data over time will facilitate the characterisation of these artefacts so that these false alarms can be ignored when monitoring for RFI. • The comparison of the detection performance between GPS and GLONASS was done when the GLONASS constellation was not yet providing continuous global coverage. This caused a noticeable degradation in the detection performance for GLONASS during certain times of the day, and updating the results with a full constellation should show an improvement. • The analysis of ∆C/No over many days was done using C/No values from commercial GPS receivers. It is assumed that these receivers use a pre-correlation estimate of the noise density, and as a result there are no thorough results for when a post-correlation estimate is used. The post-correlation estimate is more sensitive to narrowband interferers 192 Chapter 9 Conclusions and Future Work and could potentially be used for detecting weaker RFI, promoting its implementation in a real-time receiver so that it can be analysed further. • The analysis in this work concentrated on the standard positioning satellites for GPS and GLONASS. This work could be extended by including analysis of satellites which have different orbit and signal properties, such as SBAS satellites which are geostationary, and Galileo and Beidou satellites with different codes and repetition rates. There is also the potential for C/No values from L2 frequencies to be used which are provided in standard RINEX messages. Concerning the use of the AGC for the detection of RFI there are a number of avenues for future work: • In this work the AGC recordings were taken under ideal weather conditions with very little rainfall. It is possible that weather effects such as rain, thunderstorms, solar activity, may cause noticeable variations in the AGC values. This should be investigated by monitoring the AGC over longer periods of time and under different conditions to further understand and characterize the possible detection performance. • In the measurements taken, the temperature of the antenna was not taken into account. During the experiments the antenna and receiver were located close together, in other setups the receiver and antenna may be located further apart resulting in significant temperature differences. It is also possible that antennas with more complicated designs, with multiple LNAs and filter stages, may have a large temperature gradient which needs to be modelled independently of the receiver. To further gain insight into this, the gain/temperature gradient of the antenna should be investigated. • This work considered the use of the AGC for monitoring RFI outdoors and away from any nearby transmitters. In other environments such as road-side or in a cellular phone there will be unintentional RFI from nearby electrical equipment, internal components and near-field effects of objects on signal propagation. This should be investigated so that the detection performance when used in other locations can be understood. • The presented detection technique used a fixed six sigma threshold. Although the AGC does drift due to temperature the gradient is relatively smooth. It may be possible to detect weaker levels of RFI without the temperature calibration by looking for sudden changes in the AGC. This promotes the use of more advanced detection techniques. 193 Chapter 9 Conclusions and Future Work In this thesis the AGC and ∆C/No detection techniques were investigated independently. Recordings of the AGC and ∆C/No from the same receiver processing the same data will give insights into how the detection performance compares between the two, and by analysing the response of them together it may be possible to detect weaker RFI, and detect in a more robust manner. Concerning the localisation of RFI using RSS there are a number of avenues for future work: • The presence of RSS measurements within the first Fresnel zone can cause a significant increase in the position error as the log-normal model has difficulty dealing with dips in the path-loss. With redundant sensors it may be possible to improve the positioning performance by excluding these noisy measurements if they can be detected. • The log-normal model typically used for RSS has difficulty dealing with the variations due to the ground reflections. It may be beneficial to investigate solving for position using the two-ray model directly, even with the increase in computational complexity and number of unknowns. Concerning the localisation of interferes using TDOA and the reliance on GPS for timing synchronisation there are a number of avenues for future work: • The clock drift of the oscillators in the receivers tested was the limiting factor in synchronisation after GPS was jammed. In measurements of the clock drift there was a strong correlation with temperature. It may be possible to model the clock drift due to temperature changes to increase the hold-over time. • The use of the antenna array in each GEMS II node provides substantial anti-jam capability. This was used with the post-processing time synchronisation technique to improve the position estimate and should be implemented to work in real-time. Concerning the use of cross-correlation for detection and time-delay estimation there are a number of avenues for future work: • The results showed that the presence of the GNSS signals had an impact on the detection and time-delay estimation performance for weak RFI sources. One possibility is to remove the GNSS signals from the quantized samples. Even though encrypted military signals may remain this may improve detection and time-delay estimation performance. • Another possibility to mitigate the effects of the GNSS signals is to model the effect they have on the cross-correlation function in the correlation domain. With knowledge of the 194 Chapter 9 Conclusions and Future Work time-delay, phase, and Doppler frequencies of the satellite signals, it may be possible to predict their effect so that it can be removed without having to modify quantized samples directly. 195 Chapter 9 Conclusions and Future Work 196 Appendix A Response of Timing Receivers to Different Jammer Types and Power Levels This appendix shows the response of the timing receiver setup in chapter 8 to the different RFI types. A.1 Wideband Noise (2MHz) Timing Offset No. of used sats. 20 10 10 0 0 Number of Satellites Timing Offset (m) Wideband noise with a bandwidth of 2MHz. -10 200 300 400 Time (s) 500 Figure A.1. Timing degradation in the presence of a 2MHz Gaussian noise signal. 197 Appendix A Response of Timing Receivers to Different Jammer Types and Power Levels A.2 Wideband Noise (10MHz) Wideband noise with a bandwidth of 10MHz. At the same power levels as the 2MHz noise the 10MHz noise causes a lower number of satellites to be lost as the power of the jammer signal is 10 10 0 0 -10 Timing Offset Tracked Satellites Number of Satellites Timing Offset (m) spread over a larger bandwidth. -20 200 300 400 Time (s) 500 Figure A.2. Timing degradation in the presence of a 10MHz Gaussian noise signal. A.3 Swept CW (2MHz) A swept single tone with a repetition rate of 1ms and an effective bandwidth of 2MHz. The spectral properties are similar to what was found for civilian GPS jammers [48]. The effect on the 10 10 0 0 -10 Timing Offset Tracked Satellites -20 200 300 400 Time (s) Number of Satellites Timing Offset (m) timing receiver is similar to that of the 2MHz noise. 500 Figure A.3. Timing degradation in the presence of a 2MHz swept CW. A.4 CW on L1 A single continuous tone on L1. 198 10 10 0 0 -10 Timing Offset Tracked Satellites -20 200 300 400 Time (s) Number of Satellites Response of Timing Receivers to Different Jammer Types and Power Levels Timing Offset (Hz) Appendix A 500 Figure A.4. Timing degradation in the presence of a CW on L1. A.5 AM An AM signal with 100kHz separated side-lobes with a deviation rate of 50%. The AM signal is 10 10 0 0 -10 Timing Offset Tracked Satellites -20 200 300 400 Time (s) Number of Satellites Timing Offset (m) more detrimental than the other RFI types. 500 Figure A.5. Timing degradation in the presence of an AM signal. A.6 FM FM with a 100kHz modulating frequency and 100kHz deviation. During this experiment run at the 4th jammer power tested the timing offset drifts rapidly. This was the steepest observed over all of the experiments and represents a worst case scenario where the disciplining of the oscillator before the GPS outage does not appear to match the oscillators drift that well. 199 10 10 0 0 Timing Offset Tracked Satellites -10 Number of Satellites Response of Timing Receivers to Different Jammer Types and Power Levels Timing Offset (m) Appendix A -20 200 300 400 Time (s) 500 Figure A.6. Timing degradation in the presence of a FM signal. A.7 Pulsed Type 1 (4ms duty cycle every 20ms) 10 10 0 0 -10 Timing Offset Tracked Satellites -20 200 300 400 Time (s) Number of Satellites Timing Offset (m) A pulse RFI with a duty cycle of 4ms repeating every 20ms. 500 Figure A.7. Timing degradation in the presence of a pulse signal. A.8 Pulsed Type 2 (200ms every 1 second) A pulse RFI with a duty cycle of 200ms repeating every second. Although over 1 second the amount of power is the same as the pulse RFI with the 4ms/20ms duty cycle the number of satellites is reduced. The timing receiver is more vulnerable to pulse RFI with a short repetition rate. 200 10 10 0 0 -10 Timing Offset Tracked Satellites Number of Satellites Response of Timing Receivers to Different Jammer Types and Power Levels Timing Offset (m) Appendix A -20 200 300 400 Time (s) 500 Figure A.8. Timing degradation in the presence of a pulse signal 201 Appendix A Response of Timing Receivers to Different Jammer Types and Power Levels 202 References [1] OL de Weck, D Roos, and CL Magee, Engineering Systems: Meeting Human Need in a Complex Technological World, 2nd ed. Cambridge, MA: MIT Press, 2011. [2] C Adradosa, I Girardb, J Gendnerc, and G Janeaua, "Global Positioning System (GPS) location accuracy improvement due to Selective Availability removal," Comptes Rendus Biologies, vol. 325, no. 2, pp. 165–170, 2002. [3] J Carrol and et al, "Vulnerability assessment of the transportation infrastructure relying on the global positioning system," Volpe National Transportation Systems Center, August, Report for US Department of Transportation 2001. [4] JR Clynch et al., "Multiple GPS RFI Sources in a Small California Harbor," in Proceedings of the 15th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS 2002), Portland, OR, 2002, pp. 605 - 612. [5] J Carroll and K Montgomery, "Global positioning system timing criticality assessment preliminary performance," in Proc. 40th Annual Precise Time and Time Interval (PTTI), Dec., 2008, pp. 485-505. [6] AT Balaei, B Motella, and AG Dempster, "GPS interference detected in Sydney-Australia," in IGNSS Society 2007 Symposium Proceedings, Sydney, Australia, 2007. [7] S Pullen and G Gao, "GNSS jamming in the name of privacy," Inside GNSS, vol. 7, pp. 3443, March/April 2012. [8] L Viðarsson, S Pullen, G Green, and P Enge, "Satellite Autonomous Integrity Monitoring and its Role in Enhancing User Performance," in Proceedings of the 14th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS 2001), Salt Late City, 2001, pp. 690-702. [9] E Cetin, RJR Thompson, and AG Dempster, "Passive Interference Localization within the GNSS Environmental Monitoring System (GEMS) – TDOA Aspects," GPS Solutions, Accepted for publication pending modifications, 2013, Accepted for publication pending 203 References modifications. [10] RJR Thompson, E Cetin, and AG, Dempster, "Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control," in IGNSS Society 2011 Symposium Proceedings, Sydney, 2011. [11] RJR Thompson, E Cetin, and AG Dempster, "Influence of GPS Satellites Cross-Correlation on the TDOA Measurements within the GNSS Environmental Monitoring System (GEMS)," in IGNSS Society 2011 Symposium Proceedings, Sydney, 2011. [12] RJR Thompson, AT Balaei, and AG Dempster, "Dilution of precision for GNSS interference localisation systems," in Proceedings of the European Navigation Conference (ENC/GNSS), Naples, 2009. [13] RJR Thompson, A Tabatabaei Balaei, and AG Dempster, "Outdoor localization of a WiFi source with unknown transmission power," in in IGNSS Society 2009 Symposium Proceedings, Gold Coast, Australia, 2009, pp. CD-ROM procs. [14] RJR Thompson, J Wu, AT Balaei, and AG Dempster, "Detection of RF interference to GPS using day-to-day C/No differences," in Proceedings of the 2010 International Symposium on GPS/GNSS, Taipei, Taiwan, October, 2010. [15] E Cetin, RJR Thompson, and AG Dempster, "Interference Localisation within the GNSS Environmental Monitoring System (GEMS)," in IGNSS2011 Symposium on GPS/GNSS, Sydney, Australia, 2011. [16] RJR Thompson, E Cetin, and AG Dempster, "Unknown source localization using RSS in open areas in the presence of ground reflections," in Position Location and Navigation Symposium (PLANS), 2012 IEEE/ION, Myrtle Beach, South Carolina, 2012, pp. 10181027. [17] RJR Thompson, E Cetin, and AG Dempster, "Evaluation of Relative GPS Timing Under Jamming Conditions," in International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS 2012), Nashville, 2012. [18] M Trinkle, E Cetin, RJR Thompson, and AG Dempster, "Interference Localisation within 204 References the GNSS Environmental Monitoring System (GEMS) - Initial Field Test Results," in Proceedings of the 25th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS 2012), Nashville, 2012. [19] E Kaplan, Understanding GPS: Principles and Applications.: Artech House, 1996. [20] Qiang Liu, Huapu Lu, Hongliang Zhang, and Bo Zou, "Research and Design of Intelligent Vehicle Monitoring System Based on GPS/GSM," in ITS Telecommunications Proceedings, 2006 6th International Conference on, 2006, pp. 1267-1270. [21] CM Ho, AJ Mannucci, UJ Lindqwister, X Pi, and BT Tsurutani, "Global Ionosphere Perturbations Monitored by the Worldwide GPS Network," Geophys. Res. Lett., vol. 23, 1996. [22] GPS ICD, "Navstar GPS Space Segment/Navigation User Interfaces, Interface Specification," IS-GPS-200E, 2010. [23] GLONASS ICD, "Global Navigation Satellite System GLONASS Interface," Moscow, Version 5.0, 2002. [24] KT Woo, "Optimum semi-codeless carrier phase tracking of L2," NAVIGATION, vol. 42, no. 2, pp. 82-99, 2000. [25] A Dempster, "How Vulnerable is GPS?," Position, vol. 20, pp. 64-67, December 2005. [26] J B Y Tsui, Fundamentals of global positioning system receivers.: Wiley Publishing, 2000. [27] AW Moore and RE Neilan, "The International GPS Service trackingnetwork: Enabling diverse studies and projects through international cooperation," Journal of Geodynamics, vol. 40, no. 4-5, pp. 461-469, November-December 2005. [28] IGS Central Bureau. (2010, May) The IGS Tracking Network. [Online]. HYPERLINK "http://igscb.jpl.nasa.gov/network/complete.html" http://igscb.jpl.nasa.gov/network/complete.html [29] GK Crosby et al., "A Ground-based Regional Augmentation System (GRAS) - The Australian Proposal," in Proceedings of the 13th International Technical Meeting of the 205 References Satellite Division of The Institute of Navigation (ION GPS 2000), vol. 49, Salt Lake City, 2000, pp. 19-25. [30] K Crabtree, "Honeywell Provides Satellite Precision Landing System for Qantas A380 Landing at Sydney Airport," Amsterdam, Honeywell News Release 2009. [31] A Pinker and C Smith, "Vulnerability of the GPS Signal to Jamming," GPS Solutions, vol. 3, no. 2, October 1999. [32] JR Clynch et al., "The Hunt for RFI: Unjamming a Coast Harbor," GPS World, vol. 14, no. 1, pp. 16-23, 2003. [33] A Grant, P Williams, N Ward, and S Basker, "GPS jamming and the impact on maritime navigation," Journal of Navigation, vol. 62, no. 2, pp. 173-187, 2009. [34] J Merrill, "U. S. Interference Detection & Mitigation Plan (IDM)," in 51st Meeting of the Civil GPS Service Interface Committee at the Institute of Navigation Conference (GNSS 2011), 2011. [35] J Carrol and K Montgomery, "Global Positioning System Timing Criticality Assessment Preliminary Performance Results," in 40th Annual Precise Time and Time Interval (PTTI) Meeting, 2008. [36] T Celano, K Carroll, C Biggs, and M Lombardi, "Common-View LORAN-C As A Backup To GPS For Precise Time Recovery," in 35th Annual Precise Time and Time Interval (PTTI) Meeting, 2004. [37] A Cameron, "Administration Ax Falls on PNT Backup, Loran-C," GPS World, 2009. [38] G Gerten, "Protecting the global positioning system," IEEE Aerosp. Electron. Syst. Mag., vol. 20, no. 11, 2005. [39] Anonymous, "Low Cost and Portable GPS Jammer," Phrack Magazine, no. 60, 2002. [40] Anonymous. (2013, March) Jammer Store. [Online]. HYPERLINK "http://www.jammerstore.com" http://www.jammer-store.com 206 References [41] AT Balaei, "Detection, characterization and mitigation of interference in receivers for global navigation satellite systems," University of New South Wales, PhD Thesis 2007. [42] DO-245, "Minimum Aviation System Performance Standards for Local Area Augmentation System (LAAS)," RTCA, Washington, D.C., WG-4A SC-159, 1998. [43] M Powe and JIR Owen, "GNSS Frequency Protection Requirements," EUROCONTROL, EEC Technical/Scientific Report No. 1999-013 EEC Report 337, 1999. [44] Filing of the National Space-Based Positioning Navigation and Timing Executive Committee (EXCOMM), "LightSquared System Test Results," 2011. [45] GX Gao, "DME/TACAN Interference and its Mitigation in L5/E5 Bands," in ION Institute of Navigation Global Navigation Satellite Systems Conference, Fort Worth, TX, USA, 2007. [46] AT Balaei, B Motella, and AG Dempster, "GPS interference detected in Sydney Australia," in IGNSS Society 2007 Symposium Proceedings, Sydney, 2007. [47] B Motella, M Pini, and F Dovis, "Investigation on the effect of strong out-of-band signals on global navigation satellite systems receivers," GPS Solutions, vol. 12, no. 2. [48] RH Mitch et al., "Signal Characteristics of Civil GPS Jammers," in ION GNSS, 2011. [49] TE Humphrey, BM Ledvina, ML Psiaki, BW O’Hanlon, and PM Kintner Jr., "Assessing the Spoofing Threat: Development of a Portable GPS Civilian Spoofer," in Proceedings of the Institute of Navigation GNSS Conference, Savannah, GA, 2008. [50] JT Didymus. (2011, December) U.S. drone captured by hacking into GPS, says Iranian engineer. [Online]. HYPERLINK "http://www.digitaljournal.com/article/316253" http://www.digitaljournal.com/article/316253 [51] J Roberts. (2012, June) EXCLUSIVE: Drones vulnerable to terrorist hijacking, researchers say. News Article. [Online]. HYPERLINK "http://www.foxnews.com/tech/2012/06/25/drones-vulnerable-to-terrorist-hijackingresearchers-say/" http://www.foxnews.com/tech/2012/06/25/drones-vulnerable-to- terrorist-hijacking-researchers-say/ 207 References [52] CJ Hegarty, D Bobyn, J Grabowski, and AJ Van Dierendonck, "An Overview of the Effects of Out-of-band Interference on GNSS Receivers," in roceedings of the 24th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS 2011), Portland, 2011, pp. 1941-1956. [53] SiGe Semiconductor Inc, "SE4150L GPS Receiver IC Datasheet," 2009. [54] B Parkinson, Global Positioning System: Theory and Applications, Volume II., 1996. [55] AT Balaei, D Akos, and AG Dempster, "Quantization degradation of GNSS signal quality in the presence of CW RFI," in 10th International Symposium on Spread Spectrum Techniques and Applications, September, 2008, pp. 42-47. [56] JW Betz, "Effect of partial-band interference on receiver estimation of C/N0: Theory," in Proceedings of ION National Technical Meeting, Long Beach, CA, 2001, pp. 817-828. [57] AT Balaei, AG Dempster, and J Barnes, "A Novel Approach in Detection and Characterization of CW Interference of GPS Signal Using Receiver Estimation of C/No," in IEEE/ION Position, Location, And Navigation Symposium, 2006, pp. 1120-1126. [58] JL Shewfelt, R Nishikawa, C Norman, and GF Cox, "Enhanced Sensitivity for Acquisition in Weak Signal Environments Through the Use of Extended Dwell Times," in Proceedings of the 14th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS 2001), Salt Lake City, 2001. [59] A Soloviev and TJ Dickman, "Deeply integrated GPS for indoor navigation," in Indoor Positioning and Indoor Navigation (IPIN), 2010 International Conference on, 2010. [60] N Luo, G Xie, D Akos, S Pullen, and P Enge, "Radio Frequency Interference Validation Testing for LAAS Using the Stanford Integrity Monitor Testbed," in 2003 ION National Technical Meeting, Anaheim, Jan 2003. [61] MS Braasch and AJ Van Dierendonck, "GPS Receiver Architectures And Measurements," Proceedings of the IEEE, vol. 87, no. 1, pp. 48-64, Jan 1999. [62] C Curry, "GAARDIAN Project Results and Introduction to The SENTINEL Project," in 208 References GNSS Interference, Detection, and Monitoring Conference, 2011. [63] F Butsch, "A Concept for GNSS Interfence Monitoring," in Proceedings of the 12th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS 1999), 1999. [64] F Bastide, D Akos, C Macabiau, and B Roturier, "Automatic gain control (AGC) as an interference assessment tool," in Proceedings of the 16th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS/GNSS 2003), Portland, 2003, pp. 2042-2053. [65] A Ndili and P Enge, "GPS receiver autonomous interference detection," in Position Location and Navigation Symposium, IEEE 1998, 1998, pp. 123-130. [66] H Borowski, O Isoz, S Lo, F Eklöf, and D Akos, "Detecting false signals with automatic gain control," GPS World, vol. 23, no. 4, pp. 38-43, 2012. [67] O Isoz and D Akos, "Development of a deployable low cost interference detection and localization system for the GNSS L1/E1 band," in n Satellite Navigation Technologies and European Workshop on GNSS Signals and Signal Processing (NAVITEC), 2010, 2010. [68] CC Sun and SS Jan, "Interference Characteristics for the Civil Airport Environment using Time-Frequency Analysis," in Position Location and Navigation Symposium (PLANS), 2012 IEEE/ION, Myrtle Beach, 2012, pp. 347-354. [69] LM Marti and F van Graas, "Interference Detection by Means of the Software Defined Radio," in Proceedings of the 17th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS 2004), 2004, pp. 99-109. [70] AT Balaei and AG Dempster, "A statistical inference technique for GPS interference detection," Aerospace and Electronic Systems, IEEE Transactions on, vol. 45, no. 4, pp. 1499-1511, 2009. [71] A Tani and Fantacci, "Performance Evaluation of a Precorrelation Interference Detection Algorithm for the GNSS Based on Nonparametrical Spectral Estimation," IEEE Systems Journal, vol. 2, no. 1, pp. 20-26, March 2008. 209 References [72] LM Marti, "Global Positioning System Interference and Satellite Anomalous Event Monitor.," Ohio University, PhD Thesis 2004. [73] PJ Mumford, AT Balaei, and AG Dempster, "UNSW GNSS Interference Detection Device," in IGNSS Society 2007 Symposium Proceedings, Sydney, 2007. [74] N Weston et al., "A near real-time GPS interference detection system in the United States using the national CORS network," in Proceedings of FIG Congress, Sydney, 2010. [75] O Isoz, "Detection and localization of wide band interference in the global positioning system L1 band using cross correlation techniques," Master's Thesis 2009. [76] RE Phelts, DM Akos, and P Enge, "Robust Signal Quality Monitoring and Detection of Evil Waveforms," in Proceedings of the 13th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS 2000), 2000, pp. 1180-1190. [77] F Bastide, E Chatre, and C Macabiau, "GPS Interference Detection and Identification Using Multicorrelator Receivers," in ION GPS, Salt Lake City, 2001, pp. 872-881. [78] M Trinkle and DA Gray, "GPS Interference Mitigation; Overview and experimental Results," in SatNav 2001, 2001. [79] MM Casbona and MW and Rosen, "Discussion of GPS Anti-Jam Technology," GPS Solutions, vol. 2, no. 3, pp. 18-23, 1999. [80] JM Tranquilla, "Analysis of a choke ring groundplane for multipath control in Global Positioning System (GPS) applications," IEEE Transactions on Antennas and Propagation, vol. 42, no. 7, p. 905, 1994. [81] CW Rhodes, "Interference to digital broadband communications and spread spectrum communications," IEEE Transactions on Consumer Electronics, vol. 58, no. 1, pp. 15-22, February 2012. [82] Filing of the National Space-Based Positioning Navigation and Timing Executive Committee (EXCOMM), "LightSquared System Test Results," July 6, 2011. 210 References [83] Z Fu, J Hornbostel, and A Konovaltsev, "Suppression of Multipath and Jamming Signals by Digital Beamforming for GPS/Galileo applications," GPS Solutions, vol. 6, no. 4, pp. 257-264, 2003. [84] MD Zoltowski and AS Gecan, "Advanced adaptive null steering concepts for GPS," in Military Communications Conference, 1995. MILCOM '95, Conference Record, IEEE, 1995, pp. 1214-1218. [85] R Pengelley, "GPS anti-jamming protector produced for military vehicles," Jane's International Defence Review, vol. 44, no. 16, July 2011. [86] PW Ward, "RFI Situational Awareness in GNSS Receivers: Design Techniques and Advantages," in Proceedings of the 63rd Annual Meeting of The Institute of Navigation, vol. April, Cambridge, MA, 2007, pp. 189-197. [87] CJ Hegarty, AJ Van Dierendonck, D Bobyn, M Tran, and J Grabowski, "Suppression of Pulsed Interference through Blanking," in Proceedings of the IAIN World Congress and the 56th Annual Meeting of The Institute of Navigation, 2000, pp. 399-408. [88] MA Soderstrand, TG Johnson, RH Strandberg, HH Loomis, and KV Rangarao, "Suppression of Multiple Narrow-band Interference using Real-time Adaptive Notch Filters," IEEE Transactions on Circuits and Systems II: Analog and Digital Signal Processing, vol. 44, no. 3, pp. 217-225, March 1997. [89] G Giordanengo, "Impact of Notch Filtering on Tracking Loops for GNSS Applications," University of Calgary, Master's Thesis 2009. [90] F Dovis and L Musumeci, "Use of Wavelet Transform for interference mitigation," in Proceedings of the International Conference on Localization and GNSS (ICL-GNSS), Tampere, Finland, 2011, pp. 116-121. [91] T Kraus, R Bauernfeind, and B Eissfeller, "Survey of In-Car Jammers - Analysis and Modeling of the RF Signals and IF Samples (Suitable for Active Signal Cancelation)," in Proceedings of the 24th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS 2011), 2011, pp. 430-435. 211 References [92] D Karunanayake, ME Cannon, G Lachapelle, and G Cox, "Evaluation of AGPS in Weak Signal Environments Using a Hardware Simulator," in Proceedings of The Institute of Navigation GNSS 2004, 2004. [93] M Lashley, DM Bevly, and JY Hung, "Performance Analysis of Vector Tracking Algorithms for Weak GPS Signals in High Dynamics," Selected Topics in Signal Processing, IEEE Journal of, vol. 3, no. 4, pp. 661-673, August 2009. [94] T Lin et al., "Interference Suppression for High Precision Navigation Using Vector-Based GNSS software Receivers," in Proceedings of the 24th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS 2011), Portland, 2011, pp. 372-383. [95] J Przyjemski, E Balboni, J Dowdle, and B Holsapple, "GPS Anti-Jam Enhancements Techniques," in Proc ION 49th Annual Meeting, Cambridge, 1993, pp. 41-50. [96] K Shanmugam, "Improving GPS L1 C/A Code Correlation Properties Using a Novel Multicorrelator Differential Detection Technique," in Proceedings of the 19th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS 2006), Fort Worth, 2006, pp. 2453-2464. [97] EP Glennon and AG Dempster, "Delayed PIC for Postcorrelation Mitigation of Continuous Wave and Multiple Access Interference in GPS Receivers," IEEE Transactions on Aerospace and Electronic Systems, vol. 47, October 2011. [98] S Hewitson and J Wang, "GNSS receiver autonomous integrity monitoring (RAIM) performance analysis," GPS Solutions, vol. 10, no. 3, pp. 155-170, 2006. [99] AT Balaei and B Motella, "A preventative approach to mitigating CW interference in GPS receivers," GPS Solutions, vol. 12, no. 3, 2008. [100] C Rizos, "Multi-constellation GNSS/RNSS from the perspective of high accuracy users in Australia," Journal of Spatial Science, vol. 53, no. 2, pp. 29-63, 2008. [101] Y Li, P Mumford, and C Rizos, "Seamless Navigation Through GPS Outages – A Low-cost GPS/INS Solution," Inside GNSS, pp. 39-45, July/August 2008. 212 References [102] EJ Ohlmeyer, "Analysis of an Ultra-Tightly Coupled GPS/INS System in Jamming," in Position, Location, And Navigation Symposium, 2006 IEEE/ION, San Diego, 2006, pp. 4453. [103] MA Lombardi, "Comparing LORAN Timing Capability to Industrial Requirements," in The 2006 International Loran Association (ILA) Meeting, 2006. [104] MA Lombardi, "The Use of GPS Disciplined Oscillators as Primary Frequency Standards for Calibration and Metrology Laboratories," The Journal of Measurement Science, 2008. [105] K Simonsen, "LOCO GPSI: preserve the GPS advantage for defense and security," IEEE Aerospace and Electronic Systems Magazine, vol. 19, no. 12, 2004. [106] AG Dempster, "Dilution of precision in angle-of-arrival positioning systems," Electronic Letters, vol. 42, no. 5, 2006. [107] SM Kay, Fundamentals of Statistical Signal Processing: Estimation Theory.: Prentice Hall, 1993. [108] M Trinkle and DA Gray, "Adaptive Antenna Arrays for GPS Interference Localisation," in International Symposium on Satellite Navigation Technology., 2001. [109] DJ Torrieri, "Statistical theory of passive location systems," Aerospace and Electronic Systems, IEEE Transactions on, vol. 20, no. 2, pp. 183-198, March 1984. [110] C Knapp and G Carter, "The generalized correlation method for estimation of time delay," Acoustics, Speech and Signal Processing, IEEE Transactions on, vol. 24, no. 4, pp. 320327, 1976. [111] FA Khan, "Behavior of the GPS Timing Receivers in the Presence of Interference," in Proceedings of the 20th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS 2007), Fort Worth, 2007, pp. 1977-1982. [112] J Barnes, C Rizos, M Kanli, and A Pahwa, "High accuracy positioning using Locata’s next generation technology," in Proceedings of the 18th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS 2005), Long Beach, 2005, pp. 213 References 2049-2056. [113] KG Gromov, D Akos, S Pullen, P Enge, and B Parkinson, "GIDL: Generalized interference detection and localization system," in Proceedings of the 13th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS 2000), Salt Lake City, 2000, pp. 447-457. [114] J Bhatti, T Humphreys, and B Ledvina, "Development and Demonstration of a TDOA/FDOA-based GNSS Interference Signal Localization System," in Position Location and Navigation Symposium (PLANS), 2012 IEEE/ION, 2012. [115] RA Malaney, "Nuisance Parameters and Location Accuracy in Log-Normal Fading Models," Wireless Communications, IEEE Transactions on, pp. 937-947, 2007. [116] MJ Feuerstein, KL Blackard, TS Rappaport, SY Seidel, and HH Xia, "Path loss, delay spread, and outage models as functions of antenna height for microcellular system design," Vehicular Technology, IEEE Transactions on, vol. 43, no. 3, pp. 487-498, August 1994. [117] J Lindström, DM Akos, O Isoz, and M Junered, "GNSS Interference Detection and Localization using a Network of Low Cost Front-End Modules," in Proceedings of the 20th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS 2007), Fort Worth, 2007, pp. 1165-1172. [118] L Scott, "Fast Jammer Detection And Location Using Cell-Phone Crowd-Sourcings," GPS World, vol. 21, no. 11, 2010. [119] A Brown, D Reynolds, D Roberts, and S Serie, "Jammer and Interference Location SystemDesign and Initial Test Results," in Proceedings of the ION GPS-99, 1999. [120] PJ Mumford, AT Balaei, and AG Dempster, "UNSW GNSS Interference Detection Device," in IGNSS Society 2007 Symposium Proceedings, Sydney, 2007. [121] RJR Thompson, E Cetin, and AG Dempster, "Detection and Jammer-to-Noise Ratio Estimation of Interferers using the Automatic Gain Control," in IGNSS2011 Symposium on GPS/GNSS, Proceedings of, Sydney, Australia, 2011. 214 References [122] M Luo, G Xie, D Akos, S Pullen, and P Enge, "Radio Frequency Interference Validation Testing for LAAS using the Stanford Integrity Monitor Testbed," in Proceedings of the Institute of Navigation National Technical Meeting, Anaheim, CA, 2003. [123] MS Sharawi, DM Akos, and DN Aloi, "GPS C/No estimation in the presence of interference and limited quantization levels," Aerospace and Electronic Systems, IEEE Transactions on, vol. 43, pp. 227-238, 2007. [124] A Simsky et al., "First Field Experience with L5 Signals: DME Interference Reality Check," in Proceedings of the 22nd International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS 2009), Savannah, GA, 2009, pp. 29-37. [125] JW Betz and DB Goldstein, "Candidate Designs for an Additional Civil Signal in GPS Spectral Bands," in Proceedings of ION 2002 National Technical Meeting, 2012. [126] E Falletti, M Pini, L Lo Presti, and D Margaria, "Assessment on low complexity C/No estimators based on M-PSK signal model for GNSS receivers," in Position, Location and Navigation Symposium, 2008 IEEE/ION, 2008, pp. 167-172. [127] Zarlink Semiconductor Inc, "GP2015 GPS Receiver RF Front End, GP2015 Datasheet," 2007. [128] A Ndili and P Enge, "GPS receiver autonomous interference detection," in Position Location and Navigation Symposium, 1998, 1998, pp. 123-130. [129] L Ge, S Han, and C Rizos, "Multipath Mitigation of Continuous GPS Measurements Using an Adaptive Filter," GPS Solutions, vol. 4, no. 2, pp. 19-30, 2000. [130] K Borre, D Akos, N Bertelsen, P Rinder, and S Jensen, A Software-defined GPS and Galileo Receiver: A Single-frequency Approach.: Birkhauser, 2007. [131] F Amoroso, "Adaptive A/D converter to suppress CW interference in DSPN spread spectrum communications," in Military Communications Conference (MILCOM 1983), 1983, pp. 720-728. [132] B Parkinson, JJ Spilker, P Axelrad, and P Enge, GPS: theory and applications, vols 1 and 215 References 2. Washington DC: AIAA, 1996. [133] EC Ifeachor and BW Jervis, Digital signal processing: a practical approach.: Pearson Education, 2002. [134] RM Gray, "Quantization noise spectra," Information Theory, IEEE Transactions on, vol. 36, pp. 1220-1244, 2002. [135] JL Mariano and HG Ramos, "Validity of Widrow's model for sinusoidal signals," Measurement, vol. 39, pp. 198-203, 2006. [136] CJ Hegarty, "Analytical Model for GNSS Receiver Implementation Losses," in Proceedings of the 22nd International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS 2009), Savannah, GA, 2009, pp. 3165-3178. [137] JB Johnson, "Thermal agitation of electricity in conductors," Physical Review, vol. 32, pp. 97-109, July 1928. [138] H Nyquist, "Thermal Agitation of Electric Charge in Conductors," Physical Review, vol. 32, pp. 110-113, July 1928. [139] J Kooi, G Chattopadhyay, M Thielman, T Phillips, and R Schieder, "Noise stability of SIS receivers," Int. J. Infrared Millim. Waves, vol. 21, no. 5, pp. 698-716, May 2000. [140] B Frye et al., "Gain and phase stabilities of some components used in the BIMA array," BIMA, memo 1995. [141] DV Land, AP Levick, and Hand JW, "The use of Allan deviation for the measurement of the noise and drift performance of microwave radiometers," Measurement Science and Technology, vol. 18, pp. 1917-1928, 2007. [142] E Nunzi, L Galleani, P Tavella, and P Carbone, "Detection of anomalies in the behavior of atomic clocks," Instrumentation and Measurement, IEEE Transactions on, vol. 56, no. 2, pp. 523-528, 2007. [143] PC Fenton and TJ Ford, "US Patent 5,734,674," Calgary, Alberta: Canda, 1998. 216 References [144] A Konovaltsev, U Kaelberer, M Sgammini, and M Meurer, "GBAS RF Interference Detection Threshold Determination at Palermo Airport," Journal of Italian Navigation Institute, vol. 190, pp. 45-55, 2009. [145] E Gakstatter. (2011) The FCC's Decision on LightSquared: High-Precision Users Would Be Affected Most, GPS World. [Online]. HYPERLINK "http://www.gpsworld.com/survey/the-fccs-decision-lightsquared-high-precision-userswould-be-affected-most-11089" http://www.gpsworld.com/survey/the-fccs-decision- lightsquared-high-precision-users-would-be-affected-most-11089 [146] TX Nguyen and JJ Ely, "Determination of receiver susceptibility to radio frequency interference from portable electronic devices," in Digital Avionics Systems Conference, 2002. Proceedings. The 21st, vol. 2, 2002. [147] RT Juang, DB Lin, and HP Lin, "Hybrid SADOA/TDOA mobile positioning for cellular networks," Communications, IET, vol. 1, no. 2, pp. 282-287, April 2007. [148] KC Ho and M Sun, "Passive source localization using time differences of arrival and gain ratios of arrival," Signal Processing, IEEE Transactions on, vol. 56, no. 2, pp. 464-477, February 2008. [149] YT Chan and KC Ho, "A simple and efficient estimator for hyperbolic location," Signal Processing, IEEE Transactions on, vol. 42, no. 8, pp. 1905-1915, August 1994. [150] RB Langley, "Dilution of Precision," GPS World, vol. 10, no. 5, pp. 52-59, 1999. [151] H Huang, Benesty J, GW Elko, and RM Mersereati, "Real-time passive source localization: a practical linear-correction least-squares approach," Speech and Audio Processing, IEEE Transactions on, vol. 9, no. 8, pp. 943-956, November 2001. [152] SR Drake and K Dogancay, "Geolocation by time difference of arrival using hyperbolic asymptotes," in IEEE International Conference on Acoustics, Speech, and, 2004. [153] C Mensing and S Plass, "Positioning algorithms for cellular networks using TDoA," in IEEE International Conference on Acoustics, Speech and, 2006. 217 References [154] BR Jackson, S Wang, and R Inkol, "Received signal strength difference emitter geolocation least squares algorithm comparison," in Electrical and Computer Engineering (CCECE), 2011 24th Canadian Conference on, 2011. [155] A Poonawala, P Milanfar, and RJ Gardner, "A statistical analysis of shape reconstruction from areas of shadows," in Conference Record of the Thirty-Sixth Asilomar Conference on Signals, Systems and Computers, 2002. [156] S Dulman, P Havinga, A Baggio, and K Langendoen, "Revisiting the Cramer-Rao Bound for Localization Algorithms," , 2008. [157] JAR Rose, JR Tong, DJ Allain, and CN Mitchell, "The use of ionospheric tomography and elevation masks to reduce the overall error in single-frequency GPS timing applications," Advances in Space Research, vol. 47, no. 2, pp. 276-288, 2011. [158] D Koks, "Numerical calculations for passive geolocalion scenarios," Defence Science and Technology Organisation (DSTO), Research Report DSTO-RR-0319, 2002. [159] Nak-Seon Seong and Seong-Ook Park, "Clock offsets in TDOA localization," in Proceedings of the Third international conference on Ubiquitous Computing Systems (UCS'06), 2006, pp. 111-118. [160] B Li, J Salter, A G Dempster, and C Rizos, "Indoor Positioning Techniques Based on Wireless LAN," in First IEEE International Conference on Wireless Broadband and Ultra Wideband Communications, Sydney, Australia, 2006. [161] J Turkka and M Renfors, "Path loss measurements for a non-line-of-sight mobile-to-mobile environment," in ITS Telecommunications, 2008. ITST 2008. 8th International Conference on. IEEE, 2008. [162] SY Seidel, TS Rappaport, S Jain, ML Lord, and R Singh, "Path loss, scattering and multipath delay statistics in four European cities for digital cellular and microcellular radiotelephone," Vehicular Technology, IEEE Transactions on, vol. 40, no. 4, pp. 721-730, Nov 1991. [163] T Stoyanova, F Kerasiotis, A Prayati, and G Papadopoulos, "A Practical RF Propagation 218 References Model for Wireless Network Sensors," in Sensor Technologies and Applications (SENSORCOMM 2009), Third International Conference on , 2009, pp. 194-199. [164] P Barsocchi, G Oligeri, and F Potorti, "Measurement-based frame error model for simulating outdoor Wi-Fi networks," IEEE Transactions on Wireless Communications, vol. 8, no. 3, pp. 1154-1158, March 2009. [165] JQ Shang, JA Umana, FM Bartlett, and JR Rossiter, "Measurement of Complex Permittivity of Asphalt Pavement Materials," J. Transp. Eng., vol. 125, no. 4, pp. 347-356, 1999. [166] G Kloos, JE Guivant, MN Eduardo, and F Masson, "Range based localisation using RF and the application to mining safety," in Intelligent Robots and Systems, IEEE/RSJ International Conference on, 2006, pp. 1304-. [167] SR Saunders, Antennas and Propagation for Wireless Communication Systems. New York: Wiley, 1999. [168] JH Lee and RM Buehrer, "Location estimation using differential RSS with spatially correlated shadowing," in in Proc. IEEE GLOBECOM, 2009, pp. 1-6. [169] VS Abhayawardhana, IJ Wassell, D Crosby, MP Sellars, and MG Brown, "Comparison of Empirical Propagation Path Loss Models for Fixed Wireless Access Systems," in VTC, 2005. [170] TJ Gallagher, Binghao Li, AG Dempster, and C Rizos, "A sector-based campus-wide indoor positioning system”," in International Conference on Indoor Positioning and Indoor Navigation (IPIN), 2010, pp. 1-8. [171] G Lui, TJ Gallagher, Li Binghao, AG Dempster, and C Rizos, "Differences in RSSI readings made by different Wi-Fi chipsets: A limitation of WLAN localization," in International Conference on Localization and GNSS (ICL-GNSS), 2011, pp. 53-57. [172] TP-LINK Technologies Co. Ltd., "TL-WN422G: High-Gain Wireless USB Adapter Product Information Sheet," 2008. 219 References [173] A Gupta and P Mohapatra, "Energy Consumption and Conservation in WiFi Based Phones: A Measurement-Based Study," in Annual IEEE Communications Society Conference on Sensor, Mesh and Ad Hoc Communications and Networks (SECON '07), 2007, p. 1220131. [174] Anonymous. (2012, March) NetStrumbler Website. [Online]. HYPERLINK "http://www.netstumbler.com/downloads/" http://www.netstumbler.com/downloads/ [175] Anonymous. (2012, March) Tutorial: Injection with ZyDAS zd1211 and zd1211b (zd1211rw). [Online]. ng.org/index.php?topic=5334.msg31425" \l HYPERLINK "http://forum.aircrack- "msg31425" http://forum.aircrack- ng.org/index.php?topic=5334.msg31425#msg31425 [176] Anonymous. (2012, March) Aircrack Website. [Online]. HYPERLINK "http://www.aircrack-ng.org/" http://www.aircrack-ng.org/ [177] C Tunstall and G. Gwyn Cole, Developing WMI Solutions: A Guide to Windows Management Instrumentation.: Addison Wesley Professional, 2003. [178] S Saitoh, S Fukushima, and N Fujii, "Flight Experiment of GBAS in Japan," in Proceedings of the 14th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS 2001), vol. September 2001, Salt Lake City, 2001, pp. 1757-1787. [179] N Patwari, AO Herom III, M Perkins, NS Correal, and RJ O’Dea, "Relative location estimation in wireless sensor networks," IEEE Trans. Signal Process, vol. 51, no. 8, pp. 2137-2148, August 2003. [180] Rui Yong and D Florencio, "Time delay estimation in the presence of correlated noise and reverberation," in Acoustics, Speech, and Signal Processing, 2004. Proceedings. (ICASSP '04). IEEE International Conference on, 2004. [181] Ho Wei-Gi and R Gharpurey, "A cross-correlation based signal detector with two-step down-converter robust to finite image rejection," in Circuits and Systems (ISCAS), 2011 IEEE International Symposium on, Rio de Janeiro, 2011, pp. 2197-2200. [182] ED Kaplan and CJ Hegarty, Understanding GPS: principles and applications.: Artech 220 References House, 2006. [183] MS Braasch and AJ Van Dierendonck, "GPS receiver architectures and measurements," in Proceedings of the IEEE, vol. 1, 1999, pp. 48-64. [184] SW Ellingson, JD Bunton, and JF Bell, "Cancellation of Glonass signals from radio astronomy data," in SPIE-ESO Symposium on Astronomical Telescopes and Instrumentation, Munich, Germany, 2000. [185] EP Glennon, RC Bryant, and AG Dempster, "Delayed parallel interference cancellation for GPS C/A code receivers," in In Proc. IAIN/GNSS, 2006. [186] J Weber, "Detection and generation of gravitational waves," Physical Review, vol. 117, 1960. [187] PL Normark and C Stahlberg, "Hybrid GPS/Galileo real time software receiver," in In Proceedings of ION GNSS 2005, 2005, pp. 1906-1913. [188] H Rohling, "Ordered statistic CFAR technique - an overview," in Radar Symposium (IRS), 2011 Proceedings International, 2011, pp. 631-638. [189] M Trinkle and DA Gray, "Interference localisation trials using adaptive antenna arrays," in Proceedings of the 15th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS 2002), Portland, 2002, pp. 613-619. [190] J Chen, J Benesty, and Y Huang, "Time delay estimation in room acoustic environments: an overview," EURASIP Journal on applied signal processing 2006, vol. 170, 2006. [191] MK Karakayali, "Network coordination for spectrally efficient communications in cellular systems," IEEE Wireless Communications, vol. 13, no. 4, 2006. [192] M Kezunovic, "Smart Fault Location for Smart Grids," Smart Grid, IEEE Transactions on, vol. 2, no. 1, pp. 11-22, March 2011. [193] RH Mitch et al., "Signal Characteristics of Civil GPS Jammers," in Proceedings of the 25th Int. Tech. Meeting of the Satellite Division of the U.S. Inst. of Navigation (ION GNSS 221 References 2011), Nashville, Tennessee, USA, 2011. [194] N Marechal, "Fine Synchronization for Wireless Sensor Networks Using Gossip Averaging Algorithms," in Communications, 2008. ICC '08. IEEE International Conference on, 2008, pp. 4963-4967. [195] S Stein, "Algorithms for ambiguity function processing," Acoustics, Speech and Signal Processing, IEEE Transactions on, vol. 29, no. 3, pp. 588-599, June 1981. [196] C Roberts et al., "Centimetres across Sydney: First results from the SydNET CORS network," in Proceedings of SSC2007, Hobart, Australia, 2007, pp. 152-161. [197] JB Bullock, TM King, HL Kennedy, ED Berry, and G Zanfino, "est results and analysis of a low cost core GPS receiver for time transfer applications," in Frequency Control Symposium, 1997., Proceedings of the 1997 IEEE International, 1997. [198] DW Allan and MA Weiss, "Accurate Time and Frequency Transfer during Common-View of a GPS satellite," in In Proc. 34th Ann. Symp. on Frequency Control, 1980, pp. 334-346. [199] Yu S Shmaliy and L Arceo-Miquel, "Efficient predictive estimator for holdover in GPSbased clock synchronization," IEEE Trans. on Ultrason., Ferroel. and Freq. Contr, vol. 55, no. 10, pp. 2131-2139, Oct 2008. [200] M Trinkle and DA Gray, "GPS Interference Mitigation: Overview and experimental Results," in 5th International Symposium on Satellite Navigation Technology and Applications (SatNav 2001), 2001. 222