A German research team successfully demonstrated a completely autonomous airplane landing in May, without assistance from any ground-based systems, fulfilling a key step towards autonomous air traffic and the much-bruited Urban Air Mobility (UAM).
An optical reference system, encompassing a camera in the normal visible range and an infrared camera for conditions with poor visibility, combined with GPS to bring the modified Diamond DA42 in for a safe, unpiloted landing at the Diamond Aircraft airfield in Wiener-Neustadt, Austria.
The team, from the Technical University of Munich (TUM) and the Technische Universität Braunschweig, formed the project they call C2Land with funding from the German federal government. Two 2019 conference papers by the researchers, cited at the end of this article, give the technical underpinnings of the C2Land system.
What’s New
Automatic landings by both commercial aircraft and small planes can and do take place at major airports with the Instrument Landing System (ILS) infrastructure to guide aircraft in with sufficient precision. Ground antennas send radio signals to the autopilot to make sure it navigates to the runway safely. Procedures in development to use GNSS alone to make autonomous landings also require a ground-based augmentation system.
But systems such as these are too expensive for small airports that will conceivably carry the major share of UAM: automated air freight transport and autonomous flying taxis.
What needs to happen before George Jetson air taxis become a reality? UAM will take place in the zone 500 to 5,000 feet above ground, transporting one to five passengers or cargo over distances of five to 50 miles. The vision shared by most UAM stakeholders, a group that includes NASA and the FAA, involves vertical take-off and landing rather than conventional “glide” takeoff and landing, but precise navigation to the landing spot is critical in both cases.
“Automatic landing is essential, especially in the context of the future role of aviation,” said Martin Kügler, research associate at the TUM Chair of Flight System Dynamics.
Fly-by-wire systems, semiautomatic and typically computer-regulated systems for aircraft navigation, use GPS signals for positioning. But since GPS is susceptible to errors, interference, and obstruction, it is not solely sufficient for landing procedures. Current GPS approach procedures require that human pilots resume control over the aircraft at 60 meters altitude, and land the aircraft manually.
To enable completely automated landings , the TU Braunschweig team designed an optical reference system: two cameras, one in normal visible range and one infrared camera for poor visibility conditions. Custom image processing software lets the system determine where the aircraft is relative to the runway based on the camera data it receives. Additional functions were integrated in the software, such as comparison of data from the cameras with GPS signals, calculation of a virtual glide path for the landing approach and flight control for various phases of the approach.
Visual Recognition
Test pilot Thomas Wimmer, who sat through the procedure with his hands folded, said “The cameras already recognize the runway at a great distance from the airport. The system then guides the aircraft through the landing approach on a completely automatic basis and lands it precisely on the runway’s centerline.”
The researchers presented their system in two papers at the Institute of Navigation’s 2019 Pacific PNT Meeting in April:
“Model-based Threshold and Centerline Detection for Aircraft Positioning during Landing Approach,” by S. Wolkow, M. Angermann, A. Dekiert, and Ulf Bestmann; and
“Linear Blend: Data Fusion in the Image Domain for Image-based Aircraft Positioning during Landing Approach,” by M. Angermann, S. Wolkow, A. Dekiert, U. Bestmann, and P. Hecker.
Collins Aerospace Systems, a unit of United Technologies Corp., has begun taking orders for its latest-generation Miniature PLGR Engine – M-Code (MPE-M) GPS receiver set for 2020 production deliveries.
According to independent testing, the MPE-M is the lowest size, weight and power (SWaP) small Type II form factor ground receiver available and incorporates the company’s recently certified Common GPS Module (CGM).
As a drop-in replacement for the thousands of customers using Collins’ Miniature PLGR Engine-SAASM (MPE-S) GPS receiver, the new MPE-M technology provides ten-times stronger anti-jamming capabilities for the direct acquisition of GPS signals than its predecessor.
The MPE-M is capable of receiving the current military Y-Code GPS signal along with the newer Military Code (M-Code) signal. For all GPS signals, the MPE-M provides warfighters improved security and assured positioning, and it satisfies the U.S. government’s requirement for all military GPS equipment to be M-code-capable.
“The MPE-M is ideal for lightweight, ground-based applications such as radios, blue force trackers, targeting devices, vehicle LRUs and small unmanned aircraft,” said Troy Brunk, vice president and general manager, Communication, Navigation and Electronic Warfare Systems for Collins Aerospace. “The implementation of M-code will provide our warfighters with increased mission effectiveness and safety due to the improved reliability of the signal.”
Collins Aerospace is currently the only military GPS receiver provider that manufactures its products in house, assuring control over quality and delivery schedules. The MPE-M’s security certification also makes the receiver eligible for export to U.S. allies through the Foreign Military Sales (FMS) program.
Is 5G simply another generation of mobile communications technologies? Or is it something revolutionary?
To help with answers, test and measurement specialist Rohde & Schwarz has compiled an in-depth book describing the main aspects of 5G New Radio (NR) technology. The contents of the book can be read online for free.
Rohde & Schwarz has been an active participant in the 3GPP standardization process involving cellular technologies, including the upcoming 5G NR. Five technology experts at Rohde & Schwarz wrote the book to provide in-depth information for professionals working with 5G NR technology.
The 400-page 5G New Radio: Fundamentals, Procedures, Testing Aspects provides insights into fundamentals and procedures on the architecture and transmission of 5G NR technology. The chapters provide answers to how
and why the 5G technology was specified a certain way by 3GPP. The book also discusses the new challenges to test and measurement, brought about the arrival of 5G technology, and presents modern, innovative test solutions to solve these challenges.
A report filed with NASA’s Aviation Safety Reporting System and published in June outlines how a passenger aircraft flew off course during a period of GPS jamming and nearly crashed into a mountain. Fortunately, an alert radar controller intervened, and the accident was averted.
Friedman Memorial Airport serves the ski resort town of Sun Valley, Idaho. Mountain peaks in the area are in excess of 12,000 feet. Airport arrival and departure procedures are carefully structured to ensure aircraft maintain safe distances from terrain.
According to the report, when “Aircraft X” arrived there was “…an abundance of smoke in the area” of the safe arrival route. Also “During this time there was widespread GPS jamming… Almost every aircraft was reporting…GPS outages.” Two previous flights had advised that their GPS signals were interrupted, but came back on line in time to make a safe approach to landing.
Aircraft X also reported problems with GPS, and then advised air traffic control that GPS had come back on line and was working well. The controller then cleared the aircraft for a GPS-based approach, including descending to 9,000 feet. Communications with and control of the aircraft was switched from Salt Lake Center (250+ miles away) to the tower at the local airport.
Shortly thereafter, the controller in Salt Lake City noticed Aircraft X straying off course. Also, it was at 10,700 feet altitude and nearing a 10,900 feet mountain. He quickly contacted the local control tower and the aircraft was directed back onto a safe flight path.
The report concludes that “Had [the Radar Controller] not noticed, that flight crew and the passengers would be dead, I have no doubt.”
Dana A. Goward is president of the Resilient Navigation and Timing Foundation.
GNSS chip manufacturers and positioning systems developers are working on bespoke devices for autonomous driving. This month, we look at a development with embedded functional safety.
By Fabio Pisoni, Domenico Di Grazia, Giuseppe Avellone, Luis Serrano, Brett Kruger, Laura Norman and Natasha Wong Ken
INNOVATION INSIGHTS by Richard Langley
I DRIVE A 10-YEAR OLD KIA SPORTAGE. It is still quite roadworthy despite having to contend with New Brunswick winters. However, it lacks some of the safety features that are present in newer cars. There is no back-up camera, no forward-collision warning, no automatic emergency braking, and no blind-spot warning, for example. These are just some of the safety systems that come as standard or optional on most new cars these days. Still, the driver is responsible for the safety and operation of the car at all times. True, help might be provided for parallel parking and cruise control, but that’s about it for automated operation with most vehicles.
But things are changing and changing fast. Real automation is coming to automobiles. Already partial automation is available in some high-end vehicles that can take over steering, braking and acceleration in certain circumstances. The driver is still responsible for other aspects of the vehicle’s operation including paying attention to road conditions. Soon, we will have conditional automation where the car can drive itself but the driver must stay alert and be prepared to take over immediately at any time. Next will come high automation where a computer fully drives the car at certain times on certain routes such as a highway. Multiple systems, including back-up systems, will maintain a required safety level and the car will determine if it is safe to operate autonomously. If not, it could pull over to the side of the road and shut down. And finally, we may have full automation of cars. They will be able to drive on any road under virtually any conditions and won’t need any controls such as steering wheels or accelerator or brake pedals.
Augmented GNSS guidance will play a major role in the automation of vehicles. As with any navigation or guidance system, there are four important requirements: accuracy, availability, continuity and integrity. Perhaps the most obvious requirement, accuracy describes how well a measured value agrees with a reference value, typically the true value. How well a system accounts for various errors or biases determines the accuracy of corrected measurements and, ultimately, the accuracy of a derived position. A navigation system’s availability refers to its ability to provide the required function and performance within the specified coverage area at the start of an intended operation. In many cases, system availability implies signal availability. Environmental factors such as signal attenuation or blockage or the presence of interfering signals might affect availability. Ideally, any navigation system should be continuously available to users. But, because of scheduled maintenance or unpredictable outages, a particular system may be unavailable at a certain time. Continuity, accordingly, is the ability of a navigation system to function without interruption during an intended period of operation.
While accuracy, availability and continuity of a guidance system are all important, it is the integrity or trustworthiness of the system that is paramount. It is why the automotive industry has already developed integrity standards for the automation of vehicles. And it is why GNSS chip manufacturers and positioning systems developers are working on bespoke devices for autonomous driving, whatever the level of automation. In the Innovation column this time around, we’ll learn about one such development — one with embedded functional safety.
Autonomous driving applications are raising the requirements for onboard GNSS receivers to new highs. Position accuracy, protection levels, high availability, robustness of operation and integrity are the priorities shaping a new class of automotive components and architectures. Autonomous driving deals with life-critical issues: the expectation of reliability and safety for this new generation of receivers, as well as for other sensors and systems, is very high.
The International Organization for Standardization (known by the language-independent short form ISO) has issued documents codifying functional safety (FuSa) for automotive applications: ISO 26262: part 1 to part 11. ISO 26262 complements the well-known automotive reliability standard published by the Automotive Electronics Council, AEC-Q100. With respect to FuSa, a system can be defined as functionally safe if it always operates correctly and predictably. More importantly, in the event of failures, the system must remain safe for people. Lastly, as security is becoming paramount, a new standard for cybersecurity in automotive applications — ISO/SAE 21434 — is in development by ISO and SAE International (initially called the Society of Automotive Engineers) that will require a GNSS receiver to be robust against jamming, spoofing and meaconing attacks.
The Automotive Safety Integrity Level (ASIL) is a key part of ISO 26262 compliance, and the standard specifically identifies the minimum testing requirements depending on the ASIL of the component. The ASIL of a component or system depends on the ASIL of the target application. The ASIL is determined at the beginning of a development process. It varies from ASIL-A to ASIL-D, where A is for less critical applications and D for the most critical ones such as steering and breaking systems. ASIL-rated lane-level positioning performance can be demonstrated today by combining an ASIL-B software positioning engine and TerraStar-X correction technology from Hexagon Positioning Intelligence with GNSS measurements from an ASIL-B-rated GNSS chipset.
To conjugate performance requirements with the demand of embedded functional safety, STMicroelectronics has developed TeseoAPP (STA9100), a next-generation GNSS component, designed to meet an ASIL-B level of safety. TeseoAPP is a multi-band GNSS measurement engine. It outputs all the observables, navigation and integrity data required by a safety-critical precise positioning algorithm, located on a host processor. TeseoAPP also computes a local L1 code-based standard position, velocity and time (PVT) solution (SPS) for monitoring and integrity purposes. Also part of the baseline features are autonomous satellite acquisition (cold start condition), real-time assistance, data decoding and storage on external non-volatile memory (NVM), accurate timing and pulse-per-second generation under vehicle dynamics.
RECEIVER ARCHITECTURE
The target architecture for a safety-critical platform is sketched in FIGURE 1, where a host microprocessor is in charge of collecting GNSS observables and sensor data from the TeseoAPP. The latter includes on the same chip die a first configurable RF chain for the L1 signal ensemble and the baseband part for processing all the signals in the served bands, while the second chip is an RF front end (code-named STA5635), configurable for receiving the other served bands (such as GPS L2 or L5, Galileo E5a or E5b or E6, and so forth). The two chips are clearly visible in the photograph of a TeseoAPP evaluation module of FIGURE 2.
FIGURE 1. Block diagram of the TeseoAPP platform for safety-critical applications, featuring surface-acoustic-wave (SAW) filters, a temperature-compensated crystal oscillator (TXCO), non-volatile memory (NVM) and both internal and external STA5635 tuners. (See text for other initialisms used.) Diagram: Authors)FIGURE 2 The TeseoAPP Evaluation Module, including the STA9100 (TeseoAPP) and STA5635 (external tuner). Photo: Authors
The selected frequency plan and constellation configuration depend on the specific autonomous driving scenario and the target geographic area. The TeseoAPP supports a mix of frequencies and signals as shown in TABLE 1. The chipset baseband unit can track up to 80 channels. A tracking snapshot from a rooftop antenna (located at the ST office in Naples, Italy) is illustrated in FIGURE 3.
Both the TeseoAPP and the STA5635 have been designed for ASIL-B following the concept of “safety element out of context” (SEooC) described in ISO standard ISO 26262:2012. In this context, assumptions have been made for the application (such as on the mission profile), identifying the related safety goals from which functional and technical safety requirements have been derived.
TABLE 1. The TeseoAPP (STA5635) supported frequency plans and scenarios.FIGURE 3. Screenshot of the L1-L5 TeseoAPP configuration, from the ST Teseo-Suite tool (using the Naples rooftop antenna). Image: Authors
Following the guidelines identified in the ISO 26262 flow for safety-relevant product development, several safety mechanisms have been identified at the hardware, firmware and system/boot level. The microcontroller unit (MCU) supports dual-core operation in a lock-step configuration to verify processor output errors together with a memory built-in self-test (executed at startup) and error correction code on a safety-related embedded random access memory. Other hardware redundancies have been introduced in safety relevant parts such as triple-voted registers for critical configuration parameters. For the real-time operating system (RTOS), an ASIL-D-level product — the highest level — was selected.Functional safety analysis of the GNSS sub-system has produced a dedicated technical safety concept, including aspects such as tuner operation, interference and jamming mitigation, signals and observables quality management (QM), reliable host communication (using generic end-to-end or E2E protocols for data integrity and resilient flow control), and reliable system software. A simplified overview of all these safety mechanisms is outlined in FIGURE 4, where the orange-colored blocks are specific for the GNSS sub-system.
FIGURE 4. Overview of the TeseoAPP safety mechanisms. (See text for acronyms and initialisms used.) Diagram: Authors
Safety Mechanisms. The technical safety concept of the GNSS sub-system is implemented by a security, integrity and safety (SIS) monitoring layer (see FIGURE 5). The SIS collects information and metrics from other receiver blocks embedded in the RF/baseband hardware and from different components of the GNSS firmware stack. The SIS internally computes integrity risk estimates, which are delivered to a central intelligence monitor (CIM) capable of switching the receiver into a safe state, within a fault-tolerant time interval, when the overall receiver integrity appears compromised. In its simplest form, the CIM can be represented by a weighted sum of integrity risk inputs, followed by some activation function. During this process, a first layer of logic (CIM-L1) combines a subset of signal quality metrics to decide a priori which observables shall be passed to the host or discarded (not delivered).
FIGURE 5 Safety information flow through the TeseoAPP security, integrity and safety layer. (IP = intellectual property; other short forms in text.) Diagram: Authors
The collected signal metrics include quality estimators (based on multi-correlation techniques for example) or classic linear combinations of observables (such as dual-frequency carrier-phase differences or code-minus-carrier). Receiver metrics, on the other hand, have a more global scope and include estimators for inter-frequency biases, system-time cross-checks among constellations, and so on. The fault collection and control unit (FCCU) conveys hardware status flags to the SIS. Typically, an FCCU exception indicates some critical hardware failure and takes a priority path when switching the safe state. For example, a fault in the MCU lock-step monitor will trigger an immediate firmware action, mediated by the FCCU.
POSITIONING PERFORMANCE
To demonstrate the performance that can be achieved using the ST TeseoAPP chipset, Hexagon Positioning Intelligence (PI) has combined measurements from the TeseoAPP with an automotive-grade antenna and Terrastar-X correction technology, and processed the data using Hexagon PI’s software positioning engine. Even with a modern receiver supporting dual-frequency, multi-constellation measurements, such as the TeseoAPP, corrections are necessary to deliver decimeter-level performance and safety information required by an autonomous vehicle.
In clear-sky environments, lane-level positioning accuracy is achieved, enabling GNSS as a key input to autonomous systems. FIGURE 6 shows the horizontal error performance of the combined ST+PI solution in the form of an error time series and an error cumulative distribution function (CDF). The error performance expected from today’s single frequency automotive-grade GNSS without corrections and processing is also shown for comparison.
FIGURE 6. Horizontal error time series and cumulative distribution function (CDF) of the TeseoAPP alone and of the TeseoAPP with Hexagon PI software positioning engine (SWPE) in an open-sky environment. (Image: Authors)
For guidance systems in autonomous applications, the GNSS position must be accompanied by safety information and integrity guarantees. The concept of protection levels (PLs) has been introduced to provide this. A horizontal protection level defines a circle or ellipse around the reported GNSS position, which will have some error, within which the actual position is guaranteed to fall. The Hexagon PI software positioning engine is ASIL-B rated, so its position and PL outputs are available for use in safety-related autonomous applications. The autonomous system using the GNSS position is assured that its actual position is within the protection level ellipse. To output ASIL-B-rated positions accompanied by PLs, ASIL-rated GNSS measurement inputs are required.
Using the inputs and techniques described above, the Hexagon PI software positioning engine calculates PLs for every GNSS position output. The Hexagon PI data from Figure 6 is shown again in FIGURE 7 with accompanying PL information. In this case, a PL with integrity risk of 10-7 is shown, meaning that the actual position error is expected to exceed the reported PL at a rate less than 10-7 per hour.
FIGURE 7. Horizontal error and protection level (PL) including cumulative distribution functions (CDFs) of the Hexagon PI software positioning engine (SWPE) in an open-sky environment. (Image: Authors)
The PLs shown in Figure 7 are typically much greater than the position error. This is because the protection level calculation must account for a large number of potential faults that are not generally present. For instance, undetectable GNSS satellite faults can occur at rates greater than 10-7 per hour, and so must be accounted for in the PL.
In non-clear-sky environments, the GNSS position calculation is complicated by frequent loss of “sight” of the GNSS satellites. This is mitigated by having additional constellations and frequencies. However, for added availability of a precise position in challenging environments, it is necessary to incorporate sensor fusion into the position calculation, typically by using a six degree-of-freedom inertial measurement unit (IMU) as input, which includes three accelerometers and three gyroscopes to measure 3D translational and rotational motion. The IMU can maintain position accuracy for short periods when GNSS is unavailable, such as when driving under an overpass on a highway. The IMU provides a relative positioning output, so the absolute error growth is unconstrained in the absence of GNSS inputs. Therefore, it is important to have the GNSS receiver as the primary sensor in the positioning solution to constrain IMU drift and to reacquire GNSS signals rapidly after emerging from a GNSS outage.
Position error results for a typical highway environment are shown in FIGURE 8 after adding input from an automotive-quality IMU to the Hexagon PI software positioning engine. Small spikes in position error are due to short GNSS outages along the test route. However, the error growth due to loss of GNSS is minimal due to the coupling of the IMU data with the GNSS measurements.
FIGURE 8. Horizontal error time series and cumulative distribution function (CDF) of the TeseoAPP alone, and of the TeseoAPP with Hexagon PI software positioning engine (SWPE) in a highway environment. (Image: Authors)
FIGURE 9 shows the Hexagon PI highway data with accompanying PLs. Though the errors are well-constrained through GNSS outages, the PLs typically increase significantly. This is due to the higher noise of low-cost IMUs, and the uncertainty associated with reacquiring GNSS signals. PLs must account for worst-case IMU performance, which can have errors orders of magnitude greater than the nominal performance. During GNSS signal reacquisition, minimizing receiver noise is critical for fast position reconvergence, reinforcing the need for high-quality GNSS in autonomous applications.
FIGURE 9. Horizontal error and protection level (PL) including cumulative distribution functions (CDFs) of the Hexagon PI software positioning engine (SWPE) in a highway environment. (Image: Authors)
CONCLUSION
The TeseoAPP is the first generation of multi-band GNSS chipsets designed by STMicroelectronics to meet the two main requirements of autonomous driving: accuracy and safety-critical operation. The execution of the ISO 26262 standard for TeseoAPP is still a work in progress and encompasses two main aspects: 1) a safety plan implementation, code quality metrics and processes management and 2) the technical safety concept. Both of these aspects presented specific challenges, mainly due to the inherent complexity of the product and the large amount of firmware involved.
To exploit the maximum benefit of the TeseoAPP in safety-critical automotive applications, a high-accuracy ASIL-B-rated position engine is required. Hexagon PI’s software positioning engine is designed to use measurements from an ASIL-rated GNSS receiver, along with GNSS corrections and IMU data, to generate ASIL-rated position outputs, with accompanying integrity guarantees. The Hexagon PI software positioning engine computes protection levels. The calculation and determination of PLs is required to meet the safety and integrity guarantees necessary in autonomous driving for functionally safe operation.The software positioning engine also outputs ASIL-rated velocity, attitude and absolute time data, although we have not discussed these in this article.
The required high performance and safety expectations suggested, since the early stages of the project, a system composition in which the TeseoAPP was configured as an ASIL-B measurement-engine whereas the ASIL-B software positioning engine algorithms (by Hexagon PI) run on a separate ASIL host processor. We believe this synergy of competencies will represent the key for a successful solution to enable safe and reliable positioning in autonomous driving applications.
ACKNOWLEDGMENTS
The TeseoAPP chipset has been developed with the support and in the framework of the European Safety Critical Applications Positioning Engine project, which is funded by the European GNSS Agency under the European Union’s Fundamental Elements research and development program.
FABIO PISONI leads the GNSS System Architecture and Software Team (Automotive and Discrete Group) at STMicroelectonics Italy in Milan, where he has worked since 2009. He has a degree in electronics from Politecnico di Milano and has previous experience as a GNSS and digital signal processing (DSP) engineer.
DOMENICO DI GRAZIA is a GNSS signal senior staff engineer at STMicroelectronics Italy in Naples, where he has worked since 2003. He has a degree in telecommunication engineering from the University of Naples Federico II, holds patents in the GNSS area, and has previous experience in digital communications.
GIUSEPPE AVELLONE is in the GNSS System Architecture and Software Team (Automotive and Discrete Group) at STMicroelectonics Italy in Catania, where he has worked since 1998. He has a degree in electronics from Università di Palermo and previous experience as a GNSS and DSP engineer.
LUIS SERRANO is a GNSS technical marketing manager with STMicroelectronics based in Munich. He holds a Ph.D. in GNSS from the Department of Geodesy and Geomatics Engineering, University of New Brunswick, Canada. He has been active in the GNSS precise positioning field since 2007, and holds a patent on GNSS.
BRETT KRUGER is a software engineer specializing in GNSS/INS integration in the Safety Critical Systems Group at the Hexagon Positioning Intelligence (PI) NovAtel brandin Calgary, Canada. He holds an M.A.Sc. in electrical engineering from the University of Toronto, Canada.
LAURA NORMAN is a geomatics engineer specializing in GNSS integrity and protection levels in Hexagon PI’s Safety Critical Systems Group. She obtained her M.Sc. from the Department of Geomatics Engineering at the University of Calgary, Canada.
NATASHA WONG KEN is the Safety Critical Systems product manager at Hexagon PI. She has worked at Hexagon PI since 2012 after obtaining a B.Sc. in geomatics engineering from the University of Calgary.
Raytheon Company has signed a strategic agreement with AirMap, an airspace intelligence platform for drones, to collaborate on projects to safely integrate unmanned aerial systems (UAS) into the national airspace system. This will help unlock the positive economic and social benefits of expanded commercial drone operations, the companies said.
Unmanned air traffic control advances will unlock safe, efficient and scalable drone operations with a myriad of economic and social benefits.
“AirMap is ushering in a new era in drone aviation,” said Matt Gilligan, vice president of Raytheon’s Intelligence, Information and Services business. “Drones must safely operate in an already complex ecosystem, which is where our experience matters.”
The agreement combines the two companies’ expertise:
Raytheon’s Standard Terminal Automation Replacement System, or STARS, is used by air traffic controllers across the U.S. to provide safe and efficient aircraft spacing and sequencing guidance for more than 40,000 departing and arriving aircraft daily at both civilian and military airports.
AirMap is a global provider of airspace intelligence for UAS operations, with over 250,000 registered users. In 2018, U.S. registered commercial drone pilots used AirMap to request more than 45,000 automated authorizations to fly in controlled airspace.
“Raytheon technology has helped safely and effectively manage airspace in the most complex, dense controlled airspace in the world for decades,” said Ben Marcus, AirMap co-founder and chairman. “They are an ideal partner to join AirMap on the path toward enabling safe, efficient, and scalable drone operations in U.S. low-altitude airspace between 0 and 400 feet.”
The two companies are working toward an integrated demonstration that will showcase how AirMap’s unmanned aircraft traffic management platform can increase air traffic controllers’ awareness of potential conflict between drones and manned aircraft near airports to ensure overall safety of the airspace.
The surveying profession has come to a crossroads, and is divided amongst itself to boot. A gap exists within the profession, and yes it is a generation gap, based on how technology has evolved and how the different generations experience it differently. In this column I explore the histories both of the generations and the technology to reach conclusions on how best to move forward — together.
Surveyors now have more tools than ever before available to them to perform their tasks. But surveyors of different ages regard these tools differently. Not to put too fine a point on it, the younger porfessionals among us feel their creativity and desire to further the profession is being stifled by the group who is supposed to be leading and mentoring them.
Why is this crucial to consider? Because these are the future users, purchasers and adopters of geospatial equipment and software, and the future setters of industry standards. All involved, from manufacturers to distributors to surveyors themselves, would do well to think deeply upon this.
As we enter the final stretch of the 21st century’s second decade, many things have changed since the Y2K scare and the proliferation of the Interweb. From deregulation of the surveying profession to changing coordinate systems and datums, the surveying profession faces many challenges in 2019. One of the biggest challenges we face has nothing — yet everything — to do with technology.
Talented people are necessary to grow our profession. We are falling well short of having enough to keep up with demand. Sounds like a simple problem; just hire more surveyors and technicians. This sounds easy, but several roadblocks confront us.
A select few still invest in their surveying future by going to college to get a degree and eventually become a licensed surveyor. These individuals find, however, that the road to success has lots of potholes along the way, just as their elder predecessors did.
Recently, I participated in a group discussion with the National Society of Professional Surveyors (NSPS) Young Surveyors Network to discuss surveying, technology and the young surveyor’s role in promoting future career opportunities. This discussion was part of Network’s series of meetings and seminars held in parallel with the main NSPS Spring Business Meetings.
It was great to see the higher proportion of women in the young surveyor group than in the typical professional society meeting. Their feedback was consistent with that of the young men in the group. All together, their perspectives led me to write this article.
While I think of myself as still “young-ish” (in my early 50s), being the oldest participant in that group was intimidating, to say the least. These young technicians and surveyors are driven and focused, yet they seek the same feedback and mentoring that I desired when I was their age.
In the weeks after that meeting, some of the items discussed continued to resonate with me and forced me to reflect on my own experiences and career path. To be fair to them and truly understand their views on today’s surveying profession, I needed to look beyond the profession, policies and procedures to which I hold fast in my ethical approach to the craft. These younger generations have been exposed to a completely different world than the one I remember fondly, and the world they grew up in has subjected them to challenges to which I cannot relate. To help explain the conundrum of trying to find a way to relate, we need to take a step back and look at not just generational values but how the many industrial revolutions have affected us as well.
TALKING ‘BOUT MY GENERATION
The first part of my research to help me find a way to step into the shoes of these young surveyors was to look at past generations and how they relate to each other. Going back to the turn of the 19th century, we get the following breakdown:
Traditionalists or Silent Generation: Born before 1945
This timeframe contains sub-groups including the “lost generation of 1914,” the “interbellum” and the “greatest generation.” Alaska and Hawaii were not included in the United States during this period. Most of the country west of the Colonial states was subject to the government Public Land Survey System started in the early 1800s. The Great Depression took its toll on much of the population, and previously rapid expansion slowed to a standstill.
Baby Boomers: Born 1946 – 1964
World War II changed the world. Soldiers returning from military duty to start or resume families accelerated population growth and a departure from traditional social attitudes. Two-income families emerged, and prosperity ruled for many years. Surveyors, teaming with civil engineers, helped fuel an unprecedented explosion of real estate expansion through planned developments across the country.
Generation X: Born 1965 – 1976
The children of the fast and free-living Baby Boomers grew up to become the Gen Xers. They were the first “latchkey” kids, more likely to be raised by divorced or remarried parents. As young adults, in their effort to enhance their lifestyle more than their parents, they did many things to the extreme with no consideration of cost. This led to massive real estate developments, “McMansions” and increased debt. Surveying continued to flourish but most growth was enjoyed by engineering firms who absorbed surveyors to expand their services.
Millennials or Gen Y: Born 1977 – 1995
This group is often labeled as the “Peter Pan” generation for its predisposition to put off typical adulthood norms like marriage, having children and buying real estate. They have a propensity to be more mobile and nomadic, as they take advantage of technology and rapidly changing environmental factors. With this generation we find the slowdown in career choices towards surveying, even though technology and spatial data acquisition have exploded with potential.
Gen Z, iGen, or Centennials: Born 1996 – Current
This generation was born into technology, and it affects everything they do. From infancy they were experienced soothing music, dancing screens, interactive toys, and dolls teaching them new skills. This generation doesn’t know of a world without computers, cellphones, GPS-based maps or high-speed internet. Surveying has also benefitted from the technology explosion but it hasn’t captured the imagination of this generation sufficiently to develop future practitioners.
YOU SAY YOU WANT A REVOLUTION. WELL, YOU KNOW…
The generational differences only tell part of the story. Each one faced its own challenges when it came to technology (or lack thereof), societal standards, and other facets of their respective eras. A succession of several Industrial Revolutions brought new tools for completing a wide array of tasks and procedures. Here is a summary of each of them in chronological order:
First Industrial Revolution (1784)
Mechanical production via water and steam power led the way during the late 1700s and began a trend of radical changes in the ability to create larger items. The Gunter chain and surveyor’s compass, both invented in the 1600s, were the mainstay of measuring tools during this time period.
Second Industrial Revolution (1870)
Mass production and increases in labor opportunities coupled with the adaptation of electricity in many areas enabled people to flourish like no other time to date. The optical theodolite with horizontal angle measurement was introduced and then mass produced in the late 1800s to help surveyors make more progress westward.
Third Industrial Revolution (1969)
A significant leap forward in technology occurred with the invention of the microprocessor in the late 1950s, followed quickly by rapid development of electronic machines designed to follow manual instructions. Programmable controllers and devices were born from the fast-paced development of sophisticated miniaturized circuitry. These developments were used to create measurement devices for sending infrared and visible light waves across long distances. In the late 1970s, technological advancements led to the development of electronic theodolites or total stations. These instruments were the first to be able to electronically determine the horizontal and vertical angles normally read manually by the operator, and to combine this data with electronic distance measurement. Further development created methods of storing this data electronically for input into computer calculation and drafting programs.
Fourth Industrial Revolution (Current)
Industry experts differ as to when the Fourth Revolution began, but all agree we have turned the corner and are now fully entrenched into a new realm. Further miniaturization of computer chips, advanced sensors and storage, and robotic mechanisms have introduced a new reality for everyone, including the surveyor. Today’s practitioner has many sophisticated tools available for work, including GNSS receivers, laser or LiDAR scanners, UAVs with a multitude of sensors, hydrographic vehicles with single and multi-beam fathometers, and many more instruments currently under development.
Surveyors now have more tools than ever available to perform their tasks. Now we must cross-reference these revolutions with the practitioners from the various generations to help us understand upon which road the profession is headed.
TECHNOLOGY MEETS GENERATIONAL DIFFERENCES; WHAT COULD GO WRONG?
One thing that stood out in my aforementioned discussion with the young surveyors’ group was how much they were embracing technology not just in their every day lives and communication, but how they understood the enhanced abilities of the latest tech and instruments for surveying. They see the value in large data, point clouds and BIM (building information modeling) needed for industry use.
The general consensus from this group was that my generation (Gen X) and earlier (Baby Boomers) are easily dismissive of their enthusiasm for incorporating these new technologies into our workflow simply as ways to shortcut old methods done by more labor-intensive means. While I initially tried, myself, to dismiss this suggestion, further research has only proven their point: their creativity and desire to further the profession is indeed being stifled by the group that should be leading and mentoring them.
Cross-correlating the generations with their various personalities and quirks with the amalgamations of industrial revolutions turns up some interesting results. Gen Xers and earlier surveyors were strictly taught by their managers and mentors that both historical data and original monuments are sacred and not to be denied. This information was derived from the most basic of survey instruments and measuring equipment, with accuracy that is not acceptable by today’s standards.
But the tradition remained: if it was good enough for our forefathers to establish the early frontier, then more accurate measuring devices are simply overkill. New sophisticated robotic total stations, GNSS receivers and robust data collectors available as a result of the Third Industrial Revolution are shiny objects that stand in the way of “good surveying,” in the opinion of the elder surveyors.
Millennial surveyors, meanwhile, look at the world with a different vision and much different solutions. Most of them were not exposed to televisions with just three channels, telephones mounted on walls, or kitchens without microwave ovens, to just to name a few “antiquities.” Their families have always owned a computer and the library is a place where you go to study. Research isn’t looking in an encyclopedia; you Google. They embracw cellphones with a multitude of apps and functions, including location services within a few feet, practically as extensions of themselves.
The equipment produced for surveyors today is well within their wheelhouse as it maps a multitude of points and features in a blink of an eye. Accuracy and detail are no longer an issue — but adapting that data to legacy deeds and maps is where us old timers can help bridge the gap.
Another problem that has proven to be a yawning void between the generations is the remnants of the economic slowdown of 2007-2012. Many Baby Boomer and Gen X surveyors learned to do more with less. Times were tough and we couldn’t afford to upgrade to the latest versions of total stations, GNSS, software, or invest in new technologies like laser scanning. There was also an exodus of technicians simply because there was no work in surveying for the time period, and they found employment in other professions. That left a void in who was doing the work (now being completed by upper level surveyors with older skill sets), and having no younger personnel to train and groom for future career growth.
There were many technological advancements during that time frame but overall the industry suffered because of the economic downturn. The Millennials, most of whom were too young to be employed during this period, now are faced with working for an older profession that couldn’t afford to stay current with technology and who have trouble relating to the motivations of the younger generation.
CAN’T WE ALL JUST GET ALONG?
I believe the surveying profession is at a crossroads, one based upon the gap caused by the generation / technology combination described above. Steps must be taken to rectify this. Here are a few of the pathways to closing the gap and becoming a solid profession for the future:
Embrace the mentor/mentee relationship, but be open to reversing the roles. The younger generations have a handle on the latest technology, so us old timers need to be more willing to close our mouths and open our ears and minds.
Create more opportunities for younger surveyors to participate in organizations so they can also be influencers. Keep in mind that they don’t typically like to “belong” to an organization, so adapt our professional groups and keep their interests in mind.
Change the way we communicate. Many Baby Boomers / Gen X members are critical of the younger generations and social media, yet this trend shows no sign, at all, of stopping. Smartphones are here to stay, so let’s learn to adapt, to remain in step with the youngsters.
Be willing to invest in new and emerging technology. Who know where the next radical survey technique will come from if you don’t have an open mind and checkbook? Invest not only in equipment but your young staff’s future.
Encourage younger staff to get involved in something. Anything. Social interaction can lead to better communication skills and expose them to more business situations. Don’t push them in over their head,s but get them to be “uncomfortable” occasionally. They will thank you for it.
Many professions and occupations will suffer in the next 3–5 years because of attrition through retirement, incapacitation and death. These workforces will lose 20–40% of their workers. Those left will have to pick up the slack and then some. We need to either
A) hire a lot more surveyors, or
B) figure out how to make it work with less bodies.
The conversation that took place in that meeting room with the young surveyors has made a deep impression on me and has changed my focus on the future of surveying. How does this apply to an article in a geospatial publication? Simple: these are the future users, purchasers and adopters of geospatial equipment and software, and the setters of industry standards.
The younger generation understands how to use today’s technology, and the surveying profession overall needs to embrace that fact. The technology won’t mean a thing if we don’t have the bright minds to use it to its full potential.
So I ask you again to embrace, encourage and listen to the young surveyors; they will thank you for it.
RNT Foundation Directors and Congressmen. From left: RADM Jeff Hathaway, USCG (ret); Rep. John Garamendi (D-CA); Rep. Peter DeFazio (D-OR); Dana A. Goward, SES, CAPT, USCG (ret); and CAPT Pauline Cook, USCG (ret). (Photo: Resilient PNT Foundation)
“It’s absolutely vital for national security that we get a terrestrial based, hard backup system [for GPS],” said Congressman Peter DeFazio (D-OR), chairman of the House Transportation and Infrastructure Committee.
His remarks came at an event organized by the RNT Foundation to recognize DeFazio and Congressman John Garamendi (D-CA) for their support of the National Timing Resilience and Security Act of 2018. Representative Garamendi is chairman of the House Armed Services Readiness subcommittee.
Garamendi first introduced legislation in 2016 to address the nation’s need for a GPS backup system. After going through several iterations, it was signed into law in December. The Act requires the Department of Transportation to establish a terrestrial timing system by 2020. Also, that the new system be expandable to one that can be used for location and navigation.
Congress funded a GPS Backup Technology Demonstration through a Department of Defense appropriation in early 2018. The demonstration was intended to be a joint project of the Departments of Defense, Homeland Security and Transportation. A delay in transferring funds from Defense to the other two departments put the demonstration almost a year behind schedule. Now that the project is underway, Transportation Department representatives have said they want to transition directly from the demonstration to deciding upon and implementing the mandated timing system.
At the event, DeFazio remarked that as a boater and hiker he is an avid user of GPS. He mentioned that it is an “ incredible utility, but I also know of its vulnerability. It’s critical to national security and the meaningful movement of everything in the United States of America from airplanes to surface transportation and others … It’s absolutely vital for national security that we get a terrestrial based, hard backup system.” He also noted that Congressman Garamendi has been the driving force for this issue in the House of Representatives.
Speaking about his current role on the Armed Services committee, Garamendi said “The reality is that the military is not prepared for the loss of the GPS signal, and they are just now becoming aware after seven years of beating them over the head saying ‘guys, what are you going to do when you don’t have GPS?’” Garamendi noted that the military would be a big users of the domestic backup system.
He also regretted that after “… years of people saying ‘single point of failure’ for the American economy and system is the loss of GPS” the nation is not farther along to having a backup system.
The RNT Foundation presented the congressmen with plaques showing images of a GPS satellite and a terrestrial transmission tower, and 0ne of America’s “first GPS devices” — a 102-year-old copy of The American Practical Navigator by Nathaniel Bowditch.
Incorporating precise and consistent absolute location information is an essential component of enabling advanced driver assistance (ADAS) and autonomous driving (AD) technology for vehicles.
To help meet this need, Trimble recently released Trimble RTX Auto. The Trimble RTX Auto correction service provides a precise point position (PPP) solution that can be used to correct the position of any auto grade GNSS chipset. RTX Auto works in parallel with other on-vehicle sensors to deliver a positioning solution that satisfies ADAS and AD requirements.
Absolute position contributes to many features:
Lane centering. Systems designed to keep a car centered in a lane, relieving the driver of the task of steering, is often achieved with cameras and absolute position data. Absolute position can be used when lines disappear, or weather prevents them from being seen.
Map aiding. a combination of precise map and location data helps to navigate junctions, lane changes, roundabouts or intersections where lane information is essential to safe driving.
Prediction of future road structure. Both allow a vehicle to begin slowing in advance of a bend in the road and to avoid harsh braking that would happen if the system only relied on short range sensors.
Adhering to the speed limit. This helps drivers anticipate changes in speed limits when a downpour prevents cameras from seeing the speed limit signs or when they might be obscured by natural surroundings or another vehicle.
RTX Auto is both Automotive Safety Integrity Level (ASIL) and Automotive Software Process Improvement and Capability Determination (ASPICE) certified. These certifications validate that Trimble RTX Auto meets functional safety requirements for ADAS and autonomous applications in the auto industry.
Super Cruising. Trimble is on the road today providing RTX-based absolute positioning within General Motors’ Super Cruise driver assistance feature, a hands-free driving system for the freeway. For more information on Super Cruise, visit www.cadillac.com/world-of-cadillac/innovation/super-cruise.
To test the accuracy of the competing satnav smartphone apps, the words ESA and Galileo were traced along ESTEC’s football field. The left side uses single-frequency GPS and Galileo signals, the center uses dual-frequency signals from the two constellations while the right is with precise corrections. The word “ESA” is 15 meters high, while “Galileo” is 7 meters high. (Photos: ESA)
News from the European Space Agency
Europe’s students and young researchers were challenged to design a smartphone app to take advantage of Galileo’s dual-frequency signals. The winning entries should soon be available to the public.
Run by ESA in collaboration with the European Global Navigation Satellite Systems Agency — GSA — plus the European Commission with the support of Google, a total of five teams made it to the final, which took place at ESA’s ESTEC technical heart in the Netherlands.
Following on from last year’s inaugural competition — which has already resulted in the winning app becoming publicly available — this year’s event challenged teams to make use of the dual-frequency capability of the latest smartphones running Android 8.0, including and computing dual-frequency positioning solutions from satnav signals to compare them with their single frequency equivalents. The competition slogan was “Galileo give mE5,” referring to Galileo’s dual E1 and E5 frequencies.
“Galileo give mE5”
The objective of the competition was to reach meter accuracy or less worldwide in unobscured sky, while allowing the user to select Galileo-only positioning, GPS-only positioning and the combination of both on a simultaneous basis, with the potential to include other satnav constellations in turn.
The winner was selected based on technical checks and a jury’s vote. Separate awards were also given to the most innovative app and the winner of a public vote.
The multinational O ThiSaVRoS team — named after the Greek word for treasure — developed the “GNSS Android-based Dual Frequency Iono-estimating Precise Point Positioning” or GADIP3 app.
The multinational ‘O ThiSaVRoS’ team – named after the Greek word for treasure – developed the ‘GNSS Android-based Dual Frequency Iono-estimating Precise Point Positioning’ or GADIP 3 app, winning the ESA-EC-GSA Galileo smartphone app competition 2019. (Photo: ESA)
Winners
The app allows users to perform reliable positioning fixes in real time — selecting which constellations to employ and a choice of single or dual frequency signals — while advanced users can modify the way the positioning is performed, and log all available data for follow-up analysis.
“Our mission goal is to provide precise positioning to everyone,” explained team coordinator Lotfi Massarweh. The O ThiSaVRoS team performed analysis on more than 120 hours of data from stationary, pedestrian and mobile testing to come up with a pre-processing approach involving rejection of signals from low elevation and under a specific signal-to-noise ratio.
The five-person team hail from China, Greece, Italy and Spain, studying at Portugal’s Instituto Superior Técnico Lisboa, Delft University of Technology in the Netherlands, Germany’s Leibniz Universität Hannover and the Universities of Bath and Nottingham in the UK. They worked remotely to develop and test the app over the previous six months.
NavGate allows geo-tagging in augmented reality
The NavGate smartphone app allows the sharing of geo-tags in augmented reality via the phone’s camera, as well as on maps. (Image: ESA)
As their app’s name suggests, O ThiSaVRoS hope to achieve precise point positioning in future, made possible by dual-frequency signal availability, to come close to single-metre-scale precision.
Second place went to the ESTEC-based Team GNSS Tonic’s NavGate app — aimed at bringing people together socially to interesting locations. Users can tag sites of interest to be seen by other people, with the resulting geotags viewable for others either on a map or else directly in augmented reality through their phone’s camera. NavGate could potentially be used for everything from sharing dining recommendations to fishing spots, or meeting up with people during an evening out.
The third prize to the Step with GNSS app by the Romania-based Space Walkers Team, designed to gather data on the paths of users walking outdoors. This game based app is backed up by a server application collecting data from the app users and analysing GNSS performance worldwide or regionally.
Single versus dual frequency
The winner of both the public vote and the most innovative app award went to Universitat Autònoma de Barcelona’s Inari Team and their Inari app.
Inari allows users to select various positioning modes or customise their own, selecting which algorithms and which corrections should be employed as well as specifying constellations and signal frequency. The app can also highlight jamming or spoofing that might be influencing the positioning accuracy.
ESA’s technical evaluation team performed tests of the competing apps in the days running up to the final, including tracing out ESA GALILEO as accurately as possible across the establishment’s football field.
The speaker of the jury, Frank van Diggelen from Google, congratulated the teams on their efforts. “Dual frequency on smartphones is a quite new development, and you really are pioneers in this. The manufacturers are still trying to get things right, and you’re helping them do that bit better. Doing anything for the first time is hard but it’s good to be first, so congratulations for that,” he said.
Galileo smartphone app competition final
The receiver chipsets inside smartphones routinely make use of Galileo in combination with several other satnav constellations — the U.S. GPS, Russian Glonass and Chinese BeiDou. These chipsets function in ‘black box’ style, making the resulting positioning fixes accessible to users, but without giving any option to the user to select which constellation to employ — or information on Galileo’s particular contribution to the phone’s overall positioning performance.
However, in newer Android smartphones it has become possible to access the raw signal measurements used to compute position, opening the door to the development of applications where the user can indeed select which constellations to employ.
The very latest models also allow the use of dual satnav frequencies, giving a major boost to positioning precision. The higher chip rate of the additional frequency allows the chipset to compensate for signal propagation errors from the signals’ journey through the ionosphere — the electrically active outer layer of atmosphere — and reduces false ‘multipath’ detections caused by signals reflecting off buildings.
Photo: Ministry of Defense of the Russian Federation
Israeli security officials publicly accused Russia of disrupting and spoofing GPS signal reception in Israeli airspace throughout the month of June. The electronic warfare at which Russia is known to be adept was reportedly traced to the Khmeimim Air Base in Syria, where Russia maintains and actively flies a large number of warplanes on behalf of the Syrian government. The base is approximately about 350 kilometers (217 miles) north of Ben Gurion, so if the accusation is true, fairly powerful equipment is behind the attack.
Both Israeli and other-nationality airline pilots have reported interruptions in GPS reception during take-off and landing at Tel Aviv’s Ben Gurion International Airport. The Israeli Airline Pilots Association labeled the interruptions a spoofing attack, causing airplane receivers to report false positions.
The International Federation of Air Line Pilots’ Associations issued a Notice to Airmen: “GPS signal loss affects RNAV arrivals and departures and may create numerous alerts for systems that rely on internal position accuracy. Flight Crews should be aware of the potential risk, avoid distractions, and plan for alternative procedures as necessary.”
Pilots have since for the most part relied on Instrument Landing System, a precision runway approach aid based on two radio beams which together with both vertical and horizontal guidance during an approach to land at Ben Gurion International Airport.
The Israeli Airports Authority stated that the GPS attacks affected only airborne crews and not terrestrial navigation systems, and that they occur only during daytime.
The Russian ambassador to Israel has denied the accusations.
In April, a U.S. research institute, the Center for Advanced Defense Studies, documented more than 10,000 separate incidents of GPS disruption on Russian soil, in northern Scandinavia and in the Middle East between February 2016 and November 2018. It said Russia was “pioneering” the technique to “protect and promote its strategic interests.” GPS World summarized the report here, stating that “The Russian Federation is growing and actively nurturing a comparative advantage in the targeted use and development of GNSS spoofing capabilities to achieve tactical and strategic objectives at home and abroad.”
Tie-in with Iran Tensions. Meanwhile the Helsinki Times reported that researchers at the Finnish Geodetic Institute noticed unusual power variations in the GPS signal on June 20 and 21: “an increase of up to 10dBHz in the carrier-to-noise ratio readings comparing with the usual daily values.” Normally the variations are between -0.5 and 0.5 dBHz.
The same findings were communicated to the research community by Peter Steigenberger, senior scientist at the German Aerospace Center, DLR:
“Based on carrier-to-noise density ratio observations (C/N0) of IGS receivers, we observed global flex power operations on June 20 and 21, 2019. Flex power started subsequently for all healthy Block IIR-M and IIF satellites on June 20 between 15:18 and 17:49 UTC. C/N0 of the P(Y)-code tracking increased by roughly 10 dB for all healthy Block IIR-M and IIF satellites whereas C/N0 of the C/A-code decreased by about 2-3 dB for the healthy IIR-M satellites only. The changes in power levels are similar to flex power mode III discussed in “Steigenberger P, Thölert S, Montenbruck O. (2019) Flex power on GPS Block IIR-M and IIF, GPS Solutions, doi:10.1007/s10291-018-0797-8″. All satellites returned to normal power levels on June 21 between 6:00 and 10:00 UTC.”
On June 20, a US military drone was downed down by Iranian missiles. On June 21 President Trump tweeted that he had called off a dawn attack on Iran that day.
Whether the spoofing affecting Israeli airspace has any connection to building tensions 1,500 kilometers to the east is unknown.
Autopilot Navigation Steers Car off Road, Research from Regulus Cyber Shows
The Tesla Model S and Model 3 — electric cars built for speed and safety — are vulnerable to cyberattacks aimed at their navigation systems, according to recent research from Regulus Cyber.
During a test drive using Tesla’s Navigate on Autopilot feature, a staged attack caused the car to suddenly slow down and unexpectedly veer off the main road. Regulus Cyber, the first company to deal with smart-sensor security across a wide range of applications including automotive, mobile, and critical infrastructure, initially discovered the Tesla vulnerability during its ongoing study of the threat that easily accessible spoofing technology poses to GNSS receivers.
The Regulus Cyber researchers found that spoofing attacks on the Tesla GNSS receiver could easily be carried out wirelessly and remotely, exploiting security vulnerabilities in mission-critical telematics, sensor fusion, and navigation capabilities.
Regulus Cyber experts traveled to Europe last week to test-drive the Tesla Model 3 using Navigate on Autopilot. An active guidance feature for its Enhanced Autopilot platform, it’s meant to make following the route to a destination easier, which includes suggesting and making lane changes and taking interchange exits, all with driver supervision.
While it initially required drivers to confirm lane changes using the turn signals before the car moved into an adjacent lane, current versions of Navigate on Autopilot allow drivers to waive the confirmation requirement if they choose, meaning the car can activate the turn signal and start turning on its own. Tesla emphasizes that “in both of these scenarios until truly driverless cars are validated and approved by regulators, drivers are responsible for and must remain ready to take manual control of their car at all times.”
Designed to reveal how the semi-autonomous Model S and Model 3 would react to a spoofing attack, the Regulus Cyber test began with the car driving normally and the autopilot navigation feature activated, maintaining a constant speed and position in the middle of the lane.
Although the car was three miles away from the planned exit when the spoofing attack began, the car reacted as if the exit was just 500 feet away — abruptly slowing down, activating the right turn signal, and making a sharp turn off the main road. The driver immediately took manual control but couldn’t stop the car from leaving the road.
The testing revealed another unexpected finding that significantly amplified the threat—a link between the car’s navigation and air suspension systems. This resulted in the height of the car changing unexpectedly while moving because the suspension system “thought” it was driving through various locations during the test, either on smooth roadways, when the car was lowered for greater aerodynamics, or “off-road” streets, which would activate the car elevating its undercarriage to avoid any obstacles on the road.
Yoav Zangvil, Regulus Cyber CTO and co-founder, explains that GNSS spoofing is a growing threat to ADAS and autonomous vehicles. “Until now, awareness of cybersecurity issues with GNSS and sensors has been limited in the automotive industry. But as dependency on GNSS is on the rise, there’s a real need to bridge the gap between its tremendous inherent benefits and its potential hazards. It’s crucial today for the automotive industry to adopt a proactive approach towards cybersecurity.”
The Regulus Cyber testing is designed to assess the impact of spoofing with low-cost, open source hardware and software, the same kind of technology that is accessible to anyone via e-commerce websites and open source projects on GitHub. Taking control of Tesla’s GPS with off-the-shelf tools took less than one minute.
The researchers were able to remotely affect various aspects of the driving experience, including navigation, mapping, power calculations, and the suspension system. Under attack, the GNSS system displayed incorrect positions on the maps, making it impossible to plot an accurate route to the destination.
Tesla’s response on Model S
Prior to the Model 3 road test, Regulus Cyber provided its Model S research results to the Tesla Vulnerability Reporting Team, which responded with the following points at that time:
Any product or service that uses the public GPS broadcast system can be affected by GPS spoofing, which is why this kind of attack is considered a federal crime. Even though this research doesn’t demonstrate any Tesla-specific vulnerabilities, that hasn’t stopped us from taking steps to introduce safeguards in the future which we believe will make our products more secure against these kinds of attacks.
The effect of GPS spoofing on Tesla cars is minimal and does not pose a safety risk, given that it would at most slightly raise or lower the vehicle’s air suspension system, which is not unsafe to do during regular driving or potentially route a driver to an incorrect location during manual driving.
While these researchers did not test the effects of GPS spoofing when Autopilot or Navigate on Autopilot was in use, we know that drivers using those features must still be responsible for the car at all times and can easily override Autopilot and Navigate on Autopilot at any time by using the steering wheel or brakes, and should always be prepared to do so.
“This is a distressing answer by a car manufacturer that is the self-proclaimed leader in the autonomous vehicle race,” Zangvil commented. “As drivers and safety/security experts, we’re not comforted by vague hints towards future safeguards and statements that dismiss the threats of GPS attacks.”
He offers the following counterpoints in response:
Attacks against any GPS system are indeed considered a crime because their effects are dangerous, as we’ve shown, yet the same devices we used to simulate the attacks are legally accessible to any person, online via e-commerce sites.
Taking steps to “introduce safeguards for the future” indicates that spoofing is, in fact, a major issue for Tesla, which relies heavily on GNSS.
In the case of cars, a spoofing attack is confusing in the best case, and a threat to safety in more severe scenarios.
The more GPS data is leveraged in automated driver assistance systems, the stronger and more unpredictable the effects of spoofing becomes.
The fact that spoofing causes unforeseen results like unintentional acceleration and deceleration, as we’ve shown, clearly demonstrates that GNSS spoofing raises a safety issue that must be addressed.
In addition, the spoofing attack made the car engage in a physical maneuver off the road, providing a dire glimpse into the troubled future of autonomous cars that would have to rely on unsecure GNSS for navigation and decision-making.
Given that the trust of the public still has to be earned as the automotive industry moves towards autonomy, the leading players are accountable for a responsible deployment of new technology.
As Tesla clearly stated, drivers are responsible for overriding autopilot under a spoofing attack, so it appears its auto pilot system can’t be trusted to function safely under a spoofing attack.
Because every GNSS/GPS broadcast system can be affected by GNSS/GPS spoofing, the issue is everyone’s problem and shouldn’t be ignored; furthermore, governments and regulators that have a mandate to protect the public’s safety must engage in proactive measures to ensure only safe GNSS receivers are used in cars.
“According to Tesla, they’ll soon be releasing completely autonomous cars utilizing GNSS, which means that, in theory, an attacker could remotely control the car’s route planning and navigation,” Zangvil said. “We’re obligated to ask what steps they’re taking to address this threat, and whether new safeguards will be implemented in its next generation of entirely autonomous cars.”
Although Regulus Cyber researchers tested only the Model S and Model 3, they concluded that the “disturbing vulnerability” of Tesla’s GNSS system is most likely company-wide, as the same chipsets are used across the Tesla fleet.
“Just a few months ago we saw that during a spoofing incident in a car show in Geneva, seven different car manufacturers complained that their cars were being spoofed. This incident proves that many other automotive companies that are working on the next generation of autonomous cars are also vulnerable to these attacks. As an industry, to win public trust and succeed, every car manufacturer should be proactive and prepare against these threats,” Zangvil said.
