Viavi Solutions has launched the µPNT GDO-1000, a GNSS-disciplined oscillator built in the M.2 B-key form factor, suitable for low size, weight and power (SWaP) platforms.
Measuring 22 x 42 mm (the size of a postage stamp) and weighing less than 4 grams, the GDO-1000 is designed for platforms requiring accurate timing in places where traditional timing modules do not fit or are too power-hungry, including defense and airborne platforms, unmanned systems, data center cards, and communications equipment.
The µPNT GDO-1000 addresses these challenges through a combination of capabilities:
Dual-frequency L1/L5 GNSS reception with microsecond-class 24-hour holdover enables precise, resilient timing in compromised conditions.
The M.2 B-key form factor drops into modern compute platforms, time appliance cards, and embedded systems without custom mechanical design, drawing approximately half a watt.
Patented AI and ML algorithms developed by the Jackson Labs team, now part of VIAVI, predict and compensate for oscillator behavior across environmental conditions
The microelectro-mechanical systems (MEMS) oscillator delivers better thermal stability across the full military temperature range than traditional quartz oven-controlled crystal oscillators (OCXOs), with sustained phase noise and Allan Deviation performance under vibration and shock
It accepts an external 1PPS input, allowing it to be disciplined by M-code GPS, alternative navigation sources, or other external references without hardware modification
Multiple 1PPS and low-phase-noise 10MHz coaxial inputs and outputs for system integration flexibility, despite its miniature size.
The GDO-1000 will be on display by Viavi at booth 407 during the 2026 Joint Navigation Conference, taking place June 1-4 at the Northern Kentucky Convention Center. As part of the event technical program, Lisa Perdue and Nino De Falcis of Viavi will speak on a “New Cesium-Less ePRTC Solution to Provide Timing for Homeland Critical Infrastructure.”
Global corporation VIAVI Solutions Inc. has completed the acquisition of Jackson Labs Technologies, a leader in positioning, navigation and timing (PNT) solutions for critical infrastructure serving both military and civilian applications.
Jackson Labs develops and supplies modules, subsystems and box-level solutions that include front-end receivers, transcoders, rack-mounted equipment, and patented retrofit technology. Their broad customer base includes armed forces, defense contractors, energy distribution infrastructure, low-Earth-orbit (LEO) operators and 5G service providers.
Jackson Labs’ next-generation M-code solutions complement and advance VIAVI’s timing and synchronization portfolio at a time when PNT requirements for defense, space, commercial aviation, transportation and telecommunication networks are expanding and becoming increasingly critical.
“As telecommunications, avionics and mission-critical infrastructure adopt next-generation technology, legacy timing and synchronization protocols are no longer sufficient. Jackson Labs is a trusted provider of PNT solutions in these markets, and we look forward to addressing these opportunities together,” said Oleg Khaykin, president and CEO of VIAVI. “With this acquisition, we are continuing to drive operational scale via the addition of advanced technology and high-performance products that address market segments with strong growth and profitability.”
“Being a part of VIAVI will significantly expand Jackson Labs Technologies’ market reach worldwide, and allow us to further deliver world-class solutions for the rapidly developing PNT landscape as it enters a new era,” said Said Jackson, CEO of Jackson Labs Technologies.
DelMorgan & Co. acted as the exclusive financial advisor to Jackson Labs in connection with the transaction. Terms of the transaction are not being disclosed.
About VIAVI
VIAVI s a global provider of network test, monitoring and assurance solutions for communications service providers, enterprises, network equipment manufacturers, original equipment manufacturers, government and avionics. It helps customers harness the power of instruments, automation, intelligence and virtualization.
VIAVI is also a leader in light management solutions for the anti-counterfeiting, consumer electronics, industrial, government and automotive markets.
VIAVI operates offices throughout North, Central and South America, Europe, Africa, the Middle East, and the Asia-Pacific, including China and Japan.
Simulator vendors explain their evolution in response to changes in GNSS/PNT, comment on technical challenges they face, and outline principal markets.
GNSS receivers — which were never as simple as FM radio receivers or garage door remote controls — are becoming increasingly complex. The causes for this include continuing efforts to:
reduce their size, weight, and power (SWAP)
utilize new signals from up to four GNSS constellations
integrate them with other sensors, such as inertial measurement units (IMUs), cameras, and lidars
take advantage of a growing number of public and private, global, regional, and local correction services
meet the requirements of booming new markets, such as autonomous vehicles
mitigate the threats posed by the proliferation of unintentional and intentional RF interference, the latter better known as jamming, and by spoofing.
In short, receiver manufacturers must constantly adapt to a GNSS/PNT landscape that is, as one of the respondents to this Q&A put it, “ever evolving.”
In turn, the growing complexity of GNSS receivers requires increasingly sophisticated simulators to test receivers and their integrations in controlled conditions before field testing and deployment. Increasingly, this is achieved by replacing with software what was once done in hardware. Simulation remains a vital, though often underappreciated, segment of our industry.
On the following pages, five simulator vendors briefly explain their evolution in response to changes in GNSS/PNT, comment on the principal technical challenges they face, and outline their principal markets.
Spirent Federal Systems’ GSS6450 RF record and playback GNSS simulator is portable, for testing automotive applications in the field. (Photo: Spirent Federal)
Lisa Perdue Product Line Director, Simulation Orolia
OROLIA
How has your approach to simulation changed over the years and in response to what changes in GNSS/PNT?
We have transitioned away from the GNSS simulator approach of using fixed, allocated hardware that we used in our early simulators to the more modern software-defined approach we use today. Given the ever-evolving PNT landscape, it is difficult to design hardware that will support all future GNSS and PNT simulation needs. Instead, we focus on the development of the Skydel software platform, which can then be used with the supported COTS hardware or turnkey system to generate the necessary signals. This gives us the benefit of maximum scalability and flexibility while being truly future proof.
The software-defined approach also allows us to offer Skydel in new and exciting ways. We aim to make PNT simulation accessible to everyone and we can do that through subscription and cloud-based simulation services.
What are currently the greatest technical challenges to GNSS/PNT simulation?
Today GNSS is only a part of the PNT picture. GNSS receivers are often tightly integrated with other sensors and many times the GNSS receiver cannot be isolated to test it on its own. Other sensors must also be stimulated or simulated and included as part of testing. Correction services are becoming more common, but many are proprietary with no public specification. With no common standards available, it can be technically challenging to create a one-size-fits-all test solution.
We tackle these challenges through our plug-in feature. The plug-in architecture allows you to expand the capabilities of Skydel by adding your own features or complex integration with other systems. It allows you to exchange information with the Skydel Engine and even integrates it into the Skydel UI. With our open-source SDK, which includes example plug-ins, you can create your data outputs synchronized to the GNSS simulation, such as IMU or correction services data.
In what markets and applications are your simulators used? Are they used only in labs or also in the field?
At Orolia, we say ‘Skydel Everywhere.’ Skydel is used in applications ranging from military encrypted receiver testing (SAASM, M-Code, PRS) to commercial applications supporting any of the GNSS signals available.
Skydel is used in systems that are found in labs, but you can also find Skydel at an individual engineer’s desk, or even home offices. In the field, Skydel has provided simulation and threat generation capability to authorized test ranges and field test events.
The broadsim software-defined GNSS is powered by Orolia’s Skydel GNSS simulator engine. (Photo: Orolia)
RACELOGIC
Julian Thomas Managing Director Racelogic
How has your approach to simulation changed over the years and in response to what changes in GNSS/PNT?
Over the years, GNSS technology has changed significantly but our approach of identifying a need and creating a solution hasn’t changed since we launched our first LabSat GNSS simulator. We created LabSat because we needed a cost-effective, accurate and easy to use record and replay simulator that we could use for product development and production line testing for our VBOX Automotive and VBOX Motorsport technologies. This need could not be met by any other simulator manufacturer, so we developed our own solution, which in turn became LabSat. Although our approach has not changed, the needs of users, including our own engineers, have, so we continue to develop and improve LabSat to meet these needs.
With the increasing number of satellite launches in market segments such as communication and navigation, the number of requests for testing space-qualified receivers has increased dramatically. To test these kinds of scenarios, we have been making some major upgrades to simulate rocket launches and Earth orbit trajectories that require very different characteristics from land-based simulation.
As the number of constellations and signals has expanded very rapidly, the number of simultaneous signals that need to be simulated has put a far greater requirement on the computing power needed to render them. We have been working very hard on optimizing our routines to make the most of the new breed of high-performance multi-core processors. The result has been a big decrease in the time taken to create a scenario, and an increase in the number of signals that can be simulated in real-time.
What are currently the greatest technical challenges to GNSS/PNT simulation?
The biggest challenge is in simulating a large number of constellations and signals in real-time without using dedicated, expensive hardware to create them. The good news is that with the latest Intel Xeon processors boasting up to 40 cores and 80 threads, a much larger number of signals can now be created in real-time using off-the-shelf PC components.
In what markets and applications are your simulators used? Are they used only in labs or also in the field?
With the global pandemic causing national lockdowns, many engineers switched to working from home. Our largest growth in the simulator market has therefore been due to providing these engineers with a small, low cost, easy to use simulator that they can have on their desks at home, allowing them to continue to develop GNSS applications without having to go into the office. The markets these engineers work within are as varied as the markets that use GNSS technology.
We have also seen a big increase in the use of our simulators to test mass produced satellites used in providing global internet coverage. These satellites are being produced in large volumes, and the need for a low cost, reliable testing method on the production line has driven strong growth in this area.
Our simulators are often used in the field to gather data for in-lab testing, as small size and battery life are very important factors in this environment.
SPIRENT FEDERAL SYSTEMS
Phillip Bonilla Senior Systems Engineer
How has your approach to simulation changed over the years and in response to what changes in GNSS/PNT?
Spirent has provided highly accurate simulation solutions since the early phases of GPS availability, starting with defined hardware for each signal type. As the GNSS landscape has grown, Spirent has worked closely with leading developers, adding key flexibility and functionality to adapt and provide a growing product portfolio. By adopting a robustly defined system architecture, and employing signal-agnostic hardware, Spirent simulators can generate any of the available constellations and frequencies, with no more than a few clicks of a mouse.
While broadening the support for the increasing number of constellations has been a focus, so too has the necessity to provide users with high numbers of available channels and auxiliary simulation needs. To complement GNSS simulation, significant effort is being devoted to resilient application testing, providing users with flexible solutions for introducing jamming and spoofing to the test environment. Our agnostic hardware supports signal generation using software defined radio (SDR), including interference sources and user-defined IQ signal data. As customer demands have grown, alternative RF and PNT sensors have been—and continue to be—incorporated, allowing users an expanded and comprehensive test environment.
The new spirent simulator generates alternative RF navigation signals concurrently with GNSS signals. (Photo: Spirent Federal)
What are currently the greatest technical challenges to GNSS/PNT simulation?
Today, nearly all industries rely on GNSS or other PNT sources to some extent. With such varied and widespread use, laboratory testing is critical, and maintaining the highest levels of accuracy, reliability and robustness remains one of the greatest challenges. For modern hardware-in-the-loop configurations, simulation systems must be able to keep latency consistent to enable powerful post-processing of results. With this challenge in mind, we at Spirent design and manufacture our own hardware, ensuring precision and ultra-low latency.
Another significant test challenge posed by modern applications is the growth in vehicle speed and maneuverability. Creating a truly realistic test environment for supersonic and even hypersonic vehicles with high rates of spin and jerk places huge demands on a simulator. Spirent recently has introduced the industry’s first 2 kHz update rate, enabling the most accurate trajectories for the most mobile technologies.
Lastly, positioning engines are becoming more complex. In addition to GNSS and inertial, vision systems and a range of other sensors and signals-of-opportunity are providing developers greater opportunity for precision and robustness. Therefore, a core part of Spirent’s mission statement is delivering test equipment that is designed to be integrated into wider test benches and ensuring that equipment is always orders of magnitude more accurate than any device under test.
In what markets and applications are your simulators used? Are they used only in labs or also in the field?
Spirent simulators are used in all phases of the product life cycle across nearly all applications. Receiver manufacturers use our solutions beginning with initial research and development, throughout product development, and well into production and field testing. Along with the ability to use Spirent’s simulators for live range testing, Spirent’s GSS6450 record and playback system enables users to record the real world in high dynamic detail for repeatable lab testing.
JACKSON LABS
Gregor Said Jackson President and CTO
How has your approach to simulation changed over the years and in response to what changes in GNSS/PNT?
Initially, we saw a large demand for GPS-only solutions. We are shipping units into this market and it is growing more than 30% year over year for us. Recently, customers are looking to also supporting other constellations. There is an emerging market for LEO simulation capability. Many LEO constellations are becoming reality, such as OneWeb, Kuiper, Starlink, Iridium, Xona, and others, and customers are more frequently asking if we can support these types of signals in our simulators. Demand also is arising for additional base-band signals to accommodate the RF signals, such as synchronized raw IMU data and other observables. Jamming and spoofing signals also are being requested and reproducing these as faithfully as possible is a big challenge for synthesized simulation. Lastly, we see demand rising for mil-type secure applications, such as M-Code, PRS (Galileo) and P(Y) code SAASM of course. The complexity of future simulators will rise in lockstep with the complexity of the RF spectrum coming to us from space.
What are currently the greatest technical challenges to GNSS/PNT simulation?
The STL-1400 positioning and timing receiver is designed for battery-operated low SWaP-C applications. (Photo: Jackson Labs)
A faithful reproduction of the real live-sky RF signals would rank high on this list. There are almost an unlimited number of out-of-band and in-band benign and adversary RF signals on a typical GNSS antenna these days, and more recently the sun has been acting up with solar flare activity that can disrupt GNSS signals. As GNSS receivers mature and become capable of tracking four, five or more carrier frequencies and constellations at once it becomes increasingly challenging to supply these types of signals from a simulator, and at a reasonable price-point. Sometimes, a wideband recording and playback system can do a better job at reproducing live-sky signals, however these systems are limited to playing back the same exact mission over and over again of course, and thus are not very flexible.
In what markets and applications are your simulators used? Are they used only in labs or also in the field?
Our simulators are built for two different applications: the first is a traditional type of GPS signal simulation where a Windows application allows a user to set up static or dynamic scenarios, allows them to upload NMEA playback files, create jamming or spoofing signals, and generally tweak the RF signal in many ways, such as modifying power levels and antenna patterns and even creating space vehicle failures in real time. Our customers range from car, aircraft, and avionics manufacturers, to R&D labs, to the government and academia.
Our simulators also are used for a hardware-in-the-loop application that we call transcoding. It allows glueless retrofitting of existing GPS equipment with any and all the emerging PNT solutions such as LEO positioning and timing, celestial navigation, INS/IMU, CSAC holdover, and concurrent/multi-frequency GNSS using a 1×1-in. transcoder module. Our transcoders fly on Air Force aircraft, are used to retrofit telecom equipment, and allow deep-indoors and underground GPS reception. Transcoders created an entirely new market for simulators.
SYNTONY GNSS
Sylvain Daubas GNSS Simulators R&D Teams
How has your approach to simulation changed over the years and in response to what changes in GNSS/PNT?
Manufacturers of GNSS receivers are targeting more precision and availability, especially in urban areas, which require acquiring more signals from more constellations and greater effort to minimize multipath errors. This confirms that an SDR design for signal generation is decisive to keep systems cost-efficient, as it directly benefits from Moore’s law. For instance, our new RTGS4-12 configuration is about four times more powerful (240 channels) than our previous standard configuration, for a similar budget level.
Regarding precision and RF quality, our simulators benefit from the same RF cards as Echo, our high-fidelity record and playback equipment, with a state-of-the-art RF front end: three channels at a 100 MHz sampling rate and a 16 bit IQ. The capacity to simulate protected signals is also crucial: with PRN Link, Constellator is ready for any present or future signal with encrypted spreading codes.
What are currently the greatest technical challenges to GNSS/PNT simulation?
Building a CRPA simulator is not an easy task, as this requires extreme levels of phase and time synchronization between several RF outputs, typically four, seven or more. This can be done in two ways: with a dedicated new RF board running with a single synthesizer for all channels or using the classical one, to which one should add a complex calibration mechanism. SYNTONY has made the tough choice, investing more at first in a mono-synthesizer version. However, this will benefit our customers, for which the usage will be simplified and it will save them a lot of time by shortening the calibration phase. This version already is available for sale.
On another note, it is a significant challenge to keep our product and its interfaces user friendly while also enabling our clients to configure each of the more than 500 parameters available (at the last count). We also keep in mind that new signals may appear, from LEO constellations for instance, answering to new needs such as autonomous driving. Constellator is HW ready for them, only requiring a software update.
In what markets and applications are your simulators used? Are they used only in labs or also in the field?
Constellator currently is mainly used in laboratories, in many market segments. Because it was initially built in partnership with spacecraft manufacturers, it benefits from the high standards of performance of space industries and includes several advanced space-dedicated features.
On top of the typical usage inside the labs, two other SYNTONY simulator products that are directly derived from Constellator are used in the field:
ECHO Recorder & Playback is used to record the GNSS environment with ultra-high fidelity: today @ 100Mhz, and before the end of 2021 even up to @ 200Mhz. ECHO has been used by our customers in cars, trains and often in aircraft test flights. Another usage of ECHO is to detect and record scintillation phenomena, as we will soon do in Brazil.
SubWAVE (GNSS coverage extension for underground places) allows indoor positioning with precision, directly compatible with standard GPS receivers, which can be crucial for safety or operational reasons. We have installed SubWAVE inside subways stations and tunnels (for example, in Stockholm, Paris and New York), in road tunnels (soon in France, in the “Tunnel du Mont Blanc”), in an underground bus terminal (also in Stockholm), in underground train stations (in Switzerland), and before the end of 2021 also in an underground mine (in Finland).
A roundup of recent products in the GNSS and inertial positioning industry from the September 2020 issue of GPS World magazine.
OEM
Inertial sensors
Includes four models
Photo: SGB Systems
The third-generation Ellipse series has a 64-bit architecture, allowing high-precision signal processing. All of the INS/GNSS devices now embed a dual-frequency, quad-constellation GNSS receiver for centimetric position and higher orientation accuracy. The Ellipse-A is a motion sensor; Ellipse-E provides navigation with an external GNSS receiver; Ellipse-N is a single-antenna RTK GNSS/INS; and Ellipse-D is a dual-antenna RTK GNSS/INS. With its new 64-bit architecture, the third-generation Ellipse series enables the use of high-precision algorithms and technology used in high-end inertial systems such as rejection filters and FIR filtering.
The PNT-6220 Assured Reference combines low-Earth-orbit (LEO) signals, GNSS, terrestrial, wireline and atomic clock services in one small solution for critical infrastructure applications. The PNT-6220 seamlessly combines concurrent L1, L2, L3 and L5 GNSS reception with a LEO-based Satellite Time and Location (STL) timing receiver. It also includes terrestrial receivers and PTP/IEEE-1588 edge grandmaster and PTP/IEEE-1588-slave capability. It provides assured PNT for critical infrastructure applications such as those described in the directives of Presidential Executive Order 13905. It can serve as a timing reference for 5G equipment, an ePRTC-capable reference, or a high-performance disciplined reference that supports PTP/IEEE-1588, STL, RF distribution and multi-frequency GNSS capability. The PNT-6220 can automatically select the most optimal UTC reference input and switch over among its numerous reference inputs if one or more are jammed or spoofed, as well as average several references for additional stability and accuracy.
Jackson Labs Technologies, jackson-labs.com
GNSS Receiver
Integrates correction service
Photo: Septentrio
The AsteRx-m2 Sx OEM board provides a GPS/GNSS receiver with always-on sub-decimeter accuracy without the need for additional correction service subscriptions. GNSS corrections are automatically streamed to the receiver. The integration enables plug-and-play positioning with high accuracy available out of the box. The AsteRx-m2 Sx is an efficient positioning solution for small robots, aerial drones and automation applications. Advanced anti-jamming technology AIM+ ensures robust and reliable operation in challenging environments, even in the presence of RF interference.
The xOEM v3 inertial navigation system includes the architecture from the company’s IP65-encased xNAV v3 as well as a full range of software interfaces, providing integrators maximum configuration flexibility, real-time monitoring, post-processing and analysis. Software interfaces can be customized using the OxTS NAVsuite. Plugins can be created using the company’s NAVsdk, allowing the xOEM v3’s software to be easily packaged and included as part of a product.The high-grade MEMS inertial sensors and real-time kinematic (RTK)-capable GNSS receiver within the xOEM v3 board set deliver high performance capabilities. The board set provides 0.1° heading accuracy, 0.05° pitch/roll accuracy and 2 cm global position accuracy. The board set is compact at 150 grams, which enables manufacturers to seamlessly integrate and build a high-performance INS into their products, such as commercial mapping applications on land and in the air. Its light weight means more payload capacity for other critical components. An add-on lidar georeferencing software package is also available with a sophisticated boresight calibration tool.
The M300 Plus GNSS receiver is designed to supplement the company’s M300 Pro, which is aimed at clients who need a more economical version for their CORS networks. The M300 Plus is also designed for monitoring projects and other applications. By using a powerful, adaptive detecting and canceling technology, the M300 Plus provides enhanced anti-jamming capability, which is critical for a reference station providing reliable GNSS data. Its built-in web server provides remote control of receiver configuration, status, firmware update and data download. It uses a 4G module as an internet backup, enhancing the stability of data connections.
The MQ-8 family — 3D lidar sensors and perception software — are part of Quanergy’s Flow Management platform. Designed with a new smart beam configuration, the MQ-8 solution delivers up to 140 meters of continuous tracking range, enabling up to 15,000 m2 of coverage with a single sensor. It is suitable for flow management applications such as security, smart city, social distancing and smart space industries.
Cesium OSM Buildings expands the company’s suite of Global Base Layers including worldwide terrain, aerial imagery and streetmaps already available. With the new layer, 3D buildings can be visualized, styled and analyzed in an efficient and interoperable manner using 3D Tiles, the open standard developed by Cesium to stream massive 3D geospatial datasets. The layer gives geospatial developers urban context to 3D applications. The buildings are created for efficient visualization and are streamable to any device with 3D Tiles.Cesium OSM Buildings are derived from OpenStreetMap. Buildings are also regularly updated, firmly clamped to terrain, and individually selectable and styleable.
Version 2.1 of Global Mapper Mobile provides updates to both the free and Pro versions. The iOS and Android applications are designed for viewing and collecting GIS data, and provide situational awareness and location intelligence for remote mapping projects. A complement to the desktop version, the mobile app can display all supported vector, raster and elevation data formats. The release improves vector feature styling, terrain layer support and layer transparency setting. In the Pro version, it introduces advanced GPS support, allowing users to connect to external, high-accuracy Bluetooth GPS devices from vendors such as Eos Positioning and Bad Elf. It also allows access to detailed information including the satellite constellation, precise location information and the raw NMEA stream.
The AiRXOS Enterprise Energy Solution provides digital compliance, situational awareness of airspace and assets, inspection, emergency response/disaster recovery capabilities, analytics and asset performance tools in a connected platform. It runs on AiRXOS’ Air Mobility Platform — a secure, cloud-based, extensible platform that enables integration of an energy organization’s current applications and other UAS service suppliers. It brings all UAS lifecycle operations into one view, including infrastructure inspection, asset and crew management, and emergency operations after a natural disaster.
The Xeno FX is a fixed-wing platform optimized for efficient and cost-effective area survey and monitoring missions. Users can program the flight plan before launch to ensure thorough coverage of a target region. The fixed-wing design allows for efficient cruise and maximum time aloft. The Safe Launch protective feature means the propeller starts spinning only after the airframe has been safely hand launched. A quick-change modular payload system allows users to reconfigure their data-acquisition hardware for multiple missions. Constructed of Multiplex’s resilient Elapor foam, the folding wings make for compact storage and easy transport.
The U.S. Department of Homeland Security “did exactly what was required by Congress” in issuing its report in June on positioning, navigation and timing (PNT), according to a letter sent by numerous PNT companies to the DHS.
The July 17 letter to Chad F. Wolf, acting secretary of Homeland Security, refutes a previous letter from Congressional representatives that the report contained numerous errors and failed to address many of the things Congress had required.
“We believe that some key claims made in the members’ letter of June 9 are either exaggerated, irrelevant to the report’s Congressional tasking, or simply wrong,” states the July 17 letter, which is signed by senior executives of Satelles, Orolia, Iridium, Navsys, Jackson Labs, Seven Solutions and Qulsar.
The group takes on the claims of the representatives point by point, finding them exaggerated, irrelevant or incorrect.
For instance, the letter critical of the DHS report states:
“The report focuses on the needs of ‘industry’ largely ignoring the needs and impacts on public services (including first responders), government operations, and individual citizens.”
In response, the industry representatives state:
“The focus of the report, as directed by the NDAA, is on the requirements of the owners and operators of national critical infrastructure. This includes “public services, government operations,” and its beneficiaries, “individual citizens.” To the extent that the report focuses on incentivizing the industry, it is in order for it to be able to meet these requirements.
“While the report only highlights PNT use cases from a subset of the 16 critical infrastructure sectors, their pragmatic recommendations address a range of requirements across all sectors. With respect to PNT needs for backing up GPS, DHS acknowledges the differences between and commonalities among the sectors and offers exceptional guidance for leveraging the capabilities of diverse forms of commercially available alternative PNT rather than endorsing a single, anti-competitive, government-imposed solution.”
The CAST-5000 produces a coherent wavefront of GPS RF signals to provide repeatable testing in the laboratory environment or anechoic chamber. The basic system generates four independent, coherent simulations that reference a single point and is configurable to support up to eight elements for CRPA testing. With an intercard carrier-phase error of less than 1 millimeter, the CAST-5000 is extremely accurate.
The system generates a wavefront of GPS when its GPS RF generator cards are operated in a ganged configuration. Each generator card provides a set of GPS satellites coherent with the overall configuration. Several RF generator cards may be utilized together, ensuring phase coherence among the bank of signal generator cards. The CRPA antenna, antenna electronics and the GPS receiver can be tested as a unit with or without radiating signals.
The CAST-8000 is a new simulator that merges the CAST-5000 CRPA tester with a CAST-3000 EGI tester. The CAST-5000/8000 has the ability to be “ganged” together with additional CAST simulators to provide multiple vehicle and/or multiple antenna test configurations.
The 18-channel miniature full-constellation CLAW GPS Simulator is a fully self-contained, low size, weight, power and cost (SWaP-C) miniature GPS simulator. It is very popular in manufacturing environments as well as R&D applications that require consistent and repeatable local GNSS signals at low price points.The CLAW simulator does not require external computers for processing and control — it works fully self-contained by simply applying power, and storing location/time/date data in internal non-volatile (NV) memory, or by storing complex vector data to simulate highly dynamic scenarios. The CLAW also can be used to transcode NMEA or SCPI position/velocity/time (PVT) data into GPS RF signals. JLT offers an easy to use, highly configurable and cost-free SimCon Windows application program that is downloadable from the JLT website.
The SimConapplication allows random scenario generation and is thus usable to simulate leap-second events, week 1023 rollover events, or any other GPS live-sky scenarios including highly complex yet easy-to-create dynamic vector simulations. For authorized U.S. government users, a version that does not have altitude and velocity limitations is popular for low-Earth-orbit (LEO) simulations. Multipath simulation allows use of the entire 18-channel simulator capability. The unit can be field-upgraded with an easy to use in-field software upgrade feature. The CLAW is also very useful in GNSS receiver sensitivity testing for R&D or mass-production assembly lines as it allows accurate control of RF output power ranging from –100 dBm to less than –130 dBm with 0.1-dB resolution and typically better than 1-dB accuracy over the controllable power range.
The CLAW GPS Simulator also has a built-in RF signal generator with sweep, CW and random noise functions that are useful in simulating GNSS jamming scenarios, as well as GPS spoofing scenarios. The simulator comes in an FCC-certified metal desktop enclosure with numerous accessories.
The Orolia family of GNSS simulators offers a wide breadth and depth of tools for those responsible for mission-critical positioning, navigation and timing (PNT) applications. The simulation tools enable users to test a variety of scenarios, from simple to complex. Orolia’s simulators are feature-rich and easy to use, offering a way to harden GPS/GNSS-based systems without the limitations of testing from live-sky signals. Orolia’s approach allows users to buy only what they need today and upgrade later.
ESSENTIAL
Photo: Orolia
GSG 5/6. An essential scenario-based simulator used for testing a variety of smart applications such as drones, the internet of things (IoT), connected cars, cellular and more. GSG 5/6 offers ease-of-use with an out-of-the-box configuration and comprehensive set of pre-defined scenarios, plus the ability to create scenarios. It can simulate all constellations, all frequencies, and movements/trajectories anywhere on or above Earth. This enables a multitude of test solutions covering accuracies and sensitivities due to environmental conditions, technology factors and other events. Application packages are available for real-time kinematic (RTK), eCall, high-velocity, jamming and sensors.
ADVANCED
Skydel Software Engine. The software behind Orolia’s high-end GNSS simulators: GSG-8, BroadSim, BroadSim Anechoic and BroadSim Wavefront. All share the same software-defined benefits and interoperability. In addition to Orolia’s turn-key systems, Skydel can run on the user’s own commercial off-the-shelf (COTS) hardware. It is suitable to test and validate GNSS systems for a variety of applications, with advanced signal customization and configurable outputs. Users can create advanced scenarios with multiple parameters and variables: antenna patterns, orbits, multipath, hardware-in-the-loop (HIL) and more. The easy-to-use API configures all aspects, available in Python, C#, C++ and LabVIEW. User interactions can be recorded and exported as executable Python script — a learning tool that drastically reduces the automation learning curve.
Photo: Orolia
GSG-8. An advanced software-defined GNSS simulator supporting multiple constellations, frequencies and hundreds of signals all-in-view. With a 1000-Hz iteration rate, high dynamics and real-time synchronization, GSG-8 delivers ultra-high performance and flexibility. It is designed for space trajectories, custom PNT signals, HIL and more. Advanced jamming and spoofing options allow users to create benign and threat scenarios required for critical applications. Complex objects such as Differential GNSS (RTK), multi-antenna vehicles, attitude measurements and sophisticated GNSS receivers can be tested. A comprehensive software development kit (SDK) allows users to incorporate encrypted or proprietary signals. Powered by the Skydel Simulation Engine.
Photo: Orolia
BroadSim. Available through Orolia Defense & Security, BroadSim was designed to meet the demand of NAVWAR testing. BroadSim supports high dynamics, advanced jamming and spoofing simulation tools, and encrypted military codes including Y-code, M-AES and M-MNSA. BroadSim uses a custom Linux operating system for security and better performance. BroadSim excels in NAVWAR applications due to its four independent RF outputs, a wide dynamic range with up to 0 dBm transmit power, and integrated jamming and spoofing scenario creation. BroadSim’s ease-of-use and functionality to configure multiple vehicles allows any user to seamlessly test the performance and vulnerability of their system without requiring a high level of expertise. Powered by the Skydel Simulation Engine.
Photo: Orolia
BroadSim Anechoic. Available through Orolia Defense & Security, BroadSim Anechoic enables users to accurately simulate over-the-air (OTA) GNSS environments in their anechoic chamber. Designed from the ground up for the user, by users, the system has 32 individual RF outputs enabling it to drive 16 dual-frequency antennas. The automation of antenna mapping, time delay and power loss calibration cuts set-up time from days to minutes. Easily verify signals with a built-in spectrum analyzer. The 48-dB transmit chain amplifier and 80-dB transmit chain dial attenuator allow for complete signal control and high dynamic range. Powered by the Skydel Simulation Engine.
Photo: Orolia
BroadSim Wavefront. Available through Orolia Defense & Security, BroadSim Wavefront enables fully featured testing of controlled reception pattern antenna (CRPA) and multi-element antenna electronic systems. Scaled upon the same easy-to-use software-defined platform and interface, it supports 4-16 antenna elements with integrated high dynamics and a phase coherence of 1° σ. Users can simultaneously simulate multiple spoofers, jammers, repeaters and alternate PNT sensors with just a few clicks. The Wavefront makes no compromise between the number of signals and the iteration rate, which remains at 1,000 Hz. It is designed to help engineers deliver results and make decisions, and can be calibrated in a matter of minutes. Powered by the Skydel Simulation Engine.
The LabSat 3 Wideband is a compact yet powerful multi-constellation and multi-frequency GNSS testing solution.
The easy-to-use, one-touch record and replay function provides an efficient way to test and develop GNSS-based technology without the cost and limitations of live-sky signals.
With simple-to-install upgrade options available, customers can invest with the confidence that its capabilities can grow alongside their future requirements.
LabSat 3 Wideband can record and replay up to three different channels at 56-MHz bandwidth across all major constellations and signals including:
GPS: L1/L2/L5
GLONASS: L1/L2/L3
BeiDou: B1/B2/B3
QZSS: L1/L2/L5
Galileo: E1/E1a/E5a/E5b/E6
L-band correction services including SBAS and IRNSS
2x CAN, RS232 and digital inputs tightly synchronized with GNSS data
Future signal launches are also supported, including L2C, L5 and L1C
LabSat 3 Wideband has a removable SSD (up to 7TB) and a two-hour runtime provided by an internal battery. It is lightweight and portable, making it ideal for field testing in any environment.
SatGen Signal Simulation Software
SatGen software allows users to quickly create bespoke, accurate scenarios with their own time, location and trajectory, that can be replayed via a LabSat GNSS Simulator.
The latest version of SatGen can be used to create a single scenario containing all the upper and lower L-Band signals for GPS, Galileo, GLONASS and BeiDou.
Precision-sensitive applications such as autonomous driving, control of unmanned aerial vehicles (UAV), or positioning of aircraft during landing procedures in coordination with ground-based augmentation systems (GBAS) require that modern GNSS receivers undergo detailed tests before implementation.
Rohde & Schwarz signal generators like the R&S SMW200A and the R&S SMBV100B offer a unique approach to generating complex and highly realistic scenarios for testing of GNSS receivers that are able to work with diverse navigational systems such as GPS, GLONASS, Galileo, BeiDou and QZSS/SBAS signals. Both simulators can emulate them all for testing.
R&S SMW200A. The R&S SMW200A GNSS simulator (pictured above) can be used to produce complex interference scenarios with multiple interferers — all generated within the instrument itself. It can emulate up to 144 GNSS channels and can be equipped with up to four RF outputs. With its ability to simulate multi-constellation, multi-frequency, multi-antenna and multi-vehicle scenarios, the R&S SMW200A is able to cover a variety of high-end GNSS applications.
R&S SMBV100B. The R&S SMBV100B supports the same navigational systems, with access to 60 GNSS channels and one RF output, with the same ability to configure realistic scenarios including obscuration, multipath and atmospheric effects, as well as the specific characteristics of the antenna and the simulated vehicle. An integrated noise and CW interference generator also can be added.
Since the devices do not require an external PC for scenario configuration, all the tests can be created quickly through the user-friendly GUI. Due to all-encompassing instrument options available, both simulators can be set up to fit unique user requirements.
For testing GNSS receivers under controlled and repeatable conditions, the R&S SMW200A and the R&S SMBV100B provide extensive and cost-effective solutions. The platforms are ready to adapt to future requirements and testing of newly implemented GNSS signals.
GSS9000, SimMNSA, CRPA test system, anechoic chamber testing, mid-range testing
Photo: Spirent Federal
Spirent Federal provides GPS/GNSS test equipment that covers all applications, including research and development, integration/verification and production testing.
GSS9000. The enhanced GSS9000 Multi-Frequency, Multi-GNSS RF Constellation Simulator is Spirent’s most comprehensive simulation solution. It can simulate signals from all GNSS and regional navigation systems and has a system iteration rate (SIR) of 1000 Hz (1 ms), enabling higher dynamic simulations with more accuracy and fidelity. The GSS9000 supports restricted/classified signals. Users can evaluate the resilience of navigation systems to interference and spoofing attacks, and have the flexibility to reconfigure constellations, channels, and frequencies between test runs or test cases.
SimMNSA. The first fully approved MNSA M-code simulator. Authorized users of the GSS9000 series of simulators will be able to utilize the advanced capabilities of SimMNSA to create more robust solutions for their customers. SimMNSA has been granted Security Approval by the Global Positioning System Directorate.
CRPA Test System. Spirent’s Controlled Reception Pattern Antenna (CRPA) Test System generates both GNSS and interference signals. Users can control multiple antenna elements. Null-steering and space/time adaptive CRPA testing are both supported by this comprehensive approach.
Anechoic Chamber Testing. Spirent’s GSS9790 Multi-Output, Multi-GNSS RF Constellation Wave-Front Simulator System is a development of the GSS9000. The GSS9790 is a unique solution providing the core element for GNSS applications that require a test system that can be used in both conducted (lab) and radiated (chamber) conditions.
Mid-Range Solutions. Spirent also offers solutions that cater to intermediate GPS/GNSS testing needs. The GSS7000 multi-constellation simulator provides an easy-to-use solution for GNSS testing that can grow with users’ requirements. The GSS6450 RF record and playback system enables replay of a real-world GNSS/GPS test repeatedly in the lab.
High-end GNSS simulation solutions for R&D, integration and production testing
Photo: Syntony GNSS
Constellator. Syntony’s GNSS simulator Constellator supports all constellation signals available and provides a high level of service in different ranges. It covers, in a single unit, a wide spectrum of use cases from entry-level with L1C/A up to very demanding configurations such as multi-frequencies and 400 channels management.
Extensively used in aeronautics, space and defense industries, Constellator answers complex requirements:
Standalone mode (on the ground and in space)
Multi-frequencies
All constellations and their signals, including NavIC/IRNSS
Hardware in-the-loop (HIL) mode with zero-effective latency and 1000-Hz update rate
All typical synchronization interfaces
Particularly in the space industry, Constellator implements the advanced models (Earth gravity, drag, 3D ionospheric models, side lobes, etc.) needed to achieve accurate simulations for all kinds of orbits (from LEO to GEO and SSTO). Combined with other Syntony GNSS simulation products (interference generator, Recorder & Player Echo, GBAS simulator, etc.), Constellator can be used to tackle challenging use cases such as jamming, spoofing, multipath, and multiple antennas testing. Constellator is based on a software-defined radio (SDR), making it hardware-ready for future constellations, signals and codes. It is easily upgradeable and versatile.
GNSS Recorder & Player. Syntony’s Echo is an ultra-high-fidelity GNSS recording and playback solution. It is designed to capture real-life signals and environments, for instance from airplanes, and then replayed for R&D or production tests. Echo offers:
3 RF channels of 100-MHz bandwidth each (for the whole set of GNSS signals from all constellations)
16-bit resolution (I&Q)
from 7 to more than 1,000 hours of record/replay capabilities depending on configuration
Echo-R can also record complex and very long realistic scenarios from a simulator; Echo-P can replay them with very high fidelity for long-run or production tests. Please ask Chief Sales Officer Francois Goudenove for distributor contacts in the U.S., Europe, India, China, South Korea and Japan.
This tongue-in-cheek photo, courtesy of Racelogic, underlines how simulators help GNSS engineers “road test” multiple positioning products in multiple scenarios. (Photo: Racelogic)
The number of GNSS signals, the frequency and sophistication of intentional and unintentional threats to those signals, and the need for integration between GNSS and other positioning, navigation and timing (PNT) sources — especially for indoor and autonomous navigation — are continuing to increase, as is the number of new applications for GNSS. In response, manufacturers of GNSS simulators are creating new and improved models able to simulate all these new signals and scenarios.
Additionally, as GNSS chipsets continue to be further commoditized, simulator manufacturers must address the needs of new entrants into the GNSS receiver market that have lower accuracy requirements and require less technical expertise and, therefore, require units that are smaller and cheaper and have simpler interfaces.
No single manufacturer can address the full spectrum of challenges that these trends present. So, while their products overlap in capabilities and SWaP-C (size, weight, power and cost), each one has chosen its market niche and preferred mix of features.
Even on the deceptively simple question of definition (“What is a GNSS simulator?”), the seven manufacturers featured here give different answers, covering the following capabilities:
Simulating GNSS signals as well as inertial navigation data.
Enabling users to test hardware, software and new solutions in the lab before deployment.
Enabling users to test systems under pristine or extreme conditions, including error conditions.
Enabling users to test systems during rare, transitional and prohibited events.
Helping to retrofit existing equipment to new and emerging standards.
Innovations being introduced or developed include:
an anechoic simulator to test continuous radiation pattern antennas (CRPAs).
simulation of a full M-code modernized signal.
software-defined simulators.
increased automation of repetitive tasks.
the capability to record and replay real-world signals.
the capability to record and synchronize data on the conditions faced by a test vehicle.
While the universe of GNSS satellites and receivers continues to grow and evolve, the universe of GNSS simulators is keeping pace — or even a step ahead.
Click on the company to be directed to that section.
John F. Clark, Vice President, Engineering. (Photo: CAST Navigation)
In the lab, simulators allow users to “drive” a piece of equipment through 3D space, performing flight testing or checking equipment integration. Simulators also validate operational flight programs (OFPs) for pilots before they are fielded, to ensure that the software is working correctly.
Innovation. CAST’s latest simulator is the CAST 5000 wavefront generator. It allows users to drive GNSS and interference signals that represent a continuous radiation pattern antenna (CRPA), which consists of multiple, smaller antennas all combined into one unit. In real life, each one of those antenna elements is in a different location; therefore, when they receive signals from a jammer or any of the GNSS satellites, each one will see that signal in a slightly different phase from the other elements. “Our simulator allows us to present signals to these antennas that model the same type of phase differentiation that you see in real life,” Clark said.
Photo: CAST Navigation
Coming Next. CAST Navigation is constantly improving its software based on user feedback. “We are in the process of enhancing our user interface to make it much more powerful but also much simpler to use,” Clark said. Hardware is also being improved, with implementation of the latest available GNSS always on the list.
Looking Ahead to 2022. Jamming and spoofing are becoming more prevalent, not just for the military but also for consumers. Consumers are starting to encounter more instances of jamming, denying their phone the ability to track a GPS satellite or transmitting incorrect GPS data so the solution that their device gives them is not correct. “Our focus is on products and capabilities that help our customers simulate those types of environments and mitigate those kinds of reactions,” Clark said.
Jackson Labs Technologies Inc.
Said Jackson, President and CTO. (Photo: Jackson Labs)
Jackson Labs’ simulators take a position, navigation or timing signal, re-encode it into an RF signal through a GPS simulation procedure, and output a real-time RF signal that encodes the position, navigation and timing (PNT) information, within milliseconds, into an RF signal that can be fed into existing equipment. “We came up with a general-purpose simulator that is basically a no-frills, low-cost, highly accurate, highly stable, highly reliable, extremely small GPS-only simulator,” explained Jackson. “We only provide GPS L1 simulation, to keep the cost of the product down, because GPS L1 C/A code is the only code required to generate an accurate and assured PNT fix, and because we are looking at simulating to embedded systems, where you only need an L1 C/A code simulator.”
Photo: Jackson Labs
Coming Next. Jackson Labs’ simulators don’t require an external computer for data processing or control. That makes it possible for companies like Toyota to plug the unit into a car on the assembly line, and generate RF output that is fed into their GPS-based navigation systems to pass final quality-assurance checks on the production line. Jackson Labs expects to further reduce SWaP-C (size, weight, power and cost) requirements and potentially add other signals. “We are also looking to potentially combine our simulators with other product lines that we have, such as our comprehensive atomic clock product line,” Jackson said.
Looking Ahead to 2022. Jackson predicts that the sector will split into two paths: an industrial sector with units for manufacturing and deployment, and companies that introduce emerging GNSS systems at much lower price points, smaller SWaP, and with more modular deployment. Inertial navigation systems (INS) are critical for autonomous driving and assured capabilities during spoofing and jamming events, Jackson said. “It is not possible today to very easily simulate INS units.There is a market for innovation in terms of integrating what the military calls ‘assured PNT,’ which includes things like dual navigation.”
Orolia
Stéphane Hamel, Director, Testing and Simulation. (Photo: Orolia)
According to Orolia’s Hamel, a simulator’s purpose is two-fold: first, it must reproduce threats and second, it must prove the solution is working.
Innovation. When Skydel Solutions joined Orolia in March, it brought a professional software-defined simulator that makes possible fast prototyping and development cycles. It integrates advanced interference simulation and can simulate hundreds of threats simultaneously. “When you want to do a repetitive step, automation is the key,” Hamel said. “Our simulator can teach you how to automate, just by clicking on a button and generating source code.” In 2018, Skydel introduced an anechoic simulator to test Controlled reception pattern antennas (CRPAs). Also new is a waveform simulator, so CRPA units can be tested in a conducted (rather than radiated) way.
Image: Orolia
Coming Next. In the next three years, Orolia is looking at adding Galileo PRS, GPS M-code, or the next-generation signal. “Being software-defined means that we are very flexible and we can allow our partners to develop their own plug-ins,” Hamel said. “They can build custom signals, restricted or modernized signals. Our simulator will take care of the dynamics of the signal and our partners can focus on the characteristics of the signal, or the things that are secret, classified, or if they simply want to protect their IP.”
Looking Ahead to 2022. Resilience to serious spoofing and jamming threats is high on Orolia’s list, as well as ensuring secure or valid positioning, navigation and timing (PNT) in GPS-denied environments. Alternative signals, sensors and increased complexity require a simulator to address all of these. Companies that develop complex proprietary hardware platforms will be challenged to keep up with the increasing complexity. and a software-defined approach will be an advantage.
Racelogic’s first LabSat was a recorder with player — the signals were recorded outside, and then replayed in the lab. Racelogic’s simulators now also provide simulation of the signals using software to generate the signals as though they are being sent by the satellites.
Innovation. In 2018, Racelogic introduced the LabSat wideband, which uses the company’s SatGen software. It records at 56 MHz and up to 6 bits of resolution and streams the data to an internal SSD hard drive. It can also replay real-world simulations or ones generated with SatGen. For the automotive world, it records and replays signals such as CAN, RS232, RS485, IMU and other data channels, synchronizing them at the same time. VBOX allows users to record and replay video with the perfectly synchronized recording made on the LabSat. “You see exactly the kinds of conditions of the test vehicle or person who has been subjected to the test,” Thomas said.
Photo: Spirent
Coming Next. Racelogic is providing wider bandwidth, greater bit depth, and multiple channels in a small battery-powered device that records even more signals, including lidar, EtherCAT (an automotive Ethernet format) and CAN-FD (a faster version of the CAN format). It will be able to synchronize with multiple video cameras instead of just one in high resolution. “It is basically the same as what we are selling, but on steroids, and at a very similar price point,” Thomas said.
Looking Ahead to 2022. With multi-GNSS going mainstream, both chip manufacturers and simulator manufacturers will be challenged by the cost of test equipment. Chip makers need to be able to test the new signals on their production lines, while simulator makers will need to provide devices at a price point and ease of use for customers with less stringent or slightly less technical requirements. “They need a simpler interface and a smaller, cheaper unit,” Thomas said.
Rohde & Schwarz
Markus Irsigler, Product Manager, Signal Generators. (Photo: Rohde & Schwarz)
An increasing number of GNSS applications depend on multi-frequency GNSS.
Innovation. In response, Rohde & Schwarz added multi-frequency test capabilities to its entry-level and mid-range test solutions. “We have launched a new GNSS simulator based on the new mid-range vector signal generator R&S SMBV100B,” Irsigler said. A simple and flexible option concept allows users to turn the instrument into a full-featured and powerful GNSS signal source. It addresses a wide range of test applications, from single- and multi-frequency production testing to multi-frequency receiver characterization. The instrument can be equipped with an internal noise generator that allows users to simulate GNSS plus noise or CW interference without using additional external hardware.
Photo: Rohde & Schwarz
Coming Next. GNSS test solutions from R&S are based on general-purpose vector signal generators. With this approach, GNSS and other signals can be generated at the same time in the same instrument allowing coexistence and interference testing without additional external signal sources. As this results in test solutions that are compact and very flexible to use, R&S will continue to use this approach for upcoming product upgrades and enhancements as well as for its next generation of GNSS test solutions. The company’s upcoming activities will mainly focus on the high-end segment, where the R&S SMW200A with up to 4 RF outputs and up to 144 channels addresses multi-antenna and multi-vehicle GNSS test applications.
Looking Ahead to 2022. With the safety demands of autonomous driving or aircraft landing procedures, multi-frequency testing will become standard. Because such applications must be sufficiently robust against spoofing and jamming threats, there will be an increasing need to test navigation systems against such influences. “Simulating GNSS alone is not enough,” Irsigler said. “Test solutions for autonomous driving will require several other techniques and signals to be applied or simulated, such as RTK/PPP or outputs from other vehicle sensors to perform sensor fusion.”
Spirent Federal Systems
Roger Hart, Director of Engineering. (Photo: Spirent)
Spirent’s simulators test with “real-world” signals as well as allowing tests under pristine conditions or under extreme conditions that may never occur in the real world, including error conditions.
Innovation. In December 2018, Spirent released the SimMNSA, which provides a full M-code modernized signal solution. Until now, the GPS Directorate limited M-code simulation to either pseudo-M-code, which provides the same spread-spectrum but uses a commercial encryption standard, or a system of playing back a canned set of M-code limited to certain satellites and dates and times. With the policy change, Spirent can now implement M-code based on the modernized Navstar security algorithm (MNSA), and now offers both an M-code solution with the SimMNSA and a full Y-code with the SimSAAS.
Jeff Martin, Director of Sales. (Photo: Spirent)
Coming Next. Spirent plans to provide customers an increased channel count to help test multi-constellation, multi-frequency receivers against multipath, jamming and spoofing. “We are in a period of intense development in terms of AVs, UAVs, and so forth, which don’t use GNSS exclusively,” Hart said, explaining that Spirent is working on testing of GNSS/sensor-fusion platforms.
Looking Ahead to 2022. “As new interface specifications are released, we are proactive in developing new signals,” Hart said. Spirent also is supporting efforts to achieve assured PNT solutions. It is investigating interference-mitigation techniques such as algorithms, directional antennas, and other anti-jam technologies. Signal authentication is another need. “As the systems are becoming more integrated and networked, we are conscious of cyber-security threats and are looking in that area,” Hart said.
Photo: Spirent
Syntony GNSS
Cyrille Gernot, GNSS Receiver Development and Product Manager. (Photo: Syntony GNSS)
GNSS receiver manufacturers use simulators to ensure that their products are robust in challenging situations that can’t be clearly assessed using real-world data. “That’s where the GNSS simulator comes into play,” Gernot said, “by offering controlled and repeatable scenarios.”
Innovation. Syntony’s new pseudo-random-noise code (PRN code) server allows the GNSS simulator user to dynamically send the pseudo-random sequence modulating a carrier. It is especially useful for testing encrypted signals such as the GPS military signal or the IRNSS RS signal. “Access to encryption keys is extremely difficult for a simulator manufacturer to obtain,” Gernot said. “However, the simulator does not actually need to have knowledge of those encryption keys; only the resulting pseudo-random sequence to modulate is required.” The Syntony PRN server allows users to dynamically input their own pseudo-random sequences to be modulated on the target carrier into the simulator.
Coming Next. Syntony’s next simulator will simulate spoofing and synchronous multi-antenna signals for CRPA and antenna network testing.
Photo: Syntony GNSS
Looking Ahead to 2022. As the threat of spoofing and jamming increases, the receiver industry will have to develop countermeasures and mitigation strategies. One of the best methods remains the use of antenna arrays, Gernot said. “Antenna arrays allow for spatial discrimination that is especially efficient to counter spoofing, jamming or unintentional interferences.To meet the industry’s future demands, Syntony is already working on accurate simulation of antenna arrays while accounting for inherent errors such as inter-antenna phase and amplitude offsets and overcoming obstacles, including phase coherency at the output of the simulator RF channels.”
Architecture of the X-Survey antenna. (Image: Harxon)
Blocking interference
Interference can be blocked at the data-collection stage, using an advanced antenna.
Harxon’s X-Survey is a compact high-precision GNSS antenna. It provides superior navigation and communication performance in surveying applications. A frontal band-pass filter setting effectively rejects out-of-band signals before they enter the low-noise amplifier of the antenna for signal augmentation.
Meanwhile, the filter itself has insertion loss, making a low insertion loss filter a prerequisite for optimal system noise reduction. To avoid this situation, X-Survey employs ceramic filter with low signal loss and in-band flatness to significantly improve system anti-interference capability and ensure reliable signal receiving.
The mosaic module provides AIM+ mitigation technology. (Image: Septentrio)
Septentrio began to tackle the interference problem more than 20 years go, designing and manufacturing high-precision GNSS receiver technology with emphasis on reliability and robustness. The result is Advanced Interference Monitoring and Mitigation (AIM+) technology which secures the company’s GNSS receivers against jamming and spoofing interference. AIM+ has recently been upgraded with an extended anti-spoofing functionality.
Building on its existing spoofing detection, Septentrio has developed a new anti-spoofing algorithm for its commercial receivers. The algorithm leverages Galileo Open Service Navigation Message Authentication (OSNMA) for spoofing resistance. It was developed in the framework of the GSA FANTASTIC project with the goal of improving the security of timing in critical infrastructure.
Mobile devices and cloud applications increasingly rely on GNSS technology used by telecom companies. Having secure and robust GNSS receivers in telecom infrastructure is key to reliable mobile and positioning services.
Alternative signals
Prototype design of the PNT-5500. (Image: Jackson Labs)
A new reference receiver, Jackson Labs’ PNT-5500, includes a custom Satelles/Iridium (STL) and GPS receiver, and an optional Edge Grandmaster/PTP1588 capability.
Using STL signals received directly through a small antenna mounted on the device, the PNT-5500 provides nanosecond timing synchronization in GPS-challenged environments, including deep indoors (no rooftop antenna required). It provides secure timing during GPS jamming and spoofing events. The unit is designed for high-volume, low-cost telecom small-cell synchronization, and is optionally available with holdover oscillators such as DOCXO and CSAC atomic clocks.
While GPS is vulnerable to jamming and spoofing, the PNT-5500 uses the Iridium infrastructure to provide assured timing that is impervious to spoofing and provides 1,000X higher signal strength compared to GPS, producing jamming resilience and deep-indoor reception. The system is designed to be fully interoperable with legacy equipment, for a low-cost, fully-deployed Assured PNT capability alternative to GNSS today.
Assessing vulnerability
Image: Qascom
Qascom offers several robust PNT services and products, including vulnerability assessment, robust navigation and interference localization.
Vulnerability assessment is the key proactive measure, using cutting-edge signal generators to design and test tomorrow’s receivers. For example, Qascom’s QA707 GNSS simulator tests receivers against emerging jamming and spoofing threats, allowing OEMs to discover in advance any potential vulnerability that may affect the availability and the integrity of the signal.
Robust navigation is supported by advanced mitigation algorithms, equipped with pre and post-correlation algorithms, as well as the inclusion of sensor fusion and dead-reckoning features.
Qascom’s attack detection products include external monitoring networks that support GNSS receivers. These networks provide an accurate perception of the operational environment, allowing threat characterization, classification and forecast. For instance, Qascom’s QB100 enables the simultaneous threat detection and localization by means of a monitoring cluster that delivers 24/7 situational awareness to a set of target receivers within the protection area.
Reliable timing
Meinberg provides GNSS timing solutions for nearly every application type. Its reliable systems are based on firmware built from the ground up by an in-house team of expert engineers. All Meinberg firmware is constantly checked and updated to ensure it adapts to evolving industry standards.
The company’s synchronization systems use a built-in Meinberg GPS receiver or combined GPS/GLONASS clock. They also support a broad range of reference time sources, including 1 PPS, 10 MHz, inter-range instrumentation group time codes (both direct current level shift and amplitude modulated), or network time protocol (NTP) servers. This redundancy in synchronization sources means Meinberg’s systems are protected against a loss of signal. Furthermore, to ensure the correctness of the reference time and date, an intuitive Secure Hybrid System (SHS) feature includes an independent secondary clock for enhanced plausibility checks.
For superior holdover performance, the Meinberg XHERB (with one or two Rubidium modules from Stanford Research) can be added to the Meinberg Intelligent Modular Synchronization (IMS) time and frequency systems. If the reference clock loses its sync source, the XHE chassis will provide the sync reference for the IMS chassis based on its holdover performance.
The CAST-5000 produces a single coherent wavefront of GPS RF signals to provide repeatable testing in the laboratory environment or anechoic chamber. The basic system generates four independent, coherent simulations that reference a single point and is upgradeable to support seven elements for CRPA testing. With an intercard carrier- phase error of less than 1 millimeter, the CAST-5000 is extremely accurate.
The system generates a wavefront of GPS when its GPS RF generator cards are operated in a ganged configuration. Each generator card provides a set of GPS satellites coherent with the overall configuration. Several RF generator cards may be utilized together, ensuring phase coherence among the bank of signal generator cards.
The CAST-5000 Controlled Reception Pattern Antenna (CRPA) tester allows a full end-to-end test of the antenna system. The CRPA antenna, antenna electronics and the GPS receiver can be tested as a unit with or without radiating signals.
The CAST-8000 is a new simulator that merges both the CAST-5000 CRPA tester with a CAST-3000 EGI tester.
The tiny 1-inch square Micro-Transcoder module allows glueless retrofitting of existing GPS equipment with secure and Assured-PNT (A-PNT) capability. It is the smallest, full-constellation, stand-alone, real-time 10-channel GPS simulator available from JLT. The unit is useful in upgrading existing legacy GPS receivers with external position, navigation and timing references such as INS, CSAC, SAASM, M-code, GNSS, eLoran or other alternative positioning and timing sources by simply replacing the legacy GPS antenna from an existing GPS system with the Micro-Transcoder RF output.
The unit is based on the JLT CLAW GPS Simulator and RSR Transcoder technologies, and includes a general-purpose, stand-alone, full-constellation, 10-channel, real-time GPS simulator with integrated high-stability timing reference, as well as an internal GNSS receiver for monitoring the RF output signal for quality and accuracy. The unit will transmit a standard UTC time, position, velocity and heading GPS L1 C/A RF signal by simply applying 3.3V power to it.
The Micro-Transcoder can also be operated as a generic GPS simulator with built-in GPS Disciplined Oscillator (GPSDO), and is supported by a free Windows application downloadable from the JLT website. The Windows application allows control of all the simulation aspects, creating and storing simulation vector commands and testing user equipment for leap-second and GPS week rollover event compatibility to identify weaknesses in user equipment. The unit does not require a connected PC to function. The Micro-Transcoder is also available mounted onto an evaluation board for easy evaluation. The unit transcodes baseband PNT NMEA signals into a GPS L1 RF signal with typically less than 100-ms latency. UTC 1PPS timing-transfer accuracy to the GPS RF output is typically better than 5 ns. The unit requires only 3.3V to operate, and setup, location and simulation vector file information can optionally be stored in its internal NV memory.
For those responsible for mission-critical PNT applications, the Orolia GSG series of GPS/GNSS simulators is an important tool to evaluate risk for jamming, spoofing or any other threat. Orolia GSG-5/6 series simulators are easy to use, feature-rich and affordable, offering a way to harden GPS-based systems without the limitations of testing from “live sky” signals. The Orolia platform approach allows customers to buy only what they need today and upgrade later. The adaptability of the GNSS RF generation platform can extend to applications for intelligent repeating.
Test Solutions
Position accuracy and dynamic range/sensitivity
Simulate movements/trajectories anywhere on or above Earth
Sensitivity to GPS impairments: loss of satellites, multipath, atmospheric conditions, interference, jamming and spoofing
Conducted or over-the-air RF
GPS time-transfer accuracy
Effect of leap-second transition
Multi-constellation testing
Modernization signals/frequencies
Keyless military SAASM, dual-frequency and survey-grade receiver testing
Infrastructure possibilities include zone-based indoor location (intelligent repeating) and pseudolite applications.
GSG-6 Series 64-channel multi-frequency, advanced GNSS simulator is powerful enough for any cutting-edge test program. GPS, GLONASS, Galileo, Beidou, QZSS and NAVIC (IRNSS) signals are available across multiple frequencies. The GSG-6 is designed for military, research and professional applications.
GSG-5 Series 16-channel multi-constellation L1-band GNSS simulator is designed for commercial development/integration programs. It is for developing commercial products with GNSS capability, and will shorten test programs with confidence.
GSG-51 single-channel signal generator is designed for one purpose — fast, simple go/no-go manufacturing test and validation, ensuring the manufacturing line is operating at full capacity with confidence in quality.
Specifically designed for testing GNSS interferences and cyber-attacks. QA707 has been designed to test robustness against emerging cyber-threats beyond jamming and spoofing. It allows the creation of scenarios with signal and code jamming, data-level cyber-attacks, denial of service threats, low-level spoofing channels control, and trajectory-controlled spoofing.
Optimal for signal modernization design. Being a flexible software defined radio (SDR) solution, QA707 is also suitable for testing of signal modernization and for the simulation of new signal components. An open API is provided to create specific signals simulation. Particularly, the tool is ready to support the upcoming Galileo Open Service Authentication (OSNMA).
Runs on a standard PC or laptop with USRP or other hardware. QA707 is compatible with several third-party hardware RF up-converters, including National Instruments’ USRP. It also can support customer’s specific hardware through the hardware API interface. Qascom introduces the new frontier of GNSS security testing. QA707 is supported from back office with custom services as well as jamming and spoofing mitigation solutions for receivers and applications. This covers 100% of customer GNSS security needs.
QA707 Main Features
Multi-constellation (GPS L1, Galileo E1, SBAS L1)
Galileo OSNMA ready
RF simulation, binary file dump, signal record and replay
Support to SDR platforms and open API for custom RF upconverters
The LabSat 3 Wideband is easy to use, cost-effective and produces extremely low noise, accurate and repeatable signals. Users can record and replay up to three different channels at 56 MHz with a bit depth of up to 3 bits I and 3 bits Q.
The following signals can be recorded and replayed:
2X CAN, RS232, and digital inputs recorded and replayed tightly synchronized with GNSS data
Small, battery or mains powered and with a removable SSD (up to 4 Tb), LabSat 3 Wideband allows detailed, real-world satellite data to be recorded then replayed on the bench. The rugged enclosure measures a compact 167 x 128 x 46 millimeters and weighs 1.2 kilograms, meaning it can be placed in a backpack and used to reliably record real-world signals in almost any situation.
SatGen Signal Simulation Software
If a user wants to simulate the signals from scratch, Racelogic’s latest SatGen signal simulation software can produce synthesized scenarios containing the full complement of popular GNSS signals: GPS L1, L2C, L5, GLONASS L1, L2, Galileo E1, E5, E6 and BeiDou B1, B2.
SatGen software allows users to quickly create accurate scenarios with their own time, place and trajectory, with any combination of constellation and signal that is currently available or will become available in the near future.
Precision-sensitive applications such as autonomous driving, control of unmanned aerial vehicles (UAV), or positioning of aircrafts during landing procedures in coordination with ground-based augmentation systems (GBAS) require that modern GNSS receivers undergo detailed tests before implementation.
Designed to generate highly realistic test scenarios, Rohde & Schwarz signal generators like the R&S SMW200A and the R&S SMBV100B offer a unique approach to generating complex and highly realistic scenarios for testing of GNSS receivers that are able to work with diverse navigational systems such as GPS, GLONASS, Galileo, BeiDou and QZSS/SBAS signals. The R&S SMW200A and the R&S SMBV100B can emulate them all for testing.
R&S SMW200A
The R&S SMW200A GNSS simulator (pictured above) can be used to produce complex interference scenarios with multiple interferers — all generated within the instrument itself. It can emulate up to 144 GNSS channels and can be equipped with up to four RF outputs. With its ability to simulate multi-constellation, multi-frequency, multi-antenna and multi-vehicle scenarios, the R&S SMW200A is able to cover a variety of high-end GNSS applications.
R&S SMBV100B
The R&S SMBV100B supports the same navigational systems, with access to 24 GNSS channels and one RF output, with the same ability to configure realistic scenarios including obscuration, multipath and atmospheric effects, as well as the specific characteristics of the antenna and the simulated vehicle. An integrated noise and CW interference generator can also be added.
Since the devices do not require an external PC for scenario configuration, all the tests can be created quickly through the user-friendly GUI. Due to all-encompassing instrument options available, both simulators can be set up to fit unique user requirements.
For testing GNSS receivers under controlled and repeatable conditions, the R&S SMW200A and the R&S SMBV100B provide extensive and cost-effective solutions. The platforms are ready to adapt to future requirements and testing of newly implemented GNSS signals.
SDX is a proven and advanced GNSS simulator based on GPU-accelerated computing and software-defined radio (SDR).
It is available as a complete turnkey system suitable for all GNSS simulation needs, including everything from compact test benches to complete CRPA test systems, such as SDX wavefront and SDX anechoic. Moreover, its software-defined roots enable the selection of cost-effective hardware into configurations that can be repurposed for different projects.
The architecture behind SDX provides real-time simulation of uncompromising accuracy. It features advanced signal customization and supports configurable outputs. IQ data can be generated in, or imported back into, the simulator as well. The API is embedded in the simulator core, enabling deep automation with a few simple clicks, as well as complex scripts developed with popular programming languages.
SDX simulates multiple constellations on multiple frequencies (GPS, Galileo, GLONASS, BeiDou and SBAS) on a large number of channels. Encrypted codes are supported for GPS and Galileo.
The Advanced Jammer module in SDX gives users complete control over interference creation. It is integrated directly into simulation scenarios to enable dynamic jammers (up to 120dB J/S) to interact with GNSS signals.
SDX also allows users to create advanced scenarios suitable for any type of vehicle: antenna patterns (receiver and GNSS SV), LEO/GEO/HEO orbits, multipath, hardware-in-the-loop (HIL), additive pseudorange errors, message modification and corruption, raw logging and more.
It is suitable for the design and validation of GNSS receivers, complex integration, academic research, NAVWAR and test engineering.
SDX is developed and actively supported by Skydel’s engineering teams and worldwide distributors. Skydel offers direct support to clients to ensure prompt deployment and integration, or to review advanced customization requirements.
GSS9000, SIMMNSA, CRPA Test System, anechoic chamber testing, mid-range testing
Photo: Spirent
Spirent Federal provides GPS/GNSS test equipment that covers all applications, including research and development, integration/verification, and production testing.
GSS9000. The Spirent GSS9000 Multi-Frequency, Multi-GNSS RF Constellation Simulator is Spirent’s most comprehensive simulation solution. It can simulate signals from all GNSS and regional navigation systems and has a system iteration rate (SIR) of 1000 Hz (1 ms), enabling higher dynamic simulations with more accuracy and fidelity. The GSS9000 supports restricted/classified signals. Users can evaluate the resilience of navigation systems to interference and spoofing attacks, and have the flexibility to reconfigure constellations, channels, and frequencies between test runs or test cases.
SimMNSA. SimMNSA allows authorized users to simulate true M-code for the first time ever. SimMNSA has been successfully delivered to users of the GSS9000 series simulator. SimMNSA has been granted Security Approval by the Global Positioning System Directorate.
CRPA Test System. Spirent’s Controlled Reception Pattern Antenna (CRPA) Test System generates both GNSS and interference signals. Users can control multiple antenna elements. Null-steering and space/time adaptive CRPA testing are both supported by this comprehensive approach.
Anechoic Chamber Testing. Spirent’s GSS9790 Multi-Output, Multi-GNSS RF Constellation Wave-Front Simulator System is a development of the GSS9000. The GSS9790 is a unique solution providing the core element for GNSS applications that require a test system that can be used in both conducted (lab) and radiated (chamber) conditions.
Mid-Range Solutions. Spirent also offers solutions that cater to intermediate GPS/GNSS testing needs. The GSS7000 multi-constellation simulator provides an easy-to-use solution for GNSS testing that can grow with users’ requirements. The GSS6450 RF record & playback system enables replay of a real-world GNSS/GPS test repeatedly in the lab.
A scalable software-defined simulation platform powered by Skydel’s SDX, capable of generating high-fidelity GNSS and jamming signals simultaneously across multiple constellations and vehicles. Simultaneously simulate every signal below:
BroadSim’s software-defined platform includes intuitive user control and APIs; fast development cycles; flexible licensing and upgradability; and no additional hardware needed to maintain.
Forms
Original (4U)
Rack-mounted 4U simulator used for lab or field testing
4 RF outputs (unlimited jamming signals generated on 1)
1000-Hz simulation iteration rate
High-performance processor, GPUs and memory
Anechoic
Simulation system used for anechoic chamber testing
32 RF outputs and 16 dual-frequency antennas
Automatic antenna mapping
Automatic time delay and power loss calibration
Wavefront
Phase coherent simulation system
Real-time automated phase calibration
Scalable from 4 to 16 elements
Supports CRPA and multi-element receiver testing
Supports jamming and spoofing
Panacea
An automated PNT performance and vulnerability test suite that supports up to 32 UUTs (units under test) in real time, from test plan creation to post-test evaluation.
Time synchronization to live sky
Compatible with 100+ different GNSS receiver brands
Create dynamic scenarios with parameters such as jamming patterns, motions, power loss, delays and more.
Manages receiver communication and standardizes data output for easy analysis, visualization and reporting
Jackson Labs Technologies has released the latest upgrades to its GPS simulator and transcoder product line.
Screenshot: Jackson Labs
The latest version of freeware application SimCon rev. 1.20 is now available. New features include:
Single-button GPS Week Number Rollover testing to test when GPS receivers will fail (hardly any will fail April 6; most older units will fail sometime between now and 2025).
Single-button GPS receiver leap second testing: Some GPS receivers might have an issue operating properly when the next leap second happens after the upcoming April 6 week number rollover, and SimCon makes that trivially easy to check.
Additional support for modern external GNSS receiver NMEA sentences for transcoding such as $GNGGA, $GLGGA, etc.
Improvements in GPS receiver switchover performance when switching from a fully GPS-denied area (running from INS) to GPS-available while transcoding in aircraft and vehicles.
This was fine-tuned based on extensive flight tests with the Navy/Air force.
Added support for the new Micro-Transcoder with its new Eval board.
Photo: Jackson Labs
Jackson Labs also announced a new product line, the PhaseStation ADEV Frequency Stability phase noise test system (signal source analyzer).
The test system is:
useful in testing signal performance in a host of products such as GPS or GNSS disciplined oscillators.
useful to qualify and evaluate local oscillator (LO) performance for GNSS receiver design, including GPS TCXO evaluation and parametrization.
stability measurements of 1PPS and arbitrary frequency outputs from GNSS receivers
useful in optimization of GNSS receiver Kalman filter design via the GNSS receiver 1PPS output signals.
automatically synchronizes and syntonizes (calibrates) the internal dual oscillator DOCXO option to external GNSS receivers via 1PPS input.
Jackson Labs Technologies Inc. (JLT) is offering the CLAW GPS/GNSS simulator. Designed with small size, weight and power (SWAP), the CLAW is only slightly larger than a standard deck of cards.
CLAW targets applications that require small, low-power and low-cost GNSS synthesis with repeatable and highly accurate GNSS RF signals such as production testing of GNSS receivers, simulating GNSS anomalies such as leap-second events, 1023 GPS Week roll-overs, simulated operation in inaccessible locations around the world, real-time transcoding of different GNSS systems, and testing using dynamically user-configured RF signal levels.
With nanosecond-accurate encoding, CLAW is particularly suited to allow easy stress-testing of GPSDO frequency and timing reference products such as JLT’s GNSDOs under various different mission scenarios, the company said.
The CLAW GNSS simulator is a no-frills solution that contains real-time processing hardware to simulate GPS constellations without the need to connect any external equipment other than a USB power source or power supply.
Providing a real-time computed RF output signal rather than an offline file-playback differentiates CLAW from competitive solutions that are only capable of recording and playback operation in non-real-time, or require offline computation of data files using external computers that are played back on the simulation device.
CLAW is a completely self-contained, ruggedized, miniature, real-time hardware GPS simulator.
Navigation coordinates and 1PPS timing pulses can be provided in real-time through the NMEA and SCPI compatible USB interface or via the built-in RS-232 interface, and are encoded in the CLAW into RF GPS signals in real-time with nanosecond-level accuracy and minimal delay.
Position, velocity and timing (PVT) information may be provided as a simple NMEA stream from an external source such as an inertial navigation system (INS), Galileo/GLONASS/BeiDou/SAASM GNSS receiver, and CLAW will encode this PVT data into standard L1 C/A GPS RF signals in real-time with minimal phase/position shifts. This allows real-time GNSS transcoding of any other GNSS standard simply by connecting an external GNSS receiver, INS system or PVT source to the RS-232 inputs of the CLAW, allowing retrofit of existing legacy equipment with the latest GNSS systems.
CLAW includes glueless drivers for Rockwell Collins Remote Secure Receiver (RSR Puck) among others, allowing transcoding of assured, secure L2 P(Y) code into legacy L1 C/A code in real time to retrofit commercial receivers with military P(Y) capability. CLAW also allows user-entry of ephemeris and almanac information, providing a means to simulate any past or future GPS constellation and time/date event, the company added.
CLAW was designed with a particular emphasis to encoding the optional externally-provided 1PPS GPS system time with nanosecond-level accuracy targets, allowing accuracy testing of GPS timing and frequency devices on top of simply providing a positioning/velocity reference. CLAW initially will support GPS L1 C/A code encoding with up to 12 satellites, and later versions will support additional GNSS systems such as L2 GPS, GLONASS, BeiDou and Galileo.
A comprehensive cost-free optional user application for Windows will be offered that allows control and monitoring of the unit, creation of simulation scenarios using Google Earth and manual waypoint entry, among other options. The unit also can be controlled via simple serial terminal commands, or various other available public-domain freeware programs.
Once position information is stored in the units’ NVRAM, the unit will generate GPS RF constellations within seconds upon power-up and thus does not require any user interaction other than plugging in the power supply.
CLAW contains a highly accurate and stable internal 10-MHz reference oscillator that may optionally be synchronized by an external 1PPS reference, 10-MHz reference, or both. CLAW supports a user-selectable RF signal attenuation range of 63 dB in 0.5-dB steps, allowing a wide range of RF signal levels to be generated with high accuracy and power-level resolution. Antenna DC power consumption also can be controlled via software command.
CLAW can be powered by its USB interface, or by a 6.5V to 28V DC power feed, and consumes less than 1.7W allowing extended operation of 24 hours or more from low-cost ubiquitous USB consumer battery packs.
“Prepare for Tomorrow: Find Vulnerabilities Today” was the title of our wide-ranging webinar in July that focused on GNSS signal simulation for jamming and spoofing scenarios. We did not have time to address all the questions posed by the audience, so we return to them here.
Q: While testing receivers, realistic scenarios for jamming and spoofing are very important. What is the typical approach to set the number of interference sources, their type and main signal parameters?
Two different approaches are common, those involving the use of an anechoic chamber and those which are lab-based. Each approach has its limitations and merits. Each approach must address the number of significant interferers, their signal powers and the waveforms of the interference signals. Each must also consider the geometric arrangement of these interferers relative to the antenna under test and relative to the simulated constellations under test.
Changes in signal phase, signal Doppler and signal power are as important for the interference signals as they for the wanted GNSS signals. These changes are caused by the simulated motion of the vehicle and potentially the motion of the interferers. These changes should also include the impact of terrain surrounding the vehicle and the interferers, and also the gain and phase patterns of the receive antenna on the vehicle and the transmit antennas on the interferers. Some interferers might be discounted from the significant set due to their signals being masked from the vehicle by the terrain or antenna patterns or by them being too far from the vehicle to have an impact. These interference signals may become significant as the scenario progresses due to vehicle or interferer motion.
Simulator graphical user interface. (Image: Spirent Federal Systems)
Q: In GNSS navigation systems for commercial applications, what emphasis of design effort should be on anti-jamming/anti-spoofing over improving the navigation accuracy?
Commercial applications is a broad area, so it will depend on the particular application as to whether it needs more accuracy or more resiliency against AJ/AS, but in general, the accuracy of GNSS is fairly mature. Standard GNSS offers accuracies on the order of ~1 meter. Centimeter accuracy can be achieved with differential or real-time kinematic (RTK). Multi-constellation use can increase availability in areas with limited sky view such as urban canyons. Multi-frequency can aid in the reduction of multipath and improve accuracy. If the application needs accuracy, these features are readily available.
However, integrity and resiliency are growing needs in commercial applications, especially ones that are in critical operations. Much more can be done to detect jamming and spoofing than what is in standards GNSS receivers today. In our systems, we include an additional software layer called BroadShield, which monitors internal state variables of the receiver, and will alarm on detection. Additional sensors combined with the GNSS receiver such as an inertial measurement unit (IMU), magnetometer, odometer, or even the much stronger Satellite Time and Location (STL) signal offer augmentation during periods of GNSS denial, or in the case of spoofing, authentication of the navigation solution.
While both jamming and spoofing are intentional attacks, they are highly different in their set-up and serve very different purposes. Due to their simplicity, most jamming attacks can be mitigated thanks to adaptive filtering or pulse blanking. On the other hand, spoofing is a malicious attack, highly complicated, and requires knowledge of the GNSS signal structure as well as precise timing and positioning.
The question is thus whether one should emphasize navigation accuracy over the ability to output a position (jamming case) or the possibility to output a completely erroneous position (spoofing case). The answer lies, obviously, in the end application and the coupling of GNSS receivers with other systems. High-precision non-life-critical applications should emphasize navigation accuracy while implementing simple jammer filtering strategies. Life-critical applications, being often coupled with other systems, should ensure the reliability of the solution even if that means being unable to compute a position due potential threats.
Q: Do you have GPS/inertial navigation system (INS) test capabilities?
The CAST-3000 EGI integration system produces GPS RF signals commensurate with simulated IMU sensor data to provide repeatable testing in the integration laboratory for a wide range of military and government applications.
CAST GNSS/INS simulators generate high-fidelity signals required for emulating the legacy GPS signals as well as those used by next-generation navigation technologies. This is because our sole business focus is supplying GNSS simulators, GNSS/INS test equipment, and GNSS/INS support services to government and military avionics laboratories, prime contractors, and GNSS receiver manufacturers. For 35 years we have provided off-the-shelf products to both the government and U.S. major defense contractors.
CAST EGI integration tools are used by Northrop Grumman and Honeywell and are now also being used in integration laboratories worldwide. Our equipment supports system integration in major weapons platform labs and development at major military contractor labs. CAST simulators produce high-quality, accurate signals that are used in government, military and commercial labs around the globe.
Our NCS TITAN GNSS simulator is able to emulate the presence of IMUs and micro electro-mechanical systems (MEMS) sensors with the optional available real-time IMU/Sensor Emulation Package (SEP). The SEP upgrades the TITAN to support the simulation of inertial sensors, which nowadays are implemented as MEMS, among others, and of other common aiding sensors. To obtain more accurate positioning for location-based services and navigation, GNSS chipset and receiver manufacturers as well as system integrators combine more and more GNSS navigation with such sensor fusion or signals of opportunity.
The optional SEP enables controlled and progressive testing of sensor-fusion algorithms when used with NCS Control Center operating software. This software supplies the SEP with an internally- or externally-generated center-of-gravity (CoG) trajectory for the device under test.
The various sensor models to be emulated by the SEP run within the Control Center software. The device under test (vehicle) input trajectory at the CoG passes through the sensor model, which in turn generates the appropriate sensor output, by taking into account the corresponding error model for each sensor defined.
We have added the capability to emulate INS/IMU data in addition to GNSS signals to our Constellator simulator, to offer to the customers a complete testing platform. Constellator can simulate up to six gyrometers and six accelerometers. The attitude of each sensor is defined with respect to the vehicle axes. Deterministic errors can be configured to simulate the axis misalignment and scale factors, and biases can be defined in order to simulate realistic sensors. Stochastic error models are also available such as random walk or Gauss-Markov models for each sensor (gyrometer or accelerometer) to improve the sensor emulation fidelity.
Q: Do you have detailed scenarios for jamming and spoofing in timing use of GNSS receivers, that is, involving time synchronization for telecommunications companies?
The simulated jammer’s signal specification must be very flexible in order to faithfully simulate real-world jamming events. For example, the jammer’s spectral shape should be flexible enough to simulate a Blue Force electronic attack (BFEA) on a GNSS receiver.
Also, the simulator should be able to simulate dynamic scenarios by varying the power of the jammers as a function of their trajectories and as a function of different antenna patterns.
Sometimes when testing receivers, the simulated jammers should replicate pre-recorded waveforms from real world. The ability to play back the pre-recorded IQ-baseband signal in conjunction with GNSS signals is another powerful feature of a simulator. Simulation of spoofing attacks on a GNSS timing receiver is only possible when the GNSS simulator provides fine-grained control of transmitted signal. This includes controlling the offsets on the pseudoranges with additive ramps, as well as individual signal power levels at very precise points in time.
Also, the GNSS simulator must be able to synchronize itself with the live sky’s GNSS signal. Another way to achieve realistic spoofing is to use two simulators controlled independently (that is, full control on constellation, navigation message, propagation time offset, power and so on).
FIGURE 1. Real-world jamming simulation must take into account key factors such as varying jammer power, as a function of their trajectories and antenna patterns. (Image: Skydel)
Q: Please discuss how to simulate a smart spoofer that would generate a replica of a constellation (or all constellations) and then produces two full RF transissions: one that is the true signal, and a strong spoofed signal that pulls the receiver to a false location. Can you simulate the two full multi-band RF ensemble?
Two artificial synchronized scenarios could be created using SatGen signal generator software that can reproduce the GNSS signals from a number of constellations. The user could create two separate signal streams, both starting at exactly the same position and time and using the same constellations, chosen by the user.
The second scenario could then be set to diverge away in position from the first scenario, while staying perfectly synchronized in time. The signal-to-noise ratio of each scenario could be adjusted independently of each other to simulate a spoofing situation where the spoofing signal is much stronger than the real signal. A file containing this twin scenario can be replayed using a LabSat Wideband with two separate RF outputs, each synchronously replaying the two different scenarios. This would closely simulate the actions of a smart spoofer, but in a completely repeatable, and controllable manner.
This could be accomplished by either combining the output of two of our CLAW GPS simulators, or by combining the output of a single CLAW simulator with live-sky signals using passive industry-standard splitters/combiners. The CLAW is able to receive a custom ephemeris download in RINEX format to match either the spoofed live-sky constellation, or to generate a synthesized constellation in the case where two CLAW simulators are being used.
The simulator has a wide RF power adjustment range of over 45-dB, allowing the spoofing signal to be gradually introduced to the primary GPS constellation RF signal. This spoofing simulation could be accomplished with better than 0.5 meter peak-to-peak positioning accuracy and better than 5-ns real-mean-squared (rms) typical UTC (GPS) offset unit-to-unit, allowing the victim receiver to be pulled off of its true (live-sky) position with very high accuracy. Typically, GPS receivers are spoofed easily as long as the UTC timing synchronization is 500-ns or better between the live-sky and spoofed signals.
Timing synchronization to the spoofed victim GPS signal to within nanoseconds is achievable through the external 1PPS reference input, the simulator accepting a position, navigation and timing (PNT) fix in real time via its NMEA serial and 1PPS inputs. This allows capturing a moving victim receiver by estimating its momentary position, then ramping up the spoofer power, and then presenting the victim receiver with alternate position information as required (see Figures 2 and 3).
High position and timing accuracy between the spoofed and live-sky signal is important to prevent and mitigate spoofing detection via UTC phase or position jumps that could happen when the receiver gradually or quickly switches over to the spoofed satellite signals.
FIGURE 2. Spoofing attack on a GPS receiver using a CLAW simulator to spoof a live-sky antenna signal. Initially the spoofer was phase- and frequency-synchronized to UTC(GPS), then spoofer RF power is ramped up, and once the victim GPS receiver is captured, a frequency offset is added to UTC(Spoofer), which pulls the system off-phase. (Figure: Jackson Labs)
FIGURE 3. Simulating a spoofing attack on a timing application where the spoofer does not know the exact victim antenna location with certainty. The resulting antenna position offset error (50 meters in this simulation) still allows the victim receiver to be captured, and then causes a time error as satellites move in and out of view even with the spoofer being synchronized to UTC(GPS) at all times. This error is clearly visible in the resulting UTC(Spoofer) output from the victim receiver equipment. (Figure: Jackson Labs)
Q: We want to correctly model and simulate effectiveness of various anti-jamming (AJ) and anti-spoofing (AS) solutions to make informed decisions about which AJ/AS solution is most effective for a specific mission and interference scenario. How can you help?
Live-sky testing on a jamming/spoofing range provides a wealth of data, and reassurance that the system under test does work as intended. Record and playback systems (RPS) under live-sky conditions can allow further evaluation back in the lab, after the live-sky tests are complete. Performance parameters of the RPS may degrade the validity of the signal when played back; signal bandwidth and bit-depth are absolutely key, for example. Recordings that use too few bits will degrade the dynamic range of the recorded signals, so significant care should be taken when selecting an RPS.
Either way, under live-sky or with recorded live-sky, you get what you get. It is extremely difficult to predict what the test parameters actually are. It is perilous to attempt to alter the test parameters after the event. Lab-based or anechoic chamber-based systems have their limitations, but they are repeatable, predictable and tweakable. Again, performance parameters of the simulation system play a key role in the validity of the testing. The ability to calibrate the simulation system to give a repeatable, predictable performance is as important as the realism of the simulation. Carrier-phase accuracy/repeatability among antenna elements and signal timing accuracy are important parameters when evaluating AJ and AS systems.
Q: We had a receiver where the time stamp for any location report would drift off progressively, up to an hour off of the known true location. What might contribute to this? We do not believe this was an intentional threat, but an artifact of nearby electronics or other system conditions. It actually occurred on a pivot irrigation arm in motion, with substantial vibration. The receiver was electrically isolated. The results were repeatable on the pivot arm, but not on our vibration table.
Interesting problem with no obvious answer. Even the worst oscillator will take many months to drift off by up to an hour with no GNSS, even under horrible vibration conditions, so this is an unlikely cause. Is it drift or a jump in error? Nearby electrical noise could cause GNSS denial (jamming), but not erroneous data. That requires spoofing. If you have no reason to believe that it is intentional, that makes spoofing unlikely, but still possible. Is a GNSS repeater or a record/playback GNSS tester operating in the area? These are spoofers, even if they are unintentional.
If this is a precision agriculture application, then an RTK reference station transmitting erroneous data could be the cause. What time-stamping format is used: local time or UTC? An unlikely but possible scenario is the unit is changing time zones so local time jumps an hour. Is there a processor/software app between your output and the actual GNSS receiver? This could introduce errors. What is the position output indicated when the time drift occurs? The best way to diagnose this is to record the time and position output as log files using a laptop PC connected to the serial data.
Q: Do your simulators work as well for testing handheld, consumer-grade GPS? Please discuss the differences in testing techniques or approaches for high-precision vs. mass-market receivers?
We have a range of simulators suitable for all levels of GNSS testing. If you don’t need the high fidelity and wide bandwidth of the LabSat Wideband, then the entry level LabSat 3 will also work with any GNSS device including handheld consumer-grade products.
To fully explore the performance of high-precision receivers, including multipath effects and P-code reception, a wider bandwidth and a greater number of bits would be required to capture and replay all of the available signals. For these applications, we recommend a bandwidth of 56 MHz and at least 4 bits of resolution.
For testing of consumer-grade, handheld devices with simpler RF front ends, we recommend a much reduced bandwidth of around 9 MHz and only 2 bits of resolution. This smaller bandwidth and fidelity will easily reproduce the majority of real-world conditions, and the resulting data files will be much easier to handle.
FIGURE 4. Simulator graphical user interface. (Image: Racelogic)
Q: How many GNSS signals can a software-defined radio produce?
The theoretical limits of a software-defined radio (SDR) are based on four distinct characteristics of the SDR: the digital-to-analog converter’s (DAC’s) bit resolution, the maximum sampling rate, the bandwidth and the number of RF outputs. With most SDRs, available bandwidth is defined by the sampling rate.
With a 16-bit DAC, there is enough dynamic range to generate up to 50 GNSS signals and hundreds of multipath echos (with more than 60 dB of range to accommodate different signal power levels) per RF output.
For example, with a sampling rate of 50 MSps, a 40-MHz wide signal — combining GNSS constellation signals such as GPS L1 C/A, Galileo E1, GLONASS G1 — can be generated. Nowadays, SDRs can have two or more RF outputs and are able to operate with sample rates of 100 MSps or higher. By distributing the GNSS signals across different RF outputs, the entire GNSS spectrum can be covered at a relatively low cost in terms of hardware.
A handful of SDRs can easily be synchronized to form multiple RF output systems. In such cases, the complete range of GNSS signals for all visible satellites can be generated at the same time.
Q: In a dual-frequency receiver would it be possible to still use L1 spoofed/jammed with L2 clean to get an accurate position? Is it possible to do a combination between the two signals in order to save the spoofed/jammed L1?
In principal, it is still possible to use L1 spoofed/jammed with L2 clean in a dual-frequency receiver to get an accurate position. Such receivers are available as off-the-shelf products. These receivers use a special algorithm to detect if a GNSS frequency band is spoofed/jammed and automatically switch over to the clean frequency band. However, this principle can only be applied if the entire GNSS spectrum is not completely jammed. Whether a dual-frequency receiver can still use L1 spoofed/jammed with L2 clean to get an accurate position is therefore finally basically dependent on the overall bandwidth of the interferer/jammer.
With IFEN’s TITAN simulator, it is possible to easily create the corresponding simulation scenarios for the real-time simulation of realistic test scenarios to test the robustness of GNSS receivers against interference/jamming and also spoofing. In doing so, various static and dynamic interference/jamming sources are supported by the simulator’s software.
It is possible to achieve a PNT solution using L2 signals only. This requires reception and decoding of either the military L2 P(Y) signal, or reception of the new but still pre-operational L2C commercial signal. Codeless or semi-codeless commercial L1/L2 receivers rely on tracking the carrier phase on L2 to be able to mitigate effects such as solar flares and ionospheric errors; however, they are not capable of generating a PNT solution with L2-only reception as would be the case under this spoofing/jamming scenario.
P(Y) signal reception on L2 typically requires reception of the coarse acquisition (C/A) signal on L1 prior to tracking P(Y) unless the receiver has its own internal (atomic) time-base synchronized to UTC to the sub-microsecond level.
On-Demand Webinars
Simulation against Jamming and Spoofing: With cyber attacks on the rise, it is more critical now than ever to thoroughly test GPS and GNSS systems against jamming and spoofing.
