Evaluation of Relative GPS Timing Under Jamming Conditions

Transcription

1 Evaluation of Relative GPS Timing Under Jamming Conditions Ryan J.R Thompson, Ediz Cetin, Andrew G. Dempster, School of Surveying and Geospatial Engineering, University of New South Wales, Australia BIOGRAPHY Ryan Thompson is a PhD student at the School of Surveying and Geospatial Engineering at the University of New South Wales (UNSW), Australia. He received his BEng in Electrical Engineering at the same university in 8. His current research activities are focused on the localization of Radio-Frequency Interference (RFI) that impacts ground-based Global Navigation Satellite System (GNSS) augmentation systems. Dr Ediz Cetin is a Senior Research Associate at the School of Surveying and Geospatial Engineering, University of New South Wales. He received his BEng (Hons) Control and Computer Engineering and PhD degree in unsupervised adaptive signal processing for wireless receivers from the University of Westminster, London, United Kingdom. His research interests encompass interference detection and localisation, Global Navigation Satellite Systems (GNSS) receivers, Software Defined Radio, Blind signal processing and design and low-power implementation of digital circuits. Professor Andrew Dempster is Director of the Australian Centre for Space Engineering Research (ACSER) at the University of New South Wales (UNSW). He is also Director of Research in the School of Surveying and Geospatial Engineering and Director of Postgraduate Research in the Faculty of Engineering. He has a BE and MEngSc from UNSW and a PhD from University of Cambridge in efficient circuits for signal processing arithmetic. He was system engineer and project manager for the first GPS receiver developed in Australia in the late 8s and has been involved in satellite navigation ever since. His current research interests are in satellite navigation receiver design and signal processing, areas where he has six patents, and new location technologies. He is leading the development of space engineering research at ACSER. ABSTRACT In this paper the performance of GPS timing under jamming conditions is evaluated in the context of a GPS jammer localization system that uses the Time- Difference-Of-Arrival (TDOA) technique. To investigate the performance of GPS timing receivers under jamming conditions, jammer signals of different types and powers were combined with real GPS signals and input into two timing receivers and the response of the PPS and frequency outputs measured. It was found that for at least 3 seconds after the jammer was turned on there was no noticeable drift. This is long enough to switch to a backup timing source or to perform a number of TDOA measurements. The implementation of post-processed time synchronization based on common-view satellite time transfer was also explored to examine the performance that can be expected when using the GPS signals embedded in the data captured for TDOA localization. The relative clock drift between two GPS receivers was then measured for hours to see how Temperature Compensated Crystal Oscillators (TCXOs) behave over time. Using a linear fit to the relative clock drift values before simulated GPS outages, it was found that in the worst case a similar amount of holdover could be achieved as the timing receivers before the drift became significant. The performance of the timing receivers during a jammer localization field-trial was then analyzed. It was found that the TDOA localization could be improved significantly by correcting for timing offsets detected using the post-processing technique. INTRODUCTION The increasing dependence on the capabilities provided by GNSS means that any disruption to the positioning, navigation, and timing products they provide could have wide reaching financial and social consequences. Due to the weak power of the GNSS signals they are susceptible to even moderate levels of Radio-Frequency Interference (RFI) or jamming [],[],[3]. Two real-world examples of jamming events to GPS include a malfunctioning television antenna amplifier disrupting a Differential-GPS (DGPS) station at a harbor [4] and a Privacy Protection Device (PPD) disrupting the Ground-Based Augmentation System (GBAS) at an airport [5]. The traditional direction finding techniques used to localize these sources took a considerable amount of time to track down the source of these outages. This motivates the development of a permanent or deployable sensor network that operates continuously and can detect and localize interference sources in a timely manner. One such system is the GNSS Environmental Monitoring Systems (GEMS) being developed by GPSat Systems [6],[7] which motivates the work undertaken in this paper. An example of the growing reliance on GNSS outside of traditional navigation is time synchronization. The good

2 levels of synchronization provided by GPS time transfer are being increasingly relied upon in a number of different applications, such as telecommunications and power generation. In telecommunications it is needed to allow for new techniques for increasing uplink and downlink capacity [8]. In power generation it is required to detect and localize faults in smart grids to maintain reliability [9]. In the presence of RFI the time synchronization will degrade []. Time synchronization is also important for sensor networks that aim to detect and localize interference sources to GPS [6],[]. A localization technique which can provide good position estimates of wideband interferences is TDOA []. The quality of the time-delay measurements produced between pairs of sensor nodes will degrade in the presence of timing errors and degrade the position estimate []. In the presence of GPS jamming in a timing application an option is to use a more stable clock, such as an Oven- Controlled-Crystal-Oscillator (OCXO) or atomic clock (such as a Rubidium standard), which can provide longer hold-over than the satellite disciplined TCXOs typically used in the timing receivers. The drawback to this is the increased cost and increased power requirements which may not be suitable for use in localization network with a large number of nodes. Another potential option is to use other signals to provide timing. One demonstrated option in the context of GPS jammer localization using TDOA is the use of CDMA signals from cellular networks []. There is also the potential for frequency diversity in the GNSS bands such as the use of GLONASS signals on either L or L [3]. Adding the capability to use multiple timing signals again increases the cost and power usage of the sensor network. From the jammer point of view of, it is also cheaper to jam multiple signals then it is for the localization system to add redundant timing sources. A number of jammers available already provide the capability to jam GPS, Wi-Fi, and cellular signals in a single unit. Testing of civilian jammers also showed that a number already output interference over multiple GNSS bands [4]. As a result this work concentrates on how long GPS timing receivers with relatively inexpensive TXCOs can be used in the presence of jamming before they degrade. This work contrasts with what was done previously in [] in that specific attention is given to the rate of change of the random walk nature of the clock drift. With this knowledge an indication of the length of time that TDOA can be performed after the timing receivers are jammed without large position errors is gained. To gain further insight into the timing performance that can be expected in real-time and with post-processing [5] the relative clock drift between two GPS receivers with TCXOs was recorded for a period of time and analyzed. Finally the timing performance of a prototype jammer localization system is analyzed from a field-trial [7] where a deployment of three sensor nodes was placed over an area to localize a real interference source in the GPS band. This paper is structured as follows: First an introduction to the importance of time synchronization for the timedelay estimation in TDOA localization systems is given. In the next part the performance of a pair of GPS timing receivers is evaluated under ideal and jamming conditions. Next, how the GPS satellite signals can be used for time synchronization is presented as a postprocessing technique is given. Following this, the behavior of the clock drift between two GPS receivers is analyzed to gain insight into the potential holdover performance for timing techniques which rely on receivers with TCXOs. The performance of the timing receivers in the field from a real experiment is then given as well as the improvements that can be gained from applying corrections based on the post-processed timing technique in TDOA localization. This is followed by the concluding remarks. TIME DELAY ESTIMATION In TDOA localization, sets of data between sensor nodes are typically cross-correlated together in order to generate hyperbolae that intersect at position of the source transmitter. The received signal arriving at two sensor nodes can be modeled as [6]: r t) = s( t) + n ( ) () ( t r t) = a s( t + τ d ) + n ( ) () ( t where s(t) is the signal of interest, a is an attenuation factor, τ d is the time-delay of the signal arriving between sensor nodes r and r, and n and n describe the noise at each node assumed to be Gaussian and independent. Assuming the bandwidth of s(t) is large, the τ d can be estimated by calculating the cross-correlation of the signals received at r and r : T Rˆ r r = r ( t) r ( t τ ) dτ (3) T τ τ where T is the length of integration. The estimated τ d is taken from the value of τ that maximizes the crosscorrelation function: ˆ τ = arg max ˆ ( τ ) (4) d R r r EFFECT OF TIMING ERRORS Due to the drifting nature of oscillators, especially TCXOs, the absolute or universal time at each sensor node will be different. The local time of a clock read at time t can be modeled as [7]: + t T ( t) = T ε ( t) dt (5) t

3 where T is the clock bias or timing offset at universal time t, and ε(t) is the oscillator s instantaneous clock drift. The clocks at each sensor node will have a different timing offset and clock drift rate and this will influence the error in the time-delay estimate. The error in the timedelay estimate will depend on how closely each clock is synchronized to the universal time of the sensor network. In the presence of clock offsets, the cross-correlation function will have the following form: Rˆ T τ T j πf ( t ) r r = r ( t) e r ( t τ + t) τ e jπf ( t ) dτ (6) where t = T T is the relative clock bias or timing offset between the two sensor nodes, and fi = ε i ( t) f L corresponds to the offset in the frequency of each sensor node, and f L is the frequency of the signal of interest s(t), which in this case is at GPS L. If there is a relative frequency offset f, =f -f between the sensor nodes greater than /T, where T is the integration time, the magnitude of the cross-correlation peak will be greatly reduced [8]. It is possible to overcome the frequency offset by searching for frequency along with time-delay. This is the same as evaluating the complex ambiguity function. The timing offset between the two sensor nodes, t is of greater significance. If there is a ns timing offset this will result in a 3m bias in the time-delay estimate for example. The time-delay estimate will become biased by the value of this timing offset between the sensor nodes: τ + t = arg max Rˆ ( τ, f, f ) (7) ˆd r r The presence of such timing offsets will degrade the localization solution [] and also limit the effective range of the system due to Geometric-Dilution-Of- Precision (GDOP) [9]. TIMING BOARD PERFORMANCE One option to time-synchronize the sensor nodes in TDOA system is to use GPS timing receivers. In this section the performance of a GPS timing receiver based on SigNav utevo Timing Micro Modules will be evaluated. These timing receivers provide a 3.7MHz frequency reference and a PPS which are synchronized to GPS time. To evaluate the performance, an Agilent Universal Frequency Counter/Timer (533A) was used with the timing boards connected to the same antenna (Zero Baseline) and also to two separate antennas (North- South Baseline). An outline of the experimental setup is shown in Figure. The North-South Baseline setup refers to two antennas placed.78m apart on the roof of the Electrical Engineering building at UNSW. Each pillar uses a high-quality choke-ring antenna. The locations of these antennas have also been surveyed to geodetic accuracy and the North pillar antenna is used as part of the SydNET CORS network []. The measurements were taken with the timing boards operating in two modes: navigation mode where the position is solved along with the receiver clock offset, and hold mode where the position is fixed and only the receiver clock offset is solved for. Figure. GPS time transfer testing setup. In navigation mode the performance in the timing offset (PPS synchronization) was similar to what would be expected from GPS L C/A positioning. If the relative position error from the timing receivers given in the NMEA messages was equal to m then the timing offset was close to m. In Figure the time-series of the error in the relative position (XYZ) is shown along with the timing offset (PPS). In the PPS line there is a bias which is believed to be caused by the difference in the physical lengths of the paths between each antenna to the timing receivers. The timing receivers have commands that can be used for calibrating for this out. Error (m) 5 5 North Pillar South Pillar passive splitter switch utevo utevo PPS / 3.7MHz Counter PPS / 3.7MHz PPS XYZ Figure. The behavior of the error in the baseline length and the timing offset with the timing receivers operating in navigation mode for the North-South baseline test. The frequency references provided at 3.7MHz were found to be equal to within a standard deviation of.4hz. The standard deviation was similar irrespective of the baseline or the operation mode of the receivers. In the GEMS system [6] the frequency reference is used for down-converting the received RF signals containing the GPS and jammer signals. This equates to a standard deviation of.5hz after down-conversion. This is good enough so that a search in frequency when determining the time-delay should not be required for integration times

4 shorter than 488ms. In Figure 3 the time-series of the timing offset is shown when the timing receivers are placed in the hold mode. As can be observed there is less variation over time in comparison to navigation mode which can be expected as only the receiver clock offset needs to be solved for. As shown in Table the standard deviation is also lower in hold mode when compared with the navigation mode. Timing offset (ns) Figure 3. The time-series of the timing offset between the timing receivers for the Zero and North-South baselines in hold mode. Table. Relative timing synchronization performance between the timing receivers. Baseline Timing (PPS) Freq. Ref. Mean Std. dev Std. Dev. Zero (hold mode) North-South (hold mode) Zero (nav. mode) North-South (nav. mode) -3.4ns (-4.m) 57.ns (7.3m) 3.5ns (-.9m) 58.7ns (7.4m) North-South Baseline Zero Baseline.78ns (.53m).6ns (.79m) 3.8ns (.9m) 7.43ns (.3m) TIMING RECEIVERS UNDER JAMMING.4Hz.4Hz.4Hz.4Hz To evaluate the performance of the timing receivers in the presence of jamming, jammer signals from a GSS STR765 Interference Simulator were combined with the GPS signals from antennas. An overview of the configuration is shown in Figure 4. In this setup, care was taken to ensure that the cables connected to each receiver were of the same length after the splitter so that any bias in the timing due to different physical paths was reduced. South Pillar utevo PPS / 3.7MHz To explore the timing synchronization in the presence of total jamming, a CW signal at -5dBm was combined with the GPS signals and turned on and off for different periods of time. At this power level, the receivers lose lock of all satellites instantly and go into a holdover mode. The response of the timing offset and frequency offset between the timing receivers is shown in Figure 5 and Figure 6. As can be seen from these figure, after jamming the timing and frequency offsets do not begin to drift immediately. After a number of seconds the outputs do begin to drift and this is most likely a result of shortterm stability of the TCXOs used in the timing receivers. This length of time is long enough to estimate some timedelays in a TDOA system or to switch to another of timing source without suffering any degradation. This jammer on-off process was repeated a number of times and it was observed that in the worst case the timing offset began to drift 3 seconds after the jammer was turned on and the maximum drift rate observed was.m/s. The timing receivers do have the capability to improve holdover by building a model of the clock drift with respect to temperature changes but this requires the receivers to operate through a number of diurnal cycles to work well. The receivers in these experiments were only turned on for a short period of time before testing. After the jammer is turned off there is some transient behavior in the time and frequency offsets as can be seen in Figure 5 and Figure 6. This occurs when the timing receiver begins using satellites again in its timing solution and begins re-disciplining the oscillator. The redisciplining of the oscillator in finite frequency steps can also be observed in the frequency offsets. During these transient periods the magnitude of the cross-correlation output could reduce significantly as a.5hz offset in the frequency references equates to approximately a 77Hz offset at RF Jammer On Figure 5. Response of the timing offset to jamming. Jammer utevo Counter PPS / 3.7MHz Figure 4. Jammer testing configuration.

5 Frequency (Hz) Jammer On Time (ms) Figure 6. Response of frequency offset to jamming. PERFORMANCE UNDER JAMMERS OF DIFFERENT TYPES AND POWER To get an overview of the behavior of the timing receivers under different jamming conditions the STR675 Interference Simulator was used to generate jammer signals of different types and powers. As real GPS signals were used their power level has been amplified by the Low Noise Amplifier (LNA) at the antenna and attenuated by the cabling and combiner/splitter. There are also losses that affect the signal output from the signal generator. In order to calibrate the power of the jammer signals with the noise floor at the input to the timing receivers a spectrum analyzer was used. The noise power in a MHz bandwidth at GPS L at the input to the timing receivers was measured to be -97.6dBm. There was a loss of.57db on the signal from the jammer. The noise power in MHz was used as the reference and the power from the signal generator was scaled accordingly. In Figure 7 the different jammer power levels and the times when the jammer was turned on and off are shown for testing the response for the different jammer types. The power levels were varied between dbm to dBm in 5dB steps, with the jammer turned on for 45 seconds, and then turned off for 5 seconds to allow the timing receiver to recover. Although CW type jammers can cause problems with tracking at even low power levels [] if the CW crosses GPS code spectral lines this was not tested here. In Figure 7 and Figure 8 only powers of dBm onwards is shown as at the lower power levels there was typically no effect on the number of satellites being used or the timing and frequency offsets. In Figure 8 the response of the timing offset to the jammer power levels given in Figure 7 for a MHz wideband noise signal is shown along with the number of satellites one of the timing receivers was using in its timing solution. The receivers were placed in hold mode during these tests. The number of satellites being used gives the best indication of the quality of the timing solution. As the power of the jammer is increased the number of satellites used in the timing solution falls. In Figure 9 the response of the C/No under the jamming testing is shown for a strong satellite signal. For moderate power levels the receiver is able to reacquire satellites over time. For the jamming event at 4 seconds the receiver momentarily loses almost all satellites and the offset begins to drift quickly. As satellites are reacquired, the offset stops drifting and returns to its nominal value over time. For power levels of dBm and above, all the satellites are jammed and significant drift is observed. Jammer Power (dbm) Timing (Hz) Jammer On Figure 7. The different power levels used for the jamming signals over time Figure 8. The response of the timing offset and the number of satellites used for the MHz noise jammer. C/No (db/hz) Figure 9. Response of reported C/No for a satellite during the jammer testing. This process was repeated for a number of different jammer types. The response of the timing receivers to the different jammer types for the experiment runs is given in Appendix A. In general, when no satellites can be used the timing offset begins to drift. With at least satellite, the drift stops and begins to return to zero. The more

6 satellites that can be used the faster the offset returns to zero. The timing receivers showed differing vulnerability to different jammer types. These results are summarized in Table which shows the minimum and maximum number of satellites used by one of the timing receivers over the 45 second jamming period. This demonstrates the ability of the receiver to recover satellites after the jammer is turned on. The results in Table show that the receivers are most susceptible to AM and FM type interference. At a power level of -8.97dBm, for example, for the CW, SCW, and M (MHz wideband noise) type jammers the receiver is able to begin using a couple of satellites. At this power level for the AM type the receiver is unable to recover any satellites and for the FM type only a single satellite is recovered. Table. The minimum/maximum number of satellites used in the timing solution during jamming. PWR JAMMER TYPE^ (dbm) CW SCW AM FM P P M M / 9/9 / 8/9 9/ / 9/9 / -.97 / 9/9 8/8 8/8 8/ 7/ 9/9 / / 8/9 6/6 5/7 9/ 9/ 8/9 / /8 6/9 6/5 /6 9/9 9/ 7/8 / /6 /6 /3 /3 9/9 9/ 4/7 7/ /4 /4 / / 9/9 8/9 /5 3/ /3 / / / 9/ 5/8 / / / / / / /9 4/9 / /3 ^JAMMER TYPES (see Appendix A): SCW: A swept CW with +/- MHz deviation around GPS L with a sweep rate of khz, similar to what was seen in [4]. M: Gaussian noise with a bandwidth of MHz. M: Gaussian noise with a bandwidth of MHz. CW: A single tone on GPS L. AM: An AM signal with a khz modulating frequency and 5% depth rate. FM: FM with a khz modulating frequency and khz deviation. P: Pulses of CW with a duty cycle of 4ms repeating every ms. P: Pulses of CW with a duty cycle of ms repeating every second. POST-PROCESSED TIMING The use of the timing receivers facilitates the sampling of data for TDOA processing in real-time [6]. An alternative that is not real-time is to record longer sets of data and process them offline [5]. A system for localizing jammers in the GPS band has the advantage in that it will also capture embedded GPS signals which can be processed for timing off-line. The post-processed methodologies track the GPS signals in the data and use the resulting navigation data to determine the time and frequency offsets between sensor nodes. This could be the fallback method if localization was not possible before the synchronization given by the timing receivers degraded too much. In a TDOA setup, the location of the sensor nodes is typically known beforehand. As a result it is not necessary to perform the entire GPS navigation process to derive timing. For TDOA the sensor nodes will also be spaced relatively close together so that the jammer signal is of high enough effective SNR for time-delay estimation. As a result some GPS satellites can be assumed to be visible at the same time at many sensor node locations. This scenario is shown in Figure. Using the common-view satellite time transfer technique [] it is possible to determine the time offset t r, r between two sensor nodes r and r using: t = ( t τ ) ( t τ ) = ( t t ) ( τ τ ) r, r r r r r r r r r (8) where t r and t r are the local measured times of arrival for a satellite at each sensor nodes, and τ r and τ r is the actual time taken by the satellite signal to reach each sensor node. The value of (t r - t r ) can be found in the receiver tracking data by taking the difference of the sample locations of the correlation peak of the same Time-Of- Week (TOW) message. The relationship between the TOW locations and the sample locations are shown in Figure. The value of (τ r - τ r ) which is the time-delay of the satellite signal at the specific TOW can be found using ephemeris data to calculate the range r r and r r of the satellite between the sensor nodes and dividing by the speed of light: τ r = r r /c and τ r = r r /c. Figure. Geometry of satellite time-delays between sensor nodes during common-view of a GPS satellite. node : node : (Node ) τ r : (Satellite) r r Figure. The relationship between the locations of the TOW messages and absolute samples betweens the two sensor nodes. Due to the drifting nature of the oscillators at each sensor node the time offset will not be constant. The clock drift r r (Node ) TOW TOW TOW 3 τ r : τ r : τ r :3 TOW TOW TOW 3 τ r : τ r :3

7 rate can be found by calculating the rate of change between successive time offset measurements: d ε r, r ( t) = t r, r (9) dt Using the time offsets t r, r the specific samples to be read from the data files that correspond to the same GPS time can be found. With a number of these time offsets t r, r and the corresponding sample offsets s r, r, a linear model can be used to fit and interpolate over the period of interest: sr, r ( k) = α + β k () where k is the sample number in the file from node, sr, r ( k) is the sample offset of the node file from the node file at sample k, α is a constant offset between the files and β is the sample drift rate in units of k/k or samples per sample. A linear fit works well over short durations (~5s) but for longer periods where clock drift variations becomes an issue a polynomial fit may be more appropriate. As a fit is used the sample offset may be a non-integer value. In this case the remainder needs to be corrected in the time-delay for TDOA as well. Depending on the length of the integration time used for estimating the time-delay, the clock drift rate may become significant. For example if the relative clock drift between the two sensor nodes is equal to m/s then for a ms integration time the clocks would have drifted by m. This clock drift needs to be corrected in the time-delay measurements: t ( ˆ τ d ) corrected = ˆ τ d ε ( t) dt () t The relative frequency offset, f, of the clocks between the two sensor nodes also needs to be calculated for use in (9) to ensure a significant magnitude in the crosscorrelation output. This can be calculated from the clock drift rate ε(t) using the following: f ε () (, = r, r t) fl where f L is the center frequency of the signal of interest s(t), which in this case is the GPS L frequency 575.4MHz. An example of the sample offset fit for two unsynchronized data sets recording the same satellite is shown in Figure. From the fit of the sample offsets the value of α is samples. The data has a sampling rate of MHz so this corresponds to a time offset of 56.78ms. The value of β is equal to a drift rate of m/s which corresponds to a frequency offset of 89.4Hz. to Node (samples) x Node sample (samples) x 8 Figure. An example of the sample offsets between two files from unsynchronized IF data sets. To evaluate the performance of this technique the approach was coded in MATLAB based on the software receiver of Borre et al. [3]. A NordNAV multi-frontend was used for sampling IF data along with two GPS simulators also running off a shared clock. An outline of the test setup is shown in Figure 3. A number of different baseline lengths between 5 and 5km were tested. The use of the multi-frontend running off the same clock ensures that the recorded sets of IF data should already be perfectly synchronized. Using the two synchronized GPS simulators allows the testing of variable baseline lengths. Spirent GSS656 shared clock Spirent GSS656 RF RF NordNav Multi f=α+β k IF -bit Post-process timing IF -bit Figure 3. Setup for testing long baseline synchronization using postprocessing. In the technique a TOW message was found that was common to the tracking results from both files to find a correlation peak to begin synchronizing the data. After that the sample offset was determined using the corresponding correlation peaks every 5ms and a linear fit using 3 satellites was used to model the drift of the sample offsets over time. The behavior of the computed offsets for each satellite is shown in Figure 4. There is no noticeable drift although there is some variance in the sample offsets for individual satellites. The technique as coded was able to time synchronize to within +/-.

8 samples and frequency synchronize to within +/- Hz. This was determined from the values of α and β from the fit, which were not exactly zero as expected. It is expected that these results could be improved by using a more advanced tracking technique for measuring locations of the correlation peaks for the satellite signals. to Node (samples) Node sample (samples) x 8 Figure 4. Sample offsets between two files. To evaluate the performance in the presence of jamming, jammers of different types was then added to the IF data in software. Signals of CW and wideband (WB) noise were added with increasing power. There was no noticeable increase in the variance of the sample offsets until the satellite C/No was below 3dB/Hz. Problems with synchronization began to occur when tracking errors (equivalent to bit decoding errors) began to occur. CLOCK DRIFT BEHAVIOUR Sat Sat Sat 3 Under jamming conditions the drift in the time and frequency offsets for both the real-time and postprocessed techniques will depend on the stability of the local oscillators at each sensor node. To examine this behavior the clock drift was measured from two NordNav GPS receivers with TCXOs. The GPS receivers were placed in the same room and used the same antenna. In Figure 5 the relative clock drift as recorded between the two GPS receivers is shown over hours. These relative clock drift values correspond to ε r,r (t) in (9). The drift varies between 33-35m/s which correspond to a frequency offset between Hz at GPS L. The rate of change is not constant over time although does show some correlation with temperature as shown in Figure 6. The 'stuck' behavior at 5.44C in the plot is due to a bug in the temperature sensor. The TCXO in one of the timing receivers showed a sharp change in drift rate at certain temperatures. This is typical of some TCXO designs and although that particular TCXO showed such variations, the magnitude of the total drift over the hour period was actually smaller than the TCXO in the other receiver whose drift correlated almost exactly with temperature. Relative clock drift (m/s) GPS x 5 Figure 5. The clock drift from two independent GPS receivers with a shared antenna. Temperature (C) x 4 Figure 6. The ambient temperature recorded next to the two GPS receivers. POTENTIAL TCXO HOLDOVER Under jamming conditions a prediction must be made of the clock drift in order to determine the time and frequency offsets. In this work a simple holdover technique of taking the last clock drift values to create a linear model is used. To examine the best and worst case scenarios for the linear fit of the clock drift values shown in Figure 5, the timing error that would have accumulated during a GPS outage of seconds was calculated. This was done at every point in time for the hours of relative clock drift recordings and the timing offset calculated by integrating over the error of the fit. Over the hours of data the best and worst cases are shown in Figure 7 and Figure 8. At some locations the linear fit works well but at other locations it does not. The behavior of the timing offset over time is shown in Figure 9 for the best and worst cases. The maximum drift rate seen was m/s which is close to the rate of.m/s that was observed for the timing receivers during testing. In the worst case scenario the timing offset is small for only a number of seconds. It may be possible to extend this period by using more advanced clock prediction techniques such as Finite-Impulse-Response (FIR) and Kalman filtering [4]. In addition with the monitoring of temperature, it may also be possible to reduce the variations in the clock drift over time by modeling the effect. For a jammer localization system with a number of nodes operating continuously over time the potential for modeling the relative clock drifts should be explored and promotes useful future work.

9 Relative Clock Drift (m/s) GPS Time(s) x 5 Figure 7. Best case performance of a linear fit holdover technique during a simulated outage due to jamming. Relative Clock Drift (m/s) HO Fit HO Fit In the field trial, a network of three GEMS nodes was setup in a paddock with an interference source moved to different locations. An overview of the setup is shown in Figure. Each node consisted of an 8 element circular antenna array with a corresponding 8-channel RF frontend with a FPGA sampling board and GPS timing receiver. The timing receivers are the same type that was evaluated previously and was used to provide a 3.7MHz sampling clock for the ADCs and a PPS to trigger the sampling of IF data at the same time between sensor nodes. The 3.7MHz was also used for mixing in the RF front-end. An overview of the coupling of the timing receiver at each node is shown in Figure 9. A wideband interference source was used with a power of 5nW (-76 dbw) in the GPS bandwidth (MHz). The jammer was moved to different locations and the FPGAs at each node were set to record 33ms of IF data from each antenna element every 3 seconds. Due to network and computational constraints the data was stored and the TDOA processing was performed off-line GPS Time(s) x 5 Figure 8. Worst case performance of a linear fit holdover technique during a simulated outage due to jamming. Figure. The field trial experimental setup [7] Best Worst Figure 9. The resulting timing offset caused by the error in the clock drift fit over the outage period. GEMS II FIELD TRIAL This evaluation of GPS timing under jamming conditions is motivated by its use to synchronize sensor nodes to perform TDOA localization of GPS jammers. To explore the localization performance possible in real-world conditions a field test was undertaken with a working prototype GEMS system in [7]. In this section an evaluation of the timing performance of this set-up is given in more detail. Figure. Sensor node and timing architecture. FIELD TRIAL TIMING PERFORMANCE It is possible to examine the timing synchronization between the sensor nodes used in the field trial setup by applying the post-processing time transfer technique to the embedded GPS satellite signals in the data blocks recorded for TDOA processing. Again the difference between the observed time-delay of the satellite signals and the expected time-delay of the satellite signals can be used. In this context however it is not necessary to find TOW messages to initially synchronize the correlation peaks that correspond to the sample locations in the data files. Assuming that the sensor network was already operating before any

10 jamming, in the field the nodes are already time synchronized to the PPS to within a number of nanoseconds. Under jamming conditions the time offset will not drift to point where the time of transmit for each correlation peak in the data becomes ambiguous for a long period of time. This will occur when the time offset becomes greater than half a millisecond. During the tests detailed in the previous section a maximum drift rate of.m/s was observed after jamming and this corresponds to over 34 hours of time before this ambiguity occurs. After this point of time some additional aiding will be required to overcome this ambiguity or the time-delay estimate could be out by multiples of ms. Another concern of using the post-processing is the inability to acquire and track the GPS signals in data blocks in the presence of jamming signals. In this scenario the anti-jam capabilities of the 8 element antenna array can be used to mitigate the jammer by placing a null in its direction and by placing beams at the GPS satellites to improve the SNR [5]. As this technique is performed in post-processing it is possible to steer beams at each GPS satellite individually. An example of the timing offset observed in a block of GEMS II data is shown in Figure. The difference in the time-delay of the satellite extracted from the tracking data is shown along with the actual time delay calculated using ephemeris data. Time-delay (m) t r,r Actual Delay Tracked Delay Integration (ms) Figure. The difference between the delay of the satellites from the tracking outputs and the true delay. To evaluate the level of the synchronization being achieved between the sensor nodes in the field trial the timing offsets were calculated using the post-processed technique for over 6 data blocks taken every 3 seconds. In Figure 3 the timing offsets between each sensor node baseline is shown. The standard deviation for each of the baselines was equal to 9m. This is larger than what was found in lab testing under ideal conditions. It was expected that the timing behavior be similar to what was seen in Figure. The peak to peak variation in the timing offset in the field trial data is over 4m whereas in the bench testing with the North-South Baseline the peak to peak variation was only.5m. This may be due to a number of factors such as the use of cheap patch antennas placed on the ground during the trial, the use of a GPS L C/A receiver to survey the locations, or some jitter in the FPGA trigger mechanism when latching onto the PPS Data block (3s) Figure 3. The timing offset measured between the different sensor node pairs using the GPS satellites in the captured IF data for TDOA processing. TIME-DELAY CORRECTIONS FOR TDOA Along with monitoring the performance of the time synchronization it is also possible to improve the performance of the TDOA localization by using the measured time offsets as corrections for the time-delay estimates. In TDOA localization a number of intersecting hyperbola are used to determine the source location. The TDOA positioning equation takes the form τ d i, j 4 = - ( x x) + ( y y) ( x j x) + ( y j y) i c i c (3) where τ di,j is the time-delay of the signal of interest between sensor nodes i and j, (x i,y i ) is the position of sensor node i, and c is the speed of light. Using the nonlinear least-squares technique a position estimate can be found from the positioning equations by minimizing the least-squares cost-function ξ : T ξ = [ d f ( θ)] C [ d f ( θ)] (4) θ ˆ = arg min( ξ ) (5) θ where d is the vector of noisy time-delay estimates, f(θ) is the system of TDOA positioning equations, C is the covariance matrix of the time-delay estimates, and θ is the vector of parameters to be estimated, in this case the position of the source (x,y). The timing offsets to be used as corrections which are found using the post-processing technique can be applied to the time-delay estimates: ( ˆ τ d ) =τˆ d t ri, rj (6) corrected R, R,3 R,3

11 where t ri,rj is the timing offset between nodes i and j, found using the common-view satellite time transfer technique. For the data blocks taken at interference position 3 as shown in Figure, the timing offsets for each baseline and the localization results with and without the timing corrections is shown in Table 3. For the first two points the timing synchronization error in the baselines is small. As a result the position estimates of the TDOA processing are good even without the timing correction. Applying the timing correction based on the post-processing technique actually degrades the position estimates slightly in this case. This is most likely due to the coarseness of the timedelay of the post-processing technique which only estimates the tracked delays to a sample (~m), whereas the timing receivers are able to perform better than that. For block numbers and 3, larger timing errors are found with the post-processing technique on the nd and 3rd baseline. As a result the positioning error increases. Applying the correction is able to significantly improve the positioning result by as much as 6.9m. In Figure 6 the improvement in the intersection of the TDOA hyperbolae and the resulting position estimate with the timing correction is shown. Table 3. Timing and position error at location 3. Block # Baseline Baseline Baseline 3 No fixes With fixes RMSE *error is in meters. The effect of the timing corrections can also be seen by looking at the behavior of the correlator outputs for each block of data. In Figure 4 the correlator outputs are shown for each baseline without timing corrections. It can be seen that there is a noticeable jitter in the locations of the correlation peaks which correspond to the measured errors in the time-delays of the GPS satellites in Table 3. The correlation peaks with the corrections added are shown in Figure 5. After the corrections the crosscorrelation peaks line up closer together. The RMSE positioning error for the data blocks at each location is shown in Table 4. For the first three locations applying the timing correction improves the overall RMSE of the position estimates. There is an increase in the error in one of the data blocks at position #4. Applying the timing corrections increased the position error in the last data-block from 4.44m to 3.3m. The reason for this is not known although it is believed again to be due to the coarseness of the software receiver. With a more sophisticated way of determining the code-phases of the satellites the performance is expected to increase. Table 4. RMSE with and without timing corrections. Position RMSE Position Error (m) Without Timing With Timing Corr. # # # # Correlator Output Correlator Output y (metres) 7 x Baseline Baseline Baseline Time delay (metres) Figure 4. Cross-correlation peaks before correction Baseline Baseline Baseline Time delay (m) Figure 5. Cross-correlation peaks after correction x (metres) Figure 6. TDOA performance before and after timing corrections for data block 4. {circles: sensor nodes, square: true location, dashed lines: hyperbolae, solid lines: corrected hyperbolae}

12 CONCLUDING REMARKS An important application of GPS is timing and in this work the behavior of GPS timing under jamming conditions was evaluated. For a period after jamming, depending on the clock drift of the timing receivers, it is possible to switch to a backup timing source or to measure a number of time-delays for a short time before the degradation becomes significant. This length of time could be extended by using a software technique that characterizes the clock drift before the jamming outages occur but the holdover time was still limited due to the variable nature of the TCXOs used in the receivers. In jammer localization field trial, the performance of timing boards was found to be below what was expected but this could be overcome by using the GPS signals embedded in the data for TDOA processing. The use of the embedded GPS signals in the data used for TDOA processing provides an alternative to the timing boards and combined with the antenna array provides strong antijam capability. The future work will now look at the implementation of the post-processed timing techniques in near real-time in the GEMS II hardware platform. ACKNOWLEDGMENTS The authors would like to thank Matthew Trinkle for help during the field trial and data processing, Eamonn Glennon for help with the timing receiver setup, Peter Mumford for help with the bench jammer setup, Graeme Hooper from GPSat Systems for providing the STR765 interference simulator and GPIB interfacing, and Joseph Yiu for providing a HP 8658B for GPIB testing. This work was funded by Australian Research Council (ARC) Linkage grant LP889 led by the University of New South Wales with partners University of Adelaide and GPSat Systems, investigating the development of a network of sensor stations that can quickly detect and geo-locate interference to GPS within a given area. REFERENCES [] JA Volpe, "Vulnerability assessment of the transportation infrastructure relying on the Global Positioning System," U.S. Dept. of Trans., Final Report for the National Transportation Systems Center Aug 9,. [] A Dempster, "How Vulnerable is GPS?," Position, vol., pp , December 5. [3] The Royal Academy of Engineering, "Global Navigation Space Systems: reliance and vulnerabilities," March,. [4] J R Clynch et al., "The Hunt for RFI: Unjamming a Coast Harbor," GPS World, vol. 4, no., pp. 6-3, 3. [5] S Pullen and G. X. Gao, C. Tedeschi, and J. Warburton, "The impact of uninformed RF interference on GBAS," in Proceedings of the International Technical Meeting of the Institute of Navigation, Newport Beach, CA,. [6] E Cetin, R J R Thompson, and A G Dempster, "Interference Localisation within the GNSS Environmental Monitoring System (GEMS)," in IGNSS Symposium on GPS/GNSS, Sydney, Australia,. [7] M Trinkle, E Cetin, RJR Thompson, and AG Dempster, "Interference Localisation within the GNSS Environmental Monitoring System (GEMS) - Initial Field Test Results," in Proceedings of the 5th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION-GNSS), Nashville, Tennesee,. [8] MK Karakayali, "Network coordination for spectrally efficient communications in cellular systems," IEEE Wireless Communications, vol. 3, no. 4, 6. [9] M Kezunovic, "Smart Fault Location for Smart Grids," Smart Grid, IEEE Transactions on, vol., no., pp. -, March. [] F A Khan, "Behavior of the GPS Timing Receivers in the Presence of Interference," in Proceedings of the th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS 7), Fort Worth, TX, 7, pp [] J Bhatti, T Humphreys, and B Ledvina, "Development and Demonstration of a TDOA/FDOA-based GNSS Interference Signal Localization System," in IEEE/ION PLANS,. [] Nak-Seon Seong and Seong-Ook Park, "Clock offsets in TDOA localization," in Proceedings of the Third international conference on Ubiquitous Computing Systems (UCS'6), 6, pp. -8. [3] C Rizos, "Multi-constellation GNSS/RNSS from the perspective of high accuracy users in Australia," Journal of Spatial Science, vol. 53, no., pp. 9-63, 8. [4] R H Mitch et al., "Signal Characteristics of Civil GPS Jammers," in ION GNSS,. [5] O Isoz and D Akos, "Development of a deployable low cost interference detection and localization system for the GNSS L/E band," in n Satellite Navigation Technologies and European Workshop on GNSS Signals and Signal Processing (NAVITEC),,. [6] C Knapp and G Carter, "The generalized correlation method for estimation of time delay," Acoustics, Speech and Signal Processing, IEEE Transactions on 4, 976. [7] N Marechal, "Fine Synchronization for Wireless Sensor Networks Using Gossip Averaging Algorithms," in Communications, 8. ICC '8. IEEE International Conference on, 8, pp [8] S Stein, "Algorithms for ambiguity function

13 processing," Acoustics, Speech and Signal Processing, IEEE Transactions on, vol. 9, no. 3, pp , June 98. [9] S M Kay, Fundamentals of Statistical Signal Processing: Estimation Theory.: Prentice Hall, 993. [] C Roberts et al., "Centimetres across Sydney: First results from the SydNET CORS network," in Proceedings of SSC7, Hobart, Australia, 7, pp [] AT Balaei and B Motella, "A preventative approach to mitigating CW interference in GPS receivers," GPS Solutions, 8. [] DW Allan and MA Weiss, "Accurate Time and Frequency Transfer during Common-View of a GPS satellite," in In Proc. 34th Ann. Symp. on Frequency Control, 98, pp [3] K Borre, D Akos, N Bertelsen, P Rinder, and S Jensen, A Software-defined GPS and Galileo Receiver: A Single-frequency Approach.: Birkhauser, 7. [4] Yu S Shmaliy and L Arceo-Miquel, "Efficient predictive estimator for holdover in GPS-based clock synchronization," IEEE Trans. on Ultrason., Ferroel. and Freq. Contr, vol. 55, no., pp. 3-39, Oct 8. [5] M Trinkle and D A Gray, "GPS Interference Mitigation: Overview and experimental Results," in 5th International Symposium on Satellite Navigation Technology and Applications (SatNav ),. APPENDIX A - RESPONSE OF TIMING RECEIVERS TO DIFFERENT JAMMERTYPES AND POWER LEVELS Figure A. Timing degradation in the presence of a MHz Gaussian noise signal. NOISE (MHz) Wideband noise with a bandwidth of MHz. At the same power levels as the MHz noise the MHz noise causes a lower number of satellites to be lost as the power of the jammer signal is spread over a larger bandwidth Figure A3. Timing degradation in the presence of a MHz Gaussian noise signal. Jammer Power (dbm) Jammer On SWEPT CW (MHz) A swept single tone with a repetition rate of ms and an effective bandwidth of MHz. The spectral properties are similar to what was found for civilian GPS jammers [4]. The effect on the timing receiver is similar to that of the MHz noise Figure A. Jammer power levels over time. NOISE (MHz) Wideband noise with a bandwidth of MHz Figure A4. Timing degradation in the presence of a MHz swept CW. CW ON L A single continuous tone on L.