Detection and Localisation of Radio Frequency Interference to GNSS Reference Stations

Transcription

1 Detection and Localisation of Radio Frequency Interference to GNSS Reference Stations By Ryan James Richard Thompson A thesis submitted to The University of New South Wales in partial fulfilment of the requirements for the degree of Doctor of Philosophy School of Electrical Engineering and Telecommunications Faculty of Engineering The University of New South Wales Australia March 13 1

2 i

3 Abstract Global Navigation Satellite Systems (GNSS) are increasingly being relied upon in many applications. Reference stations provide corrections to errors inherent in GNSS processing, allowing GNSS to be used in more applications. The GNSS satellite signals are relatively weak and receivers are susceptible to Radio-Frequency Interference (RFI). To maintain the integrity of these reference stations any RFI must be detected and localised quickly. The research presented in this thesis investigates the detection and localisation of RFI using a sensor network. The first part of this thesis investigates RFI detection. For stationary receivers located in a stable environment, variations in the Carrier-to-Noise Density Ratio (C/No) can be used for detection. Weaker RFI can be detected if variations due to multipath are removed as they repeat with each satellite groundtrack. Issues associated with using the Automatic-Gain-Control (AGC) for RFI detection are also investigated. The drift in the AGC due to temperature is characterised and it could be reduced using a gain/temperature model, allowing the AGC to be used for detecting weaker RFI. The second part of this thesis investigates RFI localisation. An analysis using Dilution-of- Precision (DOP) showed that the Received-Signal-Strength (RSS) technique has potential. RSS performance was evaluated using simulations and real measurements and was found to suffer degradation due to the presence of ground reflections, resulting in the concluding that RSS is not appropriate. Time-Difference-Of-Arrival (TDOA) is another potential localisation method. Different aspects that affect TDOA were investigated, including time synchronization and effect of GNSS satellite cross-correlations. It was found that a number of time-delay measurements could be made before the timing from jammed GPS timing receivers degraded significantly, and that the GNSS satellite cross-correlation peaks make detecting and localising weaker RFI difficult. The explored C/No and AGC techniques are suitable for implementation into a sensor network and could detect weaker RFI using methods proposed in this thesis. For RFI localisation, TDOA was found superior to the RSS but some issues were found concerning weak RFI. The effectiveness of TDOA was demonstrated in a prototype system with real RFI and performance could be improved through an offline time synchronisation technique. ii

4 Acknowledgements My greatest thanks go to my supervisor Andrew Dempster who sparked my initial interest in this research area as an undergraduate student and gave me the opportunity to pursue my interest further. Next my thanks go to my co-supervisors Asghar Tabatabaei Balaei and Ediz Cetin who have provided close supervision and motivation over the course of my PhD. Thanks are also be given to Jinghui Wu for co-supervision during an interim part of the thesis. This research was undertaken as part of a partnership with the University of Adelaide and an industrial sponsor GPSat Systems. At the University of Adelaide I would like to thank Doug Gray and Mathew Trinkle. Special thanks are given to Mathew Trinkle for his supervision and motivation during the parts of this thesis undertaken in Adelaide. Gratitude is also given to Mark Knight for giving me the opportunity to collect real field trial data with live signals while in Adelaide. I would also like to thank Graeme Hooper and GPSat Systems for their contributions to the project and their willingness to provide equipment for use during experimentation. During my studies there have been a number of other people I must thank for support with theory and experimentation during this project, including Peter Mumford, Binghao Li, Eammon Glennon, Nima Alam, and Peter Leech from the School of Surveying and Geospatial Engineering. I would also like to thank the many members of the SNAP group for their friendship and support during my studies. My work was sponsored through an APAI-Linkage scheme so I give thanks to the Australian Government, the University of New South Wales, the University of Adelaide, and the industrial sponsor GPSat Systems, for providing funding to cover my research and living costs. I am also grateful for the funding I received to attend a number of conferences, including IGNSS 9, IGNSS 11, PLANS 1, and ION 1. Finally I would like to thank my family and all of my other friends for their support, without which I would not have been able to complete this thesis. iii

5 Table of Contents Abstract... ii Acknowledgements... iii Table of Contents... iv List of Figures... x List of Tables... xx List of Abbreviations... xxi Chapter 1 Introduction Vulnerability of Civilian Infrastructure to GNSS outages Research Motivation Contributions Carrier-to-Noise Density Ratio (C/No) Automatic Gain Control (AGC) Cross-Correlation Received Signal Strength (RSS) Time Difference of Arrival (TDOA) Thesis Structure List of Publications... 6 Chapter Background Introduction Global Navigation Satellite Systems Ground-Based Reference Stations The Threat of Radio-Frequency Interference Sources of Interference Case Studies of Interference Interference Effects iv

6 Table of Contents.4 Interference Detection Hardware Techniques Pre-Correlation Post-Correlation Interference Mitigation Hardware Techniques Pre-Correlation Baseband Processing Post-Correlation System-Level Interference Localisation Network-based Localisation Time Difference of Arrival Received Signal Strength Summary and Conclusion Chapter 3 Detection of RFI to GNSS Using C/No differences Introduction Carrier to Noise Density Ratio (C/No) C/No Estimation Noise Density Estimation Comparison between pre-no and post-no with RFI Effect of Integration Time Noise-Density With Synthetic Data Detection of RFI using C/No C/No Detection UNSW Experiment C/No Repeatability v

7 Table of Contents 3.5. Statistical Properties of C/No Measurements Day Separation False Alarm Performance Receiver Response to RFI Experiment Results with added RFI C/No for Multi-GNSS C/No for GPS C/No quantization effects False Alarm Performance C/No for GLONASS Comparison between GPS and GLONASS Minimum Detectable J/N Summary and Conclusion... 7 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control Introduction AGC Operation Estimation of jammer to noise ratio using AGC values σ-sensing AGC Histogram sensing AGC Correlation Losses AGC Stability Noise-Floor Estimation Detection Performance Summary and Concluding Remarks Chapter 5 Dilution of Precision for Interference Localisation Introduction vi

8 Table of Contents 5. Dilution of Precision DOP for Satellite Navigation Systems Maximum Likelihood Estimation (MLE) Interference Localisation Using DRSS Comparison of DOPs Linear Array of Sensors Four sensor arrays Five sensor arrays Summary and Concluding Remarks Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Introduction Path loss Models in Range-Based RSS positioning Log-normal shadowing model Two-ray reflection model Position Estimation Position Solution by Least-Squares Path loss exponent Least-squares solver Measuring path loss using Wi-Fi Logging RSS from Wi-Fi Devices Dynamic Test Characterising RSSI Values Field Experiment Path loss behaviour Positioning Results Comparison of position error with CRLB Divergent points vii

9 Table of Contents Optimal path loss value Different Sensor Sets Performance at GPS L1-band Path loss comparison between GPS L1 and Wi-Fi Simulations at GPS L1 Band Summary and Conclusions Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements Introduction Time-delay estimation GNSS signal cross-correlations Impact on detection Adaptive detection technique Behaviour for different baselines Very small (.38m) baseline Short (1m) baseline Moderate (5m) baseline Long (5km) baseline Impact on time-delay estimation Summary and concluding remarks Chapter 8 Evaluation of Relative GPS Timing under Jamming Conditions Introduction Effect of timing errors GPS timing receiver evaluation Performance of timing receivers under jamming Performance under jammers of different types and power Post-processed timing synchronisation Clock drift behaviour viii

10 Table of Contents Potential TCXO holdover Field trial experiment Real-time synchronisation performance Post-processed timing corrections Summary and Conclusions Chapter 9 Conclusions and Future Work Introduction Summary and Concluding Remarks Future Work Appendix A Response of Timing Receivers to Different Jammer Types and Power Levels A.1 Wideband Noise (MHz) A. Wideband Noise (1MHz) A.3 Swept CW (MHz) A.4 CW on L A.5 AM A.6 FM A.7 Pulsed Type 1 (4ms duty cycle every ms)... A.8 Pulsed Type (ms every 1 second)... References... 3 ix

11 List of Figures Figure.1. GPS L1 C/A code signal modulation... 1 Figure.. The calculation of position from the intersection of ranges to a receiver Figure.3. The IGS tracking network [8]... 1 Figure.4. Examples of areas with an increasing dependency on GNSS products [34] Figure.5. Generic band-pass sampling GNSS receiver architecture Figure.6. Losses for GPS and GLONASS with a CW at L1+1.5kHz Figure.7. The fall in the equivalent C/No from the presence of a wideband Gaussian interferer using (.) [6].... Figure.8. A network of sensors placed around the runway at an airport for localising interference sources Figure.9. The intersecting lines of an AOA localisation system Figure.1. The intersecting hyperbolas of a TDOA localisation system Figure.11. The intersecting circles of a RSS localisation system Figure 3.1. Generic receiver front-end Figure 3.. C/No values of an observable satellite using a pre-correlation estimation of the noise density Figure 3.3. Close-up of multipath oscillations as the satellite moves through different parts of the sky with a pre-correlation estimation of the noise density (zoom of Figure 3.) Figure 3.4. C/No values of an observable satellite using a post-correlation estimation of the noise density Figure 3.5. Close-up of multipath oscillations as the satellite moves through different parts of the sky with a post-correlation estimation of the noise density (close-up of Figure 3.4) Figure 3.6. Comparison of effective C/No with increasing J/N Figure 3.7. Comparison of effective C/No with increasing Doppler Figure 3.8. Effect of integration time on C/No losses for a GPS satellite in the presence of CW RFI Figure 3.9. Comparison of dips with GPS and GLONASS in the presence of CW RFI (1ms integration time) Figure 3.1. C/No estimated from synthetic data showing how a post-correlation estimation of the noise density reveals falls as the CW RFI crosses spreading code spectral lines Figure Correlator outputs from synthetic data (same data as used for Figure 3.1) revealing the increase in tracking loop variance as the CW RFI crosses spreading code spectral lines x

12 List of Figures Figure 3.1. A plot of the C/No values (using pre-no) versus elevation for a satellite. The threshold is made using (3.13) Figure A plot of the C/No values (using pre-no) over time during a flyover. The threshold is made using (3.13) Figure The C/No values from a satellite one day after another. The satellite groundtrack repeats approximately 4 seconds earlier each day Figure Two consecutive days of C/No values with the last day values corrected for groundtrack repeat time. The C/No values now align Figure The C/No values using a pre-correlation noise density estimate Figure The C/No values using a post-correlation noise density estimate Figure Standard deviation for C/No techniques (pre-no)... 5 Figure Standard deviation for C/No techniques (post-no) Figure 3.. Kernel density estimate of C/No in different elevation windows for pre-no Figure 3.1. Kernel density estimate of C/No in different elevation windows for post-no Figure 3.. C/No values with and without RFI Figure 3.3. The number of detections as RFI power is increased Figure 3.4. The repetition of the post-no C/No values after averaging every 3 seconds Figure 3.5. The post-no C/No values and the detection threshold after averaging every 3 seconds Figure 3.6. C/No (post-no) values with and without the effect of RFI using (3.8) Figure 3.7. The number of detections (post-no) as the power of a CW RFI at different frequency offsets is increased Figure 3.8. The drops from all visible satellites (post-no) Figure 3.9. The number of detections as RFI power is increased (post-no) Figure 3.3. Large-scale variations in multipath that repeats day-to-day from the NordNav C/No measurements Figure The C/No values corresponding to the C/No values shown in Figure 3.3, with the variations from multipath reduced Figure 3.3. A strong oscillation in the C/No caused by multipath that repeats day-to-day Figure The C/No values corresponding to the C/No values shown in Figure 3.3, with the multipath variations effectively removed Figure The standard deviation of C/No for different satellites over a number of day pairs Figure The mean of C/No for different satellites over a number of day pairs xi

13 List of Figures Figure Standard deviation for PRN Figure Standard deviation for PRN Figure The number of detections over time using the C/No values over a number of day pairs Figure The number of satellites with simultaneous detections using the C/No values over a number of day pairs Figure 3.4. The tracking problems during acquisition for PRN1 which caused a number of false alarms Figure The tracking problems during acquisition for PRN5 which caused a number of false alarms Figure 3.4. The fall in C/No for the different C/No estimators for a wideband RFI Figure The fall in C/No for the different C/No estimators for a CW RFI at different frequencies Figure The response of the NordNav C/No for a CW Sweep Figure The response of the C/No using a post-correlation estimate of the noise density for a CW Sweep Figure Experimental Setup Figure The C/No from the NordNav over a number of days, with a CW of J/N dB added on the last Figure The C/No and detection threshold corresponding to the C/No values from Figure Figure The C/No from the NordNav over a number of days, with a CW of J/N dB added on the last Figure 3.5. The C/No and detection threshold corresponding to the C/No values from Figure Figure The C/No values extracted from a number of days of RINEX data (GPS) from an IGS reference station Figure 3.5. An exampling of the repeating multipath behaviour in the C/No values extracted from RINEX data (close-up from Figure 3.51) Figure The C/No and resulting detection threshold without dithering added Figure The C/No and resulting detection threshold with dithering added, eliminating the problems from the quantisation of the C/No Figure The number of detections in 5s windows over time (GPS) Figure The number of effected satellites in 5s windows over time (GPS) xii

14 List of Figures Figure The C/No anomaly during day pair (GPS) which caused a number of detections. 65 Figure The C/No anomaly during day pair 4 (GPS) which caused a number of detections. 65 Figure The C/No anomaly during day pair 7 on PRN11 (GPS) which caused a number of detections Figure 3.6. The C/No anomaly during day pair 7 on PRN3 (GPS) which caused a number of detections Figure C/No values from the IGS RINEX data (GLONASS) Figure 3.6. Close-up of repeating multipath behaviour (GLONASS) Figure The number of detections in 5s over time (GLONASS) Figure The number of effected satellites in 5s windows over time (GLONASS) Figure The C/No anomaly during day pair 7 on PRN7 (GLONASS) Figure The C/No anomaly during day pair 7 on PRN1 (GLONASS) Figure Comparison of the standard deviation for C/No values over a 4 hour period Figure Kernel density estimate of satellite elevations over a 4 hour period Figure The minimum J/N that would cause detections for at least 3 satellites (1s windows) Figure 3.7. Kernel density estimate of minimum J/N for detection (1s windows) Figure The minimum J/N that would cause detections for at least 3 satellites (5s windows) Figure 3.7. Kernel density estimate of minimum J/N for detection (5s windows) Figure 4.1. The encoding behaviour of a -bit sign and magnitude ADC Figure 4.. The ideal AGC control loop Figure 4.3. The simulated response of the AGC gain voltage to an added RFI of J/N -6 db Figure 4.4. AGC loop that uses the quantised samples to estimate the rms level Figure 4.5. The σ-sensing AGC behaviour for different RFI types: CW and WB Figure 4.6. Increasing the number of quantisation bits makes the AGC gain behave closer to the ideal Figure 4.7. AGC loop that uses the histogram of the incoming samples to control the gain Figure 4.8. The normalised result of the numerical convolution to calculate the probability density function of noise plus CW RFI, with J/N = 7.8 db Figure 4.9. The change in gain for a histogram counting AGC with MAG set high 33% of the time Figure 4.1. The impact of changing the MAG high % on the sensitivity and response of the AGC gain to CW RFI xiii

15 List of Figures Figure The SNR loss as a function of L/σ for -bit quantisation Figure 4.1. Photograph of the USB temperature logger and the GPS receiver Figure The AGC values over a 138 second period Figure The variation of the AGC PulseWidth and temperature for a GPS receiver in an environment with mild exposure to the outside environment Figure A plot of the temperature versus AGC PulseWidth for the recorded data set Figure After being corrected by (4.8) the majority of the variation in the AGC value can be removed, leading to improved detection and J/N estimation of jammers Figure The overlapping of the histogram bin percentages for determining the noise floor of the Novatel receiver Figure The response of the AGC to CW RFI of increasing J/N Figure The change in the AGC PulseWidth compared with the expected change in gain Figure 4.. The difference in 6σ thresholds before and after temperature compensation Figure 4.1. The measured response of the AGC to CW RFI and the 6-σ detection thresholds with and without temperature compensation Figure 5.1. A D TOA positioning system using 3 satellites Figure 5.. An example of good DOP performance for TOA Figure 5.3. An example of poor DOP performance for TOA Figure 5.4. The distribution of position estimates for a TOA scenario with added measurement noise Figure 5.5. The error ellipse calculated for the measurement noise as used in Figure Figure 5.6. The difference of two RSS equations creating a DRSS equation, eliminating P o Figure 5.7. The circles of position for DRSS for sources (stars) placed along the x-axis Figure 5.8. The error ellipses for DRSS with and without solving for n Figure 5.9. The linear-array topology with interferer fixed at x=, with TDOA hyperbolas shown for a possible interferer location Figure 5.1. The GDOP (scaled by 1/c) for TDOA along the y-axis for a linear array of sensors with different sensor spacing Figure The GDOP for AOA along the y-axis for a linear array of sensors with different sensor spacing Figure 5.1. The GDOP for DRSS along the y-axis for a linear array of sensors with different sensor spacing Figure The DRSS circles for a position with infinite DOP xiv

16 List of Figures Figure A plot of the least-squares cost function for the dashed circles of position in Figure Figure For collinear arrays there are always solutions on either side of the baselines for TDOA and DRSS Figure Potential four sensor network topologies Figure The PDOP surface for DRSS in a 4 sensor square Figure The PDOP surface for DRSS in a 4 sensor triangle network Figure The DOP surface for DRSS in a square network (solving for n) Figure 5.. The DOP surface for DRSS in a triangle network (solving for n) Figure 5.1. A star array of sensors which has good DOP performance for all three methods Figure 5.. The DOP surface for DRSS in a star network Figure 5.3. The DOP surface for DRSS in a star network (solving for n) Figure 5.4. DOP comparison of different methods for a star array with spacing of 5m using some typical noise variances Figure 6.1. The geometry used for the two-ray reflection model Figure 6.. A comparison between the path loss for the log-normal (LN) and two-ray reflection model (RM) Figure 6.3. The lines of position for RSS and DRSS equations for a transmitter Figure 6.4. The least-squares cost function (in db) for the DRSS lines of position Figure 6.5. The path loss behaviour at 1m and 1m heights using the two-ray model Figure 6.6. The position estimation technique for DRSS Figure 6.7. The client-server interchange of packets when measuring RSSI in 'active' scanning mode Figure 6.8. The monitoring of the broadcast beacons from access-points in 'passive' scanning mode Figure 6.9. A photograph of the USB Wi-Fi adapter used in the experiments Figure 6.1. The RSSI (in dbm) values from the Windows Network Driver Interface Specification (NDIS) interface while rotating the USB adapter s antenna Figure The RSSI (unitless) values from the modified zd111rw Linux drivers while rotating the USB adapter s antenna Figure 6.1. The setup for characterising the RSSI from the USB Wi-Fi dongle Figure The RSSI (unitless) values at different attenuations Figure The spline fit of the histogram of RSSI at different attenuations Figure The fall in RSSI before and after the spline calibration technique xv

17 List of Figures Figure The USB Wi-Fi adapter and antenna used as a sensor node Figure The rover with RTK GPS and a Wi-Fi access point Figure Sensor network setup Figure 6.19 The RSSI values measured at different sensor nodes #1, #, and #3, over time with the transmitter located at one of the test points Figure 6.. The test locations where path loss was measured for the 1.5m data set Figure 6.1. The path loss behaviour for the 1.5m data set Figure 6.. The test locations where path loss was measured for the 1.55m data set Figure 6.3. The path loss behaviour for the 1.55m data set Figure 6.4. The ECDF comparison of positioning results at heights of 1.5m and 1.55m Figure 6.5. The vectors of the position errors for the 1.5m height data Figure 6.6. The vectors of the position errors for the 1.55m height data Figure 6.7. The error ellipses for different sets of parameters being estimated Figure 6.8. A comparison of the position error and CRLB for the 1.5m data Figure 6.9. A comparison of the position error and CRLB for the 1.55m data Figure 6.3. The position error for test point in the 1.55m data set Figure The path loss models for test point in the 1.55m data set Figure 6.3. The position error for test point 31 in the 1.55m data set Figure The path loss models for test point in the 1.55m data set Figure The 67th percentile position error for different fixed path loss exponent values for the 1.5m data set Figure The 67th percentile position error for different fixed path loss exponent values for the 1.55m data set Figure The DRSS lines of position with all sensor node measurements for test point 14 in the 1.55m data set Figure The DRSS lines of position with sensor node 4 excluded from the measurements for test point 14 in the 1.55m data set Figure The path loss using the two-ray model Figure The distribution of the position estimates for a number of simulation runs with transmitter at (5,5) Figure 6.4. The distribution of the position estimates for a number of simulation runs with transmitter at (75,75) Figure The path loss behaviour at the different simulation heights for the transmitter at (5,5) xvi

18 List of Figures Figure 6.4. The path loss behaviour at the different simulation heights for the transmitter at (75,75) Figure The distribution of the position estimates for a number of simulation runs with transmitter at (5,5) Figure The distribution of the position estimates for a number of simulation runs with transmitter at (75,75) Figure 7.1. Possible signals present at two sensor nodes in the L1 band Figure 7.. 1ms of IF data cross-correlated together for sensor nodes separated by 1m Figure 7.3. Close-up of the cross-correlation peak at zero-delay for sensor nodes separated by 1m Figure ms of IF data cross-correlated together for sensor nodes separated by 5km Figure 7.5. Close-up of the cross-correlation peak at zero-delay for sensor nodes separated by 5km Figure 7.6. View of peaks around zero-delay with different front-end filter bandwidths Figure 7.7. View of a side peak with different front-end filter bandwidths Figure 7.8. Circular cross-correlation output with and without GPS signals Figure 7.9. Histogram of the correlator output with and without GPS signals Figure 7.1. Output of the correlator near zero-delay for a baseline of 1m over 1 seconds Figure Output of the correlator along zero-delay for a baseline of 1m Figure 7.1. Block diagram of the mean change detection algorithm Figure Figure 13. Output of the correlator for the.38m baseline with RFI added Figure Response of the detection technique, with the outputs breaching the threshold causing a detection Figure Output of the correlator for the 1m baseline with RFI added Figure Magnitude of the correlator along zero delay with no obvious crossing of the thresholds when RFI is added Figure The real part of the correlator showing crossing of the detection threshold Figure The imaginary part of the correlator Figure Output of the correlator for the 5m baseline with RFI added Figure 7.. The magnitude of the correlator output along zero delay Figure 7.1. The correlator output for the 5km baseline Figure 7.. The magnitude along a delay bin containing on a single satellite with RFI added after 5 seconds xvii

19 List of Figures Figure 7.3. The magnitude along a delay bin containing two satellites with RFI added after 5 seconds Figure 7.4. The individual components for the single satellite at a delay of Figure 7.5. A sum of sines fit used to model the output at a delay of Figure 7.6. An example of an anomaly error introduced by the GPS cross-correlations Figure 7.7. An example of bias introduced by the GPS cross-correlations Figure 7.8. Location of the peak in the correlation function over 15 seconds of data for added RFI of different power Figure 7.9. The number of anomalous time-delay estimates as a function of effective J/N Figure 7.3. RMSE for anomaly free time-delays as a function of effective J/N Figure Bias for anomaly free time-delays as a function of effective J/N Figure 8.1. GPS time transfer testing setup Figure 8.. The behaviour of the error in the baseline length and the timing offset with the timing receivers operating in navigation mode for the North-South baseline test Figure 8.3. The time-series of the timing offset between the timing receivers for the Zero and North-South baselines in hold mode Figure 8.4. Jammer testing configuration Figure 8.5. Response of the timing offset in the PPS outputs between the timing receivers to a jamming signal being turned on and off over time Figure 8.6. Response of frequency offset in the 3.7MHz outputs between the timing receivers to a jamming signal being turned on and off over time Figure 8.7. The different power levels used for the jamming signals over time Figure 8.8. The response of the timing offset and the number of satellites used for the MHz noise jammer Figure 8.9. Response of reported C/No for a satellite during the jammer testing Figure 8.1. Geometry of satellite time-delays between sensor nodes during common-view of a GPS satellite Figure The relationship between the locations of the TOW messages and absolute samples betweens the two sensor nodes Figure 8.1. Setup for testing long baseline synchronisation using postprocessing between unsynchronised front-ends Figure An example of the sample offsets calculated between two unsynchronised IF data sets Figure Setup for testing long baseline synchronisation using postprocessing xviii

20 List of Figures Figure Sample offsets between two files Figure The clock drift in receiver 1 over time Figure The clock drift in receiver over time Figure The relative clock drift between the two independent GPS receivers with a shared antenna Figure The ambient temperature recorded next to the two GPS receivers Figure 8.. Best case performance of a linear fit holdover technique during a simulated outage due to jamming Figure 8.1. Worst case performance of a linear fit holdover technique during a simulated outage due to jamming Figure 8.. The resulting timing offset caused by the error in the clock drift fit over the outage period Figure 8.3. The field trial experimental setup [18] Figure 8.4. Sensor node and timing architecture Figure 8.5. The difference between the delay of the satellites from the tracking outputs and the true delay Figure 8.6. The timing offset measured between the different sensor node pairs using the GPS satellites in the captured IF data for TDOA processing Figure 8.7. Cross-correlation peaks before correction Figure 8.8. Cross-correlation peaks after correction Figure 8.9. TDOA performance before and after timing corrections for data block Figure A.1. Timing degradation in the presence of a MHz Gaussian noise signal Figure A.. Timing degradation in the presence of a 1MHz Gaussian noise signal Figure A.3. Timing degradation in the presence of a MHz swept CW Figure A.4. Timing degradation in the presence of a CW on L Figure A.5. Timing degradation in the presence of an AM signal Figure A.6. Timing degradation in the presence of a FM signal.... Figure A.7. Timing degradation in the presence of a pulse signal.... Figure A.8. Timing degradation in the presence of a pulse signal... 1 xix

21 List of Tables Table.1. Different types of RF interference and potential sources [41] Table 3.1. Detection performance for C/No from the NordNav receiver... 6 Table 5.1. DOPs for a linear array of sensors Table 6.1. The positioning results from the experiments at 1.5m and 1.55m heights Table 6.. Positioning results with different strategies for the path loss exponent (1.5m data set) Table 6.3. Positioning results with different strategies for the path loss exponent (1.55m data set) Table 6.4. The positioning performance when excluding a sensor node Table 6.5. First Fresnel zone distance comparison between Wi-Fi and GPS Table 6.6. Simulated Positioning Results for a small area network Table 6.7. Simulated Positioning Results for a wide area sensor network Table 8.1. Relative timing synchronisation performance between the timing receivers Table 8.. The minimum/maximum number of satellites used in the timing solution during jamming Table 8.3. Timing and position error in meters at location Table 8.4. RMSE with and without timing corrections xx

22 List of Abbreviations RM ADC AGC AM AOA ARC ASC AWGN bps BPSK BW CDMA CFAR CORS COTS CRLB CW C/A C/No DGPS DF DME DOP DSPN DRSS ECDF FDMA FDOA FM FIM FIR FPGA Two-ray model Analogue to Digital Converter Automatic Gain Control Amplitude Modulation Angle of Arrival Australian Research Council Active Signal Cancellation Additive White Gaussian Noise bits per second Binary Phase Shift Keying Bandwidth Code Division Multiple Access Constant False Alarm Rate Continuously Operating Reference Station Commercial of the Shelf Cramer-Rao Lower Bound Continuous Wave Coarse/Acquisition Code Carrier to Noise Density Ratio Differential GPS Direction Finding Distance Measuring Equipment Dilution of Precision Direct Sequence Pseudorandom Noise Difference of RSS Cumulative Distribution Functions Frequency Division Multiple Access Frequency Difference of Arrival Frequency Modulation Fisher Information Matrix Finite Impulse Response Field Programmable Gate Array xxi

23 List of Abbreviations GAMES GD GN GBAS GEMS GIMOS GLONASS GNSS GPS GPSDO GRAS IF IGS INS I-P J/N J/S LBS LM LN LNA LORAN MAC MAG NB Mc/s MCDD MLE MM MOPS MSS NDIS NLOS NMEA GPS Anomaly Monitoring Equipment Suite Gradient Descent Gauss-Newton Ground-Based Augmentation System GNSS Environmental Monitoring System GNSS Interference Monitoring System Global Navigation Satellite System Global Navigation Satellite System Global Positioning System GPS Disciplined Oscillator Ground-Base Regional Augmentation System Intermediate Frequency International GNSS Service Inertial Navigation System In-Phase Jammer to Noise Ratio Jammer to Signal Ratio Location-Based Services Levenberg-Marquardt Log-normal Low Noise Amplifier LOng RAnge Navigation Media Access Control Magnitude Narrowband Mega chips per second Multi-Correlation Differential Detection Maximum Likelihood Estimator Method of Moments Minimum Operational Performance Standards Mobile Satellite Services Network Driver Interface Specification Non Line of Sight National Marine Electronics Association xxii

24 List of Abbreviations OCXO N Pd PDOP PNT post-n pre-n PPD PPS PRN P(Y) Q-P QZSS RAIM RF RFI RMSE ROC RSS RTCA RINEX RSSI RTK SATCOM SBAS SSC SCW SNR SNR eff SPS SQM SSIS SUI S/N Oven Controlled Crystal Oscillator Noise Density Probability of Detection Position Dilution of Precision Position Navigation Timing Post-Correlation Noise Density Pre-Correlation Noise Density Privacy Protection Device Pulse Per Second Pseudo random Noise Precision Code Quadrature-Phase Quazi-Zenith Satellite System Receiver Autonomous Integrity Monitoring Radio Frequency Radio Frequency Interference Root Mean Square Error Receiver Operating Characteristic Received Signal Strength Radio Technical Commission for Aeronautics Receiver Independent Exchange Format Received Signal Strength Indication Real Time Kinematic SATellite COMmunications Space-Based Augmentation System Spectral Separation Coefficient Swept Continuous Wave Signal to Noise Ratio Effective SNR Standard Positioning Service Signal Quality Monitoring Service Set Identifiers Stanford University Interim Signal to Noise xxiii

25 List of Abbreviations TCXO TDOA TOA TOW US WB WMI UAV UWB UNSW VGA C/No Temperature Compensated Crystal Oscillator Time Difference of Arrival Time of Arrival Time of Week United States Wideband Windows Management Instrumentation Unmanned Aerial Vehicle Ultra Wideband University of New South Wales Variable Gain Amplifier C/No difference xxiv

26 xxv List of Abbreviations

27 Chapter 1 Introduction 1.1 Vulnerability of Civilian Infrastructure to GNSS outages The term Global Navigation Satellite System (GNSS) encompasses a range of systems that provide Position, Navigation, and Timing (PNT) capabilities through transmitted satellite signals. When the first fully functioning GNSS, the NAVSTAR Global Positioning System (GPS), was originally developed by the United States Department of Defense it was intended to provide these capabilities to authorised military users only. After a Korean passenger jet was shot down by a Soviet fighter while travelling over restricted airspace a directive was made by the then US President Ronald Reagan that the capabilities provided by GPS should be available to civilians so that such a tragedy could be avoided in the future [1]. Since that time GPS has been developed as a system for both civilian and military users. Over time, through advances in GNSS technology, and the removal of selective availability [], the performance of the PNT solutions that GNSS has provided has greatly surpassed its original specification. At the same time the price of GNSS receivers has decreased substantially and GNSS services are now commonly available in consumer products, creating a growing industry based on Location-Based Services (LBS). Its global coverage, good performance, and good 1

28 Chapter 1 Introduction reliability record has also allowed GNSS to become increasingly relied upon in a number of applications. The signals transmitted by GNSS satellites are relatively weak by the time they reach the user and as a result GNSS receivers are susceptible to either intentional or un-intentional jamming from Radio Frequency Interference (RFI). As society becomes more reliant on the services provided by GNSS, parts of critical civilian infrastructure are becoming vulnerable to GNSS outages caused by RFI [3]. There have been a number of real world examples of RFI disrupting GNSS, including a malfunctioning television antenna amplifier that jammed Differential GPS (DGPS) service in a harbour [4], military jamming exercises disrupting a hospital paging system which relied on telecommunications networks using GPS [5], harmonics from a high powered television broadcast tower [6] affecting nearby GNSS receivers, and a Privacy Protection Device (PPD) from a truck driver disrupting the Ground-Based Augmentation System (GBAS) at an airport [7]. An example of an augmentation that increases the capability of GNSS is ground-based reference stations. These are used to augment the integrity, utility, and performance of GNSS [8]. The improvements to integrity rely on the monitoring of the satellites signals by the reference station for signal faults and distortions. The improvements in performance rely on corrections to many of the errors inherent in GNSS processing, and these corrections can be provided to users in an area. Scenarios where these corrections are important include vertical aiding for aircraft landing, navigation in sea-ports, and precision agriculture. These scenarios are particularly vulnerable if the availability of corrections is lost during a critical time due to the presence of RFI. 1. Research Motivation There is uncertainty surrounding the ability to deal with the threat of RFI that leaves a number of GNSS users vulnerable and holds back its adoption by others. This is delaying the potential cost reductions and productivity increases that GNSS can provide. One example is the aviation industry where traditional landing aids are expensive to maintain and are inflexible in relation to flight paths and ability to operate in different weather conditions, and this capability can be provided more economically using GNSS. The cost of a failure of a GNSS landing aid in terms of life and economics in an aviation scenario could be catastrophic in the worst case. This uncertainty and vulnerability is the driving motivation for the research undertaken in this thesis. One potential solution to the problem of RFI is to deploy a network of permanent sensor stations to monitor for the presence of RFI and quickly localise it once detected. The use of a permanent sensor network has potential advantages over traditional detection and localisation

29 Chapter 1 Introduction methods which can take some time to track down RFI sources [4],[7]. This thesis will look at potential detection and localisation techniques which are facilitated by a permanent sensor network. This research is undertaken as part of Australia Research Council (ARC) Linkage grant LP88191 led by the University of New South Wales with partners the University of Adelaide and GPSat Systems, Australia. The ultimate goal is integration of the results of this thesis into the second phase of the GNSS Environment Monitoring System (GEMS), a network of sensors that provides integrity monitoring of GNSS signals over an area, to provide the capability of being able to detect and localise any RFI in a precise and timely manner. 1.3 Contributions This work has contributed to the detection and localisation of RFI sources to GNSS receivers and reference stations as outlined in this section. In terms of detection, three different techniques have been investigated and research produced concerning the following: Carrier-to-Noise Density Ratio (C/No) In GNSS receiver operation, the C/No is an important metric for evaluating the quality of the tracking outputs from satellites. The C/No can be used for the detection of RFI but is generally a noisy measurement because of variations caused by multipath. In Chapter 3 it is shown that these variations repeat with a satellite s ground-track and by taking the difference of C/No between ground-tracks, much of this variation can be removed allowing C/No to be used more effectively for detecting RFI Automatic Gain Control (AGC) In the RF front-end of a GNSS receiver, an AGC is required to minimize quantisation losses. The AGC gain can be used for detecting RFI as it reflects the power at the receiver's antenna. This is limited by how the AGC drifts over time. In Chapter 4 it is shown that this drift is highly correlated with temperature and can be effectively removed after modelling the change in the AGC gain with respect to temperature over a couple of days Cross-Correlation Although cross-correlation is important for calculating time-delays in a TDOA localisation system, it can also be used for detecting the presence of RFI. The GNSS 3

30 Chapter 1 Introduction signals captured with the RFI will also create peaks in the cross-correlation function. In Chapter 7 it is found that these cross-correlation peaks do make detection more difficult with a loss in the minimum detectable RFI power. The results prompt investigation into the removal of these GNSS signals to improve performance. In terms of localisation, aspects of two different methodologies have been investigated and research produced concerning the following: Received Signal Strength (RSS) Although this work is motivated by GPS L1, it is generally not legal to transmit in the L1 band. To explore RSS Commercial of the Shelf (COTS) Wi-Fi devices were used. A common issue with these devices is the dependability of the RSSI provided. In Chapter 6 it is shown that in combination with a variable attenuator and an access point with fixed power a spline fit could be used to deal with the problem of outliers in the RSS measurements from Wi-Fi adapters. In theoretical works the log-normal path loss model is typically used. The theoretical analysis of the performance of RSS was found to be good through evaluation of DOP in Chapter 5. In Chapter 6 RSS was evaluated in a field trial using Wi-Fi devices. The lognormal model does not account for ground reflections, which caused a significant degradation in the path loss as the heights of the transmitter and receivers were increased. As a result RSS was found not to be a robust localisation method, even for a network with sensor spaced close together. The AGC can be used for providing RSS measurements. The influence of the AGC methodology on the behaviour of RSS was investigated in Chapter 4 and it was found that the response of the AGC depends on quantisation error and the probability density function of the RFI. For an AGC that uses the histogram of the quantised samples, the difference in the response could be removed by changing the desired number of samples in the different histogram bins Time Difference of Arrival (TDOA) In the TDOA methodology, strong time synchronisation is required between sensor nodes. An economical method for providing this synchronisation is to use GPS timing 4

31 Chapter 1 Introduction receivers, but in the presence of RFI their performance will degrade. In Chapter 8 the performance of timing is evaluated under jamming conditions and it is found that a number of TDOA measurements can be taken before it degrades too much. It is also found that the position performance using TDOA can be improved by post-processing the GNSS signals captured in the data and applying timing corrections to the time-delay estimates. The data captured at sensor nodes for a GNSS interference localisation system will contain any GNSS satellites and pseudo-lites transmitting in the same band as the unwanted RFI. The power of the combination of all of these signals is not negligible and the effect of these signals on distorting the cross-correlation is explored in Chapter 7. Any distortion will increase the error in the time-delay estimates, resulting in an overall decrease in the accuracy of the TDOA localisation system. The results demonstrated that the removal of the GNSS signals will improve the ability to localise weaker, but easily detectable RFI. Concurrent with the research undertaken during this thesis, a prototype of the GEMS system operating in real-time was demonstrated to participants at the IGNSS 11 conference, and a field trial using a network of GEMS nodes placed in an area with live interferers was performed under the supervision of the Australian Department of Defence. 1.4 Thesis Structure This thesis is structured in nine chapters with one appendix. In Chapter 1, an introduction is given describing the problem area dealt with in this thesis and thesis contributions. Chapter provides a background on the previous research and challenges involved with dealing with the threat of RF interference to GNSS. In Chapter 3, the concept of C/No differences is introduced and evaluated for the detection of RFI. In Chapter 4, the detection and power estimation of RFI to GNSS using the AGC is explored. In Chapter 5, different potential passive localisation methodologies for GNSS RFI are explored using the Dilution of Precision metric. In Chapter 6, the passive localisation of unknown sources is explored using the RSS technique. In Chapter 7, the influence of GNSS cross-correlations on detection and time-delay estimation is explored in the context of a TDOA localisation system. In Chapter 8, an evaluation of GPS timing under jamming conditions is given, with extended results given in Appendix A. The thesis concludes with a summary and an outline of potential future work in Chapter 9. 5

32 Chapter 1 Introduction 1.5 List of Publications Research undertaken during this thesis has been published in the following journal publications: [9] Cetin E, Thompson RJR, Dempster AG, (13) "Passive Interference Localization within the GNSS Environmental Monitoring System (GEMS) TDOA Aspects", GPS Solutions. Accepted for publication pending modifications. Research undertaken during this thesis has been published in the following peer-reviewed conference proceedings: [1] Thompson RJR, Cetin E, Dempster AG, (11) "Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control", IGNSS11 Symposium on GPS/GNSS, Sydney, Australia, November 11. [11] Thompson RJR, Cetin E, Dempster AG, (11) "Influence of GPS Satellites Cross- Correlation on the TDOA Measurements within the GNSS Environmental Monitoring System (GEMS)", IGNSS11 Symposium on GPS/GNSS, Sydney, Australia, November 11. Research undertaken during this thesis has been published in the following conference proceedings: [1] Thompson RJR, Balaei AT, Dempster AG, (9) "Dilution of precision for GNSS interference localisation systems", European Navigation Conference (ENC GNSS), Naples, Italy, 9. [13] Thompson RJR, Balaei AT, Dempster AG, (9) "Outdoor localization of a WiFi source with unknown transmission power. IGNSS9 Symposium on GPS/GNSS, Gold Coast, Australia, December 9. [14] Thompson RJR, Balaei AT, Dempster AG, (1) "Detection of RF interference to GPS using day-to-day C/No differences", 1 International Symposium on GPS/GNSS, Taipei, Taiwan, October 1. [15] Cetin E, Thompson RJR, Dempster AG, (11) "Interference Localisation within the GNSS Environmental Monitoring System (GEMS)", IGNSS11 Symposium on GPS/GNSS, Sydney, Australia, November 11. 6

33 Chapter 1 Introduction [16] Thompson RJR, Cetin E, Dempster AG, (1) "Unknown Source Localization using RSS in Open Areas in the Presence of Ground Reflections", ION/IEEE PLANS 1, Myrtle Beach, USA, April 1. [17] Thompson RJR, Cetin E, Dempster AG, (1) "Evaluation of Relative GPS Timing Under Jamming Conditions," Proceedings of the 5th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS 1), Nashville, TN, September 1, pp [18] Trinkle M, Cetin E, Thompson RJR, Dempster AG, (1) "Interference Localisation within the GNSS Environmental Monitoring System (GEMS) - Initial Field Test Results" Proceedings of the 5th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS 1), Nashville, TN, September 1. 7

34 Chapter 1 Introduction 8

35 Chapter Background.1 Introduction In the following chapter an overview is provided of the background and challenges related with dealing with threat of RF interference to GNSS systems. This includes a brief outline of the technical details associated with potential detection, mitigation, and localisation techniques and how the research undertaken in this thesis attempts to addresses some of the issues.. Global Navigation Satellite Systems The term Global Navigation Satellite System (GNSS) encompasses a range of satellite based systems that can be used for determining a user's position at any location at any time around the world [19]. Along with position, the technology also provides a number of other products, such as timing and frequency information. Using these products the GNSS signals have been used for a seemingly endless number of applications, from protecting assets from theft [], to monitoring changes in the ionosphere [1]. At the moment there are two fully operational GNSS systems that provide global coverage, the United State's GPS [] and the Russian Federation's GLONASS [3]. 9

36 Chapter Background The NAVSTAR Global Positioning System was developed by the United States Department of Defense and became fully operational in It consists of a nominal constellation of 4 operational satellites that transmit ranging signals on two frequencies at L1 (1575.4MHz) and L (17.6MHz). On the L1 band a Coarse-acquisition (C/A) code is broadcast for civilian use along with an encrypted Precision P(Y) code for military use. The encrypted P(Y) code is also broadcast on the L band which forms a dual-frequency use system for authorised users. The military codes provide better accuracy and anti-jamming performance then the civilian codes. The development of codeless and semi-codeless tracking techniques [4] have allowed civilian users to take advantage of the encrypted signal on L but its use is not guaranteed by the US military. In GPS each satellite broadcasts on the same frequency and uses Code Division Multiple Access (CDMA) modulation to distinguish between them. The CDMA spreading code consists of special 'Gold codes' encoded on the carrier frequency using Binary-phase-shift-keying (BPSK) with a chipping rate of 1.3Mcps (chips per second) and a data rate of 5bps. An overview of the encoding scheme is shown in Figure.1. The spreading code is used as the ranging signal and the encoded data contains all of the satellite ephemeris data required to calculate a position. Figure.1. GPS L1 C/A code signal modulation To acquire and track these signals a GPS receiver down-converts the incoming RF signal to a baseband frequency and then performs a search in Doppler frequency and code offset. To estimate the distance between the satellite and the receiver the code phase between a downconverted satellite signal and a locally generated replica is used to calculate a pseudorange. The 1

37 Chapter Background term pseudorange is used because the distance measurement includes an offset due to receiver clock error. Using four satellites it is then possible to calculate for position and the receiver clock error using the intersection of spheres using these pseudoranges. Although only three satellites are required to solve for position in three dimensions a fourth pseudorange is required to estimate the timing offset of the receiver clock which is typically of lesser quality than the atomic clocks used on the GPS satellite vehicles. The geometry of the Time of Arrival (TOA) localisation methodology that GPS employs is shown in Figure. and the true receiver position lies at the intersection of the three shown ranges. r r 3 Figure.. The calculation of position from the intersection of ranges to a receiver. The potential of the capabilities provided by a GNSS are used in a variety of applications outside of traditional navigation. A majority of the world's telecommunications and power networks now rely on GPS for timing synchronisation. The increased reliance is now starting to cause alarm at the potential for significant outages in everyday services if there is a fault with the GPS system [5]...1 Ground-Based Reference Stations In its basic form the standard positioning service (SPS) provided by GPS to civilian users is capable of providing accuracy at best up to 3-5m [6]. Using differential GPS (DGPS) and realr 1 Receiver 11

38 Chapter Background time kinematic (RTK) techniques it is possible to significantly improve this accuracy by using corrections from a base-station with a known location. These corrections are typically provided by a network of reference stations and there are a number of such networks in the world servicing public and private users. An example of such a network is the International GNSS service (IGS) tracking network [7]. This service provides high quality GPS and GLONASS products which facilities a variety of geodetic and research uses. There are also a number of Continuously Operating Reference Station (CORS) networks for providing real-time access to geodetic level positioning for applications such as surveying and precision agriculture. These networks can consist of many hundreds of tracking stations as shown by an outline of the locations of the reference stations used in the IGS tracking network in Figure.3. These networks represent a significant investment in terms of hardware as well as a means of accessing the reference data in a timely manner. Figure.3. The IGS tracking network [8]. In certain applications, along with improved positioning accuracy, a degree of integrity is also required about the signals being used for navigation. A good example of such an application is precision guided aircraft landings where safety-of-life is an issue. In terms of integrity a network of ground stations is required to continually monitor the satellite signals to detect any faults and to flag an alarm quickly if any faults are detected. On a large scale this integrity is often provided by a Space-Based Augmentation System (SBAS) but it may not respond quickly enough or provide coverage for all applications and users. To ensure the safety of the service a local 1

39 Chapter Background network which can respond faster is required. SBAS is also unable to detect the presence of any local disturbances or RFI which may deny integrity in a given area. In Australia there are two kinds of augmentation systems that are being developed for the purpose of aviation by Airservices and Honeywell, the Ground-Based Augmentation System (GBAS) and the Ground-Based Regional Augmentation System (GRAS) [9]. Recently the Honywell GBAS system was approved by the Australia Civil Aviation Authority to begin performing Cat-I precision landings at Sydney Airport [3]. The accuracy of the corrections provided by the reference stations used in the GBAS and GRAS systems however is dependent on the GPS receiver operating in an environment where there is no radio-frequency interference to jam or degrade its positioning solution. The usefulness of these reference and augmentations systems will degrade in the presence of radiofrequency interference in the GNSS bands [31]..3 The Threat of Radio-Frequency Interference The signals transmitted by the GNSS satellites are relatively weak [5] by the time they reach the receivers on the ground. They are broadcast by satellites orbiting at a nominal range of 4,km and the minimum received signal power on the surface of the Earth is -16dBW []. This makes GNSS receivers vulnerable to even weak sources of radio-frequency interference (RFI) that overpowers the already weak GNSS signals. In in the United States something as innocent as a malfunctioning television antenna amplifier was able to jam GPS service in a 1km area at a harbour [3]. Intentional jamming tests in the United Kingdom have shown that a 1.5W noise source can jam over 5nm [33] from transmitter source. In 1 a small personal jammer used in a delivery van was capable of disrupting the GBAS system at Newark Airport while driving on a nearby highway [7]. The threat of RFI presents a worrying problem to those responsible for maintaining infrastructure that is increasingly relying on the services provided by GNSS for day to day operation. In 11 the United State's National PNT Advisory Board released a report [34] detailing the extent to which infrastructure has become dependent on GPS and examples are shown in Figure.4. One of the biggest uses of GNSS outside of traditional navigation is the ability to provide timing and frequency transfer and a large dependency on GPS as a time source exists in the electric power and telecommunications industries [35]. Strong timing synchronisation is required in power generation networks for maintaining a reliable power supply as the monitoring requirements increases as the networks become ever more complicated. In telecommunications networks 13

40 Chapter Background timing requirements are becoming tighter as the number of users and data rates is increasing. A real world example of the vulnerability of telecommunications to jamming event was a hospital's paging system which was disrupted in San Diego in 8. Power Grids Commerce Defense Transport GNSS Law Enforcement Scientific Research Comms. Networks Emergency Services Figure.4. Examples of areas with an increasing dependency on GNSS products [34]. Not only is the reliance on GNSS increasing as industries take advantage of the services they provide the reliance is also increasing as a number of traditional systems that provide similar services are being shut down. In 1 the LORAN-C system which can provide a backup of timing and positioning capabilities [36] to GNSS was planned to be dismantled [37]. In order to save costs it is also being proposed to decommission the more traditional aircraft landing aids and replace them with GNSS-based systems. Without suitable backups a way to protect these systems that relies on GNSS, a way of detecting, mitigating, and localising any interferers in a timely manner is needed [38]..3.1 Sources of Interference In the context of GNSS vulnerability RFI can be defined as any unwanted signal that is picked up by the GNSS receiver hardware while attempting to process the available satellite or augmentation signals. The structure of the RFI signal could be of a variety of different types and modulations, and could be being transmitted intentionally or unintentionally. With the increase in spectrum congestion and the increasing proliferation of GPS jammer products the number and sources and occurrences of RFI can be expected to increase. Designs for GPS jammers are readily 14

41 Chapter Background available [39] or can be purchased complete online [4]. In this thesis the following definitions below and as shown in Table.1 of interference are used: Continuous Wave (CW) Interference: A single un-modulated carrier. Narrow Band (NB) Interference: Interference with discrete frequency spectra. Wide Band (WB) Interference: Interference that has spectral energy spread over a wider area but the majority is captured by the receiver front-end. Ultra Wide Band (UWB) Interference: Interference that has spectral energy over a very large range (multiple bands), of which only a small percentage is captured by the receiver front-end. In-Band Interference: Interference that is broadcast in the frequency allotments used for GNSS receivers Out-of-Band Interference: Interference that is broadcast in the frequency allotments next to the GNSS bands that is powerful enough to be mixed in-band by the receiver front-end components. Intermodulation Interference: Interfering components resulting from the interaction of two or more spectral components passing through a device with nonlinear behaviour. Table.1. Different types of RF interference and potential sources [41] Type Wideband Gaussian Wideband phase/frequency modulation Wideband spread-spectrum Wideband pulse Narrowband phase/frequency modulation Narrowband swept continuous wave Narrowband continuous wave Example sources: Intentional jammers. Television transmitter harmonics, microwave and satellite communication links. Intentional jammers, microwave and satellite communication links, pseudo-lites. Aviation DME, radar transmitters. Intentional jammers, AM and FM radio transmitter harmonics. Intentional jammers or FM station harmonics. Intentional jammers, unmodulated carriers and intermodulation products. A great deal of study into the effects of interference on GNSS receivers has been motivated by the potential of GNSS as a navigation aid in aviation. Guidelines have been given by the RTCA 15

42 Chapter Background for minimum operating standards (MOPS) for receivers in the presence of RFI [4]. These guidelines have been formulated by evaluating the effect of different types of RFI on the performance of receivers and the powers at which they begin to degrade performance. In the following section a number of real-world examples of RFI is be presented..3. Case Studies of Interference One of the first identified threats to GPS was from aeronautical satellite communications (SATCOM) and mobile satellite services (MSS) equipment operating close to GPS receivers in aircraft [43]. These devices broadcast in frequencies surrounding GNSS bands (MSS up to 1567MHz and SATCOM down to MHz) and with broadcast antennas co-located close to GPS antennas it can be expected that some power will end up in the pass-band of the GPS receivers due to the weakness of the GPS front-end filters and from spurious harmonics that result in-band. A number of different portable electronic devices have also been known to emit RF energy in the GNSS bands [43]. Reported cases such as a personal laptop computer transmitting large amounts of RF energy in the GNSS bands have prompted guidelines for switching off of such devices during critical times in aircraft ascent and descent. A great deal of interest in the effect of strong out-of-band signals occurred in 11 due to the proposal of Lightsquared, a terrestrial wireless broadband network operating close to the GNSS bands, with ground stations with signal strengths significantly stronger than GNSS signals [44]. The spectrum which Lightsquared was to occupy was used for ground-to-satellite communications, with transmit powers significantly lower to what was proposed by the Lightsquared network. The filters used in the RF front-ends of many GPS receivers were found to be vulnerable to strong out-of-band signals close to the GNSS bands in experiments which simulated the signals from the Lightsquared basestations. In-band interference will also be a problem for receivers that track the newer GNSS signals. Unlike the L1 and L bands which are protected, it is expected that GNSS receivers operating in the L5 band will need to be able to tolerate operating in the presence of other strong signals such as distance measuring equipment (DME) [45]. In the literature there are a number of reported cases of interference coming from television broadcast towers which have higher order harmonics which end up in GNSS bands. Cases have been reported in Australia [46] and Italy [47] and at these locations the RFI was strong enough to disrupt receiver performance. 16

43 Chapter Background The other significant source of RFI reported in the literature has been from purpose built GPS jammers. Original public available designs consisted of either a strong CW or wideband (1- MHz) noise signal in the GPS bands [39]. The majority of commercially available GPS jammers transmit swept CW signals [48] over the GNSS bands and such a device was responsible for the disruption of the GBAS installation at Newark Airport [7]. Another type of RFI that has been gaining significant attention is spoofing signals. A spoofing signal is a counterfeit GNSS signal with the intent of capturing and misleading the GNSS receiver for nefarious purposes [49]. It has been rumoured that a military drone was captured in the Middle East through the use of a spoofer to trick the drone into landing in enemy territory [5]. Proof of this concept has been recently demonstrated with a spoofer signal taking control of a UAV [51]..3.3 Interference Effects The primary reason for GNSS receivers being so vulnerable to RFI is that the satellites signals are so weak by the time they reach the receiver. A typical GPS receiver with a MHz bandwidth will have a noise-floor of approximately -11dBm. The GPS signals arriving at a receiver antenna located on the surface of the Earth will have a nominal power level of -13dBm [], which is db below the noise level. This low power level means that only a relatively weak RFI signal is needed to jam operation of the receiver. In this section the effects of interference on the typical elements of a GPS receiver as shown in Figure.5 are described. Active antenna analogue signal digital signal GPS receiver LNA LNA filter filter AGC ADC baseband processor correlator outputs navigation processor position Figure.5. Generic band-pass sampling GNSS receiver architecture. In a typical GNSS receiver system the satellite signals are first captured by an active antenna. An active antenna is required to overcome any losses due to cabling between the antenna and the GPS receiver hardware. As the satellite signals already arrive weak, any losses due to cabling 17

44 Chapter Background need to be avoided. At this stage degradation due to RFI occurs when the LNA in the antenna oversaturates. Once the signal enters the GPS receiver hardware it is usually amplified by another LNA to overcome mixing and filtering losses. As with the previous stage the hardware elements are vulnerable to oversaturation. It is at this stage that the receiver is also vulnerable to strong out-ofband signals which the front-end filters cannot attenuate sufficiently. The non-linear nature of oversaturation presents difficulty in modelling the effect and is explored in [5]. Distortion and intermodulation of strong signals due to oversaturation in the mixing components decreases the effective Signal to Noise Ratio (SNR) of the GNSS signals. After down-conversion the signal is then sampled by an Analogue-to-Digital Converter (ADC). For ADCs with more than 1 bit sampling an automatic gain control (AGC) is required to set the power level at the input to the ADC as to minimise quantisation losses. The variable gain amplifier (VGA) in the AGC will have limited dynamic range (typically in the range of 5dB [53]) so RFI that is too strong will oversaturate at the input to the ADC. The quantisation process performed by the ADC is also vulnerable to RFI due to the low number of bits typically used in GNSS receivers [54]. Due to the low dynamic range of the ADCs used there is also significant loss of SNR in the presence of CW interference as more of the RFI signal is captured at the expense of the underlying noise signal where the GNSS signals lie [55]. After quantisation by the ADC the signal is now in the digital domain and is sent to the baseband processor to perform acquisition and tracking of satellites. At this stage the threat of the RFI occurs where the spectrum of the RFI overlaps with the spectrum of the GNSS signals [56]. This disrupts the correlation process and increases the variance of the tracking loops. In the acquisition and tracking process the increase in variance can result in losing lock of the satellite or the loop could begin tracking the RFI. Loss of lock of all visible satellites will deny operation of the receiver and leakage of the interferer into the tracking loops will degrade the positioning solution as the resulting pseudoranges will be noisier. For a CW interferer the fall in the Carrier-to-Noise density ratio C / N found using the following equation [57]: as it crosses the different spectral lines of the PRN spreading used can be C ( Td R ( τ )sinc( f ctd )) N = L N + J ( T C sinc( T f )) CW n d j d i (.1) where N is the thermal noise power, L n is the processing gain in the noise, T d is the integration 18

45 Chapter Background duration time, τ is the signal-reference code phase different in code chips, fˆ c is the estimate of carrier frequency estimate, ˆ fc = fc fc, fi = fi fc ˆ, J is the interference power, C j is the th j spectral line coefficient, and R ( ) is the cross-correlation of the received C/A code and the τ receiver replica. In Figure.6 the falls in C / N are shown calculated using (.1) for a CW at different Doppler offsets to a GPS and GLONASS satellite. Although the GNSS signals typically have an overall sinc-shaped spectrum due to the use of finite length codes the spectrum resolves to line components with longer integration times because the codes repeat at a fixed frequency. 45 C/No (db/hz) GLN GPS Doppler Frequency (Hz) x 1 4 Figure.6. Losses for GPS and GLONASS with a CW at L1+1.5kHz. Two important metrics for the performance of GPS receivers are the acquisition/tracking thresholds and the variance of the delay lock loop. The acquisition threshold is the minimum C / N level where the receiver can reliably acquire satellite signals (~36dB/Hz [58]) and the tracking threshold is the minimum C / N level where the receiver can reliably track the satellite signals (~3 db/hz for precise positioning [59]). In the presence of RFI the C / N will be reduced and a simplified expression for the C / N in the presence of interference is given by [6]: ( J / S ) /1 ( C / N ) /1 1 [ C / N ] eq = 1log 1 + (.) QRc where C / N is the Carrier-to-Noise Density ratio with no interference, J/S is the Jammer-to- Signal ratio, Q is the spread spectrum processing gain (1 for narrowband, for wideband Gaussian), and R c is the PRN code chipping rate. In Figure.7 the fall in the equivalent / N 19 C is shown for different J/S for different satellite SNR. At a J/S of -4.74dB the C / N for the satellite with a S/N of -3dB falls below the tracking threshold which will result in a loss of lock. The

46 Chapter Background acquisition threshold is higher than the tracking threshold so for higher J/S the receiver will eventually be prevented from tracking any satellites as lock is lost and it is unable to acquire new satellites. C/No eq (db/hz) S/N=-3dB S/N=-dB S/N=-1dB Acquisition Threshold Tracking Threshold J/S ratio (db) Figure.7. The fall in the equivalent C/No from the presence of a wideband Gaussian interferer using (.) [6]. This delay-lock loop is used for tracking the code-phase of the incoming GPS satellite signal and the variance of this will be proportional to the variance of the pseudorange measurements. Consider the variance for an Early-minus-late power tracking loops [61]: B = L d σ T 1 + (.3) C / N T ( d) C / N where σ T is the tracking error variance in units of PRN chips, B L is the code tracking loop bandwidth in Hz, d is the early-to-late correlator spacing, C / N is the carrier-to-noise value in units of ratio-hz, and T is the pre-detection integration interval in seconds. It is clear from (.3) that the variance of the tracking loop will increase as the C/No decreases and as shown by (.) RFI will cause this.

47 Chapter Background.4 Interference Detection In order to ensure the integrity of systems relying on the services provided by GNSS infrastructure, any RFI source must be detected quickly and at power levels low enough so that it can be detected before it disrupts the operation of the GNSS equipment. There are a number of systems in development for detection such as the Patriot Watch [34] from the United States, the Sentinel Project [6] from the United Kingdom, and the GNSS Interference Monitoring System (GIMOS) [63] from Germany. The RTCA provides specifications for receiver susceptibility when operating as part of aviation equipment [4] and it is this guideline which the different detection techniques are typically compared against. There are a number of different interference detection techniques that have been reported in the literature and they can be broken down into the following three categories: o Hardware o Pre-correlation o Post-correlation The hardware category describes techniques use parts of the hardware chain such as the antenna or RF front-end, the pre-correlation category describes techniques which perform signal processing on the incoming samples before any GNSS baseband processing, and the postcorrelation category describes the techniques that use many of the parameters and observables that are part of GNSS baseband processing..4.1 Hardware Techniques RFI affects many of the components in the RF analogue front-end and these effects can be exploited for the purpose of detection. The automatic gain control (AGC) is a very important component in a GNSS receiver which can be used to monitor for changes in the power level at the receiver antenna [64]. In the case of a multi-bit ADC it is also possible to detect RFI by monitoring the histogram of the incoming samples. The AGC is required in GNSS receivers where more than one bit is used during quantisation to minimise quantisation losses from the ADC. In GNSS receivers, where the signal power of the received satellites arrives below the thermal noise floor, the AGC is usually driven by the ambient noise. In the presence of RFI the power level at the input to the ADC will increase and the AGC will reduce the gain. This sudden change in the gain level can be used for detecting the appearance of interference. An AGC-based approach not only provides a fast method for detecting interference, but is also able to achieve 1

48 Chapter Background this with no additional hardware overhead by exploiting an existing receiver component in the RF front-end. The use of the AGC for detection has been investigated by a number of authors. In [65] the AGC was evaluated in the context of receiver autonomous monitoring for interference detection. Changes in the AGC gain were found to be correlated with pseudorange error as the power of the interference signals was increased. The variation in the AGC gain in the presence of pulsed-rfi also allows it to provide an ability to partially characterise the type of RFI. In [64] the AGC was evaluated for detecting interference with specific attention given to the L5 band where future GNSS receivers will have to operate in the presence of other aviation equipment. The AGC gain was found to vary over time related to changes in ambient temperature which will limit its effectiveness for detecting weak interferences. In [66] it was also noted that the AGC gain moved with temperature. One difficulty with using the AGC for detection of GPS interference is that its value changes in time. In Chapter 4 it is shown that this drift is highly correlated with temperature and can be effectively removed after measuring the change in the AGC gain with respect to temperature over a couple of days. Applying this correction allows the AGC to detect interference sources down to a J/N of -8dB. A number of authors have demonstrated the use of the AGC for detecting real unknown signals in the GNSS bands. In [46] the AGC showed variation in the presence of interfering signals from a television tower in Sydney, Australia. In another case in Italy [47] the AGC was also affected due to spurious transmissions from a television tower. In [67] it was shown that the AGC could be used for finding potential sources when placed in a moving vehicle. In [68] the AGC values from a RF front-end were recorded along with IF samples at an airport and a number of interference events were detected. Analysis of IF samples during these events showed that the AGC was responding to unknown CWI signal sources. Overall in the literature the AGC can be used for detecting down to moderate levels of interference. In [6] the AGC crossed their detection thresholds at a power of dbm in a 1MHz bandwidth. By itself, the AGC appears capable of detecting at interference power levels which satisfy the RTCA requirements for wideband RFI; however it is not able to satisfy the requirements for narrowband RFI which is as low as -1.5dBm.

49 Chapter Background Through simulations using a model of an ADC and AGC it was found that the AGC gain will respond differently to different types of interference based on the interferer s probability density function. This is explored in Chapter 4 and it is shown that through adjusting the design and control of the AGC gain loop the difference can be minimised. This has implications when determining the minimum detectable interference levels for different RFI types..4. Pre-Correlation In the pre-correlation category, there are a number of detection techniques that perform signal processing on the samples coming from the RF front-end. The most effective are those that perform statistical inference testing techniques on the incoming signals [69][7][71]. With these approaches, the incoming signal is broken down into small blocks and inference tests are carried out in the time and frequency domains to detect the presence of an interferer by looking for changes in signal power. Assessment windows are used a priori to characterise the statistical properties of the incoming signal in the absence of RFI and this is compared with the statistical properties of an evaluation window. Using these techniques [7] was able to detect a CW source down to -137dBm and a wideband source down to -17dBm. In [7] a statistical inference technique was able to detect a CW source down to -133.dBm and also detect a real interferer at powers below the receiver's noise floor. These statistical techniques that perform signal processing on the raw IF samples are able to meet the RTCA guidelines for receiver susceptibility, but have the highest hardware and computational requirements. The techniques in [7] were implemented on a FPGA hardware platform to facilitate interference detection in real time [73]. In a multiple antenna system it is possible to detect interference sources by crosscorrelating sets of data together. Theoretically cross-correlation should be able to detect wideband interference sources down to significantly lower levels than those that use a single antenna. However along with the RFI and thermal noise there will also be the signals from the GNSS satellites themselves. In Chapter 7 the use of cross-correlation for detecting RFI in the presence of the GNSS signals is explored. The cross-correlation function is found to vary as the antennas are moved further apart. Antennas placed close together allow an easy method for detecting wideband interference to below the RTCA requirements. 3

50 Chapter Background.4.3 Post-Correlation It is possible to detect the presence of RFI by monitoring the behaviour of many of the observables that are produced during the GNSS tracking and navigation process. In the presence of RFI the variance of many of these observables can be expected to increase as the RFI degrades the performance of the receivers tracking loops. Examples of such observables include the correlator outputs, the effective C/No, the pseudorange error, the position error, and so on. A simple technique looking for any sudden outages or degradation in the position solution was used to demonstrate a near real-time GNSS interference detection system in the United States using the observables from national CORS network data [74]. From experimental results in [6] the AGC and C/No were found to be the most sensitive to RFI, although the hardware indicator of input signal power given by the AGC was a more reliable indicator as a whole. One of the post-correlation observables that are commonly used in GNSS processing is the carrier-to-noise density ratio (C/No). This is the ratio of the RF carrier power C to the noise power density No (the noise power N in 1Hz) and is used to evaluate the quality of the signal tracking. Under normal operating conditions this parameter is used for setting acquisition and tracking thresholds and for scaling the weighting given to different satellites when solving for position. If the C/No value is below a certain threshold it may be preferable to exclude it in the navigation process, or if the value deviates suddenly it may indicate the presence of interference. The C/No has a reputation as a noisy measurement for RFI detection [7][75]. In this thesis in Chapter 3 it is shown how that the majority of the variations in the C/No repeats with the satellite ground-tracks in a similar way to how multipath repeats. By taking the difference between C/No measurements between ground-tracks most of the variation can be removed allowing C/No to be used for detecting weaker levels of interference with less false alarms. To ensure integrity in critical applications, Signal Quality Monitoring (SQM) has been developed to detect anomalies in the signals transmitted from the GNSS satellites due to hardware and other failures [76]. Once an anomaly is detected with a particular satellite, data from this satellite is excluded from the position solution calculation. These techniques work by taking advantage of multiple correlators [77] to monitor the shape of the correlation triangle from the tracking process. Although analysis of the correlation triangle was originally intended for detecting anomalies, the presence of RFI will also distortion the correlation triangle. Receivers utilising SQM require large receiver front-end bandwidth and increased computational overhead as more 4

51 Chapter Background correlators are needed. As a result its availability is typically limited to more expensive or survey grade receivers..5 Interference Mitigation The vulnerability of GNSS receivers can be reduced by implementing techniques to mitigate the presence of any RFI [78]. RFI mitigation in the GNSS context is also referred to as anti-jam technologies [79]. There are a number of different interference mitigation techniques that been reported in the literature and can be broken down into the following categories: o Hardware o Pre-correlation o Baseband processing o Post-correlation o System-level.5.1 Hardware Techniques In all GNSS receivers an antenna is required to pick up the signals transmitted by the satellites. The RFI can be expected to come from the ground so antennas with low gain along the horizontal designed for mitigating against multipath [8] can provide some protection against ground-based transmitters of RFI. Antennas with choke-rings or multiple elements to achieve low gain along the horizon can be expensive and weighty. This kind of antenna is not suitable for all applications where weight is an issue and a radiation pattern with some gain below the horizontal is desirable, such as a banking aircraft. In the RF front-end, the shape of the filters will have an influence on the receiver s susceptibility to interference [81]. Filters with sharp roll-offs around the GNSS signal bands will mitigate the effect [5] of near and out-of-band interference sources which are strong enough to pass through less effective filters. As spectral congestion increases it can be expected that the problems with near and out-of-band interference will increase. An example of this was a planned ground transmitter based wireless broadband network called Lightsquared which was to broadcast next to the GPS bands which was found to degrade the performance of some GNSS receivers during testing [8]. This problem will motivate the need for stronger standards for front-end filter designs in new GNSS receivers. 5

52 Chapter Background A common hardware-based approach to mitigating interference is the use of a multi-element antenna array [78]. Using a multitude of different techniques such as beam-steering [83] and nullsteering [84], it is possible to give different weights and phase to the incoming signals from the different antenna elements to improve the signal strength of the GNSS satellites and attenuate the interfering signal. Another advantage of these arrays is that the nulling process will give an indication of the bearing of the RFI which can aid in its geo-location. A disadvantage of these techniques are the increased cost, weight, and size of the hardware. Although the antenna array systems can be expensive they are very effective and there are commercial solutions available [85]. In the RF front-end, the AGC and ADC can be used for mitigating the effect of interference. In general the more bits used in the ADC the less vulnerable the receiver will be to RFI [54]. The use of more bits will increase the effectiveness of the other mitigation techniques but comes at the expense of increased memory and hardware requirements. With the use of a multi-bit ADC the effect of CW interference can be reduced by placing the cusp of the incoming signal over the lower thresholds in the ADC [86]. This ensures that the SNR of the incoming satellites is maximised while minimising the power of CW. The AGC can also be used to mitigate the effect of pulsed-rfi. For strong pulsed RFI pulse-blanking techniques allow the RFI signal to be removed with only a small reduction in the effective SNR as long as the pulse-width of the RFI is not too long compared with the GNSS signal code period [87]..5. Pre-Correlation The pre-correlation mitigation of RFI refers to techniques that perform signal processing on the samples coming out of the RF front-end before it is processed by the receiver baseband. The most effective pre-correlation mitigation techniques attempt to remove the interfering signal from samples while preserving as much of the GNSS signals as possible. For CW or narrowband signals different types of notch filters have been used effectively for removing RFI [88]. As the processing power available increases filters can be designed that minimise the effect on the phase of the incoming signal which will reduce the error introduced in the position solution [89]. The use of adaptive notch filters has been demonstrated to deal with RFI which was disrupting the use of precision farming equipment. For wideband RFI more advanced interference cancellation techniques are required to preserve the spectrum of the underlying GNSS signals. The wavelet transform can be used for removing more complicated forms of interference [9]. Active signal cancellation (ASC) is also possibility 6

53 Chapter Background for RFI with known structure [91]. The ASC technique has been demonstrated for removing swept-cw signals which are used in jammers that have a wideband bandwidth which can significantly degrade the performance of the GNSS receiver but have a known signal structure..5.3 Baseband Processing The effects of RFI can be reduced by modifying how the correlators and tracking loops operate in the GNSS base-band processing blocks. Techniques such as assisted-gps [9] which facilitate longer integration times traditionally used for weak signal acquisition and tracking will improve robustness in the presence of RFI. A vector tracking loop used for tracking of weak signals [93] will also improve tracking performance in the presence of RFI [94]. Modifications of tracking loop parameters in traditional tracking loop designs can also be used to improve tracking under low SNR [95]. In [96] using a technique called MCDD improved acquisition performance in the presence of CW and narrowband interference could be achieved through the use of differential detectors and modified correlators. For multi-user interference and strong signals from pseudolites interference cancellation techniques can be used, as well as for CW type RFI [97]..5.4 Post-Correlation If RFI is degrading the quality of measurements the effect on the resulting position solution can be reduced by excluding the effected satellites. These techniques are only effective if only a couple of satellites are affected by the RFI over time so that enough satellites can still be tracked to provide a position solution. In the RAIM technique redundant satellites are used for detecting faulty measurements or outliers in receiver measurements [98]. In the presence of RFI that only affects a low number of satellites over time the RAIM technique will exclude measurements from these effected satellites. The SQM technique will also flag satellites for exclusion that have distorted correlation triangles due to the RFI. If the spectral properties of the RFI can be estimated in the pre-correlation domain a more advanced technique [99] excludes satellites where the RFI is interfering with the GPS spreading code signal [56]. This technique is most effective against narrowband RFI where it is only likely to affect a low number of satellites. For a single tone CW the chances of it impacting all of the visible satellites are low as the satellites will have different Doppler frequencies. 7

54 Chapter Background.5.5 System-Level At a system level there are a number of different techniques that can be used for mitigating RFI and improving the robustness in the presence of RFI. In a multi-gnss [1] context signal frequency diversity can be achieved by using a receiver that can track a variety of satellite signals on a variety of frequencies. A number of geodetic and increasingly civilian receivers now provide the ability to track GPS and GLONASS which operate on different frequencies. GLONASS also provides an open civilian signal in the L band, and in modernised plans GPS provides an open civilian signal in the L band called LC, and on L5. The disadvantage of this approach is that the costs of adding multi-gnss capability are significant while the costs of a jammer that can cover multiple frequencies are lower. The level of robustness of the GPS receiver to jamming can be improved through the integration with inertial navigation system (INS) devices. For short-periods of outages the INS can be used to provide navigational capabilities until the GPS signal is restored [11]. The performance of the carrier-tracking loops in the presence of RFI can also be improved through tight-coupling with an INS allowing for narrower noise bandwidths [1]. In applications where GPS is used for timing synchronisation the robustness of the overall system to a jamming event can be improved by using a clock reference which can provide a long holdover period. Once a GPS Disciplined Oscillator (GPSDO) loses lock of the satellites the timing and frequency outputs will drift over time depending on the quality of its clock reference [13]. Cheaper reference clocks such as a Temperature Compensated Crystal Oscillator (TCXO) will drift quicker than ones which use an atomic standard. A GPSDO with a TCXO could fail the requirements for CDMA base station synchronisation within a number of hours [13]. A rubidium-based standard had a predicted holdover period of weeks. The disadvantage of using a better reference is the costs with clocks with the most stability costing many thousands of dollars [14]..6 Interference Localisation Once the presence of RFI has been detected it can be dealt with by geo-locating and disabling it. The traditional method for tracking down unwanted RFI has been to use a directional antenna and move to different locations to create bearing lines that intersect where the RFI lies. This can be time consuming, and in the past it has taken months to find sources that have disrupted GNSS sources at a harbour [3] and at an airport [7]. As the direction finding equipment is moved to different locations it must be orientated correctly to minimise the errors in the bearing 8

55 Chapter Background measurements. The source might also be intermittent, reducing the ability to make a number of bearing measurements at different locations if the source stops transmitting after the equipment is set up. In electronic warfare scenarios DF has been demonstrated to be effective in localising GPS jammers when used in UAVs [15]. Placing the direction finding equipment on an airborne moving platform overcomes many of the shortcomings of a ground-based platform that needs to be moved to different locations, which can take time. The cost of such projects will limit the use of UAVs in practice to military organisations with large budgets, or in scenarios where a case of civilian GPS jamming poses a threat to national security..6.1 Network-based Localisation The problems with traditional direction finding leads to the development of network-based systems that can detect and localise RFI quickly. In a network-based solution, a permanent installation of sensor nodes is used with hardware and software specialised for localising an interference source as shown in Figure.8. The GNSS Environmental Monitoring System (GEMS) that was originally designed for fault detection and integrity monitoring [15] is being improved to provide this capability. Adding this capability to GEMS is a leading motivation for the research undertaken in this thesis. Another example of a proposed networked system under development that is capable of both localisation and detection is the GPS Anomaly Monitoring Equipment Suite (GAMES) [38]. For localisation purposes in a network different sensor nodes take samples of RF data which contain the signals of interference source and this is processed for use with different localisation techniques, such as angle-of-arrival (AOA), frequency difference of arrival (FDOA), time-difference-of-arrival (TDOA), received-signal-strength (RSS), etc. The implementation of a real-time network based detection and localisation system presents many research and practical challenges. 9

56 Chapter Background Network Sensor Network Sensor Interferer Network Sensor Figure.8. A network of sensors placed around the runway at an airport for localising interference sources. The work undertaken in this thesis concentrates on detection and localisation techniques which can be implemented in such a network-based system. Concerning localisation methodologies, the Dilution of Precision (DOP) of different passive localisation techniques is compared in Chapter 5 to explore the theoretical performance of each method using typical propagation models and noise values Angle-of-arrival In the angle-of-arrival (AOA) technique the angle at which the interfering signal arrives at different sensor nodes is used to create bearing lines which intersect at the location where the transmitter lies [16]. Digital beam-forming has been used in GNSS for improving the SNR of satellites in the presence of RFI as a mitigation technique. As well as improving the SNR by steering beams at the satellites and by nulling out the RFI the information from the beam-steering process can also be used for estimating the angle at which the RFI hits the antenna for use in a localisation system. In traditional beam-forming each channel is added together with different phase and weight in order to maximise the gain of the antenna array in different directions. The computational load from beam- forming comes from the greater amount of data used from the multiple channels in the antenna array and the need to steer beams in multiple directions. The direction of the interference source is then taken as the angle at which the received power at the beam-former is maximised. 3

57 Chapter Background A major advantage of the AOA technique is that it does not require strong timing synchronisation between each sensor node, which is necessary for other techniques. The multiple antenna hardware also provides the added benefit of allowing the implementation of the different mitigation techniques to allow the continued operation of GNSS equipment under jamming conditions. For the geo-location scenario in Figure.9, demonstrated in D for simplicity, the AOA equations take the following form: yi y tan(θ i ) = (.4) x x i where θ i is the bearing measurement to sensor i, {x i,y i } is the location of the sensor i, and {x,y} is the location of the interference source. 1 θ 3 =9 Sensor Source y (metres) 5 θ =18 θ 1 = x (metres) Figure.9. The intersecting lines of an AOA localisation system. The Cramer-Rao Lower Bound (CRLB) can be used for determining the factors which will influence the quality of the angle estimates from an antenna array. In [17] it is used to provide a statistical lower bound on the variance when estimating the AOA of a sinusoidal signal in the presence of additive white Gaussian noise (AWGN) for a linear array of antennas, and is given by: var( ˆ) θ 1 M + 1 M 1 L λ ( π) SNR M sin θ (.5) 31

58 Chapter Background where SNR is the signal to noise ratio, M is the number of antenna elements, λ is the wavelength of the signal, L is the length of the array. Looking at (.5) the variance strongly depends on the SNR, the number of array elements, the length of the array and the angle between the source and the array. To improve the variance more array elements spread further apart can be used, but this will increase the size of the array, the time needed to calibrate the array and the computation power required to generate the bearing estimates. An adaptive antenna array for localising GPS interference [18] was developed in 1 by the University of Adelaide in Australia. In their system an 8-element antenna array was used along with beam-forming signal processing to estimate the bearings to interference sources. The platform which was located on a van was moved to another location to create another bearing measurement to make localisation possible. The accuracy of the bearing measurements was found to be within 1- degrees of the true bearing measurement and the system worked well even at low SNR. Systematic biases in the phase and amplitude calibration of the antenna array limited the overall accuracy Time Difference of Arrival In the time-difference of arrival (TDOA) technique [19], the time-delays of the interfering signal between different pairs of sensor nodes are used to create intersecting hyperboloids in 3D or hyperbolae in D where the transmitter may lie. In order to calculate the time-delay, data between sensor nodes is typically cross-correlated together [11]. For the scenario in Figure.1 the TDOA equations take the following form: 1 τ i j = ( ri rj ) (.6) c where τ i j is the time-delay of the interference signal between sensors i and j, c is the propagation constant (taken as the speed of light in a vacuum for this application) and r i is the 3

59 Chapter Background range between the interference source and sensor i. 1 Sensor Source y (metres) 5 τ 1-3 = τ -3 = x (metres) Figure.1. The intersecting hyperbolas of a TDOA localisation system The lower bound on the variance of the time-delay (TDOA) measurements found through crosscorrelation is given by [17]: 1 var(ˆ) τ π (.7) B BT SNR RMS eff where B RMS is the Root Mean Square (RMS) bandwidth of the interference source, B is the noise bandwidth of the sensor nodes, T is the integration time, and SNR eff is the effective SNR between the sensor nodes. A critical result for the lower bound on the variance for the time-delay estimates is that it is inversely proportional to the rms bandwidth of the interference source. For a good estimate the bandwidth of the signal should be wideband. This limits the effectiveness of a localisation system that uses TDOA to being suitable for wideband interference only. In practice CW interference cannot be ignored as it severely degrades the performance of GPS receivers [57] and any robust localisation system will need another methodology capable of localising it. A practical limiting factor in the accuracy of the time-delay measurements is the timesynchronisation between the sensors. For accurate cross-correlation the time synchronisation between each sensor needs to be as close as possible. An error of 1ns in the time transfer between each sensor will introduce an error of 3m in the equivalent range measurement. GPS is commonly used in time transfer applications but in the presence of RF interference the timing synchronisation is known to degrade [111]. A method of time synchronisation independent of GPS with accuracy in the low ns will be required which presents a serious challenge. One 33

60 Chapter Background possible solution is the use of Locata, which claims timing synchronisation in the picoseconds [11]. One drawback to the use of the TDOA technique is that it requires strong time and frequency synchronisation between sensor nodes. The effect of interference on timing receivers is explored in the work of this thesis in Chapter 8 in the context of a TDOA localisation system. Through the use of post-processing of captured GNSS data it is possible to do timing synchronisation offline as well. The CRLB given by (.7) assumes that the signal for which the time-delay is to be estimated is present along with noise only. In reality the data captured at the sensor nodes will also contain any GNSS satellites and pseudo-lites transmitting in the same band. The power of the combination of all of these signals is not negligible and the effect of these signals on distorting the cross-correlation is explored in Chapter 7. There have been a number of demonstrations of TDOA-based systems for localising RFI in the GPS L1 band. In [113] a hardware platform was developed to measure the signal propagation delay along the baseline of two antennas to create a hyperbolic positioning system similar to TDOA. This system consisted of a number of sensor nodes time synchronised to a master clock by cables. For large baselines over a large area connecting all of the sensor nodes together by cable is impractical for time synchronisation. In this system only broadband interference sources were used. In [67] a number of cheap unsynchronised RF front-ends were used to calculate TDOA measurements of a wideband interference source. The navigational data obtained from the GPS satellites contained in the data was used to time-synchronise the network of sensors when the interference source was not jamming the signal. In [114] a system was demonstrated that used GPS to provide timing to perform TDOA localisation of CDMA signals in another band Received Signal Strength In a Received Signal Strength (RSS) localisation system, the measured power of the interferer at each sensor node is used to create circles (or spheres in 3D) which intersect where the transmitter lies [115] as shown in Figure.11. The rate at which the power level falls is referred to as the path-loss and is well studied as it is important in designing communication links. The log-normal shadowing path-loss model takes the form: d = n σ (.8) i RSS i P 1 log1 ( ) + d i 34

61 Chapter Background where P is a reference power level measured at a distance d, n is the path-loss exponent, d i is the distance between the transmitter and receiver, and σ i is the standard deviation of the shadowing. 1 RSS 3 =1 Sensor Source y (metres) 5 RSS 1 =1 RSS = x (metres) Figure.11. The intersecting circles of a RSS localisation system. Considering the example of estimating the amplitude (A) of a sinusoidal signal in the presence of AWGN, under the assumption that the frequency of the sinusoid is not near or 1/, the CRLB gives the following lower bound [17]: σ var( Aˆ) (.9) N where σ is the variance of the AWGN and N is the data length. The lack of a bandwidth term shows that like AOA, RSS accuracy does not depend on the bandwidth of the signal. This is not the same as TDOA, suggesting that RSS could be a useful alternative for narrowband signals. A difficulty with using RSS is that the path-loss exponent n can differ significantly depending on the surrounding environment and the height of the transmitter and receiver pair [116]. In free space it falls at n= but in denser areas where there are a lot of blockages and multipath n can increase to higher values, and be lower where the environment behaves as a waveguide. In areas such as this the value of the shadowing σ can also be expected to increase. Without taking a detailed survey of the environment the path-loss exponent will need to solved along with the position of the transmitter which increases the complexity of the RSS approach. 35

62 Chapter Background Outside of the GNSS context, the RSS is an extensively used parameter in wireless networks for measuring signal quality. The common availability of the RSS value in Wi- Fi equipment makes it a good candidate for doing real-world path-loss measurements. In Australia where the research in this thesis was undertaken it is not legal to broadcast in the GNSS bands, so experimentation was undertaken using devices operating in the.4ghz ISM band. In Chapter 6 the performance and suitability of using Wi-Fi devices for measuring path-loss was evaluated. In the majority of the literature for RSS localisation the path-loss environment is assumed to be log-normal however this was not found to be the case depending on the heights of the transmitter and receivers. In Chapter 6 simulations and real experiments are performed at two heights to explore the practical considerations of using RSS localisation in the presence of a ground reflection which makes the path-loss noisy. In a GNSS context, the AGC in the GNSS receiver can be used for estimating the RSS of the interference. Initial results using the AGC for interference localisation was explored in [117]. In this system measured changes in the AGC value due to the switching on-off of an interference source is used to estimate its power. A grid-search is then used to find the location that best satisfies the AGC power estimates from each sensor node. The accuracy in the setup was found to be within a few meters of the true location. On a wider scale approach a system was proposed that used the AGC to form a J/N meter which could be used in a crowd-sourcing approach using mobile phones with GPS receivers to get a large number of measurements [118]. Other localisation systems have used changes in the C/No output of GPS satellites [119] to get an indication of the power of the RFI. The advantage of these techniques is that they are relatively easy and cheap to implement in GNSS hardware. In Chapter 4 the process of estimating the RSS from changes in the AGC gain is explored. The AGC methodology was found to introduce some bias into RSS estimates and this could be corrected by changing the way the AGC operates..7 Summary and Conclusion This chapter has introduced a number of issues concerning the detection, mitigation, and localisation of RFI to GNSS. Potential avenues for research are highlighted and at the appropriate parts a brief description of how the work undertaken in this thesis addresses these, along with the relevant research chapter. 36

63 Chapter 3 Detection of RFI to GNSS Using C/No differences 3.1 Introduction There are a number of different techniques that can be used for GNSS interference detection. Techniques which perform statistical testing on the time and frequency domain properties of signals incoming to an RF front-end have the best performance and can meet the susceptibility thresholds set by the RTCA [7],[7]. A drawback to these techniques is that they require access to the raw ADC samples and the digital signal processing needs to be implemented in hardware to perform detection in real-time [1]. Another common technique used for detecting RFI is by monitoring for changes in the AGC [64]. In practice, access to the AGC level is generally not available from commercial GPS equipment and the effect of temperature on the hardware components and the gain level also needs to be compensated in order to maximize detection performance and reduce false alarms [11]. An alternative approach that doesn't require special hardware is to use the observables that are a product of the satellite navigation process. Some of these observables, such as the carrier-to-noise ratio (C/No), can be output to the user and are available as parts of the RINEX, NMEA, and other proprietary status messages. In this chapter the interference detection performance using C/No (or the closely related SNR) measurements is investigated. 37

64 Chapter 3 Detection of RFI to GPS using C/No differences Traditionally C/No measurements are seen as noisy measurements for interference detection [7],[75]. Due to multipath and blockages, the C/No values vary greatly as the satellites go through their orbits, thus making an elevation vs. C/No model require relatively large detection thresholds to minimise false alarms [1]. In this chapter, using recorded C/No values from real stationary antennas and receivers, it is shown that the C/No values generally repeat with the satellite groundtrack in the same way that multipath does. By taking advantage of this observation it is possible to have tighter detection thresholds as the variations in C/No due to multipath repeat and can be differenced away. In the first part of this chapter the C/No is detailed and the influence of the estimation of the noise density (No) on the resultant C/No value is explored analytically. These results are then compared with synthetic data tracked with a software GPS receiver to get an idea of what to expect from C/No values in the presence of interference. The C/No values were then recorded for a number of days using a stationary antenna and RFI of different powers was added to the data from the last day to determine experimental detection performance. To gain an insight into the detection and false alarm rates in a true GNSS context, C/No values are then extracted from the RINEX data from an IGS station that provides useable GPS and GLONASS observables. An experiment is then performed with a real CW RFI added in the RF path to a GPS receiver. Parts of the work shown in this chapter have been published in the following conference proceedings [14]: Thompson RJR, Wu J, Balaei AT, Dempster AG, (1) Detection of RF interference to GPS using day-to-day C/No differences. Proceedings of the 1 International Symposium on GPS/GNSS, Taipei, Taiwan, October Carrier to Noise Density Ratio (C/No) In GPS baseband processing the C/No value in db/hz is used for assessing the signal quality of tracked satellites and can be defined as [13]: C N = 1 log 1( SNR β r ) (3.1) where C is the power of the GPS carrier, N is the receiver noise density in a 1Hz bandwidth, SNR is the signal-to-noise ratio, and βr is the receiver's equivalent pre-correlation bandwidth. For 38

65 Chapter 3 Detection of RFI to GPS using C/No differences a typical GPS receiver with a MHz bandwidth the noise power N will be equal to -111dBm. Nominally GPS signals arrive at a signal power of about -131dBm. This is db below the noise floor in a MHz bandwidth, making the SNR equal to - db, resulting in a nominal C/No value of a GPS satellite of 43dB/Hz. The lower the C/No value the lower the quality of the pseudo-range and phase measurements can that be expected and the observations should be weighted appropriately while calculating the position solution. In the NMEA standard, C/No values are available as part of the GSV (satellites in view) message. In the RINEX standard, C/No values are available as part of the S1 observable. One problem with using the C/No values from GPS receivers for detection of RFI is that there is generally no information on how the value was calculated. There is no set standard for the calculation of C/No values specified in the NMEA and RINEX standards. In order to estimate the fall in C/No in the presence of interference this needs to be known as well as the receiver's precorrelation bandwidth C/No Estimation In Figure 3.1 an outline is given of a generic RF front-end for a band-pass sampling GPS receiver. The RF input from the antenna consisting of the GPS carrier power C and the interference power C l first passes through an LNA. The RF signal is filtered, down-converted, and filtered again. The bandwidth of the filters determines the noise bandwidth and can vary from MHz for a typical commercial GPS receiver to 88MHz for a receiver used in geodetic applications [14]. RF input: LNA RF Filter BW: IF Filter C, C l, N x(t) -βr/ to βr/ Figure 3.1. Generic receiver front-end. Following the working in [56], the signal x(t) after down-conversion to baseband and filtering can be represented by: i x( t) = e θ s( t) + w( t) (3.) 39

66 Chapter 3 Detection of RFI to GPS using C/No differences where θ is the phase of the s(t), s(t) is the GPS signal and w(t) is the interference plus noise signal. In this work it is assumed that all of the power of C and C l pass through the front-end filters. In receiver operation this signal x(t) is then correlated with a replica signal for acquisition and to determine the time of arrival of the satellite signal for use in the navigation process: ( k + 1) T 1 * iθ ck ( τ ) = x( t) r ( t τ ) e dt (3.3) T kt where τ is the time delay of the replica signal, θ is the phase, and T is the integration time. Hardware consisting of a number of correlators and tracking loops are used to find and track the values of the time delay and phase that maximise the value of (3.3). Assuming that the tracking loop is properly tracking the satellite signal and K is large, the carrier power of the satellite signal can be estimated by taking the average of the prompt (τ=) in-phase correlator output: K C ˆ 1 = R { c k ( ) } K (3.4) k = Noise Density Estimation In this work the two different methodologies for estimating the noise-density will be investigated: the pre-correlation method that uses the power of x(t), and the post-correlation method that uses the variance of the correlator outputs Pre-correlation Noise Density (pre-no) In the pre-correlation method the noise density is estimated without using the outputs of the correlation process. Rather than reflecting the variance of the tracking loops it reflects the power of the input signal after filtering: C N pre = N + C l C β / r β / r G l ( f ) (3.5) where G l ( f ) is the power spectral density of the RFI normalized to 1. The value of the noise density plus the RFI power can be estimated from the power of the incoming signal: 4

67 Chapter 3 Detection of RFI to GPS using C/No differences LT ( Nˆ 1 ) pre = x( t) βrlt dt (3.6) This leads to the following estimate of the C/No using a pre-correlation noise density estimate: Cˆ Nˆ 1 K R k = 1 = LT pre 1 r K β LT { c ( ) } k x ( t) 1 dt (3.7) In many commercial receiver designs an Automatic Gain Control (AGC) is used to keep the power level at the input to the Analogue to Digital Converter (ADC) at a constant level that minimizes the quantization loss. If the AGC is operating correctly the power level at the input to the ADC should be constant, so x(t) will be constant and as a result the N estimate can be set to a constant value. In Figure 3., C/No values using pre-no are shown for the satellite pass of PRN 8 recorded from an antenna on the rooftop of the Electrical Engineering building at the University of New South Wales (UNSW). IF data was collected using a NordNav R3 software receiver on 6/9/11 and the C/No calculated using the raw correlator outputs using (3.7). As the elevation increases the C/No value increases as expected and the values look relatively clean. The C/No values are not entirely smooth and at lower elevations there are visible oscillations caused by multipath as shown in Figure C/No (db/hz) C/No (db/hz) Time (s) x 1 5 Figure 3.. C/No values of an observable satellite using a pre-correlation estimation of the noise density Time (s) x 1 5 Figure 3.3. Close-up of multipath oscillations as the satellite moves through different parts of the sky with a pre-correlation estimation of the noise density (zoom of Figure 3.). 41

68 Chapter 3 Detection of RFI to GPS using C/No differences As the pre-correlation method does not need to estimate the variance of the correlator outputs the number of computations required is minimized. An issue with the pre-correlation method is that it does not give any indication to the variance of the correlator output. An increase in tracking loop variance could be evidence of many things that disrupt receiver operation, including the presence of narrowband RFI, ionospheric scintillation, spoofing attacks, multi-user interference, Doppler collision, and short-time multipath Post-Correlation Noise Density (post-no) In the post-correlation noise density estimate the noise density reflects the power of the signal that enters the tracking loops: C N post = N β / r β / r G s C β / r ( f ) df + C G ( f ) G ( f ) l β / r l s df (3.8) where G s ( f ) is the normalized power spectrum of the GNSS signal and G l ( f ) is the normalized power spectrum of the RFI. The G l ( f ) G ( f ) s term corresponds to the spectral intersection of the GNSS signal and the RFI and is referred to as the Spectral Separation Coefficient (SSC) [15]. There are a number of different ways of estimating the noise density from the tracking outputs. One possibility is to use the sample variance from the prompt quadrature-phase (imaginary part of (3.3)) correlator output: 1 K K T post c ) Cˆ k k = 1 ( N ) = ( I { ( }) (3.9) Depending on the desired statistical properties of the C/No there are many different techniques which can be used for its estimation. In this work the Moments Method (MM) is chosen due to it being unbiased [16]. MM uses the second and fourth order moments of the received constellation noise in order to estimate the signal to noise ratio: K 1 = R c k c k ) N k = 1 { ( ) } + I{ ( } M ˆ (3.1) K 1 4 = R c k c k ) N k = 1 { ( ) } + I{ ( } 4 M ˆ (3.11) 4

69 Chapter 3 Detection of RFI to GPS using C/No differences Pˆ d Pˆ n Mˆ Mˆ 4 = (3.1) Mˆ Mˆ Mˆ 4 In Figure 3.4 the C/No with a post-correlation noise density estimate are shown estimated using (3.1). Although from the same set of raw correlator values as the pre-no estimates shown in Figure 3., the C/No values are a lot noisier. At a number of different elevations there are locations where there are dips and an increase in variance which could indicate events that cause tracking quality to degrade. Long-term variations due to multipath can be seen in Figure 3.5 as well. C/No (db/hz) Time (s) x 1 4 Figure 3.4. C/No values of an observable satellite using a post-correlation estimation of the noise density. C/No (db/hz) Time (s) x 1 5 Figure 3.5. Close-up of multipath oscillations as the satellite moves through different parts of the sky with a post-correlation estimation of the noise density (close-up of Figure 3.4). 3.3 Comparison between pre-no and post-no with RFI The way the receiver estimates the noise power will have the most dramatic effect on the C/No estimate in the presence of interference. According to the analysis in [56] the estimation of noise density using the variance of the correlator outputs results in the C/No being more sensitive in the detection of narrowband interference then estimating it using the power of the incoming samples. In Figure 3.6 the drops in C/No are shown in the presence of a CW RFI of increasing Jammer-to- Noise ratio (J/N) using (3.5) and (3.8). In this work the value of N is set equal to (3.6), the power of the down-converted signal after filtering. The fall in C/No (pre-no) is the same regardless of the frequency of the CW, while for the post-no it is different. The C/No values using precorrelation noise density estimate cause a constant fall in C/No with increasing Jammer to Noise ratio (J/N) while at some frequencies there is no drop for the post-no. 43

70 Chapter 3 Detection of RFI to GPS using C/No differences In Figure 3.7 the C/No is shown for a CW RFI with changing frequency. A ms integration time is used and the receiver bandwidth is set equal to MHz. The CW has a J/N of -5dB and a Jammer-to-Signal ratio (J/S) of 15dB. The C/No values using the post-correlation noise density estimate falls only when the CW crosses the power spectrum of the GPS signal. Away from the spectral lines the CW is effectively suppressed and no falls in C/No are observed. The normalized power spectrum G s ( f ) was calculated using a real GPS spreading code to demonstrate that the use of the short finite length code (13 chips every 1ms) does not result in a smooth sinc-shaped spectrum but a line spectrum that follows a sinc-shaped envelope. Longer modern codes such as LC-M (13 chips every ms) do not resolve as sharply and have a more ideal sinc-shape, even for long integration times. C/No (db/hz) No post +3.5kHz No post +31kHz pre-no J/N (db) Figure 3.6. Comparison of effective C/No with increasing J/N. C/No (db/hz) Post No Pre No No RFI Doppler (Hz) x 1 4 Figure 3.7. Comparison of effective C/No with increasing Doppler Effect of Integration Time The length of the integration time used in the correlators will have an effect on the drop in C/No in the presence of RFI [57]. In Figure 3.8 the dips in C/No are shown for a GPS spreading code with different integration times. Using a longer integration time makes the spectrum of the spreading codes resolve into finer lines, resulting in falls in C/No only as the CW crosses these lines. Due to the encoding of a data-bit the longest coherent integration time for GPS without aiding such as data wipe-off is ms. It is evident that using a longer integration time will allow some satellites to continue tracking in the presence of even a strong CW RFI as long as it does not cross these spectral lines. This can be used to provide some mitigation against CW RFI as the Doppler values of visible satellites are varied and it is unlikely that all satellites will be affected. Also, prior knowledge of the CW frequency can be used to exclude such satellites so it doesn't degrade the navigation solution [99]. 44

71 Chapter 3 Detection of RFI to GPS using C/No differences GLONASS also uses a spreading code for ranging but uses different carriers for different satellites in a Frequency Division Multiple Access (FDMA) system, not different spreading codes for different satellites in a Code Division Multiple Access (CDMA) system as used by GPS. The spreading code for GLONASS is 511 chips long with a chipping rate of 511 Mchips/s. Although the GLONASS code is shorter than the GPS codes it still resolves into 1kHz spectral lines as it repeats every 1ms. In Figure 3.9 the fall in C/No is shown for a particular GPS spreading code and the GLONASS spreading code. The comparison is made using a 1ms integration time as data-bits for GLONASS are encoded every 1ms, not ms like GPS. The dips for GPS show variation in the magnitude of the spectral lines as a result of design for good cross-correlation properties. The GLONASS code has been designed for an optimal autocorrelation function (no cross-correlation triangles) and as a result the dips are more regular and strongly follow a sincshaped envelope. This difference in the drops in C/No between GPS and GLONASS, along with the different satellite orbit behaviour, means that they will have different vulnerability and detectability performance over time in the presence of RFI. C/No (db/hz) ms 5ms 1ms Doppler(Hz) x 1 4 Figure 3.8. Effect of integration time on C/No losses for a GPS satellite in the presence of CW RFI. C/No (db/hz) GPS GLONASS Doppler(Hz) x 1 4 Figure 3.9. Comparison of dips with GPS and GLONASS in the presence of CW RFI (1ms integration time) Noise-Density With Synthetic Data The different methods for estimating the noise density will have different properties. In Figure 3.1 the C/No values are shown using IF data generated in MATLAB for the scenario shown above. The data is generated in MATLAB at a sampling rate of 5.714MHz and an IF frequency of 4.39MHz. The frequency plan and quantization used matches that of a popular commercial GPS front-end [17], the Zarlink GP15. A CW RFI is added starting at a Doppler offset of 1.5kHz with frequency increasing at 1Hz/s. The data is then tracked using the NordNav software receiver with a coherent integration time of ms and the correlator outputs recorded at 5Hz. 45

72 Chapter 3 Detection of RFI to GPS using C/No differences The commercial software receiver was used to verify the correctness of the synthetically generated data. The pre-no C/No values are estimated using (3.7) with the noise power equal to a constant and the post-no C/No values are estimated using (3.1). As can be seen in Figure 3.1 the size and locations of the dips in C/No (post-no) closely match the analytical results shown in previously in Figure 3.8 using (3.8). The C/No values from the post-correlation method are noisier but show a better indication of the quality of receiver tracking in the presence of RFI. Insights into why the behaviour of the C/No estimates are different can be found by examining the values of the absolute value of the in-phase (I-P) and quadrature-phase (Q-P) correlator outputs from the data in Figure 3.11 with the corresponding C/No values shown Figure 3.1. The pre-no method estimates the carrier power by averaging the value of the I-P channel over time and dividing by a constant estimate of the noise density from the power of quantized samples. This will smooth out the increase in the variance that is visible in Figure 3.11 in the I-P channel as the CW RFI crosses the GPS line spectrum and none of the variance from the Q-P channel is used for estimating the noise density. The post-no method on the other hand uses the variance of the tracking outputs in order to estimate the noise density. As a result, using the post-no will give detection performance similar to monitoring the 'correlator output variance' as investigated in [18]. Using the post-no method results in noisier C/No values which is one reason it might not be used in many commercial receivers. 5 C/No (db/hz) post-no pre-no Time (s) Figure 3.1. C/No estimated from synthetic data showing how a post-correlation estimation of the noise density reveals falls as the CW RFI crosses spreading code spectral lines. Correlator Output I-P Q-P Time (ms) x 1 4 Figure Correlator outputs from synthetic data (same data as used for Figure 3.1) revealing the increase in tracking loop variance as the CW RFI crosses spreading code spectral lines. 46

73 Chapter 3 Detection of RFI to GPS using C/No differences 3.4 Detection of RFI using C/No. A common method for the detection of RFI using the C/No is to record the values when a satellite is visible and fit a polynomial model of the C/No versus elevation [63],[1]. A threshold can be chosen based on the standard deviation of the fit at different elevations and the presence of RFI is detected when the C/No goes below this threshold. This can be written as: C N C C ( θ ) > mean ( θ ) 6 σ ( ) θ? N N (3.13) where θ is the elevation angle and σ is the standard deviation calculated from previous C/No data. Using the pre-no values from the previous section a detection threshold calculated using the mean and standard deviation of the C/No values (in 5 degree elevation windows) using a quadratic fit is shown in Figure 3.1 and Figure At low elevations the detection threshold grows significantly as the standard deviation of the quadratic fit increases due to multipath. On the right side of the ground track (shown in Figure 3.13) below degrees elevation the C/No falls suddenly and even with the six sigma threshold there are still false alarms. This could be because of a signal blockage. C/No (db/hz) C/No Threshold Elevation (degrees) Figure 3.1. A plot of the C/No values (using pre-no) versus elevation for a satellite. The threshold is made using (3.13). C/No (db/hz) C/No Threshold Time (s) x 1 4 Figure A plot of the C/No values (using pre-no) over time during a flyover. The threshold is made using (3.13) C/No Detection Previous work has shown that multipath repeats with the satellites groundtrack for GPS from day to day [19]. This has been used to detect and remove multipath at stationary receivers such as at GNSS reference stations. This multipath is also responsible for the majority of the variations in C/No as the signal reflections combine additively and subtractively with the line-of-sight signal. 47

74 Chapter 3 Detection of RFI to GPS using C/No differences These kinds of variations could also cause false alarms with techniques that only look at the timeseries of C/No values [7],[75]. In Figure 3.14 the C/No values (using pre-no estimation) are shown for a GPS satellite over two groundtrack repetitions (one day after another). The plot for the second day is shifted to the left as GPS satellites appear in the same place in the sky approximately 4 minutes earlier each day. In Figure 3.15 the C/No values are shown with the groundtrack repeat time added to the time-stamps of the previous day. This shifts the previous day plot to the right and the C/No values match up closely. C/No (db/hz) C/No(d-1,t) C/No(d,t) Time (s) x 1 5 Figure The C/No values from a satellite one day after another. The satellite groundtrack repeats approximately 4 seconds earlier each day C/No(d-1,t-44) C/No(d,t) x 1 5 Figure Two consecutive days of C/No values with the last day values corrected for groundtrack repeat time. The C/No values now align. The majority of C/No variations caused by multipath can be removed by taking differences between the C/No values between these two groundtrack repetitions. These measurements have been named C/No with the units of db and are calculated using: C N ( d, t) = C N ( d, t) C N ( d 1, t τ ) (3.14) where d is the day of observation, t is the time in seconds, and τ is the groundtrack repeat time. The value of τ is different for each individual satellite and should be calculated with each groundtrack repetition due to changes in the satellite motion over time. For GPS this value is approximately 4 seconds, but is different for each individual satellite. This value can be derived from the orbit model in the ephemeris data. In this work the repeat time was found using the International GNSS Service (IGS) precise ephemeris data by finding the point in time which the position of the satellite is closest between two groundtrack repetitions. 48

75 Chapter 3 Detection of RFI to GPS using C/No differences As the C/No values repeat the presence of RFI can be detected by looking for any unusual changes. In Figure 3.16 the C/No value is shown for a satellite's groundtrack. As can be seen much of the variation has been removed and the C/No has near zero-mean. For the pre-no estimate this works well and significantly reduces the standard deviation at times where multipath is prominent compared with the elevation fit models. A disadvantage of this technique is that it assumes that the multipath environment doesn't change over time so is only suitable for stationary receivers in environments that don't change very much. It also assumes no interference in the original data. In Figure 3.17 the C/No is shown for the post-no estimates. These values are a lot noisier and will be less effective for RFI detection. C/No (db) Time (s) x 1 5 Figure The C/No values using a precorrelation noise density estimate. C/No (db) Time (s) x 1 5 Figure The C/No values using a postcorrelation noise density estimate Statistical properties of C/No To examine the potential performance improvement using C/No, the standard deviation was calculated in windows of 5 degrees on the resulting C/No using (3.14) as well as the polynomial fit using (3.13). The results are shown in Figure 3.18 and Figure For the pre-no values taking the C/No significantly reduces the standard deviation at all elevations for this particular satellite. The improvement is less significant for the post-no values and even increases the standard deviation at certain elevations. 49

76 Chapter 3 Detection of RFI to GPS using C/No differences Standard deviation C/No C/No Standard deviation C/No C/No Elevation (deg) Elevation (degrees) Figure Standard deviation for C/No techniques (pre-no). Figure Standard deviation for C/No techniques (post-no). To examine the behaviour of C/No with elevation the kernel density estimates of the standard deviation in degree elevation windows are shown in Figure 3. and Figure 3.1. The pre-no values resemble a Laplace or Gumbel distribution. There is a noticeable shift in the mean and change in kurtosis at different elevations. This may be because the satellite signal travels through more of the atmosphere at lower elevations which has changing propagation properties with weather, or changes in the efficiency of the receiver components over time due to temperature. The post-no values resemble a Gaussian distribution. As the post-no values are dominated by the variance of the tracking loops the C/No values can be interpreted as the difference of two Gaussian distributions with similar mean and standard deviation that doesn't vary much with elevation. Density Density x -5 5 x Figure 3.. Kernel density estimate of C/No in different elevation windows for pre-no. Figure 3.1. Kernel density estimate of C/No in different elevation windows for post-no. 5

77 Chapter 3 Detection of RFI to GPS using C/No differences Detection Performance (pre-no) As with the C/No versus elevation fit, a six-sigma threshold of the previous day's C/No values can be used to create a detection threshold. This requires at least two days of training C/No values. For the C/No values the standard deviation was calculated in 1 second steps and multiplied by six to form a detection threshold. This window size was found to give a low number of false alarms while being able to detect interference to a low J/N. The detection performance could be improved with more methodological tuning of the parameters of window size and threshold on each satellite individually and is left as potential future work. In Figure 3. an example detection threshold is shown using C/No values. The threshold increases when the satellite is at lower elevations due to the multipath. Even though taking the C/No does reduce the effect of the multipath it does not remove it completely. To get an idea of the detection performance possible with this set of data the theoretical fall in the C/No was calculated using (3.5) and added to the C/No data on the chosen day of observation. The receiver bandwidth is assumed to be MHz resulting in a noise power of -11dBm. This section will concentrate on CW type RFI. The number of detections was recorded with a number of different J/Ns. In Figure 3. the theoretical fall in C/No is shown for an RFI with a J/N=- 1dB in comparison to when no RFI is present. In Figure 3.3 the number of detections as the J/N of the RFI is increased is shown. At a J/N of -15dB the number of detections begins to increase noticeable. For a receiver with a narrow bandwidth this technique can detect RFI at low power levels but as the bandwidth increases the absolute minimum detectable interference in terms of absolute power decreases. For example for a MHz BW (N=-11dBm) this equates to a J/N of -15dBm, but with a MHz BW this equates to a J/N of -115dBm. C/No (db) - -4 J/N=-1dB No RFI Threshold Time (s) x 1 4 Figure 3.. C/No values with and without RFI. Detections J/N (db) Figure 3.3. The number of detections as RFI power is increased. 51

78 Chapter 3 Detection of RFI to GPS using C/No differences Detection Performance (post-no) The C/No and resultant C/No values have a much higher variance when post-no estimation is used. Although undesirable in terms of time to detection the variance can be reduced by averaging the C/No values. A 3 second averaging period was found to reduce the standard deviation to a level similar to that which was found with the pre-no values. The smoothed data has a standard deviation of.3356 compared with for the unsmoothed data. The use of averaging or smoothing can be undesirable as short bursts of RFI may be smoothed out and a delay is added to the detection time. The averaged C/No values are shown in Figure 3.4. Unlike the pre-no values there are noticeable variations in the C/No even at high elevations. Overall the averaged C/No values still repeat each day and can be used for detection. In Figure 3.5 the C/No values are shown along with the six-sigma detection threshold. Unlike the pre-no there are large jumps in the detection threshold at certain times. This is because of sudden large dips at a high elevation of short duration in one of the training data sets. This would have caused false alarms if it was in the day that was being checked for RFI. The cause of these dips is not known, but there are a number of effects that could increase the variance of the tracking loops. C/No Threshold C/No (db/hz) 5 45 Day n-1 C/No (db) - 4 Day n Time (s) x 1 4 Figure 3.4. The repetition of the post-no C/No values after averaging every 3 seconds Time (s) x 1 4 Figure 3.5. The post-no C/No values and the detection threshold after averaging every 3 seconds. Measuring the detection performance for the post-no estimates is more complicated as the drop in C/No will depend on the spectral properties of the RFI and the spectral separation coefficient at a particular point in time. If a receiver is using a long integration time in the presence of even a strong CW RFI there may be no immediately fall in C/No depending on the SSC. If the CW 5

79 Chapter 3 Detection of RFI to GPS using C/No differences crosses a strong spectral line there could be a large fall in C/No even if the CW has low power. In Figure 3.6 the fall in C/No is shown calculated using (3.8). The natural rate of change of Doppler for satellites is slow (in the range of.1hz/s) so the 3s averaging process does not significantly reduce the magnitude of the dips. In Figure 3.7 the number of detections is shown with a CW RFI at two different frequencies. At L1+1.5kHz there is a strong spectral line so over this satellite's groundtrack the CW could be detected at a J/N of -5dB. At L1+33kHz there is no strong spectral line and the RFI is detected at a J/N of -15dB. 15 IF+33kHz IF+1.5kHz C/No (db) dB -6 No RFI Threshold Time (s) x 1 4 Figure 3.6. C/No (post-no) values with and without the effect of RFI using (3.8). Detections J/N (db) Figure 3.7. The number of detections (post-no) as the power of a CW RFI at different frequency offsets is increased. The probability of detecting narrowband RFI improves over time as the chance of the CW crossing a strong spectral line increases, and due to each satellite having a different spreading code the number of detections will be different. To explore the detection performance over 4 hours with all satellites for a single CW the fall in C/No was calculated using (3.8) for all the visible satellites over 4 hours. As the real C/No values were not available a fixed threshold was used based on the standard deviation of the C/No for the available values for the satellite shown in Figure 3.5. In Figure 3.8 all of the dips in C/No are shown for the visible satellites (elevation > 5 degrees) for a CW with J/N of -db over an 11 second period. In Figure 3.9 the number of detections over 4 hours are shown for CWs at two different frequencies. The performance is about the same over 4 hours and the CWs can be detected down to a J/N of -.5dB. With a realistic threshold based on all of the visible satellites if the real data was available the real-world performance would be better than this. The histogram of the detections will also give some insight into the type of interference. For a CW interferer the hits will occur at multiples of 1kHz as it crosses different spectral lines as the satellite Doppler changes. 53

80 Chapter 3 Detection of RFI to GPS using C/No differences C/No (db) Time (s) x 1 4 Figure 3.8. The drops from all visible satellites (post-no). Detections IF+33kHz IF+1.5kHz J/N (db) Figure 3.9. The number of detections as RFI power is increased (post-no). 3.5 UNSW Experiment In the previous section the analysis was performed with real C/No values for only one satellite. This was due to technical limitations with the NordNav receiver not being able to reliably output the raw correlator values at 5Hz in real-time. In order to get the raw correlator values the IF data was recorded to disk while the chosen satellite was visible for three days and post-processed. To get a better idea of the behaviour and detection performance of using C/No measurements over time the C/No values given by the NordNav at 1Hz was recorded to RINEX format in real-time over a number of days and processed C/No Repeatability It is not known what specific C/No estimation algorithm is being used by the NordNav software but it does have similar behaviour to the pre-no technique discussed previously. In Figure 3.3 the C/No and repeatability is shown for a certain satellite over 3 days. In Figure 3.31 the C/No values are shown along with the threshold from the two previous day's data. Again using C/No removes the variations due to multipath. There is a gap in the data caused by the instability of the NordNav software due to overflows in the USB transfer buffer. Although the C/No values from the NordNav appear noisier the C/No technique is able to produce a usable detection threshold with 1s standard deviation estimation windows without requiring any averaging. 54

81 Chapter 3 Detection of RFI to GPS using C/No differences C/No (db/hz) Day n- Day n-1-34 Day n Time (s) Time (s) x 1 4 x 1 4 Figure 3.3. Large-scale variations in multipath that repeats day-to-day from the NordNav C/No measurements. C/No (db) Day -1 Threshold Figure The C/No values corresponding to the C/No values shown in Figure 3.3, with the variations from multipath reduced. Observing the 7 days worth of data revealed some unusually strong multipath. An example of such event is shown in Figure 3.3. These strong multipaths were present even at higher elevations. The C/No technique is able to deal with this as seen in Figure 3.33 with no unreasonable increase in the detection threshold. C/No (db/hz) Day n Day n-1 Day n Time (s) x 1 4 Figure 3.3. A strong oscillation in the C/No caused by multipath that repeats day-today. C/No (db) Day -1 Threshold Time (s).8.85 x 1 4 Figure The C/No values corresponding to the C/No values shown in Figure 3.3, with the multipath variations effectively removed Statistical Properties of C/No Measurements In Figure 3.34 the standard deviation of all the C/No values is shown for different satellites for different day pairs. A day pair refers to the C/No taken on the days n and n-1. The standard deviation doesn't vary much between the day pairs. In Figure 3.35 the mean of all of the C/No 55

82 Chapter 3 Detection of RFI to GPS using C/No differences values is shown for different satellites for different day pairs. Weather was found to have a noticeable effect on the C/No. On the first day pair there was a storm later in the day which caused a fall in the mean of the C/No. PRN 1 does not follow the same trend as the other satellites and this is because it was visible before the storm and as a result didn't show a decrease. As changes in AGC values have been shown to be correlated with changes in temperature this could be having an effect on the resulting C/No values as well. Over time the C/No trend is similar over satellites that have similar visibility times. An unusually large change in temperature or other weather effect could potentially cause false alarms if the detection threshold is set too tightly and doesn't take this into account. It would be difficult to distinguish between a fall due to weather and a weak wideband RFI without another detection technique and information regarding the environment the receiver is in. Standard deviation #1 #9 #1 #7 mean( C/No) #1 #9 #1 # Day pair Day pair Figure The standard deviation of C/No for different satellites over a number of day pairs. Figure The mean of C/No for different satellites over a number of day pairs Day Separation In certain situations it will be necessary to take the C/No after more than just a single groundtrack repetition. This will be important for the use of other GNSS that have different groundtrack repetition rates (such as 8 days for GLONASS) and for having a clean set of C/No values in case one day is already affected by RFI and shouldn't be used to form detection thresholds. The impact of increasing the day separation will be examined by looking at the standard deviation over time for the C/No as the day separation is increased. In Figure 3.36 the standard deviation is shown for PRN7 calculated in 3 second windows. As the day separation increases so does the standard deviation. After 5 days there are small numbers and a dramatic increase when the satellite is at low elevations due to multipath. After a number of days the 56

83 Chapter 3 Detection of RFI to GPS using C/No differences multipath does not repeat each day as closely. In Figure 3.37 standard deviation for increasing day separation is shown for PRN. For this satellite there is a spike in the standard deviation that increases with increasing day separation. At that time a strong multipath as shown in Figure 3.3 was visible. For multipath of this type the C/No could be a useful detection technique without the need of processing the pseudorange and carrier-phase data as is typically used in multipath detection techniques [19]. Standard deviation 1 1 day.8 3 days 5 days Time (s) x 1 4 Figure Standard deviation for PRN7. Standard deviation day 1 3 days 5 days Time (s) x 1 4 Figure Standard deviation for PRN False Alarm Performance The C/No detection technique was run over 6 day pairs of collected data to get an insight into the false alarm performance that can be expected. This is the kind of information that will be useful to the people monitoring the health of a GNSS reference stations and the results can be interpreted to detect the presence of anomalies in the C/No values which would be from RFI. The results of the C/No detection technique in terms of detections every 5s are shown in Figure 3.38 and in terms of effected satellites every 5s in Figure This data was collected when no RFI was present so there should be no detections. During some of the day pairs there are a noticeable number of false alarms. Looking at Figure 3.39 though there is only at most two effected satellites at a time. If there was a real interference source causing a noticeable degradation in C/No it would be expected that multiple satellites would be affected given a long enough observation time. In these cases where only a single satellite is being affected could mean that the satellite is malfunctioning, experiencing multipath or a local atmospheric effect. One way to improve the false alarm performance would be to require at least or 3 satellites to be affected at once. In the rest of this work the heuristic of at least 3 satellites having detections at a time will be used. 57

84 Chapter 3 Detection of RFI to GPS using C/No differences 4 Detections 3 1 # of effected Satellites Day Pair (days) Day Pair (days) Figure The number of detections over time using the C/No values over a number of day pairs. Figure The number of satellites with simultaneous detections using the C/No values over a number of day pairs. During the second day pair the noticeable jumps in detection have been observed. This is due to the NordNav software reporting observables from satellites that have not been acquired properly yet. Examples of this are shown in Figure 3.4 and Figure 3.41 and shows why there would be a number of false alarms if there are tracking problems as the satellite is just becoming visible. These could be removed with the use of a higher acquisition threshold or a better lock detector in the NordNav software. C/No (db/hz) Day n- Day n-1 Day n Time (s) x 1 4 Figure 3.4. The tracking problems during acquisition for PRN1 which caused a number of false alarms. C/No (db/hz) Day n- Day n-1 Day n Time (s) x 1 4 Figure The tracking problems during acquisition for PRN5 which caused a number of false alarms Receiver Response to RFI Although not specified, insights into the C/No estimation algorithm used by the NordNav can be gained by tracking synthetic data with added RFI. In MATLAB a GPS signal was generated at - db below a noise level at a sampling rate of 5.714MHz. The RFI of different types was then 58

85 Chapter 3 Detection of RFI to GPS using C/No differences added and the signal was quantized to -bit sign and magnitude and saved to disk to be processed by the NordNav software. In Figure 3.4 the fall in C/No is shown from the NordNav along with the expected fall from (3.5) for an added wideband RFI increasing in power. There is a noticeable bias between the two plots, most likely due to a different scale term applied to the noise power, but they both follow the same trend. The same set of data was also tracked using the software receiver of Borre et. al [13] and using the raw in-phase correlator values the C/No was calculated using the pre-no estimation method (3.7). The NordNav C/No values also look noisier compared with the values calculated using (3.7). In Figure 3.43 the fall in C/No for CW RFI at different frequencies with increasing power is shown. For CW RFI the NordNav C/No values behave differently depending on the frequency and the power level. These results imply that the in calculating the noise density, the NordNav software is doing something more complicated than just assuming it is equal to the power of the incoming samples. C/No (db/hz) KaiBorre Pre-No Eq. NordNav 4 6 J/N Figure 3.4. The fall in C/No for the different C/No estimators for a wideband RFI. C/No (db/hz) IF IF+5 IF J/N Figure The fall in C/No for the different C/No estimators for a CW RFI at different frequencies. To explore the behaviour of the NordNav C/No output further, a CW RFI of changing frequency was added in synthetic data. In Figure 3.44 the C/No values are shown for a CW with frequency changing at a rate of 4Hz/s with the CW added s into the data. There is a noticeable drop in the C/No similar to what would be expected from using a pre-no technique but there is also a noticeable ripple as the frequency of the CW changes. This would suggest that the NordNav uses a more complicated technique in estimating the No than just using the power of the incoming 59

86 Chapter 3 Detection of RFI to GPS using C/No differences samples. In Figure 3.45 the C/No using post-no is shown calculated from the same set of raw correlator values (ms integration time). As expected from (3.8) there was no sudden drop in the C/No as the CW was not intersecting with any GPS code spectral lines at that particular time. There is a dip in C/No when the CW crosses a spectral line as time moves on. C/No (db/hz) RFI on Time (s) RFI on Figure The response of the NordNav C/No for a CW Sweep. Figure The response of the C/No using a post-correlation estimate of the noise density for a CW Sweep. These results imply that the NordNav is using a special technique for estimating the noise density which is unrelated to the variance in the correlator outputs. One possibility includes power spectrum estimation looking at the power in particular frequency bins depending on the Doppler frequency of the tracked satellite. In practice this technique gives a good compromise between the less noisy C/No values from a pre-no method while still showing some variation over time in the presence of a CW as does the post-no method Experiment Results with added RFI. To investigate the performance of RFI detection using C/No with real signals a signal generator was combined with the satellite signals from the same rooftop antenna at UNSW and connected to a GPS receiver. An overview of the experimental setup is shown in Figure The NordNav R3 was used which generated RINEX data with C/No values at 1Hz. Two consecutive days of RINEX data was recorded with no RFI present to create the C/No detection thresholds with RFI added on the third day. 6

87 Chapter 3 Detection of RFI to GPS using C/No differences Signal Mounted antenna RF combiner NordNav R3 RINEX (1Hz) Figure Experimental Setup. As the RF signal from the antenna has been amplified by an LNA it is necessary to calibrate the power levels with the combined signal from the signal generator. To determine the J/N and calibrate the power measurements a weak CW was injected that did not change the AGC value of the receiver but created a noticeable peak in the power spectrum of the IF samples recorded by the NordNav receiver. It is assumed that the power of the samples without the CW is equal to the receiver's thermal noise. The NordNav was found to have a 3dB bandwidth of.7mhz resulting in an effective noise floor of dBm, and the values from the signal generator were adjusted to match this. On the third day of measurements, a CW interferer on the L1 band center frequency was added at different powers using the signal generator. To simulate a wideband interferer a 3dB attenuator was placed at the input to the NordNav receiver. This will attenuate the incoming signal and the AGC will increase its gain to compensate and in the process amplify the receiver's thermal noise, increasing the effective noise floor. The detection results are shown in Table 3. The C/No technique was able to detect CW interference down to a J/N of dB, or dBm, using the heuristic of requiring at least 3 satellites having detections in the observation time. 61

88 Chapter 3 Detection of RFI to GPS using C/No differences Table 3.1. Detection performance for C/No from the NordNav receiver J/N Observations Detections Number of simultaneously effected satellites in a 5 second window Probability of detection (Pd) ^ ^wideband RFI test with 3dB attenuator. In Figure 3.47 an example of the fall and distortion of the C/No values is shown when a CW was present. At this power level a constant drop is visible as well as dips which change over time. In Figure 3.48 the C/No is shown. The dips which are an artefact of the NordNav's C/No estimation algorithm increases the number of detections in this example. In Figure 3.49 the fall is shown when the CW is present and the probability of detection was insignificant. At this power only 1 satellite was affected in a 5s window. There were only 6 detections and it would be difficult to distinguish between RFI, multipath, or tracking problems. C/No (db/hz) Day n- Day n-1 Day n Time (s) x 1 4 Figure The C/No from the NordNav over a number of days, with a CW of J/N dB added on the last. C/No (db/hz) C/No Threshold Time (s) x 1 4 Figure The C/No and detection threshold corresponding to the C/No values from Figure

89 Chapter 3 Detection of RFI to GPS using C/No differences C/No (db/hz) Time (s) Day n- Day n-1 Day n x 1 4 Figure The C/No from the NordNav over a number of days, with a CW of J/N dB added on the last. C/No (db/hz) C/No Threshold Time (s) x 1 4 Figure 3.5. The C/No and detection threshold corresponding to the C/No values from Figure C/No for Multi-GNSS To explore the possible detection performance using C/No in a GNSS context the detection technique was used on data from a receiver with GPS and GLONASS observables. Nine groundtrack pairs of 1Hz RINEX data were downloaded from the IGS reference station PDEL located on an island off Portugal. The station uses a Leica 1 which is a popular receiver used in a number of IGS and Continuously Operating Reference Station (CORS) networks and as a survey grade receiver. No specification is given as to the C/No estimation method that the receiver in question uses. In this work it is assumed that it uses a pre-correlation noise density estimate C/No for GPS In Figure 3.51 and Figure 3.5 the behaviour of the C/No is shown for three days and it resembles values used with pre-no noise density estimates. This model of receiver has also been used for measuring the power of signal reflections which implies that the C/No are proportional to the signal power at the antenna. 63

90 Chapter 3 Detection of RFI to GPS using C/No differences Day n- C/No (db/hz) Day n- Day n-1 Day n Time (s) x 1 4 Figure The C/No values extracted from a number of days of RINEX data (GPS) from an IGS reference station. C/No (db/hz) Day n-1 Day n Time (s) x 1 4 Figure 3.5. An exampling of the repeating multipath behaviour in the C/No values extracted from RINEX data (close-up from Figure 3.51) C/No quantization effects The C/No values in the RINEX data from PDEL are quantised to.5db. Quantization to 1dB is common depending on the type and setup of the receiver and newer receivers typically have finer resolutions. This quantisation results in the standard deviation of the C/No in certain windows being equal to zero and breaks the detection algorithm. To overcome this, dither can be added and this improves the behaviour of the detection threshold. For the data a dither of random noise with variance equal to.8 was added to the C/No values and found to give good detection performance. The improvement can be seen by comparing the detection thresholds in Figure 3.53 and Figure For receivers which output C/No values rounded more coarsely (such as to an integer for NMEA) more dithering will be needed. C/No (db) - -4 C/No Threshold Time (s) x 1 4 Figure The C/No and resulting detection threshold without dithering added. C/No (db) - -4 C/No Threshold Time (s) x 1 4 Figure The C/No and resulting detection threshold with dithering added, eliminating the problems from the quantisation of the C/No. 64

91 Chapter 3 Detection of RFI to GPS using C/No differences False Alarm Performance The C/No detection technique was applied to a week of data from day 17 to 179 in 1. In the chosen days of data to be processed there were a small but noticeable number of false alarms. In Figure 3.55 and Figure 3.56 the number of detections are shown along with the number of satellites affected at the same time with the results grouped into 5s blocks. 3 3 Detections Day Pair (days) # of effected Satellites Day Pair (days) Figure The number of detections in 5s windows over time (GPS). Figure The number of effected satellites in 5s windows over time (GPS). In Figure 3.57 and Figure 3.58 examples of the false alarms during the 3rd and 4th day pair are shown. The majority of these detections occurred at lower elevations and looked like multipath. This promotes the need for classification or detection heuristics for distinguishing between C/No anomalies that could be caused by multipath, satellite malfunctions, etc, with RFI. The false alarms due to acquisition problems in the NordNav were not present, but with the ability of the higher quality receiver to track weaker signals at lower elevations the number of false alarms due to multipath has increased. C/No (db/hz) Day n- Day n-1 Day n C/No (db/hz) Day n- Day n-1 Day n Time (s) x 1 4 Figure The C/No anomaly during day pair (GPS) which caused a number of detections Time (s) x 1 4 Figure The C/No anomaly during day pair 4 (GPS) which caused a number of detections. 65

92 Chapter 3 Detection of RFI to GPS using C/No differences Returning to Figure 3.56 there is a peak in the number of satellites affected during an observation window on the 7th day pair. It looks out of the ordinary because it affects 3 satellites at the same time and could be a genuine RFI event. The fall in C/No from two of these satellites is shown in Figure 3.59 and Figure 3.6. The nature of the falls look like they could be caused by a genuine RFI event but the three satellites are at lower elevations and the other tracked satellites at higher elevations are not affected. This cause of this anomaly is unknown and should be investigated in future work Day n- Day n-1 Day n x 1 4 Figure The C/No anomaly during day pair 7 on PRN11 (GPS) which caused a number of detections. C/No (db/hz) Day n- Day n-1 Day n Time (s) x 1 4 Figure 3.6. The C/No anomaly during day pair 7 on PRN3 (GPS) which caused a number of detections C/No for GLONASS So far this work has only concentrated on using C/No for GPS. GLONASS observables are also available from RINEX data and are becoming more popular as the constellation is restored and modernized. For C/No detection the critical difference between GPS and GLONASS is that the GLONASS groundtracks repeat every 8 days. For the GPS data collected with the NordNav receiver at UNSW, the standard deviation of the C/No increased as the number of days taken between the measurements was increased. If the standard deviation increases too much C/No will be less effective. In Figure 3.61 and Figure 3.6 the repeating behaviour of the C/No is shown for a typical GLONASS satellite. The behaviour is similar to what is typical of GPS satellites and good detection thresholds can be created without needing modification of window sizes or sigma values. 66

93 Chapter 3 Detection of RFI to GPS using C/No differences C/No (db/hz) Day n-16 Day n-8 Day n Time (s) x 1 4 Figure C/No values from the IGS RINEX data (GLONASS). C/No (db/hz) Day n-16 Day n-8 Day n Time (s) x 1 4 Figure 3.6. Close-up of repeating multipath behaviour (GLONASS). The detection technique was run over the same time as the GPS data and the results are shown in Figure 3.63 and Figure The number of detections is fewer than the GPS data although it is noted that there are less GLONASS satellites visible so the number of observations is lower. During the 7th day pair there is a noticeable jump in the number of detections which occurs at the same time as the jumps seen in the results from GPS shown in Figure 3.55 and Figure 3.56, indicating an external event caused it. 15 Detections Day Pair (days) # of effected Satellites Day Pair (days) Figure The number of detections in 5s over time (GLONASS). Figure The number of effected satellites in 5s windows over time (GLONASS). In Figure 3.65 and Figure 3.66 the fall in C/No is shown for the satellites affected on the 7th day pair. The behaviour is similar to the GPS satellites. On the other tracked GLONASS satellites at the same time that were at higher elevations there was no drop in the C/No values. As these anomalies in C/No occurred for satellites at low elevations and for both GPS and GLONASS it is likely that it was caused by some obstruction of the receivers antenna. Looking at the data for 67

94 Chapter 3 Detection of RFI to GPS using C/No differences GPS and GLONASS simultaneously adds the ability to monitor the health and behaviour of the antenna and for any problems with the receiver hardware that cause a systematic fall in C/No. 48 Day n-16 Day n-8 5 Day n-16 Day n-8 C/No (db/hz) Day n C/No (db/hz) Day n Time (s) x 1 4 Figure The C/No anomaly during day pair 7 on PRN7 (GLONASS) Time (s) x 1 4 Figure The C/No anomaly during day pair 7 on PRN1 (GLONASS) Comparison between GPS and GLONASS In Figure 3.67 the standard deviation is shown between 4 hours of C/No values calculated from the RINEX data. The behaviour of the standard deviation is similar between the two systems, although at higher elevations it is lower for GPS. The difference is small considering the groundtrack repeat time for GLONASS is 8 times longer than GPS. In Figure 3.68 the distribution of the elevations for both systems is shown. The difference in the elevations at the receiver location can be seen. GLONASS has fewer satellites at higher elevations and appear to be concentrated in a set of elevations at 1, 3, and 5 degrees. The elevation profile of the GPS satellites is smoother with a peak at 7 degrees. Standard Deviation GLONASS GPS Density GPS GLONASS Elevation (deg) Figure Comparison of the standard deviation for C/No values over a 4 hour period x Figure Kernel density estimate of satellite elevations over a 4 hour period. 68

95 Chapter 3 Detection of RFI to GPS using C/No differences Minimum Detectable J/N This section examines the minimum detectable RFI in terms of J/N between GPS and GLONASS. To determine this, the minimum J/N was calculated that would cause at least 3 satellites to have detections at once. This was determined numerically by calculating the C/No values with RFI added using (3.5) for each satellite for a particular day, and incrementally increasing the J/N of the RFI until at least 3 satellites crossed the C/No detection threshold. In Figure 3.69 the minimum detectable J/N is shown for the GPS and GLONASS data over 4 hours using 1 second detection windows. The kernel density of the minimum J/N over 4 hours is shown in Figure 3.7. At some locations there are gaps and sudden jumps which are caused by gaps in the RINEX data. Over a 4 hour period GPS is able to detect RFI down to a J/N of -9dB and GLONASS down to a J/N of -1dB. Compared with GPS, there are times when the minimum J/N for GLONASS increases significantly. This is because the number of visible satellites at high elevations, which would have a tight detection threshold, is lower with GLONASS as the constellation has fewer satellites. The probability of at least 3 satellites crossing the detection threshold is significantly lower at these times. As the GLONASS constellation is completed better detection can be expected. However due to the use of FDMA in GLONASS, it may not be able to match GPS because of the technical limit on the number of satellites that it can broadcast at once. Minimum J/N (db) GLONASS GPS Time (s) x 1 4 Figure The minimum J/N that would cause detections for at least 3 satellites (1s windows). Density GPS GLONASS J/N (db) Figure 3.7. Kernel density estimate of minimum J/N for detection (1s windows). Determining the minimum J/N every second results in a noisy value over time. The value can be smoothed out by looking for at least three satellites having a single detection in a 5 second window. This will also improve the ability to detect weaker RFI but the time to detection will be increased. In Figure 3.71 the minimum detectable J/N is shown for the GPS and GLONASS data over 4 hours using the 5 second windows. The kernel density of the minimum J/N over 4 69

96 Chapter 3 Detection of RFI to GPS using C/No differences hours is shown in Figure 3.7. Over 4 hours a J/N of -11.7dB can be detected by GPS and a J/N of -1.dB by GLONASS. At some locations GLONASS can detect at a lower J/N then GPS but due to the less number of satellites visible at different times of the day the required J/N for GLONASS is significantly larger than GPS. Minimum J/N (db) GLONASS GPS x 1 4 Figure The minimum J/N that would cause detections for at least 3 satellites (5s windows). Density GPS GLONASS J/N (db) Figure 3.7. Kernel density estimate of minimum J/N for detection (5s windows) Summary and Conclusion In this work the ability to detect the presence of RFI was investigated using C/No measurements. The way the receiver estimates the noise-density was found to have a major impact on the detection performance. In the context of a stationary receiver in a surrounding environment which doesn't change, taking the difference of C/No measurements between groundtracks allows much of the variation in C/No to be removed. Over long observation times the post correlation noisedensity estimate allows for the detection of much weaker narrowband interferers. Depending on the frequency offset of the RFI, the post-correlation method may not detect the presence of even a relatively strong RFI if its spectrum does not overlay with the GNSS signal spectrum, while the pre-correlation method will detect it instantly. In experimental data the C/No technique was able to detect RFI down to a J/N of -16.8dB. The technique was also found to be suitable for GLONASS even with its different groundtrack repetition time. In practical receiver implementation, it would be beneficial to calculate C/No using pre-no and post-no separately so that the variance of the tracking loops could be monitored as well as an overall indication of the power at the input to the baseband correlator which may not immediately enter the tracking loops when RFI is present. 7

97 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control 4.1 Introduction The Automatic Gain Control (AGC) is an important element in Global Navigation Satellite System (GNSS) receivers which contain multi-bit Analogue-to-Digital Converters (ADC). The AGC is needed to set the root mean square (rms) voltage level at the input to the ADCs in the RF front-end at a level that minimises losses from the quantisation process [131]. Due to differences in gain from different antenna and front-end components the rms voltage level before the AGC will be different for each individual receiver and antenna setup. In the presence of Radio Frequency Interference (RFI), the rms voltage level will increase and as a result the AGC will reduce its gain, attenuating the combination of the RFI and GNSS signals. As the response of the AGC gain is proportional to the power at the input to the receiver, it can be used for detecting RFI and for estimating the Jammer-to-Noise Ratio (J/N) [86]. As AGCs are an existing part of most GNSS receivers they present an inexpensive method for detecting RFI. Furthermore, as J/N measurements can be used as Received Signal Strength (RSS) measurements, the AGC can be used for localising RFI if used in a sensor network [117],[118]. 71

98 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control The way AGC is implemented influences the J/N estimation. In [86] one type of J/N meter is described that uses an AGC that estimates the rms level at the input to the ADC using the rms value of the quantised samples. In [118] another type of J/N meter is described that uses an AGC that estimates the rms level at the input to the ADC from the histogram of the incoming samples. Due to the nonlinear behaviour of quantisation noise and the way that probability density functions mix differently for different types of RFI, the J/N estimates from these methods may have biases. This behaviour is investigated and a way to overcome this is presented in the first part of this chapter. Another issue with using the AGC for RFI detection is that the AGC gain values measured over a period of time appear to drift with a noticeable diurnal pattern. In [64] measurements taken from a GPS receiver operating in the L1 band over days showed that the value of the AGC gain varied by about +/-.5 db and appeared to be correlated with ambient temperature. The presence of these variations will limit the possible detection performance when using the AGC and this is investigated in the second part of this chapter. This chapter is structured as follows: In section 4. the theoretical operation of the AGC is described. In section 4.3 the estimation of the J/N using the AGC is explored along with the biases introduced by two different possible AGC implementations. In section 4.4, the stability of the AGC values over time is explored and a method for calibrating the drift due to changes in temperature is presented. In section 4.5, a technique for estimating the noise-floor of the GPS receiver under test is described and used to characterise the response of the AGC to RFI in terms of J/N ratio. In section 4.6, the RFI detection performance using AGC is explored with and without calibrating for the drift due to temperature. Concluding remarks are given in section 4.7. Parts of the work presented in this chapter have been published in the following peer-reviewed conference proceeding: [1] RJR Thompson, E Cetin, and AG, Dempster, "Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control," in IGNSS11 Symposium on GPS/GNSS, Sydney. 4. AGC Operation The purpose of the AGC is to adjust the voltage or power level of the IF signal at the input to the ADC of a GNSS receiver to minimise the quantisation loss [13]. The aim is to place the 7

99 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control threshold levels in the ADC at locations relative to the probability density function of the incoming signal as to capture the most of the satellite signals. This optimal level is generally described in terms of L/σ, where L is the maximum threshold or voltage level in the ADC and σ is the rms noise level at the input to the ADC. An example of a -bit encoding strategy is shown in Figure L L -3 Figure 4.1. The encoding behaviour of a -bit sign and magnitude ADC. Using a probabilistic model of the output of the correlator in a generic Direct Sequence Pseudorandom Noise (DSPN) receiver [131] the optimum value of L/σ can be found. For -bit sign and magnitude encoding/quantisation, the quantisation loss is minimal when L/σ =.996. With the maximum threshold L fixed at V (arbitrarily) the incoming rms noise level σ IF should be equal to /.996 =.. As shown in Figure 4., in ideal operation the AGC loop would adjust the gain g of the Variable Gain Amplifier (VGA) until σ IF is equal to σ IDEAL =.. RF input Downconversion and filtering VGA ADC AGC gain voltage σ IF Figure 4.. The ideal AGC control loop. + σ IDEAL Ideally the AGC gain will change linearly with the rms level of the incoming IF signal and as described can be used for the detection and estimation of J/N: 73

100 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control g.σ IF = σ IDEAL (4.1) By monitoring the behaviour of the AGC gain g in the absence of RFI the relative noise level at the receiver in normal operating conditions can be estimated. If this value changes abruptly it can be used for detecting RFI and estimating the J/N if RFI is detected. Assuming that the noise and RFI are independent the J/N can be calculated from the change in the AGC gain as follows: g 1.σ IF = σ IDEAL (4.) g. (σ IF+ σ RFI) = σ IDEAL (4.3) J/N = (g 1 /g ) -1 (4.4) where g 1 is the gain before the RFI appears and g is the gain after the RFI appears, and σ RFI is the variance of the RFI at the input to the ADC. Assuming that the response of the VGA is linear, the use of J/N allows relative powers of RFI to be calculated without needing knowledge of the absolute noise floor in the receiver. In Figure 4.3 the response of an AGC is shown for a simulated receiver that samples the AGC gain every 1 ms in the presence of Additive White Gaussian Noise (AWGN) only. RFI is added.5 seconds into the simulation and the fall in the AGC gain value can be observed. It is important to note that the calculation of J/N is undertaken after down-conversion and filtering by the RF front-end. The characteristics of the front-end down-conversion and filtering can have an impact on the J/N calculation if they are different between the receivers being used in a geo-location scenario. 4. AGC control voltage (v) RFI off RFI on Time (1ms) Figure 4.3. The simulated response of the AGC gain voltage to an added RFI of J/N -6 db 74

101 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control 4.3 Estimation of jammer to noise ratio using AGC values σ-sensing AGC In practice the AGC in a GNSS receiver cannot directly measure the true input rms level at the input to the ADC. Instead it can make an estimate of the input rms level by taking the expected value of the quantised samples. The operation of this kind of AGC is shown in Figure 4.4. In [86], a practical implementation of a J/N meter is described where the rms. level of the incoming signal is monitored in this way. RF input Downconversion and filtering VGA ADC N 1 ( ) N AGC gain voltage σ IDEAL Figure 4.4. AGC loop that uses the quantised samples to estimate the rms level. + σˆ IF To explore the impact the quantisation noise has on the behaviour of the σ-sensing AGC a simulation setup was created in MATLAB. In this setup AWGN and RFI of different powers were added together and then quantised. A minimisation function was used to find the AGC gain that set the estimate of σ IF closest to σ IDEAL. In the simulation the wideband (WB) RFI is modelled as AWGN with bandwidth equal to half the sampling rate, the continuous-wave (CW) RFI is modelled as a single-tone at the intermediate frequency. In this simulation the intermediate frequency is 4.39MHz and the sampling frequency is 5.714MHz, based on the GP15 chipset [17]. The simulation results are shown in Figure 4.5 when -bit sign and magnitude quantisation is used. As the J/N increases the difference between the change in AGC gain grows depending on the type of RFI. As mentioned previously this is because the amount of quantisation noise changes with signal type and power. At a J/N of db this difference is equal to 1.14 db. Depending on the Geometric Dilution of Precision (GDOP) of the sensor network used in a Received Signal Strength (RSS) localisation system, a small error in the power measurement (in this case relative J/N between sensor nodes) can cause a large error in the final position estimate as explored in Chapter 6. 75

102 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control AGC gain (db) WB CW J/N (db) Figure 4.5. The σ-sensing AGC behaviour for different RFI types: CW and WB. In Figure 4.6 the behaviour of the AGC gain is compared for the ideal case (no quantisation) and for different numbers of quantisation bits. As the number of quantisation bits increases the response of the AGC for CW RFI increasingly matches the ideal response. As the number of bits increases the quantisation error decreases and the estimate of σ IF becomes more accurate. For this type of AGC the only way to improve the consistency of the J/N estimates for different types of RFI would be to increase the number of bits. This is because the dynamic range of the rms level measurement (σ NOISE +σ RFI ) will be small when a small number of bits are used [133] and the power measurement will be biased due to quantisation noise [134]. AGC gain (db) bit 4-bit Ideal J/N (db) Figure 4.6. Increasing the number of quantisation bits makes the AGC gain behave closer to the ideal Histogram sensing AGC In practice, adjusting the AGC gain based on the power of the quantised samples is a technique not used in GNSS receivers that are inexpensive with a small number of quantisation bits. 76

103 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control Another more common way of setting the AGC gain in GPS receivers [17],[53] is to compute the histogram of the incoming samples and then adjust the gain so that the number of samples in particular bins matches the optimum value. This is shown in Figure 4.7. For -bit sign and magnitude encoding/quantisation this corresponds to setting the magnitude bit (+3,-3) high 33% of the time. This type of AGC will respond differently to RFI with different probability density functions. To explore this difference the behaviour of the AGC gain will again be compared in the presence of CW RFI and wideband RFI. RF input Downconversion and filtering VGA ADC ADC Bin Histogram Counter AGC gain voltage Figure 4.7. AGC loop that uses the histogram of the incoming samples to control the gain. + Bin X(%) Ideal Bin X(%) The pdf of the incoming IF signal can be determined from the pdfs of the receiver thermal noise and the pdf of the RFI. Assuming that the thermal noise (X) is independent of the RFI signal (Y) the resultant pdf can be calculated by taking the convolution of X and Y [135]: Z = ( X Y )( x) (4.5) The pdf of the thermal noise can be modelled using the normal distribution: f x 1 σ ( x) = e (4.6) πσ If the RFI is wideband noise, equation (4.6) can be used. The pdf for a CW interferer (sinusoidal) is given by: f ( x) = π A 1, x if x A, otherwise. (4.7) where A is the CW amplitude. The values of (4.5) are calculated numerically using MATLAB 77

104 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control and these are used to calculate what the AGC gain would be to maintain the set L/σ value. The magnitude of the noise is set to db in the following calculations. Figure 4.8 depicts the results and the plots are normalised to the maximum value of each pdf, where Y is the pdf of the CW and X is the pdf of the thermal noise. The resultant pdf of the addition of the two incoming signals is shown by Z. f(x)/max(f(x)) Y X Z -5 5 x Figure 4.8. The normalised result of the numerical convolution to calculate the probability density function of noise plus CW RFI, with J/N = 7.8 db. The behaviour of the gain for the histogram counting AGC, which keeps the Magnitude (MAG) bit high 33% of the time, is shown in Figure 4.9. It is noticeable that the behaviour is different for the CW and WB interference types in a similar way to the findings for the σ-sensing AGC. As the J/N increases the difference in gain between the two RFI types increases, and is equal to.8 db at J/N = db. This difference is less than that found for the σ-sensing AGC. AGC gain (db) WB CW J/N (db) Figure 4.9. The change in gain for a histogram counting AGC with MAG set high 33% of the time. By changing the MAG bit high percentage, the sensitivity of the AGC gain to the CW RFI can be changed. Adjusting this percentage does not change the response of AGC to WB interference. This is because the pdfs change differently for CW and WB RFI. Running the calculations 78

105 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control numerically over a range of percentage values, a value of 18% was found to give the smallest difference between the CW and WB interference cases. Using higher percentage values, such as 8%, increases the sensitivity of the AGC gain to the CW, as can be seen in Figure 4.1. AGC gain (db) WB CW 8% CW 18% J/N (db) Figure 4.1. The impact of changing the MAG high % on the sensitivity and response of the AGC gain to CW RFI Correlation Losses The percentage of samples with the MAG bit high that gives the best J/N estimation for the CW and WB is different from the value that minimises the correlation loss for Gaussian noise only. In [131] an expression is given for calculating the correlation loss depending on the placement of the ADC threshold levels. For -bit quantisation the results are shown in Figure For values of L/σ too large and too small the loss in SNR approaches the loss for the 1-bit quantisation case [136]. -.5 SNR loss (db) L/sigma Figure The SNR loss as a function of L/σ for -bit quantisation. A value of MAG bit high = 33% corresponds to L/σ =.996. A value of MAG bit high = 18% corresponds to L/σ = 1.9. As can be observed from Figure 4.11, at L/σ =.996 the SNR loss is 79

106 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control.54 db. At L/σ = 1.9 the SNR loss is.64 db. The cost in operating the AGC to give the best estimate of J/N for CW is only a marginal drop in SNR of.1 db for the case where interference is absent. 4.4 AGC Stability In order to be used as a sensitive J/N meter and detect weak RFI, the stability of the AGC needs to be monitored and variations caused by environmental and other effects calibrated out. As noted in [64],[1], for measurements with real GNSS receivers there appears to be a strong correlation between changes in temperature and changes in the AGC gain level. Changes in the AGC gain will add a bias to the J/N estimate as well impact the detection reliability of RFI. It is interesting to note that from [64] that the AGC gain actually increases with temperature. This would appear somewhat contradictory, as the thermal noise should increase as temperature increases as given by the Johnson-Nyquist noise formula [137],[138], resulting in a reduction in gain. In practice the efficiency of the electronic components reduces with increases in temperature. As a result the gain of the AGC must be increased to compensate for the fall in effective gain of the receiver components. The gain stability of components in the signal path of receivers is of great concern in radio astronomy and has been studied previously in this context. The effects of slow variations in ambient temperature are seen as a low frequency component in the noise output of radiometers [139]. In [14], for discrete components including mixers and amplifiers, gain/temperature gradients of between -.5dB/deg. C to -.1dB/deg. C were observed for individual components at microwave frequencies, and the overall drift of the system was -.7dB/deg C. To explore this behaviour a USB temperature logger was attached to a Novatel OEM6 GPS receiver with an antenna connected and the AGC values recorded over a couple of days. The receiver was placed in a backyard shed to increase the exposure to the outside temperature changes. A photograph of the USB temperature logger and the Novatel receiver is shown in Figure 4.1. The receiver was in a sealed weatherproof enclosure with power supply conditioning provided by GPSat Systems. 8

107 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control Temperature logger GPS receiver Figure 4.1. Photograph of the USB temperature logger and the GPS receiver. The 'AGC PulseWidth' values recorded from the receiver over a 138 second period are shown in Figure The receiver used does not directly output an AGC gain voltage; instead it outputs AGC PulseWidth values. In these values there are two kinds of noise that are visible, a highfrequency component and a low frequency random walk or drift, similar to what has been observed in the output of radiometers [141]. Further analysis using the Allan deviation may present useful detection techniques in this kind of behaviour [14]. AGC PulseWidth Time (s) x 1 4 Figure The AGC values over a 138 second period. The results of the observations over a number of days are shown in Figure The response of the AGC PulseWidth appears closely correlated with changes in the temperature of the GPS receiver. 81

108 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control AGC PulseWidth Time (s) x 1 5 Temperature (C) Time (s) x 1 5 Figure The variation of the AGC PulseWidth and temperature for a GPS receiver in an environment with mild exposure to the outside environment. A direct characterisation of the effect of temperature on each of the individual components in the RF front-end would be difficult to measure. Instead the response of the receiver as a whole can be modelled. In Figure 4.15 the relationship between temperature and AGC PulseWidth is shown. As can be observed the relationship appears to be linear in the temperate and gain ranges that occurred during the measurement period. The response of the AGC can be modelled using the following equation: AGC PulseWidth = 6.73 x (4.8) where x is the temperature in deg. C. Taking the derivative of (4.8) reveals that for 1 deg. C change in temperature there will be a 6.73 change in the value of the AGC PulseWidth. The fit has an RMSE of 4.39 AGC PulseWidths. For a receiver being used outdoors in sunlight and with exposure to the outside environment the variations in temperature can be expected to be much greater. 8

109 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control AGC PulseWidth Measurements Linear Fit Temperature (C) Figure A plot of the temperature versus AGC PulseWidth for the recorded data set. If no RFI is present, the receiver could continually monitor the AGC value and the temperature to continually self-calibrate and improve the model in (4.8) over time. In Figure 4.16 the response of the AGC is shown before and after corrected for the variations due to temperature. There are still periodic slight trends visible which may be related to the changes in power level from the visible satellites and other ambient signals. The amount of variation is drastically reduced, however, which will allow for detection of much weaker RFI. AGC PulseWidth Time (s) x 1 5 Figure After being corrected by (4.8) the majority of the variation in the AGC value can be removed, leading to improved detection and J/N estimation of jammers. 4.5 Noise-Floor Estimation To evaluate the RFI detection and J/N estimation performance using the AGC PulseWidth on the Novatel receiver, the relative noise-floor of the receiver needs to be estimated. The IF signal at the input of the ADC is not directly accessible hence the noise floor cannot be measured directly. However, the Novatel receiver used also outputs the histogram of the samples out of the ADC along with the AGC PulseWidth and this can be used for estimating the noise-floor. 83

110 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control The receiver uses.5-bit sign and magnitude quantisation with 6 output levels. In the encoding behaviour shown in Figure 4.1 this corresponds to output levels of (-5,-3,-1,1,3,5). The use of these extra levels (compared with the bit case) allows the detection and mitigation of CW RFI [143], using the AGC and ADC. According to the methodology presented previously [131], the quantisation loss for.5 bits is minimised when the +/- 1 sample bins occur 53.6% of the time. The histogram message from the receiver indicates that the output of the +/- 1 bits occurred 48.9% of the time. This is close to optimal and the difference is most likely due to different assumptions and operating requirements being made by the manufacturer. Assuming that the addition of a CW RFI to the antenna input of the receiver along with the thermal noise can be modelled using equation (4.5), the expected histogram percentage for each ADC bin can be calculated for a given J/N ratio. Using a signal generator, a CW at different power levels was combined with the output of a GPS simulator and the histogram percentages from the ADC of the receiver were recorded. To estimate the noise floor, the change in the +3/-3 sample bin percentage from the receiver was compared with the expected result from (4.5). The +3/-3 bin was used specifically as it was the most sensitive to changes in the CW power. The comparison of the response of the receiver and the theoretical response is shown in Figure The theoretical and recorded curves match up closely except at low J/N values. Using this method the noise floor was found to be -9dBm. This value may initially appear high, but is close to the value found in [144] for a similar setup with another Novatel receiver. Although the front-end bandwidth of the receiver is not known, it does support the Omnistar DGPS service therefore if a single RF front-end channel is used for sampling the Omnistar and GPS signals the bandwidth can be assumed to be greater than 6MHz [145]. Another example of a receiver that supports Mobile Satellite Services (MSS), of which Omnistar is one example, has a L1 RF front-end bandwidth of 88MHz [14]. Bin 3 (%) Simulation.18 Novatel J/N (db) Figure The overlapping of the histogram bin percentages for determining the noise 84

111 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control floor of the Novatel receiver. In Figure 4.18 the response of the AGC PulseWidth is shown for different power levels for the injected CW RFI in terms of J/N measured during the noise-floor experiment. The shape of the curve is similar to the theoretical result shown in Figure 4.9 and the AGC PulseWidth appears to follow a db scale AGC PulseWidth J/N (db) Figure The response of the AGC to CW RFI of increasing J/N. In Figure 4.19 the change in the AGC PulseWidth is plotted against the expected change in gain from an ideal AGC, along with a linear fit with a resulting equation of AGC PulseWidth = y (4.9) where y is the expected change in gain in db. The fit has a RMSE equivalent to.19db. This confirms that the AGC PulseWidth is proportional to a db scale. Using (4.8) and (4.9) it is also possible to determine the gain-temperature gradient of the receiver being tested, and the receiver has a value of -.776dB/deg. C. This is somewhat higher than the value of -.7dB/deg. C observed in [14] for a microwave radiometer, but minimisation of this property may not have been a design consideration for this GPS receiver as the AGC would easily compensate for this when used in standard GNSS operation. 85

112 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control AGC PulseWidth 5 Measurements Linear Fit Gain (db) Figure The change in the AGC PulseWidth compared with the expected change in gain. 4.6 Detection Performance The variation in the AGC due to temperature makes setting a tight RFI detection threshold difficult without correction. A mean-change detection algorithm would be vulnerable to RFI that ramps up slowly over time (such as a moving source that gradually gets closer). Setting an absolute threshold based on the previous day s data would also be vulnerable to false alarms if the temperature varied by a large amount from day-to-day. In Figure 4. the 6-σ detection thresholds are shown for the uncorrected and corrected AGC fits from the data recorded in section 4.4. In Figure 4.1 the 6-σ detection thresholds are shown in terms of the change in the AGC from a CW RFI of different powers. With the corrections and using a 6-σ threshold the technique can detect a CW RFI down to a J/N of -8dB. Without correction and again using a 6σ threshold the technique can detect a CW RFI down to only a J/N of db. 48 AGC PulseWidth Time (s) x 1 5 Figure 4.. The difference in 6σ thresholds before and after temperature compensation. 86

113 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control {red lines: uncompensated, blue lines: compensated}. AGC PulseWidth J/N (db) Figure 4.1. The measured response of the AGC to CW RFI and the 6-σ detection thresholds with and without temperature compensation. {green line: compensated, blue line: uncompensated}. Considering a typical GPS receiver with a noise floor of -111 dbm the AGC could be used for detecting CW RFI down to -119 dbm. The RTCA defines minimum susceptibility requirements for GPS receivers operating in the presence of RFI [146]. The required RFI mask for a CW interferer on L1 is -1.5 dbm and for a wideband interferer ( MHz) is -17. dbm. The use of the AGC in a front-end with a MHz bandwidth would only be able to achieve the detection requirements for wideband interferences. For RF front-ends with wider bandwidths, which as a result have higher thermal noise powers, the AGC will be less effective. This is a concern for modern geodetic receivers, some of which have front-end bandwidths as high as 88MHz to maximise positioning performance and support MSS services [14]. At 88MHz the resulting noise floor is dBm and detection would only be possible for RFI power greater than -1.56dBm. The performance is also not as good as the specialised interference detection techniques [7], [7] but the complexity and cost of a receiver that only needs to record its AGC value will be a lot less than one that needs to perform custom digital signal processing on IF samples. For receivers that already sample the AGC gain but do not output it to the user a firmware change is all that would be needed to make it available for use with RFI detection and J/N estimation. 87

114 Chapter 4 Detection and Jammer-to-Noise Ratio Estimation of Interferers Using the Automatic Gain Control 4.7 Summary and Concluding Remarks In this work two important elements that impact the detection and J/N estimation of RFI using the AGC have been investigated. By observing and characterizing how the AGC responds differently to different types of RFI, the bias in the J/N estimates can be reduced by adjusting the (+3,-3) histogram with only a small loss in SNR. The change in temperature was found to have a large influence on the drift of the AGC values over time. A linear model was found to be appropriate for modelling this change and by compensating for it the detection level of RFI using the AGC could be improved from a J/N of - db to a J/N of -8dB. Even with this compensation for scenarios requiring integrity such as those outlined by the RTCA more robust techniques such as those that do signal processing on the quantised samples will still be required. For use in crowdsourced scenarios and where the requirement for integrity is reduced the AGC still presents an attractive option. Future work will investigate the effects of environment such as heavy rainfall and lightning on the AGC, as well as the response in environments where the receiver will be in the near-field of many objects and transmitters such as personal computers and mobile phones which generate spurious emissions in the L1 band. 88

115 Chapter 5 Dilution of Precision for Interference Localisation 5.1 Introduction One potential source of disruption to GNSS is from Radio-Frequency Interference (RFI) that degrades or jams the operation of a GNSS receiver. In order to maintain the integrity of GNSS in an area, once a RFI source is detected it needs to be localised so that it can be dealt with accordingly. For RFI, the source must be located passively. Two of the most widely used methods for passively localising unknown or "uncooperative" sources are Angle-Of-Arrival (AOA), which uses bearing measurements, and Time Difference of Arrival (TDOA) [19], which uses time delay measurements. An issue with the use of AOA is that antenna arrays are required and the hardware and computing requirements are significant. An issue with TDOA is that the variance of the time-delay measurements increases as the bandwidth of the unknown source reduces [17], so it is difficult to use TDOA to localise a narrowband source. GPS is susceptible to all types of RFI including narrowband. Another issue with TDOA is that it requires tight timing synchronisation between each of the sensor nodes. A potential alternative to using AOA and TDOA is using the Received Signal Strength (RSS) of the RFI measured at different locations. 89

116 Chapter 5 Dilution of Precision for Interference Localisation In the context of GNSS receivers, RSS has the advantage that measurements can be made using existing hardware so the cost is reduced [118]. In a traditional RSS localisation scheme the transmit power of the source is assumed to be known, while for unknown sources it is not known. The work in this chapter investigates the use of RSS in this scenario. By taking the differences of RSS measurements, Difference of RSS (DRSS) measurements are formed [147], where the transmit power term is removed so it doesn t need to be estimated, and lines of position can be drawn. Localisation systems that use the differences of cellular signal attenuations [148] and gains ratios [149] which are similar to DRSS have been presented in the past in hybrid systems. The work in this chapter is different from these in that it considers the use of the DRSS measurements alone without aiding from TDOA. The performance of using DRSS will be investigated and compared to TDOA and AOA through the Dilution of Precision (DOP) metric. This initial investigation will reveal the potential of DRSS for use in the localisation of RFI to GNSS using typical positioning models and measurement errors found in the literature. This chapter is structured as follows: In section 5., an introduction to DOP and how it is derived for positioning systems is given. In section 5.3, DOP as it is used in the traditional GPS context is shown. In section 5.4, the performance of a Maximum Likelihood Estimator (MLE) is compared to the results from the DOP equations. In section 5.5 the DOP concept is applied to RSS/DRSS. In section 5.6 the behaviour of the DOP for DRSS is investigated for different sensor topologies and the positioning performance compared with AOA and TDOA. A summary and concluding remarks are given in section 5.7. Parts of this chapter have been publishing in the following conference proceedings: [1] RJR Thompson, AT Balaei, and AG Dempster, "Dilution of precision for GNSS interference localisation systems," in European Navigation Conference (ENC GNSS), Naples, Italy, Dilution of Precision The Dilution of Precision (DOP) is an important metric for evaluating the effect of geometry on the positioning accuracy of localisation systems. DOP is closely related to the Cramer-Rao Lower Bound (CRLB), which is used to give a lower bound on the variance possible from any unbiased estimator [149]: θ ˆ σ ( θ > CRLB ( θ) (5.1) ) θˆ 9

117 Chapter 5 Dilution of Precision for Interference Localisation where θ is the vector of parameters being estimated and σ θ ˆ ( θ) is the variance of the estimation of these parameters. This is a commonly used method for analysing the performance of different localisation systems and algorithms [16],[15],[17]. In the calculation of the CRLB the general additive noise vector model of the positioning measurements with noise takes the form d ˆ = f( θ) + ε (5.) where dˆ =[d 1,d,,d N ] T is the vector of noisy measurements, f(θ)=[f 1 (θ),f (θ),,f N (θ)] T is the vector of positioning equations evaluated at the user position θ, and ε=[ ε 1, ε,..., ε N ] T is the vector of the independent Gaussian additive noise for each measurement. In matrix-vector form the CRLB covariance matrix is defined as the inverse of the Fisher Information Matrix (FIM) [17] and is as follows: 1 ( H C ) 1 T CRLB = H (5.3) where H corresponds to the Jacobian of the set of positioning equations f with respect to the vector of parameters being estimated θ, and C=E[ε T ε] is the covariance matrix of the measurements. If the noise in each measurement is assumed to be uncorrelated Gaussian noise of equal magnitude, the covariance matrix takes the form measurements. σ m C = I where σ m is the variance of In the GNSS context DOP is used to show the ratio of positioning error to the pseudorange error [151]. The DOP equations are derived in a similar way to the CRLB except that the covariance m matrix is taken out, i.e. C is replaced by C/ σ in assuming (5.3). This makes DOP independent of the absolute magnitude of the variance of the measurement error, but still reflects the correlation of the noise between the positioning equations as can occur in TDOA. DOP can therefore be derived from the CRLB if C is Toeplitz and symmetric along its diagonal: 1 Q = CRLB (5.4) σ m 91

118 Chapter 5 Dilution of Precision for Interference Localisation leading to the expression of DOP as the ratio of the positioning error σ p in terms of the measurement noise σ m : σ = DOP (5.5) p σ m where DOP contains the elements of interest from Q. Taking the trace of Q gives the Geometric Dilution of Precision (GDOP). 5.3 DOP for Satellite Navigation Systems The localisation system used in GNSS finds the location of a receiver by finding the intersection of spheres. The radius of these spheres is found by making pseudorange measurements between the satellite and a receiver. The positioning equations are Time of Arrival (TOA) [6] and accounting for receiver clock bias takes the form: 1 t i = ( xi xu ) + ( yi yu ) + ( zi zu ) + b (5.6) u c for N number of satellites, where i=1..n, t i is the TOA measurement from the ith satellite, ( i i i x, y, z ) is the co-ordinate of the satellite, x, y, z ) is the user ( u u u position, c is the speed of light, and b u is the receiver clock bias. The geometry of TOA simplified in D is shown in Figure 5.1. y Satellite Receiver TOA 1 TOA TOA 3 x Figure 5.1. A D TOA positioning system using 3 satellites. 9

119 Chapter 5 Dilution of Precision for Interference Localisation 93 There are 4 parameters for which to solve in this estimation problem, the user position ( ) u u u z y x,, and the receiver clock bias b u. Taking the partial derivatives with respect to these parameters forms the Jacobian matrix H for this system of equations which can be calculated as: u i i i i i i db dz r y y dy r y y dx r x x c df 1 1 i TOA = (5.7) = c r z z r y y r x x c c r z z r y y r x x c r z z r y y r x x c N u N N u N N u N u u u u u u M M M TOA 1 H (5.8) where ) ( ) ( ) ( u i u i u i i z z y y x x r + + = If the measurements are assumed to have uncorrelated independent Gaussian noise of equal variance, the covariance matrix takes the form I C σ TOA =. Using (5.3) and (5.8) the CRLB matrix takes the form: = bˆ ẑbˆ ŷbˆ xˆbˆ ẑbˆ ẑ ŷẑ xˆẑ ŷbˆ ŷẑ ŷ xˆŷ xˆbˆ xˆẑ xˆŷ xˆ σ σ σ σ σ σ σ σ σ σ σ σ σ σ σ σ CRLB (5.9) The first term xˆ σ represents the lower bound on the variance of the estimation of the x term. By taking different combinations of the diagonal elements of the CRLB matrix and dividing by σ m, different types of DOPs can be defined. For example the commonly used GDOP, which expresses the estimation error in terms of the geometry of the satellites, can be calculated by: ) trace( σ 1 GDOP CRLB m = (5.1)

120 Chapter 5 Dilution of Precision for Interference Localisation and using (5.9) and (5.1): 1 GDOP = σ xˆ + σ ŷ + σ ẑ + σ σ m bˆ (5.11) The GDOP term includes the error in the estimation of the receiver clock bias term as well as the error in position. The clock bias term is a nuisance parameter, and of greater interest is the Position Dilution of Precision (PDOP) which gives the lower bound on the root mean square error of the position estimate in metres in the form 1 PDOP = σxˆ + σ ŷ + σ (5.1) ẑ σ m For a simplified D system with two satellites the DOP is shown geometrically in Figure 5.. The true circles of position are plotted along with the circles of position with average the estimated position will be inside the area enclosed by the ± σ of noise added. On ± σ circles of position. In Figure 5.3 the DOP is shown again geometrically but with the satellites in different positions. The area enclosed by the corresponding DOP value would be greater. ± σ circles of position is much larger for this second example, and the 1 8 y (metres) x (metres) Figure 5.. An example of good DOP performance for TOA. {white dot: true position; black dots: transmitter} 94

121 Chapter 5 Dilution of Precision for Interference Localisation 1 8 y (metres) x (metres) Figure 5.3. An example of poor DOP performance for TOA. {black dot: true position; white dots: sensors} 5.4 Maximum Likelihood Estimation (MLE) In order to attain the CRLB an efficient estimator is required. Under certain conditions [15] the MLE can be efficient and asymptotically approach the CRLB. For finite measurements the MLE is not efficient although but can be used to provide a good estimate of parameters in many cases. To calculate the MLE position estimate the least-squares cost function of the positioning equations can be minimised [153]: = ( dˆ f(ˆ)) θ C (ˆ d f(ˆ)) θ T 1 T ε (5.13) ˆ θ = arg min( ε) (5.14) θ where dˆ again is the vector of measurements with additive noise, f(θ) is the vector of positioning equations evaluated at θ, and C is the covariance matrix. As this system is non-linear, an iterative method such as Gauss-Newton [154] is required that linearises the system around an initial guess and continues until a minimum in the cost function is found. In Figure 5.4 the solutions found by the Gauss-Newton method are plotted for 5 simulation runs of measurements with added Gaussian noise with variance 1. In an attempt to ensure convergence 95

122 Chapter 5 Dilution of Precision for Interference Localisation the true location is used as the initial guess. The calculated GDOP at this point is 1.3. The mean value of the estimated positions for the simulations is (4.89,-4.9), close to the true position (5,-5). The Root-Mean-Square-Error (RMSE) of the estimates is 1.1m which is close to the PDOP value. As the number of simulation runs to infinity the RMSE will asymptotically approach the DOP value if the position estimator is efficient. It can be seen in Figure 5.4 that the spread of the estimated positions is not normally distributed around the true position of the source, there is some correlation between x and y. A technique to show this interaction is to plot an error ellipse [17] from the CRLB matrix. In Figure 5.5 the error ellipse is shown which illustrates the distribution of the estimates in a way that just the single GDOP value can't. y (metres) x (metres) Figure 5.4. The distribution of position estimates for a TOA scenario with added measurement noise. {white dot: sensors; black dots: true position, star: position estimates} y (metres) x (metres) Figure 5.5. The error ellipse calculated for the measurement noise as used in Figure

123 Chapter 5 Dilution of Precision for Interference Localisation {white dot: sensors; black dot: true position, star: position estimates} 5.5 Interference Localisation Using DRSS In a traditional RSS localisation system using the log-normal fading path-loss model [115] the transmit power of the source is assumed to be known. For RFI the transmit power is not known. This term represents a nuisance parameter that needs to be solved along with the position parameters. In this work it is assumed that the transmitter and receiver antennas are isotropic and the propagation constant is equal in all directions. In this work the hardware and software measuring the RSS are assumed to be ideal, so effects such as non-linearity and saturation in analogue parts of a potential receiver for example are ignored. One way to remove the need to solve for transmit power is to take Difference of RSS (DRSS) measurements. For the positioning system shown in Figure 5.6, the circles created by sensors 1 and are represented by RSS equations [115] RSS d1 = P 1n log1 σ (5.15) d 1 + RSS d = P 1n log1 σ (5.16) d + where RSS i is the received signal strength of the source measured at sensor i, P o is a reference transmit power measured at distance d, d i is the distance between the sensor and the source, n is the path-loss exponent of the propagation environment and σ i is standard deviation of the shadowing noise. In dense outdoor suburban environments the value of σ i can be as high as 9dB, and the value of n can vary from to 5. The difference of (5.15) and (5.16) eliminates the transmit power variable: d DRSS 1, = RSS1 RSS = 1n log 1 + σ1 + σ d (5.17) 1 Constant Differences-of-Received-Signal-Strength (DRSS) represent circles as shown in Figure 5.7, in the same way that constant TDOA represent hyperbolas [148]. If the individual variances of the shadowing are equal and independent then the variance of one DRSS measurement is σ. In practical situations this value is likely to be lower due to correlated shadowing [148] but is 97

124 Chapter 5 Dilution of Precision for Interference Localisation assumed to be σ to make the covariance matrix simpler to calculate. This value also represents the worst case scenario when there is no correlation between the shadowing. The number of sensors needed to solve for position for RSS and DRSS remains the same but the computational complexity of solving for position is reduced in DRSS because the transmit power parameter is removed. This reduces the number of columns in the Jacobian matrix by 1 and opens up the possibility of using closed-form position estimation algorithms [155]. y DRSS 1- Interferer d d 1 RSS 1 Sensor 1 Sensor RSS x Figure 5.6. The difference of two RSS equations creating a DRSS equation, eliminating P o. 1 8 y (metres) 6 4 Figure 5.7. The circles of position for DRSS for sources (stars) placed along the x-axis. The analysis of the DOP for DRSS will begin with assuming that the path loss exponent is known. In this scenario the parameters to be estimated are θ=(x,y). There are parameters to be estimated so a minimum of 3 sensors are required to create two independent positioning equations. Starting with (5.17) for an arbitrary sensor i and reference sensor j, and taking the partial derivatives with respect to θ we get: x (metres) 98

125 Chapter 5 Dilution of Precision for Interference Localisation 99 dx r x x n r x x n df i i j j = DRSS ln(1) 1 ln(1) 1 j i dy r y y n r y y n i i j j + ln(1) 1 ln(1) 1 (5.18) where ) ( ) ( y y x x r i i i + = As the partial derivatives are from DRSS measurements there are more places where the value of (5.18) can become zero compared to RSS, where the transmit power is known. If the value of a partial derivative does become zero it provides no information for the estimation process at that point. Taking j= as a reference sensor in a i=1..n sensor setup = ), ( DRSS y x H ln(1) 1 r y y r y y r x x r x x r y y r y y r x x r x x r y y r y y r x x r x x n N N N N M M (5.19) The covariance matrix is given by: = L O O M M O O L σ C (5.) There is covariance between each of the measurements because the noise from the reference sensor j is common to all the DRSS measurements. Along with power, another nuisance parameter that may need to be solved is the path-loss exponent n. The impact of this nuisance parameter on RSS localisation is covered thoroughly in [115] and in Chapter 7 of this thesis with real experimental data. It can be expected to have similarly detrimental effect in DRSS. Although n can be found by taking a path-loss survey of the

126 Chapter 5 Dilution of Precision for Interference Localisation environment, it may not be possible to cover all areas to a high degree of accuracy, or it could change over time. Taking the partial derivatives again but this time with respect to n also leads to: df 1n x x = ln(1) rj 1n x xi ln(1) r j DRSS i j i 1n y y ln(1) rj j + dx 1n y y i dy [log1 rj log1 ri ] dn ln(1) ri (5.1) Again taking j= as the reference sensor in a 1..N sensor setup log1 r log1 r1 log1 r log1 r3 H n = DRSS ( ) 1 (5.) M log1 r log1 r N Looking at (5.), problems will arise when the ranges between the sensors and transmitter become equal. An example of where this can happen is when the source is located in the centre of a square sensor network as was observed in RSS [115], where the partial derivatives with respect to n becomes zero. The impact on DOP of n in the square array is explored further in section For a derivation of the Jacobian matrices for AOA and TDOA used in the proceeding parts of this chapter see [16],[154]. The DOP behaviour with n known and unknown is shown in Figure 5.8, where a scenario similar to what was used in [115] is recreated but this time the error ellipses for DRSS are plotted. Looking at Figure 5.8, it can be seen that when the transmitter is located inside the area of the sensor network the difference in the DOP when n is known and unknown is minimal. However the further away from the sensors the faster the difference in DOP grows when n is unknown. For the point (14, 3) which is inside the area of the sensors there is only a slight increase in DOP when solving for n. At the point (195, 1) which is outside the area of the sensors there is a large increase in DOP when solving for n. This result shows that the need to solve for n makes using DRSS for localisation more difficult as the transmitter is moved away from the sensor network. 1

127 Chapter 5 Dilution of Precision for Interference Localisation 15 y (metres) x (metres) Figure 5.8. The error ellipses for DRSS with and without solving for n. {dots: test points, crosses: fixed monitors, solid line: error ellipse when solving for n} 5.6 Comparison of DOPs Linear Array of Sensors To gain an understanding of how DRSS performs, a simple linear array [17] is used to calculate the DOP terms for AOA, TDOA and DRSS. The position of the transmitter is fixed on the x-axis at x= and moves along the y-axis. By keeping the position on the x-axis fixed the geometry simplifies to the form shown in Figure 5.9. y Interferer Sensor TDOA r 1 r r 1 α 9⁰ α x Figure 5.9. The linear-array topology with interferer fixed at x=, with TDOA hyperbolas shown for a possible interferer location. Beginning with the Jacobian and covariance matrices for AOA [16], the calculation of the DOP for the scenario in Figure 5.9 is as follows: 11

128 Chapter 5 Dilution of Precision for Interference Localisation 1 = H AOA = cos sin 1 cos sin r r r r r r x x r y y r x x r y y r x x r y y α α α α (5.3) with the following covariance matrix: = H AOA = σ AOA C. (5.4) Continuing with the Jacobian matrix for DRSS (with the path-loss exponent assumed to be known): = DRSS ln(1) 1 r y y r y y r x x r x x r y y r y y r x x r x x n H = sin cos 1 sin cos ln(1) 1 r r r r r r n α α α α (5.5) with the following covariance matrix: = 1 1 σ DRSS C. (5.6) Next, calculating the Jacobian matrix for TDOA: = = 1 sin cos 1 sin cos TDOA α α α α c r y y r y y r x x r x x r y y r y y r x x r x x c H (5.7) with the following covariance matrix:

129 Chapter 5 Dilution of Precision for Interference Localisation C TDOA = σ TDOA 1 1. (5.8) The x-dops and y-dops are found by taking the σ xˆ and σ y terms from the CRLB matrix calculated using (5.9) and dividing them by σ m, and are shown in Table 5.1. From the y-dops both AOA and DRSS are noticeably more sensitive to measurement error than TDOA because of the extra range terms in the numerators. The different interactions between the range terms in the DOPs reveal that they will behave differently. The DOPs for TDOA and DRSS are dependent on the constant parameters n and c. Typically n will have a value of and c is taken as the speed of light in a vacuum. Table 5.1. DOPs for a linear array of sensors. AOA DRSS 1 r (x-dop) (y-dop) + r ln( 1) 1 r1 r r n cos α 1 r cos α 1 1 r cos ln(1) 1 n α ( r 1 1 r r sin α ) TDOA 1 1 c [17] cos α c 3 1 (1 sinα ) As the TDOA DOPs do not have a range term in their numerator their performance can be improved by increasing the length of its baselines. This can be seen in Figure 5.1 where increasing the baseline spacing does not cause an overall increase in the GDOP (scaled by 1/c) values for TDOA, but stretches the curve along the horizontal axis. This is not the case for DRSS and AOA which have squared range terms in their numerators. For best performance DRSS and AOA sensors will need to be placed closer together and need to be not too far from the transmitter compared with TDOA. This can be seen in Figure 5.11 and Figure 5.1 where increasing the baseline spacing between sensors not only stretches the curve along the horizontal as with TDOA, but the magnitude of the GDOP values increase as well. The increase in DOP from increasing baseline length is greater for AOA than with DRSS. 13

130 Chapter 5 Dilution of Precision for Interference Localisation m 45m 1m GDOP y (metres) Figure 5.1. The GDOP (scaled by 1/c) for TDOA along the y-axis for a linear array of sensors with different sensor spacing m 45m 1m GDOP y (metres) Figure The GDOP for AOA along the y-axis for a linear array of sensors with different sensor spacing. 14

131 Chapter 5 Dilution of Precision for Interference Localisation m 45m 1m GDOP y (metres) Figure 5.1. The GDOP for DRSS along the y-axis for a linear array of sensors with different sensor spacing. If a transmitter is placed along the baseline of the array of sensors the GDOP becomes infinite for all the localisation methods. For DRSS and TDOA this is because the y-y i terms in the Jacobian matrices become equal (and in this case zero) and the resulting FIM becomes rank deficient. When the FIM is inverted to form the CRLB its elements take on infinite values. This implies that there is an ambiguity [156] in the solution and in the case of the linear array, the solution can take on more than 1 possible value on the y-axis. An example scenario is shown in Figure The plot reveals that along the baselines of the sensors the true DRSS circles of position (solid) only touch at a single point. This is the worst case scenario for positioning equations. For the best DOP the lines of position need to intersect at right-angles. In Figure 5.14 the cost function (5.13) surface is plotted for the dashed lines of position which have added error. In attempting to minimise the least-squares cost function to solve for position the Gauss-Newton method will break down due to the rank deficiency and become divergent. As can be seen in Figure 5.14 there are two possible global minima, so the solution is not unique. 15

132 Chapter 5 Dilution of Precision for Interference Localisation y (metres) x (metres) Figure The DRSS circles for a position with infinite DOP. {dashed: lines of position with added error} 1.5 log 1 (ε) x (metres) 4 y (metres) Figure A plot of the least-squares cost function for the dashed circles of position in Figure {stars: possible position solutions} One aspect that DOP does not show is another type of ambiguity that is created in DRSS and TDOA [157] which is present in linear arrays. In Figure 5.15 a scenario is shown where there are two equal global minima of the cost function on opposite sides of the sensor array. This kind of ambiguity is different to the previous type discussed as the DOPs do not become infinite, but some kind of prior information will be required about the location of the interferer to constrain it to a side of the array. The Gauss-Newton method could converge to either solution depending on where it is initialised. An AOA system does not have the same issue with ambiguities on either side of a linear array as do TDOA and DRSS. 16

133 Chapter 5 Dilution of Precision for Interference Localisation y (metres) x (metres) Figure For collinear arrays there are always solutions on either side of the baselines for TDOA and DRSS Four sensor arrays DRSS has poor DOP in a square-array of sensors such as {(,),(,5),(-5,5),(5,)} shown in Figure 5.16(a), as the DOP becomes infinite along a circle which passes through each of the sensors. This contrasts with TDOA and AOA which exhibit no strong divergent behaviour in this setup. The DOP surface for DRSS (not solving for n) is shown in Figure 5.17 and the DOP becomes infinite because the FIM becomes rank deficient at these points. Moving one of the sensors to form a triangle as shown in Figure 5.16(b), such as moving a sensor to the origin, removes this divergent behaviour as shown by the DOP surface in Figure If 4 sensors are to be used this triangle network has been found to have the best DOP surface for DRSS through Monte-Carlo simulations. In this setup however, TDOA now exhibits divergent behaviour at different points. (a) Square 17

134 Chapter 5 Dilution of Precision for Interference Localisation (b) Triangle Figure Potential four sensor network topologies 8 6 GDOP y (metres) 6 4 x (metres) Figure The PDOP surface for DRSS in a 4 sensor square. {black dots: sensor nodes; the broken sections of the mesh are places where the GDOP exceeds a threshold it diverges to infinity in these regions} GDOP 6 4 y (metres) 6 4 x (metres) Figure The PDOP surface for DRSS in a 4 sensor triangle network. {black dots: sensor nodes} 18

135 Chapter 5 Dilution of Precision for Interference Localisation Adding the requirement to solve for the path-loss exponent n in the square-array leads to an even worse DOP surface, and in practice n will typically need to be solved. As was shown in [115], solving for n introduces places where the DOP becomes formally infinite where in the previous case the DOP was well behaved. As shown in Figure 5.19, the DOP surface while solving for n becomes divergent along the middle of the baselines of the sensors and at the centre. Moving the array into a triangle formation does not totally eliminate all of the divergent behaviour but the useable area for positioning is significantly larger as show in Figure 5.. These results show that even with 4 sensors the choice of sensor geometry is critical for DRSS and TDOA. Their geometrical requirements would appear to be opposite to each other in this case. In the 4 sensor case solving for n there is no sensor placement where the DOP doesn t become divergent somewhere for DRSS, although it is well behaved inside the area of the sensor nodes if a triangle shape is used. 1 GDOP y (metres) 6 4 x (metres) Figure The DOP surface for DRSS in a square network (solving for n). {black dots: sensor nodes} GDOP y (metres) 6 4 x (metres) 19

136 Chapter 5 Dilution of Precision for Interference Localisation Figure 5.. The DOP surface for DRSS in a triangle network (solving for n). {black dots: sensor nodes} Five sensor arrays Through the use of Monte-Carlo simulations the star-array as shown in Figure 5.1 was found to be the best sensor geometry to minimise the DOP surface with 5 sensors for DRSS. Figure 5.1. A star array of sensors which has good DOP performance for all three methods. Unlike in the 4 sensor square array example, there are no problems with DRSS diverging to infinity when the path-loss exponent is solved along with position. Placing a sensor node in the middle of the square solves the divergence problems. A plot of the DOP surface is shown in Figure 5. and a plot of the DOP surface when solving for n also is shown in Figure 5.3. By comparing the two plots it can be seen that inside the sensor array there is only a slight increase in the DOP values. Outside the sensor array the DOP values while solving for n increases at a faster rate. GDOP y (metres) 6 4 x (metres) Figure 5.. The DOP surface for DRSS in a star network. {black dots: sensor nodes} 11

137 Chapter 5 Dilution of Precision for Interference Localisation GDOP 6 4 y (metres) 6 4 x (metres) Figure 5.3. The DOP surface for DRSS in a star network (solving for n). {black dots: sensor nodes} With a suitable geometry found for the practical use of DRSS, some typical values for noise variances have been chosen to compare the DOP between localisation methods. For TDOA, the c=3x1 8 and σ m =1ns [158]. For DRSS, n= and σ m =3dB [115]. For AOA σ m =⁰ [159]. The plots in Figure 5.4 show that inside the area enclosed by the sensor network DRSS is a suitable alternative to AOA even if the true value of n is unknown. It is important to note that TDOA is not appropriate for narrowband interference sources and is shown to illustrate how DOP behaves differently compared to other localisation methods. Positioning error (metres) inside sensor array AOA DRSS DRSS+n TDOA y (metres) Figure 5.4. DOP comparison of different methods for a star array with spacing of 5m using some typical noise variances. {σ TDOA =1ns, σ DRSS =3dB, σ AOA =⁰, the area between y= and y=5 is inside the area enclosed by the sensor array.} 111

138 Chapter 5 Dilution of Precision for Interference Localisation 5.7 Summary and Concluding Remarks Through an investigation of the different passive localisation methods the TDOA technique was found to have the best performance in terms of the DOP metric. The extra range term in the denominators for the Jacobian matrices for AOA and DRSS results in a rapid increase in DOP as the interference source moves away from the sensor nodes. The introduced DRSS technique was found to be significantly more sensitive to network geometry, especially if the path-loss exponent is unknown and the source is located outside the sensor network. At least 5 sensor nodes are required for DRSS so that there are no locations with infinite DOP inside the area enclosed by the sensor network whereas only 3 are required for the TDOA and AOA methods. Using typical measurement noise values found in the literature DRSS was found to be a suitable alternative to TDOA and AOA in a square sensor network with spacing of 5m. The rapid increase in positioning error for sources located outside this sensor network was significant for the DRSS and AOA, and is more so if the path-loss exponent needs to be solved for. In the context of this square network used for the localisation of RFI to GNSS based on these DOP comparisons, TDOA will be superior for broadband interferers in all cases. For narrowband interferers, which TDOA has difficultly localising, DRSS will be superior to AOA both inside and outside the sensor network if the path-loss exponent is known. If the path-loss exponent is not known, DRSS is superior inside the sensor array and AOA is superior for sources outside the sensor network. 11

139 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 6.1 Introduction In order to ensure the integrity of systems that rely on the products that GNSS services provide any RFI source that can disrupt its operation must be localised quickly. Traditionally there are two methodologies for localising unknown sources such as RFI [19]: those that use the Angle- Of-Arrival (AOA) of the incoming RFI signals to triangulate the transmitter position, and those that use the Time-Difference-Of-Arrival (TDOA) of the incoming RFI signals in multi-lateration. Although these techniques provide good localisation performance they have some drawbacks. Systems that use AOA will have higher hardware and computational requirements due to the need of antenna arrays and for the associated spatial signal processing [18]. A localisation system that uses TDOA requires precise timing synchronisation between sensor nodes [16] and is less able to localise narrowband-type interferers as the signals need to be wideband for achieving good estimation of time-delays [17]. 113

140 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas An alternative to AOA and TDOA is to use the Received Signal Strength (RSS) of the incoming RFI signal to define radii which intersect at the source location. The benefits of RSS compared with AOA and TDOA are that it is cheaper to implement in terms of computation and hardware requirements and the measurements can be made using elements of existing GNSS receivers [118],[117]. The drawbacks to RSS are that its positioning accuracy is strongly dependent on the surrounding path loss behaviour and is less effective in the presence of many Non Line-of-Sight (NLOS) signals. The work presented in this chapter concentrates on the use of the log-normal shadowing model to model the path loss for localising unknown RF sources in open outdoor areas where there may be a ground reflection that causes variations in the path loss behaviour [116]. Relatively good accuracy can be achieved using RSS measurements in a fingerprinting methodology [161], but for a large outdoor environment where a localisation network is likely to be set up it may not be possible to build the fingerprint database economically and it may change over time. This work contrasts with previous work done using RSS for localisation in that the unknown source scenario is explored along with the effect of the height and frequency on the path loss behaviour. This is done with experimental results using Wi-Fi devices at.4ghz and simulations at the GPS L1- band at GHz. This chapter is structured as follows: in section 6., the two path loss models typically used for RSS positioning are explored. In section 6.3, a strategy for solving for position using the lognormal shadowing model in the case of unknown sources is explored. In section 6.4, the RSS output from the Wi-Fi devices that were used in the field experimentation are characterised. In section 6.5, the results of the field experiments are presented and analysed. In section 6.6, simulation results at the GPS L1 frequencies are explored. Summary and concluding remarks are given in section 6.7. Parts of the work detailed in this chapter have been published in the following conference proceedings: [13] RJR Thompson, A Tabatabaei Balaei, and AG Dempster, "Outdoor localization of a WiFi source with unknown transmission power," in IGNSS Symp., Gold Coast, Australia, 9, pp. CD-ROM procs. 114

141 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas [16] RJR Thompson, E Cetin, and AG Dempster, "Unknown source localization using RSS in open areas in the presence of ground reflections," in IEEE/ION PLANS, Myrtle Beach, South Carolina, 1, pp Path loss Models in Range-Based RSS positioning In ranging-based RSS methods, a path loss model is used to relate the RSS to a range measurement. There are two commonly used path loss models: the log-normal shadowing model, and the two-ray or ground reflection model that takes into account the influence of a reflected signal from the ground. With a number of RSS measurements equal to or greater than the number of unknown parameters to be solved it is then necessary to minimise the system of equations to find a position solution Log-normal shadowing model In the log-normal shadowing model a path loss exponent is used to characterise the fall in signal strength as a transmitter and receiver are separated and the variance, or shadowing, of the path loss values with distance is modelled as a log-normal distribution [115]: d P d = P 1n log 1 +σ (6.1) d where P is the reference transmit power measured at a reference distance d, P d is the power measured at a distance d, n is the path loss exponent, and σ is the variance of the shadowing. In free space the value of n is equal to, and in practice can vary depending on the surrounding environment [16]. The variance of the shadowing is also dependant on the surrounding environment and can increase significantly in complex environments where there are multiple blockages between the transmitter and receiver [163]. 6.. Two-ray reflection model Another model that can be used to define path loss is the two-ray reflection model which takes into account the impact a reflected signal from the ground has on the received signal power. This model fits observations taken in Line-Of-Sight (LOS) of the transmitter in open areas [164]. It can be defined as [165]: P d δd jπ λ 1 e = P 1 log1 + Γ (6.) d d + δ d 115

142 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas where P is the transmit power, d is the distance between the transmitter and the receiver, λ is the wavelength of the transmitted signal, d+δ d is the distance of the reflected path: δ d = ( ht + hr ) + d ( ht hr ) + d (6.3) Γ is the reflection coefficient, and h t and h r are the transmitter and receiver heights. The reflection coefficient is different depending on whether the transmitted signal is vertically or horizontally polarised. In this work the transmitted signal is assumed to be vertically polarised and the reflection coefficient is given by sin( θ ) ( Γ = sin( θ ) + ( ε cos( θ ) r ε cos( θ ) r ) ) (6.4) where θ is the incident angle of the ground reflection and ε r is the relative permittivity of the ground material. An example value of ε r for surfaces includes 6. for dry asphalt [166]. Typically the reflection coefficient is approximated to be -1; in this work it is calculated explicitly. The geometry of the two-ray reflection model is shown in Figure 6.1. Transmitter d Receiver h t d 1 d h r ε r θ θ Figure 6.1. The geometry used for the two-ray reflection model. The plots in Figure 6. show the RSS values using (6.1) and (6.) for a transmitter with P = dbm, n=, ε r =9, at a frequency of MHz, with receiver and transmitter heights of 1m. The RSS values given by the two-ray model move above and below the values given by the lognormal model as the reflected signal constructively and destructively combines with the LOS signal. Also shown in Figure 6. as a blue dot, is the distance of the first Fresnel zone. The first Fresnel zone distance can be defined as [116]: 116

143 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas ( Σ + ) ( Σ + ) 1 λ λ d f = + (6.5) λ 4 where Σ = h + h t r = h and t hr, and can be used to describe where the path loss will begin to monotonically decrease. After this distance there are no longer dips caused by the ground reflection and in this case the distance is about m or 1 wavelengths. -1 RM LN RSS (dbm) Distance (m) Figure 6.. A comparison between the path loss for the log-normal (LN) and two-ray reflection model (RM). {circle: first Fresnel zone distance} 6.3 Position Estimation If the path loss behaves as the two-ray model suggests, it would be ideal to solve for position using it directly. Doing this requires knowledge of a number of parameters which may not be known for an unknown source over a large area, including the height of the transmitter and the relative permittivity of the ground surface. Solving this directly has been demonstrated when these parameters are known for use in close proximity mining safety [167]. In larger outdoor environments where the permittivity could vary and in the unknown source scenario where the transmitter height is unknown, solving for position this way is expected to be difficult due to the number of unknowns. 117

144 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas For these reasons the log-normal shadowing model will be used here and this work will explore its use when the path loss does follow the two-ray reflection model. Using this model the RSS measured by receiver i is related to the range to the transmitter by: d i RSS i = P 1nlog1 ( ) + σ i (6.6) d where d ( x x ) + ( y y ) i = is the distance of the transmitter to the receiver, (x,y) is the i i transmitter position, and (x i,y i ) is the receiver position. The Differences of RSS (DRSS) measurements may be taken between two receivers i and j to remove the transmit power term from (6), reducing the number of unknowns to be solved and allowing lines of position to be visualised. If the path loss exponent is known, DRSS can be expressed as: d j DRSS i-j = RSSi RSS j = 1n log1 ( ) + σ i + σ j (6.7) d i Position Solution by Least-Squares With a number of RSS measurements that is equal to or greater than the number of unknowns the transmitter position can now be solved. Simplifying to dimensions, the parameters to be solved in RSS positioning are x and y so at least two sensor nodes are required. If the transmit power is unknown the parameters to be solved are [P,x,y], requiring at least three sensors. If the path loss exponent is unknown the parameters to be solved are [P,x,y,n], requiring at least four sensors. The need to solve for more parameters will decrease the positioning performance that can be expected as explored in Chapter 5 through analysis of the Cramer-Rao Lower Bound (CRLB), and with a low number of sensors and poor geometry there may be some locations where positioning performance will be poor. In matrix-vector form the system of positioning equations can be represented by d ˆ = f ( θ) + e (6.8) where dˆ is the vector of noisy measurements, f (θ) is the vector of positioning equations, such as (6), evaluated at θ ={P,x,y,n}, the true location and transmit power and path loss exponent, and e is the vector of measurement noise. The RSS equations are non-linear in nature and need to be 118

145 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas solved iteratively. One method to solve them is to minimise the least-squares cost-function [153] defined as ( dˆ f (ˆ)) θ C (ˆ d f (ˆ)) θ T 1 T ε (6.9) = where θˆ is the estimate of the parameters. It is assumed that there is no correlated shadowing between the RSS measurements for the open area scenario explored in this chapter. Correlated shadowing [168] may improve the results as explored in other works concerning techniques where RSS measurements are differenced [147]. With no correlated shadowing the covariance matrix takes a similar form that is used in TDOA equations, and takes the form: 1 L 1 1 = σ O O M C (6.1) M O O 1 1 L 1 In Figure 6.3 the lines of position are shown for a transmitter in a sensor network consisting of four sensor nodes. In Figure 6.4 the least-squares cost-function (6.9) that corresponds to the scenario in Figure 6.3 is shown. The cost-function is significantly less convex than for other localisation methods such as TDOA and AOA due to the logarithmic terms in the RSS positioning equations. 4 y (metres) x (metres) Figure 6.3. The lines of position for RSS and DRSS equations for a transmitter. {solid: DRSS lines, dashed: RSS lines, circles: sensor nodes, square: transmitter location}. ε y (metres) Figure 6.4. The least-squares cost function (in db) for the DRSS lines of position. x (metres) 4 119

146 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 6.3. Path loss exponent Along with the transmit power and position, the path loss exponent may also need to be solved in (6.6) depending on the knowledge of the terrain and heights of the transmitter and receivers in the sensor network. One example of a large-scale empirical path loss study in telecommunications is the Stanford University Interim (SUI) model [169] where the path loss exponent is given by γ = a bh + c / (6.11) b h b where a, b, and c are dependent on the terrain and h b is the base-station height. In this model, along with others such as the COST-31 Hata model and ECC-33 model [169], the base-station height has an influence on the path loss exponent. In the unknown transmitter case, such as a GPS jammer which motivates this work, the height of the transmitter is unknown so the path loss exponent will need to be solved along with transmit power and position. In the open outdoor scenario it could be expected that the terrain would have less influence on the path loss and there will be a LOS path between the transmitter and receiver. Due to the ground reflections however the value of n will still vary depending on the location and antenna heights. To explore this behaviour simulation results will be used for an example sensor network: Considering an array of sensor nodes in a star formation of radius 75m, with nodes located at (,75),(75,),(,-75),(-75,),(,) the path loss exponent was calculated based on fits of RSS values for each sensor node using (6.). This was done for transmitters located at different points in an area of interest equally spaced between x=[-1, 1] and y=[-1,1] in and around the sensor network and different heights. For an effective height of 1m, the average value of n over the area was.5, and varied from to For an effective height of 1m, the average value of n over the area of interest was.9138 and varied from 1.8 to The difference in the path loss behaviour for the two effective heights is shown in Figure 6.5. As a result of the different path loss exponent values it again should be solved along with transmit power and position especially in the presence of ground-reflections. 1

147 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Power (dbm) m 1m Distance (m) Figure 6.5. The path loss behaviour at 1m and 1m heights using the two-ray model Least-squares solver Due to the non-linear nature of the RSS positioning equations they cannot be solved directly to find the transmitter position. It is necessary to solve by choosing an initial guess and using an iterative technique such as the Gauss-Newton (GN) or the Levenberg-Marquardt (LM) techniques [154]. A direct implementation of the Taylor-series expansion in the GN technique can diverge quite easily due to the logarithmic terms and risk of rank deficiency in the matrix of RSS positioning equations. To overcome this the LM algorithm is recommended as it combines the GN technique with the Gradient Descent (GD) technique which can be used where the Taylorseries expansion begins to diverge. One problem with the iterative solver is that an initial guess is required. If the initial guess is in the wrong place the solver may converge to a local minima. To overcome this a coarse gridsearch can be used to calculate (6.9) at a number of different values and the minimum used as the initial guess. The use of DRSS equations means that only different values of (x,y,n) need to be searched and P can be ignored, significantly reducing the computational burden. An overview of the position estimation process is shown in Figure 6.6. Grid-search over [x,y,n] Initial guess Levenburg- Mardquart Position estimate Figure 6.6. The position estimation technique for DRSS. 11

148 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas An alternative to overcome these problems is to linearise the positioning equations using an intermediate variable and solving for position directly [155]. This is not used here since they require: at least 5 RSS measurements, the path loss exponent to be known, and the positioning performance is significantly below the iterative techniques. 6.4 Measuring path loss using Wi-Fi The work presented in this section is motivated by RFI localisation in the GPS L1 band. However, the GPS bands are protected and it is generally not legal to transmit in these bands. An alternative approach to evaluate the performance of the RSS-based localisation is to measure the path loss in another band such as the "nearby" ISM band using IEEE8.11 Wi-Fi devices. These devices provide Received Signal Strength Indication (RSSI) outputs, which can be equivalent to RSS measurements, which have been used by a number of authors for path loss measurement and positioning purposes [165],[17]. The quality of the RSSI values given by these devices can be variable, however [171]. After an initial evaluation of a number of different Wi-Fi adapters with different chipsets, one based on the ZyDAS 111b chipset [17] was found to give the best RSSI output for the purpose of measuring path loss in this scenario. The other chipsets tested included the Realtek 8187L and the Ralink RT86, and in terms of the histogram and number of outliers in the RSSI from the ZyDAS 111b chipset performed the best. An investigation of the performance of the RSSI output of the ZyDAS 111b is described in the following sections Logging RSS from Wi-Fi Devices The most common method for making RSSI measurements is through measuring the signal strength of packets sent by access points in response to probe requests. This is called active scanning [173] as the Wi-Fi client device is actively requesting probe responses from surrounding access points on different channels. This is shown in Figure 6.7. However, this method can suffer from coverage and latency problems, as the probe request sent by the client must be strong enough to be decoded by the access point, and the access point must reply in time. Another method for making RSSI measurements is by placing the Wi-Fi device in a passive [173] or promiscuous monitoring mode. In normal operation, a Wi-Fi device is programmed to make available packets that are addressed to its particular Media Access Control (MAC) address. In passive mode however, the device can decode all incoming packets. As an access point 1

149 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas transmits beacon packets periodically (up to Hz) for infrastructure purposes, the RSSI measurements can be taken from these instead. This method is shown in Figure 6.8. Probe Requests Broadcast Beacons Probe Responses Figure 6.7. The client-server interchange of packets when measuring RSSI in 'active' scanning mode. Figure 6.8. The monitoring of the broadcast beacons from access-points in 'passive' scanning mode. To compare the coverage performance of the active and passive scanning modes, a USB Wi-Fi dongle with a ZyDAS 111b chipset with a detachable antenna was placed in both active and passive modes one after another and 5 minutes of data recorded. An image of this device is shown in Figure 6.9. For active scanning, the manufacturer's drivers for Windows XP were used along with the application Network Stumbler [174] to record the RSSI values. For passive scanning mode, a modified version of the zd111rw [175] drivers was used under Ubuntu 9.4 along with the aircrack-ng package [176], and tcpdump was used to capture the radiotap headers of the incoming Wi-Fi packets. Over 5 minutes, the active scanning technique was able to make RSSI measurements on 1,471 probe responses from 11 unique Service Set Identifiers (SSIDs). Over 5 minutes, the passive scanning technique on the other hand was able to make RSSI measurements on 4,958 packets from 11 unique SSIDs Dynamic Test As part of the Windows Management Instrumentation (WMI) interface [177] it is possible to poll the Wi-Fi chipset driver at a periodic rate to get the RSSI of the access point that the device is currently connected to. Using this technique it is theoretically possible to get more RSSI measurements from an access point than when using the probe request/response technique, which generally provides an RSSI measurement every seconds. To evaluate the dynamic response of the Windows and Ubuntu based measurements the RSSI was measured as the antenna shown in Figure 6.9 was rotated 9 degrees and back again. 13

150 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Rotation Figure 6.9. A photograph of the USB Wi-Fi adapter used in the experiments. The change in RSSI as the antenna was rotated is shown in Figure 6.1 and Figure In both figures the measurement rate is ms. As can be observed, the response in the RSSI is markedly different between the Windows and Linux based set-ups. Another difference is that the WMI interface provides the RSSI value in dbm. The Windows based RSSI value measurement values appears to be filtered whereas the Linux based ones appear to be change rapidly. As shown in Figure 6.11, the RSSI values measured in passive mode under Ubuntu change almost instantly. The RSSI values taken using the Windows driver are slow to react with some sudden jumps and appear filtered. It takes almost 1 seconds for the RSSI values to settle. From these results the use of passive mode is recommended for this chipset, and will be used in the field experiments which are described in the proceeding sections horizontal RSSI ver horizontal vertical RSSI vertical vertical Time (s) Time (s) Figure 6.1. The RSSI (in dbm) values from the Windows Network Driver Interface Specification (NDIS) interface while rotating the USB adapter s antenna. Figure The RSSI (unitless) values from the modified zd111rw Linux drivers while rotating the USB adapter s antenna. 14

151 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Characterising RSSI Values To characterise how RSSI changes with RF power the USB Wi-Fi adapter was connected directly to an access point through a variable attenuator as shown in Figure 6.1. The access point was set to transmit beacon packets every ms, allowing 5 RSSI measurements to be taken per second. The modified zd111rw drivers provide the RSSI as an unsigned integer with values ranging from to 18. The attenuation was varied from 3 to 89dB and the RSSI measured at each step. Wi-Fi Access Point Variable attenuator USB Wi-Fi dongle Figure 6.1. The setup for characterising the RSSI from the USB Wi-Fi dongle. The values of the measured RSSI are shown over time at two different attenuation levels in Figure The RSSI appears to follow a Gaussian distribution but there are also outliers and unexpected behaviour which has been observed from the RSSI values from various different Wi- Fi chipsets [171]. This behaviour occurred with the Windows based setup as well. As the Wi-Fi device is connected directly to the access-point these variations must be caused by the device itself and not from a shadowing effect or from the access point, as the outliers only occur when the attenuation is high. Analysing how the histogram of the RSSI changes with attenuation, it is apparent that the highest RSSI values correspond to the true value, and the others are anomalous. The anomalous values do not occur as regularly as the true values. In order to find the true RSSI value, a spline fit is applied to the histogram of the RSSI values over an observation period and the location of the global maximum is used as the true RSSI value. In Figure 6.14 the shape of the spline fit is shown for the values corresponding to the attenuation of 16dB shown in Figure

152 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas RSSI dB 39dB 59dB Time (ms) Figure The RSSI (unitless) values at different attenuations RSSI Figure The spline fit of the histogram of RSSI at different attenuations In Figure 6.15 the response of the RSSI as the attenuation is increased is shown before and after using the spline fit of the histogram for 1 seconds of RSSI values. The RSSI falls linearly as the Counts attenuation is increased and can be fit with a linear model: 16dB 59dB 39dB RSSI( x) = ( x) (6.1) where x is the amount of attenuation in dbs. As can be observed in Figure 6.15, the fall in db is slightly steeper than what would be expected at 1.7dB per db of attenuation, and the fit has an RMSE of 1.dB. For the averaged RSSI values taking the mean, at higher power levels the RSSI begins to jump around significantly. With the spline fit, the RSSI can be used for taking reliable measurements of the signal strength even at the higher power levels. Without this fix, the RSSI will not be accurate for strong signal strengths, which would be when the access point is located within a close distance. 1 8 Mean Spline Linear Fit (Spline) RSSI Attenuation (db) Figure The fall in RSSI before and after the spline calibration technique. 16

153 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 6.5 Field Experiment To explore the path loss behaviour and localisation performance for RSS in an open outdoor environment a sensor network of 5 sensor nodes was set-up using laptops with Wi-Fi adapters and an access point (operating at.41mhz) used as a rover. The experiment took place on the Village Green at UNSW, which is a circular field, over an area of 15m. The devices were the same as analysed in section 6.4 and attached to 1/4 wavelength dipole antennas of the same make in an attempt to normalise the antenna radiation patterns. In practice for unknown sources there will be no control over the radiation pattern of the transmitter which will be a further challenge for RSS positioning because there is no guarantee that the transmitter will radiate equally in all directions. In this work it is assumed that the transmitter radiates equally in all directions. RTK GPS was used to measure the positions of the sensors and the rover at different positions around the oval. At survey marks located around the field, the RTK GPS provided positioning accuracy in the range of 1-3cm. The rover was moved to different locations and the RSS values were collected at a number of test points with the transmitters and receivers at a height of 1.5m. A photograph of a sensor node is shown in Figure 6.16 and of the rover in Figure Figure The USB Wi-Fi adapter and antenna used as a sensor node. Figure The rover with RTK GPS and a Wi-Fi access point. In Figure 6.18 an overheard image of where the experiment was conducted is shown. The green markers are the locations of the sensor nodes and the southernmost sensor node was placed closer to the centre to allow test points outside the geometry of the sensor network to be taken. RSS measurements were taken with transmitter and receiver heights of 1.5 and 1.55m. In Figure 6.19 the value of the RSS measured at three of the sensor nodes is shown at one of the rover test locations. Although noisier than the measurements taken when the devices were connected to the 17

154 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas access point through an attenuator, the values did not drift over short periods of time. The passive monitoring and spline fit technique described in section 6.4 were used to find the mean RSS values at each location. The only modification was that the wireless driver was updated to give RSS values in dbm instead of an RSSI. #4 #3 # #1 RSS (dbm) S1 S S3 # Time (s) x 1 9 Figure Sensor network setup. {Green arrows = sensor nodes}. Imagery (C) 1 DigitalGlobe, GeoEye, Sinclair Knight Merz, Cnes/Spot Image; Map data (C) 1 Google, Whereis(R). Sensis Pty Ltd Figure 6.19 The RSSI values measured at different sensor nodes #1, #, and #3, over time with the transmitter located at one of the test points During the experiment care was taken to ensure that the transmitter was always in line-of-sight of all the sensor nodes in the network. In a large real world environment in practice the transmitter and sensor nodes may not have line of sight to each other due to obstructions such as buildings. The scenario that drives this research is the localisation of an interference source that is interfering with the Ground-Based Augmentation System (GBAS) at an airport. In a large open area like an airport runway there are expected to be fewer obstructions between the interference source and the sensor nodes than in a built-up urban environment, where localisation of a cellular handset is performed for example. In a GBAS setup the GPS stations are usually placed together, each having line of site with each other at an open location at an airport [178] Path loss behaviour The RSS values taken at different points at a height of 1.5m were used to create a log-normal model of the path loss. The rover locations used are shown in Figure 6.. The resulting equation to describe the path loss was: 18

155 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas P d = log1 ( d ) +σ (6.13) where σ is equal to.964db. The RSS at each test point, along with the log-normal fit, and the path loss given by the two-ray model (with heights equal to 1.5m and ε r =9) are shown in Figure 6.1. In general the RSS values fall linearly with distance. The path loss falls at a faster rate than expected under the two-ray model and the cause of this is not known, but may be due to the ground surface not being perfectly flat or the steeper than theoretical slope found in the RSSI output in (6.1). y (meters) 5 RSS (dbm) Points RM LN x (meters) Distance (m) Figure 6.. The test locations where path loss was measured for the 1.5m data set. {circles: sensor nodes, squares: test locations}. Figure 6.1. The path loss behaviour for the 1.5m data set. After the measurements were taken at 1.5m, the heights of the antennas were raised to 1.55m. The rover was moved to the different locations shown in Figure 6. and the RSS values recorded. The resulting equation that describes the path loss was: P d = log1 ( d ) +σ (6.14) where σ is equal to 3.63dB. The RSS at each test point, along with the log-normal fit, and the path loss given by the two-ray model (with heights equal to 1.55m and ε r =9) are shown in Figure 6.3. Due to the increased height of the transmitter and receivers, a number of RSS measurements were taken within the first Fresnel zone. A large dip is visible at a distance of 35m in the test point data and this matches the dip given by the two-ray reflection model. Although the error of the fit for 1.55m is of similar magnitude to the fit for the 1.5m data, the distribution of the residuals is not as normally distributed. Similar to the data at 1.5m, the data at 1.55m also begins to fall at a faster rate than the two-ray model implies. Nonetheless, the Wi-Fi devices used are 19

156 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas able to give a good indication of the path loss and show variations as expected from the two-ray model when taking RSS measurements in open outdoor areas. y (meters) 5 RSS (dbm) Points RM LN x (meters) Distance (m) Figure 6.. The test locations where path loss was measured for the 1.55m data set. {circles: sensor nodes, squares: test locations}. Figure 6.3. The path loss behaviour for the 1.55m data set Positioning Results The technique outlined in section 6.3 was used to estimate the position of the transmitter at test point using the recorded RSS values, using the grid-search to initialise the LM technique solving using the log-normal path loss model. The initial guess was found using a grid search of, points in [x,y,n] with values uniformly distributed between x=[-,], y=[-,], and n=[- 5,5]. The number of points chosen is not coarse and a large number of points were chosen to ensure that the global minimum could be found. The positioning results using the log-normal model are shown in Table 6.1 and the Empirical Cumulative Distribution Functions (ECDF) of the position errors shown in Figure 6.4. The Cramer-Rao Lower Bound (CRLB) was calculated using the value of n and σ that fits each individual test point using its true location with the workings from Chapter 5, with P and n added as unknowns along with position. Table 6.1. The positioning results from the experiments at 1.5m and 1.55m heights. Effective Height 1.5m 1.55m Position CRLB Position CRLB Error* Error* 67th percentile th percentile Mean * Solving for P and n. 13

157 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas As can be observed from Table 6.1, the positioning error significantly increases when the height of the transmitter and receivers are increased to the height of 1.55m, with an error of 9.7m at the 67th percentile for the 1.5m data compared with an error of 53.87m at the 67th percentile for the 1.55m data. This is caused by the dips in the path from the ground reflections. At the height of 1.5m the first Fresnel zone distance is small and the path loss values fall monotonically for most of the recorded data points. At this height, the positioning performance is good. At the height of 1.55m the distance of the first Fresnel zone is larger and there are visible dips in the path loss due to the ground reflections. For the 1.55m data the mean error of all of the points was equal to 5.7m demonstrating that a number of points also had divergent behaviour with large position errors. Looking at the ECDFs in Figure 6.4 there are certain percentiles where the positioning error increases rapidly. For the 1.5m data this occurs at the 84th percentile. For the 1.55m data this occurs much earlier at the 54th percentile and begins to increase again at the 77th percentile. It could be expected that for test points located further away from the sensor network the positioning error would increase rapidly as suggested by the CRLB. For the 1.55m data the increase at the 84th percentile is caused by a small number of points that have divergent behaviour. 1 Cumulative Probability h=1.5m h=1.55m 5 1 Position Error (m) Figure 6.4. The ECDF comparison of positioning results at heights of 1.5m and 1.55m. In Figure 6.5 and Figure 6.6 the behaviour of the position estimates relative to the true position is shown. At nearby test points the position solutions appear to point in the same direction, and 131

158 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas could evidence of correlated shadowing. For the 1.5m data there is only one noticeably divergent point when the transmitter is located inside or close to the sensor network. For the locations outside the sensor network the position error tends to increase, as expected, given the behaviour of the CRLB. For the 1.55m data, the number of divergent points is greater and divergence occurs at locations within the sensor network. At locations within the sensor network where the positioning error is large, typically at least one sensor node is within the first Fresnel zone. Under the same conditions and using the same equipment increasing the height of the transmitter and receivers dramatically increased the error of the position estimates. The lognormal shadowing model was not as effective at the 1.55m height due to the ground reflections. 5 5 y (m) y (m) x (m) -5 5 x (m) Figure 6.5. The vectors of the position errors for the 1.5m height data. {arrow: position estimate vectors, circles: sensor nodes, square: true locations}. Figure 6.6. The vectors of the position errors for the 1.55m height data. {arrow: position estimate vectors, circles: sensor nodes, square: true locations} Comparison of position error with CRLB The CRLB provides a lower bound on the variance of any unbiased estimator [17]. In Chapter 5 it was used to compare the performance of different localisation methods with typical noise variances. In summary, it can be calculated from the inverse of the Fisher Information Matrix (FIM) I(θ): σ 1 I( θ) = Hθ ( ) C Hθ ( ) (6.15) [ I(θ ] 1 (θ) (θ) = ) θˆ θˆ CRLB (6.16) where H(θ) corresponds to the Jacobian matrix of the set of positioning equations f(θ). For RSS equations the maximum likelihood estimator has been shown to be biased [179]. As a result the 13

159 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas CRLB may not always give a useful indication of the positioning performance that could be expected. For the sensor network used in field experiment the error ellipses based on the CRLB are shown for different points when different unknowns are solved for in Figure y (m) n and P known n and P unknown P unknown x (m) Figure 6.7. The error ellipses for different sets of parameters being estimated. {circles: sensor nodes, dots: test locations}. The CRLB increases rapidly as the transmitter moves further away from the sensor network when P and n are unknown. In the experimental results the error did tend to increase at locations further away from the sensor network, but most of the time not at the rate suggested by the CRLB. In Figure 6.8 and Figure 6.9 the ECDF of the position errors are shown along with the CRLB for the 1.5m and 1.55m data. At the 67th percentile for both data sets the CRLB overestimates the position error. The CRLB overestimation is greater for the 1.5m than for the 1.55m data. At higher percentiles the empirical position error begins to overtake the CRLB and for the 1.55m significantly so. The rapid increase in the CRLB for locations outside the sensor network may be hinting at the greater chance of divergent points which were observed in the experimental data. 133

160 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 1 1 Cumulative Probability Results CRLB Cumulative Probability Results CRLB Position Error (m) Position Error (m) Figure 6.8. A comparison of the position error and CRLB for the 1.5m data. Figure 6.9. A comparison of the position error and CRLB for the 1.55m data Divergent points The apparent 'divergent' behaviour where the position error is large at some test points, especially for the 1.55m data, is a concern if there are to be requirements on the robustness of the localisation system. In Figure 6.3 the position error for test point in the 1.55m data set is shown and the associated path loss behaviour is shown in Figure At this location the true fit of the log-normal model has a transmit power of -7.4dBm and a path loss exponent of The position estimation technique finds a transmit power of 63.37dBm and a path loss exponent of 4.67, and the path loss model given by this solution is shown by the "Minima" line in Figure Although this solution appears divergent, it is in fact the global minimum of the leastsquares cost-function (6.9). y (meters) 1-1 RSS (dbm) RM Minima True Fit x (meters) Figure 6.3. The position error for test point in the 1.55m data set. {arrow: position estimate vector, circles: sensor nodes, square: true location}. 1 Distance (m) Figure The path loss models for test point in the 1.55m data set. 134

161 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Another example of divergent behaviour occurred at test point 31 in the 1.55m data set as shown by the position error in Figure 6.3 and the path loss models in Figure The true fit has a transmit power of -9.3dBm and a path loss exponent of 1.4. The position estimation algorithm finds a solution with transmit power of and a path loss exponent of These are unrealistic values as the power increases with distance, but again it is the minimum of the leastsquares cost function found by the position estimation algorithm. In these cases the requirement to solve for P and n increases the chance of a solution outside the network with unrealistic P and n values. y (meters) x (meters) RSS (dbm) Distance (m) RM Minima True Fit Figure 6.3. The position error for test point 31 in the 1.55m data set. {arrow: position estimate vector, circles: sensor nodes, square: true location}. Figure The path loss models for test point in the 1.55m data set Optimal path loss value Solving for P and n introduces divergent-like behaviour at certain data points as shown in the previous section with some points also having unrealistic path loss exponent values. If some information about the heights and path loss environment was available an alternative approach may be to use a fixed value of n to reduce this problem. To examine how the choice of the path loss exponent impacts the positioning performance the positions equations were solved using fixed values of n and the results shown in Table 6. for the 1.5m height data and in Table 6.3 for the 1.55m height data. For the 1.5m data set using a fixed path loss value of 3.75 had the best performance while a value of 1.75 had the best performance for the 1.55m data set. The position error was noticeably reduced at the 95th percentile at both heights compared with solving for n as using a fixed value for the path loss exponent reduces the divergent behaviour. 135

162 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Table 6.. Positioning results with different strategies for the path loss exponent (1.5m data set). solve n n= n=3 n=3.75 CRLB* 67th percentile 95th percentile Mean *solving for P and n Table 6.3. Positioning results with different strategies for the path loss exponent (1.55m data set). solve n n = n=1.75 n=1.5 CRLB 67th percentile 9th percentile Mean In Figure 6.34 and Figure 6.35 the position error at the 67th percentile is shown for the 1.5m and 1.55m data respectively for different path loss exponent values. It is interesting to note that the value that minimises the error is different to the value given by the path loss models found in (6.13) and (6.14). For the 1.55m data using a fixed value of n of almost any value between.5 and.75 outperforms solving for n. For values of n above.75 the positioning performance begins to degrade. For the 1.5m data the ideal value of n lies between 3 and 4. Although using fixed values of n does reduce the positioning error, the choice of n would not be clear to best cover both the 1.5m and 1.55m data sets. A value of n=1.5 that suits the 1.55m data would significantly increase the positioning error for the 1.5m where a better value is As a result it is recommended that the path loss exponent be solved when the transmitter height is unknown. It is also noted that in general from examining the distribution of the position errors, underestimating the path loss exponent causes the position solution to become biased towards the sensor node nearest to the transmitter, and overestimating the value causes the position solution to move outside the sensor network and become increasingly divergent. 136

163 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 8 Position Error (67%) 6 4 Position Error (67%) n n Figure The 67th percentile position error for different fixed path loss exponent values for the 1.5m data set. Figure The 67th percentile position error for different fixed path loss exponent values for the 1.55m data set Different Sensor Sets In the field experiment five sensor nodes were deployed. Only four sensor nodes are required to solve for all the unknowns in the position equations. Although the CRLB shows that the position performance will improve with more sensors, due to the dips in the path loss it may be beneficial to exclude a sensor node if it is within the first Fresnel zone of the transmitter, or for some reason if that sensor node had noisier RSS measurements than the others. The positioning results with different sensor nodes excluded are shown in Table 6.4. At the 67th percentile the use of all five sensor nodes has improved the position performance for the 1.5m data set. For the 1.55m dataset the removal of sensor node slightly improves the position error at the 67th percentile and has lower mean error. Table 6.4. The positioning performance when excluding a sensor node. Excluded sensor node 1.5m 1.55m (Figure 6.18): 67th 95th Mean 67th 95th Mean * All 5 used An example of where removing a measurement from a sensor node reduces the position error is shown in Figure 6.36 and Figure 6.37 for test point 14 in the 1.55m data set. With all 5 the 137

164 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas position error is 48.34m and the transmit power is estimated as 44.86dBm with a path loss exponent of With sensor node 4 removed, the position error is 14.8m and the transmit power is estimated as -3.73dBm with a path loss exponent of.5. Further investigation of choosing different sets of sensors to improve positioning presents useful future work if a metric can be devised to decide whether a certain measurement is located within the Fresnel zone or not. y (meters) 5-5 #4 #3 # #5 #1 y (meters) 5-5 #3 # #5 # x (meters) Figure The DRSS lines of position with all sensor node measurements for test point 14 in the 1.55m data set. {star: position estimate, circles: sensor nodes, square: true location} x (meters) Figure The DRSS lines of position with sensor node 4 excluded from the measurements for test point 14 in the 1.55m data set. {star: position estimate, circles: sensor nodes, square: true location}. 6.6 Performance at GPS L1-band Path loss comparison between GPS L1 and Wi-Fi In the GEMS system [15], the unknown signals will be at the GPS L1 frequency of GHz, not at the.4ghz frequency of the Wi-Fi used in the field experiment. The different frequencies will have an impact on the path loss behaviour and the distance of the first Fresnel zone. The distance of the first Fresnel zone at different heights and wavelengths is shown in Table 6.5. Table 6.5. First Fresnel zone distance comparison between Wi-Fi and GPS. Heights Distance h t h r Wi-Fi (.41GHz) GPS L1 (1.575GHZ) 1.55m 1.55m 76.97m 5.1m 3.m 1.55m m 96.34m 1m 1.55m m 91.61m In Figure 6.38 the path loss is shown for Wi-Fi and GPS L1 for transmitter and receivers at a height of 1.55m. At this height the first Fresnel zone distance is meters longer for Wi-Fi 138

165 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas than for GPS L1. As a result, positioning with RSS will perform better at GPS L1 when compared with Wi-Fi. RSS (dbm) WiFI GPS L Distance (m) Figure The path loss using the two-ray model. {circles first Fresnel zone distances} Simulations at GPS L1 Band In this section the positioning performance will be explored in the GPS L1 band through Monte- Carlo simulations. The two-ray model is used to generate the RSS values at different locations for a specified sensor network and noise is added to the measurements. The set of position equations is then solved using the position estimation algorithm used previously and the value of the shadowing noise added (modelled as white Gaussian noise with zero mean) is equal to db Small Area Sensor Network In a GBAS installation at one particular airport [178] the antennas for the reference stations have a height of 1.55m and have typical separations of 1m. One possible topology for an interference localisation network is to have 6 sensors in a star configuration with one sensor located in the center that closely surrounds the GBAS reference antennas. The radius of the network is set to 5m and is shown in Figure In Table 6.6 the positioning performance after 1, simulation runs is shown for different transmitter locations and heights, with the receiver heights fixed at 1.55m. Even for this closely spaced sensor network the positioning error is large. With 67th percentile values in the range of 44.3 to 17.36m, RSS is not suitable in this scenario if robust localisation performance is required. The aim of the GEMS system for localisation is position error in the range of 5-1m. 139

166 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Table 6.6. Simulated Positioning Results for a small area network. Height Position CRLB Simulations 67th 95th Mean 67th 95th Mean 1m (5,5) m (5,5) m (5,5) m (75,75) m (75,75) m (75,75) In Figure 6.39 and Figure 6.4 the distribution of the position estimates are shown for the initial 5 simulation runs with the transmitter height of 1.55m At the transmitter location of (5,5) with a height of 1.55m, the position estimates are located around the true location with only a few divergent solutions producing outliers. In Figure 6.4 the distribution of the position estimates is shown for 5 simulation runs for a point located outside the sensor network at (75,75). The transmitter again has a height of 1.55m. At this location, the distribution of the position estimates is more spread out and there are more divergent points. It is also becoming difficult to determine whether the transmitter is located inside or outside although the distribution of the solutions is providing information on the potential bearing of the transmitter. The spread of the position estimates at (75,75) is also large as suggested by the CRLB for points outside the sensor network as shown previously in Figure y (m) y (m) x (m) Figure The distribution of the position estimates for a number of simulation runs with transmitter at (5,5). {star: position estimate, circles: sensor nodes, square: actual position} x (m) Figure 6.4. The distribution of the position estimates for a number of simulation runs with transmitter at (75,75). {star: position estimate, circles: sensor nodes, square: actual position}. 14

167 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Looking at Table 6.6, at the (5,5) location the position error is actually smallest at the 3m height compared with the 1.55m height, and at the (75,75) location the 1m height has the smallest position error. At this location the slope of the path loss is larger for the 3m height that at 1.55m. The greater the slope the better the positioning results are expected to be as there is greater fall with distance. In Figure 6.41 the path loss models are shown for the position at (5,5), at 3.m the path loss exponent is.93, at 1m the path loss exponent is At (75,75) the best positioning is at a transmitter height of 1m, with the path loss in relation to the sensor positions shown in Figure 6.4. Power (dbm) m 3m 1m Power (dbm) m 3m 1m Distance (m) Distance (m) Figure The path loss behaviour at the different simulation heights for the transmitter at (5,5). Figure 6.4. The path loss behaviour at the different simulation heights for the transmitter at (75,75) Wide-Area Sensor Network The small area topology described in the previous section has trouble localising transmitters located outside the sensor network. The area of an airport is large and the interference source is likely to be located away from the GBAS reference antennas, such as from a nearby highway. To provide greater coverage the sensor nodes can be placed further apart. To explore this scenario the radius is increased to 5m with one sensor located in the center. The results of the simulation runs are shown in Table 6.7 for different transmitter heights and positions. At these distances the transmitter is far outside the first Fresnel zone of all the sensor nodes for both locations. As shown previously in Figure 6.4 the gradient of the path loss is greater for the 1m height transmitter so the positioning error is marginally better. 141

168 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas Table 6.7. Simulated Positioning Results for a wide area sensor network. Height Position CRLB Simulations 67th 95th Mean 67th 95th Mean 1m (5,5) m (5,5) m (5,5) m (75,75) m (75,75) m (75,75) In Figure 6.43 and Figure 6.44 the distribution of the position estimates are shown for a test point at (5,5) and (75,75). The distribution of the position estimates in the simulation runs look similar to the results found for the small area sensor network with a radius of 5m, after being scaled by a factor of 1, but there are more divergent points. Again the sensor network has large position errors but is still providing some information about the location and bearing of the transmitter relative to the sensor network y (m) y (m) x (m) Figure The distribution of the position estimates for a number of simulation runs with transmitter at (5,5). {star: position estimate, circles: sensor nodes, square: actual position} x (m) Figure The distribution of the position estimates for a number of simulation runs with transmitter at (75,75). {star: position estimate, circles: sensor nodes, square: actual position}. 14

169 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 6.7 Summary and Conclusions The choice of path loss model is an important part of RSS positioning and the two-ray reflection model shows that there will be large variations with distance due to ground reflections. The influence of the ground reflection on positioning performance when using the log-normal shadowing model to solve the positioning equations was explored through a field trial with Wi-Fi devices and Monte-Carlo simulations. With proper characterisation, Wi-Fi devices were found to be an effective tool for measuring path loss behaviour in an outdoor area. In terms of positioning performance, the use of RSS for localising RFI sources with unknown power and path loss exponent can have problems for the less dense networks explored here if the source is located too close or too far from the sensor nodes. If the transmitter is located too close to the sensor nodes the RSS measurements could be taken within the first Fresnel zone. Within this zone it is difficult to fit the log-normal path loss model when solving for position due to the dips in the path loss from the ground reflection. If the transmitter is located too far from the geometry of the sensor network the CRLB begins to increase rapidly resulting in poor position estimates. It is shown through real experiments that the heights of the transmitter and receiving nodes affect the position accuracy immensely. At a height of 1.5m the positioning performance was found to be good but at a height of 1.55 it is degraded significantly. Monte-Carlo simulations at GPS L1 also showed large positioning errors when using RSS over large areas. The results from this chapter demonstrates that it is difficult to have a robust localisation system using RSS for unknown sources, such as RFI, when the log-normal path loss model is used to solve the positioning equations. For robust localisation to be achieved other alternatives such as AOA or TDOA are required or a better way of solving the positioning equations that take ground reflections into account is needed. 143

170 Chapter 6 Passive Source Localisation Using RSS in Open Outdoor Areas 144

171 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements 7.1 Introduction The results of chapter 6 showed that, due to the presence of ground reflections, the localisation of a transmitter using the Received Signal Strength (RSS) technique can suffer from large position errors, even in a sensor network over a small area. This was due to ground reflections increasing the variability of the path-loss behaviour as the effective heights of the transmitter and receivers increased. Another technique that can be used for passively localising unknown sources is Time Difference of Arrival (TDOA) [19]. In TDOA, data sets between sensor nodes are crosscorrelated and the peak in the cross-correlation function is used to estimate the time-delay of the unknown signal, and can be used for detection as well [11]. A number of time-delays from different baselines of sensors can be used to form hyperbolas which intersect at the location of the unknown source. The performance of time-delay estimation is dependent on a number of factors, including the time synchronisation between nodes [16], the bandwidth and effective Signal to Noise Ratio (SNR) of the signal [17], and the properties of the underlying background noise at each sensor node [18]. 145

172 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements The work in this chapter investigates the behaviour of this underlying noise and the impact it has on cross-correlation in a GNSS context. If the noise at each sensor node is statistically independent, then weaker sources can be detected compared with detection techniques that using single signal paths, with the improvements in detection proportional to the observation time [181]. Furthermore, the time-delay estimate will not be distorted by the presence of any spatially correlated signals. In the context of a GNSS RFI localisation system, along with the RFI there will also be the signals from any visible GNSS satellites that are transmitting in the bandwidth of each sensor node. As a result the background noise at each sensor node will not be statistically independent and will be spatially correlated. The GNSS signals are wideband and will create narrow cross-correlation peaks which may be mistaken for a wideband RFI, increasing the number of false alarms and reducing the ability to detect weaker unwanted signals. The presence of the GNSS signals will also distort the shape of the cross-correlation peak from the RFI, increasing the error in the time-delay measurements in a similar way to the effect of multipath, resulting in a less accurate position estimates. The aim of this chapter is to explore the influence that these GNSS satellite cross-correlation peaks have on cross-correlation and how it impacts the detection and time-delay estimation of RFI. To explore the effect of these cross-correlation peaks, GNSS satellite signals generated in software, from live antennas, and from GPS simulators, will be used in different scenarios with synthetically added wideband RFI of different power levels. This chapter is structured as follows: in section 7., time-delay estimation using cross-correlation is introduced. In section 7.3, the behaviour of the GNSS signals cross-correlation peaks are explored. In section 7.4, the impact of the cross-correlations on detection over time is explored. In section 7.5, an adaptive detection technique is introduced to overcome some of the issues found in section 7.4. In section 7.6, the behaviour of the detection technique for different baseline lengths is explored. In section 7.7 the effect of the cross-correlations on the estimation of timedelay is explored. A summary and concluding remarks are given in section 7.8. The work in this chapter has been published in the following peer reviewed conference proceeding: 146

173 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements [11] RJR Thompson, E Cetin, and AG Dempster, "Influence of GPS Satellites Cross-Correlation on the TDOA Measurements within the GNSS Environmental Monitoring System (GEMS)," in IGNSS11 Symposium on GPS/GNSS, Sydney, Time-delay estimation In the TDOA localization technique the relative time-delays of a signal between a number of spatially separated sensor nodes are used to construct intersecting hyperbolas (for initial simplicity a D, constant height system is assumed). In the presence of no noise these hyperbolas will intersect at the location of the source and can be solved using closed form or iterative search algorithms [153]. The received signals of a source s 1 at two locations x 1 and x can be modelled as [11]: x t) = s ( t) + n ( ) (7.1) 1( 1 1 t x ( t) = α s1( t + D) + n ( t) (7.) where α describes the difference in amplitude of the signal at the two locations, n 1 and n is uncorrelated white noise, and D is the time-delay of the source signal between the locations x 1 and x. An estimate of the time-delay D between these two signals can be found using an estimate of the cross-correlation function: Rˆ x1x 1 = T τ τ T x ( t) x ( t τ ) dτ 1 (7.3) Alternatively the cross-correlation function can be calculated by taking advantage of the Discrete Fourier Transform of the sampled data and using the cross power spectral density: Rˆ x x 1 N = 1 j(πnk / N ) τ ) Rx ( ) 1x f e (7.4) k= ( The time-delay estimate Dˆ can then be found by taking the value of τ that maximizes the crosscorrelation function: D ˆ = arg max ( ) (7.5) R x τ 1x Along with time-delay estimation, the cross-correlation function can also be used for the detection of unknown signals such as the RFI source. If the properties of the background noise at 147

174 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements each location n 1 and n are known then the output of the correlation function (7.3) can be modelled. In the presence of an interferer the behaviour of the correlation function will change and monitoring this change can be used for detection. 7.3 GNSS signal cross-correlations In practice any sensor nodes used for detecting and calculating the time-delays of RFI in the L1 band will also pick up the legitimate GNSS signals that are being transmitted in the same band. An overview of some potential sources of signals is shown in Figure 7.1. There are many GNSS satellites from different constellations (GPS, GLONASS, Galileo, Beidou, etc) transmitting civilian and military codes with different frequencies, signal powers, bandwidths, codes, and code repetition rates [18]. The cross-correlation peak from a single satellite common to both sensors nodes with a power of -13dBm will only create a small peak in the cross-correlation function. However there will be many satellites visible at one time so the correlation peaks will add together. As the potential number of GNSS satellites increases [1] the issues explored in this chapter can be expected to get worse. Satellites Pseudolites RFI (node 1) (node ) Figure 7.1. Possible signals present at two sensor nodes in the L1 band. To explore the behaviour of the GNSS signal cross-correlation peaks, 1ms of GNSS data was generated in MATLAB (including the P-code, but left unencrypted) at two locations. The IF data was generated at a high sampling rate (4.9MHz) and then filtered to the desired pre-correlation bandwidth. The ephemeris used to generate the data included all of the GPS satellites that were transmitting (including the unhealthy satellite) as well as the Satellite Based Augmentation System (SBAS) satellites transmitting on L1 C/A only, and a Quazi-Zenith Satellite System (QZSS) satellite which broadcasts on L1 C/A. The L1C signal on the QZSS satellite was omitted along with any potential Galileo GIOVE satellites. The signal strengths of each satellite were 148

175 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements modelled using an elevation fit from C/No values extracted from RINEX data from a CORS station. At the locations and times chosen (near the Electrical Engineering building at UNSW, on 11/7/11 at 13:) there were 15 satellites visible, 1 GPS satellites, SBAS satellites and a QZSS satellite. In Figure 7. and Figure 7.3 the output of 1ms of cross-correlated (downconverted and filtered to baseband) data is shown for two sensor nodes separated by 1m. There are peaks every 1ms due to the code repetition rate of the satellites transmitting the C/A code. Due to the variation in the phase and Doppler of the satellites the distribution of the peaks is not uniform. The large peak near zero-delay will present problems with detection and time-delay estimation if RFI is present and doesn't have a peak large enough to go above the GPS crosscorrelation peaks. In Figure 7.4 and Figure 7.5 the cross-correlation peaks are shown for 1ms of data for two sensor nodes separated by 5km. The greater variation in the phase and Doppler frequencies of the satellites increases the non-uniformity of the peaks that repeat every 1ms compared with the 1m case. In Figure 7.5 the cross-correlation peaks have spread out and the individual peaks from satellites are visible. 1 x 15 1 x 15 Correlator Output Correlator Output Delay (samples) x 1 5 Figure 7.. 1ms of IF data cross-correlated together for sensor nodes separated by 1m Delay (samples) Figure 7.3. Close-up of the crosscorrelation peak at zero-delay for sensor nodes separated by 1m. 149

176 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements 6 x 15 6 x 15 Correlator Output 4 Correlator Output Delay (samples) x 1 5 Figure ms of IF data cross-correlated together for sensor nodes separated by 5km Delay (samples) Figure 7.5. Close-up of the crosscorrelation peak at zero-delay for sensor nodes separated by 5km. A civilian GPS receiver typically has a RF front-end with a MHz pre-correlation bandwidth [183]. An RF front-end used for localization purposes will typically have a wider bandwidth such as 8MHz for detection and localising wideband or out-of-band RFI and for better time-delay accuracy. For the protection of receivers that use semi-codeless techniques to use encrypted signals an even wider bandwidth greater then MHz will be required [4]. In Figure 7.6 and Figure 7.7 the behaviour of the cross-correlation peaks is shown with a MHz and 8MHz frontend filter. For the 8MHz filter a significant part of the energy of the P-code is passed resulting in higher and sharper peaks near the zero-delay. However as the code repetition rate of the P-code is practically infinite there is little change in the behaviour of one of the group of side peaks that repeat every 1ms. The peaks in Figure 7.7 are from the C/A code only and increasing the frontend filter bandwidth makes them sharper. Using interference cancellation techniques [184],[185]; it may be possible to remove the crosscorrelation peaks if the GNSS signals can be replicated. This will be computationally intensive and as shown in Figure 7.6 the encrypted P(Y)-code signals will appear in the correlator outputs. With this computational complexity and encrypted signals in mind, the remainder of this work will explore what can be done in terms of detection and time-delay estimation assuming that these GNSS signals are not removed. 15

177 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements Correlator Output 5 x MHz MHz Correlator Output 5 x MHz MHz -5 5 Delay (samples) Figure 7.6. View of peaks around zero-delay with different front-end filter bandwidths Delay (samples) x 1 4 Figure 7.7. View of a side peak with different front-end filter bandwidths. 7.4 Impact on detection The detection of unknown signals using cross-correlation is a commonly used technique in radio astronomy [186]. An RFI or unknown signal of sufficient power will cause a change in the crosscorrelation function from the background noise and this can be used for detection. To investigate the behaviour of the cross-correlation peaks with real hardware a NordNav R3 multi-frontend [187] was used to capture data from real antennas and from two Spirent GPS simulators running in sync. The use of the multi-frontend running off the same frequency reference and sampling clock removes the synchronization problems that occur when using independent frontends. With thermal noise present only the output of the correlation function will have a probability distribution that doesn't change much over time, with slow variations due to changes in temperature and surface brightness. Using the histogram of the correlator output from previous data with no interferer it would be possible to determine a detection threshold with a fixed probability of false alarm that covers all the sample delay bins. However when the GPS signals are present there will be a number of delay bins that are above this threshold due to the satellite signal cross-correlations. To explore the thermal noise only case, 1ms of IF data from two antenna inputs to the multifrontend receiver with no antennas connected was recorded from each and then correlated together at baseband. The behaviour of the correlator in the presence of no GPS signals can be seen in the red line in Figure ms of IF samples was then recorded from two synchronized GPS simulators running a scenario with 8 visible satellites. The magnitude of the circular 151

178 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements correlator output is shown by the blue line in Figure 7.8. In Figure 7.9 the histogram is shown of the output of the correlator. In the presence of the GPS signals there are a number of outliers visible which would cause false alarms if a detection threshold was used based on the case of thermal noise only. abs(correlator Output) 5 x GPS No GPS 5 GPS No GPS Sample delay x x 1 4 Figure 7.8. Circular cross-correlation output with and without GPS signals. Figure 7.9. Histogram of the correlator output with and without GPS signals. Another problem that the GPS cross-correlations introduce is that the magnitude of the peaks and sample delay bins they appear in will change over time as the satellites move and different satellites become visible. If the sensor stations used for detection are close together and the signals from the satellites arrive at similar time-delays the cross-correlations from the satellites will overlap. This is demonstrated in Figure 7.1 which shows the output of the cross-correlator around the zero-delay point for two receivers separated by a distance of 1m observed in 1ms intervals over a period of 1 seconds. In the data there are 8 satellites with various phases and Dopplers that are adding and cancelling each other out over time. In Figure 7.11 the magnitude of the correlator output is shown along the delay bin. Without any knowledge of the GPS signals an adaptive threshold technique would be required to keep the number of false alarms low and the detection performance good for this 1m baseline. 15

179 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements x Correlator Output Time in file (1ms) Figure 7.1. Output of the correlator near zero-delay for a baseline of 1m over 1 seconds. Figure Output of the correlator along zero-delay for a baseline of 1m. 7.5 Adaptive detection technique To overcome the problems shown in the previous section an adaptive detection threshold is needed. One approach is to use a mean-change detection technique that tries to characterize the behaviour of the cross-correlation peaks in each delay bin over time and look for any sudden unusual changes. An overview of the developed adaptive threshold technique is shown in Figure 7.1. Examination Cells Guard Cells Test Cell Correlation outputs at sample delay n E 1 E E... E N1 G 1 G G... G N Y σ = Find T and N for desired P fa ( X ) X i N 1 X 1 N = X i 1 σ X * Tσ ± T Decision: Y > X ±Tσ? Figure 7.1. Block diagram of the mean change detection algorithm. The algorithm is inspired by Constant False Alarm Rate (CFAR) detection [188] and works by calculating the mean and standard deviation from a window of previous correlator outputs (called examination cells) along a particular sample delay and determines if the correlator value in the current test cell exceeds a threshold. A number of guard cells (outputs before the test cell that are ignored) are chosen to provide some protection against RFI that ramps up over time. Due to the unknown variability of the correlator outputs for different baselines the values of T (σ threshold 153

180 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements multiplier) and N (number of guard cells) need to be tuned beforehand from previous data to provide a low probability of false alarm. For the following analysis of data for different baselines the values of T and N were found numerically by searching for values over clean sets of data until the false alarm rate is %. As the search over the parameters is D, the point in [T,N] is chosen which has false alarms with the biggest N value. 7.6 Behaviour for different baselines Very small (.38m) baseline For very small baselines the satellites will all have close relative phases and Doppler frequencies and the correlator output will behave smoothly over time. To explore this scenario real IF data was recorded from two antennas separated by.38m connected to the multi-frontend receiver. The IF data was then cross-correlated together in 1ms blocks at baseband over 1 seconds. In Figure 7.13 the cross-correlation peak from the real GPS signals can be seen, along with a wideband (MHz, J/N=-1.5dB) interferer which was added to the recorded samples offline after 5 seconds at a sample delay of. The slow variation in the correlator output can be seen before the RFI is added, allowing a relatively tight 5σ threshold to be used along with seconds of guard cells. 4 x 1 4 Correlator Output Time in file (1ms) Figure Figure 13. Output of the correlator for the.38m baseline with RFI added. There is a noticeable jump when the RFI is added 5 seconds into the data. Figure Response of the detection technique, with the outputs breaching the threshold causing a detection. {red line: threshold, blue points: test points}. 154

181 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements The RTCA defines minimum susceptibility requirements for GPS receivers operating in the presence of RFI [146]. The adaptive threshold technique described above was able to meet the required RFI mask for a CW interferer (-1.5dBm) and a wideband interferer (-17.dBm in a MHz bandwidth) when the RFI was added to the recorded data, with the assumption that the thermal noise power at each sensor node was equal to -111dBm. For the detection of RFI the use of two antennas close together such as in an antenna array in AOA [189] can provide a useful option Short (1m) baseline. For longer baselines it begins to become impractical to connect multiple antennas to a single front-end. To explore the behaviour of the cross-correlation peaks for longer baselines the multifrontend was connected to two Spirent GPS simulators running in sync to repeat the scenario shown in Figure 7.1. As shown in Figure 7.15 for the 1m baseline, the magnitude of the correlation peak at zero-delay varies much more rapidly in time than for the.38m baseline shown in Figure To prevent false alarms the threshold T was increased to 8.5σ and the number of guard cells N reduced to 65. The same wideband interference source used for the previous baseline was again added 5 seconds into the data files. As can be seen in Figure 7.15 and Figure 7.16 the change in the magnitude of the correlator output is not as large as for the case of the.38m baseline and the RFI is not detected. 3 x 1 4 Correlator Output Time in file (1ms) Figure Output of the correlator for the 1m baseline with RFI added. Figure Magnitude of the correlator along zero delay with no obvious crossing of the thresholds when RFI is added {red line: threshold, blue dots: test points}. 155

182 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements To understand why this occurs it is necessary to look at the real and imaginary parts of the correlator outputs as shown in Figure 7.17 and Figure In this case due to the phase of the added RFI at zero-delay, all of RFI power ends up in the real part. This is a consequence of doing the time-delay processing at baseband. The change in the real part of the correlator output is large and is easily detectable by the proposed detection technique when run on the real part of the correlator alone. For robust detection using the correlator output for data that has been converted to baseband the magnitude of the output along with the real and imaginary parts should be processed independently. 4 x 14 x 1 4 Correlator Output - Correlator Output Time in file (1ms) Figure The real part of the correlator showing crossing of the detection threshold. {red line: thresholds} Time in file (1ms) Figure The imaginary part of the correlator. {red line: threshold} Moderate (5m) baseline. The previous scenario is repeated for a baseline of 5m. In Figure 7.19 and Figure 7. the correlator output is shown. As can be seen in Figure 7.19, the surface of the correlation function before and after RFI is added is not smooth and the location of the peaks varies in magnitude and sample delay. At a baseline of 5m the individual satellites are beginning to resolve in the correlation space and the variations becoming more rapid. To maintain the desired false alarm rate of % the threshold T was increased to 11σ and the number of guard cells N reduced to 5. This sharp decrease in the number of guard cells is due to the increasingly sinusoidal behaviour of the cross-correlation peak. For this baseline, the detection of interference that ramps up over time becomes difficult as the cross-correlation peaks are beginning to move rapidly with time. 156

183 Chapter 7 Influence of GPS Satellite Cross-Correlations on TDOA Measurements x 1 4 real(correlator Output) Time in file (1ms) Figure Output of the correlator for the 5m baseline with RFI added. Figure 7.. The magnitude of the correlator output along zero delay {red line: threshold, blue points: test points} Long (5km) baseline. The scenario is again repeated for a baseline of 5km. For this scenario the correlation peaks from individual satellites resolve. In Figure 7.1 individual satellites can be seen at sample delays of - 46, -146, and At delays of 7 and 86 there are locations where two satellites which have close time-delays and beating of the correlation peak is visible. Figure 7.1. The correlator output for the 5km baseline. In the magnitude output of the correlator, satellites which do not overlap appear as constant peaks as can be seen in Figure 7.. The presented detection technique begins to struggle with the rapid 157