Jamming of Aviation GPS Receivers: Investigation of Field Trials performed with Civil and Military Aircraft

Jamming of Aviation GPS Receivers: Investigation of Field Trials performed with Civil and Military Aircraft BIOGRAPHIES Pascal Truffer, Maurizio Scaramuzza, Marc Troller, skyguide, Swiss Air Navigation Services Ltd. Marc Bertschi, Swiss Air Force Dr. Pascal Truffer received his Master in Electrical Engineering and Information Technology in 1994 at the Swiss Federal Institute of Technology (ETH) Zürich. He joined the Communication Technology Laboratory at the ETH Zurich, where he received his Ph.D. in technical sciences in the field of characterization of indoor radio wave propagation at 24 GHz in 2001. From 2004 to 2008 he worked as head of radio engineering at Zürich airport. In 2008 he joined the Communication, Navigation and Surveillance (CNS) expert group at skyguide, Swiss Air Navigation Services Ltd. Dr. Maurizio F. Scaramuzza received his diploma in Geomatics in 1995 at the Swiss Federal Institute of Technology (ETH) Zürich. He joined the Institute of Geodesy and Photogrammetry at the ETH Zurich in 1995, where he received his Ph.D. in technical sciences in the field of satellite based flight approaches and landings in 1998. In 1999, he joined skyguide, Swiss Air Navigation Services Ltd., built up and led the GNSS team. Since 2006 he is head of the expert group on Communication, Navigation and Surveillance. Dr. Marc Troller is a navigation expert at skyguide, Swiss Air Navigation Services Ltd. He is project manager of the first Swiss civil GNSS approach at Zurich airport and involved in several other GNSS approach implementation projects in the Swiss airspace. He has an M.S. in Geodesy from the Swiss Federal Institute of Technology in Zürich as well as a Ph.D. from the same university. He has been active in modeling GPS troposphere errors as well as in GPS tomography for weather prediction purposes. Dr. Troller is chairman of the ICAO EUR PBN task force, a member of the Swiss Geodetic Commission of the Swiss Academy of Sciences and a board member of the Swiss Institute of Navigation. Captain Marc Bertschi is a Swiss Air Force pilot, flying helicopter (AS332 Super Puma and EC635) and fixed wing aircraft (Super King Air and Beech 1900D). He has been involved in several GNSS approach implementation projects for the Swiss Air Force, especially RNAV approaches for helicopters in mountainous areas. As a technical pilot, he was involved in the upgrading of the Swiss Air Force Super King Air, including RF leg capability. ABSTRACT GPS becomes more and more important for approach and departure procedures. Aircraft rely on GPS on and close to the ground, where intentional or unintentional jamming signals may occur. Because of the low power, the received GPS signal is susceptible to RF interference, even for low power jammers. While theoretical calculations and laboratory experiments are essential for the understanding of jamming effects, they cannot reflect reality in all the details. From the known transmit power of a jammer the calculation of the field strength at the aircraft in distance d is straightforward. The directional gain of the GPS antenna with its low noise amplifier and the cable that is connected to the GPS receiver are specified. However, the total receiver gain, which includes the influence of the fuselage of the aircraft, is unknown. This is because the GPS antenna is normally mounted on top of the aircraft, whereas the interference is transmitted from the ground. Without the total receiver gain, the calculation of the interference power at the GPS receiver, and thus the interference-to-signal ratio (J/S) or the carrier-to-noise ratio (C/N 0) is not feasible. By laboratory experiments, the critical thresholds of J/S or C/N 0, where the tracking of the C/A code is lost, has been determined for different types of interference signals for the aviation receiver CMA-5024. Comparing those results to the ones of field trials reveal critical distances to the interference source and thus reliable values for the total receiver gain. This paper describes tests of civil and military aircraft performed in live jamming scenarios. The analysis of the recorded aviation GPS and flight management system (FMS) data reveal the effects of the jamming signals on different aviation receivers and aircraft types. An equivalent isotropically radiated power of 200 mw has been chosen for the jamming signal. This is comparable 30th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2017), Portland, Oregon, September 25-29, 2017 1258

to low power jamming devices. Four different types of interference signals were radiated from a biconical broad bandwidth antenna during predefined times, namely a pseudo random noise (PRN) sequence, a continuous wave (CW), a frequency hopping (FH) and a radar like signal with high pulse repetition frequency (PRF). The bandwidth of the interference signals was limited to 2 MHz around the center frequency of the GPS L1 band. Civil and military organizations participated with two fighters, four helicopters, two business aircraft and one flight calibration aircraft. Three helicopters and one of the business aviation aircraft are equipped with specific data recorder units that collect data from the aviation GPS receiver, the FMS and attitude data of the aircraft. In addition, independent multiband GNSS receivers record reference tracks in the GPS and GLONASS bands. Several flights have been conducted while the four interference signals were successively radiated. As results, most of the GPS L1 receivers were susceptible to three of the four transmitted jamming signals, namely the PRN sequence, the CW and the FH. The high PRF signal seemed not to impact the GPS reception. Data of the four aircraft equipped with additional data recorder units is analyzed in the position and range domain. GPS tracks are compared to the FMS position solution and the track retrieved from an independent multiband GNSS receiver. Performance parameters like the horizontal integrity level (HIL), number of used satellites and position differences are discussed. The evaluation of the critical tracking threshold C/N 0 with respect to the distance to the jammer yields reliable values for the total receiver gain for one specific receiver type. Analyses of further recorded data show that the detection of jammer events by monitoring C/N 0 is generally reliable. The field trials complement findings of theoretical calculations and laboratory experiments and support the understanding of realistic jamming scenarios. INTRODUCTION In aviation, GPS is the primary means of en-route navigation and becomes more and more important for approach and departure procedures. Aircraft increasingly rely on GPS close to the ground, where intentional or unintentional jamming signals are more likely compared to en-route. The received GPS signal is susceptible to Radio Frequency Interference (RFI) because of its low power, even for low power jammers. While theoretical calculations and laboratory experiments are essential for the understanding of jamming effects, they cannot reflect the real environment in all the details. In case of RFI in the GPS L1 band, GPS navigation may become unreliable or unavailable. In case of non-availability of GPS, the workload of pilots and air traffic controllers would be increased. This paper investigates the susceptibility of aviation GPS receivers to RFI by evaluating data of an arranged field test in the presence of predefined interference signals. It must be noted that the emission of signals in the GPS L1 band is generally prohibited by law. Thus, an agreement with the Swiss regulators, namely the Federal Office of Communications (OFCOM) and the Federal Office of Civil Aviation (FOCA) was required for the trials. To limit the potential of unwanted influence on other GPS users, like rescue organizations or public and private GPS dependent infrastructure, proper planning and official communication was essential for the safe execution of the jamming trials. MOTIVATION There are several parameters involved in the calculation of the impact of the RFI. Presuming that the Equivalent Isotropic Radiated Power (EIRP) P t of the interference is known, the power density P d in function of the distance d is given by (1): PP dd = PP tt 4 π dd 2 (1) The received power P r PP rr = PP dd AA ee GG rr (2) is a function of P d, gain G r of the receiver antenna and the aperture A e, where: AA ee = λλ2 4 ππ (3) The aperture is a function of the known wavelength λ. GPS antennas normally include a low noise amplifier with a gain of about 30 db. Since the receiver antenna is in many cases mounted on top of the aircraft, while the interference signal is transmitted from the ground, the fuselage of the aircraft adds some unknown negative gain to the total receiver gain G r. In addition to that, the automatic gain control (AGC) adds a value to G r, which is not contained in the measurement data. 1259

Equation (4) recaps the received power by the GPS receiver: PP rr = PP tt λλ 2 GG rr 16 ππ 2 dd 2 (4) The total receiver gain G r cannot be easily defined by experiments in the laboratory or by simulation. From (4) follows, if the estimation of G r was 20 db off, i.e. factor of 100, distance d would vary by a factor of 10. Without knowledge of the total receiver gain G r, the calculation of the interference power at the GPS receiver, and thus the interference-to-signal ratio (J/S) or the carrier-to-noise ratio (C/N 0) is not feasible. LABORATORY EXPERIMENTS By laboratory experiments the critical thresholds of J/S or C/N 0, where the tracking of the C/A code is lost, has been determined for different types of interference signals for the aviation receiver CMA-5024. The four test signals are the following: 1. Pseudo Random Noise sequence (PRN) 2. Continuous Wave (CW) 3. Pulse with high Pulse Repetition Frequency (PRF) with 20480 Hz 4. Frequency Hopping (FH) signal with f = 1 khz and dwell time = 3 ms The transmitted signals, as recorded by a spectrum analyzer 400 m apart from the jammer, are depicted in Figure 1. Jammer PRN Jammer CW Jammer Pulse with high PRN Jammer FH Figure 1: Transmitted signals at 1.57542 GHz from top left to bottom right: PRN, CW, Pulse with high PRF and FH. 1260

The power of the first test signal, the PRN, is spread along the spectrum. If the J/S is about 0 10 db above the received GPS power, the aviation GPS receiver CMA-5024 stops tracking. A spread spectrum signal, as used with GPS, is robust against a CW interference. However, experiments show that a strong CW would hinder GPS reception. It is presumed that this is due to the nonlinear nature to the automatic gain control. With a received CW power of about 60 db above the received GPS power, the receiver stops tracking. The third signal is a short pulse with high PRF of 20 khz. In theory, such a signal does not interfere with the GPS signal, since the spectral lines are spread 20 times wider than the ones of the GPS signal. Experiments in the laboratory support this view. Finally, a FH signal with delta frequency of 1 khz and dwell time of 3 ms has similar impact as a CW interference. The GPS receiver s issue with tracking because of RFI is indicated by the reduction of C/N 0. Because of applied filters, the impact on the estimated position error is not immediate, but delayed. If the receiver stops tracking, GNSS navigation is not possible anymore. In case GNSS navigation solution fails, the flight management system (FMS) retrieves its position from inertial reference or conventional navigation system if available. As a demonstrative example, we presume a CW jamming signal is transmitted with an EIRP of P t =100 mw (20 dbm). The distance 1 NM corresponds to a free space loss of 100 db at 1.575 GHz. At the aircraft, a presumed loss for fuselage of -10 db, an antenna gain of +30 db and loss for cables (partially compensated by the AGC) of -10 db are added. The signal received at the GPS receiver results in: 20 dbm 100 db 10 db + 30 db 10 db = 70 dbm. This corresponds to the required 60 db difference to the received GPS power for a CW jammer, which is -130 dbm. To this calculus, the radius of a CW jammer with 100 mw EIRP would interfere with GPS within 1 NM of distance. FIELD TRIALS During the field trials, the test signals described above were radiated at a biconical broad bandwidth antenna with known EIRP of 200 mw (23 dbm) during predefined times. The location of the transmitter in a valley prevents the GPS interference to impact a large area on the ground. The power was chosen high enough to cause GPS outages on different aircraft types and as low as possible to reduce the impact on other GPS users in a distance d of about 2 5 NM. The calculation of the distance d with potential impact on different receivers was based on estimations of the receiver gain G r = 10..17 db as described above. The bandwidth of the interference signals was limited to 2 MHz around the center frequency of the GPS L1 band. This limitation seems appropriate for the intended field test and reduces the impact on other GNSS. Civil and military organizations participated with two jet fighters, four helicopters, two business aircraft and one flight calibration aircraft. The aircraft passed close to the jammer with an overflight height of 160 m to 430 m above ground and at low speed. One of the business aircraft and three helicopters were equipped with specific recorder units that collect data from the aviation GPS receiver. In addition to that, the helicopter collected data from the FMS and the Attitude and Heading Reference System (AHRS) [1]. In addition, independent multiband GNSS receiver record the reference tracks in the GPS and GLONASS band. Table 1: Aircraft equipped with additional data recording units and their GPS receivers. Aircraft Beechcraft Super King Air B350 Eurocopter EC635 Eurocopter EC145 AgustaWestland AW109SP Aviation GPS receiver Rockwell Collins GPS4000S CMC Electronics CMA-5024 CMC Electronics CMA-5024 Genesys Aerosystems GPS-WAAS receiver The following parameters were recorded among others: in the range domain, the C/N 0 and in the position domain the numbers of satellites used (SAT used), the Horizontal Integrity Level (HIL) and position information. The multiband GNSS receiver recorded the carrier phase solution. The latter allows the calculation of the position difference to the on-board GPS as outlined in [2]. Since the jamming signals are limited to the GPS L1 band, GLONASS reception might not be affected. It must be noted that the position differences also include the offset between the locations of the ordinary GPS antenna and the reference antenna. 1261

RESULTS Most of the GPS L1 receivers were susceptible to three of the four transmitted jamming signals, namely the PRN sequence, the CW and the FH. According to pilots reporting, receiver outages occurred in about 1 2 NM distance to the jammer. The pulse with high PRF seemed not to have an impact on GPS reception. The position solutions of the aviation GPS receivers of four aircraft are evaluated and compared to the recorded reference tracks. For the four jamming signals the position solution of the Super King Air (SKA) and the JAVAD multiband receiver are depicted in Figure 2. The position of the jammer is indicated by a red dot. At first sight, the jamming signals seem not to have a significant impact on the position solution of the aircraft. A small deviation from the reference track recorded by the JAVAD receiver can be observed near the jammer. The impact of the jammer on the integrity of position solution becomes obvious by marking the positions where HIL is smaller than 40 m, i.e. where the position solution is presumed reliable for an LPV (Localizer Performance with Vertical guidance) approach. By comparing the influence of the four jamming signals, it seems that the jamming signals CW and FH interfere most with the GPS. The pulse with high PRN does not impact the position solution. Super King Air Figure 2: Influence of the four jamming signals on the trajectory of the Super King Air near the jammer (red dot). Similarly, the HIL, the position difference and the number of used satellites are plotted in Figure 3 with respect to time (Modified Julian Date, MJD). Again, the GPS4000S in the SKA is not affected by the pulse with high PRF. The three other jamming signals PRN, CW and FH raise the HIL and almost at once the number of used satellites drops to zero. Seconds after that event, the position difference raises to inacceptable levels. This effect has been investigated in detail in [3]. Where no values for HIL are available, a zero value is plotted. As soon as the aircraft overflew the jammer, the satellites in view are tracked again and the HIL and the GPS position differences revert to normal. It must be noted that for the jamming signal FH the HIL returns to 42 m after the jamming event. This is just above the 40 m threshold, i.e. the position solution is already close LPV precision, but will not be indicated as such. 1262

Super King Air Figure 3: HIL, position difference and number of satellites used near the jammer (red triangle) with the four jamming signals. The impact of the jammers is investigated further by analyzing the C/N 0 of the GPS satellite signals. In Figure 4 the C/N 0 of all satellites is plotted against the MJD for the jammer PRN and the aircraft SKA. The red line is the moving average of the individual C/N 0 of all used satellites. The yellow dots indicate the number of satellites used. The time when the aircraft is overflying the jammer is indicated by a red triangle. The number of used satellites immediately drops to zero when the aircraft approaches the jammer. In contrast, the C/N 0 decreases slowly before the GPS receiver stops tracking. Almost at once, the C/N 0 recovers when the SKA overflies the jammer, but remains reduced. A few seconds later the receiver stops tracking again. As indicated in Figure 2 (top left) the SKA is preforming a turn. During this maneuver the GPS antenna is exposed to the jammer. The SKA seems more susceptible to interference from the front than from below or behind. This is most probably due to the fuselage shielding the antenna, since it is mounted in front on top. The results of the jamming signals CW and FW correspond to the ones in Figure 4, but are not illustrated here. 1263

Figure 4: C/N 0 for all satellites and its moving average together with the number of satellites of SKA. Next, the HIL and position difference are compared to the C/N 0 and number of satellites in the time domain. Figure 5 shows the result for SKA with jamming signal PRN. While the HIL raises above 40 m and the number of used satellites drops to zero at once, the average of the C/N 0 starts to decrease many seconds earlier. By using a threshold of 10 db below the normal level of about 45 db, the interference event is clearly detectable more than one minute before the aircraft overflies the jammer. It must be noted that the SKA was flying slow (180 knots) for this test. Such a jamming detection has been suggested before in [4]. 10 db threshold > 60 s Figure 5: SKA position and range domain compared and detection of jammer PRN with 10 db threshold. Besides the SKA, data from the aviation GPS receivers has been collected on three helicopters. The results in the position and range domain correspond to the ones presented above. In the following, the distance d, where the jamming signals interfere with the GPS reception, is presented. Figure 6 indicates the influence of the jamming signal PRN on the four aircraft types. The distances where the GPS position solution is not reliable, i.e. where HIL is larger than 40 m are sketched. With respect to the 1264

PRN jamming signal, the SKA shows distances of 2.2 to2.7 NM. For the Eurocopter EC635 those distances are 0.6 to 0.7 NM. The HIL of the EC635 does not recover right over the position of the jammer but further ahead. This might be due to the GPS antenna being mounted on the tail of the helicopter. The results of the Eurocopter EC635 are described in detail in [5]. The measured distances for the EC145 are around 1.5 NM. For the AW109SP the distances d cannot be easily determined, because the PRN jamming signal stopped before the position solution became reliable again. With 5 NM an estimation is given for d. It must be noted that the helicopters were flying with a speed of 100 knots at 160 m above ground, while the SKA was flying with a speed of 180 knots at 430 m above ground. Jammer PRN 2.7 NM 2.2 NM 0.6 NM 0.7 NM 1.5 NM 1.2 NM 1.4 NM Figure 6: Distances d where HIL is > 40 m for jamming signal PRN and the four aircraft types. Finally, the distances d are evaluated for the jamming signals CW and FH. Table 2 summarizes the distances d where the four jamming signals interfere with GPS reception. These values are not exact but visually determined. Based on the estimated distances a correction for G r can be calculated. Before the test, d was estimated from 2 to 5 NM. For the SKA the measured d is in the same range, so no correction of G r is required. For the EC635 the estimated d varies between 0.6 and 1.6 NM, thus the real distance was about three times shorter than primarily expected. From (4) we conclude that the total receiver gain G r needs to be adjusted by a factor of +10 db to approach the real conditions. This holds true for the aviation receiver CMA-5024 and antenna mounting on EC635. The correction of the total receiver gain G r all aircraft is given in Table 2. Table 2: Results of the impact of the jamming signals and the total receiver gain G r. PRN [NM] CW [NM] Pulse [NM] FH [NM] Correction G r Super King Air (SKA B350) 2.2 2.7 3.1 3.2 no impact 1.8 5.3 0 db Eurocopter (EC635) 0.6 0.7 1 1.6 no impact 1 1.6 + 10 db Eurocopter (EC145) 1.4 1.5 1.23 2 no impact 1 1.6 + 3 to +10 db Agusta (AW109SP) 1.2 (5) 1.7 (5) no impact 1.8 (5) 0 db 1265

CONCLUSION It can be concluded that the low power of the test signal (200 mw) was enough to cause unreliable position information on the FMS for three of the four test signals, namely PRN, CW and FH. Near the jammer the GPS receivers stopped tracking and a deviation from the reference position was measured. Depending on the antenna mounting on the aircraft, those deviations were not symmetrical but more pronounced before or after the jammer. As assumed, the position differences were always smaller than the corresponding horizontal integrity levels, i.e. false position solutions were detected. We confirmed that an interference event can be detected earlier in the range domain by monitoring the average C/N 0. The test signal pulse with high PRF did not have an impact on GPS reception. The distance at which the jammer affected the GPS reception and hence the total receiver gain G r were evaluated for one of the business aviation aircraft and three of the helicopters. As presumed, the jammer had an impact on the GPS reception in a distance of less than 5 NM. Although the attitude, the speed and the height were different for the evaluated aircraft, the effect of the four jamming signals were overall comparable. The results for the total receiver gain in the field trials and the laboratory vary by a factor of less than 10 db. The results obtained by laboratory experiments are therefore considered reliable. The results presented in this paper will facilitate the prediction of the affected area by jammers with similar signals but different power. ACKNOWLEDGMENTS Skyguide and Swiss Air Force organized and funded the jamming trials. We are grateful to the participants of the field test, namely Swiss Air Force, Swiss Air-Rescue REGA, FCS Flight Calibration Services GmbH, Pilatus Aircraft Ltd., RUAG Aviation, Federal Office for Defence Procurement armasuisse and ETH Zurich (Swiss Federal Institute of Technology in Zurich). The data recording was supported by the CHIPS HRRF project. Finally, we thank Heinz Wipf, Sergio Rämi and the Swiss Helicopter Association for initiating the jamming trials and preparing the necessary agreement with The Federal Office of Communications (OFCOM) and The Federal Office of Civil Aviation (FOCA). REFERENCES [1] Troller, M., Scaramuzza, M., Leibundgut, H., Bertschi, M., Assessment and Modelling of Avionics EGNOS Protection Levels, ENC 2017. [2] Troller, M., Scaramuzza, M., Wipf, H., Nyffenegger, M., Leibundgut, H., "Flight Performance Investigations of Enhanced Rotorcraft Operations in Mountainous Areas Towards a More Ambitious RNP Performance", Proceedings of the 29th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS+ 2016), Portland, Oregon, September 2016, pp. 3660 3668. [3] Scaramuzza, M., Truffer, P., Troller, M., Wipf, H., Leibundgut, H., Bertschi, M., Rämi, S., "Empirical Assessment and Modelling of RFI Impact on Aviation GPS/SBAS Receiver Performance", Proceedings of the 29th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS+ 2016), Portland, Oregon, September 2016, pp. 3063 3069. [4] Scaramuzza, M., Wipf, H., Troller, M., Leibundgut, H., Rämi, S., Wittwer, R., "GNSS RFI Detection: Finding the Needle in the Haystack", Proceedings of the 28th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS+ 2015), Tampa, Florida, September 2015, pp. 1617 1624. [5] Truffer, P., Scaramuzza, M., Troller, M., "Field test of susceptibility of aviation GPS receivers to RF interference", ENC2017. 1266