Getting there more safely INNOVATION INSIGHTS with Richard Langley It’s all physics. How things work, that is. You’ve heard me say that before in this column, but I suppose I’m a little biased (or realistic) as my first degree is in physics — applied physics, to be more precise. Mind you, some chemists might disagree that it’s all down to physics. But as Sheldon Cooper in the popular American TV sitcom The Big Bang Theory stated in a radio interview with real science journalist Ira Flatow following his apparent discovery of the first stable super-heavy element, “Yes, yes, I’d be a physicist with a Nobel in chemistry. Everyone laugh at the circus freak. You know, I don’t need to sit here and take this, Flatow. It is because of bullies like you, every day more and more Americans are making the switch to television.” But in all seriousness, it really was physicists who first explained the physical phenomena associated with a range of technologies that had to be understood before global navigation satellite systems could become a reality. From orbital mechanics, to relativity theory, to semiconductors, to transatmospheric propagation of radio signals, to atomic clocks, the fundamental understanding of how these worked was provided by physicists. This was particularly true for atomic clocks. An atomic clock, like any clock, consists of two basic components: a resonator or oscillator and a counter. The oscillator generates a stable frequency, whose cycles are counted, converted to units of seconds, minutes, hours and perhaps days, and continuously displayed. This is the case whether we are describing a wristwatch with a quartz crystal oscillator or an atomic clock whose oscillator is made up of atoms undergoing quantum energy transitions. A crystal oscillator is stimulated to vibrate at its design frequency and thereby generate a fluctuating electrical current with that frequency. The atomic oscillator works thanks to the principles of quantum physics. Atoms have energies, but the energies are quantized, meaning that only specific energy levels are possible. An atom may exist at a particular energy level and spontaneously transition to a lower energy level and in so doing emit electromagnetic radiation (such as radio waves or light) of a specific frequency equal to the change in energy divided by a fundamental physical constant called Planck’s constant, named after Max Planck, who introduced it in 1900. The atom can be stimulated to return to the higher energy level by exposing it to radiation of that same exact frequency. A practical atomic oscillator can be constructed by confining a collection of atoms in an enclosure and bathing them in electromagnetic radiation from a tunable generator. By automatically tuning the frequency of the generator to maximize the number of stimulated atoms through a feedback loop, a very pure and constant frequency will result. The first clocks based on an energy transition of the cesium atom were developed in the mid-1950s. Later on, clocks based on energy transitions of the rubidium and hydrogen atoms were developed. By the 1960s, commercial rack-mountable cesium and rubidium clocks became available. But a need existed for miniaturized atomic clocks that could be easily embedded in equipment requiring a very stable frequency source. Funded in part by the Defense Advanced Research Projects Agency, the first chip-scale atomic clock was demonstrated by physicists in 2004, and by 2011, a chip-scale atomic clock based on a cesium atom transition became commercially available. In this month’s column, we look at how chip-scale atomic clocks can help us navigate more safely by allowing a GNSS receiver to position itself more accurately even with only three satellites in view, and to protect itself by being able to detect a sophisticated spoofing attempt. Physics — isn’t it wonderful! GNSS positioning and navigation are based on one-way range measurements. Synchronization of the receiver and satellite timescales is carried out with respect to a third time scale of higher stability, such as GNSS system time, by introducing so-called clock errors. To account for the time and frequency offsets of the satellites, the user can obtain appropriate corrections from the broadcast navigation message in real time. In post-processing, more accurate corrections are provided by various products of the International GNSS Service (IGS). Due to the generally poor accuracy and limited long-term frequency stability of a quartz oscillator built into a GNSS receiver, the receiver clock error has to be estimated epoch-by-epoch. This is the typical case for single-point positioning (SPP) based on code (pseudorange) observations only. This comes with certain drawbacks: The up-coordinate is determined two to three times less precisely than the horizontal coordinates, Higher dilution of precision values are obtained than in the hypothetical case of trilateration, High correlations of up to 99 percent between the receiver’s up-coordinate and clock error persist, and At least four satellites are necessary for positioning. Especially in the case of kinematic positioning, this situation can be significantly improved by using a more stable (atomic) clock for the receiver and introducing the information about its frequency stability into the estimation process. This approach is called receiver clock modeling (RCM), and basically requires that the integrated clock noise is smaller than the receiver noise during the modeling interval. Besides SPP, this method can also be applied in a common-clock setup in relative positioning using single-differenced observations (which, by their nature, contain more information) instead of typically used double-differenced observations, or precise point positioning. The recent development of chip-scale atomic clocks (CSACs) offers the required frequency stability and accuracy, and opens up the possibility of using atomic clocks in real kinematic GNSS applications without any severe restrictions regarding power supply or environmental influences on the clocks. When connecting one of these clocks to a GNSS receiver, replacing or steering the internal oscillator accordingly, and modeling its behavior in a physically meaningful way instead of epoch-wise estimation, the navigation performance can be improved distinctly. The receiver clock parameter absorbs signal delays common to all simultaneous line-of-sight signals whether these delays represent the physical clock or any other common delay. Thus, it is especially vulnerable to delays caused by jammers or spoofers. If the clock behavior is predictable, information about jamming or spoofing can be retrieved, and thus the integrity of the positioning solution can be improved. Chip-Scale Atomic Clocks For our test purposes, we used two different commercially available CSACs, dubbed CSAC A and CSAC B. To gain knowledge about their frequency stabilities, we compared them against an active hydrogen maser at the Physikalisch-Technische Bundesanstalt (PTB), Germany’s official metrology institute. We analyzed the raw fractional phase measurements and computed individual Allan variances for our devices. The resulting frequency stabilities are shown in FIGURE 1. Clock Model Basically, a clock is an oscillator generating a sinusoidal signal with a given nominal frequency coupled with a frequency counter. The deviation of the signal’s nominal frequency with respect to a reference time scale can be described by a frequency offset and drift plus random frequency fluctuations. In the time domain, the resulting clock error δt, that is, the difference between nominal time t and the time read simultaneously on the clock, can be approximated by the following equation: (1)   with systematic time offset b0, frequency offset b1, frequency drift b2, and random noise x(t,t0). Thus, the main (deterministic) part of a clock model can be described by a quadratic polynomial. The more interesting characteristics of a clock are contained in the underlying noise processes. The time-dependent Allan deviation (ADEV) enables the determination of a modeling or predicting interval τp over which receiver clock modeling is physically meaningful; that is, the integrated clock noise x(t,t0) is smaller than GNSS receiver noise: (2)   The noise σrx of a typical commercial GNSS receiver can be assessed to approximately one percent of the chip or wavelength of the signal in use, such as 3 meters, 0.3 meter, or 2 millimeters for C/A-code, P-code, or L1 carrier-phase observations, respectively. To apply the knowledge gained about the devices’ frequency stabilities, appropriate models for GNSS data analysis should be established. One prerequisite is that the clock noise has to be well below the GNSS receiver noise; that is, the integrated random frequency fluctuations of CSACs cannot be resolved by the GNSS observations in use. We assume typical values for code and ionosphere-free carrier-phase observations from modern geodetic GNSS receivers of 1 meter and 5 millimeters, respectively. Since these observations are phase-based measures, we can model the dominating underlying noise process as white-noise phase modulation (WPM) over time. The corresponding graphs are depicted in FIGURE 1 as dashed lines. The intersection points between these lines and the ADEV curves define maximal time intervals Δt for physically meaningful receiver clock modeling in our case study. Depending on the CSAC in use, RCM is applicable over time intervals of at least ten minutes and up to one hour in C/A-code-based applications, such as SPP. GNSS Applications We have tested and validated our receiver clock modeling approaches for GNSS navigation. Kinematic Experiment We carried out a real kinematic experiment on a cart track in farm fields with an approximately 500 × 800 square meter area with only a few natural obstructions in the form of a tree-lined lane (see FIGURE 2). The basic measurement configuration consisted of four GNSS receivers running the same firmware version connected to a GNSS antenna via an active signal splitter. Three of these receivers were fed by the 10-MHz signals of our CSACs. For comparison purposes, the fourth receiver was driven by its internal quartz oscillator. Each test drive with our motor vehicle lasted approximately 8 to 10 minutes. We recorded GPS and GLONASS data with a sampling interval of one second. (Only GPS-based results are described herein.) That was also the case for our temporary local reference station, which consisted of a GNSS antenna mounted on a tripod and connected to another GNSS receiver. Hence, we were able to generate reference solutions for the vehicle trajectories in relative positioning mode with baselines of up to only some hundred meters, yielding 3D coordinate accuracies below 20 centimeters. The RCM algorithms presented here were implemented in the Institut für Erdmessung GNSS Matlab Toolbox. To compute a typical real-time SPP navigation solution based on GPS C/A-code observations only, broadcast ephemerides were used. Tropospheric and ionospheric signal delays were corrected by the Saastamoinen and Klobuchar models, respectively. [Click on an image to enlarge it.] FIGURE 1. Allan deviations of investigated atomic clocks and GPS ionosphere-free carrier and C/A-code observation noise modeled as white-noise phase modulation (WPM) over time. FIGURE 2. Test track. The yellow ellipse marks a treed lane with signal obstructions. Precision and Accuracy Two of the most important GNSS performance parameters are the precision and accuracy of the coordinate solution. FIGURE 3 shows topocentric coordinate differences with respect to the reference trajectory and clock-error time series of the receiver driven by its internal quartz oscillator, estimated without RCM. This is typical for almost all end users. The (linearly detrended) receiver clock error exhibits values between roughly −100 and +200 nanoseconds, which is typical for a quartz oscillator. The noise of the coordinates is in the range of 20–25 centimeters in the horizontal components and about 50 centimeters in the up-component, respectively. Furthermore, certain coordinate offsets are visible due to remaining systematic effects such as ionospheric delay and orbit errors. We could attribute these effects thanks to repeated analysis runs with different correction models such as precise IGS final orbits or by forming the ionosphere-free linear combination. Hence, the assessment of the accuracy of the results is difficult since it chiefly depends on the applied correction models, and it is less influenced by receiver clock modeling. Without use of RCM, the three receivers connected to the CSACs show similar behavior in the coordinate domain. However, the clock residuals become very small compared to those of the internal oscillator and amount to only a couple of nanoseconds at most. As an example, FIGURE 4 depicts the results for CSAC A. Even over a relatively short period of time of approximately eight minutes, this oscillator shows a significant frequency drift, which we have to account for in RCM. Note that this is also true for the device’s oven-controlled crystal oscillator (OCXO) post-filtered signal. When applying RCM, as expected, no changes in the time series of the north and east coordinates occur, but a strong decrease of the up-coordinate residuals is clearly visible. The noise level is up to 20–30 centimeters. Due to the applied polynomial clock model, the clock residuals are also reduced. Thanks to the increasing number of epochs/observations contributing to the estimation of the clock parameters, the course of these residuals gets smoother over time. Furthermore, spikes in the up-coordinate time series at around minutes five to seven caused by sudden signal obstructions are almost eliminated thanks to RCM. Also, when applying RCM, there are no improvements in the horizontal components, but the scatter of the up-coordinates is decreased in the range of 48 percent (CSAC B) to 58 percent (CSAC A). Our second RCM approach based on an existing extended Kalman filter clock model shows comparable results. The most obvious difference to a sequential least-squares approach is that the spikes in the up-coordinate and clock residual time series at around minutes five to seven are not smoothed as strongly. Reliability and Integrity Reliability and integrity are very important GNSS performance parameters, especially for real-time and safety-of-life critical applications. In general, we distinguish between internal and external reliability, which are both measures for the robustness of the parameter estimation against blunders in the observation data. Thereby, good reliability makes it easier to identify and remove gross errors and outliers in GNSS data analysis. Internal reliability is calculated in terms of so-called minimal detectable biases (MDBs) of the GNSS observations. These values determine lower bounds for gross observation errors so that these can still be detectable. External reliability describes the influence of these MDBs on the parameter estimates. In our experiments, we found reductions in the size of the MDBs of up to 16 percent. As a consequence, the vertical protection level — a measure of integrity — is also improved. Positioning with 3 Satellites Generally, GNSS positioning requires at least four satellites in view to solve the equation system for the four unknowns. This can become a severe restriction in difficult environments such as urban canyons. Taking benefits of an oscillator of high accuracy, with known and predictable frequency stability, enables positioning using only three satellites. This approach enhances GNSS continuity and availability, and is called clock coasting. Thanks to the stability of CSACs, the GNSS observations are corrected by an additional receiver clock term, which is computed from the latest clock-coefficient estimates. To show the effects of this method, we generated two artificial partial satellite outages so that only observations on only three satellites remain. The latter were chosen in such a way that typical situations in an urban canyon were simulated; that is, only satellites with high elevation angles were visible to the receiver. The resulting coordinate and clock time series are depicted in FIGURE 5. When coasting through periods with only three satellites available, the horizontal coordinates become approximately two to three times noisier (1–2 meters). Due to the poor observation geometry, an additional offset of about 1 meter is induced in the north component during the first partial outage. However, the noise of the up-coordinate is only slightly increased in both of the outage periods, although a significant drift is visible during the first one. Most likely, this is because the coefficients used for clock coasting are only based on 60 epochs up until that time. During the second partial outage this drifting behavior vanishes independently of the satellite geometry. Due to the fact that the clock time series are linearly detrended and a linear clock polynomial is applied, the corresponding residuals shown in FIGURE 5 equal zero during the coasting periods. The presented approaches for RCM and clock coasting are applicable in multi-GNSS positioning and timing data analysis, too, where we also have to consider inter-system biases. Thanks to the high temporal stability of these biases, they can be modeled by a polynomial in the same sense as the receiver clock error. [Click on an image to enlarge it.] FIGURE 3. Topocentric coordinate deviations with respect to the reference trajectory and clock errors. The receiver is driven by its internal oscillator. No receiver clock modeling was applied in a sequential least-squares adjustment. Note the different y-axis scales. FIGURE 4. Topocentric coordinate deviations with respect to the reference trajectory and clock errors for a receiver connected to the CSAC A signal. The results without receiver clock modeling are depicted in black and blue. The results applying a quadratic polynomial for clock modeling in a sequential least-squares adjustment are shown in red. FIGURE 5. Topocentric coordinate deviations with respect to the reference trajectory and clock errors. The receiver is connected to CSAC B. The solution is obtained from a sequential least-squares adjustment with clock coasting from minutes one to two and five to seven. Spoofing Detection Jamming and spoofing of GNSS signals have become major threats to GNSS positioning and timing. Although these authentication issues have been well known since the beginnings of GPS, they have become more severe in recent years due to the greatly increased number of applications that rely on (highly) accurate GNSS positioning and timing. Experiment A spoofing attack’s goal is for the signal tracking loops of a target receiver to acquire the spoofing signal, and then pull its navigation solution away from the authentic position. So as not be detected by the target receiver, the common delay of the spoofing signals — which will be absorbed by the receiver’s clock-error estimate — must not deviate significantly from the receiver’s authentic clock error. This means that the injected delay has to be as small as possible so that it cannot be separated from the typical random frequency (and thus time) fluctuations of the oscillator driving the receiver. To simulate a spoofing attack, we set up an experiment consisting of two GNSS receivers, one driven by its internal quartz oscillator, and one connected to CSAC B, both recording the same GNSS signals via a signal splitter. The input signal of the latter comes from an active coaxial switch, which allows us to switch between two different antennas in less than 1 second. Both antennas in our measurement configuration were mounted on tripods. However, one antenna was connected to a commercial GNSS repeater, which generates an additional delay, and its output signals were transmitted via cable to the coaxial switch (see FIGURE 6). When switched to the antenna without the repeater, the receivers recorded authentic signals. When switched to the repeater, they recorded spoofed signals. The location of the repeater antenna ranges from 2 to 25 meters away from the authentic antenna, thereby introducing different delays — in addition to the repeater delay — into the signal processing of the two receivers. We assume that a short delay of about 2 meters (7 nanoseconds) is more difficult for receivers to detect than a delay of about 25 meters (83 nanoseconds). Whenever the signal path is switched from the authentic antenna to the repeater antenna, this should result in a jump in the clock-error time series. Combined with the known frequency stability of the receivers’ oscillators, we can establish a hypothesis test for the significance of such a clock-error jump. For each new location of the repeater antenna, the measurement procedure was the same. We recorded authentic and spoofed data four times alternating for two minutes with a data rate of 1 Hz. FIGURE 6. Measurement configuration of a spoofing detection experiment. Results FIGURES 7 and 8 show the original clock-time offsets for two different locations of the repeater antenna as recorded by the receivers, and the corresponding predicted clock states from the Kalman filter. The jumps in each clock-error time series are more or less clearly visible, especially in the case of the 2-meter distance. For the latter, the hypothesis test of the temperature-controlled crystal oscillator (TCXO) always accepts the alternative in favor of the null hypothesis; that is, from a statistical standpoint, no spoofing attack is detectable. This is because of the small signal delay attributable to the measurement geometry, which cannot be properly separated from random time deviations caused by the TCXO’s low frequency stability. On the contrary, even for this short distance between the spoofing and authentic antennas, every start and end of the four spoofing attacks were detected. As an example, FIGURE 8 shows the results for a larger distance (around 14 meters). In this case, all spoofing attacks can be properly detected by both the TCXO- and the CSAC-controlled receivers. The seven-times-increased distance ensures that even the low-cost TCXO inside the receiver combined with a sophisticated receiver internal clock estimation is capable of spoofing detection by monitoring its clock states. FIGURE 7. Original and predicted receiver time-offset states after a straight line fit for a receiver driven by its internal TCXO and connected to CSAC B, respectively. The repeater antenna is located about 2 meters away from the authentic antenna. FIGURE 8. As for Figure 7 but with the repeater antenna located about 14 meters away from the authentic antenna. Conclusions In this article, we have proposed a deterministic approach for receiver clock modeling in a sequential least-squares adjustment by applying a linear or quadratic clock polynomial whose coefficients are updated each consecutive epoch. As a prerequisite, an individual characterization of the frequency stabilities of three miniaturized atomic clocks was carried out with respect to the phase of an active hydrogen maser showing an overall good agreement with manufacturers’ data. A real kinematic experiment was carried out with two chip-scale atomic clocks, and typical code-based GPS navigation solutions were computed. We showed that the precision of the up-coordinate time series are improved by up to 58 percent, depending on the clock in use. Furthermore, internal and external reliability were significantly enhanced. Additionally, it was shown that our algorithm is capable of coasting through periods of partial satellite outages with only three satellites in view. This increases availability and continuity of GNSS positioning with poor satellite coverage caused by high shadowing effects or multipath, for example. Finally, we investigated the benefits of an atomic clock in spoofing detection and showed first results. Our approach, based on a Kalman filter and a hypothesis test, enhances the detectability of a spoofer when using a CSAC instead of the receiver’s internal oscillator, especially in the case of small signal delays injected by the spoofing device, which helps to identify a sophisticated spoofer very quickly. Manufacturers We used two different CSACs: a Jackson Labs (jackson-labs.com) LN (CSAC A) and a Microsemi Quantum SA.45s (CSAC B). For the kinematic experiment, we used four JAVAD GNSS Delta TRE-G3T receivers connected to a NovAtel 703 GGG antenna via an active signal splitter. The local reference station consisted of a Leica (leica-geosystems.us) AX1202GG antenna connected to a Leica GRX1200+ GNSS receiver. A JAVAD Delta TRE-G3T was used in the spoofing experiment. Disclaimer The authors do not recommend any of the instruments tested. It is also to be noted that the performance of the equipment presented in this article depends on the particular environment and the individual instruments in use. Acknowledgments This article is based, in part, on the paper “Benefits of Chip Scale Atomic Clocks in GNSS Applications” presented at ION GNSS+ 2015, the 28th International Technical Meeting of the Satellite Division of The Institute of Navigation, held Sept. 14–18, 2015, in Tampa, Florida. The authors would like to thank Andreas Bauch and Thomas Polewka, who are both with PTB, for their support during execution and analysis of the clock comparisons, and Achim Hornbostel from the German Aerospace Center (Deutsches Zentrum für Luft- und Raumfahrt) for discussions on spoofing experiments. We also thank IGS and its participating agencies for their GNSS products, which were a valuable contribution to our case study. Our work was funded by the Federal Ministry of Economics and Technology of Germany. Further Reading • Authors’ Conference Paper “Benefits of Chip Scale Atomic Clocks in GNSS Applications” by T. Krawinkel and S. Schön in Proceedings of ION GNSS+ 2015, the 28th International Technical Meeting of the Satellite Division of The Institute of Navigation, Tampa, Florida, Sept. 14–18, 2015, pp. 2867–2874. • Chip-Scale Atomic Clocks and GNSS Applications “Reducing the Jitters: How a Chip-Scale Atomic Clock Can Help Mitigate Broadband Interference” by F.-C. Chan, M. Joerger, S. Khanafseh, B. Pervan and O. Jakubov in GPS World, Vol. 25, No. 5, May 2014, pp. 44–50. “Time for a Better Receiver: Chip-Scale Atomic Frequency References” by J. Kitching in GPS World, Vol. 18, No. 11, Nov. 2007, pp. 52–57. • Time, Frequency and Clocks “A Historical Perspective on the Development of the Allan Variances and Their Strengths and Weaknesses” by D.W. Allan and J. Levine in IEEE Transactions on Ultrasonics, Ferroelectrics, and Frequency Control, Vol. 63, No. 4, April 2016, pp. 513–519, doi: 10.1109/TUFFC.2016.2524687. Time – From Earth Rotation to Atomic Physics by D.D. McCarthy and P.K. Seidelmann, published by Wiley-VCH Verlag GmbH & Co. KGaA, Weinheim, Germany, 2009. “Special Issue: Fifty Years of Atomic Time-Keeping: 1955 to 2005,” Metrologia, Vol. 42, No. 3, June 2005. The Measurement of Time: Time, Frequency and the Atomic Clock by C. Audoin and B. Guinot, published by Cambridge University Press, Cambridge, U.K., 2001. The Science of Timekeeping by D.W. Allan, N. Ashby and C.C. Hodge, Hewlett Packard (now Agilent Technologies) Application Note 1289, 1997. “The Role of the Clock in a GPS Receiver” by P. Misra in GPS World, Vol. 7, No. 4, April 1996, pp. 60–66. “Time, Clocks, and GPS” by R.B. Langley in GPS World, Vol. 2, No. 10, Nov./Dec. 1991, pp. 38–42. • Clock Modeling Feasibility and Impact of Receiver Clock Modeling in Precise GPS Data Analysis by U. Weinbach, Ph.D. dissertation, Gottfried Wilhelm Leibniz Universität Hannover, Hannover, Germany, Wissenschaftliche Arbeiten der Fachrichtung Geodäsie und Geoinformatik der Leibniz Universität Hannover, Nr. 303, and Deutsche Geodätische Kommission bei der Bayerischen Akademie der Wissenschaften, Reihe C, Dissertationen Heft Nr. 692, 2013. “Time and Frequency (Time-Domain) Characterization, Estimation, and Prediction of Precision Clocks and Oscillators“ by D.W. Allan in IEEE Transactions on Ultrasonics, Ferroelectrics, and Frequency Control, Vol. UFFC-34, No. 6, Nov. 1987, pp. 647–654, doi: 10.1109/T-UFFC.1987.26997. “Relationship Between Allan Variances and Kalman Filter Parameters” by A.J. van Dierendonck, J. McGraw and R.G. Brown in Proceedings of the Sixteenth Annual Precise Time and Time Interval (PTTI) Applications and Planning Meeting, Greenbelt, Maryland, Nov. 27–29, 1984, pp. 273–292. • Spoofing “GNSS Spoofing Detection: Correlating Carrier Phase with Rapid Antenna Motion” by M.L. Psiaki with S.P. Powell and B.W. O’Hanlon in GPS World, Vol. 24, No. 6, June 2013, pp. 53–58. “Assessing the Spoofing Threat” by T.E. Humphreys, P.M. Kintner, Jr., M.L. Psiaki, B.M. Ledvina and B.W. O’Hanlon in GPS World, Vol. 20, No. 1, January 2009, pp. 28–38.