Simulating new GNSS signals and threats

Senior Software Engineer Neil O’Brien utilizing a CAST-8000 GNSS Simulator to analyze CRPA trajectory data. (Photo: CAST Navigation)

The Spirent PNT X. (Photo: Spirent Federal Systems)

Developers and manufacturers of GNSS receivers have always needed to simulate the signals from GNSS satellites to test receivers in their labs and in the field. Now, as the vital role of GNSS for critical infrastructure and the growing threat of radiofrequency attacks are increasingly recognized, simulators must keep up. In particular, they must enable users to test a variety of new positioning, navigation and timing (PNT)  signals from satellites in low-Earth orbit (LEO) and geostationary orbit (GEO), as well as realistically simulate sophisticated jamming and spoofing attacks.

In this cover story on simulators, we discuss these challenges with experts at four simulator manufacturers:

• John Clark, Vice President, Engineering, CAST Navigation
• Lisa Perdue, Product Line Director, Safran Federal Systems
• Jan Ackermann, Director Product Line Management, Spirent Communications, and Paul Crampton, Senior Solutions Architect, Spirent Federal Systems
• Avag Tsaturyan, Systems Engineer, M3 Systems.

How are the missions/applications of simulators changing?

Clark: Our customers have been requesting larger simulation systems that can support GNSS and inertial navigation systems (INS) on multiple vehicles simultaneously. Each vehicle is required to support a phased-array (CRPA) antenna sub-system, multiple INS interfaces and signal interference capabilities. This is a change from earlier times when our customers required smaller systems with less capability.

Perdue: We see a growing focus on testing NAVWAR scenarios and assessing receiver performance against diverse threats. The increasing complexity of receivers with multiple constellations and frequencies demands more advanced simulation capabilities. We provide comprehensive PNT simulators that support hybrid scenarios, in which simulated signals and threats are combined with live signals and sensors, creating a dynamic and realistic testing environment.

Crampton: For many years, simulators have been used to prove the capability of receivers and the systems into which the receivers are integrated. Testing ensures that receivers can perform as expected, including performance in boundary cases, which are tricky to recreate in live-sky conditions.

Over time, threats to navigation and timing performance began to dominate the schedules of test labs. Ensuring reliable performance in suboptimal operating environments is critical to receiver users. The workload of test labs has increased to the point where test automation has become necessary, not only in terms of increased efficiency but also just to keep pace with rapidly evolving threat profiles.

So, one of the main changes we are seeing is the need to speed up the innovation cycle with simplified, automated testing while maintaining test fidelity and robustness. Spirent simulators are enabling testing to “shift left,” to start testing earlier in the development cycle with digital twins — software-only models of receivers and devices — to shorten the time spent on R&D.

Ackermann: Increasing efficiency, flexibility and realism have been critical drivers in the simulator industry for many years and will continue to drive us forward at an ever-increasing pace. Precision and robustness requirements demand more signals and sensor fusion, which need to be supported by simulators. Greater realism and flexibility means that more representative testing can be done in the lab, saving time and money.

On the other hand, while lab testing has grown ever more realistic, there are times where in-field verification is required — simulators have had to become more flexible to address this “augmented reality” test environment and optimize field testing. Simulators are being used on ranges to enhance testing, using combinations of real and simulated signals — including resiliency tests that incorporate live-sky signals.

Are new markets for simulators emerging?

Clark: Yes, as the world evolves and circumstances change, the ability to validate proper operations of GNSS and GNSS/INS navigation systems under less-than-optimal conditions has become challenging. The use of simulators can greatly enhance your understanding of the behavior of a navigation system, thus allowing for more reliable navigation error planning and mitigation when these errors do occur. This has become a much more important area of concern as the automated navigation and integrated navigation markets mature.

Perdue: Yes, new markets are emerging in areas such as autonomous vehicles, UAV swarms, urban air mobility and space exploration, including lunar missions. Additionally, the growing focus on cybersecurity and electronic warfare has increased the demand for simulators that can replicate complex cyberattack scenarios and electronic threats.

Ackermann: New markets for simulators are constantly emerging. As PNT impacts more and more areas of our lives, the geographic and technological spread of simulator requirements continues to expand. Even in existing segments we see new market needs. In automotive, for instance, the emergence of a wide range of safety-critical functions such as intelligent speed assist (ISA) and eCall drive new simulation needs.

From the emergence of the LEO market to the development of LEO PNT constellations, these markets appear and evolve at a rapid pace. Spirent simulators can be used to generate novel and established signals from LEO PNT constellations with ultra-realistic orbital models for complex rotational effects and satellite parameters. The emerging focus on lunar missions from space agencies around the world means new test environments, more stringent requirements, and the potential for new signals outside of L-band, at S-band and beyond.

Crampton: Increasing the realism of testing continues to open new opportunities for simulator use. Spirent provides an all-in-one alternative PNT solution for ultra-realistic LEO modeling, inertial emulation, L and S-band signals, etc. — to be fused and tested in unison.

Senior Software Engineer Neil O’Brien utilizing a CAST-8000 GNSS Simulator to analyze CRPA trajectory data. (Photo: CAST Navigation)

Are simulator requirements changing?

Clark: In the past our customers were focused on the simulation of a single element of GNSS signals and a single INS output interface for the testing of vehicles that only supported single element antenna (FRPA) and a single INS capability. Our customers are now requiring simulator systems that produce multiple elements of phase-coherent GNSS signals that are commensurate with multiple INS interface outputs to drive navigation systems that can utilize a phased-array multiple-element antenna sub-system (CRPA) and multiple INS sources simultaneously.

Perdue: Yes, simulator requirements are always evolving. High signal counts are essential due to the increase in LEO constellations, and there’s a need to replicate multiple threats to create realistic environments. Built-in automation is crucial for managing these complex scenarios. The ability to add custom signals and constellations is necessary for experimenting with new technologies. Our software-defined architecture allows for quick integration of new signals, ensuring flexibility and responsiveness to changing needs. Innovations such as a radio utilizing the RFSoC to provide a high number of multi-frequency outputs from a single system and the BroadSim Duo, which offers dual-frequency capabilities in a compact form factor, demonstrate our approach to meeting these evolving requirements.

Ackermann: As new markets and use cases emerge, the simulator requirements evolve. The growing prevalence of NAVWAR threats, such as GNSS jamming and spoofing, and the range of systems these attacks are impacting is enhancing the criticality of lab testing.

Whether seeking to gain battlefield advantage or to secure civil operations (aviation, for instance), the ability to generate a wide range of NAVWAR attack vectors in complex scenarios is needed like never before. New waveforms must be incorporated quickly and realistically, while defensive technologies such as CRPAs must be exercised with a higher level of precision.

Crampton: Due to the demand for flexible attack vectors and the expanding range of available signals, simulators need to be capable of generating authentic RF environments from novel, user-defined waveforms. A time-saving method has been developed using prerecorded I/Q files. Spirent’s sixth-generation solution, PNT X, accepts raw I/Q data, analyzes the environment and the dynamic movement between receiver and transmitters, and automatically applies the correct motion effects to the generated RF signal. The simulated signal now has real-world dynamics without the need for manual inputs from the user. Realism made simple! Additionally, multiple I/Q-defined transmitters can be seamlessly integrated with native 3D terrain-modeling capabilities to create rich RF environments with multipath and obscuration.

A continuous, dynamic range is required to better replicate high-power jamming threats for controlled reception pattern antenna (CRPA) testing. With PNT X, high-power jammers can be simulated from the moment they become part of the noise floor to when a vehicle, such as an aircraft using a CRPA, passes by it. This continuous range enables CRPA developers to characterize null-steering ability with greater precision than previously possible.

Ackermann: As previously mentioned, there is also a growing need for integration and automation. Systems need to work in concert, and testing needs to happen quickly and efficiently to stay ahead of markets and threats. To this end, the ability to automate and to control remotely, and the ability to integrate seamlessly with other simulation and control systems, are core requirements for modern labs. Spirent is simplifying and automating testing with support for multiple industry-standard frameworks.

In established markets, safety requirements on devices under test drive simulator needs. For instance, functional safety requirements for automotive applications demand the ability to simulate threats and events, while the fidelity requirement of the simulation is elevated to assure conformance.

3D view of an aircraft flying a simulation. (Photo: CAST Navigation)

What mix of signals do you support?

Clark: GPS L1/L2/L5, L1C, L2C, C/A, SBAS, P, Y, SAASM, M-Code AES and MNSA, Glonass and BeiDou

Perdue: We support a wide array of signals, including GPS, GLONASS, Galileo, BeiDou, and regional systems such as QZSS and IRNSS. Additionally, we incorporate alternative navigation signals, such as those from Xona, and support inertial navigation and timing signals. Our software-defined architecture enables us to handle high signal counts and allows for extensive customization, ensuring we can simulate any required signal environment. This flexibility ensures we meet the diverse needs of various industries and applications, from aviation and maritime to autonomous vehicles and defense.

Ackermann: Spirent supports all open service GNSS signals and classified GPS testing — including M-Code Regional Military Protection — as well as PRS (through prs[ware] and our partnership with Fraunhofer IIS) on our simulation platforms.

In addition:

• Regional systems (e.g., NavIC or QZSS)
• S-band frequency signals
• Custom non-ICD signals
• LEO PNT (Xona Space System’s PULSAR and others)
• A broad range of interference waveforms, including CW, FM, PM, wideband AWGN, chirp, matched spectrum, etc.
• Generation of RF from I/Q data injection in L-band and S-band frequencies
• Correction/augmentation
• Inertial sensor emulation

Furthermore, the ability to geolocate custom RF beacons either in a range of orbits or in terrestrial locations adds huge signal flexibility.

What are the key challenges you face?

Clark: As our customers’ needs grow and evolve, some of our key challenges have been the ability to continue to evolve our product utilizing cutting-edge technology while still maintaining backwards compatibility with our older technologies. Efforts like this give our customers peace of mind when making a system purchase and enable them to take full advantage of prior purchases when requirements change and system enhancements are necessary.

Perdue: A key challenge is creating complex simulation environments that require specialized expertise. Customers often lack the knowledge to design these environments effectively. Ensuring simulation accuracy and cybersecurity are significant concerns, especially as new threats emerge alongside new technologies developed to combat existing threats. Translating performance requirements into practical specifications and meeting stringent industry standards adds another layer of complexity. We address these challenges through continuous updates and close collaboration with our customers to ensure our solutions meet their evolving needs.

Ackermann: For 40 years, we have faced a challenge that, to some degree, is being addressed. Namely, PNT is not widely standardized and therefore test requirements are highly diverse. The scale of Spirent and the empowering flexibility of our systems enables us to overcome this, but it remains challenging.

The current geopolitical situation also presents challenges, as the number of threats and the potential for negative events demand ever-increasing sophistication in testing. That’s why we built PNT X with high-power jamming and spoofing capability for greater realism and accurate test results.

Crampton: The complexity of next-gen positioning engines means that our systems have to integrate and interact with other systems, built by other companies with other protocols and specifications. Spirent maintains the precision and stability our customers expect from us while incorporating an open and controllable architecture for easier plug-and-play in complex hardware-in-the-loop environments.

M3 SYSTEMS

Please introduce your company.

Tsaturyan: We represent the Mistral Group, which includes three distinct companies: M3 Systems France, M3 Systems Belgium and Boreal. M3 Systems France teams provide GNSS simulation and test and measurements solutions and radionavigation and signal processing expertise. M3 Systems Belgium teams are experts in air traffic management (ATM) studies. Boreal teams offer beyond-line-of-sight missions for maritime surveillance, Earth observation, and scientific experiments with the BOREAL long-range unmanned aircraft. Each company extends its scope to the challenges of GNSS and UTM with an integrated approach.

What are your key markets? What challenges are you addressing?

Our customers are from different industries: we work with space agencies — such as France’s Centre National d’Études Spatiales (CNES) and the European Space Agency (ESA) — private R&D labs and automotive companies and railways. We propose GNSS simulation products such as the Stella GNSS simulator, which allows users to simulate a vehicle in a realistic environment and in real time for low latency. Our simulator is designed to reproduce the sky with high precision. The GNSS signal passes through different layers, each one of which has a different effect. First, there can be an error in the satellite clock, then there can be a delay as the signal passes through the atmosphere, then, on the ground, there is a risk of a spoofing or jamming attack and, in urban areas, multipath from buildings.

What signals does your simulator support?

Our GNSS simulator is multiconstellation and multi-frequency. It supports all the available GNSS signals and frequencies. Users can simulate multiple antennas and multiple trajectories, custom atmosphere and multipath effects. We offer several built-in models of multipath. Users also can use their own multipath models and even integrate it with an SE-NAV multipath simulation tool. We also have several built-in jamming signals that users can apply and spoof the real signal coming from the antenna or spoof the simulated signal. Our setup now also supports Galileo’s Open Service Navigation Message Authentication (OSNMA). Our Stella GNSS simulation software can run on three different products designed for specific needs: the Stella GNSS Simulator Base (based on NI’s USRP kit), the Stella GNSS Simulator Suite (based on our bundle), and the Stella GNSS Simulator Advanced (based on NI’s VST). Our VST-based solution is optimized for tests that require high performance in terms of calibration — such as simulating a CRPA antenna, where the channels need to be very tightly synchronized.

Photo: M3 Systems

What does your Stella Suite do?

The Stella GNSS Simulator offers up to two independent RF simulations, enabling simultaneous simulation and the jamming/spoofing or the simulation of multiple antennas and trajectories.

Our simulator suite is basically an all-in-one device that allows users to plug in a receiver. This single device enables  users to simulate jamming, spoofing, multiple antennas or multiple trajectories.

When did you launch this product?

We released it and demonstrated it during Emerson NI’s “NI Connect” event. They have an annual event in May in Austin, to which they invite all their partners and customers. This year, we were invited there to present our new simulator. We brought a HIL test setup to demonstrate the new configuration of our GNSS simulator: a closed-loop test of a drone autopilot system. When kinematic parameters from the flight simulator are simulated, the trajectory is sent to the Stella GNSS simulator, which then generates the GNSS RF signal and interference to assess the receiver’s performance. The receiver then passes its positioning data to the autopilot, which sends the commands to the flight control unit in the flight simulator. It’s one of the use cases, because to fully test the receiver, in addition to the nominal situation, it is also necessary to introduce some errors — such as interference, jamming, spoofing or meaconing.

What are some other use cases for this simulator?

Another use case is the test of Advanced Driver Assistance Systems (ADAS) in a 3D simulation environment. Basically, it is designed to test any unit that includes the GNSS positioning and to test the receiver’s robustness in case of jamming, spoofing, or meaconing.

Is this all done in the lab or can you put your box in a vehicle?

With this setup, it’s all done in the lab, but we also offer solutions to record the real signals from a UAV or a ground vehicle.

Are the challenges changing? Is the market changing?

Now, a GNSS simulator is no longer sufficient. Testing the receiver’s robustness against various types of attacks, particularly jamming, requires diverse methods. Consequently, there is an emerging need for simulating jamming mitigation antennas, such as Controlled Reception Pattern Antennas (CRPA).