©2016 IEEE.This material is posted here with permission of the IEEE. Internal or personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution must be obtained from the IEEE by writing to pubspermissions@ieee.org. BENEFITS OF GNSS IF DATA RECORDING Gérard Lachapelle and Ali Broumandan Schulich School of Engineering PLAN Group (http://plan.geomatics.ucalgary.ca) University of Calgary 2500 University Drive, N.W., Calgary, Alberta, Canada, T2N 1N4 Abstract — The advantages of recording IF (intermediate frequency) data when observing GNSS signals are discussed. This fundamental data can be reprocessed indefinitely with any acquisition and tracking loop algorithm to assist in the design and use of enhanced loops for the applications needed. If a sufficient number of bits and signal bandwidth are recorded, no fundamental information is lost and the data can be used in postmission for advanced earth observations and GNSS infrastructure protection used methods yet to be discovered. The data storage requirement is described and two examples are employed to demonstrate its use. Keywords: — GNSS, data recording, signal analysis, scintillation, tracking loop, vulnerabilities I. INTRODUCTION Digitized IF data is the first and most fundamental data available following GNSS antenna signal receipt. Due to its high density, digital data is used by receivers to derive lower density measurements (e.g. code and carrier phase) with algorithms specific to each receiver model. Since this digital data is not recorded, it cannot be reprocessed later to obtain higher quality derived measurements with more sophisticated algorithms. Information contained in such fundamental data is lost and cannot be recovered. Figure 1 shows the different processing stages of a receiver along with the data rate in each stage. The down-converted RF signals to IF (or baseband) in the front-end are then digitized using an analog-to-digital converter (ADC) at a suitable sampling rate. The quality of the antenna, noise figures of the RF front-end and the frequency and phase response of the filters in the RF frontend influence the quality of the received signals. The sampling rate is proportional to the bandwidth of the signals to be processed in order to achieve the performance requirement of a given application. Generally, high accuracy receivers require a wider bandwidth such that almost full power of the signals is captured. The sampling rate in GNSS applications may vary from a few mega samples per second (MSPS) to a few tens of MSPS. The number of quantization bits during analog-to-digital conversion is selected based on allowable signal loss and processing power available for further processing. Acquisition and tracking algorithms are specific to receivers/ companies and are proprietary. They are developed to be cost effective in term of computational power requirements and to meet the application at hand. Hence they are not the most sophisticated signal processing algorithms available in term of reducing code and carrier phase noise and multipath due to cost; the best algorithms may not be available to the relevant manufacturer due to patent restrictions and trade secrets. Most important is that acquisition and tracking algorithm performance are improving continuously as the past 30 years have positively demonstrated and will likely continue to improve. Due to IF measurement storage requirements, positions, velocity and time (PVT) solutions are stored in most receivers, such as in handheld units and smartphones. Medium to high grade receivers store in addition pseudorange, carrier phase and associated measurements. A prime example is the International GNSS Service (IGS), which has been storing pseudorange and carrier measurements in its world-wide network for decades. These are an invaluable source of information to derive and maintain the primary earth reference frame and other information. This would not be possible if only PVT solutions would have been stored. As the data density that is stored is decimated from IF to code and carrier to PVT solutions, information is irretrievably lost. Hence what would be the advantages of storing IF data and with what storage requirement? The second question is addressed in the next section. The first one is summarized below, with examples provided later in the paper. IF data allows one to reprocess it at will, at any computational speed in post-mission, using any signal acquisition and tracking algorithms, including those yet to be invented at future dates. This would permit the recovery of much more information that can be obtained using pseudorange and carrier phase data. During the first 10 years of GPS operation, this data was deemed useful mostly for accurate geodetic positioning solutions to maintain national and world reference frames; continental and regional crustal motion and deformation could be effectively studied, hence the beginning of GNSS derived earth observations; the IGS network is an extraordinary achievement. Then GNSS signals started to be used for atmospheric studies; early storage of IF data positively demonstrated its advantage for such studies. Some regional/local networks are now collecting IF data for this purpose, often over limited periods of time. A relatively new discipline exploiting GNSS signals for earth observations is reflectometry, ranging from wind speed [3] to sea roughness estimation [4]; these applications are independent from positioning and timing and were not anticipated by GPS developers. What other disciplines might emerge in the years ahead using GNSS signals? Isn’t the value of systematically storing IF data continuously on worldwide networks truly exciting to provide long term data series from which earth, climate, atmosphere might be investigated over time? In the sequel, two applications will be described to illustrate the advantages of IF data capture. The first one deals with a forensic analysis of GNSS signals affected by electronic interference, the nature of which is assumed unknown a priori. The second is a study of ionospheric scintillation in Brazil in 2012-13 where IF data was recorded during selected periods. European Navigation Conference 2016, Helsinki, Finland (May 29-June 02, 2016) 978-1-4799-8915-7/16/$31.00 ©2016 IEEE Page 1/6 Figure 1: Data Capture Points in a GNSS Receiver The first application would normally require short term IF data storage depending on the infrastructure requiring protection while the second requires medium to long term, the latter in anticipation of techniques yet to be discovered. II. IF DATA STORAGE REQUIREMENTS As shown in Figure 1 the data rate is higher at the first receiver processing stage and reduces significantly along the processing stages. As it moves through various processing stages, quality is increasingly and irreversibly affected by the algorithms used. Hence, stored digital data offers greater flexibility in terms of using different algorithms, but with a higher storage requirement compared to data stored at other processing stages. The digital data storage requirement depends on the number of constellations that are not sharing the same frequency band, number of frequency bands in each constellation to be captured, and number of bits used to represent each digital sample. Many standard receivers use 2bits quantization because the quantization power loss is about 0.5 dB compared to 1.96 dB with 1-bit quantization [14]. However, if the applications need high quality of code and carrier phase measurements, or is related to monitor higher dynamic range of the input signal power, then a higher number of quantization bits is needed. Typical examples include anti-jamming receivers and weak signal processing to mitigate cross-correlation. Current high-end receivers use 4 to 6 bits. A 16-bit ADC captures GNSS signals with a power variation between ±49 dB from their nominal received power on the surface of the earth, with negligible quantization power loss [15]; this would theoretically be the ideal number of bits for earth observations, although at a high storage cost. Experts from various fields would have to weigh in to assess the most cost effective option. Digital data can be stored in any suitable format, e.g. the GNSS SDR Metadata Standard [13]. The memory required to store digital data can be calculated as 2 Bandwidth ( bits / sample ) [Tera Bytes (TB)] Memory 8 1012 Here, the sampling frequency is chosen as twice the bandwidth of the signal according to the Nyquist sampling theorem. For instance considering 16 bits per sample and full available bandwidth on each signal, the memory required to store the digital data for individual GNSS signals namely GPS, Galileo, GLONASS, BeiDou, QZSS and IRNSS at different frequency bands over a 24-hour day per antenna is shown in Figure 2 [5-12]. In the case of GLONASS FDMA the entire signal bandwidth was considered. Figure 2: Memory requirement per day for individual signals (16-bit assumption) The stability and phase noise of the reference oscillator affect the quality of the sampled signals. The phase noise of sampling clock, derived from the reference oscillator, used by the ADC decreases the SNR of the sampled signals which in turn leads to decreased C/N0 of the GNSS signals [1]. The magnitude of the SNR loss increases with the increase in sampling frequency for a given phase noise of the referece oscillator. Also, it affects the code and carrier tracking loops in the GNSS receiver, deteriorating achievable performance [18]. The stability of the oscillator permits longer coherent integration intervals leading to higher sensitivity. Hence, good quality oscillators, which are still relatively costly, large and power consuming, need to be chosen for optimal data quality. III. EXAMPLE 1: INTERFERENCE FORENSIC ANALYSIS GNSS signals can be easily disrupted by various types of interfering signals including jamming and spoofing signals. In GNSS-based critical applications, such as aircraft, train and ship collision avoidance, it is required to investigate the possible sources of error/malfunction in case of incidents or accidents. A receiver may have produced faulty measurements or an external intentional or unintentional sources may have been the cause. The use of IF samples available throughout the event allows a more in-depth analysis. To demonstrate the effectiveness of this approach, two laboratory tests were performed to investigate the robustness of a commercial receiver to an intentional radio frequency attack and then to analyze the benefits of IF samples analysis to further understand the cause of the disruption on the PVT solution. The first test investigates the robustness of PVT solutions of the receiver under a wideband (1) jamming attack. The second test examines the effect of a spoofing attack. A. Jamming attack: The experimental setup and data collection apparatuses for the first test are shown in Figure 3. The authentic GNSS signals via a roof top antenna were fed to a two-way combiner. The second input of the combiner was connected to a Rohde & Schwarz (R&S) SMBV100A hardware simulator generating high power GNSS signals at L1 band as a wideband jammer. The combined signals after power adjustment were sampled by a National Instrument (NI) European Navigation Conference 2016, Helsinki, Finland (May 29-June 02, 2016) Page 2/6 Figure 3: Data collection scenario Figure 5: C/N0 values of authentic signals front-end utilizing a 16-bit digitizer. In this data set jamming power was gradually increased to finally mask the authentic signals and then decreased to its initial power level. The combined signals were fed to a two-way splitter. One of the outputs was connected to a GNSS receiver and another output was connected to the NI front-end. This type of interference attack does not disturb the receiver while the jamming power is equal or a bit higher than that of the authentic signals. Nevertheless, if the jamming power significantly increases, it severely affects the acquisition and tracking modules of the receiver. Figure 4 shows the positioning errors of the receiver as a function of time. The position and navigation solutions were denied during a 150 s period. Figure 5 shows the authentic signal C/N0 values reported by the receiver, confirming tracking issues during the disruption period. However, the latter is not know at this stage. Time/frequency analyses of IF samples may be used to characterize the error source. Figure 6 shows the standard deviation (std) of IF samples as a function of time. It is around 1 as it should be when no interference occurs. The IF samples power increases to 30 dB during the data collection. This analysis confirms that the signal is affected by a high power interference signal during the period starting at 100 s as opposed to signal outage, antenna, cable or any other physical hardware/software malfunction. A spectral analysis of the IF samples at 1 and 270 s from the beginning of the data is shown in Figure 7 for a 5 MHz signal bandwidth. The GPS carrier centre frequency is shifted by 420 KHz (IF frequency). The spectrum of the signal does not show a high power peak at the frequency band hence the signal is not affected by a narrowband jammer. The signals spectrum at time t=270 is similar to that of BPSK modulation. This is not the case for authentic GPS as the signals are below the noise floor. This analysis demonstrates a possible wideband jamming attack utilizing BPSK modulation. Figure 6: IF samples standard deviation profile during the data collection Figure 4: Receiver position solution errors European Navigation Conference 2016, Helsinki, Finland (May 29-June 02, 2016) Page 3/6 Figure 7: Power spectral density of IF samples Figure 8: East, North and Up errors as a function of time B. Spoofing attack: This test was performed utilizing a hardware simulator (HS). The HS can simulate two independent receiver antennas from a single simulation scenario simultaneously. To simulate a realistic spoofing scenario one of the HS ports simulated a static receiver as the authentic receiver. The other port outputted a rover receiver scenario moved on a 1000 m side square trajectory where the authentic receiver was located in one of its corner. The spoofing signals had a 1-3 dB power advantage over the authentic signals. The output signals of the ports were fed to a RF combiner and then passed to a RF splitter. The same as the previous test the output signals from the splitter were fed to the same receive and NI front-end. The spoofing signals was initially disconnected for about 150 s. During this period the receiver was locked on the authentic signals. After about 150 s form the beginning of the data collection, spoofing signals were injected to the simulation scenario. At that epoch, the Euclidean distance of the spoofer location from the authentic one was about 1400 m (the spoofer and authentic were located on opposite corners of the square trajectory). In this case the spoofing and authentic signal correlation peaks did not overlap for most PRNs. Figure 8 shows the East, North, Up errors of the position solution of the receiver as a function of time. As shown, the existence of the spoofing signal during the first 300 s period did not disrupt the position solution. This is due to the fact that the receiver was locked on authentic signals and the existence of spoofing signals did not affect the authentic signal tracking performance. After 300 s the spoofing signals succeeded in grabbing the tracking point of the authentic signals and in deceiving the position solutions. If an unexpected event occurs, investigating the navigation solution does not provide any information regarding its cause. Having access to the IF samples, further analyses can be performed to characterize the nature of the accident. Figure 9 shows the power spectral density plots at different time of the data collection scenario. The spectral density is increased at t=400 compared to that at t=1. The power spectral density plot of the signal at t=400 is similar to that of BPSK modulation with a 2 MHz main peak bandwidth. This is not the case for authentic signals as compared to the spectral density plot at t=1. Hence, there is a high possibility of existence of more than normal BPSK modulated signals (e.g. spoofing attack) in the desired frequency band. Post correlation analyses can be used to further characterize the interference source. Figure 10 shows a view of correlator outputs in the case of PRN2. There are two correlation peaks as opposed to one distinctive peak for the authentic case. Appearance of more than one correlation peaks at the output of the cross ambiguity function is one of the spoofing detection metrics. Considering the above analysis it can be concluded that the cause of the erroneous solutions was a spoofing attack. IV. EXAMPLE 2: IONOSPHERIC SCINTILLATION ANALYSIS As a result of high level solar activity, ionospheric scintillation occurs and causes amplitude and phase fluctuation of GNSS signals received on the earth’s surface. The effect is inversely proportional to frequency and GNSS frequencies were chosen sufficiently high to avoid much of the effects seen at lower frequency (as it was the case for the NNSS Transit Doppler system). Nevertheless, effects affecting carrier phase measurements remain during the above periods, which reach a maximum every 11 years. Hence, every 11-year period, occasional carrier phase measurement issues occur on satellite signals traversing parts of the ionosphere that are disturbed. However, with the number of satellites available increasing, the likelihood of significant carrier phase positioning performance issues decreases. European Navigation Conference 2016, Helsinki, Finland (May 29-June 02, 2016) Page 4/6 Figure 11: Example of S4 values for satellites above 10˚ elevation Figure 9: Power spectral density of IF samples Figure 10: Authentic and spoofing signals correlation peaks Added to this is the increasingly robust and sophistically carrier phase tracking loops used by receivers. Code lock loops producing pseudorange measurements are not affected directly, although a higher level of ionospheric activity results in higher code delays. Since the delays are a function of frequency, the use of two frequencies is used to remove it. IF data is now used commonly by researchers investigating the effect of the ionosphere on GNSS signals. The advantage is that enhanced tracking loop algorithms can be tested with the same data as often as needed to test performance. Leading manufacturers have been doing just this and the remarkable improvement of their carrier phase measurements under ionospheric scintillation during the past 25 years are well known. An example of such research is the joint project undertaken by the University of Calgary and Brazil’s IBGE (Instituto Brasileiro de Geografia e Estatística) in 2012-13 reported by [2]. A solar maximum was predicted to occur (and did occur) in 2013. An IF data collection system was set up in Rio de Janeiro during anticipated periods of scintillation from June 2012 to March 2013. The choice of the location was ideal as equatorial scintillation is generally the most significant. A GPS L1/L2C IF data recording system was used for this purpose. Due to various hardware limitations, only 1-bit recording was performed, which was to prove sufficient to accomplish the investigations intended. The level of ionospheric scintillation is best characterized by a parameter called S4 [19]. The theoretical maximum is 1, although values slightly above 1 sometime occurs due to various error contributions. An example is shown in Figure 11 for October 24, 2012, a scintillation day considered high in Rio. S4 values above 0.6 indicate strong to very strong scintillation. Satellites with S4 values below 0.4 are only affected mildly or not at all due to their positions relative to the band of the ionosphere affected by scintillation that day. The 1-bit IF data for the above day and others of high and low scintillation was processed using various aided phase lock loops implemented in the GSNRx software receiver [17] for this purpose as described in [16]. The IF data was used to test and enhance these loops; the ability to reprocess the IF data during the loop aiding and tuning process proved invaluable. The shared-architecture tracking loop described in [16] was selected as the most effective. The results reported in [2] show no carrier phase date loss on L1 and only up to 4% on L2C for satellites affected by ionospheric scintillation when high. V. CONCLUSIONS The two examples described herein illustrate well the advantages of recording GNSS IF data for applications ranging for scientific studies to protection of the infrastructure for safety of life applications. The two applications discussed required a limited number of bits and limited storage periods. Others, some yet to be discovered, would require more bits and long storage periods. It would appear that starting with 4 bits long term storage as an example would address many of current and anticipated scientific uses. Storage costs and data access methods would become issues if large global GNSS networks were to be considered. The long-term benefits would likely be proportional to the level of commitment involved. European Navigation Conference 2016, Helsinki, Finland (May 29-June 02, 2016) Page 5/6 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] REFERENCES Brannon, B (2004) “Sampled systems and the effects of clock phase noise and jitter,” Technical Report AN-756, Analog Devices. Fortes, L., T. Lin and G. Lachapelle (2015) Effects of the 2012-2013 Solar Maximum on GNSS Signals in Brazil. GPS Solutions, 19, 2, 309-319 Garrison, J. L., Komjathy, A., Zavorotny, V.U., and Katzberg, S.J., “Wind Speed Measurement using Forward Scattered GPS Signals,” IEEE Transactions on Geoscience and Remote Sensing, Vol. 40, No. 1, Jan. 2002, pp. 5065, DOI:10.1109/36.981349. Garrison, J. L., Katzberg, S. J., and Hill, M. I., “Effect of Sea Roughness on Bistatically Scattered Range Coded Signals from the Global Positioning System,” Geophysics Research Letters, Vol. 25, No. 13, July 1, 1998, pp. 22572260 GPS ICD L1 (2013) “Global Positioning Systems Directorate Systems Engineer & Integration Interface Specification, IS-GPS-200H,” Navstar GPS Space Segment/Navigation User Interfaces, 24 Sep. GPS ICD L1C (2013) “Global Positioning Systems Directorate Systems Engineer & Integration Interface Specification, IS-GPS-800D,” Navstar GPS Space Segment/User Segment L1C Interfaces, 24 Sep. GPS ICD L5 (2013) “Global Positioning Systems Directorate Systems Engineer & Integration Interface Specification, IS-GPS-705D,” Navstar GPS Space Segment/User Segment L5 Interfaces, 24 Sep. BeiDou ICD (2013) “BeiDou Navigation Satellite System Signal In Space Interface Control Document, Open Service Signal,” Version 2.0, China Satellite Navigation Office, December GLONASS L1 L2 ICD (2008) “GLONASS Interface Control Document, Navigational Radiosignal In bands L1, L2,” Edition 5.1., Russian Institute of Space Device Engineering, Moscow. OS SIS ICD (2010) “European GNSS (Galileo) Open Service Signal In Space Interface Control Document,” Issue 1.1., European Union, Sep. [11] [12] [13] [14] [15] [16] [17] [18] [19] IS-QZSS (2014) “Quasi-Zenith Satellite System Navigation Service Interface Specification for QZSS,” Version 1.6, Japan Aerospace Exploration Agency, Nov. ISRO-IRNSS-ICD-SPS-1.0 (2014) “IRNSS Signal In Space ICD For Standard Positioning Service,” Version 1.0, ISRO Satellite Centre, ISRO, Bangalore, Jun. Gunawardena, S. and T. Pany (2015) "GNSS SDR Metadata Standard Working Group Report," Proceedings of the 28th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS+ 2015), Tampa, Florida, September 2015, pp. 3218-3221. Hegarty, J. C. (2011) “Analytical Model for GNSS Receiver Implementation Losses,” Navigation, vol. 58, pp. 29–44, DOI: 10.1002/j.2161-4296, tb 01790.x. Kester, W. (2004) Analog-Digital Conversion, Analog Devices, ISBN 0-916550-27-3, Chapter 6. Also available as The Data Conversion Handbook (2005), Elsevier/Newnes, ISBN 0-7506-7841-0, Chapter 2. Lin, T., G. Lachapelle and L. Fortes (2014) “GNSS Solutions: How Do Modern GNSS Signal Processing Techniques Deal with Equatorial Ionospheric Scintillation?” Inside GNSS, January/February 2014, http://www.insidegnss.com/node/3854. Petovello MG, O’Driscoll C, Lachapelle G, Borio D, Murtaza H (2008) Architecture and Benefits of an Advanced GNSS Software Receiver. J Glob Position Syst 7(2):156-168 Serna, E. P., S. Thombre, M. Valkama, S. Lohan, V. Syrjälä, M. Detratti, H. Hurskainen, J. Nurmi (2010) “Local Oscillator Phase Noise Effects on GNSS Code Tracking,” Inside GNSS, November/December, pp.5262. Van Dierendonck AJ, Klobuchar J, Hua Q (1993) Ionospheric Scintillation Monitoring Using Commercial Single Frequency C/A Code Receivers. Proc. ION-GPS1993, Institute of Navigation, Salt Lake City, September, pp 1333-1342. European Navigation Conference 2016, Helsinki, Finland (May 29-June 02, 2016) Page 6/6