SINTEF RFI ACTIVITIESJune 2019, Helsinki

Aiden Morrison, Nadia Sokolova

• Brief SINTEF Introduction

• Our motivations for pursuing RFI monitoring

• Past projects covering GNSS interference

• Lessons learned, and knowledge gaps

• Ongoing activities, and upcoming monitoring hardware

2

Outline

3

4

GBAS RFI Monitoring

GNSS for ITS

Indoor Navigation

Custom Navigation HW System Design

Image sources: [3]

Autonomous system Navigation

Navigation Focused Research Areas

• While all GNSS applications are vulnerable to RFI, some have higher potential losses

• If my phone loses GNSS due to RFI, I might be slightly inconvenienced

• If our drone loses GNSS due to RFI, we might lose a very expensive drone or crash in to important infrastructure

• Example of an economic impact

• Some applications have higher risks

5

Our motivation for pursuing RFI monitoring

6

GBAS - Ground Based Augmentation System

Concept of operation:

• Similar to differential GNSS but with extras

• Corrections and safety flags are carried from the ground to the aircraft via a dedicated VHF link called VDB

• There are typically four ground stations which allow for much more sensitive monitoring for outliers and errors

• But the system is very sensitive to signal degradation from RFI

CAT III GBAS-based Automatic Landing

7

Precision Approach Requirements

• Category type identifies system capability, indicating the minimum approach height that can be achieved.

• Hitting these performance metrics is hard under ideal conditions. • If weak RFI is present on even one of the four antennas it can reduce availability and continuity• Stronger RFI is an immediate problem – there are several recent examples

GBAS Precision Operation CAT l CAT ll CAT lllAccuracy [m]

95 %

Horizontal 16.0 6.9 6.1Vertical 7.7 2.0 2.0

Integrity

Time-to-Alert [s]

3 22

Alert Limit [m]H: 40

V: 10-15

H: 17.3

V: 5.3

H: 15.5

V: 5.3PHMI / approach 2x10-5 2x10-9 2x10-9

Continuity Failure Rate5x10-5 / approach

5x10-6 / 15 sec10-7 / 15 sec

Availability 0.99 – 0.99999 0.99 – 0.99999 0.99 – 0.99999

8

GBAS and other aircraft events (plus a fancy boat)

• From the point of view of GBAS, we need to know a few pieces of information about RFI

• 1) The occurrence rate

• 2) The relative occurrence rate

• Future GBAS systems are intended to use both the L1/E1 and L5/E5a bands on GPS and Galileo

• In the event of RFI on a single frequency it may be possible to fall back to operation using only the other

• 3) Power levels

• 4) Spectral occupancy

• Unintentionally generated tones are mitigated by the signals themselves

• It may be possible to identify individual emitters over differing events and positions

• Unfortunately real-time analysis at this level can be computationally expensive

• Instead, we take an alternative approach

9

What we need to know

• RFI detection concept – how to detect RFI with minimal processing power?

• It’s not feasible to analyze all signals in real time in terms of C/N0 – that would require a full multifrequency GNSS

receiver and wouldn’t provide us a bitstream for our SDR

• Instead we look for in band power level deviation

• Must allow for site to site variation and slow variability due to thermal effects etc. But rapid increases in power are strong indicators of RFI

• Weak events visible

• Strong events up to -10dBm

• Example of car-borne jammer events10

Event detection - 1

Event detection - 2

• Mobile Jammer

• Cigarette lighter style

• 'Stepped CW' signal

• Car drove within 10 m

• Test conducted with NKOM and FFI

• Other monitors deployed

• Indra Navia, DFS, NLR, ESTEC

• The monitor at ESTEC triggered frequently on adjacent band pulsed power sources (See Event 000)

• Also caught a delivery truck or taxi with a jammer

• Event 008 is a jamming event

• GNSS satellites cannot be tracked in L1 band for duration

• There are Drawbacks to this approach

11

• Three major factors motivated the design of a second generation monitoring system

• The Manual result collection and analysis required a large amount of user intervention

• Far too many "false alarms"

• E5b, L2, G2, E6, E1PRS, and G1 not collected/analyzed

• These signals all have slightly different characteristics making them more or less suitable to different use cases

• Let’s see what this coverage looks like on a signal map

12

Lessons learned & Knowledge gaps

• A chart is helpful:

• Ignoring the S-band signals, this chart shows the L-band

• Signal plans evolve over time

• Uncertain if the GLONASS CDMA plans are still accurate

• Most of these signals are now turned on and ’healthy’

• The rise of RFI

• As GNSS has risen to solve more and more problems, it has become a larger target

• People are right to be paranoid about being tracked, but jamming GNSS is hazardous

• If usage based road tolling depends on GNSS it will become a target

• This is why we need a radically different front-end

• From 2x24 MHz to 4 x 55 MHz

• This is a nearly 5x increase in the amount of data

• For reasons we will cover later we also want to go from 1 bit to 4 bit

• 4x again so ~20x the data relative to the first system

• A higher dynamic range is also desirable13

RF signal background - 3 of 3

• Our design needs to tolerate 6 or 7 orders of magnitude

• (Images from wikipedia, Nuand, and Maxim)

• 60-70dB+ dynamic range

• Each bit of ADC range represents 3dB of amplitude dynamic range, 6dB of power

• Each bit of ADC range takes up more data whether or not the signal is using these bits

• Therefore – it’s inefficient to throw bits at the problem outside of processing applications that need or benefit from having a wide dynamic range signal

• E.g. Novatel 7 series receivers have 8 bit quantization but only turn it on when requested for RFI mitigation, otherwise they use 4 bits to save energy

• Instead we need to employ what is called ’gain control’ to feed back from the digitized signal to the analog gain levels

• Dynamic range considerations map back to every stage of the design

• IP3 etc. Of first gain stage

• Maximum power handling of components (SAWs and LNA)

• Representation range of the ADCs

• Gain Control and feedback to use a VGA

• The MAX2120 mixer chip includes a VGA with a 70 dB analog linear range

• Also 15dB of digital control range at the baseband, for a combined 85dB

• Probably not feasible to use the full range, but still a good start

• System block diagram14

Quantization concepts and requirements - 3 of 3

15

• System automation, and updated hardware capabilities

Hardware: Reconfigurable multiband front-end.

Cloud Storage, Archiving and Retrieval

Hardware: Embedded computer module (COTS)

Software: Online monitoring, analysis and

notification. Periodic archiving and reporting.

Power In (<90W)

GNSS Antenna

USB3

Ethernet

Notifications(e.g. Email)

User configuration options

USB3LNA,

Splitter

SAW, E1/L1/G1

SAW, E5/L2/E6

LNA, Splitter

LNA, Splitters

RF Power Meter A

RF Power Meter B

VGA, Mixer, LPF 1

VGA, Mixer, LPF 2

VGA, Mixer, LPF 3

VGA, Mixer, LPF 4

8x ADC FPGAUSB3 FIFO

OCXO,Clocking

Other Low Level Interfaces

RF via USB3

Other Low LevelInterfaces to FPGA

i.MX8SOM

-

Detection, and pre-

processingsoftware

PCIe to SATA2 IC

PCIe SATA2SATA2

SSD

Keyboard/Mouse(USB2)

Monitor (HDMI) EthernetInterface

RGMIINotifications(e.g. Email)

Raw and processed data

Indicator LEDs, and Buttons

Design Evolution - Concept

• First version powered up and ran code

• Now in the process of implementing firmware

• Why not just buy an off-the-shelf front-end?

• A few small reasons

• 1) None have integrated power level measurement for environment

characterization and triggering

• 2) Onboard oscillator and clock generators need to be low phase noise

components for GNSS signals

• 3) GNSS Pre-filtering /Sensitivity to adjacent band signals:

• Front-ends like HackRF, bladeRF, and LimeSDR focus on wide bandwidth

• This makes sensitive pre-triggering difficult and pushes up false alarm rates

• 4) Many off the shelf solutions use fractional-N PLLs in their mixers

• Can introduce large residual code-carrier divergence

• Deployment plans...16

Design Evolution - Hardware

• Multiple locations in Norway and Europe (e.g. research

facilities at ESTEC and NLR).

• Several sites to be operated by the Norwegian Public

Roads Administration. SINTEF monitors will be co-

located with monitoring equipment deployed by Nkom.

17

Deployment plans

Patterødkrysset(Busiest intersection in Norway)

E8 Kilpisjärvi-SkibotnRoad used for autonomous testing

• Starting next year we hope to have phased array based RFI detectors which provide bearing

information to the host system

• These will be tested for drones based detection and tracking of GNSS RFI sources

• I want the drones to be able to ’remove’ the source, but unlikely to get HMS approval

18

Future activities

• If GNSS based road pricing is adoped there will very likely be a large spike in RFI events

• It produces a financial incentive

• It will be necessary to have a comittment to both prevention and response

• Prevent jamming equipment from entering the country

• The credible ability to rapidly detect and localize jamming

19

Policy outlook

Teknologi for et bedre samfunn