Assessing Spoofer Impact on GNSS Receivers: Tracking Loops

2.1 Dynamics

Throughout the paper,${\eta }_a={[{\tau }_a,{\theta }_a,f_a]}^T$ denotes the dynamic parameters of the authentic signal, which include the authentic code delay, carrier phase, and carrier frequency, whereas C_a represents the received power of the authentic signal. Similarly, ${\eta }_s={[{\tau }_s,{\theta }_s,f_s]}^T$ denotes the dynamic parameters of the spoofing signal, comprising the spoofing code delay, carrier phase, and carrier frequency, and C_s represents the received power of the spoofing signal. The relative dynamic between the authentic and spoofing signals is defined as $\Delta \eta ={\eta }_s-{\eta }_a={[\Delta \tau ,\Delta \theta ,\Delta f]}^T$, and the relative power is expressed as $\Delta g=C_s/C_a$. These relative parameters are gathered in $\Delta v={[\Delta {\eta }^T,\Delta g]}^T$. All parameters are continuous and time-varying. It is important to note that the carrier phase and carrier frequency are related as follows:

$\begin{array}{ccc}{f}_a=\frac{1}{2\pi }\frac{d{\theta }_a}{dt},& f_s=\frac{1}{2\pi }\frac{d{\theta }_s}{dt},& \Delta f=\frac{1}{2\pi }\frac{d\Delta \theta }{dt}\end{array}$ 1

Additionally, considering the sampling induced by the correlator (with the integration time T_i as the sampling period), we denote ψ[k] as the dynamic parameters evaluated at the midpoint of the k-th integration interval [kT_i,(k+1)T_i], defined as ψ[k]=ψ((k + 0.5)T_i), where $\psi \in \{{\eta }_a,{\eta }_s,\Delta \eta ,C_a,C_s,\Delta g\}$.

Finally, we define the nominal tracking error ε_η[k] as the difference between the authentic parameters η_a[k] and the estimated parameters $\hat{\eta }\left[k\right]={\left[\hat{\tau }\right[k],\hat{\theta }[k],\hat{f}[k\left]\right]}^T$ at epoch k as follows:

${\epsilon }_{\eta }\left[k\right]=\left[\begin{array}{c}{\epsilon }_{\tau }\left[k\right]\\ {\epsilon }_{\theta }\left[k\right]\\ {\epsilon }_f\left[k\right]\end{array}\right]\triangleq {\eta }_a\left[k\right]-\hat{\eta }\left[k\right]=\left[\begin{array}{c}{\tau }_a\left[k\right]-\hat{\tau }\left[k\right]\\ {\theta }_a\left[k\right]-\hat{\theta }\left[k\right]\\ f_a\left[k\right]-\hat{f}\left[k\right]\end{array}\right]$ 2

including code ε_τ, phase ε_θ, and frequency ε_f nominal tracking errors. For the sake of clarity, the parameter k is omitted throughout the remainder of this article when not necessary.

2.2 Correlator Output Model

The model of the correlator output under spoofing was previously derived by Hussong et al. (2023) as a function of the relative parameters Δv. Specifically, for any $\eta ={[\tau ,\theta ,f]}^T$, we have the following:

$\Lambda (\eta ,\Delta \nu )={\Lambda }_a\left(\eta \right)+{\Lambda }_s(\eta ,\Delta \nu )+{\Lambda }_{n,a}+{\Lambda }_{n,s}$ 3

where Λ_n,a and Λ_n,s represent the random contributions of the authentic and spoofing signals at the correlator output, including both additive white Gaussian noise (AWGN) and inter-system GNSS interference. These random contributions, Λ_n,a and Λ_n,s, are modeled as two independent, circular complex Gaussian stochastic processes (also independent of η), as demonstrated by Ghizzo et al. (2025). Their properties are not further detailed in this paper but can be found in the work by Ghizzo et al. (2024).

Additionally, Λ_a and Λ_s represent the contributions of the authentic and spoofing signals at the correlator output, expressed as follows:

$\begin{array}{ccc}{\Lambda }_a\left(\eta \right)& =& \begin{array}{cc}\sqrt{C_a}{d}_k{\zeta }_{\tau }\left(\tau \right){\zeta }_f\left(f\right)e^{j\theta },& {\Lambda }_s(\eta ,\Delta \nu )\end{array}\\ & =& \sqrt{\Delta g}{\Lambda }_a(\eta +\Delta \eta )=\sqrt{\Delta g{C}_a}{d}_k{\zeta }_{\tau }(\tau +\Delta \tau ){\zeta }_f(f+\Delta f)e^{j(\theta +\Delta \theta )}\end{array}$ 4

where d_k is the navigation message bit. ζ_τ and ζ_f are the code and frequency synchronization mismatch functions, given as follows:

$\begin{array}{cc}{\zeta }_{\tau }\left(\tau \right)\triangleq \underset{-B/2}{\overset{B/2}{\int }}{G}_c\left(f\right)e^{j2\pi f\tau }df,& {\zeta }_f\left(f\right)\triangleq \sin c\left(\pi f{T}_i\right)\end{array}$ 5

with G_c(f) denoting the power-normalized power spectral density (PSD) of the local replica, as defined by Betz and Kolodziejski (2009, Equation (1)), and B representing the equivalent radiofrequency front-end (RFFE) double-sided bandwidth. Owing to the shape of the synchronization mismatch functions in Equation (5), we refer to Λ_a and Λ_s as the “authentic peak” and “spoofing peak,” respectively, throughout the remainder of this paper.

Typically, GNSS receivers include at least three correlators: the early (Λ_E), prompt (Λ_P), and late (Λ_L) correlators. Under spoofing, these correlators are expressed as follows:

$\begin{array}{ccc}{\Lambda }_E({\eta }_a-\hat{\eta },\Delta \nu )& =& {\Lambda }_E({\epsilon }_{\eta },\Delta \nu )=\Lambda ({\epsilon }_{\eta }-\frac{c_{\tau }}{2}{e}_1,\Delta \nu )\\ & =& {\Lambda }_a({\epsilon }_{\eta }-\frac{c_{\tau }}{2}{e}_1)+{\Lambda }_s({\epsilon }_{\eta }-\frac{c_{\tau }}{2}{e}_1,\Delta \nu )+{\Lambda }_{E,n,a}+{\Lambda }_{E,n,s}\\ {\Lambda }_P({\eta }_a-\hat{\eta },\Delta \nu )& =& {\Lambda }_P({\epsilon }_{\eta },\Delta \nu )=\Lambda ({\epsilon }_{\eta },\Delta \nu )\\ & =& \begin{array}{ccc}{\Lambda }_a\left({\epsilon }_{\eta }\right)& +{\Lambda }_s({\epsilon }_{\eta },\Delta \nu )& +{\Lambda }_{P,n,a}+{\Lambda }_{P,n,s}\end{array}\\ {\Lambda }_L({\eta }_a-\hat{\eta },\Delta \nu )& =& {\Lambda }_L({\epsilon }_{\eta },\Delta \nu )=\Lambda ({\epsilon }_{\eta }+\frac{c_{\tau }}{2}{e}_1,\Delta \nu )\\ & =& {\Lambda }_a({\epsilon }_{\eta }+\frac{c_{\tau }}{2}{e}_1)+{\Lambda }_s({\epsilon }_{\eta }+\frac{c_{\tau }}{2}{e}_1,\Delta \nu )+{\Lambda }_{L,n,a}+{\Lambda }_{L,n,s}\end{array}$ 6

where c_τ denotes the early-late delay spacing and e₁=[1,0,0]^T. The terms Λ_E,n,a, Λ_P,n,a, and Λ_L,n,a represent the authentic random contributions, whereas Λ_E,n,s, Λ_P,n,s, and Λ_L,n,a correspond to the spoofing random contributions. It is important to note that, given the definition in Equation (2), the early, prompt, and late correlators can be expressed either as a function of $\hat{\eta }$ or ε_η.

2.3 Classification of Spoofing Impact

Leveraging the orthogonal properties of GNSS pseudorandom noise sequences, Hussong et al. (2023) categorized the impact of spoofing on the correlator output model in Equation (3) into four spoofing-induced situations based on the relative parameters Δv : nominal, induced spoofing, induced jamming, and induced multipath. It is important to note that, although these situations are labeled similarly to other types of interference, they are in fact subcategories of spoofing impact.

2.3.1 Nominal Situation

The nominal situation serves as a reference scenario in which the spoofing impact is not considered (or is considered negligible). Thus, in this situation, both the spoofing GNSS peak and re-radiated noise are neglected, as illustrated in Figure 2(a). Under these conditions, the correlator output in Equation (3) can be expressed (for the early, prompt, and late correlators) for any $\eta ={[\tau ,\theta ,f]}^T$ as follows:

${\Lambda }^{\left(N\right)}\left(\eta \right)={\Lambda }_a\left(\eta \right)+{\Lambda }_{n,a}$ 7

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 2

Illustration of the classification of spoofing impact on correlators (a) Nominal (b) Induced jamming (c) Induced spoofing (d) Induced multipath The points Λ_E, Λ_P, and Λ_L indicate the early, prompt, and late correlators. The blue and red horizontal lines illustrate the authentic and spoofing noise floor.

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 3

Architecture of a PLL-assisted DLL tracking loop

It is worth noting that in this situation, Λ^(Ν) is independent of ∆v.

3.1 DLL Discriminator

The DLL discriminator estimates the code tracking error between the received signal and the local replica. Numerous implementations of code discriminators have been presented by Kaplan and Hegarty (2017). In this paper, we consider the non-coherent early minus late power (NEMLP), defined as follows:

$d_{\tau }({\eta }_a-\hat{\eta },\Delta \nu )=\frac{1}{\hat{C}{K}_{\tau }}({\left|{\Lambda }_E({\eta }_a-\hat{\eta },\Delta \nu )\right|}^2-{\left|{\Lambda }_L({\eta }_a-\hat{\eta },\Delta \nu )\right|}^2)$ 10

where Λ_Ε and Λ_L are the early and late correlator outputs, as defined in Equation (6),$\hat{C}$ is the received power estimate, and K_τ is the normalization factor to achieve a unity slope, as expressed by Betz and Kolodziejski (2009, Equation (38)).

3.2 Phase Closed-Loop Model

In a digital tracking loop, the code (DLL) and carrier (PLL) phase estimates $\hat{\varphi }\in \{\hat{\tau },\hat{\theta }\}$ are updated at each epoch k by the previously filtered discriminator output $\widehat{\delta \varphi }$[k-1] (Stephens & Thomas, 1995). Moreover, considering a carrier-aiding operation (i.e., exploiting the correlation between the code τ_a and the carrier phase θ_a to mitigate most of the input dynamics in the DLL using the PLL measurements), as detailed by Kaplan and Hegarty (2017), the code and phase updates can be expressed as follows:

$\{\begin{array}{cc}\hat{\tau }\left[k\right]=\hat{\tau }\left[k-1\right]+T_i\left(\widehat{\delta \tau }\left[k-1\right]\right)-\beta \widehat{\delta \theta }\left[k-1\right]& \left(\mathrm{DLL}\right)\\ \hat{\theta }\left[k\right]=\hat{\theta }\left[k-1\right]+T_i\widehat{\delta \theta }\left[k-1\right]& \left(\mathrm{PLL}\right)\end{array}$ 17

with $\widehat{\delta \tau }$ and $\widehat{\delta \theta }$ denoting the code and phase filter outputs, as defined in Equation (14). The parameter β is the scaling factor between the code chip rate and the L-band carrier frequency, as defined by Kaplan and Hegarty (2017). By substituting Equation (14) into Equation (17), the closed-loop model can be expressed in the z-transform domain as follows:

$\{\begin{array}{cc}\hat{\tau }\left(z\right)+\beta \hat{\theta }\left(z\right)\hspace{0.17em}=\frac{z^{-1}}{1-z^{-1}}{T}_i{F}_{\tau }\left(z\right)D_{\tau }\left({\eta }_a\left(z\right)-\hat{\eta }\left(z\right),\Delta \nu \left(z\right)\right)& \left(DLL\right)\\ \hat{\theta }\left(z\right)\hspace{0.17em}=\frac{z^{-1}}{1-z^{-1}}{T}_i{F}_{\theta }\left(z\right)D_{\theta }\left({\eta }_a\left(z\right)-\hat{\eta }\left(z\right),\Delta \nu \left(z\right)\right)& \left(PLL\right)\end{array}.$ 18

Therefore, the dynamic behavior of the tracking loops can be modeled by considering the system in Equation (18) of two difference equations, each modeling the DLL or the PLL, with the solutions being $\hat{\tau }$ and $\hat{\theta }$. This system is referred to as the closed-loop model. The PLL-aiding-DLL operation induces a phase term $\beta \hat{\theta }$ in the DLL equation. It is important to note that the solutions $\hat{\tau }$ and $\hat{\theta }$ are included in the discriminator outputs D_ϕ (within $\hat{\eta }$), and thus, the linearity and interdependence between the two equations are directly linked to the discriminator function, as further explained below. Moreover, in $\hat{\eta }$, $\hat{f}$ and $\hat{\theta }$ are related by $\hat{f}=\frac{1}{2\pi }{\delta }^{\left(1\right)}\hat{\theta }$, indicating that any dependence on the frequency $\hat{f}$ implies a dependence on the PLL.

It is worth noting that the term T_iz⁻¹/(1−z⁻¹) in Equation (18) corresponds to the NCO transfer function (integrator).

4.1 Equivalent Dynamic Definition

The equivalent tracked dynamic, denoted ${\varphi }_{\mathrm{eq}}\in \{{\tau }_{\mathrm{eq}},{\theta }_{\mathrm{eq}}\}(\hspace{0.17em}\mathrm{and}{\eta }_{\mathrm{eq}}={[{\tau }_{\mathrm{eq}},{\theta }_{\mathrm{eq}},f_{\mathrm{eq}}]}^T)$, represents the signal dynamic observed by the receiver when tracking the received signal, considering both signal and implementation distortion. In the presence of interference, this dynamic can differ from the authentic dynamic η_a. It is worth noting that this dynamic may not always have a physical interpretation, but provides insights into the behavior of the tracking system, accounting for any system distortions, e.g., steady-state errors, phase ambiguity, or distortion in discriminator functions.

We define the equivalent tracking errors ε_ϕ,eq as the errors between the equivalent ϕ_eq and the estimated parameters $\hat{\varphi }$ as follows:

$\begin{array}{cc}{\epsilon }_{n,\mathrm{eq}}\triangleq {\eta }_{\mathrm{eq}}-\hat{\eta }=\left[\begin{array}{c}{\tau }_{\mathrm{eq}}-\hat{\tau }\\ {\theta }_{\mathrm{eq}}-\hat{\theta }\\ f_{\mathrm{eq}}-\hat{f}\end{array}\right]=\left[\begin{array}{c}{\epsilon }_{\tau ,\mathrm{eq}}\\ {\epsilon }_{\theta ,\mathrm{eq}}\\ {\epsilon }_{f,\mathrm{eq}}\end{array}\right]& \left(\mathrm{and}{\epsilon }_{\varphi ,\mathrm{eq}}\triangleq {\varphi }_{\mathrm{eq}}-\hat{\varphi }\right)\end{array}$ 20

Finally, we define the relative equivalent dynamic $\Delta {\eta }_{\mathrm{eq}}={[\Delta {\tau }_{\mathrm{eq}},\Delta {\theta }_{\mathrm{eq}},\Delta f_{\mathrm{eq}}]}^T(\hspace{0.17em}\text{and}\hspace{0.17em}\Delta {\varphi }_{\mathrm{eq}}\in \{\Delta {\tau }_{\mathrm{eq}},\Delta {\theta }_{\mathrm{eq}}\left\}\right)$ as the difference between the equivalent and authentic dynamics:

$\begin{array}{cc}\Delta {\eta }_{\mathrm{eq}}\triangleq {\eta }_{\mathrm{eq}}-{\eta }_a& \left(\mathrm{and}\Delta {\varphi }_{\mathrm{eq}}\triangleq {\varphi }_{\mathrm{eq}}-{\varphi }_a\right)\end{array}$ 21

4.2 Considered Frames

In this article, a frame defines the coordinate system in which the solution of the closed-loop model is expressed.

• Estimate Frame: The estimate frame is the basic frame in which the solution of the closed-loop model is $\hat{\eta }$. The closed-loop model is given by Equation (18).

• Nominal Frame: In the nominal frame, the solution is expressed relative to the authentic dynamic η_a. The solution of the closed-loop model in the nominal frame becomes the nominal tracking error ε_η. This frame enables a determination of the nominal tracking error and quantification of the interference distortion.

• Equivalent Frame: In the equivalent frame, the solution is expressed relative to the equivalent dynamic η_eq. The solution of the closed-loop model in this frame becomes the equivalent tracking error ε_η,eq. This frame enables a computation of the system’s SE and an analysis of the dynamic behavior.

It is worth noting that the closed-loop model and its solution are equivalent across the three frames. Therefore, the system can be studied in any one of the frames, and the solution can be translated depending on the desired quantity. The different frames are related by a change of coordinates through a mathematical transformation, as depicted in Figure 4. The various transformations are expressed for any $\eta ={[\tau ,\theta ,f]}^T$ as follows:

$\begin{array}{ccc}{{\rm T}}_{0\to \mathrm{eq}}\left(\eta \right)={\eta }_{\mathrm{eq}}-\eta ,& T_{0\to a}\left(\eta \right)={\eta }_a-\eta ,& T_{a\to \mathrm{eq}}\left(\eta \right)=\Delta {\eta }_{\mathrm{eq}}\end{array}+\eta$ 22

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 4

Illustration of the closed-loop model frames and frame transformations The blue curves represent the closed-loop solution at lock in each frame, as detailed in Section 4.4.

4.3 Equivalent Closed-Loop Model

The equivalent closed-loop model (i.e., the closed-loop model expressed in the equivalent frame) is obtained by applying the transformation $T_{0\to eq}$ to Equation (18) as follows:

$\{\begin{array}{ccc}{\epsilon }_{\tau ,\mathrm{eq}}+\beta {\epsilon }_{\theta ,\mathrm{eq}}& ={\tau }_{\text{ca}}-\frac{z^{-1}}{1-z^{-1}}{T}_i{F}_{\tau }\left(z\right)D_{\tau }({\epsilon }_{n,\mathrm{eq}}-\Delta {\eta }_{\mathrm{eq}},\Delta \nu )& \left(\mathrm{DLL}\right)\\ {\epsilon }_{\theta ,\mathrm{eq}}& ={\theta }_{\mathrm{eq}}-\frac{z^{-1}}{1-z^{-1}}{T}_i{F}_{\theta }\left(z\right)D_{\theta }({\epsilon }_{\eta ,\mathrm{eq}}-\Delta {\eta }_{eq},\Delta \nu )& \left(\mathrm{PLL}\right)\end{array}$ 23

with ${\tau }_{ca}={\tau }_{eq}+\beta {\theta }_{eq}$ representing the carrier-aided tracking equivalent delay. The equivalent closed-loop model in Equation (23) is equivalent to Equation (18), except that the solution is now ε_ϕ,eq. The equivalent closed-loop model can also be expressed in the time domain as follows:

$\{\begin{array}{c}{\delta }^{\left(N_{\tau }\right)}{\epsilon }_{\tau ,\text{eq}}\left[k\right]+\beta {\delta }^{\left(N_{\tau }\right)}{\epsilon }_{\theta ,\text{eq}}\left[k\right]={\delta }^{\left(N_{\tau }\right)}{\tau }_{ca}\left[k\right]-\sum _{n=0}^{N_{\tau }-1}{\kappa }_{\tau ,n}{\delta }^{\left(n\right)}{d}_{\tau }({\epsilon }_{\eta ,\text{eq}}[k-1]-\Delta {\eta }_{\text{eq}}[k-1],\Delta \nu [k-1])\\ {\delta }^{\left(N_{\theta }\right)}{\epsilon }_{\theta ,\text{eq}}\left[k\right]={\delta }^{\left(N_{\theta }\right)}{\theta }_{\text{eq}}\left[k\right]-\sum _{n=0}^{N_{\theta }-1}{\kappa }_{\theta ,n}{\delta }^{\left(n\right)}{d}_{\theta }({\epsilon }_{\eta ,\text{eq}}[k-1]-\Delta {\eta }_{\text{eq}}[k-1],\Delta \nu [k-1])\end{array}$ 24

4.4 Locked State Definition

The locked state defines a solution of the system in which synchronization with the observed signal dynamics ϕ_eq is successfully established and maintained. In this state, the system can be considered stationary within the equivalent frame. Throughout this work, the locked state is denoted by a superscript l, such as in ${\hat{\varphi }}^l$ or ${\epsilon }_{\varphi }^l$. The locked state can be expressed as a function of the equivalent tracking error ε_ϕ,eq, satisfying the following conditions (G. A. Leonov et al., 2015):

1. Equilibrium Condition: The code and carrier phase errors at the locked state ${\epsilon }_{\varphi ,\mathrm{eq}}^l$ are constant, and their digital derivatives are zero for all k ∈ ℤ:

   $\begin{array}{ccc}{\epsilon }_{\varphi ,\mathrm{eq}}^l\left[k-1\right]={\epsilon }_{\varphi ,\mathrm{eq}}^l\left[k\right]& or& \delta {\epsilon }_{\varphi ,\mathrm{eq}}^l\end{array}=0$ 25

   Thus, the equilibrium condition can also be expressed for all integers n > 0 as follows:

   $\begin{array}{ccc}{\epsilon }_{\varphi ,\mathrm{eq}}^l[k-n]={\epsilon }_{\varphi ,\mathrm{eq}}^l\left[k\right]& or& {\delta }^{\left(n\right)}\end{array}{\epsilon }_{\varphi ,\mathrm{eq}}^l=0$ 26

2. Stability Condition: The system can maintain the locked state after a small perturbation. This condition is related to the discriminator slope, as described by Gardner (2005, p.185), and is given by the following:

   $\frac{\partial d_{\varphi }({\epsilon }_{\eta ,\mathrm{eq}}^l-\Delta {\eta }_{\mathrm{eq}},\Delta \nu )}{\partial {\epsilon }_{\varphi ,\mathrm{eq}}}>0$ 27

Furthermore, Leonov and Kuznetsov (2014) demonstrated that if the low-pass filter is both controllable and observable (as assumed from its design), only the system’s SE satisfy the locked state conditions in Equations (25), (26), and (27). This feature ensures that the filter states remain constant in the locked state, resulting in the equilibrium condition for the filter states, expressed as follows:

$\begin{array}{cc}\forall n\in {\mathbb{N}}^{\ast },& {\delta }^{\left(n\right)}{d}_{\varphi }({\epsilon }_{\eta ,\mathrm{eq}}^l-\Delta {\eta }_{\mathrm{eq}},\Delta \nu )\end{array}=0$ 28

where ℕ^∗ is a set of non-zero natural integers.

4.5 Derivation of the SE Condition

The system’s SE can be expressed by considering the locked state conditions given in Equations (26), (27), and (28), within the equivalent closed-loop model described by Equation (24). The resulting computation yields a system of three unknowns, ${\epsilon }_{\eta ,\text{eq}}^l$, and two equations (corresponding to the DLL and PLL). To render the system solvable, a third equation is introduced, representing the phase-frequency equilibrium. Additionally, the stability condition in Equation (27) imposes three supplementary constraints. The detailed computation is presented in Appendix A and leads to the following:

$\{\begin{array}{ccc}{d}_{\tau }({\epsilon }_{\eta ,\mathrm{eq}}^l-\Delta {\eta }_{\mathrm{eq}},\Delta \nu )=k_{\tau },& d_{\theta }({\epsilon }_{\eta ,\mathrm{eq}}^l-\Delta {\eta }_{\mathrm{eq}},\Delta \nu )=k_{\theta },& {\chi }_f({\epsilon }_{\eta ,\mathrm{eq}}^l-\Delta {\eta }_{\mathrm{eq}},\Delta \nu )=0\\ \frac{\partial d_{\tau }({\epsilon }_{\eta ,\mathrm{eq}}^l-\Delta {\eta }_{\mathrm{eq}},\Delta \nu )}{\partial {\epsilon }_{\tau ,\mathrm{eq}}}>0,& \frac{\partial d_{\theta }({\epsilon }_{\eta ,\mathrm{eq}}^l-\Delta {\eta }_{\mathrm{eq}},\Delta \nu )}{\partial {\epsilon }_{\theta ,\mathrm{eq}}}>0,& \frac{\partial {\chi }_f({\epsilon }_{\eta ,\mathrm{eq}}^l-\Delta {\eta }_{\mathrm{eq}},\Delta \nu )}{\partial {\epsilon }_{f,\mathrm{eq}}}>0\end{array}$ 29

Here, k_τ and k_θ are the steady-state errors, which remain constant over time, and are expressed as follows:

$\begin{array}{cc}{k}_{\tau }=\frac{{\delta }^{\left(N_{\tau }\right)}{\tau }_{\text{ca}}}{{\kappa }_{\tau ,0}},& k_{\theta }=\frac{{\delta }^{\left(N_{\theta }\right)}{\theta }_{\text{eq}}}{{\kappa }_{\theta ,0}}\end{array}$ 30

${\chi }_f$ is a function depicting both PLL phase and frequency equilibrium, as follows:

$\begin{array}{cc}2\pi T_i{\chi }_f\left({\epsilon }_{\eta },\Delta \nu \right)=\arg \left\{{\Lambda }_P\left({\epsilon }_{\eta }\right[k],\Delta \nu [k\left]\right)\right\}-\arg \left\{{\Lambda }_P({\epsilon }_{\eta }[k-1],\Delta \nu [k-1])\right\}& \left(\mathrm{mod}\pi ,\frac{\pi }{2}\right)\end{array}$ 31

The solutions of the closed-loop model and its SE can be expressed in any reference frame (Section 4.2). Specifically, the SE can be expressed in the nominal frame by applying the transformation $T_{\mathrm{eq}\to a}=T_{a\to \mathrm{eq}}^{-1}$ to Equation (31) as follows:

$\{\begin{array}{ccc}{d}_{\tau }\left({\epsilon }_{\eta }^l,\Delta \nu \right)=k_{\tau },& d_{\theta }\left({\epsilon }_{\eta }^l,\Delta \nu \right)=k_{\theta },& {\chi }_f\left({\epsilon }_{\eta }^l,\Delta \nu \right)=0\\ \frac{\partial d_{\tau }\left({\epsilon }_{\eta }^l,\Delta \nu \right)}{\partial {\epsilon }_{\tau }}>0,& \frac{\partial d_{\theta }\left({\epsilon }_{\eta }^l,\Delta \nu \right)}{\partial {\epsilon }_{\theta }}>0,& \frac{\partial {\chi }_f\left({\epsilon }_{\eta }^l,\Delta \nu \right)}{\partial {\epsilon }_f}>0\end{array}$ 32

It is worth noting that the system in Equation (32) may have multiple valid solutions, each representing a potential SE of the tracking loops, and thus a possible equivalent tracked dynamic ϕ_eq.

4.6 Summary of the Locked-State-Based Resolution Strategy

To summarize, this section has proposed a method for analyzing the closed-loop model in Equation (18) by translating the model into an equivalent, motionless frame in which the system is stationary at lock. Analysis of the system in this equivalent frame enables a determination of its SE, expressed in Equation (29), and provides insight into its dynamic behavior, as discussed in Section 4.5.1.

Specifically, the equivalent dynamic ϕ_eq is computed from the system’s SE (Equation (32)) at perfect lock (k_ϕ = 0) within the nominal frame. Subsequently, the stress error k_ϕ, as defined in Equation (30), indicates whether the system converges (Section 4.5.1). For a convergent system, the equivalent tracking error can be further analyzed to determine whether the system is in lock or in a transient response state.

5.1 Nominal Situation

First, the tracking loops are analyzed in the nominal situation as a reference. In this nominal situation, neglecting the noise contribution, the correlator outputs in Equation (6) can be simplified as follows:

${\Lambda }_E^{\left(N\right)}\left({\epsilon }_{\eta }\right)={\Lambda }_a({\epsilon }_{\eta }-\frac{c_{\tau }}{2}{e}_1),{\Lambda }_P^{\left(N\right)}\left({\epsilon }_{\eta }\right)={\Lambda }_a\left({\epsilon }_{\eta }\right),{\Lambda }_L^{\left(N\right)}\left({\epsilon }_{\eta }\right)={\Lambda }_a({\epsilon }_{\eta }+\frac{c_{\tau }}{2}{e}_1)$ 34

5.1.1 DLL Discriminator

The output of the DLL discriminator can be expressed by substituting Equation (34) into Equation (10) as follows:

$d_{\tau }^{\left(N\right)}\left({\epsilon }_{\eta }\right)=\frac{C_a}{\hat{C}{K}_{\tau }}{\zeta }_f{\left({\epsilon }_f\right)}^2{Z}_{\tau }\left({\epsilon }_{\tau }\right)$ 35 where:

$Z_{\tau }\left({\epsilon }_{\tau }\right)\triangleq {\zeta }_{\tau }{({\epsilon }_{\tau }-\frac{c_{\tau }}{2})}^2-{\zeta }_{\tau }{({\epsilon }_{\tau }+\frac{c_{\tau }}{2})}^2$ 36

The discriminator depends on both ε_τ and ε_f. However, the discriminator can be factorized into separate terms involving ε_τ and ε_f. For small values of ε_f, the term ζ_f(ε_f)² acts as an attenuation factor and does not affect the zero of the discriminator, which is determined by Z_τ. The discriminator d_τ is plotted in Figure 5(a) for an infinite RFFE bandwidth and a bandwidth of 8 MHz, illustrating a linear region as a function of ε_τ, spanning the range $[-c_{\tau }/2,c_{\tau }/2]$ around the zero at ε_τ = 0.

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 5

DLL and PLL discriminators in the nominal situation (c_τ= 0.1 chip and T_i = 20 ms) (a) DLL discriminator (b) PLL discriminator (c) PLL differential function The blue line represents the DLL discriminator for a finite RFFE bandwidth, whereas the PLL discriminator remains independent of the RFFE bandwidth.

5.2 Spoofing-Induced Jamming Situation

As shown in Section 2.3, the spoofer’s impact on the correlator output in the induced-jamming situation is primarily limited to the retransmitted noise. Therefore, disregarding the noise contribution, the correlator output under the induced-jamming situation is identical to that of the nominal situation. As a result, the loop discriminators, along with their linear and independence properties, SE, and dynamic behavior, are equivalent to those in the nominal situation, as presented in Section 5.1.

5.3 Spoofing-Induced Spoofing Situation

In the induced-spoofing situation, disregarding the noise contribution, the early, prompt, and late correlator outputs in Equation (6) can be simplified as follows:

$\begin{array}{ccc}{\Lambda }_E^{\left(s\right)}({\epsilon }_{\eta },\Delta \nu )& =& {\Lambda }_s({\epsilon }_{\eta }-\frac{c_{\tau }}{2}{e}_1,\Delta \nu ),\\ {\Lambda }_P^{\left(s\right)}({\epsilon }_{\eta },\Delta \nu )& =& {\Lambda }_s({\epsilon }_{\eta },\Delta \nu ),\\ {\Lambda }_L^{\left(s\right)}({\epsilon }_{\eta },\Delta \nu )& =& {\Lambda }_s({\epsilon }_{\eta }+\frac{c_{\tau }}{2}{e}_1,\Delta \nu )\end{array}$ 40

As shown in Equation (4), the spoofing peak ∧_s retains the same shape as the authentic peak ∧_a, but is shifted by Δη and amplified by $\sqrt{\Delta g}$. The discriminator outputs d_τ, d_θ, and ${\chi }_f$ can be computed through straightforward calculations, yielding results similar to those in Section 5.1, but shifted by Δη. Specifically, the system under the induced-spoofing situation can thus be expressed as follows:

$\begin{array}{cccc}{\epsilon }_{\tau }^{l\left(s\right)}=-\Delta \tau ,& {\epsilon }_f^{l\left(s\right)}=-\Delta f+\frac{P^{\prime }}{2T_i},& {\epsilon }_{\theta }^{l\left(s\right)}=-\Delta \theta +P\pi ,& \forall P,P^{\prime }\in \mathbb{Z}\end{array}$ 41

The dynamic behavior of the loop is then very similar to that of the nominal situation, except that the tracked dynamic ϕ_eq corresponds to the spoofing dynamic ϕ_s (plus any potential PLL ambiguity). Finally, the spoofing signal does not affect the linearity or independence of the loops. Therefore, for small equivalent tracking errors, the linear approximation remains valid.

5.4 Spoofing-Induced Multipath Situation

In the induced-multipath situation, disregarding the noise contribution, the early, prompt, and late correlator outputs in Equation (6) can be simplified as follows:

$\begin{array}{ccc}{\Lambda }_E^{\left(M\right)}({\epsilon }_{\eta },\Delta \nu )& =& {\Lambda }_a({\epsilon }_{\eta }-\frac{c_{\tau }}{2}{e}_1)+{\Lambda }_s({\epsilon }_{\eta }-\frac{c_{\tau }}{2}{e}_1,\Delta \nu )\\ {\Lambda }_P^{\left(M\right)}({\epsilon }_{\eta },\Delta \nu )& =& {\Lambda }_a\left({\epsilon }_{\eta }\right)+{\Lambda }_s({\epsilon }_{\eta },\Delta \nu )\\ {\Lambda }_l^{\left(M\right)}({\epsilon }_{\eta },\Delta \nu )& =& {\Lambda }_a({\epsilon }_{\eta }+\frac{c_{\tau }}{2}{e}_1)+{\Lambda }_s({\epsilon }_{\eta }+\frac{c_{\tau }}{2}{e}_1,\Delta \nu )\end{array}$ 42

5.4.1 DLL Discriminator

The DLL discriminator output in the induced-multipath situation can be obtained by substituting Equation (42) into Equation (10):

$d_{\tau }^{\left(M\right)}({\epsilon }_{\eta },\Delta \nu )=\frac{C_a}{\hat{C}{K}_{\tau }}({\zeta }_f{\left({\epsilon }_f\right)}^2{Z}_{\tau }\left({\epsilon }_{\tau }\right)+\Delta g{\zeta }_f{\left({\epsilon }_f+\Delta f\right)}^2{Z}_{\tau }({\epsilon }_{\tau }+\Delta \tau )+2\sqrt{\Delta g}\cos \left(\Delta \theta \right){\zeta }_f\left({\epsilon }_f\right){\zeta }_f({\epsilon }_f+\Delta f)Z_{\Delta \tau }\left({\epsilon }_{\tau }\right))$ 43

with Z_τ as defined in Equation (36) and:

$Z_{\Delta \tau }\left({\epsilon }_{\tau }\right)\triangleq {\zeta }_{\tau }({\epsilon }_{\tau }-\frac{c_{\tau }}{2}){\zeta }_{\tau }({\epsilon }_{\tau }+\Delta \tau -\frac{c_{\tau }}{2})-{\zeta }_{\tau }({\epsilon }_{\tau }+\frac{c_{\tau }}{2}){\zeta }_{\tau }({\epsilon }_{\tau }+\Delta \tau +\frac{c_{\tau }}{2})$ 44

The DLL discriminator output in Equation (43) depends on both ε_τ and ε_f and cannot be assumed to be linear around its zeros with respect to ε_τ, as shown in Figure 6. Notably, the discriminator is influenced by the time-varying relative parameters Δν, causing its characteristics to change over time as Δν evolves. Among these parameters, the relative phase Δθ plays a significant role, as it can undergo large variations driven by the relative frequency Δ_f (Equation (1)).

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 6

Example of the DLL discriminator outputs in the induced-multipath situation (c_τ = 0.1 chip, T_i = 20 ms, Δg = 0.64, Δτ = 0.6 chip, Δf = 31 Hz, for $\Delta \theta /2\pi \in \{0,0.25,0.5,0.75\}$) (a) Δθ = 0 (b) Δθ = π/2 (c) $\Delta \theta =\pi \left(d\right)\Delta \theta =3\pi /2$ Colors represent the amplitude and sign of the discriminator output, while black lines indicate its zeros.

5.4.4 System SE

The system SE can be computed by substituting Equations (43), (45), and (47) into Equation (32). In this situation, the DLL and PLL discriminators are interdependent, which makes resolving the system more challenging. Nevertheless, because both Equation (43) and Equation (47) are independent of ε_θ, the code and frequency SE can be determined independently of the phase SE, as follows:

$\{\begin{array}{cc}{d}_{\tau }({\epsilon }_{\tau }^{l\left(M\right)},{\epsilon }_f^{l\left(M\right)},\Delta \nu )=0& {\chi }_f({\epsilon }_{\tau }^{l\left(M\right)},{\epsilon }_f^{l\left(M\right)},\Delta \nu )=0\\ \frac{\partial d_{\tau }({\epsilon }_{\tau }^{l\left(M\right)},{\epsilon }_f^{l\left(M\right)},\Delta \nu )}{\partial {\epsilon }_{\tau }}>0,& \frac{\partial {\chi }_f({\epsilon }_{\tau }^{l\left(M\right)},{\epsilon }_f^{l\left(M\right)},\Delta \nu )}{\partial \epsilon f}>0\end{array}$ 49

The phase SE is then computed by substituting the solution of Equation (49) into Equation (45):

$\begin{array}{cc}{\epsilon }_{\theta }^{l\left(M\right)}=-\frac{\Delta \theta }{2}+\arctan \left({\gamma }_{\Delta }({\epsilon }_{\tau }^{l\left(M\right)},{\epsilon }_f^{l\left(M\right)})\tan \left(\frac{\Delta \theta }{2}\right)\right)+p\pi ,& \forall p\in \mathbb{Z}\end{array}$ 50

An example of the resolution of Equation (49) is illustrated in Figure 7. The SE solution (blue points) corresponds to the intersection of the stable zeros of d_τ (black) and ${\chi }_f$ (red). The figure highlights the emergence of multiple SE points and their variations with respect to the relative parameters Δν.

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 7

Example of the code and frequency SE solution for (c_τ = 0.1 chip, T_i = 20 ms, Δg = 0.64, Δτ = 0.6 chip, Δf = 31 Hz, for $\Delta \theta /2\pi \in \{0,0.25,0.5,0.75\}$) (a) Δθ = 0 (b) Δθ = π/2 (c) Δθ = π (d) Δθ = 3π/2

The black lines represent the zeros of d_τ, and the red lines represent the zeros of ✗_f as functions of ε_τ and ε_f. The solid lines indicate stable zeros, whereas the dashed lines represent unstable zeros (stability condition in Equation (27)). Finally, the blue dots represent the possible SE that satisfy Equation (49).

In the literature, only the DLL equation of Equation (49) is considered, which is equivalent to examining the intersection of the zeros d_τ (black) at ε_f = 0 . It is worth noting that in a frequency-asynchronous case, this appoach does not allow for the computation of the correct convergence point or the consideration of all possible SE, thereby preventing the prediction of potential system bifurcations.

The solutions of Equation (49) are shown in Figures 8 and 9 for a set of Δτ, Δf, and $\Delta \theta \in [0,2\pi ]$. The figures illustrate the emergence of multiple SE and their variations with the relative phase Δθ. For each set of relative parameters, two primary clusters of interest are identified: one centered around the authentic dynamic (ε_η = 0) and one centered around the spoofing dynamic $({\epsilon }_{\eta }=-\Delta \eta )$. These clusters are referred to as the authentic and the spoofing SE cluster, respectively. Additionally, owing to the inherent PLL ambiguity, secondary clusters appear periodically, separated by intervals of 1/2T_i.

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 8

Code and frequency SE in the induced-multipath situation, represented in the nominal frame (c_τ = 0.1 chip, T_i = 20 ms, Δg = 0.64, Δτ = 0.6 chip) (a) Δf = 0 Hz (b)Δf = 12 Hz (c) Δf = 25 Hz (d) Δf = 31 Hz

The colors represent the value of Δθ ∈ [0, 2π], and the black crosses denote the SE of the nominal situation, as defined in Equation (39).

In particular, Figure 8(a) illustrates the frequency-synchronous situation (Δf = 0), which is commonly studied in the literature (Kim et al., 2012; Wang et al., 2023). In this case, the code SE is independent of the frequency SE, with ${\epsilon }_f^l=P\text{'}/2T_i$, and ${\epsilon }_{\tau }^l$ oscillates with Δθ within the MEE. The PLL ambiguity induces a periodicity of 25 Hz (1/2T_i) in the authentic and spoofing clusters.

Furthermore, Figure 8 shows the impact of Δf on the SE configuration for constant values of Δg = 0.64 and Δτ = 0.6 chip. When the frequency SE is no longer zero, it induces a rotation along the relative phase Δθ in the SE clusters. For $\Delta f>1/2T_i$ (Figures 8(c) and 8(d)), additional undesired SE (which do not belong to a cluster) appear. These undesired SE do not cover the entire Δθ range, and their presence around the authentic SE cluster can pull the system toward another cluster (bifurcation).

Figure 9 depicts the impact of Δτ on the SE configuration for constant values of Δg = 0.81 and Δf =12 Hz. For low values of Δτ (Figures 9(a) and 9(b)), some discontinuities are observed in the spoofing SE cluster, resulting in undesired SE near the authentic SE cluster. These discontinuities seem to disappear for higher values of Δτ (Figures 9(c) and 9(d)).

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 9

Code and frequency SE in the induced-multipath situation, represented in the nominal frame (c_τ = 0.1 chip, T_i = 20 ms, Δg = 0.81, Δf = 12 Hz) (a) Δτ = 0.1 chip (b) Δτ = 0.2 chip (c) Δτ = 0.4 chip (d) Δτ = 0.9 chip

The colors represent the value of Δθ ∈ [0, 2π], and the black crosses denote the SE of the nominal situation, as defined in Equation (39).

5.4.5 Loop Spoofing SEE

Figure 10 shows the maximum absolute tracking error when the system is locked on the authentic cluster, referred to as the absolute spoofing SEE (SSEE), as a function of Δτ and Δf for Δg = 0.64. These results are analogous to the MEE studied for multipath interference in the literature (Van Nee, 1996) (for Δf = 0), except that they express both joint code, frequency, and phase errors ε_η and model the impact of Δf and loop interdependence. The absolute error exhibits symmetry along Δf.

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 10

Absolute SSEE (i.e., $\underset{\Delta \theta \in [0,2\pi ]}{\max }\left|{\epsilon }_{\eta }^l\right|=\underset{\Delta \theta \in [0,2\pi ]}{\max }\left|\Delta {\eta }_{\mathrm{eq}}\right|$) for Δg=0.64, c_τ = 0.1 chip, and T_i = 20 ms (a) Code (b) Frequency (c) Phase

It is worth noting that the SSEE does not represent the maximum possible error, but rather the tracking error at lock, i.e., the tracking error to which the system tries to converge. The full behavior of the system is described by the closed-loop model in Equation (18) and is analyzed further in the next section. Lastly, Figure 10 highlights the limits of the induced-multipath situation for ${\epsilon }_{\tau }=T_c+c_{\tau }/2$, as presented by Hussong et al. (2023).

6.1 Nominal, Induced-Jamming, and Induced-Spoofing Situations

In the nominal, induced-jamming, and induced-spoofing situations, the linear properties of the closed-loop model are maintained (Section 5). The additivity property of the DLL and PLL holds, and both authentic and spoofing contributions Λ_n,a and Λ_n,s can be considered independently. Therefore, the impact of authentic and re-radiated noise can be expressed using the models developed for linear tracking loops in the literature, e.g., as reported by Betz and Kolodziejski (2009).

6.2 Induced-Multipath Situation

The analysis of the tracking loops reveals their nonlinearity under induced-multipath situations (Section 5.4.6). Consequently, the additivity property of the DLL and PLL can no longer be considered (i.e., the noise does not have the same impact depending on the state vector $\hat{\eta }$ value). The closed-loop model in Equation (18) must be analyzed along with the noise contributions Λ_n,a and Λ_n,s, as a stochastic and nonlinear dynamic system (El Bouch et al., 2024; Gupta, 1975), with the solution being the probability density function (PDF) of the random variable $\hat{\eta }$ (or equivalently ε_η and ${\epsilon }_{\eta ,\mathrm{eq}}$ in the nominal and equivalent frames).

The solution of the stochastic model can be estimated by exploiting the quasi-harmonic behavior of the system, as shown in Section 5.4.7. The solution PDF can thus be computed over one period $\Delta \theta \in [0,2\pi ]$ for each value of Δv. The 99th percentile of the absolute possible tracking error when tracking the authentic cluster dynamic is depicted in Figure 11. These bounds are referred to as the SEE and represent more accurate error bounds than the SSEE presented in Figure 10 or SEE values reported in the literature, as they account for both noise impact and loop nonlinearity and interdependence.

• Download figure
• Open in new tab
• Download PowerPoint

FIGURE 11

Absolute SEE (99th percentile of the absolute random tracking error ε_η) for Δg = 0.64 and C/N₀ = 55 dB.Hz (a) Code (b) Frequency (c) Phase

The tracking loop parameters are set to T_i = 20 ms, c_τ = 0.1 chip, B_τ= 1 Hz, and B_θ = 20 Hz.

First, Figure 11(a) highlights the low-pass behavior of the DLL, which filters the input relative equivalent dynamic Δη_eq with a cut-off frequency B_τ (here, 1 Hz). Below this cut-off frequency, the error is similar to its SSEE, as presented in Figure 10(a). However, the filter reduces the tracking error at high frequencies. We observe an increase in code error at rational multiples of the Nyquist frequency (e.g., 25 Hz (T_i/2), 16.6 Hz (T_i/3), and 12.5 Hz (T_i/4)).

Figure 11(b) depicts the absolute frequency SEE. The cut-off frequency of the PLL is much higher than that of the DLL, resulting in less attenuation of phase and frequency errors. Additionally, the figures highlight regions with high-frequency errors, where the frequency error and probability of cycle slip are elevated. These regions correspond to the areas where the phase SE values are close to π/2 (or −π/2), as shown in Figure 10(c). In these regions, the correlator output approaches the limits of the arctan function interval ([−π /2, π /2]). When the phase approaches these limits, the PLL discriminator corrects the phase, inducing a jump in the frequency error and causing a phase cycle slip. These regions are observed at relatively high relative power (Δg > 0.5). It is worth noting that because of these frequent cycle slips, the phase is unavailable in these regions (Figure 11(c)).