2.1. Characteristics of GNSS radio signals

Currently, there are six different GNSS constellations, which can be used independently, and more than 20 different types of GNSS signals. All signals are transmitted between 1,164 and 1,610 MHz, and the aggregate of all constellations and signals constitute what is known as the global navigation satellite system. Radio frequency spectra of GNSS are illustrated in Figure 1. For GNSS signal spectra generation, the GNSS-matlab library (Pascual, Reference Pascual2022) was used. Most civilian signals are located in the L1 and L5 bands, and signals of these bands are used also in IoT applications. Therefore, for the purposes of this work, only the signals in the L1 and L5 bands will be discussed further.

Figure 1. GNSS signal spectra: (a) L1; (b) E5/L5; (c) B1I and (d) GLONASS L1.

The main characteristics of GNSS signals located in L1 and L5 bands can be found in GPS Directorate (2021a,c), European Union (2021), China Satellite Navigation Office (2017, 2018, 2019), Glonass, ICD (2008) and GPS Directorate (2021b). There are some specific details that need to be addressed to successfully record these signals. One such characteristic is related to GPS L1C, GALILEO E1 and BEIDOU B1C signals. All of these signals are rather complex, because they use TMBOC(6,1,1/11), CBOC(6,1,1/11) and QMBOC(6,1,3/44) modulations, respectively. These modulations are similar because they are essentially various possible combinations of Binary Offset Carrier BOC(1,1) and BOC(6,1) modulations, which allow distributing signal power over data and pilot components of the signal (Hein et al., Reference Hein, Avila-Rodriguez, Wallner, Pratt, Owen, Issler, Betz, Hegarty, Lenahan and Rushanan2006; Yao et al., Reference Yao, Lu and Feng2010). Frequency spectra of the GPS L1C, GALILEO E1 and BEIDOU B1C signals are shown in Figure 1a.

Another signal to be discussed is GALILEO E5a. This signal is part of the GALILEO E5 signal, which uses altBOC(15,10) modulation. The spectrum of E5 signal is shown in Figure 1b together with the GPS L5 signal. From the figure, it is clear that the E5 main lobes are very similar to the main lobe of GPS L5 Binary Phase Shift Keying BPSK(10) modulation. This was done by design so that both E5 lobes can be received and processed independently as E5a and E5b signals. Receivers can even demodulate E5a as the BPSK(10) signal (Rodriguez, Reference Rodriguez2008).

The third signal which needs more attention is GLONASS L1 C/A, because unlike other GNSS systems, GLONASS uses the Frequency Division Multiple Access (FDMA) technique (GLONASS, ICD, 2008). This means that to transmit GNSS data, GLONASS uses 14 channels and each channel has its centre frequency defined by

(1) $${f_{cp}} = 1602 + 0.5625p{\rm{\;\;MHz}}$$

where $p$ is the channel number in the interval $ - 7 \le p \le 6$ . The width of each channel is only 0.511 MHz and all 14 channels need 7.3125 MHz of bandwidth. The frequency spectrum of GLONASS L1 C/A is shown in Figure 1d.

The remaining GNSS signals do not have any special characteristics that need to be known in advance before recording GNSS signals. It is enough to know the centre frequency and signal bandwidth to successfully record these signals. Note that GNSS signals are relatively weak and are below the noise floor (Borre et al., Reference Borre, Akos, Bertelsen, Rinder and Jensen2007). This means that looking at these signals with a spectrum analyser would show nothing at the GNSS centre frequencies. Therefore, it is important to use appropriate gain parameters in the SDR for recording and replaying GNSS signals.

2.2. Software-defined radio and synchronisation

Software-defined radios represent systems in which all signal processing is performed by the software. They are composed of analogue front-end, which is a configurable analogue transceiver, and an analogue-to-digital/digital-to-analogue converter (Krueckemeier et al., Reference Krueckemeier, Schwartau, Monka-Ewe and Technische2019). The front-end converts a specific part of the spectrum to a lower frequency band, where it can be converted to the digital domain. The digital receiver then performs all the necessary digital signal processing. Therefore, SDR systems provide a great degree of flexibility.

An SDR system can record any part of spectrum, which is within its operational limits and GNSS signals are no exception. However, to successfully record these signals, more than one SDR is needed, because there are four centre frequencies around which L1 and L5 signals are located. This means that four separate SDR devices must work as a phase-coherent transceiver, which simultaneously and synchronously receives or transmits signals at the aforementioned four centre frequencies. The need for such an operation arises from the fact that L1 and L5 signals coming from the same satellite are synchronised, their code delay is approximately the same since both signal travel the same path, the relative speed is the same and Doppler shifts are proportional with a known factor (Leclère et al., Reference Leclère, Landry and Botteron2018). Additionally, GNSS receiver manufacturers can use acquisition information gathered by acquiring the L1 signal for L5 acquisition as an optimisation and cost-cutting measure, which leads to operational mode when, without L1 signals and their synchronisation to L5, L5 signals cannot be detected.

To realise a phase-coherent transceiver from separate SDRs, the time, frequency and phase synchronisation in hardware and software must be achieved. Usually, SDR systems have 10 MHz frequency reference signal input and output, as well as 1 Pulse Per Second (1 PPS) signal input for synchronisation; however, synchronisation using these inputs and outputs without additional efforts is not sufficient for application, which requires channel coherence (Krueckemeier et al., Reference Krueckemeier, Schwartau, Monka-Ewe and Technische2019).

There are three possible ways to distribute the 10 MHz reference signal in the whole system. In the reference clock sharing topology, a common reference signal is distributed to all SDRs and every SDR generates its own Local Oscillator (LO) signal using Phase Lock Loop (PLL) (Tröster-Schmid and Bednorz, Reference Tröster-Schmid and Bednorz2016). In practice, this approach produces tens of degrees of phase drift due to reference signal drift and several degrees of phase drift due to noise caused by PLL (Baker and Avenell, Reference Baker and Avenell2019).

Another possible approach is the daisy chain topology, when the reference signal is used only for the first SDR in the chain, and after PLL generates the LO signal of that SDR, the LO signal is used internally and also exported to the next SDR in the chain, which in turn exports this signal to the subsequent SDR (Tröster-Schmid and Bednorz, Reference Tröster-Schmid and Bednorz2016). This is a simpler and commonly used approach, allowing several degrees of phase drift per daisy chain stage and several decimal parts of degree phase drift due to LO output and input circuits (Baker and Avenell, Reference Baker and Avenell2019).

The last possible topology is the star distribution, in which case, the LO signal of the first SDR is exported to all remaining SDRs via a splitter. This topology is superior to the previous two, because it provides a stable phase relationship between all devices in the system, since phase noise in all channels becomes correlated in time (Tröster-Schmid and Bednorz, Reference Tröster-Schmid and Bednorz2016). Such a configuration is used in large or phase sensitive applications (Baker and Avenell, Reference Baker and Avenell2019).

After reference signal distribution is done, time synchronisation must be addressed. Without it, all previous efforts do not make much difference, because recorded basebands are misaligned in time. Time synchronisation can be achieved by using 1 PPS input if the SDR has it. Using this signal, all SDRs in the system can have a synchronous start and stop, and also the internal components of each SDR can be triggered synchronously system-wide. Synchronous start and stop is sufficient to solve time misalignment (Jepson, Reference Jepson2019; Tröster-Schmid and Bednorz, Reference Tröster-Schmid and Bednorz2016).

However, not all SDRs have 1 PPS input. In such a case, time alignment can be done in the software. A noise source has to be connected to radio frequency inputs of each SDR and by estimating cross-correlation between signal streams, the time and phase alignment can be achieved (Laakso et al., Reference Laakso, Rajamäki, Wichman and Koivunen2021). Alignment is done by shifting maxima of cross-correlation functions to the same time moment. The same time shifts can be applied to recorded baseband signals.

Finally, after reference signal distribution and time alignment are completed, phase alignment must be performed. Even if phase drift is minimised and a stable phase relation between SDRs is established, phase differences between SDRs at the beginning are unknown and random due to PLL behaviour and distribution equipment (Tröster-Schmid and Bednorz, Reference Tröster-Schmid and Bednorz2016; Laakso et al., Reference Laakso, Rajamäki, Wichman and Koivunen2021). Phase alignment can be accomplished in software and must be done every time the SDRs are started. For phase alignment, the noise source is used as well. Phase correction coefficient ${\alpha _n}$ is calculated for all SDRs $n = 1, \ldots, N$ using

(2) $${\alpha _n} = {{\langle {x_n}^{\rm{*}},r\rangle } \over {\left| {\langle {x_n}^{\rm{*}},r\rangle } \right|}}$$

where ${x_n}$ is a complex baseband signal of the $n$ th SDR, $r$ is the baseband values of the reference SDR, a star symbol denotes complex conjugate, $\langle \cdot, \cdot \rangle $ is a dot product and $\left| \cdot \right|$ is a modulus operation. Coefficient ${\alpha _n}$ should be calculated over a few frames to reduce the noise (Laakso et al., Reference Laakso, Rajamäki, Wichman and Koivunen2021). After correction coefficients are applied, it is assumed that the SDRs are coherent until the next restart. Note that the noise source should not be connected after alignment procedures are completed, because it will significantly reduce the signal-to-noise ratio (Laakso et al., Reference Laakso, Rajamäki, Wichman and Koivunen2021).

3.1. HackRF One software-defined radios

At the very centre of developed GNSS L1+L5 record–replay simulator are software-defined radios. To record all GNSS L1 and L5 signals, four HackRF One SDRs were used. HackRF One was chosen because it can work in a frequency range from 1 to 6 GHz, has a bandwidth of 20 MHz, can both transmit and receive radio signals, has many power gain control options, has hardware support for 10 MHz frequency synchronisation and 1 PPS time synchronisation, has 8 bit resolution, and is also relatively cheap (Ossmann, Reference Ossmann2022). Note that 8 bit resolution is an advantage because larger sample resolution can cause instability issues and recorded files will be excessively large requiring massive storage. Actually, in commercial applications like LabSat 3 Wideband, no more than 3 bit resolution is used (Racelogic, 2022), while many standard receivers support only 2 bits, and in some cases, only 1 bit is enough (Hegarty, Reference Hegarty2011). The rack of four HackRF One SDRs used in the simulator is shown in Figure 3a. An input GNSS SAW filter is necessary for recording and replaying GNSS signals. It also acts as a DC block and is connected to a four-way splitter as shown in Figure 3a.

An alternative SDR could be USRP B210, which has all of the HackRF One features, but is more expensive and has 12 bit resolution. An attempt was made to record and replay GNSS signals using USRP B210, but when recording two channels simultaneously at different centre frequencies, USRP SDR causes a linear time-dependent phase difference between the basebands. It was not completely possible to remove this phase artefact, which destroys phase synchronisation between L1 and L5 signals.

3.2. SDR host computer

The SDR host computer is no less important than the SDRs themselves. In this work, the Asus ROG Strix SCAR II GL504GM with Intel Core i7-8750H processor, 1 TB Kingston A2000 NVME SSD disk, 32 GB DDR4 2666 CL19 RAM and Ubuntu 20.04 LTS operating system was used. It is important that the host computer would have enough USB ports for each SDR, because every SDR must be connected directly to the host computer without any hubs to avoid limiting of the bandwidth. The Linux operating system is preferred, because it does not load the computer significantly, supports all the necessary software and allows forcing the computer to work in performance mode simply via a terminal. Note that the performance mode is absolutely necessary, because SDRs load the USB controller and CPU, and if the CPU is not in performance mode, after some time during a sustained load, there will be drops in performance, which could cause overflows or underflows affecting L1 and L5 synchronisation.

3.3. PPS distributor for time synchronisation

To record and replay GNSS signals, SDRs must be synchronised in time. According to Bartolucci et al. (Reference Bartolucci, del Peral-Rosado, Estatuet-Castillo, Garcia-Molina, Crisci and Corazza2016), a HackRF One time synchronisation error of less than one sampling period can be achieved. HackRF One can be synchronised by using an external 1 PPS signal or by using one of the SDRs as a trigger source.

In practice, it was observed that using one of the SDRs as a source is not reliable and using the external 1 PPS signal produced by a standard GNSS receiver is better. However, to use an external signal safely and reliably, a PSS signal distributor is necessary. Following Kutkov (Reference Kutkov2021), the PPS distributor was designed and built for the GNSS L1+L5 record–replay simulator. A block diagram of the developed distributor is shown in Figure 4. This device works by using a GNSS receiver or any other external 1 PPS source, then this signal is buffered so as not to overload the source. The buffered signal is then distributed to three other buffers: one for daisy chain output, another for LED indication and the third for eight parallel outputs connected to the SDRs. This PPS distributor supports both TTL and CMOS voltage levels (depending on jumper configuration) and can be powered via a micro-USB port. Note that the hardware time synchronisation feature is only available in firmware release 2021.03.1 or newer of the HackRF One SDR.

Figure 4. Block diagram of PPS distributor.

3.4. Common oscillator distribution scheme for frequency synchronisation

To achieve frequency synchronisation, which in turn has an effect on phase synchronisation, the star topology is used, as shown in Figure 5. First, an external 10 MHz oscillator module is used to improve the frequency stability of HackRF One which records and replays L5 signals. Then, the reference signal of L5 HackRF One, generated by an on-board Si5351C clock generator, is exported via a CLKOUT output to a 10 MHz amplifier–distributor box. From the distributor box, local oscillator signals are delivered to the three remaining SDRs.

Figure 5. Block diagram of common oscillator distribution.

Since the 10 MHz distributor has a built-in OCXO, it was attempted to realise the reference clock sharing topology, but the achieved synchronisation was worse and had a significant effect on GNSS L1 and L5 signals, because, when replaying the record, L5 signals would sometimes randomly disappear after a few minutes into playback. Such behaviour was not observed using the star topology described above.

3.5. Software phase correction for phase synchronisation

While using HackRF One, the only possible way to achieve phase synchronisation is via software. The software is implemented in Python and it works by reading a part of the GNSS record and calculating the necessary phase corrections to eliminate the phase difference between signals. When reading signals, the first 5 s are skipped, because HackRF PLL stabilises only after approximately 5 s from the time when the SDR has started. After skipping the initial interval, only 30 s are read. This limitation is caused by random access memory and, as a result, the minimum necessary amount of RAM for this software to work is 32 GB.

After records are loaded as complex samples into memory, necessary phase corrections are calculated in two ways: (i) by calculating phase difference using one second worth of samples for each second in 30 s and averaging 30 calculations, and (ii) by calculating phase difference using all samples in 30 s. The final results are compared by the user and should not be different by more than 0.01 degree. All of this is necessary to confirm that recorded signals fit the initial assumptions.

There are two initial assumptions. The first assumption is that the recorded signals are comparable to the output of noise generator, because GNSS signals are below the noise floor and no other signals are supposed to be in L1 and L5 bands. This assumption is necessary, because a noise source is needed for phase synchronisation (Laakso et al., Reference Laakso, Rajamäki, Wichman and Koivunen2021), and if the assumption is not violated, there is no need for a special phase synchronisation procedure like in KerberosSDR (KrakenRF Inc, 2022). The second assumption is that phase correction is a single complex number that can be applied to the whole record. If this assumption is invalid, the final results produced by two different ways of phase correction calculations will differ by more than 0.01 degree. These assumptions can be violated by choosing very large values for gain parameters of the HackRF One SDR. The correct gain values should be determined by trial and error.

Furthermore, in written software, GNSS L5 recording is used as a reference, and phase correction is calculated in such a way that phase difference between the GNSS L5 record and any other record would be zero degrees.

Since GNSS records can be rather long, the calculated phase corrections are applied using GNU Radio software as shown in Figure 6. GNU Radio generates the constructed flow diagram as a Python script, which can be used inside other external Python scripts (GNU Radio Website, 2022). By doing this, the main script calculates corrections and then starts the GNU Radio script for each record to apply calculated corrections.

Figure 6. Functional blocks in GNU Radio environment for applying phase correction.

3.6. Synchronisation and sampling rate

GNSS L1 and L5 signals are transmitted on different centre frequencies using different modulations and different bandwidths. Therefore, in theory, different GNSS signals could be recorded using different sampling rates. This would be beneficial to the whole system, because multiple SDRs could be connected to the same USB port via a hub, less storage would be used by records and overall load on the host computer would be reduced.

However, despite extensive efforts, L1 and L5 signals were not successfully recorded and replayed in a multi-sampling rate system. None of the L1+L5 capable receivers used in experiments were able to detect both L1 and L5 signals. However, this does not mean that no signals can be recorded using different sampling rates for different centre frequencies. If the goal is to record only L1 signals, there are no issues in using different sampling rates. All receivers were able to detect L1 signals transmitted on all centre frequencies. Problems would begin only when an attempt to record multiple bands is made.

The most likely explanation for such a behaviour is that when recording GNSS signals using different sampling rates, synchronisation between signals is destroyed. This is not an issue for L1, because receivers do not use acquisition results from GPS L1 signals to acquire, for example, GALILEO L1 signals. No synchronisation between GPS and GALILEO could even be expected, because these signals are transmitted from different satellites.

Unfortunately, the situation for L1 and L5 bands is different, because these signals are transmitted by the same satellites; therefore, these signals are expected to be synchronised and receivers use acquisition results from L1 signals to acquire L5 signals (Leclère et al., Reference Leclère, Landry and Botteron2018).

The fact that GNSS receivers heavily rely on L1 signal for L5 reception is clearly seen in the subsequent results, which are discussed below. Note that commercially available solutions do not use different sampling rates for multiple bands as well. For example, LabSat 3 Wideband can record three different bands, but all of them are recorded using the same bandwidth and, therefore, the same sampling rate (Racelogic, 2022). However, this creates situations where more bandwidth is recorded than needed and the system is stressed more than necessary. In the case of LabSat 3 Wideband, this problem is solved by reducing the resolution from 3 bits to 1 bit.

To record multiple GNSS signals in the same band, different sampling rates for different centre frequencies can be used, because the loss of synchronisation is not important. However, to record multiple GNSS bands, the same sampling rate must be used for all centre frequencies to maintain synchronisation.

Since the HackRF One SDR does not have a possibility to adjust the resolution, the only possible optimisation for the system is to record GNSS signals with reduced bandwidth, which is achieved by reducing the sampling rate to the same value as the desired bandwidth. This was investigated and results are discussed in the following section.