Personal Privacy Jammers: Locating Jersey PPDs Jamming GBAS Safety-of-Life Signals

By Joseph C. Grabowski

When jamming interfered with GPS signals at Newark Airport, a three-month effort determined that low-power, mobile personal-privacy devices were responsible. This article describes how they were found and outlines how the observable parameters of such devices encompass a wide variation in RF spectra and internal modulation.

Personal privacy devices (PPDs) are now recognized as being responsible for causing interference to GPS receivers. However, in November of 2009, when the Local-Area Augmentation System (LAAS) installed its first Ground-Based Augmentation System (GBAS) at Newark International Airport (EWR), this fact was not known. Within the first month of its installation, anomalies in GBAS processing were correlated to the presence of radio-frequency interference (RFI). Initial efforts to determine the source of this unexpected RFI were not successful.

The Federal Aviation Administration (FAA) had a significant interest in finding this RFI source, leading to deployment of RFI detection and location equipment by several groups. Zeta Associates temporarily installed equipment in early January 2010 that was capable of detecting and characterizing RFI but did not have emitter location capability.

Determining that an RFI transmitter is in motion is more certain if the RFI is observed simultaneously by multiple sensors. However, analysis from hundreds of RFI events indicates that when an RFI source is in motion, observations collected by a single sensor can provide sufficient information to determine that the RFI transmitter is in motion.

Continuing interest in understanding PPD effects on GPS receivers led to the installation of remotely accessible monitoring equipment that provides detailed characteristics of these devices. Remote access facilitates monitoring, particularly since PPDs are present for 30 to 60 seconds at a time and only a few times a day.

Background

The January 2010 deployment included a WAAS GPS receiver, spectrum analyzer, and a Zeta custom-developed Snapshot System, assembled from commercial off-the-shelf (COTS) equipment for conducting WAAS site-installation surveys, and capable of capturing intermittent short-duration RFI events. It consists of a tuneable receiver (10 MHz to 3 GHz) whose RF front end spans 25 MHz that is digitized at a sample rate of 56 MHz, with storage capacity sufficient for up to 80 minutes. Once captured, the time-series data can be analyzed in many different ways. Possible analysis techniques include examination of the raw time samples, generation of spectral plots, or demodulation of the RFI signal. Each approach can lead to a better understanding of the underlying interference signal. If digital data is present and can be demodulated, it might be possible to associate the demodulated bits with a known transmitter.

Data can be captured manually or programmatically using a trigger determined by an algorithm that monitors WAAS GPS receiver automatic gain control (AGC) logs. The AGC function within a WAAS receiver has a well-behaved response for normal Gaussian noise RF environments. When RFI is present, the AGC exhibits atypical responses that then trigger the Snapshot System. As WAAS receivers utilize both L1 and L2, and each RF path has its own AGC, it is possible to detect the presence of potential RFI at either L1 or L2.

The Snapshot System RF input for this deployment was from a PCTEL antenna identical to those used at WAAS reference sites. This antenna incorporates a triplexer that provides three separate 40 MHz passbands each centered on L1, L2, and L5, with approximately 50 dB of gain. This antenna was located approximately one mile north of the four LAAS antennas within Port Authority of New York and New Jersey (PANYNJ) Building 80.

Within the first hour of being deployed on January 20, 2010 the Snapshot System had detected and captured one RFI event in the GPS L1 band. After one day, the Snapshot System had detected and captured more than 25 separate instances of RFI within the GPS L1 band. Most RFI events were narrowband (10s of kHz bandwidth) and short duration (no more than 3 seconds).

However, there also were five RFI events that spanned more than 15 MHz across L1 (Figure 1) were present as long as 20 seconds and at a power level as much as 25 dB above the receive antenna’s noise floor. Some of these RFI events were strong enough to reduce a WAAS G-II receiver C/N₀ by as much as 20 dB and thereby resulted in loss of tracking for lower-elevation GPS satellites. Higher-elevation GPS satellites were able to continue tracking throughout these events but at a lower C/N₀. The wideband RFI events were also detected by the SLS 4000 GBAS monitor and coincided with tracking problems in the LAAS GBAS receivers.

Two of the captured broadband RFI events were demodulated and analyzed. The underlying linear frequency modulation (FM) signal swept over more than 15 MHz in less than 1 millisecond (Figure 2).

At that time, it was not known if the source of the RFI was stationary or moving, whether it was unintentional (emanating from a licensed transmitter but with malfunctioning electronics), inadvertent (equipment normally used for test purposes and capable of operating in the GPS band but accidentally left on), or intentional (purposeful jamming of GPS).

Since the RFI was observed by GPS receivers separated by 1,700 meters, a search was undertaken to identify any other GPS receivers in the vicinity of EWR. One National Geodetic Survey (NGS) continuously operating reference site (CORS) NJI2 is located near EWR about 4,500 meters northwest from Building 80. Analysis of data from NJI2 during the same time periods that RFI was detected by the WAAS and LAAS receivers did not contain any indication of RFI, and therefore suggested that the source of RFI was more localized to EWR.

The Snapshot System remained in place for approximately two weeks before moving to another location. Collected data was analyzed, showing that wideband RFI was associated with significant degradation to both the WAAS and LAAS receivers. Additional characteristics noted the RFI was intermittent, lasting typically 30 seconds but no more than 60 seconds, was observed more often Monday through Friday, and most frequently around 8 a.m. local time.

Locating The RFI

Figure 3 shows a Google map of EWR with blue dots indicating the location of the four LAAS antennas, a green dot for Building 80, and a yellow dot for the GBAS shelter. EWR is adjacent to the New Jersey Turnpike (NJT), which has seven southbound and seven northbound lanes of traffic.

Since the Snaphsot System did not include location capability, other teams with direction-finding equipment, including beam-forming antennas, travelled to EWR to try to locate the RFI source. These teams were on site at various times from February to March. However, those efforts did not provide sufficiently reliable information to reduce the search area. By mid-March, the search area remained identical to that of January.

Zeta then deployed two WAAS G-II receivers separated by considerable distance (1,722 meters) to monitor for RFI, and analyze each receiver’s response only when RFI sufficient to significantly degrade GPS reception was detected. One receiver was located within Building 80, and the second receiver within the GBAS shelter near the LAAS antennas. This configuration was designed to determine degradation relative to each reference receiver and thereby establish probable search areas for the RFI emitter. The Zeta equipment also incorporated a rotating directional antenna (at the GBAS shelter shown in Figure 4) that was commanded to rotate only when significant RFI was detected.

The expectation was that RFI would be detected simultaneously by both GPS receivers, and that the relative degradation in normalized C/ N0 would provide an indication as to which location lay in closer proximity to the RFI source. The rotating high-gain directional antenna would then indicate a reduced probable search area consistent with the relative degradation between the two receivers. At the time this equipment was deployed, it was still thought that the RFI was most likely stationary and high-power. However, the measurement results were quite different than expected. Subsequent data analysis from this equipment revealed that the RFI was low-power and moving, specifically moving along the NJT.

The Zeta equipment was deployed on March 19, 2010, and remained in place while operating automatically. On March 25, data collected during the previous week were analyzed. During this 1-week collection there were 11 instances when both receivers detected wideband RFI events and one antenna rotation even partially tracked one wideband RFI emitter. Such data was indicative of a non-stationary emitter, a finding that was quite significant. Based on data from the two receivers, the apparent velocity of the RFI emitters ranged between 45 miles per hour (mph) to 72 mph. Initial analysis of antenna-rotation data also indicated the RFI source was east of the GBAS shelter and moving south on the NJT.

Understanding the importance of degradations from both receivers was crucial in determining that the RFI has attributes of transmitting at low power and is moving. Had a single stationary RFI emitter been responsible for these observations, the degradations measured at each receiver would have occurred at essentially the same time, not 50 to 80 seconds apart. A high-power moving RFI emitter would also have produced degradations at both receivers at the same time, and since that was not observed, the conclusion was that the RFI emitter was relatively low in output power. Low-power RFI emitters will cause significant degradation to GPS receivers only when they are in close proximity to them, on the order of hundreds of meters.

Receiver data logs were processed specifically for degradation in normalized C/N₀. Normalized C/N₀ was only computed for those satellites above 20 degrees, and all of those results were averaged together. Prior knowledge regarding WAAS PCTEL antennas has established an expected C/N₀ versus satellite elevation that is accurate to approximately ±1 dB with a nominal mean of 0 dB. This normalized C/N₀ represents an average of all satellites in view. However, individual satellite signal strength can vary greater than ± 1 dB. Significant deviations of more than –3 dB are indicative of strong RFI within the GPS processing band. Normalized C/N₀ was plotted for each day that data was collected, followed by expanding those time periods where significant degradation was present.

Figure 5 shows data of the first evidence of a low-power moving PPD. Data for Building 80 receiver is in blue and data from the GBAS shelter receiver in pink. Since Building 80 is north of the GBAS shelter, when degradations occurred first at Building 80, this implies that the RFI emitter is moving from north to south. Similarly, when degradations were first seen at the GBAS shelter, the RFI emitter was moving from south to north. This plot uses major time grids of 60 seconds and minor grids of 10 seconds.

The double separate degradations observed by the Building 80 receiver have only been observed from monitoring equipment located at that building, and have since been associated with travel paths of PPDs on the nearby highways. Both GPS receiver and spectral data contain this same characteristic. This characteristic is due to the fact that vehicles traveling south on the NJT have clear line of sight to the roof of Building 80 (shown by Figure 6) before they travel under Interstate 78, after which they pass next to Building 80. During the time that they are under Interstate 78, their transmissions are blocked in the direction of the roof of Building 80.

Spectral data as observed by the 4-foot reflector is shown in Figure 7. Figure 8 shows spectral maximum data as collected by the 4-foot linearly polarized reflector along with additional information.

When the GBAS shelter receiver at first detected RFI, the reflector began rotating from an azimuth of 0 degrees in a clockwise direction. At the same time, a spectrum analyzer began capturing spectra at a rate of 3 per second. The first spectral maximum was observed at an azimuth of 30 degrees, a direction in which the antenna was pointed towards the NJT, to a location approximately 900 meters away from the GBAS shelter. The next time spectra were at high levels occurred for azimuths between 145 to 195 degrees, or southeast of the GBAS shelter. The approach of using a rotating antenna was originally intended to provide a direction towards a stationary source and not to track a moving emitter. However, it appears that to some extent, the rotating antenna in fact did track a moving emitter from north to south.

On the afternoon of the day these results were communicated to the FAA lead for the EWR RFI investigation, all search activities were shifted to the NJT and away from the airport operating area. Just south of the GBAS shelter there is an official-use overpass that straddles the NJT. All detection equipment was positioned onto the overpass, under the hypothesis that the RFI was emanating from vehicles traveling the NJT. Evidence substantiating this initial finding was found within a day, and approximately one month later a concerted effort was undertaken to identify and stop a single vehicle that was using a PPD.

The Zeta equipment remained in place for many months and continued to provide additional evidence of PPD characteristics. Early in the investigation it was hoped that only a few PPDs had been responsible, but as more data was collected it became evident that many different types of PPDs were traveling along the NJT past EWR.

Modeling PPD Effect

Once it was realized that the RFI was from low power moving emitters, a simple model was used to predict their degradation effect on WAAS GPS receivers. The model shown in Figure 9 was used for the purpose of computing distance between the RFI emitter and a WAAS antenna and to then compute the additional level of interference noise power that the WAAS antenna would receive. Here, the WAAS PCTEL antenna is located 50 meters from a road that is 2000 meters long and straight and has an RFI emitter transmitting +25 dBm, moving at 32.5 meters per second (72.5 mph) and with clear line of sight to the WAAS antenna.

With these assumptions it is a simple matter to compute the additional noise power at the WAAS antenna. Non-coherent summation of the RFI noise and inherent system noise was used to compute the total noise power and therefore the additional degradation in C/N₀. The resulting predicted degradation was overlaid on one of the actual RFI events and is shown as a green line in Figure 10. The predicted degradation closely resembles actual event data logged by receivers.

The shape of degradation in normalized C/N₀ versus time has been observed in nearly all of the EWR RFI events that have been analyzed. The magnitude of degradation depends on the power of the RFI and its proximity to the GPS antenna, while its time duration depends on the velocity of the vehicle carrying the PPD. The shape is directly related to the distance versus time between the vehicle and the WAAS antenna. Faster/slower moving vehicles with PPDs will simply shrink/stretch the time scale.  Curved roadways would have different shapes that could also be readily predicted.

CORS data was revisited after realizing that PPDs were traveling the NJT. Specifically, two CORS sites CTDA (70 meters from Interstate 95) and NJDY (380 meters from Interstate 95) were identified. Data from those two sites were analyzed for a couple of weekdays. Possible evidence of PPDs was found within that data. Reported Signal to Noise Ratio (SNR) from CTDA and NJDY contained variations similar to those observed by GPS receivers at EWR during times when PPD induced RFI has been detected.

Continued RFI Monitoring

The LAAS program desired continued monitoring of RFI from PPDs near EWR, including estimates of their effective isotropic radiated power (EIRP). Additional equipment was assembled to provide this capability and installed on March 3, 2011. This monitoring equipment is located within the GBAS shelter at EWR and comprises several COTS components that incorporate improvements beyond the first Snapshot System used at EWR. Improvements include an upgraded Snapshot System (Figure 11), an RHCP directional antenna, and a wireless modem that provides remote access to the monitoring equipment.

Remote access makes it possible to analyze captured RFI data from any computer connected to the Internet, and to modify software if necessary. The new equipment configuration, specifically the use of an AEL AST 1507AA RHCP antenna, was chosen with the explicit purpose of establishing more accuracy in estimated EIRP.

Analysis of data collected during 2010 indicated three significant sources of error in estimating EIRP; Free Space Loss (FSL) from not knowing the exact position of the PPD on the NJT, polarization mismatch loss between the PPD antenna and the receive antenna, and the effects due to transmission from within a vehicle. Differences in FSL loss between the closest southbound lane on the NJT and the most distant northbound lane is on the order of 11 dB. If it is known that the PPD is traveling south, the difference in FSL between the nearest to farthest southbound lanes is less but still about 6 dB. FSL differences for northbound lanes are smaller, on the order of 3 dB. Knowing the direction of travel reduces this uncertainty but does not eliminate it. The WAAS PCTEL antenna is RHCP, but at the horizon has an axial ratio of approximately 5 dB. Many PPDs appear to be using quarter wavelength dipole antenna that are mounted with a rotatable connector. Assuming all PPD antennas are linearly polarized, there would then be an uncertainty of about 5 dB when using data observed by the WAAS PCTEL antenna. The AEL antenna has an axial ratio of 0.2 dB at L1 and significantly reduces uncertainty of polarization mismatch loss. Even though the AEL antenna has a 3 dB mismatch loss, that loss has an uncertainty of 0.2 dB for any orientation of the PPD antenna. The PCTEL antenna has a symmetric gain response relative to the NJT. The AEL antenna was pointed to the north intentionally so that observed RFI power will be stronger when a PPD is north of the GBAS shelter. Simultaneous capture of real time samples from both antennas by the ICEPOD6-M5 provides an indication of the direction in which the PPD is traveling. The third uncertainty comes from the effects of the PPD being located within a vehicle. Vehicular effects on the PPD transmitters were not accounted for due to difficulty in using a simple model. Aloi [1] has measured vehicular effects of quarter wavelength dipole antenna (typically used by PPDs) and has previously published [1] [2] on the effect of vehicles on GPS signals. His most recent findings have not yet been published but indicate that the type of vehicle, the location of a dipole antenna within it, and the position outside of the vehicle from which power is being measured, can lead to significant variation (10 to 15 dB) of the observable power. Consequently, the reported EIRP estimates from the Snapshot System have been referenced to a point just outside the vehicle and do not attempt to account for vehicular effects.

Figure 12 shows a block diagram of the current monitoring equipment. The PCTEL antenna along with the WAAS G-II receiver is used for monitoring GPS signals. WAAS G-II receiver logs are monitored continuously and saved to disk, but snapshots are only taken if the RFI algorithms indicate that RFI is present. A snapshot will be taken if any of three tests (based on AGC, normalized C/N₀, or spectral power) are exceeded. Narrowband RFI tends to most impact the AGC response, while wideband RFI tends to trigger the normalized C/N₀ metric. Since the Snapshot System is also continuously monitoring the RF spectra from both antennas, an additional test checks if there are significant spectra changes.

The AEL antenna is connected to a filter/low noise amplifier (LNA) (Delta Microwave L5995) identical to those within the PCTEL antenna, before it is connected to one of the two L-band tuners (900 to 2200 MHz) of the ICE-Online ICEPOD6-M5, which includes 1 TB of long-term storage and 8 GB of high-speed RAM and is capable of sustained data transfers of as high as 400 MB/s between the L-band tuners and disk. Sample rates and RF filtering are programmable and have been set to use a complex sample rate of 40 MSPS and an RF bandwidth of 30 MHz. When RFI is present, data transfers are 320 MB/s. The internal 1 TB disk can store approximately 100 minutes of RFI. Software parameters limit RFI data capture for any single event to no more than 90 seconds. Implementation of a circular buffer within the high-speed RAM (8 seconds for each L-band tuner path) allows continuous capture of RF data while waiting for a trigger indicating that RFI is present. To reduce false alarms, RFI must be present for at least 4 seconds before data is captured. However, no RFI data is lost, because the circular buffer is longer than 4 seconds. RFI data captures typically contain 3 seconds of data at the beginning, with no RFI, and therefore make it possible to observe the onset of the RFI.

The new equipment has captured hundreds of RFI events, spanning a wide range in bandwidth (7 MHz to an estimated 150 MHz), chirp rate (9 kHz to 170 kHz), and power levels (–10 dBm to as much as +20 dBm). Accurately estimating EIRP of moving emitters is a challenge and requires detailed knowledge of the characteristics of all components used in generating the estimate. Furthermore, distance to the RFI source can only be inferred, since its movement precludes exact measurement, and consequently there will always be some uncertainty in any reported EIRP. However, even with these qualifications, there is evidence from Snapshot System data that some of the RFI sources are transmitting at power levels as much as +20 dBm.

Modeling Antenna Responses

The use and orientation of the two antennas was chosen to determine the direction that PPDs are traveling and thereby reduce some of the uncertainty with respect to their exact location. Figure 13 shows the direction (58 degrees) in which the AEL antenna is pointed.

The combination of its beam width (70 degrees) and axial ratio (0.2 dB) results in a nearly uniform gain across all lanes north of the GBAS shelter. Although FSL still depends on the exact location of the PPD, this approach does reduce many of the uncertainties associated with estimating EIRP. Since the PCTEL antenna has an omnidirectional pattern it will have a symmetrical response.

To determine the time that maximum PPD power would be observed by each antenna, a model was used that assumed the PPD was transmitting at constant power, with fixed polarization, travelling at a constant velocity, and there were no obstacles between the transmitter and each antenna. FSL was calculated for each second of travel and used to determine the magnitude of RFI power that would be received. This value was then used to calculate a nominal Interference to Signal (I/S) relative to the GPS signal. The distance between each antenna and each of the travel lanes on the NJT were also used. The intent of this model was to understand how I/S would vary with time for each of the NJT travel lanes. Figure 14 shows the predicted I/S for the PCTEL antenna and Figure 15 for the AEL antenna. In each of these plots red, yellow and orange represent 3 of the 7 south bound travel lanes and green, blue and purple represent 3 of the 7 north bound travel lanes. A time of 0 was used for the time when the PPD is nearest physically to the GBAS shelter. A nominal velocity of 30 meters/second (67 MPH) was used for the PPD and I/S was computed for 30 seconds before and after its closest approach (± 900 meters north and south of the GBAS shelter). If the PPD travels slower than 30 m/s then the following curves would be wider for the same times. Similarly, if the PPD travels faster, these same curves would be narrower.

Modeling of the AEL antenna took into account its pattern and orientation. It has less gain towards the south, and consequently observed power from a PPD located south of the GBAS shelter is much less. A southbound PPD will initially be within the main beam of the AEL antenna; therefore the expected interference to signal ratio (I/S) will gradually increase until it passes to the south of the GBAS shelter. Similarly, a northbound PPD will not exhibit significant I/S until north of the GBAS shelter. Figure 15 indicates that the maximum I/S occurs within 2 seconds of the point where the PPD is closest to the GBAS shelter. Typical GPS receivers can tolerate an I/S of 30 dB for CW type signals.

Processed RFI data does display some of these characteristics but with some important differences. PPD power was measured once every millisecond using Snapshot System data and total power within the bandwidth of that PPD was calculated. Total power from both the PCTEL (green) and AEL (pink) antennas were then plotted together with one example for a southbound PPD in Figure 16 and a northbound PPD in Figure 17.

Although the envelope of the measured average power tends to have the shape that modeling predicts, there are significant variations over short periods of time. Figure 18 expands a portion of one example and indicates that RFI power varied by more than 17 dB in 0.2 seconds. Examination of spectral data for time intervals of less than one second frequently contains significant changes in observable power. Swept CW from PPDs should exhibit relatively flat RF spectral power, but typical observed spectra include sloping across the band and notches. Possible explanations for these observations include: blockage and diffraction from other vehicles near the one containing the PPD, multipath from other vehicles on the NJT, and the effect of transmitting from within a vehicle. Although some of the snapshot captures exhibit smooth power variation similar to predicted, the vast majority of the hundreds of snapshots exhibit significant variations in power.

Examples of Observed PPDs

The variety of PPDs observed by the updated EWR monitoring equipment has been surprising. Within its first month of operation, more than 40 PPDs were observed with no less than 19 from unique and different PPD transmitters. Classification of PPD transmitters is based on the combination of RF spectra and the spectrum of the FM demodulated data. Although the observed PPD transmitters use a linearly swept FM sawtooth, most contain deviations from a pure linear sweep. Figure 19 shows examples of FM demodulated time series. Rather than attempting to uniquely describe the attributes of each type of deviation, it is simpler to compute the spectrum of the FM demodulated data. The fundamental frequencies of chirp rates that have been observed have spanned 9 kHz to 170 kHz. Figure 20 shows a histogram of chirp rates observed near EWR and indicates that the most frequent rates have been 9, 26, 29, 72, 85, 118, 123, 159 and 170 kHz.

 

 

 

Examples of the 19 unique PPDs (detected within one month) are shown in Figure 22 through Figure 40, with the RF spectrum shown on the left, and the spectrum of the FM demodulated shown on the right. In each of these plots the scaling for the RF spectra is identical, spanning 40 MHz centered on 1575 MHz with a vertical scale using 10 dB per grid. All of the FM demodulated spectra use a horizontal axis that spans 0 to 200 kHz. For references purposes Figure 21 shows the RF spectra when no RFI is present.

Some of these PPDs were transmitting at power levels (observed by the PCTEL antenna) as much as 40 dB above the LNA noise floor. Most spectra were not centered symmetrically about L1 with some completely outside the mainlobe of the GPS C/A code. A few were transmitting outside the programmed 40 MHz bandwidth of the Snapshot System (1555 to 1595 MHz). For those PPDs transmitting outside this band, estimates were made of the upper or lower frequencies using the linear slope of the FM demodulated data, and then extrapolating that slope based on the chirp interval.

Some of the FM demodulated spectra contain a single spectral line that indicates the waveform modulating the RF has a very linear sweep. Most contain additional harmonic lines about the major component and a few appear to have bandwidth about their main spectral component. The current hypothesis is that many of these devices are poorly shielded and that the internal oscillator used to modulate the RF is affected by other nearby signals that are then appearing at the RF output. Some of the possible sources could be circuits that are within the device itself but there is some evidence that a few of these devices are susceptible to energy external to the PPD. A Snapshot System located near Houston International Airport (ZHU) has captured data from PPDs that contain strong components at 58.7 Hz in addition to its linearly swept 97 kHz waveform. Since this frequency is sufficiently different from utility AC power sources (60 ± 0.03 Hz), it has been hypothesized the vehicle carrying that PPD, also has a power inverter. Most power inverters are specified to provide a frequency output of 60 ± 3 Hz. Figure 32 shows a spectral notch that was present at that single frequency throughout the complete capture and suggests that that particular device may have had an impedance matching problem in its transmission path.

A few snapshots have also provided evidence that some of the PPDs are erratic and probably not functioning as their manufacturer intended. Figure 41 contains a raster of 6 seconds of spectral data that shows a PPD whose output was meant to be between 1560 and 1580 MHz but for short periods of time was transmitting at frequencies above 1580.

Remarks on Additional PPDs

Since April 2011 the Snapshot System has captured many additional and different PPDs. No effort has been carried out to catalog all of the different types that have been observed but the following describes interesting and notable PPDs.

Figure 42 shows characteristics of a PPD that has had estimated EIRP approaching +20 dBm, to a point just outside the vehicle, and has also been associated with GPS receiver C/N₀ degradation of more than -27 dB, strong enough to cause the WAAS receiver, located at the GBAS shelter, to lose lock on all GPS satellites for a short period of time.

Figure 43 shows a PPD that is one of the most frequently observed PPDs but that has not been associated with any significant degradation to the GPS receivers.  Estimated EIRP for these PPDs has been on the order of no more than +10 dBm. One device with similar characteristics was procured and its measured power at the antenna output port was no more than +14 dBm. Marketing information on the internet for that PPD specified its output power as +25 dBm.

Figure 44 shows a PPD that is transmitting at both L1 and L2. The EWR Snapshot System has been configured to only capture snapshot data at L1 due to the fact that LAAS only uses L1. However, the WAAS receiver used to monitor for RFI is a dual frequency receiver that on occasion has indicated simultaneous RFI at both L1 and L2. Even though the EWR Snapshot System has not captured data at L2, the simultaneous presence of both L1 and L2 RFI, provides strong circumstantial evidence that this RFI source was transmitting on both frequencies. A Snapshot System monitoring the WAAS Reference Station (WRS) at Leesburg Virginia has captured simultaneous L1 and L2 RFI events. Demodulation of that data indicated the two RF outputs had similar modulation but the demodulated data was not coherent. Therefore, that PPD was probably using individual, but similar waveform generators, for each RF output.

Almost all PPDs have been observed individually. However, there have been at least three times in the last two years when two unique PPDs have been observed within 60 seconds of each other. Figure 45 plots normalized degradation in C/N₀ while Figure 46 plots snapshot measured power for the same RFI event. Analysis of snapshot data for each of the times that had strong RFI power are shown in Figure 47 and Figure 48 and confirmed that there were in fact two unique PPDs observed approximately 40 seconds apart. Both were traveling south on the NJT and approximately 1200 meters apart.

Most of the observed RFI events last for no more than 50 seconds although a few that lasted much longer have been correlated with slow traffic on the NJT. Figure 49 is from June of 2010, before the updated monitoring equipment was in place, and displays normalized degradation of C/N₀. The time duration for which this RFI was observed was more than 3 minutes and was during a time when traffic was ‘slow’ on the NJT.

Very wide-bandwidth PPDs have recently been observed more often. The frequency span these devices are transmitting has had to be estimated due to the fact that the Snapshot monitor has 40 MHz of bandwidth, and these PPDs are transmitting beyond this bandwidth. Figure 50 through Figure 52 show examples of these types of PPDs. The left plot in these figures is the RF spectra and the right plot is the FM demodulated waveform. The latter each contain a linear component that is present for only a portion of the chirp interval. Under the assumption that the modulating waveform would be linear for the repetition interval, the slope of the visible linear component was extrapolated to the total chirp time interval. It is not possible to estimate the upper and lower frequency points for the last two examples, since neither of those had a frequency that began or ended within the observable 40 MHz bandwidth of the monitor.

Although the Snapshot System L-band tuners can be programmed for greater bandwidth, the limiting bandwidth is the bandpass filters contained within the LNA modules, which have bandwidths of 40 MHz.

Data captured by a Snapshot System operating near ZHU contains evidence that external energy may have coupled into that PPD and affected the modulation waveform. Figure 53 shows a plot of the RF spectra and an expanded portion of the FM demodulated spectra indicating the presence of a 58.7 Hz component. A raster of the demodulated FM, shown in Figure 54, highlights the 58.7 Hertz component.

Careful analysis of normalized C/N₀ has also provided clues as to the possible travel paths that a PPD might be using. RFI was suspected at the WRS located at Leesburg Virginia (ZDC). A Snapshot System was installed to detect and characterize possible RFI. Analysis of snapshot data did confirm that a few PPDs were traveling past ZDC. One of the PPDs was more disruptive than the others but fortunately was also following a very predictable schedule. It was regularly detected twice a day, first within 10 minutes of 4:30 AM local and next within 30 minutes of 2:30 PM. Normalized C/N₀ contained similar patterns for each time of day and are shown in Figure 55 and Figure 56. Examination of the local roadways, shown in Figure 57, suggested the possible roads and direction in which this PPD was traveling. The WAAS antennas on the roof of ZDC have clear line of sight to state highway 7 for vehicles that are east of ZDC. Normalized C/N₀ for morning events tended to have a relatively abrupt onset followed by a gradual return to normal while the afternoon events exhibited a gradual increase in degraded C/N₀ followed by a quick return to normal. This observation lead to hypothesizing that the PPD was traveling east in the morning and west in the afternoon.

FAA Spectrum personnel were informed of this analysis and confirmed that this hypothesis was correct. Using this information they were able to detect the vehicle that was responsible and remove this particular PPD from service.

EWR RFI Event Statistics

A large number of RFI events have been detected at EWR since the updated Snapshot System was installed on March 3, 2011. These RFI events have been ranked according to the magnitude of degradation in normalized C/N₀, as reported by the GBAS shelter WAAS receiver. The following plots show the total number of RFI events per day (red dots) and for every seven consecutive days (blue line). On average, PPD-induced receiver degradation of at least 10 dB has been observed two times a day. Although a small number of narrowband RFI events produced receiver degradation of as much as 10 dB, the vast majority of RFI events causing 10 dB or more of receiver degradation are due to PPDs.

Figure 58 indicates that since March 2011, more PPD RFI events are being observed. However, Figure 60 indicates that the higher-power PPDs are not being observed as often. One possible explanation is that the previously observed PPDs have stopped working, and the individuals using them have either not acquired replacements or they have acquired different ones with less-damaging RFI.

Many recent PPDs have been transmitting with estimated frequency spans of 65 MHz to 140 MHz. Although the estimated EIRP of many of these very wide bandwidth PPDs has been as much as +10 dBm, their effect on GPS receiver processing has not been as damaging due to the fact that the RFI is within the GPS receiver processing bandwidth for only a portion of the time.

Spectra of Swept FM with Multipath

One of the most commonly observed characteristics in PPD spectral data has been uniformly spaced nulls as shown in Figure 61 and Figure 62. Figure 63 displays a spectral raster that shows how the nulls shift in frequency over time. Initially, there was uncertainty as to the mechanism responsible for these observations. Under the hypothesis that multipath might be responsible, a single ray multipath model was used to predict the spectral characteristics of a PPD that includes a multipath component. This analysis was pursued in the hope that it might provide additional information as to the exact location of PPDs.

The swept CW signals used by PPDs provide a useful source for characterizing multipath between the PPD and monitoring antennas. Equation (1) models observed CW that is the sum of the direct path and a single reflection in which reflected component has a path length difference of d meters.

(1)

Assuming the reflection is from a metal surface, it should experience a phase reversal. Therefore, destructive cancellation between the direct and multipath component will be present for those frequencies that have a path length difference that is an integer multiple of the wavelength. Equation (2) represents this condition.

(2)

Simplification results in the following expression.

(3)

As an example, if spectral nulls are observed at intervals of 10 MHz, then the path length difference is approximately 30 meters. Spectral nulls have been observed at frequency intervals ranging from 2 MHz to as much as 30 MHz. These null spacing’s translate to path length differences of between 150 meters to 10 meters. Multipath with a path length difference of less than 8 meters will exhibit a single null in the 40 MHz bandwidth of the Snapshot System and therefore cannot be estimated accurately using this technique. A path length difference of 8 meters is also what might be expected for two vehicles traveling side by side on interstate highways since interstate highway specifications require lanes to be approximately 4 meters wide.

Once a possible mechanism for the spectral nulls was hypothesized, additional analysis was performed on specific RFI events in which uniformly spaced spectral had been observed. Snapshot and GPS receiver data indicates the direction of travel for a PPD. With direction of travel known, it is possible to approximate the distance that the PPD is from the monitoring equipment. However, for those RFI events that were examined, the calculated path length difference was similar to or greater than the distance between the PPD and monitoring equipment. The most likely location of surfaces that would reflect the PPD transmission was other vehicles on the NJT. Had the surfaces responsible for the reflections been stationary objects nearby, then it might have been possible to hypothesize the most likely location of the PPD by combining receiver proximity and path length differences.

The magnitude of the reflection coefficient can be estimated by comparing the relative power of the spectral maximum and minimum. However the magnitude of the reflection coefficient can only be bounded since it depends on both the reflection coefficient and the relative path length difference. Since the reflected path travels farther, its magnitude will inherently be reduced, in addition to the loss from the reflection, and therefore the observed relative difference will be smaller than shown by equation (4).

     (4)

For the examples shown in Figure 61 and Figure 62 the spectral max/min was on the order of 10 dB. By using 10 dB for SpectraMaxMin in equation (4), a reflection coefficient of at least 0.5 is calculated. Reflection coefficients of trucks with shipping containers will probably be much greater than 0.5 and could easily be as high as 0.9.

Direction-Finding Methods

After examining more than a thousand examples of PPDs and their effect on GPS receivers, I have concluded that any type of ground-based direction finding system intended to detect and locate low power moving PPDs over a large area using time-difference-of-arrival (TDOA) or beam forming (angle-of-arrival, AOA) techniques will face significant challenges.

Accuracy of TDOA-based location systems can be decomposed into two components: measurement accuracy, and the geometry of the equipment used to make these measurements. In 1982, Paul Chestnut calculated the relationship between accuracy and these two components, showing that geometry is a multiplicative factor. Direction-finding conceptual design typically strives to position the measurement equipment such that it surrounds the area to be monitored, if possible. For those situations where it is not possible to encircle the area, the measurement equipment will typically have a long baseline between its sensors and with a perpendicular orientation with respect to the monitored area. This strategy reduces errors due to geometry.

Measurement error depends on the observable power of the signal to be located. This component will most likely limit the ability to accurately locate low-power moving PPDs. Measurement data from GPS receivers demonstrate the ability to reliably detect the presence of these PPDs, but only when they have been within hundreds of meters. Most PPDs have been observed for 30 to at most 60 seconds. For PPDs traveling along the NJT at a velocity of 30 m/s, this time span implies that they were not detected until they were within 900 meters. Reliable detection was not demonstrated unless they were within 500 meters. This is a direct consequence of the fact that all GPS antenna are designed for hemispherical coverage for satellites above the horizon. The PPDs are at the horizon or lower relative to most GPS antenna patterns. If GPS antennas were used as part of a TDOA-based system, they would need to be positioned no further apart than approximately 600 meters. Using GPS antennas to detect and locate PPDs is inherently limited to proximity detection.

The ability to locate low-power PPDs within a larger area requires a system to be able to detect a PPD by all of its sensors simultaneously from distances much greater than 600 meters. In principal, higher-gain antennas orienting their main beam along the NJT would increase the distance over which PPDs could be detected. Even when high-gain directional antennas have been positioned along the NJT, the observed power has not followed predictions based strictly on FSL. One reason for this is that clear line-of-sight could not be achieved between the high gain antenna and the PPD. Vehicular effects might also be responsible for these observations. What is known is that the power observed by ground-based antennas has shown significant fluctuation, much greater than could be explained by FSL propagation. Ground-based direction finding systems for low-power moving PPDs must be able to simultaneously detect RFI by multiple sensors, in an environment that may at times shield the PPD from its sensors, and that also has fluctuating observable power.

The ability to observe, detect, and locate low-power moving PPDs over a large area would require a system to have its monitoring antenna located high above the NJT, and oriented to look down on the NJT and the surrounding area. Although such a system must still contend with shielding from the vehicle itself, it would be the only approach that could potentially observe these PPDs over a large area, simultaneously by all of its measurement sensors. Implementing such a concept may be expensive.

A less expensive approach might rely on proximity detection, with many sensors on the ground, each monitoring their own small area, and only report PPDs that travel close to each of them. One such approach, referred to as crowd sourcing, uses cell phones to aid in detecting and locating PPDs. Crowd sourcing is a form of proximity detection.

Summary

The first evidence of low-power moving PPDs along the NJT used two GPS receivers separated by considerable distance and then correlated their responses. This approach is only useful for detection of PPDs traveling in close proximity to the GPS receivers. Analysis of GPS receiver normalized C/N₀ also provided a basis for determining if RFI might be from a moving emitter. The shape of normalized C/N₀ versus time not only provides clues that the RFI source is in motion, but may even be correlated with their possible travel paths, when blockage exists between the GPS antenna and local roadways.

Autonomous operation is a necessity for detecting low-power moving PPDs, since they may be observable only a few times a day and for less than 60 seconds.

Capturing real-time samples of these intermittent RFI events determined the existence of many different types of PPDs. Almost all use some form of swept FM modulation. Analysis of their spectra and modulation indicates that many devices are probably not operating as their manufacturer intended. Modulation waveforms of PPDs have included triangle, highly linear sawtooth, sawtooth with synchronous perturbations on top of the fundamental sawtooth, and sawtooth with analog modulation. The leading hypothesis for this observation is that the devices are not shielded very well and that the internal modulator is susceptible to coupling from either other circuits within the PPD itself or from external electronic devices operating in the vicinity of the PPD.

Acknowledgments

The author thanks the FAA for support in this investigation, Rich Holley of ICE-Online for help in utilizing capabilities of the ICEPOD6-M5, and Julian Babel of the FAA Technical Center for regularly swapping external hard drives attached to the Snapshot System.

---

Joe Grabowski is a systems engineer at Zeta Associates where he works on a variety of GPS projects in support of the FAA, as well as communications systems and digital signal processing applications. He received an M.S.EE from Purdue University. Since 2010 he has been involved in the investigation of personal privacy device impacts on FAA SBAS and GBAS sites.