# Characterization of the Multipath Situation Under Meaconing

Mathieu Hussong, Emile Ghizzo, Carl Milner, Axel Garcia Pena, Julien Lesouple

► To cite this version:

Mathieu Hussong, Emile Ghizzo, Carl Milner, Axel Garcia Pena, Julien Lesouple. Characterization of the Multipath Situation Under Meaconing. Navigation, 2026, 73 (1), pp.navi.738. 10.33012/navi.738. hal-05481002

HAL Id: hal-05481002

https://hal.science/hal-05481002v1

Submitted on 28 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
# Characterization of the multipath situation under meaconing

Mathieu HUSSONG |

Emile GHIZZO |

Carl MILNER |

Axel GARCIA |

Julien LESOUPLE |

Fédération ENAC ISAE-SUPAERO ONERA,
Université de Toulouse, France.

**Correspondence**

Email: mathieu.hussong@gmail.com

**Abstract**

With the escalating prevalence of in-band interference, the vulnerability of global navigation satellite system (GNSS) receivers to potential jamming or spoofing threats has become a critical concern. The proliferation of GNSS repeaters, commonly known as meaconers (electronic devices that intercept GNSS signals, amplify them, and subsequently rebroadcast them) contributes to this threat landscape, by compromising GNSS accuracy, availability, continuity, and integrity of the nearby receivers. This paper investigates the impact of a meaconer on a GNSS receiver, when the received satellite signals are in the multipath situation. The multipath situation is the situation when the meaconing GNSS signal affects the tracking of the authentic GNSS signal, as if the receiver were exposed to a strong classical multipath. This paper characterizes and bounds the estimated carrier-to-noise ratio ($C/N_0$) and tracking loop outputs in the multipath situation. Then, this paper identifies the geometrical conditions under which a satellite is affected by meaconing multipath. Finally, extensive simulations validate the mathematical models by comparing the expected $C/N_0$ and tracking loop outputs to highly realistic simulation results. The findings reveal significant distortions in the $C/N_0$ for satellites in the multipath situation. In rapid-dynamic scenarios, the $C/N_0$ can decrease up to 20 dB.Hz, and $C/N_0$ distortions may have more complex yet predictable patterns in slow-dynamic scenarios. The delay lock loop (DLL) outputs are shown to be corrupted by deterministic offsets up to ±15 meters, accompanied by increased standard deviations due to the degraded tracking performance caused by the meaconer interference.

**Keywords**

GNSS, meaconer, multipath situation, spoofing

# 1 | INTRODUCTION

## 1.1 | Context of the study

As noted by the International Telecommunication Union et al. (2024) and Garcia-Pena et al. (2020), the increasing occurrence of in-band interference may render GNSS receivers susceptible to jamming or spoofing threats, potentially compromising their performance. The proliferation of GNSS repeaters, commonly referred to as meaconers, contribute to this threat landscape. Meaconers are electronic devices that capture electromagnetic signals around a GNSS frequency thanks to a first receiving antenna, then amplify the received signals with a specific gain, and finally broadcast back the amplified signals thanks to a second emitting antenna. Every receiver within the line of sight of the meaconer's emitting antenna receives the signals with a greater delay than the one of the authentic GNSS signals directly transmitted by the satellites. This delay comprises the processing time required for amplification within the meaconer, and the geometric distance between its emitting antenna and the user's receiver.

Numerous studies have investigated the general impact of meaconers on GNSS signals. Coulon et al. (2020) first illustrated through simulations that meaconers could significantly degrade the accuracy and availability of GNSS receivers in their vicinity. Dovis (2015) discussed various types of GNSS interference, including meaconing, jamming, and spoofing, highlighting their potential to disrupt GNSS-dependent systems. Their study revealed that meaconing can induce significant deviations in positional accuracy, leading to substantial errors in navigation and timing information. Dobryakova and Ochin (2014) examined the impact
of meaconing on GNSS receiver integrity monitoring, emphasizing its potential to generate hazardous but detectable misleading information. They also noted that meaconing interference, while pervasive, poses serious concerns due to its capacity to disrupt GNSS-reliant operations.

## 1.2 | Meaconer description and impacts

A meaconer is characterized by its gain $G_m$, intrinsic delay $\tau_m$, and phase offset $\theta_m$. In this paper, the meaconer gain $G_m$ is defined as the ratio between the signal power at the meaconer's receiving antenna input and the signal power at its emitting antenna output. The intrinsic delay $\tau_m$ represents the group delay of the signal between the receiving antenna input and emitting antenna output. The phase offset $\theta_m$ represents the differences of the instantaneous phases between the signal at the emitting antenna input and receiving antenna output. All these parameters are considered constant and known for a given meaconer.

In Fig. 1, the satellite signal is captured by both the meaconer and nearby GNSS receivers. The signal directly transmitted from the satellite to the GNSS receiver is termed the authentic signal (green in the figure), with $d_{SU}$ denoting the propagation distance (i.e., the Euclidean distance between the satellite and the GNSS receiver antenna phase centers). The signal rerouted through the meaconer is termed the meaconer signal (red in the figure), with $d_{SM}$ and $d_{MU}$ representing the distances between the satellite and the meaconer antenna phase centers, and the meaconer and GNSS receiver antenna phase centers, respectively. The total propagation distance of the meaconer signal is $d_{SM} + d_{MU}$.

<figure><img src="image_2.png" /><figcaption>FIGURE 1 Illustration of meaconer effects on nearby GNSS receivers.</figcaption></figure>

### 1.2.1 | Mathematical model of a meaconer

The GNSS signals rebroadcast by the meaconer have the same structure as the authentic signals received at the user's GNSS receiver antenna, but they differ in power (due to the meaconer gain $G_m$, the different space and atmospheric losses, the antenna gains and the environments around the antennas), time delay (due to the meaconer intrinsic delay $\tau_m$, the geometrical distance between the two meaconer's antennas, the different signal propagation times, and the antenna hardware biases), carrier frequency and carrier phase offset (due to the relative motions between the satellite, the meaconer and the user, and other propagation effects), as evidenced by Hussong et al. (2023) and Steindl et al. (2013). Moreover, the meaconer signal contains additional noise, generated by the meaconer active components. In this paper, the relative parameters of interest between the authentic signal and the meaconer one are expressed as follows:

* The relative power denoted as $\Delta g$ represents the ratio between the meaconer signal useful power and the authentic signal useful power at the user's antenna output.

* The relative noise power spectrum density, denoted as $\Delta N$, represents the ratio between the actual thermal noise power spectrum density (PSD) under meaconing interference, divided by the thermal noise PSD that would have been observed without meaconing (if only receiving the authentic signal). The thermal noise PSD are measured at the correlator input of the user's receiver.
* The relative delay $\Delta\tau$ represents the difference between the propagation time of the meaconer signal and the propagation time of the authentic signal at the user's antenna output.

* The relative frequency $\Delta f$ represents the difference between the received carrier frequency of the meaconer signal and the received carrier frequency of the authentic signal at the user's antenna output.

* The relative phase $\Delta\theta$ represents the difference between the received instantaneous phase of the meaconer signal and the received instantaneous phase of the authentic signal at the user's antenna output.

Meaconer signals share some similarities with classical multipath signals (that have been analyzed for instance in He et al. (2011)), as both represent delayed versions of the line-of-sight GNSS signal. However, meaconer signals differ fundamentally due to their arbitrarily high relative gain ($\Delta g$), whereas classical multipath signals are typically analyzed under the assumption of low relative gain ($\Delta g \ll 0$ dB). This distinction precludes the common small-gain approximation used in traditional multipath studies, necessitating a detailed analysis of meaconing effects where this assumption cannot be made. Moreover, classical multipaths are often modeled by random processes as in Hu et al. (2023) due to the unknown nature of their origin, whereas meaconing multipaths can be modeled deterministically when the position and characteristics of the meaconer are known. The predictable properties of the meaconer signal allow to deterministically derive the meaconer impact on the correlator outputs and on the $C/N_0$ estimations.

## 1.2.2 | Classification of the meaconer impacts at the correlator output

Hussong et al. (2023) has proposed a classification of the meaconer impacts at the correlator output level, laying the mathematical groundwork of meaconing interference from results of Bamberg et al. (2018) and Peng et al. (2019). For each authentic GNSS signal reaching the user's GNSS antenna, the impact of the meaconer at the correlator output can be cataloged in one of four situations. These four distinct situations are illustrated in Fig. 2 and briefly detailed below.

* In the nominal situation, the receiver is synchronized with the authentic signal parameters, without significant distortion induced by the meaconer.

* In the jamming situation, the receiver is synchronized with the authentic signal parameters, and the meaconing peak is significantly distant (in terms of relative delay) to be disregarded. The impact of the meaconer on the correlator outputs is thus only dictated by the rebroadcast noise of the meaconer signal.

* In the spoofing situation, the receiver is synchronized with the meaconing signal parameters (meaconing peak), and the authentic peak is significantly distant (in terms of relative delay) to disregard the distortion induced by the authentic signal peak on the meaconer one.

* In the multipath situation, the authentic and meaconer peaks are sufficiently close to each other (in terms of relative delay) to simultaneously affect the synchronization process. This situation is similar to a classical multipath interference, where both the authentic signal and a reflection of that authentic signal arrive at the receiver through different paths. The similarity of this interference situation with classical multipath motivated its name - the *multipath situation*. However, this situation differs from classical multipath because the power of the meaconer signal can be arbitrary large, and especially, larger than the authentic signal power. Additionally, the properties of the meaconer signal (power, delay, Doppler, phase) evolve differently as the properties of a classical multipath signal (as discussed in the paper), due to the different nature of the interfering source - the meaconer.

<figure><img src="image_3.png" /><figcaption>FIGURE 2 Classification of the situations at the correlator output. *E*, *P*, and *L* respectively represent the early, prompt, and late correlators.</figcaption></figure>
## 1.3 Motivations to Characterize the Multipath Situation

The nominal, jamming, and spoofing situations and their cascading impacts on pseudoranges, $C/N_0$, and estimated positions have been extensively analyzed in Hussong et al. (2025). However, the multipath situation remains understudied due to specific scenario designs or assumptions. For instance, in civil aviation applications (Hussong et al., 2023), the distances between the aircraft and meaconer typically ensure that meaconing signals arrive with sufficient delays to avoid the multipath situation.

Characterizing the multipath situation under meaconing is critical. In this situation, both the authentic and meaconer signals simultaneously influence the GNSS receiver's tracking, potentially causing severe DLL degradations. Akin classical GNSS multipath (He et al., 2011), DLL outputs may exhibit mean errors up to ±15 meters, with standard deviations reaching 6 meters. Destructive interference between the two signals could also drastically reduce $C/N_0$ estimations.

In non-aviation scenarios (e.g., static, pedestrian, vehicular), the multipath situation is more likely and warrants further investigation. Indeed, the reduced distance between the meaconer and the user could cause the repeated signal to arrive with a smaller delay at the user's antenna. Studies such as Ghizzo et al. (2024, 2025) have characterized DLL distortions and $C/N_0$ degradations as functions of the relative parameters $\Delta\eta = [\Delta g, \Delta N, \Delta\tau, \Delta f, \Delta\theta]^T$ presented above. However, these models are challenging to interpret, since it is unclear how the relative parameters depend on the scenario and how they could be predicted from the geometry of the user's environment. A detailed characterization of these conditions could bridge this gap and facilitate the prediction of when, where, and how the multipath situation occurs.

## 1.4 | Objectives of the Study

This study aims to characterize and quantify the impact of meaconing in the multipath situation on DLL outputs and $C/N_0$ estimations through mathematical modeling and realistic simulations. Specifically, this paper:

1. Derives the GNSS receiver correlator outputs in the presence of meaconing, based on the meaconing signal characteristics, by using state-of-the-art models.

2. Quantifies DLL output errors and $C/N_0$ degradations under meaconing interference in various configurations.

3. Establishes a mapping between the multipath situation and user environment geometry, facilitating the prediction and interpretation of meaconing impacts in relation to satellite and meaconer positions.

4.Validates these findings through realistic simulations, offering visualizations of meaconer effects for improved understanding.

This paper offers several original contributions. First, this analysis enables the prediction of both the mean and worst impacts of meaconing multipath on a GNSS receiver as a function of the relative parameters. Second, the paper introduces the concept of the multipath cone, a region where a GNSS receiver is susceptible to meaconing multipath. It presents a mathematical model of the multipath cone and its properties, providing a means to predict when and where a GNSS user will experience multipath and which satellite signals will be affected by multipath errors. Third, it maps the DLL output errors and $C/N_0$ degradations to the geometry of the user's environment, enabling users to easily quantify the impact of meaconing multipath on individual satellite signals by only considering the azimuth and elevation angles of the satellites. Finally, the paper validates these findings through highly realistic simulations, demonstrating the actual effects of a meaconer on a user's GNSS receiver in the multipath situation. These visualizations aid in better understanding the challenges posed by meaconers and the impacts of meaconing multipath.

This paper is organized as follows: Section 1 has introduced the context and categorizes the impacts of meaconers on GNSS receivers. Section 2 details mathematical models of the DLL outputs and $C/N_0$ estimations under meaconing from the state of the art. Section 3 introduces the multipath cone concept. Section 4 maps meaconing multipath degradations to user environment geometry. Finally, Section 5 validates these findings through simulations, providing actionable insights into meaconer impacts.

## 2 | MATHEMATICAL MODELS OF THE GNSS OBSERVABLES IN THE MULTIPATH SITUATION

This section presents the theoretical model of the correlator output, tracking loops, and $C/N_0$ in the multipath situation. The models have been derived in previous works as a function of the relative parameters $\Delta\eta$ for GPS L1 C/A. A list of all the variables of this paper is provided in Appendix C for a clearer understanding of the presented mathematical models.
## 2.1 | Model of the correlator outputs

GNSS implements direct-sequence spread spectrum (DS-SS). The received signal is correlated with a local replica controlled by the code and carrier numerically controlled oscillators over the integration time $T_i$. Typically, GNSS receivers encompass at least three correlators: the early ($\Lambda_E$), prompt ($\Lambda_P$), and late ($\Lambda_L$) correlators, where the local replicas are respectively shifted in code by $-c_\tau/2$, 0, and $c_\tau/2$ ($c_\tau$ is the chip spacing). The correlator output in the presence of meaconing interference has been derived as a function of the tracking errors $\varepsilon_\eta = [\varepsilon_\tau, \varepsilon_\theta, \varepsilon_f]^\top$ and relative parameters $\Delta\nu$ in Hussong et al. (2023). The correlator output at epoch $k$ is expressed as the linear combination

$$ \Lambda(\varepsilon_\eta, \Delta\nu) = \Lambda_a(\varepsilon_\eta) + \Lambda_s(\varepsilon_\eta, \Delta\nu) + \Lambda_n \quad (1) $$

with $\Lambda_a$ and $\Lambda_s$ the nominal and spoofing contributions expressed as

$$ \Lambda_a(\varepsilon_\eta) = \sqrt{C_a} d_k \zeta_\tau(\varepsilon_\tau) \zeta_f(\varepsilon_f) e^{j\varepsilon_\theta} \quad \text{and} \quad \Lambda_s(\varepsilon_\eta, \Delta\nu) = \sqrt{\Delta g C_a} d_k \zeta_\tau(\varepsilon_\tau + \Delta\tau) \zeta_f(\varepsilon_f + \Delta f) e^{j(\varepsilon_\theta + \Delta\theta)}. \quad (2) $$

Here, $\zeta_\tau$ and $\zeta_f$ are the code and frequency synchronization mismatch functions defined in Ghizzo et al. (2024, Eq. (7)). $C_a$ is the received signal power, and $d_k$ is the navigation message bit (considered constant over the integration time). The noise contribution, $\Lambda_n$, can be defined as Gaussian noise with power $P_n$, expressed in Ghizzo et al. (2024) by

$$ P_n = \frac{N_0}{T_i} (1 + \Delta N) \zeta_\tau(0). \quad (3) $$

## 2.2 | Model of the tracking loops

The dynamic behavior of the tracking loops has been modeled in Ghizzo et al. (2025) as a non-linear system of two difference equations, depending on the relative parameters $\Delta\eta$. This paper focuses on the system's dynamic value at lock (i.e., where the loop has successfully established and maintains synchronization with the incoming signal dynamics). The tracking errors at lock have been shown to be equivalent to the system's stable equilibria (SE) values ($\varepsilon_\tau$, $\varepsilon_\theta$, and $\varepsilon_f$), being the solutions of this system (without stress error)

$$ \left\{ \begin{array}{l} D_{\tau}(\varepsilon_{\eta}, \Delta\nu) = 0, \qquad D_{\theta}(\varepsilon_{\eta}, \Delta\nu) = 0, \qquad \chi_{f}(\varepsilon_{\eta}, \Delta\nu) = 0, \\ \frac{\partial D_{\tau}(\varepsilon_{\eta}, \Delta\nu)}{\partial \varepsilon_{\tau}} > 0, \qquad \frac{\partial D_{\theta}(\varepsilon_{\eta}, \Delta\nu)}{\partial \varepsilon_{\theta}} > 0, \qquad \frac{\partial \chi_{f}(\varepsilon_{\eta}, \Delta\nu)}{\partial \varepsilon_{f}} > 0. \end{array} \right. \quad (4) $$

$D_\tau$ and $D_\theta$ are the code and phase discriminator outputs and $\chi_f$ the phase discriminator difference. Details about these discriminators are provided in Appendix B. They can be expressed as

$$ \begin{aligned} D_{\tau}(\varepsilon_{\eta}, \Delta\nu) &= \frac{C_a}{2P_a} (\zeta_f(\varepsilon_f)^2 Z(\varepsilon_{\tau}, 0) + \Delta g \zeta_f(\varepsilon_f + \Delta f)^2 Z(\varepsilon_{\tau} + \Delta\tau, 0) + 2\sqrt{\Delta g} \cos(\Delta\theta) \zeta_f(\varepsilon_f) \zeta_f(\varepsilon_f + \Delta f) Z(\varepsilon_{\tau}, \Delta\tau)) \\ D_{\theta}(\varepsilon_{\eta}, \Delta\nu) &= \varepsilon_{\theta} + \frac{\Delta\theta}{2} - \operatorname{atan}\left(\gamma_{\Delta}(\varepsilon_{\tau}, \varepsilon_f) \tan\left(\frac{\Delta\theta}{2}\right)\right) - p\pi \end{aligned} \quad (5) $$

$$ \chi_f(\varepsilon_\eta, \Delta\nu) = \varepsilon_f + \Delta f - \frac{1}{2\pi T_i} \left[ \operatorname{atan}\left(\gamma_\Delta(\varepsilon_\tau, \varepsilon_f) \tan\left(\frac{\Delta\theta}{2}\right)\right) - \operatorname{atan}\left(\gamma_\Delta(\varepsilon_\tau, \varepsilon_f) \tan\left(\pi\Delta f T_i + \frac{\Delta\theta}{2}\right)\right) \right] - \frac{p'}{2T_i}. $$

The integers $p$ and $p'$ represent the phase and frequency ambiguity respectively and

$$ Z(\tau_1, \tau_2) \triangleq \zeta_{\tau} \left( \tau_1 + \frac{c_{\tau}}{2} \right) \zeta_{\tau} \left( \tau_1 + \tau_2 + \frac{c_{\tau}}{2} \right) - \zeta_{\tau} \left( \tau_1 - \frac{c_{\tau}}{2} \right) \zeta_{\tau} \left( \tau_1 + \tau_2 - \frac{c_{\tau}}{2} \right) \quad (6) $$

$$ \gamma_{\Delta}(\varepsilon_{\tau}, \varepsilon_{f}) \triangleq \frac{\zeta_{\tau}(\varepsilon_{\tau}) \zeta_{f}(\varepsilon_{f}) - \sqrt{\Delta g} \zeta_{\tau}(\varepsilon_{\tau} + \Delta\tau) \zeta_{f}(\varepsilon_{f} + \Delta f)}{\zeta_{\tau}(\varepsilon_{\tau}) \zeta_{f}(\varepsilon_{f}) + \sqrt{\Delta g} \zeta_{\tau}(\varepsilon_{\tau} + \Delta\tau) \zeta_{f}(\varepsilon_{f} + \Delta f)}. \quad (7) $$

The code tracking error at lock $\varepsilon_\tau$ can be found solving (4) numerically, and is presented in Fig. 3 (explained hereafter) for GPS L1 C/A signals, which structure is detailed in Appendix B. The tracking error at lock (i.e., the SE), does not represent the actual errors, but rather the tracking error to which the system tries to converge. In slow-dynamic scenarios (i.e.: static, pedestrian, car), the SE can be assimilated to the DLL output error in the code pseudorange.
<figure><img src="image_4.png" /><figcaption>FIGURE 3 Maximum and mean values of the DLL errors at lock with respect to Δf, Δτ and Δg, considering Δθ ~ U[0, 2π] for GPS L1 C/A.</figcaption></figure>

Fig. 3a represents the absolute value of the tracking mean error at lock, when averaged over Δθ uniformly distributed between 0 and 2π, and as a function of Δf and Δτ. The results are given for GPS L1 C/A signals. This mean error is a good approximation of the DLL output error that is found in the code pseudorange estimation, in the situations when Δθ varies more than 2π during Tᵢ (as evidenced in Section 5). Fig. 3a highlights that the code pseudoranges can be corrupted with error of ±11 meters for many relative parameters values (mainly when Δτ < 1 chip and when |Δf| < 25 Hz). Fig. 3b reports the maximum absolute value of the tracking error at lock. The DLL errors can potentially reach ±15 meters when Δτ < 1 chip and when |Δf| < 25 Hz, and for specific values of Δθ. Especially when Δf ∈ [1; 10] Hz, large DLL errors are observed even with very small relative delay Δτ. Fig. 3c shows the influence of the relative power Δg on the maximum tracking errors at lock, exhibiting that the largest errors are almost proportional to Δg (in linear scale).

All in all, Fig. 3 shows that the DLL outputs may be corrupted by huge deterministic errors up to ±15 m under meaconing multipath, especially when Δτ < 1 chip and when |Δf| < 25 Hz). When the relative delay Δτ exceeds 1 chip, the deterministic part of the DLL output errors drops to zero meter. When the absolute relative Doppler |Δf| becomes larger than 25 Hz, the deterministic part of the DLL output errors decreases, but might still be significative depending on the error tolerance of the user's application.

## 2.3 | Impact of the tracking loops distortions on the C/N₀

The expected value of the C/N₀ estimate in the multipath situation (with moment method) has been modeled in Ghizzo et al. (2024) as a function of the relative parameters Δη:

$$C_{\Delta\eta} = \mathbb{E}\left[\frac{\widehat{C}}{N_0}\right] = \frac{1}{T_i} \frac{\sqrt{\overline{P_d}^2 - C_a^2\sigma_d^2}}{P_n + \overline{P_d} - \sqrt{\overline{P_d}^2 - C_a^2\sigma_d^2}}, \quad (8)$$

with

$$\overline{P_d} = \left( \zeta(\varepsilon_\eta)^2 + \Delta g \zeta(\varepsilon_\eta + \Delta\eta)^2 + 2\sqrt{\Delta g \zeta(\varepsilon_\eta)\zeta(\varepsilon_\eta + \Delta\eta)} \frac{\sin(\pi M \Delta f T_i)}{M \sin(\pi \Delta f T_i)} \cos(\Delta\theta) \right) C_a \quad (9)$$

$$\sigma_d^2 = 2\Delta g \zeta(\varepsilon_\eta)^2 \zeta(\varepsilon_\eta + \Delta\eta)^2 \left[ 1 + \frac{\sin(2\pi M \Delta f T_i)}{M \sin(2\pi \Delta f T_i)} \cos(2\overline{\Delta\theta}) - 2 \frac{\sin^2(\pi M \Delta f T_i)}{M^2 \sin^2(\pi \Delta f T_i)} \cos^2(\overline{\Delta\theta}) \right], \quad (10)$$

where T_c is the C/N₀ estimation time, $\overline{\Delta\theta} = \pi M \Delta f T_i + \Delta\theta$ the mean relative phase within T_c and M = T_c/Tᵢ the number of integration time within T_c.

Fig. 4 plots the values of (8) as a function of Δf, Δτ, and Δg, with the approximation ε_η = 0, with a nominal C/N₀ of 40 dB-Hz, T_c = 1 s, Tᵢ = 20 ms, and still considering GPS L1 C/A signals. Fig. 4a shows the mean values of the theoretical C/N₀, averaged
over $\Delta\theta$ uniformly distributed between 0 and $2\pi$ (i.e., $\Delta\theta \sim U[0, 2\pi]$). The results are plotted for $\Delta g = \Delta N = -3$ dB, as a function of $\Delta f$ and $\Delta\tau$. It demonstrates that when $\Delta\tau < 1$ chip, the $C/N_0$ is significantly degraded (as for the DLL output errors), even with a low received meaconer power. The degradations are mainly observed for $|\Delta f| < 25$ Hz, except when $\Delta f$ is really close to zero ($|\Delta f| < 0.1$ Hz), where both authentic and meaconer signals can combine with constructive interference in this case. Fig. 4b represents the lowest theoretical $C/N_0$ values for $\Delta\theta$ varying between 0 and $2\pi$. These results are very similar to the mean values of Fig. 4a. This similarity indicates that $\Delta\theta$ does not significantly affect the $C/N_0$ estimations, except for small relative Doppler values $\Delta f$, when $|\Delta f| < T_e^{-1} = 1$ Hz. Additionally, when $|\Delta f| < 0.1$ Hz, the mean $C/N_0$ is marginally affected by meaconing interference, whereas the lowest values show degradations around 10 dB.

Fig. 4c depicts the mean $C/N_0$ values, averaged over $\Delta\theta \sim U[0, 2\pi]$, and for $\Delta\tau = 0$ chip (as this relative delay produces large $C/N_0$ degradations). The $C/N_0$ are plotted against $\Delta f$ and $\Delta g$. Even with a small relative power of $\Delta g = -30$ dB, $C/N_0$ is degraded by about 3 dB. The degradations exceed 15 dB when $\Delta g > -10$ dB and $|\Delta f| \in [0.5, 25]$ Hz. In all plots, the $C/N_0$ values are symmetrical with respect to $\Delta f$.

All in all, Fig. 4 shows that the estimated $C/N_0$ can be drastically reduced under meaconing multipath, especially when $\Delta\tau < 1$ chip and $|\Delta f| < 25$ Hz. This drop highlights the lack of robustness of the moment method $C/N_0$ estimation under meaconing interference, potentially causing loss of lock of the GNSS signals.

<figure><img src="image_5.png" /><figcaption>FIGURE 4 Mean and smallest values of the $C/N_0$ estimates (moment method) with respect to $\Delta f$; $\Delta\tau$ and $\Delta g$, considering $\Delta\theta \sim U[0, 2\pi]$ for GPS L1 C/A</figcaption></figure>

## 3 | MAPPING OF THE MULTIPATH SITUATION TO THE GEOMETRY

This section aims to determine the geometrical condition under which a satellite signal is received in the multipath situation, in order to better visualize the scenarios producing the multipath situation for a given satellite. Indeed, the relative parameters $\Delta\eta$ are useful for modeling the $C/N_0$ and the DLL outputs, but they can not provide a clear understanding of the meaconing multipath impacts during real scenarios that are defined based on their geometries. By mapping the multipath situation with respect to the geometry of the user's environment, this section identifies the geometrical configurations yielding to the multipath situation.

### 3.1 | Conditions to observe the multipath situation

The multipath situation is dependent on two factors (as illustrated by Figs. 3 and 4): the delay condition and the Doppler criterion, defined as follows:

* **Delay condition** - To observe the multipath situation, both the authentic and meaconer peaks shall affect the correlators. For GPS L1 C/A, the signal peaks after correlation form a triangle of width 2 chips. The early and late correlators are computed at a delay difference of $c_\tau/2$ with respect to the prompt correlator. The meaconer peak can only be observed with a delay greater than the authentic peak (i.e.: $\Delta\tau \ge 0$ s) because the meaconer signal detours before reaching the user GNSS antenna, resulting in a larger propagation time. Assuming the receiver tracks the authentic peak, the meaconer peak distorts the late
correlator if the delay difference between the two peaks is smaller than $T_c + \frac{c_τ}{2}$; where $T_c$ is the chip duration. Conversely, if the receiver tracks the meaconer peak, the authentic peak distorts the early correlator if $\Delta\tau \le T_c + \frac{c_τ}{2}$. Fig. 5 illustrates the correlator outputs in the presence of authentic and meaconer signals. Only when $\Delta\tau < T_c + \frac{c_τ}{2}$, the sum of the authentic and meaconer peaks modifies the correlator values, resulting in a new equilibrium different from the nominal one (as also evidenced by Fig. 3). In the illustration of Fig. 5, $c_τ = T_c$ for pedagogic reasons (more visible in the illustration), but the rest of this paper uses $c_τ = T_c/10$ because this value is commonly used in GNSS receivers as it reduces the tracking estimation error (Van Dierendonck et al., 1992). Larger choices of $c_τ$ would cause the same impacts but with larger amplitudes.

<figure><img src="image_6.png" /><figcaption>FIGURE 5 Illustration of the delay condition to observe the multipath situation for GPS L1 C/A signals.</figcaption></figure>

* **Doppler criterion** - The $C/N_0$ and DLL outputs strongly depend on the relative Doppler $\Delta f$ as evidenced by Figs. 3 and 4. To observe large multipath errors and $C/N_0$ degradations, the authentic signal and the meaconer signal should have a relative Doppler shift at the user GNSS antenna smaller than 25 Hz. Otherwise, the multipath situation causes smaller degradations on the GNSS observables. Whereas the delay condition is a mandatory condition for a signal to be in the multipath situation, the Doppler criterion only indicates the most affected signals among all the signals respecting the delay condition, and therefore helps to identify the satellite signals bearing high degradations caused by meaconing multipath.

## 3.2 | Definition of the geometry in this study

In this paper, the meaconer impact is computed according to the position of the user relative to the meaconer. This approach allows for better visualization and understanding of the meaconing effects on GNSS receivers. The meaconer impact also depends on the velocities of both the meaconer and the user, as well as the positions of the satellites and the meaconer characteristics. The term geometry refers to the relative position and velocities of the user, the meaconer, the satellites, and also the meaconer gain, intrinsic delay, frequency and phase offsets.

## 3.3 | Mapping of the delay condition to the geometry

The delay condition $M$ is defined with respect to the relative parameters as:

$$ M \Leftrightarrow \Delta\tau < T_c \left(1 + \frac{c_τ}{2}\right) = T_{\max}. \qquad (11) $$

The relative delay $\Delta\tau$ can be expressed as the difference between the meaconer signal propagation time $\tau_s$ and the authentic signal propagation time $\tau_a$. From Fig. 1, the relative delay can be expressed as:

$$ \Delta\tau = \tau_s - \tau_a = \left( \frac{d_{SM}}{c} + \tau_m + \frac{d_{MU}}{c} + \tau_{\text{ant},s} \right) - \left( \frac{d_{SU}}{c} + \tau_{\text{ant},a} \right) = \frac{d_{SM} + d_{MU} - d_{SU}}{c} + \tau_m + \Delta\tau_{\text{ant}}, \qquad (12) $$

where $c$ represents the speed of light, $\tau_m$ is the meaconer intrinsic delay, and $\Delta\tau_{\text{ant}}$ accounts for the antenna group delay difference between the authentic $\tau_{\text{ant},a}$ and meaconer $\tau_{\text{ant},s}$ signal delays at the user's receiver antenna. The expression of $\Delta\tau$ (33) can be
rearranged using the parameters defined in Fig. 6 to obtain a geometric mapping of the delay condition. In Fig. 6, $M'$ is the orthogonal projection of $M$ onto the line (SU), and $O$ is the orthogonal projection of $S$ onto the line (MU). $\beta_1$ represents the non-oriented angle between the meaconer and the satellite as seen by the user, and $\beta_2$ represents the non-oriented angle between the imaginary point $O$ and the satellite as seen by the meaconer. $\gamma_1$ represents the non-oriented angle between the user and the meaconer as seen by the satellite, and $\gamma_2$ represents the non-oriented angle between the meaconer and the imaginary point $O$ as seen by the satellite.

<figure><img src="image_7.png" /><figcaption>FIGURE 6 Illustration of the satellite (S), meaconer (M), and user (U) in the (SMU) hyperplane, with the authentic signal (green) and the meaconer signal (red).</figcaption></figure>

The objective is to obtain an expression of $\Delta\tau$ that depends only on terms known in the geometry. To do so, $\Delta\tau$ is derived in terms of $d_{SU}$, $d_{MU}$, and the angle $\beta_1$. Using the parameters from Fig. 6, the relative delay (33) becomes:

$$ \begin{aligned} \Delta\tau &= \frac{d_{SM} + d_{MU} - d_{SM'} - d_{M'U}}{c} + \tau_m + \Delta\tau_{\text{ant}} \\ &= \frac{d_{SM} - d_{SM'}}{c} + \frac{d_{MU}}{c} \left(1 - \frac{d_{M'U}}{d_{MU}}\right) + \tau_m + \Delta\tau_{\text{ant}} \\ &= \frac{d_{SM} - d_{SM'}}{c} + \frac{d_{MU}}{c} (1 - \cos(\beta_1)) + \tau_m + \Delta\tau_{\text{ant}}. \end{aligned} \quad (13) $$

The computation of $(d_{SM} - d_{SM'})$ is done in Appendix A. It is proved that an excellent approximation of the difference is $d_{SM} - d_{SM'} \approx 0$ m. It follows,

$$ \Delta\tau \approx \frac{d_{MU}}{c} (1 - \cos(\beta_1)) + \tau_m + \Delta\tau_{\text{ant}}. \quad (14) $$

By injecting (14) into (11), the delay condition can now be expressed as

$$ \mathbb{M} \Leftrightarrow d_{MU} (1 - \cos(\beta_1)) < c (T_{\text{max}} - \tau_m - \Delta\tau_{\text{ant}}). \quad (15) $$

Particularly, if $T_{\text{max}} < \tau_m + \Delta\tau_{\text{ant}}$, this condition is never satisfied, and the multipath situation is never observed. Furthermore, if $d_{MU} < c(T_{\text{max}} - \tau_m - \Delta\tau_{\text{ant}})/2$, the condition is always satisfied, and the multipath situation is observed for all the visible satellites. Otherwise, for a given geometry, the satellites in the multipath situation $\mathbb{M}$ are the ones seen inside a cone with summit $U$, symmetry axis (UM), and aperture angle $\beta_{\text{max}}$ given by

$$ \beta_{\text{max}} = \cos^{-1} \left( 1 - c \frac{T_{\text{max}} - \tau_m - \Delta\tau_{\text{ant}}}{d_{MU}} \right). \quad (16) $$

A representation of the multipath cone $\mathbb{M}$ depicted by (15) is shown in Fig. 7, where the user $U$ is in the air and the meaconer $M$ is on the ground. In this configuration, only some signals are in the multipath situation. These satellite signals are received in a direction close to the direction of the meaconer from the user perspective. As the meaconer is often seen with an elevation around
0°, the signals in the multipath situation are more likely to have low elevations. Moreover, the closer the user is to the meaconer, the larger the multipath cone aperture $\beta_{max}$ is, as illustrated by the two examples on the skyplot in Fig. 7b.

<figure><img src="image_8.png" /><figcaption>FIGURE 7 Illustrations of the multipath cone M.</figcaption></figure>

## 3.4 | Mapping of the Doppler criterion to the geometry

The relative Doppler $\Delta f$ can be expressed as in Petovello (2015) as

$$ \Delta f = f_s - f_a = \frac{(\mathbf{v}_S - \mathbf{v}_M)^T \cdot \mathbf{u}_{SM} + (\mathbf{v}_M - \mathbf{v}_U)^T \cdot \mathbf{u}_{MU}}{\lambda} - \frac{(\mathbf{v}_S - \mathbf{v}_U)^T \cdot \mathbf{u}_{SU}}{\lambda}, \quad (17) $$

where $f_s$ (resp. $f_a$) is the received frequency at the user's GNSS antenna of the meaconer (resp. authentic) signal. $v$ represents the velocity vectors, and $u$ denotes the unit direction vectors. $\lambda$ is the wavelength of the GNSS signal. Note that the receiver clock drift has no impact on the relative Doppler $\Delta f$, as it is equally present in $f_s$ and $f_a$. As a satellite is almost seen in the same direction from the user and from the meaconer points of view, $\mathbf{u}_{SM} \approx \mathbf{u}_{SU}$. This approximation leads to

$$ \Delta f \approx \frac{(\mathbf{v}_U - \mathbf{v}_M)^T \cdot (\mathbf{u}_{SU} - \mathbf{u}_{MU})}{\lambda}. \quad (18) $$

The $C/N_0$ degradation and the DLL output distortions in the multipath situation are strongly affected as a function of the absolute value of the Doppler shift $|\Delta f|$. The relative Doppler can be mapped to the geometry to identify the regions $\mathbb{F}$ of small absolute relative Doppler $|\Delta f| < f_{max}$ where the impact of meaconing multipath is the strongest. The value of $f_{max}$ can be chosen depending on the tolerated degradations of the DLL outputs and of the $C/N_0$. For instance, if an application tolerates 3 m of DLL output error and a 6-dB drop of the estimated $C/N_0$ cause by meaconing multipath, Figs. 3 and 4 show that this degradations are only observed when $|\Delta f| < 25$ Hz. In this case, choosing $f_{max} = 25$ Hz for region $\mathbb{F}$ would identify the satellite signals associated with potential larger degradations.

$$ \mathbb{F} \Leftrightarrow |\Delta f| < f_{max} \Leftrightarrow \left| \frac{(\mathbf{v}_U - \mathbf{v}_M)^T \cdot (\mathbf{u}_{SU} - \mathbf{u}_{MU})}{\lambda} \right| < f_{max} \Leftrightarrow \left| \frac{v_{MU}}{\lambda} (\cos(\alpha_U) - \cos(\alpha_M)) \right| < f_{max} \quad (19) $$

$$ \Leftrightarrow 2 \left| \frac{v_{MU}}{\lambda} \sin \left( \frac{\alpha_U + \alpha_M}{2} \right) \sin \left( \frac{\alpha_U - \alpha_M}{2} \right) \right| < f_{max}, \quad (20) $$
with $v_{MU} = ||v_{MU}|| = ||v_U - v_M||$ the relative velocity between the user and the meaconer, $\alpha_U$ the non-oriented angle between $v_{MU}$ and $u_{SU}$, and $\alpha_M$ the non-oriented angle between $v_{MU}$ and $u_{MU}$, defined by:

$$ \alpha_U = \cos^{-1} \left( \frac{v_{MU} \cdot u_{SU}}{v_{MU}} \right) \quad \text{and} \quad \alpha_M = \cos^{-1} \left( \frac{v_{MU} \cdot u_{MU}}{v_{MU}} \right). \qquad (21) $$

If the relative direction $u_{MU}$ and velocities $v_{MU}$ between the user and the meaconer are fixed, the relative Doppler $\Delta f$ only depends on the direction of the satellite with respect to the user $u_{SU}$. Consequently, it is possible to represent the received relative Doppler on a skyplot as a function of the elevation and azimuth angles of $u_{SU}$. When mapped on a skyplot, the region $\mathbb{F}$ corresponding to $|\Delta f| < f_{max}$ forms a ring perpendicular to the vector $v_{MU}$ (and containing the meaconer location). Three examples of the regions with $f_m = 0$ Hz are shown in Fig. 8, for three different positions of the meaconer (in red on the skyplots). These plots highlight the Doppler rings $\mathbb{F}$ as a function of the elevation and azimuth angles of the received satellite signal. The relative velocity $v_{MU}$ is indicated with a black arrow, and is directed towards the East (elevation 0° and azimuth 90°) with a velocity norm of $v_{MU} = 10$ m/s. The relative Doppler does not depend on the distance between the user and the meaconer $d_{MU}$, but only on the direction vector $u_{MU}$ with respect to the velocity vector $v_{MU}$. The absolute value of the relative Doppler $\Delta f$ can reach (in Hz) up to 10 times the value of the relative velocity (in m/s) for GPS L1. The satellites observed far from the meaconer direction and its Doppler ring have high absolute relative Doppler $|\Delta f|$, and are therefore less impacted by multipath distortions (as the magnitudes of the $C/N_0$ degradations and the DLL errors decrease when $|\Delta f|$ increases).

<figure><img src="image_9.png" /><figcaption>FIGURE 8 Three examples of relative Doppler values $\Delta f$ as a function of the geometry ($v_{MU} = 10$ m/s).</figcaption></figure>

## 4 | IMPACT OF THE MULTIPATH SITUATION ON THE DLL OUTPUTS AND ON THE $C/N_0$

Section 2 presented the DLL errors at lock and the $C/N_0$ estimations as functions of the relative parameters, and section 3 expressed $\Delta \tau$ and $\Delta f$ with respect to the geometry. By combining these sections, it is possible to map the DLL errors at lock and $C/N_0$ estimations to the geometry. This section provides the impact of the meaconer on the multipath error envelope (i.e., the maximum DLL error in stable equilibrium in the multipath situation) and on the estimated $C/N_0$, as functions of the satellite elevation and azimuth angles.

For better visualization of the meaconer impact on GNSS observables, the multipath error envelope and the estimated $C/N_0$ are plotted on skyplots for a specific values of $\Delta g$ (0 dB or -3 dB) and for three different values of $v_{MU}$ (0 m/s, 5 m/s, and 15 m/s). On each skyplot, the meaconer is observed at an elevation of 0° and an azimuth of 180° (South), represented by a large red dot. The user is moving at a speed $v_{MU}$ towards an elevation of 0° and an azimuth of 90° (East) relative to the meaconer. The meaconer impact on a satellite is represented by a color at the corresponding elevation and azimuth angle of the satellite, from the user's perspective.

All the skyplots have been computed with $d_{MU} = 180$ m, $\tau_m = \Delta \tau_{ant} = 0$ s, and $T_{max} = 1.05 T_c \approx 307.7$ m. Equation (16) shows that $\beta_{max} \approx 135°$ in this configuration, stating that the satellites seen at an angle greater than 135° with respect to the meaconer are not in the multipath situation. The non-affected satellites lie in the northern part of the skyplot, depicted by the bold dotted line on each skyplot. The satellites not affected by multipath are either in the nominal or jamming situation, and their
multipath error envelope and $C/N_0$ are computed accordingly to the formulas of Hussong et al. (2023) in these situations. Finally, the receiver noise is neglected in the skyplots, to only represent the deterministic mean behavior of the GNSS observables in the multipath situation.

## 4.1 | Mapping of the multipath error envelope on skyplots

Fig. 9 presents the meaconer multipath error envelop (MMEE), which are the maximum code tracking errors at lock, obtained by solving (4), as a function of the satellite elevation and azimuth angles. They have been computed for $\Delta g = \Delta N = 0$ dB, and for three different relative velocities $v_{MU} = [0; 5; 15]$ m/s between the meaconer and the user. Even if the received satellite signal power changes as a function of the satellite elevation, the ratios $\Delta g$ and $\Delta N$ remain unchanged. Indeed, both the meaconer and the user see the satellite with the same elevation (as they are close one to each other), so they both received the same power at their antenna input.

The figure highlights significant MMEE values (up to ±15 m) when the emitting satellite is observed in the multipath cone. Only the satellite that are seen extremely close to the meaconer direction do not show large DLL errors, the rest of the satellite signals are distorted by the meaconing interference depending on the relative velocity. In the static case, MMEE values are almost constant at ±15 meters all over the skyplot. When the relative velocity $v_{MU}$ increases, the large MMEE values at lock agglomerate around a ring perpendicular to the velocity vector and containing the meaconer direction (shaping the Doppler rings $\mathbb{F}$ evidence in section 3). The errors above 10 meters are contained inside the Doppler ring corresponding to $f_{max} = 25$ Hz. The rest of the skyplot bears reduced but still significant DLL errors. In all cases, the errors outside of the multipath situation equal zero, because the receiver noise is neglected in these skyplots.

<figure><img src="image_10.png" /><figcaption>FIGURE 9 Maximum tracking error at lock $\max_{\Delta\theta \in [0, 2\pi]} |\epsilon_{\tau}|$, as a function of the geometry, with $\Delta g = \Delta N = 0$ dB.</figcaption></figure>

## 4.2 | Mapping of $C/N_0$ degradations on skyplots

Fig. 10 shows the lowest $C/N_0$ as a function of the geometry. The lowest value is computed by evaluating the $C/N_0$ for all $\Delta\theta \in [0; 2\pi]$ (knowing the satellite elevation and azimuth angles) and taking the smallest result. While $\Delta\theta$ significantly influences the $C/N_0$ estimations for small values of $v_{MU}$ (below 0.1 m/s, corresponding to $|\Delta f| < 1$ Hz), it plays a marginal role for higher values of $v_{MU}$. Therefore, the results displayed on Fig 10 provide an excellent approximation in dynamic cases of the received $C/N_0$. For the static case, the results show the largest degradation eventually observed.

The $C/N_0$ in Fig. 10 is heavily degraded by the presence of the meaconer in the multipath situation. In this figure, the nominal $C/N_0$ is set at 40 dB.Hz. Outside of the multipath cone (in the northern part of the skyplots), the nominal/jamming situation is observed, and the $C/N_0$ drops to about 38 dB.Hz when $\Delta g = \Delta N = -3$ dB. These values align with the results of Hussong et al. (2023). For the satellites in the multipath situation, the $C/N_0$ degradation exceeds 15 dB.Hz when $\Delta g = \Delta N = -3$ dB for almost all satellites in the southern hemisphere when $v_{MU} = 5$ m/s. When $v_{MU} = 15$ m/s, these degradations occur for the satellite in the Doppler ring $\mathbb{F}$ corresponding to $f_{max} = 25$ Hz, and especially for the satellite that are seen close to the meaconer direction.
<figure><img src="image_11.png" /><figcaption>FIGURE 10 Lowest $C/N_0 = \min_{\Delta\theta \in [0,2\pi]} |C_{\Delta\nu}|$, as a function of the geometry, with $\Delta g = \Delta N = -3$ dB.</figcaption></figure>

## 5 | VALIDATION OF THE MODELS AND VISUALIZATION OF THE IMPACT THROUGH SIMULATIONS

This section validates the presented models by designing three different scenarios affected by meaconing interference in the multipath situation. It compares the impact computed from the equations presented in this paper to the impact obtained by simulating the scenarios in a highly realistic GNSS generation software. Additional details about the software and the methodology used to obtain the results are provided in Appendix D.

### 5.1 | Definition of the scenarios under scrutiny

The three scenarios are designed to represent a static, a pedestrian, and a car trajectory. They pass close to a fixed meaconer on the ground. In each scenario, the same GPS satellite is under scrutiny, and its DLL outputs and estimated $C/N_0$ are monitored.

<figure><img src="image_12.png" /><figcaption>FIGURE 11 Illustration of the pedestrian and car trajectories.</figcaption></figure>
Fig. 11 illustrates the pedestrian and car scenarios. The trajectories are each 1200 meters long, with 200 meters of nominal/jamming situation, then 800 meters where the GPS satellite under scrutiny is inside the multipath cone, and finally 200 meters back in the nominal/jamming situation. The meaconer is 100 meters away from the trajectory, with a gain of 76 dB chosen to compensate the free-space losses to have $Δg = ΔN = 0$ dB when the user is closest to the meaconer. Both the user and the meaconer antennas are omnidirectional with gains of 0 dBi in all directions. The meaconer intrinsic delay is set to $τ_m = 0$ s, and its phase offsets is set to $θ_m = 0$ rad. The only difference between the pedestrian and car scenarios is that the pedestrian travels the 1200 meters at 1.4 m/s (in about 857 seconds), while the car travels the same distance at 14 m/s (in about 86 seconds).

The relative parameters of both scenarios are displayed for information in Fig. 12. Outside the multipath cone, the relative power and noise PSD stay below –10 dB, and the satellite is in the nominal or jamming situation, producing negligible $C/N_0$ and DLL output distortions, as previously investigated by Hussong et al. (2023). The relative Doppler is positive in the first half of the trajectory because the user is moving towards the meaconer, perceiving the meaconer signal with a higher frequency. Conversely, the relative Doppler is negative in the second half of the trajectory, with the zero-crossing of $Δf$ occurring when the user is closest to the meaconer. The Doppler values are 10 times larger in the car scenario because the car is moving 10 times faster than the pedestrian. Finally, all the relative parameter curves are almost symmetrical because the user trajectory is symmetric with respect to the meaconer, and the satellite did not move significantly during the trajectory duration.

<figure><img src="image_13.png" /><figcaption>FIGURE 12 Relative parameters of the pedestrian scenario (top) and of the car scenario (bottom).</figcaption></figure>

The static scenario represents a 120-second static user located 100 meters from the meaconer (at the “closest point to the meaconer” in Fig. 11). The meaconer is activated after 20 seconds, so the first 20 seconds of the static scenario are in the nominal situation. Similarly, the meaconer is shut down for the last 20 seconds of the scenario. In between, the meaconer gain is set to 76 dB to have $Δg = ΔN = 0$ dB, and the satellite under scrutiny is in the multipath situation during 80 seconds.

<figure><img src="image_14.png" /><figcaption>FIGURE 13 Relative parameters of the static scenario.</figcaption></figure>
The relative parameters of the static scenario are displayed in Fig. 13. The relative distance $c\Delta\tau$ is almost constant but increases slowly (by about 1 meter, or 5 GPS L1 wavelengths, during the meaconer activation) due to the satellite's motion. As $v_{MU} = 0$ m/s in this scenario, (18) states that $\Delta f \approx 0$ Hz. The exact relative Doppler is indeed extremely close to zero but varies slightly due to the satellite's different observation angles with respect to the user and the meaconer ($u_{SM} \approx u_{SU}$).

## 5.2 | Degradation of the DLL outputs and $C/N_0$ in the scenarios under scrutiny

The three scenarios have been run $N$ times ($N = 8000$ for the static and car scenarios, $N = 800$ for the pedestrian scenario) with a Monte-Carlo method. Only the random receiver-generated noise changes between the different runs. At each second of the scenarios, the mean value of $C/N_0$, and the mean value and standard deviation of the DLL outputs are computed with the $N$ values available. The results are shown in Figs. 14 to 16. Note that in the third subplots of the figures, the DLL outputs (in red on the figures) are the actual DLL errors comprised in the code pseudorange estimations, and not the DLL errors at lock as in the previous sections (also plotted in the figures, but in black). Indeed, the DLL errors at lock assume that the loop manages to converge towards its SE, whereas the actual DLL error considers the transient response and the smoothing effect of the loop.

### 5.2.1 | Impact of the multipath situation in the static scenario

In the static scenario (Fig. 14), the relative Doppler $\Delta f$ is close to zero, so the relative phase $\Delta\theta = 2\pi c\Delta\tau/\lambda + \theta_m$ plays a prominent role in the $C/N_0$ and DLL output computation. When $\Delta\theta = 0[2\pi]$, the authentic and the meaconer signals add up constructively, resulting in a higher $C/N_0$ than in the nominal situation. The DLL tracking loops are attracted towards the meaconing signal due to its similarity to the authentic signal, producing a large DLL output mean error. When $\Delta\theta = \pi[2\pi]$, the meaconer signal causes destructive interference with the authentic signal, significantly reducing $C/N_0$ (up to 18 dB.Hz). The DLL tracking loops are also repelled from the meaconer signal, producing large DLL mean errors in the opposite direction. Additionally, the DLL standard deviations increase when $C/N_0$ is low because poor signal quality degrades tracking performance.

The presented models of the theoretical $C/N_0$ and DLL SE are also plotted in black, showing an excellent match to the observed values, validating the models in static situations. Indeed, in static cases, the tracking loops have the time to converge to the SE, because the dynamic is low. Therefore, the theoretical values at the SE are extremely close to the actual values produced by the GNSS receiver software.

<figure><img src="image_15.png" /><figcaption>FIGURE 14 $C/N_0$, DLL standard deviation, and DLL mean values in the static scenario.</figcaption></figure>

### 5.2.2 | Impact of the multipath situation in the pedestrian scenario

In the pedestrian scenario, the relative Doppler $\Delta f$ is large enough ($|\Delta f| > 0.1$ Hz) so that the $C/N_0$ estimation is mainly driven by the variations of $\Delta g$ ($\sigma_d \neq 0$ in (8)). The $C/N_0$ suffers steady but significant degradations (down to 18 dB.Hz when $\Delta g = 0$ dB), starting as soon as the user enters the multipath cone. These degradations deteriorate tracking performance and increase DLL standard deviations up to 10 times its nominal value. A rapid increase in $C/N_0$ is observed when the user is closest to the meaconer, as $|\Delta f| \approx 0$ Hz (and thus $\sigma_d \approx 0$). This rapid increase is well reflected by the theoretical model (Fig. 4), validating the $C/N_0$ model in pedestrian or slow-motion scenarios.
The DLL stable equilibrium oscillates due to rapid variations of $\Delta\theta$, but the DLL low-pass filter limits rapid variations in DLL output and smooths the DLL stable equilibrium around its mean value, explaining the mismatch between the stable equilibrium and simulation results. Still, the stable equilibrium values shape the observed values of DLL mean outputs that reach up to 15 meters of error when the user is closest to the meaconer. Filtering the stable equilibrium values through the DLL filter produces the observed simulation results. This filtering process is not shown, but is demonstrated in Ghizzo et al. (2025).

<figure><img src="image_16.png" /><figcaption>FIGURE 15 $C/N_0$, DLL standard deviation, and DLL mean values in the pedestrian scenario.</figcaption></figure>

### 5.2.3 | Impact of the multipath situation in the car scenario

In the car scenario, the high velocity between the user and receiver reduces the time spent in the multipath cone. The $C/N_0$ is still degraded (up to 18 dB.Hz when the car is closest to the meaconer), leading to higher DLL standard deviations at that moment. However, the $C/N_0$ drop and the DLL distortions are not immediately visible when the car enters the multipath situation. Indeed, the large relative Doppler values $|\Delta f| \approx 65$ Hz at the beginning of the multipath situation mitigate the degradations induced by the meaconing interference. The degradations are eventually observed when $|\Delta f| < 25$ Hz as the car approaches the meaconer. The multipath situation also induces DLL mean errors up to 10 meters.

The models of $C/N_0$ and DLL mean output values show good conformity to the simulated data. The validation of the developed models exposes the meaconer threat and underscores the degradation of the GNSS accuracy (and potentially availability if the receiver loses the lock of the signal) when the meaconer is close to the user and when the multipath situation is observed.

<figure><img src="image_17.png" /><figcaption>FIGURE 16 $C/N_0$, DLL standard deviation, and DLL mean values in the car scenario.</figcaption></figure>
CONCLUSION

This study has comprehensively investigated the impact of meaconing interference on GNSS receivers in the multipath situation. The multipath situation under meaconing arises when both the authentic and the meaconer signals influence the correlator outputs of the GNSS receiver, leading to C/N₀ degradations and DLL output distortions. This paper demonstrates that the multipath situation affects all satellites observed within a cone centered around the meaconer, with the cone's width dependent on the meaconer's distance and intrinsic delay. The satellites inside this cone are not equally impaired by the multipath interference. The impact is primarily driven by the power and Doppler shift differences between the received authentic and meaconer signals. The most severe C/N₀ degradations and DLL output distortions occur when the authentic and meaconer signal powers are similar, and when the relative Doppler shift is small. This paper also shows that the relative Doppler is minimal when the satellite is observed near the ring perpendicular to the user's relative motion and containing the meaconer location. The magnitude of C/N₀ and DLL output degradations deterministically depends on the geometry between the user, the meaconer, and the satellite. C/N₀ estimations in the multipath situation can easily drop to 20 dB.Hz, and DLL outputs can exhibit mean errors of ±15 meters (with an early-late spacing of cτ = 0.1 Tc). Simulations confirm that satellites in the multipath situation are affected by these degradations, consistent with the models. Such signal distortions could potentially lead to signal lock losses or hazardous position estimations, compromising GNSS accuracy, availability, and integrity. Particularly, this paper speculates that meaconers used for indoor GNSS coverage in environments like metro systems or hangars might unintentionally degrade GNSS performance of nearby receivers if the multipath situation occurs. To mitigate these risks, the authors propose increasing the intrinsic delay τm of these meaconers beyond Tmax to prevent the multipath situation and preserve GNSS receiver performance. This work paved the path to explore the impact of meaconers onboard aircrafts (where meaconing multipath is likely to happen), as it can severely impair aircraft receiver performance beyond aviation requirements. Experimental validation of results presented in this paper could be valuable as future work. The authors could not carry out such experiment as meaconing is currently prohibited in France.

A | APPENDIX: COMPUTATION OF THE DISTANCE $d_{SM} - d_{SM'}$

The value of $d_{SM} - d_{SM'}$ can be rearranged with the notations of Fig. 6:

$$d_{SM} - d_{SM'} = d_{SM} (1 - \cos(\gamma_1)) = d_{SM} \left(1 - \cos\left(\frac{\pi}{2} - \beta_1 - \gamma_2\right)\right) \quad (22)$$

$$= d_{SM} \left(1 - \cos\left(\frac{\pi}{2} - \beta_1 - \left(\frac{\pi}{2} - \beta_2\right)\right)\right) \quad (23)$$

$$= d_{SM} (1 - \cos(\beta_2 - \beta_1)) = d_{SM} (1 - \cos(\beta_1) \cos(\beta_2) - \sin(\beta_1) \sin(\beta_2)) \quad (24)$$

$$= d_{SM} \left(1 - \frac{d_{M'U} d_{OM}}{d_{MU} d_{SM}} - \frac{d_{MM'} d_{OS}}{d_{MU} d_{SM}}\right) \quad (25)$$

$$= d_{SM} - \frac{d_{M'U} d_{OM}}{d_{MU}} - \frac{d_{MM'} d_{OS}}{d_{MU}}. \quad (26)$$

Trigonometric formulas directly give the expressions of $d_{M'U}$, $d_{OS}$, and $d_{MM'}$:

$$d_{M'U} = d_{MU} \cos(\beta_1) \qquad d_{OS} = d_{SU} \sin(\beta_1) \qquad d_{MM'} = d_{MU} \sin(\beta_1). \quad (27)$$

The Al-Kashi theorem gives the expression of $d_{SM}$:

$$d_{SM} = \sqrt{d_{MU}^2 + d_{SU}^2 - 2d_{MU}d_{SU} \cos(\beta_1)}. \quad (28)$$

Finally, the Pythagorean theorem provides an expression of $d_{OM}$, that can be arranged using (27) and (28) as

$$d_{OM} = \sqrt{d_{SM}^2 - d_{OS}^2} = \sqrt{d_{MU}^2 + d_{SU}^2 \cos^2(\beta_1) - 2d_{MU}d_{SU} \cos(\beta_1)}. \quad (29)$$

Inserting Eqs. (27) to (29) into (26) gives

$$d_{SM} - d_{SM'} = d_{SU} \left( \sqrt{1 - 2 \frac{d_{MU}}{d_{SU}} \cos(\beta_1) + \left( \frac{d_{MU}}{d_{SU}} \right)^2} - \cos^2(\beta_1) \sqrt{1 - \frac{2}{\cos(\beta_1)} \frac{d_{MU}}{d_{SU}} + \left( \frac{d_{MU}}{d_{SU} \cos(\beta_1)} \right)^2} - \sin^2(\beta_1) \right) \quad (30)$$
The distance $d_{SU}$ can be computed as a function of the satellite elevation angle (assimilated to $\beta_1$ in the case where the user is at the same altitude as the meaconer) with the formula in MathWorks, Inc. (2025):

$$d_{SU} = \sqrt{R_S^2 + R_E^2 - 2R_S R_E \cos(\beta)} \quad \text{with} \quad \beta = \cos^{-1}\left(\frac{R_E - R_E \sin^2(\beta_1) + \sin(\beta_1)\sqrt{R_E^2 \sin^2(\beta_1) + R_S^2 + 2R_E R_S}}{R_E + R_S}\right) \quad (31)$$

Where $R_E$ is the Earth radius and $R_S$ is the satellite orbit semi-major axis. The numerical values of the difference ($d_{SM} - d_{SM'}$) can then be plotted for different values of $d_{MU}$ as a function of $\beta_1$. The results are shown in Fig. 17 and clearly state that the distance can be approximated to zero meter (in comparison to the maximum multipath effect distance $cT_{max} \approx 308$ m).

<figure><img src="image_18.png" /><figcaption>FIGURE 17 Numerical values of (30) for three different values of $d_{MU}$ and as a function of the elevation angle (assimilated to $\beta_1$).</figcaption></figure>

B | APPENDIX: SIGNAL PROCESSING AND SIGNAL STRUCTURE PARAMETERS

This appendix provides in Table 1 the signal processing parameters of the GNSS receiver used in the paper.

<table><caption>TABLE 1
Signal processing parameters.</caption><tbody><tr><td colspan="2">Tracking correlator</td><td>Integration Time T<sub>i</sub> = 20 ms</td></tr><tr><td rowspan="4">DLL</td><td>Discriminator</td><td>Early-Minus-Late Power (defined in Teunissen and Montenbruck, 2017, p. 417)</td></tr><tr><td>Correlator spacing</td><td>Early-minus-late correlator spacing c<sub>τ</sub> = T<sub>c</sub>/10</td></tr><tr><td>Low-pass Filter</td><td>1st order, Bandwidth = 1 Hz</td></tr><tr><td>Loss Indicator</td><td>Duration = 1 s, Type = Moment (C/N<sub>0</sub>), Threshold = 25 dB·Hz</td></tr><tr><td rowspan="3">PLL</td><td>Discriminator</td><td>ATAN discriminator (defined in Teunissen and Montenbruck, 2017, p. 475)</td></tr><tr><td>Low-pass Filter</td><td>3rd order, Bandwidth = 30 Hz</td></tr><tr><td>Loss Indicator</td><td>Type = Normalized estimate of the cosine of twice the carrier phase (defined in Parkinson and Spilker, 1996, p.393), Duration = 1 s, Threshold = 0.85</td></tr><tr><td colspan="2">C/N<sub>0</sub> Estimate</td><td>Moment Estimator</td><td>Estimation period = 1 s</td></tr><tr><td rowspan="5">GPS L1 C/A structure (used for numerical applications)</td><td>Carrier Frequency</td><td>1575.42 MHz</td></tr><tr><td>Modulation</td><td>Binary Phase Shift Keying (1)</td></tr><tr><td>Spreading Code</td><td>C/A Code (Gold code, 1023 chips)</td></tr><tr><td>Chip rate</td><td>1.023 MHz</td></tr><tr><td>Navigation Data Rate</td><td>50 Hz</td></tr></tbody></table>
C | APPENDIX: TABLE OF THE VARIABLES AND PARAMETERS

This appendix summarizes in Table 2 all the variables and parameters of this paper.

<table><caption>TABLE 2
Summary of Variables and Parameters</caption><thead><tr><th>Symbol</th><th>Description</th><th>Unit</th></tr></thead><tbody><tr><td>C<sub>Δη</sub></td><td>Mean value of the C/N<sub>0</sub> with the moment method</td><td>dB-Hz</td></tr><tr><td>β<sub>max</sub></td><td>Maximum aperture angle of the multipath cone</td><td>radians</td></tr><tr><td>β<sub>1</sub></td><td>non-oriented angle between the satellite and the meaconer, from the user perspective</td><td>radians</td></tr><tr><td>C/N<sub>0</sub></td><td>Carrier-to-noise density ratio</td><td>dB-Hz</td></tr><tr><td>C<sub>a</sub></td><td>Authentic signal power at the receiver's antenna output</td><td>Watt</td></tr><tr><td>c<sub>τ</sub></td><td>Chip spacing (expressed as a fraction of the chip duration T<sub>c</sub>)</td><td>unitless</td></tr><tr><td>d<sub>MU</sub></td><td>Distance between meaconer and user</td><td>meters</td></tr><tr><td>d<sub>SM</sub></td><td>Distance between satellite and meaconer</td><td>meters</td></tr><tr><td>d<sub>SU</sub></td><td>Distance between satellite and user</td><td>meters</td></tr><tr><td>d<sub>k</sub></td><td>Navigation message bit</td><td>unitless</td></tr><tr><td>D<sub>τ</sub>, D<sub>θ</sub></td><td>Code and phase discriminator outputs</td><td>unitless</td></tr><tr><td>f<sub>a</sub>, f<sub>s</sub></td><td>Doppler frequencies of the authentic and the meaconer signals</td><td>Hz</td></tr><tr><td>f<sub>max</sub></td><td>Maximum relative frequency of the Doppler region F</td><td>Hz</td></tr><tr><td>G<sub>m</sub></td><td>Meaconer gain</td><td>unitless</td></tr><tr><td>Λ<sub>E</sub>, Λ<sub>P</sub>, Λ<sub>L</sub></td><td>Early, prompt, and late correlator outputs</td><td>unitless</td></tr><tr><td>Λ<sub>a</sub>, Λ<sub>s</sub></td><td>Authentic and meaconer signal contributions at the correlator output</td><td>unitless</td></tr><tr><td>λ</td><td>Wavelength of the GPS L1 C/A signal</td><td>meters</td></tr><tr><td>F</td><td>Region in which satellites have small relative Doppler</td><td></td></tr><tr><td>M</td><td>Region in which satellites are in the multipath situation</td><td></td></tr><tr><td>N</td><td>Number of Monte Carlo runs</td><td>unitless</td></tr><tr><td>P<sub>n</sub></td><td>Noise power</td><td>Watt</td></tr><tr><td>T<sub>c</sub></td><td>Chip duration of the GPS L1 C/A signal</td><td>seconds</td></tr><tr><td>T<sub>e</sub></td><td>C/N<sub>0</sub> estimation time</td><td>seconds</td></tr><tr><td>T<sub>i</sub></td><td>Integration time</td><td>seconds</td></tr><tr><td>T<sub>max</sub></td><td>Maximum relative delay provoking the multipath situation</td><td>seconds</td></tr><tr><td>τ<sub>m</sub></td><td>Meaconer intrinsic delay</td><td>seconds</td></tr><tr><td>τ<sub>ant, a</sub></td><td>Group delay of the authentic signal at the user's antenna</td><td>seconds</td></tr><tr><td>τ<sub>ant, s</sub></td><td>Group delay of the meaconer signal at the user's antenna</td><td>seconds</td></tr><tr><td>Δf</td><td>Relative frequency shift</td><td>Hz</td></tr><tr><td>Δg</td><td>Relative power ratio (meaconer/authentic signal power)</td><td>unitless</td></tr><tr><td>ΔN</td><td>Relative noise power spectrum density ratio</td><td>unitless</td></tr><tr><td>Δτ</td><td>Relative time delay</td><td>seconds</td></tr><tr><td>Δτ<sub>ant</sub></td><td>Group delay difference at the user's antenna</td><td>seconds</td></tr><tr><td>Δθ</td><td>Relative phase difference</td><td>radians</td></tr><tr><td>Δη</td><td>Relative parameter vector</td><td></td></tr><tr><td>ε<sub>f</sub></td><td>Frequency tracking errors</td><td>Hz</td></tr><tr><td>ε<sub>τ</sub></td><td>Code tracking errors</td><td>seconds</td></tr><tr><td>ε<sub>θ</sub></td><td>Phase tracking errors</td><td>radians</td></tr><tr><td>ε<sub>η</sub></td><td>Vector containing the three tracking errors (code, frequency, phase)</td><td></td></tr><tr><td>ζ<sub>τ</sub>, ζ<sub>f</sub></td><td>Code and frequency synchronization mismatches</td><td>unitless</td></tr><tr><td>u</td><td>Unit direction vectors</td><td>unitless</td></tr><tr><td>v<sub>S</sub>, v<sub>A</sub>, v<sub>M</sub></td><td>Velocity vectors of the satellite, the aircraft, and the meaconer</td><td>m / s</td></tr><tr><td>χ<sub>θ</sub></td><td>Phase discriminator difference</td><td>unitless</td></tr><tr><td>θ<sub>m</sub></td><td>Intrinsic phase offset of the meaconer</td><td>radians</td></tr><tr><td>Z</td><td>Component function of the Early-Minus-Late Power discriminator</td><td>unitless</td></tr></tbody></table>
# D | APPENDIX: SIMULATION SETUP AND PLATFORM

This appendix details the simulation bench and the methodology used to carry out the simulations of Section 5. The simulations are performed following several steps listed below.

## 1. User's trajectory generation:

The first step of the simulations consists in the generation of the trajectories of the user's receivers. The trajectories are defined by series of waypoints generated at a sampling frequency of 50 Hz (commonly used value for GNSS signal processing in GNSS receivers). The signal processing sampling frequency of 50 Hz (at which the correlator outputs are generated) is not to be confounded with the measurement sampling frequency of 1 Hz at which the measurements (pseudoranges and $C/N_0$ estimation) are generated. Each waypoint contains the 3D position of the user at the corresponding epoch. The authors choose to run the simulations on a straight road located at Toulouse, France, but this choice is arbitrary and do not impact the results.

The static trajectory contains 6001 waypoints (to represent the 120 seconds of the scenario) located at [43.615636°; 1.380236°, 152 m] in LLA-coordinate frame. The pedestrian scenario contains 42851 waypoints (to represent the 857 seconds of the scenario) starting at [43.615636°; 1.380236°, 152 m] in LLA-coordinate frame, and moving towards the East at a constant speed of 1.4 m/s. The car scenario contains 4301 waypoints (to represent the 86 seconds of the scenario) starting at [43.615636°; 1.380236°, 152 m] in LLA-coordinate frame, and moving towards the East at a constant speed of 14 m/s.

## 2. Meaconer and satellite path generation:

The second step of the simulations consists in the generation of the position of the meaconer and of the satellite under scrutiny. The meaconer is located at a fixed position on the ground (at an altitude of 152 m) as given by Fig. 11. The satellite positions and velocities are determined with Table 3 hereafter, presenting the orbital elements obtained from the U.S. Coast Guard Navigation Center (2024). Once the almanac has been converted into position and velocities over time for all the satellites, the authors selected one satellite passing at the South of the meaconer with an elevation of 67°. The elevation choice does not play a direct role in the meaconer impact, but a different satellite elevation would produce different relative parameters (especially different relative delay, Doppler, and phase), that would slightly modify the meaconing effects on the estimated $C/N_0$ and DLL outputs. Especially, the order of magnitude of the degradations would not differ, but the temporal fluctuations of the impact could be offset. Only this satellite is under consideration for all the simulations. The exact PRN and starting time selected does not play a role in the results, as the results are only analyzed with respect to the relative parameters presented in Figs. 12a to 13.

## 3. Computation of the relative parameters:

Once the user's trajectory, the meaconer location and the satellite trajectory have been defined at each second during the scenarios, the relative parameters presented in Figs. 12a to 13 are computed. The relative Doppler $\Delta f$ is derived with (17), and the relative gain $\Delta g$ and delay $\Delta \tau$ are obtained with the formulas of Hussong et al. (2024), recalled hereafter:

$$ \Delta g = G_m + 20 \log \left( \frac{\lambda}{4\pi d_{MA}} \right) + \Delta g_{\text{ant}} + \Delta g_{\text{env}} \quad \text{in dB.} \qquad (32) $$

$$ \Delta \tau = \frac{d_{SM} + d_{MA} - d_{SA}}{c} + \tau_m + \Delta \tau_{\text{ant}}. \qquad (33) $$

with $d_{MA}$ the Euclidian distance between the meaconer and the user, $d_{SM}$ the Euclidian distance between the satellite and the meaconer, and $d_{SA}$ the Euclidian distance between the satellite and the user. $\Delta g_{\text{ant}} = \Delta g_{\text{env}} = 0$ dB and $\Delta \tau_{\text{ant}} = 0$ s in the simulations of this paper.

## 4. Generation of the correlator outputs of the user's receiver:

The next step of the simulation consists in generating the correlator outputs $\Lambda_a$ and $\Lambda_s$ of (1) received from the satellite signal under scrutiny, with the assumption of perfect synchronization $\varepsilon_\tau = 0$ s, $\varepsilon_f = 0$ Hz, and $\varepsilon_\theta = 0$ rad. This assumption is highly realistic is case of low-dynamic scenarios (as it is the case here). The value of the noise, $\Lambda_n$, is selected as a realization of a Gaussian variable, as given by (3). With the knowledge of the relative parameters at a rate of 50 Hz, the correlator outputs $\Lambda_E, \Lambda_P, \Lambda_L$ can be generated at the same rate in the 3 scenarios.
5. **Generation of the simulated measurements:**

The tracking loops of the user's GNSS receiver can now be run, using the determined values of the correlator outputs. The discriminators of the tracking loops used for the simulations are early-minus-late-power (EMLP) for the code, and *atan* discriminator for the phase, described in Teunissen and Montenbruck (2017), respectively page 417 and page 475. The discriminator outputs are filtered to reduce noise without impacting the dynamic tracking estimate too much. The simulations of this paper uses a common loop low-pass filter of bandwidth 1 Hz for the code, and can be found in Teunissen and Montenbruck (2017), at page 419. The code measurements are kept each sampling interval of 1 s (1 value is kept each 50 generated values), providing simulated DLL output values at a rate of 1 Hz.

The $C/N_0$ is estimated directly from the correlator outputs with the moment method, and can be found in Pauluzzi and Beaulieu (2000). The $C/N_0$ estimation time is set to 1 s in the simulations, providing $C/N_0$ estimates at a rate of 1 Hz.

6. **Repetition of the simulations for Monte Carlo** When the measurements have been simulated, the results are stored and the steps 4 and 5 are rerun up to $N$ times for each scenario ($N = 8000$ for the static and car scenarios, $N = 800$ for the pedestrian scenario). In the different runs, only the value of the noise at the correlator output $\Lambda_n$ in (1) is modified, corresponding to another realization of the Gaussian variable given by (3).

When the three scenarios have been run $N$ times, the mean and the standard deviation of the DLL outputs are computed for each epoch with the $N$ corresponding values. The mean of the estimated $C/N_0$ is also computed at each epoch with the $N$ available values. The results are plotted in red in Figs. 14 to 16.

7. **Generation of the theoretical measurements:**

The theoretical DLL SE values are computed by solving (4) with a numerical method, knowing the relative parameters determined in step 3. The results are obtained at a rate of 50 Hz and are plotted in black in Figs. 14 to 16. The theoretical mean value of the $C/N_0$ is computed with (8) at a rate of 1 Hz and is also plotted in black in the corresponding figures.

<table><caption>TABLE 3
GPS Almanac used for the simulations (from U.S. Coast Guard Navigation Center (2024))</caption><thead><tr><td>PRN</td><td>Eccentricity</td><td>Inclination (rad)</td><td>SQRT(A) (m<sup>1/2</sup>)</td><td>Right Ascension (rad)</td><td>Mean Anomaly (rad)</td></tr></thead><tbody><tr><td>01</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>4.7621</td><td>4.6797</td></tr><tr><td>02</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>4.7621</td><td>2.8237</td></tr><tr><td>03</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>4.7621</td><td>0.2038</td></tr><tr><td>04</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>4.7621</td><td>0.7296</td></tr><tr><td>05</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>5.8093</td><td>1.4129</td></tr><tr><td>06</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>5.8093</td><td>3.0253</td></tr><tr><td>07</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>5.8093</td><td>5.4101</td></tr><tr><td>08</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>5.8093</td><td>3.5670</td></tr><tr><td>09</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>0.5733</td><td>1.9526</td></tr><tr><td>10</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>0.5733</td><td>0.2059</td></tr><tr><td>11</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>0.5733</td><td>5.9283</td></tr><tr><td>12</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>0.5733</td><td>4.2159</td></tr><tr><td>13</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>1.6205</td><td>2.3601</td></tr><tr><td>14</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>1.6205</td><td>4.6329</td></tr><tr><td>15</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>1.6205</td><td>0.6136</td></tr><tr><td>16</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>1.6205</td><td>2.9209</td></tr><tr><td>17</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>2.6677</td><td>3.4391</td></tr><tr><td>18</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>2.6677</td><td>5.2813</td></tr><tr><td>19</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>2.6677</td><td>5.8239</td></tr><tr><td>20</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>2.6677</td><td>1.1531</td></tr><tr><td>21</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>3.7149</td><td>4.1693</td></tr><tr><td>22</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>3.7149</td><td>6.0253</td></tr><tr><td>23</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>3.7149</td><td>1.8362</td></tr><tr><td>24</td><td>0.0</td><td>0.9599</td><td>5153.6201</td><td>3.7149</td><td>2.3622</td></tr></tbody></table>
ACKNOWLEDGMENTS

This research received no specific grant from any funding agency, commercial or not-for-profit sectors.

REFERENCES

Bamberg, T., Appel, M., & Meurer, M. (2018). Which GNSS tracking loop configuration is most robust against spoofing? *Proceedings of the 31st International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2018)*, 3587–3595. https://doi.org/10.33012/2018.15912

Coulon, M., Chabory, A., Garcia-Pena, A., Vezinet, J., Macabiau, C., Estival, P., Ladoux, P., & Roturier, B. (2020). Characterization of meaconing and its impact on GNSS receivers. *Proceedings of the 33rd International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2020)*, 3713–3737. https://doi.org/10.33012/2020.17713

Dobryakova, L., & Ochin, E. (2014). On the application of GNSS signal repeater as a spoofer. *Scientific Journals of the Maritime University of Szczecin, 40*(112), 53–57.

Dovis, F. (2015). GNSS interference threats and countermeasures. Artech House.

Garcia-Pena, A., Macabiau, C., Novella, G., Julien, O., Mabilleau, M., & Durel, P. (2020). RFI GNSS L5/E5a mask derivation. *Proceedings of the 33rd International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2020)*, 188–205. https://doi.org/10.33012/2020.17540

Ghizzo, E., Garcia-Pena, A., Lesouple, J., Milner, C., & Macabiau, C. (2024). Assessing GNSS carrier-to-noise-density ratio estimation in the presence of meaconer interference. *Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)*, 8971–8975. https://doi.org/10.1109/ICASSP48485.2024.10448170

Ghizzo, E., Hussong, M., Garcia-Pena, A., Lesouple, J., Milner, C., & Macabiau, C. (2025). Assessing spoofer impact on GNSS receivers: Tracking loops [manuscript submitted for publication]. Ecole Nationale de l'Aviation Civile.

He, Z., Hu, Y., Wu, J., Wang, J., Hou, J., & Wang, K. (2011). A comprehensive method for multipath performance analysis of GNSS navigation signals. *2011 IEEE International Conference on Signal Processing, Communications and Computing (ICSPCC)*, 1–6. https://doi.org/10.1109/ICSPCC.2011.6061564

Hofmann-Wellenhof, B., Lichtenegger, H., & Collins, J. (1997). GPS theory and practice. Springer WienNewYork.

Hu, M., Yao, Y., Ge, M., Neitzel, F., Shi, J., Pan, P., & Yang, M. (2023). Random walk multipath method for galileo real-time phase multipath mitigation. *GPS Solutions*, 27(2), 58. https://doi.org/10.1007/s10291-023-01397-6

Hussong, M., Ghizzo, E., Milner, C., & Garcia-Pena, A. (2025). GNSS performance degradation under meaconing in civil aviation: Pseudorange and position models. *GPS Solutions*, 29(3), 93. https://doi.org/10.1007/s10291-024-01804-6

Hussong, M., Ghizzo, E., Milner, C., Garcia-Pena, A., & Lesouple, J. (2024). Impact of onboard meaconers on aircraft GNSS receivers. *Proceedings of the 37th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2024)*, 418–450. https://doi.org/10.33012/2024.19862

Hussong, M., Ghizzo, E., Milner, C., Garcia-Pena, A., Lesouple, J., & Macabiau, C. (2023). Impact of meaconers on aircraft GNSS receivers during approaches. *Proceedings of the 36th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2023)*, 856–880. https://doi.org/10.33012/2023.19423

International Telecommunication Union, International Civil Aviation Organization, & International Maritime Organization. (2024). Joint Statement on Protection of the Radio Navigation Satellite Service from Harmful Interference [Accessed: 2025-06-17]. https://www.itu.int/en/mediacentre/Documents/2025/ICAO-IMO-ITU-Joint-Statement.pdf

Kaplan, E. D., & Hegarty, C. (2017). Understanding GPS/GNSS: Principles and applications. Artech House.

MathWorks, Inc. (2025). *Slantrangecircularorbit — calculate slant range or distance between circularly orbiting satellite and ground station* [R2024a]. MathWorks. https://fr.mathworks.com/help/satcom/ref/slantrangecircularorbit.html

Parkinson, B. W., & Spilker, J. J. (1996). *Progress in astronautics and aeronautics: Global positioning system: Theory and applications* (Vol. 164). Aiaa.

Pauluzzi, D. R., & Beaulieu, N. C. (2000). A comparison of SNR estimation techniques for the AWGN channel. *IEEE Transactions on Communications*, 48(10), 1681–1691. https://doi.org/10.1109/26.871393

Peng, C., Li, H., & Lu, M. (2019). Research on the responses of GNSS tracking loop to intermediate spoofing. *Proceedings of the 32nd International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2019)*, 943–952. https://doi.org/10.33012/2019.16987

Petovello, M. (2015). How does a GNSS receiver estimate velocity? *Inside GNSS*, 14(March/April 2015), 38–41.

Steindl, E., Dunkel, W., Hornbostel, A., Hättich, C., & Remi, P. (2013). The impact of interference caused by GPS repeaters on GNSS receivers and services. *Proceedings of the European Navigation Conference (ENC 2013)*.
Teunissen, P. J. G., & Montenbruck, O. (2017). *Springer handbook of global navigation satellite systems*. Springer. https://doi.org/10.1007/978-3-319-42928-1

U.S. Coast Guard Navigation Center. (2024). GPS NANUs, almanacs, OPS advisories, and SOF [Accessed: 2024-12-16]. https://www.navcen.uscg.gov/gps-nanus-almanacs-opsadvisories-sof

Van Dierendonck, A. J., Fenton, P., & Ford, T. (1992). Theory and performance of narrow correlator spacing in a GPS receiver. *Navigation*, 39(3), 265-283. https://doi.org/10.1002/j.2161-4296.1992.tb02276.x

Van Nee, R. D. (1995). *Multipath and multi-transmitter interference in spread-spectrum communication and navigation systems* [Ph.D. dissertation]. Delft University of Technology.