# Assessing Spoofer Impact on GNSS Receivers: Tracking Loops

Emile Ghizzo, Mathieu Hussong, Julien Lesouple, Axel Garcia-Pena,
Christophe Macabiau

<figure><img src="image_1.png" /></figure>

## To cite this version:

Emile Ghizzo, Mathieu Hussong, Julien Lesouple, Axel Garcia-Pena, Christophe Macabiau. Assessing Spoofer Impact on GNSS Receivers: Tracking Loops. Navigation, In press, 72 (4), 10.33012/navi.724. hal-05245859

HAL Id: hal-05245859

https://enac.hal.science/hal-05245859v1

Submitted on 9 Sep 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Assessing Spoofer Impact on GNSS Receivers : Tracking Loops

Emile GHIZZO*

Mathieu HUSSONG

Julien LESOUPLE

Carl MILNER

Axel

GARCIA-PENA

Christophe MACABIAU

¹Fédération ENAC ISAE-SUPAERO
ONERA, Université de Toulouse, France

## Correspondence

*Corresponding author name
Email: emile.ghizzo@alumni.enac.fr

## Abstract

In the context of global navigation satellite systems (GNSS), synchronization is crucial for successfully decoding the navigation message and accurately estimating pseudoranges. Synchronization of each received GNSS signal typically involves at least two tracking loops: a delay lock loop (DLL) and a phase lock loop (PLL). The reception of a spoofed signal disrupts the synchronization process, potentially leading to erroneous pseudorange estimation or loss of service. This paper investigates the impact of spoofing on code, carrier phase, and frequency tracking estimates and proposes a transformation-based strategy to characterize the joint DLL and PLL under spoofing, focusing on the system's stable equilibria (SE), linearity and interdependence, transient response, and noise impact. The study reveals the nonlinearity and interdependence of the tracking loops (i.e., PLL and DLL cannot be considered separately) and shows the emergence of multiple SE, leading to potential chaotic behavior and bifurcation.

## Keywords

GNSS, Spoofing, Tracking, PLL, DLL, Stable equilibrium, Loop interdependence

## 1 | INTRODUCTION

Global Navigation Satellite Systems (GNSS) have become indispensable for precise positioning and temporal synchronization. GNSS technology is utilized in terrestrial, aerial, and maritime navigation, as well as for timing in critical infrastructure and automated processes. However, this widespread dependence on GNSS introduces vulnerabilities that, if maliciously exploited, can lead to significant consequences. Among these threats, spoofing is particularly insidious (Psiaki & Humphreys, 2016).

A GNSS spoofer is a device that generates or re-transmits counterfeit GNSS signals, capable of deceiving a receiver and inducing erroneous position, velocity, and time (PVT) solutions. Spoofers are typically categorized based on their level of sophistication and intent (Fernández-Hernández et al., 2019). Depending on the level of sophistication and intent, the received spoofing signal may be synchronized or unsynchronized in time, frequency, and phase with the authentic signals. Furthermore, the spoofer can transmit either a duplicate or a modified version of the navigation message. However, as demonstrated by Hussong et al. (2023), regardless of the spoofer's sophistication level and intent, its impact at the correlator output can be classified into four scenarios: nominal, induced-jamming, induced-spoofing, and induced-multipath, as briefly outlined in this paper.

In a GNSS receiver, carrier and code synchronization are essential for successfully decoding navigation messages and accurately determining the code and carrier pseudoranges of a specific satellite. Each received GNSS signal is tracked using at least two tracking loops: a delay lock loop (DLL) and a phase lock loop (PLL). Tracking loops can be implemented in either analog or digital form, with their relationship discussed by Stephens and Thomas (1995). In this paper, we consider a digital tracking loop. Such a loop, depicted in Fig. 1, typically consists of three components: (1) a detector, (2) a low-pass filter, and (3) a numerically controlled oscillator (NCO) (Gardner, 2005, chap. 1). The detector measures the synchronization error between the incoming signal and the local replica generated by the NCO. In GNSS receivers, the detector comprises a correlator and a discriminator. The output of the detector is then filtered by the low-pass filter, whose control output is applied to the NCO.
<figure><img src="image_3.png" /><figcaption>FIGURE 1 Typical architecture of a digital tracking loop (I&D: Integrate and Dump).</figcaption></figure>

In the context of spoofing, the outputs of tracking loops (e.g., code, phase, and frequency measurements, or correlator outputs) have been extensively proposed for detection. For instance, Spens et al. (2022) introduce spoofing detection methods based on metrics from smartphone receivers, while Demir et al. (2023) present a detection algorithm for code pseudoranges using hyperbola equations. Additionally, Radin et al. (2015) and Stenberg et al. (2020) utilize double-difference pseudoranges between multiple receivers for detection, whereas Tao et al. (2019) focus on monitoring Doppler measurements to identify spoofing.

The impact of spoofing on tracking loops has been highlighted in the literature through simulations and collected measurements. For example, Kerns et al. (2014) examine the probability of locking onto spoofing signals while accounting for the presence of additional re-radiated Gaussian noise. Similarly, Kim et al. (2012) simulate the effects of a frequency-synchronous spoofer for three different relative delays. Bamberg et al. (2018) analyze the dynamics of DLL and PLL behaviors, highlighting potential bifurcations under various loop parameters. Furthermore, Peng et al. (2019) emulate the impact of intermediate frequency-asynchronous spoofing signals on different DLL and PLL discriminator types and loop bandwidths, while Gao and Li (2023) observe the spoofing impact on PLL-assisted DLL tracking loops.

Although the behavior of tracking loops is relatively predictable for frequency-synchronous spoofer (Kerns et al., 2014; Kim et al., 2012), asynchronous spoofer (Bamberg et al., 2018; Gao & Li, 2023; Peng et al., 2019) can induce unpredictable behaviors, such as oscillations or convergence toward dynamics representing neither the authentic nor the spoofing signal.

This highlights the necessity of characterizing tracking loops under spoofing. Developing a model of loop behavior under spoofing would not only enable the quantification of pseudorange errors and the identification of unpredictable threats based on receiver architecture and spoofing geometry, but would also facilitate the development of more sophisticated detection methods leveraging loop observables.

In the literature, tracking loop behavior under spoofing is primarily modeled through the analysis of discriminators, as originally proposed for multipath interference (Spilker Jr et al., 1996; Van Nee, 1996). For instance, Bamberg et al. (2022) compute the spoofing error envelope (SEE) of the DLL for low- and high-power spoofing signals, while Wang et al. (2023) examine the DLL discriminator shape under spoofing. Similarly, Ma et al. (2020) investigate the PLL and DLL discriminators in the presence of a synchronous spoofer. However, for sufficiently strong signals, such as spoofing signals, the impact extends beyond inducing a bias in the discriminator to also distorting its shape, thus undermining the linearity assumption of tracking loops. In such cases, discriminator analysis alone is insufficient to fully characterize the system; instead, the full dynamic response must be considered, including the transient response, the non-linearity or the DLL and PLL interdependence.

In this context, this paper investigates the impact of spoofing on code and carrier phase tracking and proposes a transformation-based strategy to characterize the DLL and PLL under spoofing. The proposed model not only accounts for the estimation errors caused by discriminator distortion but also captures the complete dynamic behavior of the joint DLL and PLL, including both the transient response and the locked state. This is achieved by analyzing the system's linearity and interdependence properties, identifying possible points of convergence, and studying its stochastic behavior under spoofing. The system's dynamic behavior is evaluated for each spoofing-induced scenario introduced by Hussong et al. (2023).

The paper is organized as follows: Sec. 2 summarizes the classification of correlator outputs under spoofing as presented by Hussong et al. (2023); Sec. 3 introduces the closed-loop model necessary for this paper; Sec. 4 presents the proposed method for analyzing the general closed-loop model. In Sec. 5, the method is applied to characterize the deterministic loop behavior under spoofing for each spoofing-induced scenario. Sec. 6 then analyzes the stochastic behavior. Finally, Sec. 7 presents the numerical solution of the closed-loop model with simulated results.
Summary of paper notations

<table><tr><td>η<sub>a</sub></td><td>Authentic dynamic (η<sub>a</sub> = [τ<sub>a</sub>, θ<sub>a</sub>, f<sub>a</sub>]<sup>T</sup>)</td><td>Λ<sub>E</sub>, Λ<sub>P</sub>, Λ<sub>L</sub></td><td>Early, prompt, and late correlator outputs</td></tr><tr><td>η<sub>s</sub></td><td>Spoofing dynamic (η<sub>s</sub> = [τ<sub>s</sub>, θ<sub>s</sub>, f<sub>s</sub>]<sup>T</sup>)</td><td>ŷ</td><td>Estimated parameters (ŷ = [ŷ̂, ŷ̂, ſ̂]<sup>T</sup>)</td></tr><tr><td>Δη</td><td>Relative dynamic (Δη = [Δτ, Δθ, Δf]<sup>T</sup>)</td><td>ε<sub>η</sub></td><td>Nominal tracking error (ε<sub>η</sub> = [ε<sub>τ</sub>, ε<sub>θ</sub>, ε<sub>f</sub>]<sup>T</sup>)</td></tr><tr><td>Δν</td><td>Relative parameters (Δν = [Δη<sup>T</sup>, Δg]<sup>T</sup>)</td><td>ε<sub>η,eq</sub></td><td>Equivalent tracking error (ε<sub>η,eq</sub> = [ε<sub>τ,eq</sub>, ε<sub>θ,eq</sub>, ε<sub>f,eq</sub>]<sup>T</sup>)</td></tr><tr><td>η<sub>eq</sub></td><td>Equivalent dynamic (η<sub>eq</sub> = [τ<sub>eq</sub>, θ<sub>eq</sub>, f<sub>eq</sub>]<sup>T</sup>)</td><td></td><td></td></tr><tr><td>Δη<sub>eq</sub></td><td>Relative equivalent dynamic (Δη<sub>eq</sub> = [Δτ<sub>eq</sub>, Δθ<sub>eq</sub>, Δf<sub>eq</sub>]<sup>T</sup>)</td><td></td><td></td></tr><tr><td>N<sub>τ</sub></td><td>DLL order</td><td>N<sub>θ</sub></td><td>PLL order</td></tr><tr><td>d<sub>τ</sub></td><td>DLL discriminator</td><td>d<sub>θ</sub></td><td>PLL discriminator</td></tr><tr><td>D<sub>τ</sub></td><td>DLL discriminator z-transform</td><td>D<sub>θ</sub></td><td>PLL discriminator z-transform</td></tr><tr><td>F<sub>τ</sub></td><td>DLL low-pass filter transfer function</td><td>F<sub>θ</sub></td><td>PLL low-pass filter transfer function</td></tr><tr><td>κ<sub>τ,n</sub></td><td>DLL low-pass filter coefficients</td><td>κ<sub>θ,n</sub></td><td>PLL low-pass filter coefficients</td></tr><tr><td>δ̂<sub>τ</sub></td><td>Code NCO input</td><td>δ̂<sub>θ</sub></td><td>Carrier NCO input</td></tr><tr><td>c<sub>τ</sub></td><td>Early-late delay spacing</td><td>β</td><td>Carrier aiding scaling factor</td></tr><tr><td>T<sub>i</sub></td><td>Correlator integration time</td><td></td><td></td></tr></table>

## 2 | PRELIMINARIES - CORRELATOR OUTPUT UNDER SPOOFING

The impact of spoofing on correlator output has been previously analyzed by Hussong et al. (2023), where a classification of correlator outputs under spoofing was proposed to facilitate the analysis of spoofing effects on the post-correlation stage. This section briefly introduces the key concepts necessary to understand the impact of spoofing on the post-correlation stage and the classification employed in this work.

### 2.1 | Dynamics presentation

Throughout the paper, $η_a = [τ_a, θ_a, f_a]^T$ denotes the dynamic parameters of the authentic signal, which include the authentic code delay, carrier phase, and carrier frequency, while $C_a$ represents the received power of the authentic signal. Similarly, $η_s = [τ_s, θ_s, f_s]^T$ denotes the dynamic parameters of the spoofing signal, comprising the spoofing code delay, carrier phase, and carrier frequency, and $C_s$ represents the received power of the spoofing signal. The relative dynamic between the authentic and spoofing signals is defined as $Δη = η_s - η_a = [Δτ, Δθ, Δf]^T$, while the relative power is expressed as $Δg = C_s/C_a$. These relative parameters are gathered in $Δν = [Δη^T, Δg]^T$. All parameters are continuous and time-varying. It is important to note that the carrier phase and carrier frequency are related by

$$f_a = \frac{1}{2\pi} \frac{d\theta_a}{dt}, \quad f_s = \frac{1}{2\pi} \frac{d\theta_s}{dt}, \quad \Delta f = \frac{1}{2\pi} \frac{d\Delta\theta}{dt}. \qquad (1)$$

Additionally, considering the sampling induced by the correlator (with the integration time $T_i$ as the sampling period), we denote $ψ[k]$ as the dynamic parameters evaluated at the midpoint of the k-th integration interval $[kT_i, (k + 1)T_i]$, defined as $ψ[k] = ψ((k + 0.5)T_i)$, where $ψ \in \{η_a, η_s, Δη, C_a, C_s, Δg\}$.

Finally, we define the nominal tracking error $ε_η[k]$ as the difference between the authentic parameters $η_a[k]$ and the estimated parameters $ŷ[k] = [ŷ̂[k], ŷ̂[k], ſ̂[k]]^T$ at epoch k, such that

$$ε_η[k] = \begin{bmatrix} ε_τ[k] \\ ε_θ[k] \\ ε_f[k] \end{bmatrix} \triangleq η_a[k] - ŷ[k] = \begin{bmatrix} τ_a[k] - ŷ̂[k] \\ θ_a[k] - ŷ̂[k] \\ f_a[k] - ſ̂[k] \end{bmatrix} \qquad (2)$$

including code $ε_τ$, phase $ε_θ$ and frequency $ε_f$ nominal tracking errors. For the sake of clarity, parameter k is omitted in the rest of this article when not necessary.
## 2.2 | Correlator output model

The model of the correlator output under spoofing was previously derived by Hussong et al., 2023 as a function of the relative parameters $\Delta\nu$. Specifically, for any $\eta = [\tau, \theta, f]^T$,

$$ \Lambda(\eta, \Delta\nu) = \Lambda_a(\eta) + \Lambda_s(\eta, \Delta\nu) + \Lambda_{n,a} + \Lambda_{n,s} \quad (3) $$

where $\Lambda_{n,a}$ and $\Lambda_{n,s}$ represent the random contributions of the authentic and spoofing signals at the correlator output, including both additive white Gaussian noise (AWGN) and inter-system GNSS interference. These random contributions, $\Lambda_{n,a}$ and $\Lambda_{n,s}$, are modeled as two independent, circular complex Gaussian stochastic processes (also independent of $\eta$), as demonstrated by Ghizzo et al., 2025. Their properties are not further detailed in this paper but can be found in (Ghizzo et al., 2024).

Additionally, $\Lambda_a$ and $\Lambda_s$ represent the contributions of the authentic and spoofing signals at the correlator output, expressed as

$$ \Lambda_a(\eta) = \sqrt{C_a} d_k \zeta_{\tau}(\tau) \zeta_f(f) e^{j\theta}, \quad \Lambda_s(\eta, \Delta\nu) = \sqrt{\Delta g} \Lambda_a(\eta + \Delta\eta) = \sqrt{\Delta g C_a} d_k \zeta_{\tau}(\tau + \Delta\tau) \zeta_f(f + \Delta f) e^{j(\theta+\Delta\theta)}. \quad (4) $$

where $d_k$ is the navigation message bit, and $\zeta_{\tau}$ and $\zeta_f$ are the code and frequency synchronization mismatch functions, such that

$$ \zeta_{\tau}(\tau) \stackrel{\Delta}{=} \int_{-B/2}^{B/2} G_c(f) e^{j2\pi f \tau} df, \quad \zeta_f(f) \stackrel{\Delta}{=} \text{sinc}(\pi f T_i) \quad (5) $$

with $G_c(f)$ denoting the power-normalized power spectral density of the local replica, as defined in (Betz & Kolodziejski, 2009, Eq. 1), and $B$ representing the equivalent RF front-end (RFFE) double-sided bandwidth. Due to the shape of the synchronization mismatch functions in (5), we refer to $\Lambda_a$ and $\Lambda_s$ as the 'authentic peak' and 'spoofing peak,' respectively, in the remainder of this paper.

Typically, GNSS receivers include at least three correlators: the early ($\Lambda_E$), prompt ($\Lambda_P$), and late ($\Lambda_L$) correlators. Under spoofing, these are expressed as

$$ \begin{aligned} \Lambda_E(\eta_a - \hat{\eta}, \Delta\nu) &= \Lambda_E(\varepsilon_\eta, \Delta\nu) = \Lambda(\varepsilon_\eta - \frac{c_\tau}{2}e_1, \Delta\nu) = \Lambda_a(\varepsilon_\eta - \frac{c_\tau}{2}e_1) + \Lambda_s(\varepsilon_\eta - \frac{c_\tau}{2}e_1, \Delta\nu) + \Lambda_{E,n,a} + \Lambda_{E,n,s}, \\ \Lambda_P(\eta_a - \hat{\eta}, \Delta\nu) &= \Lambda_P(\varepsilon_\eta, \Delta\nu) = \Lambda(\varepsilon_\eta, \Delta\nu) = \Lambda_a(\varepsilon_\eta) + \Lambda_s(\varepsilon_\eta, \Delta\nu) + \Lambda_{P,n,a} + \Lambda_{P,n,s}, \end{aligned} \quad (6) $$

$$ \Lambda_L(\eta_a - \hat{\eta}, \Delta\nu) = \Lambda_L(\varepsilon_\eta, \Delta\nu) = \Lambda(\varepsilon_\eta + \frac{c_\tau}{2}e_1, \Delta\nu) = \Lambda_a(\varepsilon_\eta + \frac{c_\tau}{2}e_1) + \Lambda_s(\varepsilon_\eta + \frac{c_\tau}{2}e_1, \Delta\nu) + \Lambda_{L,n,a} + \Lambda_{L,n,s} $$

where $c_\tau$ denotes the early-late delay spacing and $e_1 = [1, 0, 0]^T$. The terms $\Lambda_{E,n,a}$, $\Lambda_{P,n,a}$, and $\Lambda_{L,n,a}$ represent the authentic random contributions, while $\Lambda_{E,n,s}$, $\Lambda_{P,n,s}$, and $\Lambda_{L,n,s}$ correspond to the spoofing random contributions. It is important to note that, given the definition in (2), the early (E), prompt (P), and late (L) correlators can be expressed either as a function of $\hat{\eta}$ or $\varepsilon_\eta$.

## 2.3 | Spoofing impact classification

Leveraging the orthogonal properties of GNSS pseudorandom noise sequences, Hussong et al. (2023) categorize the spoofing impact on the correlator output model (3) into four spoofing-induced situations based on the relative parameters $\Delta\nu$: nominal, induced-spoofing, induced-jamming, and induced-multipath. It is important to note that, although these situations are labeled similarly to other types of interference, they are in fact subcategories of spoofing impact.

### 2.3.1 | Nominal situation

The nominal situation serves as the reference scenario in which no spoofing impact is considered (or is considered negligible). Thus, in this situation, both the spoofing GNSS peak and re-radiated noise are neglected, as illustrated in Fig. 2a. Under these conditions, the correlator output (3) can be expressed (for the E, P and L) for any $\eta = [\tau, \theta, f]^T$ as

$$ \Lambda^{(N)}(\eta) = \Lambda_a(\eta) + \Lambda_{n,a}. \quad (7) $$

It is worth noting that, in this situation, $\Lambda^{(N)}$ is independent of $\Delta\nu$.
<figure><img src="image_4.png" /><figcaption>FIGURE 2 Illustration of the classification of spoofing impact on correlator. The points $\Lambda_E$, $\Lambda_P$, and $\Lambda_L$ indicate the early, prompt and late correlators. The blue and red horizontal lines illustrate the authentic and spoofing noise floor.</figcaption></figure>

### 2.3.2 | Spoofing-induced jamming situation

In the induced jamming situation, the receiver tracks the authentic signal, while the spoofing GNSS peak is negligible, as illustrated in Fig. 2b. In this situation, the correlator output (3) can be expressed for any $\eta = [\tau, \theta, f]^T$ as

$$ \Lambda^{(J)}(\eta, \Delta\nu) = \Lambda_a(\eta) + \Lambda_{n,a} + \Lambda_{n,s}. \qquad (8) $$

The impact of the spoofer at the correlator output is primarily due to the spoofing random contribution, $\Lambda_{n,s}$. This situation can be likened to a jamming threat, as the name suggests, where a non-GNSS wideband signal is transmitted to the receiver.

### 2.3.3 | Spoofing-induced spoofing situation

In the induced spoofing situation, the receiver tracks the spoofing signal while the authentic peak is negligible, as illustrated in Fig. 2c. In this situation, the correlator output (3) can be expressed for any $\eta = [\tau, \theta, f]^T$ as

$$ \Lambda^{(S)}(\eta, \Delta\nu) = \Lambda_s(\eta, \Delta\nu) + \Lambda_{n,a} + \Lambda_{n,s}. \qquad (9) $$

This situation represents the typical spoofing case considered in the literature, where the receiver is expected to track and synchronize with the spoofing signal dynamics, $\eta_s$.

### 2.3.4 | Spoofing-induced multipath situation

In the induced multipath scenario, both the authentic $\Lambda_a$ and spoofing $\Lambda_s$ peaks are included in the correlator output expression $\Lambda^{(M)}$, as illustrated in Fig. 2d. In this situation, the correlator output (3) cannot be further simplified. This scenario resembles multipath-like interference and occurs when $\Delta\tau < T_c + c_\tau/2$ (Hussong et al., 2023), where $T_c$ is the chip period. However, it is important to note that the amplitude of the spoofing peak, $\Lambda_s$, can be equal to or even exceed that of the authentic peak, $\Lambda_a$.

## 3 | PRELIMINARIES - TRACKING LOOPS CLOSED-LOOP MODEL

This section introduces the dynamic model of the joint DLL and PLL tracking loops. While the behavior of tracking loops has been extensively documented in the context of phase-locking in the literature (Gardner, 2005; G. Leonov et al., 2015; G. A. Leonov et al., 2015; Monteiro et al., 2009; Yang et al., 2017), the tracking loops implemented in GNSS receivers, comprising at least a DLL and a PLL with carrier-aiding, have not been explicitly modeled. To address this gap, this section presents the general closed-loop model along with the relevant properties for analyzing the system. Throughout the paper, the subscript $\tau$ denotes parameters, states, or values associated with code tracking (DLL), $\theta$ with phase tracking (PLL), and $\phi \in \{\tau, \theta\}$ with both code and phase tracking. For illustration, this work focuses on GPS L1 C/A signal tracking, although similar reasoning could be applied to other modulation types.
<figure><img src="image_5.png" /><figcaption>FIGURE 3 PLL-assisted-DLL tracking loops architecture.</figcaption></figure>

## 3.1 | DLL Discriminator

The DLL discriminator estimates the code tracking error between the received signal and the local replica. Numerous implementations of code discriminators are presented in (Kaplan & Hegarty, 2017, p. 174). In this paper, we consider the non-coherent early minus late power (NEMLP), defined as

$$d_{\tau}(\eta_a - \hat{\eta}, \Delta\nu) = \frac{1}{\hat{C}K_{\tau}} \left( |\Lambda_E(\eta_a - \hat{\eta}, \Delta\nu)|^2 - |\Lambda_L(\eta_a - \hat{\eta}, \Delta\nu)|^2 \right). \quad (10)$$

where $\Lambda_E$ and $\Lambda_L$ are the E and L correlator outputs, as defined in (6), $\hat{C}$ is the received power estimate, and $K_{\tau}$ is the normalization factor to achieve a unity slope, as expressed in (Betz & Kolodziejski, 2009, Eq. (38)).

### 3.1.1 | PLL discriminator

The PLL discriminator estimates the phase misalignment between the received signal and the local replica. Various implementations of carrier phase discriminators can be found in the literature (Kaplan & Hegarty, 2017, p. 168). The one analyzed in this work is the arctan discriminator, defined as

$$d_{\theta}(\eta_a - \hat{\eta}, \Delta\nu) = \arctan \left( \frac{\Re\{\Lambda_P(\eta_a - \hat{\eta}, \Delta\nu)\}}{\Re\{\Lambda_P(\eta_a - \hat{\eta}, \Delta\nu)\}} \right) \quad (11)$$

where $\Re\{\cdot\}$ and $\Im\{\cdot\}$ denote the real and imaginary part operators, respectively, and $\Lambda_P$ is the prompt correlator output, as defined in (6). The arctan discriminator can also be expressed as

$$d_{\theta}(\eta_a - \hat{\eta}, \Delta\nu) = \arctan \left( \tan \left( \arg \{ \Lambda_P (\eta_a - \hat{\eta}, \Delta\nu) \} \right) \right) = \arg \{ \Lambda_P (\eta_a - \hat{\eta}, \Delta\nu) \} \left( \mod \pi, \frac{\pi}{2} \right) \quad (12)$$

with $\arg\{\cdot\}$ denoting the argument operator and $(\mod \cdot, \cdot)$ representing the shifted modulo operator, defined such that $\forall x, p, q$,

$$x (\mod p, q) = x + q (\mod p) - q. \quad (13)$$

### 3.1.2 | Loop low-pass filter

The discriminator output $d_{\phi}$ is filtered to reduce noise without significantly impacting the dynamic tracking estimate $\hat{\phi} \in \{\hat{\tau}, \hat{\theta}\}$. Various implementations of low-pass filters can be found in the literature (Teunissen & Montenbruck, 2017, p. 419). For the one
considered in this work, as defined by Stephens and Thomas (1995), the filter output $\hat{\delta\phi}$ is expressed in the z-transform domain as

$$ \hat{\delta\phi}(z) = F_{\phi}(z) D_{\phi}(\eta_{a}(z) - \hat{\eta}(z), \Delta\nu(z)) \quad \text{with} \quad F_{\phi}(z) = \frac{1}{(1 - z^{-1})^{N_{\phi}-1}} \sum_{n=0}^{N_{\phi}-1} \kappa_{\phi,n} T_{i}^{N_{\phi}-1-n} (1 - z^{-1})^{n}. \quad (14) $$

Here, z is the z-transform variable, $D_{\phi}$ is the z-transform of the discriminator output $d_{\phi}$, and $F_{\phi}$ is the low-pass filter transfer function. $(\kappa_{\phi,n})_{n \in [0; N_{\phi}-1]}$ represents the filter coefficients, as computed by Stephens and Thomas (1995), and $N_{\phi}$ denotes the loop order. Similarly, the low-pass filter output can be expressed in the time domain as a function of its input $d_{\phi}$ as

$$ \delta^{(N_{\phi}-1)} \hat{\delta\phi}[k] = \sum_{n=0}^{N_{\phi}-1} \kappa_{\phi,n} \delta^{(n)} d_{\phi}(\eta_{a}[k] - \hat{\eta}[k], \Delta\nu[k]). \quad (15) $$

where $\delta^{(n)}$ denotes the n-th difference (Backward Euler transformation), defined for $n > 0$ as

$$ T_{i}^{n} \delta^{(n)} x[k] = \delta^{(n-1)} x[k] - \delta^{(n-1)} x[k-1] \quad (16) $$

and $\delta^{(0)}x[k] = x[k]$. In the z-transform domain, the n-th difference is equivalent to a multiplication by $[(1 - z^{-1})/T_{i}]^{n}$. Note that $\hat{\delta\phi}$ and $\delta\hat{\phi}$ represent two distinct quantities: while $\hat{\delta\phi}$ denotes the estimate of the derivative of $\phi$, $\delta\hat{\phi}$ denotes the derivative of the estimate of $\phi$.

## 3.2 | Phase closed-loop model

In a digital tracking loop, the code (DLL) and carrier (PLL) phase estimates $\hat{\phi} \in \{\hat{\tau}, \hat{\theta}\}$ are updated at each epoch k by the previously filtered discriminator output $\hat{\delta\phi}[k-1]$ (Stephens & Thomas, 1995). Moreover, considering a carrier aiding operation (i.e., exploiting the correlation between the code $\tau_a$ and the carrier phase $\theta_a$ to mitigate most of the input dynamics in the DLL using the PLL measurements), as detailed in (Kaplan & Hegarty, 2017, p. 162), the code and phase updates can be expressed as

$$ \left\{ \begin{aligned} \hat{\tau}[k] &= \hat{\tau}[k-1] + T_i (\hat{\delta\tau}[k-1] - \beta \hat{\delta\theta}[k-1]) & \quad (\text{DLL}) \\ \hat{\theta}[k] &= \hat{\theta}[k-1] + T_i \hat{\delta\theta}[k-1] & \quad (\text{PLL}) \end{aligned} \right. \quad (17) $$

with $\hat{\delta\tau}$ and $\hat{\delta\theta}$ denoting the code and phase filter outputs, as defined in (14). The parameter $\beta$ is the scaling factor between the code chip rate and the L-band carrier frequency, as defined in (Kaplan & Hegarty, 2017, p. 163). By substituting (14) into (17), the closed-loop model can be expressed in the z-transform domain as

$$ \left\{ \begin{aligned} \hat{\tau}(z) + \beta \hat{\theta}(z) &= \frac{z^{-1}}{1-z^{-1}} T_i F_{\tau}(z) D_{\tau}(\eta_a(z) - \hat{\eta}(z), \Delta\nu(z)) & \quad (\text{DLL}) \\ \hat{\theta}(z) &= \frac{z^{-1}}{1-z^{-1}} T_i F_{\theta}(z) D_{\theta}(\eta_a(z) - \hat{\eta}(z), \Delta\nu(z)) & \quad (\text{PLL}) \end{aligned} \right. \quad (18) $$

Therefore, the dynamic behavior of the tracking loops can be modeled considering the system (18) of two difference equations, each modeling the DLL or the PLL, with the solutions being $\hat{\tau}$ and $\hat{\theta}$. This system is referred to as the closed-loop model. The PLL-aiding-DLL operation induces a phase term $\beta\hat{\theta}$ in the DLL equation. It is important to note that the solutions $\hat{\tau}$ and $\hat{\theta}$ are included in the discriminator outputs $D_{\phi}$ (within $\hat{\eta}$), and thus, the linearity and interdependence between the two equations are directly linked to the discriminator function, as further explained below. Moreover, in $\hat{\eta}$, $\hat{f}$ and $\hat{\theta}$ are related by $\hat{f} = \frac{1}{2\pi}\delta^{(1)}\hat{\theta}$, meaning that any dependence on the frequency $\hat{f}$ implies a dependence on the PLL.

It is worth noting that the term $T_i z^{-1}/(1 - z^{-1})$ in (18) corresponds to the NCO transfer function (integrator).

### 3.2.1 | Frequency closed-loop model

This subsection presents the model of the frequency estimate dynamic behavior, $\hat{f}$. By substituting the definition of the frequency estimate, $\hat{f} = \frac{1}{2\pi}\delta^{(1)}\hat{\theta}$, into (17), the frequency estimate can be expressed as

$$ 2\pi \hat{f}(z) = z^{-1} \hat{\delta\theta}(z) = z^{-1} F_{\theta}(z) D_{\theta}(\eta_a(z) - \hat{\eta}(z), \Delta\nu(z)). \quad (19) $$

It is worth noting that (19) is entirely equivalent to the PLL equation in (18), but explicitly shows the frequency estimate behavior, $\hat{f}$.
### 3.2.2 | Closed-loop model linear and independence properties

This subsection presents the properties of linearity and independence of the closed-loop system in (18). Analyzing the spoofing impact on these properties is crucial for determining whether the assumptions made in the nominal situation hold under spoofing (e.g., signal additivity, noise properties, independence between DLL and PLL, etc.).

**Loop Linearity:**

The closed-loop system is linear if the dependent variables $\hat{\phi}$ and their derivatives appear linearly. Under the linearity property, the system satisfies additivity and homogeneity. Considering (18), and noting the linearity of $F_{\hat{\phi}}$ (see (14)), the linearity assumption is equivalent to the linearity of the DLL and PLL discriminators $d_{\hat{\phi}}$.

**Loop Independence:**

The DLL and PLL are considered independent if, in (18), the DLL equation does not depend on $\hat{\theta}$ and its derivatives, and the PLL equation does not depend on $\hat{\tau}$ and its derivatives. The independence property allows for the study of each loop separately. As shown in (18), due to the PLL-aiding-DLL operation, the DLL equation depends on the phase $\hat{\theta}$ and, consequently, on the PLL (as intended). Beyond the PLL-aiding-DLL coupling, any undesired dependence between the two loops is reflected in the dependence of their discriminators $d_{\theta}$ and $d_{\tau}$.

## 4 | RESOLUTION STRATEGY

The dynamic behavior of the tracking loops under spoofing can be expressed by computing the solution $\hat{\eta}$ of the closed-loop model (18). While in the nominal situation, the system can be solved analytically or analyzed through its linear approximation and transfer function analysis tools (Gardner, 2005, p. 97), the presence of spoofing may disturb the discriminators, thereby affecting the linearity and interdependence properties of the loops (see Sec. 3.2.2). Consequently, solving the closed-loop model system (18) becomes very challenging due to non-linearity and loop interdependence. Additionally, the high order of the loops (typically 3 for PLL) makes analytical solutions intractable (G. A. Leonov et al., 2015).

To address this, we propose a transformation-based strategy to analyze the closed-loop model (18) within a stationary frame relative to the observed signal dynamics. In other words, we propose a change of variables to translate the system solution into a frame where the locked solution is stationary. This approach enables the determination of the system's stable equilibria (SE) (i.e., potential points of convergence of the system) and facilitates the analysis of the system's linear properties, independence, and dynamic behavior.

### 4.1 | Equivalent dynamic definition

The equivalent tracked dynamic, denoted $\phi_{eq} \in \{\tau_{eq}, \theta_{eq}\}$ (and $\eta_{eq} = [\tau_{eq}, \theta_{eq}, f_{eq}]^T$), represents the signal dynamic observed by the receiver when tracking the received signal, considering both signal and implementation distortion. In the presence of interference, this dynamic can differ from the authentic dynamic $\eta_a$. It is worth noting that this dynamic may not always have a physical interpretation, but provides insights into the behavior of the tracking system, accounting for any system distortions, e.g., steady-state errors, phase ambiguity, or distortion in discriminator functions.

We define the equivalent tracking errors $\epsilon_{\phi,eq}$ as the errors between the equivalent $\phi_{eq}$ and the estimated parameters $\hat{\phi}$ such that

$$ \epsilon_{\eta,eq} \triangleq \eta_{eq} - \hat{\eta} = \begin{bmatrix} \tau_{eq} - \hat{\tau} \\ \theta_{eq} - \hat{\theta} \\ f_{eq} - \hat{f} \end{bmatrix} = \begin{bmatrix} \epsilon_{\tau,eq} \\ \epsilon_{\theta,eq} \\ \epsilon_{f,eq} \end{bmatrix} \quad (\text{and } \epsilon_{\phi,eq} \triangleq \phi_{eq} - \hat{\phi}). \qquad (20) $$

Finally, we define the relative equivalent dynamic $\Delta\eta_{eq} = [\Delta\tau_{eq}, \Delta\theta_{eq}, \Delta f_{eq}]^T$ (and $\Delta\phi_{eq} \in \{\Delta\tau_{eq}, \Delta\theta_{eq}\}$) as the difference between the equivalent and authentic dynamics, defined as

$$ \Delta\eta_{eq} \triangleq \eta_{eq} - \eta_a \quad (\text{and } \Delta\phi_{eq} \triangleq \phi_{eq} - \phi_a). \qquad (21) $$
<figure><img src="image_6.png" /><figcaption>FIGURE 4 Illustration of the closed-loop model frames and frame transformations. The blue curve represents the closed-loop solution at lock in each frame, as detailed in Sec. 4.4.</figcaption></figure>

## 4.2 | Considered frames

In this article, a frame defines the coordinate system in which the solution of the closed-loop model is expressed.

* **Estimate frame:** The estimate frame is the basic frame where the solution of the closed-loop model is $\hat{\eta}$. The closed-loop model is given by (18).

* **Nominal frame:** In the nominal frame, the solution is expressed relative to the authentic dynamic $\eta_a$. The solution of the closed-loop model in the nominal frame becomes the nominal tracking errors $\varepsilon_\eta$. This frame enables the determination of the nominal tracking error and quantification of the interference distortion.

* **Equivalent frame:** In the equivalent frame, the solution is expressed relative to the equivalent dynamic $\eta_{eq}$. The solution of the closed-loop model in this frame becomes the equivalent tracking errors $\varepsilon_{\eta,eq}$. This frame enables the computation of the system's SE and the analysis of the dynamic behavior.

It is worth noting that the closed-loop model and its solution are equivalent across the three frames. Therefore, the system can be studied in any one of the frames, and the solution can be translated depending on the desired quantity. The different frames are related by a change of coordinates through a mathematical transformation, as depicted in Fig. 4. The various transformations are expressed for any $\eta = [\tau, \theta, f]^T$ as

$$ \mathcal{T}_{0 \to \text{eq}}(\eta) = \eta_{\text{eq}} - \eta, \quad \mathcal{T}_{0 \to a}(\eta) = \eta_a - \eta, \quad \mathcal{T}_{a \to \text{eq}}(\eta) = \Delta\eta_{\text{eq}} + \eta. \qquad (22) $$

## 4.3 | Equivalent closed-loop model

The equivalent closed-loop model (i.e., the closed-loop model expressed in the equivalent frame) is obtained by applying the transformation $\mathcal{T}_{0 \to \text{eq}}$ to (18), such that

$$ \left\{ \begin{aligned} \varepsilon_{\tau, \text{eq}} + \beta \varepsilon_{\theta, \text{eq}} &= \tau_{\text{ca}} - \frac{z^{-1}}{1-z^{-1}} T_i F_{\tau}(z) D_{\tau} (\varepsilon_{\eta, \text{eq}} - \Delta\eta_{\text{eq}}, \Delta\nu) & (\text{DLL}) \\ \varepsilon_{\theta, \text{eq}} &= \theta_{\text{eq}} - \frac{z^{-1}}{1-z^{-1}} T_i F_{\theta}(z) D_{\theta} (\varepsilon_{\eta, \text{eq}} - \Delta\eta_{\text{eq}}, \Delta\nu) & (\text{PLL}) \end{aligned} \right. \qquad (23) $$
with $\tau_{ca} = \tau_{eq} + \beta \theta_{eq}$ representing the carrier-aided tracking equivalent delay. The equivalent closed-loop model (23) is equivalent to (18), except that the solution is now $\varepsilon_{\phi,eq}$. The equivalent closed-loop model can also be expressed in the time domain as

$$ \left\{ \begin{aligned} \delta^{(N_{\tau})} \varepsilon_{\tau,eq}[k] + \beta \delta^{(N_{\tau})} \varepsilon_{\theta,eq}[k] &= \delta^{(N_{\tau})} \tau_{ca}[k] - \sum_{n=0}^{N_{\tau}-1} \kappa_{\tau,n} \delta^{(n)} d_{\tau} (\varepsilon_{\eta,eq}[k-1] - \Delta\eta_{eq}[k-1], \Delta\nu[k-1]) \\ \delta^{(N_{\theta})} \varepsilon_{\theta,eq}[k] &= \delta^{(N_{\theta})} \theta_{eq}[k] - \sum_{n=0}^{N_{\theta}-1} \kappa_{\theta,n} \delta^{(n)} d_{\theta} (\varepsilon_{\eta,eq}[k-1] - \Delta\eta_{eq}[k-1], \Delta\nu[k-1]) \end{aligned} \right. \quad (24) $$

## 4.4 | Locked state definition

The locked state defines a solution of the system where synchronization with the observed signal dynamics $\phi_{eq}$, is successfully established and maintained. In this state, the system can be considered stationary within the equivalent frame. Throughout this work, the locked state is denoted by the superscript 'l', such as in $\dot{\phi}^l$ or $\varepsilon_{\phi}^l$. The locked state can be expressed as a function of the equivalent tracking error $\varepsilon_{\phi,eq}$, satisfying the following conditions: (G. A. Leonov et al., 2015)

1. **Equilibrium condition:** The code and carrier phase errors at the locked state $\varepsilon_{\phi,eq}^l$ are constant, and their digital derivative is zero, such that for all $k \in \mathbb{Z}$,

$$ \varepsilon_{\phi,eq}^l[k-1] = \varepsilon_{\phi,eq}^l[k] \quad \text{or} \quad \delta \varepsilon_{\phi,eq}^l = 0. \quad (25) $$

Thus, the equilibrium condition can also be expressed for all integers $n > 0$ as

$$ \varepsilon_{\phi,eq}^l[k-n] = \varepsilon_{\phi,eq}^l[k] \quad \text{or} \quad \delta^{(n)} \varepsilon_{\phi,eq}^l = 0; \quad (26) $$

2. **Stability condition:** The system can maintain the locked state after a small perturbation. This condition is related to the discriminator slope, as described in (Gardner, 2005, p.185), and is given by

$$ \frac{\partial d_{\phi} (\varepsilon_{\eta,eq}^l - \Delta\eta_{eq}, \Delta\nu)}{\partial \varepsilon_{\phi,eq}} > 0. \quad (27) $$

Furthermore, G. Leonov and Kuznetsov (2014) demonstrates that if the low-pass filter is both controllable and observable (as assumed from its design), only the system's SE satisfy the locked-state conditions (25), (26), and (27). This ensures that the filter states remain constant in the locked state, resulting in the equilibrium condition for the filter states, expressed as

$$ \forall n \in \mathbb{N}^*, \quad \delta^{(n)} d_{\phi} (\varepsilon_{\eta,eq}^l - \Delta\eta_{eq}, \Delta\nu) = 0 \quad (28) $$

where $\mathbb{N}^*$ is set of non-zero natural integers.

## 4.5 | Derivation of the SE condition

The system's SE can be expressed by considering the locked-state conditions given in (26), (27), and (28), within the equivalent closed-loop model described by (24). The resulting computation yields a system of three unknowns, $\varepsilon_{\eta,eq}^l$, and two equations (corresponding to the DLL and PLL). To render the system solvable, a third equation is introduced, representing the phase-frequency equilibrium. Additionally, the stability condition in (27) imposes three supplementary constraints. The detailed computation is presented in Appendix A and leads to

$$ \left\{ \begin{aligned} \frac{d_{\tau} (\varepsilon_{\eta,eq}^l - \Delta\eta_{eq}, \Delta\nu)}{\partial d_{\tau} (\varepsilon_{\eta,eq}^l - \Delta\eta_{eq}, \Delta\nu)} &= k_{\tau}, & d_{\theta} (\varepsilon_{\eta,eq}^l - \Delta\eta_{eq}, \Delta\nu) &= k_{\theta}, & \chi_f (\varepsilon_{\eta,eq}^l - \Delta\eta_{eq}, \Delta\nu) &= 0 \\ \frac{\partial d_{\theta} (\varepsilon_{\eta,eq}^l - \Delta\eta_{eq}, \Delta\nu)}{\partial \varepsilon_{\theta,eq}} &> 0, & \frac{\partial d_{\theta} (\varepsilon_{\eta,eq}^l - \Delta\eta_{eq}, \Delta\nu)}{\partial \varepsilon_{\theta,eq}} &> 0, & \frac{\partial \chi_f (\varepsilon_{\eta,eq}^l - \Delta\eta_{eq}, \Delta\nu)}{\partial \varepsilon_{f,eq}} &> 0 \end{aligned} \right. \quad (29) $$

where $k_{\tau}$ and $k_{\theta}$ are the steady-state errors, which remain constant over time, and are expressed as

$$ k_{\tau} = \frac{\delta^{(N_{\tau})} \tau_{ca}}{\kappa_{\tau,0}}, \quad k_{\theta} = \frac{\delta^{(N_{\theta})} \theta_{eq}}{\kappa_{\theta,0}} \quad (30) $$
and $\chi_f$ is a function depicting both PLL phase and frequency equilibrium, such that

$$2\pi T_i \chi_f (\varepsilon_\eta, \Delta\nu) = \arg\{\Lambda_P (\varepsilon_\eta[k], \Delta\nu[k])\} - \arg\{\Lambda_P (\varepsilon_\eta[k-1], \Delta\nu[k-1])\} \pmod{\pi, \frac{\pi}{2}} \quad (31)$$

The solutions of the closed-loop model and its SE can be expressed in any reference frame (Sec. 4.2). Specifically, the SE can be expressed in the nominal frame by applying the transformation $T_{eq\to a} = T_{a\to eq}^{-1}$ to (31), such that

$$\left\{ \begin{array}{ll} d_{\tau}(\varepsilon_{\eta}^{l}, \Delta\nu) = k_{\tau}, & d_{\theta}(\varepsilon_{\eta}^{l}, \Delta\nu) = k_{\theta}, & \chi_{f}(\varepsilon_{\eta}^{l}, \Delta\nu) = 0 \\ \frac{\partial d_{\tau}(\varepsilon_{\eta}^{l}, \Delta\nu)}{\partial \varepsilon_{\tau}} > 0, & \frac{\partial d_{\theta}(\varepsilon_{\eta}^{l}, \Delta\nu)}{\partial \varepsilon_{\theta}} > 0, & \frac{\partial \chi_{f}(\varepsilon_{\eta}^{l}, \Delta\nu)}{\partial \varepsilon_{f}} > 0. \end{array} \right. \quad (32)$$

It is worth noting that the system in (32) may have multiple valid solutions, each representing a potential SE of the tracking loops, and thus a possible equivalent tracked dynamic $\phi_{eq}$.

### 4.5.1 | System dynamic behavior

The dynamic behavior of the joint DLL and PLL can be categorized in the equivalent frame into four distinct behaviors:

1. **Perfect lock:** The equivalent tracking error $\varepsilon_{\phi,eq}$ remains constant and equal to zero, indicating that the system is perfectly locked to the observed dynamic $\phi_{eq}$. This condition satisfies (29) without any stress error ($k_{\phi} = 0$), corresponding to the zeros of the discriminator.

2. **Lock:** The equivalent tracking error $\varepsilon_{\phi,eq}$ remains constant, though not zero. This indicates that the system is locked to the equivalent dynamic $\phi_{eq}$, with a stress error $k_{\phi}$, and satisfies the conditions in (29). For small values of $k_{\phi}$, the stress error induces a bias in the SE proportional to $k_{\phi}$. However, once $k_{\phi}$ exceeds a certain threshold, the discriminator may not reach zero, and the system may diverge. The impact of the dynamic on loop convergence is studied in (Gardner, 2005, chap. 3).

3. **Transient response:** The equivalent tracking error $\varepsilon_{\phi,eq}$ is not constant, but $k_{\phi}$ remains constant. Therefore, the system is not locked but is in its transient response, gradually converging to $\tau_{ca}$ and $\theta_{eq}$.

4. **Non-convergent response:** The value of $k_{\phi}$ is not constant, indicating that the tracked dynamic is too fast for the system to achieve lock. It is important to note that the system is not necessarily diverging; for example, with a harmonic input, the system may not achieve lock but can still reach a steady state where the response is also harmonic.

### 4.6 | Summary of locked state based resolution strategy

To summarize, this section proposes a method to analyze the closed-loop model in (18) by translating it into an equivalent, motionless frame where the system is stationary at lock. The analysis of the system in this equivalent frame enables the determination of its SE, expressed in (29), and provides insight into its dynamic behavior, as discussed in Sec. 4.5.1.

Specifically, the equivalent dynamic $\phi_{eq}$ is computed from the system's SE (32) at perfect lock ($k_{\phi} = 0$) within the nominal frame. Subsequently, the stress error $k_{\phi}$, as defined in (30), indicates whether the system converges (Sec. 4.5.1). For a convergent system, the equivalent tracking error can be further analyzed to determine whether the system is in lock or in a transient response state.

## 5 | CLOSED-LOOP MODEL UNDER SPOOFING - DETERMINISTIC ANALYSIS

This section presents the characterization of the deterministic dynamic behavior of the closed-loop model under spoofing. The system is analyzed for each spoofing-induced scenario outlined in Sec. 2.3, following the strategy described in Sec. 4. Specifically, the section details the system's SE (Sec. 4.5) along with the linear and interdependence properties of the loops (Sec. 3.2.2). The analysis of these properties is independent of the system's stochastic nature. Therefore, in this section, the system is assumed to be deterministic, and the random contributions of the correlator output model (6) are disregarded. The stochastic closed-loop model is studied in Sec. 6, building upon the results derived in this section.

It is worth noting that the discriminators $d_{\phi}$ appear in both the SE expression (Sec. 4.5) and the loop properties (Sec. 3.2.2). Therefore, the DLL and PLL discriminators are explicitly expressed for each spoofing-induced scenario. Finally, the PLL
differential function $\chi_f$ is computed under the assumption that the variation in both the authentic and spoofed code delay and frequency over $T_i$ is negligible, such that

$$ \begin{aligned} \delta^{(1)} \tau_a[k] &\approx 0, & \delta^{(1)} f_a[k] &\approx 0, & \delta^{(1)} \theta_a[k] &\approx 2\pi T_i f_a[k], & \delta^{(1)} C_a[k] &\approx 0, \\ \delta^{(1)} \tau_s[k] &\approx 0, & \delta^{(1)} f_s[k] &\approx 0, & \delta^{(1)} \theta_s[k] &\approx 2\pi T_i f_s[k], & \delta^{(1)} C_s[k] &\approx 0, \\ \delta^{(1)} \Delta\tau[k] &\approx 0, & \delta^{(1)} \Delta f[k] &\approx 0, & \delta^{(1)} \Delta\theta[k] &\approx 2\pi T_i \Delta f[k], & \delta^{(1)} \Delta g[k] &\approx 0. \end{aligned} \quad (33) $$

## 5.1 | Nominal situation

First, the tracking loops are analyzed in the nominal situation as a reference. In this nominal situation, and neglecting the noise contribution, the correlator outputs (6) can be simplified as

$$ \Lambda_{\mathrm{E}}^{(\mathrm{N})}(\varepsilon_{\eta}) = \Lambda_{\mathrm{a}}(\varepsilon_{\eta} - \frac{c_{\tau}}{2} e_1), \quad \Lambda_{\mathrm{P}}^{(\mathrm{N})}(\varepsilon_{\eta}) = \Lambda_{\mathrm{a}}(\varepsilon_{\eta}), \quad \Lambda_{\mathrm{L}}^{(\mathrm{N})}(\varepsilon_{\eta}) = \Lambda_{\mathrm{a}}(\varepsilon_{\eta} + \frac{c_{\tau}}{2} e_1) \quad (34) $$

<figure><img src="image_7.png" /><figcaption>FIGURE 5 DLL and PLL discriminators in the nominal situation ($c_{\tau} = 0.1$ chip and $T_i = 20$ ms). The blue line represents the DLL discriminator for a finite RFFE bandwidth, while the PLL discriminator remains independent of the RFFE bandwidth</figcaption></figure>

### 5.1.1 | DLL discriminator

The output of the DLL discriminator can be expressed by substituting (34) into (10) as

$$ d_{\tau}^{(\mathrm{N})}(\varepsilon_{\eta}) = \frac{C_{\mathrm{a}}}{\hat{C} K_{\tau}} \zeta_{f}(\varepsilon_{f})^{2} Z_{\tau}(\varepsilon_{\tau}) \quad (35) $$

where

$$ Z_{\tau}(\varepsilon_{\tau}) \triangleq \zeta_{\tau} \left(\varepsilon_{\tau} - \frac{c_{\tau}}{2}\right)^{2} - \zeta_{\tau} \left(\varepsilon_{\tau} + \frac{c_{\tau}}{2}\right)^{2}. \quad (36) $$

The discriminator depends on both $\varepsilon_{\tau}$ and $\varepsilon_f$. However, it can be factorized into separate terms involving $\varepsilon_{\tau}$ and $\varepsilon_f$. For small values of $\varepsilon_f$, the term $\zeta_f(\varepsilon_f)^2$ acts as an attenuation factor and does not affect the zero of the discriminator, which is determined by $Z_{\tau}$. The discriminator $d_{\tau}$ is plotted in Fig. 5a for an infinite RFFE bandwidth and a bandwidth of 8 MHz, illustrating a linear region as a function of $\varepsilon_{\tau}$, spanning the range $[-c_{\tau}/2, c_{\tau}/2]$ around the zero at $\varepsilon_{\tau} = 0$.
## 5.1.2 | PLL discriminator

The output of the PLL discriminator can be expressed by substituting (34) into (11) as

$$d_{\theta}^{(N)}(\varepsilon_{\eta}) = \arg\{\Lambda_{a}(\varepsilon_{\eta})\} \left(\mod \pi, \frac{\pi}{2}\right) = \varepsilon_{\theta} \left(\mod \pi, \frac{\pi}{2}\right). \quad (37)$$

The discriminator, shown in Fig. 5b, depends solely on $\varepsilon_{\theta}$ and exhibits linear behavior within the range $[-\pi/2, \pi/2]$ around $\varepsilon_{\theta} = 0$, with a periodicity of $\pi$.

## 5.1.3 | PLL differential function

The function $\chi_f$ can be expressed by substituting (34) for epochs $k$ and $k-1$ into (31), while considering the approximation (33), as

$$\chi_f^{(N)}(\varepsilon_\eta) = \frac{1}{2\pi T_i} \left( \varepsilon_\theta[k] - \varepsilon_\theta[k-1] \left( \mod \pi, \frac{\pi}{2} \right) \right) \approx \varepsilon_f \left( \mod \frac{1}{2T_i}, \frac{1}{4T_i} \right). \quad (38)$$

The function $\chi_f$, shown in Fig. 5c, depends solely on $\varepsilon_f$ and exhibits zeros at $\varepsilon_f = 0$, with a periodicity of $1/(2T_i)$.

## 5.1.4 | System SE

The system SE in the nominal situation can be expressed by substituting (35), (37), and (38) into (32) ($k_\phi = 0$), such that

$$\varepsilon_{\tau}^{l(N)} = 0, \quad \varepsilon_{f}^{l(N)} = \frac{p'}{2T_i}, \quad \varepsilon_{\theta}^{l(N)} = p\pi, \quad \forall p, p' \in \mathbb{Z}. \quad (39)$$

Consequently, in the nominal situation, the system exhibits multiple SE points, highlighting the presence of multiple phase and frequency SE (and thus multiple potential tracked dynamics, $\phi_{eq}$) in addition to the authentic dynamic, $\phi_a$. These multiple phase and frequency SE, represented by $p$ and $p'$, arise from the $\pi$-ambiguity of the PLL discriminator and can result in cycle slips in the phase measurement. The periodicity effect on phase tracking has been extensively analyzed in the literature, e.g., in (Gardner, 2005).

## 5.1.5 | System linearity and independence

The analysis of the DLL and PLL discriminators reveals their linearity for low frequency errors $\varepsilon_f$. The loop system then exhibits linear properties in the nominal situation (Sec. 3.2.2). Additionally, the two loops are independent at lock (i.e., their SE are independent, as depicted in Eq. (39)). During their transient response, the DLL depends only on the phase error, which is influenced by the PLL-aiding-DLL operation (with the DLL discriminator independent of $\varepsilon_f$ and $\varepsilon_\theta$).

## 5.1.6 | System dynamic response

The dynamic response of the tracking loops can be studied with respect to the equivalent tracked dynamic $\phi_{eq}$, following the classification presented in Sec. 4.5.1. If the stress error $k_\phi$, defined as a function of $\phi_{eq}$ in (30), is constant, the loops are able to converge (for small values of $k_\phi$):

* If $\varepsilon_{\phi,eq}$ is constant, the system has achieved lock and is biased by $d_{\phi}^{-1}(k_\phi)$. Assuming a carrier-aiding operation, the dynamic that drives $k_\tau$ is $\delta^{(N_\tau)}\tau_{ca} = \delta^{(N_\tau)}\tau_a + \beta\delta^{(N_\tau)}\theta_a \approx 0$. Therefore, the carrier-aiding operation cancels almost all authentic dynamic effects on the DLL.

* Otherwise, the system is in its transient response. As the system exhibits linear properties, the closed-loop model can be approximated by a linear dynamic system, and its transient response can be analyzed using transfer function analysis tools, as presented, for example, in (Gardner, 2005, p. 114).

## 5.2 | Spoofing-induced jamming situation

As shown in Sec. 2.3, the spoofer's impact on the correlator output in the induced-jamming situation is primarily limited to the retransmitted noise. Therefore, disregarding the noise contribution, the correlator output under the induced-jamming situation is identical to the nominal situation. As a result, the loop discriminators, along with their linear and independence properties, SE, and dynamic behavior, are equivalent to those in the nominal situation, as presented in Sec. 5.1.
## 5.3 | Spoofing-induced spoofing situation

In the induced spoofing situation, disregarding the noise contribution, the E, P, and L correlator outputs in (6) can be simplified to

$$ \Lambda_{\text{E}}^{(\text{S})}(\varepsilon_{\eta}, \Delta\nu) = \Lambda_{\text{s}}(\varepsilon_{\eta} - \frac{c_{\tau}}{2}e_{1}, \Delta\nu), \quad \Lambda_{\text{P}}^{(\text{S})}(\varepsilon_{\eta}, \Delta\nu) = \Lambda_{\text{s}}(\varepsilon_{\eta}, \Delta\nu), \quad \Lambda_{\text{L}}^{(\text{S})}(\varepsilon_{\eta}, \Delta\nu) = \Lambda_{\text{s}}(\varepsilon_{\eta} + \frac{c_{\tau}}{2}e_{1}, \Delta\nu) \quad (40) $$

As shown in (4), the spoofing peak $\Lambda_s$ retains the same shape as the authentic peak $\Lambda_a$, but it is shifted by $\Delta\eta$ and amplified by $\sqrt{\Delta g}$. The discriminator outputs $d_\tau$, $d_\theta$, and $\chi_f$ can be computed through straightforward calculations, yielding results similar to those in Sec. 5.1, but shifted by $\Delta\eta$. Specifically, the system under the induced-spoofing situation can thus be expressed as

$$ \varepsilon_{\tau}^{l(S)} = -\Delta\tau, \quad \varepsilon_{f}^{l(S)} = -\Delta f + \frac{p'}{2T_{i}}, \quad \varepsilon_{\theta}^{l(S)} = -\Delta\theta + p\pi, \quad \forall p, p' \in \mathbb{Z}. \quad (41) $$

The dynamic behavior of the loop is then very similar to the nominal situation, except that the tracked dynamic $\phi_{eq}$ corresponds to the spoofing dynamic $\phi_s$ (plus any potential PLL ambiguity). Finally, the spoofing signal does not affect the linearity or independence of the loops. Therefore, for small equivalent tracking errors, the linear approximation remains valid.

## 5.4 | Spoofing-induced multipath situation

In the induced multipath situation, and disregarding the noise contribution, the E, P, and L correlator outputs in (6) can be simplified as

$$ \begin{aligned} \Lambda_{\text{E}}^{(\text{M})}(\varepsilon_{\eta}, \Delta\nu) &= \Lambda_{\text{a}}(\varepsilon_{\eta} - \frac{c_{\tau}}{2}e_{1}) + \Lambda_{\text{s}}(\varepsilon_{\eta} - \frac{c_{\tau}}{2}e_{1}, \Delta\nu), \\ \Lambda_{\text{P}}^{(\text{M})}(\varepsilon_{\eta}, \Delta\nu) &= \Lambda_{\text{a}}(\varepsilon_{\eta}) + \Lambda_{\text{s}}(\varepsilon_{\eta}, \Delta\nu), \\ \Lambda_{\text{L}}^{(\text{M})}(\varepsilon_{\eta}, \Delta\nu) &= \Lambda_{\text{a}}(\varepsilon_{\eta} + \frac{c_{\tau}}{2}e_{1}) + \Lambda_{\text{s}}(\varepsilon_{\eta} + \frac{c_{\tau}}{2}e_{1}, \Delta\nu). \end{aligned} \quad (42) $$

### 5.4.1 | DLL discriminator

The DLL discriminator output in the induced-multipath situation can be obtained by substituting (42) into (10) as

$$ d_{\tau}^{(\text{M})}(\varepsilon_{\eta}, \Delta\nu) = \frac{C_{\text{a}}}{\hat{C} K_{\tau}} (\zeta_{f}(\varepsilon_{f})^2 Z_{\tau}(\varepsilon_{\tau}) + \Delta g \zeta_{f}(\varepsilon_{f} + \Delta f)^2 Z_{\tau}(\varepsilon_{\tau} + \Delta \tau) \\ + 2\sqrt{\Delta g} \cos(\Delta \theta) \zeta_{f}(\varepsilon_{f}) \zeta_{f}(\varepsilon_{f} + \Delta f) Z_{\Delta \tau}(\varepsilon_{\tau})) \quad (43) $$

with $Z_\tau$ as defined in (36) and

$$ Z_{\Delta\tau}(\varepsilon_{\tau}) \triangleq \zeta_{\tau}\left(\varepsilon_{\tau}-\frac{c_{\tau}}{2}\right) \zeta_{\tau}\left(\varepsilon_{\tau}+\Delta \tau-\frac{c_{\tau}}{2}\right)-\zeta_{\tau}\left(\varepsilon_{\tau}+\frac{c_{\tau}}{2}\right) \zeta_{\tau}\left(\varepsilon_{\tau}+\Delta \tau+\frac{c_{\tau}}{2}\right). \quad (44) $$

The DLL discriminator output (43) depends on both $\varepsilon_\tau$ and $\varepsilon_f$ and cannot be assumed linear around its zeros with respect to $\varepsilon_\tau$, as shown in Fig. 6. Notably, the discriminator is influenced by the time-varying relative parameters $\Delta\nu$, causing its characteristics to change over time as $\Delta\nu$ evolves. Among these parameters, the relative phase $\Delta\theta$ plays a significant role, as it can undergo large variations driven by the relative frequency $\Delta f$ (Eq. (1)).

### 5.4.2 | PLL discriminator

In the induced-multipath situation, the prompt correlator output (42) consists of a combination of two complex signals. The argument of this complex number is derived in Appendix B and is substituted into (11), yielding

$$ d_{\theta}^{(\text{M})}(\varepsilon_{\eta}, \Delta\nu) = \varepsilon_{\theta} + \frac{\Delta\theta}{2} - \arctan\left(\gamma_{\Delta}(\varepsilon_{\tau}, \varepsilon_{f}) \tan\left(\frac{\Delta\theta}{2}\right)\right) (\text{mod } \pi, \frac{\pi}{2}). \quad (45) $$

where $\gamma_\Delta$ represents the amplitude ratio between the authentic and spoofing peaks, defined as

$$ \gamma_{\Delta}(\varepsilon_{\tau}, \varepsilon_{f}) \triangleq \frac{\zeta_{\tau}(\varepsilon_{\tau}) \zeta_{f}(\varepsilon_{f}) - \sqrt{\Delta g} \zeta_{\tau}(\varepsilon_{\tau} + \Delta \tau) \zeta_{f}(\varepsilon_{f} + \Delta f)}{\zeta_{\tau}(\varepsilon_{\tau}) \zeta_{f}(\varepsilon_{f}) + \sqrt{\Delta g} \zeta_{\tau}(\varepsilon_{\tau} + \Delta \tau) \zeta_{f}(\varepsilon_{f} + \Delta f)}. \quad (46) $$

The PLL discriminator (45) depends on $\varepsilon_\theta$, $\varepsilon_\tau$, and $\varepsilon_f$. While the discriminator remains linear with respect to $\varepsilon_\theta$, the arctan function introduces non-linearity with respect to $\varepsilon_\tau$ (DLL) and $\varepsilon_f$ (PLL).
<figure><img src="image_8.png" /><figcaption>FIGURE 6 Example of the DLL discriminator outputs in the induced-multipath situation ($c_{\tau} = 0.1$ chip, $T_{i} = 20$ ms, $\Delta g = 0.64$, $\Delta \tau = 0.6$ chip, $\Delta f = 31$ Hz, for $\Delta \theta/2\pi \in \{0, 0.25, 0.5, 0.75\}$). Colors represent the amplitude and sign of the discriminator output, while black lines indicate its zeros.</figcaption></figure>

### 5.4.3 | PLL differential function

By substituting the argument of (42), expressed at epochs $k$ and $k-1$, into (31), and applying the approximation (33), we obtain

$$ \chi_f^{(M)}(\varepsilon_\eta, \Delta\nu) \approx \varepsilon_f + \frac{1}{2\pi} Z_f(\varepsilon_\tau, \varepsilon_f) \left( \mod \frac{1}{2T_i}, \frac{1}{4T_i} \right) \quad (47) $$

with

$$ Z_f(\varepsilon_\tau, \varepsilon_f) \triangleq 2\pi\Delta f - \frac{1}{T_i} \left[ \arctan \left( \gamma_\Delta(\varepsilon_\tau, \varepsilon_f) \tan \left( \frac{\Delta\theta}{2} \right) \right) - \arctan \left( \gamma_\Delta(\varepsilon_\tau, \varepsilon_f) \tan \left( \pi\Delta f T_i + \frac{\Delta\theta}{2} \right) \right) \right] \quad (48) $$

and $\gamma_\Delta$ is defined as in (46). The function $\chi_f$ depends on both $\varepsilon_\tau$ and $\varepsilon_f$, but it is independent of the phase error $\varepsilon_\theta$ (as deliberately designed during the construction of $\chi_f$, as shown in Appendix A).

### 5.4.4 | System SE

The system SE can be computed by substituting (43), (45), and (47) into (32). In this situation, the DLL and PLL discriminators are interdependent, which makes resolving the system more challenging. Nevertheless, since both (43) and (47) are independent of $\varepsilon_\theta$, the code and frequency SE can be determined independently of the phase SE, such that

$$ \left\{ \begin{array}{l} d_{\tau} \left( \varepsilon_{\tau}^{l(M)}, \varepsilon_{f}^{l(M)}, \Delta\nu \right) = 0, \quad \chi_{f} \left( \varepsilon_{\tau}^{l(M)}, \varepsilon_{f}^{l(M)}, \Delta\nu \right) = 0, \\ \\ \frac{\partial d_{\tau} \left( \varepsilon_{\tau}^{l(M)}, \varepsilon_{f}^{l(M)}, \Delta\nu \right)}{\partial \varepsilon_{\tau}} > 0, \quad \frac{\partial \chi_{f} \left( \varepsilon_{\tau}^{l(M)}, \varepsilon_{f}^{l(M)}, \Delta\nu \right)}{\partial \varepsilon_{f}} > 0. \end{array} \right. \quad (49) $$

The phase SE is then computed by substituting the solution of (49) into (45), such that

$$ \varepsilon_{\theta}^{l(M)} = -\frac{\Delta\theta}{2} + \arctan \left( \gamma_{\Delta} \left( \varepsilon_{\tau}^{l(M)}, \varepsilon_{f}^{l(M)} \right) \tan \left( \frac{\Delta\theta}{2} \right) \right) + p\pi, \quad \forall p \in \mathbb{Z}. \quad (50) $$

An example of the resolution of (49) is illustrated in Fig. 7. The SE solution (blue points) corresponds to the intersection of the stable zeros of $d_\tau$ (black) and $\chi_f$ (red). The figure highlights the emergence of multiple SE points and their variations with respect to the relative parameters $\Delta\nu$.

In the literature, only the DLL equation of (49) is considered, which is equivalent to examining the intersection of the zeros $d_\tau$ (black) at $\varepsilon_f = 0$. It is worth noting that in a frequency-asynchronous case, this does not allow for the computation of the correct convergence point or the consideration of all possible SE, thereby preventing the prediction of potential system bifurcations.

The solutions of (49) are shown in Figs. 8 and 9 for a set of values of $\Delta\tau$, $\Delta f$, and $\Delta\theta \in [0, 2\pi]$. The figures illustrate the emergence of multiple SE and their variations with the relative phase $\Delta\theta$. For each set of relative parameters, two primary
<figure><img src="image_9.png" /><figcaption>FIGURE 7 Example of the code and frequency SE solution for ($c_{\tau} = 0.1$ chip, $T_i = 20$ ms, $\Delta g = 0.64$, $\Delta \tau = 0.6$ chip, $\Delta f = 31$ Hz, for $\Delta\theta/2\pi \in \{0, 0.25, 0.5, 0.75\}$). The black lines represent the zeros of $d_{\tau}$, and the red lines represent the zeros of $\chi_f$ as functions of $\varepsilon_{\tau}$ and $\varepsilon_f$. The solid lines indicate stable zeros, while the dashed lines represent unstable zeros (stability condition (27)). Finally, the blue dots represent the possible SE that satisfy (49).</figcaption></figure>

clusters of interest are identified: one centered around the authentic dynamic ($\varepsilon_{\eta} = 0$) and the other around the spoofing dynamic ($\varepsilon_{\eta} = -\Delta\eta$). These are referred to as the authentic and the spoofing SE cluster, respectively. Additionally, due to the inherent PLL ambiguity, secondary clusters appear periodically, separated by intervals of $1/2T_i$.

In particular, Fig. 8a illustrates the frequency-synchronous situation ($\Delta f = 0$), which is commonly studied in the literature (Kim et al., 2012; Wang et al., 2023). In this case, the code SE is independent of the frequency SE, with $\varepsilon_f^l = p'/2T_i$, and $\varepsilon_{\tau}^l$ oscillates with $\Delta\theta$ within the MEE. The PLL ambiguity induces a periodicity of the authentic and spoofing clusters of 25 Hz ($1/2T_i$).

Furthermore, Fig. 8 shows the impact of $\Delta f$ on the SE configuration for constant values of $\Delta g = 0.64$ and $\Delta \tau = 0.6$ chip. When the frequency SE is no longer zero, it induces a rotation along the relative phase $\Delta\theta$ in the SE clusters. For $\Delta f > 1/2T_i$ (Figs. 8c and 8d), additional undesired SE (which do not belong to a cluster) appear. These undesired SE do not cover the entire $\Delta\theta$ range, and their presence around the authentic SE cluster can pull the system toward another cluster (bifurcation).

Fig. 9 depicts the impact of $\Delta\tau$ on the SE configuration for constant values of $\Delta g = 0.81$ and $\Delta f = 12$ Hz. For low values of $\Delta\tau$ (Figs. 9a and 9b), some discontinuities are observed in the spoofing SE cluster, resulting in undesired SE near the authentic SE cluster. These discontinuities seem to disappear for higher values of $\Delta\tau$ (Figs. 9c, 9d).

### 5.4.5 | Loop spoofing SE envelope (SSEE)

Fig. 10 shows the maximum absolute tracking error when locked on the authentic cluster, referred to as the absolute spoofing SE envelope (SSEE), as a function of $\Delta\tau$ and $\Delta f$ for $\Delta g = 0.64$. These results are analogous to the MEE studied for multipath interference in the literature (Van Nee, 1996) (for $\Delta f = 0$), except that they express both joint code, frequency, and phase errors $\varepsilon_{\eta}$, and model the impact of $\Delta f$ and loop interdependence. The absolute error exhibits symmetry along $\Delta f$.

It is worth noting that the SSEE does not represent the maximum possible error, but rather the tracking error at lock, i.e., the tracking error to which the system tries to converge. The full behavior of the system is described by the closed-loop model (18) and further analyzed in the next section. Lastly, Fig. 10 highlights the limits of the induced-multipath situation for $\varepsilon_{\tau} = T_c + c_{\tau}/2$, as presented in (Hussong et al., 2023).

### 5.4.6 | System linearity and independence

The presence of spoofing affects both the linearity and the independence of the discriminators. Both DLL and PLL exhibit nonlinearities that affect both the transient response and the system's SE. Consequently, the additivity of the system input can no longer be assumed, and thus the noise or other interference cannot be considered independently. In addition, the loops exhibit interdependence in both the transient response and SE (as seen in Figs. 8 and 9) requires that the DLL and PLL be considered jointly.

### 5.4.7 | System dynamic response

The dynamic response of the tracking loops can be studied with respect to the equivalent tracked dynamic $\phi_{eq}$, following the classification presented in Sec. 4.5.1. The equivalent dynamic under the induced-multipath situation is computed in Sec. 5.4.4.
(The potential dynamics $\Delta\eta_{eq}$ are depicted in Figs. 8 and 9), highlighting a quasi-harmonic behavior along the variation of $\Delta\theta$. This quasi-harmonic behavior induces a non-constant stress error, and thus the loops may not converge toward their SE. Moreover, the nonlinear properties of the loops make the dynamic response very challenging to analyze.

Nevertheless, by assuming that the relative parameters $\Delta\tau$, $\Delta f$, and $\Delta g$ remain constant over one period of $\Delta\theta$, assuming no bifurcation, and considering that the system is initially in its quasi-harmonic behavior (i.e., no significant transient response error), the system's behavior can be determined by computing it over one period $\Delta\theta \in [0, 2\pi]$ for each value of $\Delta\nu$. While the system's SE is independent of the loop equivalent bandwidth $B_{\phi}$, the quasi-harmonic behavior depends on the loop properties.

It is worth noting that this approximation does not allow modeling system bifurcation between the different SE, but only in its quasi-harmonic state around one SE. The behavior of the system, considering bifurcation and chaotic behavior, requires solving (18) numerically.

## 6 | CLOSED-LOOP MODEL UNDER SPOOFING - STOCHASTIC ANALYSIS

This section discusses the stochastic behavior of the closed-loop model under spoofing. We remind the reader that the random contributions are $\Lambda_{n,a}$ and $\Lambda_{n,s}$ within the correlator output (6). In this section, we use the system's properties under spoofing demonstrated in Sec. 5 (e.g., system's SE, linearity, and interdependence).

<figure><img src="image_10.png" /><figcaption>FIGURE 8 Code and frequency SE in the induced-multipath situation, represented in the nominal frame ($c_{\tau} = 0.1$ chip, $T_{i} = 20$ ms, $\Delta g = 0.64$, $\Delta\tau = 0.6$ chip). The colors represent the value of $\Delta\theta \in [0, 2\pi]$, and the black crosses denote the SE of the nominal situation, as defined in (39).</figcaption></figure>

<figure><img src="image_11.png" /><figcaption>FIGURE 9 Code and frequency SE in the induced-multipath situation, represented in the nominal frame ($c_{\tau} = 0.1$ chip, $T_{i} = 20$ ms, $\Delta g = 0.81$, $\Delta f = 12$ Hz). The colors represent the value of $\Delta\theta \in [0, 2\pi]$, and the black crosses denote the SE of the nominal situation, as defined in (39).</figcaption></figure>
<figure><img src="image_12.png" /><figcaption>FIGURE 10 Absolute SSEE (i.e., $\max_{\Delta\theta \in [0,2\pi]} |\epsilon_{\eta}^l| = \max_{\Delta\theta \in [0,2\pi]} |\Delta\eta_{eq}|$) for $\Delta g = 0.64$, $c_{\tau} = 0.1$ chip, and $T_i = 20$ ms.</figcaption></figure>

## 6.1 | Nominal, induced jamming, and induced spoofing situations

In the nominal, induced-jamming, and induced-spoofing situations, the linear properties of the closed-loop model are maintained (Sec. 5). The additivity property of the DLL and PLL holds, and both authentic and spoofing contributions $\Lambda_{n,a}$ and $\Lambda_{n,s}$ can be considered independently. Therefore, the impact of authentic and re-radiated noise can be expressed using the models developed for linear tracking loops in the literature, e.g., in (Betz & Kolodziejski, 2009).

## 6.2 | Induced multipath situation

The analysis of the tracking loops reveals their nonlinearity under induced-multipath situations (Sec. 5.4.6). Consequently, the additivity property of the DLL and PLL can no longer be considered (i.e., the noise does not have the same impact depending on the state vector $\hat{\eta}$ value). The closed-loop model (18) must be analyzed along with the noise contributions $\Lambda_{n,a}$ and $\Lambda_{n,s}$, as a stochastic and nonlinear dynamic system (El Bouch et al., 2024; Gupta, 1975), with the solution being the probability density function (PDF) of the random variable $\hat{\eta}$ (or equivalently $\epsilon_{\eta}$ and $\epsilon_{\eta,eq}$ in the nominal and equivalent frames).

The solution of the stochastic model can be estimated by exploiting the quasi-harmonic behavior of the system, as shown in Sec. 5.4.7. The solution PDF can thus be computed over one period $\Delta\theta \in [0, 2\pi]$ for each value of $\Delta\nu$. The 99th percentile of the absolute possible tracking error when tracking the authentic cluster dynamic is depicted in Fig. 11. These bounds are referred to as the spoofing error envelope (SEE) and represent more accurate error bounds than the SSEE presented in Fig. 10 or SEE in the literature, as they account for both noise impact and loop nonlinearity and interdependence.

First, Fig. 11a highlights the low-pass behavior of the DLL, which filters the input relative equivalent dynamic $\Delta\eta_{eq}$ with a cut-off frequency $B_{\tau}$ (here, 1 Hz). Below this cut-off frequency, the error is similar to its SSEE, as presented in Fig. 10a. However, the filter reduces the tracking error at high frequencies. We observe an increase in code error at rational multiples of the Nyquist frequency (e.g., 25 Hz ($T_i/2$), 16.6 Hz ($T_i/3$), and 12.5 Hz ($T_i/4$)).

Fig. 11b depicts the absolute frequency SEE. The cut-off frequency of the PLL is much higher than that of the DLL, resulting in less attenuation of phase and frequency errors. Additionally, the figures highlight regions with high-frequency errors where the frequency error and probability of cycle slip are elevated. These regions correspond to the areas where the phase SE values are close to $\pi/2$ (or $-\pi/2$), as shown in Fig. 10c. In these regions, the correlator output approaches the limits of the arctan function interval ($[-\pi/2, \pi/2]$). When the phase approaches these limits, the PLL discriminator corrects the phase, inducing a jump in the frequency error and causing a phase cycle slip. These regions are observed at relatively high relative power ($\Delta g > 0.5$). It is worth noting that due to these frequent cycle slips, the phase is unavailable in these regions (Fig. 11c).
<figure><img src="image_13.png" /><figcaption>FIGURE 11 Absolute SEE (99th percentile of the absolute random tracking error $ε_η$) for $Δg = 0.64$ and $C/N_0 = 55$ dB.Hz. The tracking loop parameters are set to $T_i = 20$ ms, $c_τ = 0.1$ chip, $B_τ = 1$ Hz, and $B_θ = 20$ Hz.</figcaption></figure>

## 7 | SIMULATIONS

This section analyzes the dynamic behavior of tracking loops under spoofing. The theoretical models of the loops proposed in this work are evaluated and compared with the behavior of the loops in a Software Defined Radio (SDR) receiver. Three distinct scenarios are considered: jamming, spoofing, and multipath, corresponding to the spoofing-induced situations presented in Sec. 2.3. For each scenario, the code, phase, and frequency estimates are represented in both the nominal ($ε_η$) and equivalent ($ε_{η,eq}$) frames. We note that the frame and the transformation between them are detailed in Sec. 4.2.

On one hand, the theoretical model includes, for both scenarios, the system's SE (for $k_φ = 0$), as defined in (32), and the numerical solution of the deterministic (noise-free) closed-loop model in (18). Additionally, in the multipath scenario, the theoretical SEE, as presented in Fig. 11, is plotted.

On the other hand, the simulation results depict the code, frequency, and phase tracking errors of SDR tracking loops from our own implementation. The architecture of the SDR shapes the model presented in this work and is detailed in Appendix C. The parameters of the loops for both the simulation and the model are presented in Table 1.

The dynamics of the authentic signal $η_a$ are generated similarly for each scenario to simulate realistic high dynamics without authentic stress error ($δη_a^{(3)} = 0$). The dynamics of the spoofing signal $η_s$ are generated based on scenario-specific conditions outlined in (Hussong et al., 2023). Detailed expressions for $η_a$ and $Δη$ are presented in Appendix D.

<table><caption>TABLE 1
Simulation parameters.</caption><tr><td></td><td>Correlator</td><td>Integration Time ($T_i$) = 20 ms</td></tr><tr><td rowspan="2">DLL</td><td>Discriminator</td><td>NEMLP, Early-Late Spacing ($c_τ$) = 0.1 chip</td></tr><tr><td>Low-pass Filter</td><td>1st Order, Bandwidth ($B_τ$) = 1 Hz</td></tr><tr><td rowspan="2">PLL</td><td>Discriminator</td><td>arctan</td></tr><tr><td>Low-pass Filter</td><td>3rd Order, Bandwidth ($B_θ$) = 20 Hz</td></tr></table>
## 7.1 | Jamming scenario

<figure><img src="image_14.png" /><figcaption>FIGURE 12 Nominal tracking error $\epsilon_{\eta}$ in the jamming scenario.</figcaption></figure>

The results of the jamming scenario are presented in Fig. 12. The relative parameters $\Delta\eta$ (shown in red) are generated according to (67), and the initial state vector is set to $\hat{\eta}[0] = \eta_a[0] - [3.0 \times 10^{-3}, 0, 0]^T$ (chip, rad, Hz). In this scenario, the theoretical equivalent dynamic is $\eta_a$, making the equivalent and nominal frames identical. Therefore, only one tracking error is represented.

As shown in Fig. 12, the deterministic model (black) exhibits a short transient response for $t < 2$ s. This transient response is obscured by noise in the SDR errors (blue). For $t > 2$ s, the deterministic model achieves lock and matches the theoretical SE (yellow). Additionally, no stress error is observed since $\delta\phi_a^{(3)} = 0$ (see Sec. 4.5.1).

The theoretical noise variance can be derived by considering the additivity property of the tracking loops (Sec. 6.1). The authentic and re-radiated noise have power spectral densities (PSD) of $N_0$ and $\Delta g N_0$, respectively. Substituting these into (Betz & Kolodziejski, 2009, Eq. 13), we obtain standard deviations of $1.2 \times 10^{-3}$ and $1.0 \times 10^{-3}$ chip, yielding a total standard deviation of $1.6 \times 10^{-3}$ chip. This value closely matches the code standard deviation of $1.7 \times 10^{-3}$ chip measured in Fig. 12a. A similar observation can be made for the PLL.

## 7.2 | Spoofing scenario

The results of the spoofing scenario are presented in Figs. 13 (nominal frame) and 14 (equivalent frame). In this scenario, the theoretical equivalent dynamic is $\eta_s$. The generated relative dynamic $\Delta\eta$ (shown in red) is identical to that of the jamming scenario, and the initial state vector is set to the spoofing dynamic $\hat{\eta}[0] = \eta_s[0] - [3.0 \times 10^{-3}, 0, 0]^T$ (chip, rad, Hz). Both Figs. 13 and 14 show the convergence of the system toward the spoofing dynamic $\eta_s$ after its transient response ($t > 2$ s). The system's SE (yellow) matches the predicted $\epsilon_{\eta}^t$ expressed in (41), which is also equal to $-\Delta\eta_{eq} = -\Delta\eta$.

The expression of the system state in the equivalent frame allows for the analysis of the transient response, stress error, and noise impact. First, the transient response ($t < 2$ s) is similar to that in the jamming scenario (see Fig. 12), as the tracking loops retain the same linear characteristics, albeit with different initial values $\hat{\eta}[0]$. Furthermore, the tracking errors $\epsilon_{\eta,eq}$ are null at lock, demonstrating the absence of stress error and achieving a perfect lock.

Finally, the theoretical code standard deviation induced by the noise of the authentic and re-radiated signals can be computed using (Betz & Kolodziejski, 2009, Eq. 13), resulting in values of $1.5 \times 10^{-3}$ and $1.2 \times 10^{-3}$ chip, respectively, equivalent to a total standard deviation of $1.9 \times 10^{-3}$ chip. This matches the measured standard deviation of $2.0 \times 10^{-3}$ chip observed in Fig. 14a.

## 7.3 | Multipath scenario

The results of the multipath scenario are plotted in Figs. 15 (nominal frame) and 16 (equivalent frame). The relative dynamic $\Delta\eta$ (shown in red in Fig. 15) is generated as per (68), with a relative frequency $\Delta f$ ranging from 0 to -4 Hz (red axis), inducing a variation of $\Delta\theta$ from 0 to $-8\pi$ per second. This setup enables the observation of the impact of the relative frequency $\Delta f$ on the tracking loops.
<figure><img src="image_15.png" /><figcaption>FIGURE 13 Nominal Tracking error $\epsilon_{\eta}$ in spoofing scenario.</figcaption></figure>

<figure><img src="image_16.png" /><figcaption>FIGURE 14 Equivalent Tracking error $\epsilon_{\eta,eq}$ in spoofing scenario.</figcaption></figure>

<figure><img src="image_17.png" /><figcaption>FIGURE 15 Nominal Tracking error $\epsilon_{\eta}$ in multipath scenario.</figcaption></figure>

The equivalent dynamic is computed from (49), assuming no bifurcation (tracking of the authentic SE cluster). The relative equivalent dynamic $\Delta\eta_{eq}$ is plotted in yellow in Fig. 15. As discussed in Sec. 5.4.4, the relative equivalent dynamic $\Delta\eta_{eq}$ exhibits a quasi-harmonic behavior, driven by the variation of the relative phase $\Delta\theta$ within the varying envelope, as shown in Fig. 10.

The deterministic model and simulated dynamic response are shown in black and blue, respectively, in both nominal and equivalent frames. The analysis of the deterministic behavior highlights two distinct cases, depending on the relative frequency $\Delta f$: 1) for low relative frequencies ($|\Delta f| < 0.1$ Hz), the system converges to its SE and achieves lock onto the spoofing-induced dynamic $\eta_{eq}$. The deterministic equivalent tracking error $\epsilon_{\eta,eq}$ remains constant (and null), as shown in Fig. 16. 2). For $|\Delta f| > 0.1$ Hz,
<figure><img src="image_18.png" /><figcaption>FIGURE 16 Equivalent Tracking error $\epsilon_{\eta,eq}$ in multipath scenario.</figcaption></figure>

the frequency of the oscillation of $\Delta\eta_{eq}$ increases, and $k_\phi$ can no longer be considered constant. Consequently, the system cannot achieve lock and enters into a quasi-harmonic behavior. The deterministic error $\epsilon_{\eta,eq}$ is the output of $\Delta\eta_{eq}$ passed through the non-linear closed-loop equivalent filter. Notably, while the DLL (with a cutoff frequency of 1 Hz) attenuates the signal as the oscillation frequency increases, the PLL (whose order induces resonance) amplifies the oscillations.

The analysis of the noise impact (difference between blue and black curves) highlights the non-additive and heterogeneous behavior induced by the system's non-linearity. While the variance of the input AWGN is constant, the variance of the tracking error strongly varies depending on $\Delta\theta$ and can induce errors much larger than the deterministic bias, as shown for frequency in Fig. 16b (mainly for low $\Delta f$).

Finally, the proposed SEE, shown in orange in Fig. 15 (representing the 1st and 99th percentiles of the stochastic tracking errors), as presented in Sec. 6.2, provides an accurate bound for the tracking error, considering both deterministic and random non-linear dynamic behaviors.

## 8 | CONCLUSION

This paper investigated the spoofing impact on code and carrier phase tracking and proposed a transformation-based strategy to characterize the joint DLL and PLL architecture under spoofing (i.e., system's Stable equilibria (SE), linearity and interdependence properties, dynamic behavior, and noise impact) as a function of the relative dynamic $\Delta\eta$. The system's dynamic behavior was analyzed under each spoofing-induced situation introduced in (Hussong et al., 2023): induced-jamming, induced-spoofing, and induced-multipath.

In the induced-jamming and induced-spoofing situations, the system's SE can be expressed as (39) and (41), respectively. The linearity and independence properties hold, allowing the system's dynamic behavior to be studied using linear system analysis tools (Gardner, 2005, p. 114). Additionally, the noise can be considered additive and characterized as proposed for the nominal situation in (Betz & Kolodziejski, 2009).

In the induced-multipath situation, the system exhibits non-linearities and interdependence. The system's SE, expressed as (49), highlights the emergence of multiple SE and the interdependence between code and frequency SE. These distortions induce chaotic behaviors, with potential bifurcations between SE or areas of high cycle-slip probability (Fig. 11). The non-linearity of the loops breaks the additivity and homogeneity of the AWGN, leading to strongly varying tracking error variances, which can exceed the deterministic bias (Fig. 16). This paper proposes a new spoofing error envelope to bound the system within its quasi-harmonic behavior while accounting for these distortions, as shown in Fig. 11.

The theoretical distortions highlighted in this paper raise several important questions about their actual impact on real GNSS receivers in real-world spoofing environments. For instance, how frequently does the induced-multipath scenario occur? What are the effects of loop non-linearity and chaotic behavior? Can the system bifurcate toward other SE, and how often does this happen? Moreover, how does receiver implementation influence these outcomes?
To address these questions, future works will delve deeper into closed-loop model analysis to characterize the probability of bifurcations between different SE and consider alternative receiver architectures and implementations, e.g., other types of discriminators, GNSS modulations, longer integration times, or systems incorporating frequency lock loops (FLLs). Finally, leveraging these results would enable enhancements to existing detection and mitigation techniques by exploring practical implementations or identifying patterns in the code and phase pseudoranges.

REFERENCES

Bamberg, T., Appel, M. M., & Meurer, M. (2018). Which GNSS tracking loop configuration is most robust against spoofing? *Proceedings of the 31st International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2018)*, 3587–3595. https://doi.org/10.33012/2018.15912

Bamberg, T., Konoaltsev, A., & Meurer, M. (2022). Developing a spoofer error envelope for tracking GNSS signals. *NAVIGATION: Journal of the Institute of Navigation*, 69(3). https://doi.org/10.33012/navi.534

Betz, J. W., & Kolodziejski, K. R. (2009). Generalized theory of code tracking with an early-late discriminator part II: Noncoherent processing and numerical results. *IEEE Transactions on Aerospace and Electronic Systems*, 45(4), 1557–1564. https://doi.org/10.1109/TAES.2009.5310317

Demir, M. Ö., Kurt, G. K., & Pusane, A. E. (2023). A pseudorange-based GPS spoofing detection using hyperbola equations. *IEEE Transactions on Vehicular Technology*, 72(8), 10770–10783. https://doi.org/10.1109/TVT.2023.3257228

El Bouch, S., Galy, J., Chaumette, E., & Vilà-Valls, J. (2024). A modified Cramér-Rao bound for discrete-time Markovian dynamic systems. *ICASSP 2024 - 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)*, 9706–9710. https://doi.org/10.1109/ICASSP48485.2024.10446252

Fernández-Hernández, I., Walter, T., Alexander, K., Clark, B., Châtre, E., Hegarty, C., Appel, M., & Meurer, M. (2019). Increasing international civil aviation resilience: A proposal for nomenclature, categorization and treatment of new interference threats. *Proceedings of the 2019 International Technical Meeting of The Institute of Navigation*, 389–407. https://doi.org/10.33012/2019.16699

Gao, Y., & Li, G. (2023). A new asynchronous traction signal spoofing algorithm for PLL-assisted DLL receiver. *GPS Solutions*, 27(3), 141. https://doi.org/10.1007/s10291-023-01478-6

Gardner, F. M. (2005). *Phaselock techniques*. John Wiley & Sons. https://doi.org/10.1002/0471732699

Ghizzo, E., Djelloul, E.-M., Lesouple, J., Milner, C., & Macabiau, C. (2025). Assessing jamming and spoofing impacts on GNSS receivers: Automatic gain control (AGC). *Signal Processing*, 228, 109762. https://doi.org/10.1016/j.sigpro.2024.109762

Ghizzo, E., Pena, A. G., Lesouple, J., Milner, C., & Macabiau, C. (2024). Assessing GNSS carrier-tonoise-density ratio estimation in the presence of meaconer interference. *ICASSP 2024 - 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)*, 8971–8975. https://doi.org/10.1109/ICASSP48485.2024.10448170

Gupta, S. C. (1975). Phase-locked loops. *Proceedings of the IEEE*, 63(2), 291–306. https://doi.org/10.1109/PROC.1975.9735

Hussong, M., Ghizzo, E., Milner, C., Garcia-Pena, A., Lesouple, J., & Macabiau, C. (2023). Impact of meaconers on aircraft GNSS receivers during approaches. *Proceedings of the 36th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2023)*, 856–880. https://doi.org/10.33012/2023.19423

Julien, O. (2005). *Design of Galileo L1F receiver tracking loops* [Doctoral dissertation, University of Calgary]. https://www.ucalgary.ca/engo_webdocs/GL/05.20227.OJulien.pdf

Kaplan, E. D., & Hegarty, C. (2017). *Understanding GPS/GNSS: Principles and applications*. Artech house. https://us.artechhouse.com/Understanding-GPSGNSS-Principles-and-Applications-Third-Edition-P1871.aspx

Kerns, A. J., Shepard, D. P., Bhatti, J. A., & Humphreys, T. E. (2014). Unmanned aircraft capture and control via GPS spoofing. *Journal of Field Robotics*, 31(4), 617–636. https://doi.org/10.1002/rob.21513

Kim, T.-H., Sin, C. S., & Lee, S. (2012). Analysis of effect of spoofing signal in GPS receiver. *2012 12th International Conference on Control, Automation and Systems*, 2083–2087. https://ieeexplore.ieee.org/document/6393229

Leonov, G., Kuznetsov, N., Yuldashev, M., & Yuldashev, R. (2015). Nonlinear dynamical model of Costas loop and an approach to the analysis of its stability in the large. *Signal Processing*, 108, 124–135. https://doi.org/10.1016/j.sigpro.2014.08.033

Leonov, G., & Kuznetsov, N. (2014). *Nonlinear mathematical models of phase-locked loops. stability and oscillations*. Cambridge Scientific Press. https://cambridgescientificpublishers.com/product/volume-seven-nonlinear-mathematical-models-of-phase-locked-loops

Leonov, G. A., Kuznetsov, N. V., Yuldashev, M. V., & Yuldashev, R. V. (2015). Hold-in, pull-in, and lock-in ranges of PLL circuits: Rigorous mathematical definitions and limitations of classical theory. *IEEE Transactions on Circuits and Systems I: Regular Papers*, 62(10), 2454–2464. https://doi.org/10.1109/TCSI.2015.2476295
Ma, C., Yang, J., Chen, J., Qu, Z., & Zhou, C. (2020). Effects of a navigation spoofing signal on a receiver loop and a UAV spoofing approach. *GPS Solutions*, 24(3), 76. https://doi.org/10.1007/s10291-020-00986-z

Monteiro, L. H., Lisboa, A., & Eisencraft, M. (2009). Route to chaos in a third-order phase-locked loop network. *Signal Processing*, 89(8), 1678–1682. https://doi.org/10.1016/j sigpro.2009.03.006

Peng, C., Li, H., & Lu, M. (2019). Research on the responses of GNSS Tracking loop to intermediate spoofing. *Proceedings of the 32nd International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2019)*, 943–952. https://doi.org/10.33012/2019.16987

Psiaki, M. L., & Humphreys, T. E. (2016). GNSS spoofing and detection. *Proceedings of the IEEE*, 104(6), 1258–1270. https://doi.org/10.1109/JPROC.2016.2526658

Radin, D., Swaszek, P. F., Seals, K. C., & Hartnett, R. J. (2015). GNSS spoof detection based on pseudoranges from multiple receivers. *Proceedings of the 2015 International Technical Meeting of The Institute of Navigation*, 657–671. https://www.ion.org/publications/abstract.cfm?articleID=12658

Spens, N., Lee, D.-K., Nedelkov, F., & Akos, D. (2022). Detecting GNSS jamming and spoofing on Android devices. *NAVIGATION: Journal of the Institute of Navigation*, 69(3), 537–552. https://doi.org/10.33012/navi.537

Spilker Jr, J. J., Axelrad, P., Parkinson, B. W., & Enge, P. (1996). *Global Positioning System: Theory and applications, volume I*. American Institute of Aeronautics; Astronautics. https://doi.org/10.2514/4.866388

Stenberg, N., Axell, E., Rantakokko, J., & Hendeby, G. (2020). GNSS spoofing mitigation using multiple receivers. *2020 IEEE/ION Position, Location and Navigation Symposium (PLANS)*, 555–565. https://doi.org/10.1109/PLANS46316.2020.9109958

Stephens, S., & Thomas, J. (1995). Controlled-root formulation for digital phase-locked loops. *IEEE Transactions on Aerospace and Electronic Systems*, 31(1), 78–95. https://doi.org/10.1109/7.366295

Tao, H., Wu, H., Li, H., & Lu, M. (2019). GNSS spoofing detection based on consistency check of velocities. *Chinese Journal of Electronics*, 28(2), 437–444. https://doi.org/10.1049/cje.2019.01.006

Teunissen, P. J., & Montenbruck, O. (2017). *Springer handbook of global navigation satellite systems* (Vol. 10). Springer. https://doi.org/10.1007/978-3-319-42928-1

Van Nee, R. D. (1996). *Multipath and multi-transmitter interference in spread spectrum communication and navigation systems* [Doctoral dissertation, Delft University of Technology, Faculty of Electrical Engineering, Mathematics and Computer Science]. https://scispace.com/pdf/multipath-and-multi-transmitter-interference-in-spread-5fvdsmh9fo.pdf

Wang, Y., Kou, Y., & Huang, Z. (2023). Necessary condition for the success of synchronous GNSS spoofing. *Chinese Journal of Electronics*, 32(3), 438–452. https://doi.org/10.23919/cje.2021.00.307

Yang, R., Ling, K.-V., Poh, E.-K., & Morton, Y. (2017). Generalized GNSS signal carrier tracking: Part I — modeling and analysis. *IEEE Transactions on Aerospace and Electronic Systems*, 53(4), 1781–1797. https://doi.org/10.1109/TAES.2017.2673998

A | APPENDIX-DERIVATION OF SYSTEM SE

This appendix derives the expression for the system SE in (29). First, by applying the conditions (26) and (28) to (24), we obtain

$$ \kappa_{0,\tau} d_{\tau} (\varepsilon_{\eta,eq}^{l} - \Delta\eta_{eq}, \Delta\nu) = \delta^{(N_{\tau})} \tau_{ca}, \quad \kappa_{0,\theta} d_{\theta} (\varepsilon_{\eta,eq}^{l} - \Delta\eta_{eq}, \Delta\nu) = \delta^{(N_{\theta})} \theta_{eq}. \qquad (51) $$

In addition, the conditions (27) applied to (24) add the two constraints

$$ \frac{\partial d_{\tau} (\varepsilon_{\eta,eq}^{l} - \Delta\eta_{eq}, \Delta\nu)}{\partial \varepsilon_{\tau,eq}} > 0, \quad \frac{\partial d_{\theta} (\varepsilon_{\eta,eq}^{l} - \Delta\eta_{eq}, \Delta\nu)}{\partial \varepsilon_{\theta,eq}} > 0 \qquad (52) $$

leading to

$$ \left\{ \begin{array}{l} d_{\tau} (\varepsilon_{\eta,eq}^{l} - \Delta\eta_{eq}, \Delta\nu) = \frac{\delta^{(N_{\tau})} \tau_{ca}}{\kappa_{0,\tau}} = k_{\tau}, \quad d_{\theta} (\varepsilon_{\eta,eq}^{l} - \Delta\eta_{eq}, \Delta\nu) = \frac{\delta^{(N_{\theta})} \theta_{eq}}{\kappa_{0,\theta}} = k_{\theta}, \\ \\ \frac{\partial d_{\tau} (\varepsilon_{\eta,eq}^{l} - \Delta\eta_{eq}, \Delta\nu)}{\partial \varepsilon_{\tau,eq}} > 0, \quad \frac{\partial d_{\theta} (\varepsilon_{\eta,eq}^{l} - \Delta\eta_{eq}, \Delta\nu)}{\partial \varepsilon_{\theta,eq}} > 0 \end{array} \right. . \qquad (53) $$

This system consists of three unknowns: $\varepsilon_{\eta,eq}^l$ and two equations (with two constraints). For the sake of clarity, let us replace $\varepsilon_{\eta,eq}^l - \Delta\eta_{eq}$ with $\eta$. To resolve (53), we propose a third equation based on the state filter condition (28) for $n = 1$, expressed as $\delta d_{\theta}(\eta)$. It is worth noting that the set of solutions to this condition alone is larger than the set of solutions obtained when it is
combined with (53). We propose an alternative condition function that reduces the set of solutions and is simpler to resolve, considering

$$ \left\{ \begin{array}{l} \delta d_{\theta}(\eta) = d_{\theta}(\eta[k], \Delta\nu[k]) - d_{\theta}(\eta[k-1], \Delta\nu[k-1]) = 0, \\ d_{\theta}(\eta, \Delta\nu) = k_{\theta}. \end{array} \right. \qquad (54) $$

By substituting the expression of $d_{\theta}$ from (11) and denoting $\theta = \arg\{\Lambda_P(\eta, \Delta\nu)\}$ (for the sake of clarity), we have

$$ \arctan(\tan(\theta[k])) - \arctan(\tan(\theta[k-1])) = 0, \quad \tan(\theta[k]) = \tan(k_{\theta}), \qquad (55) $$

additionally, we have $\tan(\theta[k]) \tan(\theta[k-1]) = \tan(k_{\theta})^2 \ge 0 > -1$, thus

$$ \arctan\left(\frac{\tan(\theta[k]) - \tan(\theta[k-1])}{1 + \tan(\theta[k]) \tan(\theta[k-1])}\right) = 0, \quad \tan(\theta[k]) = \tan(k_{\theta}) \qquad (56) $$

and then as $\tan(\theta[k]) = \tan(k_{\theta}) < \infty$

$$ \arctan\left(\frac{1 + \tan(\theta[k]) \tan(\theta[k-1])}{1 + \tan(\theta[k]) \tan(\theta[k-1])} \tan(\theta[k] - \theta[k-1])\right) = 0, \qquad (57) $$

then,

$$ 2\pi T_i \chi_f (\varepsilon_{\eta}, \Delta\nu) = \theta[k] - \theta[k-1] \pmod{\pi, \frac{\pi}{2}} = 0. \qquad (58) $$

Therefore, by formulating the third constraint through the application of the stability condition (27) to the frequency closed-loop model (19), the system's SE can be expressed as (29).

The expressions (56) and (57) are derived from the trigonometric identities

$$ \forall x, y \text{ such that } xy > -1, \quad \arctan x - \arctan y = \arctan\left(\frac{x-y}{1+xy}\right), \qquad (59) $$

and

$$ \forall a, b \text{ such that } \tan a \tan b \neq -1, \quad \tan(a-b) = \frac{\tan a - \tan b}{1 + \tan a \tan b} \qquad (60) $$

respectively. The conditions for both equations are satisfied due to the second equation in (54): $\tan(\theta[k]) \tan(\theta[k-1]) = \tan(k_{\theta})^2 \ge 0 > -1$.

## B | APPENDIX-GENERALIZED HALF-ANGLE FORMULA DERIVATION

Let $z_1 = \rho_1 e^{j\theta_1}$ and $z_2 = \rho_2 e^{j\theta_2}$ be two complex numbers, where $\rho_1$ and $\rho_2$ are positive. This appendix derives the argument of the sum $z = z_1 + z_2$. To begin, we express $z$ as

$$ z = z' \exp\left(\frac{\ln \rho_1 + \ln \rho_2}{2}\right) \exp\left(j \frac{\theta_1 + \theta_2}{2}\right) \qquad (61) $$

with $z'$ defined as

$$ z' = \exp(\Delta\rho + j\Delta\theta) + \exp(-\Delta\rho - j\Delta\theta) \qquad (62) $$

and $\Delta\rho = (\ln \rho_1 - \ln \rho_2)/2$ and $\Delta\theta = (\theta_1 - \theta_2)/2$. Alternatively,

$$ z' = 2 \cosh(\Delta\rho) \cos(\Delta\theta) + 2j \sinh(\Delta\rho) \sin(\Delta\theta) \qquad (63) $$

$$ = 2 \cosh(\Delta\rho) \cos(\Delta\theta) (1 + j \tanh(\Delta\rho) \tan \Delta\theta) \qquad (64) $$

If $\cos(\Delta\theta) = 0$, $z'$ becomes purely imaginary. In this case, the argument of $z'$ is either $\pi/2$ or $-\pi/2$, depending on the sign of $\Delta\rho$. Otherwise,

$$ \arg\{z\} = \frac{\theta_1 + \theta_2}{2} + \arctan\left(\frac{\rho_1 - \rho_2}{\rho_1 + \rho_2} \tan \Delta\theta\right). \qquad (65) $$
## C | APPENDIX-SIMULATOR ARCHITECTURE

The SDR tracking loops are depicted in Fig. 17, incorporating a first-order digital DLL and a third-order PLL. These loops include correlators, a discriminator, a low-pass filter, and an NCO. Additionally, a carrier-aiding operation is implemented to mitigate the DLL stress error. The loops provide the estimates $\hat{\eta}[k]$. The filter coefficients are computed as described in (Stephens & Thomas, 1995), and the initial filter state is set to zero for all scenarios.

The received signal is generated at the correlator output following the model in (6). The input dynamics, $\eta_a[k-1]$ and $\eta_s[k-1]$, are generated as described in Appendix D, while the estimate $\hat{\eta}[k-1]$ is obtained from the loop output in the previous epoch. Finally, the simulator generates a combination of authentic and re-radiated Gaussian noise at the correlator outputs. The specific method used to generate the correlated noise between Early, Late, and Prompt outputs is detailed in (Julien, 2005).

<figure><img src="image_19.png" /><figcaption>FIGURE 17 Architecture of the implemented SDR tracking loops.</figcaption></figure>

## D | APPENDIX-SIMULATION GENERATED DYNAMICS

This Appendix describes the generation of the dynamics $\eta_a$ and $\eta_s$. First, the authentic dynamic $\eta_a$ is generated identically across all scenarios to simulate realistic high dynamics without introducing stress error ($\delta\eta_a^{(3)} = 0$), such that

$$ \tau_a(t) = \tau_{a,2} t^2 + \tau_{a,1} t, \quad \theta_a(t) = -\beta (\tau_{a,2} t^2 + \tau_{a,1} t), \quad f_a(t) = -\frac{\beta}{2\pi} (2\tau_{a,2} t + \tau_{a,1}) \quad (66) $$

with $\tau_{a,1} = 6.35 \times 10^{-7}$ and $\tau_{a,2} = 1.27 \times 10^{-10} \text{ s}^{-1}$. The authentic noise is generated to have a $C/N_0 = 45 \text{ dB} \cdot \text{Hz}$. The relative dynamic $\Delta\eta$ is generated based on the scenario-specific conditions outlined in (Hussong et al., 2023).

### Jamming and spoofing scenarios:

In the jamming and spoofing scenarios, to exclude interference between the authentic and spoofing components, the relative parameters $\Delta\eta$ must satisfy the condition $\Delta\tau > T_c + c_\tau/2$ (see Hussong et al., 2023). The relative dynamic $\Delta\eta$ is therefore generated for $t \in [0, 250] \text{ s}$ as

$$ \Delta\tau^{(J/S)}(t) = \tau_0^{(J/S)} + \tau_1^{(J/S)} (t - \tau^{(J/S)})^2, \quad \Delta\theta^{(J/S)}(t) = -\beta\Delta\tau^{(J/S)}(t), \quad \Delta f^{(J/S)}(t) = -\frac{1}{2\pi} \frac{d\Delta\theta^{(J/S)}}{dt} \quad (67) $$

with $\tau_0^{(J/S)} = 1.33 \times 10^{-6}$, $\tau_1^{(J/S)} = 8.34 \times 10^{-12} \text{ s}^{-1}$, and $\tau^{(J/S)} = 125 \text{ s}$. The relative power is generated as constant, such that $\Delta g(t) = 0.64$. The re-radiated noise is generated with a PSD amplified equally to the GNSS signal ($\Delta g(t) = 0.64$).
Multipath scenario:

In the multipath scenario, the relative dynamic $\Delta\eta$ is generated for $t \in [0, 400]$ s to satisfy the condition $\Delta\tau < T_c + c_\tau/2$ (see Hussong et al., 2023) as

$$ \Delta\tau^{(M)}(t) = \tau_0^{(M)} + \tau_1^{(M)} t^4, \quad \Delta\theta^{(M)}(t) = -\beta\Delta\tau^{(M)}(t), \quad \Delta f^{(M)}(t) = -\frac{1}{2\pi} \frac{d\Delta\theta^{(M)}}{dt}, \qquad (68) $$

with $\tau_0^{(M)} = 1.34 \times 10^{-7}$ and $\tau_1^{(M)} = 1.02 \times 10^{-17}$ s$^{-3}$. The relative power, as well as the relative PSD between authentic and re-radiated noise are constant and equal to 0.64.