# GNSS performance degradation under meaconing in civil aviation: pseudorange and position models

Mathieu Hussong, Emile Ghizzo, Carl Milner, Axel Garcia-Pena

► To cite this version:

Mathieu Hussong, Emile Ghizzo, Carl Milner, Axel Garcia-Pena. GNSS performance degradation under meaconing in civil aviation: pseudorange and position models. GPS Solutions, 2025, 29 (3), pp.93. 10.1007/s10291-024-01804-6. hal-05386863

HAL Id: hal-05386863

https://enac.hal.science/hal-05386863v1

Submitted on 28 Nov 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# GNSS performance degradation under meaconing in civil aviation: pseudorange and position models

Mathieu Hussong<fnref n="1" /> Ⓔ · Emile Ghizzo<fnref n="1" /> Ⓔ · Carl Milner<fnref n="1" /> Ⓔ · Axel Garcia-Pena<fnref n="1" /> Ⓔ

Received: 10 October 2024 / Accepted: 5 December 2024 / Published online: 11 April 2025
© The Author(s) 2025

## Abstract

With the escalating prevalence of in-band interference, the vulnerability of Global Navigation Satellite System (GNSS) receivers to potential jamming or spoofing threats has become a critical concern. The proliferation of GNSS repeaters, commonly known as meaconers (electronic devices that intercept GNSS signals, amplify them, and subsequently rebroadcast them) contributes to this threat landscape, by compromising GNSS accuracy, availability, continuity, and integrity. Specifically, the performance of standardized aviation receivers might be degraded when exposed to meaconing interference, causing critical yet unknown safety issues. This study assesses the robustness against meaconing, by evaluating the behavior of the checks performed by a certified aviation receiver. Firstly, the precise mathematical models of the GNSS observables (code, phase, smoothed pseudoranges, and carrier-to-noise density ratio $C/N_0$) are derived under meaconing interference. Secondly, this study evaluates the robustness of the aviation consistency tests performed on the pseudoranges in the presence of meaconing. Thirdly, this paper classifies the meaconer impacts at the position level, to analyze in each situation the robustness brought by the fault detection test. Finally, the effects of meaconing on the accuracy, the availability, and the integrity of the estimated positions are presented for each situation. It is shown that a meaconer deteriorates the accuracy and availability, and marginally increases the probability of misleading position information. This comprehensive analysis contributes to better understand the risks associated with meaconing signals and paves the path to a global assessment of the meaconer impact during an approach phase of flight, integrating piloting considerations.

**Keywords** Accuracy · Availability · Aviation · Integrity · Meaconer · Spoofing

## Introduction

Global Navigation Satellite Systems (GNSS) face increasing threats from jamming and spoofing (ITU 2001, 2016; Pena et al. 2020). The complexity of this threat environment grows due to the proliferation of GNSS repeaters, also called meaconers, which function by capturing GNSS signals, amplifying them, and retransmitting them to receivers within

their range. Indeed, the potential danger caused by meaconers has been well established by (Coulon et al. 2020; Steindl et al. 2013), acknowledging degradations of the GNSS performance under meaconing interference. Moreover, GNSS outages due to meaconing interference are slowly becoming commonplace in the aviation domain (Forbes 2024) whilst civil aircrafts rely heavily on GNSS for navigation, approach, and landing procedures. The complete assessment of the meaconing impact on standardized airborne GNSS receivers arises as a major priority for ICAO (ICAO Annex 17) since it might degrade the integrity, accuracy, continuity, and availability of the GNSS solution as stated in (Berz 2018), which highlighted that aircraft GNSS receivers might be prone to safety risks in the vicinity of such meaconers.

The literature has studied the impact of meaconers on GNSS receivers, both in static cases (Bamberg et al. 2018; 2022; Peng et al. 2019) and dynamic cases (Coulon et al. 2020; Hussong et al. 2023). These studies reveal that the meaconer presence can adversely affect tracking loop

<footnote>✉ Mathieu Hussong
mathieu.hussong@gmail.com</footnote>

<footnote>Emile Ghizzo
emile.ghizzo@enac.fr</footnote>

<footnote>Carl Milner
milner@recherche.enac.fr</footnote>

<footnote>Axel Garcia-Pena
axgarcia@recherche.enac.fr</footnote>

<footnote n="1">¹ French Civil Aviation University (ENAC), Toulouse, France</footnote>
performance, pseudorange estimation, and position deter-
mination under specific geometrical and power conditions.
The resulting effects at the correlator output have been pre-
viously categorized by the authors of this paper as spoofing
(where tracking loops follow meaconer signals), jamming
(where meaconer signals degrade tracking performance by
increasing the effective thermal noise and can even cause
loss of lock), or multipath-like errors (where meaconer sig-
nals distort the nominal behavior of the GNSS receiver as
if it was exposed to a multipath). These effects transpose
into the pseudorange and position domains depending on
the receiver processing techniques.

To the authors' knowledge, the impact of a ground mea-
coner on a GNSS receiver for dynamic cases respecting avia-
tion standards and processing techniques (ED259 REV.A
2023; DO 229E 2016) have only been analyzed in (Hussong
et al. 2023), but mainly through simulations; the mathemati-
cal models of the GNSS performance degradations have not
yet been investigated under meaconing interference. Indeed,
the complexity of the tracking loops and pseudorange check
procedures complicate the mathematical derivation of the
pseudorange and position models under meaconing interfer-
ence in civil aviation. Therefore, the lack of mathematical
description of the potential threat of a ground meaconer on
the aircraft GNSS receiver performance (availability, accu-
racy, and integrity) has motivated this study.

Therefore, to ensure civil aviation safety, a step in the
right direction would be the mathematical characterization
of the meaconer effects and the identification of ground risk
zones where a meaconer would degrade the GNSS airborne
receiver performance beyond civil aviation requirements.

This study contributes to filling the gap in the literature
of the meaconing impact on civil aviation GNSS receivers.
Indeed, the manuscripts aims to quantify the degradation of
positioning performance brought by Global Positioning Sys-
tem (GPS) L1 C/A under meaconing interference in civil avia-
tion, considering the standardized processing techniques and
tests described in aviation standards (ED259 REV.A 2023;
DO 229E 2016). The standardized procedure, however, are not
considered in this work. The quantification of the performance
is based on three metrics representing the GNSS availability,
accuracy, and integrity, which are defined then evaluated to
assess the impact of meaconing on the GNSS performance of
the aircraft's navigation solutions.

To achieve the manuscript objective, the methodology of
this paper consists of modeling the impact of meaconing at
different levels of the GPS L1 C/A observables, progressing
to the position level. This begins with the correlator output
level, followed by the pseudorange level, and concludes at the
position level. At each stage, the impact is categorized into
different situations based on the characteristics of the meacon-
ing signals, with their corresponding mathematical models.
This methodology offers several key advantages. It provides a

systematic approach to assessing GNSS observables and ena-
bles the isolation of the meaconing impact on each component
of a certified aircraft's receiver (such as carrier-smoothing,
consistency checks, fault detection procedures, or protection
level derivations). Additionally, this methodology provides
tailored mathematical models for each observable and sys-
tem block. The classification of the meaconing situations with
flow charts also simplifies the understanding of the meaconing
impact and their cascading effects on the aircraft's receiver.
Finally, the three metrics (GNSS availability, accuracy, and
integrity) ensure a precise and robust analysis of the meacon-
ing threat.

The contributions of this work include an in-depth analy-
sis of the robustness of standardized consistency checks,
fault detection procedures, and protection level computations
against meaconing interference in civil aviation. Additionally,
it lays the groundwork for evaluating navigation solution per-
formance in certified civil aviation GNSS receivers.

This article is organized as follows: the first section details the architecture of a standardized airborne GNSS receiver, along with the nominal models of the GNSS observables. The second section defines a meaconer and its different impacts on the correlator outputs. The third section deeply describes the methodology of the study. The fourth section presents the precise pseudorange and position models at a given epoch under meaconing interference, in compliance with aviation standards and processing techniques. The fifth section shows the impact of the meaconing interference on the estimated GNSS position. Finally, the sixth section employs these derivations to assess the degradations of the GNSS performance when exposed to a meaconer.

Airborne GNSS receiver

This section presents the nominal mathematical models of
the GPS L1 C/A pseudoranges and of the estimated position
for a standardized airborne GNSS receiver obtained from
these pseudoranges only. The architecture of the measure-
ment processing blocks of a standardized airborne GNSS
receiver is also explained, to allow the analysis of the impact
of a meaconer broadcasting back L1 signals on each process-
ing block of the aircraft receiver.

Pseudorange models without meaconing
interference

Using the models of (Kaplan et al. 2017), the estimated code
$\hat{\rho}$ and phase $\hat{\phi}$ pseudorange models can be represented with-
out meaconing interference as:

<figure><img src="image_2.png" /></figure>
$$ \hat{\rho}_i[\kappa] = \rho_i[\kappa] + \epsilon_i[\kappa] \quad (1) $$

$$ \hat{\phi}_i[\kappa] = \phi_i[\kappa] + \epsilon_{\phi,i}[\kappa] \quad (2) $$

where $\kappa$ denotes the epoch (the index of the sample since the last transition from acquisition to tracking) at which the measurements are generated. In this paper, the subscript $i$ refers to the satellite vehicle number, and $\rho$ and $\phi$ respectively represent the code and phase ideal pseudoranges, that are corrupted by the code $\epsilon$ and phase $\epsilon_\phi$ estimation errors. They are defined by (Kaplan et al. 2017) as:

$$ \rho_i[\kappa] = d_{SA,i}[\kappa] + c\delta t_r[\kappa] - c\delta t_i[\kappa] + T_i[\kappa] + I_i[\kappa] \quad (3) $$

$$ \phi_i[\kappa] = d_{SA,i}[\kappa] + c\delta t_r[\kappa] - c\delta t_i[\kappa] + T_i[\kappa] - I_i[\kappa] $$

$$ \epsilon_i[\kappa] = \epsilon_i^{DLL}[\kappa] \text{ with } \epsilon_i^{DLL}[\kappa] = M_i[\kappa] + n_i[\kappa] $$

$$ \epsilon_{\phi,i}[\kappa] = \epsilon_{\phi,i}^{PLL}[\kappa] \text{ with } \epsilon_{\phi,i}^{PLL}[\kappa] = m_i[\kappa] + \lambda N_i[\kappa] + n_{\phi,i}[\kappa] $$

$c$ is the speed of light, $\delta t$ is the satellite clock offset, $\delta t_r$ is the receiver clock offset, $T_i$ is the tropospheric delay, and $I_i$ is the ionospheric delay. $M_i$ (resp. $m_i$) is the code (resp. phase) multipath tracking loop estimation error, $\lambda N_i$ is the carrier phase tracking loop integer ambiguity term, and $n_i$ (resp. $n_{\phi,i}$) represents code (resp. phase) thermal noise tracking loop estimation errors. Note that the receiver antenna code and phase biases are omitted in this study, as well as the Delay-Locked Loop (DLL) and Phase-Locked Loop (PLL) estimation errors due to the signal dynamics. The tracking loop estimation errors due to the oscillator phase noise and vibrations would be modelled inside $n_\phi$ but are also omitted in this work.

The DLL and PLL noise errors, $n_i$ and $n_{\phi,i}$, are modeled as independent Gauss-Markov (GM) processes, because the tracking loops inherently introduce temporal correlation in the measurements (due to the equivalent loop filter). The GM processes are characterized by their respective correlation times $\tau_n$ and $\tau_{\phi,n}$, and their standard deviations $\sigma_{DLL}$ and $\sigma_{PLL}$. In this paper, $\sigma_{DLL}$ and $\sigma_{PLL}$ are given as a function of the effective $C/N_0$ (denoted $C/N_{0,eff}$) by (Kaplan et al. 2017):

$$ \sigma_{DLL}(C/N_{0,eff}) = c \sqrt{\frac{B_{DLL}}{4\pi^2 C/N_{0,eff} \int_{-B/2}^{B/2} f^2 S(f) df}} \left(1 + \frac{1}{T_i C/N_{0,eff} \int_{-B/2}^{B/2} S(f) df}\right), \quad (4) $$

$$ \sigma_{PLL}(C/N_{0,eff}) = \frac{\lambda_1}{2\pi} \sqrt{\frac{B_{PLL}}{C/N_{0,eff}} \left(1 + \frac{1}{2T_i C/N_{0,eff}}\right)}, \quad (5) $$

where $B_{DLL}$ and $B_{PLL}$ are the DLL and PLL equivalent filter noise bandwidths, $B$ is the radio-frequency front-end bandwidth, $S$ is the normalized PSD of the received signal, $\lambda_1$ is the wavelength of the GPS L1 C/A signal, and $T_i$ is the integration time.

General blocks scheme of a standardized airborne measurement processing.

The flow diagram of the GNSS reception chain and measurement processing is summarized in Fig. 1. This flow diagram has been derived by the authors from the Minimum Operational Performance Standards (MOPS) in (DO229E, ED259Rev.A) documents. The content of the blocks of Fig. 1 also comply with the MOPS, and their definitions are given in the next subsections, along with the corresponding MOPS sections presenting the block contents and models. The different pseudoranges are first smoothed (carrier smoothing) and enter three pseudorange approval test blocks (C/N₀ threshold, CMC test and Step detector) that accept or exclude the smoothed pseudoranges for the position estimation (inside WLSE); accepted pseudoranges measurements are also called usable. Finally, if a position can be estimated, the protection levels are computed, and a fault detection (FD) block verifies the consistency of the estimated position. The estimated position can be used for navigation if the FD block provides a successful verification (note that this block does not use the estimated position but rather some intermediate matrices W and residuals of the WLSE block).

## Carrier smoothing

Before they are employed in the Weighted Least Square position Estimation (WLSE), the code pseudoranges are smoothed using the phase measurements (DO229E Sect. 2.1.4.1.1; Hwang et al. 1999). Aviation standards impose the use of carrier smoothing to reduce the impact of multipath and thermal noise in the code pseudorange by utilizing phase pseudorange data, resulting in a smoothed pseudorange that is both less error-prone and free of ambiguity compared to the raw code pseudorange (Geng et al. 2019).

$$ \left\{ \begin{array}{l} \tilde{\rho}_i[\kappa] = \frac{1}{\Gamma} \hat{\rho}_i[\kappa] + \frac{\Gamma-1}{\Gamma} (\tilde{\rho}_i[\kappa-1] + \hat{\phi}_i[\kappa] - \hat{\phi}_i[\kappa-1]) \quad \text{if } \kappa \ge 1 \\ \tilde{\rho}_i[\kappa] = \hat{\rho}_i[\kappa] \quad \text{if } \kappa = 0 \end{array} \right. \quad (6) $$

In this paper, the diacritic ~ refers to a carrier smoothed value. The smoothed pseudorange $\tilde{\rho}_i[\kappa]$ for signal $i$ at epoch $\kappa$ is calculated using the code pseudorange $\hat{\rho}_i$ at epoch $\kappa$, the smoothed pseudorange $\tilde{\rho}_i$ at previous epoch ($\kappa - 1$), and the phase measurements $\hat{\phi}_i$ at both previous ($\kappa - 1$) and current ($\kappa$) epochs when they are available. Otherwise, the smoothed pseudorange value is (re)-initialized using the current code pseudorange value. To comply with civil aviation standards (ED259 rev. A), $\Gamma = 100f_s$ where $f_s$ is the sampling frequency
<figure><img src="image_3.png" /><figcaption>Fig. 1 Architecture of the measurement processing blocks of a standardized aviation receiver</figcaption></figure>

(in Hz) of pseudorange generation, achieving a smoothing effect with an exponential decay of characteristic time 100 s.

The effect of carrier smoothing on the different error terms are derived in the electronic supplement based on simplifications commonly used in civil aviation contexts. These derivations provide the model of the smoothed pseudorange for signal i at epoch κ:

$$ \tilde{\rho}_i[\kappa] = d_i[\kappa] - c\delta t_i[\kappa] + c\delta t_r[\kappa] + T_i[\kappa] + \tilde{I}_i[\kappa] + \tilde{M}_i[\kappa] + \tilde{n}_i[\kappa] \quad (7) $$

With

$$ \tilde{I}_i[\kappa] = I_i[\kappa] - 2I_d(\Gamma - 1) + o(1) \quad (8) $$

$$ \tilde{M}_i[\kappa, \theta] \sim GM(\Gamma; \tilde{\sigma}_{mp}^2(\theta)) \quad \text{with} \quad \tilde{\sigma}_{mp}(\theta) = 0.13 + 0.53e^{-\theta/10}(\text{m}) \quad (9) $$

$$ \tilde{n}_i[\kappa] \sim GM(\Gamma; \tilde{\sigma}_n^2) \quad \text{with} \quad \tilde{\sigma}_n^2 \underset{\kappa \to \infty}{\approx} \sigma_{PLL}^2 \left( 2 + \frac{\sigma_{DLL}/\sigma_{PLL}}{(\Gamma - 1)^2} \right) \quad (10) $$

o(1) is a function that rapidly goes to zero when κ increases. $I_d$ is the ionospheric divergence (in m/s), and θ is the elevation angle of the satellite (in degrees).

### C/N₀ threshold

The GNSS receiver should not use a measurement for positioning when its estimated carrier-to-noise ratio (denoted as $\tilde{C}/N_0$), drops below 30 dB.Hz (ED259 rev.A section DMS:023). If so, the signal is still tracked but does not feed

the WLSE algorithm. The $C/N_0$ threshold removes the pseudorange of signal i at epoch κ if

$$ \tilde{C}/\tilde{N}_{0,i}[\kappa] < 30 \text{dB.Hz} \quad (11) $$

### Measurement quality monitoring (CMC test)

A quality test (sometimes known as the Code Minus Carrier—CMC test) is performed on the measurements before being used by the WLSE. This test is defined by (ED259 rev.A Sect. 3.1.1.6.1.2) and originally aims at detecting any carrier slip of the phase measurements, that could bias the smoothed pseudoranges and induce wrong position estimations. A pseudocode of the CMC procedure is available in the electronic supplement. The CMC test removes the pseudorange from signal i at epoch κ if

$$ |\tilde{\rho}_i[\kappa] - \hat{\rho}_i[\kappa]| > 10m \quad (12) $$

### Step detector

In compliance with (ED259 rev.A Sect. 3.1.1.9.1), the airborne GNSS receiver shall be able to detect and exclude any pseudorange step larger than 700 m used in the position solution. A pseudocode of the step detector procedure is available in the electronic supplement. This block is much less effective than the FD procedure to detect spoofing (as it is not its primary purpose). Step detector is therefore not presented in this work, and it is supposed to never detect spoofing on its own.
# Position estimation and protection levels

## Position model without meaconing interference

The smoothed pseudoranges feed the iterative linear WLSE defined in (DO229E appendix E). The different pseudorange error terms can be considered separately through the WLSE to model the impact of each smoothed error on the position (Kaplan et al. 2017). The mathematical model of the position is given by:

$$ \hat{x}_{pos}[\kappa] = \tilde{x}[\kappa] + \tilde{\epsilon}_{pos}[\kappa] \\ \tilde{x}[\kappa] = x_a[\kappa] + \delta_t[\kappa] + \delta_T[\kappa] + \tilde{\delta}_I[\kappa] \quad (13) $$

$$ \tilde{\epsilon}_{pos}[\kappa] = \tilde{\delta}_M[\kappa] + \tilde{\delta}_n[\kappa] $$

where $\hat{x}_{pos}$ is the estimated 3D position computed from smoothed pseudoranges, $x_a$ is the true aircraft position, and $\tilde{\epsilon}_{pos}$ is the smoothed position error introduced by the tracking loops. Additionally, $\delta_t$ is the nominal residual satellite clock errors in the position (unaffected by smoothing and the meaconer), $\delta_T$ and $\delta_I$ are the residual position errors due to the tropospheric delay (unaffected by smoothing and the meaconer) and ionospheric delay, $\tilde{\delta}_M$ and $\tilde{\delta}_n$ are the multipath and thermal noise induced deflections in the position domain.

## Fault Detection procedure (FD)

The FD procedure, described in (Parkinson et al. 1988) is built on hypothesis testing of the measurement residuals to detect inconsistencies in the usable measurements. The FD procedure raises an alarm at epoch $\kappa$ if:

$$ q[\kappa] \geq T_q \quad (14) $$

With $q[\kappa] = r^T W r$, $r = (I - G(G^T W G)^{-1} G^T W)^{-1} e$ and $T_q = F_{N_s-4}^{-1}(1 - p_{fa})$.

$e$ contains the differences between the smoothed usable pseudoranges at epoch $\kappa$ and the predicted usable pseudoranges at epoch $\kappa$ (DO 229E 2.1.4.2.2.2.3), $r$ denotes the pseudorange residuals, $W$ and $G$ are the weight and geometry matrices of the WLSE, $N_s$ is the number of usable pseudoranges at epoch $\kappa$, $F_{N_s-4}^{-1}$ represents the inverse cumulative distribution function of the chi-square distribution with $N_s - 4$ degrees of freedom, and $p_{fa}$ is the probability of false alarm.

When only 4 satellites are usable, FD is deemed non-operational, and no FD alarm can be raised. In this case, the position is still estimated and used for navigation despite its unknown integrity. With 5 or more usable satellites, FD can

detect a fault. If no fault is detected, the position is used for navigation, otherwise, a FD alarm is raised. The exclusion of the faulty measurements is not intended, as civil aviation standards do not require it (DO229E Sect. 1.8.2.3).

## Protection levels

Satellite Based Augmentation System (SBAS) integrity is based on the computation of protection levels. The horizontal (HPL) and vertical (VPL) protection levels in SBAS mode are defined in (DO 229E Appendix J) and recapped in the electronic supplement. They monitor the integrity of the position throughout the flight, by comparing the horizontal and vertical alert limits to the respective protection levels, and by raising an alarm if at least one protection level exceeds its alert limit. If an alarm is raised, the position is declared unavailable.

## Meaconer

This section describes the mathematical model of a meaconer from the literature and presents the meaconing impact on the correlator outputs of a standardized aircraft GNSS receiver.

### Meaconer description

A meaconer, also known as a GNSS repeater, is an electronic device designed to capture electromagnetic signals, to amplify them, and to rebroadcast them around a specific GNSS central frequency (Fig. 2). The meaconer is characterized by its gain $G_m$ and intrinsic delay $\tau_m$. In this paper, the meaconer gain $G_m$ is defined as the ratio between the signal power at the meaconer receiving antenna input and the signal power at its emitting antenna output. The meaconer introduces an intrinsic delay $\tau_m$, which signifies the signal group delay between the meaconer receiving antenna input and its emitting antenna output.

The GNSS signals observed and rebroadcast by the meaconer have the same structure as the authentic signals received at the aircraft's GNSS receiver antenna but with different powers (due to the meaconer gain $G_m$, due to the different free space losses of the different signal paths, and due to the antenna gains), time delays (due to the meaconer delay $\tau_m$ and the different signal paths propagation times), frequency offsets (due to the different relative motions between the satellite, the aircraft and the meaconer), and carrier phase offsets (Coulon et al. 2020; Hussong et al. 2023). Moreover, the rebroadcast signal, which includes one or more repeated GNSS signals, also include one, and only one, noise component, called rebroadcast noise. In this paper, the relative parameters $\Delta g$, $\Delta N$, and $\Delta \tau$ between the
<figure><img src="image_4.png" /><figcaption>**Fig. 2** Illustration of the aircraft environment when exposed to a meaconer. $d_{SA}$ represents the Euclidian distance between the satellite and the aircraft, $d_{SM}$ between the satellite and the meaconer and $d_{MA}$ between the meaconer and the aircraft. $d_{SM} + d_{MA}$ represents the propagated distance of the repeated signal. $H$ is the minimum distance between the aircraft ground projection trajectory and the meaconer location. $L$ is the meaconer distance along the runway with respect to the landing point</figcaption></figure>

nominal parameters and the repeated ones can be expressed as follows:

* The relative delay $\Delta\tau$ represents the difference between the propagation time of the repeated signal and the propagation time of the authentic signal at the aircraft antenna output.

* The relative power denoted as $\Delta g$ represents the ratio between the meaconer signal power and the authentic signal power at the aircraft antenna output.

* The relative noise power spectrum density denoted as $\Delta N$ represents the ratio between the thermal noise power spectrum density (PSD) observed at the correlator input without meaconer interference, and the PSD of the thermal noise broadcasted by the meaconer (rebroadcast noise) at the GNSS receiver correlator input.

In the precise context of civil aviation with a meaconer on the ground, the knowledge of these three relative parameters are sufficient to derive the meaconing impact on an aircraft's receiver.

## Meaconer impacts at the correlator output

A classification of the Correlator Output Situations (COS) that can be observed in presence of meaconing interference is shown in Fig. 3. This classification has been built with respect to the meaconing impact at the correlator output,

and segregates the impact of a meaconer into 4 distinct situations. The mathematical models of the situations are detailed in (Hussong et al. 2023) and summarized below for GPS L1 C/A.

In the nominal COS, the receiver is synchronized with the nominal signal parameters, without any significant distortion induced by the meaconer.

In the jamming COS, the receiver is synchronized with the nominal signal parameters, and the meaconing peak is positioned at a significant distance (in terms of delay, $\Delta\tau$) or is sufficiently low in amplitude compared to the nominal peak, to disregard the distortion induced by the meaconing peak on the authentic one. The impact of the meaconer on the correlator output is thus completely determined by the rebroadcast noise of the meaconing signal. The effect of the meaconer in this situation is equivalent to a jammer increasing the noise floor $N_0$ level, hence the name of the COS.

In the spoofing COS, the receiver is synchronized to the meaconing signal parameters (meaconer peak), and the nominal peak is positioned at a significant distance (in terms of delay, $\Delta\tau$) or is sufficiently low in amplitude compared to the meaconing peak, to disregard the distortion induced by the nominal peak on the meaconer one.

In the multipath COS, the nominal and meaconing peaks are sufficiently close to each other (in terms of delay, $\Delta\tau$) to both affect the synchronization process (Matera 2022). In the context of civil aviation with a meaconer on the ground,
<figure><img src="image_5.png" /><figcaption>**Fig. 3** Illustration of GPS L1 C/A correlation peaks and noise for the different COS (nominal components in green and meaconer components in red). Time is expressed in chip (1 chip = 1/1023000 s)</figcaption></figure>

the multipath condition is unlikely to be observed and to
significantly impact the position estimation, as demonstrated
by (Hussong et al. 2024b, a). Consequently, the multipath
COS has a marginal impact on the received pseudoranges
and on the position estimation; therefore, this study focuses
on the jamming and spoofing COS.

**Methodology of the paper**

**Definition of the figures of merit**

This paper evaluates the position degradation under meacon-
ing through three figures of merit. The quality of the GNSS
position is quantified by metrics representing the availability,
the accuracy, and by the integrity of the position. The avail-
ability is defined at a given epoch κ by the possibility to
compute a position from the GNSS observables, and to use
this position for navigation. The accuracy is monitored at a
given epoch κ by the distribution of the GNSS position error,

which is the offset between the true aircraft position and the
estimated position at epoch κ, when the position is used for
navigation. The integrity is defined at a given epoch κ by the
probability P<sub>MI</sub> of the horizontal or vertical aircraft posi-
tion error to exceed the corresponding horizontal or vertical
protection level, while keeping the protection levels smaller
than the alert limits, when the position is used for navigation.

Under meaconing interference, the availability, the accu-
racy, and the integrity of the position may be degraded by the
meaconer signals, compromising the quality of the position
estimations. These degradations need to be known to ensure
the safety of the flight in all conditions, and the fulfillment of
civil aviation requirements. The three figures of merit facili-
tate the assessment of the performance degradation at the
position level under meaconing interference. Additionally,
they provide insights into the combined robustness brought
by the consistency checks and FD, illustrating the level of
protection afforded to standardized aircraft receivers against
meaconing only brought by them. Furthermore, quantifying
the mitigation of meaconing by the receiver establishes a
benchmark (for a future study) to evaluate the additional robustness conferred by the logic of the standards at the piloting level.

## Description of the methodology

To be able to derive the availability, the accuracy, and the integrity of an airborne position at a given epoch for a meaconer specific configuration, this paper goes through the following steps, as illustrated in Fig. 4:

First, this paper derives, for each COS of (Hussong et al. 2023), the corresponding PseudoRange Situation (PRS) models for the code and the phase, as a function of the meaconer relative parameters, as well as the mapping between COS and PRS. The models of the carrier-smoothed pseudoranges under meaconing interference are also defined, to evaluate the robustness of the different standardized pseudorange approval tests conducted by civil aviation receivers on the pseudoranges in the presence of meaconing.

Second, this paper classifies, from the PRS and the previous results of the robustness of the tests, the different meaconing impacts at the position level. The mathematical model of the estimated position is also developed for each POsition Situation (POS) as well as the mapping between PRS and POS. The robustness of the FD procedure is computed depending on the POS.

Finally, the availability, accuracy, and integrity of the position are computed and assessed in each POS to obtain the impact of the meaconer, using the established mathematical models of the position.

## Meaconing impact on the pseudoranges and on the position

This section derives the impact of the meaconing interference on the code, the phase and the smoothed pseudorange models, along with their repercussion on the estimated positions.

## Pseudorange altered models and effective C/N₀ models under meaconing interference

The mathematical models of the code and phase pseudoranges, as well as the effective C/N₀ models, can be determined depending on the COS. As the impact of the meaconing interference has been characterized at the correlator output level, the corresponding meaconing errors on the pseudoranges are modeled via the tracking loops terms ($ε_i$ and $ε_{φ,i}$) of the pseudorange models (Eq. (1) and (2)).

In both the nominal or jamming COS, the code and phase tracking loop models for each signal i at an epoch κ remain the same as in Eq. (3) (without meaconing interference) and are modeled as

$$ \begin{gathered} \epsilon_i[\kappa] = \epsilon_i^{nom}[\kappa] = \epsilon_i^{jam}[\kappa] = \epsilon_i^{DLL}[\kappa] \text{ and } \epsilon_{\phi,i}[\kappa] = \epsilon_{\phi,i}^{nom}[\kappa] = \epsilon_{\phi,i}^{jam}[\kappa] = \epsilon_{\phi,i}^{PLL}[\kappa]. \end{gathered} \tag{15} $$

The effective C/N₀ in the jamming COS is reduced compared to a nominal situation, as given by Eq. (16), leading to a higher standard deviation of the thermal noise tracking error models in the jamming COS. The meaconer

<figure><img src="image_6.png" /><figcaption>**Fig. 4** Methodology of this paper to derive the accuracy, the availability and the integrity of the position from the COS under meaconing interference</figcaption></figure>
interference affects the effective $C/N_0$ as follows (Hussong et al. 2023; Betz 2001):

$$ \left(\frac{C}{N_0}\right)_{\text{eff,J}} = \frac{1}{1 + \Delta N} \left(\frac{C}{N_0}\right)_a \qquad (16) $$

where $(C/N_0)_{\text{eff,J}}$ denotes the effective $C/N_0$ in the jamming COS, and $(C/N_0)_a$ denotes the nominal $C/N_0$. Remember that $C/N_{0,\text{eff,J}}$ is used as input in (4) and (5).

In the spoofing COS, the code and phase tracking loop models for each signal $i$ contain an additional bias and are modeled as shown below. Note that $\epsilon_i^{\text{DLL}}$ and $\epsilon_{\phi,i}^{\text{PLL}}$ represent in this case the DLL and PLL tracking errors with respect to the tracked signal peak, the meaconer peak, and thus they are assumed to have the same expression (error components with respect to the meaconer peak) as the nominal case:

$$ \epsilon_i^{\text{spo}}[\kappa] = c \Delta \tau_i[\kappa] + \epsilon_i^{\text{DLL}}[\kappa] \text{ and } \epsilon_{\phi,i}^{\text{spo}}[\kappa] = c \Delta \tau_i[\kappa] + \epsilon_{\phi,i}^{\text{PLL}}[\kappa] \qquad (17) $$

The effective $C/N_0$ is also reduced in the spoofing COS, leading to a higher standard deviation of the tracking error models. In the spoofing COS, the meaconer interference affects the effective $C/N_0$ as follows (Hussong et al. 2023):

$$ \left(\frac{C}{N_0}\right)_{\text{eff,S}} = \frac{\Delta g}{1 + \Delta N} \left(\frac{C}{N_0}\right)_a \qquad (18) $$

where $(C/N_0)_{\text{eff,S}}$ denotes the effective $C/N_0$ in the spoofing COS.

In the multipath COS, the code and phase tracking loop models are defined in (Hussong et al. 2024b, a) but are not investigated in this paper as the multipath COS has a marginal effect on the estimated pseudoranges in the context of civil aviation when the meaconer is on the ground and the aircraft is moving at speed. Only a meaconer onboard an aircraft can significantly degrade the GNSS performance in the multipath COS. For an in-depth analysis of the impact of onboard meaconers, the reader is invited to read (Hussong et al. 2024b).

## Mapping of the pseudorange situations with respect to the correlator output situation

Once the pseudorange mathematical models associated to a given COS are defined, PseudoRange Situations (PRS) defining the specific impact of the meaconer interference on the pseudorange can also be defined. Each defined PRS will thus have a pseudorange mathematical models determined in the previous section associated to it. Five PRS are defined, they are given by Fig. 5 together with the mapping with respect to the COS and explained hereafter.

If a pseudorange activates the $C/N_0$ threshold, the CMC test, or the step detector, the pseudorange is declared unusable, whatever the meaconing effect on it. In this PRS (denoted as the unusable PRS), the pseudorange model is not provided as the pseudorange is not used for WLSE. Otherwise, the PRS keeps the same name as the COS and uses the mathematical models provided in the previous section for the given COS. Finally, a pseudorange is declared usable or is in the usable PRS if the three consistency checks are passed; note that “usable PRS or satellite” term will be used to denote any satellite which is in nominal, jammed, spoofed or multipath PRS.

Effect of the airborne measurement processing blocks under meaconing interference.

This section details the influence of the different blocks of Fig. 1 on the received code and phase pseudoranges under meaconing interference and depending on the PRS. The effects in the nominal PRS are not recalled, as they are assumed to be identical to the situation without meaconing interference previously presented.

## Effect of the carrier smoothing under meaconing interference

The effect of the carrier smoothing depends on the PRS.

In the jamming PRS, the smoothed thermal noise term of the pseudorange, $\tilde{n}_{i}^{\text{jam}}$, is modified by the meaconing interference. The nominal smoothed thermal noise model Eq. (10) cannot be applied and needs to be adjusted. Indeed, the relative PSD gain of the noise reradiated by the meaconer, $\Delta N$, bears high variations over time (due to the meaconer-to-aircraft distance variations—Hussong et al. 2023), that induce variations of the effective $C/N_0$ (Eq. 16). The Gauss-Markow models of the code and phase thermal noises, $n_i$ and $n_{\phi,i}$, need thus to account for rapid changes of standard deviations as they are driven by the effective $C/N_0$ (Eqs. 4 and 5). They may vary rapidly with respect to the carrier smoothing filter correlation time $\Gamma$. Especially, thermal noise errors cannot be considered as 2nd order wide sense stationary signals. To model the smoothed thermal noise in jamming PRS, the code $n_i$ and phase $n_{\phi,i}$ thermal noises are modeled (before smoothing) to consider their time-changing standard deviations as GM processes characterized by their correlation times and their standard deviations as follows:

$$ \begin{aligned} n_i[\kappa] &\sim GM(\tau_n; \sigma_{\text{DLL}}^2(C/N_{0,a})_i \times g_{n,i}[\kappa]) \text{ with } g_{n,i}[\kappa] \\ &= \left( \frac{\sigma_{\text{DLL}}(C/N_{0,\text{eff}})_i[\kappa]}{\sigma_{\text{DLL}}(C/N_{0,a})_i} \right)^2 \end{aligned} \qquad (19) $$
$$n_{\phi,i}[\kappa] \sim GM(\tau_{\phi,i}; \sigma_{\text{PLL}}^2(C/N_{0,a})_i \times g_{\phi,n,i}[\kappa]) \text{ with } g_{\phi,n,i}[\kappa] \\ = \left( \frac{\sigma_{\text{PLL}}(C/N_{0,eff})_i[\kappa]}{\sigma_{\text{PLL}}(C/N_{0,a})_i} \right)^2$$

where $\sigma_{\text{DLL}}$ and $\sigma_{\text{PLL}}$ are given by Eqs. (4) and (5). The functions $g_{n,i}$ and $g_{\phi,n,i}$ account for the variations of the thermal noise standard deviations and are known for a given geometry and given meaconer characteristics. They are derived from the effective $C/N_0$ from Eqs. (16) and (18) (considered deterministic and equal to its true mean value), and from the true known $C/N_0$ value without meaconing interference. In the nominal PRS, $g_n = g_{\phi,n} = 1$. The complete derivation of the smoothed thermal noise is performed in the electronic supplement. The stochastic model of the smoothed thermal noise $\tilde{n}_i^{jam}$, which is dependent on the epoch $\kappa$, is given below and follows a GM process with deterministic correlation time and standard deviation, defined by:

$$\tilde{n}_i^{jam}[\kappa] \sim GM\left(\Gamma, \tilde{\sigma}_{n,i,NWSS}^2[\kappa]\right) \text{ with}$$

$$h_{\text{PLL},\kappa}[\mu] = \sum_{j=1}^{\kappa-1} \left(\frac{\Gamma-1}{\Gamma}\right)^j e^{-\frac{j\delta t}{\tau_{\phi,n}}} \delta(\mu-j) \quad (23)$$

This formula is rapidly computable and can be used to predict the distribution of the smoothed thermal noise, for protection level derivations or for simulations. An example of the values of $\tilde{\sigma}_{n,i,NWSS}$ is given in Figs. 6 and 7 for a clearer understanding of the carrier smoothing effect on the thermal noise under jamming PRS.

The black curve represents the code thermal noise standard deviation $\sigma_{\text{DLL},i}$ over time, with an arbitrary time-changing profile chosen for the example. The phase thermal noise $\sigma_{\text{PLL},i}$ is not represented but follows the same variations with a different amplitude scale. The dashed dark blue line represents the smoothed thermal noise standard deviation $\tilde{\sigma}_{n,i,NWSS}$ of the derived mathematical model in Eq. (20). The light blue curve represents the standard deviation computed from 10,000 Monte Carlo runs of thermal noise series (generated from GM distributions of standard deviations defined by the black curve) to which the smoothing filter recursive equation (Eq. 6) has been applied. Simulations act as a validation.

$$\begin{aligned} \tilde{\sigma}_{n,i,NWSS}^2[\kappa] = & \left(\frac{\Gamma-1}{\Gamma}\right)^2 \tilde{\sigma}_{n,i,NWSS}^2[\kappa-1] + \frac{1}{\Gamma^2} \sigma_{\text{DLL},i}^2 g_{\text{DLL},i}[\kappa] + \left(\frac{\Gamma-1}{\Gamma}\right)^2 \sigma_{\text{PLL},i}^2 g_{\text{PLL},i}[\kappa] + \left(\frac{\Gamma-1}{\Gamma}\right)^2 \sigma_{\text{PLL},i}^2 g_{\text{PLL},i}[\kappa-1] \\ & - 2\left(\frac{\Gamma-1}{\Gamma}\right)^2 \sigma_{\text{PLL},i}^2 g_{\text{PLL},i}^{(\kappa)}[\kappa-1]e^{-\frac{1}{\tau_{\phi,n}}} + 2\frac{\sigma_{\text{DLL},i}^2}{\Gamma^2}(h_{\text{DLL},\kappa} * g_{\text{DLL},i}^{(\kappa)})[\kappa] \\ & + 2\frac{\sigma_{\text{DLL},i}^2}{\Gamma} \left(\frac{\Gamma-1}{\Gamma}\right)^{\kappa} g_{\text{DLL},i}^{(\kappa)}[0]e^{-\frac{\kappa}{\tau_{n}}} + 4\sigma_{\text{PLL},i}^2 \left(\frac{\Gamma-1}{\Gamma}\right)^2 (h_{\text{PLL},\kappa} * g_{\text{PLL},i}^{(\kappa)})[\kappa] \times \left[1 - \cosh\left(\frac{1}{\tau_{\phi,n}}\right)\right] \text{ if } \kappa \ge 1 \end{aligned} \quad (20)$$

$$\hat{\sigma}_{n,i}^2[\kappa] = \sigma_{\text{DLL},i}^2 g_{n,i}[0] \text{ if } \kappa = 0$$

The functions $g_{\text{DLL},i}^{(\kappa)}$ and $g_{\text{PLL},i}^{(\kappa)}$ are built upon the functions $g_{\text{DLL},i}$, and $g_{\text{PLL},i}$ and reflect the apparent variations of the thermal noise standard deviations with respect to a nominal situation, when taking into account the smoothing process. These functions are defined for all $\mu \in [0;\kappa]$ as:

$$\begin{aligned} g_{\text{DLL},i}^{(\kappa)}[\kappa - \mu] &= \frac{1 - e^{-2\delta t / \tau_n}}{1 - e^{-2\mu / \tau_n}} \sum_{j=0}^{m-1} e^{-2j\delta t / \tau_n} g_{\text{DLL},i}[\kappa - (j + 1)\delta t] \\ g_{\text{PLL},i}^{(\kappa)}[\kappa - \mu] &= \frac{1 - e^{-2\delta t / \tau_{\phi,n}}}{1 - e^{-2\mu / \tau_{\phi,n}}} \sum_{j=0}^{m-1} e^{-2j\delta t / \tau_{\phi,n}} g_{\text{PLL},i}[\kappa - (j + 1)\delta t]. \end{aligned} \quad (21)$$

and the functions $h_\kappa$ and $h_{\phi,\kappa}$ are defined for all $\mu \in [0;\kappa]$ as:

$$h_{\text{DLL},\kappa}[\mu] = \sum_{j=1}^{\kappa-1} \left(\frac{\Gamma-1}{\Gamma}\right)^j e^{-\frac{j\delta t}{\tau_n}} \delta(\mu-j) \quad (22)$$

method to ensure the accuracy and to confirm the derivations for Eq. (20).

To show the effect of the carrier smoothing filter, Fig. 7 presents a zoom of Fig. 6. The filter's main effects are the reduction of the thermal noise standard deviation, and a delay between the current noise profile and the smoothed noise profile. The match between the theoretical and simulated curves validates the formula of Eq. (20). The mathematical model of the smoothed pseudorange in the jamming PRS is then given by:

$$\begin{aligned} \tilde{\rho}_i^{jam}[\kappa] &= d_i[\kappa] - c\delta t_i[\kappa] + c\delta t_r[\kappa] + T_i[\kappa] \\ &\quad + \tilde{I}_i[\kappa] + \tilde{M}_i[\kappa] + \tilde{n}_i^{jam}[\kappa] \text{ with } \tilde{n}_i^{jam}[\kappa] \\ &= \tilde{n}_{i,NWSS}[\kappa] \end{aligned} \quad (24)$$

(24) In the spoofing PRS, a deterministic term $c\Delta\tau$ is added to both the code and phase tracking errors to obtain the pseu-
<figure><img src="image_7.png" /><figcaption>Fig. 5 Flow chart to determine the PRS from the COS</figcaption></figure>

dorange errors as determined in Eq. (17). As detailed in the electronic supplement, the smoothing filter does not modify this term in the smoothed pseudorange. Consequently, the smoothed pseudorange model in the spoofing PRS is equal to the jamming PRS model except for the extra term $c\Delta\tau$ and for a different effective $C/N_0$ Eq. (18):

$$ \tilde{\rho}_i^{spo}[\kappa] = d_i[\kappa] + c\Delta\tau_i[\kappa] - c\delta t_i[\kappa] + c\delta t_r[\kappa] + T_i[\kappa] + \tilde{T}_i[\kappa] + \tilde{M}_i[\kappa] + \tilde{n}_i^{spo}[\kappa] \quad (25) $$

$$ \tilde{n}_i^{spo}[\kappa] = \tilde{n}_{i,NWSS}[\kappa] $$

<figure><img src="image_8.png" /><figcaption>Fig. 6 Illustration of the smoothing effect on the code thermal noise standard deviation</figcaption></figure>
<figure><img src="image_9.png" /><figcaption>**Fig. 7** Zoom on the plot of Fig. 6</figcaption></figure>

## Analysis of the consistency checks under meaconing interference

This subsection analyses the robustness provided by the two consistency checks monitored in this study ($C/N_0$ threshold and CMC test) in the jamming and in the spoofing PRS.

### Effect of the $C/N_0$ threshold under meaconing interference

Replacing Eq. (16) (resp. Equation (18)) into (11) gives the condition of activation of the $C/N_0$ threshold $T_{CN0}$ in terms of $\Delta N$ in the jamming PRS (resp. spoofing PRS). Figure 8 represents the values of $\Delta g$ and $\Delta N$ for which the $C/N_0$ threshold activates in the jamming and spoofing PRS. The estimated effective $\bar{C}/N_{0,eff}$ is here considered equal to its true mean value for clarity. Figure 8 presents the results as a function of the nominal $C/N_0$ and only value higher than the $C/N_0$ threshold ($> 30dBHz$) are used.

Figure 8 reports that the $C/N_0$ threshold activates in the jamming PRS when $\Delta N$ is above a determined value that only depends on the nominal $C/N_0$. In the spoofing PRS, the $C/N_0$ threshold is less likely to activate (as the areas of activation are smaller) and depends on $\Delta N$, $\Delta g$ and on the nominal $C/N_0$. In both PRS, the higher the nominal $C/N_0$ is, the larger $\Delta N$ should be to activate the test. Thus, a smaller meaconer noise PSD is needed to activate the screening of the pseudoranges with low nominal $C/N_0$. Globally, the $C/N_0$ threshold test is a good indicator and a sufficient mitigation test for the jamming PRS, but not for the spoofing PRS.

### Effect of the CMC test under meaconing interference

In the jamming and spoofing PRS, the standard deviation of the smoothed thermal noise is modified according to Eq. (20). The probability to activate the CMC test can thus increase. The derivation of the CMC probability $P_{CMC}$ is highlighted in the electronic supplement. Figure 9 presents the probability of the CMC activation when exposed to meaconing interference (identically for the jamming and spoofing PRS) as a function of the satellite elevation. The maximum reachable (i.e., observed in the worst-case condition detailed in the electronic supplement) probability is higher for low elevation satellites because the multipath standard deviation affects the CMC test and is larger at low elevations. $P_{CMC}$ stays below $2.10^{-3}$, so the risk of losing a satellite due to CMC activation is marginal, even when exposed to a meaconer. Therefore, the CMC test does not bring any robustness against meaconing interference (this outcome could have been predicted, given that its primary function is to detect discrepancies between phase and code measurements).

## Meaconing impact on the position models

### Definition and mapping of the position situations

The impact of the meaconer interference on the position estimation is classified in different situations, called POsition Situations (POS); for each POS, the mathematical model of the position estimation as well as of the smoothed pseudorange used to derive it is defined in this section. A flow chart
<figure><img src="image_10.png" /><figcaption>**Fig. 8** $C/N_0$ threshold activation as a function of $\Delta g$ and $\Delta N$, and for different nominal $C/N_0$. The colored areas represent the zones in which the test is activated</figcaption></figure>

to determine the POS from the PRS is given by Fig. 10, and the mathematical conditions are detailed hereafter.

The conditions are defined using $N_{usable}$ as the number of usable pseudoranges (i.e., the number of pseudoranges that are not in the *unusable* PRS), $N_{SBAS}$ the number of usable SBAS signals, $N_{nominal}$ and $N_{spoofed}$ the number of satellites respectively in the nominal or spoofing PRS at epoch $\kappa$.

<figure><img src="image_11.png" /><figcaption>**Fig. 9** Maximum reachable probability of exceeding the CMC threshold in the jamming or spoofing PRS, depending on the elevation angle of the satellite</figcaption></figure>

The availability condition $C_1$ tests if at least 4 pseudoranges are usable at the current epoch ($C_1[\kappa] \Leftrightarrow N_{usable}[\kappa] \ge 4$), and the unavailable POS $S_1$ is obtained when $C_1$ is not fulfilled. In $S_1$, a position cannot be computed, and the POS is declared as “no position”. The SBAS condition $C_2$ tests if at least one usable SBAS satellite is usable ($C_2[\kappa] \Leftrightarrow N_{SBAS}[\kappa] \ge 1$), otherwise the position is in the $S_2$ POS: “position without SBAS correction”. The nominal condition $C_3$ is fulfilled when all the usable pseudoranges are in the nominal PRS ($C_3[\kappa] \Leftrightarrow N_{nominal}[\kappa] = N_{usable}[\kappa]$) and, if so, the POS is declared as $S_3$: nominal position. If $C_3$ is not fulfilled, then at least one pseudorange is in the jamming or in the spoofing PRS. The next POS are segregated based on the number of spoofed pseudoranges $N_{spoofed}[\kappa]$ at the current epoch. The jamming condition $C_4$ is fulfilled when no usable pseudorange is spoofed ($C_4[\kappa] \Leftrightarrow N_{spoofed}[\kappa] = 0$) and the POS is declared as jammed. The spoofing condition $C_5$ is fulfilled when all the usable pseudoranges are spoofed ($C_5[\kappa] \Leftrightarrow N_{spoofed}[\kappa] = N_{usable}[\kappa]$) and the POS is declared as spoofed. Finally, the “FD alarm” POS is declared in all the other cases (“FD alarm” $\Leftrightarrow 1 \le N_{spoofed} \le N_{usable} - 1$).

## Mathematical models of position situations

**Position models in the “no position”, “position without SBAS correction” and “FD alarm” situations** In the “no position” POS, a position cannot be estimated because it needs a minimum of four satellites to compute it. In the “position
<figure><img src="image_12.png" /><figcaption>**Fig. 10** Flow chart of the priority order to determine the POS from the PRS</figcaption></figure>

without SBAS correction” and “FD alarm” POS, a position can be estimated, but its model is not provided because the position is not used for navigation in these two POS.

**Position model in the jammed POS** In the jammed POS, the position model is given by:

$$ \hat{x}_{pos}[\kappa] = \tilde{x}[\kappa] + \tilde{\delta}_{M}[\kappa] + \tilde{\delta}_{n}[\kappa] \quad (26) $$

where the thermal noise position error $\tilde{\delta}_n$ is zero-mean and with a variance equal to

$$ \begin{aligned} Var(\tilde{\delta}_n[\kappa]) &= S[\kappa]\Sigma_n[\kappa]S^T[\kappa] \text{ and } (\Sigma_n[\kappa])_{(i,j)} \\ &= \begin{cases} \tilde{\sigma}_{n,i,NWWS}^2[\kappa] & \text{if } j \\ 0 & \text{otherwise} \end{cases} \end{aligned} \quad (27) $$

And $S$ is the projection matrix of the WLSE (Axelrad et al. 1996).

**Position model in the spoofed POS** In the spoofed POS, the position model is given by:

$$ \hat{x}_{pos}[\kappa] = \tilde{x}_{mc}[\kappa] + \tilde{\delta}_{M}[\kappa] + \tilde{\delta}_{n}[\kappa] \quad (28) $$

$\tilde{x}_{mc}[\kappa] = x_{mc}[\kappa] + \delta_l[\kappa] + \delta_T[\kappa] + \tilde{\delta}_I[\kappa]$ where $x_{mc}$ is the true position of the meaconer. Note that $\delta_T$ and $\tilde{\delta}_I$ are assumed to be the same as for the aircraft position since the aircraft and the meaconer position are spatially close enough to not see any significant difference on the tropospheric and ionospheric contributions. $\tilde{\delta}_M$ is assumed to have the same distribution as for the jamming POS.

**Effect of the FD procedure under meaconing interference** In the nominal and jammed POS, the FD procedure performance is similar to its performance without meaconing interference. Therefore, in this section, only the POS situations where at least on pseudorange is in the spoofed PRS are analyzed: spoofed and FD alarm PRS. The FD performance does not depend on the estimated position, but only on the pseudorange residuals. As the residuals in the jammed POS (26) and in the spoofed POS (28) are identical (the extra spoofing bias $c\Delta\tau$ being absorbed by the clock bias term of the WLSE), the FD performance is the same in the jammed POS as in the spoofed POS. When only one pseudorange is in the spoofing PRS, the FD procedure is very effective at detecting spoofing. Indeed, the spoofed pseudorange is biased by an extra term of $c\Delta\tau$ that can be easily detected by the procedure. Figure 11 shows the average probability of the FD procedure to detect one pseudorange in the spoofing PRS, depending on the elevation of the considered satellite, and in the worst-case scenario (when the extra term $c\Delta\tau$ is the smallest, detailed in the electronic supplement). Intermediate results to obtain this graph are also provided in the electronic supplement. The probability $P_d$ of detection of signal $i$ when only this signal is in spoofing PRS is given below.

$$ P_{d_i} = P(q_i \ge Tq_i) \text{ knowing } e_i = [w_1 w_2 \dots w_i + \min(c\Delta\tau_i) \dots w_{N_S}]^T \quad (29) $$

$q_i$ and $T_q$ are expressed in Eq. (13), and $w_j \sim N(0, \sigma_j)$ where $\sigma_j$ is the smoothed pseudorange standard deviation in the nominal PRS (DO229E Appendix E).

The FD procedure raises an alarm as soon as one signal is spoofed, and this detection capability is presumed as long as at least one spoofed PRS and at least one nominal or
<figure><img src="image_13.png" /><figcaption>**Fig. 11** Probability of detection of the spoofed pseudoranges by the FD procedure as a function of the satellite elevation. The solid line represents the probability to detect instantaneously the spoofing bias. The dotted lines represent the same probability after 0.5 s and 1 s in the spoofing PRS</figcaption></figure>

jammed PRS remain in the navigation solution. Finally, if all the pseudoranges are in the spoofing PRS, then the whole set of signals is coherent, the FD procedure cannot detect the spoofing biases, and the position is in the spoofing POS. Therefore, the FD procedure provides a very high robustness against meaconer interference, except if all the usable pseudoranges are in the spoofed PRS.

The aircraft is supposed to start its flight in a nominal or jamming POS, as the spoofed POS would be detected while the aircraft is still parked at the airport since its actual position is known. When the aircraft flies, a meaconer with sufficient gain would progressively disrupt the signals, causing them to be lost and reacquired in the order of their nominal carrier-to-noise ratios (as signals associated with smaller nominal $C/N_0$ values need smaller values of $\Delta N$ for their effective $C/N_0$ to drop below 30 dB.Hz). As a result, all pseudoranges would not be in the spoofed PRS simultaneously but the number of spoofed PRS would progressively increase, potentially spoofing all visible satellites. As a result, FD would raise an error at the epochs prior to the spoofing of all the pseudoranges, when the number of spoofed PRS lies between $1$ and $N_{usable} - 1$, so prior to the spoofed POS during a flight.

**Protection level computation under meaconing interference** As shown by Eq. (20), the exact thermal noise standard deviation $\hat{\sigma}_{n,i,NWSS}^2$ cannot be estimated by only considering the current $C/N_0$ value, but this method is tolerated by civil aviation standards (DO 229E Appendix J). Indeed, the smoothed pseudorange has been calculated with measurements from the previous epochs. Therefore, the smoothed thermal noise contains thermal noise errors

form past pseudorange estimations. The Protection Levels (PL) could be misevaluated under the jamming or spoofing POS if only the current $C/N_0$ is used to estimate the smoothed thermal noise standard deviation.

A comparison between the PL computation incorporating the smoothed thermal noise standard deviation $\hat{\sigma}_{n,i,NWSS}$ and the PL computation following minimum operation standards is presented hereafter.

Two different methods are used to calculate the PL values in jamming or spoofing POS, “exact PL” and “standard PL”. Both methods implement the standardized equations and mathematical models of (DO 229E Appendix J) as done for the nominal POS. The only difference between the mathematical models used to compute the PL values for nominal POS and for jamming or spoofing POS is the $\sigma_{air}$ value, as well as the equations used to calculate this term for “exact PL” method. Indeed, $\sigma_{air}$ value must be adapted to consider the variation of effective $C/N_{0,eff}$ due to meaconer interference; however, whereas for “standard PL” the same equations as in standard (DO 229E Appendix J) are used, “exact PL” considers the memory effect of the smoothing filter as well as the relative fast time variations of $C/N_{0,eff}$. Note that this explanation also states that “standard PL” is used for nominal POS with $C/N_{0,eff} \approx C/N_{0,a}$.

* “Exact PL” method uses the smoothed standard deviation model (Eq. 20) for the thermal noise estimation to calculate $\sigma_{air}$, $\sigma_{air} = \hat{\sigma}_{n,i,NWSS}$, instead of the standardized expression.
* “Standard PL” computes the standard deviation of σ<sub>air</sub> by using Eq. (4) and (5) and by multiplying the value with a scaling factor given by Eq. (10) to account for the smoothing effect, matching the carrier smoothing filtering effect on white Gaussian noise. “Standard PL” is assumed to be the default method to compute protection levels following the minimum standards.

In jamming or spoofing POS, the two methods show different protection levels, especially after the interference peak, when the aircraft is flying away from the meaconer. An example is illustrated in Fig. 12 with a meaconer gain, G<sub>m</sub>, of 120 dBs at a distance of H = 2000 meters. When the aircraft flies away from the meaconer (after 500 s), the smoothing keeps the memory from the past, where the meaconer induced high thermal noise in the measurements. This higher noise is considered in the “exact VPL” computation, but not in the “standard VPL”, leading to slightly higher PLs from the exact method. The nominal PLs are shown in black lines (solid and dashed and calculated from the “standard PLL” method as previously stated) as a reference and refer to the same scenario without meaconer interference.

The difference between the two curves is only 2 cm in
this configuration but can be larger if the meaconer gain
is higher. However, the PL difference between the two

methods stays reasonably small not to create intolerable
integrity hazards when following the default method of
the standard and to not create situations where the PL are
above the AL values (whereas in the nominal situation
they were below). Therefore, since the PL computation is
not able to create situations where the estimated position is
not used in presence of meaconer interference (PL > AL),
it can be concluded that the PL computation does not pro-
vide robustness against this type of interference.

Determination of the GNSS performance
degradation under meaconing interference

This section presents the impact of meaconing interference
on the accuracy, availability, and integrity of the position,
depending on the POS. Remember that these figures of merit
are defined to determine the impact of meaconer interference
on the position estimation performance without consider-
ing the protection brought by the standard rules or logic;
only the robustness provided by the consistency checks, FL
procedure and PL computation are analyzed. First, three sce-
narios depicting aircraft approaches are described. In each
scenario, the relative parameters are known, consequently
the PRS and the POS can be determined. The approaches are
then run 10,000 times with a Monte-Carlo method, and the

<figure><img src="image_14.png" /><figcaption>**Fig. 12** Standard (blue) and exact (red) VPLs during a 1000-s flight</figcaption></figure>

<figure><img src="image_15.png" /></figure>
estimated positions are monitored and analyzed with respect to the POS. Additional details about the implementation of the simulation bench providing the results of this section can be found in the electronic supplement.

## Definition of the three scenarios

To demonstrate the impact of a meaconer on an aircraft receiver, the aircraft GNSS performances are monitored and displayed during highly realistic approaches for three different scenarios (illustrated in Fig. 13). The approaches start at the Final Approach Fix (FAF) and end at the Decision height (Dh) of the Toulouse RNP RWY 32L approach (DIRCAM LFBO). The approaches last about 194 s when flown at 131 kt, and the GPS L1 C/A measurements are generated at a rate of $f_s = 1$ Hz during the approaches.

* Scenario 1 is an approach without meaconer

* Scenario 2 is an approach with a meaconer of gain $G_{m,2} = 110dB$ on the ground at $L_2 = 4000m$ before the runway threshold, and $H_2 = 1500m$ perpendicular to the runway axis.

* Scenario 3 is an approach with a meaconer of gain $G_{m,3} = 120dB$ on the ground at $L_3 = 4000m$ before the runway threshold, and $H_3 = 150m$ perpendicular to the runway axis.

Each scenario is run $N_{geom} = 10000$ times, each time with a different satellite geometry, so that the $N_{geom}$ satellite geometries uniformly cover all the geometries of the GPS constellation (from Gps.gov) that can be observed over Toulouse during 24 h. The approaches are carried on to the end, even if the

GPS position is unavailable, without SBAS correction, or in the FD alarm POS at a given epoch $\kappa$. This procedure is not representative of the piloting logic of the standards, but offers a better visualization of the meaconer impact on the estimated position performance when only the consistency checks, FD procedure and PL computation are considered for mitigating the meaconer impact and when the standards/pilot logics are not. The robustness added by the piloting logic will be investigated in future work.

Figure 14 reports the proportions of time each POS is observed during the scenarios. The proportions of time $P_s$ are defined for each POS at epoch $\kappa$ as:

$$P_s[\kappa] = \frac{1}{N_{geom}} \sum_{j=1}^{N_{geom}} 1_s[\kappa, j] \quad (30)$$

where the indicator function $1_s[\kappa, j]$ equals 1 if the approach $j$ is in the POS $s$ at epoch $\kappa$, $1_s[\kappa, j]$ equals 0 otherwise. Equation (30) is computed with the knowledge of the relative parameters and the classification of Fig. 10.

In scenario 1, the position stays nominal as there is no meaconer. In scenario 2, all the approaches start in nominal POS then progressively become jammed (jamming POS), as the meaconer interference increases when the aircraft flies towards the meaconer. During some approaches, a subset of pseudoranges gets spoofed by the meaconer, raising FD alarms (FD alarm POS). At the end of the approach, the position is either in the jamming or in the “FD alarm” POS. In scenario 3, the position is already in jamming POS at the FAF, and FD alarms are raised when the aircraft flies towards the meaconer. All the pseudoranges are eventually spoofed, thus, spoofed POS appears close to the meaconer.

<figure><img src="image_16.png" /><figcaption>Fig. 13 Configuration of the three scenarios under scrutiny. $t_{FAF}$ is the time at which the aircraft reaches the FAF and starts the approach, $t_m$ where the aircraft is the closest to the meaconer, and $t_{Dh}$ where the aircraft reaches the decision height and ends its approach</figcaption></figure>
<figure><img src="image_17.png" /><figcaption>**Fig. 14** Proportions of time of the different POS observed during the approaches in each scenario</figcaption></figure>

High ΔN (Fig. 8) causes the C/N₀ test to exclude some pseudoranges, sometimes generating a “no position” POS when not enough pseudoranges are usable. At the end of the approach, the position is either in the spoofed or “FD alarm” POS.

Finally, Fig. 15 reports the mean values and standard deviations of the observed Δg and ΔN throughout the approach, when averaged over the Nₐgeom geometries. They are given as an indication to better apprehend the next presented results.

## Availability under meaconing interference

The GNSS position availability has been previously defined in this work as the probability to compute a position that can be used for navigation at a given epoch κ. An estimated position which is used for navigation is defined as available position. An available position is found in the nominal, jammed, or spoofed POS, and is not found in the “no position”,

“position without SBAS correction” or “FD alarm” POS. The availability of the position Pₐ is therefore computed as:

$$ P_a[\kappa] = \sum_{s \in \text{positionsituations}} P_a[\kappa|s] \times P_s[\kappa] \\ \approx P_{\text{nominal}}[\kappa] + P_{\text{jammed}}[\kappa] + P_{\text{spoofed}}[\kappa] \quad (31) $$

where Pₐ[κ|s] is the probability to have an available position at epoch κ conditioned to be in POS s, and P_s[κ] is the probability to be in the POS s at epoch κ. Pₐ[κ|no position] = Pₐ[κ|no SBAS] = Pₐ[κ|FD alarm] = 0 and Pₐ[κ|nominal] = Pₐ[κ|jammed] = Pₐ[κ|spoofed] = 1. Figure 16 illustrates the availability of the position during the approaches in the three scenarios.

The availability is drastically reduced in the vicinity of the meaconer, for both scenarios 2 and 3, and can be reduced to 0% when the meaconer gain is high. A meaconer can therefore degrade the GNSS availability beyond civil aviation requirements. In scenario 3, the availability increases back after hovering the meaconer, because some positions in the spoofed POS are observed. At this point, any of the
<figure><img src="image_18.png" /><figcaption>Fig. 15 Mean value and standard deviations of Δg and ΔN during the three scenarios</figcaption></figure>

presented checks (CMC, C/N₀ threshold) or procedure (FD, PL computation) cannot detect the spoofing of the position since the pseudoranges are coherently spoofed and arrive with sufficient C/N₀ at the aircraft’s antenna.

## Accuracy under meaconing interference

The accuracy of the position has been previously defined as the difference between the estimated aircraft position $\hat{x}_{pos}$ and the true aircraft position $x_a$ when the position is deemed available. Mathematically, the position error $\zeta_{pos}$ is given at epoch $\kappa$ when the position is available by:

$$ \zeta_{pos}[\kappa] = \hat{x}_{pos}[\kappa] - x_a[\kappa] \quad (32) $$

The standard deviation $\sigma_{pos}$ of the position error is finally computed as

$$ \sigma_{pos}[\kappa] = \sqrt{\Sigma_{\zeta_{pos}}[\kappa]_{(1,1)} + \Sigma_{\zeta_{pos}}[\kappa]_{(2,2)} + \Sigma_{\zeta_{pos}}[\kappa]_{(3,3)}} \quad (34) $$

The bias and the standard deviation of the accuracy of the position are shown at each epoch for the three scenarios in Fig. 17, when averaged for each POS over the number of geometries for which the position is available.

The GNSS accuracy is degraded when exposed to a meaconer. As expected by the mathematical models, the position error in the jamming POS is zero-mean but with larger standard deviations when the aircraft is close to the meaconer than the values for nominal POS. The position error

$$ \zeta_{pos}[\kappa] = \begin{cases} \delta_t[\kappa] + \delta_T[\kappa] + \tilde{\delta}_l[\kappa] + \tilde{\delta}_M[\kappa] + \tilde{\delta}_n[\kappa] & \text{in nominal and jammed POS} \\ x_{mc}[\kappa] - x_a[\kappa] + \delta_t[\kappa] + \delta_T[\kappa] + \tilde{\delta}_l[\kappa] + \tilde{\delta}_M[\kappa] + \tilde{\delta}_n[\kappa] & \text{in spoofed POS} \end{cases} $$

where $x_{mc}$ denotes the position of the meaconer. As shown in Eq. (32), in nominal and jammed POS, the position is unbiased (since error terms are zero-centered) whereas in spoofed POS, the position is biased with a value equal to $x_{mc} - x_a$. Taking the covariance of Eq. (32) gives the covariance of the position error $\Sigma_{\zeta_{pos}}$:

$$ \Sigma_{\zeta_{pos}}[\kappa] = \Sigma_{\delta_i}[\kappa] + \Sigma_{\delta_T}[\kappa] + \Sigma_{\tilde{\delta}_l}[\kappa] + \Sigma_{\tilde{\delta}_M}[\kappa] + \Sigma_{\tilde{\delta}_n}[\kappa] \quad (33) $$

in the spoofing POS has a slightly larger standard deviation (than for nominal POS) due to the larger C/N₀,eff when the pseudoranges are in spoofed PRS, and a large mean position error corresponding to the distance between the aircraft and the meaconer. A meaconer can therefore cause noticeable accuracy issues that might exceed the civil aviation GNSS accuracy requirements.
<figure><img src="image_19.png" /><figcaption>**Fig. 16** Availability during the approaches in the three scenarios. $P_a$ is depicted in blue, and the dotted lines refer to the vertical axis on the right and represent the mean number of tracked satellites</figcaption></figure>

($C/N_{0,eff} > 25dBHz$), mean number of satellites in usable PRS and in spoofed PRS observed during the approaches
## Integrity under meaconing interference

The integrity of the position has been defined at a given epoch $\kappa$ by the probability $P_{MI}$ of the horizontal or vertical

aircraft position error (resp. $\epsilon_H$ and $\epsilon_V$) to exceed the corresponding horizontal or vertical protection level (resp. *HPL* or *VPL*) while the protection levels are smaller than the alert limit *HAL* or *VAL* and when the position is available.

<figure><img src="image_20.png" /><figcaption>**Fig. 17** Accuracy during the approaches in the three scenarios. The mean values of the position error and its standard deviation are given for each POS (with an available position) when observed. The mean</figcaption></figure>

position error in the spoofing POS is larger than the other errors, so its values are provided with the vertical axis on the right
<figure><img src="image_21.png" /><figcaption>Fig.18 Mean $P_{MI}$ observed during the approaches in the three scenarios</figcaption></figure>

$$P_{MI}[\kappa] = P(HPL[\kappa] < \epsilon_H[\kappa] | HPL[\kappa] < HAL \cap VPL[\kappa] < \epsilon_V[\kappa] | VPL[\kappa] < VAL) \quad (35)$$

The integrity $P_{MI}$ should be lower than $10^{-7}$ during
LPV200 approaches. However, in the context of meaconing
interference, the integrity may become larger than 10⁻⁷ in the
vicinity of a meaconer, creating an integrity risk. Figure 18
represents the mean probability P<sub>MI</sub> observed in the three
scenarios, when averaged for each POS over the number of
geometries for which the position is available.

The standard P<sub>MI</sub> in the jammed POS may slightly (but insignificantly) not respect the civil aviation requirement when flying away from the meaconer, whereas the integrity requirement is always respected with the exact computation method. In the spoofed POS, both the standard and the exact method fail at ensuring the integrity of the approach, and P<sub>MI</sub> ≈ 1 when spoofed, compromising the integrity of the approach. Furthermore, integrity, messages carried by SBAS signal can not reduce the integrity risk under meaconing, because the meaconer broadcasts the same satellite signals as the current visible constellation signals, and because the SBAS message is not modified by the meaconer.

**Conclusion**

This study proposed a novel methodology to assess GNSS
observables in the presence of meaconer interference and to
isolate its impact on each component of a certified aircraft
receiver, such as carrier-smoothing, pseudorange approval
checks, fault detection procedures, protection level deriva-
tions, and position computation. Additionally, this method-
ology provides mathematical models for each GNSS observ-
able, along with classifications of the meaconing impact
and their cascading effects on the aircraft's receiver: from
correlator output to position performance passing through
pseudorange measurement and estimated position.

The meaconer impact on the GNSS measurements can
be cataloged in four situations at the correlator output
(COS)—nominal, jamming, spoofing, multipath. These four
situations propagate into five pseudorange situations (PRS)
— unusable, nominal, jamming, spoofing and multipath. The
pseudorange situations of all the visible satellites at a given
epoch determines the position situation (POS) as one of six
different cases—unavailable, position without SBAS, nomi-
nal, jamming, FD alarm, and spoofing.

The performance of pseudorange consistency checks,
although effective in some cases, was found to be insuf-
ficient to fully mitigate the effects of meaconing signals.
The measurement quality monitoring test, as well as the
step detector test, have been proved ineffective to exclude
jammed or spoofed pseudoranges on their own. The C/N₀
threshold demonstrated its efficiency to exclude jammed-
PRS pseudoranges corrupted by high meaconing power but
can hardly exclude spoofed-PRS pseudoranges.

The FD procedure has been proved very effective to detect
spoofed-PRS pseudoranges, when at least one pseudorange

is still not in the spoofed PRS. If all the pseudoranges are in
spoofed PRS, the FD procedure does not raise any alarm and
the position is in the spoofing POS. The protection levels
are marginally impacted by meaconing interference, and the
protection level logic cannot solely ensure the integrity of
the estimated positions under meaconing interference.

Specific metrics representing the accuracy, availability,
and integrity of the position have been designed to evalu-
ate the position performance degradation under meaconing,
ensuring a precise and robust analysis of the meaconing
threat. The study of the accuracy reveals that meaconing
interference significantly reduces the accuracy of the esti-
mated aircraft position. In the jammed POS, the standard
deviation of the Gaussian position error is increased due to
meaconing; in the spoofed POS, the position is estimated
around the meaconer location, producing large position mean
errors. The computation of the availability demonstrates an
important drop of the availability of aircraft's GNSS solu-
tions. In the position without SBAS and FD alarm situations,
the estimated position is not trustable and cannot be used for
positioning. The probability of position unavailability and
of untrustable positions increases as the aircraft enter zones
with high meaconing signal power, underscoring the critical
need for protection measures to respect aviation availability
requirements. Finally, the integrity indicates that the prob-
ability of misleading GNSS position is barely increased by
meaconing interference, except when the position is spoofed.
In the spoofed POS, the probability of misleading informa-
tion skyrockets to 100%.

This work paves the way for further exploration into the
real-time operational risks posed by meaconing. Future
studies should extend this analysis over complete flight
approaches to capture a more holistic understanding of
GNSS meaconing, with particular emphasis on integration
with standard operating procedures and pilot decision-mak-
ing processes.

**Supplementary Information** The online version contains supplementary material available at https://doi.org/10.1007/s10291-024-01804-6.

**Author contribution** M.H. derived the mathematical models, wrote the main manuscript text, and prepared figures. All authors reviewed the manuscript.

**Funding** Open access funding provided by École Nationale de l'Aviation Civile. The authors did not receive support from any organization for the submitted work. The authors have no relevant financial or non-financial interests to disclose.

**Data availability** No datasets were generated or analysed during the current study.

**Declarations**

**Conflict of interests** The authors declare no conflict of interests.
**Open Access** This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.

## References

Annex 17 - Aviation Security to the Convention on International Civil Aviation. ICAO

Bamberg T, Appel MM, and Meurer M (2018) Which GNSS Tracking Loop Configuration is Most Robust Against Spoofing? In: Proceedings of the ION GNSS+ 2018, Miami, FL, USA, Sept. 2018, pp. 3587–3595

Bamberg T, Konovaltsev A, Meurer M (2022) Developing a spoofer error envelope for tracking GNSS signals. J Inst Navig 69(3):navi.534

Berz G (2018) GNSS spoofing and aviation: an evolving relationship. Inside GNSS 25:54–59

Betz JW (2001) Effect of Partial-Band Interference on Receiver Estimation of C/N0: Theory. In: Proceedings of ION ITM-21, Long Beach, CA, USA, pp. 817–828

Coulon M, Chabory A, Garcia Peña A, Vezinet J, Macabiau C, Estival P, Ladoux P, and Roturier B (2020) Characterization of Meaconing and its Impact on GNSS Receivers. In: Proceedings of ION GNSS+ 2020, St. Louis, MO, USA, Sept. 2020, pp. 3713–3737

DIRCAM LFBO https://www.dircam.dsaef.defense.gouv.fr/images/Stories/Doc/MIAC1/miac1_toulouse_bagnac_lfbo.pdf

DO 229E (2016) Minimum Operational Performance Standards for Global Positioning System/Satellite-Based Augmentation System Airborne Equipment - 2.5.10.3.1. RTCA Inc

ED259 REV.A (2023) Minimum Operational Performance Standard for Dual-Frequency Multiconstellation Satellite-Based Augmentation System Airborne Equipment. EUROCAE, Sant-Denis, France, Standard

Garcia, M. (2024, February 3). FAA tells pilots to go analogue as GNSS spoofing incidents increase. Forbes. https://www.forbes.com/sites/marisagarcia/2024/02/03/faa-tells-pilots-to-go-analogue-as-gnss-spoofing-incidents-increase/

Geng J, Jiang E, Li G, Xin S, Wei N (2019) An improved hatch filter algorithm towards sub-meter positioning using only Android raw GNSS measurements without external augmentation corrections. Remote Sens 11(14):1679

Gps.gov: Official U.S. government information about the Global Positioning System (GPS) and related topics, https://www.gps.gov/technical/ps/

Hussong M, Ghizzo E, Milner C, Garcia-Pena A, Lesouple J, and Macabiau C (2023) Impact of meaconers on aircraft GNSS receivers during approaches. In: Proceedings of the 36th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2023), 2023, pp. 856–880

Hussong M, Ghizzo E, Milner C, Garcia-Pena A, and Lesouple J (2024) Characterization of the multipath situation under meaconing interference. In: Proceedings of the 37th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2024), 2024

Hussong M, Ghizzo E, Milner C, Garcia-Pena A, and Lesouple J (2024) Impact of onboard meaconer on aircraft receivers. In: Proceedings of the 37th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2024), 2024

Hwang PY, McGraw GA, Bader JR (1999) Enhanced differential GPS carrier-smoothed code processing using dual-frequency measurements. Navigation 46(2):127–137

International Telecommunication Union (2001) The Protection of Safety Services from Unwanted Emissions, Recommendation ITU-R SM.1535–0

International Telecommunication Union (2016) Radio Regulations: Articles, ITU.

Kaplan ED, Hegarty C (2017) Understanding GPS/GNSS: principles and applications. Artech house, Norwood

Matera ER (2022) A multipath and thermal noise joint error characterization and exploitation for low-cost GNSS PVT estimators in urban environment, Ph.D. dissertation, Toulouse INP

Peng C, Li H, and Lu M (2019) Research on the Responses of GNSS Tracking Loop to Intermediate Spoofing. In: Proceedings of ION GNSS+ 2019, Miami, FL, USA, Sept. 2019, pp. 943–952

Peña AJG, Macabiau C, Novella G, Julien O, Mabilleau M, and Durel P (2020) In-band RFI GNSS L5/E5a Mask Definition. In: Proceedings of ION GNSS+ 2020, St. Louis, MO, USA, Sept. 2020, pp. 188–205

Spilker JJ Jr, Axelrad P, Parkinson BW, Enge P (1996) Global Positioning System: theory and applications, vol I. American Institute of Aeronautics and Astronautics, Washinton

Steindl E, Dunkel W, Hornbostel A, Hättich C, and Remi P (2013) The impact of interference caused by GPS repeaters on GNSS receivers and services. European Navigation Conference

**Publisher's Note** Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Mathieu Hussong is a third-year PhD student in the Signal Processing and Navigation group at ENAC, the French National Civil Aviation University. He holds a master's degree in aeronautics from ENAC and an additional master's degree in aerospace systems specializing in navigation and telecommunications. His PhD research focuses on aircraft GNSS spoofing characterization and impact.

Emile Ghizzo is a third-year PhD student in the Signal Processing and Navigation group at ENAC, the French National Civil Aviation University. He holds a master's degree in aeronautics from ENAC and an additional master's degree in aerospace systems specializing in navigation and telecommunications. His PhD research focuses GNSS spoofing and jamming detection.

Carl Milner is an associate professor at the ENAC. He currently lectures on navigation science and technology including radio navigation aids, signal processing, positioning algorithms and GNSS for aviation. His research work addresses the design of integrity monitoring algorithms and performance for civil aviation applications including the use of GNSS augmentation systems both for current and future multi-constellation multi-frequency GNSS.

Axel Garcia-Pena is a researcher/lecturer with the SIGNAV research axis of the TELECOM team of ENAC (Ecole Nationale de l'Aviation Civile), Toulouse, France. He received his double engineer degree in 2006 in digital communications from SUPAERO and UPC, and his PhD in 2010 from the Department of Mathematics, Computer Science and Telecommunications of the INPT (Polytechnic National Institute of Toulouse), France.

<figure><img src="image_22.png" /></figure>