GNSS Threat Simulator for Urban Air Mobility Scenarios

Abstract

The safety-critical functions of autonomous drones heavily rely on Positioning, Navigation and Timing (PNT) information provided by Global Satellite Navigation Systems (GNSSs). This makes GNSS technology a critical element as the PNT solution can be affected by several threats, mostly in urban and suburban environments. In order to evaluate safe and reliable GNSS-based solutions in Urban Air Mobility (UAM) scenarios, a proper GNSS security impact simulator is needed. In this context, the present work details the design, implementation and testing of a GNSS Threat Simulator (GTS) capable of reproducing typical issues within a GNSS system in a UAM environment, such as satellite visibility (i.e., the actual visibility condition of the receiver’s antenna with respect to terrain and ground obstacle), multipath, electromagnetic interference, cyber threats (i.e., spoofing and jamming) and satellites failures. The GTS elaborates and modifies dual-frequency multi-constellation GNSS observables in order to inject the desired threats. The effectiveness of the proposed simulator has been demonstrated through both fast-time and real-time simulations, in which the GTS was used to validate a hybrid navigation unit installed on a drone operating in a representative urban scenario.

1. Introduction

The rapid advancement of drone technology has positioned unmanned aerial vehicles (UAVs) at the forefront of Urban Air Mobility (UAM) applications, promising to revolutionize transportation in congested urban environments. For drones to operate safely and effectively, they rely heavily on Positioning, Navigation, and Timing (PNT) information provided by Global Satellite Navigation Systems (GNSSs) [1]. This reliance on GNSS underscores its critical role in ensuring the operational safety and reliability of UAVs. However, various threats can compromise GNSS-based solutions, particularly in urban and suburban environments where signal degradation, interference, and cyber threats are prevalent [2,3].

Drones operating in urban settings face unique challenges, including multipath effects, where GNSS signals reflect off buildings and other structures, leading to inaccurate positioning. Multipath effects can cause positioning errors that significantly impact the navigational accuracy required for safe drone operations, particularly during critical phases such as takeoff and landing [4]. Additionally, electromagnetic (EM) interference, both unintentional and intentional, can disrupt GNSS signals, complicating the navigation processes for drones [5]. This interference poses a particular challenge in urban environments, where infrastructure can obstruct signals and increase the likelihood of navigation errors.

Moreover, cyber threats such as spoofing and jamming are increasingly recognized as significant risks for GNSS reliability in drone applications. Spoofing attacks involve transmitting false GNSS signals to mislead UAVs into incorrect positioning, while jamming can incapacitate GNSS receivers, leaving drones without critical navigation data [6,7]. These vulnerabilities underscore the necessity for robust and resilient navigation solutions in UAM, where safety and operational integrity are paramount.

Historically, the issue of navigation reliability has been addressed with techniques such as Receiver Autonomous Integrity Monitoring (RAIM), which was originally developed for aviation safety [8]. Over the years, several RAIM algorithms have been proposed and refined [9], including Fault Detection and Exclusion (FDE) techniques, which extend the basic RAIM concept to not only detect but also isolate the faulty measurement and recompute a corrected navigation solution. These methods laid the foundation for integrity monitoring in satellite navigation and were later expanded into Advanced RAIM (ARAIM), which incorporates multi-constellation and multi-frequency data, aligning well with the resilience goals of modern GNSS systems [10].

To effectively evaluate the safety and reliability of GNSS-based technologies for drones in UAM contexts, a comprehensive GNSS security impact simulator is essential. This paper details the design, implementation and testing of a GNSS Threat Simulator (GTS) designed specifically to replicate the unique challenges faced by drones in urban environments. The GTS is capable of simulating various critical threats, including satellite visibility conditions, considering the actual line of sight from the drone’s antenna in relation to urban obstacles, multipath effects, EM interference, and cyber threats such as spoofing and jamming, along with satellite failures. Moreover, GTS also aims to reproduce conditions under which RAIM and similar integrity monitoring algorithms may fail or be stressed, offering a realistic framework to test the limits and robustness of navigation fault detection strategies in challenging urban environments.

The GTS modifies and elaborates dual-frequency, multi-constellation (DFMC) GNSS observables to inject the desired threats into the simulation. DFMC GNSS systems provide users with signals from several satellite constellations and on at least two frequencies per constellation (e.g., L1/L5 for GPS or E1/E5a for Galileo), improving navigation accuracy, availability, and especially robustness against ionospheric errors and certain classes of interference. They enhance resilience against specific interferences, making them particularly suitable for urban drone operations [11].

The effectiveness of the proposed simulator has been validated through both fast-time and real-time simulations of a drone flying in an urban environment. These tests highlight the GTS’s capability to mimic real-world GNSS challenges specific to drone applications, offering valuable insights for evaluating GNSS solutions tailored for UAM.

In the following sections, after presenting the state-of-the-art concerning the simulation of effects and threats typical of urban and suburban environments, the high-level architecture of the GTS and the implemented algorithms are described. Finally, the results of both fast-time and real-time simulations are presented.

2. Related Work

This chapter contains an analysis of the literature and experimental data associated with characterizing the threats to a GNSS system in a UAM environment.

2.1. Low Visibility

Satellite visibility is a crucial aspect related to the use of GNSS for navigation means; in fact, satellite trilateration as well as integrity monitoring algorithms require a minimum number of satellite signals in Line-of-Sight (LOS) for a proper and reliable computation of the position, velocity and time solution in terms of WGS84 positions (i.e., latitude, longitude and altitude) and north-east-up velocities in time. Unfortunately, the proper functioning of a GNSS receiver requires uninterrupted signal reception, but radio wave signals cannot effectively penetrate obstacles such as mountains, water surfaces, soil, vegetation, or man-made structures like walls, dams, buildings, and bridges. Nonetheless, with reference to UAM application in the inner-city streets of urban areas lined with skyscrapers, the visibility of GNSS satellites is often further limited for extended periods or simply unavailable [12]. This so-called “signal outages situation” can also happen in forestry applications with dense canopy area and at high banking angles, when signal shading through the aircraft fuselage and wings can also happen in airborne applications [13]. As reported above, satellite visibility is completely dependent on the instantaneous geometrics (line-of-sight conditions) between each single satellite (transmitter) and the user (antenna receiver) based on both possible obstacles and the vehicle attitude.

2.2. Multipath

It is well known that signal propagation through the ionosphere and troposphere introduces a ranging error that translates to a receiver positioning error through the visible satellite geometry; furthermore, in the so-called urban environment, positioning availability and accuracy are adversely affected by receiver antenna obscuration and severe signal multipath. These phenomena are referred to as natural sources of interference.

Non-Line-of-Sight (NLOS) and multipath are accepted as being the dominant error sources in urban and suburban environments. As such, a number of methods have been developed to model signal reflection and their impact on positioning error. These methods can be either purely deterministic, which includes asymptotic methods such as ray-tracing [14,15], statistical [16], or hybrid methods [17]. A hybrid model based on ground vehicle measurement campaign data can be found in [18,19]. Regarding the simplification of the propagation environment, it has been found in [20] that simple canonical shapes representing building facades can be used to predict positioning error when wideband channel models are employed.

2.3. Electromagnetic Interference

Any electromagnetic source interacting with the GNSS signals is interfering with the process of estimating the propagation time.

The signal impinging the GNSS receiver antenna at a given frequency is the combination of the signals broadcast by all the satellites in view. GNSS Radio Frequency (RF) compatibility addresses the issue of intrasystem (from the same system) and intersystem (from other systems) interference. Signals belonging to the same satellite constellation are designed to be theoretically orthogonal (exploiting code or frequency diversity), and thus they can be separated by the receiver processing. However, such orthogonality is not perfect, and a residual power is always generating intrasystem interference. Intersystem interference is due to the fact that several GNSS systems share the same carriers, and again, some power from the signals of another system can disrupt the signal of interest. Several methodologies, such as the effective carrier-power-to-noise-density theory introduced in [21], are used during the design phase of the systems to ensure that a maximum acceptable level of intersystem interference is respected [22,23]. Due to the growing number of operational satellites in the new GNSS constellations, the number of satellites that are in view to a user receiver at the same time is growing as well; this implies increased intersystem interference.

Regarding the so-called artificial interferences, the intrinsic power weakness of GNSS signals affects the performance of any type of receiver, since all the communication systems transmitting at carrier frequencies close to the band of interest are potential sources of interference for a GNSS receiver, and even small leakages out of their allocated bandwidth can be threatening to GNSS signals. Even though unintentional Radio Frequency Interference (RFI) events are generally unpredictable, their presence has been experienced in the past and the increasing number of wireless communication infrastructures is increasing the probability that some power spillover from signal frequencies located near the GNSS bands could affect the performance of GNSS receivers in a certain region. The presence of interfering power can be due to several reasons, but the main effects are caused by harmonics or spurious components generated by intermodulation products in the communication transmitter [24].

Jamming refers to intentional transmission of RF energy to hinder a navigation service by masking GNSS signals with noise. The malicious objective of jammers is to cause the receiver to lose tracking and to impede signal reacquisition [25]. Although jamming is a well-known threat in military applications, it represents a growing threat for many GNSS-based applications. Systems involving safety and liability-critical operations (e.g., UAM) could potentially be heavily impaired by jamming attacks. The level of threat associated with jamming cannot be disregarded, considering that portable jammers are available online and can be purchased at a very low cost. Although the use of jammers is not legal, the interest of individuals willing to break the law may result in fraudulent actions toward GNSS-enabled systems. Several studies have addressed the characterization of commercial jammers and their effect on GNSS receivers, demonstrating that they can affect GPS receivers’ functionality even if located up to 9 km away [26,27].

In [28], the authors present a way through which the interference impact is computed in terms of Signal-to-Noise Ratio (SNR) gain. Different threat scenarios are simulated according to the nature of the interference, i.e., continuous or pulsed emissions.

2.4. Cyber Threats

The impact of cybersecurity threats in aviation is becoming increasingly significant. Indeed, the networks between aviation systems (both on-board and on the ground) are increasing, introducing new cyber vulnerabilities, which may also be exploited by means of novel and sophisticated attack vectors.

This is particularly true for GNSS because of [29] its centrality in an avionic architecture, which makes it an attractive target for attackers; its openness (at least for civil GNSS signal structure) makes it considerably vulnerable to cyberattacks; its weak transmitting and receiving power makes it susceptible to interferences, both natural and malicious. For example, technological progress and the availability of advanced Software Defined Radio (SDR) platforms are making the development of GNSS spoofers not only feasible but also affordable [30].

As a consequence of the aforementioned considerations, a GNSS cyberthreat simulator is an essential tool to characterize the impact of cyberattacks exploiting GNSS vulnerabilities and verify and validate GNSS-intrusion detection and mitigation systems.

Moreover, considering the multidimensional and multilevel nature of GNSS evaluations, the research groups are working according to different objectives. For example, in the case of spoofing, the main research initiatives consider [31]:

•

Spoofing implementation, which focuses on the analysis of the spoofing-attack mechanisms and serves as the basis for impact analysis and validation of anti-spoofing methods;

•

Spoofing impact assessment, which evaluates the spoofing effects on GNSS receivers and systems that depend on GNSS;

•

Spoofing detection and mitigation, which develops methods to reveal, classify and eliminate spoofing threats.

In [28], the authors compute the spoofing impact in terms of pseudo-range drifts and spoofing-to-signal power ratios.

2.5. Satellite Failures

When testing integrity monitoring algorithms and related failure detection and exclusion capabilities, it is necessary to inject fault modes on the ranging satellites so to assess the actual capabilities of the algorithms to challenge such failure situations, even if they have low likelihood but are still in the possible range of integrity risks that are usually assumed for critical aeronautical safety applications, such as take-off and landing.

Unfortunately, so far, systematically monitored fault modes have been experienced and recorded related only to GPS constellation, as reported in [32,33]. No or minimal information is available related to other GNSS constellations, such as GALILEO and BeiDou, which, indeed, have a relatively short operational life and would not allow for the gathering of reliable fault mode models and associated probabilities. This is also one of the key issues related to the deployment of the Advanced Receiver Autonomous Integrity Monitoring (A-RAIM) algorithm that requires known a priori constellation and satellite failure probabilities.

With reference to a generic GNSS/INS navigation unit, a summary of failure types and related mathematical models of failure is listed in [34]. Key root causes and a failure mode database derived from analyzing data from the UK Civil Aviation Authority GPS monitoring program up to 2007 is reported in [35].

Moreover, based on [33],

Table 1. Probability of failure types for GPS.

Fault Modes and Assigned Test Range for Position Bounding	Assigned Fault Rates as a Fraction of 10−5/Hour/Satellite
Ramp 0.03–1.00 m/s	10/15
Step 300–700 m	3/15
Acc. 0.00005–0.025 m/s2	2/15

reports the types of failures (i.e., step, ramp and acceleration) with related probability distributions that have to be considered for the position determination when testing integrity algorithms for blended GPS/INS PNT solutions.

Finally, it shall be noted that constellation-wide faults have been assumed in the fault model for some integrity algorithms (e.g., A-RAIM). This category of faults is mainly related to a wrong computation and/or communication of the Earth Orientation Parameters (EOPs) that are uploaded to the ranging satellites. Potential EOP faults can be separated into two general types. Type A faults are said to occur when EOPs are correctly computed, but the earth’s motion might have changed since uploading them to the ranging satellites, such as after a strong earthquake. Type B faults happen when EOPs used in the orbit determination process were badly computed and the situation is not detected by the master station of the ground segment prior to upload. The two types have similar impacts on GPS ephemerides and user positioning errors but can differ in magnitude and in the methods of detection. Here, we consider it reasonable to assume that while Type A EOP faults are common to any constellation, any Type B EOP fault is independent across GNSS constellations because even though observations used to generate EOPs are collected and used internationally, the raw data are processed by different organizations. Therefore, while Type B can be detected by some integrity algorithms, Type A shall be detected and excluded by the respective constellation control segments.

3. GNSS Threat Simulator Architecture

3.1. GTS Functional Context

The GTS is a detailed GNSS measurement error simulator to be integrated in a fast-time simulation environment and in real time for being used in a laboratory and flight environment to reproduce the typical GNSS threats to be injected in emulated/real GNSS receivers. Figure 1 shows the functional context in which this simulator can be employed, related key input/output data, depicted in red, and configuration parameters, depicted in black.

This module is capable of reproducing the main UAM GNSS threats (low visibility, multipath, EM interference, intentional/unintentional spoofing, jamming, failures) typically present in urban and suburban scenarios for DFMC GNSS receivers.

Inputs of the model are:

•

From the vehicle simulator (or a source of high-accuracy data in case of its use in flight), the vehicle’s true trajectory in terms of position, velocity, and attitude is provided;

•

From the actual or simulated GNSS receiver, the SNR of actual visible satellites, actual observables (i.e., pseudo-ranges), actual GNSS navigation mode (i.e., single/dual frequency, with/without Satellite-Based Augmentation System—SBAS service, etc.) and position, velocity, and time of actual visible satellites.

Outputs of the model are:

•

Modified number of visible satellites;

•

Signal-to-noise ratio corresponding to visible satellites;

•

Modified observables (i.e., pseudo-ranges) describing the modified measurements of the receiver due to the injected threats;

Configuration parameters of the model are:

•

Threat scenario to be injected among RF interference, cyber threat and satellite failures;

•

Receiver configuration, i.e., a set of parameters that identify the type and class of the GNSS receiver (e.g., GPS/SBAS, DFMC, number of constellations, update frequency, GPS Class I, Class II, etc.) and related receiver configurations in terms of mask angle, sensitivity, etc.;

•

Terrain and urban elevation data, i.e., elevation data from database (e.g., buildings, mountains) to be used for determining the mission environment.

Actually, based on the true vehicle position and velocity, and the given failure scenario that the user wants to inject, this module opportunely modifies the number of visible satellites and the key observables of the GNSS receiver in open sky (e.g., the pseudo-ranges and delta ranges of phase shift) so that the resulting data are affected by the desired urban threat or failure. The visible satellite information and related observables can come from a GNSS receiver simulator or even from the raw measurements available from a real GNSS receiver operating in open sky conditions, so to provide to the navigation processing algorithms a set of data that is modified considering the urban environment. When used in this modality, this module actually modifies the vehicle trajectory used by the terrain and urban elevation data so to insert the vehicle into a virtual urban environment with simulated surroundings that would induce the threat.

3.2. GTS High-Level Architecture

Figure 2 shows the first hierarchy level of the GNSS receiver simulator model. Input/output data of the simulator are depicted in red, configuration parameters are depicted in black, and internal data that are exchanged between each model are in blue.

The Satellite Visibility and Environment, using the available terrain and urban elevation data, computes the altitude above ground of the vehicle, the distances of the vehicle from the terrain and the other obstacles on the horizontal plane (with a given azimuth angle grid) and the satellites (with their azimuth and elevation angles) that are in LOS of the antenna considering the available terrain and urban elevation DB and assuming an ideal hemispherical radiation pattern. Finally, based on all of the above computations for each satellite, a specific visibility/multipath condition is declared (i.e., open sky, mountain or canyon) that would form the Satellite Scenario information to be used by the subsequent error models.

The RF Threat Injection module, based on the specified threat scenario, evaluates the interfering power at the output of the correlator due to several jamming waveforms and possible (unintentional) EM interferences.

SINR and Short-Range Multipath computes an estimation of the Signal-to-Interference-plus-Noise Ratio (SINR) for each received satellite in line-of-sight, using the antenna radiation pattern model, the information coming from the Satellite Visibility and Environment block, and the interfering power due to jamming and EM interferences coming from the RF Threat Injection block.

Long-Range Multipath, using information coming from the Satellite Visibility and Environment block, evaluates the possibility of having reflection from the ground, nearby obstacles and from the vehicle itself. It estimates some parameters that are used to compute the multipath variance portion for the satellites’ pseudo-ranges. Based on these parameters, the errors related to this effect on each satellite’s pseudo-range are generated.

Satellite Failure Injection defines the failure events to be included in the simulation and generates the required fictitious errors in the GNSS receiver observables. Each failure occurs at a specified simulation time and could end at a later time; failure effects are computed for both pseudo-range and delta-range measurements, but based on the current receiver mode, these effects could be different (e.g., in the case of SBAS, they could disappear after a few seconds).

The Cyber Threats Injection module, according to the threat scenario, provides fake pseudo-ranges to emulate possible spoofing attacks. The true trajectory of the vehicle is also needed for carrying out smart spoofing attacks that exploit dynamic techniques that virtually modify the behavior of the vehicle.

Finally, the Observables’ Composition module combines the input observables with the error contributions generated by each configured threat, as previously discussed. It receives the PR and DR from the GNSS receiver and adds to them the PR and DR deviations generated by each simulated threat. Note that the PR and DR from the GNSS receiver are assumed to be in ‘Open Sky’ conditions. For threats such as multipath and cyber-attacks, which only generate pseudorange modifications, the module also computes the corresponding delta range.

4. GNSS Threat Simulator Implementation

The GTS can be used in different ways, as follows:

•

For standalone fast-time evaluation of the effects that an urban/suburban environment and related threats can have on a (either simulated or real) GNSS receiver signals in open sky conditions (i.e., far away from terrain and human artefacts and without other threats);

•

For being integrated in a fast-time simulator that includes the model of a GNSS receiver that has no threat simulation (i.e., is a ‘standard’ avionic receiver simulator);

•

For being integrated in an HW-in-loop simulation with real-time emulation of a GNSS receiver on-board a piloted aircraft (either manned or unmanned) to perform a realistic simulation of the effects on the aircraft avionics that can be experienced during a flight in an urban or suburban environment;

•

For being integrated in a flight control computer on-board an actual aircraft flying in open sky conditions and having a real GNSS receiver that performs online measurements to be used for the aircraft navigation.

In any of the above usage modalities, the main aim of GTS is to allow the user to evaluate the effect of the urban environment on the PR/DR and SNR of an open sky receiver for supporting the development and preliminary validation (also in flight) of new navigation processing algorithms.

In the next sections, the algorithm details of the GTS modules depicted in Figure 2 will be given, taking advantage of the previous work made by the authors in [28,36], where preliminary implementation of some models has been described.

4.1. Satellite Visibility and Environment

The aim of this module is to check satellite visibility using a pre-defined elevation map of the terrain and of the human artefacts. Moreover, the module classifies the environment surrounding the vehicle to provide the characterization of the possible multipath severity that can affect each visible satellite.

As reported in [36], the module first converts the trajectory data into the ECEF reference system and calculates the required rotation matrix using standard conversion and rotation formulas. Then, for each satellite, visibility is verified by first computing the line-of-sight in the local tangential plane (NED with respect to the WGS-84 datum) and rotating it relative to the antenna base plate using the antenna base plate’s mounting angles. At this point, the visibility checks consist of verifying that the LOS elevation angle is greater than the minimum threshold value (mask angle) in the NED plane.

The next step involves defining the latitude and longitude checkpoints necessary to assess the multipath scenario according to the altitude map. For each satellite, we compute the minimum “elevation margin” (ΔH_min) between the LOS vector and the elevation profile and compare this value to a threshold ΔH_{Mount_thd} (set at the default value of 40 m). To ensure accurate elevation data management, we also integrate the EGM96 mean sea level altitude model. The checkpoints for LOS checks are evaluated along the LOS direction, using a parametric distance vector (i.e., from 50 m up to 4950 m with 100 m steps for a total of 50 evaluations). This criterion serves as the primary basis for determining the Mountain Scenario, in conjunction with an assessment of the current user height related to AGL and the satellite elevation (

Table 2. Scenario determination.

Scenario Assessment for the i-th Satellite	Check for All Checkpoints
NLOS	At least one surface elevation intersection occurs (ΔHmin < 0)
Mountains	(ΔHmin < ΔHMount_thd)
Canyon	For each checkpoint j belonging to a circle around the user position (currently at Rdeg = 35/10,000 deg distance in terms of latitude and longitude from the user): • Obstacle is identified if HDTEDj − Huser > ΔHCanyon_thd • For each identified obstacle i, a satellite is in the Canyon Scenario if (Elavationi < CanyonElevthd) and not (−90 + k180 < (Azimuthj − Azimuthi) < −90 + k180) where CanyonElevthd is 40 degrees.
Open Sky	None of the above scenarios

).

To determine the canyon scenario, we analyze a dedicated set of checkpoints surrounding the user’s position. In the current implementation, these checkpoints are evenly spaced in azimuth at a predefined distance from the user (i.e., at about 350 m). Each checkpoint is evaluated against the user’s height. If the height of a checkpoint exceeds the user’s height by a specified threshold ΔH_{Canyon_thd} (set at the default value of 20 m), it is classified as a reflective obstacle (Table 2). This obstacle will be treated as a source of signal replicas for satellite signals received from the opposite semicircle in terms of azimuth (see Figure 3).

The key changes in the current software with respect to the previous one reported in [36] are

•

The use of raster surface elevation maps derived from different data sources, such as the Digital Terrain Elevation Data (DTED) Level 1 with horizontal spatial resolution of about 90 m, the DSM Level 2 map with horizontal resolution of about 30 m, and a high-resolution map (0.2 arcsec about 6 m) extracted from Flight Gear and integrated with OpenStreetMap;

•

The evaluation of the surrounding scenario considering not only the terrain elevation but also human artefacts;

•

The storage in global memory blocks of the mean sea level elevation data matrix, as well as the EGM96 geoid altitude data matrix, initialized only at the simulation starting time. In this way, the algorithm no longer has the need to build a runtime 3-deg-by-3-deg map area tile on the basis of the actual aircraft position, allowing better performance for real-time applications.

4.2. Long-Range Multipath

The aim of this module is to address the effects of long-range multipath components, specifically reflections from obstacles far enough to induce relative delays, potentially leading to errors in pseudo-range estimates. This is achieved by utilizing scenario information from the previous model, each characterized by specific statistical parameters modeling the propagation paths. The defined environments are correlated with the classical simulation scenarios outlined in [37] (i.e., open sky, suburban, urban) and the corresponding simulation parameters are applied. Multipath delay effects are simulated by quantifying a standard deviation based on the model reported in [36,37] and summarized in

Table 3. Multipath error model and parameters for different scenarios.

Scenario	Model	Parameters
Canyon	${\sigma }_{RMS}\left(t\right)=\mathrm{m}\mathrm{a}\mathrm{x}\left\{K_1+K_2{\mathit{tan}}^{-1}\left[K_3\left(\alpha \left(t\right)-K_4\right)\right],\epsilon \right\}$	$K_1$$:6.3784$ $K_2$$:-3.5782$ $K_3$$:0.1725$ $K_4$: 29.075 $\epsilon :{10}^{-4}$ $\alpha \left(t\right)$: Elevation [deg]
Mountain	${\sigma }_{RMS}\left(t\right)=\mathrm{m}\mathrm{a}\mathrm{x}\left\{K_1+K_2\mathit{exp}\left[K_3\alpha \left(t\right)\right],\epsilon \right\}$	$K_1$$:0.55349$ $K_2$$:30.254$ $K_3$$:-0.23566$ $\epsilon$$:{10}^{-4}$ $\alpha \left(t\right)$: Elevation [deg]
Open Sky		$K_1$$:0.038818$ $K_2$$:2.7128$ $K_3$$:-0.21969$ $\epsilon$$:{10}^{-4}$ $\alpha \left(t\right)$: Elevation [deg]

.

For each satellite, the multipath model will compute the delay effect on the L1 carrier (assumed valid also for E1 and B1). This delay will then be used to build the pseudo-range error model for both standalone and SBAS mode (i.e., single-frequency mode), while for the dual-frequency mode, it is amplified with the factor

$$f_{DF}=\sqrt{{\displaystyle \frac{{f_1}^4+{f_2}^4}{{\left({f_1}^2-{f_2}^2\right)}^2}}},$$

(1)

where f₁ is the first frequency, and f₂ is the second one [38].

Figure 4 reports a schematic view that summarizes the computation of the effect of the long-range multipath described in this section.

4.3. SINR and Short-Range Multipath

The aim of this module is to introduce the effects due to the multipath short-range components, i.e., the reflections occurring close to the receiver position for which the relative delays are negligible with respect to the GNSS signal chirp period, using the current scenario information coming from the Satellite Visibility module. Indeed, even if short-range reflections produce a random fading of the signal strength, typically they have no effects on the pseudo-range delay evaluation. For this reason, they are accounted for by simulating the 3D gain pattern of the antenna installed on the vehicle and providing an attenuation value depending on the satellite’s relative position (with respect to the vehicle) and the attitude of the vehicle itself.

Specifically, the SNR gain is computed as [36,37,39]:

$${MS}_{dB}=10{\log }_{10}\left({\left|g_0\left(t\right)\right|}^{2}E\left[{\left|a_c\left(t\right)\right|}^2|P_0\left(t\right)\right]\right)$$

(2)

where $g_0\left(t\right)$ is assumed to be the antenna magnitude gain, such that ${\left|g_0\left(t\right)\right|}^2$ is the antenna power gain along the instantaneous direction of the satellite with respect to the vehicle coordinate system, and:

$$E\left[{\left|a_c\left(t\right)\right|}^2|P_0\left(t\right)\right]=\left[{\displaystyle \frac{1}{R\left(t\right)}}+1\right]{\left[1-A\left(t\right)\right]}^2+A^2\left(t\right)P_0\left(t\right)$$

(3)

where the parameter $P_0\left(t\right)$ represents the power of the signal shadowing components modeled with log-normal distribution ${10}^{X_P/10}$, with ${\mathsf{\mu }}_P$ and ${\sigma }_P$ being, respectively, the mean and variance of the normal distribution $X_P$, $A\left(t\right)$, the probability of shadows, and $R\left(t\right)$, the Rice factor, all defined as functions of the current scenario (i.e., Open Sky, Mountain or Canyon). The parameters actually used by the current simulation model for typical scenarios are reported in

Table 4. Short-range multipath algorithm parameters.

Scenario	Elevation [deg]	Shadowing Probability $\mathit{A}\left(\mathit{t}\right)$	Rice Factor [dB] $\mathit{R}\left(\mathit{t}\right)$	Shadow Component [dB]
				${\mathbf{\mu }}_{\mathit{P}}$	${\mathit{\sigma }}_{\mathit{P}}$
Open Sky	15	0	6	N/A
	25	0	10.3
	35	0	12
	45	0	10.4
	55	0	9
Mountains	15	0.77	4.7	−12.6	4.8
	25	0.59	4.7	−6	3.5
	35	0.54	10.7	−7.6	3.2
	45	0.43	4	−7.2	3.2
	55	0.35	11.8	−7.7	2.6
Canyon	15	0.97	9	−15.2	5.2
	25	0.79	3.2	−12.1	6.3
	35	0.60	4.8	−4.4	5.1
	45	0.56	8.5	−3	2.7
	55	0.30	6	−3	2.7

.

Figure 5 reports a schematic view that summarizes the computation of the SNR described in this section.

4.4. RF Threats Injection

This module aims at injecting RFI threats by simulating intentional/unintentional interferences to the target GNSS receiver. The interference impact is computed in terms of SNR gain. Different threat scenarios are simulated according to the nature of the interference: continuous RFI, such as jamming signals emitted by hostile agents and intersystem interferences produced by operational satellites in other GNSS constellations; pulsed RFI, related to unintentional RF interferences due to harmonics or spurious components coming from out-of-band communication systems (e.g., transponders, Very High Frequency—VHF radios).

The SNR gain is evaluated as the composition of three distinct contributions, i.e., continuous RFI (e.g., jamming, intersystem interferences), pulsed RFI (e.g., transponders, VHF radios) and cyber threats (e.g., spoofing). In detail, for the $i$-th satellite operating at the frequency $f$, the overall SNR gain is computed using the following expression,

$$G_{\mathrm{R}\mathrm{F}\mathrm{I}}^{\left(i\right)}\left(f\right)\triangleq {\displaystyle \frac{1-\beta }{1+{\mathrm{I}\mathrm{N}\mathrm{R}}_{\mathrm{c}}\left(f\right)+{\mathrm{I}\mathrm{N}\mathrm{R}}_{\mathrm{p}}\left(f,\beta \right)+{\mathrm{S}\mathrm{P}\mathrm{N}\mathrm{R}}_i\left(f\right)}},$$

(4)

where

$${\mathrm{I}\mathrm{N}\mathrm{R}}_{\mathrm{c}}\left(f\right)\triangleq {\displaystyle \frac{\mathrm{S}\mathrm{N}{\mathrm{R}}_{\mathrm{m}\mathrm{a}\mathrm{x}}\left(f\right)}{{\mathrm{S}\mathrm{I}\mathrm{R}}_{\mathrm{c}}\left(f\right)}},$$

(5)

$${\mathrm{I}\mathrm{N}\mathrm{R}}_{\mathrm{p}}\left(f,\beta \right)\triangleq {\displaystyle \frac{1}{\beta }}\sum _{n=1}^{N_{\mathrm{p}}}{\displaystyle \frac{\mathrm{S}\mathrm{N}{\mathrm{R}}_{\mathrm{m}\mathrm{a}\mathrm{x}}\left(f\right)}{{\mathrm{S}\mathrm{I}\mathrm{R}}_{\mathrm{p}}^{\left(n\right)}\left(f\right)}}{d}_n,$$

(6)

$${\mathrm{S}\mathrm{P}\mathrm{N}\mathrm{R}}_i\left(f\right)\triangleq \mathrm{S}\mathrm{N}{\mathrm{R}}_{\mathrm{i}}\left(f\right){\mathrm{S}\mathrm{S}\mathrm{R}}_i\left(f\right),$$

(7)

in which $\beta$ represents the so-called blanker duty-cycle, often used on GNSS receivers in order to mitigate pulsed interferences; $SN{R}_{max}\left(f\right)$ represents the maximum signal-to-noise power ratio, i.e., $SN{R}_{max}\left(f\right)\triangleq \underset{i}{\mathit{max}}SN{R}_i\left(f\right)$; ${SIR}_c\left(f\right)$ stands for the overall signal-to-continuous interference power ratio; ${SIR}_p^{\left(n\right)}\left(f\right)$ and $d_n$, respectively, correspond to the signal-to-pulsed interference power ratio and the duty cycle of the $n$-th pulsed interference, for all $n\in \left\{\mathrm{1,2},\dots ,N_{\mathrm{p}}\right\}$; ${SSR}_i\left(f\right)$ refers to the spoofing-to-signal power ratio of the $i$-th satellite, evaluated according to the model described in Section 4.5. Further details are available in [28].

4.5. Cyber Threat Injection

This module aims at injecting cyber threats by simulating spoofing cyberattacks to the target GNSS receiver. The spoofing impact is computed in terms of pseudo-range-drifts and spoofing-to-signal ratios. Different threat scenarios are simulated according to the capabilities of the spoofer in regard to the prediction of legitimate navigation bits and signal power management.

For the computation of the pseudorange-drift, we extend the model available in [31]. In detail, a measurement of the pseudorange ${\rho }_{i,r}\left(t\right)$ between a satellite $i$ and a receiver $r$ at time $t$ may be modeled as,

$${\rho }_{i,r}\left(t\right)=c{\tau }_{i,r}+c\left[\left(t+\delta t_r\right)-\left(t+{\delta t}_i\right)\right]=c{\tau }_{i,r}+c\left(\delta t_r-{\delta t}_i\right),$$

(8)

where $c$ is the speed of light; ${\tau }_{i,r}$ is the signal transmission delay between $i$ and $r$; $\delta t_r$ is the receiver clock offset from the GNSS time scale; ${\delta t}_i$ is the clock offset of the satellite from the GNSS time scale.

For an authentic signal (not spoofed) from $i$, the signal delay ${\tau }_{i,r}^{\left(\mathrm{a}\right)}$ is modeled as,

$${\tau }_{i,r}^{\left(\mathrm{a}\right)}={\displaystyle \frac{d_{i,r}}{c}}+I_{i,r}+T_{i,r},$$

(9)

where $d_{i,r}$, $I_{i,r}$ and $T_{i,r}$ are, respectively, the geometric range, the ionospheric delay and the tropospheric delay between $i$ and $r$. Then, the authentic pseudorange ${\rho }_{i,r}^{\left(\mathrm{a}\right)}\left(t\right)$ is modeled as,

$${\tau }_{i,r}^{\left(\mathrm{a}\right)}=d_{i,r}+c\left(\delta t_r-{\delta t}_i\right)+c{I}_{i,r}+c{T}_{i,r}.$$

(10)

For a spoofed signal related to the satellite $i$ and a receiver $r$ by means of the spoofer $s$, the signal delay ${\tau }_{i,r}^{\left(\mathrm{s}\right)}$ is modeled as,

$${\tau }_{i,r}^{\left(\mathrm{s}\right)}={\displaystyle \frac{d_{i,s}+d_{s,r}}{c}}+I_{i,s}+T_{i,s}+{\mathsf{\Delta }t}_{s,\mathrm{p}\mathrm{r}\mathrm{o}\mathrm{c}}^{\left(i\right)}+{\mathsf{\Delta }t}_{s,\mathrm{c}\mathrm{t}\mathrm{r}\mathrm{l}}^{\left(i\right)},$$

(11)

where $d_{i,s}$ is the geometric range between $i$ and $s,$  $d_{s,r}$ is the geometric range between $s$ and $r$, $I_{i,s}$ is the ionospheric delay between $i$ and $s$; $T_{i,s}$ is the tropospheric delay between $i$ and $s$; ${\mathsf{\Delta }t}_{s,\mathrm{p}\mathrm{r}\mathrm{o}\mathrm{c}}^{\left(i\right)}$ is the signal-processing delay of $s$ for the signal of satellite $i$; ${\mathsf{\Delta }t}_{s,\mathrm{c}\mathrm{t}\mathrm{r}\mathrm{l}}^{\left(i\right)}$ is the signal-controlled delay of $s$ for the signal of satellite $i$.

Assuming that atmospheric delays are the same for the receiver and the spoofer, it can be demonstrated that [28]

$${\tau }_{i,r}^{\left(\mathrm{s}\right)}={\tau }_{i,r}^{\left(\mathrm{a}\right)}+{\mathsf{\Delta }t}_s^{\left(i,r\right)},$$

(12)

with

$${\mathsf{\Delta }t}_s^{\left(i,r\right)}={\displaystyle \frac{d_{i,s}+d_{s,r}-d_{i,r}}{c}}+{\mathsf{\Delta }t}_{s,\mathrm{p}\mathrm{r}\mathrm{o}\mathrm{c}}^{\left(i\right)}+{\mathsf{\Delta }t}_{s,\mathrm{c}\mathrm{t}\mathrm{r}\mathrm{l}}^{\left(i\right)}.$$

(13)

The term ${\mathsf{\Delta }t}_s^{\left(i,r\right)}$ represents the spoofing-signal delay of the spoofer $s$ for the satellite $i$ and the target receiver $r$, i.e., the additional signal delay introduced by the $s$ at the target $r$ for the signal of $i$. In general, we may assume that ${\mathsf{\Delta }t}_{s,\mathrm{p}\mathrm{r}\mathrm{o}\mathrm{c}}^{\left(i\right)}={\mathsf{\Delta }t}_{s,\mathrm{c}\mathrm{t}\mathrm{r}\mathrm{l}}^{\left(i\right)}$, i.e., that the signal-processing delay of the spoofer $s$ is the same for all satellites and does not depend on $i$. Moreover, the spoofer $s$ may exhibit a prediction capability of the navigation data bits of the authentic signal. Thus, this capability introduces a further offset ${\delta t}_{s,\mathrm{p}\mathrm{r}\mathrm{e}\mathrm{d}}$ that should be considered in the spoofed pseudorange. Based on the aforementioned considerations, the spoofed pseudorange ${\rho }_{i,r}^{\left(\mathrm{s}\right)}\left(t\right)$ between $i$ and $r$ by means of $s$ may be modeled as,

$$\begin{array}{ll}\hfill {\rho }_{i,r}^{\left(s\right)}\left(t\right)& =c{\tau }_{i,r}^{\left(s\right)}+c\left(\left(t+\delta t_r\right)-\left(t+{\delta t}_{s,\mathrm{p}\mathrm{r}\mathrm{e}\mathrm{d}}+{\delta t}_i\right)\right)\hfill \\ & ={\rho }_{i,r}^{\left(\mathrm{a}\right)}\left(t\right)+c{\mathsf{\Delta }t}_s^{\left(i,r\right)}-c{\delta t}_{s,\mathrm{p}\mathrm{r}\mathrm{e}\mathrm{d}}.\hfill \end{array}$$

(14)

Considering the expression of ${\mathsf{\Delta }t}_s^{\left(i,r\right)}$ in (13), Equation (14) models ${\rho }_{i,r}^{\left(s\right)}$ as the following function,

$${\rho }_{i,r}^{\left(s\right)}={\rho }_{i,r}^{\left(s\right)}\left({\rho }_{i,r}^{\left(\mathrm{a}\right)},d_{i,s},d_{s,r},d_{i,r},{\mathsf{\Delta }t}_{s,\mathrm{p}\mathrm{r}\mathrm{o}\mathrm{c}}^{\left(i\right)},{\mathsf{\Delta }t}_{s,\mathrm{c}\mathrm{t}\mathrm{r}\mathrm{l}}^{\left(i\right)},{\delta t}_{s,\mathrm{p}\mathrm{r}\mathrm{e}\mathrm{d}}\right).$$

(15)

In the case of meaconing, the spoofer replays a recorded signal, i.e., it records an authentic GNSS signal and retransmits the recorded authentic signal to a target receiver to be spoofed. Thus, for meaconing, ${\delta t}_{s,\mathrm{p}\mathrm{r}\mathrm{e}\mathrm{d}}=0$. Moreover, a spoofed pseudorange (i.e., pseudorange-drift) is actually produced for satellite $i$ only if the spoofing-signal delay ${\mathsf{\Delta }t}_s^{\left(i,r\right)}-{\delta t}_{s,\mathrm{p}\mathrm{r}\mathrm{e}\mathrm{d}}$ is less than the chip period of $i$.

Strictly speaking, the spoofing model (14) holds in case the target receiver is in single-frequency mode. Instead, if the target receiver is in multi-frequency mode, the following equation is applied,

$${\rho }_{i,r}^{\left(s\right)}={\displaystyle \frac{1}{1-\gamma }}{\rho }_{i,r}^{\left(s,\mathrm{L}5\right)}-{\displaystyle \frac{\gamma }{1-\gamma }}{\rho }_{i,r}^{\left(s,\mathrm{L}1\right)},$$

(16)

where ${\rho }_{i,r}^{\left(s,\mathrm{L}5\right)}$ and ${\rho }_{i,r}^{\left(s,\mathrm{L}1\right)}$ are, respectively, the spoofed pseudoranges for L5 and L1 frequencies according to the spoofing model (14), and $\gamma ={\left({\displaystyle \frac{f_{\mathrm{L}1}}{f_{\mathrm{L}5}}}\right)}^2$. Further details are available in [28].

4.6. Satellite Failure Injection

The primary function of this module is to simulate satellite and constellation failures by introducing a specific bias time history into the pseudo-range and delta-range measurements.

For each failure scenario, the module applies an increment to the pseudo-range and delta-range at each time step, but only if the current GPS time falls within the designated failure interval [t_0i, t_fi]. This allows the module to inject the failure during the specified period.

The module requires storing the cumulative value of previous biases. Using these increments, it generates the failure signals for both the pseudo-range (PR_Fail) and delta-range (DR_Fail) until the time reaches t_fi:

$${PR\_Fail}_i=\left(A_i·0.5·{\left(t-t_{0i}\right)}^2+R_i·\left(t-t_{0i}\right)+M_i\right)·u\left(t-t_{0i}\right)$$

(17)

$${DR\_Fail}_i=\left(A_i·\left(t-t_{0i}\right)+R_i\right)·u\left(t-t_{0i}\right)+M_i·\delta \left(t-t_{0i}\right)$$

(18)

where A_i, R_i, and M_i are the magnitudes of the acceleration, ramp and step failures (for each satellite index i, only one of these quantities is different from 0), u(.) is the step function and δ(.) is the pulse function. It is worth noting that when a constellation failure is specified, a ramp failure is generated for any of the satellites within that constellation.

Finally, the module can also ‘force’ a failure in the SBAS-received signal so that the GNSS receiver is forced to not use SBAS-corrected PR and the related integrity-monitoring algorithm.

5. Results

The GTS module has been integrated in both fast-time and real-time simulation environments to validate a Hybrid Navigation Unit (HNU) [40,41] for UAM applications, leveraging a dual-frequency, multi-constellation GNSS model [36] and a drone dynamic model. In these demonstrations, the GTS module was used to inject typical urban and suburban environment effects into the GNSS measurements in order to test the HNU.

The following reports both the fast-time and real-time test results of the GTS’ functionalities.

5.1. GTS Fast-Time Simulation

In this section, a dedicated verification activity is presented to demonstrate the correct functioning of the GTS module. As described in detail in Section 4, the module is designed to emulate typical urban and suburban GNSS signal degradation. The following analysis aims to confirm that the module behaves as expected, ensuring its reliability for use in testing navigation algorithms under realistic conditions.

The fast-time simulation results of the RF Threat and the Cyber Threat modules are discussed in [28]. This paper extends the latter work by discussing the fast-time simulation results of the other modules of the GTS.

5.1.1. Satellite Visibility and Environment

To assess the impact of different elevation map formats on GNSS signal simulation, a dedicated test was carried out in two main phases. The objective was twofold: first, to compare the level of urban detail captured by each elevation map format; second, to evaluate the differences in satellite visibility and multipath characterization resulting from the use of each format.

The test focused on a representative area located in the historical center of Rome, covering approximately 15 × 15 km. This area was selected due to its dense urban morphology, which poses significant challenges for GNSS signal propagation and therefore provides a meaningful scenario for performance comparison.

Figure 6 illustrates both the entire test area and a zoomed-in view of its central region, as extracted from Google Earth. The analysis aimed to determine how accurately each elevation data source captures the structural complexity of an urban environment and how this influences the simulated GNSS measurement in such an environment.

Figure 7 presents the elevation maps of the entire test area as derived from three different sources: DTED Level 1, DSM Level 2, and Flight Gear/Open Street Map. The elevation values, expressed in meters, range from 0 to 150 m above sea level.

A more detailed comparison is shown in Figure 8 and Figure 9, which focus on two representative sub-areas within the central tile of the map, namely “Palazzaccio,” and “Lungo Tevere”. These areas were selected due to their diverse urban morphology and relevance in evaluating elevation data accuracy.

The visual analysis of these figures clearly highlights the limitations of DSM Level 2 and, to a greater extent, DTED Level 1 in accurately capturing the vertical structure of buildings. This inadequacy becomes particularly critical in scenarios involving low-altitude flight operations (≤500 m AGL), where precise modeling of the urban environment is essential for reliable satellite visibility and multipath prediction.

Based on the analysis presented above, it is evident that the elevation data of human artefacts in dense urban environments is accurately represented only when using high-resolution 3D building models, such as those available through the Flight Gear simulator integrated with Open Street Map data.

However, for GNSS threat simulation purposes, it is essential to assess the practical implications of using different elevation data sources on the final simulation outcomes.

To this end, numerical simulation tests were conducted to evaluate the impact of each elevation data source on the output of the satellite visibility simulator. One of the test scenarios consisted of a low-altitude (125 m, mean sea level), low-speed (25 knots) flight mission over the previously defined urban test area. The corresponding flight trajectory, in terms of latitude and longitude, is depicted in Figure 10.

In Figure 11, the time behavior along the given test trajectory of the mountain scenario of satellite #8 of the Galileo constellation is shown. The upper graph shows the margin in meters of the satellite LOS vector from the obstacles as computed using different terrain databases. The lower graph is simply a flag (0 or 48 value) that tells when satellite #8 is declared in a multipath condition that has been identified as ‘Mountain’ (i.e., in between a full canyon and open sky); see Section 4.1

The comparison among the results obtained using DTED Level 1, DSM Level 2, and Flight Gear combined with OpenStreetMap data clearly indicates that only the latter is capable of accurately reproducing the effects of building elevation on satellite visibility. While DSM Level 2 offers an intermediate level of accuracy and, on average, tends to follow the behavior of the detailed model, DTED Level 1 often produces inaccurate results, particularly in scenarios with significant urban complexity.

5.1.2. Long-Range Multipath

Long-range multipath effects on the pseudorange strictly depend on the current scenario evaluated by the satellite visibility function.

Figure 12 illustrates the impact of transitioning from an open-sky environment to a mountain scenario on the pseudorange measurements of the Galileo satellite Pseudorandom Noise (PRN) #12. As shown, the introduction of terrain obstructions leads to a significant increase in the pseudorange error. Conversely, when the scenario returns to open-sky conditions, the pseudorange error correspondingly decreases, highlighting the effects of GTS on GNSS measurements.

5.1.3. Short-Range Multipath

Short-range multipath effects on the SNR strictly depend on the current scenario evaluated by the satellite visibility function.

Figure 13 illustrates the impact of transitioning from an open-sky environment to a mountain scenario on the SNR, both E1 and E5a bands, associated to the Galileo satellite PRN #12. As shown, the introduction of terrain obstructions leads to a significant variation in SNR. Conversely, when the scenario returns to open-sky conditions, the SNR returns to a normal value, highlighting the effects of GTS on GNSS measurements.

5.2. GTS Real-Time Simulation

In this section, the real-time hardware in-the-loop verification architecture and some results concerning the executed tests are reported.

5.2.1. Real-Time Hardware In-the-Loop Test Rig

Figure 14 illustrates the laboratory test rig configured for hardware-in-the-loop (HIL) real-time simulation (RTS). The GTS was employed to validate a Hybrid Navigation Unit (HNU) [40,41], leveraging a GNSS functional simulator [36]. The GTS captures GNSS observables and modifies them to simulate typical effects encountered in urban and suburban environments, providing these as inputs to the navigation algorithm.

All modules are executed on a PC-104 platform, which interfaces with an HIL simulator that reproduces a six degrees-of-freedom (6-DOF) model of a drone. The GTS runs on the payload hardware, as the outputs of the HNU are not fed back into the drone’s autopilot (AP) or flight management system (FMS) functionalities.

5.2.2. Real-Time Simulation Results

The simulated scenario consists of a photogrammetry mission over the urban area of Rome, carried out through a fully autonomous drone flight (see Figure 15). After take-off, the drone climbs at a rate of 350 ft/min to a QFE-based altitude of 160 ft (i.e., barometric height relative to the airfield elevation). At waypoint C, it enters level flight, maintaining a ground speed of 65 knots along the predefined flight plan.

Figure 16 shows the number of visible satellites as a result of the ephemeris generated by the GNSS constellation (in this case, only for GPS and GAL) and the (reduced) number of satellites available for HNU after GTS applied the terrain and obstacle visibility threats.

Figure 17 shows the multipath scenario associated with the simulated flight, demonstrating the capability of the GTS to inject visibility threats in the HNU in real time.

From the figures above, it can be observed that, apart from the initial phase when the vehicle is on the ground (up to approximately 13:25 GPS time), most visibility and multipath issues occur between waypoints E and H, as the vehicle passes in close proximity to a hill.

The same test was repeated setting the GTS to simulate a static spoofing attack carried out from the roof of a building located near waypoint I (see Figure 15). The spoofer was activated when the vehicle approached the spoofing location, approximately 4.5 km away. In this scenario, the GTS injected a meaconing attack with a spoofing-to-signal power ratio of about 45 dB, occurring between 980 and 1150 s from the start of the simulation. The spoofed position was fixed in close proximity to the aircraft’s actual position at the time of the spoofing onset. Figure 18 shows the output of the GTS on the GPS satellite ID#1 in terms of (from the top to bottom) L1 SNR comparison with GNSS output, L5 SNR comparison with GNSS output, difference between the un-spoofed GNSS and spoofed GTS pseudorange, and difference between the un-spoofed GNSS and spoofed GTS delta range.

From the above figure, the spoofing attack is evident, whereas the SNR on L1/L5 first drops (the spoofer is disturbing the HNU GNSS RF receiver) and then rises up when the HNU GNSS receiver locks on the spoofer, as shown by the difference between the un-spoofed and spoofed pseudoranges and the outliers on the delta ranges. It is worth noting that the difference between the spoofed and un-spoofed pseudorange is due to the clock shift related to the delay of the re-transmission process and to the different receiver positions when the spoofer is activated, which is indeed a few tens of meters.

6. Discussion

The presented results confirm the GTS as a powerful and flexible tool for simulating and injecting a wide range of GNSS threats under urban operational conditions, with a focus on UAM. By analyzing both visibility reduction and spoofing scenarios, the GTS demonstrates its effectiveness in reproducing realistic interference patterns, thus enabling robust performance testing of navigation algorithms and avionics systems. In this regard, the GTS could also support the validation of data-driven spoofing detection methods recently proposed in the literature, such as deep learning-based classifiers [42].

Compared to traditional RF-based simulators, especially those relying on ray-tracing techniques, the GTS offers substantial advantages in terms of computational efficiency and cost-effectiveness. Ray-tracing-based RF simulators typically require significant computational resources due to their detailed electromagnetic modeling and involve expensive hardware for RF signal generation and capture. In contrast, the GTS operates entirely at the GNSS observables level (pseudorange, delta range), enabling faster simulation cycles and seamless integration with software-based GNSS processing chains, without the need for physical RF front ends.

Beyond supporting technical validation, the GTS can provide valuable theoretical insights for regulatory development and standardization in the UAM domain. For instance, it may support stakeholders in defining essential performance metrics such as alert limits, integrity risk, and time-to-alert. Moreover, by enabling the simulation of advanced threat scenarios in realistic urban environments, the GTS can aid in the evaluation of integrity monitoring strategies such as RAIM, ARAIM, and DFMC-based FDE. Recent works have also highlighted the role of machine learning-based approaches for environment-aware GNSS integrity monitoring in UAM scenarios [43], which could be further explored using the GTS framework.

The GTS’s ability to model diverse threats and simulate them both in fast-time and real-time makes it particularly suitable for iterative testing, early algorithm design, and hardware-in-the-loop validation. Thanks to its modular architecture and use of open-source tools like Flight Gear and Open Street Map, the GTS remains both highly customizable and accessible for academic and industrial users alike.

These features establish the GTS not only as a practical testbed for validating GNSS resilience in urban drone operations but also as a potential enabler for drafting the Minimum Operational Performance Standards for UAM GNSS receivers, standards which are currently not yet defined.

Nevertheless, some limitations of the GTS should be acknowledged. While the system effectively simulates GNSS threats at the observables level, full integration into a certified avionics validation chain still requires extensive hardware-in-the-loop (HIL) testing under controlled laboratory conditions. These tests are essential to assessing the impact of simulated threats on real GNSS receivers and navigation systems, considering hardware-specific effects such as RF front-end distortions, signal tracking dynamics, and time-synchronization delays.

7. Conclusions

This paper presented the design, implementation, and validation of a GNSS threat simulator aimed at enhancing the safety and robustness evaluation of GNSS-based navigation solutions in UAM contexts. The GTS is capable of reproducing a wide range of environmental and cyber threats, such as satellite visibility obstructions, multipath, electromagnetic interference, spoofing, and jamming, that typically affect GNSS signal integrity in urban and suburban environments. The simulator was integrated within both fast-time and real-time testing frameworks and applied to validate a hybrid navigation unit designed for autonomous drone operations.

Results from fast-time simulations highlighted the importance of using high-resolution elevation data, such as those derived from Flight Gear and OpenStreetMap, for accurately modeling urban morphology and predicting GNSS visibility and multipath effects. Simulations with lower-resolution data (e.g., DTED Level 1) exhibited significant inaccuracies, underscoring the critical role of detailed 3D models for realistic threat injection. Moreover, the impact of environmental transitions on GNSS observables, such as pseudorange and signal-to-noise ratio, was clearly demonstrated.

Real-time hardware-in-the-loop simulations further validated the GTS’s effectiveness in dynamically degrading GNSS signals during actual flight missions. The simulator successfully introduced complex urban threats in real-time, including a spoofing attack scenario, where the GNSS receiver behavior clearly reflected spoofing effects on both SNR and pseudorange measurements. These results confirm the GTS as a reliable and versatile tool for stress-testing navigation systems in realistic urban scenarios. Future work will include additional hardware-in-the-loop testing campaigns, with the objective of fully assessing the GTS for supporting the in-flight validation of navigation algorithms at higher operational altitudes. In this context, the GTS will be employed to replicate urban and suburban environmental effects on GNSS observables, enabling a safe and realistic assessment of navigation system performance during flight operations. Furthermore, the GTS will be extended with advanced models for emulating smart spoofing scenarios, including control laws based on the real trajectory of the GNSS receiver; the physical layer for both jamming and spoofing attacks.