The recent news of clock failures on both the European Union’s Galileo and IRNSS satellites (Indian Regional Navigation Satellite System) shows that launching and commissioning new satellite navigation constellations is not a simple business. The news, however, does make it worthwhile asking whether clock failures could have any implications for GNSS users — especially professional users such as in the surveying or GIS industries.

The short answer is that satellite clock failures should not directly impact any users of the Galileo or IRNSS satellites. In the event of all clocks (primary and backup) failing on a single GNSS satellite, the satellite becomes unusable.

What happened?
Six Passive Hydrogen Maser (PHM) clocks have failed on Galileo satellites, but the good news is that this was almost exclusively on the In-Orbit Validation satellites. In a statement, The European Space Agency (ESA) said the failure was “related to the fact that when some healthy [hydrogen maser] clocks are turned off for long periods, they do not restart due to a change in clock characteristics.”

ESA has since been able to remotely restart one of the failed PHM clocks, leaving only five of the PHM clocks offline.

Meanwhile, four RAFS clocks (Rubidium Atomic Frequency Standard) have failed on Galileo satellites, all of them on Full Operational Capability satellites. The ESA also revealed that the rubidium-based clock failures “all seem to have a consistent signature, linked to probable short circuits and possibly a particular test procedure performed on the ground.”

India has had the same experience with RAFS clocks, but with much more severe consequences; it was announced that three clocks (one primary and two backups) onboard satellite IRNSS 1a had failed.

What is the impact of these failures?
Whilst a total of nine clocks have failed on Galileo satellites, no more than two have failed in a single Galileo satellite. Providing each satellite has at least one clock remaining, they can continue to function as normal. Therefore, there has been no direct impact on the performance or stability of Galileo’s GNSS signals.

However, the failure of all three RAFS clocks on the IRNSS satellite has left the satellite totally unusable and it will have to be replaced. India already plans to do this later in 2017.

Atomic Clock Technology. The basics
Each Galileo satellite is equipped with four clocks. Two are RAFS clocks like those found in GPS and GLONASS satellites. The other two are the more accurate (and much more complex) Passive Hydrogen Maser, PHM (see I and II) clocks that offer the Galileo constellation increased timing accuracy. Whilst only one clock in working order is required for each satellite, a minimum of two is required to provide redundancy.

A PHM clock uses the properties of the hydrogen atom to serve as a frequency reference. It is a complex and high-cost device, but has a significantly higher precision than the Rubidium clock. Typically, PHM clocks are expected to have a 20-year lifetime.

An RAFS clock uses the transition of Rubidium 87 atoms as a frequency reference. RAFS clocks are less costly and more compact than PHM clocks, and have an expected lifetime of 12 years or more.

Receiver Level Protection
GNSS receivers used in surveying applications need to be able to detect segment errors or failures at satellite level. Whilst they are less frequent, they do happen. No GNSS system is immune to software or hardware failures. Manufacturers of GNSS chipsets and location-aware devices need to know how their equipment will respond in the event of such an event occurring.

Absolutely trusting integrity of all received GNSS signals without implementing checks can be dangerous — it can leave the receiver open to being affected by a GNSS segment error and can also leave the receiver or system susceptible to deliberate spoofing attacks too (a growing threat to GNSS users since the rise in popularity of augmented reality games such as Pokémon GO).

Multi-constellation, multi-frequency GNSS equipment is a good way of mitigating segment failures affecting a single constellation. It has the advantage of also making it harder for a spoofer to carry out a successful attack. In surveying, where precision is especially important, GNSS receivers should be tested each time there is a firmware or software update to verify correct functionality. Whilst a surveyor may not be able to test and diagnose problems with a receiver, it is possible to verify that a receiver is working as it should by carrying out measurements with known data points. If the measurements are at variance with the known data, this could indicate a GNSS receiver problem.

It is possible to simulate a variety of real-life hardware and software failure scenarios, including specific scenarios for surveying applications, by making the most of modern GNSS simulation equipment and rigorous test plans. With these in place, it is possible to understand how receivers and systems will react to errors from all components of a GNSS system and see the potential issues before they disrupt the user experience. Testing is a vital component of assuring that GNSS user equipment is adequately protected and is unlikely to suffer any unexpected behavior.

The future of the Galileo constellation
ESA and the European Commission (EC) have the required technical and programmatic expertise and knowledge to improve the situation with the Galileo clocks that will be onboard future satellites. Launching a new satellite navigation constellation is not a trivial undertaking and many important lessons have been learned by Europe during the development of the Galileo constellation. Galileo will be an important complementary system to GPS and will be a key component in multi-constellation, multi-frequency systems used in many applications including surveying and GIS.

Article by Guy Buesnel,  PNT Security Technologist at Spirent.