You have four satellites

Hold a phone under open sky and it soon knows where it is to within a few metres. It does this by listening to satellites more than 20,000 km away whose signals take about a fifteenth of a second to arrive, and it times those signals with a clock that would be laughed out of any observatory. The receiver gets away with this through a piece of reasoning a navigator taking a sight of the pole star would recognise: write down what you measured, write down what you don't know, and make sure you have at least as many measurements as unknowns.

This chapter follows that reasoning from the first satellite navigation system, which found ships by the pitch of a radio tone, to GPS, which finds them by the arrival time of a code. Along the way it shows why the answer is four satellites rather than three, why the same timing error can be harmless or ruinous depending on where the satellites sit in your sky, why the clocks in orbit are deliberately set to run slow before launch, and what happens when the signals are blocked, bent, or faked.

Why one clock isn't enough§

Suppose a transmitter sends a pulse at an instant everyone agrees on, and you note the instant it arrives. Multiply the travel time by the speed of light, 299,792,458 m/s, and you have your distance from the transmitter: a circle on a map, or a sphere in space. Three such spheres meet at a point. That is ranging by one-way timing, and it has a catch. Your clock has to agree with the transmitter's. A clock that is one millisecond fast makes every distance 300 km too long. A nanosecond is 30 cm.

No ordinary receiver carries a clock that good. So instead of a range it measures a pseudorange: the distance the signal appeared to travel, according to a clock with an unknown error b.

The important word is every. The same clock times every signal, so the same error c·b is added to every pseudorange. Try it below. Push the receiver's clock error away from zero and watch the three circles swell together. They still surround the receiver, but they no longer pass through a single point. Then press Solve for the clock.

Here's why this works. On a flat map the receiver has three unknowns: east, north, and the clock error. Each transmitter gives one equation. With three transmitters there are as many equations as unknowns, and only one clock correction makes all three circles meet. With two transmitters there are three unknowns and two equations, so any clock error produces circles that cross somewhere. The receiver gets a confident fix in the wrong place and nothing warns it. Lift the problem into three dimensions and you add one more coordinate, height, so you need one more signal. That is the whole reason for four satellites.

Listening to Sputnik§

The first satellite navigation system did not time anything. It listened to pitch. In October 1957, the Monday after Sputnik I was launched, two young physicists at the Johns Hopkins Applied Physics Laboratory in Maryland, William Guier and George Weiffenbach, tuned a 20 MHz receiver to the satellite's beacon and noticed that its tone slid downward as it passed^[1] documented. That slide is the Doppler shift: the satellite was approaching, then receding, and the received frequency fell as it did. They realised they could estimate how close the satellite came from the steepest part of the frequency curve, a method the laboratory already used for missiles passing their targets^[1]. Within weeks they showed that a single pass of Doppler data, recorded with a simple antenna, could determine Sputnik's entire orbit.

On 17 March 1958 the laboratory's research chairman, Frank McClure, called them into his office and asked them to turn the problem around^[1]. If you know the orbit, can the same Doppler curve tell you where the receiver is? Fewer unknowns, McClure reasoned, should mean better accuracy. The Navy needed exactly that. Its new Polaris submarines had to know their launch position at sea, ideally to within a few hundred feet^[1]. Over a weekend McClure and Richard Kershner sketched the system that became Transit: polar-orbiting satellites broadcasting two very stable frequencies, a tracking network that measured their orbits, and an injection station that uploaded those orbits for the satellites to rebroadcast^[1].

Transit: a position from a pitch§

A Transit satellite circled at about 600 nautical miles, roughly 1,100 km, in a polar orbit, and transmitted on 150 MHz and 400 MHz^[2]. Comparing the two frequencies let receivers remove most of the ionosphere's effect, an idea Guier and Weiffenbach had already floated in 1958^[1]. What the receiver measured was the shift in frequency caused by the satellite's motion along the line of sight:

Here v_r is the range rate, positive when the satellite is moving away. At 400 MHz and orbital speeds near 7.3 km/s, the shift swings from about +9 kHz to −9 kHz during a pass. Play a pass below, then drag the receiver toward and away from the ground track.

Two features of the curve carry the position. The moment the shift crosses zero is the moment of closest approach, when the satellite moves neither toward nor away from you, and the known orbit says where the satellite was at that moment. That fixes your position along the track. The slope at the crossing says how close the satellite came. Pass directly overhead and the frequency plunges; stand far to one side and it slides gently. For a satellite moving in a straight line at speed v, the slope is f₀v²/(cD), where D is the distance at closest approach. That fixes your distance from the track.

It does not say which side. A receiver 900 km east of the track hears exactly the same curve as one 900 km west, so every Transit pass yields two candidate fixes documented. In practice they are far apart, and the navigator's own dead-reckoning position, the subject of From a sight to a fix, makes the choice. Earth's rotation also breaks the symmetry slightly, because the receiver is carried eastward during the pass; the figure lets you see one solution fit and its mirror fail.

Transit was operational from 1964 without interruption^[2]. It was released to industry in July 1967, and by 1984 civilian users far outnumbered military ones^[2]. Its weakness was time. One pass gives one fix, a pass lasts less than twenty minutes, and the design aimed for a fix about once an hour^[1]; between passes a ship navigated by dead reckoning. The Navy ended Transit navigation service on 31 December 1996^[3], by which time GPS had made it obsolete.

From Transit to GPS§

The idea that replaced Transit grew from two programmes. At the Naval Research Laboratory, Roger Easton's TIMATION satellites carried precise clocks so that ground receivers could range to them by timing. The Air Force's Project 621B studied a satellite ranging system of its own. In 1973 the Defense Department's new joint programme office, directed by Bradford Parkinson, settled on a design that combined atomic clocks in orbit with coded ranging signals, and named it NAVSTAR^[4][5]. How much of the final design came from each predecessor, and who deserves to be called its inventor, is still argued by participants and their families contested^[5].

The first NAVSTAR satellite was launched on 22 February 1978^[6]. Air Force Space Command declared full operational capability on 27 April 1995, and announced it formally that July^[7]. The modern constellation flies at an altitude of about 20,200 km in six equally spaced orbital planes, each satellite circling Earth twice a day, with 24 baseline slots arranged so that at least four satellites are in view from nearly anywhere^[8].

For its first years of full operation, civilian users received a deliberately degraded signal. Selective Availability was a technique for degrading the civil signal worldwide^[9]. On 1 May 2000 the White House announced that the degradation would stop at midnight, and said civilian receivers would become about ten times more accurate^[9][10].

Four satellites, four unknowns§

A GPS satellite broadcasts its position and the time by its own clock. The receiver measures a pseudorange to each satellite it can hear. In three dimensions, equation (7.1) becomes

with four unknowns: the receiver's x, y, z in an Earth-centred frame and its clock error b. The equations are not linear, because distance involves a square root, so the receiver solves them by repeated improvement. Start from any guess. Work out the pseudoranges that guess predicts. The differences from what was measured, the residuals, say how wrong the guess is, and a straight-line approximation of equation (7.3) around the guess says how to move it. This is the Gauss–Newton method, and every step solves a small linear least-squares problem^[11]:

Each row of H holds the unit vector u_i from the guess toward satellite i, and a 1 for the clock. Below, the receiver starts from the least informed guess there is, Earth's centre with a perfect clock. Step through the iterations.

Notice two things. First, convergence is fast. Even from Earth's centre the first step lands within roughly a thousand kilometres, because the satellites are so far away that the directions to them barely change as the guess moves. After that the number of correct digits roughly doubles with every step: kilometres, then tens of metres, then fractions of a millimetre. Second, with exactly four satellites the final residuals are zero: four equations, four unknowns, one exact answer, and no way to tell whether any measurement was bad. With six or eight satellites the least-squares solution can no longer fit every pseudorange exactly, and the leftover residuals become evidence. That redundancy is what the rest of this chapter relies on.

Geometry is half the error§

Every pseudorange carries some error: a little noise, a little leftover atmosphere, a little error in the broadcast orbit and clock. GPS.gov distinguishes this ranging error from user accuracy, how close your computed position is to the truth, and notes that the second depends on satellite geometry as well as on the first^[14]. The link between them is the dilution of precision, a pure number that depends only on the directions to the satellites:

Here Q = (H^TH)⁻¹, the same matrix as in equation (7.4) written in local east, north and up axes. HDOP keeps only the east and north terms, VDOP only the vertical, and TDOP the clock.

Drag the satellites below. Each dot in the cloud on the right is one fix computed with the same random ranging errors, so the cloud is what the geometry does to those errors.

The pattern is familiar from the cocked hat of three position lines in From a sight to a fix. Lines of sight that cross at wide angles pin a position down; lines that nearly agree leave it free to slide. Two features are specific to satellites. Vertical error is usually larger than horizontal, because every satellite you can see is above you and none below. And the clock is entangled with height: lengthening every pseudorange by the same amount looks almost like moving the receiver down. When all satellites sit at the same elevation the two become indistinguishable, which is the singular case in the figure. Under open sky with good geometry, GPS.gov reports that smartphones are typically accurate to within a 4.9 m radius^[14].

Clocks that run fast in orbit§

Timing to a few nanoseconds means the satellites' clocks must be described with general relativity. Two effects compete. A clock higher in Earth's gravity runs faster than one on the ground. A clock moving at orbital speed runs slower. For GPS the first wins: Ashby gives the net rate offset the clocks must be corrected for as 4.4645 parts in 10^10[15], which is about 38 µs a day. Left uncorrected, he notes, errors building up in one day would cause navigation errors of more than 11 km^[15]. The satellite clocks are therefore set before launch to a nominal 10.22999999543 MHz instead of 10.23 MHz, so that they appear to run at the right rate from the ground^[16][12].

Both terms come from a first-order formula, plotted above for circular orbits^[17]. At GPS altitude it gives a gravitational term of about +45.7 µs a day and a velocity term of about −7.1 µs a day. Because GPS orbits are slightly elliptical, a further periodic term rises and falls around each orbit; the receiver computes it from the broadcast orbit, and ignoring it can cost several metres of range^[16].

When signals lie§

A GPS fix is an inference from signals, and every inference is only as good as its assumptions. The solver in equation (7.4) assumes every pseudorange is the true distance plus one shared clock error plus a little noise. Each kind of trouble breaks that assumption in its own way, and the redundancy of extra satellites catches some of them and misses others. In the figure below, choose a fault and watch where the receiver thinks it is and what its residuals say.

The cases sort into three groups. Some faults are common to every signal and move straight into the clock estimate: receiver clock drift is absorbed completely, which is the whole point of solving for b. Some are different for each satellite and show up as residuals, provided there are more than four satellites: a reflection that lengthens one path (multipath), a wrong satellite clock, or the ionospheric delay, which is largest for low satellites whose signals cross more of the ionosphere. A second frequency removes most of the ionospheric delay, the same trick Transit used with its two carriers. The third group is the dangerous one: errors that are consistent with some other position. A spoofing attack that fakes every signal coherently presents the receiver with a self-consistent wrong answer, and no residual test can see it.

This is not hypothetical. In June 2013 a University of Texas team led by Todd Humphreys, invited aboard the superyacht White Rose of Drachs in the Mediterranean, used a briefcase-sized transmitter to overpower its GPS signals and steer it onto a parallel course while its chart showed it on the planned line^[18] documented. Since February 2022 the European Union Aviation Safety Agency has reported an increase in jamming and spoofing affecting aircraft, and warns that spoofing is harder to detect than jamming and can affect several aircraft systems at once^[19]. The figure's receiver is deliberately naive; real receivers add signal-level defences and cross-checks against other sensors, and the consistency test shown is an illustrative version of the receiver autonomous integrity monitoring used in aviation.

When the satellites go quiet§

If the signals disappear entirely, a vessel falls back on what navigators have always had: dead reckoning from speed and heading, and fixes from anything else it can measure. The modern form of dead reckoning is the inertial navigator, which integrates measured acceleration twice to get position. Integration is unforgiving. A constant accelerometer bias B produces a position error ½Bt², which grows with the square of time. Inertial navigators on Earth are usually built so that their errors oscillate with the Schuler period of about 84 minutes rather than growing without limit, but gyro errors still accumulate^[20].

What bounds the drift is an independent fix. That can be a radar range to a headland, a sextant sight, or a terrestrial radio system like those in The invisible lighthouse. Enhanced LORAN, or eLoran, a modernised low-frequency hyperbolic system, is the option most often discussed as a backup to satellites. It has been studied and trialled rather than deployed everywhere documented: two eLoran systems took part in U.S. Department of Transportation field tests in 2020, and the resulting report concluded that no single technology can back up GPS for every use and recommended combining several^[21].

Other constellations§

GPS is one of several global systems, now grouped under the name GNSS. GLONASS, begun by the Soviet Union and continued by Russia, reached a full constellation of 24 operational satellites in 1995^[22]. The European Union declared Galileo's initial services on 15 December 2016^[23], and China commissioned its third-generation BeiDou system for global service on 31 July 2020^[24]. The systems differ in orbits, signals and time scales, but they share the measurement of equation (7.1). A receiver that tracks several constellations sees more satellites spread across more of the sky. In the terms of Figure 4, that means lower DOP, and in the terms of Figure 6, more redundancy with which to spot a bad signal. Each additional time scale adds one more clock unknown, so mixing systems costs a satellite each time, a direct echo of the reasoning at the start of this chapter.

The same inference, all the way down§

Look back across the chapters. A navigator measuring the height of the pole star, as in Latitude from the sky, learns one number about where she is, a circle of latitude. A sight of any star puts her on a circle of equal altitude centred where that star is overhead. A radio bearing gives a line; a LORAN time difference gives a hyperbola; a Transit Doppler curve gives a distance from a ground track with a mirror on the other side. A GPS pseudorange gives a sphere whose radius is wrong by an amount shared with every other sphere.

In each case the method is the same. Model the source exactly: the star's position at the moment of the sight, the satellite's orbit at the instant of the signal. Measure something that depends on where you are. Count the unknowns, including the ones you would rather not have, such as the error of your chronometer or your receiver clock. Collect at least as many independent measurements as unknowns, more if you can, and let the leftovers tell you how much to trust the answer. The instruments changed from brass to silicon and the signals from starlight to coded microwaves, but the reasoning is still inference from signals. Four satellites are the modern answer to an old question: how many things must I measure before the sky has told me where I am?