Rehearse the minute GNSS goes dark
Kshana replays jamming, spoofing and clock holdover when GNSS (Global Navigation Satellite System) signals fail, and tells you how long a system keeps time and position inside its budget, and which clock or sensor buys the most margin. It is one Rust engine. It runs in a terminal, a notebook, an IDE (integrated development environment), an AI (artificial intelligence) assistant, or in your browser.
Every run is reproducible bit for bit from the scenario, the seed and the engine version. Every capability carries one of three labels in a machine-checked ledger: VALIDATED (an independent external oracle agrees), MODELLED (internally consistent, and said out loud) or PARTNER (a hardware partner owns it).
Status: v0.38.0. A validated, reproducible simulation substrate for PNT resilience. Timing and holdover come first, because that domain is the best validated. Kshana is a study and trade-off instrument: not radio-frequency (RF) signal-generator hardware (it drives no radio and transmits nothing; its signal-level output is baseband IQ sample files for software receivers), not a hardware or certified GNSS receiver (its software receiver is an analysis tool) and not a flight product. New to the field? Start with the plain-language primer and the glossary.
What's new in 0.38
0.38 makes the neutral referee measurable: it scores receiver logs against a published test schedule, reads more receivers and sensors, tests timing systems, and ships a benchmark and an interference observatory. It stays advisory: nothing here is certified, no result is a type approval, and nothing transmits. Each row states what the ledger holds for it (how a label is earned); a status names only what was checked, and the ledger row and the linked page say what was not.
| New in 0.38 | What it does, and why | Ledger status | Read |
|---|---|---|---|
| Jammertest scoring | kshana jammertest import reads the published NPRA test catalogue and transmission plan as scheduled truth; jammertest score scores a receiver log per test (detection latency, missed alarms, false alarms, time to recover), as a signed evidence pack if you give a key | MODELLED: one ledger row. The bars were pre-registered before any scored run; on the JammerTest 2024 data the minimum-data rule failed in both runs (4 and 7 scorable windows against 10 required), so no bar is assessable and nothing is claimed | Jammertest |
| The receiver's own flags | UBX-NAV-STATUS spoofDetState, UBX-SEC-SIG and NovAtel RXSTATUS read into a per-epoch self_report and compared with Kshana's alarms (both, receiver only, Kshana only, neither); a Septentrio SBF reader and read-only --serial input | MODELLED; agreement between a receiver's detector and Kshana's is not validation | Receiver trust |
| More receivers and sensors | RTKLIB .pos, NovAtel OEM7, RTCM 3 MSM4/MSM7 C/N0 (from the BSD-licensed pyrtcm tables, not the RTCM text), GNSS-SDR monitor streams, an IMU log as a second sensor, a ROS 2 package, a gnss_lib_py bridge, and imu-fit for hybrid sensor parameters | MODELLED: six ledger rows; self-written fixtures only, no capture from a real receiver, IMU, GNSS-SDR run or ROS graph was read | Machine inputs |
| Timing and holdover tests | the holdover-test kind scores a holdover test (GNSS removed by the operator, holdover, recovery) from a measured time-error record against ITU-T masks, "measured against the mask"; linuxptp and chrony log readers; the hardware stages and the lab-attestation field | MODELLED: two ledger rows; the times are the operator's statement, not verified | Timing HIL, Hardware safety |
| Standards packs, LunaNet AFS, lab round trip | scored packs for DHS RPCF, IMO MSC.1/Circ.1575 and ICAO Doc 9849 Appendix F against bars stated before the run, "supports evidence for"; a NIST IR 8323r1 crosswalk; a LunaNet AFS code generator and checker; a signed pack that links a lab run's scenario, test conditions, receiver log and score | MODELLED for the packs and the round trip; the AFS code check is VALIDATED against its printed check columns (see the ledger rows) | Standards, LunaNet AFS |
| kshana-bench and the observatory | fixed tasks, splits and metrics for interference detection, IQ detection, holdover prediction and the optimism gap, with a sealed holdout and a static leaderboard; a reproducible daily interference product with a 24 h delay, coarse cells and no attribution | no ledger row of its own: it scores submissions, and its baselines are labelled MODELLED in the result files; against the pre-registered bars the scorer, C1 to C3 and D2 are met and D1 is NOT MET (pinned by a test) | Bench, Observatory |
| Exporters | trust telemetry as Home Assistant MQTT discovery and state messages (publish only, no credentials) beside Prometheus, CEF, LEEF and OTLP | MODELLED: one ledger row | Trust telemetry |
| Optical link margin against time | the optical-atmosphere kind can write one seeded realisation of a site's weather as a link-margin series | MODELLED: one ledger row; one draw from the model, not the climate | Optical atmosphere |
0.37's highlights: changelog. The full 0.38 list is in the changelog.
0.38 in depth
Each capability from the table above, in a few lines: what it does, one command to run it, one
picture drawn from a real run of the engine, and what the ledger holds for it. The pictures
are written by tools/gen_figures_038.py into
docs/figures/0.38/ (never drawn by hand): python3 tools/gen_figures_038.py
rewrites them from a built engine, and --check fails if one is stale or its caption here differs.
Where an input is a log, it is a made-up one the script writes, because the real third-party logs
are never vendored, and the caption says so. Everything below is advisory: not certified, not a
type approval, and nothing transmits. A status names what was checked and nothing more;
how a label is earned.
Jammertest scoring
kshana jammertest import turns the published NPRA test catalogue and transmission plan into
scheduled truth, and kshana jammertest score scores a receiver log against it: for each
scheduled test, whether it was detected, how late, and how long the receiver took to recover, plus
false alarms outside every slot. The catalogue is fetched, never vendored.
xval/jammertest-plan/fetch.sh ../jammertest-plan
kshana jammertest score session.toml --catalog ../jammertest-plan/testcatalog2025.json \
--plan ../jammertest-plan/plan-tuesday-2025-09-16.json --location 1 --json
Ledger status: MODELLED. The bars were fixed before any scored run; on the JammerTest 2024 data the minimum-data rule failed in both runs, so no bar is assessable and nothing is claimed. Jammertest.
The receiver's own flags
UBX-NAV-STATUS spoofDetState, UBX-SEC-SIG and NovAtel RXSTATUS are read into a per-epoch
self_report and set beside Kshana's alarms: both, receiver only, Kshana only, or neither. A
Septentrio SBF reader and a read-only --serial input feed the same comparison. Neither side is
ground truth.
kshana receiver-trust session.toml # [log] format = "ubx", path = "receiver.ubx"
Ledger status: MODELLED. Agreement between a receiver's detector and Kshana's is not validation. Receiver trust.
More receivers and sensors
RTKLIB .pos, NovAtel OEM7, RTCM 3 MSM4/MSM7 C/N0, GNSS-SDR monitor streams, an IMU log as a second
sensor, a ROS 2 package and a gnss_lib_py bridge all end in the same receiver-trust timeline.
imu-fit reads the sensor parameters the hybrid and fusion scenarios need off a stationary IMU
log, so a scenario can be run with the sensor you actually have.
kshana imu-fit still.csv --format csv --axis x --expected-mean 0 --id bench-imu
Ledger status: MODELLED. Self-written fixtures only; no capture from a real receiver, IMU, GNSS-SDR run or ROS graph was read. Machine inputs.
Timing and holdover tests
The holdover-test kind scores a holdover test (GNSS removed by the operator, holdover, recovery)
from a measured time-error record against ITU-T masks, and says so in those words: measured
against the mask. linuxptp and chrony log readers feed it; the hardware stages and the
lab-attestation field say who stated what.
kshana scenarios/holdover-test-example.toml
Ledger status: MODELLED. The times GNSS was removed and restored are the operator's statement, not verified. Timing HIL, Hardware safety.
Standards packs
Scored packs for the DHS Resilient PNT test profiles, IMO MSC.1/Circ.1575 and ICAO Doc 9849
Appendix F, plus a NIST IR 8323r1 crosswalk in compliance-report. Each test runs a bundled
scenario and compares a result field with a bar stated before the run; a test that needs a receiver
log is listed as needing an input, not scored. The wording is "supports evidence for".
kshana standards-pack list
kshana standards-pack run imo-circ-1575
Ledger status: MODELLED. A met bar says a modelled scenario met a stated bar, nothing about a product; every miss is kept and pinned by a test. Standards.
LunaNet AFS
The LunaNet Augmented Forward Signal code generator (Gold, Weil and tertiary codes, the message frame and its error coding) and a checker for a recorded or generated symbol stream, pinned to one edition of the specification.
kshana lunanet-afs-check spec
kshana lunanet-afs-check generate --frames 2 --out afs.sym
kshana lunanet-afs-check symbols afs.sym
Ledger status: VALIDATED for the code and synchronisation checks, against the values the specification prints (which it marks TBC); one check is NOT MET, kept and pinned (one printed tertiary-code column differs: the document prints the same value for two PRNs). The LDPC and CRC words of subframes 2 to 4 are not checked. The ledger rows say exactly which. LunaNet AFS.
Lab round trip
kshana.test-conditions/1 is a published description of what a laboratory did (events, times,
powers). kshana evidence round-trip links the scenario hash, the conditions hash, the receiver log
hash and the score into one signed pack, and refuses a pack whose conditions and scoring scenario
disagree about the events. Kshana never produces or replays a signal: how a scenario reached a
receiver is the operator's responsibility.
kshana evidence --help
The picture is the layout of a pack. Ledger status: MODELLED. Test conditions, Test bench.
kshana-bench
Fixed tasks, splits and metrics for interference detection, IQ detection, holdover prediction and the optimism gap, with a sealed holdout and a static leaderboard. It scores submissions; it is not a ranking of receivers.
kshana bench baseline --task d --split test --out results/
Ledger status: no ledger row of its own; the baselines are labelled MODELLED in the result files. Against the pre-registered bars the scorer, C1 to C3 and D2 are met and D1 is NOT MET (pinned by a test). Bench.
Interference observatory
One product per UTC day and region from an open aircraft-position archive, on a fixed coarse grid: each cell is degraded, not degraded, or not observed (which is not "clear"). Released no earlier than 24 h after the day ends, with small cells suppressed and no attribution of cause.
kshana interference-map daily /path/to/extracted/2026-09-15 \
--dataset adsb-lol --day 2026-09-15 --bbox 53.5,9.0,66.0,31.0 --out products/
The picture is the committed sample days, not an observatory product. Ledger status: MODELLED: no external oracle, no ground truth and no cause attribution; a cell that is not observed was not assessed, which is not the same as clear. Observatory method.
Exporters
Trust telemetry as Prometheus text, CEF, LEEF, OTLP and Home Assistant MQTT discovery and state messages. The command publishes only to a destination you give it and holds no credentials.
kshana trust-telemetry --result session.result.json --print-metrics
kshana trust-telemetry --result session.result.json --print-syslog --format cef
Ledger status: MODELLED. Trust telemetry.
Optical link margin against time
The optical-atmosphere kind can write one seeded realisation of a site's weather as a link-margin
series: cloud episodes, a liquid-water column for each, one scintillation sample per step. The
Studio's Optical PNT page opens the optical-atmosphere scenarios.
kshana scenarios/optical-atmosphere-network.toml
Ledger status: MODELLED. One draw from the model, not the climate. Optical atmosphere.
New Studio views
kshana.dev/studio gains a Bridge replay (two runs side by side on one
mission clock, at /studio/replay/), an Optical PNT page
(/studio/optical/), a Holdover test page (/studio/holdover/) and an observatory viewer
(/studio/observatory/). They run the same engine in the browser, nothing is uploaded, and they carry
the same advisory statement. The pictures above are drawn from the engine's own output by a script;
they are not screenshots of these pages.
Space-user navigation (gnss-ssv)
For a spacecraft above, around or far past the GNSS orbits: how many GNSS signals it can use, how strong they are, how good the geometry is, and what an onboard filter can do with them. One kind, four modes, chosen by the scenario's tables: a shell of users (the share of time with one and four signals, per constellation), a trajectory (signals, C/N0, dilution of precision and the limb-ray medium along an orbit), a navigation run (a nine-state filter on pseudoranges, to the Moon) and a formation (relative navigation of deputies about a chief). The public source for the availability comparison is the interoperable GNSS Space Service Volume booklet (UN OOSA ST/SPACE/75, from the International Committee on GNSS), which is itself a simulation; it is fetched, never vendored. Full page: docs/SSV.md.
kshana scenarios/gnss-ssv-shell.toml # shell: the upper space service volume, reduced size
kshana scenarios/gnss-ssv-heo.toml # trajectory: a high Earth orbit, limb medium
kshana scenarios/gnss-ssv-nav-lunar.toml # navigation: an onboard filter toward the Moon
kshana scenarios/gnss-ssv-formation-heo.toml # formation: relative navigation
Ledger status: MODELLED, and the comparison with the booklet mostly misses. The bars were fixed before the run. Of eight, only S0 (the inverse link budget, 13 of 13 values) and S6 (the lunar mission) are met. S1 to S5 and S7 are NOT MET: the upper and lower service volume geometry (43 of 52 and 48 of 52 cells), the 15/20/25 dB-Hz upper service volume, the six GEO missions, the HEO mission, and the parametric sidelobe pattern against measured GPS panel patterns. Almost every miss in S1 to S5 involves GLONASS, and the booklet prints two different reference angles for it; a diagnostic variant that uses the other pair brings S1, S2 and S4 to every cell, but it does not replace the run of record and no row is VALIDATED. The formation run's absolute filter is also overconfident (mean normalised error squared well above the value of about 3 that a consistent filter gives).
Space-user navigation, what the comparison shows.
Lunar infrastructure (lunar-infrastructure)
The Moon's orbit and surface as navigation and geodetic infrastructure, in five studies chosen by
study: od-consistency (an onboard Earth-GNSS orbit determination in a halo orbit against an
independent ground one), carrier-phase (integer ambiguity fixing between surface stations and an
orbiter), frame-coestimation (the lunar datum from Earth-station ranging with and without orbiter
links), space-tie (laser, VLBI and GNSS offsets on one spacecraft against the local-tie error) and
geodesy-sensitivity (which observable family sees the Love numbers h2, k2 and l2). The model is a
restricted three-body one with stated simplifications and illustrative inputs. Full page:
docs/LUNAR-INFRASTRUCTURE.md.
kshana scenarios/lunar-infrastructure-od-consistency.toml
kshana scenarios/lunar-infrastructure-carrier-phase.toml # quick; the scored run takes about eight minutes
kshana scenarios/lunar-infrastructure-frame-coestimation.toml
kshana scenarios/lunar-infrastructure-space-tie.toml
kshana scenarios/lunar-infrastructure-geodesy-sensitivity.toml
Ledger status: MODELLED, and three bars are NOT MET. The numerics are checked against independent numpy and scipy programs; nothing is compared with a measurement of a lunar quantity, and nothing is VALIDATED. Met: the two orbit solutions are consistent (mean q 5.81 against 6 expected), and orbiter links raise the smallest datum eigenvalue about 111-fold, assuming a known orbit. Not met: the injected 3e-10 m/s2 model error is not detected (C3: the onboard solution is known to about 350 m, so about ten metres hides in its covariance); integer fixing is not achieved (1 to 3 % success at 25 dBi, and at the registered 12 dBi the problem cannot be formed); and the trace half of G3 for adding an observable family (the trace rose in 12 of 28 additions, each time because the family raised the rank). Each miss is pinned by a test. Lunar infrastructure.
Kshana Studio
Open kshana.dev/studio and the whole engine runs in your browser, compiled to WebAssembly. Nothing to install, and nothing is uploaded. The Studio has two views of the same engine, and a switch in the header moves between them, keeping the scenario, the view and any settings you changed.
The Simple view is where the Studio opens. It starts from questions (how many satellites can I see, can I trust my position fix, how long can a clock keep time, what does a jammer do to my receiver) and from a map of everything the engine can do, each area with its share of validated methods. Open a scenario and the answer comes first: one plain sentence, written for what that scenario measures, then its key figures and a chart. At most five settings are on show, the ones that change the answer most; the rest wait under Advanced settings. How this is computed explains the method, and For researchers gives the engine's own figures, the scenario file, the code to run it from Python and the citation.
The Advanced view is the full dashboard: the scenario library, five numbered steps (Choose, Set, Run, Read results, Share or export), the key figures with PASS and FAIL chips where the run states a threshold, and every panel: overview, charts, maps, replay, the engine's report and exports. One search box reaches scenarios, domains and the fields inside them, and you can pin up to four runs and compare them side by side.
The Studio's source and its build notes are in web/README.md.
The site
The rest of kshana.dev is built from this repository's own files and engine runs: missions, capabilities, the evidence ledger, the published research and the editions.
Capabilities
One engine covers the whole failure chain, from the first jammed satellite to the last
nanosecond of clock holdover. The engine has 87 scenario kinds; kshana kinds lists
them and docs/SCENARIOS.md documents every field.
| Capability | What it answers |
|---|---|
| Spectrum | how a jammer takes the GNSS L band, band by band, second by second |
| Clocks and timing | how long each clock holds time after GNSS is lost |
| Constellations around any body | coverage, dilution of precision and availability around the Earth, the Moon or Mars |
| Solar system | where every planet is, and the light time of any link |
| Low-Earth-orbit navigation | a pass, a link, a navigation message and a fused fix, stage by stage |
| Campaigns | a chained mission, a sweep or a Monte Carlo ensemble in one scenario |
| Animation | a run's time series as an animated drawing, a player or frames |
| Reports | every figure with its unit and its label, in HTML (HyperText Markup Language) and JSON (JavaScript Object Notation) |
| Interoperability exports | orbits and geometry for other tools: SP3, CCSDS OMM and OEM, CZML, KML, GeoJSON, STK and SigMF |
| Maritime trust | can the bridge trust this fix: a 0-100 score and reasons for a vessel's NMEA, live or from a log (advisory, not type-approved navigation equipment) |
| NMEA training streams | synthetic bridge NMEA with scripted jamming and spoofing and an instructor log, for crew training (text only; never for a vessel's live navigation systems; advisory, not type-approved navigation equipment) |
| Interference map | where aircraft and ships reported degraded navigation data, and how much of a route it touches |
| Evidence packs | a signed, offline-verifiable technical record of a vessel's log window and what the engine computed from it, for an incident report (advisory, not type-approved navigation equipment) |
| Trust telemetry | the trust stream as Prometheus metrics, SIEM events and optional OpenTelemetry, with a sample Grafana dashboard (deploy/grafana/kshana-gnss-trust.json) |
| Signal K and OpenCPN | the trust score on a boat's Signal K server and in OpenCPN, with a reference build for a small computer next to the receiver (advisory, not type-approved navigation equipment) |
| Test-bench export | kshana bench-export: a scenario's vehicle motion and events for a laboratory GNSS simulator (no signal is written), and how to score the receiver's log afterwards |
| Compliance mapping and report | kshana compliance-report: which rows of public resilience frameworks a set of runs supports evidence for, and the gap that is left |
| Notebooks | runnable tutorials: vessel trust and training streams, an interference-map route exposure, compliance mapping and the test bench, quantum against classical GDOP |
| Galileo OSNMA verifier | which satellites' navigation data a receiver can cryptographically authenticate, and why a check fails; Kshana grants no rights under the EU's OSNMA ICD IPRs (see the NOTICE in the page) |
The export formats in full: SP3 is Standard Product 3; CCSDS OMM and OEM are the Orbit Mean-elements and Orbit Ephemeris Messages of the Consultative Committee for Space Data Systems; CZML and KML are the Cesium and Keyhole Markup Languages; STK is Systems Tool Kit; SigMF is the Signal Metadata Format.
Run any of them with kshana example <scenario> > s.toml && kshana s.toml: the scenarios
are l-band-waterfall-jamming, constellation-multi-gnss-coverage, solar-system-tour
and leo-pass-iridium.
All four are made-up data and advisory: they show the format and the behaviour of the software, not how any receiver or system performs against interference. Run the first with kshana receiver-trust examples/maritime-trust/session.toml, the second with kshana route-exposure on the samples in examples/interference-map/, the third with kshana nmea-scenario scenarios/training/coastal-drag-off.toml --out drag.nmea (training use only: never feed it to live navigation equipment), and the fourth as in docs/EVIDENCE-PACKS.md.
The full domain-by-domain detail follows; for a per-capability maturity ledger see
docs/CAPABILITY.md and docs/VALIDATION.md.
| Domain | Capability |
|---|---|
| Orbit & geometry | SGP4/SDP4 propagation (validated to 4.12 mm against all 666 AIAA 2006-6753 vectors); real two-line elements (a committed, date-stamped Celestrak gps-ops snapshot) or synthetic Walker-delta constellations whose mean elements realise the i:T/P/F formula to under 1 km over a 24 h propagation; multi-constellation visibility, dilution of precision — geometric, position, horizontal, vertical and time (GDOP/PDOP/HDOP/VDOP/TDOP), validated to 1e-6 against gnss_lib_py 1.0.4, Stanford NAV Lab (Navigation and Autonomous Vehicles Laboratory), and GNSS availability; a gradient-free constellation-design optimiser, streets-of-coverage minimum-satellite sizing, a multi-constellation comparison tool, and a Walker design sweep that tabulates coverage / PDOP / revisit-time over a planes × satellites grid and reports the Pareto-optimal designs. |
| Numerical propagator | A Cowell numerical propagator (src/propagator.rs) complementing the analytic SGP4/SDP4 path, with a hierarchical seven-perturbation force model (src/forces.rs): two-body + the full J2–J6 zonal field (the Earth-oblateness zonal harmonic coefficients J2 to J6; the exact analytic gradient of its disturbing potential), an optional EGM2008 tesseral spherical-harmonic geopotential to degree/order 70 (Earth Gravitational Model 2008; src/gravity_sh.rs; real NGA — US (United States) National Geospatial-Intelligence Agency — coefficients, Holmes–Featherstone normalized-Legendre recurrence, cross-checked against the closed-form Legendre functions and the analytic ∇V identity), epoch-driven Sun and Moon third-body gravity (a built-in low-precision ephemeris, no DE/SPK — Development Ephemeris / SPICE Spacecraft and Planet Kernel — kernel), solar-radiation pressure (cannonball model with a conical umbra+penumbra shadow), atmospheric drag (Vallado piecewise-exponential density, co-rotating atmosphere), the post-Newtonian Schwarzschild relativistic correction, and the Lense–Thirring frame-dragging term (IERS — International Earth Rotation and Reference Systems Service — Conventions 2010 §10, linear in Earth's angular momentum, ~1–2 orders below Schwarzschild) — driven by a choice of two adaptive integrators (RK4 — fourth-order Runge–Kutta — step-doubling or the Dormand–Prince RK5(4) embedded pair). Validated against Orekit 12.2 (CS GROUP, Apache-2.0) NumericalPropagator/DormandPrince853 — 278 epochs across LEO (low Earth orbit) + GTO (geostationary transfer orbit), the conservative-force tiers agreeing to a worst-case |Δr| 0.08 m over 24 h (tests/numerical_cowell_propagator_reference.rs); the atmospheric-drag tier is characterised separately (≈ 333 m / 24 h) and the absolute Sun/Moon-ephemeris and density inputs stay honestly Modelled. Additional internal evidence (not external validation): the unperturbed orbit is checked against the exact universal-variable Kepler solution to sub-metre over 24 h, energy/angular-momentum conserve to ~1e-9, and each perturbation matches a hand-derived closed-form signature. |
| Maneuvers & trajectory design | Impulsive ΔV nodes with 6×6 covariance propagation (ECI — Earth-centred inertial — / LVLH — local vertical, local horizontal — execution-error frames), finite-burn integration checked against the closed-form Tsiolkovsky rocket equation to < 0.01 %, an Izzo-2015 single-revolution Lambert solver, an exact universal-variable Kepler propagator, and a porkchop (launch × arrival) C3 (launch energy) / arrival-V∞ sweep emitted as a JSON contour grid — the performance-simulation layer above GMAT/Orekit, with every Lambert output round-tripped against two-body truth and the porkchop minimum checked against the analytic Hohmann floor. |
| Time systems & reference frames | IERS leap-second UTC / TAI / TT / UT1 scales (Coordinated Universal Time, International Atomic Time, Terrestrial Time, and the Earth-rotation time Universal Time 1), a Julian-date API (application programming interface), the IAU-2000 (International Astronomical Union) Earth Rotation Angle (ERA), GMST-based (Greenwich Mean Sidereal Time) TEME ↔ ECEF (true equator, mean equinox ↔ Earth-centred, Earth-fixed) with WGS-84 (World Geodetic System 1984) geodetic frames, IAU 2006 precession (Fukushima–Williams), full IAU 2000A/2000B nutation, IERS polar motion, and the equinox-free CIO-based IAU 2006/2000A GCRS↔ITRS reduction (CIO = Celestial Intermediate Origin) — all validated bit-for-bit against the SOFA/ERFA vectors, and independently cross-checked against ANISE (the pure-Rust NAIF/SPICE reimplementation; NAIF = the Navigation and Ancillary Information Facility of NASA, the US National Aeronautics and Space Administration): kshana's GCRS→ITRS vs ANISE's ITRF93 (International Terrestrial Reference Frame 1993) from JPL's earth_latest_high_prec.bpc, the same IERS Earth-orientation parameters fed to both, agree to ≤ 0.86 m on the ground / ≤ 3.6 m at GNSS orbit (max 0.028″) across eight epochs 2020–2023. |
| Inertial | Three-axis strapdown INS — quaternion attitude, WGS-84 NED (north-east-down) mechanization, coning/sculling compensation, and a deterministic IMU error model (scale-factor, misalignment, g-sensitivity, quantization, drift); a first-principles cold-atom-interferometer accelerometer (Mach–Zehnder phase, quantum projection noise, contrast decay, vibration coupling) that derives the velocity-random-walk coefficient; and a sequential-importance-resampling particle filter for map-aided (terrain-/gravity-referenced) GPS-denied navigation. |
| Alt-PNT (GPS-denied) | A cold-atom gravimeter measurement model whose white-noise floor (σ = ASD/√τ, ASD = amplitude spectral density) is derived from the CAI accelerometer physics; a low-degree, fully-normalised spherical-harmonic gravity-anomaly field (checked against the closed-form Legendre functions and a hand-derived single-term anomaly) plus synthetic mascons; the gravity-functional synthesis kernel (gravity_sh::gravity_magnitude / gravity_disturbance_mgal) — the "map reader" a gravity-aided navigator matches against — is validated against the GRS80 normal-gravity standard (Geodetic Reference System 1980), reproducing the closed-form Somigliana normal gravity and the published γ_e / γ_p to 3.5e-12 and producing a physically-bounded disturbance map from the real ICGEM (International Centre for Global Earth Models) EGM2008 field (RMS — root mean square — ≈ 26 mGal, max ≈ 89 mGal at d/o 70; tests/icgem_gravity_reference.rs); and a gravity-map-matching particle filter that recovers a GPS-denied track from the anomaly sequence it flies through. It extends to terrain-referenced navigation (TERCOM/SITAN — terrain contour matching / Sandia Inertial Terrain-Aided Navigation — against an SRTM (Shuttle Radar Topography Mission) .hgt DEM (digital elevation model), src/altpnt/terrain.rs), an IGRF-14 geomagnetic main field (14th-generation International Geomagnetic Reference Field) to degree/order 13 (src/igrf.rs, checked against the tilted-dipole closed form and ∇V finite differences), and a combined gravity + magnetic + terrain navigator that fuses all three scalar channels through one particle filter (information is additive — no channel makes the fix worse). A 60-minute GPS-denied benchmark (a ~700 km / one-hour outage where the inertial solution drifts to ~70 km) is recovered to ~145 m (< 500 m) by a hierarchical coarse-to-fine matcher — the ESA NAVISP (Navigation Innovation and Support Programme) Quantum Wayfarer target. |
| Fusion | Loosely-coupled 15-state GNSS/INS error-state EKF (extended Kalman filter) with closed-loop feedback (the gnss-ins pack); a tightly-coupled pseudorange update that keeps correcting with fewer than four satellites; a coupled clock + position filter; a general unscented (sigma-point) Kalman estimator for strongly nonlinear measurements; a tightly-coupled GNSS/INS UKF navigator (pseudorange + Doppler) whose force-model orbital coast is self-consistency-checked to 0.77 m RMS over a 30-minute curving LEO pass that includes a 120-second GNSS outage (a filter-consistency figure, not an external-oracle validation — this navigator stays MODELLED); and a full 17-state tightly-coupled GNSS/INS UKF (position, velocity, attitude error, accelerometer and gyro biases, clock bias and drift) whose quantum-CAI dead-reckoning coasts a 120-second outage on the cold-atom accelerometer's derived velocity-random-walk. |
| Orbit determination | Recovery of an orbital state [r, v] from ground-station range tracking, composing the two-body + J2 force model and RK4 integrator with a Gauss–Newton batch corrector (determine_orbit_batch, sub-metre / mm·s⁻¹ from noiseless ranges, ~2 m at a 5 m noise floor) and a sequential unscented-filter variant (determine_orbit_sequential). |
| Observability & estimation theory | A general, reusable Fisher-information / Cramér–Rao layer (src/fim.rs): the information matrix M = HᵀWH, the Cramér–Rao lower bound, observability rank and datum-defect null space (Moore–Penrose pseudo-inverse), and D/A/E/T-optimal experiment-design scalars from a symmetric Jacobi eigensolver. Validated — eigenvalues vs numpy.linalg.eigh, the CRLB covariance vs σ²(XᵀX)⁻¹ via numpy.linalg.inv, and GNSS DOP from the information matrix, all matched to 1e-9 (tests/fim_observability_reference.rs), and additionally cross-checked against the Kay (1993) closed-form bounds with Monte-Carlo CRLB attainment. It underpins the DOP engine, the passive-geolocation CRLB, and the lunar absolute-station observability theorem (below). |
| Lunar & cislunar | An Earth–Moon circular restricted three-body (CR3BP) propagator in the rotating frame — conserved Jacobi constant and all five Lagrange points (src/cr3bp.rs) — now with a 6×6 state-transition matrix (STM) and a single-shooting differential corrector (cr3bp_jacobian, propagate_state_stm, differential_correct_halo) that produces genuinely periodic halo / NRHO (near-rectilinear halo orbit) orbits: the STM is validated against finite differences, corrected orbits close to machine precision, and seeding the published apolune state reproduces the L2 southern 9:2 NRHO (L2 = the second Earth–Moon Lagrange point; the Gateway orbit) at period ≈ 6.57 d / perilune ≈ 3,250 km, consistent with the published ≈ 6.56 d / ≈ 3,370 km (a CR3BP — circular, Sun-free — solution, not validated against a real LANS (Lunar Augmented Navigation Service)/Gateway ephemeris; the selenocentric MCI/MCMF (Moon-centred inertial / Moon-centred, Moon-fixed) transform of the corrected orbit is a follow-on); plus LunaNet / LNIS (LunaNet Interoperability Specification) cislunar PNT geometry (MCI↔MCMF reduction, selenographic coordinates) with a lunar south-pole ARAIM pass that honestly surfaces the integrity gap: a ~30 m σ_URE (user range error) drives the protection level well above a 50 m alert limit (src/lunar.rs, scenarios/lunanet-araim.toml); and a surface-beacon DOP augmentation (src/lunar_beacon.rs) showing how a few surveyed surface ranging beacons supply the low-elevation, wide-azimuth line-of-sight rows an all-overhead orbit-only set lacks — collapsing the ill-conditioned south-polar GDOP and, via a root-sum-square error budget, the realized position accuracy in metres (reusing the gnss_lib_py-validated DOP kernel and the airless-horizon visibility closed form; the dilution-of-precision analysis is written up in arXiv:2607.06212). |
| Lunar PNT suite | A lunar/cislunar navigation suite layered on the CR3BP core, each a runnable kind: Lunar Coordinate Time (lunar-time-offset, src/lunar_time.rs — the secular LTC/TCL − TT rate (LTC = Lunar Coordinate Time; TCL = its French form, Temps-Coordonnée Lunaire) from the self-potential difference + kinetic term, reported with the published 56–59 µs/day band); a geodetic lunar VLBI (very-long-baseline interferometry) delay observable (lunar-vlbi, src/lunar_vlbi.rs — an Earth-baseline near-field two-range-difference delay + rate, cross-checked against the same-codebase plane-wave Δ-DOR (delta differential one-way ranging) in the far-field limit, partials finite-difference-verified); a joint multi-technique OD + clock batch estimator (lunar-joint-od-clock, src/lunar_combination.rs — a Gauss–Newton fit fusing VLBI + lunar-local ranges + inter-satellite ranges) carrying a Fisher-information observability result: internal ranging alone leaves a six-degree-of-freedom rigid-body datum defect, so a surface station's absolute position is unobservable until an Earth-frame tie is added — an Earth-baseline VLBI delay restores observability for a sparse constellation and sharpens the Cramér–Rao bound for a rich one, the absolute datum closing at three non-collinear Earth stations (the observability result written up in arXiv:2607.02566); reference-frame realisation (lunar-frame-realisation, src/lunar_frame_realise.rs — a 7-parameter Helmert datum fit + IAU 2015 WGCCRE orientation tie — WGCCRE = the IAU Working Group on Cartographic Coordinates and Rotational Elements); a Moonlight/LCNS-class service-volume analysis (LCNS = Lunar Communications and Navigation Services; moonlight-service-volume, src/lunar_service.rs — DO |