Crystal Oscillators in OSNMA-Enabled Receivers: An Implementation View for Automotive Applications

To ensure the authenticity of navigation data, Galileo Open Service navigation message authentication (OSNMA) requires loose synchronization between the receiver clock and the system time. This means that during the period between clock calibrations, the receiver clock error needs to be smaller than a pre-defined threshold, currently up to 165s for OSNMA. On the other hand, relying on the PVT solution to steer the receiver clock or correct its bias may not be possible since this would depend on the very same signals we intend to authenticate. This work aims to investigate the causes of the frequency accuracy loss leading to clock errors and to build a model that, from the datasheet of a real-time clock (RTC) device, allows to bound the error clock during a certain period. The model's main contributors are temperature changes, long-term aging, and offset at calibration, but it includes other factors. We then apply the model to several RTCs from different manufacturers and bound the maximum error for certain periods, with a focus on the two-year between-calibration period expected for the smart tachograph, an automotive application that will integrate OSNMA.