1 Introduction↩︎

A recurring gap runs through the PNT-resilience literature. Resilient PNT is a recognised national priority [1], and government, industry, and academic sources converge on the need for a quantified, reproducible, vendor-neutral resilience score checked against a published framework, yet every fielded instrument is self-attestation or pure concept. The DHS Resilient PNT Conformance Framework (RPCF) v2.0 [2] defines maturity Levels 0 to 4 and seven technique categories (Obfuscate, Limit, Verify, Isolate, Diversify, Mitigate, Recover). The Resist-Detect-Respond-Recover (RDRR) function model [3] frames an assurance case as a documented body of evidence. Yang’s resilient-PNT concept [4] names availability, reliability, continuity, and accuracy criteria. None ships a measurement: a system owner declares conformance, or an assessor scores a questionnaire, and the result is a number nobody can reproduce.

This invites a hazard that is rarely examined. To produce a single grade, the multi-dimensional, model-derived reality of a PNT system must be collapsed into one number or one Level. Composite-indicator methodology has long warned that such collapses are sensitive to the (arbitrary) weighting and aggregation choices [5]–[7], but the warning has not been quantified for PNT resilience, where the dimensions trade off in physically meaningful ways: a single-band receiver is precise and cheap but fragile, while a diverse architecture is robust but each fallback source is coarser.

We make three contributions. First, an open, deterministic scoring engine that maps a PNT architecture and its simulated behaviour to per-dimension sub-scores across the RPCF categories, the RDRR functions, and Yang’s criteria, with every sub-score traceable to a scenario, a seed, an engine version, and an oracle, and tagged with its validated-or-modelled status. Second, a study of the decision-stability of the resulting single score and single Level, under a defensible weighting space and a threat ensemble. Third, a reporting protocol that follows from the result.

The decision-stability question has a direct precedent in composite-indicator sensitivity analysis [5]–[7]; our weighting-instability result (Section 4) is that established method applied to a new domain, and we claim it as such, not as a new technique. The genuinely framework-specific finding is categorical and lies outside weighted-aggregate sensitivity: a weakest-link Level, a minimum over the categories (our operationalization of the RPCF ladder, not the framework’s own definition), is driven by the threat assumed and is invariant to the weighting. Two further points are domain properties rather than sensitivity results: because the composite rewards declared techniques independently of measured behaviour, self-attestation can be gamed by declaration, which we show by construction; and an apparently redundant architecture whose sources share a common-mode failure domain has, by definition, an effective diversity far below its source count.

Honest scope. This is a controlled, parameter-grounded simulation, not a field measurement, and it is a simulation-derived self-assessment aligned to RPCF v2.0, not a certification, accreditation, or compliance statement, and not endorsed by any authority. The sub-scores are timing-domain and detection figures of merit; they are not position-domain accuracy. The modelled-majority of the underlying engine is carried on the face of every result.

2 Frameworks and related work↩︎

PNT-resilience frameworks. RPCF v2.0 [2] is the most operationally specific: it ladders systems through Levels 0 to 4 against the seven technique categories above, and is moving toward formal standardization (IEEE P1952 [8]). The RDRR model [3] and Yang’s framework [4] are complementary lenses on the same behaviours. All three are declarative; the present work supplies a measurement layer aligned to them, never replacing or certifying against them.

Resilience quantification. The notion of a resilience curve, the loss and recovery of function over time, originates in the resilience-triangle of Bruneau et al. [9]; our timeline metrics (detection, reaction, recovery, loss duration) and the bounded-versus-unbounded degradation verdict are PNT instances of that idea.

Composite-indicator fragility. That a weighted aggregate can reorder the things it ranks is known in the composite-indicator literature [5], [6]; our contribution is to measure the effect for PNT resilience and to tie it to the declared-versus-measured gap that self-attestation creates. We quantify ranking agreement with Kendall’s tau [10].

3 Method↩︎

3.1 Architecture model↩︎

An architecture is a named set of PNT sources, each with a kind, an independence group (sources sharing a group fail together), and a quality weight, plus the set of RPCF technique categories it declares. Independence groups separate apparent redundancy (source count) from effective redundancy (independent failure domains).

3.2 Framework-aligned sub-scores↩︎

Each (architecture, scenario) pair is reduced to a behaviour summary: holdover (in-spec coast under denial), availability, impairment-detector AUC, integrity, and a bounded-degradation flag. Each RPCF category sub-score is a documented, monotone function of one or more of these drivers in \([0,1]\): Verify from detector AUC; Diversify from the inverse-Simpson effective diversity (the Hill number of order 2) over independence groups [11], [12]; Mitigate from availability; Recover from holdover gated by the bounded flag; and the procedural categories (Obfuscate, Limit, Isolate) from declared presence scaled by source quality, so these three are declaration-driven and scenario-independent, which is precisely the mechanism H2 exploits. The RDRR functions and Yang criteria are documented re-projections of the same drivers and add no independent information; the position-domain Yang accuracy criterion is not modelled and is carried as a gap. Every sub-score carries a validated-or-modelled status and an oracle kind; in this study all drivers are modelled, and the engine’s machine-checked verification matrix forbids labelling a self-consistency check as an external validation.

3.3 Composite and tentative Level↩︎

The composite is a weight-normalized mean of the seven RPCF sub-scores, the single number whose stability we interrogate. We also assign a maturity Level by our own operationalization of the RPCF ladder, which RPCF v2.0 specifies qualitatively rather than as a formula: a weakest-link ladder on the minimum sub-score (cutpoints at \(0.2/0.4/0.6/0.8\)), with a bounded-degradation gate that caps maturity at Level 2 when error is unbounded, on the reasoning that a system that cannot bound its error under sustained denial cannot substantiate a higher Level. The minimum rule, the cutpoints, and the gate are our design choices, not RPCF’s definition; we call the result a tentative Level throughout, and the threat-dependence we report is a property of this weakest-link operationalization.

3.4 Instability metrics↩︎

We sample dimension weightings from a symmetric Dirichlet over the seven RPCF categories. At concentration \(\alpha=1\) this is uniform on the simplex (maximum entropy over weight vectors); it deliberately includes near-degenerate weightings that load most of the mass on a single category, so it is a broad space rather than a curated set of expert-endorsed weightings, and the concentration sweep below tightens it toward equal weights. For each (weighting, scenario) draw we score and rank every architecture, and report the top-1 flip rate (the fraction of draws whose winner differs from the modal winner), which we give per scenario, because pooling across scenarios mixes a high-instability nominal regime with near-stable active-denial regimes and a single pooled rate would be a mixture of heterogeneous blocks rather than one proportion. We also report the mean Kendall tau [10] between each draw’s ranking and its scenario’s equal-weight reference, the Level flip rate (the fraction of architectures whose tentative Level is not constant across scenarios), and each architecture’s rank range. The equal-weight ranking is a descriptive reference, not a privileged truth, since the thesis is that no weighting is privileged; Kendall tau measures whole-order agreement and quantizes in steps of \(2/\binom{7}{2}\approx0.095\) for seven items, so it understates instability concentrated in specific middle ranks and we read it coarsely alongside the rank ranges. To separate the two sources of variation we report the weighting-only flip rate within each fixed scenario (re-weighting with the threat held constant) and sweep the concentration \(\alpha\in\{1,2,5,10,20\}\) from broad to near-equal. Finally, to probe robustness to the chosen driver values, we perturb every behaviour driver by a uniform \(\pm 20\) percent over 40 replicates and recompute the metrics; this varies driver magnitudes but holds the functional form and the decision thresholds fixed, so it tests robustness within the reduction, not of the reduction itself.

3.5 Reference panel and threat ensemble↩︎

The panel has seven architectures spanning single-band GNSS, multi-band GNSS, GNSS with inertial, a spoof-hardened variant, a deliberately apparent-redundant quad-GNSS array, a “paper-tiger” single-band receiver that nonetheless declares all seven techniques, and a genuinely diverse architecture (GNSS, inertial, clock, eLoran). The threat ensemble is nominal, wideband jamming, spoofing, meaconing, and a combined attack, the standard civil GNSS threat classes [13]. The reduction from (architecture, threat) to a behaviour summary is a documented, deliberately simple physical model: a denial defeats GNSS RF sources; surviving non-GNSS sources set holdover; detection depends on the declared Verify technique and on cross-checks from independent groups; and a stealthy spoof corrupts the solution silently when the modelled detector AUC fails to clear a fixed threshold. The panel deliberately includes adversarial constructions, the paper-tiger receiver for H2 and the apparent-redundant array for H3, to surface specific failure modes; we therefore do not claim the panel is unbiased, only that, given the panel, the instability metrics are computed without further tuning. The bounded-degradation verdicts depend on where the modelled AUC values sit relative to the detection threshold, a sensitivity we flag in the limitations.

3.6 Pre-registered hypotheses↩︎

H1a (weighting instability). Within a fixed threat, re-weighting reorders the top architecture. Refuted if the winner is stable in at least 95 percent of weight draws under a near-equal (defensible) prior. H1b (Level threat-dependence). The tentative weakest-link Level is a function of the threat assumed, not a property of the architecture. Refuted if every architecture holds a constant Level across the threat ensemble. H2 (measured beats declared). Architectures with identical declared techniques can have opposite measured bounded verdicts, and Levels, under the same threat; established by a constructed existence example, not a survey statistic. H3 (apparent vs effective redundancy). Under a shared common-mode failure domain, an apparently redundant architecture’s effective diversity is far below its source count, a consequence of the failure-domain assignment that the engine deliberately separates from raw source count.

4 Results↩︎

The study evaluates seven architectures across five threats and 2000 weight draws per scenario, that is 10,000 rankings (and 70,000 architecture evaluations) per weighting prior, engine version 0.19.0, fixed seed. Table 1 consolidates the per-architecture picture.

4.1 H1a: weighting instability is confined to the contested middle↩︎

The winner-stability result splits cleanly by prior (Fig. 1, Fig. 2). Pooled across the five threats, the modal winner is chosen in 94.7 percent of broad-simplex (\(\alpha=1\)) draws (top-1 flip rate 0.053) and in 99.6 percent under the near-equal prior (0.004). Under the near-equal, defensible prior H1a is refuted: the winner clears the 95 percent stability bar comfortably. It survives only under the broad uniform-simplex prior, which narrowly fails the bar (94.7 percent) and does so largely because that prior admits near-degenerate weightings no analyst would choose. Weighting instability is therefore not this paper’s strong claim; the categorical Level instability of Section 4.2 is.

Where weighting instability does live is worth locating, because it is the case a buyer cares about. Re-weighting alone, with the threat held fixed, flips the winner in 22.0 percent of draws under nominal conditions but in only about 1 percent under each active-denial scenario: when GNSS is denied the genuinely diverse architecture dominates regardless of weighting, but when nothing is denied a checklist-declaring single-band receiver competes with it and the winner depends on which dimensions one weights. This is the weighted-aggregate sensitivity that the composite-indicator literature [5]–[7] describes, in a PNT instance. The rank ranges of the non-dominant architectures span most of the order (Fig. 1): the paper-tiger single-band receiver ranges over ranks one to five, the apparent-redundant quad-GNSS array two to five, and the GNSS-inertial system three to five, while only the dominant architecture (ranks one to two) and the bare receivers (ranks six to seven) are stable. The mean Kendall tau to the equal-weight reference is 0.90 under the broad prior, which confirms that the aggregate order is largely stable and that the instability is concentrated in the middle ranks rather than spread across the ranking.

Two controls frame the reading. Sweeping the Dirichlet concentration, the pooled flip rate falls monotonically from 0.053 at \(\alpha=1\) to near zero at \(\alpha=20\) (Fig. 2), so what instability there is comes from broad priors, not from any single extreme. And under a \(\pm 20\) percent perturbation of every driver across 40 replicates, the contested-middle architectures keep wide rank ranges in 100 percent of replicates and the Level-flip rate is invariant, so the conclusions are not knife-edge in the driver values; robustness to the functional form and the decision thresholds is a separate question we address in the limitations.

4.2 H1b: a single Level is scenario-dependent↩︎

This is the paper’s strongest and most weighting-invariant finding. The tentative weakest-link Level (our minimum-over-categories operationalization of the RPCF ladder, not RPCF’s own rule) is not a property of the architecture but of the threat assumed (Fig. 3). The diverse architecture is rated Level 3 under jamming, spoofing, and the combined attack, Level 2 under meaconing (harder to detect), and Level 0 under nominal conditions, where no denial occurs to demonstrate recovery. One in seven architectures changes Level across the ensemble (14.3 percent), so H1b holds. Unlike the weighting instability above, this is invariant to the weighting and is not reachable by weighted-aggregate sensitivity analysis, because a minimum ladder, not a mean, drives it: a single Level label hides the threat-dependence entirely.

4.3 H2: declared posture is not measured resilience↩︎

The composite rewards declared techniques: the paper-tiger single-band receiver, which declares all seven RPCF categories, scores 0.69 under equal weights in nominal conditions, second of seven and ahead of a real GNSS-inertial system at 0.34 (Fig. 4). Yet a checklist sees the paper-tiger and the diverse architecture as identical (both declare all seven techniques), while their measured behaviour diverges completely: across all four denial scenarios the paper-tiger is unbounded and Level 0, the diverse architecture is bounded and Level 2 to 3 (four declared-versus-measured contrasts). We construct this pair deliberately, so it is an existence proof rather than a survey statistic: it shows that because the composite and the technique checklist reward declared categories, a posture that is identical on paper can hide opposite measured resilience. Self-attestation can therefore be gamed by declaration; this single constructed pair establishes existence, not prevalence.

4.4 H3: apparent redundancy is illusory↩︎

A four-receiver GNSS array in four independence groups has an effective diversity (inverse-Simpson, the Hill number of order 2) of approximately 4.0 (3.998 with the modelled quality weights) when the groups are assumed independent. Once all four are assigned to a single GNSS common-mode failure domain, as a wideband denial that defeats them at once requires, that number is 1.0 by the definition of the index (Fig. 5). The collapse is therefore a consequence of the failure-domain assignment, not an emergent measurement; the substantive and externally well-established content is the physical premise that co-located GNSS receivers share an RF failure domain. The genuinely diverse architecture, whose clock, inertial, and eLoran sources do not share that domain, retains an effective diversity of 3.9. The point for scoring is that counting sources, or even counting nominal independence groups, overstates redundancy a common-mode threat erases, and that the engine separates the two so the overstatement is visible. Inverse-Simpson over quality-weighted groups is a redundancy proxy and carries no failure-probability semantics; a reliability-weighted survival metric is future work.

5 Discussion↩︎

The results argue for a specific reporting discipline. Do not report a single composite resilience score or a single maturity Level. Report the per-dimension sub-scores, each with its validated-or-modelled provenance; report the rank range an architecture occupies across defensible weightings, not a point rank; and report the assigned Level per threat scenario, not as a context-free badge. The single number is safe only when one design dominates, which is exactly the case in which the buyer does not need it; in the contested case where the buyer does need it, the number is unstable.

This complements, rather than competes with, RPCF and IEEE P1952. A standard defines the dimensions and the maturity ladder; an open, oracle-checked engine [14] can supply reproducible per-dimension evidence and an honest account of its own uncertainty. The honesty discipline, the validated-versus-modelled split carried on the face of every report and the refusal to claim certification, is not a disclaimer bolted onto a product; for a skeptical insurer or procurement buyer it is the product.

6 Limitations↩︎

The architectures and threat responses are synthetic, parameter-grounded reductions, not field measurements; the instability we measure is a property of how the dimensions combine, and the qualitative conclusions depend on architectures genuinely trading off across dimensions, which real PNT systems do, rather than on the specific reduction. The figures of merit are timing-domain and detection metrics; position-domain accuracy is not modelled and is reported as a gap, not a number. The sub-score mappings are one defensible choice among several; the study’s point is precisely that the choice matters, so we publish the mappings, the seeds, and the engine version for inspection. We tested robustness to a \(\pm 20\) percent perturbation of every driver and the qualitative conclusions held in all 40 replicates, but that perturbation holds the functional form and the decision thresholds (the detection-AUC cutoff and the Level cutpoints) fixed; the bounded-degradation and Level verdicts depend on where the modelled detector AUC values fall relative to that detection threshold, and robustness to the thresholds and cutpoints themselves is untested. The mappings remain one defensible family, and a fundamentally different reduction could behave differently. The engine is modelled-majority, and the scores inherit that status.

7 Reproducibility↩︎

The scoring engine, the instability study, the reference panel and threat ensemble, the integrity-hashed assurance report, and the artifact generator are open source in the Kshana PNT-resilience simulator [14]. Every numeric routine carries a hand-derived oracle test (35 tests for the resilience module; the full engine suite passes). The study artifact is regenerated by one command and records the engine version, seeds, weighting priors, and a configuration hash; the example assurance report carries a SHA-256 integrity hash.

8 Conclusion↩︎

A single-number PNT resilience score reliably identifies a dominant architecture and is stable under defensible near-equal weightings, but it reorders contesting designs under broad weightings, and, more sharply, a tentative weakest-link maturity Level is a function of the threat assumed rather than of the system. A constructed example shows declared techniques can diverge from measured resilience, and an apparently redundant architecture’s effective diversity falls far below its source count once a common-mode failure domain is acknowledged. The remedy is not a better single number but the discipline of reporting per-dimension, provenance-tagged sub-scores with their ranges, which an open, oracle-checked engine can supply as a measurement layer aligned to the published frameworks.

References↩︎