ONCLE (One Clock Ensemble) for Galileo’s Next-Generation Robust Timing System

This paper presents the ONCLE (One Clock Ensemble) solution for the Galileo time and frequency reference system with advanced features in terms of robustness, performance, continuity, and simplicity. Each component clock is frequency-steered to the ensemble time, which itself creates an average of those steered clock outputs, while clock faults are detected and corrected in real time within an integrated system. The feasibility of algorithm and hard - ware approaches has been demonstrated on an elegant breadboard and verified by an extended test and validation campaign at the Engineering Model (EM) level, developed for the Galileo next-generation onboard timing system under European GNSS Evolutions Program. Based on the progress for space application and the heritage on the Galileo ground precise timing facility (PTF), we propose a robust solution for the upgrade of PTF for ground application aiming to pro - vide a fully continuous and performance-improved timescale under automated operation. The capability is demonstrated by preliminary simulation results.


INTRODUCTION
The generation of the clock ensemble output (or timescale), based on a pool of clocks that shows better performance in terms of accuracy, stability and reliability, is a concept that has been successfully implemented over many years. The fundamental concept of the timescale is the weighted average of the N clocks to optimize the ensemble performance with regard to different individual clock performances (Brown, 1991;Stein, 2003;Thomas et al., 1994).
To improve the robustness of the timing system, the identification of clock anomalous behavior has been of great interest. There is a large body of technical literature on detecting discontinuities in time series using various methods based on sliding square windows and Kalman filters (Galleani & Tavella, 2012;Huang et al., 2014;Khare et al., 2016;Riley, 2008;Signorile, 2014;Zenzinger et al., 2012).
To improve performance and robustness, various solutions based on real-time algorithms for clock ensembles (Galleani et al., 2019;Trainotti et al., 2019) and monitoring are possible. In fact, a practical implementation for phase continuous clock switching has been reported (Bertacco et al., 2020) for ground application. Alternative developments were conducted for the Galileo onboard timing system (Krauss et al., 2014;Soualle et al., 2010).
In this paper, we report our ONCLE Solution for the Galileo timing system. By this solution, the unit integrates clock ensembling with automated clock fault handling and switching and generates a timescale or frequency reference physically realized via a steering loop with simple implementation.
Section 2 describes the ONCLE concept. Section 3 provides the development status for the Galileo second-generation onboard timing system with verification testing results obtained at the Engineering Modeling (EM) level. Based on these outcomes, in Section 4, we propose an improved version of the timing system for current precise timing facility (PTF) in the Galileo ground segment, demonstrated by preliminary simulation results. Section 5 gives a conclusion and outlook of the work as a whole.

ONCLE CONCEPT
The concept of the ONCLE (One Clock Ensemble) for a robust time and frequency reference system was initiated by Spectratime in 2009 (Wang & Rochat, 2009). Since then, we have conducted feasibility studies and verifications of algorithm and hardware approaches for both space and ground applications.
With a minimum of three input clocks, the integrated system is able to generate an output signal with improved robustness and performances by advanced features in real time: • Clock ensemble based on the weighted average • Clock fault detection and correction based on a cascade of low-pass recursive filters and associated logic • Steering loop to keep all clocks in phase and on frequency Aiming for a simple and reliable solution, the algorithms are designed to be implementable by a field-programable gate array (FPGA) for space application or by a simple industrial micro-controller chip for ground application.

Current Timing System and the CMCU
The onboard timing system, including ultra-stable atomic clocks and the Clock Monitoring and Control Unit (CMCU), is one of the utmost critical payloads of a global navigation satellite system (GNSS). The frequency stability, robustness, and reliability of the timing system output signals have a direct impact on system performance through their contribution to the system ranging error and system availability.
In the first generation of Galileo satellites, one passive hydrogen maser (PHM) and one Rubidium atomic frequency standard (RAFS) operated in a hot redundancy scheme on each spacecraft, and the CMCU selected the clock signal to be distributed (Felbach, 2003). Vulnerabilities and risks of the present onboard timing system have since been identified.

Frequency Reference Subsystem (FRS) EBB Predevelopment for the Next Generation
Under the European GNSS Evolutions Program (EGEP), Spectratime with the support of the GMV developed an elegant breadboard (EBB) of the robust onboard Frequency Reference Subsystem (FRS), which was completed in 2014 (Rochat et al., 2012).
The feasibility of the ONCLE concept as an improved CMCU was demonstrated on FRS EBB over the course of this FRS project. The work was reported in the paper by Rochat et al. (2012). The self-standing unit was able to receive and process a number of clock signals and generate an output signal with improved availability and robustness. Tested under various clock degradation scenarios, this unit demonstrated at the breadboard level its capability to autonomously detect, correct, isolate, and remove (or reintroduce) the identified clock with reduced impact on the output signal.

CMCU+ EM Development for the Next Generation
During 2015 and 2019, an engineering model (EM) of the next-generation onboard CMCU (referred to as CMCU+) was developed in the frame of the EGEP (Wang & Rochat, 2019). As a subcontract of Airbus Defense and Space, Spectratime contributed 50% of the work for CMCU+. As far as the algorithms' activities are concerned, the algorithm's design, development, and high-level verification were the responsibility of Spectratime and the implementation of the algorithms on the hardware platform was the responsibility of Airbus (while keeping full functional compatibility with current CMCU).
The algorithm subsystem represents the "+" of the CMCU+ design with advanced features. The algorithms consist of three functionalities processing in real time. The algorithm architecture is based on FRS development and was adapted with CMCU hardware architecture.
FIGURE 1 shows the functional blocks of algorithms and the interface with other blocks and telecommands with signal flow. Phase comparisons between the output signal of CMCU+ and input signals from onboard clocks go through the Measurement Filtering (MF) algorithm to the ONCLE and Clock Fault Detection and Correction (CFDC) algorithms. In the case of clock faults, the CFDC algorithm provides fault corrections, failed clock removal, and discontinuity compensation commands to MF and the ONCLE. The ONCLE receives telecommands, if necessary, to remove or include a healthy clock and further provides ensemble corrections on the Direct Digital Synthesizer (DDS) to input modules. All input clocks are kept in phase and frequency to the corrected master clock.
The algorithm design was first verified by the authors using a simulation under various test cases with three clock scenarios including events on master and secondary clocks. After the implementation of the algorithms, high-level performance verification was conducted at the CMCU+ EM level in real-time operation with two sets of input Atomic Frequency Standard (AFS) configurations to assure the atomic clock technology diversity: • AFS Set A: 1 x PHM + 3 x RAFS • AFS Set B: 3 x PHM + 1 x RAFS According to the high-level performance verification requirements for CMCU+, various test cases of ensemble stationary performance and transient performances of clock events (healthy clock removal or inclusion, different dynamic frequency jumps, white frequency noise [WFN] level increase, clock failures, etc.) have been performed. Test results were verified by the clock-handling capability, Allan Deviation (ADEV), and the Maximum Accumulated Phase Offset (MAPO) during 100 mins of the output signal, in which the 100 min was driven by the time between two consecutive updates of the broadcast navigation message in the Galileo system (refer to ESA [n.d.]).
The FemtoSteppers were used to create frequency and phase steps as testing and validation tools to replay real clock measurement data or typical clock model files and to generate typical clock anomalies, with a resolution of 100 fs in phase and 1e-17 in frequency. Figure 2 illustrates the block diagram of the test bench. FemtoSteppers were connected to four active inputs of the CMCU+ unit to replace four atomic clocks. Two Timepods were used to measure the frequency or phase performance of signals: One for CMCU+ output and the other for that of input clock signals, in particular, where clock events occur. The CMCU+ EM under testing with the test bench is shown in Figure 3.
A few test cases are presented below as examples (refer to the paper by Wang and Rochat [2019]) for more test results). Figure 4 shows test cases of the ensemble stationary performance with two AFS scenarios: • For Set A, the ADEV of the CMCU+ output was dominated by the master clock (PHM01). The high performance of the PHM was maintained in the ensemble output while the sub-ensemble of 3x RAFS assured the full detection capability and the capability to form a next ensemble in case of the master PHM anomaly or failure. • For Set B, the ADEV at 1 s of the CMCU+ output was dominated by that of the individual PHM which served as the master clock and was improved when comparing individual PHMs at tau ≥ 10 s. The theoretical improvement limit was 1/√N (N being the number of clocks) when the ensemble driving clocks were of the same quality.  Figure 5 shows the test case when a medium-dynamic frequency jump of 1e-12 during 2,500 s started at 500 s on the master PHM01 for AFS Set A corresponding to the MAPO on PHM01 of 4.8 ns during 100 min. The CMCU+ output frequency was corrected consequently at 2,048 s, 2,540 s, and 4,689 s, triggered by small and medium jump detectors. The MAPO of the CMCU+ output during the 100 min was reduced to 1.1 ns (within the limit of 1.2 ns) during the anomaly specified for CMCU+. It demonstrated that the detection and correction of the jump is useful as long as it is performed adequately before the next update of the navigation message within 100 min. Figure 6 shows the test case when the white frequency noise (WFN) level increased by 10 times starting at 500 s on the master PHM01 for AFS Set A. The anomaly on PHM01 was shortly detected in 53 s by the large jump detector. The master PHM01 was immediately removed and switched over. The output frequency was affected only during these 53 s and was representative of the ensemble of 3x RAFS. The MAPO of CMCU+ output over the 100-min duration remained below 0.28 ns.

Current PTF
The precise timing facility (PTF) is a key element of the ground mission segment to generate Galileo System Time (GST). The active hydrogen maser (AHM) provides the physical realization of GST, ensuring the extremely high short-term stability required for navigation purposes (Morante et al., 2016;Stehlin et al., 2006;Zanello et al., 2009).
In order to reinforce GST availability, the PTF is designed to operate with at least two AHMs (one as primary and the other as backup). The backup AHM steering algorithm was developed to steer the backup AHM in phase to the primary AHM (Wang et al., 2008). In case of signal loss or out-of-lock of the primary AHM, the automatic clock switching was implemented to ensure GST (master clock [MC]) continuity by switching to the backup AHM (Zanello et al., 2009).
Several algorithms have been implemented in PTF to identify performance anomalies in GST(MC) and clocks as phase and frequency jumps and instabilities. When a clock anomaly occurs, the output of the algorithm exceeds the threshold and a warning is raised, offered by the measurement function (Zanello et al., 2009).
However, in this configuration, the detection of above clock anomalies as phase and frequency jumps and instabilities (including other lower-dynamics clock failure mechanisms than clock signal loss or out-of-lock) was not followed by automatic fault correction or clock switch-over, so human intervention was required, which could have been detrimental to the continuity of the GST. The other limitation of the current PTF was that the short-term stability of the GST relies on the individual nominal AHM.

Proposal of Robust Clock Ensemble for Next Generation
The results and experiences gathered for an onboard timing system led us to propose a Robust Clock Ensemble (RCE) solution for the next generation of PTF, FIGURE 6 Test case: WFN level increase on master PHM01 for AFS Set A which aims to integrate time generation as well as measurement and control subsystems (Wang et al., 2015). The ONCLE-based solution aims to improve the performance of GST, real-time clock anomaly detection, and automatic fault compensation (or clock switch-over). In particular, it will avoid the discontinuity in frequency and phase of the output signal to GST to enable reliable satellite clock modeling, which is essential to support the navigation timekeeping performance which is the key purpose of the PTF.
A mathematical model was developed to simulate the expected RCE output versus four AHM inputs. The function of phase-locked loop (PLL) based on the FemtoStepper, the phase comparator, and the proportional integral (PI) filter, as well as the functions of ONCLE and CFDC, were established in the model. Figure 7 shows the architecture of RCE covering the proposed hardware and algorithms. The RCE output is defined by the master clock, steering by the algorithms, and correction via the output Femtostepper.  Figure 8 shows the architecture of the steering system, forming a basic PLL. The PI filter acquires the phase difference between the secondary and master clocks and generates a steering frequency correction to be applied to the secondary clock via the FemtoStepper. The s-transfer function of second-order closed loop is:

PLL
where τ is the loop time constant of 1,000 s, selected as a trade-off of the time offset and the frequency stability to allow smooth steering of secondary clocks; ξ is the damping factor, which was set to 1. Figure 9 demonstrates that the secondary clock AHM2 is steered in-phase with the master clock AHM1 from the simulation.

ONCLE
The ensemble generation algorithm is based on the weighted or simple average of clocks, shown in Figure 10. Adaptive weights may be envisaged to be applied on input clocks. The frequency of the master clock is corrected to generate an ensemble output signal. Then, each clock is phase and frequency corrected and aligned to each input channel to the weighted average of individual clocks.
The ADEV comparison over 10 days' data in Figure 11 demonstrated improvement with the ensemble. The RCE output achieved the flicker floor of ADEV at 6e-16. The frequency drift of RCE was 6.4e-16/day, the average of the four AHMs. The output drift was also adjustable via the FemtoStepper by the correction command.

CFDC
The CFDC aims for the reliable detection and correction of clock faults with simple approaches. Figure 12 illustrates three functions handling main clock fault types: • Phase jump detection and compensation • Clock failure fast detection and clock removal • Frequency jump detection and compensation The phase measurements per 1 s from the phase comparator gives a straightforward indication in the case of a phase jump. Once a phase jump exceeds the pre-defined threshold, the compensation function makes the phase correction on the level of one threshold to the input with a 1-s delay and iterates the comparison for the next correction. As shown in Figure 13, the phase jump of 30 ps was detected immediately in 1 s after the event occurrence and was fully corrected during the next few seconds.
The frequency jump detection is based on recursive filters with different filtering factors, which requires minimal memory and registers, and is efficient for the detection of frequency jumps in various dynamics. The difference equation of the first-order low-pass recursive filter (e.g., the Infinite Impulse Response [IIR] Filter) is: where n is the number of samples, x (n) is the input of the filter, y (n) is the output of the filter, and N is the filtering factor. The time constant of an exponential moving average is the amount of time for the smoothed response of a unit set function to reach 1 1 63 2 − ≈ e . % of the original signal. The relationship between this time constant Tau and the filtering factor N is given by the formula: where T s is the sampling time interval of the discrete time implementation. If the sampling time is fast compared to the time constant, then: In each clock input channel, the low-pass recursive filters provide averaged frequencies in different time constants in order to detect various levels of anomalies. The subtraction of two successive filters acts as a high-pass filter and outputs to the fault detection and correction compared to the predefined threshold of each detector. A high-frequency jump can be detected quicker, while the detection of a small jump takes longer. The detection capability is the trade-off of the time constant, the detection time before corrective action, and the detectable level corresponding to noise level of clock technology in the ensemble.
The simulation result of the clock failure with a frequency jump of 8e-12 is illustrated in Figure 14. The RCE output was not affected by the clock failure as a consequence of the fast detection, discontinuity compensation, and clock removal. The algorithm is capable of detecting a failure of the master or secondary clocks and can switch the master clock to the next healthy clock smoothly. Figure 15 demonstrates that a very small frequency jump of 1e-14 is detectable and corrected. It is worthwhile to note that frequency jump detection is based on several recursive filters. More filters can be added, if necessary, and optimized depending on system requirements and clock characteristics. The performance of the CFDC in terms of detection delay, false alarm probability, and the minimum detectable level shall be further analyzed for this application in future work.

CONCLUSION
Thanks to the EGEP for next-generation onboard timing system developments, the feasibility of algorithm and hardware approaches to realize the ONCLE concept was demonstrated on the FRS EBB. The output signal with improved robustness and performance was verified by an extended test and validation campaign at the CMCU+ EM level.
Benefits of a robust onboard timing system for the second generation of Galileo (G2G) satellites have been demonstrated, in particular, with the ability to detect and correct space clock anomalies, keeping the latest uploaded navigation clock model valid in case of clock failure, clock removal, or clock inclusion. The clock model stays valid in the case of clock introduction if the clock exhibits standard drift rate with any offset. The only constraint when the new clock is introduced is the wait for clock stabilization after warm-up.
Advantages of the ONCLE solution render it a prospective candidate for an upgrade of the PTF on ground to obtain a continuous GST with improved performance. Preliminary simulation results with four high-performance AHMs have demonstrated the capabilities to provide a robust timescale generation. Moreover, without the need of human intervention, this integrated solution is expected to simplify the operation and, thereby, reduce the operational cost for ground segments.
It is worthwhile to note that this approach may also be interesting for other robust timescale generations on ground in the context of timing metrology. A single device integrating hardware and algorithms for key timescale generation functions (clock comparison, clock ensemble, clock switching, clock anomaly detection, isolation, and recovery) as developed for the onboard CMCU+ but requiring higher performance, should be targeted for the future development.

a c k n o w l e d g m e n t s
The authors acknowledge the European Space Agency for the technical guidance on algorithm development for the onboard timing subsystem for Galileo. The authors would like to thank GMV and Airbus DS for collaborations in FRS EBB and CMCU+ EM developments. Works of FRS and CMCU+ reported in this paper have been supported under contracts of the European Space Agency in the frame of the EGEP. The views presented in the paper represent solely the opinion of the authors and should be considered as R&D results not necessarily impacting the present European Geostationary Navigation Overlay Service (EGNOS) and Galileo system design. r e f e r e n c e s