An Autonomous Satellite Time Synchronization System Using Remotely Disciplined VC-OCXOs

An autonomous remote clock control system is proposed to provide time synchronization and frequency syntonization for satellite to satellite or ground to satellite time transfer, with the system comprising on-board voltage controlled oven controlled crystal oscillators (VC-OCXOs) that are disciplined to a remote master atomic clock or oscillator. The synchronization loop aims to provide autonomous operation over extended periods, be widely applicable to a variety of scenarios and robust. A new architecture comprising the use of frequency division duplex (FDD), synchronous time division (STDD) duplex and code division multiple access (CDMA) with a centralized topology is employed. This new design utilizes dual one-way ranging methods to precisely measure the clock error, adopts least square (LS) methods to predict the clock error and employs a third-order phase lock loop (PLL) to generate the voltage control signal. A general functional model for this system is proposed and the error sources and delays that affect the time synchronization are discussed. Related algorithms for estimating and correcting these errors are also proposed. The performance of the proposed system is simulated and guidance for selecting the clock is provided.


Introduction
Some existing satellite time synchronization systems, such as the gravity recovery and climate experiment (GRACE) achieve synchronization by means of compensating the clock errors at the ground station rather than producing the synchronized and syntonized timing signals [1,2]. Achieving real-time synchronization and syntonization of satellite systems should produce more ideal signals and eliminate the various errors due to the inaccuracy of the on-board clocks.
In general, atomic clocks have better long-term stability but also worse short-term stability, greater volume, weight, power, price and shorter lifetime compared with a high quality crystal oscillator (although chip-scale atomic clocks have been developed, their stability is not as good as full-scale atomic clocks and they are not space qualified). For this reason, global navigation satellite systems (GNSS), such as the global positioning system (GPS), adopts a time-keeping system (TKS) that couples the atomic clock with a voltage-controlled crystal oscillator (VCXO) on-board the satellite to produce the reference timing signal [3,4]. This sophisticated and expensive military-based system is not suitable when low cost and low complexity is required. The Japanese Quasi-Zenith Satellite System proposed a solution that they refer to as "remote time synchronization system for the on-board crystal oscillator" (RESSOX) to realize time synchronization between the ground station and satellites [5,6]. Different from GPS, the QZS employs a VCXO as the on-board clock in the RESSOX scheme. This VCXO is remotely steered by an atomic clock that is located in the ground station by means of a series of feed-forward control and feedback control. The positioning accuracy of RESSOX is better than using GPS & QZSS with on-board atomic clock [7]. However, it was not implemented in the final QZSS owing to the budget constraints.
The systems mentioned above are steered by ground stations, which means the redundant ground stations and personnel are essential. Autonomous time synchronization for space systems is put forward in recent years. In [8], the NAMURU V3.2 spaceborne receiver, which is developed specifically for CubeSat formation flying, is disciplined to an external reference-GPS time. However, this kind of one-way time dissemination method has limited precision (20 nanoseconds). Hence starting from Block IIR, GPS adopts inter-satellite links combined with the polling time division duplex scheme (PTDD) to achieve autonomous time synchronization in cases where the ground station is not available [9,10]. Similar discussions about other GNSS systems could be found in [11,12], although these are not actually being implemented yet. In addition, some other scientific-based space missions are also being deployed, In [13], a method based on asynchronous two way time-stamping exchange is being employed, where the clock skews and clock offsets are estimated but not adjusted.
Based on the above discussions, when spacecraft activities require autonomous, robust, high-accuracy time synchronization performance, the question regarding how to reduce overall satellite cost, power consumption, on-board weight and volume, and improve satellite lifespan becomes an interesting issue. In this paper, we propose a remote physical time synchronization system based on a VC-OCXO. The main contributions of this paper are threefold. First, it has the STDD & FDD configuration, in which the satellites simultaneously communicate with each other via different frequencies. Different from the PTDD adopted by GPS crosslink, STDD has the advantages on ranging precision, clock synchronization precision, ranging efficiency and channel utilization ratio [14]. Second, a functional model for the synchronization loop that contains clock error measurement, prediction and adjustment, is designed to be applicable to various space scenarios. A relative motion compensation method based on the proposed model is provided for this purpose. Unlike the LS based relative motion compensation methods that makes use of pseudo-range, carrier phase and even Doppler observations [15,16], the proposed method only requires pseudo-range observations and ephemeris information, and the error originates from relative motion could be calculated by means of one communication link. Third, it proposes a cost-effective and energy-effective way to achieve the desired synchronization and syntonization performance of satellite systems.
The paper is organized as follows: in Section 2 we propose an autonomous time-synchronization system and illustrate the design in detail. In Section 3, a software-defined simulator is presented to investigate the performance of this system. Related simulation results are provided and analyzed. Finally, Section 4 concludes the paper and describes the advantages and disadvantages compared with existing time synchronization systems. Recommendations for further improvement are also provided.

System Design
The proposed system is a Master/Slave architecture, with the aim of the system to synchronize the VC-OCXO with a remote reference clock. GNSS-like technology is adopted as a basic element to establish the communication network. The master clock is considered as the reference clock and is assumed absolutely accurate and stable. It could be situated either on another satellite or at the ground station. For the sake of simplification, we call it the master satellite in this paper. The slave satellite carries an on-board VC-OCXO as its frequency source. More than one slave satellite may be employed in this system, which means it has a centralized topology. As the STDD & FDD configuration is employed, each slave satellite and the master satellite simultaneously intercommunicates with each other in defined time slots in terms of the CDMA & frequency division multiple access (FDMA) channel, which is different from the PTDD and broadcasting scheme adopted in GPS crosslink. An example of this system is illustrated in Figure 1, which also includes a table showing the connectivity between each of the elements. There are two fundamental scenarios for this system: ground to satellite mode (GSM) and satellite to satellite mode (SSM). Each of the two scenarios needs to be discussed separately due to the differences in parameters such as baseline length, velocity, communication frequency, visibility and space environment. Figure 2 shows the simplified representation of this system. The receiving device receives the GNSS like signal and after down conversion, the intermediate frequency (IF) is quantized using an analogue to digital converter (ADC). In the Measurement Device, signal acquisition, tracking and decoding processes are included for data recovery, code and carrier phase extraction, while measurement of pseudoranges and pseudorange-rates is also performed. The phase shift is measured by the comparison of the pseudo-noise (PN) code of the master satellite and the slave satellite. The transmitting device transmits the GNSS-like signal that incorporates clock error information by a series of processes that include a digital signal generator, digital to analogue converter (DAC), up-converter and amplifier. Different from the master satellite, the slave satellite carries not only a transmitting device, a receiving device and a measurement device, but also a control device. It is used to process the range measurement information from two satellites. The phase shift that is caused by the clock error is extracted by means of delay correction, after which the voltage control signal is generated to adjust the voltage of VC-OCXO.

Figure 2.
Simplified representation of this autonomous time synchronization system. Note that only one master is present, although this may be space or ground based.
In addition, it is noted that this physical time synchronization method could be considered as a closed loop. The clock error of the slave satellite relative to the master satellite is extracted from pseudo-range measurement. It is translated into the control signal, which is used to adjust the VC-OCXO of the slave satellite. Meanwhile, the corrected VC-OCXO generates the timing signal for ranging measurement activities. Therefore, the scheme could be divided into two parts: clock error extraction and clock adjustment, which are the two fundamental issues we consider.
In order to solve these two problems, a specific software simulator based on dual one-way ranging measurements and PLL [17] has been developed. The following is the principle of this new method, as shown in Figure 3. Based on the discussions above, the differences between the proposed system and the existing similar systems can be presented, as shown in Table 1.

Clock Model
Owing to the reference clock being considered as a perfect frequency source, we only need to model the VC-OCXO on-board the slave satellite. The instantaneous voltage of the VC-OCXO can be modeled as: where t is the reference time generated by the master clock, A0 and f0 are the nominal amplitude and frequency values of the signal respectively, and ε( ) t and ( ) t φ correspond to the amplitude and phase random fluctuations [18,19]. The instantaneous frequency is: The phase and frequency deviations are expressed as: The quantity ( ) x t is the clock error between two clocks. It is usually modeled by Equation (5) [20]: where 0 a , 1 a and 2 a represent the clock bias, clock drift and clock drift rate respectively, while ( ) ψ t denotes the random noise, which can be expressed by the sum of five independent noise terms [21]. Its power-law spectral density is represented as: These five random noise terms are known in the metrological literature as: Here the operator 〈⋅〉 represents time averaging, and M is the observation interval, yi is the i th of M fractional frequency values averaged over the measurement (sampling) interval [22]. We adopt the wavelet transform algorithm to realize the simulation of phase noise [23]. Figure 4 shows the principle of dual one way ranging measurement. Unlike the existing ranging method employed by GPS crosslink, the master satellite and the slave satellite communicate with each other simultaneously, but it is a "pseudo-simultaneous" scheme because of the clock skew and clock offset between two clocks. The parameters are defined as follows: t Δ is the initial clock error between the master clock and the slave clock, τ TM , τ RM , τ TS , τ RS are the transmitting and receiving delay of master satellite and slave satellite, respectively.  Hence the pseudo-ranges measured from each side and illustrated in Figure 4 are represented as:

Ranging Measurement
where I denotes the ionospheric delay between S and M, d denotes the other delay effects including tropospheric delay and Sagnac delay, c is the speed of light, ε S τ is the clock bias of the slave clock, which is derived from the ranging measurement process. From Equation (5), ε S τ can be expressed as: where ( ) M y t is the frequency deviations at the instance M t . Unlike the 1 a presented in Equation (5) a are 1 × 10 −12 /s and 1 × 10 −18 /s 2 separately, then ε S τ is approximately 20 picoseconds, which can be ignored.
Differencing and summing Equations (8) and (9) yields the instantaneous clock error and the instantaneous relative distance between two satellites: The first term of Equation (11) can be obtained directly from the ranging measurement of each satellite. The second term denotes the relative motion error. It is easy to understand that Equation (12) makes sense when the master satellite and the slave satellite are stationary, but ( ) t . This is the reason why Equation (12) uses an approximately equal. It implies that the error would be critical if the system members have a fast relative velocity between each other. Take GNSS for example, the maximum time synchronization error that originates from relative motion can be shown to be approximately 1 microsecond. The related equation will be presented later in this section. The third term can be calibrated precisely before the electronic apparatus employed in the synchronization loop are installed into the payload, but is expected to be within 0.1 nanosecond. The fourth term can be effectively compensated through the use of the dual frequency ionospheric correction algorithm, which is described in [24] as: where fi is the radio frequency, and Ri is the corresponding pseudo-range measurement. Certain frequencies can be adopted for different scenarios and goals of synchronization precision. The fifth term can be obtained by means of Equation (10), although the on-board clocks normally have good stabilities and as such, this term only has a small effect during a short time interval. The sixth term, which denotes the other delays, include the tropospheric delay and Sagnac delay in the GSM. The European Geostationary Navigation Overlay Service (EGNOS) tropospheric correction model can be employed for the GSM to eliminate most of the tropospheric delay [25]. Meanwhile, a Sagnac-effect correction method can be applied to the propagation time of the signal in such a case [26]. An applicable solution for this specific requirement is proposed in this paper. The relative motion error consists of two parts, namely the ephemeris error and the Doppler shift. In the proposed system, we assume that the slave satellites only have the pseudo-range observation and the ephemeris of the entire system members.
where ∆ denotes the change of position from the instance that the slave satellite transmits the ranging signal to the instance that the master satellite receives the signal. It can be expressed as ∆ = • , where is the velocity of the master satellite, which varies over time. Equation (14) can be expanded by the first-order Taylor series as: Similarly:  Furthermore, the error caused by clock error can be expressed as:

Substitution of Equations (15)-(17) into
Equations (11) and (12) yields: where: The LOS velocity of the satellites changes slowly in a short time interval, thus we can assume: Therefore, the terms c′ and c′′ can be given by: Substitution of Equations (21) and (22) into Equation (18) yields: Therefore, the maximum ranging error and clock error of slave satellite owing to relative motion can be expressed as:

Adjustment Method
The pseudo-ranges in the first term of Equation (11) are measured on each satellite, which means the information must be collected on the slave satellite for subsequent processing. In other words, the pseudo-ranges obtained from the master satellite must be packed into the data frames and transmitted to the slave satellite. Here we propose using the Proximity-1 Version-3 Space Link Protocol as defined by the Consultative Committee for Space Data Systems (CCSDS) for data frame design [27]. With a data overlay of 1000 bits/s and 200 bits per sub frame, the minimum clock adjustment time period would be 0.2 s. The processor on the slave satellite extrapolates the previous clock errors with a nonlinear LS method. The time to be adjusted is given by a third-order PLL, which is then converted into the voltage control signal. The on-board VC-OCXOs of the slave satellites change the frequencies at the fixed time period:

t t x t y t f t t a t t t t t t t − Δ + =
where is the th clock adjustment instance, is the adjustment frequency converted by the voltage control signal. As shown in Figure 7, a series of phase delay elimination procedures are implemented before the slave clock starts detecting the phase deviation between two clocks. It is noted that different effects should be considered in different scenarios, due to the space condition, separation distance and relative velocity. Equation (24) determines whether it is necessary to compensate for the relative motion error. The delay elimination methods for each kind of delays are represented in Table 2.

Case Study and Simulation
A Maltab software simulation was developed to fully explore the performance of the system. We simulated four slave clocks with different stabilities. The Allan deviation of each phase noise component at = 1 s is shown in Table 3, and the design of the PLL control loop is shown in Table 4.  Table 4. Simulation parameters of PLL.

Order of PLL Parameters
Third order

Relative Motion Compensation
In this Matlab simulation, since the slave satellites are independent of each other, we choose a master satellite and a slave satellite to perform the simulation. The orbit data from the GRACE mission and Beidou G2 & Beidou A2 were employed via Satellite Tool Kit (STK) because they have significantly different inter-satellite baselines and relative velocities. For both scenarios, we assume that the measurement noise is zero, and the delays including the ionospheric delay, device delay and other delays are effectively eliminated by corresponding methods represented in Table 1. The reason for this is that we want to focus on the theoretical performance of the considered relative motion compensation scheme, rather than on the degrading effects of the measurement noise and the residuals. The positioning error of the receiver is assumed to contribute 1 picosecond of timing error. The maximum decoupling error caused by relative motion can be obtained from Equation (24), which if sufficiently large can be corrected using Equation (23). The compensation results of the two scenarios are shown in Figures 8 and 9.   The results show that the errors due to relative motion have been effectively eliminated. Along with the space delays and device delay correction methods mentioned above, we can infer that the system is widely applicable for the proposed operation modes and that this novel system can maintain a considerable accuracy of clock error extraction even for high-dynamic scenarios.

Clock Adjustment
Once the clock error has been extracted, the next step is clock adjustment. In this simulation, the sub frame has an overlay of 0.2 s and the clock adjustment time period is 1 s, which implies that each control signal is predicted by 5 sets of previous data. The PLL parameters of the clock adjustment loop are described in Table 4. The bandwidth BL of the control loop is 0.5 Hz.
For both two scenarios, the slave clock has the same on-board VC-OCXO. The free running characteristic of this particular clock is shown in Figure 10, it is obtained with = 1 × 10 s, = 1 × 10 s/s and = 1 × 10 s/s 2 and the free run clock 3 shown in Table 3 is employed.
(a) Figure 10. Cont.   Figure 10a shows the Allan deviations of the simulated slave clock in three different situations: free running and steered by the master clock in the GRACE and Beidou G1 & A2 scenarios. Compared with the free running clock, the Allan deviation reduces by orders of magnitude when the clock is steered. In addition, the Allan deviations of GRACE 1 and Beidou A2 are nearly the same, which proves that the dynamic error can be practically eliminated in both cases. To better express the performance of the proposed system, the simulated clock error of both scenarios are shown in Figure 10b, from which it can be seen that the synchronization loop stabilizes in less than 25 s, even in the event that the on-board clock is drifting. In order to evaluate the stability of the synchronization loop, statistics relating to the synchronization error data ε n from the first hour to the 24th h have been determined for an arbitrary number of initial conditions. These statistics include the bias , and root-mean-square error . The results from these simulations are shown in Table 5. We can therefore infer that the dynamic error and the clock error are effectively eliminated and that the system could meet the requirement of various scenarios with different relative velocities and orbit planes.

Residual Errors
The simulated synchronization performance previously described is expected to exceed the performance of an actual deployed system constructed with hardware & software owing to the degrading effects of the residuals. However, the residuals cannot be simulated unless that the specified hardware, frequencies and space scenario is confirmed. Therefore, in Figure 11, clock instability is analyzed for different residual errors, which are uniform randomly distributed in the range 0.05 nanoseconds, [−0.05, 0.05] nanoseconds, [−0.1, 0.1] nanoseconds, [−0.2, 0.2] nanoseconds and constant 0.05 nanoseconds, respectively. The bandwidth of the control loop is 0.5 Hz. It can be seen that the residual error has a great effect on the short-term stability of the slave clock when it is not a fixed value, which could be explained by that the PLL cannot get the absolute ideal control signal with the increasing instability of residual error. Figure 11. Comparison of the Allan deviations of a free run slave clock and a controlled clock for different residual errors. Data from the 1st hour to the 24th h are truncated to evaluate the synchronization performance. The standard deviations of the stable loops and the free run clock are 0.004 nanosecond, 012 nanosecond, 0.24 nanosecond, 0.47 nanosecond and 10 nanosecond, respectively.

Bandwidth of the Control Loop
The accuracy of the PLL depends on the bandwidth. Analysis of the behavior of bandwidth in Figure 12 shows that clock stability improves with the decreasing bandwidth. However, PLL bandwidth cannot be set arbitrarily small because the dynamic stress tolerance may be exceeded. Hence the performance of the clock must be taken into account when designing the bandwidth of PLL.

System Performance
Now we consider the performance of the synchronization system, assuming a configuration with a single master clock and four slave clocks. Each of the slave clocks has a different level of performance, as indicated by the different free running Allan deviation plots shown in Figure 13, which also shows the controlled Allan deviations. The results imply that the slave clocks with different stability performances cannot be synchronized to a common master clock below a given threshold. In other words, the synchronization performance also relies on the free running stabilities of the slave clocks. Therefore, the same type on-board slave clocks should be applied for the proposed system in order to achieve better time synchronization performance.
It can be seen that some of the systems mentioned in Table 1 are real-life systems, while some are still in experimental stage. In addition, it goes without saying that the systems which employ two-way ranging would have a better accuracy of clock error measurement than the systems with one-way ranging. Furthermore, different clocks, clock adjustment intervals and space environments would affect the synchronization performances as well. Therefore, in order to fairly compare the proposed system with the other existing systems which also have the function of clock steering, the following assumptions are made.
First, all the systems adopt the same slave clock and the clock adjustment interval is 1 s. Second, all the systems are simulated under the same scenario. The PTDD scheme adopted by GPS and the scheme employed by NAMURU V3.2, which utilizes the measured clock error as the control signal are simulated, as shown in Figure 14. It can be seen that the proposed scheme has a better performance than the other schemes. We have reason to believe that the real-world performance would be better because of the implementation of the proposed phase error detection method.

Conclusions
A clock synchronization and syntonization system for satellites based on VC-OCXOs is described in this paper. Compared with the existed schemes, the proposed scheme behaves better under the similar simulated scenarios. A high-accuracy phase error extraction and correction method is proposed, including error analysis, correction methods and control signal prediction. The dedicated requirements Free running PTDD + PLL STDD + mesasurement Proposed system for different scenarios are proposed. The simulation results imply that the proposed system could achieve a relative good synchronization and syntonization performance under the premise of reducing overall costs. The proposed dynamic compensation scheme proves that the system could reduce the dynamic error to sub-nanosecond level in various space scenarios, such as formation flying scenarios, GNSS constellations or hybrid constellations. The slave clocks are recommended to be the same type because the synchronization loop has a limited disciplining capability for a particular VC-OCXO. Moreover, the bandwidth of the control loop relates to the convergent rate and synchronization precision of the closed loop. In addition, the residual error is also a critical element that will affect the synchronization loop, which must be considered carefully. Although the key features and techniques for this novel system have been described in this paper, there still remain many interesting open issues, such as distributed synchronization loop design in case of holdover mode.