Galileo Broadcast Ephemeris and Clock Errors Analysis: 1 January 2017 to 31 July 2020

A preliminary analysis of Galileo F/NAV broadcast Clock and Ephemeris is performed in this paper with 43 months of data. Using consolidated Galileo Receiver Independent Exchange (RINEX) navigation files, automated navigation data monitoring is applied from 1 January 2017 to 31 July 2020 to detect and verify potential faults in the satellite broadcast navigation data. Based on these observation results, the Galileo Signal-in-Space is assessed, and the probability of satellite failure is estimated. The Galileo nominal ranging accuracy is also characterized. Results for GPS satellites are included in the paper to compare Galileo performances with a consolidated constellation. Although this study is limited by the short observation period available, the analysis over the last three-year window shows promising results with Psat= 3.2 × 10−6/sat, which is below the value of 1 × 10−5 stated by the Galileo commitments.


Introduction
Galileo is the European Global Navigation Satellite System (GNSS). Similar to the other GNSSs (GPS, GLONASS, and BeiDou), it provides positioning, navigation, and timing services for worldwide users.
The first phase of Galileo deployment started with a reduced constellation of four operational In-Orbit Validation (IOV) satellites launched in 2011 and 2012. After the successful completion of this initial phase, the Galileo program is currently moving toward Full Operational Capability (FOC). The first pair of Galileo FOC satellites, E201 and E202, was launched in August 2014. Unfortunately, due to an orbit injection anomaly, these satellites were placed into erroneous eccentric orbits. After these two eccentric satellites, 20 FOC satellites were successfully launched between 2015 and 2018. Currently, the Galileo constellation comprises 26 satellites, 4 IOV, and 22 FOC, transmitting on five frequencies, i.e., E1, E5a, E5b, E5, and E6 [1].
Galileo Initial Service Open Service (IS OS) was declared by the European Commission on 15 December 2016. After the reprofiling of Galileo Safety-of-Life (SoL) in the early 2010s, Galileo is meant to support augmentation for SoL services through a Dual-Frequency Multiconstellation (DFMC) Satellite-Based Augmentation System (SBAS) and Advanced Receiver Autonomous Integrity Monitoring (ARAIM) [2,3]. Integrity denotes the measure of trust that can be placed in the information supplied by the navigation system.
The characterization of Clock and Ephemeris error of the GNSSs is a key element to validate the assumptions for the integrity analysis of GNSS SoL augmentation systems. Specifically, the performance metrics of SoL applications require the characterization of the nominal User Range Errors (UREs) as

Anomaly Monitoring
The methodology applied in this work to identify potential satellite failures is described next, which involves three steps: Data Cleansing, Anomaly Detection, and Anomaly Verification.

Data Cleansing
The broadcast RINEX navigation files collected by the International GNSS Service (IGS) may contain errors or inconsistencies from different sources, such as data login errors due to accidental bad receiver data and/or hardware/software bugs, losses of navigation messages, different transmission time recording, among others.
Data Cleansing is a complex algorithm that builds a cleansed RINEX broadcast navigation file from a wide set of RINEX files of individual receivers distributed worldwide by exploiting the redundancies between them.
The following steps are defined in [12] for GPS broadcast navigation data: 1.
Least-Significant Bit (LSB) recovery to remove potential errors in the decoding of navigation messages and convert the values to double-precision floating-point numbers.

2.
Classify the GPS URA values to cope with the different URAs appearing in the RINEX files (e.g., some receivers use URA indices instead of URA values, and the same URA index may correspond to three possible values in meters).

3.
Duplication removal and majority voting to select the most likely message as the one shared by the largest number of stations, after removing duplicates. In this step, the navigation data are classified as robust parameters (most ephemeris and clock parameters) and fragile parameters (Transmission Time of Message (TTOM), PRN, URA, Issue of Data Clock (IODC)). The robust parameters are used to identify the candidates of navigation messages. Their associated fragile parameters are then selected as those shared by the largest number of stations. 4.
TTOM recovering. The TTOM is not a parameter broadcast in the navigation message. The record given in RINEX navigation files is not the TTOM but the first reception time of the message by the receiver collecting data. The correct TTOM cannot be determined by the oldest one because some IGS receivers may provide an incorrect TTOM older than the actual one. On the other hand, since the IGS stations are not evenly distributed, neither can it be determined simply by the most frequent one. A procedure is then defined to retrieve the TTOM. 5.
Minority discard. After the previous steps, few navigation messages can still have errors in their robust parameters, and a uniqueness criterion is applied to select the final candidates.
Upgrading the Cleansing Algorithm to Galileo Broadcast Navigation Data The Galileo broadcast messages have some particular features that must be taken into account to upgrade the algorithm given in [12] for the GPS to process Galileo data. In short [9]: • There is only a single Issue of Data Navigation (IOD) to identify the ephemeris, satellite clock correction parameters and SISA, instead of the two IODC and Issue of Data Ephemeris (IODE) of GPS navigation data. • The following parameters are not linked to the IOD: The Broadcast Group Delay (BGD) values; The navigation Data Validity Status (DVS); The signal Health Status (HS).
In RINEX navigation files [13], DVS and HS are embedded in the 8 bits of the Satellite Vehicle (SV) health flag for the different signals E1B, E5a, and E5b. Thus, SV health = 0 means that DVS and HS are OK. Note: in the GPS, the Total Group Delay (TGD) and SV health are linked to the IODC.

•
Galileo broadcast navigation message update [9]: The typical refresh rate of navigation data ranges from 10 min to 3 h, and each message must be associated with a different IOD; The maximum nominal broadcast period of a healthy navigation message data set is currently 4 h; The message Validity Duration (VD) is 4 h.
Note: the GPS navigation message is, typically, updated every 2 h, with a different IODC, being the validity time given by the Fit Interval (FI), typically 4 h (it can also depend on the IODC value [14]). The validity of the Galileo message is up to 4 h after the Time of Ephemeris (Toe) [9]. • Minority discard step: In the case of GPS satellites, candidates are selected according to a uniqueness criterion based on PRN-IODC, i.e., the one confirmed by the larger number of stations having the same PRN-IODC. As the IODC may be occasionally reused by a satellite within the same day, a backup uniqueness criterion based on PRN and Time-of-Clock (Toc) is also applied, i.e., PRN-Toc. In the case of Galileo satellites, the previous uniqueness criterion, based on checking the PRN-IODC, cannot be applied. This is because the IOD may be repeated within the same day. Thence, with Galileo satellites, for each Data Source's value in the RINEX file, the uniqueness is based only on the PRN-Toc criterion. This criterion is applied to all robust parameters, except SV health (i.e., DVS, HS) and BGDs, as they are not linked to the IOD.
Finally, all messages containing the selected robust parameters by the previous uniqueness criteria, appearing with any combination of SV health and BGD parameters, are approved and saved in the consolidated broadcast navigation RINEX file.

Anomaly Detection: Space Approach
Anomaly detection follows the "Space Approach" defined in [12], which uses the consolidated broadcast navigation files from the previous Data Cleansing step and precise orbit and clock products provided by IGS, including other sources as well.
The satellite coordinates and clocks are computed from the consolidated broadcast navigation files according to the Galileo OS SDD [9]. The discrepancy between coordinates and clock regarding the precise products is calculated. The orbit error is then projected to the user's location on the Earth's surface and combined with the clock error to represent the orbit and clock error at the user level. The Worst-Case User Range Error (WC URE) is calculated, which corresponds to the user location where URE takes the greatest absolute value. The geometric method described in Section 3.5 of [12] (p. 40) has been implemented for the WC URE computation. Anomalies are detected by comparing the WC URE with a threshold defined for a given level of probability (see Section 4.1).
Following [12], adapted to Galileo data, a potential anomaly is declared when all the following conditions are fulfilled:

•
The WC URE exceeds the NTE threshold; • The most recent navigation data set broadcast on a Healthy SIS by the Galileo satellite is used, where Healthy SIS, means: The RINEX field SV health [13] is 0, i.e., DVS = "Navigation Data Valid" and HS = "Signal OK", and SISA NAPA (NAPA = No Accuracy Prediction Available); • The Age of Ephemeris (AoE) is smaller than or equal to 4 h Toe, i.e., The precise orbits and clocks are available and healthy. Note: in the GPS the validity period is given from TTOM and Fit Interval (FI) by ∆t = t − TTOM ≤ FI, where FI is typically 4 h.
A configurable Sampling Rate (SR) of 300 s has been used in this study. Precise orbits at 900 s SR have been interpolated. No interpolation is needed for clocks, as they are available at 300 or 30 s SR. Maximum data holes of 1800 s have been allowed for IGS orbits and 600 s for clocks.

Anomaly Verification: Ground Approach
The anomaly verification follows the "Ground Approach" defined in [12], which uses the RINEX Observation and Navigation files of individual receivers of permanent stations to validate the potential anomalies detected with the Space Approach. The algorithm is based on the following steps:

1.
A set of 10 or more active stations having the satellite in view during the whole anomaly event, or as long as possible, is selected. These stations should experience as large anomalous UREs as possible. The algorithm for station selection presented in Section 4.2 of [12] has been implemented in this study.

2.
For each selected station (rec), the Instantaneous SIS URE (IURE) is computed from the prefit residual (pre f it j rec ) of the Ionosphere-Free (IF) combination of Galileo C1 and C5 code measurements [15]. That is, for each satellite, j = 1, . . . , N in view from the receiver (rec): whereρ j rec andT are the geometric range and the satellite clock offset computed with the broadcast ephemeris, Trop j rec is the tropospheric delay estimated using the UNB-3 nominal model and the simple mapping function implemented in the gLAB tool [16], and P IF j rec is the IF combination of unsmoothed code measurements. Satellites below 5 deg of elevation are excluded. The IURE for the anomalous satellite (sat) is then computed as: whereT rec is the receiver clock offset estimated as the weighted average of the prefit residuals of all satellites in view, excluding the anomalous satellite (sat) (see Equation (4.7) in [12]). A configurable sampling rate of 300 s has been used in this study. 3.
Following [12], the Galileo satellite is set as "anomalous" when all the following conditions are fulfilled: • The IURE exceeds the NTE threshold; • The most recent navigation data broadcast on a Healthy SIS by the Galileo satellite are used, where Healthy SIS means: The RINEX field SV health is 0, i.e., DVS = "Navigation Data Valid" and HS = "Signal OK" and SISA NAPA.

•
The broadcast navigation message is within its validity time, i.e., The signal was tracked with an acceptable SNR, i.e., the RINEX SNR flag value ≥4. Figure 1 shows an example of Anomaly Detection, with the Space Approach in the left plot and Anomaly Verification with the Ground Approach in the right plot. This example corresponds to the event experienced by the Galileo satellite E101 on 26 December 2017. An NTE threshold of 4.42 × SISA is used. As depicted in the left plot, due to a large clock error (in pink), the WC URE (green circles) goes over the NTE at 07:40 of 26 December 2017, with the satellite set as healthy. This anomalous condition ends when a new navigation message with an unhealthy condition (black line) is received at 15:00. The orbit error (in blue) is kept under the NTE threshold. This potential event is confirmed by the Ground Approach shown in the right plot, using measurements from the station SEYG (in Seychelles islands). The IURE values computed from Space and Ground approaches are shown in green and blue, respectively. The unhealthy condition from the RINEX flag shown in black corresponds to the consolidated (cleansed) RINEX file.

Decision Criterion
The potential SIS anomaly is considered "true" when none of the selected receivers show a nominal IURE, at least one receiver from the selected set shows an anomalous IURE, and the rest are unable to track the satellite during the anomalous event. On the contrary, an anomaly is considered "false" when none of the selected IGS receivers shows anomalous IURE, at least one of the receivers from the selected set shows nominal IURE, and the rest do not track the satellite. The case where, at the same time, there are receivers that present anomalous and nominal IURE is considered "paradoxical" and requires manual intervention. The satellite is considered "untracked" when the selected receivers with the anomalous satellite in view cannot track it. In this case, the anomaly is very likely to be false [12].

Data Sets
The previous data cleansing, anomaly detection, and verification procedures have been applied over 43 months of F/NAV Galileo navigation data, from 1 January 2017 to 31 July 2020.
Worldwide RINEX-2/3 Navigation files have been gathered from several public domain servers, such as CDDISA, EUREF and ESNG, avoiding repetitions of stations. The already-compiled RINEX navigation files named "brdc, brdm or auto" are not used to guarantee "one station one vote." Dual-frequency RINEX-2/3 Observation files at a 1 Hz sampling rate have also been gathered from IGS servers.
Precise orbit and clock products from the Multi-GNSS Experiment (MGEX) (CODE products) [17] have been used to check the broadcast navigation data (with orbits at 900 s until 5 August 2017 and at 300 s later, and clocks at 300 s until 11 August 2017 and at 30 s later).
The Antenna Phase Centers (APCs) and the System Time used in the IGS products is different from those used in the broadcast navigation data. Thence, the Antenna Exchange Format (ANTEX) file provided by the European GNSS Service Center [18] has been used, which has the same APCs as in the broadcast Galileo ephemeris. Some update has been necessary for the ANTEX reading, as these files use a different reference than IGS ANTEX files.
To align the IGS clocks to the Galileo system time, the IGS clocks have been corrected first for the difference (∆APC) between Galileo broadcast and IGS APCs. The epoch-wise trimmed mean of the difference between the IGS (∆APC corrected) and broadcast clocks has been computed to estimate the difference between Galileo and IGS reference times (∆T). This trimmed mean is calculated after removing the 20% of data above and below the epoch-wise median. Finally, the IGS (∆APC corrected) clocks are aligned with the Galileo system time by correcting with ∆T.
Although this trimmed mean can protect against clock outliers due to one or few faulty satellites, the estimation of ∆T with the previous approach can be affected by simultaneous satellite events, as experienced on 14 May 2017 (see Figure 2). For the GPS satellites, the National Geospatial-Intelligence Agency (NGA) precise products [19] have been used, which requires neither any APC correction nor time alignment. The sampling rate of these products is 900 s until 27 February 2012 and 300 s afterwards.

Observed Error Distribution
This section analyses the observed error distribution in the coordinates and clocks of Galileo and GPS satellites, computed from the F/NAV and LNAV broadcast navigation messages, respectively.
The plots of Figure 3 show the relative frequency histogram for the aggregate total radial (red), along-track (green), cross-track (blue), clock (pink), and IURE (cyan) errors. The plots in the left column involve more than 3.5 years of Galileo F/NAV navigation data, i.e., from 1 January 2017 to 31 July 2020. The plots in the right column are for the GPS satellites and LNAV message and contain more than 10 years' data, i.e., from 1 January 2010 to 31 July 2020. Although larger periods are also available for GPS, it is unclear if they would represent the current state of the system [11]. The bottom plots are a zoom of top plots to better see the distribution peaks. Figure 3. Relative frequency histogram for the observed error distribution of broadcast navigation data from aggregated data of all satellites (bin size: 2 cm). The plots in the left column are for Galileo F/NAV from 1 January 2017 to 31 July 2020. The plots in the right column are for GPS LNAV data from 1 January 2010 to 31 July 2020. The plots show the radial (red), along-track (green), cross-track (blue), clock (pink), and IURE (cyan) errors. Bottom plots are an x-range zoom of top plots. The eccentric satellites E201 and E202 are excluded.
A sharper distribution is found for Galileo satellites compared with the GPS histogram. The radial and cross-track errors are the error components more tightly distributed in both Galileo and GPS. Similar distributions are found for Galileo radial and clock errors, leading to a similar pattern for IURE. Moreover, a small bias appears in the radial error and IURE (see left column, bottom plot). This bias is quantified in Section 5, when analyzing the observed nominal accuracy. No bias is observed in the clock error, although it may have been absorbed, in some way, by the clock alignment process. In the GPS, the IURE is clearly dominated by clock error, with fairly overlapping patterns. Cross-track error is sharper in the Galileo than in the GPS, whereas along-track exhibits a larger spread in both Galileo and GPS data. No remarkable biases are found in the GPS error distributions.

Identification of Potential SISE Events
The SISE values, measured as the instantaneous maximum projected ranging errors at the worst user location, i.e., WC URE, are analyzed this section and the next. We start identifying first potential events having anomalous SISE values and then we will analyze the SISE overbounding by a Gaussian distribution.
As stated in the OS SIS ICD [20], the "SISA is a prediction of the minimum standard deviation (1σ) of the unbiased Gaussian distribution, which overbounds the SISE predictable distribution for all possible user locations within the satellite coverage area." Figure 4 depicts the relative frequency of the different broadcast SISA values for the IOV and FOC satellites and across the whole constellation, excluding the eccentric satellites E201 and E202. As depicted, the most frequent SISA value (more than 97%) is 3.12 m in these three satellite sets, and NAPA is broadcast in less than 0.8% of cases. The methodology of Anomaly Monitoring presented in Section 2 is used next to identify anomalous behaviors in Galileo and GPS satellites. The same threshold as GPS with IAURA is used for Galileo with SISA to identify potential events, i.e., NTE = 4.42 × SISA.
A summary of the identified Galileo F/NAV events is given in Table 1 and Figure 5. Regarding Table 1, the detections with the Space Approach are shown on the left and the verification results with the Ground Approach on the right. The Satellite Vehicle Numbers (SVNs) E1XX corresponds to the IOV satellites and E2XX to the FOC satellites (see Figure 5).  It is worth mentioning the detection was found with the space approach for SVN E208 at the end of 14 May 2017 (see Table 1). The Ground Approach algorithm declares this event as "Paradoxical" because only one station, the RGDC, Rio Grande (Argentina), in the selected set of 50 stations, exhibits abnormal behavior during the analyzed time interval, while seven stations are in nominal mode. The other analyzed 42 stations untracked the signal. Figure 6 shows, at the left, the plot of space approach with the WC URE over the threshold at the end of the day. The right plot shows the Ground Approach plot for the station RGDG, where the ground IURE, blue dots, reaches the 4.42 × SISA threshold, indicated by red dots. Although the other seven stations tracking the satellite are in a nominal condition on this day, many of them detect the anomalous condition a few minutes after on the next day. In fact, this is the same event involving both 14 and 15 May 2017.  Table 1, RGDG, detecting the anomaly. As depicted, the WC URE values are reaching the threshold at the end of the day. The y-axis is in a cubic root scale.
The multisatellite events detected on 14-15 May were produced by hardware equipment failure in the ground segment of Galileo. As a result, the navigation message for all satellites was not refreshed. The cause root of this failure was identified, the equipment was replaced, and the services were recovered to their nominal levels at 12:44 of 16 May 2017 (see NAGU2017015 [21]). Figure 2 depicts the large error experienced by several of these satellites during this event on 14 May 2017.
As the consolidated (cleansed) RINEX navigation files are a critical input for the Space Approach anomaly detection, and in order to improve the reliability, a double-check has been performed using the consolidated Galileo RINEX navigation files provided by Centre National D'Etudes Spatiales (CNES), cleansed with the "Galileo Ephemeris Consolidation and Control Analysis" (GECCO) software (CNES, Toulouse, France) [22]. The GECCO cleansed RINEX files are available at the CNES server [23].
All true events detected with the gAGE cleansed RINEX navigation files were also detected with the GECCO cleansed files. Figure 7 shows an example of anomaly detection with the Space Approach using RINEX cleansed files from gAGE (left plot) and from GECCO (CNES) (right plot), with similar results. The 29 October 2019 event detected in the Galileo IOV E101 satellite (see Table 1) is described next in detail, as it will be relevant in Section 6 when estimating the observed satellite fault probability.
Galileo IOV E101 Satellite Event on 29 October 2019 A major service failure was experienced by the IOV satellite E101 on 29 October 2019. A brief description of this event and its detection is depicted in Figure 8. At approximately 18:00, the satellite clock begins to experience a large drift. This is depicted by the precise clock determination shown by the left plot in the first row of Figure 8. This behavior cannot be reproduced by the broadcast clock that follows a linear drift (see the blue line in the same plot). The precise clocks estimated with the gAGE/UPC Processing Facility [24] have been used in this plot, but the same drift is found in the precise clocks from CODE, GFZ, or CNES.
About 12 min later, the WC URE exceeds the threshold NTE = 39.78 m considered in the Milestone 3 report [7] to declare a major service failure (see, for instance, the right plot in the first row of Figure 8). The anomalous condition ends at 18:43:30 after the reception of a new message with IOD = 15, with DVS = "Navigation Data Valid" and HS = "Signal OK," but SISA = NAPA, which means that OS SIS status was set to MARGINAL. The satellite was not declared as Healthy SIS up to several days after.
This anomaly detection by the Space Approach is illustrated in the right plot at the first row of Figure 8. The clock error drift dominates the WC URE, reaching the NTE threshold at about 18:12. The orbit error is well maintained at its nominal value. The second row of Figure 8 illustrates the verification of this anomaly by the Ground Approach, using the station STHL, Santa Helena island (UK) (left plot) and station HARB, Hartebeesthoek (South Africa), (right plot). A total of 50 stations have been used to verify this anomaly (see Table 1), with the anomaly being confirmed by 18 of them. The other 32 were not tracking the satellite at that time.

GPS Satellites: Events
Exceeding the 4.42 × IAURA Threshold Figure 9 and Table 2 summarize the analysis performed on GPS satellites for the period dating from 1 January 2010 to 31 July 2020, strictly applying the methodology given in [12]. In this period of more than 10 years, only three events are recorded where the WC URE exceeds the threshold NTE = 4.42 × IAURA, totaling 50 min of failure. The first two failures occurred on 22 February and 25 April 2010, and the third occurred on 17 June 2012. No more failures until 31 July 2020 have been detected. The analysis and validation of these failures are detailed in [11], and we will not address them any further.

Signal-in-Space Error Overbounding
As indicated in the introduction, the nominal satellite ranging accuracy is typically characterized by a Gaussian distribution that overbounds the true distribution out to some probability level [25,26]. The model also assumes that much larger errors can be experienced than would be expected according to the Gaussian distribution, but with a very low probability. This small probability corresponds to the fault likelihood [11]. An overbound of SISE by a zero-mean Gaussian distribution with σ = 4.5 m for the aggregated distribution from all satellites is found in [27], after extrapolation to what is expected when the Galileo constellation reaches the FOC. A slightly higher URA value of 6 m is proposed by ICAO NSP [10] as a conservative overbound of the actual SISE to have some additional margin for Horizontal ARAIM (H-ARAIM) Galileo dual-frequency users. These two sigma values are assessed in Figure 10 for the observed SISE overbounding over two time intervals, the full period of 43 months and the last three-year window, i.e., excluding the first six-month period. This analysis is based solely on the experimental error distribution, without any extrapolation to the FOC. The plots of Figure 10 show the One-minus empirical Cumulative Distribution Function (1-CDF) of the WC URE. The pink and red lines indicate the expected values for a Gaussian distribution with a zero mean and standard deviations σ = 4.5 and σ = 6 m, respectively. The left plot comprises the full period, from 1 January 2017 to 31 July 2020. Satellites not bounded by any of the two Gaussian distributions, with σ equals to 4.5 or 6 m, are indicated by different colors, i.e., E101, E103, E203, E205, and E206. The aggregated 1-CDF for all satellites is shown in black. Several of these satellites experienced anomalous events during the firsts six months of operation after the IS OS was declared, affecting the CDF behavior. The root cause of these events has been analyzed in detail by the CSP, and most of them are not considered representative of the FOC of Galileo [27]. In fact, according to the Galileo Project Office, only the events of E203, on 6 June 2017, and E101, on 29 October 2019, are considered representative of the FOC [5] (see Section 6.3).
The right plot of Figure 10 shows the same 1-CDF, excluding the first six months of data, where many of the abovementioned events occurred, i.e., from 1 August 2017 to 31 July 2020. This time-window eliminates most, but not all, of the abovementioned events that occurred. As depicted, the two Gaussian distributions with σ = 4.5 and σ = 6 m overbound all satellites, except E101. Moreover, the aggregated 1-CDF, incorporating all satellites, in black, is well bounded below the probability level 1 × 10 −5 .
It is worth to say that, although the system is assumed to be stationary, this hypothesis is not entirely true. In fact, the ground segment software is updated and improved over time, and the satellite designs are refined with enhanced capabilities. Therefore, the system is expected to evolve toward a better performance along time, and stationarity can be assumed as a conservative hypothesis. It should be also noted that, whether or not a satellite exceeds the Gaussian distribution, at a given probability level, depends on the magnitude of the fault and on the total amount of data available to the satellite, regarding to the fault duration. For instance, in the case of the E206 event of the Galileo satellite (5 September 2018, see Table 1), the amount exceeding the threshold and duration of the event was not long enough, compared with the total amount of data, to strongly affect the 1-CDF overbounding (see Figure 10, right plot, Table 1 and Figure 5). Figure 11 shows the same plots as Figure 10 but for the GPS satellites over the same 43 months of data period, from 1 January 2017 to 31 July 2020, at the left plot, and about over a 10-year period, from 1 January 2010 to 31 July 2020, in the right plot. In the first case, all satellites largely fall under the Gaussian distributions depicted by the pink and red lines. In the right plot, only the GPS satellite G030 goes beyond the red line above the 1 × 10 −5 probability level. Satellite G059 also crosses the red line, but well below 1 × 10 −5 . As shown in Table 2 and Figure 9, although this satellite experienced a fault event (17 June 2012) of about 20 min of duration, and with a WC URE reaching up to 451.5 m, it falls below the 1 × 10 −5 level, due to the large amount of valid data available of this satellite. This is not the case of the event that occurred on satellite G030 (22 February 2010), which, with a similar duration and with a WC URE of only 42.9 m, impacts more to the CDF, exceeding the Gaussian distributions above the 10 −5 level, due to the short amount of valid data available in the analyzed period. Figure 11. The same plots as in Figure 10, but for GPS LNAV broadcast navigation data in the periods 1 January 2017 to 31 July 2020, in the left plot, and 1 January 2010 to 31 July 2020, in the right plot.
Having in mind the previous considerations, it is important to point out that the Galileo results are based on a reduced amount of data, about three years and a half, and some of the events experienced (identified in the previous Section 4.1) do not reflect the FOC configuration of the system. The results must then be consolidated with large observational data.

Observed Nominal Accuracy
The observed nominal accuracy of Galileo data is derived by excluding the tails of the SISE distribution analyzed in Section 4.3. Thence, Nominal Condition in Galileo is assumed when the following conditions are met:

•
The WC URE is under the 4.42 × SISA threshold; • The most recent navigation data set broadcast on a Healthy SIS by the Galileo satellite is used, where Healthy SIS means: The RINEX field SV health is 0, i.e., DVS = "Navigation Data Valid" and HS = "Signal OK" and SISA NAPA; • Broadcast navigation message is within its validity time, i.e., AoE = t − Toe ≤ 4 h; • The precise orbits and clocks are available and healthy. Table 3 shows, for the Galileo F/NAV navigation data, the overall mean value, 68th and 95th percentiles, and the sigma value for the Galileo radial, along-track, cross-track, clock, WC URE, and IURE. The values are given for each individual satellite, grouped by block and aggregate total. In the case of IURE, the values have been estimated over 20 points spread evenly on the Earth, derived from the vertices of a regular dodecahedron [12]. The analyzed period comprises from 1 January 2017 to 31 July 2020. The GPS nominal accuracy from LNAV navigation message over the same period is given in Table 4 for comparison.   Tables 3 and 4. The plots in the left column are for Galileo satellites, and plots in the right column for GPS satellites. From top to bottom, plots in Figure 12 are for radial, along-track, cross-track values, and plots in Figure 13 are for clock, WC URE and IURE values. The consolidated gAGE RINEX navigation files for Galileo and GPS have been used in this assessment.  As it can be seen in Figure 12, Figure 13 and Table 3, except for the radial component, the Galileo satellites show much smaller percentile values than the GPS satellites. Nevertheless, the mean bias appearing in the radial component of IOV and FOC Galileo satellites, of 5.6 and 9.7 cm, respectively, is significant. The largest biases are found in the FOC satellites, mainly on E203 to E214, reaching up to more than 10 cm. It is worth mentioning that the ANTEX files igs14_2118.atx from IGS and GSAT_2023.atx (with its associated Antenna Reference Points) from the European GNSS Service Center [18] have been used, and only discrepancies in their APCs were identified on satellites E215 to E222, which are those experiencing the smaller biases in the FOC satellites. No discrepancies are found in the APCs for the IOV satellites. Thence, as the larger biases are associated with satellites having the same APCs in both ANTEX files, the abovementioned biases are not due to any mismatch between the APCs used in the IGS products and Galileo broadcast orbits for these satellites. In spite of these biases, the 68th and 95th percentiles and the standard deviation in the radial component error are of the same order as those of GPS (see Tables 3 and 4). This positive bias in the radial component could be partially linked to the accuracy of the MGEX (CODE) reference products for Galileo satellites at the level of 5 cm [28], but it deserves further studies.
The clock alignment applied for Galileo satellites can absorb a global bias in the clock error, and this is probably the reason for having only −0.3 cm of total mean clock error in the last row of Table 3. Satellites E102, E103, E204, and E207 experience clock biases of about 10 cm or more. In spite of these biases, again, the 68th and 95th percentiles and sigma are similar, or even smaller, than in GPS. The combined bias in the radial component and clocks is translated to the WC URE, exhibiting global values of 22.7 and 10.7 cm for IOV and FOC Galileo satellites, but the 68th and 95th percentiles and sigma are smaller than those of GPS.
The along-track error component of Galileo satellites is several times smaller than the GPS, as depicted by the four statistics shown in Table 3 compared with Table 4. The cross-track component also shows smaller error figures than those of the GPS.
Finally, and as expected from the previous results, the Galileo IURE values, in the right of Table 3, shows a mean bias highly correlated with the WC URE values, while the 68th and 95th percentiles and sigma are, again, smaller than in the GPS.
Last but not least, in order to have a more robust estimation of GPS nominal accuracy, Table 5 shows the values computed over the more than the ten-year period considered before, from 1 January 2010 to 31 July 2020. As shown, values quite similar to those in Table 4 are obtained.

Observed Fault Probabilities
The observed probabilities of satellite (P sat ) and constellation (P const ) failures are estimated next following the definitions of [4]. The expected satellite Fault Rate (R), given by k events over the interval T, can be estimated by the expression: where T is the aggregated total signal of valid hours, i.e., with signals indicating that they were healthy (aggregated for all satellites). The probability of a satellite fault (P sat ) is the fault rate multiplied by the Mean Time to Notify (MTTN) the user, i.e., the delay between the event onset and the average time for the system to notify such event to the user: Derivation of these formulae can be found in [4], where it is assumed that the probability of faults follows a Poisson distribution and the a priori probability of R is approximated by a distribution f (R) ∝ 1/

√
R between 0 and R max . A methodology to estimate the MTTN in Galileo is summarized in [27], where 60 min for ATTM are expected for the future configuration of the Galileo system in the FOC. Further results from ICAO NSP [10], considering improved monitoring capabilities on the ground and tuning and mentioning barriers, expect to reduce this value.
In the last subsection, the results are extrapolated to the FOC of the Galileo program. • URA (overbound of SISE) lower than 9 m; • P sat lower than 1 × 10 −5 /sat; • P const lower than 1 × 10 −4 .
The NTE = 4.42 × URA = 39.78 m will then be used for Fault Detection. An overview of detection results using NTE = 39.78 m, is given in Table 6 and depicted in Figure 14. Two satellite failures are found in 2017, the E206 (on 7 March) and E203 (on 6-7 June), and only one satellite failure in 2019, the E101 (on 29 September) (see details of this last event in Section 4.1).   Table 7 summarizes the number of satellite faults, the cumulative duration of detected faults, and total of signal valid hours in each year from 2017 to 2020. The first row, after the header, specifies the values from 1 August to 31 December 2017. The last row indicates the values from 1 January to 31 July 2020. Results are shown for the IOV and FOC satellites and across the whole constellation. These values are from the duration column in Table 6.   Table 8 shows the cumulative results from Table 7 for the two previously considered periods, from 1 January 2017 to 31 July 2020 (first row after the header) and for the last three-year time window, from 1 August 2017 to 31 July 2020 (in the last row). It is worth mentioning that in this last period, i.e., excluding the firsts six months of data, only one satellite fault is found, which was experienced by the IOV satellite E101 on 29 October 2019.
A simple experimental estimation of MTTN can be made from the observed averaged duration of faults, but it is worth mentioning that this can only be seen as a rough estimate of this value. To be conservative, in the numerical application, we then use as MTTN the highest value between this averaged duration of faults and the 60 min given in [27], see Table 8. As shown, the obtained results for the observed fault probability over the last three-year time window are very promising, as the estimated value of P sat = 3.2 × 10 −6 /sat given in Table 8 is well below the previous commitment of 1 × 10 −5 . This value increases to 5.8 × 10 −5 /sat when considering the full period of 43 months, but as already commented, most of the faults experienced during the first half of 2017, and even others detected after this period, are considered not representative of what is expected in the FOC configuration [27].
No Wide Faults, i.e., affecting more than one satellite simultaneously, appear when considering the NTE = 39.78 m threshold. Nevertheless, taking into account the reduced size of data, a conservative value of P const = 1 × 10 −4 can be used [11].

Observed Fault Probabilities Based on NTE = 25.04 m
The Galileo program established a dedicated process involving the main actors (EC, ESA, and GSA), which analyze the Galileo performance to support the definition of the ARAIM concept and relative standards. The conclusions presented in the ICAO NSP on April 2020 consider the following values for Galileo [10]: • URA (overbound of SISE) lower than 6 m; • P sat lower than 3 × 10 −5 /sat; • P const lower than 1 × 10 −4 .
The NTE = 4.17 × URA = 25.04 m will then be used for Fault Detection. As shown in Table 1, there is an additional event out of those of Table 6  The estimated mean conditional fault rate E(R|k) and P sat for this more stringent threshold can be found in Table 9. As shown, P sat = 5.3 × 10 −6 /sat is estimated when considering the last three years window, and MTTN = 1 h, which is still about one order of magnitude below the 3 × 10 −5 /sat value. Moreover, again, no Wide Faults appear when considering this NTE = 25.04 m threshold, and the conservative value of P const = 1 × 10 −4 can be used [11].

Extrapolation to Galileo Full Operational Capability
As discussed above, the root cause of each one of the different events experienced by Galileo satellites has been investigated in detail by the Galileo Project Office to identify whether it could continue to occur when Galileo reaches the future FOC or will be eliminated thanks to the system configuration updates during this consolidation process. Table 10 provides the list of events that have been identified as representative of the FOC [5]. From the extrapolation to FOC, it follows that the two satellite events listed in Table 10, having been observed over a total of 5.28 × 10 5 valid hours on the 43 months of data (see Table 9), imply an average Fault Rate of 4.7 × 10 −6 /sat/h.
Since the averaged fault duration resulting from the exposure time in Table 10 is only 42.5 min, it will take, again, 1 h for the MTTN to calculate P sat . It should be noted that such an averaged duration value is very close to the 45 min considered by ICAO NSP [10] as the MTTN value that is expected to be achieved for the Narrow Faults in the future configuration of the Galileo system.
Taking MTTN equal to 1 h, it results in a P sat value of 4.7 × 10 −6 /sat. This value, estimated for the whole analyzed period, i.e., from 1 January 2017 to 31 July 2020, is much smaller than the value P sat = 7.8 × 10 −5 /sat given in Table 9 for the same time interval, and quite similar to the P sat = 5.3 × 10 −6 /sat value found when excluding the first six-month period.

Conclusions
A preliminary characterization of Galileo F/NAV broadcast orbit and clock errors has been made in this work based on more than three years of data since the Galileo Initial Service Open Service declaration, from 1 January 2017 to 31 July 2020. Results for GPS LNAV broadcast messages on the same data period and over the last 10 years, from 1 January 2010 to 31 July 2020, have also been determined to compare performances with the fully deployed and consolidated GPS constellation.
The methodology used in this study is based on the Stanford works [11,12], which involve complex algorithms for data cleansing and a procedure for anomaly detection and verification. This methodology has been directly implemented and applied to GPS and extended to Galileo data.
The observed orbit and clock errors in Galileo satellites are more tightly distributed than in the GPS, mainly for the along-track and cross-track errors. Events exceeding the 4.42 × SISA threshold have been identified, and their impact over the CDF was analyzed. It is worth mentioning that most of the detected events have been identified as unrepresentative of the future Galileo Full Operational Capability, and many of them were experienced during the first six-month period after the Galileo IS OS. When excluding this six-month period, the aggregated 1-CDF, incorporating all satellites, is well bounded beyond the probability level 1 × 10 −5 by a Gaussian distribution with σ = 4.
The observed nominal accuracy of Galileo satellites has been also characterized over the 43-month analyzed period and compared with the GPS determinations for the same period of time and over a longer period of more than 10 years. Results show smaller 68th and 95th Galileo percentiles for the along-track and cross-track errors than those in the GPS. Similar percentiles as in the GPS are found for the radial component and IURE, although a bias of several centimeters appears. The Galileo clock performs slightly better than the GPS clock, with smaller percentiles, but some global bias could have been absorbed by the clock alignment procedure applied to align the IGS time to the Galileo system time.
Finally, the NTE = 39.78 m threshold from Galileo commitments has been used to detect the satellite faults and to estimate the observed probability P sat . When excluding the first six-month period of Galileo IS OS, the analysis over the last three-year window, from 1 August 2017 to 31 July 2020, shows very promising results. Only one satellite fault is found, the IOV E101 on 29 October 2019, lasting for 30 min. This single fault over this three-year period results in a fault probability P sat = 3.2 × 10 −6 /sat, which is far below the 1 × 10 −5 /sat commitment. Moreover, P sat has been also estimated using the NTE = 25.04 m threshold, from ICAO NSP of April 2020. In this case, the satellite fault experienced by the IOV satellite E101 on 26 December is included in the statistics, which leads to P sat = 5.3 × 10 −6 /sat when considering the last three-year time window, being, again, a very good result. The study ends with the extrapolation to the Galileo FOC, where only two events are thought to be representative of this future configuration. In this case, a value of P sat = 4.7 × 10 −6 /sat is estimated over the whole period of 43 months, i.e., from 1 January 2017 to 31 July 2020, which, again, broadly meets the 3 × 10 −5 /sat requirement. It is worth noting that the Galileo system is still under the deployment phase, and this study is based on only about three and a half years of data. The results do not necessarily reflect the expected performance of the Galileo system once it is fully deployed. Thus, further studies should be performed in the future with larger historical data records to consolidate results.