**2. Materials and Methods**

BDS-3 B1C and B2a signals for fundamental positioning, navigation, and timing service are broadcast from 24 medium circular orbit (MEO) satellites and three inclined geostationary orbit (IGSO) satellites. Their pseudo random noise code (PRN) numbers range from 19 to 46, in which 38, 39, and 40 are the PRNs of IGSO. The two kinds of new civil ranging codes have the same length of 10230, while the chip rates of B1C and B2a are 1.023 Mbps and 10.23 Mbps, respectively [17,18]. These are separately modulated on carrier signals with center frequencies of 1575.42 MHz and 1176.45 MHz, and different ranging codes are modulated on the data component and pilot component. The power ratio of the data component to the pilot component is 1:1 for B2a while the ratio is 1:3 for B1C. In addition, both the components of B2a adopt BPSK(10) modulation while those for B1C adopt more advanced BOC and QMBOC modulation.

The expression of the modulated B2a signal can be described as:

$$S\_{B2a}^{(i)}(t) = \sqrt{2P\_{B2a}} \left[ D\_{B2a\\_d}^{(i)}(t) \mathcal{C}\_{B2a\\_d}^{(i)}(t) \cos(2\pi ft) - \mathcal{C}\_{B2a\\_p}^{(i)}(t) \sin(2\pi ft) \right] \tag{1}$$

where *S*(*i*) *<sup>B</sup>*2*<sup>a</sup>* stands for the signals from satellite *<sup>i</sup>*, *<sup>D</sup>*(*i*) *<sup>B</sup>*2*a*\_*<sup>d</sup>* is the modulation data, *<sup>C</sup>*(*i*) *B*2*a*\_*d* stands for the ranging code on the data component, *C*(*i*) *<sup>B</sup>*2*a*\_*<sup>p</sup>* is the ranging code on the pilot component, *PB*<sup>2</sup>*<sup>a</sup>* is the B2a signal power, and *f* is the carrier frequency. In Equation (1), the pilot channel is data-less, and so can be used for estimating the ranging information better without the problem of sign transitions [17].

The expression of the modulated B1C signal can be described as:

$$S\_{\rm B1C}^{(i)}(t) = \sqrt{2P\_{\rm B1C}} \left[ \frac{1}{2} D\_{\rm B1C}^{(i)}(t) \mathcal{C}\_{\rm B1C\\_d}^{(i)}(t) \cos(2\pi ft) - \frac{\sqrt{3}}{2} \mathcal{C}\_{\rm B1C\\_p}^{(i)}(t) \sin(2\pi ft) \right] \tag{2}$$

where *S*(*i*) *<sup>B</sup>*1*<sup>C</sup>* stands for the signals from satellite *<sup>i</sup>*; *<sup>D</sup>*(*i*) *<sup>B</sup>*1*<sup>C</sup>* is the modulation data; *<sup>C</sup>*(*i*) *B*1*C*\_*d* stands for the ranging code on the data component; *PB*<sup>1</sup>*<sup>C</sup>* is the B1C signal power; and *C*(*i*) *<sup>B</sup>*1*C*\_*<sup>p</sup>* is the ranging code on the pilot component, which employs QMBOC(6,1,4/33) modulation [18]. In Equation (2), we can see that not only is the pilot channel free of data information, but that the modulation is also more complicated. These improvements will enhance the ranging ability of the B1C code.

Raw IF data of direct and reflected signals were processed to obtain the code-level path delay measurements using a software-defined receiver (SDR) modified from an open source code using MATLAB [19]. Figure 1 shows a brief flow chart of this GNSS-R SDR. Firstly, both the direct and reflected signals are cross-correlated separately with the pilot and data local replicas. The coherent span for both B1C and B2a codes is 10 milliseconds; each signal produces two waveforms because of its pilot and data components. In order to increase the signal-to-noise ratio, the two values added incoherently by power ratios are the direct signal waveform and reflected signal waveform. Then, the code-level path delays are computed from the positions of waveform peaks by applying cubic spline interpolations. Furthermore, in order to increase the stability and precision, we computed 21 path delays in one second at intervals of 50 milliseconds and selected their median value for further processing. Finally, the reflector heights from the sea surface are calculated in accordance with the geometry of ground-based GNSS-R altimetry.

**Figure 1.** Basic concept of deriving code-level path delay from waveforms of direct and reflected signals using the data component (red) and the pilot component (purple).

#### **3. Experiments**

Our GNSS-R IF data collection system is mainly composed of two dual-circularly polarized crossed dipole antennas and one raw data recorder with four radio frequency signal input ports. Two of them are for the direct and reflected signals from the B1 band while the other two are for the B2 band. The bandwidths of the recorder are 20.46 MHz; its central frequencies are at 1529 MHz and 1130 MHz for the two kinds of signals, respectively. The IF data are quantified with 2 bits and recorded at a sampling rate of 62 MHz continuously in most cases. The data are then transferred to a laptop through a USB 3.0 cable.

Apart from GNSS-R setups, a geodetic GNSS receiver, chock-ring antenna, and an electronic total station were used to obtain the geodetic height of the GNSS-R antennas. An independent 26 GHz radar altimeter was installed on the trestle, which can provide vertical distance from the sea surface to its phase center with 3 mm accuracy every second. We measured the precise height differences among the phase centers of the chock-ring GNSS  

antenna, GNSS-R antenna, and radar altimeter using the electronic total station. Figure 2 shows the relevant photos.

**Figure 2.** Photos of the geodetic GNSS chock-ring antenna (**a**), electronic total station (**b**), and the monostatic radar altimeter (**c**).

We performed the experiment on a shore trestle bridge located at Weihai in Shandong province with latitude and longitude coordinates (37◦32 2.62" N, 122◦2 44.11" E) on November 5, 2020. An upward GNSS-R antenna was used for receiving direct signals with right-handed circular polarization while the down-looking one was for reflected signals with left-handed circular polarization. As the operating band of the antennas ranged from 1.16 to 1.62 GHz, it can cover B1C and B2a signals. Before entering the recorder, both of the direct and reflected signals are spilt into two channels by two two-way power dividers. One is for B1C and another is for B2a. The configuration of antennas and the satellite image of the trestle bridge are shown in Figure 3 and the tilt angles of the antennas are both 30◦ to horizontal. Their phase centers are in a single plumb line. The height of the antennas above the sea surface ranged from about three to five meters during our experiment. In addition, as the beam width angle of the antennas is 60◦, the available satellite elevation ranges from 30◦ to 90◦ for this experiment. The two antennas faced south to receive more reflected signals, and so the available satellite azimuth ranged from 150◦ to 210◦.

**Figure 3.** The configuration of antennas for our GNSS-R altimetry experiment (**a**), the photograph of the antennas' arrangement (**b**) and top view of the trestle bridge (**c**) during the experiment.
