## 2 Materials and Methods
### PPP Time Transfer Model  
We deploy a dual-frequency ionosphere-free (IF)combination within the PPP time transfer model [29]. Leveraging precise satellite products and mitigating various error sources, the pseudorange and carrier phase observation equations are formulated as follows:  
\[p_{r,\mathrm{IF}}^{s}=\mathbf{h}_{r}^{s}\cdot\Delta x+cdt_{r,\mathrm{IF}}+m_{r,w}^ {s}\cdot Z_{w}+\xi_{r,\mathrm{IF}}^{s} \tag{1}\]  
\[l_{r,\mathrm{IF}}^{s}=\mathbf{h}_{r}^{s}\cdot\Delta x+cdt_{r,\mathrm{IF}}+m_{r,w}^ {s}\cdot Z_{w}+N_{r,\mathrm{IF}}^{s}+\psi_{r,\mathrm{IF}}^{s} \tag{2}\]  
\[\left\{ \begin{array}{l}cdt_{r,\mathrm{IF}}=cdt_{r}+cdt_{r,\mathrm{IF}}\\ d_{r,\mathrm{IF}}=\alpha_{ij}d_{r,j}+\beta_{ij}d_{r,j}\\ \alpha_{ij}=\frac{f_{r}^{s}}{f_{r}^{s}-f_{r}^{s}};\beta_{ij}=-\frac{f_{r}^{s}}{ f_{r}^{s}-f_{r}^{s}};i\
eq j\end{array} \right. \tag{3}\]  
Here, \(l_{r,\mathrm{IF}}^{s}\) and \(p_{r,\mathrm{IF}}^{s}\) represent the OMC (Observed Minus Computed) values for IF carrier phase and code observations, respectively. The subscripts \(s\) and \(r\) denote the satellite and receiver, while \(\Delta x\) signifies the position increment. Here, \(\mathbf{h}_{r}^{s}\) represents the coefficients for the position. The indices \(i\) or \(j\) differentiate between the different frequencies. \(\alpha_{ij}\) and \(\beta_{ij}\) is the frequency factor. For Galileo and GPS, the E1/E5a and L1/L2 frequency are chosen. \(d_{r,i}\) denotes the hardware delay; \(f_{i}\) is the frequency \(i\); \(dt_{r,\mathrm{I}F_{ij}}\) displays the combined receiver clock offset in the IF combination, inclusive of the hardware delay; \(dt_{r}\) is the receiver clock offset; \(d_{r,\mathrm{IF}}\) indicates the hardware delay for the IF combination; \(Z_{w}\) is the zenith wet delay; \(N_{r,\mathrm{IF}}^{s}\) is the float IF ambiguity; \(m_{r,w}^{s}\) is the wet mapping function; and \(\zeta_{r,\mathrm{IF}}^{s}\) or \(\psi_{r,\mathrm{IF}}^{s}\) are the noise terms. In addition, based on elevation-dependent weighting used in our work, the precision of orbit and clock calculated from the HAS correction also need to be considered. The weight W can be expressed as [5]  
\[\left\{ \begin{array}{l}\mathbf{W}=diag(\sigma_{1}^{-2},\sigma_{2}^{-2}, \sigma_{3}^{-2},\cdots,\sigma_{m}^{-2})\\ \sigma^{2}=FR_{r}(a_{\sigma}^{2}+b_{\sigma}^{2}/\sin E^{2})+\sigma_{eph}^{2} \end{array} \right. \tag{4}\]  
where \(F\) is the satellite system error factor; \(R_{r}\) indicates code/carrier phase error ratio; \(a_{\sigma}\) and \(b_{\sigma}^{2}\) are carrier-phase error factors a and b (m); E illustrates elevation angle; \(\sigma_{eph}\) is the URA from the HAS service; m is the number of satellites. Distinct from the Multi-GNSS experiment (MGEX) final products and the real-time product offerings by IGS, the Galileo HAS service adopts Galileo System Time (GST) as the benchmark for clock offsets [27], thereby achieving improved stability and continuity. However, the GPS satellite clock references are not synchronized to a common time standard; this discrepancy does not impact the accuracy of the timing process. The receiver clock offset \(cdt_{r,\mathrm{I}F_{ij}}\), as derived from the PPP model utilizing Galileo data, encompasses the discrepancy between Galileo System Time (GST) and the local time reference, as well as the inherent hardware delay. Typically, such hardware delays are pre-calibrated to ensure accuracy [30]. The divergence \(D\) between the time \(T\) and GST can be articulated as follows:  
\[D=T-\mathrm{GST} \tag{5}\]  
Here, \(D\) signifies the local time of the user's receiver. For the PPP one-way timing, Equation (5) can be used directly. For two stations, the divergence \(\Delta T\) will be written as  
\[ \begin{array}{ll}\Delta\mathrm{T}&=D_{1}-D_{2}\\ &=T_{1}-\mathrm{GST}-(T_{2}-\mathrm{GST})\\ &=T_{1}-T_{2}\end{array}  \tag{6}\]  
Here, \(T_{1}\) and \(T_{2}\) indicate the time of users.