1. Introduction

Accuracy, integrity, continuity, and availability are the four core performance indicators of satellite navigation systems. Among them, integrity refers to the ability of the system to alert users in time when the service is abnormal or experiences failure, and it characterizes the security and reliability of system services ^[1][2]. If there is an abnormality or failure in the service, but the system fails to detect it or fails to alarm in time, an “integrity event” has occurred. Once an integrity event occurs, it will have a security impact on the user, especially for civil aviation, maritime, railway, and other users related to life safety. System reliability is even more strategically important with the widespread use of low-cost sensors for various applications including personal positioning and autonomous navigation ^[3][4]. In addition, the integrity of the core constellation is also an important foundation for the construction of the satellite-based augmentation systems (SBAS) such as WASS (wide area augmentation system)^[5][6], ENGOS (European geostationary navigation overlay system)^[7][8], MSAS (multi-functional satellite augmentation system)^[9][10] , BDSBAS (BeiDou satellite-based augmentation system)^[11], and airport ground-based augmentation systems (GBAS). These augmentation systems are constructed to further augment the global navigation satellite system (GNSS) constellation and provide higher integrity navigation services.
Satellite navigation systems in the world are paying more and more attention to the construction and improvement of their integrity capabilities. GPS and Galileo considered their integrity function at the beginning of the system design, defined the integrity parameters and algorithms, and planned its application scenarios ^{[2][12][13][14]}. China’s BeiDou also attaches importance to the construction of integrity. China’s BeiDou global navigation satellite system (BDS-3) carried out a brand new integrity concept design work, which defines and achieves the integrity functions for major civil open service (OS) signals such as B1C, B2a, and B1I. In addition to GNSSs, regional satellite navigation systems have also begun to upgrade their integrity capabilities. For example, Japan’s QZSS not only defines and provides the integrity function for its basic positioning, navigation, and timing (PNT) service, but also for its sub-meter level augmentation service (SLAS) and centimeter-level augmentation service (CLAS) ^[15][16].
Due to the numerous components, functions, and processing operations of the system, it is not easy to ensure the integrity of satellite navigation systems, especially for global ones. On 13 July 2019, a mass outage occurred in Galileo—all 24 networking satellites in orbit entered an “unavailable” or “test” state, and the system was immediately paralyzed. After 48 h of full maintenance, the system did not return to normal until 8 o’clock on 18 July. During this period, the service was knocked offline for up to 117 h (about 5 days)^[17]. Although the European GNSS Agency (GSA) issued a warning of service outage on the Galileo official website at 20:00 on 13 July^[18], it still had a serious impact on users around the world. This incident also prompted countries to take measures to ensure the safe operations of satellite navigation systems. After this incident, Russia stated that it has set up a multi-level software detection system in the ground segment of GLONASS, with a redundant design and an autonomous control function to prevent such failures from occurring.
On 27 December 2018, BDS-3 completed the construction of the basic constellation (consisting of 18 MEOs) and began to provide the initial global service ^[19]. On 31 July 2020, BDS-3 completed all construction (consisting of 24 MEOs, 3 IGSOs, and 3 GEOs) tasks and officially opened the global service^[20]. Since the initial service was provided, BDS-3 has been in a stable operation state, and there have been no integrity events affecting the system and user services. This benefits from the reasonable system design and effective risk monitoring and control measures. However, this does not mean that BDS-3 has completely eliminated the integrity hazards, especially considering that the system was built in such a short period of time (2012–2020). To ensure the safety and reliability of the service, it is necessary and valuable to carry out more in-depth research and evaluation.
This study focuses on the design and the performance analysis of BDS-3’s integrity concept. In order to improve the reliability and safety of the service, BDS-3 upgraded and improved the conceptual design and function of integrity compared to BDS-2 and carried out standard development work in ICAO SARPs at the same time. The satellite service failure and constellation service failure concepts are clearly defined, and the integrity risk probability calculation method is designed for the three OS signals of B1I/B1C/B2a. The integrity fault tree model is studied and established, and the corresponding monitoring measures for weakness in the space segment and the ground segment of the system is proposed. In terms of alarms, BDS-3 is designed with a hybrid alarm mechanism of the ground alarm approach and the satellite alarm approach, to make up for the limitations for BDS’s failure to deploy ground monitoring stations globally. Finally, the actual operation data of 2019 was used to verify the integrity performance of the system service. The results show that the actual operation of the system is consistent with the conceptual design, which proves the safety and reliability of the BDS-3 OS service.
The remainder of this paper is structured as follows. Section 2 defines the integrity of the BDS OS signals (B1I/B1C/B2a), introduces the alarm approach, and gives the calculation method of the satellite service failure probability (Psat) and the constellation service failure probability (Pconst). In Section 3, a fault tree model for the BDS satellite signal-in-space (SIS) is established, the bottom events from the space segment and the ground segment are decomposed, and the system design values of Psat and Pconst are derived. In Section 4, the integrity prevention and control measures taken by BDS-3 in the space segment and the ground segment are introduced, respectively. Finally, Section 5 presents the integrity risk verification work on BDS-3 and the analyses of the results.

2. Results and Discussion

2.1. Test Results for B1I Signal

The SIS-URE of the B1I signal at the WUL is calculated based on the B1I broadcast message from 7 January 2019 to 31 July 2019, with a sampling interval of 30 s. The URE sequence of the 18 satellites of the basic BDS-3 constellation are shown in Figure 1, in which the red dots indicate the URE value. The x-axis is in units of days of the year, and the y-axis is in meters.

Figure 1. URE and 4.42 × URA sequences of BDS-3 satellites form 1 January 2019 to 31 July 2019. (a) PRN 19; (b) PRN 20; (c) PRN 21; (d) PRN 22; (e) PRN 23; (f) PRN 24; (g) PRN 25; (h) PRN 26; (i) PRN 27; (j) PRN 28; (k) PRN 29; (l) PRN 30; (m) PRN 32; (n) PRN 33; (o) PRN 34; (p) PRN 35; (q) PRN 36; (r) PRN 37. SCID + Number in the titles of figures indicate the Satellite Configure Index used by the internal information processing system.

According to Section 2.3.1, the URE of B1I should be compared with the NTE, which is 4.42 times the URA. The URA can be obtained through the user range accuracy index (URAI) parameters broadcast in the D1 NAV message of B1I, and 4.42 times the URA is currently a fix value equal to 17.68 m. It can be seen from Figure 1 that the URE of all satellites are far less than 4.42 times the URA (among them, the largest URE appears in the satellite with a PRN code of 32, which is about 6 m). Therefore, there is no satellite service failure condition of the B1I signal during the test.

2.2. Test Results for B1C and B2a Signals

The SIS-URE of the B1C/B2a signal at the WUL is calculated based on the B1C/B2a broadcast message from 1 July 2019 to 25 September 2019, with a sampling interval of 30 s. The URE sequence of the 18 satellites of the basic BDS-3 constellation are shown in Figure 2, in which the red dots indicate the URE value and the black dots indicate the SISA value. The x-axis is in units of days of the year, and the y-axis is in meters.

Figure 2. URE and 4.42 × SISA sequences of BDS-3 satellites from 1 July 2019 to 25 September 2019. (a) PRN 19; (b) PRN 20; (c) PRN 21; (d) PRN 22; (e) PRN 23; (f) PRN 24; (g) PRN 25; (h) PRN 26; (i) PRN 27; (j) PRN 28; (k) PRN 29; (l) PRN 30; (m) PRN 32; (n) PRN 33; (o) PRN 34; (p) PRN 35; (q) PRN 36; (r) PRN 37.

According to Section 2.3.1, the URE of B1C/B2a should be compared with the NTE, which is 4.42 times the SISA. The SISA can be obtained through the SISAI parameters broadcast in the B-CNAV1/B-CNAV2 navigation message, and its value may change with the change of the index parameters. It can be seen that the URE of all satellites are less than 4.42 times the SISA, and there is no satellite service failure condition of B1C and B2a signals during the test.

In fact, there have been satellite orbit calculation and message upload anomalies in the ground segment during the assessment period, but they are detected and disposed of by the ground segment monitoring measures. This indicates the effectiveness of the fault monitoring and processing functions of the BDS-3 ground segment. We also need to be aware that the assessment of GNSS service integrity is a long-term and elaborate process. As long as the time is long enough, any potential risks that seem to have a small probability might happen. Therefore, we will continuously evaluate and analyze the integrity of the BDS-3 OS signals, and release the information and status in time. In addition, we will also work to further improve the robustness of the BDS-3 satellite and ground segment to ensure the stable operation of the system and the safe and reliability of the service.

3. Conclusions