Design of BDS-3 integrity monitoring and preliminary analysis of its performance

Available online at www.sciencedirect.com

ScienceDirect Advances in Space Research xxx (2019) xxx–xxx www.elsevier.com/locate/asr

Design of BDS-3 integrity monitoring and preliminary analysis of its performance Yueling Cao a,b, Jinping Chen c,⇑, Xiaogong Hu a,b, Feng He d, Lang Bian e, Wei Wang f Bin Wu a,b, Yang Yu a,b, Jingyuan Wang g, Qiuning Tian a,b a Shanghai Astronomical Observatory, Chinese Academy of Sciences, Shanghai 200030, China Shanghai Key Laboratory of Space Navigation and Position Techniques, Shanghai 200030, China c Beijing Satellite Navigation Center, Beijing 100094, China d National Defense University, Beijing 100091, China e China Academy of Space Technology (Xi’an), Xi’an 710100, China f Beijing Institute of Tracking and Telecommunication Technology Beijing People’s Republic of China, Beijing 100094, China g Harbin University of Science and Technology Rongcheng Campus, Rongcheng 264300, China b

Received 24 May 2019; received in revised form 31 October 2019; accepted 4 November 2019

Abstract With the improvement in the service accuracy and expansion of the application scope of satellite navigation systems, users now have high demands for system integrity that are directly related to navigation safety. As a crucial index to measure the reliability of satellite navigation systems, integrity is the ability of the system to send an alarm when an abnormity occurs. The new-generation Beidou Navigation Satellite System (BDS-3) prioritized the upgrading of system integrity as an important objective in system construction. Because the system provides both basic navigation and satellite-based augmentation system (SBAS) services by the operational control system, BDS-3 adopts an integrated integrity monitoring and processing strategy that applies satellite autonomous integrity monitoring and ground-based integrity monitoring for both the basic navigation service and SBAS navigation service. BDS-3 also uses an improved and refined integrity parameter system to provide slow, fast and real-time integrity parameters for basic navigation, and provide SBAS-provided integrity information messages in accordance with Radio Technical Commission for Aeronautics (RTCA) specification and dual frequency, multi-constellation (DFMC) specification to support the SBAS signal frequency, single constellation operation and DFMC operation respectively. The performance of BDS-3 system integrity monitoring is preliminarily verified during on-orbit testing in different states, including normal operation, satellite clock failure and satellite ephemeris failure. The results show that satellite autonomous integrity monitoring, ground-based integrity monitoring and satellite-based augmentation all correctly work within the system. Satellite autonomous integrity monitoring can detect satellite clock failure but not satellite orbit failure. However, ground-based integrity monitoring can detect both. Moreover, the satellite-based augmentation integrity system monitors the differential range error after satellite ephemeris and clock error corrections based on user requirements. Compared to the near minute-level time-to-alert capability of ground-based integrity monitoring, satellite autonomous integrity monitoring reduces the system alert time to less than 4 s. With a combined satellite-ground monitoring strategy and the implementation of different monitoring technologies, the BDS-3 integrity of service has been considerably improved. Ó 2019 COSPAR. Published by Elsevier Ltd. All rights reserved.

Keywords: BDS-3; Satellite autonomous integrity monitoring; Ground-based integrity monitoring; SBAS integrity monitoring; Onboard validation

⇑ Corresponding author.

E-mail addresses: [email protected] (Y. Cao), [email protected] (J. Chen), [email protected] (X. Hu), [email protected] (F. He), [email protected] (L. Bian), [email protected] (W. Wang), [email protected] (B. Wu), [email protected] (Y. Yu), [email protected] (J. Wang), [email protected] (Q. Tian). https://doi.org/10.1016/j.asr.2019.11.002 0273-1177/Ó 2019 COSPAR. Published by Elsevier Ltd. All rights reserved.

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002

2

Y. Cao et al. / Advances in Space Research xxx (2019) xxx–xxx

1. Introduction With the expanding application of global navigation satellite systems (GNSSs) and the improving accuracy of GNSS positioning, users have begun to evaluate the service safety of GNSS systems, especially civil aviation users with specific requirements regarding the integrity performance of GNSS (ICAO, 2006). For usage reliability, GNSS such as GPS (Kovach et al., 2008; Miles et al., 2013; Peckjian et al., 2016), Galileo (Oehler et al., 2004; Fernandez, 2011; Chatre et al., 2018) and Beidou Satellite navigation system (Liu et al., 2013; Cao et al., 2019) continuously promote system integrity as a crucial aspect of system upgrades. Methods such as satellite autonomous integrity monitoring and ground-based integrity monitoring have been introduced to improve service integrity performance, and combined with user receiver autonomous integrity, the continuity, availability and reliability of system services can be ensured. Currently, the methods of GNSS integrity monitoring include satellite autonomous integrity monitoring (SAIM), ground-based integrity channel (GIC) monitoring and receiver autonomous integrity monitoring (RAIM) (Zink et al., 2000; Vioarsson et al., 2001). RAIM works with position processing by receiving multiple navigation satellite observations. Then, the method of least squares or the parity space vector algorithm is used to detect and exclude the faulty satellite with redundant satellite observations (Hewitson and Wang, 2006; Gratton et al., 2010). Generally, RAIM technology can only be used to monitor large single satellite faults and will reduce system availability. This integrity monitoring technology is generally used in aviation en-route integrity monitoring. Both the GIC and SAIM methods are implemented by satellite navigation control systems. GIC monitoring is a method that monitors the accuracy of a signal in space corresponding to the broadcast ephemeris with observation data collected by system monitoring stations. Then, the corresponding integrity parameters are computed and broadcast to users in broadcast messages (Sardon et al., 2006; Hernandez et al., 2008). SAIM can detect satellite signal anomalies on orbit. This approach is not affected by errors in the propagation path environment or ground monitoring equipment and has many advantages, such as a simple processing scheme and near real-time-to-alert ability. Thus, SAIM has become a popular integrity monitoring strategy for GNSSs (Rodriguez et al., 2009, 2011; Xu et al., 2011; Fernandez, 2011). Aviation users have proposed the operational performance standards and specifications for GNSS integrity service and other users may refer to the aviation world. System integrity performance is usually represented in terms of the alert limit, alert time and hazardous misleading information (HMI) probability. The alert limit refers to the position error limitation, which guarantees safe operation in the corresponding flight stages and is divided

into the horizontal alert limit (HAL) and vertical alert limit (VAL). The alert time is the maximum allowable time delay from the beginning of system failure to the user receiving the alarm. The HMI probability refers to the hazardous flight probability of current positioning errors exceeding the alert limit and generally must be less than 10
7/h (ICAO, 2006; FAA, 2008). By employing SAIM technology and improving User Range Accuracy (URA) parameters, GPS III was designed to obtain a 10
7/h integrity risk probability, achieving the non-precision approach (NPA) target for integrity performance (Miles et al., 2013; Kovach et al., 2008). Using forty monitoring stations around the world, it is possible for Galileo to provide an integrity monitoring service with global coverage, and which realizes integrity performance with a 5.2-s alert time and integrity risk probability of 2  10 - 7 /150 s which meets the requirements of the Category I precision approach (CAT-I) for integrity performance (Oehler et al., 2004). The BeiDou Navigation Satellite System (BDS) is composed of a Geostationary Earth Orbit (GEO), Inclined GeoSynchronous Orbit (IGSO) and Medium Earth Orbit (MEO) hybrid constellation. The arc coverage of the BDS regional monitoring network for mobile satellites, especially MEO satellites, is very small. Therefore, it is difficult to meet the global monitoring and warning requirements based solely on ground-based integrity monitoring (Zhou et al., 2012). Additionally, BDS is the only GNSS system that provides both basic navigation services and satellite-based augmentation services with the same operational control system (Cao et al., 2014). It is necessary to simultaneously provide basic navigation message integrity and satellite-based augmentation message integrity for users, which is a considerable challenge in the design and implementation of system integrity monitoring schemes. BDS-3 prioritizes integrity in the system design and construction phases, utilizes application experiences from different monitoring methods and combines relevant information to promote integrity. To compensate for the insufficient coverage of regional ground monitoring networks and improve system integrity, the SAIM technology was adopted on BDS-3. SAIM method was introduced by Vioarsson et al. (2001) based on onboard navigation signal anomalies monitoring, and Wolf (2000) and Rodriguez et al. (2009) provided the autonomous satellite orbit and clock anomalies monitoring methods with inter-satellite links. However, without experiment data only simulation analyses have been processed to assess SAIM performance. It is necessary to verify the SAIM onboard monitoring performance according to the actual monitoring environment. This paper presents various methods to monitor the BDS-3 integrity. During the stage of BDS-3 satellite onorbit testing, the initial integrity performance is analyzed with actual data from the satellite onboard autonomous monitoring system and ground control segment.

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002

Y. Cao et al. / Advances in Space Research xxx (2019) xxx–xxx

2. Design of BDS-3 integrity monitoring methods 2.1. Satellite autonomous integrity monitoring SAIM technology performs onboard integrity monitoring independently. Navigation satellites monitor the status of the broadcast navigation signal through multiple direct feedback processing and then transmit the corresponding integrity information to users in a navigation message. The main challenge associated with SAIM technology lies in the design and implementation of onboard monitoring equipment. For the BDS-3 satellite navigation, SAIM technology was utilized onboard and the performance of the technology with actual onboard observations was assessed. The SAIM payload design is mainly based on satellite clock frequency stability monitoring and signal quality monitoring. The design flowchart of the BDS-3 satellite SAIM monitoring system was presented by Cao et al. (2019), as shown in Fig. 1. The operation processing of BDS onboard time and frequency system is similar to GPS Time Keeping System (TKS), which implements a control loop in software that continuously tunes a voltage-controlled crystal oscillator (VCXO) to generate a system reference frequency of 10.23 MHz with timing accuracy of Atomic Frequency Standard (AFS) (Petzinger et al., 2002). The BDS system reference frequency is used to generate the downlink navigation signal through the downlink signal generation unit. Then SAIM receives navigation signal from downlink transmit antenna front-end through wired links. The high stability crystal oscillator installed on SAIM is used to generate the local frequency reference of SAIM payload, which has much better short-term stability than the onboard atomic clocks. Through it, SAIM is able to monitor the system time and frequency reference and detect the possible satellite clock phase step or frequency drift (Bian et al., 2018). At least two SAIM receivers onboard will be used to guarantee the reliability of SAIM monitoring. With independent oscillators compared every epoch, GPS TKS could detect anomalies in either the AFS or in the VCXO and, if necessary, protect users from using a degraded signal by rapidly switching to non-standard codes (NSC) within seconds of the failure (Petzinger et al., 2002; Wu, 1999). The difference of satellite clock frequency

Fig. 1. Monitoring architecture of the BDS3 SAIM payload (Cao et al., 2019).

3

stability monitoring processing between BDS SAIM and GPS TKS is that BDS SAIM can detect the timing anomalies caused by the AFS, the VCXO or downlink signal generation unit. The SAIM signal quality monitorng includes abnormal signal powers monitoring, pseudo-range measurement steps monitoring, carrier phase measurement steps monitoring, code-carrier bias (CCB) monitoring, code-carrier divergence (CCD) monitoring and the distortion of pseudorandom codes correlation peak monitoring. The onboard independent signal monitoring receivers are used to receive navigation signals and data transmitted by satellites and acquire information such as correlation peak data and original measurement data. Then, the receivers monitor the possible signal distortion anomalies through correlation peak data analysis, check the carrier and code phase consistency using carrier and pseudorange measurements, and check the signal power anomaly using signal-to-noise ratio data. This process is used to assess the quality of on-orbit signal. SAIM involves three BDS3 modulated signals: B1C, B2a and B3A. The modulation and service modes of these signals are listed in Table 1 (China Satellite Navigation Office, 2017a, 2017b). BDS-3 SAIM adopts two methods to identify the signal status. When abnormal signals are detected, an alert is sent as a navigation message by changing the parameter SIF to ‘‘1” immediately; alternatively, the pseudorange can be modulated to shift from the standard code to a nonstandard code. The SAIM technology cannot exit alarm mode by itself when the signal recovers and can only do so by receiving recovery commands from the control segment. Through the above design, when there are one or more anomalies, such as signal distortion, a signal power lower than minimum transmitting power, a satellite clock phase step or frequency drift occurred which is larger than the system alert limit, the SAIM system is capable to send an alert in a few seconds. However, the BDS-3 SAIM system cannot monitor the navigation message integrity or recognize satellite orbit abnormalities. The onboard testing results on the SAIM signal quality monitoring were detailed evaluated by Cao et al. (2019) and will not be discussed in this paper. 2.2. Ground-based integrity monitoring BDS-3 ground-based integrity comprehensively monitors the prediction accuracy of the signal in space (SIS), the monitoring accuracy of the SIS according to the broadcasted navigation message, the system integrity status, the navigation signal quality and the navigation message health status. GIC technology generates basic navigation integrity messages, including SIS accuracy (SISA), SIS monitoring accuracy (SISMA), accuracy integrity flag (AIF), signal integrity flag (SIF), and data integrity flag (DIF) messages, which are transmitted to users through navigation messages. The basic navigation integrity messages are combined with RAIM by users.

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002

4

Y. Cao et al. / Advances in Space Research xxx (2019) xxx–xxx

Table 1 BD3 signals monitored by SAIM technology. Signal

Signal component

Frequency (MHz)

Modulation

Service

B1C

B1C_data B1C_pilot B2a_data B2a_pilot B3A_data B3A_pilot

1575.42

OS

1176.45

BOC(1,1) QMBOC(6,1,4/33) BPSK(10)

1268.52

BOC(15,2.5)

AS

B2a B3A

The master control station processes satellite orbit and clock offset information using observation data from 13 Class I monitoring stations distributed throughout China and inter-satellite link data. Moreover, the calculation errors and covariance information associated with the orbit and clock offset process are used to compute the SISA corresponding to the predicted ephemeris and clock offset in the navigation ephemeris. The covariance information reflects the statistical characteristics of the random errors of the orbit and the clock offset processing results. Specifically, these values vary with fluctuations in the orbit and clock offset errors and degrade with increasing data age. Moreover, the assessment errors of the past broadcast navigation messages are used to adjust the calculation of SISA. Because of the different periodic characteristics and effects on users at different locations, the SIS accuracies of the orbit and the clock offset are identified separately. The tangential and normal orbit prediction accuracy is denoted as SISAoe, and the radial orbit and clock offset prediction accuracy is denoted as SISAoc. SISAoc is further expressed by a quadratic model with three parameters: SISAoc0, SISAoc1, and SISAoc2. SISAoc0 refers to the satellite clock phase offset and satellite radial ephemeris errors; SISAoc1 refers to the accuracy of the satellite clock frequency offset; and SISAoc2 refers to the accuracy of the satellite clock frequency drift. SISA parameters will be converted to SISA index (SISAI) value to be broadcasted by the satellites. While the SISAoe may vary over the ephemeris curve fit interval and over the satellite footprint, the SISAoe index is designed to correspond to the maximum SISAoe expected over the entire ephemeris curve fit interval for the worst-case location within the satellite footprint. SISA should cope with the navigation message errors in fault-free conditions. BDS-3 satellites equipped with an Inter-Satellite Link (ISL) payload and the ISL measurements increases the satellite tracking coverages by more than 40%. With the ISL measurements, the post-residuals of the BDS-3 orbit determination are on the 10.0 cm level, and the accuracy of the 24-h predicted orbits is not reduced. (Tang et al., 2016, 2018). The maximum clock prediction errors for the broadcast clock parameters are improved to be less than 1 ns (Pan et al., 2018). Meanwhile the Ages of Data (AOD) of the broadcast ephemeris and clock parameters are usually less than 2. With the stable prediction accuracy and the reduced AOD of navigation

OS

message, SISA parameters are supposed to be valid over the entire service area to overbound the navigation message being broadcast by the satellites by a Gaussian distribution with the standard deviation. The SISMA corresponding to the broadcast ephemeris and satellite clock offset is monitored using pseudorange and phase observation data collected from 13 Class I monitoring stations and some Class II monitoring stations. The satellite monitoring processing steps with ground-based stations is shown in Fig. 2. Assuming that N receiver stations simultaneously track satellite i, the pseudorange residual error from receiver j to satellite i can be calculated with the carrier-smoothed pseudorange data when the positions of the satellite and monitoring station are known, as shown in formula (1):

Dqij ¼ qij ðtÞ

X i
X j

cdti
cdtj
dqsys ð1Þ where Dqij indicates the pseudorange residual error; qij ðtÞ represents the carrier-smoothed pseudorange at time t; X i represents the positions of satellite i as broadcasted in the navigation message and X j represents the positions of receiver j; c indicates speed of light; the dti represents the clock offset broadcasted in the navigation message and dtj is the receiver clock offset; and dqsys indicates the system errors, including those associated with the atmospheric

Fig. 2. Schematic diagram of monitoring satellite i with ground stations.

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002

Y. Cao et al. / Advances in Space Research xxx (2019) xxx–xxx

delay, antenna phase center correction, and relativity correction. The root mean square (RMS) statistic of pseudorange residuals in the updated period for transmission from multiple monitoring receivers to satellite i is calculated as the SISMA of satellite i. The SISMA value will be converted into an index value, SISMAI, according to the level conversion relationship, which is determined based on the interface, and be broadcasted to the users through a navigation message. SISMA ¼ rmsðDqi Þ

ð2Þ

where Dqi indicates the pseudorange residual error from multiple monitoring receivers to satellite i. To guarantee the monitoring reliability of SISMA, a satellite should be in view of more than four monitoring receivers before its SISMA parameter can be computed, or the SISMAI will be broadcasted as ‘‘not monitored”. Up to now SISMAI is valid over the Chinese service area as the monitoring receivers distributed in China. Based on the high prediction accuracy of the broadcast ephemeris, the assumption made in this case is that the difference between the true SISE projected at Worst User Location (WUL) in the regional area and the estimated one can be ignored, and the SISE can be overbounded by a Gaussian distribution with the value equal to SISMA. Three types of real-time integrity parameters are provided in the ground-based integrity monitoring process: AIF, DIF and SIF. If the status of the signal is healthy, these parameters are assigned values of ‘‘0”; otherwise, the parameters are assigned values of ‘‘1”. Using the BDS ground two-way satellite time frequency transfer (TWSTFT) clock measurements, the real-time satellite clock offset can be calculated and compared with the broadcasted satellite clock offset to evaluate the satellite clock predication errors. The precise orbit determination results are compared with the broadcast ephemeris to compute the orbit prediction errors. If the prediction errors of the satellite clock or orbit in the navigation message are greater than the alarm threshold, the DIF parameter will be changed to ‘‘1” to send an alarm through the navigation message, as shown in formula (3): EPH err > TH ¼ k p SISAbrd DIF ¼ 1

ð3Þ

where EPH err denotes the broadcast ephemeris and clock offset prediction errors projected at WUL, TH is the alarm threshold, k p indicates the alarm threshold confidence coefficient and SISAbrd represents the SISA value corresponding to the SISA index broadcasted in the navigation messages. To guarantee integrity, SISA is equal to the upper bound on the SISA value corresponding to the SISA index. If the integrity risk limit of 10 - 5 =h is met, the value of k p is 4.42. The satellite signal-in-space error is monitored in near real time with the one second sampling observation data,

5

and the monitoring method is the same as that for the SISMA computation. If the SIS error is greater than the alarm threshold, the broadcasted AIF parameter is changed to ‘‘1” to send an alarm, as shown in formula (4): SISE > TH ¼ k p SISMAbrd AIF ¼ 1

ð4Þ

where SISE represents the SIS error, TH represents the alarm threshold, and SISMAbrd represents the SISMA value corresponding to the SISMA index broadcast in a navigation message. The SIF message is created by the SAIM system. However, if SIF is equal to ‘‘1” and the AIF and DIF parameters are both ‘‘0”, the abnormality detected by SAIM has recovered. Then, a recovery confirmation command is transmitted to the satellite from the control system to restore the SIF parameter to ‘‘0”. The basic navigation integrity messages mentioned above will be broadcasted by the satellite itself for GEO, IGSO and MEO separately. It needs to be noted that DIF and AIF parameters broadcasted by MEO and IGSO satellites are active only when the satellites are in view of the ground uplink stations, otherwise the parameters will not be updated. Considering that the probability of SIS anomaly is very small, if a satellite is out of the view of the ground uplink stations, it relies on the SIF parameter to ensure the near real-time alert when anomaly occurred. The strategy that update AIF and DIF parameters with inter-satellite links is under considered in the BDS follow-up technology upgrade. 2.3. Satellite-based augmentation integrity monitoring Satellite-based augmentation integrity monitoring technology is used to analyze the integrity of satellite ephemeris and clock differential corrections, ionospheric grid corrections with the observation data from monitoring receivers. The monitoring process provides the User Differential Range Error (UDRE), Grid Ionospheric Vertical Error (GIVE), and degradation parameters to users for integrity analysis. UDRE indicates the accuracy of combined satellite ephemeris and clock error corrections, where satellite ephemeris accuracy component is an ‘‘equivalent” range accuracy rather than accuracy of each of the EarthCentered-Earth-Fixed (ECEF) components. GIVE indicates the accuracy of the ionospheric delay corrections. Degradation parameters are used to compute the degradation of satellite ephemeris and clock error corrections when user fail to receive the most recent corrections. BDS-3 broadcasts differential and integrity information according to two types of interface agreements through two new civil signals, B1C and B2a, separately. The augmentation information for the RTCA interface is broadcast through the B1C signal, which is suggested for use by single-frequency users. The information for the DFMC interface is broadcast through the B2a signal to meet the

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002

6

Y. Cao et al. / Advances in Space Research xxx (2019) xxx–xxx

needs to dual-frequency multi-constellation users. This design improves the compatible operation with other SBAS systems and meets the demands of both single- and dualfrequency users (RTCA DO-229D, 2006; IWG members, 2016). BDS-3 wide-area augmentation system monitoring network, which includes thirteen Class I monitor stations and thirty-four Class II monitor stations, can receive BDS, GPS, Galileo and GLONASS observations. Every monitoring station has three monitoring receivers that are equipped with standard frequency equipment. The observations of the two receivers are used for the cross checking and parallel checking of the augmentation products; specifically, one is used to process differential corrections, and the other is used for integrity monitoring. The third receiver serves as a backup of the other two receivers. The continuous multi-coverage monitoring of all visual satellites in the service area is performed using the regional monitoring network. 3. Processing procedure and broadcasting parameters of BDS-3 integrity monitoring 3.1. Information processing procedure BDS-3 integrity monitoring consists of SAIM, groundbased integrity monitoring (GBIM) and satellite-based augmentation system integrity monitoring (SBASIM). SAIM focuses on the deterioration of satellite clock performance and satellite signal anomalies. GBIM uses groundbased and inter-satellite observations to evaluate the SISA, SISMA and monitor the healthy status of navigation data, signals, satellites and control systems. SBASIM guarantees the reliability of wide-area differential corrections. The integrity monitoring system consists of the ground monitoring network, ground-based integrity monitoring facility, SBAS integrity monitoring facility, upload stations, navigation satellites and users. The detailed monitoring process is shown in Fig. 3. As mentioned above, each monitoring station includes three monitoring receivers that collect GNSS observations with a 1-second sampling frequency. The data are transmitted to the ground-based integrity monitoring facility and SBAS integrity monitoring facility in real time. The integrity monitoring facilities perform data preprocessing, which includes the identification and elimination of errors in the observation data; the carrier phase smoothing of the pseudorange, and common system error calculations and corrections. Then, the ‘‘clean” data are used to monitor the system integrity and calculate the monitoring information. In Fig. 3, the dark green lines indicate the integrity messages related to the ground-based integrity monitoring facility, the orange lines indicate the integrity messages devoted to the SBAS integrity monitoring facility and the light green circles indicate the integrity messages from the SAIM function onboard. The ground-based integrity monitoring facility computes the SIS error in real time to monitor the satellite

ephemeris and clock errors and ionospheric anomalies and generates the basic integrity parameters. The SISMA of the satellites expressed as a level value SISMAI may be used as a weigh for different satellites according to the user positioning needs. Because the SISMAI parameters are updated every 30 s, to improve the time-to-alert ability, GBIM provides AIF and DIF parameters that can be updated every 1 s when a system anomaly is detected. The ground-based integrity facility produces basic integrity information that are arranged in a separate basic navigation message and broadcasted by navigation satellites. The SBAS integrity monitoring facility mainly monitors the UDRE and the GIVE. The preprocessed observation data that are corrected via orbital and clock differential corrections are used to statistically analyze the UDRE. The ionospheric delay calculated from the ionospheric grid model is compared with the ionospheric delay calculated with a dual-frequency pseudorange combination to estimate the GIVE value. UDRE and GIVE are broadcasted in the form of UDRE index (UDREI) and GIVE index (GIVEI) respectively. The SBAS message is uploaded to the GEO satellites through the uplink system and broadcast to the users in the service area. All GEO/IGSO/MEO satellites of BDS-3 have SAIM ability and can monitor the satellite clock offset step, frequency drift and onboard anomalies in navigation signals. Because this monitoring process is not affected by the complex observation environment, the reliability and time-to-alert ability of the integrity monitoring system are highly improved compared to those of traditional systems. The user system is mainly a user terminal, which may be compatible with GNSSs. By receiving the broadcasted navigation messages and integrity messages, the positioning errors and protection levels are computed to determine whether the current navigation service satisfies the user needs. 3.2. Integrity parameters According to the above integrity monitoring operation method, the system integrity parameters are designed and defined as follows:  Signal-in-space accuracy (SISA) SISA refers to the prediction accuracy based on the broadcast ephemeris and the clock navigation message. This statistic reflects the orbit and clock prediction errors based on unbiased Gaussian distributions.  Signal-in-space monitoring accuracy (SISMA) SISMA refers to the monitoring errors associated with the broadcast ephemeris and the clock navigation message. This statistic reflects the orbit and clock monitoring errors based on unbiased Gaussian distributions.

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002

Y. Cao et al. / Advances in Space Research xxx (2019) xxx–xxx

7

Fig. 3. BDS-3 integrity monitoring process based on ground stations and satellites.

 Satellite integrity status flags (SIF/AIF/DIF) The SIF refers to the signal integrity monitoring status. Specifically, ‘‘0” means that this signal is normal, and ‘‘1” means that this signal is abnormal. This value is obtained from the SAIM and GBIM results. When the detected signal is anomalous, the SAIM system changes SIF to ‘‘1” on board, but when the signal is recovered, the status must be confirmed by the ground control system and send the recovered command to change SIF back to ‘‘0”. The AIF is a real-time indicator of the validity of the SISMA value. Specifically, ‘‘0” means that the SISMAI value is valid, and ‘‘1” means that the SISMAI value is invalid. The DIF refers to the status of the navigation message. Specifically, ‘‘0” indicates that the message parameter error broadcasted in this signal does not exceed the prediction accuracy, and ‘‘1” indicates that the prediction accuracy is exceeded. The errors in message parameters are calculated by comparing the broadcast navigation message and the results of precise orbit determination and realtime TWSTFT processing. The BDS TWSTFT method

provides high-precision satellite clock measurements whose calculation methods are described by Liu et al. (2009), Cao et al. (2014) and Pan et al. (2018).  User differential ranging error (UDRE) UDRE refers to the ranging accuracy with the satellite orbit and clock differential corrections. This statistic reflects the differential correction residual errors with an unbiased Gaussian distribution.  Grid ionospheric vertical error (GIVE) GIVE denotes the correction errors of each ionopheric grid broadcast in an SBAS message. Detailed information on this parameter can be found in (ICAO, 2006).  Degradation parameters The degradation parameters include time-related and space-related parameters, which are used to reflect the user differential ranging accuracy limit in a valid period and in the effective service area.

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002

8

Y. Cao et al. / Advances in Space Research xxx (2019) xxx–xxx

Table 2 Updated period and monitoring methods of BDS integrity parameters. Parameter type

Parameter

Updated period

Monitoring technique

Basic navigation integrity parameter

SISAI SISMAI AIF DIF SIF UDRE GIVE Degradation parameters

10 min 30 s 1s 1s 1s 6s 5 min 120 s

GBIM

SBAS integrity parameter

The updated period and monitoring methods of these integrity parameters are listed in Table 2. Integrity parameters are used to calculate integrity bounds called protection levels (PL). Take aviation users for example, depending on the flight operation, the user equipment may either simply compute a Horizontal Protection Level (HPL) or both a HPL and a Vertical Protection Level (VPL). The user receiver compares the computed protection levels with the alert limit (AL) thresholds established for the selected phase of flight. If one of the protection levels exceeds the corresponding alert limit, integrity service is not adequate to support that operation. HMI exists when the user’s position error exceeds the protection levels for a period longer than the time-to-alert (TTA). An underbound condition cannot be detected by the receiver so the GNSS integrity algorithms are designed to ensure that integrity parameters will not cause an underbound condition under any conditions of operation. The BDS-3 integrity parameters broadcasted to users are utilized to calculate the HPL and VPL, as shown in formula (5): HPL ¼ F
1 RF ð1
P h;hmi Þ vffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi sffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi u  2 2 u 2 d east þ d 2north td east þ d 2north þ þ d 2EN  2 2 pffiffiffiffiffiffi dU VPL ¼ F
1 CEF ðP v;hmi =2Þ  F
1 CEF ðtÞ

d NT

ð5Þ

F
1 RF ðtÞ

d UT

dinate system; d 2U is the variance of model distribution that overbounds the true error distribution in vertical direction with the station local coordinate system; d 2T is the variance of model distribution that overbounds the true error distribution in receiver clock offset; d EN is the covariance of model distribution in the east and north direction; d EU is the covariance of model distribution in the east and vertical direction; d ET is the covariance of model distribution in the east direction and receiver clock offset; d NU is the covariance of model distribution in the north and vertical direction; d NT is the covariance of model distribution in the north direction and receiver clock offset; d UT is the covariance of model distribution in the vertical direction and receiver clock offset. The elements in the ith row of the observation design matrix G can be expressed as follows. Gi ¼ ½
cosEli sinAzi
cosEli cosAzi
sinEli ; 1

ð7Þ

where Eli and Azi indicate the elevation angle and azimuth of the ith ranging source observed by the user receiver. The weight matrix W is a diagonal matrix that can be expressed as follows:   1 1 W ¼ diag ;; ð8Þ UERE21 UERE2N where UEREi is expressed in (9).

where and are inverse functions of the complementary error function (CEF) and Rayleigh function (RF), respectively; P h;hmi and P v;hmi are the probabilities of HMI with respect to horizontal navigation and vertical navigation, respectively; and d ii can be expressed as follows. 2 2 3 d east d EN d EU d ET 2 6d 7
1 6 EN d north d NU d NT 7 ð6Þ 6 7 ¼ ðGT WGÞ 2 4 d EU d NU d U d UT 5 d ET

GBIM + SAIM SBASIM

d 2T

where d 2east denotes the variance of model distribution that overbounds the true error distribution in east direction with the station local coordinate system; d 2north is the variance of model distribution that overbounds the true error distribution in north direction with the station local coor-

UERE2i ¼ SISA2i þ r2i;iono þ r2i;air þ þr2i;tropo

ð9Þ

In the above equation, SISAi is the SISA value corresponding to the SISA index broadcasted in the navigation messages for satellite i, ri;iono is the variance of the residual of ionospheric model correction, ri;tropo is the variance of the residual of tropospheric model correction, and ri;air is the variance of the observation noise. These variance parameters can be estimated by the appropriate empirical models. The algorithms for SBAS users are similar and are not discussed in the paper. 4. Preliminary verification of BDS-3 integrity monitoring performance 4.1. Test scheme design BDS-3 has already successfully launched twenty-one satellites. The detail Information about the operational sta-

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002

Y. Cao et al. / Advances in Space Research xxx (2019) xxx–xxx

tus of BDS-3 can be found on the website of theTest and Assessment Research Center of China Satellite Navigation Office (http://www.csno-tarc.cn/index/index&ce=english). To test and verify the BDS-3 integrity monitoring performance, the integrity monitoring operation process is verified during satellite onboard testing under normal working conditions. To identify the most common failures in the navigation system, some artificial orbital and satellite clock anomalies were created to test the system integrity and alarm performance. The results of the onboard integrity testing are given below. 4.2. Integrity monitoring under normal conditions Taking satellite M5 as an example, the time series of SISAoe =SISAoc0 =SISAoc1 parameters for a week are listed in Fig. 4. The red line in the top subgraph indicates the SISAoe parameter, which represents the orbital tangential and normal prediction error in units of meters. The blue line in the middle subgraph indicates the SISAoc0 parameter, which represents the orbital radial and satellite clock offset prediction error in units of meters. In the bottom subgraph, the SISAoc1 parameter represents the satellite clock frequency offset prediction error in units of meters per second. The SISAoc2 parameter, which represents the satellite clock frequency drift prediction error, is zero in the period and not shown in the figure. According to the calculation method of SISA parameters described in section 2.2, the serration-like periodic variation in the time series of SISA parameters shown in Fig. 4, is caused by the periodic variation of prediction errors in the orbit and clock offset.

9

For comparative analysis, the time series of URAed =URAned0 =URAned1 parameters broadcasted in a GPS PRN 1 CNAV ephemeris message (IS-GPS-200H, 2013) in the same period are shown in Fig. 5. Similarly, the red line in the top subgraph represents the URAed parameter, which indicates the elevation-dependent error of the broadcast ephemeris, such as the orbital tangential and normal prediction error. The top subgraph is given in units of meters. The blue line in the middle subgraph represents the URAned0 parameter, which indicates the none elevation-dependent prediction error bias in the ephemeris, such as for the orbital radial and satellite clock offset error. This subgraph is also given in units of meters. The green line in the bottom subgraph represents the URAned1 parameter, which indicates the satellite clock frequency offset prediction error in the ephemeris in units of meters per second. URAned2 , which indicates the satellite clock frequency drift prediction error of the broadcast ephemeris, is zero during this period. According to Figs. 4 and 5, the predicted orbital tangential and normal error of the BDS-3M5 satellite varies from 1.5 m to 4 m, the predicted clock offset error varies from 0.35 m to 0.5 m, and the clock frequency offset error is approximately on the order of magnitude of 10
5 . All three SISA parameters exhibit significant periodic changes like those of the URA parameters in the GPS CNAV navigation message. The magnitudes of the different types of SISA parameters are also comparable to that those of the GPS URA parameters. The time series variations in the SISMA and UDRE parameters of the M5 satellite are given in Fig. 6. The

Fig. 4. Time series of the SISAoe =SISAoc0 =SISAoc1 parameters for the M5 satellite.

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002

10

Y. Cao et al. / Advances in Space Research xxx (2019) xxx–xxx

Fig. 5. Time series of the URAed =URAned0 =URAned1 parameters broadcast in the GPS PRN 1 CNAV ephemeris.

SAIM monitor technology is not limited by the monitoring station distribution and can transmit an alarm in a few seconds. The monitoring result given by the broadcasting SIF parameter only can indicate the healthy status of the satellite, but cannot give the signal accuracy level. In practical applications, users can combine SAIM and GBIM monitoring messages to make comprehensive judgments and improve their navigation integrity performance. 4.3. Satellite clock anomaly monitoring

Fig. 6. Comparison of the SISMA and UDRE parameters for the M5 satellite.

red dots indicate the SISMA parameter, and the blue dots represent the UDRE parameter. The figure is given in units of meters. SISMA indicates the SIS ranging error, and UDRE indicates the differential ranging error corrected with orbital and satellite clock corrections. It is obvious that the UDRE parameter is much smaller than the SISMA parameter because of SBAS differential corrections. The above analysis shows that SISA, SISMA and UDRE all reflect the time variance of the satellite SIS accuracy and can be used to weight different satellites during user positioning.

The BDS-3M2 satellite is adopted to carry out the satellite clock anomaly monitoring test. Specifically, we send a satellite clock phase-adjusted command through the telemetry and command system to perform an onboard satellite clock step. Then we verify the performance of system integrity monitoring. First, the M2 satellite SAIM system is set to SIF alarm mode. If the status of the signal is healthy, the SIF message is assigned a value of ‘‘0”; otherwise, the SIF message is given a value of ‘‘1”. At the beginning of the test, we checked the SIF parameter broadcasted by the M2 satellite, and it was ‘‘0”, indicating that the satellite signal was healthy. At 01:53:18 BDT on May 12, 2018, we sent the satellite clock phase-adjusted command to create a +8 ns onboard satellite clock step, and at 02:09:39 BDT another satellite clock phase-adjusted command was sent to create a
8 ns onboard satellite clock step. The detailed processing of the integrity monitoring test is shown in Fig. 7. The onboard satellite clock epoch-

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002

Y. Cao et al. / Advances in Space Research xxx (2019) xxx–xxx

11

Fig. 7. The processing of the integrity monitoring test.

difference measurements from SAIM is transmitted to the ground control system, and the satellite clock step is recorded. At the same time, the satellite clock phase step calculated with the ground TWSTFT clock measurements is recorded. The satellite clock steps obtained from different data sources are compared with the clock adjustment value uploaded to the telemetry command system to evaluate the satellite clock monitoring precision. The integrity monitoring parameters SIF and SISMA are decoded from the monitoring receivers to verify the alarm information and time-to-alarm alert ability. The onboard time series of the satellite clock epochdifference measurements from SAIM are shown in the top subgraph of Fig. 8 with red dots. The time series of satellite clock errors calculated based on GBIM are shown in the bottom subgraph of Fig. 8 with blue dots, which are the difference between the satellite clock values calculated

from TWSTFT clock measurements and the satellite clock values broadcast in the navigation message, as shown in Eq. (10). Fig. 8 shows both SAIM and GBIM can monitor the satellite clock steps that caused by the satellite clock phase-adjusted commands. Dclk ¼ clk TWSTFT
clk brd

ð10Þ

where clk TWSTFT is the satellite clock value calculated with the TWSTFT measurements, clk brd is the satellite clock value calculated with the broadcasted ephemeris parameters and Dclk is the monitored satellite clock error. The satellite clock step may also cause a pseudorange jump. In these experiments, SIF is assessed according to the onboard satellite clock epoch-difference measurements, and the SISMA is calculated with the pseudorange observed by monitoring receivers. For SIS integrity, the SIS TTA starting point is where the receiver outputs out-

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002

12

Y. Cao et al. / Advances in Space Research xxx (2019) xxx–xxx

Fig. 9. Time series of SIF, SISMAI and UDREI broadcast during the first satellite clock anomaly monitoring experiment. Fig. 8. Satellite clock step based on SAIM and GBIM.

of-tolerance data and the SIS TTA end event is also at the output of the receiver (ICAO, 2006). Therefore, the time T1 when the satellite clock epoch-difference measurement jumps and time T2 when the SIF parameter changes to ‘‘1” are recorded. The time span between T1 and T2 is used to verify the TTA of the SAIM system. The time T3 is when the pseudorange jump is observed by monitoring receivers, and the time T4 is when the SISMA parameter jump is recorded. The time span between T3 and T4 is used to verify the TTA of GBIM. The detailed results of the experiments are listed in Table 3. These experiment results indicate that SAIM can send failure alerts within 4 s with the SIF parameter, which is decoded by receivers every 3 s. GBIM can send failure alerts within approximately 54 s with the SISMA parameter, which is decoded every 30 s. The TTA ability is closely related to the integrity message decoding period. The time series of SIF, SISMAI and UDREI during the first experiment are shown in Fig. 9, where SISMAI and UDREI are the SISMA and UDRE index values, respectively. Both SIF and SISMA send an alarm information when the satellite clock step occurs. UDRE does not send an alarm because the satellite clock step errors are corrected with the differential corrections. According to the experimental results, the SAIM system monitors the anomaly onboard and has a four-second TTA ability. The TTA ability of GBIM is near one minute, as

the anomalies may cause the observation signal interrupted temporarily, and the SISMA parameter is updated every 30 s. 4.4. Satellite orbit anomaly monitoring To verify the satellite orbit anomaly monitoring ability, a 28-m radial error was added in the 10:00–11:00 ephemeris of the M6 satellite when the satellite was visually tracked in China. The time series of SIF, SISMAI and UDREI are shown in Fig. 10 in the top subgraph, middle subgraph and bottom subgraph, respectively, to display the monitoring results with different monitoring methods. As shown in the figure, SIF does not give alarm information because the SAIM system does not have ephemeris integrity monitoring ability. SISMAI provided by GBIM provides alarm information because GBIM can monitor the ephemeris integrity. UDREI is normal because the differential range errors are a few decimeters after the differential corrections. 5. Summary The system integrity monitoring and processing methods and parameter systems of BDS-3 have been comprehensively upgraded. This paper introduces the design of the three types of integrity monitoring methods, the integrity monitoring process and integrity parameters adopted by BDS-3 in

Table 3 TTA analysis for SAIM and GBIM. Items

Integrity monitoring method

Abnormal data received

Navigation message alarm

TTA performance

First satellite clock adjusted operation

SAIM

01:53:20

4s

GBIM

01:53:39

SAIM

02:09:41

GBIM

02:10:06

01:53:24 (SIF message) 01:54:30 (SISMA message) 02:09:45 (SIF message) 02:11:00 (SISMA message)

Second satellite clock adjusted operation

51 s 4s 54 s

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002

Y. Cao et al. / Advances in Space Research xxx (2019) xxx–xxx

13

References

Fig. 10. Time series of SIF, SISMAI and UDREI broadcast during the orbit anomaly monitoring experiment.

detail. During satellite onboard testing, the integrity verify methods are designed under normal working, satellite clock anomaly and orbit anomaly conditions, separately. The preliminary analysis results show that SAIM technology can monitor satellite clock failure effectively but cannot monitor satellite orbit failure, which conforms to the system design. Ground-based integrity monitoring can be performed for satellite clock failures and satellite orbit failures, providing alarm information to users with different SISMAI level values. The SBAS can effectively correct the satellite clock and orbit errors, and UDREI can indicate the differential range accuracy. SAIM has a TTA ability of four seconds, and GBIM has a TTA ability of near one-minute level, which is closely related to the integrity parameter updated period. BDS-3 can perform the continuous and stable integrity monitoring of the system to meet the needs of different users by broadcasting different types of integrity parameters with various updated periods. Declaration of Interest Statement 1. To the best of our knowledge, the named authors have no conflict of interest, financial or otherwise. 2. There are no other relationships or activities that could appear to have influenced the submitted work.

Acknowledgments The authors are grateful for the comments and remarks of the reviewers, which helped to improve the manuscript. This work was supported by the National Key Research Program of China as the ‘‘Collaborative Precision Positioning Project” (No. 2016YFB0501900), National Natural Science Foundation of China (Grant Nos. 41674041 and 11203059) and the Shanghai Key Laboratory of Space Navigation and Position Techniques (Grant No. 12DZ2273300).

Bian, L., Liu, W., Yan, T., 2018. Satellite Integrity Autonomous Monitoring (SAIM) of BDS and onboard performance evaluation. In: Sun, J., Yang, C., Guo, S. (Eds.), China Satellite Navigation Conference (CSNC) 2018 Proceedings. CSNC 2018. Lecture Notes in Electrical Engineering, vol. 497. Springer, Singapore, pp. 819–832. https://doi.org/10.1007/978-981-13-0005-9_67. China Satellite Navigation Office, 2017a. BeiDou Navigation Satellite System Signal in Space Interface Control Document. Open Service Signal B1C (Version 1.0). China Satellite Navigation Office, 2017b. BeiDou Navigation Satellite System Signal In Space Interface Control Document. Open Service Signal B2a (Version 1.0). Cao, Y., Hu, X., Chen, J., et al., 2019. Initial analysis of the BDS satellite autonomous integrity monitoring capability. GPS Solut. 23 (35). https://doi.org/10.1007/s10291-019-0829-z. Cao, Y., Hu, X., Zhou, J., et al., 2014. Kinematic wide area differential corrections for BeiDou regional system basing on two-way time synchronization. Lect. Notes Electr. Eng. 305 (3), 277–288. Chatre, E., Verhoef, P., 2018. Galileo programme status update. In: Proceedings of ION GNSS 2018, Institute of Navigation, Miami, FL, USA, September 24–28, pp. 733–767. https://doi.org/10.33012/ 2018.15839. Fernandez, F.A., 2011. Inter-satellite ranging and inter-satellite communication links for enhancing GNSS satellite broadcast navigation data. Adv. Space Res. 47 (5), 786–801. https://doi.org/10.1016/j. asr.2010.10.002. FAA, 2008. Global Positioning System Wide Area Augmentation System (WAAS) Performance Standard. 1st ed., 31 October 2008. Gratton, L., Joerger, M., Pervan, B., 2010. Carrier phase relative RAIM algorithms and protection level derivation. J. Navig. 63 (2), 215–231. Hewitson, S., Wang, J., 2006. GNSS receiver autonomous integrity monitoring (RAIM) performance analysis. GPS Solut. 10 (3), 155–170. https://doi.org/10.1007/s10291-005-0016-2. Hernandez, C., Catalan, C., Fernandez, M., et al., 2008. The galileo ground segment integrity algorithms: design and performance. Int. J. Navig. Observ. 2008, 1–16. https://doi.org/10.1155/2008/178927. ICAO, 2006. Annex 10 to the Convention on International Civil Aviation, Volume I. IWG members, 2016. SBAS L5 DFMC Interface Control Document (SBAS L5 DFMC ICD), 10,24. IS-GPS-200H, 2013. Global Positioning Systems Directorate Systems Engineering & Integration Interface Specification. Sep 24, 2013. Kovach, K., Dobyne, J., Crews, M., et al., 2008. GPS III Integrity concept. In: Proceedings of 21th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS 2008), Savannah, GA, USA, September 16-19, pp. 2250–2257. Liu, L., Zhu, L., Han, C., et al., 2009. The model of radio two-way time comparison between satellite and station and experimental analysis. Chin. Astron. Astrophy 33 (4), 431–439. https://doi.org/10.1016/j. chinastron.2009.09.009. Liu, W., Hao, J., Lv, Z., et al., 2013. A method of integrity monitoring and assessment for BeiDou navigation satellite system. Lect. Notes Electr. Eng. 244, 211–219. https://doi.org/10.1007/978-3-642-37404-3_19. Miles, C., Kovach, K., Dobyne, J., et al., 2013. GPS integrity architecture opportunities. In: Proc. ION GNSS+ 2013, Institute of Navigation, Nashville, Tennessee, USA, September 16–20, pp. 2592–2604. Oehler, V., Luongo, F., Trautenberg, H., et al., 2004. The galileo integrity concept. In: Proc. ION GNSS 2004, Long Beach, CA, USA, September 21–24, pp. 604–615. Pan, J., Hu, X., Zhou, S., et al., 2018. Time synchronization of newgeneration BDS satellites using inter-satellite link measurements. Adv. Space Res. 61 (2018), 145–153. https://doi.org/10.1016/j. asr.2017.10.004. Peckjian, A., Shaw, S., Katronick, A.J., 2016. Maturation of GPS III signal integrity improvements. In: Proceedings of the 20th Interna-

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002

14

Y. Cao et al. / Advances in Space Research xxx (2019) xxx–xxx

tional Technical Meeting of the ION Satellite Division, ION GNSS+ 2016, Portland, Oregon, USA, September 12–16, pp. 2910–2921. https://doi.org/10.33012/2016.14562. Petzinger, J., Reith, R., Dass, T., 2002. Enhancements to the GPS block IIR timekeeping system. In: Proceedings of the 34th Annual Precise Time and Time Interval (PTTI) Systems and Applications Meeting, Reston, VA, December 3–5, pp. 89–107. Rodriguez, I., Garcia, C., Catalan, C., et al., 2011. Inter-satellite links for satellite autonomous integrity monitoring. Adv. Space Res. 47 (2), 197–212. https://doi.org/10.1016/j.asr.2010.07.019. Rodriguez, I., Garcia, C., Catalan, C., et al., 2009. Satellite Autonomous Integrity Monitoring (SAIM) for GNSS systems. In: Proc. ION GNSS 2009, Institute of Navigation, Savannah, GA, USA, September 22–25, pp. 1330–1342. RTCA DO-229D, 2006. Minimum Operational Performance Standards for Global Positioning System/Satellite-Based Augmentation System Airborne Equipment. December 13, 2006. Sardon, E., Mora, E., Hernandez, C., et al., 2006. Galileo integrity processing facility: preliminary design. In: Proc. ION GNSS 2006, Fort Worth, TX, USA, September 26–29, pp. 531–539. Tang, C., Hu, X., Zhou, S., et al., 2016. Improvement of orbit determination accuracy for Beidou navigation satellite system with two-way satellite time frequency transfer. Adv. Space Res. 58 (7), 1390–1400. https://doi.org/10.1016/j.asr.2016.06.007. Tang, C., Hu, X., Zhou, S., et al., 2018. Initial results of centralized autonomous orbit determination of the new-generation BDS satellites

with inter-satellite link measurements. J. Geod. 92, 1155–1169. https:// doi.org/10.1007/s00190-018-1113-7. Vioarsson, L., Pullen, S., Green, G., et al., 2001. Satellite autonomous integrity monitoring and its role in enhancing GPS user performance. In: Proc. ION GPS 2001, Institute of Navigation, Salt Lake, UT, USA, September 11–14, pp. 690–702. Wu, A., 1999. Investigation of the GPS Block IIR Time Keeping System (TKS) Anomalies Caused by the Voltage-Controlled Crystal Oscillator (VCXO). In: Proceedings of the 31th Annual Precise Time and Time Interval Systems and Applications Meeting, Dana Point, California, December 1999, pp. 55–64. Wolf, R., 2000. Onboard autonomous integrity monitoring using intersatellite links. In: Proc. ION GPS 2000, Institute of Navigation, Salt Lake, UT, USA, September 19–22, pp. 1572–1581. Xu, H., Wang, J., Zhan, X., 2011. GNSS Satellite Autonomous Integrity Monitoring (SAIM) using inter-satellite measurements. Adv. Space Res. 47 (7), 1116–1126. https://doi.org/10.1016/j.asr.2010.11.026. Zhou, S., Cao, Y., Zhou, J., et al., 2012. Positioning accuracy assessment for the 4GEO/5IGSO/2MEO constellation of COMPASS. Sci China Phys Mech Astron 55, 2290–2299. https://doi.org/10.1007/s11433-0124942-z. doi: 10.1007/s11433-012-4942-z. Zink, T., Eissfeller, B., Lohnert, E., et al., 2000. Analyses of integrity monitoring techniques for a global navigation satellite System (GNSS2). In: Proceedings of the IAIN World Congress, ION Annual Meeting, San Diego, CA, USA, June 26–28, pp. 117–127.

Please cite this article as: Y. Cao, J. Chen, X. Hu et al., Design of BDS-3 integrity monitoring and preliminary analysis of its performance, Advances in Space Research, https://doi.org/10.1016/j.asr.2019.11.002