# BDS-3 Integrity Risk Modeling and Probability Evaluation
## 4 Result and Discussion
### Probabilistic Assessment and Result Analysis of Integrity Risk Based on Actual Data  
BDS-3 provides basic positioning navigation and timing services on 27 December 2018. Based on the actual operation data of the system, 11 abnormal events of the signal-in-space integrity risk tree in Figure 2 are counted (the statistical period is from 27 December 2018 to 27 December 2020), and the actual number of failures of each abnormal event are calculated. There were eighteen abnormal events of BDS-3 during the statistical two years, and six of the eighteen anomalies occurred in the satellite arc without ground monitoring and missed detected by SAIM. The missed alarm events include one satellite clock anomaly and five signal measurement anomalies. The other anomaly events were all detected by SAIM or the ground integrity monitoring function. The integrity risk probability calculation is related to the predictive number of failures, the number of satellites in the constellation, and the evaluation confidence. In the integrity risk algorithm adopted by the joint ARAIM working group of the European Union and the United States, 60% is usually used as the confidence level, but the confidence level under conservative estimation is generally 95%. This paper predicts the number of abnormal events according to the 95% confidence requirement and evaluates the integrity risk probability of two years. Considering that the number of satellites in the BDS-3 constellation is 30, the results are shown in Table 6.  
Figure 8: Cumulative distribution function (CDF) of SISRE for BDS-3 GEO satellites (**top**), IGSOs (**middle**) and MEOs (**bottom**). According to the above analysis and assumptions about the integrity risk tree, without considering the receiver abnormal influence, based on the preliminary calculation, the probability of BDS-3 anomalies is approximately 9.06e-5/h, and the abnormal monitoring missing detection rate is 3.22e-5, whose conservative value is 1e-3 according to the system design. The probability of BDS-3 integrity risk under 95% confidence could be calculated to be approximately 0.9 e-7/h according to the system design value of missing detection rate. Figure 9 shows the probability assessment results of integrity risk with different anomaly occurrence times and different time spans under the 95% confidence level. The black line is the BDS-3 external commitment integrity risk indicator 1e-5/h. It can be seen in Figure 5 that for 0 anomaly occurrence times, more than one year is required to evaluate the integrity risk index lower than 1e-5/h; for one anomaly occurrence, more than two years are required to evaluate the integrity risk index lower than 1e-5/h; for two and three anomaly occurrences, more than three years are required to assess integrity risk indicators lower than 1e-5/h; for seven anomaly occurrence times, more than six years are required to assess integrity risk indicators lower than 1e-5/h. It can be seen from the results in Table 6 that the probabilities of \"pseudorange measurement anomaly\" and \"satellite autonomous integrity nondetection\" are relatively large. Further analysis shows that pseudorange measurement anomalies are mainly due to the influence of the space environment (such as the single event upset effect), which leads to satellite payload anomalies and affects pseudorange measurements. Therefore, improving the anti-space environment effect of satellite payload and reducing the abnormal probability of satellite payload are key factors to reduce the probability of integrity risk. Satellite autonomous integrity non-detection is because satellite autonomous integrity monitoring can only cover the detection of satellite clock frequency/phase hopping, signal power anomalies and correlation peak distortions, and does not have the detection function of ephemeris anomalies. Therefore, improving the satellite autonomous integrity monitoring ability and realizing autonomous integrity monitoring and ephemeris anomaly warning is another key factor to improve integrity performance.