# BDS-3 Integrity Risk Modeling and Probability Evaluation
## 5 Summary and Conclusions  
In this paper, the IFMEA identification analysis method was used to establish the integrity risk tree of BDS-3. The BDS-3 signal-in-space ranging errors, which are considered as one of the most important parameters for integrity monitoring, were characterized based on the real downlink navigation message. Then, the integrity performance of BDS-3 was quantitatively verified by the abnormal characteristic table statistics of the actual system anomalies. The statistical period is from 27 December 2018, to 27 December 2020. Among the BDS-3 anomalies shown in Table 6, there are 10 anomalies related to payload anomalies in the space segment which are affected by the space environment, as three satellite clock anomalies, one signal power anomaly and six signal measurement anomalies. Six anomalies were not detected by satellite autonomous integrity monitoring due to satellite autonomous integrity monitoring limitation. There are seven anomalies in the ground control segment, including two inaccurate ephemeris/clock calculation anomalies, one orbit and time synchronization processing equipment anomaly, three ephemeris fitting parameter anomalies and one monitoring station data anomaly. According to the statistical calculation, the occurrence times of each bottom event of the integrity risk tree are obtained, and the anomaly probability is predicted according to the Bayesian model. Based on the integrity risk tree analysis, the integrity risk probability of BDS-3 is calculated as approximately 0.9e-7/h at a 95% confidence level, which meets the design index requirements of 1e-7/h.  
The analysis results show that \"pseudorange measurement anomaly\" and \"satellite autonomous integrity nondetection\" are the key factors restricting system integrity. Therefore, this paper proposed solutions to improve integrity performance: the first is to improve the satellite payload against the space environment effect, reducing the probability of satellite payload anomalies to reduce the probability of pseudorange measurement anomalies; the second is to improve the ability of satellite autonomous integrity monitoring, realizing autonomous integrity monitoring and alarms of ephemeris anomalies to reduce the satellite autonomous integrity non-detection probability. The relevant specific contents will be introduced in detail in a follow-up study.  
It is very important to continuously carry out IFMEA processing for BDS-3. This paper introduces the monitoring methods of IFMEA, and preliminarily evaluates the integrity performance of the BDS-3 with initial service observation data. Subsequently, according to the analysis results of IFMEA, we will focus on the updates of the system fault tree model  
Figure 9: Probability of integrity risk with different numbers of exceptions at the 95% confidence level.  
and the system control segment and will continuously evaluate the system integrity service capability of BDS-3, using the measured data according to the system update status.  
Writing--original draft preparation, L.C. ([PERSON]); conceptualization, writing--review and editing, W.G.; conceptualization, Formal analysis, Z.H.; writing--review & editing, Y.C.; methodology, L.P. and C.L.; resources, W.Z.; validation, X.L.; data curation, L.C. ([PERSON]); software, R.Y. All authors have read and agreed to the published version of the manuscript.  
This paper is supported by the National Natural Science Foundation of China (No. 41674041, 11203059), Young Elite Scientists Sponsorship Program by CAST (YESS20200308), China Postdoctoral Science Foundation (2021M690192), Beijing Postdoctoral Research Foundation (2021-ZZ-088) and Beijing Nova Program (Z211100002121068).  
Not applicable.  
The authors declare no conflict of interest.