# BDS-3 Integrity Risk Modeling and Probability Evaluation
## 1 Introduction  
Accuracy, integrity, continuity and availability are the four main indicators of global navigation satellite system (GNSS) service performance [1; 2; 3; 4]. Among them, integrity refers to the ability of the GNSS to provide timely alerts to users when GNSS fails or errors exceed the allowable tolerance and is not qualified for the specified navigation task, which is a critically important indicator for measuring GNSS reliability [5]. With the improvement in GNSS accuracy, many high real-time users, such as civil aviation users, have already proposed clear requirements for GNSS integrity. In GNSS upgrade plans, such as GPS III in the United States, Galileo in the European Union and the BeiDou in China, improving system integrity is one of the most concerning topics [6; 7; 8; 9; 10]. Integrity can be divided into user-side integrity and system-side integrity from an object-oriented perspective. User-side integrity is based on position accuracy, which is related to user usage scenarios and continuity judgment thresholds. Usually, different scenarios have different requirements, and it is difficult to exclude the user receiver performance influence. System-side integrity is built based on signal-in-space, which can exclude uncertainty factorssuch as user scenarios and receiver performance and is usually used to characterize GNSS integrity performance. The integrity studied in this paper is only the system-side integrity. The GNSS integrity performance is usually reflected by the integrity risk probability, alarm time and alarm limit. Integrity risk probability refers to the integrity risk event probability that the instantaneous Signal-In-Space Ranging Error (SISRE) exceeds the alarm limit without sending effective alarm information within the alarm time caused by a spatial signal-in-space fault. Alarm time refers to the time from the emergence of dangerous misleading information to the arrival of warning information to the user receiver antenna. The alarm limit refers to the judgment threshold for users to assess whether the system is usable. This is related to the application field, and the alarm limits in different application fields are different. The GNSS signal-in-space alarm limit is usually related to the system integrity parameters. According to the system's commitment integrity risk probability, the GNSS signal-in-space alarm limit is usually set to the multiple SISRE, with a certain confidence level. For example, the GPS signal-in-space alarm limit is 4.42-times the URA, which is the integrity guarantee value. At present, different GNSSs adopt different integrity parameter designs, such as GPS User Ranging Accuracy (URA) parameters, Galileo Signal In-Space Accuracy (SISA) and IF parameters, and the new BDS generation system SISA, Signal In-Space Monitor Accuracy (SISMA) and Availability Integrity Flag (AIF)/Data Integrity Flag (DIF)/Signal Integrity Flag (SIF) parameters [11; 12; 13]. A detailed description of BDS integrity parameters was given by [9]. The BDS satellite navigation system is composed of a Geostationary Earth Orbit (GEO), Inclined GeoSynchronous Orbit (IGSO) and Medium Earth Orbit (MEO) hybrid constellation. The arc coverage of the BDS regional monitoring network for mobile satellites, especially MEO satellites, is very small. With the development strategy of the BDS satellite navigation system from the regional system (BDS-2) to global system (BDS-3), enhancing the integrity of BDS for users around the world is one of the most important aims of the system. To meet the requirements of integrity monitoring, BDS-3 adopts a complex monitoring mode combining ground integrity monitoring and satellite autonomous integrity monitoring. At the same time, to establish the fault tree model and analyze the system, abnormal characteristics are significant in improving the integrity performance of BDS-3.