Initial Design for Next-Generation BeiDou Integrity Subsystem: Space–Ground Integrated Integrity Monitoring

Abstract

It is essential to provide high-integrity navigation information for safety-critical applications. Global navigation satellite systems (GNSSs) play an important role in these applications because they can provide global, high-accuracy, all-weather navigation services. Therefore, it has been a hot topic to improve GNSS integrity performance. This paper focuses on an initial proposal of the next-generation BeiDou Navigation Satellite System (BDS) integrity subsystem, with the aim of providing high-quality and global integrity services for the BDS. This paper first reviews the current status of the third-generation BDS integrity service. Following this, this paper proposes a space–ground integrated integrity monitoring design for the BDS that integrates the traditional ground-based integrity monitoring method, the advanced satellite autonomous integrity monitoring (A-SAIM) method, and the augmentation from low-earth-orbit (LEO) satellites. Specifically, this work offers an initial design of the A-SAIM method, which considers both single-satellite autonomous integrity monitoring and multi-satellite joint integrity monitoring. In addition, this work describes two different ways to augment BDS integrity with LEO satellites, i.e., (a) LEO satellites act as space monitoring stations and (b) LEO satellites act as navigation satellites. Simulations are carried out to validate the proposed design using CAT-I operation in civil aviation as an example. Simulation results indicate the effectiveness of the proposed design. In addition, simulation results suggest that if the fault probability of LEO satellites is worse than 1 × 10⁻⁴, LEO satellites can contribute more to BDS integrity performance improvement by acting as space monitoring stations; otherwise, it would be better to employ LEO satellites to broadcast navigation signals. The results also suggest that after taking LEO satellites into account, the global coverage of CAT-I can be potentially improved from 67% to 99%. This work is beneficial to the design of the next-generation BDS integrity subsystem.

1. Introduction

The development of the third-generation BeiDou Navigation Satellite System (BDS-3) was finished in 2020, marking the successful completion of the BeiDou three-step development strategy and entering a new era of global service [1,2]. Compared to the second-generation BeiDou Navigation Satellite System (BDS-2), the BDS-3 constellation has significant advantages such as higher positioning accuracy, global coverage, higher reliability, and more comprehensive services [3,4]. Its service performance has been evaluated by previous studies [5,6,7,8] and widely recognized by the international community [9]. In addition, BDS-3 is playing an important role in various fields such as pedestrian positioning, smart logistics, shared economies, vehicle navigation, agriculture, finance, and electricity [10].

Integrity is the measure of trust that can be placed in the correctness of the information supplied by a navigation system [11]. Integrity also includes the ability of the system to provide timely warnings to users when the system should not be used for navigation. This concept was first introduced in the aviation domain and has recently attracted increasing interest from other safety-critical navigation applications such as intelligent transportation systems, railways, autonomous driving, and low-altitude economies [12]. It is worth noting that we will focus on aviation applications in this work. In our future work, we will extend this work to support urban air mobility and autonomous driving through combing high-precision positioning techniques and integrity monitoring techniques.

Table 1. Integrity performance requirements for different operations in civil aviation.

Parameters	En-Route	Terminal	NPA	APV-I	LPV-200	CAT-I
Time To Alert (TTA)	5 min	15 s	10 s	10 s	6 s	6 s
Horizontal AL (HAL)	7.4 km	1.85 km	556 m	40 m	40 m	40 m
Vertical AL (VAL)	N/A	N/A	N/A	50 m	35 m	15 m
Target Integrity Risk (PHMI)	10−7/h	10−7/h	10−7/h	2 × 10−7/approach	2 × 10−7/approach	2 × 10−7/approach

presents the integrity performance requirements from the International Civil Aviation Organization (ICAO) considering the following flight phases: en-route, terminal, non-precision approach (NPA), approach with vertical guidance I (APV-I), localizer performance with vertical guidance 200 (LPV-200), and Category I (CAT-I). As shown in Table 1, the integrity performance requirements include metrics such as time to alert (TTA), target integrity risk (also known as probability of hazardously misleading information (PHMI)), and alert limit (AL). Table 1 gives the integrity performance requirements for different operations from the ICAO [13].

To determine whether the integrity performance of the onboard navigation system meets the corresponding performance requirements, the navigation receiver needs to calculate the protection level (PL) in real-time and compare it with the associated AL. The PL is defined as the probabilistic upper bound of the positioning error under a target integrity risk (i.e., PHMI). Equivalently, the receiver can determine whether the integrity performance of the onboard navigation system meets the requirements by comparing the integrity risk with the target integrity risk. The integrity risk is defined as the joint probability that the positioning error exceeds the AL without issuing an alarm within the TTA [14,15].

To improve the integrity performance of global navigation satellite systems (GNSSs), GNSS service providers have also been developing satellite-based augmentation systems (SBASs) [16,17,18] independently. The SBAS uses geostationary orbit (GEO) satellites to broadcast SBAS messages, providing high-accuracy and high-integrity correction information on satellite orbits, clock offsets, and ionospheric delays [16,19,20,21]. The SBAS also provides timely alerts to users with GEO satellites if the navigation information contains faults. Currently, the BeiDou Satellite-Based Augmentation System (BDSBAS), the Wide Area Augmentation System (WAAS), the European Geostationary Navigation Overlay Service (EGNOS), and the Russian System for Differential Corrections and Monitoring (SDCM) have completed their system construction. Among them, the WAAS has received single-frequency LPV-200 certification from the ICAO, and the EGNOS has received single-frequency NPA certification. Meanwhile, the BDSBAS is working toward the certification of single-frequency APV-I, which is expected to be completed around 2025 [22].

Although the SBAS can effectively enhance the integrity performance of GNSSs, there are still certain limitations regarding their performance and applicability. Firstly, the current SBAS primarily relies on GEO satellites, like the WASS and BDSBAS, making it impossible to provide global high-level integrity services (GEO satellites maintain a rotational period that coincides with the Earth’s rotation, appearing stationary relative to the ground. Consequently, their signal coverage is regional). Secondly, the current SBAS cannot meet the performance requirements from CAT-I operations. Thirdly, the compatibility of the SBAS in applications beyond civil aviation has not been validated.

In recent years, the United States has proposed the concept of satellite autonomous integrity monitoring (SAIM). Meanwhile, the BDS-3 has achieved the implementation of SAIM, significantly enhancing the system integrity performance. SAIM monitors anomalies in navigation signals, messages, and satellite clocks [23,24,25,26]. Among them, the monitoring of signal and message anomalies relies on GNSS receivers installed on GNSS satellites. These receivers receive the GNSS signals from the satellite itself to determine whether there are any anomalies in the radio frequency signals and messages. Satellite clock anomaly monitoring refers to the GNSS satellites autonomously assessing whether their onboard clocks have experienced abnormal jumps or other behaviors. SAIM has the advantages of not relying on the satellite–ground data link and offering rapid integrity responses. Practical experience has shown that SAIM can effectively reduce the fault probability of GNSS satellites [25,27,28,29].

In addition to SAIM, it has also been a hot topic to enhance the integrity performance of GNSSs using LEO satellites [30]. On one hand, LEO satellites can act as space monitoring stations, providing additional integrity monitoring capabilities aside from ground monitoring stations. This idea is referred to as “LEO as a space monitoring station” in this paper. Compared to ground monitoring stations, the global distribution of LEO constellations enables the monitoring of global navigation satellites, which is particularly advantageous for the BDS. One the other hand, LEO satellites can also act as navigation satellites that transmit navigation signals, increasing the number of visible satellites for users. This idea is called “LEO as a navigation satellite” within this work. In-orbit experiments have demonstrated that LEO satellites can not only receive GNSS signals but also transmit navigation signals [31]. On this basis, there have been various studies focusing on improving GNSS navigation accuracy and the convergence speed of precise point positioning with LEO satellites [32,33].

Currently, there is little research explaining the relationship between autonomous integrity monitoring in medium- and high-orbit satellites and the integrity enhancement in LEO satellites from a systemic perspective. Additionally, there is no quantitative analysis detailing the requirements for medium-orbit, high-orbit, and LEO satellites to meet integrity demands represented by CAT-I. Therefore, this paper first reviews the current status and development trends in satellite navigation system integrity both domestically and internationally. Next, focusing on the integrity requirements represented by civil aviation CAT-I, this paper proposes a space–ground integrated integrity monitoring method that includes two types of satellites, namely LEO satellites as monitoring stations and LEO satellites as navigation satellites. The paper conducts a simulation analysis of the integrated integrity monitoring method with the reliability of LEO satellites as a variable, providing the minimum reliability requirements for navigation satellite schemes under simulation conditions. Finally, it offers development suggestions for enhancing the integrity of the next-generation BDS. This research is expected to provide theoretical support for enhancing the integrity of the next-generation satellite navigation system.

2. Current Status of GNSS Integrity Service

This section will review the current status of the integrity services of the four GNSS constellations, including BeiDou, the GPS, GLONASS, and Galileo. Both fundamental integrity services and SBAS integrity services will be considered. The fundamental integrity service of GNSSs represents the integrity information in the broadcast messages, and the SBAS integrity service denotes the integrity information provided by the SBAS messages.

2.1. Current Status of BDS-3 Integrity Services

The BDS-3 constellation provides fundamental integrity services with all the operational satellites, including GEO, IGSO, and MEO satellites. In addition, it offers SBAS integrity services with the GEO satellites within the BDSBAS. The fundamental integrity service of the BDS-3 is able to meet the ICAO certification requirements for non-precision approaches (NPAs). Furthermore, the BDSBAS can meet the ICAO certification requirements for APV-I. Currently, China is working actively on passing these certifications [22]. Figure 1 illustrates how the BDS-3 provides the fundamental integrity services and the SBAS integrity services.

2.1.1. Fundamental Integrity Services of BDS-3

The BDS-3 provides the fundamental integrity service in the broadcast messages by employing ground monitoring networks and SAIM. The integrity parameters include SISA, SISMA, SIF, AIF, and DIF [34], as shown in

Table 2. Fundamental integrity parameters of BDS-3.

Parameters	Description
SISMA	The signal-in-space (SIS) monitoring accuracy, which describes the errors in satellite orbits and satellite clock offsets.
SISA	The SIS accuracy, which describes the predictive accuracy of the orbital parameters and clock correction parameters in the broadcast message.
SIF	The signal integrity flag, which represents whether the signal is healthy.
AIF	The accuracy integrity flag, which represents whether the SISMA value is valid.
DIF	The data integrity flag, which represents whether the error of the broadcasted message parameters exceeds the predicted accuracy.

. For the BDS-3, the network of ground monitoring stations are mainly distributed in China. They track BeiDou satellites and send raw observations to the fundamental navigation data processing center, where the fundamental integrity parameters will be generated. The fundamental integrity parameters are included in the broadcast messages, which will be uploaded to the satellites with the ground uplink station.

In addition to the ground monitoring stations, the BDS-3 also implements the SAIM technique to ensure navigation integrity. The SAIM system uses redundant receivers installed in the satellite to monitor satellite clock anomalies and signal anomalies. Because of the high reliability of the onboard receivers, which are unaffected by ionospheric, tropospheric, and multipath interference, the SAIM technique can provide highly reliable and timely integrity alerts, thereby reducing the fault probability of BDS-3 satellites.

Currently, the BDS-3 has officially been recognized as being of the required standard by the ICAO, making it a globally accepted satellite navigation system for civil aviation. The BDS-3 is committed to a satellite fault probability of less than $1\times {10}^{-5}$ (B1I/B1C/B2a) and a constellation fault probability of less than $6\times {10}^{-5}$ (B1I/B1C/B2a). In addition, previous studies have evaluated the performance of BDS-3 fundamental integrity services with globally distributed ground stations, and the results suggest that the BDS-3 can provide the navigation services for NPAs with an availability of 100%.

2.1.2. Integrity Services of BDSBAS

Figure 2 demonstrates the basic principles of the BDSBAS. As shown in this figure, the BDSBAS is implemented based on the ground regional monitoring network, including 13 type-A monitoring stations and 34 type-B monitoring stations. The monitoring stations send raw observation data to the SBAS data processing center, where the SBAS messages are generated. Then, the SBAS messages are uploaded to the GEO satellites with the ground uplink stations. The parameters in the SBAS message include correction parameters, accuracy parameters, and degradation parameters, as shown in

Table 3. Parameters in the BDSBAS message.

Parameters	Content
Correction parameters	Fast Corrections, Long-Term Satellite Error Corrections, Mixed Fast Corrections, and Ionospheric Delay Corrections
Accuracy parameters	User Differential Range Error (UDRE), Grid Ionospheric Vertical Error (GIVE), and Clock Ephemeris Covariance Matrix Message
Degradation parameters	Fast Correction Degradation Factor and Degradation Parameters

. Based on the principles above, the BDSBAS provides integrity monitoring capabilities for four GNSS constellations, including the BDS-3, GPS, Galileo, and GLONASS. Currently, China is actively working on passing the single-frequency APV-I certification of the BDSBAS from the ICAO. Previous studies have showed that the BDSBAS can provide APV-I services to China and surrounding areas with an availability of higher than 99% [35,36]. Therefore, the BDSBAS can meet the performance requirements of APV-I.

2.2. Current Status of Integrity Services of GPS, Galileo, and GLONASS

In addition to the BDS-3, other GNSS constellations, including the GPS, Galileo, and GLONASS, also provide fundamental integrity services to global users and provide SBAS integrity services to regional users. This section will briefly introduce the current status of the integrity services of the GPS, Galileo, and GLONASS.

2.2.1. Fundamental Integrity Services

The system architectures of the GPS, Galileo, and GLONASS that generate the fundamental integrity services are similar to that of the BDS-3. They all rely on a network of ground monitoring stations and the SAIM technique. By the end of 2023, the GPS, Galileo, and GLONASS can all meet the performance requirements of NPAs.

Table 4. Integrity parameters in the broadcast ephemeris of the GPS, Galileo, and GLONASS.

Constellation	Type	Accuracy Parameters	Health Indicators
GPS	LNAV	User Range Accuracy (URA) (4 bits)	Alert Flag (AF) (1 bit), SV Health (6 + 8 bits), Integrity Status Flag (ISF) (1 bit), and Anti-Spoof (A-S) Flag (1 bit)
	CNAV	URA (4 bits) and Integrity-Assured URA (IAURA)	AF (1 bit), ISF (1 bit), and Signal Health (L1/L2/L5) (3 bits)
Galileo	F/NAV	Signal-in-Space Accuracy (SISA) (8 bits)	E5a Signal Health Status (2 bits) and E5a Data Validity Status (1 bit)
	I/NAV	Not Broadcast Yet	Not Yet Broadcasted
GLONASS	CDMA	Ephemeris (5 bits) and Clock Bias (5 bits) Accuracy Factors	Signal Health and Data Validity Attributes

and

Table 5. Performance standards of GPS, Galileo, and GLONASS.

Constellation	SISRE Accuracy	Satellite Fault Rate	Constellation Fault Rate	Continuity Risk	Availability
GPS	30 m (any satellite, global average, 99.94%); 30 m (any satellite, worst position, 99.79%)	1 × 10−5/h	1 × 10−8/h	2 × 10−4/h	0.957
Galileo	10 m (any satellite, global average, 99.9%); 20 m (any satellite, worst position, 99.9%)	3 × 10−5/h	2 × 10−4/h	/	0.920
GLONASS	18 m (any satellite, global average, 99.37%); 18 m (any satellite, worst position, 99.14%)	1 × 10−4/h	1 × 10−4/h	2 × 10−3/h	0.950

compare the integrity parameters in the broadcast messages among the GPS, GLONASS, and Galileo. Additionally, they compare the integrity performance among these three constellations.

2.2.2. SBAS Integrity Services

Currently, there are multiple operational SBASs worldwide, and there are also some SBASs under construction. These SBASs include the Wide Area Augmentation System (WAAS), the European Geostationary Navigation Overlay Service (EGNOS), the Multi-functional Satellite Augmentation System (MSAS), GPS-aided Geo-augmented navigation (GAGAN), the System for Differential Corrections and Monitoring (SDCM), the Korean Augmentation Satellite System (KASS), the African Satellite-Based Augmentation System (ASECNA), and the Australia/New Zealand Satellite-Based Augmentation System (SPAN).

The architectures of these SBASs are similar to that of the BDSBAS. They rely on a regional network of ground monitoring stations to perform integrity monitoring and generate the SBAS messages. The parameters in the SBAS messages include correction parameters, accuracy parameters, and degradation parameters. The SBAS messages are transmitted by GEO satellites.

Table 6. Comparison of SBAS integrity parameters among WAAS, EGNOS, and SDCM.

System	Correction Parameters	Accuracy Parameters	Degradation Parameters
WAAS	Fast Corrections, Long-Term Corrections, Mixed Corrections, and Ionospheric Delay Corrections	UDRE, GIVE, and Clock Ephemeris Covariance Matrix Message	Fast Correction Degradation Factor
EGNOS	Fast Corrections, Long-Term Corrections, Mixed Corrections, and Ionospheric Delay Corrections	UDRE and GIVE	Fast Correction Degradation Factor and Degradation Parameters
SDCM	Fast Corrections, Long-Term Corrections, Mixed Corrections, and Ionospheric Delay Corrections	UDRE, GIVE, and Clock Ephemeris Covariance Matrix Message	Fast Correction Degradation Factor and Degradation Parameters

and

Table 7. Certification status of WAAS, ENGOS, and SDCM.

System	Satellite Type	PRN Code	Satellite Position	Certified Service Level
WAAS	Eutelsat 117 West B	131	117°W	Single-Frequency LPV-200
	SES-15	133	129°W
	Intelsat Galaxy 30	135	125°W
EGNOS	ASTRA 5B	123	31.5°E	Single-Frequency NPA
	INMARSAT 4F2	126	63.9°E
	HOTBIRD 13G	136	5°E
SDCM	Luch-5B	125	16°W	Not Certified
	Luch-5V	140	95°E
	Luch-5A	141	167°E

compare the integrity parameters in the SBAS message among the WAAS, EGNOS, and SDCM. Moreover, they show the certification status of these SBASs.

2.3. Development Trends in GNSS Integrity Services

Recently, all GNSS service providers have been working on improving the navigation integrity performance of their own GNSS constellations. Improving the performance of integrity services is one of the key objectives. This part will summarize the development trends in integrity services in different GNSS constellations and provide references for the development of the integrity services within the next-generation BeiDou constellation.

Among all GNSS constellations, the GPS has the longest service history and the best integrity performance. The promising performance of GPS integrity services comes from two facts. First, the GPS has established a network of ground monitoring stations globally, providing high-quality ground integrity monitoring capabilities. Second, over decades of development, the GPS has accumulated maintenance experience, which helps to significantly reduce the probability of satellite faults and enable rapid responses in the event of faults. To further enhance the integrity performance of the GPS, the GPS modernization plan explicitly aims to improve integrity monitoring capabilities with the SAIM technique. Also, America is actively developing LEO constellations such as PULSAR and TruePoint, considering the use of LEO constellations to enhance GPS integrity performance.

Meanwhile, the European Space Agency (ESA) has initiated the development of the second-generation Galileo constellation (G2). The aim of the second-generation Galileo constellation is to provide more robust and resilient positioning, navigation, and timing (PNT) services for global users. To enhance navigation integrity, the G2 satellites will be equipped with six sets of enhanced atomic clocks and inter-satellite links to improve the capabilities of SAIM. Additionally, the ESA has proposed the LEO-PNT initiative, which aims to establish a Kepler constellation consisting of six high-value LEO satellites. One of the goals of this initiative is to use LEO satellites to enhance the integrity of the Galileo satellites.

As for GLONASS, Russia has initiated the Federal Special Program for GLONASS from 2021 to 2030, aiming to enhance the reliability and accuracy of the GLONASS constellation. As a part of this program, Russia plans to launch multiple GLONASS-K2 satellites before 2030 to improve the reliability of the GLONASS constellation. In addition, Russia intends to launch six GLONASS-V satellites operating in high elliptical orbit (HEO) to enhance navigation accuracy and reliability in Russia and its surrounding areas. As a backup solution for GLONASS-V, Russia is also considering using LEO satellites to enhance the performance of the GLONASS constellation.

Based on the information above, the development trends in GNSS integrity services are summarized as follows: firstly, the SAIM technique is an important approach to improve navigation integrity, which has been considered by the BDS-3, GPS, and Galileo. Secondly, it has become a hot topic to augment GNSS integrity with LEO satellites. LEO satellites enhance integrity from the service domain perspective. On one hand, they achieve multiple redundancy monitoring of medium- and high-orbit satellites, which reduces the false alarm and missed detection rates in integrity monitoring. On the other hand, by broadcasting navigation enhancement signals, LEO satellites increase the number of satellites visible to users and improve the geometric configuration. This enhancement improves users’ positioning accuracy and reduces the required level of protection for integrity. In the upcoming 5 to 10 years, GNSS service providers will focus on the development of next-generation GNSS constellations and the development of LEO constellations. Therefore, the future development of the BeiDou system may need to consider both advanced SAIM techniques and LEO-based integrity augmentation so as to effectively improve BeiDou’s integrity performance.

3. Integrity Monitoring Method of Space–Ground Integration

One of the objectives of the next-generation BeiDou system would be providing global high-integrity navigation services for civil aviation (e.g., supporting CAT-I operations) and other emerging applications such as automotive and urban air mobility. To achieve this goal, this section proposes an integrity monitoring method of space–ground integration.

3.1. Architecture of Integrity Monitoring Method

The overall framework of the integrated space–ground integrity monitoring method proposed in this paper is shown in Figure 3. It includes four components, namely medium- and high-orbit advanced SAIM (A-SAIM), LEO integrity enhancement, ground monitoring, and RAIM. Among them, the medium- and high-orbit A-SAIM serves as the core component, supported by ground monitoring. This system is enhanced by multi-source fusion for improving low-orbit integrity, with RAIM implemented as an additional method.

Building on the integrity framework of the BDS-3, the integrated space–ground integrity monitoring method proposed in this paper includes four aspects. The first one is upgrading the integrity monitoring of the medium- and high-orbit constellation from autonomous integrity to A-SAIM. This upgrade not only enhances monitoring accuracy but also introduces new capabilities for monitoring ephemeris correctness and clock drift variations, utilizing intelligent prediction methods to proactively address potential faults. The second one is the new LEO integrity enhancement, leveraging the global multi-coverage characteristics of LEO satellites to achieve multiple redundancy monitoring of medium- and high-orbit satellites, effectively reducing the duration of faults in these satellites. For highly reliable low-orbit satellites, broadcasting navigation enhancement signals to users can increase the number of visible satellites and improve geometric configuration, thereby enhancing user positioning accuracy and lowering the integrity protection level. The third one is ground-based intelligent operation and maintenance, which will receive navigation signals from medium, high, and low orbits, providing auxiliary verification of integrity monitoring data and implementing anomaly correction and control when deviations occur in medium- and high-orbit autonomous integrity and LEO integrity enhancement. The last one is that user receivers will employ RAIM or A-RAIM algorithms, integrating integrity alert information from high, medium, and low orbits to deliver high-integrity services to users.

In the integrated space–ground integrity monitoring method, LEO satellites play a crucial role as an important enhancement. First, LEO satellites, which function as space-based monitoring stations, can work in conjunction with ground monitoring stations to perform the integrity monitoring of medium- and high-orbit satellites. This will allow for quicker integrity assessments and a reduction in the mean time to failure of medium- and high-orbit GNSS satellites, thereby reducing the fault probability of GNSS satellites. Furthermore, a lower fault probability of GNSS satellites will result in a decrease in the protection levels. Second, LEO satellites can also serve as navigation satellites, broadcasting navigation signals to users. This increases the number of visible satellites for users, improving positioning accuracy and subsequently lowering the user protection level. Third, the high data transmission rates of LEO satellites can be utilized to broadcast space-based integrity enhancement information, providing globally covered space-based augmentation services.

Based on the capabilities of LEO satellites, the integrated space–ground integrity monitoring method proposed in this paper can be divided into two technical approaches. The first involves LEO satellites acting as space-based monitoring stations to perform the integrity monitoring of medium- and high-orbit satellites. The second involves LEO satellites acting as navigation satellites, directly sending navigation signals to users and participating in user positioning. The second technical approach places higher reliability requirements on the LEO satellites themselves, necessitating low failure probabilities for both individual LEO satellites and the overall LEO constellation. Both methods can achieve integrity enhancement for medium- and high-orbit GNSSs, but they have different reliability requirements and capabilities for the LEO satellites, so the planning of the solution should be based on specific needs. The following sections will provide a detailed introduction to these two methods and conduct simulation analyses.

3.2. LEO Satellites as Space Monitoring Stations

LEO satellites acting as space-based monitoring stations transmit integrity observation data to the medium- and high-orbit satellite navigation system, which then makes comprehensive integrity assessments. This technical route relies on the medium- and high-orbit navigation system to make integrity decisions and disseminate integrity information without adversely affecting the integrity risk of the medium- and high-orbit navigation satellites themselves. Compared to the technical route, where LEO satellites serve as navigation satellites, this approach has lower reliability requirements for the LEO satellites. The alarm process for space-based monitoring station-type integrated integrity enhancement is as follows:

(1) 

BeiDou Single-Satellite Autonomous Integrity Monitoring

This module uses three redundant onboard integrity monitoring receivers to fulfill integrity monitoring against all-channel signal anomalies, clock anomalies, and ephemeris anomalies, as shown in Figure 4. This aims to provide comprehensive monitoring of a single satellite’s operational status. The following describes the monitoring methods:

First, signal monitoring aims to achieve real-time monitoring for all-channel signal power, pseudorange, carrier phase, and signal quality. The satellite’s autonomous integrity receiver tracks navigation signals from the power amplifier, obtaining information such as signal power, pseudorange, carrier phase, and signal quality. It then compares these data against preset thresholds, which are derived from historical data gathered during prior stable operations. If these measurements exceed the thresholds, signal anomalies are considered to have occurred. Then, the satellite will inform the users with a broadcast message or non-standard codes (NSCs). In addition, an intelligent prediction of signal anomalies will also be considered by monitoring the change rate of all-channel signal power, pseudorange, carrier phase, and clock offset. If there is an abnormal change rate detected, then the satellite will inform the ground integrity processing center to verify whether there is a risk of signal anomalies in the following hours.

Second, single-satellite clock monitoring aims to fulfill real-time integrity monitoring against abnormal clock jumps. The satellite checks the phase jump of the satellite clock (current value minus the value at the previous moment) and compares it against preset thresholds. If there is an abnormal clock jump detected (i.e., exceeding the predefined threshold), then the satellite will inform the users with the broadcast message or the non-standard codes.

Third, single-satellite ephemeris monitoring aims to detect the anomalies in the ephemeris. The satellite’s autonomous integrity receiver tracks navigation signals and obtains ephemeris information. Then, this is achieved by a three-step procedure. The first step is to validate the correctness of the ephemeris modulation process, i.e., check the consistency between the ephemeris that is uploaded from the ground and the ephemeris that is broadcast to users. The second step is to check the consistency among the B-CNAV1, B-CNAV2, D1, and D2 ephemeris. This benefits from the fact that the ephemeris for B1C/B2a (i.e., B-CNAV1 and B-CNAV2) and the ephemeris for B1I/B3I (i.e., D1 and D2) are generated independently. Finally, the third step is to verify the consistency between the previous ephemeris (i.e., the message that is valid in the last hour) and the current one. If there is any inconsistency detected in the three steps above, then the satellite will determine whether the ephemeris is faulted by jointly considering the single-satellite monitoring result, the inter-satellite consistency check result, and the ground verification result.

(2) 

Inter-satellite consistency check

Compared to traditional SAIM techniques, one of the most important features of A-SAIM lies in the fact that A-SAIM will use inter-satellite links to realize the inter-satellite consistency check. This will greatly benefit the integrity monitoring capability for the ephemeris anomalies (specifically, orbit faults in the ephemeris) and the clock anomalies. First, this module detects the anomalies in the orbit parameters of the ephemeris by comparing the satellite-to-satellite distance measured by inter-satellite links and the distance derived from the ephemeris of these two satellites.

Second, small faults in the onboard clock can be detected by comparing the local time and the joint atomic time. The local time is provided by the onboard atomic clock, and the joint atomic time is obtained by integrating the onboard atomic clock information from all the satellites and the information from the inter-satellite links. The joint atomic time is more stable than the local time and thus, it can be used as a reference to detect the small faults in the onboard clock of each satellite. If there is any anomaly detected in the two steps above, then the satellite will inform the users with the broadcast message or the non-standard codes.

(3) 

LEO Integrity Enhancement

LEO satellites perform space-based monitoring of medium- and high-orbit navigation signals using onboard GNSS receivers. LEO satellites transmit integrity information to the medium- and high-orbit GNSS.

(4) 

Integration of Integrity Monitoring for Medium, High, and Low Orbits

The medium- and high-orbit GNSS receives integrity information and integrates it with the results of autonomous integrity monitoring to derive conclusions on integrity monitoring. This information is then broadcast to users via medium- and high-orbit GNSS satellites.

(5) 

Ground verification

Despite the development of A-SAIM, ground monitoring stations still play an important role in ensuring the integrity of the BeiDou satellites. Ground monitoring stations receive the signals from the BeiDou satellites and the raw observation data are sent to the ground integrity processing center. The ground integrity processing center will determine whether there is possibly a fault in the satellites based on these observation data and the known coordinates of the stations.

In the procedure above, the second step can be implemented in two different ways. As shown in Figure 5, the first approach is to establish communication between LEO satellites and BeiDou satellites with the BeiDou short-message communication capability. Figure 6 demonstrates the second approach. First, LEO satellites send the raw observations to the ground integrity processing center; second, the ground integrity processing center generates integrity monitoring results for the MEO/IGSO/GEO satellites based on (a) the observations from space monitoring stations and ground monitoring stations and (b) the data from inter-satellite links; finally, the integrity monitoring results are uploaded to MEO/IGSO/GEO satellites with ground uplink stations.

3.3. LEO Satellites as Navigation Satellites

LEO satellites can act as navigation satellites that transmit navigation signals to users in a similar way to GNSS satellites. This will increase the number of visible satellites for users, thereby improving positioning accuracy and reducing the protection levels. Additionally, at the user end, the signal power of LEO satellites will be higher than that of MEO/IGSO/GEO satellites, which provides advantages in multipath resistance and interference mitigation. Moreover, LEO satellites offer high data transmission rates, allowing them to timely broadcast integrity information of LEO satellites and GNSS satellites within their navigation messages. The principle of this scheme is illustrated in Figure 7 and described as follows:

First, LEO satellites receive GNSS signals based on their onboard GNSS receivers. Second, LEO satellites determine their own orbits and clock offsets based on GNSS observations and the data from inter-satellite links. Optionally, together with the second step, LEO satellites can fulfill integrity monitoring for GNSS satellites based on a consistency check. Third, LEO satellites transmit navigation signals and broadcast ephemeris (including the integrity information for LEO and GNSS satellites) to users. Finally, the user receiver realizes positioning, navigation, and timing based on LEO signals and GNSS signals. The user receiver can also realize receiver autonomous integrity monitoring (RAIM) to detect faulted satellites and compute the protection levels.

3.4. Simulation Results and Sensitivity Analysis

Multiple sets of simulations were carried out to demonstrate and compare the performance of the proposed L-SBAS schemes, i.e., LEO satellites acting as space monitoring stations and LEO satellites acting as navigation satellites. The configuration of the LEO constellation is given first. Based on this configuration, the integrity performance of the two schemes is evaluated by considering global users. Finally, sensitivity analyses are conducted to reveal the impact of LEO satellite/constellation fault probabilities on the user-end integrity performance.

3.4.1. LEO Constellation Simulation

The simulation parameters for the LEO constellation are shown in

Table 8. LEO constellation configuration.

Inclined Orbit				Polar Near-Orbit				Total Number of Satellites
Inclination	Altitude	Number of Orbital Planes	Number of Satellites per Plane	Inclination	Altitude	Number of Orbital Planes	Number of Satellites per Plane
50°	1150 km	8	12	86.5°	1175 km	6	10	156

. This LEO configuration is given by referencing the LEO constellations that are under development, such as Centispace, China’s National Satellite Internet System, and the American XONA System [31,37,38]. Figure 8 demonstrates the number of visible BDS-3 satellites (99.74% quantile) for ground users, and Figure 9 shows the number of visible satellites considering both the BDS-3 and LEO. Similarly, Figure 10 and Figure 11 compare the position dilution of precision (PDOP) without and with the LEO constellation.

Table 9. LEO coverage for GNSS satellite.

Number of Satellites That Track the Same GNSS Satellite from the Constellation Below	Minimum	Average	Maximum
BDS-3	15	18.2	21
GPS	13	16.5	18

shows the number of LEO satellites that track the same GNSS satellite simultaneously. These results suggest that the LEO constellation in Table 8 can provide sufficient coverage for both ground users and GNSS satellites.

3.4.2. Simulation of GNSS Integrity Service Performance Under LEO Constellation Enhancement

Based on the LEO constellation configuration above, simulations are carried out to evaluate the integrity performance with LEO augmentation.

Table 10. GNSS constellation parameter settings for simulations.

Constellations	BDS-3	GPS
User Range Accuracy (URA)	2 m	1 m
User Range Error (URE)	URE = 2/3 × URA
Satellite Fault Rate (Rsat)	1 × 10−5/h	1 × 10−5/h
Average Duration of Satellite Fault (MTTNsat)	1 h	1 h
Satellite Fault Probability (Psat)	1 × 10−5	1 × 10−5
Constellation Fault Rate (Rconst)	6 × 10−5/h	1 × 10−9/h
Average Duration of Constellation Fault (MTTNconst)	1 h	10 h
Constellation Fault Probability	6 × 10−5	1 × 10−8

Note: P_sat = R_sat × MTTN_sat, P_const = R_const × MTTN_const.

presents the preliminary parameter settings for the GNSS constellations. This paper analyzes the GNSS integrity service performance using the CAT-I navigation performance requirements as an example. The navigation performance requirements for CAT-I are shown in Table 1.

Before comparing the integrity performance of the two schemes “LEO as a space monitoring station” and “LEO as a navigation satellite”, the parameter settings for these two schemes are given first. If LEO satellites act as space monitoring stations, employing LEO satellites can help detect BeiDou satellite and constellation faults more quickly, thereby reducing the average duration of BeiDou satellite and constellation faults. This benefits from the fact that LEO satellites provide additional observations for BeiDou satellites and offer fast communication capability between LEO satellites and BeiDou satellites. This paper preliminarily assumes that employing LEO satellites can reduce the duration of BeiDou satellite and constellation faults by half, resulting in an average fault duration of 30 min. Therefore, the BeiDou satellite fault probability is set to $5\times {10}^{-6}$ and the BeiDou constellation fault probability is set to $3\times {10}^{-5}$ in this case. It is worth mentioning that in this case, users only utilize GNSS satellites for navigation and thus, the number of visible satellites is not affected by the introduction of LEO satellites.

If LEO satellites act as navigation satellites, it is necessary to consider the parameters such as the URA, URE, satellite fault probability, and constellation fault probability for the LEO constellation.

Table 11. Simulation parameters for LEO satellites in the case where LEO satellites act as navigation satellites.

User Range Accuracy, URA	0.3 m
User Range Error, URE	URE = 2/3 × URA
Satellite Fault Probability (Psat, LEO) and Constellation Fault Probability (Pconst, LEO)	Case 1	Psat, LEO = 1 × 10−5, Pconst, LEO = 1 × 10−5
	Case 2	Psat, LEO = 1 × 10−4, Pconst, LEO = 1 × 10−4
	Case 3	Psat, LEO = 1 × 10−4, Pconst, LEO = 1 × 10−3
	Case 4	Psat, LEO = 1 × 10−3, Pconst, LEO = 1 × 10−3
	Case 5	Psat, LEO = 1 × 10−3, Pconst, LEO = 1 × 10−2

presents the preliminary settings for these parameters. In this table, the URA for LEO satellites is set to 0.3 m [39]. Additionally, this paper considers multiple sets of parameters settings on LEO satellite fault probability and LEO constellation fault probability to provide a sensitivity analysis.

To quantitatively display the integrity performance, this paper will provide protection level world maps and global coverage results under the CAT-I navigation performance requirements. The algorithms and simulation steps are as follows: first, a user grid is divided on the Earth’s surface into 5-degree by 5-degree cells, with each grid point representing one user. For each user, the horizontal and vertical protection level (HPL and VPL) are calculated over a continuous period of 10 days, with a time step of 600 s, resulting in 1440 HPL and VPL values for each user. Based on this time series, the HPL and VPL at 99.5% availability are calculated for each user, denoted as HPL (0.995) and VPL (0.995), respectively. Finally, protection level world maps are generated and the global coverage results under CAT-I are computed. The pseudocode for this simulation process is shown in Figure 12.

In this paper, the protection levels are calculated based on the advanced receiver autonomous integrity monitoring (ARAIM) [7]. It is worth mentioning that this work only considers the integrity performance of pseudorange-based positioning systems, in particular, single-point positioning. Most of the previous studies on BDS-3 integrity performance evaluation were also concentrated on single-point positioning for aviation applications and thus, the simulation analyses below can preliminarily demonstrate the integrity performance difference between the BDS-3 and the next-generation BDS (initial design). Given that carrier-phase positioning integrity will be of great significance for novel applications such as in the automotive industry, this topic will be investigated in our future work.

The fundamental principles of ARAIM are briefly described as follows [40,41,42]: First, the fault modes that need to be monitored are determined. Each fault mode assumes that a specific subset of the satellites is faulted. For example, H₀ assumes all satellites are healthy, H₁ assumes GPS satellite 1 is faulted, H₁₀ assumes the GPS constellation is faulted, and H₂₁ assumes the GPS constellation and BeiDou satellite 1 are both faulted. The prior probability of each fault mode is determined based on the satellite fault probabilities and the constellation fault probabilities. Since the probabilities of most fault modes are extremely low, only a subset of fault modes needs to be monitored, which are numbered from 1 to N.

For each monitored fault mode, the corresponding navigation solution is calculated based on the healthy satellites under that fault mode. Then, fault detection is performed based on solution separation, as shown below. Let the subscript $q=1, 2, 3$ represent the east, north, and up directions, respectively. If the following equation holds true for any $1\le k\le N$ and $1\le q\le 3$, it is considered that the navigation system is fault-free; otherwise, it is deemed that the navigation system is faulted:

$$|{\stackrel{⌢}{x}}_q^{(k)}-{\stackrel{⌢}{x}}_q^0|<T_q^{(k)}$$

(1)

where ${\widehat{x}}_q^{\left(k\right)}$ represents the navigation solution corresponding to the k-th fault mode, ${\widehat{x}}_q^{\left(0\right)}$ represents the navigation solution calculated using all the visible satellites, and $T_q^{\left(k\right)}$ represents the test threshold. The calculation of the test threshold is given by

$$T_q^{\left(k\right)}=Q^{-1}\left({\displaystyle \frac{P_{FA,q}}{2\cdot N}}\right)\cdot {\sigma }_{ss,q}^{\left(k\right)}$$

(2)

In this equation, $Q^{-1}\left(p\right)$ represents the $(1-p)$ quantile of a standard Gaussian distribution with zero mean, $P_{FA,q}$ denotes the false alert probability allocated to the q-th direction, and ${\sigma }_{ss,q}^{\left(k\right)}$ represents the standard deviation of the test statistic ${(\widehat{x}}_q^{\left(k\right)}-{\widehat{x}}_q^{\left(0\right)})$.

Finally, the protection level is computed as follows (using VPL as an example):

$$2Q\left({\displaystyle \frac{VPL}{{\sigma }_3^{\left(0\right)}}}\right)+{\displaystyle \sum }_{k=1}^{N}Q\left({\displaystyle \frac{VPL-T_3^{\left(k\right)}}{{\sigma }_3^{\left(k\right)}}}\right)\cdot P\left(H_k\right)=PHM{I}_{VERT}\left(1-{\displaystyle \frac{P_{NM}}{PHMI}}\right)$$

(3)

where $Q\left(u\right)$ represents the tail probability of a standard Gaussian distribution with zero mean; ${\sigma }_3^{\left(k\right)}$ denotes the error standard deviation of ${\widehat{x}}_3^{\left(k\right)}$ (for 0 ≤ k ≤ N), which is related to the geometry matrix G and the URA values of each satellite; $T_3^{\left(k\right)}$ represents the test threshold, which is related to the geometry matrix G, the URE values of each satellite, and the false alert probability; $P\left(H_k\right)$ indicates the prior probability of fault mode k, which is related to constellation fault probabilities and satellite fault probabilities; $P_{NM}$ is the sum of the prior probabilities of unmonitored fault modes; $PHMI$ represents the target integrity risk; and ${PHMI}_{VERT}$ denotes the target integrity risk allocated to the vertical position, derived from navigation performance requirements.

Based on the parameter settings and algorithms above, Figure 13 presents the protection level world map while considering the BDS-3 and GPS. The figure caption provides the global coverage value under CAT-I and the average protection levels. The results indicate that when only considering the BDS-3 and GPS, the CAT-I global coverage rate is only approximately 67%. Figure 14 gives the protection level world map while considering LEO satellites as space monitoring stations. Comparing Figure 13 and Figure 14 reveals that employing LEO satellites as space monitoring stations can lead to a significant reduction in both the VPL and HPL, while the global coverage rate for CAT-I increases from 67% to 78%. This benefits from the fact that if LEO satellites act as space monitoring stations, employing LEO satellites can reduce the average duration of BeiDou satellite and constellation faults.

Figure 15 presents the protection level world map while considering LEO satellites as navigation satellites, and the parameter settings for LEO satellites are given by Simulation Case 1 in Table 11. In this scenario, both the LEO satellite fault probability and the LEO constellation fault probability are set to 10⁻⁵, representing the most ideal conditions. In reality, LEO satellites have significantly lower development costs, ground testing requirements, on-orbit validation processes, and production costs than GNSS satellites; thus, the fault probability of LEO satellites tends to be higher than that of GNSS satellites. Comparing Figure 13, Figure 14 and Figure 15 indicates that in this scenario, employing LEO satellites as navigation satellites provides more integrity performance improvement than employing them as space monitoring stations. Specifically, employing LEO satellites as navigation satellites leads to a CAT-I global coverage rate of 99%, i.e., reaching near-complete global coverage for CAT-I operations.

Figure 15, Figure 16, Figure 17 and Figure 18 illustrate the protection level world maps under different LEO satellite fault probabilities and LEO constellation fault probabilities. The results in these figures indicate that as the fault probabilities of LEO satellites and constellations increase, both the VPL and HPL significantly rise, leading to a marked decrease in the CAT-I global coverage rate. As shown in Figure 18, when the fault probabilities of LEO satellites and constellations are relatively high, it would be better to employ LEO satellites as space monitoring stations than using them as navigation satellites.

Finally, Figure 19, Figure 20 and Figure 21 compare the global average VPL, global average HPL, and CAT-I global coverage rate across different scenarios. The results indicate that when the fault probabilities of LEO satellites and constellations are both below 10⁻⁴, employing LEO satellites as navigation satellites provides more integrity performance improvement than using them as space monitoring stations. However, as the fault probabilities of LEO satellites and constellations further increase, employing LEO satellites as space monitoring stations produces better integrity performance.

3.4.3. Discussion

This paper provides an initial proposal for the development of the next-generation BeiDou integrity monitoring system. In this proposal, BeiDou integrity performance can be improved with advanced SAIM (A-SAIM) and an SBAS with LEO (L-SBAS). The proposed A-SAIM technique is an upgraded evolution of traditional SAIM approaches. It extends from single-satellite autonomous integrity monitoring to multi-satellite joint integrity monitoring. It provides comprehensive integrity monitoring capabilities against signal anomalies, large and small clock anomalies, and ephemeris anomalies. Additionally, the proposed A-SAIM technique is designed to include intelligent prediction capabilities against the anomalies above.

In addition to A-SAIM, GNSS integrity performance can be significantly benefited from LEO constellations. For one thing, LEO satellites can serve as space monitoring stations so as to enhance the integrity monitoring capability for GNSS satellite faults and constellation faults. Compared to ground monitoring stations, LEO satellites have global coverage and have longer tracking arcs for GNSS satellites. In another application, LEO satellites can act as navigation satellites that transmit navigation signals to users. This will increase the number of visible satellites at the user end, thereby having the potential to reduce protection levels. However, the performance of this approach is heavily influenced by the LEO satellite fault probability and the LEO constellation fault probability.

To maximize the benefits from LEO constellations for enhancing BeiDou integrity performance, it is crucial to improve the reliability of LEO satellites under cost and resource constraints. In terms of hardware design, components and materials with radiation resistance should be selected, and critical parts should utilize triple-mode designs to improve single-event upset resilience. In manufacturing and testing validation, it is important to strengthen process and quality control during production to conduct various environmental tests to eliminate early failures and to validate performance under on-orbit working conditions. Regarding operation and maintenance, it is essential to develop an autonomous health management system through simulated telemetry and digital telemetry to monitor satellite conditions on orbit, promptly addressing anomalies to shorten fault duration and avoid permanent failure.

Finally, it is worth mentioning that the A-SAIM technique is necessary for the next-generation BeiDou system, even if the LEO constellation can provide integrity monitoring capabilities against satellite faults. The reasons are three-fold. First, the reliability of LEO satellites may not be sufficient because of low-cost hardware and limited resources. Second, A-SAIM can fulfill integrity monitoring for signal anomalies and clock anomalies more accurately and more quickly based on the onboard hardware. In contrast, this task is challenging for both LEO-based space monitoring stations and ground monitoring stations. Third, the altitude of LEO satellites is low, making it difficult to provide integrity services to high-orbit users (e.g., spacecraft).

4. Conclusions

Toward enhancing BeiDou integrity performance, this paper revisits the current status of the “big 4” GNSS constellations and provides an initial proposal for the development plans of the next-generation BeiDou integrity subsystem. The third-generation BeiDou Navigation Satellite System (BDS-3) utilizes both ground-based integrity monitoring and satellite autonomous integrity monitoring (SAIM) to address the issues caused by the limited coverage of ground monitoring stations. The BDS-3 fundamental integrity services and satellite-based augmentation system (SBAS) integrity services can meet the navigation performance requirements for the majority of aircraft operations, such as en-route and non-precision approaches (NPAs). However, the current-state BDS-3 integrity services cannot meet the stringent navigation performance requirements from the Category I precision approach (CAT-I) and the requirements from emerging applications such as automotive and urban air mobility.

Therefore, this paper provides a preliminary proposal for the development plans of the next-generation BeiDou integrity subsystem by considering both advanced SAIM (A-SAIM) techniques and an SBAS with LEO satellites (L-SBAS). The A-SAIM technique will focus on efficient integrity monitoring against signal anomalies, clock anomalies, and ephemeris anomalies by utilizing both onboard hardware and inter-satellite links. The L-SBAS technique will employ the LEO satellites to augment GNSS integrity performance. Two different approaches to use LEO satellites are considered, i.e., LEO satellites acting as space monitoring stations and LEO satellites serving as navigation satellites. Simulation results suggest that if the LEO satellite and constellation fault probabilities are sufficiently low (e.g., 10⁻⁵), then employing LEO satellites as navigation satellites will provide more integrity performance improvement than using them as space monitoring stations. The results also indicate that the global coverage of CAT-I can be potentially improved from 67% to 99% after taking LEO satellites into account. The conclusion will be the opposite if the LEO constellation has high satellite and constellation fault probabilities. This paper is beneficial for realizing global and high-quality integrity services with the next-generation BeiDou system. Our future work will focus on experimental tests and will take carrier-phase positioning integrity into account.