Definition of integrity monitoring
Different from a SBAS used in civil aviation, integrity monitoring for WAPPS has its own particularity. The research of integrity monitoring in this work is mainly based on the following definitions:

The integrity monitoring for WAPPS mainly focuses on the correction of the services; there is no monitoring on the satellite without corrections.

WAPPS provides highprecision services by correcting the pseudo range and carrier phase measurements; hence, it is necessary to monitor the performance of corrections on both the pseudo range and carrier phase simultaneously. Based on the performance of our research operating system, the initial requirement of the miss alert rate is 10^{−3}, the false alert rate is 10^{−5}, and the timetoalert is 10 s. Moreover, with clarity of needs, these parameters may be changed in a future study.

WAPPS mainly uses a dualfrequency ionospherefree (DFIF) measurement to provide services; thus, the ionosphere anomaly is not considered here.

The user segment anomalies, such as carrier phase cycle slip, need to be guaranteed by the receiver and have not been considered in WAPPS integrity monitoring.
Based on the definition above, the correction threat factors in WAPPS are shown below, which can be summarized into two types of integrity fault modes: a step fault and a slow drift fault.

An orbit correction fault. In the precise orbit determination and prediction, there may be a step error caused by unsmooth results between the orbit solutions and a slow drift error caused by anomalous extrapolation. Satellite maneuvering will lead to the step error, which need to be monitored if there is no alert in the GNSS service.

A clock correction fault. Satellite clock’s faults such as rapid jumping and aging drift may occur. The time series filter of the clock correction estimation cannot reflect the realtime clock error effectively, resulting in step or slow drift faults.

Bit errors in broadcasting. The high rate of data transmission and low power of signal may lead to bit error of corrections, which can result in step fault.
There are many threat factors in WAPPS, which might cause abnormal deviation on the user’s observation measurements and affect positioning integrity eventually. Therefore, the WAPPS integrity monitoring will focus on the corrected measurement residuals, such as pseudo range and carrier phase. The realization process includes data analysis and modeling, parameter and process design, calculation, and verification.
Statistics on corrected residuals
To realize integrity monitoring, 1 s sampling corrected residuals of the DFIF pseudo range and carrier phase are analyzed to complete the integrity risk modeling. The tropospheric error is mitigated by the model. due to ground stations are not currently equipped with atomic clocks, the receiver clock error is calculated by using broadcast ephemeris and smoothed in real time. To avoid an abnormity in the calculation of the receiver clock, the fault detection is accomplished by using the precise coordinates of stations. In the future, it is necessary to equip stations with atomic clocks to achieve a more reliable monitoring and to reduce the integrity risk rate.
Data of 10 stations in the period from September 16, 2018 to September 22, 2018 are used, and quantile–quantile plots of all satellites between the normalized WAPPS corrected residual distribution and the standard Gauss distribution are shown in Figs. 3 and 4, represented in blue.
With the statistics on corrected residuals, the following conclusions can be drawn.

The distributions of both the corrected pseudo range and the carrier phase residuals are consistent with the Gaussian distribution in the central area. However, in the tail distribution, in which integrity monitoring is concerned, the quantile of residual distribution is smaller than the quantile of the Gaussian distribution. This indicates that the standard Gaussian distribution can be used to complete the over bound of the tail of the residual, so as to reduce the probability of integrity miss alert risk.

The normalized corrected pseudo range residual’s mean is zero and the standard deviation is 0.6–0.9 m, which can be bounded by a Gauss well.

The normalized corrected carrier phase residual’s standard deviation is 0.5–0.8 m and can also be bounded by Gauss. In addition, due to the inaccuracy of the ambiguity fixing, there are also a few anomalies in the tail.

The pseudo range residual distributions of a few satellites are different from those of most others because of the differences in performance of the satellite and station, measurement noise, model’s corrected accuracy, and performance of the station clock, identical, whereas the distributions of phase residual are almost the same. The assumption of an independent and identical distribution will be used in the monitoring, and a relevant test will be used to verify the performance.
Design of integrity monitoring
In the WAPPS integrity monitoring, an ideal zero mean Gaussian distribution is used to bound the residuals’ nonzero mean Gaussian distribution. It ensures that the miss alert probability is less than the integrity risk (Wang and Li 2013). The algorithm uses the user differential range error of pseudo range (UDRE_PR) and differential range error of carrier phase (UDRE_PH) as system integrity monitoring parameters, which represent the differential errors of the pseudo range and carrier phase, respectively.
Limited by the WAPPS design, the correction covariance cannot be obtained so that it is impossible to calculate the UDREs by amplifying the variances directly. In this algorithm, the realtime residual statistics is measured for the UDREs computation, by using data from the monitoring stations. In addition, the alert judgment is carried out by the threshold comparison and Chisquare test. The process flow is shown in Fig. 5 and some key points are described below.
For each satellite, the residuals of all visible stations are used for realtime statistics so that UDRE_PR and UDRE_PH can be calculated by onedimensional distribution parameters (Wang et al. 2015) according to Eq. (2), where \(\mu\) and \(\sigma\) are the mean and standard deviation and K is the Gaussian quantile corresponding to the miss alert rate.
$$\begin{aligned} & UDRE\_PR = (\left {\mu_{PR} } \right + K_{PR} \cdot \sigma_{PR} )/K_{PR} \\ & UDRE\_PH = (\left {\mu_{PH} } \right + K_{PH} \cdot \sigma_{PH} )/K_{PH} \\ \end{aligned}$$
(2)

UDRE_PR and UDRE_PH of each satellite calculated in the precedent epoch are used as thresholds in the current epoch. An alert flag will be set on the satellite whose residual exceeds the threshold. Then, all flags are used to vote and determine the correction’s integrity status, including “Alert,” “No Alert,” and “Not Monitor.”

The influence of ambiguity could be eliminated in the calculation of the carrier phase residual. The precise coordinate of stations and continuous observation are used to achieve time smoothing, which can reduce the influence of ambiguity and station clock error. When the residuals error is less than a certain threshold, the ambiguity is considered to be fixed. As shown in Eq. (3), \(ph\_resi\) is the carrier phase residual, \(amb\) is ambiguity, and \(T\) is smooth length. This method can fix the ambiguity of all visible satellites individually, but the precision is limited by the influences of the measurement noise, the station clock error, and the DFIF’s wavelength, which may affect the minimal detectable bias (MDB). Furthermore, \(AMB\_Thread\) is set as a prior fixed value and the miss and false alert rate are not taken into consideration, which will be improved in the future.
$$\begin{aligned} & amb(t) = {{ph\_resi(t)} \mathord{\left/ {\vphantom {{ph\_resi(t)} T}} \right. \kern0pt} T} + {{amb(t  1) \cdot (T  1)} \mathord{\left/ {\vphantom {{amb(t  1) \cdot (T  1)} T}} \right. \kern0pt} T} \\ & amb(t)  amb(t  1) < AMB\_Thread \\ \end{aligned}$$
(3)

Using an independent and identical distribution of the satellites’ residuals of each station, the algorithm uses a Chisquare test referring to the advanced receiver autonomous integrity monitoring (ARAIM) (EUU.S. Cooperation on Satellite Navigation Working Group C, ARAIM Technical Subgroup 2012). As shown in Eq. (4), \(y\) is the residual vector, \(W\) is the weighting matrix, \(G\) is the observation matrix, \(N_{sat}\) is the number of visible satellites, \(N_{sys}\) is the GNSS being used, \(P_{FA}\) is the false alert rate, \(TH\) is the threshold, and \(\chi_{N}^{2} ( \cdot )^{  1}\) is the inverse function of the Chisquare distribution function with \(N\) degrees of freedom. \(W\) relates to the correction’s accuracy and measurement noise, which can be obtained by a regular evaluation. Note that \(y\) includes both the pseudo range and carrier phase residuals computed by a known station position and clock error, instead of the carrier phase smoothed pseudo range residuals, which is computed in positioning in ARAIM, and the freedom degree of Chi Square is set as \(N_{sat}\).
$$\begin{aligned} & \chi^{2} = y^{T} (W  WG(G^{T} WG)^{  1} G^{T} W)y \\ & TH = \chi_{{N_{sat} }}^{2} (1  P_{FA} )^{  1} \\ \end{aligned}$$
(4)
Realization of the integrity monitoring
As shown in Fig. 6, an inhouse network with 20 stations in China (shown as red triangles) are used to implement integrity monitoring, while another 3 evaluation stations (shown as green triangles) are used to verify the performance.
Under the normal system status, the integrity monitoring performance is verified by comparing the evaluation the stations’ pseudo range and carrier phase residuals with the integrity threshold. Generally, UDRE_PR and UDRE_PH should bound the residuals with a certain probability and ensure that the probability of the absolute value of the residual exceeding the threshold is less than the required miss alert rate.
Figures 7 and 8 show the pseudo range and carrier phase monitoring results in the WAPPS. In both figures, the left subgraph shows the GPS corrections and the right one shows the BDS corrections, respectively. A blue point represents that no alarm epoch and a red point is an alert epoch. There are residuals of all visible satellites from three evaluation stations in one day. The data sampling is 1 s, and the monitoring miss alert rate is 10^{−3}.
Under the normal status, the integrity monitoring can ensure that the thresholds bound the corresponding residuals and the miss alert rate meets the requirement. At the same time, there is a false alert rate in 10^{−4} magnitude in carrier phase monitoring, which may affect the continuity of service and should be mitigated in the future.

Pseudo range monitoring is affected by the measurement noises with higher miss alert rate. In addition, because all monitoring stations are located in China, the elevation change when the satellite enters and exits China affects the threshold, evidently for the pseudo range threshold of the GPS.

The carrier phase monitoring is almost unaffected by the entry and exit of satellites because of the process of ambiguity fixing, although the monitoring duration is reduced. Considering the correction accuracy, the absolute value of the phase residual is used, which is set to normal when it is less than 0.5 m. As the result, the miss alert area in the carriermonitoring diagram is different from that in the pseudo range one. There is also a miss and false alert epoch, mainly in the initial and final stages of ambiguity fixing, resulting from the decline of measurement quality.