Satellite integrity testing and analysis evaluates the trustworthiness of navigation satellite signals, verifying that GNSS services deliver timely warnings whenever position or timing solutions become unsafe to use. As one of the four core performance pillars alongside accuracy, continuity, and availability, integrity is essential for safety-critical applications in aviation, maritime transport, rail, and autonomous systems. Accredited third-party laboratories conduct satellite integrity testing using live-signal monitoring, GNSS simulation, and statistical risk analysis to quantify alert limits, time-to-alert, and protection levels.
Technical Overview
Satellite integrity testing and analysis is the systematic evaluation of the trustworthiness of navigation satellite signals and the infrastructure that monitors them. In global navigation satellite system (GNSS) terminology, integrity is defined as the measure of confidence that can be placed in the correctness of the position, velocity, and timing information supplied by the system, including its ability to issue timely warnings when the service must not be used for a particular operation. Integrity is one of the four fundamental performance pillars of any satellite navigation service, alongside accuracy, continuity, and availability, and it is the parameter most directly tied to safety of life.
Unlike accuracy, which describes how close a computed position is to the truth, integrity describes the certainty that the position error has not silently exceeded safe operational limits. A system can be highly accurate yet unsafe if it fails to warn users of a fault such as a satellite clock anomaly, a corrupted ephemeris upload, or a deformed broadcast signal. Satellite integrity testing therefore focuses on quantifying how reliably and how quickly faults are detected and flagged to users.
The core integrity parameters evaluated during testing include:
- Integrity risk — the probability that a hazardously misleading signal or position solution occurs without a timely alert.
- Alert limits (AL) — horizontal (HAL) and vertical (VAL) error thresholds beyond which an alert must be raised.
- Time-to-alert (TTA) — the maximum allowable interval between the onset of a fault and its notification to the user.
- Protection levels (PL) — statistical bounds on position error computed by user equipment, which must remain below the applicable alert limit.
- Signal-in-space user range error (SIS URE) — the contribution of the space and control segments to pseudorange error.
Testing Samples
Integrity test programs cover the full signal delivery chain, from the satellite payload to the user terminal. Typical sample categories submitted to accredited third-party laboratories include:
GNSS Receivers and User Terminals
Aviation, maritime, rail, automotive, and timing receivers; multi-frequency, multi-constellation OEM boards; embedded antennas and RF front ends; and receiver firmware implementing autonomous integrity monitoring functions such as receiver autonomous integrity monitoring (RAIM) and fault detection and exclusion (FDE).
Navigation Satellite Signals and Payloads
Recorded live broadcast signals from GPS, GLONASS, Galileo, and BeiDou constellations; satellite L-band navigation payloads during ground verification; and signal-in-space recordings collected during on-orbit test campaigns.
Augmentation System Equipment
Reference station receivers, integrity monitoring receivers, and message generation units belonging to satellite-based augmentation systems (SBAS) and ground-based augmentation systems (GBAS), together with their broadcast correction and integrity messages.
Ground Monitoring Infrastructure
Monitoring station receivers, timing and frequency references, data processing and estimation software, and the telemetry and control interfaces through which anomalies are detected and flagged to the control segment.
Testing Items
Testing items are organized around the parameters that define integrity at the signal level, the receiver level, and the service level.
Signal-Level Integrity Items
- SIS URE statistics and trending against broadcast clock and ephemeris parameters.
- Detection and characterization of satellite clock anomalies, including ramps, steps, and frequency jumps.
- Ephemeris error monitoring and upload anomaly detection.
- Signal quality metrics: correlation peak symmetry, waveform distortion, signal power, code-carrier coherence, and modulation accuracy.
- Navigation message integrity: checksum and cyclic redundancy verification, data age, and authentication data fields.
Receiver-Level Integrity Items
- RAIM availability and fault detection capability against representative satellite geometries and masking angles.
- FDE performance under single-satellite and multi-satellite fault hypotheses.
- Protection level computation correctness (HPL/VPL) verified against independently derived truth trajectories.
- Receiver behavior under RF interference, jamming, spoofing, ionospheric disturbances, and multipath, including time to detect and time to recover.
Service-Level Integrity Items
- End-to-end time-to-alert verification from fault onset to user alert flag.
- Integrity risk probability assessment over defined exposure periods.
- Augmentation message verification: user differential range error (UDRE), grid ionospheric vertical error (GIVE), fast and slow corrections, and timeout and message-loss handling.
- Continuity and availability statistics compiled jointly with integrity to characterize overall service performance.
Testing Methods
Live Signal Monitoring and Data Collection
High-sensitivity monitoring receivers, geodetic-grade antennas, and disciplined timing references are deployed at one or more test sites to record broadcast signals continuously. Zero-baseline and short-baseline multi-receiver configurations separate receiver noise from genuine signal anomalies, while independent precise orbit and clock products serve as truth references for computing SIS URE and detecting space segment faults.
GNSS Simulation and Fault Injection
Constellation simulators generate controlled, repeatable scenarios in which specific integrity threats are injected: clock drifts and steps, ephemeris biases, deformed signal waveforms, degraded satellite geometry, multipath, and structured interference. Because the injected fault magnitude and onset time are exactly known, the detection threshold, detection latency, and time-to-alert of the equipment under test can be measured with full traceability. This method is indispensable for verifying rare-event behavior that cannot be captured from live signals within a practical observation window.
Statistical and Risk Analysis
Long-duration datasets are processed to characterize error distributions, which are then overbounded by conservative reference distributions so that tail probabilities relevant to integrity risk can be extrapolated. Fault tree analysis allocates the overall integrity budget across the space, control, and augmentation segments, and Monte Carlo techniques evaluate misleading information event probabilities for defined operations.
Augmentation Message Verification
SBAS and GBAS broadcasts are received, decoded, and validated item by item, including correction validity intervals, integrity flags, degradation parameters, and don't-use indicators. Test receivers are exercised through simulated message outages and corrupted messages to confirm that they fail safely and within the specified time-to-alert.
Environmental and Hardware Robustness Support
Receiver and monitoring hardware is subjected to electromagnetic compatibility immunity testing in line with the IEC 61000-4 series and to applicable environmental standards, confirming that the integrity monitoring function itself remains dependable under thermal, vibration, and electromagnetic stress.
Applications
Satellite integrity testing results underpin safety cases, certification submissions, and in-service performance monitoring across many sectors:
- Civil aviation: supporting non-precision approaches, approach procedures with vertical guidance, and localizer-performance approaches that depend on guaranteed integrity bounds.
- Maritime and inland waterway navigation: assuring trustworthy positions in traffic separation schemes, restricted channels, and port approaches.
- Rail: providing position integrity inputs for train detection and signaling concepts that reduce dependence on trackside infrastructure.
- Automotive and unmanned systems: validating lane-level positioning and geofencing functions whose safety arguments rely on declared protection levels.
- Critical infrastructure timing: verifying holdover and anomaly alarm behavior of GNSS timing receivers used in power grids, telecommunications networks, and financial systems.
- System development and acceptance: benchmarking satellite payloads, augmentation systems, and receiver firmware during development, type approval, and in-service monitoring.
FAQ
What is the difference between accuracy and integrity?
Accuracy describes how close the computed position is to the true position on average, while integrity describes the level of trust that can be placed in that solution at any moment, in particular the guarantee that hazardous errors will be flagged within a defined time. A receiver can be highly accurate yet fail integrity requirements if it does not detect a satellite fault quickly enough.
What is time-to-alert and why does it matter?
Time-to-alert is the maximum time allowed between the onset of a hazardous condition and the moment the user is warned. Safety-critical operations define demanding limits, for example on the order of a few seconds for certain aviation operations, and end-to-end testing verifies that detection, processing, and alerting all fit within the budget.
What is a protection level?
A protection level is a statistical upper bound on the position error that the user equipment computes in real time. As long as the protection level stays below the alert limit for the operation, the solution is declared intact; integrity testing verifies that the computed bound is neither optimistic nor excessively conservative.
Why is simulator-based fault injection necessary if live signals can be monitored?
Live monitoring captures nominal behavior and naturally occurring anomalies, but hazardous faults are rare and uncontrolled. Simulation injects precisely known faults with known onset times, enabling deterministic measurement of detection thresholds, missed detection probabilities, and time-to-alert that would be impossible to obtain from live data alone.
Which standards and references govern satellite integrity testing?
Testing is performed by accredited third-party laboratories operating under ISO/IEC 17025 quality management, using published constellation interface control documents and national GB series specifications for navigation signal interfaces and receiver requirements, together with IEC standards for the electromagnetic robustness of the hardware involved.
How long does a typical integrity test campaign take?
Short verification runs using simulation can be completed within days, while statistical integrity characterization requires continuous monitoring over weeks or months to accumulate sufficient data on tail behavior, anomaly rates, and availability. Test plans are typically phased, beginning with simulator-based screening and progressing to long-duration live-signal monitoring.