# Design and Performance Analysis of BDS-3 Integrity Concept
## 4 Risk Prevention and Control
### Space Segment Measures  
From the analysis in Section 3, it can be seen that the space segment is the part with the highest probability of BDS integrity risk. This is due to the complexity of the space environment in which the navigation satellite is located and the difficulty of operation caused by being far from the ground.  
The BDS-3 satellite downlink navigation payload includes the time and frequency system, navigation signal generation, navigation signal broadcast, and antenna. In order to cope with possible integrity risks in the space segment, BDS-3 satellites have taken corresponding measures in various aspects.  
To prevent the satellite clock anomaly (Event 8 in Figure 1), each satellite is equipped with multiple on-board atomic clocks, one of which is selected by the reference frequency synthesizer as the working clock, and the others as backups. The structure is shown in Figure 2, in which the 10 MHz signal is the standard output frequency of the atomic clock, and the 10.23 MHz signal for the working and standby circuits is generated by the frequency synthesizer. When an abnormality occurs in the working clock, the measurement and fault detection module of the reference frequency synthesizer detects the abnormality  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Bottom Events** & **Integrity Risk Probability** \\ \hline Satellite orbit calculation anomaly & \(2.1\times 10^{-8}\)/h \\ Satellite clock calculation anomaly & \(2.1\times 10^{-8}\)/h \\ Ephemeris fitting anomaly & \(1\times 10^{-9}\)/h \\ Orbit and time processing equipment anomaly & \(1\times 10^{-9}\)/h \\ Data input anomaly & \(1\times 10^{-9}\)/h \\ MS data anomaly & \(1\times 10^{-9}\)/h \\ Message upload anomalies & \(4.2\times 10^{-8}\)/h \\ Satellite clock anomaly & B1I & \(4\times 10^{-6}\)/h \\ B1C, B2a & \(4\times 10^{-6}\)/h \\ Satellite signal and data & B1I & \(5\times 10^{-6}\)/h \\ anomaly & B1C, B2a & \(4\times 10^{-6}\)/h \\ \hline \hline \end{tabular}
\end{table}
Table 5: Integrity risk of BDS SIS bottom event.  
in time and switches the output frequency to the hot standby circuit. To ensure a smooth signal transition before and after the switchover, the measurement and fault detection module synchronizes the frequency and phase of the 10.23 MHz signals of the hot standby and working circuits by means of a precision tracking algorithm, so that they remain synchronized at any time and the frequency and phase of the output signal can remain unchanged after the switchover.  
To prevent the satellite signal and data anomaly (Event-7 in Figure 1), each satellite has a fault-proof design for the navigation signal generation and broadcast process, as shown in Figure 3. In the digital intermediate frequency (IF) signal generation module, full triple modular redundancy (TMR) is designed for its look-up tables, registers, and processing modules, and a dedicated anti-fuse Field Programmable Gate Array (FPGA is used to refresh the TMR data at regular intervals to prevent single event upsets. For B1I, B1C, and B2a signals, the satellite has the ability to monitor and handle faults of relevant equipment on the broadcast channel, such as frequency modulators and power amplifiers, and switch to the other channel when a fault occurs in one path.  
Figure 3: Fault prevention design of BDS-3 satellite signal generation and broadcasting.  
Figure 2: Anomaly monitoring and redundant switching structure of atomic clocks for BDS-3 satellites.