ROBUST GLOBAL GEODESY SUPPLY CHAIN

Worked Example — Earth Orientation Parameters (EOP), v3

Full WP1–WP10 Assessment Walkthrough | Simulated for Illustrative Purposes, Except Where Marked Real

Methodology: ROBUSTNESS_TESTING_PROCEDURE_v1.6.docx (9 September 2026) — Nick's current, authoritative procedure, not the earlier Work Plan v1.1/v1.2 this document was previously anchored on. Reconciled against the real State of Geodesy 2026 capability model throughout.

Relationship to the original, and to v2. v2 was a mechanical reauthoring of EOP_Worked_Example_GGSC.docx against the older Work Plan v1.1 — real capability names instead of invented C-XX IDs, Functions as framing rather than a parallel scored taxonomy, and the "Components" rollup replaced. v3 (this version) goes further, in two ways:

Re-anchored on v1.6, not v1.1. The Work Plan's "Template A/B/C/D" scheme is retired in v1.6 — a single form asking what something is, what it should be, and whether it passes cannot be completed by one person at one time (Annex B.1). It's replaced by six capture instruments (C1–C6, Section 17) and ten assessment instruments (A1–A10, Section 18), a formally designed two-track consultation method (Track A continuous mapping, Track B structured Delphi-style elicitation, Section 6), a bottom-up threshold-setting method (Section 6.3), and a corrected quantitative method (Annex A) — Function Risk Score = Binding dimension gap × Criticality, gap measured as required minus current, not 5 minus current. This version uses all of it, by name, with real arithmetic shown rather than narrative assertion. The capability-model-change material from v2 (B.1 open question, B.2 New Capability Request, outputs/capability_model_change_submission.md) is unchanged and still correct — v1.6 doesn't touch that process.
The F6 combination function is corrected, not simulated. docs/EOP_Worked_Example_Comparison_BW.md (Ben's prior note) found that Nick's original single F6 — "IERS Earth Orientation Centre, France, SINGLE POINT OF FAILURE" — is actually two institutions in two jurisdictions per the real WA2 Annex: SYRTE (Observatoire de Paris, final products/Bulletin B, Medium real risk) and USNO (rapid products/Bulletin A, High real risk — the original modelled only the lower-risk half). This is exactly what C2's own field list produces when followed properly — "Jurisdiction: where nominally multi-jurisdictional, name the jurisdiction of the operationally critical sub-function separately" — so a document hardened against v1.6 that kept F6 undivided would be demonstrating C2 done wrong. This reverses v2's earlier "keep Nick's simulated numbers unchanged, minimise drift" decision, deliberately: that decision optimised for a simple mechanical reauthoring; this one optimises for showing the real methodology applied correctly, which means using the real split where one is known. All maturity/PPTD scores remain simulated for illustrative purposes; the F6a/F6b split and its institutional attribution are real.

About This Document

Purpose. This document walks through all work packages of the Robust GGSC process for the product Earth Orientation Parameters (EOP), hardened against ROBUSTNESS_TESTING_PROCEDURE_v1.6.docx so a reader can trace every number to the instrument and step that would actually produce it.

All PPTD scores, expert-elicitation numbers and modelled disruption results are simulated for illustrative purposes and do not represent real assessments. The F6a/F6b jurisdictional split (WP3, WP6, WP7) is a real correction, not a simulation — see the note above.

Structure. The document follows the ten work packages (WP1–WP10), naming the real capture instruments (C1–C6) and assessment instruments (A1–A10) each work package uses, per Sections 17–18 of the Procedure.

Two evidence conventions, kept separate (Section 5.4). Evidence status — established evidence / expert judgement / hypothesis to test / evidence gap — is recorded on captured facts (C-instruments). Confidence — High / Moderate / Low / Evidence required — is recorded on derived findings (A-instruments), and can never exceed the weakest evidence status it rests on (the ceiling rule). Earlier drafts of this document used a single "Confidence" column for both; this version keeps them distinct wherever the distinction matters.

Determination language. Three outcomes exist (Section 13.3): ROBUST, NOT YET ROBUST, or NOT YET ROBUST — EVIDENCE GAP where the blocking issue is missing evidence rather than a demonstrated failure. An evidence gap is never presented as, or silently collapsed into, a pass or a fail.

WP1 — Mobilisation and Evidence Preparation

Purpose (Section 7): confirm scope, evidence, product list, stakeholders and the consultation design before any assessment begins. WP1 assesses nothing — it builds the machinery every later work package depends on.

WP1 confirms the scope, evidence base, product communities and governance arrangements before analytical work begins. The outputs below would be agreed with UN-GGCE and the Technical Product Working Group (TPWG) for EOP before proceeding.

WP1 Element	Status / Output
Product confirmed	Earth Orientation Parameters (EOP).
Methodology confirmed	`ROBUSTNESS_TESTING_PROCEDURE_v1.6.docx`. The real, published State of Geodesy capability set is the capability baseline — not a product-specific invented list. Robustness determined against six principles (P1–P6), never averaged (Section 3).
Capability-model change process confirmed	Where a function requires a capability the model doesn't have, the TPWG raises a formal New Capability Request rather than treating an informal name as if it were scored. Process, submission format and ratification path: `outputs/capability_model_change_submission.md`, Section A.
TPWG established	It should include IERS representatives, VLBI/GNSS/SLR/DORIS network operators, IGS/IVS/ILRS/IDS service leads, national agency representatives from ≥4 jurisdictions, and a named Chair through whom Track A first contacts run (Section 7.1).
Consultation design fixed	Track A (continuous system/evidence mapping) and Track B (structured Delphi-style elicitation: Round 0 orientation → Round 1 anonymous written elicitation on C4 → synthesis → Round 2 facilitated workshop → TPWG Chair sign-off) — Section 6. The scoring method (Annex A) and bottom-up threshold method (Section 6.3) are calibrated now, before the first number is elicited, so a later concurrent product's team isn't calibrating independently (Section 5.5).
Evidence register opened	Every captured statement carries an evidence status (established evidence / expert judgement / hypothesis to test / evidence gap) and a source. Derived findings carry a separate confidence (High / Moderate / Low / Evidence required), capped by the ceiling rule (Section 5.4).
Instruments established	Capture: C1–C6. Assessment: A1–A10 (Sections 17–18) — version-controlled forms, not yet populated. C6 (governance basis) opens immediately, logging what already governs EOP before WP2 starts.
Key control note	Current PPTD maturity ≠ robustness. Geographic distribution must be assessed independently of maturity (P1 excludes maturity scores as evidence). Political independence must be assessed independently of organisational diversity (P2).

Instruments used (Section 7.2). C6 opened. C1–C5 and A1–A10 established as version-controlled forms.

Illustrative — EOP: WP1 confirms IERS as the natural home of the EOP TPWG, logs existing State of Geodesy findings on the IERS Earth Orientation Centre into the evidence register as established evidence, and records on C6 that daily EOP predictions currently rest on an informal IERS convention with no binding instrument behind it — flagged immediately as a governance gap to carry into WP2 and WP7, not discovered late.

WP2 — Product Requirements | Steps 1–2

Purpose (Section 8): turn "the product must be robust" into a measurable target. Instruments: capture C1 (product requirements), C4 (elicitation responses for thresholds), C6 (governance basis); assessment A1 (Product Requirements Specification).

Earth Orientation Parameters (EOP) describe the irregular rotation of the Earth and the relationship between the International Terrestrial Reference Frame (ITRF) and the International Celestial Reference Frame (ICRF). They are essential for satellite orbit determination, navigation, timing, VLBI scheduling and climate research.

C1 → A1 — EOP Product Requirements Specification

Requirement Field	Specification	Evidence Status	Confidence
Applications / Users	GNSS orbit determination; spacecraft operations; VLBI scheduling; international timekeeping (UTC); geodetic reference frame maintenance; climate research (LOD for Earth rotation studies).	Established evidence	High
Accuracy — Polar Motion (x,y)	≤ 0.05 mas (routine); ≤ 0.2 mas (rapid). Continuity across ITRF realisation required.	Established evidence	High
Accuracy — UT1–UTC	≤ 0.02 ms (routine); ≤ 0.05 ms (rapid). Critical for timekeeping and navigation.	Established evidence	High
Accuracy — Nutation / Precession	Sub-mas level; must be consistent with ICRF and ITRF alignment standards.	Established evidence	High
Timeliness — Rapid products	Within 24 hours of observation epoch. Operational users (space agencies, navigation services) require near-real-time access.	Established evidence	High
Timeliness — Final products	Within 30 days. Used for science, ITRF maintenance and long-term records.	Established evidence	High
Availability	Continuous. No scheduled downtime acceptable for rapid products. Final products may tolerate brief delay if rapidly communicated.	Established evidence	High
Continuity	Long-term series continuity essential for climate and reference frame science. Series extends to 1962; future breaks must be bridged with documented overlap.	Established evidence	High
Acceptable degradation	Temporary use of lower-accuracy predictions acceptable for ≤ 48 hours for non-critical navigation. VLBI-dependent products cannot accept degradation beyond 24 hours.	Expert judgement	Moderate
Sustainability requirements	IERS mandate requires multi-decade horizon. Funding: mix of national and international contributions — structural vulnerability identified. Workforce: specialist geodesists and data analysts; succession risk in several institutions.	Expert judgement	Moderate

Recovery and unacceptable-interruption thresholds — bottom-up method (Section 6.3)

Thresholds are not asserted; they are derived through the Procedure's own four-step method, worked through here for EOP's rapid-product recovery threshold:

Step	Applied to EOP
1. Establish the observed baseline	Outage-history review: EOP rapid products have never been late by more than three days in the last five years (simulated baseline, illustrative). Recorded as established evidence — descriptive, not a judgement.
2. Ask the narrower question	Downstream navigation and space-agency users, asked via Track B Round 1 on C4 how much worse than three days would be genuinely unacceptable, converge on five days.
3. Stress-test against a disruption scenario	Five days is tested against the WP6 loss-of-combination-centre scenario (DS-1, below): does the proposed threshold hold, or does it just restate current practice?
4. Escalate for ratification	The EOP TPWG Chair confirms five days in writing on A1, forming the audit trail WP7 relies on. Every WP6 scenario is then tested against exactly this number, and WP7 Step 9 accepts or rejects on that comparison — not a separate, re-derived figure.

Requirement Field	Specification	Evidence Status	Confidence
Recovery requirement	Rapid products: recovery within 5 days (ratified via the bottom-up method above). Final products: within 60 days, TPWG validation still pending.	Rapid: expert judgement, TPWG-ratified. Final: hypothesis to test	Rapid: Moderate. Final: Low — TPWG validation required
Unacceptable interruption	Loss of UT1–UTC accuracy beyond 0.1 ms for > 72 hours constitutes an unacceptable interruption for timekeeping. Full product loss for > 5 days (per the ratified recovery threshold above) would compromise satellite operations globally.	Expert judgement, TPWG-ratified	Moderate

WP3 — End-to-End Supply-Chain Mapping | Steps 3–4

Purpose (Section 9): turn the WP2 requirement into the literal chain of organisations, systems and infrastructure that produces it. Instruments: capture C2 (function record), C6 (governance basis). WP3 produces no assessment instrument — deliberately: v1.5 put a verdict form here and required mappers to record P1–P6 findings before the evidence existed (Annex B.1). WP3 only records what is.

Framing note. F1–F8 below organise the walkthrough and give the TPWG a checklist to confirm no production step is skipped. They are not themselves a scored unit — every function is mapped onto the real capabilities that support it in WP4. A function is a where/who/how, for this product instance; a capability is the generic, reusable competency behind it, scored once per function it supports. Keeping them separate is what lets WP4 ask "does a capability exist for this" without the answer being pre-decided by however the function happened to be named.

C2 asks Location and Jurisdiction as separate fields, and specifically instructs: "where nominally multi-jurisdictional, name the jurisdiction of the operationally critical sub-function separately." Applying that instruction properly to EOP's combination function is what splits F6 below — this isn't an arbitrary refinement, it's C2's own field list followed correctly. Per docs/EOP_Worked_Example_Comparison_BW.md: the real WA2 Annex shows EOP combination as two institutions — SYRTE (Observatoire de Paris, final products, Bulletin B) and USNO (rapid products, Bulletin A) — not one.

Information Artifact column added. C2's own field list also asks Input and Output per function — what a function requires, and what it produces. The taxonomy's Primitive 4 (Information Artifacts, outputs/project/ggsc_concept_taxonomy.md Section 2) defines the real EOP-relevant lifecycle: Raw Observational Baseband → Standardized Observation Logs (RINEX/vgosDB/CRD) → Uncombined Solutions (SINEX) → Integrated Multi-Technique Solution (Combined SINEX, Bulletin A/B) → Published Ephemerides (EOP C04). The column below traces exactly that lifecycle across F1–F8, closing a real gap in the previous version of this document: three of the four BIZBOK lenses (Value Stream, Capabilities, Organisations) were explicit, but Information Flow was only ever implicit in product names — never its own visible column.

#	Function	Information Artifact Produced (Primitive 4)	Organisation	Location	Jurisdiction	Upstream Dependency	Alternative
F1	Space geodetic observations (VLBI, GNSS, SLR, DORIS)	Raw Observational Baseband (Mark 6, VDIF, raw GNSS binary)	IVS network stations; IGS network; ILRS stations; DORIS network	Global	Multi-jurisdiction	Power, comms, maintained instruments	Partial — geographic distribution provides some resilience; gaps in southern hemisphere
F2	Data transmission and collection	Raw Baseband, in transit — unchanged in kind, moved from station to data centre	IVS Data Centres (Bonn, Washington, Tsukuba); IGS Data Centres	Germany, USA, Japan	Germany, USA, Japan	F1 observations	Partial — geographic diversity limited; e-VLBI relies on high-bandwidth internet
F3	Data archiving and replication	Standardized Observation Logs (RINEX 3/4, CRD, vgosDB) — first stage where the raw signal becomes a documented, interchange-format artifact	IERS Data Centres; IVS, IGS, ILRS archiving nodes	France, Germany, USA, Japan	France, Germany, USA, Japan	F2 transmission	Partial — some replication exists but not fully tested for all data types
F4	Analysis — VLBI (UT1, nutation, polar motion)	Uncombined Solutions & Normal Equations (SINEX) — VLBI-specific	~7 IVS analysis centres (Vienna, Bonn, Shanghai, Goddard, Onsala, etc.)	Austria, Germany, China, USA, Sweden	Austria, Germany, China, USA, Sweden	F3 archived data	Multiple analysis centres — partially redundant but geopolitically clustered
F5	Analysis — GNSS (polar motion, LOD)	Uncombined Solutions & Normal Equations (SINEX) — GNSS-specific	IGS Analysis Centres (JPL, CODE, GFZ, ESOC, NGS, NRCan, etc.)	USA, Switzerland, Germany, France, Canada	USA, Switzerland, Germany, France, Canada	F3 archived data	Good diversity across centres; political concentration in Western group
F6a	Combination — Rapid products (Bulletin A)	Integrated Multi-Technique Solution — Bulletin A rapid-turnaround table	USNO (US Naval Observatory)	Washington DC, USA	USA	F4, F5 analysis outputs (SINEX)	No independent operational alternative for rapid products specifically — but F6b (final products, different jurisdiction) continues if F6a is lost
F6b	Combination — Final products (Bulletin B)	Integrated Multi-Technique Solution — Combined SINEX, Bulletin B	SYRTE, Observatoire de Paris	Paris, France	France	F4, F5 analysis outputs (SINEX)	No independent operational alternative for final products specifically — but F6a (rapid products, different jurisdiction) continues if F6b is lost
F7	Product validation and quality control	Validated Bulletin A / Bulletin B — same artifact, quality-controlled, not yet a new one	IERS Central Bureau; TPWG oversight	Germany / France	Germany, France	F6a, F6b combined products	Limited — dependent on same institutions as combination
F8	Product dissemination and user access	Published Ephemerides — final delivery stage: IERS EOP C04 (long-term series), Bulletin A/B (near-real-time)	IERS website, IERS FTP, downstream navigation / space agencies	France / Germany	France, Germany	F7 validated product	Some mirror services; not fully operationalised

Critical finding (Step 4), corrected. The real assessment rates USNO (F6a) as the higher-risk institution, not SYRTE (F6b) — the reverse of the original worked example, which modelled only the lower-risk side and characterised it as the sole point of failure. Neither F6a nor F6b has an independent operational alternative for its own product track — each remains individually a single point of failure on the Annex A.3 criticality scale — but the two tracks sit in different jurisdictions, so a withdrawal event affecting one does not by itself terminate EOP production. This is the coordination-risk / concentration-risk distinction P2 tests explicitly (Annex A.7, see WP7) — not visible at all in the undivided F6.

Instruments used (Section 9.2). Capture: C2, C6. No assessment instrument in WP3.

Illustrative — EOP: an interview with IERS Earth Orientation Centre staff establishing F6a/F6b would record each combination track's provisional criticality separately (Annex A.3) from the alternative and common-dependency fields — never averaged into one "combination" rating — so WP5 elicitation starts from two concrete proposals, not one blurred function.

WP4 — Capability Mapping and Current Maturity | Steps 5–6

Purpose (Section 10): a factual, present-tense snapshot of current maturity — not yet a judgement about whether it's good enough (that's WP5). Instrument: capture C3 (capability and current maturity capture). WP4 produces no assessment instrument; the gap is computed in WP5 once the required level exists.

Twelve capability-at-function pairs from the real, published State of Geodesy capability set are applicable to EOP production (eleven distinct capabilities; Combination Processing now applies to both F6a and F6b following the WP3 split), mapped directly onto the functions F1–F8 above rather than to a separate ID scheme. Two functions — combination (F6a/F6b) and monitoring/assurance (touching F6a/F6b–F8) — have no lexical match in the real model. This is shown as it actually happens, including the part that doesn't resolve cleanly: the TPWG checks the real list against labels first, finds nothing, then does the semantic check Section A of capability_model_change_submission.md actually requires — comparing the function's plain-language description against candidate capabilities' full evidence summaries, not just their names. For monitoring/assurance, that check confirms the gap and produces a clean New Capability Request (B.2). For combination, it doesn't — Geodetic Data Products and Reference Frames both plausibly already cover it once read for meaning rather than for the word "combine," so B.1 is carried into WP5 and WP7 as an open question, not a settled request.

All PPTD scores are simulated on a 1–5 scale. What's real: the split itself, and the status column for both non-matching capabilities: B.2 carries forward provisionally (pending ratification, not as if already ratified); B.1 carries forward as unresolved (pending a TPWG decision between deepening an existing capability's definition and splitting out a new one).

C3 — Current Maturity Capture | Scores 1 (lowest) – 5 (highest), per Annex A.2 level definitions

Function	Capability (real, or Requested)	Applicable?	P	Pr	T	D	Dimensionality	Evidence Status	Confidence
F1	VLBI Data Acquisition and Storage	Required	3	4	3	4	4/4	Established evidence	Moderate
F1	GNSS Data Acquisition and Storage	Required	4	4	4	4	4/4	Established evidence	High
F1	SLR Data Acquisition and Storage	Required	3	3	3	3	4/4	Established evidence	Moderate
F1	DORIS Data Acquisition and Storage	Required	3	3	3	3	4/4	Established evidence	Moderate
F2	Network Operations	Required	3	3	4	3	4/4	Established evidence	Moderate
F3	Data Preservation	Required	3	4	3	3	4/4	Established evidence	Moderate
F4	VLBI Data Processing and Analysis	Required	4	3	4	4	4/4	Expert judgement	Moderate
F5	GNSS Data Processing and Analysis	Required	4	4	4	4	4/4	Established evidence	High
F6a	Combination Processing — no label match in the real 58; open question, not a submitted request (B.1)	Open question	3	4	3	4	4/4	Expert judgement	Low — ceiling rule, and independently: unsettled which capability record this attaches to
F6b	Combination Processing — same open question (B.1), separate function instance	Open question	3	3	3	4	4/4	Expert judgement	Low — same basis as F6a
F7	Data Quality Management	Required	3	3	3	3	4/4	Expert judgement	Low
F8	Data Distribution	Required	3	4	3	3	4/4	Established evidence	Moderate
F1–F8 (workforce, all functions)	Training and Education	Required	3	3	3	N/A	3/4	Expert judgement	Low — see note below
F6a–F8 (monitoring, cross-cutting)	Real-Time Network/Observatory Monitoring — no match in the real 58; New Capability Request submitted (B.2)	Requested, not yet ratified	2	2	3	2	4/4	Hypothesis to test	Low — ceiling rule

Note on workforce (Training and Education row): Training and Education is the closest existing capability, but a third New Capability Request — Workforce Succession and Continuity Planning (B.4) — has separately been drafted for the specific competency this row can't fully cover: continuity when a specific irreplaceable expert or undocumented toolchain is lost, as distinct from general skill development. B.4 held up under the same semantic check applied to B.1 below — its evidence comes from this engagement's own published ITRF annex, not from this EOP example, but the underlying single-point-of-failure pattern (a small, undocumented specialist team maintaining critical combination software) is the same one visible at F6a/F6b here. Not elaborated as a third full discovery narrative in this table to keep the walkthrough to the functions where it actually blocks a determination — but the same semantic-matching mechanism applies to it.

Step 6 note. Current maturity is never collapsed into a single figure (Section 10.1) — dimension-specific weakness stays visible, because that's exactly what an average would hide. No inferencing of geographic distribution from maturity scores is made (a control tested directly in WP7's P1 check). Dimensionality (number of applicable dimensions) is reported with every score per Annex A.2, so a two-dimension capability at full strength isn't structurally capped relative to a four-dimension one.

Instruments used (Section 10.2). Capture: C3.

Illustrative — EOP: for F6a (USNO, rapid), applicable capabilities include Combination Processing, Software Sustainment and Data Access and Sharing. Combination Processing scores People 3, Process 4, Technology 3, Data 4 — dimensionality 4/4. For F6b (SYRTE, final), the same capability scores 3/3/3/4 — a materially different Process rating, visible only because the two functions were kept separate rather than averaged into one "combination" figure.

WP5 — Required Maturity and Resilience Architecture | Steps 7–9

Purpose (Section 11): where current state meets required state, elicited via Track B Rounds 0–2 on C4 and scored per Annex A. Two separate outputs per function — how mature must this be, and what structure must exist around it — because a function can be highly mature and still structurally fragile. Instruments: capture C4, C6; assessment A2 (capability gap), A3 (resilience architecture determination).

The calculation (Annex A.4) — worked once, in full, before the table

Dimension gap (d) = max(0, Required(d) − Current(d)) — not 5 minus current. Measuring against the top of the scale would make the required level (the answer to Q2, and the output of an entire elicitation round) irrelevant to the arithmetic, and would inflate the apparent gap at capabilities already adequate for their function.

Binding dimension gap = the largest dimension gap across applicable dimensions — never a mean. Averaging People 4 with Technology 0 produces a comfortable number that describes nothing real; the binding gap surfaces the weakness that would actually cause the function to fail.

Function Risk Score = Binding dimension gap × Criticality (range 0–20, Annex A.3 for the criticality scale). A likelihood-times-consequence construction: only a function that is both materially short of its requirement and structurally irreplaceable scores high. It is a WP8 sequencing tool, not a robustness test — it has no geographic term, so it is never used to test P1 (Annex A.6 does that).

Worked for F6a (Combination, USNO, rapid products): required People 5 / Process 5 / Technology 4 / Data 5; current 3 / 4 / 3 / 4 (from WP4). Dimension gaps: 2, 1, 1, 1. Binding dimension gap = 2 (People). Criticality = 5 (F6a remains individually a single point of failure for rapid-product combination, even though F6b now covers final products independently — see below). Function Risk Score = 2 × 5 = 10.

A2 — Capability Gap Assessment

Function	Capability	Current PPTD	Required PPTD	Dimension Gaps	Binding Gap	Criticality (A.3)	Function Risk Score	Classification (A.9)
F1	VLBI Data Acquisition and Storage	3/4/3/4	4/4/4/4	1,0,1,0	1	3	3	Minor
F1	GNSS Data Acquisition and Storage	4/4/4/4	4/4/4/4	0,0,0,0	0	2	0	Minor
F1	SLR Data Acquisition and Storage	3/3/3/3	4/4/4/4	1,1,1,1	1	3	3	Minor
F1	DORIS Data Acquisition and Storage	3/3/3/3	4/4/4/4	1,1,1,1	1	3	3	Minor
F2	Network Operations	3/3/4/3	4/4/4/4	1,1,0,1	1	3	3	Minor
F3	Data Preservation	3/4/3/3	4/4/4/4	1,0,1,1	1	3	3	Minor
F4	VLBI Data Processing and Analysis	4/3/4/4	4/4/4/4	0,1,0,0	1	2	2	Minor
F5	GNSS Data Processing and Analysis	4/4/4/4	4/4/4/4	0,0,0,0	0	2	0	Minor
F6a	Combination Processing (open question, B.1)	3/4/3/4	5/5/4/5	2,1,1,1	2	5	10	High
F6b	Combination Processing (same open question, B.1)	3/3/3/4	5/5/4/5	2,2,1,1	2	5	10	High
F7	Data Quality Management	3/3/3/3	4/4/4/4	1,1,1,1	1	4	4	Minor
F8	Data Distribution	3/4/3/3	4/4/4/4	1,0,1,1	1	3	3	Minor
F1–F8 (workforce)	Training and Education	3/3/3/N/A	4/4/3/N/A	1,1,0	1	3	3	Minor
F6a–F8 (monitoring)	Real-Time Network/Observatory Monitoring (requested, B.2)	2/2/3/2	4/4/4/4	2,2,1,2	2	5	10	High

Classification bands per Annex A.9 (provisional, pending EOP-specific thresholds from Section 6.3): 16–20 Critical, 10–15 High, 5–9 Significant, 0–4 Minor. No function reaches Critical. Three reach High, for three structurally different reasons: F6a and F6b are each individually irreplaceable on their own product track (criticality 5) with a real maturity shortfall; Real-Time Monitoring is criticality 5 because it's cross-cutting to every critical function's assurance, not because any single station is irreplaceable. These are the three functions WP8 prioritises first — see below.

A note on what this table does not show. F6a and F6b individually carry the same Function Risk Score as the original undivided F6 did — splitting the function doesn't reduce either track's own maturity shortfall or criticality. What the split changes is the P2 finding in WP7, because P2 is tested by jurisdiction count (Annex A.7), a structural political-risk test that is completely independent of Function Risk Score. This is exactly the point Annex A.4 makes explicit: the Function Risk Score "contains no geographic term" and must never be used to infer P1 or P2 findings.

A3 — Resilience Architecture Determination | Steps 8–9

Function	Required Resilience Strategy (Section 11.3)	Required Geographic Configuration	Required Political Independence	Independence Test Specified
F1 — Observations	Distributed by nature	≥4 geographic regions; gaps in S. Hemisphere and polar zones must be addressed	≥3 independent jurisdictions per technique	Coverage and geometry analysis; failure simulation of regional loss
F2 — Data transmission	Replicated + Redundant	Multiple transmission pathways; mirrored at ≥2 independent nodes	No single national internet dependency	Pathway loss simulation; backup activation test
F3 — Data archiving	Replicated	≥3 independent archiving nodes in different jurisdictions	≥3 separate jurisdictions	Restore test from independent node without primary access
F4 — VLBI analysis	Redundant	≥3 active analysis centres in ≥3 jurisdictions	No single-jurisdiction monopoly	Independent replication of solution; blind comparison exercise
F5 — GNSS analysis	Redundant	Multiple existing centres — configuration largely adequate	Partially met — improvement in jurisdictional spread desirable	Independent replication exercise; already partially tested via IGS
F6a — Combination, rapid (USNO)	Unique but protected — no operational alternative exists for rapid-product combination specifically; duplication within the 5-day recovery threshold is judged impractical, so enhanced continuity protection is the required strategy, not a second rapid-product centre	Single site adequate for this track; the required distribution is across F6a/F6b's two jurisdictions, not within F6a itself	Independent of F6b (different jurisdiction) — met at the F6a/F6b pair level; not met at the F6a level alone	Documented succession, tested internal failover, independent backup power/comms — no cross-jurisdiction alternative is being built
F6b — Combination, final (SYRTE)	Unique but protected, same reasoning as F6a for the final-product track	Single site adequate for this track	Independent of F6a (different jurisdiction) — met at the pair level; not met at the F6b level alone	Documented succession, tested internal failover, independent backup power/comms
F7 — Validation	Independent of F6a/F6b provider	Separate institution from both combination centres	Independent jurisdiction from whichever function it validates	Validation must not depend on F6a/F6b provider staff or infrastructure
F8 — Dissemination	Replicated + Redundant	≥2 independent distribution points	Not co-located with F6a or F6b	Failover demonstration; product available without primary IERS web infrastructure

Why "Unique but protected" replaces "Redundant — PRIORITY" for F6a/F6b. The original undivided F6 required a second, fully independent combination centre (Redundant strategy) because it modelled one institution as the entire single point of failure. Once split, each track individually remains hard to duplicate within the ratified 5-day threshold — Section 11.3 requires querying whether duplication is genuinely practical before defaulting to Redundant, and for a function this specialised, it likely isn't within the roadmap horizon. The real required-configuration question moves from "does a second combination centre exist" to "are the two existing tracks genuinely independent of each other" — which Annex A.7's jurisdiction count, not the Function Risk Score, is what tests it (see WP7). Both are still blocked on resolving the open Combination Processing question (B.1) before their maturity gaps can be scored against a settled capability record.

Instruments used (Section 11.5). Capture: C4, C6. Assessment: A2, A3.

Illustrative — EOP: starting from People 3 / Process 4 / Technology 3 / Data 4 for F6a, Track B Rounds 1–2 determine required levels of 5/5/4/5 and ratify criticality 5. Binding dimension gap is 2 (People), giving a Function Risk Score of 10. Because no operationally practical alternative exists within the 5-day threshold and criticality is 5, the required strategy is Unique but protected: documented succession planning, tested internal failover and independent backup infrastructure at USNO itself — not a second rapid-product centre in a third jurisdiction, which Section 11.3 would only require if duplication were judged practical.

WP6 — Disruption Scenario Testing | Steps 10–11

Purpose (Section 12): the dynamic check — what actually happens when the WP5 architecture fails. Catches an arrangement that looks sound against the six principles but has never been stress-tested. Instruments: capture C5 (disruption scenario), C6 (authority to act); assessment A4 (disruption test result). Result vocabulary per Section 12.2: PASSES / PASSES WITH CONDITION / PARTIAL — EVIDENCE GAP / FAILS.

Six credible disruption scenarios across the Section 12.1 scenario classes, simulated for illustrative purposes except DS-1, which is split and re-run against the real F6a/F6b jurisdictional structure per docs/EOP_Worked_Example_Comparison_BW.md.

DS-1a — Organisation / Political: Withdrawal of USNO (F6a, rapid products)

Field	Detail
Scenario class	Political (Section 12.1)
Scenario	Withdrawal of USNO — USA — from EOP rapid-product (Bulletin A) combination.
Failed components	F6a — Combination, rapid products; F7 (rapid-product validation only); F8 (rapid-product dissemination only).
Claimed mitigation	None operational for F6a specifically — the required strategy is Unique but protected (WP5), not Redundant, so no alternative rapid-product centre is claimed.
Independence test applied	N/A — no alternative is claimed for F6a itself. What is tested here is whether F6b (final products, France) is genuinely unaffected — the A3 independence test between F6a and F6b: independent software build, independent data access, independent staff, no shared infrastructure.
Common dependency	F6a and F6b are in different jurisdictions but both ultimately publish through IERS — checked and confirmed not a shared operational dependency (separate software, separate staff).
Product impact	Rapid EOP products (Bulletin A) unavailable. Final products (Bulletin B) continue via SYRTE/F6b, unaffected. Against the WP2 A1 threshold (5 days, ratified): rapid-product users lose near-real-time access but final, ratified-accuracy products keep publishing on schedule.
Recovery	No demonstrated recovery path for the rapid-product track specifically. Overall EOP product delivery does not stop.
Scenario result	PASSES WITH CONDITION — the product continues via F6b, but rapid-product users experience a real, undemonstrated-recovery degradation. Corrected from the original worked example's undivided "FAILS", which modelled only one combination institution and so could not see this outcome.
Mandatory consequence	Does not alone prevent a Robust determination — but the underlying F6a maturity gap (WP5, Function Risk Score 10) and the undemonstrated internal-failover independence test remain real, unresolved findings, carried to WP7 P5.
Residual gap	USNO succession planning and tested internal failover (I-4 revised, WP8).

DS-1b — Organisation / Political: Withdrawal of SYRTE (F6b, final products)

Field	Detail
Scenario class	Political
Scenario	Withdrawal of SYRTE / Observatoire de Paris — France — from EOP final-product (Bulletin B) combination.
Failed components	F6b — Combination, final products; F7 (final-product validation only); F8 (final-product dissemination only).
Claimed mitigation	None operational for F6b specifically — Unique but protected, same basis as F6a.
Independence test applied	Same A3 pair-independence test as DS-1a, run in the other direction: is F6a genuinely unaffected by an SYRTE-side event.
Common dependency	As DS-1a — confirmed not shared.
Product impact	Final EOP products (Bulletin B) unavailable. Rapid products (Bulletin A) continue via USNO/F6a, unaffected.
Recovery	No demonstrated recovery path for the final-product track specifically. Overall EOP product delivery does not stop.
Scenario result	PASSES WITH CONDITION — same reasoning as DS-1a, mirrored.
Mandatory consequence	Does not alone prevent a Robust determination; F6b's own maturity gap and failover-independence evidence gap are carried to WP7 P5.
Residual gap	SYRTE succession planning and tested internal failover (I-4 revised, WP8).

What changed, and why it matters more than the input correction alone. This is not just a corrected input — it's evidence the disruption-testing mechanism works as intended once given accurate structure (per the Comparison note). The original single-F6 model produced a "total failure" result because it couldn't represent two independent tracks. The corrected model reproduces the nuanced "partial continuity" finding P2's jurisdiction-count test (Annex A.7) is specifically designed to surface — coordination risk between two jurisdictions, not concentration risk in one. Whether F6a and F6b are robust is still a separate question, answered in WP7: each individually carries a real maturity gap and an undemonstrated internal-failover claim.

DS-2 — Technical / Infrastructure: Simultaneous outage of the two primary IVS VLBI data centres

Field	Detail
Scenario	Simultaneous outage of the two primary IVS VLBI data centres (Bonn and Washington).
Failed components	F2 — data transmission; F3 — archiving; F4 — VLBI analysis (blocked by data unavailability).
Alternative / mitigation	Tsukuba (Japan) data centre holds partial archives. e-VLBI transmission can be rerouted but has not been operationally tested under full-load conditions.
Common dependency	All three centres use a common e-VLBI backbone infrastructure from the same provider.
Product impact	VLBI-based UT1 determination halted. Rapid EOP products degrade to GNSS-only solutions — polar motion maintained at reduced accuracy; UT1 accuracy drops significantly.
Recovery	Partial recovery via Tsukuba within ~5 days for archived data. Real-time e-VLBI: untested alternative pathway — evidence gap.
Scenario result	PARTIAL — EVIDENCE GAP
Mandatory consequence	Evidence gap on the real-time e-VLBI failover claim prevents a Robust finding on this point — never counted as available until demonstrated.
Residual gap	Third independent data transmission pathway required; Tsukuba restore test needed; e-VLBI failover exercise required.

DS-3 — Political: Loss of GNSS analysis centre contributions from one major jurisdiction

Field	Detail
Scenario	Loss of GNSS analysis centre contributions from one major jurisdiction (e.g. US centres withdraw from IGS combination).
Failed components	F5 — GNSS analysis: JPL and NGS contributions absent.
Alternative / mitigation	CODE (Switzerland), GFZ (Germany), ESOC (France/Germany), NRCan (Canada), Wuhan (China) — five alternative centres continue.
Common dependency	Common satellite orbit models and reference frame constraints could introduce systematic effects across all centres.
Product impact	Polar motion and LOD accuracy reduced but within acceptable bounds if ≥3 remaining centres continue. No unacceptable interruption provided combination proceeds.
Recovery	Automatic — IGS combination re-weighted. Product continues within degraded-but-acceptable bounds.
Scenario result	PASSES WITH CONDITION
Mandatory consequence	Does not prevent a Robust determination; the condition (pre-quantifying systematic effects) is carried as a residual vulnerability.
Residual gap	Systematic effects of withdrawal should be pre-quantified. Formal IGS protocol for centre withdrawal needed.

DS-4 — Environmental / Infrastructure: Major earthquake or natural disaster disabling ≥30% of VLBI stations

Field	Detail
Scenario	Major earthquake or natural disaster disabling ≥30% of VLBI stations in one geographic region (e.g. Central Europe).
Failed components	F1 — Observations: European VLBI stations (Wettzell, Onsala, Noto, Yebes, Medicina, Effelsberg).
Alternative / mitigation	Remaining IVS network: East Asian, North American, Australian, African stations continue. Southern hemisphere coverage already sparse.
Common dependency	European concentrations mean geometry of global VLBI solution degrades significantly.
Product impact	VLBI solution quality degrades — formal errors on nutation parameters increase by ~40% (simulated). UT1 accuracy reduces. Polar motion GNSS-maintained at normal accuracy. Overall EOP product remains within acceptable bounds for 30-day window.
Recovery	Passes within 30-day recovery window. Beyond 30 days, sustained outage would breach requirements.
Scenario result	PASSES WITH CONDITION
Mandatory consequence	Does not prevent a Robust determination in the short term; the condition (30-day ceiling) is carried as a residual vulnerability, not resolved.
Residual gap	Southern hemisphere VLBI station gap is a systemic vulnerability. Station resilience investment needed in underrepresented regions.

DS-5 — Financial: Loss of core IERS funding from two major national contributors

Field	Detail
Scenario	Loss of core national funding from the USA and France simultaneously — the two contributors now identifiable as material once combination is correctly mapped to F6a (USNO) and F6b (SYRTE).
Failed components	F6a and F6b — combination, both tracks simultaneously; F7 — validation; F4 — some analysis centre contributions at risk.
Alternative / mitigation	No emergency funding mechanism exists at either institution. Reserve funds estimated at < 6 months operating costs.
Common dependency	Both tracks depend on their own national funding stream, but neither has a diversified or multilateral alternative — a shared structural weakness even though the funding sources themselves are distinct.
Product impact	Both combination tracks' operational capacity reduces within 3 months. Product quality and timeliness degrades on both rapid and final products simultaneously — this scenario is the one credible event that affects F6a and F6b together, unlike DS-1a/DS-1b.
Recovery	No demonstrated recovery. Dependent on intergovernmental negotiation — timeline unpredictable.
Scenario result	FAILS
Mandatory consequence	Mandatory fail — no emergency funding mechanism exists; prevents a Robust determination on its own regardless of other findings.
Residual gap	Sustainable multi-source funding mechanism required (P3, P4 sustainability). Emergency reserve funding needed.

DS-6 — Technical — Cyber: Cyber incident corrupting or making inaccessible the IERS Central Bureau

Field	Detail
Scenario	Cyber incident corrupting or making inaccessible the IERS Central Bureau data holdings and software environment.
Failed components	F6a, F6b — the IERS Central Bureau coordinates both tracks, so a Central-Bureau-level incident is one of the few credible events that could touch both jurisdictions' working datasets at once, unlike DS-1a/DS-1b; F7 — validation; F8 — dissemination.
Alternative / mitigation	Offline backups reportedly maintained — but restore procedure has not been tested operationally. Software documentation is partial.
Common dependency	Backups stored in same physical facility — not geographically independent.
Product impact	If restoration from backup succeeds within 48 hours: rapid products delayed but recoverable. If restore fails or takes > 72 hours: products lapse beyond acceptable threshold.
Recovery	Evidence gap — restoration from independent backup not demonstrated. Cannot be counted as available per quality-control rules.
Scenario result	PARTIAL — EVIDENCE GAP
Mandatory consequence	An evidence gap is never evidence of robustness (Section 13.3) — this alone is sufficient grounds for NOT YET ROBUST — EVIDENCE GAP on this point until the restore is demonstrated.
Residual gap	Geographically separate backup required; documented and tested restore procedure required; software documentation gap must be closed.

Disruption Test Summary

Scenario	Class (Section 12.1)	Result	Consequence for Determination
DS-1a	Political	PASSES WITH CONDITION	No mandatory fail — corrected from the original undivided F6's FAILS; F6a's own maturity gap and undemonstrated failover independence still carried to WP7
DS-1b	Political	PASSES WITH CONDITION	No mandatory fail — mirrors DS-1a; F6b's own gaps still carried to WP7
DS-2	Technical/Infrastructure	PARTIAL — EVIDENCE GAP	Evidence gap — cannot be counted as Robust on this point
DS-3	Political	PASSES WITH CONDITION	No mandatory fail; systematic effects to be pre-quantified
DS-4	Environmental	PASSES WITH CONDITION	Passes short-term; sustained outage would breach requirements
DS-5	Financial	FAILS	Mandatory fail — no emergency funding mechanism
DS-6	Technical — Cyber	PARTIAL — EVIDENCE GAP	Evidence gap — cannot be counted as Robust on this point

Instruments used (Section 12.4). Capture: C5, C6. Assessment: A4.

Illustrative — EOP: "loss of USNO for ten days" is traced through the WP3 map — F4/F5 analysis still arrives, but nothing combines it into Bulletin A, so rapid products lapse. The claimed continuity of final products via SYRTE is then tested against the A3 independence test between F6a and F6b: separate software build, separate data access, separate staff. Because no live cross-institution failover exercise has ever been run to confirm the two tracks share nothing operationally, the result is recorded as modelled with Low confidence — not presented as a demonstrated pass.

WP7 — Robustness Determination | Step 12

Purpose (Section 13): generates no new evidence. Applies a fixed eleven-step process (Section 13.2) to everything WP2–WP6 produced and records one auditable determination. Principles are tested separately and never averaged. Instruments: assessment A5 (principle test sheet), A6 (robustness decision record), A8 (governance requirement record). No capture instrument — if WP7 needs a fact that doesn't exist, it returns to the relevant capture instrument and records an evidence gap.

A5 — Principle Test Sheet (P1–P6)

Principle	Method Applied	Evidence Used	Finding	Reasoning / Excluded Evidence
P1 — Geographic Distribution	Geographic test, 4 checks (Annex A.6): coverage, concentration, separation, sustainment — MET only if all four pass.	Coverage: VLBI adequate in Northern hemisphere, gaps in Southern hemisphere/Africa (fails check 1). Concentration: combination capacity now split USA/France rather than 100% Paris (improves check 2 versus the original undivided F6). Separation: both jurisdictions are Western-aligned, sharing some correlated political/economic exposure though not physical infrastructure (partial pass, check 3). Sustainment: archiving has 3 funded nodes but with some political clustering (check 4, partial).	PARTIALLY MET	Excluded: WP4 maturity scores — P1 is never inferred from maturity (Annex A.6). Reasoning: check 1 alone (Southern-hemisphere coverage gap) is sufficient to prevent a full MET, independent of the combination-concentration improvement.
P2 — Political Resilience	Jurisdiction count (Annex A.7) — coordination risk and concentration risk tested and reported separately, not combined.	F6a (USNO, USA) and F6b (SYRTE, France): two jurisdictions, no unified mandate binding them together (coordination risk — confirmed present). Neither track individually has a backup in a third jurisdiction (concentration risk within each track — also present, but no longer a single-jurisdiction total dependency for the product as a whole). Tested against DS-1a/DS-1b: PASSES WITH CONDITION, not FAILS.	PARTIALLY MET — improved from the original undivided F6's NOT MET	Excluded: organisational diversity within one jurisdiction is not accepted as evidence of jurisdictional independence (unchanged control). Reasoning: this finding genuinely improves once F6 is correctly split — but see the note below the table: it does not, on its own, change the product-level determination.
P3 — Centralised Accountability through Multilateral Governance	Floor check (Annex A.8) against the Governance and Strategy domain: named accountable body, authority, funding, escalation.	IERS has clear mandate; Central Bureau provides coordination. Governance and Strategy domain capabilities scored per organisation, not per function (`capability_model_change_submission.md` Section C). Funding escalation mechanisms weak; no emergency governance protocol documented (confirmed by DS-5).	PARTIALLY MET	Mandate clear; funding resilience and escalation protocols insufficient. Governance requirement arising, recorded per C6: a binding emergency-funding escalation instrument does not currently exist.
P4 — Technical Interoperability and Data Accessibility	Floor check (Annex A.8) against Data Management and Data Products and Software domains, plus WP6 evidence that a qualified alternative can actually assume the function.	IERS standards well documented; data formats (IERS EOP C04) open. Combination software partially documented; restore not tested (DS-6, PARTIAL — EVIDENCE GAP). Cross-institution failover between F6a and F6b not demonstrated (DS-1a/DS-1b, modelled not exercised).	PARTIALLY MET	Data standards good; software documentation and tested failover absent on both tracks. An untested claim is not counted as available regardless of how sound the underlying standards are.
P5 — Minimum Capability Maturity	Floor check (Annex A.8), catch-all across every capability linked to every critical function, dimension by dimension — never a domain average.	From A2 (WP5): F6a Function Risk Score 10 (binding gap 2, People), F6b Function Risk Score 10 (binding gap 2), Real-Time Monitoring Function Risk Score 10 (binding gap 2) — all three in the High band (Annex A.9). VLBI/SLR/DORIS acquisition: 1-point gaps, Minor band.	NOT MET	Three functions carry a real, High-band maturity shortfall, and two of the three sit on capability records that aren't fully settled: F6a/F6b's Combination Processing is an open question (B.1, not yet resolved which real capability it attaches to); Real-Time Monitoring is a New Capability Request (B.2, not yet ratified). Splitting F6 did not close either gap — it clarified which jurisdiction each gap belongs to.
P6 — Transparency, Monitoring and Performance Assurance	Floor check (Annex A.8) against monitoring/assurance capabilities plus the Engagement and Collaboration domain.	Real-Time Network/Observatory Monitoring: 2/2/3/2 against required 4/4/4/4, Function Risk Score 10. IERS annual report provides some transparency; incident management not formally documented; risk register not publicly evidenced.	NOT MET	The largest single capability gap identified in the assessment, corroborated by the absence of any incident-management step surviving contact with the WP6 disruption tests (DS-2, DS-6 both evidence gaps on exactly this point).

What the corrected split changes, and what it doesn't. P2 moves from a clean NOT MET to PARTIALLY MET — a real, substantive improvement directly caused by mapping F6 accurately instead of as one institution. But per Section 3's own rule, principles are never averaged: a strong or improved result on P2 cannot compensate for P5 and P6 remaining NOT MET, or for DS-5's mandatory fail. The product-level determination does not change. This is deliberately shown rather than smoothed over — a worked example that let one corrected input flip the whole determination would misrepresent how the decision rules are meant to work.

Disruption Test Summary

Scenario	Class (Section 12.1)	Result	Consequence for Determination
DS-1a	Political	PASSES WITH CONDITION	No mandatory fail — corrected from the original undivided F6's FAILS; F6a's own maturity gap and undemonstrated failover independence still carried to WP7
DS-1b	Political	PASSES WITH CONDITION	No mandatory fail — mirrors DS-1a; F6b's own gaps still carried to WP7
DS-2	Technical/Infrastructure	PARTIAL — EVIDENCE GAP	Evidence gap — cannot be counted as Robust on this point
DS-3	Political	PASSES WITH CONDITION	No mandatory fail; systematic effects to be pre-quantified
DS-4	Environmental	PASSES WITH CONDITION	Passes short-term; sustained outage would breach requirements
DS-5	Financial	FAILS	Mandatory fail — no emergency funding mechanism
DS-6	Technical — Cyber	PARTIAL — EVIDENCE GAP	Evidence gap — cannot be counted as Robust on this point

Instruments used (Section 12.4). Capture: C5, C6. Assessment: A4.

Illustrative — EOP: "loss of USNO for ten days" is traced through the WP3 map — F4/F5 analysis still arrives, but nothing combines it into Bulletin A, so rapid products lapse. The claimed continuity of final products via SYRTE is then tested against the A3 independence test between F6a and F6b: separate software build, separate data access, separate staff. Because no live cross-institution failover exercise has ever been run to confirm the two tracks share nothing operationally, the result is recorded as modelled with Low confidence — not presented as a demonstrated pass.

PRODUCT DETERMINATION: EARTH ORIENTATION PARAMETERS

NOT YET ROBUST

Validated by: EOP Technical Product Working Group / UN-GGCE

Same overall determination as the original worked example, reached differently and more accurately. The P2 finding genuinely improves once F6 is correctly split into F6a/F6b (concentration risk in one jurisdiction becomes coordination risk across two) — a real, evidence-driven change, not a rounding difference. It does not change the product-level outcome: P5 and P6 remain independently unmet, and DS-5 remains a mandatory fail on its own. Per Section 3, principles are never averaged, so an improvement on one can't buy back a failure on another. The P5 finding also carries the same structural point as v2: both critical gaps (F6a/F6b's Combination Processing, and Real-Time Monitoring) sit on capability records with an additional, independent problem beyond the maturity numbers — one pending ratification, one an open question about which existing capability it belongs to.

A6 — Robustness Decision Record

Decision Record Field	Content
Product	Earth Orientation Parameters (EOP)
Overall status	NOT YET ROBUST
Mandatory requirements	All agreed requirements defined (WP2, A1). Rapid-product recovery threshold ratified at 5 days via the bottom-up method (Section 6.3); final-product threshold still pending formal TPWG confirmation — recorded as an evidence gap.
Critical functions	F6a (Combination, rapid, USNO) and F6b (Combination, final, SYRTE) are each individually a single point of failure on their own product track (criticality 5), in separate jurisdictions. F7 (Validation) depends on the relevant F6a/F6b provider. F8 (Dissemination) partially replicated but not operationally tested.
P1 finding	Partially met. Southern hemisphere VLBI gap is the binding failure on the geographic test (Annex A.6); combination concentration improved (two jurisdictions, not one) but does not by itself change the P1 finding.
P2 finding	Partially met — improved from Not Met. F6a (USA) and F6b (France): coordination risk confirmed (no unified mandate across the two), concentration risk reduced (no longer one jurisdiction for the whole product). Tested against DS-1a/DS-1b: PASSES WITH CONDITION, not FAILS. Jurisdiction count method: Annex A.7.
P3 finding	Partially met. Mandate and accountability clear. Funding escalation and emergency governance insufficient (Governance and Strategy domain floor check, Annex A.8).
P4 finding	Partially met. Data standards good. Software documentation and cross-institution (F6a/F6b) failover testing absent.
P5 finding	Not met. F6a and F6b: Function Risk Score 10 each (binding dimension gap 2 × criticality 5), High band (Annex A.9) — and the capability itself is an open question (B.1 — deepen `Geodetic Data Products`/`Reference Frames`, or split). Real-Time Network/Observatory Monitoring: Function Risk Score 10, High band, and pending ratification (New Capability Request B.2).
P6 finding	Not met. Monitoring, incident management and corrective action framework substantially absent (Engagement and Collaboration domain floor check).
Disruption failures	DS-5 (funding) is a mandatory fail. DS-1a, DS-1b (combination withdrawal, either jurisdiction) are PASSES WITH CONDITION — no longer mandatory fails once correctly split. DS-2 and DS-6 are evidence gaps.
Evidence gaps	DS-2 e-VLBI failover; DS-6 backup restore; F6a/F6b cross-institution independence never live-exercised; final-product recovery threshold (TPWG pending); ratification status of B.2; resolution of the open B.1 question.
Residual vulnerabilities	Southern hemisphere station gap; funding sustainability; IERS software documentation; workforce succession at both USNO and SYRTE (see also New Capability Request B.4); the F6a/F6b independence claim itself is asserted, not demonstrated.
Decision rationale	P5 and P6 are unmet, and DS-5 is a mandatory fail — any one of these is independently sufficient for NOT YET ROBUST, regardless of P2's genuine improvement. Evidence gaps (DS-2, DS-6, the untested F6a/F6b independence claim) further prevent a Robust classification on their own points. Strong performance in GNSS analysis, data standards, and the now-more-accurate P2 finding do not compensate for mandatory failures in maturity, monitoring and funding.
Validation	To be confirmed by EOP TPWG and UN-GGCE prior to final report publication.

WP8 — Investment Prioritisation | Steps 13–14

Purpose (Section 14): begins only once WP7 has produced determinations — prioritisation is driven by robustness gained, not maturity improvement for its own sake. Gap types (Section 14.1): Capability / Architecture / Governance / Combined. Priority classification (Section 14.2): 1 Continuity-critical, 2 Resilience-critical, 3 Capability-critical, 4 Sustainability-critical, 5 Improvement — an evidence gap blocking Robust at a criticality-5 function is Priority 1 on the same basis as a demonstrated failure (Section 14.1). Instrument: assessment A7.

What changed from v2. I-1 is substantively re-derived, not relabelled: the original called for establishing a second independent combination centre (a Redundant strategy, appropriate to one undivided SPOF). WP5's corrected architecture determination calls for Unique but protected instead — duplication within the 5-day threshold is impractical for either track, so the investment is succession planning and tested internal failover at the two existing institutions, not a third centre. I-4's priority also moves up: per Section 14.1, an evidence gap or open capability question at a criticality-5 function is Priority 1, and F6a/F6b are both criticality 5 with an unresolved capability question (B.1) — the original scored this Priority 2.

A7 — Investment Portfolio (EOP)

Ref	Investment	Gap Type	Principles	Failure Scenario	Consequence of Inaction	Priority	Complexity
I-1	Succession planning and tested internal failover at USNO (F6a) and SYRTE (F6b) individually — documented procedures, cross-trained staff, independent backup power/comms per institution. Not a third combination centre — WP5 determined duplication impractical within the ratified threshold.	Combined (capability + architecture)	P4, P5	DS-1a, DS-1b	Neither track has a demonstrated recovery path if its own institution is disrupted; both currently rest on individual continuity that has never been tested.	Priority 1	High
I-2	Develop and operationalise emergency cyber-restore capability — geographically separate backup, tested restore procedure, software documentation	Combined	P4, P6	DS-6	Cannot confirm backup operability at either F6a or F6b. Evidence gap blocks Robust determination.	Priority 1	Medium
I-3	Establish a sustainable, diversified multi-source funding mechanism with emergency reserve (≥12 months operating costs)	Governance	P2, P3	DS-5	Product discontinuation risk within 6 months of major funder withdrawal — the one mandatory disruption fail remaining after the F6 correction.	Priority 1	High
I-4	Resolve the open Combination Processing question (B.1) — TPWG decides between deepening `Geodetic Data Products`/`Reference Frames`'s definitions or ratifying a split — then build People and Process capability against whichever is resolved, at both F6a and F6b	Combined (capability + capability-model)	P5	DS-1a, DS-1b, DS-5	Both combination tracks are critically understaffed relative to required maturity (Function Risk Score 10 each), and neither gap can be formally closed against a capability record that isn't yet agreed. An evidence gap at a criticality-5 function is Priority 1, not 2 (Section 14.1).	Priority 1	Medium
I-5	Demonstrate the F6a/F6b independence test specified on A3 — a live exercise confirming separate software builds, data access and staff, not merely an unexercised assumption	Architecture	P2, P4	DS-1a, DS-1b	The improved P2 finding currently rests on an asserted, not demonstrated, independence claim — the single largest gap between the corrected finding and a fully evidenced one.	Priority 1	Medium
I-6	Operationalise third IVS data transmission pathway; conduct e-VLBI failover exercise	Capability	P4, P6	DS-2	VLBI data centre dual-outage causes VLBI analysis failure within 48 hours.	Priority 2	Medium
I-7	Ratify the Real-Time Network/Observatory Monitoring capability (B.2) and close the resulting gap — KPIs, incident management, risk register, corrective action, governance reporting	Combined	P6	All	No ability to detect or demonstrate resilience, and no ratified capability to score this against. P6 mandatory requirement unmet; Function Risk Score 10, High band.	Priority 2	Low
I-8	Establish independent EOP validation function — separate institution from either combination centre	Architecture	P2, P4	DS-1a, DS-1b	Validation currently shares institutional dependency with whichever track it validates — not independent.	Priority 2	Low
I-9	Investment in southern hemisphere VLBI station infrastructure and DORIS/SLR expansion	Architecture	P1	DS-4	Geographic vulnerability — regional outage degrades solution geometry significantly.	Priority 3	High
I-10	VLBI observation People and Technology improvement (VLBI Data Acquisition and Storage) — staff training, instrument upgrades at 4 key stations	Capability	P5	DS-4	Minor maturity gaps; product continues but at reduced accuracy under stress.	Priority 3	Medium
I-11	Ratify Workforce Succession and Continuity Planning (B.4) and apply it across USNO, SYRTE, and IVS/IGS analysis centres	Combined	P5	DS-5	Long-term sustainability risk to specialist workforce at both combination tracks.	Priority 4	Low
I-12	GNSS analysis centre jurisdictional diversity improvement — encourage additional centres in underrepresented regions	Architecture	P2	DS-3	Minor — current GNSS diversity adequate; improvement reduces concentration risk.	Priority 5	Low

Cross-product urgency index (Section 14.3), illustrative for I-1. A sequencing aid for Priority 1–2 items only, not a funding formula. Urgency index = normalised Function Risk Score (÷20) × number of distinct products/functions addressed. I-1 addresses two functions (F6a, F6b) at Function Risk Score 10 each, and the same combination infrastructure underpins parts of ITRF and ICRF (per the Procedure's own worked example, Section 14.4) — so if I-1 is treated as shared across EOP, ITRF and ICRF: normalised score 10/20 = 0.5 × 3 products = 1.5, higher than an equally-scored investment benefiting EOP alone (0.5 × 1 = 0.5). Presented to UN-GGCE and funders alongside, not instead of, the Priority 1–5 classification above.

WP9 — Target Architecture and Roadmap | Steps 15–18

Step 15: Repeat WP1–WP8 for all five products (shown here for EOP only). Step 16: Analyse cross-product dependencies. Step 17: Consolidate target-state architecture. Step 18: Develop implementation roadmap aligned with the Joint Development Plan.

What changed here. The original document consolidated the target state into a single 11-row "Component" table (Observation infrastructure, Data centres, Analysis centres — VLBI, Analysis centres — GNSS, Combination centre, Software/processing, Data replication/access, Governance, Workforce/succession, Funding/sustainability, Monitoring/assurance, Recovery/failover). Checked against the two primitives that already exist — Organisations & Roles, and the real capability model — four of those eleven rows turned out to just be the Organisations primitive under a different label, and six mapped onto existing or requested capabilities (capability_model_change_submission.md, Section D). Below is the same content, in two A9 (target-state architecture component) tables instead of a third invented one — updated for the corrected F6a/F6b structure.

A9 — Target-State Architecture — Organisation / Facility-Type Rollup

Facility Type	Current State	Required Robust State	Gap
Observing Stations / Networks	Multi-technique global network; southern hemisphere and Africa gaps	Geographically balanced network across ≥4 regions with minimum geometry requirements per technique	Southern hemisphere VLBI investment; DORIS/SLR expansion
Data Centres	3 nodes (Germany, USA, Japan); same-provider internet backbone for e-VLBI	≥3 independent nodes in ≥3 jurisdictions; independent transmission pathways; tested restore	Third transmission pathway; failover exercise; Tsukuba restore test
Analysis Centres — VLBI	~7 centres; 5 jurisdictions; geographically clustered	≥3 fully operational, independent centres with independent software and data	Reduce EU/US concentration; strengthen non-Western centres
Analysis Centres — GNSS	Multiple IGS centres; good diversity	Adequate — maintain and extend jurisdictional spread	Minor diversity improvement desirable
Combination Centres — Rapid (F6a)	USNO (USA) — individually a single point of failure for the rapid-product track	Protected, not duplicated: documented succession, tested internal failover, independent backup infrastructure at USNO itself	Succession planning; internal failover exercise (I-1)
Combination Centres — Final (F6b)	SYRTE (France) — individually a single point of failure for the final-product track	Protected, not duplicated: same requirements as F6a, at SYRTE	Succession planning; internal failover exercise (I-1)
Cross-track independence (F6a ↔ F6b)	Asserted separate software/data/staff; never live-exercised	Demonstrated independence per the A3 test: a real exercise confirming no shared operational dependency	Independence exercise (I-5) — the gap between the improved P2 finding and a fully evidenced one

A9 — Target-State Architecture — Capability-Domain Rollup

Capability (real, or Requested)	Current State	Required Robust State	Gap
Geodetic Software and Tools	Partially documented; backup not independently tested	Fully documented; geographically independent backup; tested restore; open-source where feasible	Documentation programme; independent backup; restore exercise
Data Preservation / Data Sharing	Partial replication; not all types fully mirrored	Complete replication across ≥3 independent nodes; all EOP-relevant data accessible independently	Replication programme; access testing
Governance and Strategy domain (Mandate, Legal Framework, Funding and Investment, Budgeting) — scored per organisation, not per function; see `capability_model_change_submission.md` Section C	Governance basis (C6): the daily EOP combination arrangement across both USNO and SYRTE rests on informal or voluntary practice — no binding instrument requires either institution to continue. Emergency funding mechanism: no defined basis.	Required governance basis: binding obligation covering continuity, escalation and emergency governance for both tracks; diversified, multi-year-committed funding with a 12-month reserve	Governance requirement (per C6, carried to WP9 synthesis): a binding continuity and access instrument covering both combination tracks — currently absent at any strength above informal practice
Workforce Succession and Continuity Planning (requested, B.4)	Specialist staff; both USNO and SYRTE understaffed relative to requirement; succession risk at each	Required PPTD achieved at both combination tracks; succession plans documented at each institution	Staff investment at both tracks; succession planning programme (I-11)
Real-Time Network/Observatory Monitoring (requested, B.2)	Partial — annual reports only	KPIs, incident management, risk register, governance reporting, corrective action	Full monitoring framework; incident management; corrective action policy (I-7)
Disaster Recovery and Supply Chain Continuity	Untested; backups not geographically independent at either track	Demonstrated failover for all critical functions; recovery tested ≥annually	Failover programme; annual exercise regime
Combination Processing — open question (B.1)	Two individually protected tracks (USNO, SYRTE), each below required maturity; not yet settled whether this scores against a deepened `Geodetic Data Products`/`Reference Frames` or a new split capability	Both tracks at required maturity, against a resolved capability record, with demonstrated cross-track independence	Succession and failover investment at each track (I-1); resolve B.1 (I-4) before maturity investment can be formally scored; demonstrate independence (I-5)

Cross-Product Dependencies — EOP Contribution

EOP is a dependency for the following other critical products. These dependencies are captured in the cross-product analysis (Step 16) and would be addressed in the consolidated target architecture (Step 17).

Dependent Product	Dependency on EOP	Shared Supply-Chain Risk
ITRF	EOP (especially UT1 and polar motion) are essential inputs to ITRF realisation and maintenance. Degraded EOP accuracy directly propagates into ITRF precision.	Common IERS institutional dependency; common VLBI infrastructure
ICRF	Nutation and precession parameters link ICRF to ITRF. EOP inconsistencies degrade ICRF–ITRF relationship.	Common VLBI observation network; common analysis software environments
Satellite Orbits	Satellite orbit determination requires EOP (especially polar motion and UT1) to convert between reference frames. Real-time satellite navigation depends on rapid EOP.	Common GNSS analysis infrastructure; common IGS data centres
Global Gravity Field	Indirect dependency — accurate reference frame maintenance requires EOP consistency for long time-series gravity analysis.	Common IERS data centres; shared workforce in specialist geodetic community

A10 — Implementation Roadmap — EOP (Illustrative Sequencing)

Success indicators are written as demonstrations, not establishments (Section 15.4) — "USNO and SYRTE each have a documented succession plan" is not a success indicator; "a live internal failover at USNO met the ratified 5-day threshold" is.

Action	Investment Ref	Priority	Owner	Indicative Timing	Dependencies	Success Indicator
Succession planning and tested internal failover at USNO and SYRTE individually	I-1	Priority 1	USNO + SYRTE + UN-GGCE	Months 1–12	Funding mechanism (I-3) should be agreed in parallel	A live internal failover exercise at each institution meets the ratified 5-day threshold
Emergency cyber-restore capability — geographically separate backup, tested restore, software documentation	I-2	Priority 1	IERS + UN-GGCE	Months 1–12	None — can proceed immediately	Documented restore procedure; tested restore within 48 hours from an independent site
Sustainable multi-source funding mechanism with 12-month reserve	I-3	Priority 1	UN-GGCE + Member States	Months 1–9	Political commitment from ≥3 major funders	Multi-year funding agreements signed; reserve account established
Resolve open Combination Processing question (B.1); staff and process investment at both F6a (USNO) and F6b (SYRTE) against whichever resolution	I-4	Priority 1	USNO + SYRTE; TPWG (resolution + any ratification)	Months 1–18	Resolution decision precedes/parallels funding (I-3)	B.1 resolved (deepened definition or ratified split); PPTD People reaches required level at both tracks; succession plans approved
Live cross-track independence exercise between F6a and F6b	I-5	Priority 1	USNO + SYRTE + UN-GGCE	Months 6–15	I-1 succession work substantially complete	Documented exercise confirms no shared software, data-access or staffing dependency between the two tracks
Third data transmission pathway and e-VLBI failover exercise	I-6	Priority 2	IVS Data Centres + UN-GGCE	Months 3–12	None	Third pathway operational; annual failover exercise completed
Ratify Real-Time Network/Observatory Monitoring (B.2); establish monitoring and assurance framework	I-7	Priority 2	UN-GGCE + IERS; TPWG (ratification)	Months 1–12	None	Capability ratified; KPI dashboard live; first annual assurance report published
Independent validation function established	I-8	Priority 2	UN-GGCE + new host institution	Months 6–18	Funding (I-3); governance decision	Validation produced by an institution independent of both F6a and F6b, on a parallel schedule
Southern hemisphere station investment — new/upgraded VLBI and DORIS stations	I-9	Priority 3	Member States + UN-GGCE	Months 18–60	Bilateral agreements; land access; funding	≥2 new stations operational in identified geographic gaps
Ratify Workforce Succession and Continuity Planning (B.4); succession programme at USNO, SYRTE and IVS/IGS centres	I-11	Priority 4	USNO + SYRTE + IVS/IGS service leads; TPWG (ratification)	Months 6–48	Institutional commitment	Capability ratified; succession plans documented at both combination tracks and all critical function providers

Instruments used (Section 15.5). Assessment: A8 (governance requirement record), A9 (target-state architecture component), A10 (roadmap action).

Illustrative — EOP: the I-1 succession-and-failover investment at USNO and SYRTE is sequenced as two Priority 1 roadmap actions, owned respectively by each institution with UN-GGCE support, dependent on the funding-sustainability action (I-3) being secured first. Their governance requirements join those generated by ITRF and ICRF for the same institutions into a single consolidated requirement in WP9's synthesis (Section 15.3): a binding continuity and access obligation covering combination functions serving multiple products, not two separate single-product instruments.

WP10 — Validation, Finalisation and Monitoring | Steps 19+

Purpose (Section 16): the last quality gate before the assessment feeds governance decisions. Adds no new analysis — structurally challenges everything already produced, including a traceability audit sampling findings back to their capture field and source (Section 16.1).

Monitoring Activity	Frequency	Owner	Output
Product requirements reassessment	Every 3 years or on major change in user requirements	EOP TPWG	Updated Requirements Specification (A1)
Capability maturity validation	Annual	UN-GGCE / capability owners	Updated maturity capture (C3) and gap assessment (A2)
Critical dependency monitoring	Quarterly	UN-GGCE	Dependency risk register update (C2)
Geographic / political independence check	Annual	UN-GGCE	Principle test sheet update (A5)
Failover and recovery exercise	Annual (minimum)	USNO + SYRTE, individually, per the Unique-but-protected strategy	Exercise report; pass/fail against the ratified 5-day threshold, at each institution
Workforce and funding sustainability review	Annual	UN-GGCE + governance	Sustainability risk register update
Incident and near-miss reporting	Continuous / reviewed quarterly	IERS Central Bureau + new assurance function	Incident log; corrective action register
Governance-level resilience reporting	Semi-annual	UN-GGCE → governance mechanism	Key Resilience Indicators dashboard
Evidence register maintenance	Continuous	Consultant / UN-GGCE	Version-controlled evidence register
Robustness re-determination	On completion of Priority 1 and 2 investments; otherwise every 3 years	EOP TPWG + UN-GGCE	Updated Robustness Decision Record
Capability model change requests	Continuous, batched for ratification at WP1 kickoff and the annual maturity validation cycle	UN-GGCE + affected TPWG(s)	Updated capability model version; see `capability_model_change_submission.md`

Closing Summary — EOP Worked Example

Question	EOP Answer (Simulated except where marked real)
What must EOP reliably deliver?	Accurate polar motion (≤0.05 mas), UT1–UTC (≤0.02 ms) and nutation/precession products on a continuous basis, rapid products within 24 hours. Recovery threshold ratified at 5 days via the real bottom-up method (Section 6.3), worked through in WP2. Long-term series continuity essential.
What does the supply chain need to look like?	Multi-technique global observation network; independent data archiving across ≥3 jurisdictions; two individually protected combination tracks in separate jurisdictions (USNO/USA, SYRTE/France — real), with demonstrated cross-track independence, not a third centre; independent validation; replicated dissemination; multilateral governance with emergency protocols.
What capabilities and maturity are required?	Twelve real capability-at-function pairs at required maturity, plus one capability pending ratification (Real-Time Network/Observatory Monitoring, B.2) and one still-open question applying to both combination tracks (Combination Processing, B.1). Critical gaps, all Function Risk Score 10 / High band (Annex A.9): F6a (binding gap 2, People), F6b (binding gap 2), Real-Time Monitoring (binding gap 2). All others Minor band, addressable via Priority 2–3 investments.
What happens when critical components are disrupted?	DS-5 (funding loss) is the one remaining mandatory fail. DS-1a/DS-1b (USNO or SYRTE withdrawal) are PASSES WITH CONDITION, not FAILS — corrected once the real jurisdictional split is mapped; the original undivided F6 could not represent this outcome. DS-2 and DS-6 remain evidence gaps. DS-3 and DS-4 are absorbed by existing diversity.
What does the P2 correction actually change?	A real, evidence-driven improvement — concentration risk in one jurisdiction becomes coordination risk across two (Annex A.7) — but not the product-level determination. Per Section 3, principles are never averaged: P5 and P6 remain independently NOT MET, and DS-5 remains a mandatory fail regardless of P2's improvement. Showing an improved principle finding that doesn't flip the outcome is deliberate — it demonstrates the decision rules working as designed, not smoothed into a single number.
What happens when a function doesn't map to any existing capability?	It doesn't get silently scored as if the capability existed (what the original worked example's `C-27`/`C-47` did) — and it doesn't get treated as a clean gap just because the label doesn't match either. A semantic check against full capability definitions runs first (`capability_model_change_submission.md`, Section A). Two real outcomes exist, both drawn from this exact EOP case: monitoring/assurance produced a clean New Capability Request (B.2). Combination did not resolve cleanly — carried forward as an open question (B.1), applying identically to both F6a and F6b. Showing both outcomes is deliberate: real TPWGs will hit both kinds.
What investments and actions are required?	Five Priority 1 investments are now mandatory for any Robust determination: (I-1) succession and internal failover at USNO and SYRTE individually — not a third centre; (I-2) backup/restore capability; (I-3) sustainable funding; (I-4) resolve the open Combination Processing question at both tracks; (I-5) a live independence exercise between F6a and F6b. Three Priority 2 investments address remaining mandatory gaps. Total portfolio: 12 prioritised actions over an indicative 1–60 month horizon.

This worked example is simulated for illustrative purposes except where marked real. All PPTD scores, expert-elicitation numbers, and modelled disruption results remain hypothetical and do not represent actual assessments of the global geodesy supply chain. What's real: the capability names and the semantic-matching process that produces B.1/B.2 (outputs/capability_model_change_submission.md); the F6a/F6b jurisdictional split, the SYRTE/USNO institutional attribution, and the resulting DS-1a/DS-1b outcome (docs/EOP_Worked_Example_Comparison_BW.md, checked against the real WA2 Annex); and the instrument names, work-package structure, and Annex A calculation method throughout, all drawn directly from ROBUSTNESS_TESTING_PROCEDURE_v1.6.docx.

ROBUST GLOBAL GEODESY SUPPLY CHAIN ​

Worked Example — Earth Orientation Parameters (EOP), v3 ​

About This Document ​

WP1 — Mobilisation and Evidence Preparation ​

WP2 — Product Requirements | Steps 1–2 ​

C1 → A1 — EOP Product Requirements Specification ​

Recovery and unacceptable-interruption thresholds — bottom-up method (Section 6.3) ​

WP3 — End-to-End Supply-Chain Mapping | Steps 3–4 ​

WP4 — Capability Mapping and Current Maturity | Steps 5–6 ​

C3 — Current Maturity Capture | Scores 1 (lowest) – 5 (highest), per Annex A.2 level definitions ​

WP5 — Required Maturity and Resilience Architecture | Steps 7–9 ​

The calculation (Annex A.4) — worked once, in full, before the table ​

A2 — Capability Gap Assessment ​

A3 — Resilience Architecture Determination | Steps 8–9 ​

WP6 — Disruption Scenario Testing | Steps 10–11 ​

DS-1a — Organisation / Political: Withdrawal of USNO (F6a, rapid products) ​

DS-1b — Organisation / Political: Withdrawal of SYRTE (F6b, final products) ​

DS-2 — Technical / Infrastructure: Simultaneous outage of the two primary IVS VLBI data centres ​

DS-3 — Political: Loss of GNSS analysis centre contributions from one major jurisdiction ​

DS-4 — Environmental / Infrastructure: Major earthquake or natural disaster disabling ≥30% of VLBI stations ​

DS-5 — Financial: Loss of core IERS funding from two major national contributors ​

DS-6 — Technical — Cyber: Cyber incident corrupting or making inaccessible the IERS Central Bureau ​

Disruption Test Summary ​

WP7 — Robustness Determination | Step 12 ​

A5 — Principle Test Sheet (P1–P6) ​

Disruption Test Summary ​

PRODUCT DETERMINATION: EARTH ORIENTATION PARAMETERS ​

NOT YET ROBUST ​

A6 — Robustness Decision Record ​

WP8 — Investment Prioritisation | Steps 13–14 ​

A7 — Investment Portfolio (EOP) ​

WP9 — Target Architecture and Roadmap | Steps 15–18 ​

A9 — Target-State Architecture — Organisation / Facility-Type Rollup ​

A9 — Target-State Architecture — Capability-Domain Rollup ​

Cross-Product Dependencies — EOP Contribution ​

A10 — Implementation Roadmap — EOP (Illustrative Sequencing) ​

WP10 — Validation, Finalisation and Monitoring | Steps 19+ ​

Closing Summary — EOP Worked Example ​

ROBUST GLOBAL GEODESY SUPPLY CHAIN

Worked Example — Earth Orientation Parameters (EOP), v3

About This Document

WP1 — Mobilisation and Evidence Preparation

WP2 — Product Requirements | Steps 1–2

C1 → A1 — EOP Product Requirements Specification

Recovery and unacceptable-interruption thresholds — bottom-up method (Section 6.3)

WP3 — End-to-End Supply-Chain Mapping | Steps 3–4

WP4 — Capability Mapping and Current Maturity | Steps 5–6

C3 — Current Maturity Capture | Scores 1 (lowest) – 5 (highest), per Annex A.2 level definitions

WP5 — Required Maturity and Resilience Architecture | Steps 7–9

The calculation (Annex A.4) — worked once, in full, before the table

A2 — Capability Gap Assessment

A3 — Resilience Architecture Determination | Steps 8–9

WP6 — Disruption Scenario Testing | Steps 10–11

DS-1a — Organisation / Political: Withdrawal of USNO (F6a, rapid products)

DS-1b — Organisation / Political: Withdrawal of SYRTE (F6b, final products)

DS-2 — Technical / Infrastructure: Simultaneous outage of the two primary IVS VLBI data centres

DS-3 — Political: Loss of GNSS analysis centre contributions from one major jurisdiction

DS-4 — Environmental / Infrastructure: Major earthquake or natural disaster disabling ≥30% of VLBI stations

DS-5 — Financial: Loss of core IERS funding from two major national contributors

DS-6 — Technical — Cyber: Cyber incident corrupting or making inaccessible the IERS Central Bureau

Disruption Test Summary

WP7 — Robustness Determination | Step 12

A5 — Principle Test Sheet (P1–P6)

Disruption Test Summary

PRODUCT DETERMINATION: EARTH ORIENTATION PARAMETERS

NOT YET ROBUST

A6 — Robustness Decision Record

WP8 — Investment Prioritisation | Steps 13–14

A7 — Investment Portfolio (EOP)

WP9 — Target Architecture and Roadmap | Steps 15–18

A9 — Target-State Architecture — Organisation / Facility-Type Rollup

A9 — Target-State Architecture — Capability-Domain Rollup

Cross-Product Dependencies — EOP Contribution

A10 — Implementation Roadmap — EOP (Illustrative Sequencing)

WP10 — Validation, Finalisation and Monitoring | Steps 19+

Closing Summary — EOP Worked Example