Appearance
Satellite Orbits (GNSS) Production Workflow
This supply chain map covers the production of the Satellite Orbits Essential Geodetic Variable (EGV) — a Level 2 EGV in the GGOS framework — specifically the GNSS precise orbit and clock determination process managed by the International GNSS Service (IGS).
EGV Classification: Level 2 · Global · Geometric
Contributing products: GNSS Satellite Orbits (GSO), GNSS Satellite Clocks (GSC), Earth Observation Satellite Orbits (ESO)
Downstream consumers: This pipeline is a Primary or Important input to 10 of 14 Level 3 EGVs — including Global Reference Frames (ITRF), Sea Level, Ice Sheets, Terrestrial Water Storage, and Atmosphere. See EGV_Product_Mapping.md for the full dependency matrix.
Co-produced EGVs: The same Tier 2–3 processing simultaneously produces Station Positions and Variations (Level 2), Integrated Water Vapour and Global Ionosphere Maps (Atmosphere, Level 3 inputs), and Earth Orientation Parameter contributions. The Tier 3 bottleneck identified below is a multi-EGV resilience gap — a disruption simultaneously degrades Satellite Orbits, Station Positions, IWV, GIM, and EOP inputs.
Diagram 1: Governance Context
Where this pipeline sits in the international governance hierarchy. Shows the authoritative flow from policy to operational committees, with oversight and validation roles.
Current gaps against v2 Principles:
- Principle 3 (Centralized Accountability through Multilateral Governance): The IGS Governing Board has no formal multi-stakeholder representation for the private sector or space agencies as governance actors. IAG coordinates science through GGOS but has no formal seat at IGS operational governance. There is no single formally designated body accountable for supply chain reliability — the UN-GGCE currently holds only observer status.
- Principle 6 (Transparency & Accountability): IERS validates products but there is no formal SLA monitoring loop reporting back to UN-GGCE or GGOS. UN-GGCE's current observer status limits its ability to enforce JDP Objective 1.1 requirements.
Diagram 2: Full Pipeline Overview
Five-tier pipeline from satellite signals to end users. Subgraph titles show the EGV data level at each tier boundary.
Risk key: ■ High Risk ■ Medium Risk ■ Secure
Diagram 3: Tier 2–3 Detail and Contingency Path
Named institutions and software at the critical analysis and combination tiers. Shows the structural vulnerability and potential failover paths highlighted by the 2013 and 2018–2019 U.S. government shutdowns.
Contingency status: The inclusion of NRCan/ESA represents a theoretical failover path (often cited due to historical conflation with RTS launch), but it is not a governed protocol. No SLA, MoU, trigger criteria, or regular rehearsal exists to enact an emergency ACC handover. This structural vulnerability directly conflicts with v2 Principle 2 (Political Resilience and Distributed Operational Control) and JDP Objective 1.1. Formalising a designated, exercised, SLA-backed backup protocol is a prerequisite for the ACC/SPOCC tier to meet the resilience standard required by Principle 3 (Centralized Accountability through Multilateral Governance).
Risk Assessment
Tier 0 — Medium Risk
First-mile telemetry from observatories to Operational Data Centers (ODCs) lacks redundant upload paths at many sites. The three ODCs (GFZ/Germany, CNES REGINA/France, NGS-NOAA/USA) are all in the northern hemisphere — a geographic concentration that is not noted in current operational risk registers but conflicts with Principle 1 (Geographic Distribution). PPTD score: 4.0 (GNSS Data Acquisition and Storage — the strongest tier by maturity).
Tier 1 — Medium Risk (with systemic qualifications)
The three Global Data Centers use a data equalization protocol that maintains synchronized archives across three jurisdictions (USA, France, USA). This provides resilience against a single-site outage. However, the 2018–2019 U.S. shutdown demonstrated that data gaps occur at the ODC/RDC level before data reaches the GDCs — equalization cannot recover data that was never uploaded. While the final orbit products survived the 2018 shutdown intact (proving the value of AC redundancy), the "zero-data-loss failover" description is only accurate for GDC-level failures; ODC-level failures upstream create gaps that propagate through. PPTD score: Network Operations 2.25 ⚠, Data Preservation 2.0 ⚠. The Technology dimension of Network Operations scores 1.0 — the single weakest score in the pipeline.
Tier 2 — Medium Risk (Algorithmic diversity offset by key-person fragility)
Software diversity across codebases (GipsyX, Bernese, NAPEOS, EPOS.P8, PANDA) effectively eliminates the algorithmic single-point-of-failure risk. However, long-term maintenance of these niche scientific codebases relies on key-person expertise within academic teams. Loss of institutional knowledge constitutes the highest long-term threat at this tier. PPTD score: 3.75 (GNSS Data Processing and Analysis), but the Process dimension scores at 3 — succession planning is not formalised. JDP Objective 1.4 directly applies.
Tier 3 — High Risk / Critical Bottleneck ⚠
The ACC (GA/MIT, transitioning to GA/NASA GSFC) operates SPOCC — a Python-based combination engine developed by GFZ and deployed by the ACC on AWS. GFZ wrote the software and retains deep architectural knowledge; the ACC runs it. SPOCC is listed as a proprietary tool; no open-source community or independent reimplementation exists.
Three distinct risks converge here:
- No formal backup ACC. No designated successor if GA or its partner withdraws. The 2013 ad hoc response (NRCan + ESA/ESOC) has never been formalised or rehearsed.
- Proprietary software knowledge at GFZ. A major software failure requires GFZ involvement regardless of who operates the combination. Key-person risk at GFZ (Männel/Zajdel/Mansur) has no documented succession.
- ACC transition reintroduces U.S. political risk. The move from GA/MIT to GA/NASA GSFC (targeting late 2025) replaces MIT with a U.S. federal agency — precisely the category of partner disrupted in 2013 and 2018–19. The GA/MIT structure partially mitigated this; GA/GSFC does not.
Historical evidence:
- 2013 U.S. Shutdown: The ACC (then solely at NOAA/NGS) faced significant administrative disruption. While core products continued through automated scripts and minimal personnel (IGSMAIL-6826), the NGS/ACC failed to submit its annual report to the technical record.
- 2018–19 U.S. Shutdown: (35 days) caused CDDIS access gaps (contemporaneous alerts: IGSMAIL-7566), but the final global orbit products were not degraded because the ACC was safely hosted outside the U.S. (GA/MIT). Moving the ACC back into a U.S. federal agency negates the resilience proven in 2018.
Systemic Administrative Fragility: Longitudinal review of IGS Technical Reports (2013, 2018) shows consistent reporting failures across Global Data Centers (SIO, IGN, KASI) and critical Working Groups (Clock Products, Orbit Dynamics, Reference Frame). This is a direct manifestation of the low maturity (2.3) in Network Operations and a critical gap in Global Network Monitoring.
Tier 4 — Not Currently Governed
Product validation (IERS) and distribution exist operationally but are not governed by SLAs, performance targets, or public accountability mechanisms. This tier has no formal home in the current risk register. Principle 6 and JDP Objective 1.1 require formal performance monitoring and reporting at this tier.
JDP Alignment
| Pipeline Element | Current State | Gap | JDP Objective |
|---|---|---|---|
| CB hosting at NASA JPL | No MoU; best-effort hosting arrangement | Sole institutional host with no formal agreement | 1.1 — SLAs and MoUs for all critical functions |
| ACC operational agreement (GA + MIT) | Informal coordination; no SLA | Two-person dependency with no formal continuity plan | 1.1 — Formalized long-term operational agreements |
| NRCan/ESA contingency failover | Theoretical failover path, unrehearsed | Not a governed protocol; no trigger criteria defined | 1.1 — Formal backup agreements |
| Global Network Monitoring | Inconsistent administrative reporting (2013/2018) | Persistent reporting gap at GDCs and WGs | 1.1 — Network Operations & Monitoring maturity |
| ODC/RDC geographic distribution | All ODCs in northern hemisphere | No southern hemisphere primary archiving path | 1.2 — Regional hubs in under-represented regions |
| GDC equalization (CDDIS, IGN, SIO) | Active synchronization across 3 jurisdictions | CDDIS and SIO both in USA — only 2 political jurisdictions | 1.2 — Political distribution of critical functions |
| FAIR compliance and ISO Geodetic Register | RINEX format widely adopted; ISO register not linked | Interoperability standards not formally assessed | 1.2 — FAIR data principles and ISO Geodetic Register |
| Tier 2 software maintenance | Academic teams, no guaranteed funding continuity | Key-person risk with no succession or succession funding | 1.3 — Formalized national backing for critical capabilities |
| CB Director (Léo Martire) | Permanent Director confirmed 2026-04-16 | Succession gap resolved | 1.4 — Mandated succession planning ✓ |
| ACC personnel (Masoumi, Herring) | No documented succession plan identified | Two individuals accountable for global critical-path function | 1.4 — Continuous knowledge transfer |
| SPOCC architecture (Männel, Zajdel, Mansur) | GFZ institutional knowledge; no formal continuity program | Core engine understood by ~3 people | 1.4 — Succession planning for specialized expertise |
| Tier 4 performance monitoring | IERS validates products operationally | No SLA-based monitoring or public reporting cycle | 1.1 — Transparent accountability mechanisms |
Stakeholder Accountability Matrix
| Individual | Institution | Role | Tier | P | Pr | T | D | Succession |
|---|---|---|---|---|---|---|---|---|
| Léo Martire | NASA JPL | CB Director — governance, standards, multilateral coordination | Overall | 3 | 2 | 1 | 3 | Confirmed permanent 2026-04-16 ✓ |
| Robert Khachikyan | NASA JPL | CBIS Manager — station metadata registry | Overall | 3 | 2 | 1 | 3 | Not documented |
| Markus Bradke | GFZ | IC Chair — infrastructure strategy | T0, T1 | 2 | 3 | 1 | 3 | Not documented |
| Ryan Ruddick | Geoscience Australia | IC Vice-Chair — cross-tier coordination | T0, T1 | 2 | 3 | 1 | 3 | Not documented |
| David Maggert | EarthScope | IC Network Coordinator — Tier 0 observatory network | T0 | 2 | 3 | 1 | 3 | Not documented |
| Ignacio Romero | ESA/ESOC | RINEX standards lead — data interoperability | T0→T1 | 2 | 3 | 1 | 3 | Not documented |
| Benjamin P. Michael | NASA GSFC | GDC / CDDIS Coordinator — Tier 1 archiving standards | T1 | 2 | 2 | 2 | 2 | Not documented |
| Salim Masoumi | Geoscience Australia | ACC Co-Lead — daily combination operations | T3 | 4 | 4 | 3 | 4 | Not documented ⚠ |
| Tom Herring | MIT | ACC Co-Lead — daily combination operations | T3 | 4 | 4 | 3 | 4 | Not documented ⚠ |
| Benjamin Männel | GFZ | SPOCC Project Lead | T3 | 4 | 4 | 3 | 4 | Not documented ⚠ |
| Radoslaw Zajdel | GFZ / Wrocław | SPOCC Orbit architecture | T3 | 4 | 4 | 3 | 4 | Not documented ⚠ |
| Ghazal Mansur | GFZ | SPOCC Clock/VCE architecture | T3 | 4 | 4 | 3 | 4 | Not documented ⚠ |
PPTD scores are proxied from the nearest capability matrix entry (GNSS Data Processing and Analysis avg 3.75 for T2/T3; Network Operations avg 2.25 for T0/T1; Metadata Management avg 2.25 for CB). ⚠ = succession gap explicitly flagged. All individuals are from USA, Europe, or Australia — no representation from Africa, Latin America, South/Southeast Asia, or the Global South. This conflicts directly with v2 Principle 1 (Geographic Distribution for Technical Performance) and Principle 3 (Centralized Accountability through Multilateral Governance).
Glossary of Acronyms
| Acronym | Full Name |
|---|---|
| AC | Analysis Center |
| ACC | Analysis Center Coordinator |
| BKG | Federal Agency for Cartography and Geodesy (Germany) |
| CB | Central Bureau (IGS) |
| CBIS | Central Bureau Information System |
| CDDIS | Crustal Dynamics Data Information System (NASA, USA) |
| CNES | Centre National d'Etudes Spatiales (France) |
| CODE | Center for Orbit Determination in Europe (Switzerland) |
| EGV | Essential Geodetic Variable |
| ESA | European Space Agency |
| ESOC | European Space Operations Centre (ESA, Germany) |
| GA | Geoscience Australia |
| GDC | Global Data Center |
| GFZ | German Research Centre for Geosciences |
| GGOS | Global Geodetic Observing System (IAG) |
| GNSS | Global Navigation Satellite System |
| GSFC | Goddard Space Flight Center (NASA, USA) |
| IAG | International Association of Geodesy |
| IC | Infrastructure Committee (IGS) |
| IERS | International Earth Rotation and Reference Systems Service |
| IGN | Institut National de l'Information Géographique et Forestière (France) |
| IGS | International GNSS Service |
| ITRF | International Terrestrial Reference Frame |
| JPL | Jet Propulsion Laboratory (NASA, USA) |
| KASI | Korea Astronomy and Space Science Institute |
| MIT | Massachusetts Institute of Technology (USA) |
| NASA | National Aeronautics and Space Administration (USA) |
| NGS | National Geodetic Survey (USA) |
| NRCan | Natural Resources Canada |
| NOAA | National Oceanic and Atmospheric Administration (USA) |
| ODC | Operational Data Center |
| PPTD | People, Process, Technology, and Data |
| RDC | Regional Data Center |
| RINEX | Receiver Independent Exchange Format |
| SIO | Scripps Institution of Oceanography (USA) |
| SOPAC | Scripps Orbit and Permanent Array Center (USA) |
| SPOCC | Software for Precise Orbit and Clock Combination |
| UN-GGCE | United Nations Global Geodetic Centre of Excellence |