Prepared by GOCE Flight Control Team (HSO-OEG)

ESA UNCLASSIFIED – For Official Use

Prepared by GOCE Flight Control Team (HSO-OEG) Reference GO-RP-ESC-FS-6268 Issue 1 Revision 0 Date of Issue 07/02/2014 Status Authorised Document Type RP Distribution

ESA UNCLASSIFIED – For Official Use

Title GOCE End-of-Mission Operations Report Issue 1 Revision 0 Author GOCE Flight Control Team (HSO-OEG) Date 07/02/2014 Approved by

Christoph Steiger (HSO-OEG) GOCE Spacecraft Operations Manager

Nic Mardle (HSO-OEE) Head of Earth Explorers Management Office

Pier Paolo Emanuelli (HSO-OE) Head of Earth Observation Missions Division

Reason for change Issue Revision Date Document created 1 0 07/02/2014

Issue 1 Revision 0 Reason for change Date Pages Paragraph(s)

Page 2/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

EXECUTIVE SUMMARY

ESA’s Gravity Field and Steady-state Ocean Circulation Explorer (GOCE) mission, operated by ESOC, was characterised by a mission profile and S/C design much different from previous ESA Earth observation missions, with the S/C built for an atmospheric drag environment at very low altitudes and employing a sophisticated drag-free control system. Main mission phases and operational events (Figure 1): LEOP and commissioning: launch on 17/03/2009, S/C commissioning, orbit lowering from 283 km to 260 km mean altitude. Routine operations phase: measurement phase at 260 km from Sept 2009 to July 2012, with substantial anomalies on the central computer – failure of prime central computer and major telemetry downlink anomaly on the redundant side. Low orbit operations campaign 2012-2013: lowering of the orbit to 229 km mean altitude for maximising the scientific return. Re-entry operations Oct/Nov 2013: following fuel depletion, S/C operations proceeded in the ensuing decay phase up to shortly before re-entry into the atmosphere on 11/11/2013. GOCE has been an operationally challenging mission. An exceptional number of in-flight anomalies required extensive recovery activities, with many unusual operations activities necessary. This culminated in the recovery from the telemetry loss anomaly in summer 2010, requiring to operate the S/C “in the blind” for almost two months. With these difficulties overcome and having completed a scientifically very successful mission at 260 km altitude, a major redesign of the operations concept was performed to allow lowering the orbit by another 30 km –flying GOCE lower than what had ever been planned–, with a wide range of special measures put in place to guarantee S/C safety under the higher drag levels encountered. The mission ended with the re-entry operations campaign, when S/C and ground segment remained functional down to little over 100 km altitude, less than 1.5 hours before the re-entry.

Figure 1: GOCE altitude profile 2009-2013

Page 3/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Table of contents:

EXECUTIVE SUMMARY ...... 3 1 INTRODUCTION ...... 9 1.1 Purpose and Scope ...... 9 1.2 Contents ...... 9 1.3 Applicable Documents ...... 10 1.4 Reference Documents ...... 10 1.5 List of Acronyms ...... 12 2 GOCE MISSION OVERVIEW ...... 15 2.1 Launch and Early Orbit Phase (17-20/03/ 2009) ...... 15 2.2 Commissioning (Mar 2009 – Sep 2009) ...... 16 2.3 Routine Phase at 259.6 km (Oct 2009 – Jul 2012) ...... 18 2.4 Low Orbit Operations Campaign (Aug 2012 – Oct 2013) ...... 21 2.5 De-orbiting and Re-entry (Oct/Nov 2013) ...... 25 3 SPACECRAFT OPERATIONS ...... 28 3.1 LEOP and Commissioning ...... 28 3.2 Routine Operations Setup ...... 31 3.3 Major Contingency Operations ...... 32 3.3.1 Safe Modes and Fallbacks ...... 32 3.3.2 Failure of Prime Central Computer (CDMU-A) ...... 35 3.3.3 TM Loss Anomaly ...... 38 3.3.4 SSTI State Vector Anomaly ...... 42 3.4 Low Orbit Operations Campaign ...... 44 3.5 De-orbiting Operations Campaign ...... 50 3.6 OBSM, OBCPs and Mission Planning ...... 57 3.6.1 On-board Software Maintenance ...... 57 3.6.2 On-board Control Procedure (OBCP) Maintenance ...... 59 3.6.3 Mission Planning ...... 59 3.7 Operational Documentation and Database ...... 61 3.7.1 Spacecraft Database ...... 61 3.7.2 Flight Operations Plan (FOP) ...... 61 4 SPACE SEGMENT ...... 63 4.1 Drag-free Attitude and Orbit Control System (DFACS) ...... 63 4.1.1 DFACS Overview ...... 63 4.1.2 DFACS Activities, Events, Performance ...... 66 4.1.3 Star Trackers (STR) ...... 75 4.1.4 Digital Sun Sensor (DSS) ...... 78 4.1.5 Coarse Earth Sun Sensor (CESS) ...... 78 4.1.6 Magnetic Torquers (MTR) ...... 79 4.1.7 Magnetometers (MGM) ...... 79 4.1.8 Ion Propulsion Assembly (IPA) ...... 80 4.1.9 Gradiometer Calibration Assembly (GCA) ...... 86 4.2 Data Handling ...... 90 4.3 Electrostatic Gravity Gradiometer (EGG) ...... 94 4.4 Satellite-to-Satellite Tracking Instrument (SSTI) ...... 99 4.5 Power ...... 104 4.6 Thermal ...... 110 4.7 Radio Frequency Subsystem ...... 115 5 GROUND SEGMENT ...... 117 5.1 Flight Operations Segment Overview...... 117 5.2 Flight Control Team (FCT) ...... 119 5.2.1 FCT Setup and Evolution ...... 119

Page 4/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

5.2.2 Auxiliary Tools used by the FCT...... 120 5.3 Flight Dynamics ...... 122 5.3.1 Overview ...... 122 5.3.2 Special operations ...... 123 5.3.3 Bookkeeping for on-board consumables ...... 123 5.3.4 Mission analysis work after launch ...... 125 5.4 Stations and Facilities ...... 127 5.4.1 Ground Stations ...... 127 5.4.2 Facilities, Computers and Communications ...... 132 5.5 Mission Data Systems ...... 135 5.5.1 Mission Control System ...... 135 5.5.1.1 Overview ...... 135 5.5.1.2 GOMCS components ...... 135 5.5.1.3 GOMCS system support after launch ...... 136 5.5.1.4 Timeline of GOMCS ...... 136 5.5.1.5 Special MCS activities ...... 136 5.5.1.6 Other relevant activities ...... 137 5.5.1.7 GOMCS performance and anomalies ...... 138 5.5.2 Simulator ...... 139 5.6 Space Debris Office (SDO) Support ...... 140 ANNEXES ...... 142 A.1 List of GOCE Spacecraft Anomaly Reports ...... 142 A.2 List of GOCE-related publications ...... 144 A.3 Mission Calendar ...... 145

Page 5/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

List of Figures:

Figure 1: GOCE altitude profile 2009-2013 3 Figure 2: The GOCE spacecraft 9 Figure 3: Main flow of activities in LEOP 15 Figure 4: Mean altitude and key events throughout commissioning in 2009. 16 Figure 5: Originally planned altitude profile and corresponding eclipse durations for launch in Sept 2008 18 Figure 6: Altitude and eclipse pattern from launch up to July 2012. 19 Figure 7: IPA thrust in routine operations to compensate the air drag. 19 Figure 8: Altitude profile and thrust averaged over one orbit during the low orbit operations campaign. 22 Figure 9: Evolution of the F10.7 index from 2000 to 2013 (red line is a prediction). 22 Figure 10: Average daily thrust to compensate the drag compared to the daily solar and geomagnetic activity indices 23 Figure 11: Thrust during a strong geomagnetic storm on 01/06/2013 with the S/C at 229 km mean altitude. 23 Figure 12: Drag level on 10/11/2013, the last day of operations. 26 Figure 13: Evolution of mean altitude during de-orbiting 26 Figure 14: GOCE re-entry location. COIW is the Center of Impact Window (S/C at 80 km altitude). 27 Figure 15: GOCE re-entry captured from the Falkland Islands by Bill Chater on 11/11/2013 at 00:16 UTC. 27 Figure 16: Altitude profile and ion propulsion thrust around the safe mode of June 2012, 33 Figure 17: Altitude profile and ion propulsion thrust in Feb/Mar 2010 36 Figure 18: CDMU overview. 38 Figure 19: Principle of orbit raise during the TM loss anomaly 39 Figure 20: Altitude profile and main events during the TM loss anomaly July-October 2010 39 Figure 21: Check of essential SW TM parameters using PUS Services 12 and 19. 40 Figure 22: Downlink of SW-generated telemetry packets byte-wise in a register reported in HPTM 40 Figure 23: Increasing attitude errors in DFM_FINE following corruption of the SSTI state vector. 42 Figure 24: Orbital position delivered by SSTI-A (SST03263/4/5) and SSTI-B (SST13263/4/5) 42 Figure 25: Decay reference profiles for starting altitudes of 251km, 244.6km, 239.6km 44 Figure 26: Available thrust depending on eclipse duration (pre-launch vs. revised power budget). 45 Figure 27: Evolution of Time Offset Value (TOV) at the Kiruna station depending on average drag encountered. 47 Figure 28: Altitude profile for the low orbit operations campaign. 48 Figure 29: Mean altitude and IPA thrust during a fallback to FPM in August 2013. 48 Figure 30: Simulated evolution of Time Offset Value (TOV) 51 Figure 31: Evolution of TOV over 10 days for the medium solar activity case at altitudes of 180 to 230 km 51 Figure 32: Daily F10.7 and Ap indices during deorbiting. 54 Figure 33: Evolution of the Time Offset Value (TOV) measured at Kiruna during deorbiting. 54 Figure 34: Drag during de-orbiting operations 55 Figure 35: Difference in KSAT station AoS times between data based orbit determination of 30/10/2013 55 Figure 36: Kiruna passes during deorbiting with a duration of > 3.5 min above 5 deg elevation. 56 Figure 37: GOCE mission planning approach at the beginning of the mission 59 Figure 38: GOCE mission planning approach after introduction of the processing scripts in 2010 60 Figure 39: Usage of sensors and actuators in the various DFACS modes. 64 Figure 40: DFACS modes and mode transition logic. 65 Figure 41: Instantaneous IPA thrust over a period of 24 hours starting on 01/03/2011. 65 Figure 42: Time spent in each DFACS mode throughout the mission. 67 Figure 43: S/C attitude error at CPM entry for select cases. 68 Figure 44: Time spent in the CPM phases for rate damping, sun and Earth acquisition. 68 Figure 45: Increasing attitude error around the S/C Z-axis (yaw) after launch 69 Figure 46: Attitude error around the S/C Z-axis (yaw) over 1 orbit at various stages during deorbiting 69 Figure 47: Attitude control performance in DFM_FINE 70 Figure 48: One-sided spectral density of linear and angular accelerations in DFM_FINE. 71 Figure 49: Attitude errors during DFACS mode transitions from FPM to DFM_FINE. 72 Figure 50: Altitude manoeuvres in DFM_FINE in 2011. 72 Figure 51: IPA demanded and delivered thrust vs. observed linear acceleration during geomagnetic storm (I) 73 Figure 52: IPA demanded and delivered thrust vs. observed linear acceleration during geomagnetic storm (II) 74 Figure 53: Star tracker mounting on floor 4 of the S/C. 75 Figure 54: Angle between STR boresight and the Earth limb depending on the altitude. 76 Figure 55: Schematic of the QinetiQ T5 MkV Kaufman-Type Electron Bombardment Thruster. 80 Figure 56: IPA thrust averaged over 1 orbit throughout the mission. 81 Figure 57: IPA restarts over time (above), number of IPA restarts each year (below). 82 Figure 58: Plots of key IPA-A parameters. 83 Figure 59: Number of beam outs per year for IPA-A. 84

Page 6/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 60: “Noisy” thrust [microN] in three orbits of drag-free operations on 20/10/2013. 84 Figure 61: Pressures in the high (HPT) and low (LPT) pressure section of the IPA in the final days of IPA operations. 85 Figure 62: Block diagram of the Gradiometer Calibration Device (GCD). 87 Figure 63: Evolution of pressure in the low pressure section of the GCD throughout the mission. 88 Figure 64: Evolution of pressure in the high pressure section of the GCD throughout the mission. 88 Figure 65: Weekly nitrogen consumption throughout the mission. The GCA was only used for ICM calibrations. 89 Figure 66: CDMU architecture (units nominally powered on are highlighted). 90 Figure 67: Illustration of approach used for applying PASW patches in EEPROM (active patch chain highlighted). 92 Figure 68: PASW version and chains of patches. 93 Figure 69: Electrostatic Gravity Gradiometer. 94 Figure 70: Drag levels during 2 orbits on 08/11/2013 derived from EGG linear acceleration measurements. 95 Figure 71: SSTI functional block diagram. 99 Figure 72: SSTI-A propagation events throughout the mission. 100 Figure 73: Daily number of SSTI propagation events during de-orbiting from 21/10/2013 to 10/11/2013. 101 Figure 74: Weekly number of SSTI-A and SSTI-B propagation events in Oct/Nov 2013. 101 Figure 75: Daily number of SSTI PDOP high events during de-orbiting from 21/10/2013 to 10/11/2013. 102 Figure 76: Weekly number of SSTI-A and SSTI-B PDOP high events in Oct/Nov 2013. 102 Figure 77: Overview of on-board consumers (“GOCE loads”). 104 Figure 78: GOCE loads (i.e. power consumption by S/C units) over the mission. 105 Figure 79: Eclipse duration over the mission. 106 Figure 80: Power consumption on 21/10/2013, the last day of drag-free operations. 106 Figure 81: GOCE in-flight power budget comparison 107 Figure 82: Thrust demand vs. IPA power consumption. Left based on in-flight TM, right provided by industry. 108 Figure 83: GOCE battery-provided power over the mission. 108 Figure 84: GOCE Total PCU Output Power over the mission. 109 Figure 85: Example of a heater group. 110 Figure 86: GOCE thermal control algorithm. 111 Figure 87: Erroneous temperature readings from thermistor THT10005 on 19/04/2012. 113 Figure 88: Evolution of temperatures in the last two days of flight . 114 Figure 89: Location of S-band low gain antenna. 115 Figure 90: Overview of the GOCE Flight Operations Segment (FOS) at ESA/ESOC. 117 Figure 91: Estimated Xenon mass and weekly consumption throughout the entire mission. 124 Figure 92: Amount of Xenon left in the tank in 2013 as per the PVT method and the integration method. 124 Figure 93: Atmospheric density prediction based on MSISE00 model and March 2012 MSFC bulletin. 125 Figure 94: Evolution of altitude, density and drag force for the 2-days decay scenario starting from 239.6 km 126 Figure 95: Reconstituted density based on MSISE00 model, actual solar activity indices and actual GOCE orbit 126 Figure 96: ESTRACK network. The stations with the red name tags were used by GOCE. 127 Figure 97: Layout of GOCE machines in the Earth Observation DCR (E39) in 2013. 133 Figure 98: GOCE MCS setup 135 Figure 99: Filter window for the Dual PM MCS, allowing to select from which processor module the TM is displayed 137 Figure 100: Main components of the SIMSAT-based GOCE simulator. 139 Figure 101: Final GOCE re-entry prediction of the ESOC Space Debris Office. 141

Page 7/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

List of Tables:

Table 1: Overview of main events leading to an interruption of science operations 20 Table 2: Actors, roles and responsibilities in LEOP 29 Table 3: Example of daily station contacts during routine operations. 31 Table 4: Overview of safe modes and fallbacks 2009-2013. 34 Table 5: Overview of S/C operations during deorbiting 53 Table 6: List of On-board Software Maintenance (OBSM) activities 58 Table 7: FOP issues produced since launch 62 Table 8: S/C rates at CPM entry in the course of the mission. 67 Table 9: Minimum duration and FDIR timeout for CPM phases 67 Table 10: STR images captured during de-orbiting operations. 76 Table 11: Usage of IPA-A and IPA-B throughout the mission. 82 Table 12: Boot-dependent flags in safeguard memory. 91 Table 13: Commanding statistics (numbers are approximate) 92 Table 14: Thresholds for HW DNEL and SW DNEL (FDIR on battery status). 104 Table 15: Nominal TMT of the TCS software. 112 Table 16: RF-related OBCPs modified/created by the Flight Control Team. 116 Table 17: Overview of ground station coverage throughout the mission. 129 Table 18: List of machines used by GOCE, status as per Oct 2013. 133 Table 19: GOMCA disk overview at end of mission 138 Table 20: List of top 5 critical/urgent GOMCS anomalies sorted by date. 138

Page 8/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

1 INTRODUCTION

1.1 Purpose and Scope This document constitutes the end-of-mission operations report for ESA’s Gravity Field and Steady-state Ocean Circulation Explorer GOCE (Figure 2). Launched on 17/03/2009, GOCE depleted the fuel for its ion propulsion system on 21/10/2013 and re-entered the Earth’s atmosphere on 11/11/2013. This report covers all aspects of GOCE mission operations performed by ESA/ESOC throughout the mission.

Figure 2: The GOCE spacecraft 1.2 Contents Chapter 2 gives an overview of the main mission phases: LEOP and commissioning in 2009, routine operations at 260 km mean altitude from Sept 2009 to July 2012, the low orbit operations campaign from August 2012 to depletion of fuel in Oct 2013, and the de-orbiting operations in Oct/Nov 2013. The focus of Chapter 3 is on spacecraft operations, providing information on the operations approach in routine and contingency phases, the low orbit operations campaign, and the deorbiting operations campaign. On-board software maintenance and OBCP-related activities as well as the evolution of the mission planning system are covered. An overview of the changes required in-flight for the spacecraft database and the flight operations plan is provided as well. Chapter 4 contains a description of the performance, main activities and events for all spacecraft units and subsystems throughout the mission. Finally, Chapter 5 covers the ground segment, giving an overview of the performance, main activities and events for the teams and facilities supporting GOCE operations.

Page 9/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

1.3 Applicable Documents AD-1 GOCE Mission Implementation Plan (MIP), GO-PL-ESC-FS-1010 AD-2 GOCE FOS Mission Implementation Requirements Document (MIRD), GO-RS-ESA-GS- 0016 AD-3 OPS Procedure for Ground Segment Management and Mission Operations, QMS-EIMO- GSEG-PR-1000-OPS

1.4 Reference Documents RD-1 GOCE Flight Operations Plan (FOP), GO-PL-ESC-FS-6020 RD-2 GOCE Simulations & Training Plan for the Low Orbit Operations Campaign, GO-PL-ESC- FS-6259 RD-3 GOCE Simulations and Training Plan, GO-PL-ESC-FS-4020-OPS-HS RD-4 GOCE attitude control performances in high drag scenario, GO-TN-AI-0183 RD-5 Note from Astrium Friedrichshafen “GOCE Power Analysis applicable to long eclipse orbits in July/August”, 17.04.2012 RD-6 GOCE Weekly Operations Reports #1 to #243, GO-RP-ESC-FS-6100 RD-7 GOCE Anomaly Reporting and Tracking System (ARTS), https://artsops.esa.int RD-8 Consolidated Report on Mission Analysis, GO-RP-AI-0060 RD-9 Power Budget and Analysis, GO-TN-ASG-0015 RD-10 Mission Data Systems Combined Maintenance Statement of Work, MCSDOPS-MTE-SOW- 1004-OPS-GDS RD-11 GOCE FDS-FCT Interface Control Document, GO-FDOS-GEN-ICD-0001-OPS-GFM RD-12 Troll-2 Test Plan, ESTK-OPS-TP-1001-HSO-ONO RD-13 Review of ECC measures for the GOCE lower orbit phase, GC-OPS-MIN-1002-HSO-ONO RD-14 OPS-OEG & OPS-ONO agreement for the provision of ESTRACK planning & scheduling and reporting services, ESTK-SERV-AGR-1005-OPS-ONF RD-15 GOCE support at lower altitudes, special ESTRACK measures - v3 - Revision based on GC- OPS-MIN-1002-HSO-ON recommendations, HSO-ONO/2012/1488/dms/TB RD-16 GOCE Low Orbit Operations Plan, GO-PL-ESC-FS-6260 RD-17 Re-evaluation of GOCE Altitude Selection in 2013, GO-ME-ESC-FS-6265 RD-18 GOCE Deorbiting Operations Plan, GO-PL-ESC-FS-6266 RD-19 In-flight Test Review 2 Ground Segment Performance and Mission Operations Report RD-20 GOCE Launch and Early Orbit Phase (LEOP) Reports, OPS-OE/2009/GOCE/PPE/eh-001 to -004 RD-21 Definition of the LEOP Timeline, GO-TN-ESC-FS-6010 RD-22 GOCE Closure Plan, GO-PL-ESC-FS-6237 RD-23 GOCE Lessons Learned Public Presentation, HSO-Q-2011-1158-dms-MF RD-24 CESS On GOCE In-flight Performance, CESS-GO-R P-0005 RD-25 SSTI AGC Anomaly Technical Note, GO-TN-LAB-5011 RD-26 GOCE Platform User’s Manual, GO-MA-ASG-0001 RD-27 GOCE User Manual, GO-MA-AI-0002

Page 10/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

RD-28 GOCE SVT-3 Test Plan, GO-PL-ESC-FS-6255 RD-29 GOCE SVT-3 Test Report, GO-RP-ESC-FS-6258 RD-30 GOCE Dual PM Flight Operations Plan, GO-PL-ESC-FS-6257 RD-31 Analysis of triple head anomaly for the GOCE star trackers, GO-TN-DTU-2084 RD-32 GOCE Assessment of STR-DSS x-check anomaly (GOC_SC-8) and suggestion for recovery action, GO-TN-ASG-0212 RD-33 Fragmentation of 12044C (Briz-M), GEN-SD-TN-00096-HSO-GR RD-34 GOCE Mission Planning Concept, GO-TN-ESC-FS-6236 RD-35 GOCE - ESOC OBCP Development Environment and Process, GO-TN-ESC-FS-6253 RD-36 GOCE - OBCP Specification Document, GO-RS-ESC-FS-6242 RD-37 GOCE - OBCP Test Plan, GO-PL-ESC-FS-6243 RD-38 GOCE - OBCP Test Report, GO-RP-ESC-FS-6247 RD-39 GOCE Simulations & Training Plan for the Low Orbit Operations Campaign, GO-PL- ESC-FS-6259 RD-40 GOCE Simulations & Training Report for the Low Orbit Operations Campaign, GO-RP-ESC- FS-6263 RD-41 Mission Planning Modification Script Technical Summary, GO-TN-ESC-FS-6235 RD-42 Destructive Re-entry Analysis of GOCE with SCARAB, GOCE_FR_2005 RD-43 GOCE Deorbiting Readiness Review MoM, GO-MN-ESC-FS-6269 RD-44 ECC procedure for GOCE search along track, ECC-CRP-053 RD-45 Ground Facilities and Mission Operations Performance Report (issued on a quarterly basis), DHSO-GS-RP-xxxx-HSO-ONO RD-46 GOCE Platform OBCPs, GO-TN-ASG-0116 RD-47 Gradiometer and Science Performance Report, GO-RP-AI-0069 RD-48 ASG assessments of findings from the GOCE IPA in-orbit commissioning, GO-TN-ASG- 0213 RD-49 GOCE-In-Flight Power Budget Analysis, GO-RP-ESC-FS-6250 RD-50 SSTI State Vector Anomaly Technical Note, GO-TN-LAB-5011 RD-51 GOC_SC-46 anomaly report, GO-TN-AI-0180 RD-52 GOC_SC-59 anomaly report, GO-TN-AI-0182 RD-53 GOCE In-Orbit Anomaly Investigation Preliminary Report, GC-QA-RP-1001-OPS-CQ RD-54 Satellite Prime<->FOS (MCS): Memory Model and Image Files ICD, GO-ID-ESC-FS-3090 RD-55 GOCE-Thermal Analysis during deorbiting, GO-TN-ESC-FS-6270 RD-56 GOCE low orbit operations readiness meeting, GO-MN-ESC-FS-6261

Page 11/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

1.5 List of Acronyms

Acronym Description AND Alphanumerical Display ARTS Anomaly Report Tracking System ASH Accelerometer Sensor Head (of the Gradiometer) ASW Application Software BAT Battery CDMU Control and Data Management Unit CESS Coarse Earth Sun Sensor COIW Centre of Impact Window COP Commissioning Operations Phase CPM Coarse Pointing Mode CPM_EAP Coarse Pointing Mode - Earth Acquisition Phase CPM_RDP Coarse Pointing Mode - Rate Damping Phase CPM_SAP Coarse Pointing Mode - Sun Acquisition Phase CS-2 Cryosat-2 DB Database DCR Dedicated Control Room DFACS Drag-free Attitude Control System DFM Drag-free Mode DNEL Disconnect Non-essential Loads DSS Digital Sun Sensor DUUT DFACS Used Unit Table (governing STR selection) ECC ESTRACK Control Centre ECPM Extended Coarse Pointing Mode EGG Electrostatic Gravity Gradiometer EO Earth Observation EOL End of Life EOM End of Mission ESTRACK ESA Tracking Stations Network FCP Flight Control Procedure FCT Flight Control Team FD Flight Dynamics FDIR Failure Detection, Isolation and Recovery FDS Flight Dynamics System FOD Flight Operations Director FOP Flight Operations Plan FOS Flight Operations Segment FPM Fine Pointing Mode FTS File Transfer System G/S Ground Segment GAIEU Gradiometer Accelerometer Interface Electronic Unit GCD Gradiometer Calibration Device GCDE Gradiometer Calibration Device Electronics GOCE Gravity and Steady-state Ocean Circulation Explorer GOE Ground Operations Engineer GOMCS GOCE Mission Control System

Page 12/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Acronym Description GPOD Ground-provided Orbital Data GRD Graphical Display GRPS (Heater) Groups HOP Hibernation Operations Phase HPTM High Priority Telemetry HTR Heater IADC Inter-Agency Space Debris Coordination Committee ICM Inverse Calibration Matrix IPA Ion Propulsion Assembly IPCU Ion Propulsion Control Unit KSAT Kongsberg Satellite Services AS LEOP Launch and Early Orbit Phase LGA Low gain antenna MCR Main Control Room MCS Mission Control System MGM Magnetometer MIP Mission Implementation Plan MOP Measurement Operations Phase MPPT Maximum Power Point Tracking MPS Mission Planning System MT Magnetotorquer MTL Mission Timeline NCTRS Network Control and Telemetry Routing System OBCP On-board Control Procedure (a.k.a OCP in the GOCE project) OBS On-Board Software OBSM On-Board Software Maintenance OD Orbit Determination OPF Operations Planning file PASW Platform Application Software PCDU Power Control and Distribution Unit PCU Power Control Unit PDGS Payload Data Ground Segment PM Processor Module PPF Payload Planning File PSR Project Support Room PUM Platform User Manual PUS Packet Utilisation Standard PWR Power PXFA Proportional Xenon Feed Assembly RF Radiofrequency RM Reconfiguration Module RU Remote Unit RX Receiver S/C Spacecraft S2K SCOS-2000 SA Solar Array SAPR Solar Array Power Regulator

Page 13/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Acronym Description SAPR Solar Array Power Regulator SDO ÈSOC Space Debris Office (HSO-GR) SEU Single Event Upset SIGR Ground Schedule Increment File SIOS On-Board Schedule Increment File SIST Station Schedule Increment File SOE Spacecraft Operations Engineer SOM Spacecraft Operations Manager SPACON Spacecraft Controller SPF Skeleton Planning File SSTI Satellite-to-Satellite Tracking Instrument STR Star Tracker SVT System Validation Test TCEU Thermal Control Electronic Unit (of the GOCE Gradiometer) TCEU Thermal Control Electronic Unit (of the Gradiometer) TCS Thermal Control System TCT Thermal Control Table TDRS Telemetry Data Retrieval System TMM Telemetry Module TMT Thermal Monitoring Table TOV Time Offset Value TX Transmitter VC Virtual Channel WOR GOCE Weekly Operations Report (243 reports issued)

Page 14/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

2 GOCE MISSION OVERVIEW

This chapter gives an overview of the main phases, activities and events throughout the mission, from launch on 17/03/2009 up to re-entry on 11/11/2013. A day-by-day timeline of all activities can be found in Annex A.3 A. All operations activities are described in more detail in the weekly operations reports [RD-6]. 2.1 Launch and Early Orbit Phase (17-20/03/ 2009) Overall duration of the LEOP was about 2.5 days. The planned LEOP timeline activities could all be performed. Following an accurate injection into the target orbit at a mean altitude of 283.2 km, the following main events and activities took place (see also Figure 3): Autonomous acquisition of a 3-axis-stabilised attitude in CPM_HP; First switch ON of all 3 star trackers; Calibration of the magnetometers (mandatory prior to entering ECPM); Transition from CPM to ECPM (with GPOD in the loop); First switch ON of SSTI-A, putting the unit into the DFACS control loop; Transition from ECPM to FPM; Establishment of the post- LEOP CDMU reconfiguration strategy.

Figure 3: Main flow of activities in LEOP

Page 15/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

2.2 Commissioning (Mar 2009 – Sep 2009) With the S/C stable in FPM at the end of LEOP, main activities in commissioning were the checkout of the ion propulsion system (IPA), the gradiometer (EGG), the higher DFACS modes DFM_PREP, DFM_COARSE and DFM_FINE, and the lowering of the orbit to the altitude desired for routine operations. See Figure 4 for a plot of GOCE’s mean altitude and main events throughout commissioning.

20/03/2009 – 02/04/2009: Commissioning of DFACS units, safe mode #1 Right after LEOP, SSTI-B was commissioned and a series of commissioning activities on the DFACS units took place, including sensor calibrations on STR, DSS, CESS and a first checkout of the GCD. Commissioning of the IPA started on 30th March and lasted up to 3rd April –including firing of both engines in ECPM and in DFM_PREP–, confirming excellent health of both chains. The first safe mode of the mission was entered on 1st April, when surveillance G1 on the sun aspect angle triggered due to excessive attitude errors, with the FPM controller unable to handle the exceptionally low density environment after launch. During safe mode recovery, a loss of attitude control for 1 orbit occurred due to a flight software problem. Following the recovery, the DFACS was only brought up to ECPM, with the resumption of operations in FPM pending update of the FPM controller settings for a low density environment.

Figure 4: Mean altitude and key events throughout commissioning in 2009.

Page 16/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

03/04/2009 – 04/05/2009: Gradiometer switch ON, DFACS anomalies in CPM/ECPM The Gradiometer was switched on to Standby mode on 3rd April, and brought to Acquisition and Science Mode on 6th and 7th April, respectively. Major contingencies occurred on 18th April at the start of the long eclipse season, with a fallback to CPM caused by a false FDIR trigger, and a loss of attitude control in the ensuing recovery. On 22nd April the new controller gains for FPM were installed and FPM was entered the day after. From 27th to 29th April, the first K2 calibration of the mission was executed with the Gradiometer out of the DFACS loop in FPM.

05/05/2009 – 12/05/2009: Commissioning of drag-free modes, safe mode #2 Commissioning of the drag-free modes was started in May, entering DFM_COARSE on 7th May and eventually going to DFM_FINE on 11th May, using both EGG and IPA together in the DFACS control loop for the first time. A safe mode was triggered by a loss of attitude control when starting the first K2 calibration in DFM_FINE on 12th May. Following the recovery to FPM, commissioning of the drag-free modes was not resumed immediately, giving time for the anomaly investigation and achieving a further decay of the orbit which was anyway required. Some more Gradiometer K2 calibration runs and special tests were also performed in this time frame. The orbital decay was stopped on 26th May and DFACS mode transitions back to DFM_FINE were performed, resuming the commissioning of the drag-free modes. On 28th May, a major on-board software maintenance activity took place to correct the on-board software problems found so far. On 16th June and on 18th/19th June, the first ICM calibrations of the mission were performed in DFM_FINE. A series of K2 calibrations was also performed in this time period, in order to investigate and further characterize some unexpected results from the initial calibrations.

23/06/2009 – 13/09/2009: Decay to 259.6 km mean altitude Having completed a thorough checkout of the drag-free modes, on 23rd June a transition back to FPM was performed to resume the orbit decay, lowering the orbit down to a mean altitude of 259.6 km, which was reached on 13th Sept. While decaying, a significant number of additional K2 calibrations on the Gradiometer were performed. The installation of a second set of platform software patches to resolve problems encountered so far took place as well. This included an update of the default thermal tables based on in-flight experience. A new version of the SSTI application software was also installed on both SSTIs.

Page 17/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

2.3 Routine Phase at 259.6 km (Oct 2009 – Jul 2012)

Overview of mission profile and planned routine operations: Almost 3 years were spent at a mean altitude of 259.6 km. As solar activity and hence the drag levels remained very low, the low fuel consumption allowed extending the mission beyond the originally planned 20+10 months. This mission profile for this phase was significantly different than the profile originally planned before launch (see Figure 5): The selected altitude was lower than the mean altitude of 268 km originally intended, since drag levels were found to be significantly lower than expected, thereby allowing to improve the quality of science data by choosing a lower target altitude. There was also no need to raise the altitude throughout the routine mission. Science operations continued throughout the yearly long eclipse seasons thanks to (i) the little impact on EGG measurement quality when entering/exiting an eclipse, and (ii) good margin in the power budget. There was hence no need for raising the orbit and performing the planned “Hibernation Phase (HOP)” in DFM_PREP during long eclipse seasons. Figure 6 shows the actual evolution of the mean altitude and the eclipse pattern from launch up to end 2012. Figure 7 shows the thrust of the ion propulsion system in drag-free mode from Sept 2009 to July 2012. The routine science mission of GOCE essentially consisted in letting the S/C fly in drag-free mode and acquiring the collected science data. Only little additional activities were required: Small manoeuvres to keep the desired ground track executed whenever necessary, by applying a small bias in drag-free mode, i.e. without interrupting routine science operations. ICM calibrations (roughly every 2 months). Monthly maintenance activities to assess the status of various S/C units.

Figure 5: Originally planned altitude profile and corresponding eclipse durations for launch in Sept 2008 with measurement phases (MOP) only outside of the annual long eclipse seasons.

Page 18/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 6: Altitude and eclipse pattern from launch up to July 2012. The change in the eclipse pattern is due to drift of the inclination. Spikes in the mean altitude plot after September 2009 indicate interruptions of science operations in drag-free mode at 259.6 km (decay of the orbit due to uncompensated atmospheric drag).

Figure 7: IPA thrust in routine operations to compensate the air drag, showing instantaneous thrust and thrust averaged over each orbit. The variations are caused by changes in solar and geomagnetic activity.

Spacecraft contingencies during routine operations: Though routine operations in drag-free mode didn’t require a large overhead, the routine operations phase was by no means quiet, regularly interrupted by S/C anomalies. From Sept 2009 to July 2012 there were in total 8 interruptions of drag-free mode, two of which were major problems on the on-board computer (CDMU): The IPA stopped working suddenly in Oct 2009, June 2010, Nov 2011 (and two more times in Jan 2013 and Aug 2013 during the ensuing low orbit operations campaign), causing a fallback to FPM and hence an interruption of science operations. These anomalies were not major and could normally be recovered quickly, i.e. within 2 days or less.

Page 19/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

In Oct 2009 routine operations were interrupted for 11 days due to major problems encountered after a fallback to FPM (inability to resume DFM_PREP due to on-board software anomaly, corruption of mass memory playback data). An autonomous switchover to the redundant on-board computer (CDMU-B) occurred on 12/02/2010. An unsuccessful attempt to switch back to CDMU-A was performed on 25/02/2010. Science operations in drag-free mode with CDMU-B were then resumed in early March 2010. Owing to the very limited observables, the root cause could not be identified with certainty, but a failure of the floating point unit of the nominal processor module (PM-A) is considered the most likely failure scenario. As a consequence, CDMU-A was declared failed, and from that point onwards the mission was performed on CDMU-B. Starting on 08/07/2010, an anomaly prevented the transmission of software-generated telemetry to ground for almost 2 months. In the difficult condition of having to operate the S/C “in the blind”, a wide range of troubleshooting operations were performed as part of a major effort jointly undertaken by ESA and industry. The anomaly was found to be on the communication link between the processor module and the telemetry boards. As part of the troubleshooting activities, it was decided to raise the CDMU operating temperature (though it had already been well within the allowed operating range), which in late August 2010 led to restoring TM downlink. The orbit was temporarily raised by over 7 km during this severe anomaly. The routine mission in drag-free mode at 259.6 km was resumed on 27/09/2010. On 02/01/2011, both SSTIs started delivering a wrong state vector due to a software problem. This resulted in an outage of both SSTIs and hence an interruption of routine science operations for 2.5 weeks, up to when a new SSTI software was installed. The S/C was operated using the ground-provided orbit propagator while the SSTIs were unavailable. Two safe modes were entered late in the routine mission, due to a spurious PASW crash (March 2012) and due to a DFACS controller divergence caused by anomalous acceleration data from the gradiometer (June 2012). Table 1 gives an overview of the main events leading to an interruption of routine science operations in drag-free mode from Oct 2009 to Oct 2013.

Table 1: Overview of main events leading to an interruption of science operations between 02/10/2009 and 21/10/2013 (including the low orbit operations campaign)

Page 20/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

2.4 Low Orbit Operations Campaign (Aug 2012 – Oct 2013)

Background: Thanks to lower than expected drag levels, the mission could be operated longer than the originally planned 20+10 months at 259.6 km mean altitude, resulting in an excellent quality of the scientific data. With the end of mission upon depleting all Xenon fuel inevitably drawing closer, in 2012 discussions started on how get the most out of the mission in the remaining lifetime. Though continuing to operate at 259.6 km would reduce the noise in the scientific data, it would not yield major improvements. The only way to achieve that was to further lower the orbit. A new mission profile entailing a lowering of the orbit was hence planned and implemented. As the mission had been designed for a specific altitude range and environment, implementing a significant lowering of the orbit was not straightforward. The fundamental question was how much the orbit could be lowered without putting the mission at undue risk, while still achieving a significant improvement of the scientific return. This required realistic modelling of environmental conditions at lower orbits, an evaluation of S/C and G/S performance in such conditions (at altitudes and drag levels more extreme than what had originally been foreseen), and the implementation of measures allowing a rapid recovery of the S/C in case of drag-free mode interruptions.

Execution of the low orbit operations campaign: Based on the evaluations performed starting in early 2012 and taking into account (i) the lead time needed to implement all necessary measures for supporting safe low orbit operations, (ii) the need to monitor the DFACS behavior as the altitude was gradually decreased and (iii) the evolution of the solar activity and density predictions in 2012/2013, the altitude profile shown in Figure 8 was flown: 1. A first lowering from 259.6 km to 251 km altitude was done in August 2012. 251 km was the lowest altitude that was determined to still be compatible with the setup of the ground segment for the routine mission. 2. A second lowering from 251 km to 244.3 km was done in November 2012, with all special measures for the low orbit operations campaign in place. 3. A third lowering from 244.3 km to 239.2 km was executed in February 2013. 4. Having arrived at 239.2 km, it became apparent that drag levels were significantly lower than expected, mainly due to the solar activity not having increased as assumed in the 2012 predictions (see Figure 9). Following re-assessment, eventually a further lowering from 239.2 km to 229 km was executed May 2013. 5. Science operations in drag-free mode at 229 km up to running out of fuel on 21/10/2013. See Figure 10 for an overview of the drag levels encountered during the low orbit operations campaign, as compared to daily solar and geomagnetic activity indices. Figure 11 gives an example of drag levels during a strong geomagnetic storm at 229 km altitude, with drag peaks higher than what GOCE’s drag-free mode could handle – clearly, this altitude was at the edge of what was feasible to get consistently good science data.

Page 21/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 8: Altitude profile and thrust averaged over one orbit (corresponding to the average drag when in drag-free mode) during the low orbit operations campaign.

Figure 9: Evolution of the F10.7 index from 2000 to 2013 (red line is a prediction). Solar activity during GOCE’s life was low compared to previous solar cycles. From early 2012 to late 2013, the predicted increase in solar activity did not materialise, allowing to lower the orbit beyond what had originally been foreseen.

Page 22/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 10: Average daily thrust to compensate the drag compared to the daily solar (F10.7) and geomagnetic activity (Ap) indices during low orbit operations. Atmospheric drag levels strongly depend on the level of solar and geomagnetic activity. The overall increase in drag as the altitude was lowered is clearly visible.

Figure 11: Thrust during a strong geomagnetic storm on 01/06/2013 with the S/C at 229 km mean altitude. During such isolated periods of high geomagnetic activity at this low altitude, peaks in drag were higher than the maximum thrust level of the IPA (21 mN), impacting the quality of the science data (S/C not drag-free).

Page 23/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Spacecraft contingencies during the low orbit operations campaign: In terms of S/C anomalies, the low orbit operations campaign was a rather quiet period: 2 Fallbacks to FPM were caused by the IPA suddenly stopping to work, on 13/01/2013 and 29/08/2013 (re-occurrences of the anomaly already seen three times during the routine mission). There were 2 reoccurrences of a problem with accelerometer head 1 of the gradiometer, which had already led to a safe mode June 2012. Thanks to measures put in place in 2012, a safe mode could be avoided, however a divergence of attitude control happened during the recovery on 02/02/2013 due to problems when executing the recovery procedure, requiring ground to command a fallback to CPM. The second occurrence on 05/05/2013 was recovered without interrupting drag-free mode.

Page 24/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

2.5 De-orbiting and Re-entry (Oct/Nov 2013)

Background and preparatory activities: GOCE was the first ESA mission to re-enter since 1987. About 40 to 50 fragments with a total mass of around 250 kg were predicted to survive the re-entry and impact ground [RD-42]. Furthermore, the spacecraft design would not allow to perform a controlled re-entry, i.e. to let GOCE re-enter at a desired location. As the GOCE uncontrolled re-entry happened at a time of high public awareness of space-debris-related issues –as seen in the previous uncontrolled re-entries for Fobos-Grunt in 2012, UARS and ROSAT in 2011–, proper execution of the re-entry campaign was crucial. The following were the key aspects of the re-entry approach: The S/C would continue to be actively operated as long as possible (as opposed to e.g. a possible passivation right after fuel depletion), including standard activities like tracking of the spacecraft, orbit determination and prediction, execution of routine ground station passes, and routine spacecraft monitoring and operations activities. This was done not only to evaluate S/C performance at conditions well outside the design limits, but also to gather vital science data as long as possible (e.g. for atmospheric density studies). The GOCE re-entry was to be monitored not only by the ESOC Space Debris Office (SDO), but also by members of the Inter-Agency Space Debris Coordination Committee (IADC) in the frame of an international IADC re-entry campaign. This would allow having the best possible means available for monitoring the re-entry and predicting the re-entry location. Given this approach, de-orbiting operations entailed pushing both spacecraft and ground segment to their limits. Detailed technical evaluations were carried out in 2012 and 2013 to identify limitations and possible workarounds for operating under extreme conditions at very low altitudes.

Execution of the campaign: The orbital decay started on 21/10/2013 when fuel for the ion propulsion system was depleted. Figure 13 shows the evolution of the mean altitude during the ensuing de-orbiting. Exceeding expectations by far, S/C operations proceeded up to 1.5 hours before re-entry, with the last ground contact at KSAT’s Troll station in Antarctica on 10/11/2013 at 22:43 UTC. As the spacecraft performed extremely well to the end –down to an altitude of little more than 100 km–, there was no need to perform the originally planned spacecraft passivation. All units and subsystems kept functioning nominally, with the following most notable observables: In the last two days of flight, on-board temperatures were increasing significantly due to friction with the atmosphere. Temperatures of items at the front of the S/C (e.g. battery, power distribution unit, central computer) were getting above 80 degC in the final hours. S/C attitude control kept working nominally, even when drag levels encountered were in the order of several Newton, far beyond what the Fine Pointing Mode (FPM) controller had been designed for. See Figure 12 for the drag levels experienced on 10/11/2013, the final day of operations. Ground segment performance was also exceptional. The ground stations worked perfectly at extremely low altitudes. Orbit predictions by Flight Dynamics proved to be very accurate as well, allowing to acquire the spacecraft without ever having to search for it.

Page 25/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Soon after fuel was depleted, the SDO and IADC re-entry campaigns started, with the SDO taking radar tracking passes of GOCE using the TIRA radar station in Bonn, Germany. As the S/C remained functional for that long, precise orbit data from Flight Dynamics could be provided to the SDO almost until the very end. GOCE re-entered on 11/11/2013 00:16 UTC close to the Falklands (see Figure 14). The re-entry was seen by chance by a ground observer from the Falkland Islands, see Figure 15.

Figure 12: Drag level on 10/11/2013, the last day of operations.

Figure 13: Evolution of mean altitude during de-orbiting, from running of fuel on 21/10/2013 up to the last contact taken on 10/11/2013 at 22:43 UTC.

Page 26/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 14: GOCE re-entry location. COIW is the Center of Impact Window (S/C at 80 km altitude).

Figure 15: GOCE re-entry captured from the Falkland Islands by Bill Chater on 11/11/2013 at 00:16 UTC.

Page 27/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

3 SPACECRAFT OPERATIONS

Owing to the special mission design for extremely low altitudes and the comparably large number of S/C anomalies encountered in-flight, GOCE has been an operationally challenging mission. Many special operations and significant changes to the operational setup had to be carried out. This chapter gives an overview of the operations approach and special operational events for the various mission phases, including a section on the routine operations phase. An overview of changes in operational documentation is provided as well.

3.1 LEOP and Commissioning

LEOP operations: Operations in LEOP were performed following a classical approach in terms of the teams and facilities at ESOC, conducting operations from ESOC’s main control room in two 12-hour shifts (see Table 2). The overall duration was about 3 days. A total of 77 passes were taken using ESA’s Kiruna station and KSAT stations at Svalbard, Troll and Alaska. While all planned activities could be performed and no major S/C anomalies occurred, a significant problem during LEOP was the performance of the KSAT stations, with all passes on KSAT stations lost during the first two orbits after S/C separation, and passes later in LEOP affected as well. See [RD-21] for a detailed description of the operational setup and the planned activities in LEOP, and [RD-20] for the reports issued during LEOP by the Flight Director.

Commissioning operations: The most important commissioning activities were completed within the first 3 months, followed by a more quiet operations phase throughout summer 2009 to decay to the desired target altitude. As is not uncommon, commissioning operations have been demanding for the teams. The significant number of problems encountered on S/C side needed close interaction between the ESTEC project, industry and the FOS. Not unexpectedly, most of the effort was required in the area of the drag-free attitude and orbit control system (DFACS). While all problems could be resolved, some of the DFACS anomalies were quite significant: Loss of attitude control on 01/04/2009 due to divergence of the FPM controller (controller gains not adequate for the low drag environment encountered after launch). The magnetic torquers got switched off in the course of the recovery due to another flight software problem, leaving the S/C in free drift with no attitude control up to when ground intervened. A fallback to CPM in the first eclipse of the mission on 18/04/2009 occurred due to a false DSS FDIR trigger, After having initiated a transition back to ECPM in the course of the recovery, the DFACS controller stopped working due to a flight software anomaly (a flag was not properly initialised following the fallback) and the S/C was in free drift with no attitude control. This was recovered by commanding another fallback to CPM. A divergence of attitude control occurred on 12/05/2009 during the first K2 calibration of the mission due to a problem linked to the EGG bias compensation algorithm not working correctly, eventually resolved through DFACS software and parameter updates.

Page 28/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Actor Roles and Responsibilities

Operations Director Holds overall responsibility for the conduction of the LEOP. Interface with the (OD) launch site.

S/C Operations Execution of the LEOP timeline under supervision of the OD. Supervision of FCT Manager (SOM) and interfacing/coordination with the OM, FD, PROJECT REP, SOFT COORD.

S/C Controllers Responsible for the preparation and execution of all S/C commanding activities (SPACON, Backup under direction of the SOM. SPACON)

FCT Subsystem Continuous monitoring of the relevant subsystems and participation in operations Engineers: preparation and execution in their area of responsibility. (1) DFACS The DFACS engineer is also responsible for the SSTI. The POWER engineer holds (2) Data Handling responsibility for Power, Thermal and RF. (3) POWER Ground Operations Responsible for coordination of operations of the ground communications network Manager (OM) and the LEOP ground stations. Interface to the Network and the Stations

Flight Dynamics (FD) The Flight Dynamics coordinator and his team are in charge of all activities related to the analysis of the dynamical behaviour of the spacecraft (orbit and attitude) and for the processing and FD product generation as agreed for LEOP.

Software Coordinator The Software Coordinator and his team are in charge of the mission control (SOFTCOORD) hardware and software at ESOC.

Project Support (PS) On-site LEOP support team from industry and ESA/ESTEC. Provision of expert support for LEOP operations. Monitoring of spacecraft status. Participation in specific offline analysis as part of LEOP operations. Participation in GO/NOGO decisions, anomaly briefings.

Project ESA/ESTEC representative in the MCR. Representative Interfacing with the Project Support Team and coordination of PS activities. (PROJECT REP)

Table 2: Actors, roles and responsibilities in LEOP

The setup of the FOS teams was as follows: Flight control team: In the first month after launch, all ground station passes were manned by a SPACON, requiring a double SPACON shift for this time period. One SOE was in charge of the conduct of the overall activities, with special activities performed by the SOEs responsible for the subsystem involved. Mission planning activities were performed by the mission planning SOE. As from mid April 2009, the setup was similar to routine. Ground contacts were covered by a single SPACON shift, with the contacts outside of this shift taken as unmanned passes. Each week, a different SOE acted as on-call engineer, also responsible for the mission planning activities. Stations: station operations were performed by the ESTRACK Control Centre (ECC) operators as in routine, with GOE support for special activities whenever needed. Ground station coverage was as follows:

Page 29/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

03/2009 – 06/2009: passes were taken to cover every orbit throughout the day. Usually this amounted to up to 8 Kiruna passes and around 3 Svalbard/KSAT passes. Troll/KSAT was used for supporting special operations. 07/ 2009 – 11/2009: 6 Kiruna and 2 Svalbard/KSAT passes were taken every day. Test passes on Troll were taken every few weeks to ensure station readiness for possible contingency supports. Other ESOC support teams: following completion of LEOP, the support arrangements for Flight Dynamics and MCS Software Support were essentially as for routine, with the teams providing support during normal working hours, and on-call support on non-working days. Particularly close interaction was needed with Flight Dynamics for commissioning activities affecting the orbit (IPA commissioning and checkout of drag-free modes). Interface with ESTEC project and industry: experts from the ESTEC project and industry were present at ESOC for essential commissioning activities, like commissioning of the ion propulsion assembly, the first Gradiometer switch on and transition to measurement mode, and the first check out of drag-free modes. In the phases with no on-site support, close contact was kept by phone or by email whenever necessary. A daily report email on all current activities and events was distributed. A telecon was held on a weekly basis to discuss open problems and upcoming activities.

Page 30/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

3.2 Routine Operations Setup In absence of on-board anomalies, routine science operations were comparably straightforward: the mission did not require to perform complex observation campaigns, but rather consisted of acquiring science data while letting the S/C fly in drag-free mode. As presented in section 2.3, there was also no need to stop drag-free operations for the originally foreseen hibernation phases during the yearly long eclipse seasons. Owing to the excellent performance of drag-free mode, orbit prediction accuracy in DFM_FINE was at similar levels as what could be achieved for more standard Earth observation missions at 700-800 km altitude. However, the recovery of anomalous interruptions of drag-free mode –which occurred 8 times during routine operations at 259.6 km mean altitude– required complex flight operations and coordination activities with Flight Dynamics and the stations. The following operations activities were carried out on a regular basis during routine operations: Execution of an ICM calibration every two months (or after every recovery from drag-free mode interruption); Monthly maintenance activities to check the status of various DFACS units and the EGG; Orbit maintenance to maintain the desired ground track, consisting of small altitude raise/drop manoeuvres at most once every few weeks (size usually less than ±50 m through applying an acceleration bias to drag-free control). Table 3 shows the typical distribution of ground station contacts during routine. There was no round-the-clock coverage in every orbit; passes were usually during day time, with Kiruna as the prime station, supported by the Svalbard/KSAT station. Owing to the very low operating altitude, ground station contacts were much shorter than for a standard Earth observation mission, usually at most 6 min duration above 5 deg elevation. The operations approach was tailored for such passes, with procedures in the Flight Operations Plan optimised for execution either Table 3: Example of daily station contacts in real time with preset delta release times, or out of during routine operations. coverage from the on-board mission timeline. The flight control team was organised such that each week, a SOE took the role of the “On-call engineer” who would follow up and coordinate all operations activities in that week, and serving as the first contact point for the SPACON out of normal working hours (with any issues escalated further to the SOM or his deputy if necessary). The On-call SOE was also responsible for mission planning, performed on Thursdays covering the next week of operations. The actual mission planning run was usually done by the SPACON on shift. The SPACON team consisted of 3 staff for a single daily shift of 8h duration (shared with the Cryosat-2 mission as from spring 2010); passes falling outside of this shift were unmanned, with the link connections and the routine mass memory playback performed from the automatic release-based stack of the mission control system. The Envisat/ERS-2 SPACON team performed basic health checks for all GOCE unmanned passes, notifying the GOCE on-call SOE in case of major anomalies (e.g. S/C in safe mode). Each Monday, a weekly coordination meeting was held with all members of the FCT and representatives from Flight Dynamics, MCS software support, Station Operations, and Quality Assurance. On the same day, a coordination telecon with mission management and ESTEC was also held.

Page 31/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

3.3 Major Contingency Operations

3.3.1 Safe Modes and Fallbacks This section gives an overview of contingency operations related to the various interruptions of drag-free mode encountered throughout the mission.

Introduction: The S/C has a sophisticated, layered FDIR implementation. For problems not recoverable on unit level, drag-free mode can be interrupted either due to a S/C safe mode (with the term “survival mode” used synonymously on GOCE) or a fallback, both leading to an immediate orbital decay: A safe mode entails a CDMU reconfiguration, restarting the PASW with a unit selection as defined in parameter tables in safeguard memory. The DFACS is commanded back to CPM, performing the acquisition of the desired S/C attitude (rate damping, sun acquisition, earth acquisition), after which transitions to ECPM and FPM may be done. The ion propulsion is switched off. A fallback constitutes a less severe way of interrupting drag-free mode. There are two possible fallbacks, both leading to a power off of the ion propulsion: As a recovery action to IPA problems or EGG problems not recoverable on unit level, a DFACS mode transition back to FPM is performed; A SW DNEL (monitoring on battery status implemented in the PASW) triggers a fallback to CPM, restarting attitude acquisition. Both safe modes and fallbacks can be initiated by ground, which turned out to be necessary several times throughout the mission.

Overview of recovery operations from Safe Modes and Fallbacks throughout the mission: As on other missions, following a major contingency like a safe mode or a fallback, many S/C configuration activities had to be performed by ground to get back to a nominal state and eventually resume routine operations. Such operations on GOCE were characterised by the high complexity of the DFACS-related recovery activities and the major impact on the orbit of any such contingency, as the ion propulsion system got powered off and the orbit started to decay due to the atmospheric drag. This required close coordination with.. Flight Dynamics to provide new orbit predictions taking into account the orbital decay and the planning and execution of ensuing recovery activities (e.g. timing and thrust level for restart of ion propulsion system); Station operations and station scheduling to ensure S/C acquisition despite the sudden change in orbit. The longer term scheduling of ground stations was also affected and had to be redone taking into account the change in the orbit. The accuracy of the Flight Dynamics orbit prediction was significantly reduced out of drag-free mode owing to the uncertainty on the evolution of solar activity, whereas in DFM_FINE the S/C compensated the drag leading to very high orbit prediction accuracy. Resumption of DFM_FINE was hence not only essential to continue science operations, but also important for having problem- free S/C acquisition and accurate longer term predictions for the scheduling of the stations. Figure 16 shows the altitude profile and ion propulsion thrust for the safe mode on 07/06/2012, depicting the orbit-related activities in the course of the safe mode recovery.

Page 32/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Recovery activities for safe modes and fallbacks were similar for what concerns the major impact on the orbit and the ensuing activities to recover the altitude lost. However, a safe mode recovery was usually more work-intensive owing to the many S/C configuration activities required following a PASW start up. Table 4 gives an overview of all safe modes and fallbacks during the mission, either caused by on- board anomalies or triggered by ground to recover from an on-board anomaly. Despite the severe anomalies encountered –not only the CDMU-related failures, but also the various losses of attitude control due to PASW problems or SSTI and EGG anomalies–, the largest altitude loss encountered was only 2.4 km (after the ground-commanded safe mode to recover the TM loss anomaly), significantly less than what had been assumed before launch. In three cases of loss of attitude control or attitude divergence, on-board FDIR did not intervene and ground had to command a fallback to return to a nominal situation. The much reduced altitude loss and recovery time for science operations in case of the drag- free mode interruptions in 2013 was thanks to the revised approach for fast contingency recovery during the low orbit operations campaign (see section 3.4).

Figure 16: Altitude profile and ion propulsion thrust around the safe mode of June 2012, showing the orbit- related activities in the course of the safe mode recovery.

Page 33/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Altitude Routine OPS Date Type Title Description loss interruption 01/04/2009 Safe mode Divergence of FPM n/a (anomaly during Divergence of FPM controller due to controller commissioning in FPM) low density environment after launch 18/04/2009 Fallback to CPM Fallback to CPM due n/a (anomaly during Fallback from ECPM to CPM due to to DSS FDIR trigger commissioning in ECPM) false trigger of DSS FDIR 18/04/2009 Fallback to CPM Recovery from n/a (anomaly during DFACS controller anomaly in (ground-commanded) DFACS controller commissioning in ECPM) recovery from fallback: S/C in free descheduling drift with no attitude control 12/05/2009 Safe mode K2 cal in DFM_FINE n/a (altitude decay in DFACS controller divergence in first commissioning was K2 calibration of the mission resumed after the anomaly) 16/10/2009 Fallback to FPM IPA ASW anomaly #1 Fallback caused by IPA ASW suddenly stopping to work; due to 1300 m 10 days PASW problem it was not possible to restart the IPA after the anomaly (PASW patch needed). 12/02/2010 Safe mode Failure of CDMU-A Switchover to CDMU-B due to 2200 m CDMU-A failure (floating point unit of PM-A?), see section 3.3.2 19 days 25/02/2010 Safe mode Attempt to switch Ground-commanded safe mode in (ground-commanded) back to CDMU-A 600 m an unsuccessful attempt to switch back to CDMU-A 30/06/2010 Fallback to FPM IPA ASW anomaly #2 Fallback caused by IPA ASW 400 m 41 h suddenly stopping to work 22/07/2010 Safe mode Attempt to recover 91 days Ground-commanded safe mode in (ground-commanded) TM loss anomaly interruption an unsuccessful attempt to recover 2400 m due to TM loss from TM loss anomaly, see section anomaly 3.3.3. 02/01/2011 Fallback to CPM SSTI state vector Ground-commanded fallback to (ground-commanded) anomaly CPM to recover from the 1500 m 18 days DFM_FINE attitude control divergence caused by the SSTI delivering a wrong state vector. 09/11/2011 Fallback to FPM IPA ASW anomaly #3 Fallback caused by IPA ASW 600 m 37 h suddenly stopping to work 05/03/2012 Safe mode Sudden PASW restart Sudden restart of PASW for reasons 900 m 3.2 days unknown 07/06/2012 Safe mode DFACS controller Divergence of DFM_FINE attitude divergence (EGG 1200 m 5.6 days control due to EGG ASH-1 anomaly anomaly) 13/01/2013 Fallback to FPM IPA ASW anomaly #4 Fallback caused by IPA ASW 300 m 24 h suddenly stopping to work 04/02/2013 Fallback to CPM DFACS controller Divergence of attitude control n/a (drag-free mode not (ground-commanded) divergence (in during recovery from EGG ASH-1 recovered to achieve decay recovery from EGG anomaly to 240 km) anomaly) 29/08/2013 Fallback to FPM IPA ASW anomaly #5 Fallback caused by IPA ASW 340 m 19.5 h suddenly stopping to work Table 4: Overview of safe modes and fallbacks 2009-2013, showing FDIR-triggered fallbacks and safe modes as well as those initiated by ground to attempt to recover anomalies.

Page 34/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

3.3.2 Failure of Prime Central Computer (CDMU-A) The permanent failure of CDMU-A on 12/02/2010 constituted a major anomaly, requiring a series of special operations to continue the mission.

Operations in the blind 12-13/02/2010: In the afternoon of 12/02/2010, good TM stopped being received. A signal was present, with the spectrum visible at the Kiruna station showing a mixture of characteristics reminiscent of both TM Mode 1 and Mode 2, e.g. a NRZ-L/PSK/PM modulation on a subcarrier at 302,7 kHz (1/2 of one of the Mode 2 TM I/Q channel bit rate), and a bit rate of the NRZ-L modulating signal of 63.733 kbps (i.e. the one of Mode 1). With these observables, troubleshooting of the anomaly as per the no-AoS system contingency procedure started. Several reconfigurations of the downlink chain were performed in close collaboration with a ground operations engineer to interpret the observables in the downlink signal. This included power cycling of the transmitters, power cycling of the TM modules, and switches between TM mode 1 and TM mode 2 for the downlink chain. After one day of troubleshooting, TM was recovered following a complete power off of both transmitters and both TM modules on 13/02/2010 at 14:27. A first check of the S/C status revealed that a switchover to CDMU-B had occurred following two reconfiguration attempts on CDMU-A. After the two bootups on CDMU-A, the PASW was running for 74 sec and 68 sec respectively, before the next reconfiguration occurred.

Recovery operations Feb – Apr 2010: The main activities and operations following the anomaly are summarised here below (see also Figure 17): 12-14/02/2010 –Initial recovery activities: following recovery of TM, the S/C was checked out and some basic recovery activities were performed. At that time, the DFACS stayed in its lowest mode (CPM), resulting in an orbital decay of about 700 m per day. 15-16/02/2010 – thrusting resumed: a transition to Fine Pointing Mode (FPM) was done on 15/02/2010, with thrusting resumed in DFM_PREP on 16/02/2010. 16/02/2010 – OBSM on PM-B: as PM-B was inaccessible as long as the PASW had been running on CDMU-A, the default PASW version from launch was active after the CDMU-A failure, with none of the many fixes applied in commissioning active. The most essential PASW patches were installed on PM-B soon after the switchover. 25/02/2010 – Failed attempt to go back to CDMU-A: Having completed an investigation of the observables, it was decided to attempt a switchback to CDMU-A on 25/02/2010, which was unsuccessful. While throughout the series of CDMU reconfigurations on 12/02/2010 the PASW was running for a limited amount of time prior to occurrence of an anomaly leading to the next PM reboot, in this new attempt no successful PASW start-up could be observed (i.e. no PASW-generated telemetry available). The procedure used for the switchback was such that an autonomous return to CDMU-B was triggered by the on-board reconfiguration logic when the PASW start up on CDMU-A failed.

Page 35/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

The switchback attempt was performed with extended ground station coverage, with Kiruna passes supported by a GOE. 02/03/2010 – Science operations resumed: following a mode transition to DFM_FINE on 02/03/2010 and an ensuing ICM calibration, routine science operations were resumed. March/April 2010 – Updates for permanent stay on CDMU-B: The S/C configuration was updated for a permanent stay on CDMU-B, including a tuning of the CDMU reconfiguration settings and the corresponding boot-dependent SGM parameter groups. A significant revision of the flight operations plan was undertaken, adapting the procedures for a permanent stay on CDMU-B, most notably affecting many data handling procedures and the safe mode recovery procedure.

Figure 17: Altitude profile and ion propulsion thrust in Feb/Mar 2010, showing the complex orbit-related activities in the course of the CDMU-A failure.

Results of failure investigation and lessons learnt: A detailed investigation of the failure was performed [RD-51]. The root cause could not be determined with certainty owing to the very limited observables available. An PASW error log recording during one of the PASW crashes on 12/02/2010 indicated a software exception during execution of a floating point instruction, based on which a failure of the floating point unit (FPU) of processor module A was suspected. The no-AoS condition at the onset of the anomaly was seemingly a re-occurrence of the spurious TM loss problem observed before launch. In the course of this anomaly, the following issues related to on-board HW/SW architecture and on-board software maintenance have come up: Unlike for some other ESA missions, the GOCE CDMU lacks the possibility to switch ON the unused CDMU processor module to a ‘service mode’ for accessing its memory. This made it

Page 36/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

particularly difficult to diagnose the potential failure of PM-A, which could only be accessed by triggering a CDMU reconfiguration back to the A-side, requiring a large overhead and offering limited visibility in case the PASW would not start up nominally on PM-A (as was the case in the attempt on 25/02/2010). Not having a service mode for the unused processor module also meant that no PASW corrections could be installed on PM-B during commissioning. When the system switched over to CDMU-B, the default flight software was running on PM-B with all the major PASW corrections applied after launch not active, requiring some urgent OBSM activities after the switchover. The PASW error logs –recorded when the PASW stops anomalously– got overwritten in the case of consecutive PASW restarts on the same CDMU side. Thus, out of the three PASW crashes on CDMU-A in the course of the anomaly, only a single crash log could be recovered, rendering the diagnosis of the anomaly more difficult.

Page 37/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

3.3.3 TM Loss Anomaly

Introduction: The TM loss anomaly in summer 2010 was the most serious S/C contingency of the mission, leading to an interruption of routine science operations for 91 days. During almost two months, the S/C had to be operated with extremely limited visibility on its status. Having just recovered from an interruption of drag-free mode due to a problem with the ion propulsion system on 30/06/2010, an anomalous signal was visible at the station in the afternoon of 08/07/2010. The ensuing troubleshooting activities completed on 09/07/2010 yielded the following results (see also Figure 18): Power cycling the Telemetry module (TMM) or switching over to the redundant TMM led to reception of a clean carrier-only signal, however with no SW-generated TM (on the real time data stream VC-0) received, only the HW-generated high priority telemetry (HPTM) on VC- 1 and idle frames on VC-7. If the so-called ACARO link between the processor module and the TMM was left enabled following the TMM power cycle, after a while the state of the TMM seemed to get corrupted, leading to the previously observed anomalous downlink signal. Eventually the ACARO link was left disabled, allowing to keep receiving a clean downlink signal. No safe mode or fallback had occurred, the S/C was still in drag-free mode with the DFACS working (no drift of the orbit observed). The status on 09/07/2010 was hence such that a good signal had been recovered, but only HPTM was available, giving very limited information on the status of the CDMU Figure 18: CDMU overview. All software-generated TM and the transponders. Information on (including mass memory playback data) is flowing over the the status of e.g. DFACS, thermal ACARO links. The HW-generated HPTM contains very limited control, the power subsystem, the information on the CDMU and the transponders (~150 payloads and the data handling parameters). Processor module A had failed in Feb 2010. software was not available anymore.

Recovery operations July - Sept 2010: With the S/C seemingly still fully functional in drag-free mode, but little to no information on the actual status and what had happened, an intense investigation started. Operations were in general performed in TM Mode 1, allowing to do orbit determination based on radiometric data. Figure 20 shows the altitude profile and key events in the recovery activities: 13/07/2010 – orbit raise: to gain more margin, a first raise of the orbit was started soon after the anomaly by commanding an acceleration bias in DFM_FINE.

Page 38/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

22/07/2010 – safe mode triggered by ground: an initial investigation concluded that the only way to reset the ACARO link was to restart the PASW, requiring to bring the S/C into safe mode. Unfortunately SW-generated TM was not recovered, hence ground had to perform a recovery of the survival mode with virtually no visibility on the S/C status, while the orbit was now decaying. 29/07/2010 – restart of IPA and start of orbit raise: the orbital decay was stopped by performing a transition to DFM_PREP “in the blind” (assuming the S/C had reached Fine Pointing Mode following the safe mode. On 03/08/2010, a raise of the orbit was started to get more margin. This raise in DFM_PREP was performed with a special thrust profile to minimise the risk of having to search for the S/C (see Figure 19). Investigation activities July/Aug 2010: a series of investigation activities Figure 19: Principle of orbit raise during the TM loss anomaly: when was performed to firing at high thrust, an IPA failure may lead to large differences characterise the anomaly, between actual and predicted orbit, possibly requiring a search for mainly linked to the S/C. Hence the orbit raise was only done under station coverage configuration of the during day time (low thrust in blind orbits over night). downlink chain. Dedicated testing of processor module A –failed in Feb 2010– was also performed to check the feasibility of eventually using that processor module. A complete power down off of the CDMU to recover the anomaly was prepared, but not implemented owing to the very high risk of such a procedure.

Figure 20: Altitude profile and main events during the TM loss anomaly July-October 2010

Page 39/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

23/08/2010 – installation of patch to downlink SW TM in HPTM: starting in July, the S/C manufacturer had developed a patch allowing to downlink SW TM as part of HPTM (see more details in the following section). The uplink of this patch in late August allowed gaining some visibility on the S/C status, constituting a major step towards recovering the anomaly. 30/08/2010 – recovery of software TM: as part of a series of investigation activities after the patch installation, SW TM could be recovered following a slight warm up of the CDMU temperature (by about 7 degC). Sep/Oct 2010 – resumption of nominal mission: a decay to the routine altitude of 259.6 km started soon after the recovery, with a transition to drag-free mode on 27/09/2010, resuming the routine science mission.

Special activities to get visibility on S/C status: During the anomaly, ground was faced with the problem of having to check out the S/C and investigate the problem despite having extremely limited visibility on the S/C status. In July, a check of key parameters in software telemetry was done re-using Packet Utilisation Standard (PUS) monitoring and event action services 12 and 19 of the PASW. Normally employed for FDIR purposes, they were used to check out software TM parameters by defining a S12 entry to monitor a parameter against an expected value, with the event action performing an activity visible in the downlink signal (e.g. switch off of ranging in the transmitter), see Figure 21). Owing to the high overhead, this method was used only for checking out key software parameters. Figure 21: Check of essential SW TM parameters using PUS Services 12 and 19. If the parameter is not as expected, the S12 A dedicated PASW modification monitoring triggers and a corresponding S19 entry switches off developed by the S/C ranging (visible in the downlink signal). manufacturer to allow the downlink of SW-generated TM in HPTM was installed on-board on 23/08/2010. The mechanism makes use of the fact that by default the PASW can write a 16 bit register which is reported in HPTM. The PASW was thus modified such that specific software TM packets could be downlinked on request byte by byte in HPTM. The basic principle is shown in Figure 22. The mechanism also required a corresponding change in the mission control system to re- assemble the SW packet downlinked byte-wise. A severe Figure 22: Downlink of SW-generated telemetry packets byte-wise in limitation was the excruciatingly a register reported in High Priority Telemetry (HPTM). A packet slow downlink rate at 1.4 bytes downlinked by these means has to be reassembled on ground. per second: a checkout of the S/C Owing to the fixed HPTM packet generation rate, the resulting net downlink rate is very low at around 1.4 Bytes per second.

Page 40/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

–i.e. getting a sample of the most important PASW housekeeping packets– took more than a day given the short GOCE station contacts. To alleviate this limitation, a new housekeeping packet was defined containing only key SW parameters, which was then downlinked on a regular basis. This mechanism was key for undertaking troubleshooting activities for which visibility on S/C status was essential, like for instance the warm up of the CDMU undertaken end of August 2010.

Results of failure investigation and follow-up activities: The anomaly was subject to an agency-wide investigation headed by the Inspector General, which proceeded for a while following the recovery. While the problem could not be reproduced on ground despite extensive testing, the failure hypothesis considered most likely is that oscillation of the LVDS receiver on the PM-B ACARO Master leads to the observed behaviour. On other projects, similar LVDS receivers were seen to be prone to oscillate under certain conditions and temperature ranges. See also [RD-53, RD-52] and anomaly report GOC_SC-56. A major update of the Flight Operations Plan (FOP) was done in late 2010 to incorporate all lessons learnt and special procedures used throughout the anomaly (e.g. to define the S12/S19 entries for S/C checkout, procedures for operating the mechanism to downlink PASW TM in HPTM). Following the recovery, it was decided to proceed with developing a new PASW version which would allow to operate the CDMU with PASW instances running on the two processor modules in parallel, to be used in case of a non-recoverable re-occurrence of the anomaly. PM-A would be used for downlinking SW telemetry (assuming only the floating point unit of PM-A had failed), while the DFACS algorithms (requiring floating point instructions) would run on PM-B. Development of this “Dual PM” PASW was a major undertaking completed only in spring 2012. It also had a major impact on the ground segment at ESOC, requiring to develop a dedicated MCS version and FOP version. Following completion of all work, dedicated test with the GOCE engineering model at TASI Torino (SVT-3) was performed in May 2012 [RD-28, RD-29].

Page 41/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

3.3.4 SSTI State Vector Anomaly The third longest interruption of science operations was caused by a major anomaly in the application software of the SSTI, with the mission out of routine operations for 18 days. On 02/01/2011, a reconfiguration from SSTI-A to SSTI-B occurred, after which S/C dynamics became increasingly non-nominal with very high attitude errors (Figure 23). Ground commanded a fallback to CPM, allowing to recover good S/C attitude control in Coarse Pointing Mode. The anomaly was caused by a sudden change in the state vector delivered by SSTI-A, corresponding to a rotation of the state vector by 90 deg around the Z-axis. This led to an FDIR-triggered switchover to SSTI-B, which provided the same erroneous state vector, thereby leading to the observed severe controller problems in DFM_FINE. See Figure 24. Figure 23: Increasing attitude errors in DFM_FINE following corruption of the SSTI state vector.

Figure 24: Orbital position delivered by SSTI-A (SST03263/4/5) and SSTI-B (SST13263/4/5), showing key events during the onset of the anomaly: 1 sudden change in SSTI-A state vector, 2 start of FDIR-triggered reconfiguration to SSTI-B, 3 SSTI-B reaches navigation mode, delivering the same wrong state vector.

Page 42/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Investigation by the SSTI manufacturer revealed the anomaly to have been caused by a problem in the SSTI application software when doing a state vector conversion from Earth Centred Earth Fixed (ECEF) to Earth Centred Inertial (ECI) coordinates: a lookup table covering only years 2001 to 2010 was used, with the memory location accessed for year 2011 containing an erroneous value. This led to the observed anomaly early on 02/01/2011, as 01/01/2013 was still part of the last GPS week of 2010 (see anomaly GOC_SC-58 and [RD-50]). The correction of the anomaly required a new version of the SSTI application software to be uplinked on both SSTIs. This anomaly constituted a double failure of the SSTIs, which had the following main consequences: To recover to DFACS modes higher than CPM, the ground-provided orbital propagator (GPOD) had to be set up and maintained. Drag-free mode could not be resumed anymore and hence science operations came to a halt (a transition to DFM_COARSE and DFM_FINE is not allowed with the GPOD in the loop). This also had an impact on flight operations, with the significantly reduced accuracy of orbit prediction when out of drag-free mode causing considerable overhead. Orbit determination activities normally based on the SSTI state vector had to be based on radiometric data, requiring to take ground station passes in the low TM mode (Mode 1). About 2 to 3 Kiruna passes were taken in Mode 1 every day. The main activities and operations following the anomaly are summarised here below: 02-03/01/2011 – Initial S/C recovery: including setup of the GPOD and transitions to ECPM and FPM with GPOD in the loop. 05/01/2011 – Thrusting resumed: a transition to DFM_PREP was performed, resuming usage of the ion propulsion system in open loop to regain the altitude lost (altitude recovery was completed on 16/01/2011). 14/01/2011 – Orbit determination based on SSTI diagnostics: having enabled special SSTI diagnostics delivering the state vector in ECEF format not affected by the anomaly, orbit determination could be based again on SSTI data. 17-18/01/2011 – Installation of new SSTI application software: the corrected application software provided by the SSTI manufacturer was successfully installed on both units, curing the anomaly. 19/01/2011 – Resumption of science operations in drag-free mode: DFM_FINE was resumed, with some fine tuning of the orbit taking place in the days thereafter.

Page 43/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

3.4 Low Orbit Operations Campaign This section gives an overview of the operational setup and evaluations performed for the low orbit operations campaign, and the actual execution of the campaign. See [RD-16] for more detailed information on the planning of the campaign and [RD-56] for the readiness meeting.

Selection of target altitude: The low orbit operations campaign entailed a lowering of GOCE’s orbit by 30 km down to 229 km mean altitude, lower than what had ever been planned. When starting preparations for the campaign, the actual target altitude was not known and was determined by a combination of assessments and evaluations on the predicted atmospheric density at lower altitudes (driven by the evolution of solar activity), and the performance of S/C and ground segment. A main driver for determining by how much the orbit could be lowered was S/C safety: in case of an interruption of drag-free mode and a resulting decay of the altitude, ground had to resume firing of the ion propulsion system in due time, before the increase of drag due to the altitude decay would become unrecoverable. The FOS was originally designed to cope with an outage of the ion propulsion system for a duration of 8 days: in case of an interruption of drag-free mode, the FOS would have to react within 8 days to stop the orbital decay. For the low orbit operations campaign, it was decided to reduce this time to 2 days –the minimum time deemed necessary to reliably deal with the recovery of major S/C contingencies–, while also evaluating an intermediate case with 4 days recovery time. Taking assumptions on the worst case environmental conditions and S/C behavior in case of drag- free mode interruption, in early 2012 the lowest possible mean altitudes still allowing a 8/4/2-day duration of drag-free mode interruption were determined to be 251/244/239 km, respectively. When solar activity didn’t raise as expected, in spring 2013 the evaluation was re-performed, now yielding a target altitude of 229 km for allowing a 2 days recovery time. Figure 25 shows the altitude decay for the assumed reference scenarios.

Figure 25: Decay reference profiles for starting altitudes of 251km, 244.6km, 239.6km (based on March 2012 density predictions), and decay reference profile for 229 km (based on lower April 2013 density predictions).

Page 44/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Evaluations on S/C performance: The performance of the S/C at lower altitudes and higher drag levels than originally foreseen was evaluated with the following results: DFACS performance: TASI Torino ran a series of simulations on the high fidelity E2E simulator (as used in development), with environmental conditions representative of the lowered orbit. All DFACS modes were found to work under the increased density conditions. For ECPM, the need for seasonal tuning of parameter TIMER_ECLIP_THR was identified [RD-4]. EGG performance: data between November 2009 and August 2011 was analysed for a possible impact of the increased drag environment on the gravity gradient performance. In that period, the common mode acceleration (= drag) increased by a factor 2 -3. While a slight performance degradation could be seen during high frequency atmospheric disturbances, overall no sensitivity of performance to the increase in drag could be detected. S/C power budget: operations in a high drag environment require higher thrust levels, which may have a substantial impact on the S/C power consumption. When in sunlight, the power budget allows to fire the IPA at the maximum thrust level (21 mN). When in eclipse season, the maximum possible IPA thrust while still keeping a balanced power budget is dependent on the eclipse duration. The power budget established before launch [RD-9] was re-evaluated, to determine the maximum power that could be drawn from battery as a function of eclipse duration, while maintaining a stable battery state- of-charge. This work was done in collaboration with the spacecraft manufacturer, running power budget simulations with tools used during development, taking into account the current health status of the battery and the power consumption of the S/C units based on actual in-flight telemetry. The result of the analysis can be seen in Figure 26, showing that the revised budget allowed having about to 6 mN of additional Figure 26: Available thrust depending on eclipse duration thrust. (pre-launch vs. revised power budget).

Setup of operations teams and ground facilities: A series of measures was put in place to ensure S/C recovery within of 2 days: Flight Control Team: The on-call scheme was revised to have two SOEs and 1 SOM on-call, with at least one of the on-call SOEs capable of operating the DFACS. This required hiring of two additional SOEs, and training of some of the existing SOEs for DFACS operations. The SPACON team was reinforced with part of the Envisat SPACON team following the Envisat end-of-mission, bringing the number of SPACONS to 6 (shared with

Page 45/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Cryosat-2). This allowed manning every GOCE pass, ensuring a faster reaction time in case of anomalies. Procedures for recovering from an interruption of drag-free mode were revised to ensure a stop of the orbital decay (i.e. restart of the ion propulsion system) as soon as possible. A dedicated simulations campaign was performed in late 2012 to train the FCT for the campaign, also involving Flight Dynamics [RD-39]. Flight Dynamics: The on-call scheme (for an engineer of the orbit team) was extended slightly. The approach for the orbit determination activities in case of an interruption of drag-free mode was adapted for the higher drag environment with rapidly increasing Time Offset Values (TOV: the difference between the expected and the actual time of arrival of the S/C at the station – a measure for the along track orbit error), see Figure 27: in general, a first OD was run as soon as possible after the contingency based on whatever information was available at this stage, in order to stop having to correct for the TOVs on station side to acquire the S/C. A second OD run was then done at a later stage. Data on the history and prediction of solar activity and atmospheric density was delivered on a monthly basis, allowing to monitor the evolution of actual solar and geomagnetic activity and atmospheric density as compared to the reference scenario devised when planning the campaign. Stations: Station coverage was extended by a Troll/KSAT pass around midnight, reducing the number of blind orbits over night for faster detection of S/C anomalies. Special training of ECC operators at ESOC and Kiruna local staff for contingency operations (e.g. search for the S/C along track by ECC in case of no AoS). On-call of Ground Operations Engineer (GOE) at ESOC for holiday periods in excess of 2 non-working days. Mission Data Systems: During the low orbit operations campaign, MCS software support (SWS) was requested to be on-call on all non-working days (as opposed to the previous approach of only requesting on-call for periods of 3 or more non-working days). For the simulations campaign, a new simulator delivery with some important fixes was requested. An additional simulator machine and MCS client were also added for executing the simulations campaign.

Page 46/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 27: Evolution of Time Offset Value (TOV) at the Kiruna station depending on average drag encountered.

Execution of the campaign: The actual altitude profile during the low orbit operations campaign is shown in Figure 28. Thanks to lower than expected drag levels owing to low solar activity, the altitude could be lowered down to about 229 km mean altitude, 10 km lower than originally planned. The orbit lowerings throughout the campaign were executed with two different methods: Orbit lowering in Aug and Nov 2012: a negative acceleration bias was introduced in DFM_FINE (similar to the way altitude tuning manoeuvres were done in routine), allowing to continue acquiring science data. An acceleration bias corresponding to a negative thrust bias of 2 mN was used in August, while a bias corresponding to 1.5 mN was used in November. The latter was chosen to avoid hitting the minimum possible IPA thrust level (0.6 mN) in a portion of the orbit when the drag levels are low, which would imply the S/C not being drag-free for a short duration and hence impact the scientific measurements.

Page 47/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Orbit lowering in Feb and May 2013: these were performed in Fine Pointing Mode (FPM) with the ion propulsion system off. The orbit lowering in Feb 2013 to 239.2 km was done in this way, as a S/C anomaly on the Gradiometer had anyway led to an interruption of drag- free mode shortly before the planned lowering start. For the final lowering in May 2013, the decay was intentionally done in FPM, to reach the target altitude as fast as possible.

The precise altitude acquired after each lowering was selected to provide a repeat cycle of around 60-75 days for the first three lowerings, while for the final lowering a target altitude of 228.9 km was selected to obtain a repeat cycle of 143 days with a sub-cycle of 56 days. During the final orbit lowering in May 2013, the redundant ion propulsion system IPA-B was checked out (only possible in FPM with IPA-A off). The engine performed flawlessly Figure 28: Altitude profile for the low orbit operations campaign. more than 4 years after the last firing in commissioning. Three interruptions of drag-free mode were encountered throughout the campaign, in Jan 2013 at 244 km (IPA stopped working), in Feb 2013 at 239 km (attitude control loss in recovery from EGG anomaly) and in Aug 2013 at 229 km (IPA stopped working). All measures put in place to ensure fast S/C recovery worked well, allowing to restart thrusting rapidly with very limited altitude loss. Figure 29 shows the altitude and thrust profile during the contingency in Aug 2013, with thrusting of the IPA resumed about 7h after the contingency, limiting the altitude loss to only 340m.

Figure 29: Mean altitude and IPA thrust during a fallback to FPM in August 2013. Thanks to the measures put in place, thrusting could be resumed 7h after the fallback, such that the resulting altitude loss was only about 340 m. The altitude was recovered initially in DFM_PREP with thrust fixed at 10.8 mN, and then in DFM_FINE with an acceleration bias. Altitude recovery was completed early on 31/08/2013.

Page 48/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

In terms of S/C performance, the following special events linked to the lowered orbit and the higher drag levels were encountered: The DFACS control was pushed to its limits during strong geomagnetic storms at the lower altitudes, with the drag temporarily going above the maximum IPA thrust (21 mN). In some cases changes in the drag were faster than what the DFACS could compensate, resulting in a spike in the linear acceleration (S/C not drag-free for short amounts of time). See section 4.1.2 for more details on the DFACS performance. The three star trackers were providing spurious invalid measurements at the same time, signaling the detection of a big bright orbit in the field of view. Each anomaly occurred at high latitudes at the time of strong geomagnetic activity. These short transient blindings may have been linked to aurora phenomena: during geomagnetic storms auroras can exceptionally reach beyond GOCE’s operating altitude, and short-lived auroral rays of light may be generated.

Page 49/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

3.5 De-orbiting Operations Campaign This section gives an overview of the operational setup and evaluations performed for the deorbiting operations campaign, and the actual execution of the campaign. De-orbiting operations were exceptional as the intention was to continue operating the S/C as long as possible, until problems in either the space or the ground segment would make it impossible to proceed. See [RD-18] for more detailed information on the planning of the campaign and [RD-43] for the readiness meeting.

Evaluations on S/C performance: S/C performance was assessed in collaboration with the S/C manufacturer: No limitations were found for key DFACS units (in particular for STR, DSS, CESS) or for the SSTI. In the frame of simulation runs performed for the low orbit operations campaign, the DFACS had been tested up to average drag levels of roughly 20 mN, corresponding to altitudes down to about 200 km. No obvious limitations were found for drag levels beyond that, however the general expectation was that disturbance torques from the atmospheric drag would eventually lead to a loss of attitude control. The Gradiometer was originally expected to be able to measure under drag levels of up to 20 mN, however this figure was corrected to be at 80 mN after further discussion. Not used in the control loop anymore after stop of drag-free operations, performance of the gradiometer did not impact the overall S/C performance, but was relevant for the quality of the science data still acquired during de-orbiting. For all other subsystems, no constraints linked to the altitude decay were found. There was in particular no concern regarding the power budget at lower altitudes with increased eclipse durations, since there was anyway a lot of margin following stop of ion propulsion system operations (largest power consumer on-board).

Evaluations on ground segment performance: Ground stations: The ability of the ground stations to track the spacecraft at extremely low altitudes was evaluated in summer 2013: For Kiruna, tracking in an altitude range from 200 to 140 km was tested successfully using pointing information in STDM format during simulated contacts with a maximum elevation in the range 25 to 85 degrees. The antenna was in program track using STDMs generated by Flight Dynamics. It was also verified that the antenna Front End Controller (FEC) could correctly predict the tilt for the high elevation supports (up to 85 degrees elevation). Finally, the saturation level of the KIR-1 antenna Tracking Receiver was evaluated (using a test loop). For the KSAT Svalbard SG-3 antenna, two test passes at 140 Km at two different maximum elevations (13 and 74 degrees) were taken in program track, feeding the ground station with pointing data in TLE format provided by ESOC Flight Dynamics. In both cases the SG3 antenna tracked correctly. In addition it was assessed that no problems were to be expected with tracking receiver saturation and TOV measurements. This test was also representative for the other KSAT antennae.

Page 50/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Orbit prediction accuracy: A key aspect for preparing the de-orbiting operations was assessing the achievable accuracy of the orbit prediction by Flight Dynamics in a high drag environment. To evaluate the prediction inaccuracy, Flight Dynamics performed an analysis comparing pairs of propagated orbits starting with the same initial state but using different solar activity profiles, for two different solar activity regimes and at different altitudes (from 230 to 180 km mean altitude in steps of 10 km), see Figure 30. It can be seen that for the lower altitudes the TOV is already above 3 sec after 24h (the time between consecutive orbit determinations in routine), which would not allow automatic acquisition of signal at the station. The evolution of the TOV 10 days in the future for the medium solar activity case is depicted in

Figure 31, showing the expected limited accuracy Figure 30: Simulated evolution of Time Offset of the predictions several days in the future, Value (TOV) under different solar activity profiles rendering station scheduling (to be performed and for different altitudes. Automatic signal several days in advance) difficult. acquisition is still expected to work for TOVs around 3 sec.

Figure 31: Evolution of TOV over 10 days for the medium solar activity case at altitudes of 180 to 230 km

Page 51/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Setup of Operations Teams and Ground Facilities: A series of measures were activated to help operating the S/C as long as possible in the decay, on top of what had already been put in place for the low orbit operations campaign (see section 3.4). Flight Control Team: After some initial non-critical days of the decay, each Kiruna pass was manned by two spacecraft operations engineers, requiring the FCT to be organised in two shifts. Several new flight operations procedures were put in place to cover the special safe mode recovery or the planned S/C passivation activities. The mission planning procedure was adapted for the expected frequent replanning activities, including a change for the FD-provided Skeleton Planning File (SPF). Stations: Station coverage was extended further, taking two Troll/KSAT pass over night (rather than one), and covering each orbit during the day by a Kiruna or Svalbard/KSAT pass (resulting in up to 6 KSAT passes per day). All Kiruna passes were taken on the KIR-1 antenna. The potentially critical S/C acquisition activities during deorbiting were supported by a Ground Operations Engineer (GOE) for Kiruna passes, with a dedicated on-call service and on-site presence for critical passes. Extension of pre- and post-pass times for Kiruna and for Svalbard/KSAT to 5 min (not for Troll, as GOCE had no priority on that antenna), making the GOCE station scheduling more robust against the expected large drifts of the orbit at higher drag levels. Flight Dynamics: as orbit determination activities were expected to become increasingly difficult during de-orbiting operations, two orbit determination runs (instead of one) were performed every day (one in the late morning with a good amount of data over night available, the second one in the evening), requiring the FD orbit team to be organised in two shifts. Owing to the increased difficulty of performing an orbit determination run, these runs were done manually by the engineer in charge (rather than having an automatic run as in routine).

Execution of the campaign: The overall setup of the operations teams and the special measures put in place turned out to work well during the actual re-entry operations. Operations in the initial 2 weeks of deorbiting could be performed with less overhead than expected, while the last week was very work-intensive. While it did come as a surprise that both S/C and G/S kept working until the very end –last contact taken at 10/11/2013 22:43, about 1.5h before re-entry–, this did not pose any major problems: the campaign had always been planned to be open-ended, continuing S/C operations as long as possible. The total overall duration was almost exactly three weeks –from depletion of fuel on 21/10/2013 to re- entry on 11/11/2013–, corresponding to the maximum duration assumed in the planning. Throughout the campaign, daily coordination meetings were held with all operations teams, with the status and accuracy of the orbit prediction and the consequent impact on the scheduling of the stations a main topic. Separate coordination meetings with the Space Debris Office (SDO) were also held on a regular basis.

Page 52/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

S/C configuration and performance: Following fuel depletion on 21/10/2013, the deorbiting was performed with the DFACS in FPM and the SSTI used in the control loop (no need to switch to the GPOD). Transmitter switch off out of coverage was also performed until the very end. Table 5 gives an overview of the main S/C operations activities during deorbiting. Planned S/C data acquisition and configuration activities throughout the decay were implemented as foreseen, including regular acquisition of STR images and CESS diagnostics for assessment of unit performance during deorbiting, regular uplink of the light passivation sequence (to ensure the S/C would not keep radiating an RF signal in case of an unexpected permanent loss of contact), and several configuration activities for S/C FDIR and DFACS mode transition settings. There was no need to ever perform the originally planned final passivation, as the S/C kept functioning nominally until the end. SSTI-B was brought into the DFACS loop on 07/11/2013, as it was considered the more robust choice for the final days of operations at very low altitudes. The gradiometer was switched off on 10/11/2013, when the linear acceleration measurements were permanently saturated due to high drag. The following unplanned S/C configuration activities were implemented when the S/C decayed to altitudes lower than what had Table 5: Overview of S/C operations during deorbiting originally been considered feasible: The eclipse table was disabled on 06/11/2013 to exclude the risk of any unwanted survival mode due to uplink of an eclipse table not matching the actual eclipse times. On 08/11/2013, CPM mode transition durations were minimised and the automatic mode transitions from CPM to ECPM and from EPCM to FPM were re-enabled (they had been disabled earlier in the decay phase), such that in case of a survival mode or fallback to CPM, virtually no time would be spent in CPM for re-acquiring the desired attitude (going through rate damping, sun acquisition and Earth acquisition) and a transition to ECPM would be started immediately. This was judged to be the best configuration to not lose attitude control, considering the very high drag levels encountered at this stage of the decay, which were expected to ensure passive aerodynamic stabilisation of the S/C. The PASW global FDIR flag, the TMM FDIR and the HW DNEL were disabled on 10/11/2013 to prevent any unwanted on-board FDIR intervention in the final hours of flight.

Page 53/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

S/C performance during de-orbiting exceeded expectations, as the S/C kept functioning nominally up to the last contact taken about 1.5 before re-entry. Most notably, the attitude control in FPM was fully nominal. The S/C kept performing nominally when temperatures increased rapidly due to atmospheric friction in the final hours of flight (battery, CDMU and PCDU at over 80 degC as seen in the last pass). Some more information on the performance of specific S/C units and subsystems during deorbiting may also be found in chapter 4. Environmental conditions and orbit prediction accuracy: Orbit prediction accuracy turned out to be excellent. Thanks to the setup with 2 OD runs per day, TOVs remained very low, such that there was no need to ever perform a search for the S/C. Figure 33 shows the TOVs measured at Kiruna. The largest TOV of about - 6 sec (S/C early) was measured in the morning of 10/11/2013, the final day of operations. Also in this case no search was needed, since the increase of the TOV over night was monitored through taking additional Troll/KSAT passes. A contributing factor to this Figure 32: Daily F10.7 and Ap indices during deorbiting. While solar excellent performance was the activity was rather high compared to the evolution throughout 2013, comparably quiet solar and no geomagnetic storms were encountered. geomagnetic conditions in the three weeks of deorbiting (see Figure 32), such that no major changes of drag occurred. Figure 34 shows the drag levels during deorbiting, with some peaks in drag visible on 30/10/2013 and on 08/11/2013 when the geomagnetic field went from quiet to unsettled.

Figure 33: Evolution of the Time Offset Value (TOV) measured at Kiruna during deorbiting.

Page 54/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 34: Drag during de-orbiting operations, showing the evolution from beginning of the decay (left) and the extreme drag levels encountered on 10/11/2013, the last day of operations. Owing to the high drag levels encountered, orbit prediction accuracy was naturally much reduced compared to the routine phase (or even compared to a drag-free mode interruption at the routine operations altitude). As expected, this was a challenge for station scheduling, however the extension of the station pre- and post-pass helped alleviating the problem. Figure 35 gives an example of the drift in the orbit encountered late in the deorbiting over a period of a few days.

Figure 35: Difference in KSAT station AoS times between data based orbit determination of 30/10/2013 (used to schedule KSAT stations) and orbit determination on 05/11/2013.

Page 55/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Station performance and TM downlink budget: Both Kiruna and the KSAT stations (Svalbard, Troll) performed very well during deorbiting. Some minor problems encountered were not linked in any way to the specifics of the deorbiting operations and the low S/C altitude. The duration of station passes inevitably decreased as the orbit decay proceeded. Figure 36 depicts all Kiruna passes during deorbiting with a duration of more than 3.5 min above 5 deg elevation, showing the significant decrease of the maximum pass duration as the orbital decay proceeded. While this was not a problem for the TM downlink budget early in the campaign, it became an issue when operations continued at much lower altitudes than what had been expected. To allow dumping all playback data and not having to resort to reduce on-board TM generation rates, the following special measures were implemented for the final days of operations: Start and stop of the mass memory playback was performed manually before/after 5 deg elevation. On the last two days of operations, additional Svalbard/KSAT passes were scheduled in orbits already covered by a Kiruna pass. With the two passes in the same orbit overlapping, mass memory playback was left running. Additional processing on ground was then needed to ensure no duplicated data (dumped with the S/C visible by both antennae) was replayed. This approach had last been used in LEOP.

Figure 36: Kiruna passes during deorbiting with a duration of > 3.5 min above 5 deg elevation.

Page 56/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

3.6 OBSM, OBCPs and Mission Planning

3.6.1 On-board Software Maintenance A significant amount of flight software changes had to be implemented throughout the mission to resolve anomalies found in-flight. The approach for all OBSM activities was that new software releases and patches were prepared and validated by industry prior to submitting the products to ESOC [RD-54], in charge of installing the changes on-board. Whenever feasible, an additional functional test of the patches was carried out by the FCT through using the spacecraft simulator. Thorough pre-launch validation of all potential OBSM activities was key to the successful execution of these operations in-flight. Concerning patches to the platform application software (PASW), the flexibility offered by the patching mechanism (possibility to assemble chains of patches in processor module EEPROM) was essential to accommodate the amount of PASW changes needed with reasonable overhead. Installation of patches in PASW RAM onto the running PASW was not uncommon, avoiding the major activity of bringing the S/C into safe mode (implying for instance a decay of the orbit due to the interruption of drag-free mode) to activate an important PASW patch. Table 6 lists the OBSM activities performed, including references to S/C anomaly reports (where applicable), and the date the activity took place. Some of the flight software problems found had a rather serious impact on the mission, with the major events listed here below: Several cases of complete loss of attitude control were caused by on-board software problems (either problems in the code or software data). There were 2 cases of the S/C in free drift with no attitude control (GOC_SC-14 and GOC_SC-20) and 2 cases of a loss of correct attitude (GOC_SC-25 and GOC_SC-70). Following an erroneous halt of the IPA software on 17/10/2009, some settings in the DFACS were left in an inconsistent state, making it impossible to restart IPA usage. This had to be overcome though direct PASW RAM patch (and was eventually fixed permanently through patch of PASW code). See anomaly report GOC_SC-41. A corruption of mass memory playback data (first header pointers in the frames) occurred on 18/10/2009. It was eventually recovered on 23/10/2009 by resetting context information in PASW RAM, however the root cause could only be found when the anomaly reoccurred on 29/11/2009, with a patch installed in early 2010. On 28/10/2009, the triggering of a faulty FDIR mechanism on the TM module (enabled after the playback data corruption), led to continuous power cycling of the TM module. After 1200 power cycles, ground managed to intervene and disable the FDIR. See anomaly report GOC_SC-43. SSTI double failure: on 02/11/2011, both SSTIs started delivering a wrong state vector. This was caused by a software problem when converting state vectors, relying on a look-up table including values relevant only up to the end of 2010. This resulted in 18 days outage of both SSTIs, up to when a new software was installed on-board.

Page 57/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Unit Description Anomaly Date of Activity STR ASW Patch for star detection limit in STR RAM GOC_SC-11 06/04/2009 STR-2 07/04/2009 STR-1, -3 PASW Correction of OBCP 5451 for RAM and EEPROM GOC_SC-1 07/04/2009 PASW Correction of surveillance L1-4 handling in EEPROM GOC_SC-2 28/05/2009 PASW Correction of surveillance G3 counter handling in EEPROM GOC_SC-7 28/05/2009 PASW Correction of MTR FCN reconfiguration routine in EEPROM GOC_SC-14 28/05/2009 PASW Correction of CPM to ECPM mode transition algorithm in EEPROM and GOC_SC-20 28/05/2009 RAM PASW Correction of global FDIR flag handling in state ‘Cold 1’ in EEPROM GOC_SC-21 28/05/2009 PASW Correction of ECPM angular rate computation algorithm in EEPROM GOC_SC-22 28/05/2009 SSTI ASW Full new SSTI application software v3.3 GOC_SC-5 09/06/2009 SSTI-B GOC_SC-9 24/06/2009 SSTI-A PASW Correction of DFM_FINE bias compensation algorithm (EEPROM and RAM) GOC_SC-25 09/06/2009 RAM 06/08/2009 EEPROM STR ASW Patch for star detection limit in STR Flash RAM GOC_SC-11 19/06/2009 STR-2 29/06/2009 STR-3 30/06/2009 STR-1 PASW Correction of attitude observer init in ECPM/FPM in EEPROM GOC_SC-29 06/08/2009 PASW New TCS tables following evolution of thermal settings in flight n/a 06/08/2009 PASW Correction of EDAC single bit error handler in RAM and EEPROM GOC_SC-34 29/09/2009 RAM 01/10/2009 EEPROM PASW Reset of IPA synch status word in PASW RAM to resume usage of IPA GOC_SC-41 20/10/2009 RAM PASW Reset of mass memory link context to recover from mass memory playback GOC_SC-42 23/10/2009 RAM data correction GOC_SC-44 06/11/2009 RAM PASW Correction of PASW code to prevent reoccurrence of GOC_SC-41 “Transition GOC_SC-41 16/02/2010 EEPROM FPM to DFM_PREP fails (TTTCs do not reach IPA)” PASW Correction of PASW code related to mass memory playback corruption GOC_SC-42 16/02/2010 EEPROM PASW Correction of TMM FDIR function GOC_SC-43 16/02/2010 EEPROM STR ASW Update of threshold to resolve a problem with occasional invalid attitude GOC_SC-45 07/10/2010 STR-3 RAM measurements 01/11/2010 STR-1 RAM 02/11/2010 STR-2 RAM 03/05 to 05/05/2011 Flash RAM (all STRs) PASW PASW RAM patch to allow modification of flags FDIR-ENABLE and AUTO- GOC_SC-49 n/a (only to be applied in FPM-ENTRY after a Cold 2 restart PASW RAM in case of Cold 2 restart) PASW PASW RAM and EEPROM patch to resolve GOCE_SC-50 “TMM FDIR GOC_SC-50 14/12/2010 RAM triggering during execution of OBCP 5451” 15/12/2010 EEPROM PASW New default thermal tables (raise of CDMU temperature following TM loss GOC_SC-36 15/12/2010 EEPROM anomaly; resolution of GOC_SC-36, -37) GOC_SC-37 GOC_SC-56 PASW Patch for new functionality of downlinking PASW-generated TM in HPTM GOC_SC-56 23/08/2010 RAM 15/12/2010 EEPROM SSTI ASW Full new SSTI application software v4.1 to resolve SSTI state vector anomaly GOC_SC-58 17/01/2011 SSTI-B 18/01/2011 SSTI-A SSTI Full new SSTI application software v4.2 n/a 31/07/2013 SSTI-B Table 6: List of On-board Software Maintenance (OBSM) activities

Page 58/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

3.6.2 On-board Control Procedure (OBCP) Maintenance OBCPs were used on GOCE for a range of purposes, including RF configuration and FDIR activities, S/C configuration at PASW start up and power-related FDIR. A total of 16 OBCPs had been developed by the S/C manufacturer and were present in the PASW at the time of launch [RD- 46]. The OBCP development environment was available at ESOC, enabling the FCT to modify existing or develop new OBCPs as per the process outlined in [RD-35]. Modification of default OBCPs to correct problems found in-flight were required in two cases, for OBCP 5451 “Activate RF-Link A-Side in expected configuration” in April 2009 (ref. anomaly GOC_SC-1) and for OBCP 5441 “Switch RF link from A to B-Side” in April 2011 (ref. anomaly GOC_SC-57). OBCPs 5461 “Switch OFF TRSP-1” and 5462 “Switch OFF TRSP-2” were developed in-house by the FCT and uplinked to the S/C in March 2011. OBCP 5461 was used for the transmitter-1 switch off from the MTL after every routine pass (instead of the manual commands to perform this activity). This allowed to reduce the number of commands uplinked weekly for routine operations by about 30%. Refer to [RD-36, RD-37, RD-38] for specifications of the new or modified OBCPs and the corresponding test plans and reports.

3.6.3 Mission Planning The GOCE mission planning concept inherited the classical ground segment setup with interfaces to Flight Dynamics, ESTRACK Management System and the Reference Planning Facility [RD-34]. Complex payload planning activities were not performed for GOCE due to the nature of the mission (Gradiometer constantly ON when in Science mode). The generated on-board schedule (SIOS) therefore only contained nominal pass commands for mass memory playback handling and set up of RF configurations. Payload activity request from the RPF were limited to occasional enabling and disabling of DFACS-related diagnostics. Figure 37 shows the mission planning approach at the beginning of the mission. The scheduled passes had to be filtered from the delivered main planning input file, i.e. SPF. This was done with a set of MCS SPF processing scripts written by the FCT in Perl. To run these scripts, so-called configuration files had to be generated by entering each pass per station based on OMS-11 entries.

Figure 37: GOCE mission planning approach at the beginning of the mission

Page 59/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

In 2010 these SPF processing scripts were embedded in a set of new planning scripts to incorporate the Plan View file as a new planning input and to optimise the SPF filtering. Figure 38 outlines the modified approach. Details on the rational for the modifications and introduced scripts can be found in [RD-41]. These scripts added an additional layer of flexibility to the evolving mission planning profile as summarised at the end of this section, in particular for mission phases such as the low orbit operations campaign in 2012-2013 or the deorbiting operations campaign in 2013. In 2011 a planning log sheet was introduced replacing the MPS log book, to streamline and harmonize the planning process. It contained all major activities of the planning procedure and provided a quick reference of the planning activity. In 2012 the low orbit operations campaign required an overview of all available passes in case of contingencies, generated by the MPS scripts. A major change in the mission planning concept was introduced during the Deorbiting phase in 2013, where a new set of mission planning procedures was written together with another update of the MCS scripts. Details on the changes for the mission planning can be found in [RD-18]. Throughout the mission, the GOCE mission planning was subject to continuous adaptations which could be accommodated with the update of the MCS planning scripts, the rules and constraints file and a new set of procedures. The evolution of the GOCE mission planning is briefly summarised by giving the major changes here below: handling of an increased number of antennas used in routine from 3 (SG-3, Kir-1 and Troll- 1) to 10 (SG-3, SG-25, SG-4, KIR-1, KIR-2, Troll-1, Troll-2, Balder, Idun, ETX); usage of a new Scheduling product, namely the Plan View File, which was not foreseen in the MCS MPS application; automation of the SPF processing to reduce manual planning activities, which were error prone and very time consuming; introduction of a MPS log sheet to streamline and harmonize the Mission Planning execution; add warnings for additional orbital events such as Sun Interference or uplink masking; automated generation of simple planning products such as empty PPF and OPF ; generation of contingency pass sheets for the low orbit operation campaign; processing of modified Flight Dynamics input file for the deorbiting operations campaign.

Figure 38: GOCE mission planning approach after introduction of the processing scripts in 2010

Page 60/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

3.7 Operational Documentation and Database

3.7.1 Spacecraft Database As from early 2008, all changes to the spacecraft database were handled through change requests approved by the SOM. Whenever necessary, new releases of the operational database were distributed to all systems by the FCT’s Analyst. After launch, 62 DB releases were made, incorporating changes from a total of 95 DB change requests. In general, in-flight updates to the database were not major, with most modifications for typical operations-related items: update of Out Of Limits, changes or additions of ANDs and GRDs, correction of minor database problems found, instantiation of TCs, and distribution of updated or new sequences of the Flight Operations Plan. The most significant DB-related problem occurred in November 2010. A corruption in database GODB_074 for commands with a repetition factor > 1 led to a false triggering of Service 12 FDIR on the transmitter, leading to a transmitter switchover (ref. anomaly GOC-1286). Significant database-related work was needed for the Dual PM software prepared for a possible reoccurrence of the TM loss anomaly. Apart from the dedicated MCS version and FOP version, this software required a new database, which was put together and used for SVT-3, the Dual PM software test with the GOCE engineering model in May 2012 [RD-28, RD-29]. This database version was never used operationally.

3.7.2 Flight Operations Plan (FOP) Starting in early 2008, all FOP updates were handled through change requests approved by the SOM. At launch the Flight Operations Plan [RD-3] contained 970 procedures, all of which had been validated in the pre-launch mission preparation phase. In total, 87 FOP change requests were raised after launch affecting 212 procedures (some of which modified several times). 51 new procedures were added. Incorporating these updates, the FOP was re-issued on a regular basis, typically 2 times per year, see Table 7. Final version 4.5 of the FOP contained a total of 1021 procedures. Significant changes in the FOP were needed for the major CDMU-related anomalies in 2010, for the low orbit operations campaign in 2012/2013, and for the final de-orbiting operations. A dedicated, separate version of the FOP [RD-30] was produced for the Dual PM software prepared for a possible re-occurrence of the TM loss anomaly.

Page 61/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

FOP Issue Issue date Remarks 3.5 15/06/2009 FOP update incorporating all changes following completion of major commissioning activities 3.6 12/10/2009 - 3.7 03/05/2010 FOP issue with all revisions required after the permanent failure of CDMU-A 3.8 15/11/2010 FOP issue incorporating all changes needed after S/C recovery from TM loss anomaly 4.0 18/04/2011 - 4.1 17/10/2011 - 4.2 23/04/2012 - 4.3 24/09/2012 FOP issue for low orbit operations campaign 4.4 04/03/2013 - 4.5 29/08/2013 FOP issue for deorbiting operations

Table 7: FOP issues produced since launch

Page 62/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

4 SPACE SEGMENT

This chapter gives an overview of the main activities and events for each S/C subsystem, evaluating the performance and discussing the main anomalies encountered. A detailed description of all S/C units and subsystems can be found in the S/C user manuals [RD- 26, RD-27].

4.1 Drag-free Attitude and Orbit Control System (DFACS)

4.1.1 DFACS Overview The DFACS has the task of reducing the non-gravitational linear accelerations below a threshold compatible with the accelerometer dynamic range and with the gradiometric performance, when coupled to the gradiometer imperfections and residual accelerometer non-linearity effects. The DFACS implements 4 degrees of freedom control, using an ion propulsion system for linear axis control (to dynamically compensate the atmospheric drag) and magnetic torquers for three axis angular control. Attitude control is performed uniquely with magnetic torquers supported by passive aerodynamic stabilisation, owing to the need for a very quiet environment (e.g. no microvibrations caused by reaction wheels). There is no clear distinction between platform and payload: in drag-free mode, EGG and SSTI data is used in closed loop. All DFACS algorithms are embedded in the PASW running on the platform’s central computer (CDMU).

DFACS sensors and actuators: The DFACS uses the following sensors: Three hot redundant autonomous star trackers (STR), providing high accuracy and autonomous inertial attitude determination from “lost in space” conditions; Two hot redundant Digital Sun Sensors (DSS), providing high accuracy sun vector information; A Coarse Earth and Sun Sensor (CESS) consisting of 6 sensor heads, providing robust attitude line of sight measurements with respect to Sun and Earth for initial acquisition and coarse pointing (safe) mode; Three 3-axis fluxgate magnetometers (MGM), used for magnetic torquer control and as rate sensors. The readings from the three MGM on each axis are subject to a 2 out of 3 majority voting scheme; The Electrostatic Gravity Gradiometer (EGG) for obtaining linear and angular accelerations for drag-free control; The Satellite to Satellite Tracking Instrument (SSTI) for obtaining the orbit state vector to correctly orient the S/C. The DFACS uses the following actuators: Two Ion Propulsion Assembly (IPA) units operated in cold redundancy, for linear drag-free control and orbit semi-major axis control. The IPA is based on a ‘Kaufman’-type electron bombardment ion motor running on Xenon gas. The thrust can be in the range from 0.6 mN mN/s.

Page 63/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Three internally redundant magnetic torquers (MTR) for attitude control. Two operating modes are implemented: Coarse Mode (±0.5A, switching regulation, dead band around zero crossing) and Fine Mode (for scientific mode only; ±0.05A, continuous regulation, 0.05mA/Hz noise spectral density); A Gradiometer Calibration Assembly (GCA), constituted by a cold-gas propulsion system (8 thrusters), used to shake the satellite for EGG calibration purposes.

DFACS modes: The DFACS provides 3-axis stabilised Earth-pointing attitude in all modes, which include Coarse Pointing Mode (CPM), Extended Coarse Pointing Mode (ECPM), Fine Pointing Mode (FPM) and the Drag-Free Modes (DFM_PREP,

DFM_COARSE, Figure 39: Usage of sensors and actuators in the various DFACS modes. DFM_FINE). Figure 39 shows the sensors and actuators used in each mode. Figure 40 shows the DFACS modes transition logic, Figure 41 the IPA thrust in DFM_FINE: CPM is an acquisition mode as well as an FDIR-triggered survival mode. In CPM, a stable pointing with respect to Sun and Earth is achieved. CPM was designed to cope with an angular rate at separation from the launcher of up to 1°/s on each axis and to guarantee Sun acquisition in less than 5 hours. ECPM improves the LORF pointing to limit the altitude decay and to ensure the star trackers are not affected by the Earth limb, allowing a transition to the next mode (FPM). Compared to CPM, the pointing accuracy is improved due to a better LORF definition making use of the SSTI, and due to an enhanced attitude determination algorithm using an Earth magnetic field model and a sun propagator. FPM is the normal non drag-free operating mode during mission phases when orbit decay is required. The attitude is determined using star tracker data. The target attitude is defined by a reference generator driven by SSTI data, as used in all modes except CPM. DFM_PREP: the IPA is switched on and operated at a constant thrust level set by ground. The EGG can be switched on out of the control loop. The MTR are operated in coarse mode. DFM_COARSE: the EGG is in acquisition mode (i.e. with enlarged dynamic range and with coarse measurement accuracy) and the IPA is used in closed loop exploiting coarse EGG measurements, to perform a first-level linear drag-free control in the along-track direction. Angular acceleration reduction is still based on STR measurements. The MTR are operated in fine mode. DFM_FINE: the EGG is in science mode (i.e. with a smaller dynamic range, but very high measurement accuracy). Linear and angular acceleration control is performed using fine EGG measurements. STR measurements are employed to recover angular acceleration low frequency noise. The in-flight calibration of the gradiometer is also performed in DFM_FINE. The MTR are operated in fine mode.

Page 64/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 40: DFACS modes and mode transition logic.

8 7 6 ANX DNX 5 4 3 2 1 South Pole North Pole 0 Instantaneous IPA thrust [mN] IPA thrust Instantaneous 06:00 07:30 09:00 10:30 12:00 13:30 15:00 16:30 18:00 19:30 21:00 22:30 00:00 01:30 03:00 03:00 04:30

Figure 41: Instantaneous IPA thrust over a period of 24 hours starting on 01/03/2011. Each tick on the X-axis corresponds to one orbit. The orbital positions corresponding to North Pole, South Pole, Ascending Node Crossing (ANX) and Descending Node Crossing (DNX) are marked.

Page 65/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

4.1.2 DFACS Activities, Events, Performance

DFACS-related activities and events throughout the mission: The following major DFACS-related events and activities occurred throughout the mission: DFACS commissioning: from March to September 2009, the DFACS was fully commissioned, including a checkout of the drag-free modes. The orbit lowering to reach 259.6 km after launch was performed mainly in FPM. Mode transitions in the frame of on-board anomalies: any major on-board anomaly led to transitions to lower DFACS modes, e.g. in frame of a safe mode (DFACS back to CPM) or a fallback to either FPM or CPM. Recovery operations back to DFM_FINE usually took at least 1-2 days owing to the long transition durations and the complex related configuration activities. Routine DFACS-related operations : in the routine operations phase, the DFACS was stable in DFM_FINE. Occasional ICM calibrations and S/C altitude tuning through introducing an acceleration bias in the drag-free control loop of DFM_FINE were done. Major DFACS anomalies: owing to the high complexity of the system, the majority of in- flight anomalies encountered were linked to the DFACS. The problems could be resolved by operational workarounds or DFACS flight software changes. The most notable DFACS anomalies were the following: Divergence of FPM controller during commissioning due to the low density environment after launch (GOC_SC-13). In the recovery from the resulting safe mode, the magnetic torquers got switched off due to a DFACS software problem, with the S/C in free drift for 1 orbit up to when ground intervened (GOC_SC-14). Fallback from ECPM to CPM during commissioning due to a false DSS FDIR trigger (GOC_SC-19). In the ensuing transition from CPM to ECPM, the controller descheduled itself due to a DFACS software problem, with the S/C again in free drift up to when ground intervened (GOC_SC-20). Divergence of attitude control in the first K2 calibration of the mission due to a DFACS software problem (GOC_SC-25). 5 fallbacks to FPM due to the ion propulsion system stopping to work (GOC_SC-39, -53). After the first such fallback, the IPA could not be restarted due to the corruption of a buffer in the DFACS software used for communications with the IPA (GOC_SC-41). Divergence of attitude control due to the SSTI state vector anomaly (GOC_SC-58). Two divergences of attitude control due to the EGG ASH-1 anomaly and related recovery activities (GOC_SC-70, -73). Low orbit operations campaign: DFACS performance was revalidated in preparation for the low orbit operations campaign [RD-4], for drag levels higher than the design specifications. The orbit lowerings in the frame of this campaign were performed either with an acceleration bias in DFM_FINE, or by going back to FPM (ion propulsion switched off). Re-entry operations: the DFACS was operated in FPM throughout the re-entry campaign, with FPM working nominally during the entire campaign.

Page 66/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 42 shows the time spent in each DFACS mode. The DFACS was in DFM_FINE for over 80% of the mission lifetime. In routine, the other modes were only used when having to recover from an interruption of drag-free mode. Considerable time was spent in FPM during commissioning to lower the orbit and during the TM loss anomaly in 2010. DFM_PREP was also used extensively during the TM Figure 42: Time spent in each DFACS mode throughout the mission. loss anomaly.

Performance of Coarse Pointing Mode (CPM): Throughout the mission, CPM was entered 12 times (including first attitude acquisition after S/C separation, counting the 3 consecutive CPM entries in the case of the CDMU-A failure in Feb 2010 as one), with ground having no visibility for the case after the ground-triggered safe mode during the TM loss anomaly in summer 2010. CPM performance was excellent. Figure 43 and Table 8 provide information on the entry conditions to CPM for several in-flight cases in terms of S/C attitude and rates. While S/C rates at CPM entry were always low, attitude errors at CPM entry were large for major anomalies resulting in a loss of attitude control (FPM divergence on 01/04/2009, DFM_FINE divergence due to EGG problems on 12/05/2009, on 07/06/2012 and on 04/02/2013, DFM_FINE divergence due to SSTI state vector anomaly on 02/01/2011).

See Figure 44 for the duration of CPM phases for initial attitude acquisition, and Table 9 for the minimum CPM Table 8: S/C rates at CPM entry in the course phase duration as well as the setting of the FDIR of the mission. The case on 17/03/2009 is timeout surveillance for each phase: after S/C separation from the launcher. Rate damping (CPM_RDP): as CPM was never entered with high rates, the duration of CPM_RDP was usually very short, close to the minimum duration of the phase and far removed from the FDIR timeout threshold.

Sun acquisition (CPM_ SAP): duration usually close to the minimum, with the exception of the safe mode on Table 9: Minimum duration and 07/06/2012 entered with large attitude errors. FDIR timeout for CPM phases

Page 67/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Earth acquisition (CPM_ EAP): duration usually very close to the minimum transition duration of 3h. The standout case on 01/04/2009 –duration of 6h, not far from the FDIR threshold– was caused by a DFACS software problem, with the S/C in free drift for 1 orbit (GOC_SC-14).

Figure 43: S/C attitude error at CPM entry for select cases. The cases with high attitude errors are due to DFACS-related anomalies leading to a divergence or loss of attitude control.

Figure 44: Time spent in the CPM phases for rate damping, sun and Earth acquisition.

Page 68/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Performance of Fine Pointing Mode (FPM): FPM controller divergence after launch (GOC_SC-13): As GOCE operated in an atmospheric drag environment, aerodynamic forces constituted an important element for attitude control. The DFACS controller had been designed taking assumptions on the range of atmospheric density encountered and on the aerodynamic properties of the spacecraft. The accuracy of these assumptions had been one of the main unknowns during the design phase of the S/C, due to the limited predictability of the solar activity and the lack of comprehensive data on the properties of the residual atmosphere at GOCE’s operating altitude. As from the end of LEOP, the FPM controller had been under intense scrutiny, as the performance of the attitude Figure 45: Increasing attitude error around the S/C Z-axis (yaw) after control was not nominal, with launch, leading to the first safe mode of the mission on 01/04/2009. the attitude errors larger than expected, in particular the error around the S/C Z-axis (see Figure 45). On 01/04/2009 the attitude errors started growing rapidly, until FDIR triggered and safe mode was entered, upon which the S/C was successfully stabilised in CPM. The anomaly was found to have been caused by a lower than expected contribution of passive aerodynamic stabilization –due to the exceptionally low solar activity in 2009– leading to a general degradation of attitude control performance. New controller gains already under preparation could not be uplinked in time to prevent the safe mode. The new gains were eventually uplinked on 22/04/2009, with FPM performance nominal for the rest of the mission. A corresponding update of controller gains for DFM_PREP and DFM_COARSE was performed as well. FPM performance during deorbiting: the S/C was operated as long as possible in the orbital decay phase after fuel depletion. It was decided to use FPM, which was considered to be the mode most robust in an environment with very high drag levels. FPM performance was very impressive, with the controller working and no attitude divergence observed until the very end, at drag levels above 1N, at an altitude of little over 100 km. The pattern of attitude errors changed significantly during the deorbiting, with an increasing Figure 46: Attitude error around the S/C Z-axis (yaw) over 1 orbit at various stages during deorbiting with increasing drag levels. Page 69/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

number of oscillations around the S/C Z-axis, see Figure 46. At the extreme drag levels encountered towards the end, torques induced by the atmospheric drag were above the capability of the magnetic torquers: passive aerodynamic stabilisation of the S/C must have played a major role in this phase, as S/C attitude remained fully nominal.

Performance of Drag-free Mode: Overall performance: In the course of the mission, the vast majority of time was spent with the DFACS in DFM_FINE. Figure 47 shows a typical behaviour of the attitude errors, angular rates, angular accelerations and linear accelerations in DFM_FINE as observed in flight over a period of one day. As attitude control is performed uniquely with magnetic torquers, attitude control performance is linked to the amplitude and phase of acceleration disturbances. It is possible to see (in particular on the X and Z rotational axis) the periodicity imposed by the magnetic field and the orbital period, having a significant impact on the attitude control implemented with magnetic torquers only. Figure 48 shows the performance in the frequency domain of the linear acceleration along X axis and of the angular acceleration around the X-, Y- and Z-axis.

Figure 47: Attitude control performance in DFM_FINE: attitude errors, angular rates, angular accelerations and linear acceleration over a period of one day.

Page 70/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 48: One-sided spectral density of linear acceleration along X axis and angular acceleration around X-, Y- and Z-axis in DFM_FINE (the blue line is the requirement).

Figure 49 depicts the attitude errors during DFACS mode transitions from FPM up to DFM_FINE, showing different controller performances in the various modes depending on the sensors and actuators used in the control loop. When entering DFM_FINE, the EGG is switched to science mode and the EGG measurements are used for the angular accelerations control by the DFACS in combination with STR data, while STR data only are used in the lower modes. The attitude error components on the Y and Z axis show a sensible reduction after entering DFM_FINE, particularly visible in the figure for the Z component. The X-axis attitude error changes its shape when DFM_FINE is entered due to the need to reduce the angular accelerations.

Page 71/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Attitude Error X [deg] Attitude Error Y [deg] Attitude Error Z [deg] 30 25 DFM-P DFM-F 20 15 10 5 0 -5 -10

AttitudeErrors [deg] -15 -20 -25 FPM DFM-C -30 24/05/2009 25/05/2009 26/05/2009 27/05/2009 28/05/2009 29/05/2009 30/05/2009

Figure 49: Attitude errors during DFACS mode transitions from FPM to DFM_FINE.

Orbit control: Altitude control of GOCE’s orbit is crucial to achieve the desired ground coverage for global mapping of the Earth’s gravity field. The original requirement was to control the S/C altitude such that each of the 979 ascending node crossings in a 61-days repeat cycle would fall into a bin of 40 km width (corresponding to a spacing of approximately 0.4 deg). In practice, DFM_FINE was found to perform to a very high precision, with a residual drift in altitude of a few tens of centimetres per day, making the orbit prediction accuracy for GOCE comparable to what is achieved for missions on more conventional orbits above 700 km altitude. The spread around the targeted equator crossing could be kept to less than ±3 km (far better than the required ±20 km) by performing small altitude adjustment manoeuvres in the order of no more than ±20 m altitude raise/lowering every few weeks. These manoeuvres are implemented without interrupting science operations, by introducing a small acceleration bias (usually corresponding to less than 0.2 mN thrust) in drag-free mode for the desired duration of time. See Figure 50 for an overview of the manoeuvres needed in the longest uninterrupted period spent in drag-free mode from Feb to Nov 2011. The very precise altitude control allowed to improve the 0.4 deg spacing of subsequent ascending node crossings at the equator inherent to a 61 days cycle: occasionally the repeat cycles were slightly rotated with respect to each other, with the aim to achieve a homogeneous coverage of Figure 50: Altitude manoeuvres in DFM_FINE in 2011. The 0.1 deg longitudinal spacing at the large manoeuvres in August were to shift the ascending node equator by the end of the nominal crossings following completion of a repeat cycle. mission. Low orbit operations campaign: During this campaign, the DFACS encountered drag levels higher than what was originally foreseen. While performance remained excellent, the following special events linked to the lowered orbit and the higher drag levels were encountered:

Page 72/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

In presence of geomagnetic storms, spikes on the observed linear acceleration in the flight direction occur (anomaly report GOC_SC-71). These phenomena started with some isolated cases while flying at altitudes of 240 km and higher, and significantly increased in frequency as 229 km were reached. The spikes in the observed linear acceleration are caused by the DFACS not being able to fully compensate the drag in presence of a rapid variation (increase or decrease) of the density level. In these occasions the IPA thrust as commanded by the DFACS using a dedicated thrust-limiter algorithm is not changing fast enough, resulting in a spike on the observed linear acceleration, which should nominally remain close to zero in drag-free mode. Figure 51 shows the thrust the DFACS would require to maintain the spacecraft in drag free conditions (blue line), the thrust actually delivered by the IPA (green line) and the observed linear acceleration (red line) for one of such cases. The negative spike in the observed linear acceleration means that the current drag level is being under- compensated (to be drag-free would require more thrust from the IPA, but the latter does not increase fast enough) while the positive spike means that the DFACS is over- compensating the drag (IPA provided thrust does not decrease fast enough). When flying at 229 km, during strong solar and geomagnetic activity periods the IPA maximum deliverable thrust of 21 mN was sporadically hit. As the DFACS is not allowed to request a thrust higher than 21 mN to the IPA, the system is not able to fully compensate the atmospheric drag, hence resulting in a negative observed linear acceleration peak. Figure 52 is showing such a case on 01/06/2013.

Figure 51: Ion propulsion demanded and delivered thrust [mN] plotted against observed linear acceleration [m/s2] during a 3 minutes period of a geomagnetic storm during the low orbit operations campaign with rapid changes of atmospheric density.

Page 73/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 52: Ion propulsion demanded and delivered thrust [mN] plotted against the observed linear acceleration [m/s2] during a 16 minutes period of a strong geomagnetic storm, with IPA reaching the maximum deliverable thrust of 21 mN.

Miscellaneous DFACS-related anomalies: Apart from the major anomalies mentioned in the previous sections, the following DFACS-software related issues occurred throughout the mission: Some of the DFACS G3 timeout surveillances turned out to be inactive after launch due to software implementation with a variable that would wrap around before reaching the maximum mode timeout. This was resolved by PASW patch (ref. anomaly report GOC_SC- 7). Two problems related to the implementation of DFACS global surveillance G2 (S/C angular rates) were found, one early in the mission corrected by PASW patch (ref. GOC_SC-22), one late in the mission when preparing for the low orbit operations campaign (ref. GOC_SC-72). A problem with the initialisation of the attitude observer at entry to ECPM or FPM discovered in commissioning was fixed by PASW patch (ref. GOC_SC-29).

Page 74/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

4.1.3 Star Trackers (STR) Overview: GOCE has 3 identical star trackers (STR) manufactured by DTU. Each STR consists of 2 separate parts: a Data Processing Unit (DPU) and a Star Tracker Head Assembly, which is composed by a Camera Head Unit (CHU), an inner and outer Stray-light Baffle and a Star Tracker Harness to connect CHU and DPU. The three sensor heads and the stray-light baffles are mounted on floor 4, on the +Y/-Z-side of the S/C (Figure 53). STRs are used in the control loop for FPM and higher modes. Normally all three STRs are switched ON, but only one of them is used by the DFACS for attitude determination. It is also possible to switch ON the STRs out of the DFACS control loop while the satellite is operating in lower modes (CPM and ECPM). During commissioning, the alignment of STR-2 and STR-3 was updated to get in line with STR-1. The approach for STR selection management was also changed: the originally foreseen autonomous STR change by the DFACS when the STR in the control loop was getting blinded by the moon turned out to be undesirable for science, as it led Figure 53: Star tracker mounting on floor 4 of the S/C. to recording some invalid STR measurements. As from summer 2009, STR selection before and after moon blindings was therefore performed by ground. As STR-3 experienced more invalid measurements due to the closeness of its boresight to the Earth limb, it was usually kept in the last DUUT position. Throughout routine operations the STRs showed a good behaviour. As part of monthly check activities, a sample image was taken with each STR and sent to industry for evaluation; the images always showed a healthy behaviour of both hardware and software. For the few issues experienced during nominal operations, the mission had never been at risk of suffering a fallback to lower DFACS modes or even a safe mode. A total of two software patches had to be implemented. Prior to the orbit lowering in 2012 and the de-orbiting in 2013, the performance of the STRs was re- evaluated together with industry, confirming that the units were expected to work nominally at very low altitudes. It was seen that even at an altitude of 100 km the angle between the STRs boresight and the Earth limb would not surpass the operational limit of 21° (see Figure 54). During deorbiting, the STRs behaved extremely well and were still functioning nominally when last seeing the S/C at little over 100 km, 1.5h before re-entry into the atmosphere. No special stray light effects were seen. To gather information on STR behaviour, 8 images were sampled with STR-3 over the course of 1 orbit, initially every 3 days, below 190 km every day. STR-3 was chosen for this check as its orientation closest to the Earth limb made it the most sensitive to stray-light effects. Table 10 shows the image sampling history during de-orbiting.

Page 75/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 54: Angle between STR boresight and the Earth limb depending on the altitude.

STR images sampling history during de-orbiting DOY Date Start time End time Altitude 296 23/10/2013 12:05:00 13:22:00 225 km 301 28/10/2013 12:10:00 13:27:00 216 km 304 31/10/2013 11:10:00 12:27:00 209 km 307 03/11/2013 11:10:00 12:27:00 199 km 309 05/11/2013 11:50:00 13:07:00 191 km 310 06/11/2013 12:40:00 13:47:00 187 km 311 07/11/2013 12:05:00 13:22:00 181 km 312 08/11/2013 11:40:00 12:57:00 174 km 313 09/11/2013 12:40:00 13:57:00 162 km 09:15:00 10:32:00 145 km 14:40:00 140 km 314 10/11/2013 17:30:30 135 km

21:15:00 125 km Table 10: STR images captured during de-orbiting operations.

Page 76/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Significant STR anomalies: Overall the STRs proved to work very reliably. Not a single system-level contingency (i.e. safe mode or fallback to lower DFACS mode) was caused by STR anomalies. The following STR-related problems occurred: Shortly after launch, a series of L5-1 surveillances were triggered linked to a STR parameter which determined the bright/faint ratio of a catalogued star; to resolve this a patch was installed on all STRs in April 2009 in RAM only, and was then installed permanently in Flash RAM in June 2009). See anomaly report GOC_SC-11. During commissioning in 2009, some tuning of STR-related DFACS FDIR was necessary, linked to an unexpected triggering of DFACS surveillance L5-5 during moon blindings (see anomaly report GOC_SC-23), and a too low setting of the STR failed counter leading to an FDIR-triggered STR switch off during long moon blindings (see anomaly report GOC_SC- 32). On a few occasions in 2010 the STRs provided a series of unexpected invalid attitude measurements; these events led to the triggering of surveillance L5-4 for STR-3 and its consequent automatic switch OFF on 13/03/2010 and 14/04/2010. After an investigation DTU reached the conclusion that the issue was experienced when performing intensity metrics of stars close to the galactic plane: the myriad of faint stars in the vicinity of the star of interest caused an apparent increase of the background level, which eventually resulted in the galaxy plane stars being estimated too bright. This issue was solved by a STR software patch installed in Oct/Nov 2010. See anomaly report GOC_SC-45. On 24/02/2010 when GOCE was in DFM_PREP, the angular acceleration increased significantly causing flag DFM_P_COMPLETED to toggle between TRUE and FALSE; this took place when STR-3 was in control. After an investigation it was seen that the attitude measurements provided by STR-3, due to a different mounting and a slightly noisier measurement w.r.t. the other two STRs, could lead to this sort of issues in FPM and DFM_PREP. The relevant DFACS software threshold was updated to prevent toggling of the flag. See anomaly report GOC_SC-47. On several occasions throughout the mission, all 3 STRs provided invalid attitude measurements around the same time for a very small number of samples, however too short to cause a S/C safe mode. These events always took place during periods of strong geomagnetic activity and in correspondence to bright aurora effects. The STR manufacturer suggested that these invalid measurements were probably caused by the auroras entering the STRs field of view [RD-31]. See anomaly report GOC_SC-64. On different occasions STR-3 (28/01/2012 and 24/12/2012) and STR-2 (15/05/2012) experienced a sudden reboot due to an un-trapped single event upset in one of the RAM cells. Before these events the units did not show any anomalous behaviour and after the reboot the units were back to nominal. See anomaly reports GOC_SC-65 and GOC_SC-69.

Page 77/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

4.1.4 Digital Sun Sensor (DSS) The Digital Sun Sensor (DSS) is a two-axis solar sensor which provides accurate measurements of the Sun direction. It is based on the barycentre detection of the incident energy of the Sun, in the visible and near infra-red light spectrum. The DSS sensor consists of an optical head for the Sun spot imaging on the focal plane and a processing and data interface electronics which also includes the power section. The DSS is used in the lowest DFACS mode CPM and ECPM as attitude sensor but is kept ON also in higher modes out of the control loop, used for FDIR purposes (surveillance F1 – cross check DSS and STR measurements). An in-flight calibration of the DSS was performed in commissioning in 2009, aligning DSS-B to DSS-A. The new alignments were stored both in RAM and EEPROM. The following significant anomalies occurred: In April 2009 the DFACS Surveillance F2 (DSS consistency) triggered during the first eclipse entry of the mission, leading to a fallback to CPM. At the time of the trigger, eclipse was entered with DSS-B having already lost the sun, while DSS-A was still seeing the sun and providing a valid sun vector. This led to a trigger of surveillance F2, as the DFACS FDIR concept did not foresee that the two DSS sensors might not provide exactly the same measurements at eclipse entry/exit. As a consequence, the limit counter of surveillance F2 was enlarged. Refer to anomaly report GOC_SC-19. During LEOP it was noticed that the misalignment between DSS and each STR was on an average of 0.05 deg, however over the North Pole the misalignment was quickly going up to 0.22 deg. The most probable cause as analysed by industry was a reflection of the sun on the poles causing the DSSs to see a ‘second’ sun. As the F1 surveillance threshold was set at 2 deg, well above the maximum deviation seen in flight, ‘use as is’ disposition was accepted. Refer to anomaly report GOC_SC-8 and the relevant technical note [RD-32].

4.1.5 Coarse Earth Sun Sensor (CESS) The CESS provides a measurement of the Earth and sun vector on the basis of thermistor temperature readings from 6 sensor heads located around the spacecraft, such that the sensor has a full spherical field of view. Each sensor head consists of 6 PT1000 thermistors. Processing software for deriving the sun and Earth unit vectors based on CESS temperature measurements is embedded in the DFACS software. The CESS is used only in the lowest two DFACS modes CPM and ECPM, serving as the prime attitude sensor in CPM. An in-flight calibration of the CESS soon after LEOP showed good performance of the unit [RD-24]. Based on this, some of the processing parameters were updated to optimise the performance. The performance of the CESS was re-assessed in 2012 and 2013 during the low orbit operations campaign, confirming that the unit kept working nominally as altitude was lowered progressively. During de-orbiting operations with DFACS in FPM, the CESS was not used in the control loop. CESS calibration data was acquired at regular intervals, down to extremely low altitudes for offline assessment of the performance by the S/C manufacturer. For what concerns significant anomalies on the unit, thermistor CESS+Y/-Z_M2 of CESS head 6 started providing anomalous readings (with an offset to the other M-thermistors on that head) early in LEOP, ref. anomaly GOC_SC-6. This did not have an impact on the overall performance thanks to majority voting in place for the thermistor readings. The relevant threshold of DFACS surveillance L2 was adapted to avoid continuous triggerings. The behaviour has remained stable throughout the entire mission.

Page 78/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

4.1.6 Magnetic Torquers (MTR) The magnetotorquers (MTR) provide control torques around X, Y and Z axes. There are 3 MTRs, each nominally aligned parallel to the spacecraft X-, Y- and Z-axis. Each MTR consists of two main components: the core material and the winding around this core. The winding is redundant. The torquers are operated from redundant drivers in the CDMU which can be operated in coarse or fine regulation mode. In coarse mode, the maximum linear dipole is ±400 Am2; in fine regulation mode, the maximum linear dipole is ±50 Am2. The MTRs are the sole actuator for attitude control, and are hence continuously operated and used in all DFACS modes (in coarse mode up to DFM_PREP, in fine mode in DFM_COARSE and DFM_FINE). During the whole mission, MTR-A was in the control loop for most of the time. MTR-B was in control for about 20 days out of the total 1700 days of operations. Usually this was when MTR-B was selected autonomously following S/C safe mode entry, up to when ground re-established the default unit selection. For what concerns significant MTR-related anomalies, no problems on the unit themselves were encountered. However, a major anomaly occurred related to the management of the torquers by the DFACS software during a safe mode recovery on 01/04/2009. The command to recover the MTRF_FCN (software management unit for the fine magnetic torquers) to nominal was sent 11 seconds after commanding the MTRC_FCN (software management unit for the coarse magnetic torquers) back to nominal. Owing to the way MTRF/MTRC_FCN was managed in the DFACS software, this led to a situation in which all magnetic torquers were off, but no intervention by DFACS FDIR occurred. Thus, the S/C was without attitude control for one orbit (1.5h) before the coarse magnetic torquers were commanded back into the loop by ground. Refer to anomaly GOC_SC-14.

4.1.7 Magnetometers (MGM) The 3-axis magnetometer provides a measurement of the earth’s magnetic field. It consists of three magnetic sensors, X, Y and Z, operating independently and simultaneously to provide measurements of the earth’s magnetic field in 3 orthogonal axes. Each sensor has an analogue output corresponding to the component of the ambient magnetic field along its axis. The response of the sensor is proportional to the cosine of the angle between the applied field and the sensor's sensitive axis. In order to provide redundancy, together with the capability for failure detection and isolation, three identical 3-axis magnetometers are included. The MGM is used to determine the satellite rates in CPM mode and to adjust the magnetic torquer currents according to the attitude control needs in all modes. For what concerns special activities performed on the units, early in LEOP the magnetometers were calibrated in CPM to allow for performances compatible with ECPM, achieving a magnetometer bias of less than 500 nT per MGM axis. There were no significant anomalies on the MGM throughout the entire mission.

Page 79/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

4.1.8 Ion Propulsion Assembly (IPA)

Overview: The IPA is based on a ‘Kaufman’-type electron bombardment ion motor (Figure 55) running on Xenon gas. The thrust can be throttled in the range between 0.6 mN and 21 mN, providing a ec The S/C has two IPA chains, each of which consists of the following items: The Ion Thruster Assembly (ITA); The Ion Propulsion Control Unit (IPCU), providing the control electronics and the ITA power supply, together with the TM/TC interface with the CDMU; The Proportional Xenon Feed Assembly (PXFA), providing a pressure-regulated Xenon flow to the Cathode, the Neutraliser and the thruster main discharge. The IPA is used in all Drag-Free Modes and in case of emergency in ECPM. In DFM_PREP and in ECPM, it can be used as an open loop actuator, meaning that the thrust level is constant as set by ground. In DFM_COARSE and DFM_FINE, it is used as a closed loop actuator; the acceleration measurements provided by the EGG are fed to the DFACS software, which in turn commands the thrust level to compensate the atmospheric drag at a frequency of 10Hz.

Figure 55: Schematic of the QinetiQ T5 MkV Kaufman-Type Electron Bombardment Thruster.

Page 80/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

IPA operations throughout the mission: During commissioning, both the prime and the backup IPA were tested successfully with no major problems found [RD-48]. Throughout the routine mission in drag-free mode, the IPA turned out to be very reliable. The only major problem encountered was related to the electronics of the unit: on 5 separate occasions throughout 4 years of continuous operations, the IPA software stopped working for reasons unknown, leading to a trigger of DFACS surveillance L9-13 and a resulting fallback to FPM; each time the IPA was restarted with no further problems. During the low orbit operations campaign the drag force increased sensibly with respect to the levels experienced at 260 km (Figure 56), with the IPA continuing to perform well at higher thrust levels. During strong geomagnetic storms with very high peaks of atmospheric drag, the IPA kept operating nominally with the thrust at the maximum capability of 21 mN for periods of several minutes (see also section 4.1.2). The approach at the very end of the routine mission was to continue operations in drag-free mode as long as possible, up to when the IPA would stop working upon depleting all Xenon. This required adaptation of several pressure-related FDIR monitorings (see also [RD-18]). The minimum IPA operating pressure of 2.5 bar was reached on 17/10/2013, with the IPA continuing to perform nominally. Following some erratic behaviour on 20/10/2013, the engine stopped working early on 21/10/2013 at a tank pressure of about 1.5 bar.

Figure 56: IPA thrust averaged over 1 orbit throughout the mission. Thrust levels towards the end of the mission increased due to the increase of solar activity, and the orbit lowerings in the frame of the low orbit operations campaign.

Page 81/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

IPA performance: IPA-A was used for 1477.62 days out of 1700 days of mission (from launch to re-entry), while IPA-B was used for only 0.57 days. Table 11 shows the dates and the length of the period in which each IPA was used in thrust mode. The longest period of IPA-A usage without interruptions was in 2011 with a duration of roughly 10 months (308.27 days). Throughout the mission, IPA-A was restarted 20 times, IPA-B 5 times. During all restarts, the ignition worked reliably with no problems. Figure 57 gives an overview of the restarts of each IPA chain throughout the mission.

Period Start Period End Length of the period [days] IPA-A IPA-B 31/03/2009 (5 orbits) 0.31 2 02/04/2009 (4 orbits) 0.25 1 Commissioning 03/04/2009 (2 orbits) 0.13 1 03/04/2009 (2 orbits) 0.13 2 06/05/2009 09:00 12/05/2009 13:00 6.17 1 26/05/2009 07:40 23/06/2009 09:00 28.06 1 13/09/2009 10:44 16/10/2009 10:33 32.99 1 21/10/2009 13:50 12/02/2010 16:00 114.09 1 16/02/2010 08:08 30/06/2010 21:05 134.54 1 02/07/2010 04:45 22/07/2010 04:30 19.99 1 29/07/2010 11:11 01/09/2010 13:51 34.11 1 26/09/2010 02:35 02/01/2011 11:28 98.37 1 Nominal 05/01/2011 13:58 09/11/2011 20:20 308.27 1 Operation 10/11/2011 12:54 05/03/2012 10:39 115.91 1 06/03/2012 15:59 07/06/2012 20:09 93.17 1 09/06/2012 09:00 13/01/2013 09:05 218.00 1 13/01/2013 15:21 04/02/2013 16:36 22.05 1 07/02/2013 07:20 20/05/2013 04:00 101.86 1 22/05/2013 06:10 22/05/2013 09:20 0.13 2 24/05/2013 03:59 29/08/2013 17:40 97.57 1 30/08/2013 00:56 21/10/2013 03:16 52.10 1 Table 11: Usage of IPA-A and IPA-B throughout the mission.

Figure 57: IPA restarts over time (above), number of IPA restarts each year (below).

Page 82/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Several key parameters of IPA-A were monitored in-flight to detect any performance degradation of the unit. No aging effects could be seen (Figure 58). Throughout the whole mission, a total of 152 beam outs were experienced with IPA-A (Figure 59). A beam out is caused by a discharge arc over the ITA grid which then causes a short circuit; the IPA recovers such events autonomously by immediately returning to thrust control mode in case the main discharge is still available. Monitoring of the frequency of beam out events is another way of spotting a possible performance degradation due to aging of the thruster. No trend in the number of beam outs towards the end of life was visible; moreover, the frequency of beam outs in-flight was much lower than the maximum rate considered nominal before launch (1 beam out per day).

Figure 58: Plots of key IPA-A parameters. No performance degradation is visible over time; the changes in the plots visible as from 2012 are due to the higher thrust as the orbit was lowered progressively.

Page 83/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 59: Number of beam outs per year for IPA-A.

Figure 60: “Noisy” thrust [microN] in three orbits of drag-free operations on 20/10/2013.

At the end of the routine mission, the IPA was operated beyond specs, i.e. below the minimum operating pressures of the pressure regulator (5 bar) and the IPA (2.5 bar). Below 2.5 bar, the IPA initially system kept performing nominally, with a slight increase of the Anode voltage. On 20/10/2013 the engine was visibly unstable with Anode voltages anomalously high, thruster temperatures steeply increasing and high noise levels on the delivered thrust (Figure 60). Having reached a pressure of as little as 1.5 bar, on 21/10/2013 at 02:33 UTC the IPA entered a highly anomalous condition with the Anode voltage at 52 Volts and Anode current at around 3 Amps. This led to a large temperature increase of the unit, resulting a fallback to FPM due to a triggering of DFACS surveillance L9-14 once the temperature went above 193 degC. Figure 61 shows the evolution of the pressure in the High (HPT) and Low (LPT) pressure sections of the IPA during the last few days of operations.

Page 84/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 61: Pressures in the high (HPT) and low (LPT) pressure section of the IPA in the final days of IPA operations. LPT started dropping once the tank pressure went below the regulated pressure downstream. The offset between the curves is due to measurement errors of the pressure transducer. Significant anomalies: On 5 separate occasions in 4 years of IPA-A operations, an IPCU-A reboot (watchdog trigger caused by a software exception) led to a trigger of DFACS surveillance L9-13 and consequently a fallback to FPM: on 16/10/2009, 30/06/2010, 09/11/2011, 13/01/2013 and on 29/08/2013. Due to the very limited observables, was not possible to identify the root cause. After each re-occurrence, the IPA was fully nominal and thrusting could be resumed. See anomaly reports GOC_SC-39 and GOC_SC-53. Error events generated either by the IPCU or by the PASW (linked to communications with the IPCU) were investigated early in the mission. The generation of some of these events was disabled. See anomaly reports GOC_SC-16, GOC_SC-35 and GOC_SC-40. An IPCU FDIR triggering on the HPT temperature (with no associated recovery action) was caused by a wrong setting in the thermal control software (see anomaly report GOC_SC-37). Upon the first transition to thrust mode in the frame of IPA commissioning, an IPCU monitoring triggered on the LPT sensor reading, as the pressure in the low pressure section was above the FDIR limit of 2.71 bar. Ensuing investigation concluded this to be nominal at IPA switch ON after not having fired the unit for some time (due to pressure build-up in the low pressure section). To work around this, a venting procedure was introduced and used for the remainder of the mission: before each start up of the IPA, the excess pressure was vented by manually opening the valves. See anomaly report GOC_SC-18. A tuning of local IPCU FDIR on the number of beam outs was required in 2010: this FDIR had been defined inadequately and would have led to an IPA shutdown (i.e. interruption of drag-free mode) after a fixed number of beam outs. See anomaly report GOC_SC-52.

Page 85/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

4.1.9 Gradiometer Calibration Assembly (GCA) Overview: The gradiometer calibration assembly (GCA) is a cold gas propulsion system used for calibration of the EGG by means of spacecraft shaking (ICM calibration). The GCA comprises two parts, the propulsion system itself (the gradiometer calibration device GCD), and the propulsion drive electronics (the gradiometer calibration device electronics GCDE), see Figure 62. The GCDE has a nominal half and a redundant half. In the GCD, the only redundancy is the latch valve/pressure regulator function. The thruster valves are not redundant in the conventional sense of having a nominal set of thrusters and a redundant set of thrusters. Instead, a total of eight thrusters are included, which can be driven from either half of the GCDE. The GCA is normally used only in the highest DFACS mode DFM_FINE for ICM calibrations.

GCA-related activities throughout the mission: Beginning of May 2009, the GCA commissioning firing was performed with the DFACS in DFM_COARSE, allowing to assess performance of the cold gas propulsion system through the Gradiometer measurements. Each month, as a part of the monthly check activities, the pressures in the low and high pressure sections of the GCA were checked. Figure 63 and Figure 64 show the trend of the GCDE LPT and HPT throughout the mission lifetime. Note that 0.9737 bar is the maximum value allowed by the calibration curve for the LPT TM parameters. The spikes in the GCDE LPT graph are instead due to pressure checks performed right after the end of an ICM calibration. Regarding the GCDE HPT plot, the decrease of pressure is due to nitrogen consumption when performing ICM calibrations. During the mission lifetime, a total of 24 ICM calibrations were performed, usually every 2 months in routine phase: 2009: 16/06 (short 4h run), 18-19/06, 28-29/09 and 08-09/10 2010: 11-12/01, 04-05/03, 06-07/05, 05-06/10 and 07-08/12 2011: 27-28/01, 04-05/04, 07-08/06, 23-24/08 and 25-26/10 2012: 17-18/01, 15-16/03, 22-23/05, 19-20/06, 11-12/09 and 08-09/11 2013: 12-13/01, 07-08/05, 31/07-01/08 and 01-02/10 Figure 65 shows the weekly nitrogen consumption during the mission. The nitrogen mass at the beginning was about 13 kg. 5.193 kg were estimated to be left at the end of operations.

Main GCA-related anomalies: Regarding main anomalies, at first GCA switch ON in commissioning, DFACS surveillance L10-4 triggered (refer to anomaly report GOC_SC-10), as the pressure reading of low pressure was above the FDIR threshold. Ensuing investigation showed that this increased pressure level had already been seen on the ground, and can be expected when not firing the GCA for extended periods of time. Assessment by industry on the observables during the firing confirmed that the unit was healthy. The agreed way forward was to disable DFACS surveillance L10-4 on the pressure in the GCA low pressure section, as an LP overpressure is nominal at GCA switch ON, and enable the surveillance by ground only when firing the GCA.

Page 86/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 62: Block diagram of the Gradiometer Calibration Device (GCD).

Page 87/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

GCDE LPT (Bar)

1 0.95 0.9 0.85 0.8

0.75 LPT 0.7 0.65 0.6 0.55 0.5 26/06/09 25/08/09 24/10/09 24/12/09 22/02/10 24/04/10 23/06/10 22/08/10 22/10/10 21/12/10 20/02/11 21/04/11 20/06/11 20/08/11 19/10/11 19/12/11 17/02/12 18/04/12 17/06/12 16/08/12 16/10/12 15/12/12 14/02/13 15/04/13 14/06/13 14/08/13 13/10/13 13/12/13

GCDE-A LPT GCDE-B LPT

Figure 63: Evolution of pressure in the low pressure section of the GCD throughout the mission.

GCDE HPT (Bar)

145 140 135 130 125 120 115

110 105 100 HPT 95 90 85 80 75 70 65 60 26/06/09 25/08/09 24/10/09 24/12/09 22/02/10 24/04/10 23/06/10 22/08/10 22/10/10 21/12/10 20/02/11 21/04/11 20/06/11 20/08/11 19/10/11 19/12/11 17/02/12 18/04/12 17/06/12 16/08/12 16/10/12 15/12/12 14/02/13 15/04/13 14/06/13 14/08/13 13/10/13 13/12/13

GCDE-A HPT GCDE-B HPT

Figure 64: Evolution of pressure in the high pressure section of the GCD throughout the mission.

Page 88/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Nitrogen Consumption (g)

500 450 400 350 300 250 200 150 100 50 0 20/04/2009 06/11/2009 25/05/2010 11/12/2010 29/06/2011 15/01/2012 02/08/2012 18/02/2013 06/09/2013

Figure 65: Weekly nitrogen consumption throughout the mission. The GCA was only used for ICM calibrations.

Page 89/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

4.2 Data Handling Overview: The Control and Data Management Unit (CDMU) is based on the TASI Milano LEONARDO computer. The CDMU is fully redundant; the processor of the unused CDMU side can’t be accessed. See Figure 66 for a high-level overview of the CDMU architecture: Processor modules: based on ERC-32 processor (single chip TSC695F from Atmel). The Platform Application Software (PASW) is running on it. Reconfiguration units: in charge of handling the processing units redundancy and supervise the recovery capabilities of the CDMU. Telemetry units: in charge of formatting the CCSDS Telemetry Packets into Frames and forwarding the data, to the Transmitter. Also provides hardware-generated telemetry (HPTM), encoded in packets directly in the unit. HPTM provides limited visibility on the CDMU and transponder status (about 130 parameters).

Telecommand units: in charge of Figure 66: CDMU architecture (units nominally powered on receiving and forwarding ground are highlighted). commands to the processor.

Acquisition units: in charge of multiplexing all the telemetry signals acquired by sensors (currents, temperatures, relay statuses, etc.) and forwarding them to the Processing unit. The Acquisition unit can also emit, under PASW control, pulse commands for S/C unit switch on/off. The Platform Application Software (PASW) running on the processor module of the active CDMU side is in charge of all system-level functions, including data handling and drag-free control algorithms. The mass memory is also managed by the PASW, with the data being stored in a 4 Gbit memory module, organized in three packet stores (housekeeping VPS-1, memory dumps VPS-2, science data VPS-3). The PASW resides in the EEPROMs of the two processor modules in the CDMU. It is only possible to access the EEPROM of the currently active processor module. An EEPROM consists of two banks, each of which is holding a full image of the PASW in compressed form. To allow for installing PASW patches without having to replace the compressed image, additional chains of patches can be put into EEPROM. At boot up, these patches are applied in RAM after uncompression of the PASW image into RAM and prior to PASW start up in RAM. The PASW implementation is compliant to the Packet Utilisation Standard, including implementation of the usual autonomy functions (e.g. Service 11, 12, 19) as well as a powerful implementation of Service 18 (on-board control procedures OBCPs). OBCPs were used for a range of purposes, including RF configuration and FDIR activities, S/C configuration at PASW start up and power-related FDIR. A total of 16 OBCPs had been developed by the S/C manufacturer before launch.

Page 90/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

A S/C safe mode can either be triggered by PASW surveillances (e.g. global DFACS surveillances), a HW DNEL alert received from the PCDU, or CDMU-internal failure detection mechanisms. In case of safe mode, the CDMU reconfiguration logic moves to the next state out of a series of reconfiguration states, nominally (before the CDMU-A failure) the sequence was 0A>1A>2A>0B>3B: 2 retries on CDMU-A, followed by 2 attempts on CDMU-B, ending up in state 3B “cold 2” with all FDIR disabled. For each startup, the system is configured as per parameter settings in safeguard memory (see Table 12).

Table 12: Boot-dependent flags in safeguard memory, determining how the system is configured for a specific CDMU reconfiguration (e.g. nominal/redundant unit selection, automatic/manual transition of DFACS modes, enabling of FDIR). The reconfiguration states not active by default are shaded. Main Data-Handling-related activities and events: Anomalies: several data-handling-related anomalies were encountered in-flight, some of which with a major impact on the mission: A corruption of mass memory playback data (first header pointers in the frames) occurred in Oct 2009 (ref. anomaly report GOC_SC-42), eventually recovered 6 days later by resetting context information in PASW RAM. The triggering of a faulty FDIR mechanism on the TM module (TMM FDIR enabled for the first time in-flight after the playback data corruption), led to continuous power cycling of the TM module. After 1200 power cycles, ground managed to intervene and disable the FDIR (ref. anomaly report GOC_SC-43). CDMU-A failure in Feb 2010 (ref. anomaly report GOC_SC-46) arguably due to a failure of the floating point unit, requiring to perform the remainder of the mission on CDMU-B. See section 3.3.2 for more details. TM loss anomaly in Jul/Aug 2010 (ref. anomaly report GOC_SC-56), preventing the transmission of any SW-generated telemetry to ground, interrupting routine science operations for 3 months. The S/C had to be operated with little to no visibility for almost 2 months, with extensive troubleshooting activities performed. See section 3.3.3. Safe mode was entered in Mar 2012 due to reasons unknown, with the PASW suddenly stopping to work (ref. anomaly report GOC_SC-66).

Page 91/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Number of commands sent: Throughout the TCs sent in total 445000 mission a total of roughly 445000 TCs were sent TCs sent for immediate execution 262000 58.9% to the S/C, out of which about 183000 TCs (41%) TCs sent from mission timeline 183000 41.1% were uplinked for future execution from the Table 13: Commanding statistics (numbers are mission timeline (Table 13; numbers are approximate) approximate owing to the TM loss anomaly in summer 2010). Routine operations like S/C configuration before/after a ground contact were usually done from the mission timeline. The relatively high amount of TCs for immediate execution reflects the approach to perform special activities in real time during the very short contacts whenever convenient (with flight procedures tailored for this), avoiding the wait for the next ground contact (and possibly the dump of playback data) to see the results. PASW maintenance: A comparably high number of on-board software problems were encountered throughout the mission, requiring extensive OBSM activities in particular for the PASW in 2009/2010. See section 3.6.1 for an overview. In-flight patches to the PASW in EEPROM were applied using the patch chain mechanism (i.e. there was no need to ever replace the full compressed PASW image in EEPROM). A ‘flip-flop’ approach with 2 patch areas (one in each EEPROM bank) was used throughout the mission whenever a new PASW patch arrived (see Figure 67). Figure 68 shows the Figure 67: Illustration of approach used for applying PASW patches state of PASW EEPROM in Feb in EEPROM (active patch chain highlighted). Upon installation of a 2010 prior to CDMU-A failure (left), new PASW patch, the full patch chain is reinstalled in the EEPROM bank not holding the currently active set of patches. and the state at end of mission (right): In Feb 2010, the two patch chains residing in PM-A EEPROM differed by only one patch owing to the ‘flip-flop’ approach. Not all PASW patches installed in EEPROM were active in RAM, as at that time no safe mode had occurred after patch installation in EEPROM (only essential patches installed in PASW RAM). No patches had been installed since launch in PM-B EEPROM (inaccessible with PASW running on PM-A). At end of mission, the complete chain of patches resided in bank 1 of PM-B EEPROM, with all patches active in RAM owing to the safe modes in 2012, leading to a PASW restart with the patch chain in EEPROM activated. Two new OBCPs were developed and 1 existing OBCP was modified after launch (see section 3.6.2).

Page 92/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 68: PASW version and chains of patches installed in Feb 2010 prior to CDMU-A failure (left), and at end of mission with only CDMU-B available (right).

Miscellaneous Data-Handling-related anomalies: Apart from the aforementioned major anomalies, the following more minor problems were encountered: Some of the DFACS-related flags could not be modified in certain CDMU reconfiguration states. This was resolved by PASW patch (GOC_SC-21, GOC_SC-49). Two problems found early in the mission, related to the TX switch ON OBCP and PASW FDIR configuration when using the redundant remote unit, had to be resolved by PASW patches (GOC_SC-1, GOC_SC-2). Apart from the major mass memory playback corruption (GOC_SC-42), several other anomalies related to the downlink of mass memory data occurred: GOC_SC-24: data corruption in a selective dump (not reproducible on ground). GOC_SC-26: anomalous generation of an event on corruption of Mass Memory SGM context during PASW boot up. An operational workaround was put in place. GOC_SC-44: corruption in last frames of playback telemetry. This was caused by a problem in the PASW patch to resolve the playback corruption (GOC_SC-42), and was fixed by dedicated PASW RAM patch. GOC_SC-68: twice in the mission, information on the status of packet store VPS-3 got corrupted. The root cause was not found, an operational workaround was put in place. A problem with the handling and correction of single bit errors as flagged by the EDAC had to be resolved by PASW patch (GOC_SC-34). Problems related to the TM module (spurious corruption of VC-0 TM packets, resolved by TMM power cycle, ref. GOC_SC-51) and the TMM FDIR (false triggering during OBCP 5451 execution, resolved by operational workaround).

Page 93/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

4.3 Electrostatic Gravity Gradiometer (EGG)

Overview: The EGG contains three pairs of three-axis accelerometer sensor heads (ASH) mounted in a diamond configuration on ultra-stable Carbon/Carbon honeycomb panels (Figure 69). It is configured as a self-standing instrument with its own structure, thermal control and electronics. The principle of operation of the accelerometers is based on the measurement of the forces needed to maintain a proof mass at the centre of a cage. A six degree of freedom servo-controlled electrostatic suspension provides control of the proof mass in terms of translation and rotation. The gradiometer provides continuous high-resolution measurements of the gravity field in three dimensions and measurement data for drag-free control. The EGG is used in the DFACS control loop only in DFACS modes DFM_COARSE and DFM_FINE.

Figure 69: Electrostatic Gravity Gradiometer. ASH (left), core consisting of three orthogonally mounted pairs of ASHs (middle), global view of ASHs and electronic units (right).

EGG operations overview: In commissioning, the EGG was checked out in April 2009 and used in the control loop for the first time during the checkout of drag-free mode in May/June 2009. During the ensuing long decay phase in FPM, the EGG remained ON outside of the DFACS control loop. Throughout the routine mission, EGG-A was ON and in the DFACS control loop for most of the time, while EGG-B was switched ON for about 14 days. Each month, as a part of the monthly check activities, the content of a number of areas in GAIEU ASW RAM holding configuration data for the unit and not protected against SEUs, were checked. Every two months, an EGG calibration was performed (see section below). During de-orbiting operations with DFACS in FPM, the Gradiometer was left switched on in Acquisition mode outside of the DFACS loop: The unit worked fine up to when drag levels went close to 80 mN, too high to be measured. Linear acceleration measurements were saturated for the first time on 07/11/2013 (when the peak drag was reached in the orbit), at a mean altitude of 181 km. Starting on 07/11/2013, the EGG generated series of error events linked to saturation of the measurements, and several electrode reconfigurations occurred. As from 08/11/2013, electrodes VY1 and VY2 of ASH3 were permanently saturated.

Page 94/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Up to early on 10/11/2013 at a mean altitude of roughly 154 km, the EGG kept providing measurements usable to estimate the drag for at least part of an orbit (it was saturated for an increasing portion of the orbit as the atmospheric density kept increasing on the way down), see Figure 70. The EGG was switched off by ground in the afternoon of 10/11/2013.

Figure 70: Drag levels during 2 orbits on 08/11/2013 derived from EGG linear acceleration measurements. At that late stage of the de-orbiting, drag peaks were too high to be measured by the EGG (as indicated when the parameter is close to 0).

In-Orbit Calibrations: Two types of EGG-related calibrations were performed throughout the mission: K2 calibration: this is a calibration of the EGG quadratic factors in DFM_FINE. It is achieved by commanding the GAIEU to perform the calibration with the DFACS in DFM_FINE mode. Upon receipt of the relevant commands by the GAIEU, an accelerometer proof mass shaking sequence is initiated by the GAIEU. Within the EGG pre-processing software (in the CDMU), the algorithms, which are used to evaluate the spacecraft linear and angular accelerations from the individual proof mass accelerations, are adjusted accordingly, based on the data in the DFACS data packet. Many K2 calibrations were performed mostly in commissioning throughout 2009, however there was no need to run this calibration on a regular basis in the routine mission.

Page 95/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

ICM calibration: this calibration measures the EGG inverse calibration matrices by shaking the spacecraft in DFM_FINE. The S/C is shaken for 24h using two methods simultaneously: The 8 thrusters of the GCA are fired according to a pre-defined, pseudo-random pattern, with each thruster maintaining its state of OPEN or CLOSED for a period of 5 to 10 sec. A pseudo-random linear acceleration command is applied to the +X direction drag free controller, resulting in a slight variation of the IPA thrust with a peak value of corresponding to a force from the IPA of ±0.001 N. A total of 24 ICM calibrations were executed throughout the mission, in routine roughly every two months and after every interruption of drag-free mode.

Investigations on gradiometer performance: Ever since EGG commissioning, noise in part of the gradiometer measurement bandwidth has been under investigation [RD-47]. A lot of testing activities throughout the mission have been executed related to this: In 2009, tests were performed to check if there could have been a link between the disturbances seen in the Gradiometer DFACS channel and the Gradiometer TCEU thermal regulation activities: On 19/05/2009, with the spacecraft in FPM, the test consisted in a complete switch off of the gradiometer’s thermal control unit (TCEU) for 10 min, stopping all gradiometer thermal control activities in that time frame. On 26/05/2009, with the spacecraft in DFM_PREP, the test consisted in the disabling of all TCEU lines, followed by the enabling of the lines one-by-one to better understand the contribution of each line to the disturbance. On 27/07/2009, with the satellite in FPM, the TCEU was switched off for two orbits to check whether the source of the noise is related to the gradiometer thermal control. To verify the impact of varying the K2 offsets on the science performance, the current K2 offsets were changed on 29/07/2009 (+50 s2/m increment for both ASHs of a pair along the three OAGs along the inline axes) and on 31/07/2009 (+50 s2/m increment for ASHs 1/2/3 inline axes, and –50 s2/m increment for ASHs 4/5/6 inline axes) with the satellite in FPM. Between 24/08/2009 and 06/09/2009, several updates of the offsets were done with the satellite in FPM. On 12/09/2009, with the satellite in FPM, an ADC-2 test to measure the noise of the proof mass control loop was performed: to explore the possibility of the exceeding noise generated directly in the science branch, the recombination matrices were nullified, so that the proof masses were no more controlled, meaning that in the science output there was just the contribution coming from DAC, DVA, analogue Read-Out and ADC2. On 24/09/2009 and 25/09/2009 a special test with the satellite in DFM_FINE, was performed to verify whether there is a coupling between linear and angular accelerations and the gradiometer measurements. During a period of 24 hours, the proof mass control of ASH-3 and ASH-6 was modified, requiring an update of recombination matrices and science law PID parameters as per industry input.

Page 96/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

On 02/10/2009 another linear/angular coupling test, with the satellite in DFM_FINE, was performed on the gradiometer: the proof mass control of all six ASHs was modified through updating the recombination matrices and science law PID parameters as per industry input. Another special test was carried out in DFM_FINE between 20/06/2011 to 26/06/2011, disabling a checking mechanism on the ADC registers, which had been identified as a possible root cause for the increased noise observed ever since the start of the mission. A special test on the gradiometer was performed on 21/07/2011, with the satellite in DFM_FINE, similar to the test in June 2011: the ADC register check was disabled temporarily and the on-board default recombination matrices were used throughout the test to better see the science health noise in the test. Between 29/04/2013 and 02/05/2013, a special test was performed in DFM_FINE by applying 2 different detector offsets to ACC-3 and ACC-6. Special testing was performed in DFM_FINE on 04/06/2013, applying 2 different settings to the gains of the PID controller for ACC-3 and ACC-6.

EGG-related anomalies: Loss of attitude control during K2 calibration in DFM_FINE: safe mode occurred due to a loss of attitude control caused by the first execution of the K2 calibration in DFM_FINE on 12/05/2009 during commissioning. A patch for fixing the problem with the DFACS bias compensation algorithm was installed on-board. Refer to anomaly report GOC_SC-25. Some of the problems discovered early in the mission were resolved by procedural workarounds, required for constraints not known or documented before launch: Anomaly report GOC_SC-27 on rejection of load K2-vector commands for the first K2 calibration of the mission, resolved by adapting the relevant flight procedure. Anomaly report GOC_SC-28 on an EGG electrode reconfiguration during the DFACS mode transition from DFM_COARSE to DFM_FINE: all ASH anomaly recovery actions were disabled for all future gradiometer mode transitions. Anomaly report GOC_SC-60 on an electrode reconfiguration when performing the transition from Standby to Acquisition mode. Upon investigation, it was decided to perform all future transitions only with EGG default settings (PID parameters and recombination matrices). Anomaly report GOC_SC-54: DFACS surveillance L7-10 triggered in a transition to DFM_FINE due to errors raised on health and coherency status of several accelerometer heads, causing an EGG switch over. This was caused by not having the default detector offsets present when doing the transition to Science. For all future transitions from Acquisition to Science mode, the detector offsets were removed. Anomaly report GOC_SC-55: a problem occurred when switching back to TCEU-A following anomaly GOC_SC-54, requiring an update of the relevant procedure. For some problems related to the EGG application software discovered early in commissioning, a use-as-is was agreed to avoid changing the software: Anomaly report GOC_SC-30 on the wrong ordering of super-commutated parameters in some EGG diagnostic packets.

Page 97/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Anomaly report GOC_SC-38 on irregularities in the packet generation time (timestamp inside the packet data filed header) of EGG science packets. The TCEU thermal settings were adjusted in Sept 2009, following a TCEU reconfiguration due to thermal settings not adequate for EGG operations in eclipse season. See anomaly report GOC_SC-33. Several cases of the GAIEU watchdog triggering occurred throughout the mission, leading to an autonomous reboot of the GAIEU (not resulting in an interruption of drag-free mode). The root cause could not be determined with certainty; the observed problem could for instance be caused by an SEU in GAIEU program RAM. 20/03/2010 (anomaly GOC_SC-48): an electrode reconfiguration occurred in the mode transitions following the restart and had to be recovered by ground. 08/02/2011 (anomaly GOC_SC-61): following the restart, a de-synchronisation of FEEUs (FEEU2- ADC1/2 and FEEU2+ ADC2) was present, requiring ground to trigger another reboot of the EGG. 23/09/2011 (anomaly GOC_SC-63) Two cases of isolated EGG Validation_Failed events due to coherency failure on ASH-2 and ASH-5 occurred on 25/08/2011 and on 24/09/2011 (see anomaly report GOC_SC-62). Late in the mission, an anomaly on accelerometer head ASH-1 anomaly occurred several times, leading to the measurements from this head becoming unusable (with several electrodes of ASH-1 showing saturation). In each case, the problem was gone after restart the gradiometer: 07/06/2012 (anomaly GOC_SC-70): owing to a shortcoming in the DFACS settings, the DFACS was using the erroneous ASH-1 data in the control loop, causing a loss of attitude control and hence a safe mode. 02/02/2013 (anomaly GOC_SC-73): the ASH-1 anomaly re-occurred, with very similar observables as for the first time. Thanks to the tuning applied to the DFACS after the first occurrence, no attitude divergence occurred. However, attitude control was lost when bringing the DFACS from DFM_FINE to DFM_COARSE for the recovery, due to a shortcoming in the agreed recovery procedure. Ground had to command a fallback to CPM. 05/05/2013 (anomaly GOC_SC-73): this time the recovery was achieved with no further problems, by power cycling EGG-A in DFM_FINE.

Page 98/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

4.4 Satellite-to-Satellite Tracking Instrument (SSTI) Overview: The SSTI is one of the GOCE payloads, supporting precise gravity field recovery through precise orbit determination data. The SSTI is composed of a GPS receiver and the associated antennas (Figure 71). It is an integrated Global Navigation Satellite System (GNSS) receiver that is able to process GPS signals. The SSTI is also used in the DFACS control loop, providing the spacecraft state vector for the attitude control loop. The SSTI is used in all DFACS modes, except for the lowest mode (CPM). During the whole mission, SSTI-A was ON and in the control loop for most of the time, while SSTI- B was switched ON for about 293 days out of the total 1700 days of operations. During de-orbiting operations with DFACS in FPM, both SSTIs were ON. SSTI-B was inserted from ground in the DFACS control loop on 07/11/2013. SSTI-A was still ON in navigation mode out of the DFACS loop. This activity was performed as SSTI-B showed slightly better performances than SSTI-A as it ran an updated software version (ASW 4.2) installed at the end of July 2013.

Figure 71: SSTI functional block diagram.

SSTI performance – transitions to Propagation and PDOP High events: Throughout the mission life time, SSTIs have been generating ‘Propagation’ events. This means that in case of a temporary loss of navigation solution (e.g. temporary loss of GPS satellites visibility/tracking) the instrument will be able to keep providing measurement data thanks to its internal propagation function (i.e. Propagation Mode). When enough SVs will become visible again -Mode will be entered again and the nominal SSTI operations will continue.

Page 99/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 72, Figure 73 and Figure 74 show the trend during the mission years, the orbit lowering and during de-orbiting. The number of transitions to propagation mode did not increase as the altitude was lowered, in particular not during deorbiting. PDOP High events were also generated by the SSTIs throughout the entire mission. This type of PDOP is too high and solution could be not precise. During de-orbiting operations with DFACS in FPM, the generation of these events was monitored, also with no upwards trend visible. See Figure 75 and Figure 76.

SSTI Propagation Events (Mission Duration) 700 650 600 550 500 450

400 2009 350 2010 300 2011 Occurence 250 2012 200 2013 150 100 50 0 1 2 3 4 5 6 7 8 9 10 11 12 Month

Figure 72: SSTI-A propagation events throughout the mission.

Page 100/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

SSTI Propagation Events (Re-entry) 50 45 40 35 30 25 20 SSTI-A 15 10 SSTI-B 5 0

Figure 73: Daily number of SSTI propagation events during de-orbiting from 21/10/2013 to 10/11/2013.

SSTI Propagation Events (October/November 2013) 250

200

150 SSTI-A 100 SSTI-B

0 CW40 CW41 CW42 CW43 CW44 CW45

Figure 74: Weekly number of SSTI-A and SSTI-B propagation events in Oct/Nov 2013.

Page 101/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

SSTI Pdop_high Events (Re-entry) 30

15 SSTI-A 10 SSTI-B 5

0 21/10/2013 22/10/2013 23/10/2013 24/10/2013 25/10/2013 26/10/2013 27/10/2013 28/10/2013 29/10/2013 30/10/2013 31/10/2013 01/11/2013 02/11/2013 03/11/2013 04/11/2013 05/11/2013 06/11/2013 07/11/2013 08/11/2013 09/11/2013 10/11/2013

Figure 75: Daily number of SSTI PDOP high events during de-orbiting from 21/10/2013 to 10/11/2013.

SSTI Pdop_high Events (October/November 2013) 60

30 SSTI-A SSTI-B 20

0 CW40 CW41 CW42 CW43 CW44 CW45

Figure 76: Weekly number of SSTI-A and SSTI-B PDOP high events in Oct/Nov 2013.

Page 102/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Significant SSTI-related anomalies: On 02/01/2011, DFACS surveillance L6-7 triggered due to the SSTIs providing an erroneous state vector. This anomaly led to a divergence of the attitude control in DFM_FINE, requiring to command a fallback to CPM, the lowest DFACS mode (SSTI not in use). With this anomaly present, the SSTIs could not be used in the control loop, i.e. it was not possible to resume drag-free mode (and thus science operations). A new SW version was installed to cure the problem and DFM_FINE was successfully entered again on 19/01/2013. Ref. anomaly GOC_SC-58. See also section 3.3.4. During LEOP, two attempts were made to activate SSTI-A via DFACS and in both cases the time to reach Navigation from switch-on (through a Cold Start) took longer than expected, ref. anomaly GOC_SC-04. The relevant threshold of DFAC surveillance L6-5 was increased to 50 minutes to avoid triggering in case of an SSTI switch over. The problem occurred two more times in April 2009, but was not seen thereafter. The precise root cause could not be found. Series of ‘AGC failure’ events were received on several occasions starting from January 2011. Status of the unit has always been nominal. From the beginning of September 2012, when the number of events increased, GOCE was flying over the Shantung Peninsula in the Yellow Sea (China) at the time of occurrence of those events. The root cause was suspected to be an intense electromagnetic interference near (or within) L2 band (ground radar activity) as reported in [RD-25]. Refer to anomaly GOC_SC-59. SSTI Application Software updates throughout the mission: Application SW v3.3 installed on both SSTIs in June 2009 to resolve anomalies GOC_SC-05 (SSTI: NKF Range Residuals Above Threshold Events (EID=66)) and GOC_SC-09 (SSTI: Sudden drops in number of SVs used in NKF solution). Application SW v4.1 installed on both SSTIs on 17-18/01/2011 to cure anomaly GOC_SC-58 (SSTI state vector anomaly). Application SW v4.2 installed on SSTI-B end of July 2013 to increase the L2 tracking performance, leading to better science data.

Page 103/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

4.5 Power

Overview: The GOCE electrical power subsystem is based on a photovoltaic-battery system with an unregulated power bus architecture (battery provides energy directly onto the bus, no use of battery discharge regulator electronics). Primary power source is the solar generator, i.e. solar arrays consisting of four body mounted panels and two wing panels each with its own Solar Array Power Regulator (SAPR). The regulator design is based on the MPPT technique. Power transfer from the SA to the main bus is done via a two-choke step-down regulator. A Li-ion battery consisting of 8 cells in series and 52 strings in parallel, which creates a battery of 78 Ah, acts as energy storage for peak power demands and provides electrical power during eclipses. The control, distribution and conditioning of the electrical power to/via the main bus as well as battery charge are done by the PCDU. The bus voltage range at the interface of the power users is between 22 V to 34 V. The PCDU has hardware protection against battery undervoltage, overtemperature or excessive discharge current, the so-called HW DNEL (Disconnect Non-Essential Loads). In case of a trigger, all non-essential loads are disconnected and an alert is set on CDMU side, resulting in a S/C safe mode. A similar protection –albeit with more tight limit sets (Table 14)– is implemented in the PASW with PUS services 12/18/19, the so-called SW DNEL. The recovery action to a SW DNEL consists in commanding a DFACS mode transition to CPM (leading to a switch off of all non- essential units like STR, EGG, SSTI) and a TCS mode transition to survival mode. The GOCE overall power is the sum of the loads power (i.e. the power required by all S/C units) and the power used for the battery charging. See Figure 78 for a schematic overview with the respective telemetry parameters and a further breakdown of the GOCE loads power. Important power consumers were the thermal subsystem and the gradiometer, both with power consumptions around 100 W (though the TCS consumption had a very dynamic profile). Largest consumption resulted from the ion propulsion system, with power consumption having peaks of up to 730 W during commissioning (testing of maximum thrust) and towards the end of the mission with around 460 W (at an average thrust of about 12 mN).

Figure 77: Overview of on-board consumers (“GOCE loads”).

Battery voltage Battery discharge current Battery temperature

SW DNEL 27.2 Volts -58 Amps 60 degC

HW DNEL 26.4 Volts -65 Amps 65 degC

Table 14: Thresholds for HW DNEL and SW DNEL (FDIR on battery status).

Page 104/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Power-related operations and subsystem status: The power subsystem was performing nominally throughout the mission. No HW or SW DNEL trigger occurred over the complete mission. No lack of power or significant degradation of power units, except for the failure of several solar array thermistors with no operational impact (see section 4.6), were observed. In 2012 the battery degradation was estimated to be around 5.5%, with negligible impact on the power budget. A gradual increase in power demand was observed over the mission with peaks towards the end when eclipse duration and drag force were at their maximum. See Figure 79 for eclipse evolution and Figure 78 for the GOCE loads power –i.e. the power consumed by the S/C units– throughout the mission. The GOCE power consumption on the day of the fallback to FPM, 21/10/2013, due to Xenon tank depletion is shown in Figure 80. Due to the switch off of the IPA the power consumption decreased significantly. The power subsystem kept performing nominally during de-orbiting. In the final 2 days, S/C temperatures increased substantially due to atmospheric friction, with the battery and the PCDU located at the front of the S/C at temperatures of over 80 degC, but still performing nominally (see also section 4.6). On 10/11/2013 –the last day of operations– the H/W DNEL functionality was disabled along with the PASW FDIR and TMM FDIR, in order to not have any S/C FDIR intervening in the last hours of flight operations.

Figure 78: GOCE loads (i.e. power consumption by S/C units) over the mission.

Page 105/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 79: Eclipse duration over the mission. The pattern of eclipses changed as the inclination of the orbit was not controlled. As from March 2012, the S/C was experiencing eclipses in every orbit. The sharp increase in Nov 2013 is due to the deorbiting (S/C operated down to little over 100 km altitude).

Figure 80: Power consumption on 21/10/2013, the last day of drag-free operations. The decrease of power consumption after 03:00 UTC is due to the switch off of the ion propulsion system.

Page 106/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

In-flight assessment of power budget and performance of the subsystem: In preparation for the low orbit operations campaign, in 2011/2012 the GOCE power budget was re-assessed by the FCT and compared to the pre-launch power budget provided by industry [RD-9]. From this in-flight analysis performed for various S/C configurations it could be concluded that a significant power margin off roughly 120 W existed. The amount approximately corresponds to the margin added by industry for PCDU, harness losses and system margin in the pre-launch budget and roughly translates into an additional thrust of approx. 4 mN. Figure 81 depicts the output of a power budget tool calculation for DFM_FINE which was created by the FCT in the frame of this assessment. This tool allows obtaining the expected power consumption based on the S/C configuration per AOCS mode (primarily SCIENCE mode and Hold case, i.e. DFACS in DFM_PREP and EGG OFF) and compares it to the pre-launch power budget. For the computation a few input parameters (thrust level, assumed PCDU consumption and Thermal power consumption) had to be provided. This assessment together with a battery and solar array performance analysis was used to compute the allowed thrust depending on eclipse duration for the low orbit operations. See [RD-49] for a summary of all findings of the power study. An outcome from this study was also the actual relation of the IPA thrust to IPA power consumption as given on the left of Figure 82 based on in- flight TM. This figure is only applicable for higher thrust > 4mN, showing that an additional mN of thrust roughly corresponds to 30 W of additional power. Figure 81: GOCE in-flight power budget comparison: revised in- flight budget (left) vs. pre-launch power budget (right) For the batteries an in-flight performance assessment using battery discharge current integration over time and discharge cycles count method was conducted beginning of 2012 with no indications on battery performance degradation. A battery degradation of 5.5% resulting from battery manufacturer simulations (BEAST) and provided by industry [RD-5] was used for later calculations. Being in this order, the degradation factor had no impact on the overall power budget. Note that the EOL battery degradation was expected to be in the order of 20%. During the mission the battery was always capable to provide the required power/energy to the GOCE power bus users. Being at the front part of the S/C, the battery was subject to extreme heat- up effects with temperatures above 80 deg C during the deorbiting. Figure 83 shows the provided power by the battery throughout the mission. A gradually increasing trend is visible due to the increase in eclipse duration and the higher IPA thrust due to higher drag levels.

Page 107/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 82: Thrust demand vs. IPA power consumption. Left based on in-flight TM, right provided by industry.

Figure 83: GOCE battery-provided power over the mission.

Page 108/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

An assessment of the Solar Array performed in 2012 did not show any indications for performance degradation. Since the solar arrays operate on the maximum power point principle it is difficult to derive the maximum power figures from the solar generator or the degradation. A test to assess the maximum power could have been to fire the IPA at a maximum thrust right after exiting a long eclipse, maximising the S/C power consumption. This was not done due to the criticality and the difficulty to implement this in-flight. Figure 84 shows the PCU total (all solar panels) output power over the mission. Each Panel is connected to one PCU which is part of the PCDU and consists of the electronics for the SAPR, the Peak Power tracker and Majority Voter.

Figure 84: GOCE Total PCU Output Power over the mission.

Page 109/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

4.6 Thermal

Overview: The thermal subsystem consists of a total of 48 platform heater lines, also referred to as loops. Each TCS line has nominal and redundant Transistor Switch (TSW) to power on/off the heater allocated to the line, hence 96 TSW in total. Due to the hardware organisation of the TSW on PCDU side which groups six TSWs together and allocates one LCL to one group, the heater lines are grouped as well. Therefore there are in total 8 heater groups, with each heater group consisting of a nominal and a redundant branch containing 6 heater lines, 6 TSWs and 1 LCL. See Figure 85 for an example. The LCLs have an under voltage protection which will power off the LCL at a voltage of 22V. Status TM is provided for LCLs and TSW. TM for current readings is only provided for LCLs.

Figure 85: Example of a heater group, consisting of a nominal and redundant branch of 6 TSW powered by a single LCL. There are 8 such heater groups in total.

The thermal hardware is controlled by the thermal control software (TCS) which is part of the PASW. The SW controls which heater has to be switched on/off by PCDU commands via the RU over Mil-Bus according to a thermal control algorithm. This algorithm performs a comparison of actual temperature readings against temperature limits defined for a specific heater line, switching heaters as required to stay within the desired temperature range. See flow diagram in Figure 86:

1. Every second the thermistor readings are read from a data pool. The mean value Tmean belonging to a set of three thermistors is selected by a majority voting algorithm and defines the so-called sensor temperature.

2. This temperature Tmean is compared against 4 temperature limits, Tmin, Tmax, Temergency min and Temergency max, and the following action is taken depending on the outcome:

Tmin < Tmean < Tmax: no action needed, heater line is in desired temperature range

Temergency min < Tmean < Tmin: temperature too low heater switch on

Tmax < Tmean < Temergency max: temperature too high heater switch off

Tmean < Temergency min: temperature anomalously low heater line reconfiguration

Tmean > Temergency max: temperature anomalously high heater line reconfiguration Heater lines 1 – 8 are dedicated EGG heater lines which are not controlled by this algorithm.

Page 110/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 86: GOCE thermal control algorithm.

Page 111/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

The necessary information to control all thermal lines is contained in the Thermal Control Table (TCT) which processes each heater as one TCT heater line. It is the active table used by the TCS for the current working mode and includes for each of the 48 TCT heater lines the definition, temperature limit settings and status information. The actual temperature limits used in the TCT can be loaded from dedicated tables with settings to be used in various mission phases and S/C configurations, the Thermal Mode Tables (TMT). There are four TMTs : Survival TMT: used in S/C safe mode Nominal TMT: for routine operations Hold TMT: for the originally foreseen hibernation phases (DFACS in DFM_PREP) Calibration TMT: for ICM calibrations (heat up of GCD lines and thrusters) Table 15 shows the temperature settings used in the Nominal TMT as per Oct 2013.

Main thermal-related activities and events: Overall the thermal subsystem was performing nominally with only minor anomalies. As is not uncommon, there were quite some changes of thermal control settings in the TCT and the TMTs in-flight, mainly during commissioning in 2009. The following list shows the most significant Table 15: Nominal TMT of the TCS software. events in chronological order: The redundant EGG heater TSW-5 failed during the ascent phase of the launcher, leading to the LCL of heater group B1 to trip open (ref. anomaly report GOC_SC-3). The default configuration for this heater group was changed so that Heater 5 TSW was open but with the LCL closed. This allowed the other heaters in the group to be still usable. Since this configuration was lost in every safe mode (heater 5 TSW was closed by the PASW and made the LCL trip) it had to be re-established as part of each safe mode recovery. Tuning of the TCS temperature settings in TCT/TMTs, with the following main changes: Correction of wrong settings for IPA HPS heater line 15 in the Calibration TMT in Sep 2009 (ref. anomaly report GOC_SC-37). This change was included in the default table through PASW patch. Update of settings for IPA-related heater lines 40 and 47 in Sep 2009, as the unit temperature was found to be too cold owing to seasonal effects and the very low IPA

Page 112/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

thrust early in the mission (low atmospheric drag due to low solar activity). See anomaly report GOC_SC-36. Change for heater lines 13 (battery floor heater) and 22 (battery cell heater) to increase the CDMU operating temperature following recovery from the TM loss anomaly in summer 2010. This change was made permanent in EEPROM. Some further tuning was done in 2011 to account for seasonal effects. Starting in April 2012, four out of 12 solar panel thermistors gradually failed, all showing similar behaviour (ref. anomaly report GOC-SC-67): when entering colder regions, i.e. during eclipses, temperature readings were showing sporadic spikes first only for a few samples, and eventually permanently for the complete lower temperature range (see Figure 87). Possible root cause could be fractures or cracks of the material, or problems with the thermistor isolation material. As these thermistors were used for monitoring only (i.e. no use for TCS SW-controlled heater lines), the impact of this was very limited. As the S/C could be controlled down to extremely low altitudes during re-entry operations in Oct/Nov 2013, a significant warm up of the S/C caused by atmospheric friction could be observed. While slight temperature increases could already be seen early in the decay phase, a much more significant increase of on-board temperatures occurred in the last two days, most pronounced for items located closer to the front of the S/C (e.g. the CDMU and the battery), see Figure XX. This also led to reconfiguration of several heater groups to the redundant side, when the temperatures went above the TEmergencyMax settings of the TCS. See [RD-55] for more details on TCS behaviour during deorbiting.

Figure 87: Erroneous temperature readings from thermistor THT10005 on 19/04/2012.

Page 113/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 88: Evolution of temperatures in the last two days of flight, showing a major increase due to the S/C warm up caused by atmospheric friction, most pronounced for units close to the front of the S/C.

Page 114/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

4.7 Radio Frequency Subsystem The RF subsystem acts as the interface between the spacecraft and dedicated ground stations. It consists of the classical RF elements for reception, demodulation, modulation and transmission with two identical low gain antennas operating in S-band with hemispherical coverage for transmission and quasi-spherical coverage for reception and right handed circular polarisation. Each antenna is mounted in cut outs of the array wings as depicted in Figure 89. With the selection of the Dusk-Dawn orbit (ascending node at 18:00 local time) the +Z antenna was Earth pointing (nadir) while the –Z antenna was zenith pointing. Data downlink and range-rate (relative Doppler shift) for tracking can be performed in two modes, i.e. the low Mode-1 with a data rate of 63.7 Kbps and the high Mode-2 with 1.2 Mbps. Ranging measurements for orbit determination were only possible in low mode, whereas the downlink of mass memory playback data was only practical in high mode. In nominal conditions the transmitters were operated in cold redundancy with transmitter-1 connected to LGA +Z as prime. In case of a survival mode both transmitters were switched on. Receivers were operated in hot redundancy. To avoid permanent RF emission the prime transmitter was Figure 89: Location of S-band low gain antenna. switched on and off around passes via the mission timeline (MTL). RF-related operations were done with the support of OBCPs, some of which written by the S/C manufacturer before launch [RD-46], some developed in-house by the flight control team after launch (see below). The RF sub-system was performing nominally in both TM modes. The following list covers the main RF-related issues and activities throughout the mission: Possible no-AOS condition for low elevation passes after survival mode when both transmitters are switched on in parallel autonomously and configured in mode-2 (standard RF configuration at survival mode entry) due to interference of the signal from the two transmitters. This was prevented by switching off the second transmitter as soon as possible in the survival mode recovery by ground. Operating both transmitters in Mode-1 however is possible and was done as part of later recovery activities to increase the coverage robustness. See WOR#3/#77/#90/#156/#169 [RD-6]. Anomalous TMM FDIR trigger during execution of OBCP 5451 "Activate RF-Link A-Side in expected configuration" (executed from the MTL prior to every ground station pass) leading to no-AOS condition due to inconsistent configuration of transmitter and telemetry module – transmitter in high mode and telemetry module (TMM) in low mode (as the TMM configuration to high mode was interrupted by the false TMM FDIR trigger). Solution was to define a new Service 19 entry which would manually command the TMM to high mode upon occurrence of a TMM FDIR trigger. See WOR#63/#144 [RD-6] and anomaly GOC_SC-50 [RD-7].

Page 115/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

CDMU-A failure and TM loss anomaly in 2010: at the onset of both anomalies, the S/C was transmitting an anomalous signal due the downlink chain being configured by on-board autonomy in an inconsistent way. In case of the TM loss anomaly, a TX reconfiguration took place as well, for which the precise reason is not known due to lack of visibility on S/C status. In both cases, troubleshooting of the downlink chain was performed by ground as per the no-AoS system contingency recovery procedure, including power cycling or reconfiguration of the Telemetry Module (TMM) and the transmitters. For the TM loss anomaly, an extended period of time was spent with a carrier-only signal, used for orbit determination purposes, up to when the various measures for getting more visibility on the S/C status were put in place (see section 3.3.3). TX reconfigurations: A transmitter reconfiguration from TX-1 to TX-2 occurred in Sept 2010 due to a problem in a contingency recovery procedure, omitting to disable a relevant Service 12 monitoring (anomaly GOC-1277). In the frame of this anomaly, a shortcoming in the on-board approach for TX reconfiguration by OBCP 5441 was discovered, eventually requiring to modify this OBCP (see [RD-36] and anomaly GOC_SC-57). Another TX reconfiguration occurred due to a problem in the spacecraft database in Nov 2010 (see section 3.7.1, anomaly GOC-1286). New TX switch off OBPCs: in-house generation of two RF-related OBCPs to simplify operations, reducing the number of commands in the on-board schedule. These OBCPs replaced the TX switch off via direct commands starting from March 2011 onwards. Table 16 gives the RF-related OBCPs which have been modified or created by the FCT. The ESOC created/modified RF OBCPs are described in [RD-36]. Change in transmitter switch on/off times during deorbiting phase for lower attitudes in 2013, see [RD-18] and WOR#243 [RD-6].

ID Name OBCP Purpose Used Source (HEX) for 43 OCP_5441 Switch RF link from A to B-Side Platform Modified by FCT to delete all TX-1 related FDIR commands from the MTL 44 OCP_5461 Deactivate RF-Link A-Side MTL Created by FCT 45 OCP_5462 Deactivate RF-Link B-Side MTL Created by FCT Table 16: RF-related OBCPs modified/created by the Flight Control Team.

Page 116/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

5 GROUND SEGMENT

5.1 Flight Operations Segment Overview This section gives an overview of the main facilities and interfaces of the GOCE Flight Operations Segment (FOS) at ESOC (see also Figure 90). The various elements of the FOS are then discussed in more detail in the ensuing sections.

Flight Control Team (FCT): The Flight Control Team was in charge of all S/C operations activities and management of external interfaces with ESRIN and the S/C manufacturer. Originally planned to be a very small team for the routine mission, the FCT was significantly enlarged throughout the mission owing to the many S/C anomalies and special operations campaigns.

Flight Dynamics (FD): FD was in charge of orbit determination and attitude monitoring activities, with the flight dynamics system based on ESOC’s ORATOS platform. In routine, orbit determination and prediction was based on the S/C position vector measured by the on-board scientific GPS receiver (SSTI). In case of SSTI unavailability, orbit determination was based on radiometric data. Having a S/C operating in a drag environment rendered orbit determination and prediction more challenging than usual, also requiring particularly close collaboration between FD and FCT.

Ground Stations: ESA’s Kiruna station in Sweden was the prime Figure 90: Overview of the GOCE Flight Operations ground station. In routine, 6 passes per day Segment (FOS) at ESA/ESOC. were taken on Kiruna. The station was controlled remotely from ESOC’s ESTRACK control centre. External stations from Kongsberg Satellite Services AS (KSAT) were used to augment Kiruna contacts, namely the facility in Svalbard and in Troll/Antarctica. External station support from SSC’s ESRANGE facility was also used occasionally. Special challenges faced by ground station operations throughout the mission were linked to the problem of acquiring the S/C in case of an unexpected interruption of drag-free mode (leading to a fast divergence of the orbit), and the support for 2010’s on-board computer anomalies, requiring to search for the S/C and to troubleshoot and diagnose an anomalous downlink signal.

Page 117/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Data Systems: The mission control system (MCS) was based on SCOS-2000 v4.5 running on Sun Solaris. A SIMSAT-based S/C simulator offering a very representative simulation environment was also available. Both MCS and Simulator proved to be very stable throughout the mission. Some special MCS modifications were needed in the frame of 2010’s major on-board computer anomalies.

Other support functions at ESOC: The mission was using the common ESOC infrastructure in terms of facilities, network and communications, and was also supported by the generic support functions at ESOC for quality assurance and project control. All GOCE-related quality assurance items –e.g. S/C anomaly reports, ground anomaly reports, risk register, MRBs– can be found in ARTS [RD-7]. Some interaction with the ESOC space debris office late in the mission –in particular for the GOCE re-entry– also took place.

External interfaces: The main external interface of the FOS was with the PDGS at ESRIN. The FOS provided all telemetry dumped in raw format; planning-related information was exchanged between the two entities. Further interfaces not indicated in the figure were with mission management (at ESRIN), with ESTEC (E2/F phase support including input for desired ground track control), and with the S/C manufacturer (E2/F phase support, including the delivery of flight software patches).

Page 118/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

5.2 Flight Control Team (FCT) The Flight Control Team was in charge of all S/C operations activities, including the production and maintenance of operational products (flight operations procedures and S/C database). The FCT also supported all the external interfaces related to planning, troubleshooting and anomaly investigation, data retrieval and analysis, spacecraft performance evaluation, on-board software maintenance, and maintenance of on-board control procedures.

5.2.1 FCT Setup and Evolution

FCT setup: The FCT supported flight operations as follows: LEOP (17/03/2009 – 19/03/2009): two complete FCT shifts covered 24 hours a day for a total of 70 hours (3 shifts each). Operations in the first 12 hours after LEOP were also executed with this setup. Commissioning (Mar 2009 – Sept 2009): in the first month, all ground station passes were manned by a SPACON, requiring a double SPACON shift for this time period. A SOE was in charge of the conduct of the overall activities (on-call engineer), with special activities performed by the SOEs responsible for the subsystem involved. Mission planning activities were performed by the mission planning SOE. The remaining 5 months of commissioning were then performed as per the routine setup. Routine operations (Sept 2009 – Aug 2012): the ground contacts were covered by a single SPACON shift, with the contacts outside of this shift taken as unmanned passes (with the Envisat SPACON team performing simple checks for each unmanned pass). Each week, a different SOE acted as on-call engineer, also being responsible for the mission planning activities (usually run by the SPACON on day shift whenever possible). Low orbit operations campaign (Aug 2012 – Oct 2013): a secondary on-call SOE role was put in place for all non-working days, allowing for fast recoveries from drag-free mode interruptions required in this phase. The SPACON team was enlarged from 3 to 6 staff, who were manning every pass for faster reaction to anomalies. Deorbiting (Oct/Nov 2013): the FCT was organised in two shifts consisting of 1 SOM and 1 SOE, allowing to cover every Kiruna pass (coverage of the shifts from roughly 5-6 UTC up to 18019 UTC). Other measures put in place for the low orbit operations campaign were maintained (SPACON covering every pass, 2nd On-call SOE for non-working days).

Evolution of FCT: At launch, the FCT had the following size: 1 Spacecraft Operations Manager (SOM) 6 Spacecraft Operations Engineers (SOE) 1 Spacecraft Analyst dedicated to the mission 3 Spacecraft Controllers (SPACON) dedicated to the mission For the routine phase after completion of commissioning, the FCT was then reduced significantly to 1 SOM, 3 SOEs, 1 Analyst (50%, shared with Cryosat-2), 3 SPACONs (shared with Cryosat-2). 2010’s major S/C anomalies put a major workload on the FCT, also requiring to reinforce the team on SOE side.

Page 119/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

The last major change in the FCT came in preparation for the low orbit operations campaign. In mid-2012, the FCT was reinforced with 2 additional SOEs. The SPACON team was enlarged from 3 to 6 staff to cover all passes. At end of mission, the FCT had the following size: 1 SOM 7 SOEs (4 full time, 3 shared with other EO missions) 1 Analyst (50%, shared with other EO missions) 6 SPACONs (shared with other EO missions) As is not uncommon, the FCT composition changed significantly in flight, with most SOEs who had performed the pre-launch preparation gradually leaving after completion of commissioning in 2009. In most cases the move was to other missions within the Earth Observation Missions Division, so the expertise was not lost entirely and could still be relied on in case of special need. In some cases, limited part-time support for the mission (e.g. participation in the SOE on-call rotation) was agreed. Apart from many changes in the SPACON team, 4 contractor SOEs, 2 staff SOEs, 1 SOM, 1 Young Graduate Trainee were hired after GOCE launch to compensate for the departures.

FCT training: New team members were trained for the mission “on the job”, in the case of new SOEs by their fellow engineers, or by the Analyst for new members of the SPACON team. Owing to the comparably high number of S/C anomalies throughout the entire mission –many of which requiring complex recovery activities–, the mission never entered an extended period of quiet routine operations, meaning that there was little to no need for FCT refreshment training. The only dedicated training campaign after launch was done in late 2012 in preparation for the low orbit operations campaign, training the entire FCT (especially the 2 new SOEs) for the rapid recovery from interruptions of drag-free mode at the lower altitude. This was performed in the frame of a small simulations campaign supported by a simulations officer.

5.2.2 Auxiliary Tools used by the FCT The following auxiliary tools were used by the GOCE FCT: MOIS: as is standard at ESOC, the MOIS toolset was used for preparing all GOCE flight procedures. MUST: MUST-related tools were used extensively by the FCT and have been a key factor in evaluating S/C telemetry. GOCE applications were running on a server shared with Cryosat- 2. In detail, the following tools were used: GRAINS as from early in the mission. GRAINS is a Matlab-based desktop application for plotting and exporting S/C telemetry parameters; WebMUST as from 2012, offering similar functionality as GRAINS, but accessible through a web interface; MUST novelty detection tool as from 2012, for analysis of S/C TM to detect any non- nominal features. eLog: electronic log for the SPACONs, allowing to enter information on the pass execution. A hand-written log-book was still maintained in parallel.

Page 120/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission-planning-related tools: after launch, the mission planning system was expanded with several FCT-developed scripts for pre-processing of some MPS input files, allowing for a faster and more convenient weekly mission planning run (see section 3.6.3). A special Excel sheet was used for generating the daily pass sheets. Dedicated Excel sheets were used for checking the Eclipse Table TPF delivered by Flight Dynamics, and for checking and visualising of the SUMO report (angle between STR boresights and the moon) delivered by FD. Satellite Toolkit (STK) was used occasionally, e.g. for determining the S/C position at a time of interesting on-board events (e.g. simultaneous invalidity of all star trackers or AGC failure events generated by the SSTIs).

Page 121/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

5.3 Flight Dynamics

5.3.1 Overview FD support for GOCE was following the traditional setup at ESOC, with FD divided in the various operational groups (orbit determination, command generation, AOCS monitoring, and test & validation), and the FD expert engineers working on GOCE also supporting other (Earth observation) missions at ESOC. Orbit determination activities were heavily impacted by the specifics of the mission, requiring detailed modelling of the atmospheric drag when the S/C was out of drag-free mode. With every significant S/C contingency essentially leading to a major change of the orbit (stop of IPA firing when interrupting drag-free mode), close interaction between FD and FCT was required for the ensuing recovery activities (e.g. restart of the ion propulsion system). Orbit determination was normally based on the orbit state vector from the SSTI navigation solution packet. As a backup method, OD could also be based on radiometric data, the acquisition of which however required to put the on-board RF subsystem into a dedicated mode (Mode 1). The process for performing routine orbit maintenance manoeuvres was as follows: 1. The evolution of the ground track was monitored by ESTEC, requesting an orbit raise/lowering as needed to keep the desired ground track (orbit inclination was not controlled); 2. The manoeuvre was planned by the FCT, with FD doublechecking the size and duration of the acceleration bias calculated by the FCT, and updating the orbit prediction accordingly. 3. The manoeuvre was executed by the FCT through applying the acceleration bias in drag-free mode. A peculiarity of the GOCE FD setup was that the FD orbit team was on-call, enabling the FCT to request FD support outside of normal working hours for performing a new orbit determination run in case of an unexpected interruption of drag-free mode and the consequent rapid orbit decay. As opposed to the complexity of the support by the OD team, the mission required comparably few commanding products. Products that were generated on a routine basis included the Skeleton planning file (SPF) for the weekly mission planning run by the FCT, the eclipse table TPF (also uplinked on a weekly basis), and the GPOD TPFs (delivered on a routine basis to allow setting up the GPOD in case of unexpected SSTI outage). The FD setup remained stable throughout the mission, with only few changes, some of which required by the special operations campaigns late in the mission as described in the ensuing section. Minor updates included (i) the delivery of the so-called sun/spacecraft interference file for routine mission planning to work around sun interference events (suspension of playback) as from May 2011; (ii) inclusion of events for new antennae in the FD products (e.g. new ESRANGE IDUN antenna in June 2012); (iii) delivery of an RFI file indicating possible interference events with other S/C as from early 2013; (iv) an update of the FD-provided routine for calculating the propagation delay in the MCS in June 2013, allowing to use TLEs containing the B* term for increased orbit prediction accuracy in view of the upcoming de-orbiting operations campaign.

Page 122/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

5.3.2 Special operations The following special operations were supported throughout the mission: Apart from the classical FD activities in LEOP and commissioning, several special unit-level calibration activities were performed by FD: MGM calibration in LEOP, assessment of SSTI state vector accuracy in LEOP, DSS and STR misalignment calibrations in commissioning. The test firings of the IPA in commissioning required special support to assess the corresponding impact on the S/C orbit. For every interruption of drag-free mode operations, extensive support had to be provided to estimate the orbital decay rate, and to perform additional OD runs once the recovery (restart of the ion propulsion system to stop the decay and recover the altitude lost) was under way. For the TM loss anomaly in summer 2010 and the SSTI state vector anomaly in Jan 2011, orbit determination had to be based on radiometric data owing to the prolonged unavailability of the SSTI state vector, proving the importance of maintaining the classic method of determining the orbit based on Doppler and ranging data. Low orbit operations campaign: FD was heavily involved in evaluating how much the orbit could be lowered when planning the campaign (see dedicated section 5.3.4 here below). For the actual campaign the FD on-call scheme was extended slightly. The approach and FD procedures for activities following an interruption of drag-free mode were optimised for allowing a recovery as quickly as possible in collaboration with the FCT. FD also participated in the dedicated simulations campaign for training low orbit operations in late 2012. De-orbiting operations campaign: for de-orbiting, the FD setup was changed to allow performing two OD runs per day, with FD working in two shifts. The generation of various FD products (SPF, GPOD and eclipse table TPFs) was also updated for this special phase. FD orbit prediction accuracy was excellent throughout deorbiting, a key factor enabling to operate the S/C up to 1 orbit before re-entry.

5.3.3 Bookkeeping for on-board consumables FD performed bookkeeping for the following on-board consumables: Nitrogen for the GCA gold gas propulsion, used for ICM calibrations of the EGG. Xenon for the ion propulsion system. A PVT method was used for Nitrogen bookkeeping. There was large margin for Nitrogen, with over 5 kg (out of 13 kg at launch) left at end of mission. Bookkeeping for Xenon was a crucial activity, as the amount of Xenon left was –together with the evolution of atmospheric drag levels– a major factor for determining the remaining lifetime of the mission. Xenon bookkeeping was performed throughout the entire mission using two different methods: Massflow integration method: the Xenon mass flow as visible in IPA TM (1 sample every 8 sec) was used to estimate the amount of Xe left. PVT method: estimation of the remaining Xe with a classical pressure-volume-temperature method.

Page 123/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 91: Estimated Xenon mass and weekly consumption throughout the entire mission. Up to May 2013 the estimation was based on the massflow integration method, thereafter on the PVT method.

While the integration method was initially more accurate, at lower tank pressures late in the mission (with the estimation error of the integration method accumulating due to inaccuracy of the flow sensor), the PVT method was primarily used (as from May 2013). See Figure 91 for an overview of the estimates on Xenon consumption throughout the mission. Figure 92 shows the estimated remaining Xenon mass in 2013 based on the two different methods. At the end of mission, the difference between the two methods was only about 0.5 kg, significantly less than the worst case assumption before launch. The PVT method proved to be very accurate at end of life. The main uncertainty for the PVT method was due to the inaccuracy of the pressure transducer in the high pressure section, which turned out to be significantly less than the worst case estimate of about ±1 bar, as could be seen when monitoring the evolution of the pressure in the high and low pressure section of the IPA once the pressure in the Xenon tank dropped below the minimum operating Figure 92: Amount of Xenon left in the tank in 2013 as per the PVT pressure of the pressure regulator (see method and the integration method. also section 4.1.8).

Page 124/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

5.3.4 Mission analysis work after launch GOCE altitude selection was driven by the need to choose an altitude as low as possible but still compatible with the atmospheric density range for which the S/C had been designed. Owing to the large uncertainties for predicting the evolution of solar activity and the corresponding changes in atmospheric density at GOCE’s altitude (in particular in view of the unexpectedly weak solar activity throughout the mission), and the decision to lower the orbit as much as possible towards the end of the mission, re-evaluations of the altitude selection had to be done in-flight. FD supported this by providing updated atmospheric density predictions and altitude profiles in line with an operational scenario discussed with the FCT (e.g. to evaluate the minimum altitude possible still allowing to recover an interruption of drag-free mode of a specified duration). FD used the NASA MSFC predictions to model the evolution of the solar activity, and the MSISE00 model for the atmospheric density (see Figure 93 for an example of the resulting output). Early in the mission, it turned out that the altitude profile selected during mission preparation (first measurement phase at 268 km mean altitude) was not adequate, as the density was lower than expected. The orbit was then lowered in commissioning down to 259.6 km mean altitude. Major work in this area was done preparing for the low orbit operations campaign in 2012/2013, determining the lowest possible altitude given the latest density predictions and the relevant S/C-related constraints as provided by the FCT. Figure 94 gives a typical example for the output of such an analysis, depicting the evolution of altitude, density and drag in a scenario where drag-free mode is interrupted for two days starting at 239.6 km mean altitude. During the low orbit Figure 93: Atmospheric density prediction based on MSISE00 model and operations campaign it was March 2012 MSFC bulletin (95% percentile). crucial to monitor the density evolution, and to evaluate the drag actually experienced against previous predictions. For this purpose, as from Sept 2012 FD performed a monthly analysis containing.. The latest predictions on the evolution of solar activity and atmospheric density, the latter taking into account the planned altitude profile; Information on the “reconstituted density”, showing density encountered in the past based on the MSISE00 model and the actual solar activity indices. See Figure 95 for an example. This information was key to concluding in early 2013 that a further lowering of the orbit from 240 km down to 229 km was possible. Planning of deorbiting operations were supported in a similar way, evaluating the expected atmospheric density and drag levels at extremely low altitudes.

Page 125/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 94: Evolution of altitude, density and drag force for the 2-days decay scenario starting from 239.6 km, used for evaluating the minimum possible altitude for the low orbit operations campaign. The increased density and drag at the start of the decay phase is due to a simulated geomagnetic storm.

Figure 95: Reconstituted density based on MSISE00 model, actual solar activity indices and actual GOCE orbit, taken from the monthly mission analysis package delivered in Sept 2013.

Page 126/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

5.4 Stations and Facilities

5.4.1 Ground Stations

Ground station network: GOCE required support for taking passes with S-Band uplink and downlink in either TM Mode 2 (high rate, no ranging possible) or Mode 1 (low rate, ranging possible). The ground station network consisted of ESA’s Kiruna station as the prime antenna, augmented by passes from external station providers whenever needed. The following antennae were used (Figure 96): Kiruna/ESA: the baseline was to serve all supports on the Kir-1 antenna, as it was not possible to accurately measure the TOV with Kir-2 owing to station specifics. However, Kir- 2 also saw significant usage during periods with Kir-1 unavailable due to maintenance or use by other missions. KSAT stations: Troll (Antarctica): Troll-1 and as from Sept 2012 the new Troll-2 antenna; Svalbard: SG3 (prime antenna for GOCE), SG4 (used occasionally, mainly in 2009/2010), SG25 (new antenna validated for GOCE in Spring 2011); Alaska station facility (only during LEOP). SSC ESRANGE stations: several antennae at ESRANGE (BALDER, ETX, ESSEX, IDUN) were also validated for GOCE. They were not heavily used throughout the mission. The only period with extended usage was during the ERS-2 de-orbiting in summer 2011.

Figure 96: ESTRACK network. The stations with the red name tags were used by GOCE.

Page 127/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Ground station coverage throughout the mission: As GOCE was launched into a Dusk-Dawn orbit, all contacts with stations in northern Europa (the majority of the GOCE station network) were more or less during the day, leaving a gap in coverage of about 10 hours over night. In routine, the scheduling of the stations was done once a week as per the scheduling agreement [RD-14] between HSO-OE and HSO-ON. The baseline ground station coverage throughout the mission evolved as summarised in the following list (see Table 17 for an overview): LEOP (03/2009): a ground station network consisting of Kiruna (KIR) and the KSAT station facilities at Svalbard (SVA), Troll (TRO) and Alaska (ASF) was used. A total of about 80 passes were taken in 2.5 days of LEOP. Commissioning and early routine operations (03/2009 – 10/2009): 03/2009 – 06/2009: KIR and SVA passes were taken to cover every orbit throughout the day. Usually this amounted to up to 8 KIR passes (early in commissioning, when the S/C was at a rather high altitude) and around 3 SVA passes. Troll was used for supporting special operations. 07/ 2009 – 11/2009: 6 KIR and 2 SVA passes were taken every day. Test passes on Troll were taken every few weeks to ensure station readiness in case of contingency support. Initial routine operations phase (11/2009 – 02/2010): every day, 6 KIR + 1 SVA pass were taken. Test passes on Troll continued to be taken every few weeks. Routine operations phase after CDMU-A failure (03/2010 – 10/2012): following the failure of CDMU-A in February 2010, an additional late evening Svalbard pass was taken to shorten the gap of blind orbits over night, reducing the average reaction time in case of S/C anomalies. In total, 6 KIR + 2 SVA passes were taken per day. Low orbit operations campaign (11/2012 – 10/2013): as from November 2012 the coverage was augmented by an additional Troll pass around midnight, to further shorten the gap of blind orbits over night, bringing the total number of passes per day to 6 KIR + 2 SVAL + TRO. As from August 2013, an additional third Svalbard pass was taken to allow downlinking all data to ground, with the data increase caused by the decision to have both SSTIs ON in parallel following installation of new application software 4.2 on the redundant unit SSTI-B. Deorbiting operations (10/2013 – 11/2013): station coverage was augmented significantly for deorbiting. In addition to all possible KIR passes, two overnight TRO passes were taken, and a maximum of 6 SVA passes were scheduled to cover every orbit during the day. Whenever needed (e.g. in the case of S/C contingencies), ground station coverage was augmented by additional KSAT station passes, with KSAT often serving requests at very short notice. The handling of conflicts for Kiruna between various ESA missions required special attention: From early 2010 to late 2011, 4 EO missions (GOCE, Cryosat-2, ERS-2 and Envisat) were using Kiruna at the same time, leading to a significant number of conflicts that were resolved according to an agreed scheme. To resolve some of them, GOCE passes were moved to the Svalbard/KSAT station. In early 2013, ESA’s Integral mission started to use the Kiruna-1 antenna, with GOCE moved to Kiruna-2 for some of the conflicts.

Page 128/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Phase Kiruna/ESA Svalbard/KSAT Troll/KSAT Other stations

LEOP All possible passes All possible passes All possible passes Alaska/KSAT used

- Used for special ops and All passes 03-06/2009 3 passes/day 03-06/2009 Commissioning contingency - 6 passes/day thereafter 2 passes/day thereafter - Regular test passes

Limited use of Routine phase (before - Only for contingency 6 passes/day 1 pass/day ESRANGE for KIR CDMU-A failure) - Regular test passes conflict resolution

Limited use of Routine phase (after 2 passes /day (1 late evening - Only for contingency 6 passes/day ESRANGE for KIR CDMU-A failure) pass to reduce night gap) - Regular test passes conflict resolution

2 passes/day up to 07/ 2013 Low orbit operations 1 pass/day to shorten 6 passes/day 3 passes/day from 08/2013 - campaign night gap

All possible passes (at most 6 At most 6 passes/day to cover 2 passes/day to shorten Deorbiting operations - passes/day) all orbits night gap

Table 17: Overview of ground station coverage throughout the mission.

Evolution of equipment used: For what concerns external service providers, several new antennae were validated in-flight throughout the mission. Apart from that, no major changes in the equipment used occurred during the 4.5 years of GOCE flight operations. For Kiruna, it was decided to keep using IMFS/TMTCS for GOCE up to the end of the mission (as opposed to Cortex used for other Earth Observation missions). Several upgrade and maintenance activities on Kiruna were done throughout the mission, with the following most significant activities: Kiruna upgrade in early 2011 (including TMTCS upgrade to 3.0.6); Kiruna antenna maintenance in September 2011; Kiruna CSMC upgrade in 2012 (upgrade from v6.3.5 to v6.4.1); Upgrade of Kiruna PSS software in June 2013.

Special operations: Owing to the specifics of the mission profile and the operational challenges for some of the S/C contingencies, several special station-related operations were performed throughout the mission: Search for the S/C along track: GOCE’s low orbit in a drag environment meant that in case of an unexpected interruption of drag-free mode, the S/C could arrive significantly earlier than expected. If this time difference grew too large (i.e. above roughly 3 sec), the S/C would be outside of the antenna beam and would hence not be acquired automatically. The approach foreseen before launch of having the Kiruna antenna wait in Autotrack mode and follow the S/C automatically in case of early arrival turned out to be infeasible. Instead, a special procedure [RD-44] for performing a manual search for the S/C along track (i.e. applying artificial offsets to the antenna pointing along track) was put in place and was exercised several times throughout the mission. See also risk GOC_RR-9 [RD-7].

Page 129/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Support during S/C anomalies in 2010: the major S/C anomalies in 2010 (failure of CDMU-A in Feb 2010 and the TM loss anomaly in from early July to late August 2010) were particularly demanding for what concerns stations support. Recoveries from a no-AoS condition had to be performed several times. This included “troubleshooting” of a non- nominal S/C signal in close collaboration with the FCT – in several cases, the S/C downlink chain was configured inconsistently for what concerns the RF mode, leading to an anomalous downlink signal with features of both TM mode 1 and TM mode 2. In one case, tracking passes with the Villafranca antenna (never foreseen to be used for GOCE) were taken to confirm the S/C status, with the station configured for GOCE at very short notice. Support during 2011 SSTI outage: in early 2011, both SSTIs (e.g. the scientific GPS receivers of the S/C) were unusable for a period of 15 days due to a flight software problem. During this period, a significant number of Mode 1 passes was taken to allow performing orbit determination based on radiometric data. Low orbit operations campaign: The higher drag environment at lower altitudes would in general lead to a faster divergence from the expected orbital position, making it more difficult to acquire the S/C when drag-free mode was interrupted. The following range of additional special measures was put in place to for this campaign (see also [RD-15]: Additional training for the ECC operators for GOCE contingency operations; Special training of Kiruna local staff for GOCE contingency support (Kiruna local staff is on-call on all non-working days); For holiday periods in excess of 2 non-working days, a ground operations engineer was on-call as from the 3rd non-working day. De-orbiting operations: the ground stations performed extremely well during the final weeks of GOCE operations. The S/C was tracked down to little over 100 km altitude, confirming the evaluations and testing performed beforehand [RD-18], which had not identified any limitations for tracking the S/C at those altitudes. The following support arrangements were set up on top of the special measures already in place for the low orbit operations campaign: During the entire the deorbiting, on call support from a Ground Operations Engineer (GOE) during non-working days to cover for unexpected problems during the entire de-orbiting operations phase. In the final phase of the de-orbiting, GOE on-site support was provided for Kiruna passes, usually limited to the most critical first morning pass.

Station performance and significant anomalies: In general, station performance throughout the mission has been very good, with the amount of passes lost in each quarter usually less than 2% [RD-45]. As explained above, good station support has been essential for overcoming some major S/C anomalies in-flight, in supporting the special GOCE operations campaign for lowering the orbit in 2012/2013, and for the final de-orbiting. The link margin as measured in flight was very good. As tested in commissioning, this allowed taking passes over Troll/KSAT in Mode 2 rather than Mode 1. This reduced operations overhead and greatly improved the usefulness of Troll for contingency support, as it was not required to reconfigure the S/C for Mode 1 prior to each Troll pass. On Kiruna, the following two issues encountered in 2009’s commissioning phase required special attention:

Page 130/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Kiruna keyhole passes: In some of the high elevation passes with a very specific geometry, the antenna turned out to be not fast enough to follow the S/C at the highest elevation, resulting in some missing telemetry frames. As a workaround, the mass memory playback was suspended for the passes in question as part of routine mission planning (see anomaly GOC-1195). Kiruna interference with the sun: Some gaps in playback telemetry as observed over Kiruna turned out to be caused by interference of the RF signal with the sun, due to the specific geometry encountered in those passes. This was an issue not encountered in previous EO missions (possibly due to the specifics of the GOCE orbit with the inclination left to drift). This was handled on a routine basis through disabling the dump of playback data in the affected passes (see anomaly GOC-1193). A complete list of all anomalies encountered on station side can be found in ARTS [RD-7]. The following main station-related problems occurred throughout the mission: Performance of the KSAT stations during LEOP (anomaly GOC-1166): throughout the first two orbits after S/C separation, all passes on Svalbard, Troll and Alaska were lost. The LEOP network was therefore severely compromised, with only one station (Kiruna) available in the critical first few hours after separation. Later in LEOP, the performance improved, however still with a significant number of KSAT station passes affected by problems or lost altogether. Following offline investigation, it turned out that virtually all problems were due to station misconfiguration or operator errors. The topic was addressed in an ESOC-internal MRB and a subsequent meeting with KSAT representatives. End-of-2012 problems on Kiruna (anomaly GOC-1358): on 31/12/2012 and 01/01/2013, Kiruna was affected by problems which led to the CSMC software not running in a stable manner, with the NTP servers not handling properly the transition to 31/10/2012 (DoY 366, with 2012 being a leap year). A series of passes was lost, requiring to schedule several additional Svalbard passes to allow dumping all playback data. The Kiruna station was operated either in a non-nominal or manual configuration throughout the anomaly period, allowing to mitigate the effects. Problems with KSAT radiometric data in 2012/2013 (anomaly GOC-1379): when preparing for the end-of-mission operations, several problems with the radiometric data from KSAT stations (Svalbard/Troll) were discovered, which could not be resolved despite extensive testing activities since April 2013. They were not considered blocking for the deorbiting, as radiometric data from the prime GOCE station Kiruna was fully usable.

Page 131/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

5.4.2 Facilities, Computers and Communications

Facilities: All ESOC Operations Control Centre Facilities (MCR, DCR, PSR, ECC, FDR, etc.) performed well and supported the mission according to its needs. As from the end of LEOP, flight operations by the FCT were executed from the Earth Observation DCR (E39), sharing the room with ERS-2 (up to end of mission in 2011), Envisat (up to end of mission in spring 2012), Cryosat-2 (as from launch in April 2010), and Swarm (launched in Nov 2013). Operations were moved to the MCR temporarily from 27/04/2010 to 19/08/2010 to allow for a major refurbishment of E39. The Earth Observation testing area (D01) was used for work on the Pre-OPSLAN (e.g. acceptance testing of new MCS deliveries or testing with the simulator).

Computers: Significant sharing with Cryosat-2 could be achieved for the machines used for GOCE, thanks to the commonalities of the two missions for the MCS and the sharing of the SPACON team. Table 18 gives an overview of all machines used by GOCE (status as per Oct 2013), indicating the purpose of each machine and the sharing with CS-2: Two MCS chains in OPSLAN with 2 servers, 1 long term archive, 1 external server, 2 NCTRS machines, 3 MCS clients in the DCR, 2 MCS clients in D01 (backup in case of E39 outage), 1 OPSLAN PC for MCS monitoring. A single MCS chain in Pre-OPSLAN with 1 server, 1 long term archive, 1 external server, 1 NCTRS and 3 MCS clients. 2 simulators, PCs for SPACON logging and simulator access, and a MUST server. Figure 97 shows the layout of GOCE machines in E39. Machines not resident in the control rooms were either in the DENEB or HALLEY data centre located in different buildings at ESOC, allowing to continue mission operations in case of a catastrophic outage of one of the two data centres. The set of GOCE machines remained very stable throughout the mission. In particular there was no need to port to new hardware owing to the short mission duration. The following changes were done: After commissioning, the number of OPSLAN MCS clients was reduced from 3 to 2 as planned. However, a third client was added again in the frame of 2010’s major anomalies and was maintained up to the end of mission. In June 2010, GOCE MUST was migrated to the CRYMUST machine, a MUST server shared with Cryosat-2. CRYMUST was equipped with larger disks in Jan 2012. Bigger disks were installed in June/July 2010 for GOMCA and GOLTA. The CORTEX NDIU of ADM Aeolus was used to support in-flight SVT-3 in May 2012. For the simulations campaign in late 2012 to prepare the upcoming low orbit operations, an additional Pre-OPSLAN client was installed in E39 (maintained up to end of mission) and a third simulator machine was added (removed after end of the simulations campaign). In April 2013, the NCTRSs were replaced with better machines, which had become available following the end of the Envisat mission.

Page 132/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Table 18: List of machines used by GOCE, status as per Oct 2013. All machines shared with Croysat-2 are indicated. Machines used by GOCE but under CS-2 budget are listed as well.

Figure 97: Layout of GOCE machines in the Earth Observation DCR (E39) in 2013. S2K clients sun100, sun101 and sun113 also shown on the picture were used by the Cryosat-2 mission.

Page 133/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

The following failures or special events took place throughout the mission lifetime: An electrical safety test was executed on 16/09/2009 for the DENEB data centre, requiring all missions at ESOC to move to the backup computer centre. From 14/09/2010 to 17/09/2010, GOCE mission operations were therefore performed with the backup mission control machines. The connection with the PDGS was down for one day due to this maintenance activity. On 31/01/2012, a transient sudden power outage occurred in the frame a planned maintenance of the ESOC Uninterruptible Power Supplies (UPS), impacting all missions controlled from ESOC. GOCE machines in the DCR and in the DENEB data centre (prime MCS server GOMCA, prime NCTRS GONCTRA and the external server) were affected, requiring to temporarily move operations to the redundant chain. Several disk failures occurred late in the mission, requiring to replace the relevant disks: GOMCA May 2012, GOMCA Sep 2012, GOLTA Jan 2013, CRYMUST Apr 2013, GOMCA Aug 2013, sun102 Oct 2013. The graphics card of client sun114 was replaced in Feb 2012 and Aug 2013.

Computers maintained after completion of the rundown: Following the end of operations, the computers allocated to GOCE were either gradually returned to stock or handed over to Cryosat-2 in the case of essential shared machines. At the end of the rundown performed as per the closure plan [RD-22], the following machines remain active until end 2018: The CRYMUST machine holding all GOCE MUST data (TM parameter archive, TC history, on-board event history), allowing to retrieve TM after the end of the rundown; The GOLTA long term archive, holding the complete archive, including all TM files dumped throughout the mission.

Communications: The performance of communications with the ground stations and with the Payload Data Ground Segment (PDGS) in ESRIN was good, there were no problems leading to extended downtimes or any other major impact. Any downtimes of communication lines were recovered quickly.

Page 134/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

5.5 Mission Data Systems

5.5.1 Mission Control System

5.5.1.1 Overview The GOCE Mission Control System (GOMCS) is a Solaris 8 set of software tools designed to monitor, control and handle all ground interfaces of GOCE‘s flight operations segment. The system was initially based on SCOS 2000 version 4.5 and in early 2010 was migrated to SCOS 2000 version 4.5.1. This was the last major patch, although fixes were continuously developed. After launch, the setup was three clients, one prime server and one backup server. One client was always reserved by the spacecraft controller and the other two were in use by engineers (Figure 98). The prime server was connected to a long term archive server which acted as a mirror of all mission data. There was additionally an external server which retrieved data from the long term archive and provided it either daily or upon request to external users. Occasionally one client would be connected to the backup server, this was usually in order to perform specific tests, including connections to the simulators and patches.

EXT RTB NCTRB Y-LAN

NCTRA

LTA RTA X-LAN

CL1 CL2 CL3

Figure 98: GOCE MCS setup

5.5.1.2 GOMCS components Spacecraft Monitoring and Control system – Generic ESA Spacecraft Control and Operations System (SCOS 2000 version 4.5) + Earth Observation and Mission specific changes Network Control and Telemetry Routing System – NCTRS 11.0 (later NCTRS 11.1.1) Ground Data Distribution System – GDDS 1.6.0 Telemetry Data Retrieval System – TDRS 3.3 Multi-mission Configuration and Central Monitoring – MCCM 3.1.i4 File Transfer System – FTS 3.10

Page 135/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

5.5.1.3 GOMCS system support after launch The development contract including also the launch support was under the responsibility of HSO- GDE and performed by an Industrial consortium with Science Systems and GMV companies. After launch, the maintenance of the system was given initially to a dedicated contract to the same consortia and later on combined in a maintenance contract together with the Cryosat-2 system and assigned to GMV. The maintenance, as well as the support on site, benefited from the common functionalities and support requirements with the Cryosat-2 mission achieving a good quality system at relatively low cost.

5.5.1.4 Timeline of GOMCS March 2009 – Launch: GOMCS version 6.9.1 based on SCOS 4.5.0, NCTRS 11.0 June 2009 – NCTRS upgrade: Upgrade from NCTRS 11.0 to NCTRS 11.1.1 January 2010 –Upgrade to GOMCS 6.9.1: This patch contained an upgrade from the SCOS 2000 baseline from 4.5.0 t0 4.5.1. Due to unforeseen backward compatibility issues, after the patch installation all previous command history became unavailable. This required a rollback; after investigation a new delivery was installed which removed the conflicting feature. January 2011 – Upgrade to GOMCS 6.9.2: Mostly a consolidation of fixes into a new delivery: Multiple cronjobs to delete old logs and unnecessary files. Configuration for new antennas. Other routine configuration changes and FTS updates. October 2012 – Upgrade to GOMCS 6.9.3: Minor fixes and configuration updates, most relevant was the increased of the TCO gradient resolution when injecting time packets.

5.5.1.5 Special MCS activities Patch for processing normal packets inside HPTM (late 2010): In the frame of recovery activities from the TM loss anomaly in July/August 2010, an MCS patch was prepared that allowed the MCS to digest regular TM packets passed byte by byte via a S/C TM parameter in the HW-generated high priority TM (implemented via S/C on-board software patch; see also section 3.3.3 for more details). The MCS patch allowed for (each option can be enabled/disabled via configuration): extracting packets received inside HPTM extracting packets contained inside TM(6,6) coming inside HPTM

Page 136/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

New MCS branch to support Dual PM PASW (follow up to TM loss anomaly) Following successful recovery from the TM loss anomaly end of August 2010, it was decided by mission management to have a flight software developed for the case of a possible re-occurrence of the TM loss anomaly, using both processor modules of the CDMU in parallel. This also required a sophisticated corresponding development on MCS side. Due to the complexity and broad scope of the necessary changes it was decided to create a separate branch of the MCS, splitting from GOMCS 6.9.2 into MSMCS 1.0 which eventually upgraded to MSMCS 1.1. The changes implemented allowed the processing and display of TM, TC and events dependent on which processor module the TM/TC was coming from / addressed to (see Figure 99 for an example).

Figure 99: Filter window for the Dual PM MCS, allowing to select from which processor module the TM is displayed

5.5.1.6 Other relevant activities

Disk upgrades (June 2010): Due to the increasing space taken by housekeeping telemetry, in June 2010 an upgrade of the hard drives on GOLTA and GOMCA (respectively the prima and long term archive servers) was performed.

Page 137/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

This allowed the system to sustain all data necessary until GOCE’s end of mission. Table 19 shows the disk states of the servers at the end of mission.

Filesystem size capacity Mounted Notes /dev/md/dsk/d10 9295373 53% / Operating System /dev/md/dsk/d30 57152318 76% /lhome/gomca User accounts /dev/dsk/c4t8d0s6 70577241 50% /lhome1/gomca User accounts /dev/md/dsk/d40 70577241 72% /hfa Active Archive /dev/dsk/c4t10d0s6 288502542 82% /lts1 TM Archive /dev/dsk/c4t11d0s6 269914828 86% /lts2 TM Archive /dev/dsk/c4t12d0s6 269914828 90% /lts3 TM Archive /dev/dsk/c4t13d0s6 269914828 89% /lts4 TM Archive /dev/dsk/c5t9d0s6 269914828 85% /lts5 TM Archive /dev/dsk/c5t10d0s6 70577241 84% /lts6 TM Archive /dev/dsk/c5t11d0s6 70577241 87% /lts7 Recorded TM Archive /dev/dsk/c5t12d0s6 70577241 94% /lts8 Recorded TM Archive /dev/dsk/c5t13d0s6 288484552 80% /lts9 Recorded TM Archive Table 19: GOMCA disk overview at end of mission

Processing of Plan View files (Aug 2010): The mission planning approach was modified to allow processing Plan View files delivered by the Scheduling Office (see also section 3.6.3). For this activity only minor changes were required for the MCS (i.e. FTS configurations for supporting the new files). The actual processing of the Plan View file was handled by the FCT through dedicated user scripts.

Upgrade of NCTRS servers (March 2013): Due to Envisat end of mission, three new servers became available for upgrade. These new servers had two CPUs (instead of one) and two disks which enabled mirroring. The upgrade was done efficiently without any significant issues. The new machines (Prime and Backup NCTRS) benefited from doubled performance and mirrored disks.

5.5.1.7 GOMCS performance and anomalies The overall performance of the GOMCS has been excellent throughout the mission, with the system very stable. The vast majority of problems encountered in-flight did not have a major impact on operations – throughout over 4.5 years of operations, only few isolated passes were lost due to MCS problems. Table 20 lists the most critical anomalies in flight.

Occurrence

ID Observation Element Criticality Urgency

Date MCS Error message and bad performance of the

GOC-1353 2012-10-10 GOMCS High High system

GOC-1273 2010-07-26 HPTM packet samples lost in retrieval GOMCS High High

GOC-1267 2010-06-21 GOLTA loss of performances GOMCS High High

GOC-1228 2009-10-01 MPS never completes the schedule generation GOMCS High High Multiplexer crash while sending large stack of

GOC-1203 2009-06-15 GOMCS High High TCs of maximum size Table 20: List of top 5 critical/urgent GOMCS anomalies sorted by date.

Page 138/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

5.5.2 Simulator The GOCE simulator as developed before launch was based on the SIMSAT infrastructure, using an ERC-32 emulator running the flight version of the platform application software (PASW). The simulator has been a key tool for procedure validation and S/C testing after launch, in particular in the frame of activities linked to the significant S/C anomalies encountered. As the simulator was running the flight PASW, it allowed for detailed testing of PASW-related anomalies and the corresponding PASW fixes developed by the S/C manufacturer (see section 3.6.1), as well as testing of OBCPs developed in-house at ESOC (see section 3.6.2). For the pre-launch simulations campaign, three simulator machines were used. One machine was returned to stock shortly after launch, with the remaining two simulator machines supporting the mission in the routine phase. The simulator proved to be very stable. 5 simulator-related anomaly reports were raised after launch [RD-7], and only few fixes were required in the frame of the post-launch simulator maintenance contract with industry: release OD 3.3.1 was installed in June 2011, OD 3.3.2 in Oct 2011, and OD 3.3.3 in Sept 2012. A dedicated simulations campaign was done from 09/10/2012 to 06/12/2012 to train the reinforced Flight Control Team for the low orbit operations campaign, which required a particularly fast reaction to interruptions of drag-free mode. The campaign was prepared and executed by a dedicated simulations officer. A third simulator machine was added temporarily to have enough resources throughout the simulations campaign.

Figure 100: Main components of the SIMSAT-based GOCE simulator.

Page 139/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

5.6 Space Debris Office (SDO) Support

Support during the routine mission: As the GOCE FOS had never been required to implement collision avoidance activities owing to the much reduced collision risk at GOCE’s low altitude, unlike for other EO missions no such provisions had been put in place originally. A fragmentation of a Briz-M orbital stage on 16/10/2012 increased the collision risk for GOCE by 140%, albeit the absolute collision risk was still at a much lower level than for typical EO missions around 700-800 km altitude (see [RD-33] for a detailed analysis). Following this event, it was decided to implement collision avoidance for GOCE. This could be done efficiently, as the approach used was essentially the same as already in place for Cryosat-2. The main differences were in the actual execution of a possible avoidance manoeuvre (application of bias in drag-free mode to lower or raise the orbit) and the expected reduced accuracy for predicting collisions at GOCE’s very low altitude. The collision avoidance procedure (see NOM_SYS_200 in the FOP [RD-1]) was trained with all teams (FCT, FD, SDO) involved, however there was no need to ever use it, as no collision warning was received.

Support for the re-entry: GOCE was the first ESA mission to re-enter since 1987. About 40 to 50 fragments with a total mass of around 250 kg were predicted to survive the re-entry and impact ground. As the GOCE re-entry was uncontrolled, support by the SDO for monitoring the re-entry was essential. Discussions on the re-entry started in the first half of 2012, when preparing the low orbit operations campaign and the eventual end-of-life operations. It was decided that the re-entry was to be monitored not only by the ESOC Space Debris Office, but also by members of the Inter- Agency Space Debris Coordination Committee (IADC) in the frame of an international IADC re- entry campaign. Soon after fuel was depleted and the orbital decay started on 21/10/2013, the IADC campaign was kicked off. The SDO re-entry campaign was started as well, taking Radar tracking passes of GOCE using the TIRA radar station in Bonn, Germany. A unique feature of the campaign was that the S/C remained functional almost until the final re- entry, with the last ground contact taken about 1.5 before re-entry into the atmosphere. This allowed to provide precise orbit data from Flight Dynamics to the SDO almost until the very end. Regular coordination meetings were held during the de-orbiting phase, in particular discussing the assumptions on the future S/C behaviour (e.g. concerning the assumed stop of attitude control with a consequent much faster decay of the S/C). Eventually, GOCE re-entered on 11/11/2013 00:16 UTC close to the Falkland Islands (see Figure 14). See Figure 101 for the final SDO re-entry prediction.

Page 140/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Figure 101: Final GOCE re-entry prediction of the ESOC Space Debris Office.

Page 141/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

ANNEXES

A.1 List of GOCE Spacecraft Anomaly Reports The below list contains all spacecraft anomaly reports raised from 2009 to 2013. The full reports can be found in ARTS [RD-7]. ID Title GOC_SC-1 OBCP 5451 doesn't enable S12 monitoring ID 1038 GOC_SC-2 Surveillance L1-4 gets enabled even though RU-B is in use GOC_SC-3 Heater Group B1 LCL Tripped OPEN during Launch GOC_SC-4 SSTI-A: Excessive time to reach Measurement Mode GOC_SC-5 SSTI: NKF Range Residuals Above Threshold Events (EID=66) GOC_SC-6 CESS head 6 thermistor CESS+Y/-Z_M2 failed GOC_SC-7 Transition Cyclic Counter not allowing G3 triggering GOC_SC-8 Jumps in DSS-STR sun direction angles misalignment GOC_SC-9 SSTI: Sudden drops in number of SVs used in NKF solution GOC_SC-10 GCDE: L10-4 Triggering at GCA switch on via DFACS GOC_SC-11 STR: STR_n_FINETUNE parameter toggling to BOTH GOC_SC-12 Received UART_TM_Invalid event GOC_SC-13 Non-nominal S/C attitude error around Z-axis in FPM GOC_SC-14 All MTR OFF when reconfiguring MTR_FCN to Nominal side GOC_SC-15 IPCU-A generating beam events during commissioning in ECPM GOC_SC-16 IPCU-A error events generated during commissioning in ECPM GOC_SC-17 CESS readings show spikes after survival mode entry GOC_SC-18 IPCU-B: shutdown and switch off caused by LPT monitoring GOC_SC-19 Surveillance F2 (DSS consistency) trigger during eclipse GOC_SC-20 DFACS controller anomaly in transition CPM to ECPM GOC_SC-21 Global disabling of FDIR not possible in Cold 1 GOC_SC-22 Angular Rate Computation algorithm not working properly in CPM and ECPM GOC_SC-23 FDIR L5_5 causing STR2 switch off during moon blinding GOC_SC-24 Data corruption in the Selective Dump GOC_SC-25 Loss of attitude control during K2 calibration in DFM_FINE GOC_SC-26 Event 779 Mass_Memory_SGM_Context_Corrupted during PASW bootup GOC_SC-27 K2 Proof Mass shaking: command rejection by EGG GOC_SC-28 Electrode Reconfiguration on ASH3 and ASH4 at transition from DFM-COARSE to DFM-FINE GOC_SC-29 Attitude observer in ECPM, FPM not initialized at mode entry GOC_SC-30 Reverse chronological order of super-commutated parameters in the TCEU and GAE Diagnostic packets GOC_SC-31 Event 801 Timed_TC_Overdue received GOC_SC-32 STR-1 switch off by DFACS during moon blinding GOC_SC-33 TCEU reconfiguration due to line 9 high temperature GOC_SC-34 Continuous Single Bit EDAC Error generated GOC_SC-35 Frequent generation of MIL_Bus_IPCU_Vector_Word_Not_Ready events GOC_SC-36 Thermal line 32 reconfigured with Nominal settings GOC_SC-37 IPCU monitoring 30410 trigger due to TCS line 15 setting in CAL mode

Page 142/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

GOC_SC-38 Irregularities in packet generation time of EGG science packets GOC_SC-39 Fallback from DFM_FINE to FPM due to L9-13 trigger GOC_SC-40 Excessive generation of event 26 IPCU_A Clock Status GOC_SC-41 Transition FPM to DFM_PREP fails (TTTCs do not reach IPA) GOC_SC-42 Corruption of playback telemetry VC-2 and VC-3 GOC_SC-43 TMM FDIR triggering leading to excessive number of TMM power cycles GOC_SC-44 Corruption in last frames of playback telemetry GOC_SC-45 STRs providing frequent unexpected invalid attitude measurements GOC_SC-46 Safe mode no. 3: switchover to CDMU-B GOC_SC-47 STR selection affecting the DFM_PREP exit dynamics conditions GOC_SC-48 GAIEU A Reset GOC_SC-49 Flags FDIR-ENABLE and AUTO-FPM-ENTRY not modifiable in Cold 2 GOC_SC-50 TMM FDIR triggering during execution of OBCP 5451 GOC_SC-51 Corruption in the VC0 packets GOC_SC-52 Inadequate definition of IPA monitoring 30316 on beam trip count GOC_SC-53 Fallback to Fine Pointing Mode (FPM) due to Ion Thruster Control Unit (IPCU) software problem GOC_SC-54 Surveillance L7-10 trigger in transition to DFM_FINE GOC_SC-55 Both TCEUs ON after ground-commanded switch back to TCEU-A GOC_SC-56 Telemetry generated by Platform Application Software (PASW) not received anymore GOC_SC-57 Transponders FDIR not in line with routine operation GOC_SC-58 SSTI state vector anomaly GOC_SC-59 Reception of SSTI-A AGC failure events GOC_SC-60 EGG electrode saturation and reconfiguration at transition from Standby to Acquisition GOC_SC-61 GAIEU-A Reset 2011-02-08 (DoY 039) GOC_SC-62 Spurious EGG Validation-Failed Event GOC_SC-63 GAIEU-A Reset 2011-09-23 (DoY 266) GOC_SC-64 All STRs providing invalid attitude measurements. GOC_SC-65 STR-3 sudden reboot GOC_SC-66 Safe Mode no.4 - Sudden unexpected PASW reboot GOC_SC-67 Failure of solar panel thermistors GOC_SC-68 Incorrect information reported in Mass Memory HK GOC_SC-69 Surveillance L5-1 trigger on STR-2 GOC_SC-70 G1-triggered safe mode due to EGG anomaly GOC_SC-71 Spike in S/C linear acceleration GOC_SC-72 Problems with initialisation of surveillance G2 thresholds GOC_SC-73 EGG anomaly and controller divergence in DFM_COARSE

Page 143/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

A.2 List of GOCE-related publications A series of publications on GOCE mission operations have been produced over the years. All publications are listed here below in chronological order: Steiger, C., Piñeiro, J., Emanuelli, P.P., “Operating GOCE, the European Space Agency’s Low-flying Gravity Mission”, SpaceOps 2010, Huntsville, USA. Steiger, C., Lautenschläger, G., Weigl, A., Eilenberger, R., Väisänen, P., Maestroni, E., Da Costa, A., Emanuelli, P.P., “On-board Software Maintenance for GOCE, ESA’s Gravity Mission”, Data Systems in Aerospace (DASIA), ESA SP-682, Budapest, Hungary, 2010. Steiger, C., Floberghagen, R., Fehringer, M., Piñeiro, J., Emanuelli, P.P., “Flight Operations for GOCE, ESA’s Gravity Mission”, ESA Living Planet Symposium, Bergen, Norway, 2010. Steiger, C., Da Costa, A., Floberghagen, R., Fehringer, M., Emanuelli, P.P., “Weathering the Storm – GOCE Flight Operations in 2010”, 4th International GOCE User Workshop, ESA SP-696, Munich, Germany, 2011. Da Costa, A., Steiger, C., Weigl, A., Rubel, W., Eilenberger, R., Lautenschläger, G., Väisänen, P., Maestroni, E., Emanuelli, P.P., “Adaptive On-board Software Maintenance: the GOCE Mission Recovery cases”, Data Systems in Aerospace (DASIA), ESA SP-694, Malta, 2011. Romanazzo, M., Steiger, C., Sechi, G., Saponara, M., Rezazad, M., Piris Niño, A., Da Costa, A., Fehringer, M., Floberghagen, R., André, G., Emanuelli, P.P., “In-orbit Experience with the Drag-Free Attitude and Orbit Control system of ESA’s Gravity Mission GOCE”, 8th International ESA Conference on Guidance, Navigation & Control Systems, Karlovy Vary, Czech Republic, 2011. Steiger, C., Da Costa, A., Emanuelli, P.P., Floberghagen, R., Fehringer, M. “Evolution of Flight Operations for ESA’s Gravity Mission GOCE”, SpaceOps 2012, Stockholm, Sweden. Romanazzo, M., Steiger, C., Emanuelli, P.P., Floberghagen, R., Fehringer, M. “Low Orbit Operations of ESA’s Gravity Mission GOCE”, 5th European Conference for Aeronautics and Space Sciences (EUCASS), Munich, Germany, 2013. Steiger, C., Romanazzo, M., Emanuelli, P.P., Floberghagen, R., Fehringer, M. “Flying at the Edge – Extremely Low Altitude Operations for ESA’s Drag-Free Gravity Mission GOCE”, AIAA Guidance, Navigation, and Control Conference, Boston, USA, 2013. Tran, V.D., Passone, F., Steiger, C., Romanazzo, Emanuelli, P.P., M., Floberghagen, R., Fehringer, “Flying at the Edge – Extremely Low Altitude Operations for ESA’s Drag-Free Gravity Mission GOCE”, ESA Living Planet Symposium, Edinburgh, UK, 2013. Steiger, C., Romanazzo, M., Emanuelli, P.P., Floberghagen, R., Fehringer, M. “The Deorbiting of ESA’s Gravity Mission GOCE – Spacecraft Operations in Extreme Drag Conditions”, SpaceOps 2014, Pasadena, USA [to be published]. Ghisi, C.E., Steiger, C., Romanazzo, M., Emanuelli, P.P. “Drag-Free Attitude and Orbit Control System Performance of ESA’s GOCE Mission during Low Orbit Operations and De-orbiting”, SpaceOps 2014, Pasadena, USA [to be published].

Page 144/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

A.3 Mission Calendar This annex contains an overview of the main spacecraft operations activities performed each day. Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1 17/03/09 76 1 6 LEOP operations pt. 1 2 18/03/09 77 7 22 LEOP operations pt. 2 3 19/03/09 78 23 38 LEOP operations pt. 3 4 20/03/09 79 39 54 - LEOP operations pt. 4 - SSTI-B commissioning - STR/DSS/CESS calibration data acquisition - Move of operations to the GOCE dedicated control room 5 21/03/09 80 55 70 Routine mission operations 6 22/03/09 81 71 86 Routine mission operations 7 23/03/09 82 87 102 - STR image dump - Preparation of Thermal for GCA commissioning 1/2 8 24/03/09 83 103 118 - Enabling of OBLEN flag in both RMs - Preparation of Thermal for GCA commissioning 2/2 9 25/03/09 84 119 134 - Update of STR and DSS alignments in RAM - GCA first switch ON - Preparation of Thermal for IPA commissioning 10 26/03/09 85 135 150 - SSTI-A interchannel bias cal data acquisition - GCA commissioning firing in FPM - Enabling of CESS and DSS diagnostics TM packets for 3 orbits for processing by the CMF 11 27/03/09 86 151 166 - SSTI-B switch off - STR and DSS new alignments stored in EEPROM - Surveillance L2 new threshold stored in EEPROM - Configuration of Thermal after GCA commissioning 12 28/03/09 87 167 182 Routine mission operations 13 29/03/09 88 183 198 Routine mission operations 14 30/03/09 89 199 214 Ion propulsion commissioning day 1 (IPA-B preparation for thrusting) 15 31/03/09 90 215 230 Ion propulsion commissioning day 2 (IPA-B thrusting in DFM_PREP) 16 01/04/09 91 231 246 - Ion propulsion commissioning day 3 (IPA-A preparation for thrusting) - Safe Mode #1 caused by excessive S/C attitude errors, ensuing safe mode recovery 17 02/04/09 92 247 262 - Ion propulsion commissioning day 4 (IPA-A preparation for thrusting, thrusting in ECPM) 18 03/04/09 93 263 278 - Ion propulsion commissioning day 5 (IPA-A and IPA-B thrust ramps in ECPM) - First Gradiometer switch ON to Standby Mode 19 04/04/09 94 279 293 Monitoring of Gradiometer thermal stabilization after first switch ON 20 05/04/09 95 294 309 - Monitoring of Gradiometer thermal stabilization after first switch ON - Gradiometer power cycle to avoid TCEU reconfiguration

Page 145/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 21 06/04/09 96 310 325 - Gradiometer to Acquisition Mode - Star Tracker patch for GOC_SC-11 on STR-2 - Battery End of Charge setting put to Level 7 22 07/04/09 97 326 341 - Gradiometer to Science Mode - OBCP 5451 patch installation in RAM & EEPROM - STR patch for GOC_SC-11 on STR-1 and STR-3 23 08/04/09 98 342 357 - GCA pressure check - Thermal configuration after IPA commissioning 24 09/04/09 99 358 373 - Gradiometer TCEU parameters update - Gradiometer switch off 25 10/04/09 100 374 389 Routine mission operations 26 11/04/09 101 390 405 Routine mission operations 27 12/04/09 102 406 421 Routine mission operations 28 13/04/09 103 422 437 Routine mission operations 29 14/04/09 104 438 453 Routine mission operations 30 15/04/09 105 454 469 - Gradiometer switch on to Standby Mode and transition to Acquisition Mode - Gradiometer TCEU parameters update - STR-2 and STR-3 dump of uncompressed images 31 16/04/09 106 470 485 - Gradiometer to Science Mode - STR-1 dump of uncompressed image - Eclipse table uplink (start of long eclipse season) 32 17/04/09 107 486 501 - Gradiometer: report of K2 parameters and shaking profiles in preparation for upcoming K2 calibration - Eclipse table re-uplink - Thermal configuration after GCA pressure check 33 18/04/09 108 502 517 Occurrence of the following on-board anomalies: - DSS consistency surveillance F2 triggering during eclipse (false FDIR trigger) - DFACS controller problems in transition CPM to ECPM as part of F2 trigger recovery (caused by software problem) - SSTI-A timeout surveillance L6-5 trigger in mode transition CPM to ECPM 34 19/04/09 109 518 533 Continued recovery from Saturday’s problems 35 20/04/09 110 534 549 Routine mission operations 36 21/04/09 111 550 565 - New filter setting for surveillance F2 stored in Safeguard Memory - Gradiometer switch on to Standby mode 37 22/04/09 112 566 581 - Uplink of New gains for Fine Pointing Mode (FPM) - Surveillance F1 filter set to 902.5 sec in RAM 38 23/04/09 113 582 597 - Transition from ECPM to FPM - New filter setting for surveillance F1 stored in Safeguard Memory - Gradiometer switch off and ensuing switch on via the DFACS, followed by transition to Acquisition mode via the DFACS

Page 146/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 39 24/04/09 114 598 613 - Gradiometer mode transition to Science Mode - POST_LEOP flag set to FALSE in Safeguard Memory - Eclipse table uplink 40 25/04/09 115 614 629 Routine mission operations 41 26/04/09 116 630 645 Routine mission operations 42 27/04/09 117 646 661 - Gradiometer: K2 calibration pt. 1 - Thermal configuration for GCA checkout 43 28/04/09 118 662 677 - Gradiometer: K2 calibration pt. 2 - GCA checkout and venting pt. 1 44 29/04/09 119 678 693 - Gradiometer: K2 calibration pt. 3 - GCA checkout and venting pt. 2 45 30/04/09 120 694 709 - Gradiometer: dump of servo loop data - GCA checkout and venting pt. 3 - CESS calibration: uplink of new parameters to RAM, data acquisition for ground assessment 46 01/05/09 121 710 725 Routine mission operations 47 02/05/09 122 726 741 Routine mission operations 48 03/05/09 123 742 757 Star tracker 2 recovery by ground following surveillance L5-5 trigger 49 04/05/09 124 758 773 - Gradiometer DFACS scale vector update pt. 1 50 05/05/09 125 774 789 - Update of gains for DFACS modes DFM_PREP and DFM_COARSE in RAM - Storage of new FPM gains in Safeguard memory - Ion propulsion maintenance activities prior to using the IPA in the DFACS control loop - IPA minimum thrust level set to 0.6 mN in RAM - Thermal configuration for using the IPA - Gradiometer mode transition to Acquisition mode - Gradiometer DFACS scale vector update pt. 2 - STRs recovery from surveillance L5-5 trigger (GOC_SC-23) 51 06/05/09 126 790 805 - Transition from FPM to DFM_PREP - Test with IPA thrust at minimum level of 0.6 mN - Surveillance L5-5 filter update on STR-1 (GOC_SC-23) 52 07/05/09 127 806 821 - Transition from DFM_PREP to DFM_COARSE - Adjustment of acceleration bias in DFM_COARSE - Surveillance L5-5 filter update for all STRs (GOC_SC-23) 53 08/05/09 128 822 837 - Adjustment of acceleration bias in DFM_COARSE - AUTO_FPMENTRY set to TRUE in RAM and Safeguard memory - CESS calibration: storage of new parameters in Safeguard memory - Execution of GCA commissioning firing pattern - Gradiometer: dump of servo loop data - Thermal update of IPA-A-related lines (TEmin) 54 09/05/09 129 838 853 Routine mission operations 55 10/05/09 130 854 869 Routine mission operations

Page 147/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 56 11/05/09 131 870 885 Transition from DFM_COARSE to DFM_FINE 57 12/05/09 132 886 901 - Start of K2 calibration in DFM_FINE - Safe Mode #2 (loss of attitude control during K2 calibration), ensuing safe mode recovery 58 13/05/09 133 902 917 - Recovery from Safe Mode #2 (continued) - SSTI-B swapped into control loop after reoccurrence of anomaly GOC_SC-4 on SSTI-A - Gradiometer switch ON to Standby Mode 59 14/05/09 134 918 933 - Gradiometer transition to Acquisition mode - Update of miscellaneous DFACS settings (surveillances F1 and F2 filter in RAM, new IPA minimum thrust level in Safeguard memory, new surveillance L5-5 filter in Safeguard memory) - Storage of new gains for DFM_PREP and DFM_COARSE in Safeguard memory pt. 1/2 - Recovery from VPS-2 SGM context corruption (GOC_SC-26) 60 15/05/09 135 934 949 - Gradiometer transition to Science mode - Gradiometer TCEU test for disturbance on DFACS channel - Storage of new gains for DFM_PREP and DFM_COARSE in Safeguard memory pt. 2/2 - SSTI-A back into control loop, SSTI-B switch off 61 16/05/09 136 950 965 Routine mission operations 62 17/05/09 137 966 981 Routine mission operations 63 18/05/09 138 982 997 - Gradiometer K2 calibration run - Thermal control line 32 recovery to Nominal 64 19/05/09 139 998 1013 - Monthly star tracker image dump - Gradiometer test for disturbance on DFACS channel (TCEU power off for 10 min) 65 20/05/09 140 1014 1029 - Gradiometer K2 calibration run - Thermal control line 32 update of TEmin setting 66 21/05/09 141 1030 1045 Routine mission operations 67 22/05/09 142 1046 1061 Routine mission operations 68 23/05/09 143 1062 1077 Routine mission operations 69 24/05/09 144 1078 1093 Routine mission operations 70 25/05/09 145 1094 1109 - Gradiometer K2 calibration run - Reload of gradiometer TCEU configuration table 71 26/05/09 146 1110 1125 - Gradiometer test for disturbance on DFACS channel (disabling of individual TCEU lines) - Transition from FPM to DFM_PREP - Transition from DFM_PREP to DFM_COARSE - Tuning of acceleration bias in DFM_COARSE - Disabling of generation of IPCU-A error events (GOC_SC-16) - Thermal control line 41 update of TEmin temperature setting

Page 148/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 72 27/05/09 147 1126 1141 - Enabling of EGG bias compensation algorithm - Transition from DFM_COARSE to DFM_FINE - Gradiometer ASH3 and ASH4 electrode reconfigurations during mode transition to DFM_FINE (GOC_SC-28) 73 28/05/09 148 1142 1157 - Recovery from Gradiometer ASH3 and ASH4 electrode reconfigurations with DFACS in DFM_COARSE - Installation of platform software patches in EEPROM and RAM for anomaly reports GOC_SC-2, -7, -14, -20, -21, -22 - Autonomous entry from CPM to ECPM reenabled following installation of patch for GOC_SC-20 74 29/05/09 149 1158 1173 Routine mission operations 75 30/05/09 150 1174 1189 Routine mission operations 76 31/05/09 151 1190 1205 Routine mission operations 77 01/06/09 152 1206 1221 Routine mission operations 78 02/06/09 153 1222 1237 Routine mission operations 79 03/06/09 154 1238 1253 Routine mission operations 80 04/06/09 155 1254 1269 Routine mission operations 81 05/06/09 156 1270 1285 Routine mission operations 82 06/06/09 157 1286 1301 Routine mission operations 83 07/06/09 158 1302 1317 Routine mission operations 84 08/06/09 159 1318 1333 - Uplink of new K2 factors to Gradiometer - SSTI-B Application SW v3.3 installation pt. 1 85 09/06/09 160 1334 1349 - SSTI-B Application SW v3.3 installation pt. 2 - Installation of PASW RAM patch for EGG bias compensation algorithm correction (GOC_SC-25) in DFM_COARSE - Gradiometer K2 calibration run - Permanent disabling of surveillance L10-4 (GOC_SC-10) 86 10/06/09 161 1350 1365 - Repetition of K2 calibration on ASH-1, DoF-X to investigate unexpected results from the calibration run on DoY 160 87 11/06/09 162 1366 1381 Routine mission operations 88 12/06/09 163 1382 1397 Routine mission operations 89 13/06/09 164 1398 1413 Routine mission operations 90 14/06/09 165 1414 1429 Routine mission operations 91 15/06/09 166 1430 1445 - Uplink of new K2 factors to Gradiometer - Gradiometer K2 calibration run - Thermal configuration for ICM calibration - Uplink of ICM calibration profiles for GCA and IPA to PASW RAM 92 16/06/09 167 1446 1461 - Uplink of new K2 factors to Gradiometer - ICM calibration (shortened run of 4h duration) 93 17/06/09 168 1462 1477 - Gradiometer K2 calibration run 94 18/06/09 169 1478 1493 - Uplink of new K2 factors to Gradiometer - Start of ICM calibration (24h duration)

Page 149/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 95 19/06/09 170 1494 1509 - End of ICM calibration - Thermal configuration after ICM calibration - STR-2 installation of patch for star intensity ratio in flash RAM (GOC_SC-11) 96 20/06/09 171 1510 1525 Routine mission operations 97 21/06/09 172 1526 1541 Routine mission operations 98 22/06/09 173 1542 1557 - Monthly star tracker image dump 99 23/06/09 174 1558 1573 - Mode transition from DFM_FINE back to FPM (resumption of orbit decay) - Gradiometer transition from Acquisition to Science mode - SSTI-B brought into DFACS control loop - SSTI-A Application SW v3.3 installation pt. 1 100 24/06/09 175 1574 1589 - SSTI-A Application SW v3.3 installation pt. 2 101 25/06/09 176 1590 1605 - IPCU-B maintenance activities - Thermal configuration after IPA switch off 102 26/06/09 177 1606 1621 - SSTI-A brought into DFACS control loop - SSTI-B switch off - STR-1 and STR-3 memory dumps in preparation for next week's patch installation (GOC_SC-11) 103 27/06/09 178 1622 1637 Routine mission operations 104 28/06/09 179 1638 1653 Routine mission operations 105 29/06/09 180 1654 1669 - STR-3 installation of patch for star intensity ratio in flash RAM (GOC_SC-11) - IPCU maintenance activities pt. 1 106 30/06/09 181 1670 1685 - STR-1 installation of patch for star intensity ratio in flash RAM (GOC_SC-11) - IPCU maintenance activities pt. 2 107 01/07/09 182 1686 1701 - Gradiometer K2 calibration run (07:40:00 to 19:02:40) 108 02/07/09 183 1702 1717 Routine mission operations 109 03/07/09 184 1718 1733 Routine mission operations 110 04/07/09 185 1734 1749 Routine mission operations 111 05/07/09 186 1750 1765 Routine mission operations 112 06/07/09 187 1766 1781 - Emergency limits of IPA-related lines 9, 17, 34 and 41 lowered. - Thermal Line 9 reconfigured to nominal, switching off redundant LCL. 113 07/07/09 188 1782 1797 - STR1 unexpectedly switched off by DFACS due to moon blinding. GOC_SC-32 created. - Gradiometer K2 calibration run. 114 08/07/09 189 1798 1813 Routine mission operations 115 09/07/09 190 1814 1829 - Gradiometer K2 calibration run. 116 10/07/09 191 1830 1845 - STR-1 made available again to the DFACS in DUUT position 2, since moon blinding period finished. 117 11/07/09 192 1846 1861 Routine mission operations 118 12/07/09 193 1862 1877 Routine mission operations 119 13/07/09 194 1878 1893 Routine mission operations

Page 150/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 120 14/07/09 195 1894 1909 Routine mission operations 121 15/07/09 196 1910 1925 Uplink of new K2 factors to Gradiometer 122 16/07/09 197 1926 1941 Thermal: update of TMTs in RAM as per newly agreed settings 123 17/07/09 198 1942 1957 - Update of STR selection (GSUT) in safeguard memory to [STR-2, STR-1, STR-3] - Update of star tracker failed counter thresholds (related to GOC_SC-32) 124 18/07/09 199 1958 1973 Routine mission operations 125 19/07/09 200 1974 1989 Routine mission operations 126 20/07/09 201 1990 2005 Monthly GCDE pressure check 127 21/07/09 202 2006 2021 Monthly star tracker image dump 128 22/07/09 203 2022 2037 Monthly EGG memory check 129 23/07/09 204 2038 2053 Dump of gradiometer butterworth filter parameters 130 24/07/09 205 2054 2069 Update of star tracker failed counter thresholds in safeguard memory (related to GOC_SC-32) 131 25/07/09 206 2070 2085 Routine mission operations 132 26/07/09 207 2086 2101 Routine mission operations 133 27/07/09 208 2102 2117 Gradiometer test (TCEU off for two orbits from 08:35 to 11:35) 134 28/07/09 209 2118 2133 Routine mission operations 135 29/07/09 210 2134 2149 Uplink of new K2 factors to Gradiometer (at 11:28) 136 30/07/09 211 2150 2165 Routine mission operations 137 31/07/09 212 2166 2181 - Uplink of new K2 factors to Gradiometer (at 08:28) - Update of STR-3 star detection limit from 19 to 20 138 01/08/09 213 2182 2197 Routine mission operations 139 02/08/09 214 2198 2213 Routine mission operations 140 03/08/09 215 2214 2229 Routine mission operations 141 04/08/09 216 2230 2245 Uplink of new K2 factors to Gradiometer (at 06:53) 142 05/08/09 217 2246 2261 Routine mission operations 143 06/08/09 218 2262 2277 Installation of platform software patches in EEPROM for anomaly reports GOC_SC-25, -29 and the new thermal tables 144 07/08/09 219 2278 2293 Routine mission operations 145 08/08/09 220 2294 2309 Routine mission operations 146 09/08/09 221 2310 2325 Routine mission operations 147 10/08/09 222 2326 2341 Test to assess the EGG acceleration bias in Acquisition pt. 1 (as from 11:06 onwards) 148 11/08/09 223 2342 2357 Test to assess the EGG acceleration bias in Acquisition pt. 2 (up to 11:03) 149 12/08/09 224 2358 2373 Routine mission operations 150 13/08/09 225 2374 2389 Routine mission operations 151 14/08/09 226 2390 2405 Routine mission operations 152 15/08/09 227 2406 2422 Routine mission operations 153 16/08/09 228 2423 2438 Routine mission operations 154 17/08/09 229 2439 2454 Started a 48 hour on-board storage of STR-3 Quaternion packets, for STR performance analysis by Industry 155 18/08/09 230 2455 2470 Routine mission operations

Page 151/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 156 19/08/09 231 2471 2486 Routine mission operations 157 20/08/09 232 2487 2502 Gradiometer K2 calibration run for the Less Sensitive Axes on demand from Project. Intended Profile failed load (outside range for LS Axes). Calibration executed with previously loaded vectors 158 21/08/09 233 2503 2518 Routine mission operations 159 22/08/09 234 2519 2534 Routine mission operations 160 23/08/09 235 2535 2550 Routine mission operations 161 24/08/09 236 2551 2566 Monthly star tracker image dump 162 25/08/09 237 2567 2582 - F2 DSS cross check surveillance triggered during eclipse. Recovery performed. - GCA monthly pressure check. 163 26/08/09 238 2583 2598 EGG Detector Offsets changed following RPF input, as part of the measurement noise investigation. 164 27/08/09 239 2599 2614 - TCEU Reconfiguration to the redundant side due to the temperature of line 9 exceeding its high limit threshold. - STR DUUT configured to STR1-STR2-STR3 to avoid having STR-2 in control when the STR-2 Moon blindings start. - New update of the EGG Detector Offsets. 165 28/08/09 240 2615 2630 Restore of nominal EGG Detector Offsets for the weekend. 166 29/08/09 241 2631 2646 Routine mission operations 167 30/08/09 242 2647 2662 Routine mission operations 168 31/08/09 243 2663 2678 - EGG Detector Offsets changed following RPF input, as part of the measurement noise investigation. - STR DUUT configured to STR2-STR1-STR3 169 01/09/09 244 2679 2694 - F2 and F1 FDIRs Limit Counters reset to non- eclipse season values. - Update of the EGG Detector Offsets. 170 02/09/09 245 2695 2710 Update of the EGG Detector Offsets. 171 03/09/09 246 2711 2726 Update of the EGG Detector Offsets. 172 04/09/09 247 2727 2742 TCEU Reconfigured back to the prime side, and update of TCEU Thermal and FDIR parameters 173 05/09/09 248 2743 2758 Routine mission operations 174 06/09/09 249 2759 2774 Update of the detector offsets 175 07/09/09 250 2775 2790 Update of the EGG detector offsets 176 08/09/09 251 2791 2806 Routine mission operations 177 09/09/09 252 2807 2822 Routine mission operations 178 10/09/09 253 2823 2838 - Gradiometer ADC-2 noise test - Preparatory activities for stopping orbit decay: thermal 179 11/09/09 254 2839 2855 - Preparatory activities for stopping orbit decay: IPA 180 12/09/09 255 2855 2871 - Gradiometer ADC-2 noise test (repetition) 181 13/09/09 256 2871 2887 - Transition from FPM to DFM_PREP (at 10:44)

Page 152/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 182 14/09/09 257 2888 2903 - Transition from DFM_PREP to DFM_COARSE (at 04:30) - Transition from DFM_COARSE to DFM_FINE (at 14:10) 183 15/09/09 258 2904 2919 Routine mission operations 184 16/09/09 259 2920 2935 Gradiometer TCEU parameters update 185 17/09/09 260 2936 2951 Routine mission operations 186 18/09/09 261 2952 2967 - Uplink of new K2 factors to Gradiometer (at 05:59) - Gradiometer K2 calibration run - Acceleration bias update to lower orbit 187 19/09/09 262 2968 2983 Routine mission operations 188 20/09/09 263 2984 2999 Routine mission operations 189 21/09/09 264 3000 3015 Monthly star tracker image dump 190 22/09/09 265 3016 3031 Gradiometer K2 calibration run 191 23/09/09 266 3032 3047 - Uplink of new K2 factors to Gradiometer (at 07:08) - Gradiometer K2 calibration run 192 24/09/09 267 3048 3063 - Gradiometer linear/angular coupling test pt. 1 - Thermal configuration for ICM calibration pt. 1 - Thermal line 32 reconfiguration (GOC_SC-36) 193 25/09/09 268 3064 3079 - Gradiometer linear/angular coupling test pt. 2 - Thermal configuration for ICM calibration pt. 2 - Acceleration bias update to lower orbit 194 26/09/09 269 3080 3095 Routine mission operations 195 27/09/09 270 3096 3111 Routine mission operations 196 28/09/09 271 3112 3127 - Start of ICM calibration 197 29/09/09 272 3128 3143 - End of ICM calibration - Monthly GCDE pressure check - Thermal configuration after ICM calibration - EDAC handler patch in RAM (GOC_SC-34) 198 30/09/09 273 3144 3159 - Thermal updates to increase Xenon piping temperatures (GOC_SC-36) 199 01/10/09 274 3160 3175 EDAC handler patch in EEPROM (GOC_SC-34) 200 02/10/09 275 3176 3192 Start of EGG linear/angular coupling test on all axes 201 03/10/09 276 3193 3208 Routine mission operations 202 04/10/09 277 3209 3224 Routine mission operations 203 05/10/09 278 3225 3240 Routine mission operations 204 06/10/09 279 3241 3256 Routine mission operations 205 07/10/09 280 3257 3272 Thermal configuration for ICM calibration 206 08/10/09 281 3273 3288 Start of ICM calibration 207 09/10/09 282 3289 3304 - End of ICM calibration - Thermal configuration after ICM calibration 208 10/10/09 283 3305 3320 Routine mission operations 209 11/10/09 284 3321 3336 Routine mission operations 210 12/10/09 285 3337 3352 Routine mission operations 211 13/10/09 286 3353 3368 Tuning of surveillance F2 filter setting (GOC_SC-19) 212 14/10/09 287 3369 3384 Routine mission operations 213 15/10/09 288 3385 3400 Routine mission operations 214 16/10/09 289 3401 3416 Fallback to FPM (GOC_SC-39)

Page 153/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 215 17/10/09 290 3417 3432 - Excessive generation of IPCU-A event 26 (GOC_SC-40) - Failed attempt to go from FPM to DFM_PREP (GOC_SC-41) 216 18/10/09 291 3433 3448 - Second failed attempt to go from FPM to DFM_PREP - Corruption of mass memory playback data (GOC_SC-42) 217 19/10/09 292 3449 3464 - Playback data corruption investigation (GOC_SC- 42) 218 20/10/09 293 3465 3480 - Playback data corruption investigation (GOC_SC- 42) - Patch of IPA sync_status word in PASW RAM (GOC_SC-41) 219 21/10/09 294 3481 3496 - Playback data corruption investigation (GOC_SC- 42) - Transition from FPM to DFM_PREP 220 22/10/09 295 3497 3513 - Playback data corruption investigation (GOC_SC- 42) - IPA thrust increased from 1.76mN to 5.76mN 221 23/10/09 296 3514 3529 - Installation of PASW RAM patch to recover from playback data corruption (GOC_SC-42) 222 24/10/09 297 3530 3545 - IPA thrust decreased from 5.76mN to 1.76mN 223 25/10/09 298 3546 3561 Routine mission operations 224 26/10/09 299 3562 3577 - Transition from DFM_PREP to DFM_COARSE (at 09:08) - Transition from DFM_COARSE to DFM_FINE (at 15:00) 225 27/10/09 300 3578 3593 - Monthly maintenance activities (STR image dump, GCDE pressure check, EGG ground reference CRCs) - Start of orbit raise with +1mN bias (at 11:58) 226 28/10/09 301 3594 3609 Excessive power cycling of TMM due to false FDIR trigger (GOC_SC-43) 227 29/10/09 302 3610 3625 End of orbit raise with +1mN bias (at 23:00) 228 30/10/09 303 3626 3641 Routine mission operations 229 31/10/09 304 3642 3657 Routine mission operations 230 01/11/09 305 3658 3673 Routine mission operations 231 02/11/09 306 3674 3689 Routine mission operations 232 03/11/09 307 3690 3705 Routine mission operations 233 04/11/09 308 3706 3721 Routine mission operations 234 05/11/09 309 3722 3737 Routine mission operations 235 06/11/09 310 3738 3753 Installation of PASW patch to correct idle packet corruption (GOC_SC-44) 236 07/11/09 311 3754 3769 Routine mission operations 237 08/11/09 312 3770 3785 Routine mission operations 238 09/11/09 313 3786 3801 Routine mission operations 239 10/11/09 314 3802 3817 Routine mission operations 240 11/11/09 315 3818 3833 Routine mission operations

Page 154/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 241 12/11/09 316 3834 3850 Routine mission operations 242 13/11/09 317 3851 3866 Routine mission operations 243 14/11/09 318 3867 3882 Routine mission operations 244 15/11/09 319 3883 3898 Routine mission operations 245 16/11/09 320 3899 3914 Routine mission operations 246 17/11/09 321 3915 3930 Update of TCS settings for IPA-related line 47 pt. 1 247 18/11/09 322 3931 3946 Routine mission operations 248 19/11/09 323 3947 3962 Monthly maintenance activities (STR image dump, GCDE pressure check) 249 20/11/09 324 3963 3978 - Update of TCS settings for IPA-related line 47 pt. 2 - Monthly EGG CRC check 250 21/11/09 325 3979 3994 Routine mission operations 251 22/11/09 326 3995 4010 Routine mission operations 252 23/11/09 327 4011 4026 Routine mission operations 253 24/11/09 328 4027 4042 Routine mission operations 254 25/11/09 329 4043 4058 Routine mission operations 255 26/11/09 330 4059 4074 Routine mission operations 256 27/11/09 331 4075 4090 Routine mission operations 257 28/11/09 332 4091 4106 Routine mission operations 258 29/11/09 333 4107 4122 Reoccurrence of mass memory playback data corruption anomaly (GOC_SC-42) 259 30/11/09 334 4123 4138 Recovery from playback data corruption anomaly (GOC_SC-42) 260 01/12/09 335 4139 4154 Routine mission operations 261 02/12/09 336 4155 4171 Routine mission operations 262 03/12/09 337 4172 4187 Routine mission operations 263 04/12/09 338 4188 4203 Routine mission operations 264 05/12/09 339 4204 4219 Routine mission operations 265 06/12/09 340 4220 4235 Routine mission operations 266 07/12/09 341 4236 4251 Routine mission operations 267 08/12/09 342 4252 4267 Routine mission operations 268 09/12/09 343 4268 4283 Routine mission operations 269 10/12/09 344 4284 4299 Routine mission operations 270 11/12/09 345 4300 4315 Routine mission operations 271 12/12/09 346 4316 4331 Routine mission operations 272 13/12/09 347 4332 4347 Routine mission operations 273 14/12/09 348 4348 4363 Routine mission operations 274 15/12/09 349 4364 4379 Routine mission operations 275 16/12/09 350 4380 4395 Routine mission operations 276 17/12/09 351 4396 4411 Monthly maintenance activities (STR image dump, GCDE pressure check, EGG CRC check) 277 18/12/09 352 4412 4427 Routine mission operations 278 19/12/09 353 4428 4443 Routine mission operations 279 20/12/09 354 4444 4459 Start of orbit raise by 25m (at 18:00) 280 21/12/09 355 4460 4475 End of orbit raise by 25m (at 18:00) 281 22/12/09 356 4476 4491 Routine mission operations 282 23/12/09 357 4492 4508 Routine mission operations 283 24/12/09 358 4509 4524 Routine mission operations

Page 155/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 284 25/12/09 359 4525 4540 Routine mission operations 285 26/12/09 360 4541 4556 Routine mission operations 286 27/12/09 361 4557 4572 Routine mission operations 287 28/12/09 362 4573 4588 Routine mission operations 288 29/12/09 363 4589 4604 Routine mission operations 289 30/12/09 364 4605 4620 Routine mission operations 290 31/12/09 365 4621 4636 Routine mission operations 291 01/01/10 1 4637 4652 Routine mission operations 292 02/01/10 2 4653 4668 Routine mission operations 293 03/01/10 3 4669 4684 Routine mission operations 294 04/01/10 4 4685 4700 Routine mission operations 295 05/01/10 5 4701 4716 Routine mission operations 296 06/01/10 6 4717 4732 Routine mission operations 297 07/01/10 7 4733 4748 Routine mission operations 298 08/01/10 8 4749 4764 - Thermal configuration for ICM calibration - Uplink of ICM calibration timeline - Uplink of dummy eclipse table 299 09/01/10 9 4765 4780 Routine mission operations 300 10/01/10 10 4781 4796 Routine mission operations 301 11/01/10 11 4797 4812 - Start of ICM calibration 302 12/01/10 12 4813 4828 - End of ICM calibration - Thermal configuration after ICM calibration - Installation of new mission control system software on MCS A-chain 303 13/01/10 13 4829 4845 Roll back to previous MCS software version 304 14/01/10 14 4846 4861 Uplink of timeline for lowering orbit by 7m (DoY 018) 305 15/01/10 15 4862 4877 Routine mission operations 306 16/01/10 16 4878 4893 Routine mission operations 307 17/01/10 17 4894 4909 Routine mission operations 308 18/01/10 18 4910 4925 - Lowering of orbit by 7m (from 00:00 to 06:42) - Monthly maintenance activities (EGG CRC check) 309 19/01/10 19 4926 4941 - Monthly maintenance activities (STR image dump, GCDE pressure check) - STR UTC time update 310 20/01/10 20 4942 4957 Routine mission operations 311 21/01/10 21 4958 4973 Routine mission operations 312 22/01/10 22 4974 4989 Routine mission operations 313 23/01/10 23 4990 5005 Routine mission operations 314 24/01/10 24 5006 5021 Routine mission operations 315 25/01/10 25 5022 5037 STR-2 image dumps pt. 1 (related to GOC_SC-45) 316 26/01/10 26 5038 5053 STR-2 image dumps pt. 2 (related to GOC_SC-45) 317 27/01/10 27 5054 5069 Routine mission operations 318 28/01/10 28 5070 5085 Routine mission operations 319 29/01/10 29 5086 5101 Routine mission operations 320 30/01/10 30 5102 5117 Routine mission operations 321 31/01/10 31 5118 5133 Routine mission operations 322 01/02/10 32 5134 5149 Routine mission operations 323 02/02/10 33 5150 5166 Routine mission operations 324 03/02/10 34 5167 5182 Routine mission operations

Page 156/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 325 04/02/10 35 5183 5198 Routine mission operations 326 05/02/10 36 5199 5214 Routine mission operations 327 06/02/10 37 5215 5230 Routine mission operations 328 07/02/10 38 5231 5246 Routine mission operations 329 08/02/10 39 5247 5262 Routine mission operations 330 09/02/10 40 5263 5278 Routine mission operations 331 10/02/10 41 5279 5294 Routine mission operations 332 11/02/10 42 5295 5310 Installation of new MCS software on MCS A-chain 333 12/02/10 43 5311 5326 Safe Mode #3 leading to switchover to CDMU-B and loss of telemetry 334 13/02/10 44 5327 5342 - Recovery of telemetry - S/C checkout and recovery pt. 1 335 14/02/10 45 5343 5358 S/C recovery pt. 2 336 15/02/10 46 5359 5374 - DFACS mode transition to FPM - IPCU-A limited switch ON - Recovery of thermal control system 337 16/02/10 47 5375 5390 - DFACS mode transition to DFM_PREP (at 5.2 mN) - Installation of PASW patches in PASW RAM and in PM-B EEPROM 338 17/02/10 48 5391 5406 IPA thrust level raised to 6.17 mN 339 18/02/10 49 5407 5422 Routine mission operations in DFM_PREP 340 19/02/10 50 5423 5438 Routine mission operations in DFM_PREP 341 20/02/10 51 5439 5454 Routine mission operations in DFM_PREP 342 21/02/10 52 5455 5470 Routine mission operations in DFM_PREP 343 22/02/10 53 5471 5487 IPA thrust level reduced to 2.7 mN after recovery of altitude loss 344 23/02/10 54 5488 5503 Routine mission operations in DFM_PREP 345 24/02/10 55 5504 5519 Routine mission operations in DFM_PREP 346 25/02/10 56 5520 5535 - Unsuccessful attempt to return to CDMU-A - S/C recovery on CDMU-B up to Fine Pointing Mode 347 26/02/10 57 5536 5551 - DFACS mode transition to DFM_PREP (at 1.7 mN) - Installation of PASW patches in RAM - Gradiometer switch on, configuration and transition to Acquisition mode 348 27/02/10 58 5552 5567 IPA thrust level raised to 2.59 mN (at 14:30) 349 28/02/10 59 5568 5583 Routine mission operations 350 01/03/10 60 5584 5599 - Gradiometer configuration pt. 2 351 02/03/10 61 5600 5615 - DFACS mode transition from DFM_PREP to DFM_COARSE - DFACS mode transition from DFM_COARSE to DFM_FINE - Uplink of ICM calibration profiles - Thermal configuration for ICM calibration - SGM flag update to select NOM units in case of cold 1 restart 352 03/03/10 62 5616 5631 - Monthly maintenance activities (EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) - Uplink of ICM calibration timeline

Page 157/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 353 04/03/10 63 5632 5647 - Start of ICM calibration 354 05/03/10 64 5648 5663 - End of ICM calibration - Thermal configuration after ICM calibration 355 06/03/10 65 5664 5679 Routine mission operations 356 07/03/10 66 5680 5695 Start of orbit raise by 175m (at 14:00) 357 08/03/10 67 5696 5711 - End of orbit raise by 175m (at 18:00) - Monthly star tracker image dump 358 09/03/10 68 5712 5727 - Activation of latest patch chain in PM-B EEPROM - Dump and checksums of PM-B EEPROM 359 10/03/10 69 5728 5743 Routine mission operations 360 11/03/10 70 5744 5759 Routine mission operations 361 12/03/10 71 5760 5775 Routine mission operations 362 13/03/10 72 5776 5791 Surveillance L5-4 trigger on STR-3 (at 20:05) 363 14/03/10 73 5792 5807 STR-3 switched ON and brought back into the loop 364 15/03/10 74 5808 5824 Routine mission operations 365 16/03/10 75 5825 5840 Routine mission operations 366 17/03/10 76 5841 5856 - Enabling of TMM FDIR in SGM-B EEPROM - Enabling of automatic transition CPM to ECPM - Enabling of nominal HW DNEL alert input on RM-B 367 18/03/10 77 5857 5872 Routine mission operations 368 19/03/10 78 5873 5888 Routine mission operations 369 20/03/10 79 5889 5904 EGG GAIEU-A Watchdog triggered, unit cold restart OK. DFACS stays on DFM Fine. Configuration after the failure: - EGG working with default values (science affected) - EGG on MILBUS B - GAIEU WD disabled - ASH1 reconfigured due to transient (VZ1 isolated). 370 21/03/10 80 5905 5920 Non-default parameters reloaded to EGG. 371 22/03/10 81 5921 5936 GAIEU-A Watchdog enabled 372 23/03/10 82 5937 5952 Routine mission operations 373 24/03/10 83 5953 5968 EGG ASH-1 electrodes reconfigured to nominal selection: - Transition to DFM_COARSE - Loading of default Combination matrix for ASH1 and update of Detector Health and Saturation thresholds with the EGG in Acquisition Mode - Transition back to DFM_FINE 374 25/03/10 84 5969 5984 Commands for orbit raise on DoY 88 loaded onboard 375 26/03/10 85 5985 6000 SSTI-B powered on for science comparison with SSTI-A 376 27/03/10 86 6001 6016 Routine mission operations 377 28/03/10 87 6017 6032 Routine mission operations 378 29/03/10 88 6033 6048 Raise of orbit by 30m (from 00:00 to 14:30) 379 30/03/10 89 6049 6064 Routine mission operations 380 31/03/10 90 6065 6080 Routine mission operations 381 01/04/10 91 6081 6096 Routine mission operations 382 02/04/10 92 6097 6112 Routine mission operations

Page 158/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 383 03/04/10 93 6113 6128 Routine mission operations 384 04/04/10 94 6129 6145 Start of orbit raise by 16.3 m (at 23:58) 385 05/04/10 95 6146 6161 Stop of orbit raise by 16.3 m (at 15:37) 386 06/04/10 96 6162 6177 Routine mission operations 387 07/04/10 97 6178 6193 Routine mission operations 388 08/04/10 98 6194 6209 Routine mission operations 389 09/04/10 99 6210 6225 SSTI-B switch off 390 10/04/10 100 6226 6241 Routine mission operations 391 11/04/10 101 6242 6257 Routine mission operations 392 12/04/10 102 6258 6273 Routine mission operations 393 13/04/10 103 6274 6289 - Monthly maintenance activities (EGG CRC check, GCDE pressure check, star tracker image dump) - Storage of STR-3 quaternions for 2 orbits 394 14/04/10 104 6290 6305 STR-3 surveillance L5-4 trigger and recovery 395 15/04/10 105 6306 6321 Routine mission operations 396 16/04/10 106 6322 6337 Routine mission operations 397 17/04/10 107 6338 6353 Routine mission operations 398 18/04/10 108 6354 6369 Routine mission operations 399 19/04/10 109 6370 6385 Routine mission operations 400 20/04/10 110 6386 6401 - EGG mil bus recovery - Update of PM-B EEPROM checksums 401 21/04/10 111 6402 6417 Routine mission operations 402 22/04/10 112 6418 6433 Routine mission operations 403 23/04/10 113 6434 6449 Commands for orbit raise on DoY 116 loaded 404 24/04/10 114 6450 6465 Routine mission operations 405 25/04/10 115 6466 6482 Routine mission operations 406 26/04/10 116 6483 6498 Lowering of orbit by 17m (from 00:00 to 14:05) 407 27/04/10 117 6499 6514 Move of GOCE operations to Main Control Room 408 28/04/10 118 6515 6530 Routine mission operations 409 29/04/10 119 6531 6546 Routine mission operations 410 30/04/10 120 6547 6562 Routine mission operations 411 01/05/10 121 6563 6578 Routine mission operations 412 02/05/10 122 6579 6594 Routine mission operations 413 03/05/10 123 6595 6610 Routine mission operations 414 04/05/10 124 6611 6626 Routine mission operations 415 05/05/10 125 6627 6642 - Thermal configuration for ICM calibration 416 06/05/10 126 6643 6658 - Start of ICM calibration 417 07/05/10 127 6659 6674 - End of ICM calibration - Thermal configuration after ICM calibration 418 08/05/10 128 6675 6690 Routine mission operations 419 09/05/10 129 6691 6706 Routine mission operations 420 10/05/10 130 6707 6722 EGG special testing part 1 421 11/05/10 131 6723 6738 EGG special testing part 2 422 12/05/10 132 6739 6754 Routine mission operations 423 13/05/10 133 6755 6770 Routine mission operations 424 14/05/10 134 6771 6786 Routine mission operations 425 15/05/10 135 6787 6802 Routine mission operations 426 16/05/10 136 6803 6819 Routine mission operations

Page 159/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 427 17/05/10 137 6820 6835 Monthly maintenance activities (EGG CRC check, GCDE pressure check, star tracker image dump) 428 18/05/10 138 6836 6851 Routine mission operations 429 19/05/10 139 6852 6867 Routine mission operations 430 20/05/10 140 6868 6883 Commands for orbit raise on DoY 144 loaded 431 21/05/10 141 6884 6899 Routine mission operations 432 22/05/10 142 6900 6915 Routine mission operations 433 23/05/10 143 6916 6931 Routine mission operations 434 24/05/10 144 6932 6947 Orbit raise by 7.5 m (23:58 to 06:11) 435 25/05/10 145 6948 6963 Routine mission operations 436 26/05/10 146 6964 6979 - TMM FDIR trigger (GOC_SC-50) - TMM FDIR re-enabling by ground 437 27/05/10 147 6980 6995 Routine mission operations 438 28/05/10 148 6996 7011 Routine mission operations 439 29/05/10 149 7012 7027 Routine mission operations 440 30/05/10 150 7028 7043 Routine mission operations 441 31/05/10 151 7044 7059 Routine mission operations 442 01/06/10 152 7060 7075 Unexpected STR-1 invalid measurements (at 08:47) 443 02/06/10 153 7076 7091 - Commands for orbit raise on DoY 158 loaded - Unexpected STR-1 invalid measurements (at 08:44) 444 03/06/10 154 7092 7107 Routine mission operations 445 04/06/10 155 7108 7123 Routine mission operations 446 05/06/10 156 7124 7140 Routine mission operations 447 06/06/10 157 7141 7156 Routine mission operations 448 07/06/10 158 7157 7172 Orbit raise by 9 m (23:58 to 07:28) 449 08/06/10 159 7173 7188 Routine mission operations 450 09/06/10 160 7189 7204 Routine mission operations 451 10/06/10 161 7205 7220 Routine mission operations 452 11/06/10 162 7221 7236 Routine mission operations 453 12/06/10 163 7237 7252 Routine mission operations 454 13/06/10 164 7253 7268 TMM FDIR trigger (at 19:06) 455 14/06/10 165 7269 7284 TMM FDIR re-enabling by ground 456 15/06/10 166 7285 7300 Monthly maintenance activities (EGG CRC check, GCDE pressure check, star tracker image dump) 457 16/06/10 167 7301 7316 Disabling of IPA FDIR on beam/grid trips (GOC_SC- 52) 458 17/06/10 168 7317 7332 - Increase of surveillance L9-11 threshold (monitoring on IPA long term beam out) - Commands for orbit raise on DoY 172 loaded 459 18/06/10 169 7333 7348 Routine mission operations 460 19/06/10 170 7349 7364 - TMM FDIR triggerings - TMM FDIR re-enabling (5 autonomous recoveries allowed) 461 20/06/10 171 7365 7380 Routine mission operations 462 21/06/10 172 7381 7396 Lowering of orbit by 15 m (23:58 to 13:58) 463 22/06/10 173 7397 7412 Routine mission operations 464 23/06/10 174 7413 7428 Reset of TMM FDIR recovery counter 465 24/06/10 175 7429 7444 Routine mission operations

Page 160/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 466 25/06/10 176 7445 7460 Routine mission operations 467 26/06/10 177 7461 7477 Routine mission operations 468 27/06/10 178 7478 7493 Routine mission operations 469 28/06/10 179 7494 7509 Routine mission operations 470 29/06/10 180 7510 7525 Routine mission operations 471 30/06/10 181 7526 7541 Fallback to Fine Pointing Mode (GOC_SC-53) 472 01/07/10 182 7542 7557 Preparatory activities for resumption of drag-free mode 473 02/07/10 183 7558 7573 - DFACS mode transitions from FPM to DFM_FINE - Gradiometer reconfiguration during transition from DFM_COARSE to DFM_FINE (GOC_SC-54) - TCEU anomaly after ground-commanded switch back to TCEU-A (GOC_SC-55) 474 03/07/10 184 7574 7589 Routine mission operations 475 04/07/10 185 7590 7605 Routine mission operations 476 05/07/10 186 7606 7621 Gradiometer configuration following switchover pt. 1 477 06/07/10 187 7622 7637 Gradiometer configuration following switchover pt. 2 478 07/07/10 188 7638 7653 Routine mission operations 479 08/07/10 189 7654 7669 Occurrence of TM anomaly (GOC_SC-56) 480 09/07/10 190 7670 7685 - Recovery of HW-generated telemetry (VC-1) - TMM power cycle and switchover - FDIR-triggered reconfiguration to redundant transmitter TX-2 - RF configured for Mode 1, ranging/coherency ON - Mission timeline stopped 481 10/07/10 191 7686 7701 S/C monitoring with HW-generated TM only 482 11/07/10 192 7702 7717 S/C monitoring with HW-generated TM only 483 12/07/10 193 7718 7733 S/C monitoring with HW-generated TM only 484 13/07/10 194 7734 7749 - TMM FDIR trigger test - Start of orbit raise with bias of +1.7mN 485 14/07/10 195 7750 7765 TX expected configuration set to [Mode 1, COH ON, RNG ON] 486 15/07/10 196 7766 7781 S/C monitoring with HW-generated TM only 487 16/07/10 197 7782 7798 S/C monitoring with HW-generated TM only 488 17/07/10 198 7799 7814 S/C monitoring with HW-generated TM only 489 18/07/10 199 7815 7830 S/C monitoring with HW-generated TM only 490 19/07/10 200 7831 7846 S/C monitoring with HW-generated TM only 491 20/07/10 201 7847 7862 TM anomaly testing activities (set TM rate) 492 21/07/10 202 7863 7878 S/C monitoring with HW-generated TM only 493 22/07/10 203 7879 7894 - Unsuccessful attempt to resolve TM anomaly be bringing S/C to survival mode - TM anomaly testing activities 494 23/07/10 204 7895 7910 S/C monitoring with HW-generated TM only 495 24/07/10 205 7911 7926 S/C monitoring with HW-generated TM only 496 25/07/10 206 7927 7942 S/C monitoring with HW-generated TM only 497 26/07/10 207 7943 7958 Processor module PM-A switch ON test 1/2 498 27/07/10 208 7959 7974 Processor module PM-A switch ON test 2/2 499 28/07/10 209 7975 7990 - Preparatory activities for going to DFM_PREP - S/C status check with Service 12/19

Page 161/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 500 29/07/10 210 7991 8006 Transition to DFM_PREP (2mN thrust) 501 30/07/10 211 8007 8022 RM-A power off test 502 31/07/10 212 8023 8038 S/C monitoring with HW-generated TM only 503 01/08/10 213 8039 8054 S/C monitoring with HW-generated TM only 504 02/08/10 214 8055 8070 S/C monitoring with HW-generated TM only 505 03/08/10 215 8071 8086 Start of orbit raise (thrust at 6mN during day time) 506 04/08/10 216 8087 8102 S/C monitoring with HW-generated TM only 507 05/08/10 217 8103 8118 S/C monitoring with HW-generated TM only 508 06/08/10 218 8119 8135 Recovery of MTRC_FCN and SSTI_FCN 509 07/08/10 219 8136 8151 S/C monitoring with HW-generated TM only 510 08/08/10 220 8152 8167 S/C monitoring with HW-generated TM only 511 09/08/10 221 8168 8183 Thermal control system checkout 1/2 512 10/08/10 222 8184 8199 - Thermal control system checkout 2/2 - Recovery to RU-A 513 11/08/10 223 8200 8215 S/C monitoring with HW-generated TM only 514 12/08/10 224 8216 8231 S/C monitoring with HW-generated TM only 515 13/08/10 225 8232 8247 S/C monitoring with HW-generated TM only 516 14/08/10 226 8248 8263 S/C monitoring with HW-generated TM only 517 15/08/10 227 8264 8279 S/C monitoring with HW-generated TM only 518 16/08/10 228 8280 8295 Battery thermal control loops 13&22 checked and nominal 519 17/08/10 229 8296 8311 S/C monitoring with HW-generated TM only 520 18/08/10 230 8312 8327 S/C monitoring with HW-generated TM only 521 19/08/10 231 8328 8343 Move of GOCE operations back to the Dedicated Control Room after refurbishment 522 20/08/10 232 8344 8359 S/C monitoring with HW-generated TM only 523 21/08/10 233 8360 8375 S/C monitoring with HW-generated TM only 524 22/08/10 234 8376 8391 S/C monitoring with HW-generated TM only 525 23/08/10 235 8392 8407 - Installation of patch for SW TM downlink in HPTM - S/C checkout based on SW telemetry 1/4 526 24/08/10 236 8408 8423 S/C checkout based on SW telemetry 2/4 527 25/08/10 237 8424 8439 S/C checkout based on SW telemetry 3/4 528 26/08/10 238 8440 8455 - S/C checkout based on SW telemetry 4/4 - Recovery of thermal control system - Start warm up of floor 7 (CDMU/Battery) 529 27/08/10 239 8456 8471 - Reset of system log - Acquistion of PM-B FCL current samples 1/2 530 28/08/10 240 8472 8487 S/C status monitoring 531 29/08/10 241 8488 8503 - Reset and partial dump of system log - Acquistion of PM-B FCL current samples 2/2 532 30/08/10 242 8504 8519 - Recovery of SW telemetry by enabling TM link following floor 7 (CDMU/Battery) warm up - Mass memory playback TM test (VC2 and VC3) 533 31/08/10 243 8520 8535 - Dump of essential PASW tables (S5/S12/S15/S19, MTL, SPLIF) - Test of TM mode 2 (high rate) - Transmitter TX-2 switch off

Page 162/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 534 01/09/10 244 8536 8551 - Recovery from transmitter switchover (GOC-1277) - Transition to TM mode 2 (high rate) and resumption of routine mass memory playbacks - Transition to FPM to resume orbit decay (at 13:51) - Enabling of SW DNEL S19 recoveries - SSTI-A switch ON - Recovery of MTRF_FCN and EGG_FCN - Uplink of PASW operational values - Enabling of TMM FDIR with 5 recoveries in RAM and SGM-B EEPROM 535 02/09/10 245 8552 8567 - SSTI-A brought into the DFACS loop, SSTI-B switch off - Disabling of IPA FDIR on beam/grid trips (GOC_SC-52) for IPCU-B 536 03/09/10 246 8568 8584 Routine mission operations 537 04/09/10 247 8585 8600 Routine mission operations 538 05/09/10 248 8601 8616 Routine mission operations 539 06/09/10 249 8617 8632 - Monthly maintenance activities 1/2 (STR image dump, GCDE pressure check) - Uplink of dummy eclipse table - Gradiometer switch on and transition to Acquisition - Configuration of gradiometer settings 1/2 540 07/09/10 250 8633 8648 - Configuration of gradiometer settings 2/2 - Monthly maintenance activities 2/2 (EGG CRC check) 541 08/09/10 251 8649 8664 - Anomaly during gradiometer transition to Science (related to GOC_SC-54), followed by transition back to Acquisition and switch off - Service 6 dump of remainder of system log contents from TM loss-anomaly on 22nd July 542 09/09/10 252 8665 8680 - Gradiometer switch on to Standby - Configuration of gradiometer TCEU settings 543 10/09/10 253 8681 8696 - Gradiometer transition to Acquisition - Successful gradiometer transition to Science with default settings (no offsets) - TMM FDIR trigger - Reset of TMM FDIR recovery counter by ground 544 11/09/10 254 8697 8712 Routine mission operations 545 12/09/10 255 8713 8728 Routine mission operations 546 13/09/10 256 8729 8744 Configuration of gradiometer settings 547 14/09/10 257 8745 8760 Routine mission operations 548 15/09/10 258 8761 8776 Routine mission operations 549 16/09/10 259 8777 8792 Routine mission operations 550 17/09/10 260 8793 8808 Routine mission operations 551 18/09/10 261 8809 8824 Routine mission operations 552 19/09/10 262 8825 8840 Routine mission operations 553 20/09/10 263 8841 8856 Routine mission operations 554 21/09/10 264 8857 8872 Update of TCS settings for line 13 in all TMTs 555 22/09/10 265 8873 8888 Routine mission operations

Page 163/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 556 23/09/10 266 8889 8904 - IPCU-A limited switch ON - Removal of Gradiometer K2 offsets and transition to Acquisition - Installation of ICM shaking profiles - Definition of new diagnostic HK packet for use in case of reoccurrence of TM loss-anomaly 557 24/09/10 267 8905 8920 Uplink of timeline for transition to DFM_PREP 558 25/09/10 268 8921 8936 Routine mission operations 559 26/09/10 269 8937 8952 - Transition to DFM_PREP (2.75mN thrust) at 02:35 - Uplink of timeline for transition to DFM_COARSE 560 27/09/10 270 8953 8968 - Transition to DFM_COARSE at 02:30 - Transition to DFM_FINE at 12:35 - Setting of Gradiometer K2 offsets 561 28/09/10 271 8969 8984 Gradiometer K2 calibration run 562 29/09/10 272 8985 9000 Routine mission operations 563 30/09/10 273 9001 9017 Routine mission operations 564 01/10/10 274 9018 9033 Routine mission operations 565 02/10/10 275 9034 9049 Routine mission operations 566 03/10/10 276 9050 9065 Routine mission operations 567 04/10/10 277 9066 9081 - Update of the Gradiometer detector offsets - Thermal configuration for ICM calibration 568 05/10/10 278 9082 9097 - Start of ICM calibration 569 06/10/10 279 9098 9113 - End of ICM calibration - Correction of Gradiometer detector offsets - Gradiometer K2 calibration run - Thermal configuration after ICM calibration 570 07/10/10 280 9114 9129 - Unsuccessful patch for suppression of MM-A corruption events - STR-3 RAM patch to resolve GOC_SC-45 571 08/10/10 281 9130 9145 - Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 572 09/10/10 282 9146 9161 Routine mission operations 573 10/10/10 283 9162 9177 Routine mission operations 574 11/10/10 284 9178 9193 Patch for suppression of MM-A corruption events 575 12/10/10 285 9194 9209 Routine mission operations 576 13/10/10 286 9210 9225 - Gradiometer K2 calibration run - Start of orbit raise with +0.5mN bias (at 12:50) 577 14/10/10 287 9226 9241 Routine mission operations 578 15/10/10 288 9242 9257 End of orbit raise with +0.5mN bias (at 15:10) 579 16/10/10 289 9258 9273 Routine mission operations 580 17/10/10 290 9274 9289 Routine mission operations 581 18/10/10 291 9290 9305 Routine mission operations 582 19/10/10 292 9306 9321 Routine mission operations 583 20/10/10 293 9322 9338 Update of Gradiometer detector offsets 584 21/10/10 294 9339 9354 Modification of diagnostic HK packet SID 40 (for use in case of reoccurrence of TM loss-anomaly) 585 22/10/10 295 9355 9370 Disabling of IPCU-A error events 27 and 31 586 23/10/10 296 9371 9386 Routine mission operations

Page 164/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 587 24/10/10 297 9387 9402 Routine mission operations 588 25/10/10 298 9403 9418 Lowering of orbit by 22m (from 00:00 to 18:20) 589 26/10/10 299 9419 9434 Routine mission operations 590 27/10/10 300 9435 9450 Routine mission operations 591 28/10/10 301 9451 9466 Routine mission operations 592 29/10/10 302 9467 9482 Routine mission operations 593 30/10/10 303 9483 9498 Routine mission operations 594 31/10/10 304 9499 9514 Routine mission operations 595 01/11/10 305 9515 9530 - Raise of orbit by 17m (from 04:17 to 09:43) - STR-1 RAM patch to resolve GOC_SC-45 - TMM FDIR trigger after execution of OBCP 5451 596 02/11/10 306 9531 9546 STR-2 RAM patch to resolve GOC_SC-45 597 03/11/10 307 9547 9562 Routine mission operations 598 04/11/10 308 9563 9578 Routine mission operations 599 05/11/10 309 9579 9594 Routine mission operations 600 06/11/10 310 9595 9610 Routine mission operations 601 07/11/10 311 9611 9626 Routine mission operations 602 08/11/10 312 9627 9642 Routine mission operations 603 09/11/10 313 9643 9658 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check) 604 10/11/10 314 9659 9675 Routine mission operations 605 11/11/10 315 9676 9691 Routine mission operations 606 12/11/10 316 9692 9707 Routine mission operations 607 13/11/10 317 9708 9723 Routine mission operations 608 14/11/10 318 9724 9739 Routine mission operations 609 15/11/10 319 9740 9755 Routine mission operations 610 16/11/10 320 9756 9771 Routine mission operations 611 17/11/10 321 9772 9787 Routine mission operations 612 18/11/10 322 9788 9803 Routine mission operations 613 19/11/10 323 9804 9819 Routine mission operations 614 20/11/10 324 9820 9835 Routine mission operations 615 21/11/10 325 9836 9851 Routine mission operations 616 22/11/10 326 9852 9867 Routine mission operations 617 23/11/10 327 9868 9883 Routine mission operations 618 24/11/10 328 9884 9899 Routine mission operations 619 25/11/10 329 9900 9915 Routine mission operations 620 26/11/10 330 9916 9931 Routine mission operations 621 27/11/10 331 9932 9947 Routine mission operations 622 28/11/10 332 9948 9963 Reconfiguration to TX-2 due to problem in S/C database GODB_074 623 29/11/10 333 9964 9979 Recovery from TX-2 reconfiguration 624 30/11/10 334 9980 9995 TCS line 22 update to raise CDMU temperature 1/2 625 01/12/10 335 9996 10012 Routine mission operations 626 02/12/10 336 10013 10028 Routine mission operations 627 03/12/10 337 10029 10044 TCS line 22 update to raise CDMU temperature 2/2 628 04/12/10 338 10045 10060 Routine mission operations 629 05/12/10 339 10061 10076 Routine mission operations 630 06/12/10 340 10077 10092 Thermal configuration for ICM calibration

Page 165/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 631 07/12/10 341 10093 10108 Start of ICM calibration 632 08/12/10 342 10109 10124 - End of ICM calibration - Thermal configuration after ICM calibration - Tuning of acceleration bias in DFM_FINE 633 09/12/10 343 10125 10140 Routine mission operations 634 10/12/10 344 10141 10156 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check) 635 11/12/10 345 10157 10172 Routine mission operations 636 12/12/10 346 10173 10188 Routine mission operations 637 13/12/10 347 10189 10204 Routine mission operations 638 14/12/10 348 10205 10220 Installation of PASW RAM patch for GOC_SC-50 639 15/12/10 349 10221 10236 Installation of latest PASW patch chain in EEPROM 640 16/12/10 350 10237 10252 Routine mission operations 641 17/12/10 351 10253 10268 Routine mission operations 642 18/12/10 352 10269 10284 TMM FDIR trigger after execution of OBCP 5451 643 19/12/10 353 10285 10300 Routine mission operations 644 20/12/10 354 10301 10316 Routine mission operations 645 21/12/10 355 10317 10333 Routine mission operations 646 22/12/10 356 10334 10349 Tuning of acceleration bias in DFM_FINE 647 23/12/10 357 10350 10365 Routine mission operations 648 24/12/10 358 10366 10381 Routine mission operations 649 25/12/10 359 10382 10397 Routine mission operations 650 26/12/10 360 10398 10413 Routine mission operations 651 27/12/10 361 10414 10429 Routine mission operations 652 28/12/10 362 10430 10445 Routine mission operations 653 29/12/10 363 10446 10461 Routine mission operations 654 30/12/10 364 10462 10477 Routine mission operations 655 31/12/10 365 10478 10493 Routine mission operations 656 01/01/11 1 10494 10509 Routine mission operations 657 02/01/11 2 10510 10525 - SSTI state vector anomaly (GOC_SC-58) - Divergence of attitude control in DFM_FINE - Ground-commanded fallback to CPM 658 03/01/11 3 10526 10541 - Star trackers switch on - SSTI-A power off and SSTI FCN recovery - POST_LEOP flag set to FALSE in SGM EEPROM 659 04/01/11 4 10542 10557 - Transition from CPM to ECPM - Transition from ECPM to FPM - IPCU-A limited switch ON 660 05/01/11 5 10558 10573 - Transition from FPM to DFM_PREP (3.38 mN thrust) - SSTI-B switch ON out of DFACS loop - TMM FDIR trigger after execution of OBCP 5451 661 06/01/11 6 10574 10589 Routine mission operations in DFM_PREP 662 07/01/11 7 10590 10605 Routine mission operations in DFM_PREP 663 08/01/11 8 10606 10621 Routine mission operations in DFM_PREP 664 09/01/11 9 10622 10637 Routine mission operations in DFM_PREP 665 10/01/11 10 10638 10654 Monthly maintenance activities (STR image dump, GCDE pressure check) 666 11/01/11 11 10655 10670 Routine mission operations in DFM_PREP

Page 166/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 667 12/01/11 12 10671 10686 POST_LEOP flag set to FALSE for state Cold 2 668 13/01/11 13 10687 10702 Routine mission operations in DFM_PREP 669 14/01/11 14 10703 10718 Dump of SSTI-B EEPROM 670 15/01/11 15 10719 10734 Routine mission operations in DFM_PREP 671 16/01/11 16 10735 10750 Routine mission operations in DFM_PREP 672 17/01/11 17 10751 10766 - EGG switch ON and configuration, anomaly during EGG mode transition to Acquisition (GOC_SC-60), EGG power cycle - SSTI-B: installation of ASW 4.1 - SSTI-A: switch ON, full EEPROM dump and power OFF following reoccurrence of AGC_failure events (GOC_SC-59) 673 18/01/11 18 10767 10782 - SSTI-A: installation of ASW 4.1 and switch OFF - EGG: configuration of non-permanent settings - SSTI_FCN configured to [NOM=B, RED=B] - SSTI-B put into DFACS control loop 674 19/01/11 19 10783 10798 - Transition to DFM_COARSE at 02:30 - Transition to DFM_FINE at 12:35 - Setting of Gradiometer K2 offsets - SSTI-A switch ON 675 20/01/11 20 10799 10814 - SSTI_FCN configured to [NOM=B, RED=A] - Uplink of dummy eclipse table 676 21/01/11 21 10815 10830 Start of orbit lowering by 115m (at 16:00) 677 22/01/11 22 10831 10846 Routine mission operations 678 23/01/11 23 10847 10862 Routine mission operations 679 24/01/11 24 10863 10878 - POST_LEOP flag set to TRUE in RAM and SGM EEPROM - TCS line 22 update to tune CDMU-B temperature 680 25/01/11 25 10879 10894 Routine mission operations 681 26/01/11 26 10895 10910 - End of orbit lowering by 115m (at 06:24) - Thermal configuration for ICM calibration 682 27/01/11 27 10911 10926 Start of ICM calibration 683 28/01/11 28 10927 10942 - End of ICM calibration - Thermal configuration after ICM calibration 684 29/01/11 29 10943 10958 Routine mission operations 685 30/01/11 30 10959 10974 Routine mission operations 686 31/01/11 31 10975 10991 Routine mission operations 687 01/02/11 32 10992 11007 Routine mission operations 688 02/02/11 33 11008 11023 Routine mission operations 689 03/02/11 34 11024 11039 Routine mission operations 690 04/02/11 35 11040 11055 Routine mission operations 691 05/02/11 36 11056 11071 Routine mission operations 692 06/02/11 37 11072 11087 Routine mission operations 693 07/02/11 38 11088 11103 Start of orbit raise by 12m (at 12:00) 694 08/02/11 39 11104 11119 - End of orbit raise by 12m (at 00:48) - EGG watch dog trigger and FEEU desynchronisation (GOC_SC-61)

Page 167/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 695 09/02/11 40 11120 11135 - Recovery from FEEU desynchronisation by EGG power cycle in drag-free mode - Configuration of non-permanent EGG settings 1/2 696 10/02/11 41 11136 11151 - Configuration of non-permanent EGG settings 2/2 - SSTI-A into DFACS loop and SSTI-B switch off - Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check) 697 11/02/11 42 11152 11167 TMM FDIR trigger after execution of OBCP 5451 698 12/02/11 43 11168 11183 Routine mission operations 699 13/02/11 44 11184 11199 Routine mission operations 700 14/02/11 45 11200 11215 Routine mission operations 701 15/02/11 46 11216 11231 TMM power cycle to recover CRC anomaly (GOC_SC-51) 702 16/02/11 47 11232 11247 Routine mission operations 703 17/02/11 48 11248 11263 Routine mission operations 704 18/02/11 49 11264 11279 Routine mission operations 705 19/02/11 50 11280 11295 Routine mission operations 706 20/02/11 51 11296 11312 Routine mission operations 707 21/02/11 52 11313 11328 - Start of orbit raise by 21m (at 00:00) - TCS line 22 update to tune CDMU-B temperature 708 22/02/11 53 11329 11344 End of orbit raise by 21m (at 02:40) 709 23/02/11 54 11345 11360 Routine mission operations 710 24/02/11 55 11361 11376 Routine mission operations 711 25/02/11 56 11377 11392 Routine mission operations 712 26/02/11 57 11393 11408 Routine mission operations 713 27/02/11 58 11409 11424 Routine mission operations 714 28/02/11 59 11425 11440 Routine mission operations 715 01/03/11 60 11441 11456 Routine mission operations 716 02/03/11 61 11457 11472 Routine mission operations 717 03/03/11 62 11473 11488 Routine mission operations 718 04/03/11 63 11489 11504 Routine mission operations 719 05/03/11 64 11505 11520 Routine mission operations 720 06/03/11 65 11521 11536 Routine mission operations 721 07/03/11 66 11537 11552 Orbit lowering by 12m (from 08:22 to 18:17) 722 08/03/11 67 11553 11568 Routine mission operations 723 09/03/11 68 11569 11584 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check) 724 10/03/11 69 11585 11600 Routine mission operations 725 11/03/11 70 11601 11616 Routine mission operations 726 12/03/11 71 11617 11632 Routine mission operations 727 13/03/11 72 11633 11649 Routine mission operations 728 14/03/11 73 11650 11665 Acceleration bias reset to +0.187×10-06 m/s2 (at 00:00) 729 15/03/11 74 11666 11681 Installation of EGG Acquisition PID settings (GOC_SC-60) 730 16/03/11 75 11682 11697 Routine mission operations 731 17/03/11 76 11698 11713 Routine mission operations 732 18/03/11 77 11714 11729 Installation of new OBCPs 5461 and 5462 733 19/03/11 78 11730 11745 Routine mission operations

Page 168/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 734 20/03/11 79 11746 11761 Routine mission operations 735 21/03/11 80 11762 11777 Orbit lowering by 8m (from 00:00 to 06:37) 736 22/03/11 81 11778 11793 Routine mission operations 737 23/03/11 82 11794 11809 - Disabling of IPCU-A events 27 and 31 in EEPROM - OBCP 5461 test 738 24/03/11 83 11810 11825 Routine mission operations 739 25/03/11 84 11826 11841 Routine mission operations 740 26/03/11 85 11842 11857 Routine mission operations 741 27/03/11 86 11858 11873 Routine mission operations 742 28/03/11 87 11874 11889 Orbit lowering by 8m (from 00:00 to 06:00) 743 29/03/11 88 11890 11905 TMTs updated for Line22 (Tmin:4, Tmax: 9) 744 30/03/11 89 11906 11921 Routine mission operations 745 31/03/11 90 11922 11937 Routine mission operations 746 01/04/11 91 11938 11953 Thermal configuration for ICM calibration 747 02/04/11 92 11954 11970 Routine mission operations 748 03/04/11 93 11971 11986 Routine mission operations 749 04/04/11 94 11987 12002 Start of ICM calibration 750 05/04/11 95 12003 12018 End of ICM calibration Thermal configuration after ICM calibration 751 06/04/11 96 12019 12034 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check) 752 07/04/11 97 12035 12050 Routine mission operations 753 08/04/11 98 12051 12066 Routine mission operations 754 09/04/11 99 12067 12082 Routine mission operations 755 10/04/11 100 12083 12098 Routine mission operations 756 11/04/11 101 12099 12114 Routine mission operations 757 12/04/11 102 12115 12130 Routine mission operations 758 13/04/11 103 12131 12146 Installation of modified OBCP 5441 (GOC_SC-57) 759 14/04/11 104 12147 12162 Routine mission operations 760 15/04/11 105 12163 12178 TCS line 22 update to tune CDMU-B temperature 761 16/04/11 106 12179 12194 Routine mission operations 762 17/04/11 107 12195 12210 Routine mission operations 763 18/04/11 108 12211 12226 Routine mission operations 764 19/04/11 109 12227 12242 Update of TCS line 22 in all TMTs 765 20/04/11 110 12243 12258 Routine mission operations 766 21/04/11 111 12259 12274 Routine mission operations 767 22/04/11 112 12275 12290 Routine mission operations 768 23/04/11 113 12291 12307 Routine mission operations 769 24/04/11 114 12308 12323 Routine mission operations 770 25/04/11 115 12324 12339 Routine mission operations 771 26/04/11 116 12340 12355 Routine mission operations 772 27/04/11 117 12356 12371 Routine mission operations 773 28/04/11 118 12372 12387 Routine mission operations 774 29/04/11 119 12388 12403 Routine mission operations 775 30/04/11 120 12404 12419 Routine mission operations 776 01/05/11 121 12420 12435 Routine mission operations

Page 169/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 777 02/05/11 122 12436 12451 - Orbit lowering by 8m (from 23:58 to 06:13) - Memory dump of complete SGM EEPROM - STR-3: preparatory memory dumps 778 03/05/11 123 12452 12467 - STR-3: GOC_SC-45 patch installed in Flash RAM - STR-1: preparatory memory dumps 779 04/05/11 124 12468 12483 - STR-1: GOC_SC-45 patch installed in Flash RAM - STR-2: preparatory memory dumps 780 05/05/11 125 12484 12499 - STR-2: GOC_SC-45 patch installed in Flash RAM 781 06/05/11 126 12500 12515 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 782 07/05/11 127 12516 12531 Routine mission operations 783 08/05/11 128 12532 12547 Routine mission operations 784 09/05/11 129 12548 12563 Routine mission operations 785 10/05/11 130 12564 12579 Routine mission operations 786 11/05/11 131 12580 12595 Update of surveillance G1 limit counter 787 12/05/11 132 12596 12611 Routine mission operations 788 13/05/11 133 12612 12627 Routine mission operations 789 14/05/11 134 12628 12644 Routine mission operations 790 15/05/11 135 12645 12660 Routine mission operations 791 16/05/11 136 12661 12676 Routine mission operations 792 17/05/11 137 12677 12692 Routine mission operations 793 18/05/11 138 12693 12708 Routine mission operations 794 19/05/11 139 12709 12724 Routine mission operations 795 20/05/11 140 12725 12740 Routine mission operations 796 21/05/11 141 12741 12756 Routine mission operations 797 22/05/11 142 12757 12772 Routine mission operations 798 23/05/11 143 12773 12788 Routine mission operations 799 24/05/11 144 12789 12804 Routine mission operations 800 25/05/11 145 12805 12820 Routine mission operations 801 26/05/11 146 12821 12836 Routine mission operations 802 27/05/11 147 12837 12852 TMM FDIR trigger after execution of OBCP 5451 803 28/05/11 148 12853 12868 Routine mission operations 804 29/05/11 149 12869 12884 Routine mission operations 805 30/05/11 150 12885 12900 TMM FDIR trigger after execution of OBCP 5451 806 31/05/11 151 12901 12916 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check) 807 01/06/11 152 12917 12932 Routine mission operations 808 02/06/11 153 12933 12948 Routine mission operations 809 03/06/11 154 12949 12965 Routine mission operations 810 04/06/11 155 12966 12981 Routine mission operations 811 05/06/11 156 12982 12997 Routine mission operations 812 06/06/11 157 12998 13013 - Orbit lowering by 20m (from 23:58 to 16:18) - Thermal configuration for ICM calibration 813 07/06/11 158 13014 13029 Start of ICM calibration 814 08/06/11 159 13030 13045 End of ICM calibration Thermal configuration after ICM calibration 815 09/06/11 160 13046 13061 Routine mission operations 816 10/06/11 161 13062 13077 Routine mission operations

Page 170/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 817 11/06/11 162 13078 13093 Routine mission operations 818 12/06/11 163 13094 13109 Routine mission operations 819 13/06/11 164 13110 13125 Routine mission operations 820 14/06/11 165 13126 13141 Routine mission operations 821 15/06/11 166 13142 13157 Routine mission operations 822 16/06/11 167 13158 13173 Routine mission operations 823 17/06/11 168 13174 13189 Routine mission operations 824 18/06/11 169 13190 13205 Routine mission operations 825 19/06/11 170 13206 13221 Routine mission operations 826 20/06/11 171 13222 13237 Routine mission operations 827 21/06/11 172 13238 13253 Routine mission operations 828 22/06/11 173 13254 13269 Gradiometer ADC register check disabled (at 13:55) 829 23/06/11 174 13270 13285 Routine mission operations 830 24/06/11 175 13286 13302 Routine mission operations 831 25/06/11 176 13303 13318 Routine mission operations 832 26/06/11 177 13319 13334 Routine mission operations 833 27/06/11 178 13335 13350 - Orbit lowering by 5m (from 23:58 to 04:08) - Gradiometer ADC register check enabled (at 07:41) 834 28/06/11 179 13351 13366 Routine mission operations 835 29/06/11 180 13367 13382 Routine mission operations 836 30/06/11 181 13383 13398 Routine mission operations 837 01/07/11 182 13399 13414 Routine mission operations 838 02/07/11 183 13415 13430 Routine mission operations 839 03/07/11 184 13431 13446 Routine mission operations 840 04/07/11 185 13447 13462 Routine mission operations 841 05/07/11 186 13463 13478 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check) 842 06/07/11 187 13479 13494 Routine mission operations 843 07/07/11 188 13495 13510 Routine mission operations 844 08/07/11 189 13511 13526 Routine mission operations 845 09/07/11 190 13527 13542 Routine mission operations 846 10/07/11 191 13543 13558 Routine mission operations 847 11/07/11 192 13559 13574 Routine mission operations 848 12/07/11 193 13575 13590 Routine mission operations 849 13/07/11 194 13591 13606 Routine mission operations 850 14/07/11 195 13607 13623 Routine mission operations 851 15/07/11 196 13624 13639 Routine mission operations 852 16/07/11 197 13640 13655 TMM FDIR trigger (at 18:10:06) 853 17/07/11 198 13656 13671 Routine mission operations 854 18/07/11 199 13672 13687 Routine mission operations 855 19/07/11 200 13688 13703 Routine mission operations 856 20/07/11 201 13704 13719 Routine mission operations 857 21/07/11 202 13720 13735 Gradiometer ADC register check test (memory dumps) 858 22/07/11 203 13736 13751 Routine mission operations 859 23/07/11 204 13752 13767 Routine mission operations 860 24/07/11 205 13768 13783 Routine mission operations

Page 171/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 861 25/07/11 206 13784 13799 Routine mission operations 862 26/07/11 207 13800 13815 Routine mission operations 863 27/07/11 208 13816 13831 Routine mission operations 864 28/07/11 209 13832 13847 Routine mission operations 865 29/07/11 210 13848 13863 Routine mission operations 866 30/07/11 211 13864 13879 Routine mission operations 867 31/07/11 212 13880 13895 Routine mission operations 868 01/08/11 213 13896 13911 Routine mission operations 869 02/08/11 214 13912 13927 Routine mission operations 870 03/08/11 215 13928 13943 Routine mission operations 871 04/08/11 216 13944 13960 Routine mission operations 872 05/08/11 217 13961 13976 Routine mission operations 873 06/08/11 218 13977 13992 Routine mission operations 874 07/08/11 219 13993 14008 Routine mission operations 875 08/08/11 220 14009 14024 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check) 876 09/08/11 221 14025 14040 Routine mission operations 877 10/08/11 222 14041 14056 Routine mission operations 878 11/08/11 223 14057 14072 Routine mission operations 879 12/08/11 224 14073 14088 Routine mission operations 880 13/08/11 225 14089 14104 Routine mission operations 881 14/08/11 226 14105 14120 Routine mission operations 882 15/08/11 227 14121 14136 Start orbit raising by 137m 883 16/08/11 228 14137 14152 Routine mission operations 884 17/08/11 229 14153 14168 - End orbit raising (17:58z) - Start orbit lowering by 112 meters (17:58z) 885 18/08/11 230 14169 14184 Routine mission operations 886 19/08/11 231 14185 14200 Routine mission operations 887 20/08/11 232 14201 14216 Routine mission operations 888 21/08/11 233 14217 14232 Routine mission operations 889 22/08/11 234 14233 14248 - End of orbit lowering by 112m (05:58z) - Thermal configuration for ICM calibration 890 23/08/11 235 14249 14264 Start of ICM calibration 891 24/08/11 236 14265 14280 - End of ICM calibration - Thermal configuration after ICM calibration 892 25/08/11 237 14281 14297 Spurious EGG Validation_Failed event (06:45:21) 893 26/08/11 238 14298 14313 Routine mission operations 894 27/08/11 239 14314 14329 Routine mission operations 895 28/08/11 240 14330 14345 Routine mission operations 896 29/08/11 241 14346 14361 Orbit lowering by 20m (from 23:58 to 16:48) 897 30/08/11 242 14362 14377 Routine mission operations 898 31/08/11 243 14378 14393 Routine mission operations 899 01/09/11 244 14394 14409 Routine mission operations 900 02/09/11 245 14410 14425 Routine mission operations 901 03/09/11 246 14426 14441 Routine mission operations 902 04/09/11 247 14442 14457 Routine mission operations 903 05/09/11 248 14458 14473 Orbit lowering by 19m (from 23:58 to 15:45) 904 06/09/11 249 14474 14489 Routine mission operations

Page 172/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 905 07/09/11 250 14490 14505 Routine mission operations 906 08/09/11 251 14506 14521 Routine mission operations 907 09/09/11 252 14522 14537 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 908 10/09/11 253 14538 14553 Routine mission operations 909 11/09/11 254 14554 14569 Routine mission operations 910 12/09/11 255 14570 14585 Orbit lowering by 5m (from 23:58 to 04:08) 911 13/09/11 256 14586 14601 TMM FDIR trigger (at 16:43:11) 912 14/09/11 257 14602 14618 TMM FDIR trigger (at 06:21:39) 913 15/09/11 258 14619 14634 Routine mission operations 914 16/09/11 259 14635 14650 Spike in S/C angular accelerations (at 17:21:03) 915 17/09/11 260 14651 14666 Routine mission operations 916 18/09/11 261 14667 14682 Routine mission operations 917 19/09/11 262 14683 14698 Routine mission operations 918 20/09/11 263 14699 14714 Routine mission operations 919 21/09/11 264 14715 14730 Routine mission operations 920 22/09/11 265 14731 14746 Routine mission operations 921 23/09/11 266 14747 14762 EGG watchdog trigger (at 23:52) 922 24/09/11 267 14763 14778 EGG configuration after watchdog trigger pt. 1 923 25/09/11 268 14779 14794 Routine mission operations 924 26/09/11 269 14795 14810 - EGG configuration after watch dog trigger pt. 2 - Orbit lowering by 20m (from 23:58 to 16:35) 925 27/09/11 270 14811 14826 Routine mission operations 926 28/09/11 271 14827 14842 Routine mission operations 927 29/09/11 272 14843 14858 Routine mission operations 928 30/09/11 273 14859 14874 Routine mission operations 929 01/10/11 274 14875 14890 Routine mission operations 930 02/10/11 275 14891 14906 Routine mission operations 931 03/10/11 276 14907 14922 Routine mission operations 932 04/10/11 277 14923 14938 Routine mission operations 933 05/10/11 278 14939 14955 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check) 934 06/10/11 279 14956 14971 Routine mission operations 935 07/10/11 280 14972 14987 Routine mission operations 936 08/10/11 281 14988 15003 Routine mission operations 937 09/10/11 282 15004 15019 Routine mission operations 938 10/10/11 283 15020 15035 Orbit raise by 22m (from 23:58 to 19:15) 939 11/10/11 284 15036 15051 Routine mission operations 940 12/10/11 285 15052 15067 Routine mission operations 941 13/10/11 286 15068 15083 Routine mission operations 942 14/10/11 287 15084 15099 Routine mission operations 943 15/10/11 288 15100 15115 Routine mission operations 944 16/10/11 289 15116 15131 Routine mission operations 945 17/10/11 290 15132 15147 Routine mission operations 946 18/10/11 291 15148 15163 Routine mission operations 947 19/10/11 292 15164 15179 Routine mission operations 948 20/10/11 293 15180 15195 Routine mission operations

Page 173/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 949 21/10/11 294 15196 15211 Routine mission operations 950 22/10/11 295 15212 15227 Routine mission operations 951 23/10/11 296 15228 15243 Routine mission operations 952 24/10/11 297 15244 15259 Thermal configuration for ICM calibration 953 25/10/11 298 15260 15276 Start of ICM calibration 954 26/10/11 299 15277 15292 - End of ICM calibration - Thermal configuration after ICM calibration 955 27/10/11 300 15293 15308 Routine mission operations 956 28/10/11 301 15309 15324 Routine mission operations 957 29/10/11 302 15325 15340 Routine mission operations 958 30/10/11 303 15341 15356 Routine mission operations 959 31/10/11 304 15357 15372 Routine mission operations 960 01/11/11 305 15373 15388 Routine mission operations 961 02/11/11 306 15389 15404 Routine mission operations 962 03/11/11 307 15405 15420 Routine mission operations 963 04/11/11 308 15421 15436 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 964 05/11/11 309 15437 15452 Routine mission operations 965 06/11/11 310 15453 15468 Routine mission operations 966 07/11/11 311 15469 15484 Routine mission operations 967 08/11/11 312 15485 15500 Routine mission operations 968 09/11/11 313 15501 15516 - SSTI-B switch ON - Removal of 10Hz acquisition from MTL - TMM FDIR trigger during execution of OBCP 5451 (GOC_SC-50) - Fallback to Fine Pointing Mode (GOC_SC-53) 969 10/11/11 314 15517 15532 - IPCU-A limited switch ON - Transition from FPM to DFM_PREP (6.5 mN thrust) - Removal of EGG K2 offsets - Stop of eclipse table 970 11/11/11 315 15533 15548 - Transition to DFM_COARSE (at 02:30) - Transition to DFM_FINE (at 08:14) - Start of orbit raise to recover altitude lost (+1mN bias as from 14:05) - Installation of EGG K2 offsets - Reuplink of eclipse table 971 12/11/11 316 15549 15564 Update of acceleration bias for orbit raise 972 13/11/11 317 15565 15580 Routine mission operations 973 14/11/11 318 15581 15596 Routine mission operations 974 15/11/11 319 15597 15613 Stop of orbit raise at +1mN (at 10:30) 975 16/11/11 320 15614 15629 Routine mission operations 976 17/11/11 321 15630 15645 Routine mission operations 977 18/11/11 322 15646 15661 Routine mission operations 978 19/11/11 323 15662 15677 Routine mission operations 979 20/11/11 324 15678 15693 Routine mission operations 980 21/11/11 325 15694 15709 Routine mission operations 981 22/11/11 326 15710 15725 Routine mission operations

Page 174/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 982 23/11/11 327 15726 15741 Routine mission operations 983 24/11/11 328 15742 15757 Routine mission operations 984 25/11/11 329 15758 15773 Routine mission operations 985 26/11/11 330 15774 15789 Routine mission operations 986 27/11/11 331 15790 15805 Start of orbit lowering by 30m (at 23:58) 987 28/11/11 332 15806 15821 Routine mission operations 988 29/11/11 333 15822 15837 End of orbit lowering by 30m (at 02:58) 989 30/11/11 334 15838 15853 Routine mission operations 990 01/12/11 335 15854 15869 Routine mission operations 991 02/12/11 336 15870 15885 TMM FDIR trigger (at 19:55:07) 992 03/12/11 337 15886 15901 Routine mission operations 993 04/12/11 338 15902 15917 Routine mission operations 994 05/12/11 339 15918 15934 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check) 995 06/12/11 340 15935 15950 Routine mission operations 996 07/12/11 341 15951 15966 Routine mission operations 997 08/12/11 342 15967 15982 Routine mission operations 998 09/12/11 343 15983 15998 Routine mission operations 999 10/12/11 344 15999 16014 Routine mission operations 1000 11/12/11 345 16015 16030 Routine mission operations 1001 12/12/11 346 16031 16046 Routine mission operations 1002 13/12/11 347 16047 16062 Routine mission operations 1003 14/12/11 348 16063 16078 Uplink of service 19 entry (GOC_SC-50 workaround) 1004 15/12/11 349 16079 16094 Routine mission operations 1005 16/12/11 350 16095 16110 Routine mission operations 1006 17/12/11 351 16111 16126 TMM FDIR trigger (at 14:20:12) 1007 18/12/11 352 16127 16142 Routine mission operations 1008 19/12/11 353 16143 16158 Orbit lowering by 15m (from 23:58 to 12:58) 1009 20/12/11 354 16159 16174 Routine mission operations 1010 21/12/11 355 16175 16190 Routine mission operations 1011 22/12/11 356 16191 16206 Routine mission operations 1012 23/12/11 357 16207 16222 Routine mission operations 1013 24/12/11 358 16223 16238 Routine mission operations 1014 25/12/11 359 16239 16254 Routine mission operations 1015 26/12/11 360 16255 16271 Routine mission operations 1016 27/12/11 361 16272 16287 Routine mission operations 1017 28/12/11 362 16288 16303 Routine mission operations 1018 29/12/11 363 16304 16319 Routine mission operations 1019 30/12/11 364 16320 16335 Routine mission operations 1020 31/12/11 365 16336 16351 Routine mission operations 1021 01/01/12 1 16352 16367 Routine mission operations 1022 02/01/12 2 16368 16383 Routine mission operations 1023 03/01/12 3 16384 16399 Routine mission operations 1024 04/01/12 4 16400 16415 Routine mission operations 1025 05/01/12 5 16416 16431 Routine mission operations 1026 06/01/12 6 16432 16447 Routine mission operations 1027 07/01/12 7 16448 16463 Routine mission operations 1028 08/01/12 8 16464 16479 Routine mission operations

Page 175/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1029 09/01/12 9 16480 16495 Orbit lowering by 12.5m (from 23:58 to 10:23) 1030 10/01/12 10 16496 16511 Routine mission operations 1031 11/01/12 11 16512 16527 - Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) - Update of STR annual aberration correction 1032 12/01/12 12 16528 16543 Routine mission operations 1033 13/01/12 13 16544 16559 Routine mission operations 1034 14/01/12 14 16560 16575 Routine mission operations 1035 15/01/12 15 16576 16592 Routine mission operations 1036 16/01/12 16 16593 16608 Thermal configuration for ICM calibration 1037 17/01/12 17 16609 16624 Start of ICM calibration 1038 18/01/12 18 16625 16640 - End of ICM calibration - Thermal configuration after ICM calibration 1039 19/01/12 19 16641 16656 Routine mission operations 1040 20/01/12 20 16657 16672 - SSTI-B switch off - Activation of SID 23 diagnostics at 2Hz 1041 21/01/12 21 16673 16688 Routine mission operations 1042 22/01/12 22 16689 16704 Routine mission operations 1043 23/01/12 23 16705 16720 Disabling of SID 23 diagnostics 1044 24/01/12 24 16721 16736 Routine mission operations 1045 25/01/12 25 16737 16752 All 3 star trackers providing invalid measurements at the same time (GOC_SC-64) 1046 26/01/12 26 16753 16768 EGG CRC check 1047 27/01/12 27 16769 16784 Routine mission operations 1048 28/01/12 28 16785 16800 STR-3 sudden reboot (GOC_SC-65) 1049 29/01/12 29 16801 16816 Routine mission operations 1050 30/01/12 30 16817 16832 Routine mission operations 1051 31/01/12 31 16833 16848 - Transient power outage at ESOC - Move of operations to redundant MCS chain 1052 01/02/12 32 16849 16864 Routine mission operations 1053 02/02/12 33 16865 16880 Routine mission operations 1054 03/02/12 34 16881 16896 Routine mission operations 1055 04/02/12 35 16897 16912 Routine mission operations 1056 05/02/12 36 16913 16929 Routine mission operations 1057 06/02/12 37 16930 16945 Routine mission operations 1058 07/02/12 38 16946 16961 Routine mission operations 1059 08/02/12 39 16962 16977 - Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) - Move of operations back to prime MCS chain 1060 09/02/12 40 16978 16993 Routine mission operations 1061 10/02/12 41 16994 17009 Routine mission operations 1062 11/02/12 42 17010 17025 Routine mission operations 1063 12/02/12 43 17026 17041 Routine mission operations 1064 13/02/12 44 17042 17057 Orbit lowering by 15m (from 00:00 to 13:00) 1065 14/02/12 45 17058 17073 Routine mission operations 1066 15/02/12 46 17074 17089 Routine mission operations 1067 16/02/12 47 17090 17105 Routine mission operations

Page 176/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1068 17/02/12 48 17106 17121 Routine mission operations 1069 18/02/12 49 17122 17137 Routine mission operations 1070 19/02/12 50 17138 17153 Routine mission operations 1071 20/02/12 51 17154 17169 Routine mission operations 1072 21/02/12 52 17170 17185 Routine mission operations 1073 22/02/12 53 17186 17201 Routine mission operations 1074 23/02/12 54 17202 17217 Routine mission operations 1075 24/02/12 55 17218 17233 Routine mission operations 1076 25/02/12 56 17234 17250 Routine mission operations 1077 26/02/12 57 17251 17266 Routine mission operations 1078 27/02/12 58 17267 17282 Routine mission operations 1079 28/02/12 59 17283 17298 Routine mission operations 1080 29/02/12 60 17299 17314 Routine mission operations 1081 01/03/12 61 17315 17330 Routine mission operations 1082 02/03/12 62 17331 17346 Routine mission operations 1083 03/03/12 63 17347 17362 Routine mission operations 1084 04/03/12 64 17363 17378 Routine mission operations 1085 05/03/12 65 17379 17394 - Orbit lowering by 12m (from 00:00 to 10:10) - Safe Mode #4 (sudden restart of PASW) - Initial Safe Mode recovery activities 1086 06/03/12 66 17395 17410 - Recovery of DFACS units and RU - Transition to DFM_PREP at 6.5mN (at 16:00) 1087 07/03/12 67 17411 17426 Switch ON and configuration of gradiometer 1088 08/03/12 68 17427 17442 - Transition to DFM_COARSE (at 08:36) - Transition to DFM_FINE (at 14:28) - Installation of EGG K2 offsets 1089 09/03/12 69 17443 17458 - Start orbit raise with +1mN bias (at 08:00) - Installation of ICM shaking profiles in PASW RAM 1090 10/03/12 70 17459 17474 Routine mission operations 1091 11/03/12 71 17475 17490 Routine mission operations 1092 12/03/12 72 17491 17506 Routine mission operations 1093 13/03/12 73 17507 17522 Stop of orbit raise with +1mN bias (at 12:30) 1094 14/03/12 74 17523 17538 - Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) - Thermal configuration for ICM calibration 1095 15/03/12 75 17539 17554 Start of ICM calibration 1096 16/03/12 76 17555 17570 - End of ICM calibration - Thermal configuration after ICM calibration 1097 17/03/12 77 17571 17587 Routine mission operations 1098 18/03/12 78 17588 17603 Routine mission operations 1099 19/03/12 79 17604 17619 Routine mission operations 1100 20/03/12 80 17620 17635 Dump of Thermal Table for reference 1101 21/03/12 81 17636 17651 Routine mission operations 1102 22/03/12 82 17652 17667 Routine mission operations 1103 23/03/12 83 17668 17683 Routine mission operations 1104 24/03/12 84 17684 17699 Routine mission operations 1105 25/03/12 85 17700 17715 Routine mission operations 1106 26/03/12 86 17716 17731 Orbit lowering by 15m (from 23:58 to 12:31)

Page 177/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1107 27/03/12 87 17732 17747 Routine mission operations 1108 28/03/12 88 17748 17763 Routine mission operations 1109 29/03/12 89 17764 17779 Routine mission operations 1110 30/03/12 90 17780 17795 Routine mission operations 1111 31/03/12 91 17796 17811 Routine mission operations 1112 01/04/12 92 17812 17827 Routine mission operations 1113 02/04/12 93 17828 17843 Routine mission operations 1114 03/04/12 94 17844 17859 Routine mission operations 1115 04/04/12 95 17860 17875 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check) 1116 05/04/12 96 17876 17891 Routine mission operations 1117 06/04/12 97 17892 17908 Routine mission operations 1118 07/04/12 98 17909 17924 Routine mission operations 1119 08/04/12 99 17925 17940 Routine mission operations 1120 09/04/12 100 17941 17956 Orbit lowering by 15m (from 23:58 to 13:00) 1121 10/04/12 101 17957 17972 Routine mission operations 1122 11/04/12 102 17973 17988 Routine mission operations 1123 12/04/12 103 17989 18004 Routine mission operations 1124 13/04/12 104 18005 18020 Routine mission operations 1125 14/04/12 105 18021 18036 Routine mission operations 1126 15/04/12 106 18037 18052 Routine mission operations 1127 16/04/12 107 18053 18068 Routine mission operations 1128 17/04/12 108 18069 18084 Routine mission operations 1129 18/04/12 109 18085 18100 Routine mission operations 1130 19/04/12 110 18101 18116 Routine mission operations 1131 20/04/12 111 18117 18132 Routine mission operations 1132 21/04/12 112 18133 18148 Routine mission operations 1133 22/04/12 113 18149 18164 Routine mission operations 1134 23/04/12 114 18165 18180 Routine mission operations 1135 24/04/12 115 18181 18196 Spurious invalid star tracker measurements 1136 25/04/12 116 18197 18212 Spurious invalid star tracker measurements 1137 26/04/12 117 18213 18228 VPS-3 read pointer anomaly (GOC_SC-68) 1138 27/04/12 118 18229 18245 Routine mission operations 1139 28/04/12 119 18246 18261 Routine mission operations 1140 29/04/12 120 18262 18277 Routine mission operations 1141 30/04/12 121 18278 18293 Routine mission operations 1142 01/05/12 122 18294 18309 Routine mission operations 1143 02/05/12 123 18310 18325 Routine mission operations 1144 03/05/12 124 18326 18341 Routine mission operations 1145 04/05/12 125 18342 18357 Routine mission operations 1146 05/05/12 126 18358 18373 Routine mission operations 1147 06/05/12 127 18374 18389 Spurious double bit error in mass memory B 1148 07/05/12 128 18390 18405 Orbit lowering by 20m (from 23:58 to 17:00) 1149 08/05/12 129 18406 18421 Routine mission operations 1150 09/05/12 130 18422 18437 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1151 10/05/12 131 18438 18453 Routine mission operations

Page 178/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1152 11/05/12 132 18454 18469 TMM FDIR trigger (at 20:08:37) 1153 12/05/12 133 18470 18485 Routine mission operations 1154 13/05/12 134 18486 18501 Routine mission operations 1155 14/05/12 135 18502 18517 Routine mission operations 1156 15/05/12 136 18518 18533 Star Tracker 2 anomaly (GOC_SC-69) 1157 16/05/12 137 18534 18549 Recovery of Star Tracker 2 by ground 1158 17/05/12 138 18550 18566 Routine mission operations 1159 18/05/12 139 18567 18582 Routine mission operations 1160 19/05/12 140 18583 18598 Routine mission operations 1161 20/05/12 141 18599 18614 Routine mission operations 1162 21/05/12 142 18615 18630 Thermal configuration for ICM calibration 1163 22/05/12 143 18631 18646 Start of ICM calibration 1164 23/05/12 144 18647 18662 - End of ICM calibration - Thermal configuration after ICM calibration - Start of CESS/DFM diagnostics acquistion (16:00) 1165 24/05/12 145 18663 18678 - Stop of CESS/DFM diagnostics acquistion (16:00) 1166 25/05/12 146 18679 18694 Routine mission operations 1167 26/05/12 147 18695 18710 Routine mission operations 1168 27/05/12 148 18711 18726 Routine mission operations 1169 28/05/12 149 18727 18742 Routine mission operations 1170 29/05/12 150 18743 18758 Routine mission operations 1171 30/05/12 151 18759 18774 Routine mission operations 1172 31/05/12 152 18775 18790 Routine mission operations 1173 01/06/12 153 18791 18806 Routine mission operations 1174 02/06/12 154 18807 18822 Routine mission operations 1175 03/06/12 155 18823 18838 Routine mission operations 1176 04/06/12 156 18839 18854 Routine mission operations 1177 05/06/12 157 18855 18870 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1178 06/06/12 158 18871 18886 Routine mission operations 1179 07/06/12 159 18887 18903 Safe Mode #5 (loss of attitude control caused by EGG anomaly) 1180 08/06/12 160 18904 18919 - Initial Safe Mode recovery activities in FPM - Gradiometer switch ON and transition to Acquisition 1181 09/06/12 161 18920 18935 Transition to DFM_PREP at 6.5mN (at 09:00) 1182 10/06/12 162 18936 18951 Routine mission operations in DFM_PREP 1183 11/06/12 163 18952 18967 - Installation of Gradiometer non-permanent settings - Gradiometer transition to science mode 1184 12/06/12 164 18968 18983 - Gradiometer transition to acquisition mode - Removal of Gradiometer K2 offsets - Installation of ICM shaking profiles in PASW RAM 1185 13/06/12 165 18984 18999 - Transition to DFM_COARSE (at 07:30) - Transition to DFM_FINE (at 11:15) - Installation of EGG K2 offsets 1186 14/06/12 166 19000 19015 Routine mission operations 1187 15/06/12 167 19016 19031 Routine mission operations 1188 16/06/12 168 19032 19047 Routine mission operations

Page 179/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1189 17/06/12 169 19048 19063 Routine mission operations 1190 18/06/12 170 19064 19079 Thermal configuration for ICM calibration 1191 19/06/12 171 19080 19095 Start of ICM calibration 1192 20/06/12 172 19096 19111 - End of ICM calibration - Thermal configuration after ICM calibration 1193 21/06/12 173 19112 19127 EGG bias compensation disabled 1194 22/06/12 174 19128 19143 Routine mission operations 1195 23/06/12 175 19144 19159 Routine mission operations 1196 24/06/12 176 19160 19175 Routine mission operations 1197 25/06/12 177 19176 19191 Orbit raise by 50m (from 23:58 to 08:43) 1198 26/06/12 178 19192 19207 Routine mission operations 1199 27/06/12 179 19208 19224 Routine mission operations 1200 28/06/12 180 19225 19240 Routine mission operations 1201 29/06/12 181 19241 19256 Routine mission operations 1202 30/06/12 182 19257 19272 Routine mission operations 1203 01/07/12 183 19273 19288 Routine mission operations 1204 02/07/12 184 19289 19304 Routine mission operations 1205 03/07/12 185 19305 19320 Routine mission operations 1206 04/07/12 186 19321 19336 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1207 05/07/12 187 19337 19352 Routine mission operations 1208 06/07/12 188 19353 19368 Spike in S/C linear acceleration (at 20:38:40) 1209 07/07/12 189 19369 19384 Routine mission operations 1210 08/07/12 190 19385 19400 Routine mission operations 1211 09/07/12 191 19401 19416 Routine mission operations 1212 10/07/12 192 19417 19432 Routine mission operations 1213 11/07/12 193 19433 19448 Routine mission operations 1214 12/07/12 194 19449 19464 Routine mission operations 1215 13/07/12 195 19465 19480 Routine mission operations 1216 14/07/12 196 19481 19496 Routine mission operations 1217 15/07/12 197 19497 19512 Routine mission operations 1218 16/07/12 198 19513 19528 Spike in S/C linear acceleration (at 22:54:16) 1219 17/07/12 199 19529 19544 Routine mission operations 1220 18/07/12 200 19545 19561 Routine mission operations 1221 19/07/12 201 19562 19577 - EGG bias compensation filter tuning (GOC_SC-70) - Enabling of EGG bias compensation 1222 20/07/12 202 19578 19593 Routine mission operations 1223 21/07/12 203 19594 19609 Routine mission operations 1224 22/07/12 204 19610 19625 Routine mission operations 1225 23/07/12 205 19626 19641 Routine mission operations 1226 24/07/12 206 19642 19657 Routine mission operations 1227 25/07/12 207 19658 19673 Routine mission operations 1228 26/07/12 208 19674 19689 Routine mission operations 1229 27/07/12 209 19690 19705 Routine mission operations 1230 28/07/12 210 19706 19721 Routine mission operations 1231 29/07/12 211 19722 19737 Routine mission operations 1232 30/07/12 212 19738 19753 Routine mission operations

Page 180/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1233 31/07/12 213 19754 19769 Routine mission operations 1234 01/08/12 214 19770 19785 Start of orbit lowering by 8.6 km (at 06:00) 1235 02/08/12 215 19786 19801 Routine mission operations 1236 03/08/12 216 19802 19817 Routine mission operations 1237 04/08/12 217 19818 19833 Routine mission operations 1238 05/08/12 218 19834 19849 Routine mission operations 1239 06/08/12 219 19850 19865 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1240 07/08/12 220 19866 19882 Routine mission operations 1241 08/08/12 221 19883 19898 Routine mission operations 1242 09/08/12 222 19899 19914 Routine mission operations 1243 10/08/12 223 19915 19930 Routine mission operations 1244 11/08/12 224 19931 19946 Routine mission operations 1245 12/08/12 225 19947 19962 Routine mission operations 1246 13/08/12 226 19963 19978 Routine mission operations 1247 14/08/12 227 19979 19994 Routine mission operations 1248 15/08/12 228 19995 20010 Routine mission operations 1249 16/08/12 229 20011 20026 Routine mission operations 1250 17/08/12 230 20027 20042 Routine mission operations 1251 18/08/12 231 20043 20058 Routine mission operations 1252 19/08/12 232 20059 20074 Routine mission operations 1253 20/08/12 233 20075 20090 Routine mission operations 1254 21/08/12 234 20091 20106 TIMER_ECLIP_THR for ECPM set to 1000 1255 22/08/12 235 20107 20122 Routine mission operations 1256 23/08/12 236 20123 20139 TMM FDIR trigger (at 16:35:31) 1257 24/08/12 237 20140 20155 Routine mission operations 1258 25/08/12 238 20156 20171 Routine mission operations 1259 26/08/12 239 20172 20187 Routine mission operations 1260 27/08/12 240 20188 20203 Routine mission operations 1261 28/08/12 241 20204 20219 Routine mission operations 1262 29/08/12 242 20220 20235 Routine mission operations 1263 30/08/12 243 20236 20251 Routine mission operations 1264 31/08/12 244 20252 20267 - Stop of orbit lowering by 8.6 km (at 18:20) - Start of spurious wrong readings from thermistor THT10003 1265 01/09/12 245 20268 20283 Routine mission operations 1266 02/09/12 246 20284 20299 Routine mission operations 1267 03/09/12 247 20300 20315 Routine mission operations 1268 04/09/12 248 20316 20331 Start of CESS/DFM diagnostics acquistion (10:00) 1269 05/09/12 249 20332 20348 Stop of CESS/DFM diagnostics acquistion (10:00) 1270 06/09/12 250 20349 20364 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1271 07/09/12 251 20365 20380 Routine mission operations 1272 08/09/12 252 20381 20396 Routine mission operations 1273 09/09/12 253 20397 20412 Routine mission operations 1274 10/09/12 254 20413 20428 Thermal configuration for ICM calibration

Page 181/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1275 11/09/12 255 20429 20444 Start of ICM calibration 1276 12/09/12 256 20445 20460 - End of ICM calibration - Thermal configuration after ICM calibration 1277 13/09/12 257 20461 20476 Routine mission operations 1278 14/09/12 258 20477 20492 Routine mission operations 1279 15/09/12 259 20493 20508 Routine mission operations 1280 16/09/12 260 20509 20524 Routine mission operations 1281 17/09/12 261 20525 20541 Routine mission operations 1282 18/09/12 262 20542 20557 Routine mission operations 1283 19/09/12 263 20558 20573 Routine mission operations 1284 20/09/12 264 20574 20589 Routine mission operations 1285 21/09/12 265 20590 20605 TIMER_ECLIP_THR for ECPM set to 10 1286 22/09/12 266 20606 20621 Routine mission operations 1287 23/09/12 267 20622 20637 Routine mission operations 1288 24/09/12 268 20638 20653 Spurious EGG Validation_Failed event (22:01:51) 1289 25/09/12 269 20654 20669 Routine mission operations 1290 26/09/12 270 20670 20685 Routine mission operations 1291 27/09/12 271 20686 20701 Routine mission operations 1292 28/09/12 272 20702 20717 Routine mission operations 1293 29/09/12 273 20718 20733 Routine mission operations 1294 30/09/12 274 20734 20750 Routine mission operations 1295 01/10/12 275 20751 20766 Routine mission operations 1296 02/10/12 276 20767 20782 Routine mission operations 1297 03/10/12 277 20783 20798 Routine mission operations 1298 04/10/12 278 20799 20814 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1299 05/10/12 279 20815 20830 Routine mission operations 1300 06/10/12 280 20831 20846 Routine mission operations 1301 07/10/12 281 20847 20862 Routine mission operations 1302 08/10/12 282 20863 20878 Routine mission operations 1303 09/10/12 283 20879 20894 Routine mission operations 1304 10/10/12 284 20895 20910 Routine mission operations 1305 11/10/12 285 20911 20926 Routine mission operations 1306 12/10/12 286 20927 20943 Routine mission operations 1307 13/10/12 287 20944 20959 Routine mission operations 1308 14/10/12 288 20960 20975 Routine mission operations 1309 15/10/12 289 20976 20991 Routine mission operations 1310 16/10/12 290 20992 21007 Routine mission operations 1311 17/10/12 291 21008 21023 Routine mission operations 1312 18/10/12 292 21024 21039 Routine mission operations 1313 19/10/12 293 21040 21055 Routine mission operations 1314 20/10/12 294 21056 21071 Routine mission operations 1315 21/10/12 295 21072 21087 Routine mission operations 1316 22/10/12 296 21088 21103 Routine mission operations 1317 23/10/12 297 21104 21119 Tracking test in Mode 1 with Kiruna, Svalbard, Troll 1318 24/10/12 298 21120 21135 Routine mission operations 1319 25/10/12 299 21136 21152 Routine mission operations

Page 182/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1320 26/10/12 300 21153 21168 Routine mission operations 1321 27/10/12 301 21169 21184 Routine mission operations 1322 28/10/12 302 21185 21200 Routine mission operations 1323 29/10/12 303 21201 21216 Routine mission operations 1324 30/10/12 304 21217 21232 Routine mission operations 1325 31/10/12 305 21233 21248 Routine mission operations 1326 01/11/12 306 21249 21264 Start of orbit lowering by 6.4 km (at 18:20) 1327 02/11/12 307 21265 21280 Routine mission operations 1328 03/11/12 308 21281 21296 Routine mission operations 1329 04/11/12 309 21297 21312 Routine mission operations 1330 05/11/12 310 21313 21328 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1331 06/11/12 311 21329 21345 Routine mission operations 1332 07/11/12 312 21346 21361 Thermal configuration for ICM calibration 1333 08/11/12 313 21362 21377 - Stop of orbit lowering (at 06:30) - Start of ICM calibration 1334 09/11/12 314 21378 21393 - End of ICM calibration - Resumption of orbit lowering (at 10:00) - Thermal configuration after ICM calibration 1335 10/11/12 315 21394 21409 Routine mission operations 1336 11/11/12 316 21410 21425 Routine mission operations 1337 12/11/12 317 21426 21441 Routine mission operations 1338 13/11/12 318 21442 21457 Spike in S/C linear acceleration (at 21:06:23) 1339 14/11/12 319 21458 21473 Invalid measurements from all star trackers (at 09:03:11) 1340 15/11/12 320 21474 21489 Routine mission operations 1341 16/11/12 321 21490 21505 Routine mission operations 1342 17/11/12 322 21506 21522 Routine mission operations 1343 18/11/12 323 21523 21538 Routine mission operations 1344 19/11/12 324 21539 21554 Routine mission operations 1345 20/11/12 325 21555 21570 Routine mission operations 1346 21/11/12 326 21571 21586 Routine mission operations 1347 22/11/12 327 21587 21602 Routine mission operations 1348 23/11/12 328 21603 21618 Acquisition of STR images during increased geomagnetic activity 1349 24/11/12 329 21619 21634 Acquisition of STR images during increased geomagnetic activity 1350 25/11/12 330 21635 21650 Routine mission operations 1351 26/11/12 331 21651 21666 Routine mission operations 1352 27/11/12 332 21667 21682 Routine mission operations 1353 28/11/12 333 21683 21699 Routine mission operations 1354 29/11/12 334 21700 21715 Routine mission operations 1355 30/11/12 335 21716 21731 Temporary enabling of ADAL diagnostics packet (GOC_SC-72) 1356 01/12/12 336 21732 21747 Routine mission operations

Page 183/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1357 02/12/12 337 21748 21763 - Stop of orbit lowering (at 07:00) - Acceleration bias set to 0.185×10-06 m/s2 - Error in ACARO transfer and re-enabling of TMM FDIR 1358 03/12/12 338 21764 21779 Routine mission operations 1359 04/12/12 339 21780 21795 Routine mission operations 1360 05/12/12 340 21796 21811 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1361 06/12/12 341 21812 21827 Routine mission operations 1362 07/12/12 342 21828 21844 Routine mission operations 1363 08/12/12 343 21845 21860 Routine mission operations 1364 09/12/12 344 21861 21876 Routine mission operations 1365 10/12/12 345 21877 21892 Routine mission operations 1366 11/12/12 346 21893 21908 Routine mission operations 1367 12/12/12 347 21909 21924 Routine mission operations 1368 13/12/12 348 21925 21940 Routine mission operations 1369 14/12/12 349 21941 21956 Routine mission operations 1370 15/12/12 350 21957 21972 Routine mission operations 1371 16/12/12 351 21973 21988 Routine mission operations 1372 17/12/12 352 21989 22005 Routine mission operations 1373 18/12/12 353 22006 22021 Routine mission operations 1374 19/12/12 354 22022 22037 Routine mission operations 1375 20/12/12 355 22038 22053 Routine mission operations 1376 21/12/12 356 22054 22069 Routine mission operations 1377 22/12/12 357 22070 22085 Routine mission operations 1378 23/12/12 358 22086 22101 Routine mission operations 1379 24/12/12 359 22102 22117 - Surveillance L5-1 trigger on STR-3 (at 05:21) - Recovery of STR-3 by ground 1380 25/12/12 360 22118 22133 Routine mission operations 1381 26/12/12 361 22134 22149 Routine mission operations 1382 27/12/12 362 22150 22166 Routine mission operations 1383 28/12/12 363 22167 22182 Routine mission operations 1384 29/12/12 364 22183 22198 Routine mission operations 1385 30/12/12 365 22199 22214 Routine mission operations 1386 31/12/12 366 22215 22230 Routine mission operations 1387 01/01/13 1 22231 22246 Routine mission operations 1388 02/01/13 2 22247 22262 Routine mission operations 1389 03/01/13 3 22263 22278 Monthly maintenance activities 1/2 (STR image dump) 1390 04/01/13 4 22279 22294 Monthly maintenance activities 2/2 (EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1391 05/01/13 5 22295 22311 Routine mission operations 1392 06/01/13 6 22312 22327 Routine mission operations 1393 07/01/13 7 22328 22343 Routine mission operations 1394 08/01/13 8 22344 22359 Routine mission operations 1395 09/01/13 9 22360 22375 Routine mission operations 1396 10/01/13 10 22376 22391 Routine mission operations

Page 184/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1397 11/01/13 11 22392 22407 Routine mission operations 1398 12/01/13 12 22408 22423 Routine mission operations 1399 13/01/13 13 22424 22439 - Fallback to Fine Pointing Mode (GOC_SC-53) - IPCU-A limited switch ON - Transition from FPM to DFM_PREP (7 mN thrust) - Removal of EGG K2 offsets 1400 14/01/13 14 22440 22455 - Transition to DFM_COARSE (at 02:00) - Transition to DFM_FINE (at 08:04) - Installation of EGG K2 offsets 1401 15/01/13 15 22456 22472 Stop of orbit raise to recover altitude lost (at 09:00) 1402 16/01/13 16 22473 22488 Routine mission operations 1403 17/01/13 17 22489 22504 Routine mission operations 1404 18/01/13 18 22505 22520 Routine mission operations 1405 19/01/13 19 22521 22536 Routine mission operations 1406 20/01/13 20 22537 22552 Routine mission operations 1407 21/01/13 21 22553 22568 Routine mission operations 1408 22/01/13 22 22569 22584 Routine mission operations 1409 23/01/13 23 22585 22600 Routine mission operations 1410 24/01/13 24 22601 22616 Routine mission operations 1411 25/01/13 25 22617 22633 Routine mission operations 1412 26/01/13 26 22634 22649 Routine mission operations 1413 27/01/13 27 22650 22665 Routine mission operations 1414 28/01/13 28 22666 22681 Routine mission operations 1415 29/01/13 29 22682 22697 Routine mission operations 1416 30/01/13 30 22698 22713 Routine mission operations 1417 31/01/13 31 22714 22729 Routine mission operations 1418 01/02/13 32 22730 22745 Routine mission operations 1419 02/02/13 33 22746 22761 Gradiometer ASH1 anomaly (at 09:33) 1420 03/02/13 34 22762 22778 Routine mission operations 1421 04/02/13 35 22779 22794 - Transition to DFM_COARSE to recover from Gradiometer anomaly - Attitude control divergence when going to DFM_COARSE - Ground commanded fallback to CPM 1422 05/02/13 36 22795 22810 - Gradiometer switch ON and transition to Acquisition - Installation of Gradiometer non-permanent settings - Miscellaneous configuration activities in FPM 1423 06/02/13 37 22811 22826 - IPCU-A limited switch ON - Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) - Gradiometer transition to Science mode 1424 07/02/13 38 22827 22842 - Gradiometer transition to Acquisition mode - Transition to DFM_PREP at 2mN (at 07:20) 1425 08/02/13 39 22843 22858 Routine mission operations in DFM_PREP 1426 09/02/13 40 22859 22874 Routine mission operations in DFM_PREP 1427 10/02/13 41 22875 22890 Routine mission operations in DFM_PREP

Page 185/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1428 11/02/13 42 22891 22906 - Transition to DFM_COARSE (at 03:30) - Transition to DFM_FINE (at 08:07) - Installation of EGG K2 offsets - Thermal configuration for ICM calibration 1429 12/02/13 43 22907 22923 Start of ICM calibration 1430 13/02/13 44 22924 22939 - End of ICM calibration - Thermal configuration after ICM calibration - Start of orbit lowering to 239 km (at 09:00) 1431 14/02/13 45 22940 22955 Routine mission operations 1432 15/02/13 46 22956 22971 Routine mission operations 1433 16/02/13 47 22972 22987 Stop of orbit lowering to 239 km (at 22:00) 1434 17/02/13 48 22988 23003 Routine mission operations 1435 18/02/13 49 23004 23019 Routine mission operations 1436 19/02/13 50 23020 23035 Start of CESS diagnostics acquisition (08:15) 1437 20/02/13 51 23036 23052 Stop of CESS diagnostics acquisition (08:15) 1438 21/02/13 52 23053 23068 Routine mission operations 1439 22/02/13 53 23069 23084 Routine mission operations 1440 23/02/13 54 23085 23100 Routine mission operations 1441 24/02/13 55 23101 23116 Routine mission operations 1442 25/02/13 56 23117 23132 - Orbit raise by 25m (from 23:58 to 08:15) - Reconfiguration to TX-2 and ensuing recovery 1443 26/02/13 57 23133 23148 Routine mission operations 1444 27/02/13 58 23149 23164 Routine mission operations 1445 28/02/13 59 23165 23180 Routine mission operations 1446 01/03/13 60 23181 23197 Routine mission operations 1447 02/03/13 61 23198 23213 Routine mission operations 1448 03/03/13 62 23214 23229 Routine mission operations 1449 04/03/13 63 23230 23245 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1450 05/03/13 64 23246 23261 Routine mission operations 1451 06/03/13 65 23262 23277 Routine mission operations 1452 07/03/13 66 23278 23293 Routine mission operations 1453 08/03/13 67 23294 23309 Routine mission operations 1454 09/03/13 68 23310 23326 Routine mission operations 1455 10/03/13 69 23327 23342 Routine mission operations 1456 11/03/13 70 23343 23358 TMM FDIR trigger (at 17:41:11) 1457 12/03/13 71 23359 23374 Routine mission operations 1458 13/03/13 72 23375 23390 Routine mission operations 1459 14/03/13 73 23391 23406 Routine mission operations 1460 15/03/13 74 23407 23422 Routine mission operations 1461 16/03/13 75 23423 23438 Routine mission operations 1462 17/03/13 76 23439 23455 Routine mission operations 1463 18/03/13 77 23456 23471 Routine mission operations 1464 19/03/13 78 23472 23487 Routine mission operations 1465 20/03/13 79 23488 23503 Routine mission operations 1466 21/03/13 80 23504 23519 Routine mission operations 1467 22/03/13 81 23520 23535 Routine mission operations 1468 23/03/13 82 23536 23551 Routine mission operations

Page 186/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1469 24/03/13 83 23552 23567 Routine mission operations 1470 25/03/13 84 23568 23584 Routine mission operations 1471 26/03/13 85 23585 23600 Routine mission operations 1472 27/03/13 86 23601 23616 Routine mission operations 1473 28/03/13 87 23617 23632 Routine mission operations 1474 29/03/13 88 23633 23648 Routine mission operations 1475 30/03/13 89 23649 23664 Routine mission operations 1476 31/03/13 90 23665 23680 Routine mission operations 1477 01/04/13 91 23681 23696 Routine mission operations 1478 02/04/13 92 23697 23713 Routine mission operations 1479 03/04/13 93 23714 23729 - Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) - Tracking campaign 1/2 1480 04/04/13 94 23730 23745 Tracking campaign 2/2 1481 05/04/13 95 23746 23761 Routine mission operations 1482 06/04/13 96 23762 23777 Routine mission operations 1483 07/04/13 97 23778 23793 Routine mission operations 1484 08/04/13 98 23794 23809 Routine mission operations 1485 09/04/13 99 23810 23825 Routine mission operations 1486 10/04/13 100 23826 23842 Routine mission operations 1487 11/04/13 101 23843 23858 Routine mission operations 1488 12/04/13 102 23859 23874 Routine mission operations 1489 13/04/13 103 23875 23890 Routine mission operations 1490 14/04/13 104 23891 23906 Spikes in S/C linear acceleration at 14:45:32 and at 16:13:57 (GOC_SC-71) 1491 15/04/13 105 23907 23922 Routine mission operations 1492 16/04/13 106 23923 23938 TMM FDIR trigger after execution of OBCP 5451 1493 17/04/13 107 23939 23954 Failure of solar array thermistor THT10018 (GOC_SC-67) 1494 18/04/13 108 23955 23971 Routine mission operations 1495 19/04/13 109 23972 23987 TIMER_ECLIP_THR for ECPM set to 1000 1496 20/04/13 110 23988 24003 Routine mission operations 1497 21/04/13 111 24004 24019 TMM FDIR trigger during execution of OBCP 5451 1498 22/04/13 112 24020 24035 Routine mission operations 1499 23/04/13 113 24036 24051 Routine mission operations 1500 24/04/13 114 24052 24067 Routine mission operations 1501 25/04/13 115 24068 24083 Routine mission operations 1502 26/04/13 116 24084 24099 Routine mission operations 1503 27/04/13 117 24100 24116 Routine mission operations 1504 28/04/13 118 24117 24132 Routine mission operations 1505 29/04/13 119 24133 24148 Gradiometer ACC3, ACC6 detector offset test 1/4 1506 30/04/13 120 24149 24164 Gradiometer ACC3, ACC6 detector offset test 2/4 1507 01/05/13 121 24165 24180 Routine mission operations 1508 02/05/13 122 24181 24196 - Gradiometer ACC3, ACC6 detector offset test 3/4 - Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1509 03/05/13 123 24197 24212 Gradiometer ACC3, ACC6 detector offset test 4/4

Page 187/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1510 04/05/13 124 24213 24228 Routine mission operations 1511 05/05/13 125 24229 24245 Gradiometer ASH1 anomaly (at 13:12) 1512 06/05/13 126 24246 24261 - Recovery from Gradiometer ASH1 anomaly - Thermal configuration for ICM calibration 1513 07/05/13 127 24262 24277 Start of ICM calibration 1514 08/05/13 128 24278 24293 - End of ICM calibration - Thermal configuration after ICM calibration 1515 09/05/13 129 24294 24309 Routine mission operations 1516 10/05/13 130 24310 24325 Routine mission operations 1517 11/05/13 131 24326 24341 Routine mission operations 1518 12/05/13 132 24342 24357 TMM FDIR trigger after execution of OBCP 5451 1519 13/05/13 133 24358 24374 Routine mission operations 1520 14/05/13 134 24375 24390 Routine mission operations 1521 15/05/13 135 24391 24406 Routine mission operations 1522 16/05/13 136 24407 24422 Routine mission operations 1523 17/05/13 137 24423 24438 Routine mission operations 1524 18/05/13 138 24439 24454 Spikes in S/C linear acceleration at 04:03:52 and at 21:49:08 (GOC_SC-71) 1525 19/05/13 139 24455 24470 Routine mission operations 1526 20/05/13 140 24471 24486 Start of orbit lowering - fallback to FPM (at 04:00) 1527 21/05/13 141 24487 24503 - TIMER_ECLIP_THR for ECPM set to 2400 - S/C configuration for IPA-B usage (TCS, IPA FCN) - Limited IPCU-B switch ON and IPA-B venting test - Removal of gradiometer K2 offsets 1528 22/05/13 142 24504 24519 - Transition to DFM_PREP on IPA-B at 3 mN - Thrust ramp with IPA-B to 8, 12, 19 mN - Fallback to FPM - S/C configuration for IPA-A usage (TCS, IPA FCN) - TMM FDIR trigger during execution of OBCP 5451 1529 23/05/13 143 24520 24535 - IPCU-A limited switch ON 1530 24/05/13 144 24536 24551 Transition to DFM_PREP on IPA-A at 1mN 1531 25/05/13 145 24552 24567 Routine mission operations 1532 26/05/13 146 24568 24583 Routine mission operations 1533 27/05/13 147 24584 24599 Routine mission operations 1534 28/05/13 148 24600 24616 - Acquisition of DFACS diagnostics in DFM_PREP - Thrust level set to 11.3 mN in DFM_PREP - Transition to DFM_COARSE (at 20:45) 1535 29/05/13 149 24617 24632 - Transition to DFM_FINE (at 06:15) - Installation of EGG K2 offsets 1536 30/05/13 150 24633 24648 Routine mission operations 1537 31/05/13 151 24649 24664 Routine mission operations 1538 01/06/13 152 24665 24680 Spikes in S/C linear acceleration and high thrust during G2 geomagnetic storm 1539 02/06/13 153 24681 24696 Routine mission operations 1540 03/06/13 154 24697 24713 Routine mission operations 1541 04/06/13 155 24714 24729 - Gradiometer PID gain test for ACC3 and ACC6 - Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning)

Page 188/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1542 05/06/13 156 24730 24745 - Orbit lowering by 110m (00:00 to 18:10) - Start of CESS/DFM diagnostics acquisition (18:30) 1543 06/06/13 157 24746 24761 Stop of CESS/DFM diagnostics acquisition (18:30) 1544 07/06/13 158 24762 24777 Spikes in S/C linear acceleration 1545 08/06/13 159 24778 24793 Routine mission operations 1546 09/06/13 160 24794 24809 Routine mission operations 1547 10/06/13 161 24810 24826 Spurious multiple bit error in mass memory B 1548 11/06/13 162 24827 24842 - Investigation/correction of multiple bit error in MM- B - Diagnostics enabled for CESS performance assessment 1549 12/06/13 163 24843 24858 Routine mission operations 1550 13/06/13 164 24859 24874 Routine mission operations 1551 14/06/13 165 24875 24890 Routine mission operations 1552 15/06/13 166 24891 24906 Routine mission operations 1553 16/06/13 167 24907 24923 Routine mission operations 1554 17/06/13 168 24924 24939 Orbit raise by 10m (from 23:58 to 01:40) 1555 18/06/13 169 24940 24955 TMM FDIR trigger after execution of OBCP 5451 1556 19/06/13 170 24956 24971 Routine mission operations 1557 20/06/13 171 24972 24987 Routine mission operations 1558 21/06/13 172 24988 25003 Routine mission operations 1559 22/06/13 173 25004 25020 Routine mission operations 1560 23/06/13 174 25021 25036 Routine mission operations 1561 24/06/13 175 25037 25052 Routine mission operations 1562 25/06/13 176 25053 25068 Routine mission operations 1563 26/06/13 177 25069 25084 Routine mission operations 1564 27/06/13 178 25085 25100 Routine mission operations 1565 28/06/13 179 25101 25117 Routine mission operations 1566 29/06/13 180 25118 25133 Routine mission operations 1567 30/06/13 181 25134 25149 Routine mission operations 1568 01/07/13 182 25150 25165 Routine mission operations 1569 02/07/13 183 25166 25181 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1570 03/07/13 184 25182 25197 Routine mission operations 1571 04/07/13 185 25198 25213 Routine mission operations 1572 05/07/13 186 25214 25230 Routine mission operations 1573 06/07/13 187 25231 25246 Routine mission operations 1574 07/07/13 188 25247 25262 Routine mission operations 1575 08/07/13 189 25263 25278 Routine mission operations 1576 09/07/13 190 25279 25294 Routine mission operations 1577 10/07/13 191 25295 25310 Routine mission operations 1578 11/07/13 192 25311 25327 Routine mission operations 1579 12/07/13 193 25328 25343 Routine mission operations 1580 13/07/13 194 25344 25359 Routine mission operations 1581 14/07/13 195 25360 25375 Routine mission operations 1582 15/07/13 196 25376 25391 Routine mission operations 1583 16/07/13 197 25392 25407 Routine mission operations

Page 189/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1584 17/07/13 198 25408 25424 Routine mission operations 1585 18/07/13 199 25425 25440 Routine mission operations 1586 19/07/13 200 25441 25456 Routine mission operations 1587 20/07/13 201 25457 25472 Routine mission operations 1588 21/07/13 202 25473 25488 Routine mission operations 1589 22/07/13 203 25489 25504 Routine mission operations 1590 23/07/13 204 25505 25521 Routine mission operations 1591 24/07/13 205 25522 25537 Routine mission operations 1592 25/07/13 206 25538 25553 Routine mission operations 1593 26/07/13 207 25554 25569 Routine mission operations 1594 27/07/13 208 25570 25585 Routine mission operations 1595 28/07/13 209 25586 25601 Start of orbit raise by 35m (at 23:58) 1596 29/07/13 210 25602 25617 - SSTI-B switch ON to Bootstrap & Loader Mode - SSTI-B full EEPROM dump 1597 30/07/13 211 25618 25634 - End of orbit raise by 35m (at 07:00) - Thermal configuration for ICM calibration 1598 31/07/13 212 25635 25650 - SSTI-B installation of ASW 4.2 - SSTI-B power cycle and transition to Navigation Mode - Start of ICM calibration 1599 01/08/13 213 25651 25666 - End of ICM calibration - Thermal configuration after ICM calibration 1600 02/08/13 214 25667 25682 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1601 03/08/13 215 25683 25698 Routine mission operations 1602 04/08/13 216 25699 25714 Routine mission operations 1603 05/08/13 217 25715 25731 Routine mission operations 1604 06/08/13 218 25732 25747 Routine mission operations 1605 07/08/13 219 25748 25763 Routine mission operations 1606 08/08/13 220 25764 25779 Routine mission operations 1607 09/08/13 221 25780 25795 Routine mission operations 1608 10/08/13 222 25796 25811 Routine mission operations 1609 11/08/13 223 25812 25828 Routine mission operations 1610 12/08/13 224 25829 25844 Routine mission operations 1611 13/08/13 225 25845 25860 Routine mission operations 1612 14/08/13 226 25861 25876 Routine mission operations 1613 15/08/13 227 25877 25892 Routine mission operations 1614 16/08/13 228 25893 25908 Update of OBT-GPS time offset in SGM RAM and EEPROM 1615 17/08/13 229 25909 25925 Routine mission operations 1616 18/08/13 230 25926 25941 Start of orbit lowering by 20m (at 23:58) 1617 19/08/13 231 25942 25957 End of orbit lowering by 20m (at 18:40) 1618 20/08/13 232 25958 25973 Routine mission operations 1619 21/08/13 233 25974 25989 TIMER_ECLIP_THR for ECPM set to 1000 1620 22/08/13 234 25990 26005 Routine mission operations 1621 23/08/13 235 26006 26021 Routine mission operations 1622 24/08/13 236 26022 26038 Routine mission operations 1623 25/08/13 237 26039 26054 Routine mission operations

Page 190/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1624 26/08/13 238 26055 26070 Routine mission operations 1625 27/08/13 239 26071 26086 Routine mission operations 1626 28/08/13 240 26087 26102 Routine mission operations 1627 29/08/13 241 26103 26118 Routine mission operations 1628 30/08/13 242 26119 26135 Routine mission operations 1629 31/08/13 243 26136 26151 Routine mission operations 1630 01/09/13 244 26152 26167 Start of orbit lowering by 12m (at 23:58) 1631 02/09/13 245 26168 26183 Routine mission operations 1632 03/09/13 246 26184 26199 Monthly maintenance activities (STR image dump, EGG CRC check, GCDE pressure check, IPA HPT FDIR limit tuning) 1633 04/09/13 247 26200 26215 Routine mission operations 1634 05/09/13 248 26216 26232 VPS-1 read pointer anomaly (GOC_SC-68) 1635 06/09/13 249 26233 26248 Routine mission operations 1636 07/09/13 250 26249 26264 Routine mission operations 1637 08/09/13 251 26265 26280 Start of orbit lowering by 40m (at 23:58) 1638 09/09/13 252 26281 26296 Routine mission operations 1639 10/09/13 253 26297 26312 End of orbit lowering by 40m (at 11:26) 1640 11/09/13 254 26313 26329 Routine mission operations 1641 12/09/13 255 26330 26345 Routine mission operations 1642 13/09/13 256 26346 26361 Routine mission operations 1643 14/09/13 257 26362 26377 Routine mission operations 1644 15/09/13 258 26378 26393 Routine mission operations 1645 16/09/13 259 26394 26409 Routine mission operations 1646 17/09/13 260 26410 26425 Routine mission operations 1647 18/09/13 261 26426 26442 Configuration of S/C FDIR for maximum fuel depletion 1648 19/09/13 262 26443 26458 Routine mission operations 1649 20/09/13 263 26459 26474 TIMER_ECLIP_THR for ECPM set to 10 1650 21/09/13 264 26475 26490 Routine mission operations 1651 22/09/13 265 26491 26506 Routine mission operations 1652 23/09/13 266 26507 26522 Routine mission operations 1653 24/09/13 267 26523 26539 Routine mission operations 1654 25/09/13 268 26540 26555 Routine mission operations 1655 26/09/13 269 26556 26571 Routine mission operations 1656 27/09/13 270 26572 26587 Routine mission operations 1657 28/09/13 271 26588 26603 Routine mission operations 1658 29/09/13 272 26604 26619 Routine mission operations 1659 30/09/13 273 26620 26636 - Thermal configuration for ICM calibration 1660 01/10/13 274 26637 26652 Start of ICM calibration 1661 02/10/13 275 26653 26668 - End of ICM calibration - Thermal configuration after ICM calibration - Monthly maintenance activities (STR image dump, EGG CRC check) 1662 03/10/13 276 26669 26684 Routine mission operations 1663 04/10/13 277 26685 26700 Routine mission operations 1664 05/10/13 278 26701 26716 TMM FDIR trigger after execution of OBCP 5451 1665 06/10/13 279 26717 26733 Routine mission operations

Page 191/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1666 07/10/13 280 26734 26749 EGG TCEU_DIAGNOSE packet enabled 1667 08/10/13 281 26750 26765 Routine mission operations 1668 09/10/13 282 26766 26781 Routine mission operations 1669 10/10/13 283 26782 26797 Routine mission operations 1670 11/10/13 284 26798 26813 Routine mission operations 1671 12/10/13 285 26814 26829 Routine mission operations 1672 13/10/13 286 26830 26846 Routine mission operations 1673 14/10/13 287 26847 26862 Routine mission operations 1674 15/10/13 288 26863 26878 Routine mission operations 1675 16/10/13 289 26879 26894 TMM FDIR trigger after execution of OBCP 5451 1676 17/10/13 290 26895 26910 - TMM FDIR trigger after execution of OBCP 5451 - Xenon tank pressure of 2.5 bar reached 1677 18/10/13 291 26911 26926 Routine mission operations 1678 19/10/13 292 26927 26943 Routine mission operations 1679 20/10/13 293 26944 26959 - Highly degraded IPA performance at low pressures - TMM FDIR trigger during execution of OBCP 5451 1680 21/10/13 294 26960 26975 - Fuel depletion: fallback from DFM_FINE to FPM - S/C configuration for orbital decay 1681 22/10/13 295 26976 26991 Routine operations in FPM 1682 23/10/13 296 26992 27007 Acquisition of STR-3 images 1683 24/10/13 297 27008 27023 Acquisition of CESS diagnostics 1684 25/10/13 298 27024 27040 Routine operations in FPM 1685 26/10/13 299 27041 27056 Routine operations in FPM 1686 27/10/13 300 27057 27072 - Update of G3 thresholds for CPM - Acquisition of CESS diagnostics 1687 28/10/13 301 27073 27088 Acquisition of STR-3 images 1688 29/10/13 302 27089 27104 Routine operations in FPM 1689 30/10/13 303 27105 27121 Acquisition of CESS diagnostics 1690 31/10/13 304 27122 27137 - Acquisition of STR-3 images - Enabling of FPM diagnostics packets 1691 01/11/13 305 27138 27153 Disabling of autonomous transitions CPM>ECPM>FPM 1692 02/11/13 306 27154 27169 Acquisition of CESS diagnostics 1693 03/11/13 307 27170 27186 Acquisition of STR-3 images 1694 04/11/13 308 27187 27202 Acquisition of STR-3 images and CESS diagnostics 1695 05/11/13 309 27203 27218 Acquisition of STR-3 images and CESS diagnostics 1696 06/11/13 310 27219 27234 - Disabling of on-board eclipse table - Acquisition of STR-3 images and CESS diagnostics 1697 07/11/13 311 27235 27251 - SSTI-B brought into DFACS control loop - Acquisition of STR-3 images and CESS diagnostics

Page 192/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0 ESA UNCLASSIFIED – For Official Use

Mission Date DoY First Last Main Activity Day Orbit # Orbit # 1698 08/11/13 312 27252 27267 - Mode transition durations of CPM minimised and automatic transitions to ECPM and FPM enabled (configuration for high drag) - Linear acceleration measurements of the Gradiometer saturated for the first time due to high drag - Acquisition of STR-3 images and CESS diagnostics 1699 09/11/13 313 27268 27284 - Removal of light passivation sequence from MTL - Acquisition of STR-3 images and CESS diagnostics - Start of significant S/C temperatures increase 1700 10/11/13 314 27285 27300 - Disabling of PASW FDIR, HW DNEL and TMM FDIR - Gradiometer switch off - Acquisition of STR-3 images and CESS diagnostics - Last S/C visibility on Troll at 314.22.42 - Re-entry of GOCE at 315.00.16 close to the Falklands

Page 193/193 GOCE End-of-Mission Operations Report Date 07/02/2014 Issue 1 Rev 0