entinel ystem equirements ocumentemits.sso.esa.int/emits-doc/annex-a_s3-rs-esa-sy-0010_i2... ·...

European Space Agency Agence spatiale européenne

ESTEC Keplerlaan 1 - 2201 AZ Noordwijk - The Netherlands Tel. +31 71 565 4458 - Fax +31 71 565 3191

S3-RS-ESA-SY-0010_I2r1_S3-SRD.doc

document title/ titre du document

ENTINEL

YSTEM EQUIREMENTS OCUMENT

prepared by/préparé par GMES Sentinel-3 Team reference/réference S3-RS-ESA-SY-0010 issue/édition 2 revision/révision 1 date of issue/date d’édition 15 February 2007 status/état Final Document type/type de document Requirement Specification Distribution/distribution

GMES Sentinel-3 System Requirements Document

Issue 2 revision 1 S3-RS-ESA-SY-0010

page 2 of 203

A P P R O V A L

Title titre

System Requirements Document issue issue

2 revisionrevision

1

author auteur

GMES Sentinel-3 Team date date

15/02/2007

checked by verifié par

Constantin Mavrocordatos date date

15/02/2007

approved by approuvé par

Bruno Berruti date date

15/02/2007

C H A N G E L O G

reason for change /raison du changement issue/issue revision/revision date/date

Update for phase B2/C/D/E1 ITT 1 0 25/01/2007

Update prior to TEB Panel review 2 0 05/02/2007

Update following TEB panel review 2 1 15/02/2007



page 3 of 203

C H A N G E R E C O R D

reason for change/raison du changement page(s)/page(s) paragraph(s)/paragraph(s)

First Issue for Pre-TEB All All

Second Issue before Pre-TEB All All

Revision after Pre-TEB All All



page 4 of 203

T A B L E O F C O N T E N T S

1 INTRODUCTION ..........................................................................................13

1.1 Scope................................................................................................................................................13 1.2 Document Conventions..................................................................................................................13 1.3 Terminology....................................................................................................................................14

2 DOCUMENTS...............................................................................................15

2.1 Normative Documents ...................................................................................................................15 2.1.1 Documents applicable to the Work ..........................................................................................15 2.1.2 Standards and Regulations .......................................................................................................15

2.2 Reference Documents ....................................................................................................................16

3 TECHNICAL ASSUMPTIONS......................................................................18

3.1 Mission Concept .............................................................................................................................18 3.2 Mission Objectives .........................................................................................................................19

3.2.1 Operational Oceanography ......................................................................................................20 3.2.2 Global Land Applications ........................................................................................................20

3.3 Ground Segment System Overview..............................................................................................20 3.3.1 Ground Segment operational concept ......................................................................................20 3.3.2 Ground Segment Functions......................................................................................................21 3.3.3 Ground Segment products........................................................................................................22

3.3.3.1 Surface Colour .....................................................................................................................22 3.3.3.2 Surface temperature.............................................................................................................22 3.3.3.3 Vegetation products .............................................................................................................23 3.3.3.4 Surface Topography.............................................................................................................23

3.4 Mission Phases................................................................................................................................24 3.4.1 Pre-Launch Phase.....................................................................................................................24 3.4.2 Launch and Early Orbit Phase (LEOP)....................................................................................24 3.4.3 Commissioning Phase ..............................................................................................................24 3.4.4 Routine Phase...........................................................................................................................25 3.4.5 Emergency Phase .....................................................................................................................25 3.4.6 Disposal Phase .........................................................................................................................25

4 SYSTEM REQUIREMENTS .........................................................................26

4.1 Sentinel-3 Space Segment..............................................................................................................26 4.2 Sentinel-3 Payload..........................................................................................................................26



page 5 of 203

4.3 Observation requirements.............................................................................................................27

4.3.1 Coverage ..................................................................................................................................27 4.3.1.1 Surface Colour .....................................................................................................................27 4.3.1.2 Surface Temperature............................................................................................................27 4.3.1.3 Surface topography ..............................................................................................................28

4.3.2 Pointing and Geolocation of Measurements ............................................................................29 4.3.3 Timeliness Requirements .........................................................................................................30

4.4 Orbit ................................................................................................................................................30 4.4.1 Injection Orbit ..........................................................................................................................30 4.4.2 Initial Orbit Acquisition ...........................................................................................................30 4.4.3 Operational Reference Orbit ....................................................................................................30 4.4.4 Launch Window.......................................................................................................................31

4.5 Launcher Requirements ................................................................................................................31 4.6 Ground Segment Interfaces ..........................................................................................................32

4.6.1 TT&C .......................................................................................................................................32 4.6.2 Mission Data ............................................................................................................................32

4.7 Protection of Radio Frequency Services ......................................................................................33 4.8 Satellite Modes................................................................................................................................34

4.8.1 Satellite Modes general requirements ......................................................................................34 4.8.2 Satellite mode before launch....................................................................................................35 4.8.3 Satellite mode during LEOP ....................................................................................................35 4.8.4 Satellite modes during commissioning and routine phase .......................................................35 4.8.5 Satellite safe mode ...................................................................................................................36 4.8.6 Payload modes .........................................................................................................................37

4.9 Operability Requirements .............................................................................................................37 4.9.1 General requirements ...............................................................................................................37 4.9.2 Observability requirements ......................................................................................................38 4.9.3 Commandability requirements .................................................................................................42

4.10 Security Requirements ..................................................................................................................45 4.11 Autonomy and fault management ................................................................................................46

4.11.1 Autonomy.................................................................................................................................46 4.11.2 Fault Management....................................................................................................................46

4.12 Time management..........................................................................................................................48

5 PAYLOAD REQUIREMENTS ......................................................................51

5.1 General ............................................................................................................................................51 5.1.1 Optical Payload ........................................................................................................................51

5.1.1.1 Terms and definitions for Optical Payload..........................................................................51 5.1.1.2 Geophysical Assumptions ....................................................................................................55

5.1.1.2.1 Signal Levels ...............................................................................................................................55 5.1.1.2.2 Sun-Glint Zone ............................................................................................................................55



page 6 of 203

5.1.1.2.3 Extraterrestrial solar irradiance ...................................................................................................56

5.1.1.3 Inter-Instruments requirements............................................................................................56 5.1.2 Surface Topography Payload ...................................................................................................56

5.1.2.1 Terms and definitions for the Topography Payload ............................................................56 5.2 Ocean and Land Colour Instrument (OLCI) ..............................................................................57

5.2.1 General Requirements..............................................................................................................57 5.2.2 Functional and Operational Requirements...............................................................................58 5.2.3 Contamination..........................................................................................................................59 5.2.4 Instrument modes .....................................................................................................................59 5.2.5 Design Requirements ...............................................................................................................60

5.2.5.1 Spectral Requirements .........................................................................................................60 5.2.5.2 Geometrical Requirements...................................................................................................61 5.2.5.3 MTF......................................................................................................................................61 5.2.5.4 Polarisation..........................................................................................................................62 5.2.5.5 Recovery from bright target .................................................................................................62 5.2.5.6 Straylight ..............................................................................................................................62

5.2.6 Image Quality Requirements ...................................................................................................62 5.2.6.1 Radiometric Image Quality ..................................................................................................62 5.2.6.2 Spectrometric Image Quality ...............................................................................................63

5.2.7 Pre-launch Characterisation .....................................................................................................63 5.3 SLST................................................................................................................................................65

5.3.1 General Requirements..............................................................................................................65 5.3.2 Functional and Operational Requirements...............................................................................65 5.3.3 Contamination..........................................................................................................................66 5.3.4 Instrument modes .....................................................................................................................66 5.3.5 Design Requirements ...............................................................................................................67

5.3.5.1 Spectral Requirements .........................................................................................................67 5.3.5.2 Geometrical Requirements...................................................................................................68 5.3.5.3 Polarisation..........................................................................................................................69 5.3.5.4 Recovery from bright target .................................................................................................69 5.3.5.5 Straylight ..............................................................................................................................69

5.3.6 Image Quality Requirements ...................................................................................................69 5.3.6.1 Radiometric Image Quality ..................................................................................................69

5.3.7 Active Fires ..............................................................................................................................70 5.3.8 Pre-launch Characterisation .....................................................................................................71

5.4 Radar altimeter instrument ..........................................................................................................73 5.4.1 General Requirements..............................................................................................................73 5.4.2 Instrument Modes ....................................................................................................................73

5.4.2.1 Measurement and Tracking Modes......................................................................................73 5.4.2.2 Calibration modes................................................................................................................75 5.4.2.3 Support modes......................................................................................................................75 5.4.2.4 Mode transitions ..................................................................................................................75

5.4.3 Functional Requirements .........................................................................................................76 5.4.3.1 Low Resolution Mode Functional Requirements .................................................................76



page 7 of 203

5.4.3.2 SAR Mode Functional Requirement.....................................................................................77

5.4.4 Performance Requirements ......................................................................................................79 5.4.4.1 General Performance Requirements....................................................................................79

5.4.4.1.1 General Radiometric Performance Requirements .......................................................................79 5.4.4.1.2 General Timing Performance Requirements ...............................................................................79 5.4.4.1.3 General Echo Fidelity Requirements...........................................................................................80

5.4.4.2 Low Resolution Mode Performance Requirements..............................................................80 5.4.4.2.1 Radiometric requirements ...........................................................................................................80 5.4.4.2.2 Tracking.......................................................................................................................................81

5.4.4.3 SAR Mode Performance Requirements................................................................................81 5.4.4.3.1 Radiometric Requirements ..........................................................................................................81 5.4.4.3.2 Tracking.......................................................................................................................................81 5.4.4.3.3 Along-Track Impulse Response ..................................................................................................81 5.4.4.3.4 Range Ambiguities ......................................................................................................................82

5.4.4.4 End-to-end performance requirements ................................................................................82 5.4.5 Calibration requirements..........................................................................................................82

5.4.5.1 On-Ground Characterisation...............................................................................................82 5.4.5.2 In-flight Calibration.............................................................................................................83

5.4.5.2.1 Internal Calibration......................................................................................................................83 5.4.5.2.2 External Calibration.....................................................................................................................83

5.4.6 Datation Requirements.............................................................................................................83 5.5 Microwave Radiometer (MWR) ...................................................................................................84

5.5.1 General Requirements..............................................................................................................84 5.5.1.1 Frequency Channels and Integration Time .........................................................................84 5.5.1.2 Measurement Geometry .......................................................................................................84 5.5.1.3 Instrument Modes.................................................................................................................85 5.5.1.4 Field-of View Interface Requirement ...................................................................................85

5.5.2 Functional Requirements .........................................................................................................85 5.5.3 Performance Requirements ......................................................................................................85

5.5.3.1 Radiometric performance ....................................................................................................85 5.5.3.2 Antenna Performance ..........................................................................................................86 5.5.3.3 Radiofrequency Interference................................................................................................86

5.5.4 Calibration Requirements ........................................................................................................86 5.5.4.1 On-Ground Calibration/Characterisation...........................................................................86 5.5.4.2 In-Flight Calibration............................................................................................................86

5.5.5 Datation Requirements.............................................................................................................87 5.6 GNSS Tracking Equipment ..........................................................................................................87

5.6.1 General Requirements..............................................................................................................87 5.6.1.1 Instrument Modes.................................................................................................................88 5.6.1.2 Coverage ..............................................................................................................................88 5.6.1.3 Lifetime and Reliability ........................................................................................................88

5.6.2 Functional Requirements .........................................................................................................88 5.6.3 Performance Requirements ......................................................................................................88

5.6.3.1 Near Real Time ....................................................................................................................89 5.6.3.2 Slow Time Critical ...............................................................................................................89



page 8 of 203

5.6.3.3 Non Time Critical.................................................................................................................89 5.6.3.4 Real Time Navigation Solution ............................................................................................89

5.6.4 Datation Requirements.............................................................................................................90 5.7 Laser retroreflector (LRR) ...........................................................................................................90 5.8 Fire Instrument ..............................................................................................................................91

6 SATELLITE REQUIREMENTS ....................................................................92

6.1 Attitude and orbit determination and control.............................................................................92 6.1.1 AOCS General Requirements ..................................................................................................92 6.1.2 Guidance modes.......................................................................................................................93

6.1.2.1 Initial Rate damping.............................................................................................................93 6.1.2.2 Emergency Safe Attitude mode (ESAM)...............................................................................93 6.1.2.3 Earth pointing mode (EPM).................................................................................................94 6.1.2.4 Yaw steering sub-mode ........................................................................................................94 6.1.2.5 Geodetic pointing sub-mode ................................................................................................94 6.1.2.6 Flight path pointing sub-mode.............................................................................................95

6.1.3 Navigation................................................................................................................................95 6.1.3.1 Attitude navigation...............................................................................................................96 6.1.3.2 Orbit navigation...................................................................................................................96

6.1.3.2.1 Orbital events prediction .............................................................................................................97 6.1.3.2.2 Orbit reconstruction.....................................................................................................................97 6.1.3.2.3 Navigation in Rate damping mode and ESAM ...........................................................................97

6.1.4 Control .....................................................................................................................................98 6.1.4.1 Attitude control ....................................................................................................................98

6.1.4.1.1 Attitude control during ESAM ....................................................................................................98 6.1.4.1.2 Sun avoidance..............................................................................................................................98 6.1.4.1.3 Attitude offset..............................................................................................................................98 6.1.4.1.4 Autonomous slewing ...................................................................................................................98 6.1.4.1.5 Robustness...................................................................................................................................99 6.1.4.1.6 Tuning .........................................................................................................................................99

6.1.4.2 Orbit control (propulsion) ...................................................................................................99 6.1.4.2.1 Propulsion system performances ...............................................................................................101 6.1.4.2.2 Propulsion fuel gauging.............................................................................................................101 6.1.4.2.3 Orbit maintenance .....................................................................................................................101 6.1.4.2.4 Actuator calibration ...................................................................................................................102 6.1.4.2.5 Collision avoidance ...................................................................................................................102 6.1.4.2.6 End-of-life disposal ...................................................................................................................102

6.1.4.3 Momentum control .............................................................................................................102 6.1.5 FDIR.......................................................................................................................................102

6.2 Communications...........................................................................................................................103 6.2.1 General Requirements............................................................................................................103 6.2.2 Tracking, Telemetry and Command (TT&C) Requirements.................................................104

6.2.2.1 Functional requirements ....................................................................................................104 6.2.2.2 Performance requirements.................................................................................................106



page 9 of 203

6.2.3 X-band Mission Data Telemetry Downlink (MDTD) requirements......................................106

6.2.3.1 Functional requirements ....................................................................................................106 6.2.3.2 Design requirements ..........................................................................................................107 6.2.3.3 Performance requirements.................................................................................................108

6.3 Command, data handling, monitoring and control ..................................................................108 6.4 Electrical Requirements ..............................................................................................................110

6.4.1 Power generation and distribution .........................................................................................110 6.4.1.1 Functional Requirements ...................................................................................................110 6.4.1.2 Design requirements on power system...............................................................................111

6.4.1.2.1 General ......................................................................................................................................111 6.4.1.2.2 Solar array .................................................................................................................................114 6.4.1.2.3 Battery .......................................................................................................................................115

6.4.2 General Electrical Design Requirements ...............................................................................117 6.4.2.1 Harness ..............................................................................................................................117 6.4.2.2 Data bus .............................................................................................................................119 6.4.2.3 Electromagnetic compatibility ...........................................................................................119 6.4.2.4 Multipaction and gas discharge.........................................................................................119 6.4.2.5 Radiation tolerant design...................................................................................................119

6.5 Structure, Mechanisms and Pyrotechnics Requirements ........................................................120 6.5.1 Structure .................................................................................................................................120

6.5.1.1 Functional requirements ....................................................................................................120 6.5.1.2 Design requirements ..........................................................................................................121

6.5.1.2.1 General ......................................................................................................................................121 6.5.1.2.2 Fracture control requirements....................................................................................................122 6.5.1.2.3 Strength .....................................................................................................................................124 6.5.1.2.4 Mechanical Loads Factors .........................................................................................................124 6.5.1.2.5 Notching ....................................................................................................................................126 6.5.1.2.6 Corrosion ...................................................................................................................................127

6.5.2 Mechanisms ...........................................................................................................................128 6.5.2.1 Functional Requirements ...................................................................................................128 6.5.2.2 Design requirements ..........................................................................................................128

6.5.2.2.1 Reliability ..................................................................................................................................128 6.5.2.2.2 Redundancy ...............................................................................................................................128 6.5.2.2.3 Factors of safety (FOS) .............................................................................................................129 6.5.2.2.4 Functional dimensioning (motorisation) ...................................................................................129 6.5.2.2.5 Status monitoring.......................................................................................................................133 6.5.2.2.6 Life test duration........................................................................................................................133

6.5.3 Pyrotechnics Requirements....................................................................................................134 6.6 Satellite Configuration Requirements........................................................................................134 6.7 Thermal Requirements................................................................................................................135

6.7.1 General ...................................................................................................................................135 6.7.2 Functional Requirements .......................................................................................................135 6.7.3 Design Requirements .............................................................................................................136 6.7.4 Thermal Analysis and Verification Requirements.................................................................138



page 10 of 203

6.8 Space Environment Models, Constants and Units ....................................................................139

6.8.1 Measurement Units ................................................................................................................139 6.8.2 Gravity Model and Reference Ellipsoid.................................................................................140 6.8.3 Magnetic field ........................................................................................................................140 6.8.4 Atomic Oxygen Environment ................................................................................................140 6.8.5 Charged Particle Radiation ....................................................................................................140 6.8.6 Atmosphere ............................................................................................................................140 6.8.7 Solar Activity .........................................................................................................................140 6.8.8 Thermal Environment ............................................................................................................141

6.8.8.1 Solar constant ....................................................................................................................141 6.8.8.2 Earth Albedo and Infrared Emission .................................................................................141

6.9 Dependability................................................................................................................................141 6.9.1 Lifetime..................................................................................................................................141 6.9.2 Reliability...............................................................................................................................141 6.9.3 Availability.............................................................................................................................142 6.9.4 Maintainability .......................................................................................................................142 6.9.5 Fault-tolerance Failure propagation .......................................................................................142

6.10 Software requirements ................................................................................................................143 6.10.1 Software Engineering Requirements .....................................................................................143 6.10.2 Software Functional and operational requirements ...............................................................146

6.11 Satellite budgets............................................................................................................................148 6.11.1 General ...................................................................................................................................148 6.11.2 Mass .......................................................................................................................................149 6.11.3 Power .....................................................................................................................................149 6.11.4 Pointing, geo-location and co-registration .............................................................................150 6.11.5 Radio communication link budgets........................................................................................150

7 SATELLITE ASSEMBLY, INTEGRATION AND VERIFICATION REQUIREMENTS...................................................................................................151

7.1 Terrestrial Environment .............................................................................................................151 7.2 Integration Requirements ...........................................................................................................152 7.3 Verification Requirements ..........................................................................................................152

7.3.1 Test requirements ...................................................................................................................154 7.4 Model Philosophy.........................................................................................................................154 7.5 Ground Support Equipment .......................................................................................................155

7.5.1 Software Development and Verification Environment..........................................................156 7.5.2 RF suitcase .............................................................................................................................157

7.5.2.1 S-band ................................................................................................................................157 7.5.2.2 X-band................................................................................................................................157



page 11 of 203

8 GROUND PROCESSING AND SYSTEM SIMULATION REQUIREMENTS 158

8.1 System Performance Simulator ..................................................................................................158 8.2 Ground Processor Prototype.......................................................................................................159 8.3 Level-2 Basic Processor ...............................................................................................................160

APPENDIX A: REFERENCE FRAMES...............................................................162

A.1 Inertial Reference frame..............................................................................................................162 A.2 Terrestrial Reference frame........................................................................................................162 A.3 Orbital frame................................................................................................................................162 A.4 Geodetic pointing frame. .............................................................................................................162 A.5 Yaw steering frame. .....................................................................................................................162 A.6 Flight path frame .........................................................................................................................163 A.7 Sun pointing frame.......................................................................................................................163 A.8 SC control frame. .........................................................................................................................163

APPENDIX B: TIME REFERENCES ...................................................................164

APPENDIX C: POINTING METRICS...................................................................165

C.1 Attitude pointing error ................................................................................................................165 C.2 Relative pointing error ................................................................................................................165 C.3 Absolute measurement error ......................................................................................................165 C.4 Budgets summation rule..............................................................................................................165 C.5 APE summation rule....................................................................................................................165 C.6 RPE summation rule....................................................................................................................167 C.7 AME summation rule ..................................................................................................................167

APPENDIX D: GENERAL ERROR DEFINITION AND ERROR COMPILATION METHOD 168

D.1 Scope..............................................................................................................................................168 D.2 Error Characterisation For General Error Sources.................................................................168

D.2.1 Bias Errors..............................................................................................................................168 D.2.2 Drift Errors .............................................................................................................................168 D.2.3 Harmonic Errors.....................................................................................................................168 D.2.4 Random Errors .......................................................................................................................169

D.3 Compilation Of Error Sources....................................................................................................169 D.3.1 Bias and Drift Errors ..............................................................................................................169



page 12 of 203

D.3.2 Harmonic Errors.....................................................................................................................169 D.3.3 Random Errors .......................................................................................................................170 D.3.4 Total Errors ............................................................................................................................170 D.3.5 Calibration..............................................................................................................................170

APPENDIX E: APPLICABILITY OF ECSS STANDARDS..................................171

E.1 ECSS-E-10-02A Verification (17 November 1998) ...................................................................171 E.2 ECSS-E-10-03A Testing (15 February 2002).............................................................................173 E.3 ECSS-E-20A Electrical and Electronic (4 October 1999) ........................................................175 E.4 ECSS-E-20-01A Multipaction design and test (5 May 2003) ...................................................177 E.5 ECSS-E-20-08A Photovoltaic assemblies and components (30 November 2004) ..................177 E.6 ECSS-E-30 Part 1A Mechanical - Part 1 Thermal Control (25 April 2000)l .........................178 E.7 ECSS-E-30 Part 2A Mechanical - Part 2 Structural (25 April 2000)......................................180 E.8 ECSS-E-30 Part 3A Mechanical - Part 3 Mechanisms (25 April 2000) ..................................180 E.9 ECSS-E-30 Part 5.1A: Mechanical - Part 5.1: Liquid and electric propulsion for Spacecraft (2 April 2002) ............................................................................................................................................184 E.10 ECSS-E-30 Part 6A Mechanical - Part 6 Pyrotechnics (25 April 2000) .................................186 E.11 ECSS-E-30 Part 7A Mechanical - Part 7 Mechanical parts (25 April 2000)..........................189 E.12 ECSS-E-30 Part 8A Mechanical - Part 8 Materials (25 April 2000) .......................................189 E.13 ECSS-E-30-11A Modal survey assessment (20 September 2005) ............................................192 E.14 ECSS-E-40 Part 1B Software – Part 1: Principles and requirements (28 November 2003) .192 E.15 ECSS-E-40 Part 2B Software – Part 2: Document requirements definitions (31 March 2005) 193 E.16 ECSS-E-50-02A Ranging and Doppler tracking (24 November 2005) ...................................194 E.17 ECSS-E-50-05A Radio frequency and modulation (24 January 2003)...................................194 E.18 ECSS-E-60A Control Engineering (4 September 2004) ...........................................................195 E.19 ECSS-E-70-41A Ground systems & operations: Telemetry & Telecommand packet utilization (30 January 2003)...................................................................................................................196

APPENDIX F: LIST OF ACRONYMS..................................................................197

APPENDIX G: GROUND STATIONS..................................................................201

G.1.1 TTC Ground Stations .............................................................................................................201 G.1.2 Core Mision data Ground Stations.........................................................................................201 G.1.3 Local Mission data ground stations .......................................................................................201



page 13 of 203

1 INTRODUCTION

1.1 Scope In the frame of the Global Monitoring for Environment and Security programme (GMES), ESA is undertaking the development of the Sentinel-3, a European polar orbit satellite system for the provision of operational marine and land services, based on optical and microwave Earth observation payload. The present document defines the technical requirements for the Space Segment of GMES Sentinel-3 System for phases B2-C/D-E1.

1.2 Document Conventions Within this SRD, requirements are enclosed within a square and identified by a unique alphanumeric code with the following format: LL-MM-DDD Where:

• LL refers to the highest-level of functional decomposition of the system (mandatory field).

• MM refers to the second-level of functional decomposition (optional field). • The digits DDD are requirements numbers. The sequence of these numbers may contain

gaps and is independent for each combination of LL-MM. Paragraphs without such annotation provide information. Some requirements are supported by explanatory comments that are indented between horizontal lines. Requirements marked TBC will be confirmed by the Agency. Requirements marked TBD shall be defined by the Contractor. Note: The Sentinel-3 system is built on a constellation of two similar Satellites operating simultaneously. Most of the requirements within the SRD would equally apply to all necessary Satellite models that are required to operate the Sentinel-3 system over at least 15 years. In case of specific requirement applicable to the twin Satellite constellation, the requirement is marked with an asterisk (*).



page 14 of 203

1.3 Terminology Terms and definitions are given in the sections where they are used. For the list of acronyms addressed throughout this document refer to Appendix F:



page 15 of 203

2 DOCUMENTS

2.1 Normative Documents The following documents are applicable to these requirements. In the case of conflicts between this document and the applicable documents the conflict shall be brought to the attention of the Customer for resolution.

2.1.1 DOCUMENTS APPLICABLE TO THE WORK The hierarchy of documents applicable to the Work is given in the Contract. Here following, only the documents called up within this SRD are listed: <ND1> The GMES Sentinel-3 Statement Of Work <ND2> S3-RS-ESA-SY-0002, “GMES Sentinel-3 Product Assurance Requirements” <ND3> S3-RS-ESA-SY-0006, Draft-2 “Operations Interface Requirements Document” <ND4> EGOS-MCS-S2K-ICD-0001, Issue 6.2. “SCOS-2000 Database Import ICD” <ND5> EGOS-MCS-S2K-ICD-0014, Issue 1.4. “SCOS-2000 On Board SW Maintenance ICD” <ND6> FIRE Interface Specifications for Sentinel-3, Issue 1 rev 0, S3-RS-ESA-SY-011 <ND7> VEGA User’s Manual, issue 3 rev 0, March 2006

2.1.2 STANDARDS AND REGULATIONS The applicability of each standard document is specified when referred to across this document. <SD1> ECSS-E-10-02A Verification (17 November 1998) <SD2> ECSS-E-10-03A Testing (15 February 2002) <SD3> ECSS-E-10-04A Space Environment (21 January 2000) <SD4> ECSS-E-10-05A Functional Analysis (13 April 1999) <SD5> ECSS-E-20A Electrical and Electronic (4 October 1999) <SD6> ECSS-E-20-01A Multipaction design and test (5 May 2003) <SD7> ECSS-E-20-08A Photovoltaic assemblies and components (30 November 2004) <SD8> ECSS-E-30 Part 1A Mechanical - Part 1 Thermal Control (25 April 2000) <SD9> ECSS-E-30 Part 2A Mechanical - Part 2 Structural (25 April 2000) <SD10> ECSS-E-30 Part 3A Mechanical - Part 3 Mechanisms (25 April 2000) <SD11> ECSS-E-30 Part 5.1A: Mechanical - Part 5.1: Liquid and electric propulsion for Spacecraft

(2 April 2002) <SD12> ECSS-E-30 Part 6A Mechanical - Part 6 Pyrotechnics (25 April 2000) <SD13> ECSS-E-30 Part 7A Mechanical - Part 7 Mechanical parts (25 April 2000) <SD14> ECSS-E-30 Part 8A Mechanical - Part 8 Materials (25 April 2000) <SD15> ECSS-E-30-01A, Fracture Control, 13 April 1999



page 16 of 203

<SD16> ECSS-E-30-11A Modal survey assessment (20 September 2005) <SD17> ECSS-E-40 Part 1B Software – Part 1: Principles and requirements (28 November 2003) <SD18> ECSS-E-40 Part 2B Software – Part 2: Document requirements definitions (31 March

2005) <SD19> ECSS-E-50 Part 1A Communications Principles and Requirements <SD20> ECSS-E-50-01 Draft 0.11 Telemetry Synchronisation and Channel Coding (August 2006) <SD21> ECSS-E-50-02A Ranging and Doppler tracking (24 November 2005) <SD22> ECSS-E-50-03 Draft 1.8.1 Packet Telemetry (July 2006) <SD23> ECSS-E-50-04A Draft 1.13 Packet Telecommand (August 2006) <SD24> ECSS-E-50-05A Radio frequency and modulation (24 January 2003) <SD25> ECSS-E-50-12A SpaceWire - Links nodes, routers and networks (24 January 2003) <SD26> ECSS-E-60A Control Engineering (4 September 2004) <SD27> ECSS-E-70-41A Ground systems & operations: Telemetry & Telecommand packet

utilization (30 January 2003) <SD28> ECSS-Q-70B, Materials, mechanical parts and processes, (14 December 2004) <SD29> ECSS-Q-70-36A, Material selection for controlling stress-corrosion cracking, (20 January

1998) <SD30> CCSDS-301.0-B-3. CCSDS Unsegmented Time Code Standard <SD31> CCSDS-732.0-B-1. AOS Space Data Link Protocol. Blue Book <SD32> CCSDS 133.0-B-1 Space Packet Protocol <SD33> CCSDS 121.0-B-1 Lossless Compression <SD34> The Solar Spectral Irradiance from 200 to 2400 nm as Measured by the SOLSPEC

Spectrometer from the Atlas and Eureca Missions (available as attachment to ECSS-E20-08)

<SD35> ITU Radio Regulations

2.2 Reference Documents These documents are to be considered as guidelines where called up. <RD1> EOP-SMO/1151/MD-md, issue 2, “Sentinel-3 Mission Requirements” <RD2> Eigen-GL04C Combined Gravity Field Model, GeoForschungsZentrum (GFZ) Postdam,

http://www.gfz-potsdam.de/pb1/op/grace/results/ <RD3> Department of Defense World Geodetic System 1984 - Its Definition and Relationships

with Local geodetic Coordinate Systems, DMA Technical Report 8350.2, US Department of Defense, 1987

<RD4> IGRF-10, International Association of Geomagnetism and Aeronomy, 2005, http://www.ngdc.noaa.gov/IAGA/vmod/)

<RD5> Final Report of the European Diode Working Group, Dutch Space reference DS-SA&L-R-2006-006 issue 1 (Restricted distribution, provided on request)

<RD6> ACE GDEM, De Montfort University, Earth and Planetary Remote Sensing Laboratory, http://www.cse.dmu.ac.uk/EAPRS/products_ace_overview.html

<RD7> GLOBE GDEM, NOAA National Geophysical Data Center (NGDC), http://www.ngdc.noaa.gov/mgg/topo/globe.html

<RD8> Ground Segment File Format standard, PE-TN-ESA-GS-0001 <RD9> S3-RS-ESCA-FS-5000, issue 1, “Sentinel-3 Mission Analysis Guidelines”



page 17 of 203

<RD10> European Code of Conduct for Space Debris Mitigation, issue 1.0, 28 June 2004 <RD11> FIRS 197 from the NIST, Advanced Encryption Standard, November 2001 <RD12> ESA Pointing Error Handbook, EHB.DRG.REP.002 <RD13> The Average Impulse Response of a Rough Surface and its Applications, G.S. Brown,

IEEE Trans. on Antennas and Propagation, AP-25, 1, p.67, 1977. <RD14> Radar Altimeter Mean Return Waveforms from Near-Normal-Incidence Ocean Surface

Scattering, G.S. Hayne, IEEE Trans. Antennas and Propagation, AP-28, No 5, Sep.1980 <RD15> NASA-TM-2001-211221-thermal-environment-for-spacecraft-design-from-NTRS <RD16> DOPS-GS-RM-001-OPS-OSA, issue 1, “Principles and Guidelines for the FOS of an Earth

Observation Mission”



page 18 of 203

3 TECHNICAL ASSUMPTIONS This Chapter contains technical assumptions which shall be used as guidelines for the Sentinel-3 mission and as the boundary conditions for the requirements defined in subsequent Chapters. Consequently these definitions and assumptions will not themselves be verified as part of the system verification and therefore they do not carry Requirement Numbers.

3.1 Mission Concept Sentinel-3 mission is part of the GMES system, which is designed to provide an independent and operational information capacity to the European Union to warrant environment and security policies and to support sustainable economic growth. Sentinel-3 spacecraft will carry a set of optical and microwave instruments, and will ensure the provision of Ocean observation data in routine, long term and continuous fashion with a consistent quality and a very high level of availability. In addition, the mission will be designed to generate Land optical observation products, ice topography and land hydrology products. The fulfilment of Sentinel-3 mission requires the concurrent operations of two similar satellites. In addition, in order to meet the time reach requirements, a larger number of spacecrafts are needed over the full duration of the mission. The different elements composing Sentinel-3 system and the related interfaces for the provision of the operational marine and land services are shown in Figure 2.1.2-1. The following elements form part of Sentinel-3 system:

• Sentinel-3 satellite(s), which produce and downlink the observation data • Flight operations and satellite control segment (FOS), which monitor and control the

status of the satellite(s) (see <RD16>) • Ground stations, which send commands and receive housekeeping telemetry produced by

the platform and the instruments. • Ground stations, which receive payload data and platform housekeeping data stored on-

board. • Payload data ground segment (PDGS) that process and archive the information provided

by the satellites. They also monitor the short and long term quality of the instruments, possibly supported by modellers.

• The elements providing POD and other corrections that will be necessary to allow for proper level 2 altimetry product generation. This element can also be considered as forming part of the PDGS.

This division in elements does not prejudge the actual allocation of functions to facilities. As far as it is necessary for proper apportioning of requirements and for identification of interfaces, this specification may result in requirements for all of the functional blocks.



page 19 of 203

Figure 2.1.2-1 Sentinel-3 elements and external interfaces

The following elements, considered as external to Sentinel-3 system, are also necessary to provide services:

• Ocean modellers, which ingest and assimilate in the ocean models the data provided by Sentinel-3 and other sources and generate ocean forecasts

• Value adders that enhance the forecasts and customise them according to the need of the local users

• Thematic centres that deliver specialised products, based in information provided by several satellites, e.g. multi-satellite derived SST maps

• Ocean in-situ data collecting devices: buoys, tidal gauges… • Atmospheric data needed to run the ocean models, which actually are coupled ocean /

atmosphere model • Network of Laser tracking stations, providing ranging data for improvement and

verification of POD • Local stations, receiving regional payload raw data • External calibration targets, sites or devices, needed for periodic in-flight calibration of

the payload instruments This document does not place requirements over these external elements, nevertheless a proper design of Sentinel-3 needs understanding of their functions and analysis over the interface requirements necessary for a proper delivery of services.

3.2 Mission Objectives The mission objectives are defined in <RD1>. The main lines are summarised below for convenience.

Final Users

Sentinel 3Jason like (low

inclination) satellite

In situ data

FOS

Modelers Value Adders

Run Ocean & Atmosphere Assimilation

Models

Add local and specialized data and customize

Multi source inter-calibratedLevel 3 and 4 data

Local data

Provides SC & GPSprecise orbit data

POD

Service SegmentMarineCore

Services

NPOESSMETOP

ExternalGround Segments

Overall dataStream

Command &Telemetry

S3 TTCGround Station

S3 downloadGround Stations

Sentinel 3System

Operatesthe satellites

Level 0

Instrument VerificationStatus, Auxiliary Data,

Mission Planning

Auxiliary Data(Meteo, Solar Activity Index…)

PDGSProcess, CalibrateAnd Archive Data

NRT, STC & NTCLevels 1 and 2 data

PartnersGround Stations

NRT, STC & NTCLevels 1 and 2 data

Users

Requests

ProductFeedback

Oceanforecasts

SpecialisedServices

Oceanforecasts

LandCore

Services

Thematic centersProcessing multi-mission

data & generatinghigher level products

Assembly CentersThematic centers

Processing multi-missiondata & generating

higher level products

Productfeedback

Assembly Centers



page 20 of 203

3.2.1 OPERATIONAL OCEANOGRAPHY The Sentinel-3 will concentrate on the delivery of information needed to constrain and drive global and local ocean assimilation models ⎯ actually, coupled ocean/atmosphere assimilation models. For this, Sentinel-3 will deliver:

• Sea colour data, at least at the level of quality of Meris on Envisat; • Sea surface temperature, at least at the level of quality of AATSR on Envisat; • Sea surface topography data at least at the level of quality of the Envisat altimetric

system, including in particular an along-track SAR capability for addressing coastal zones sea surface topography and sea ice topography.

3.2.2 GLOBAL LAND APPLICATIONS Taking into account the users’ need for moderate resolution and wide swath, the Sentinel-3 will deliver information needed to derive global land products and services. These are:

• Land surface colour at least at the level of quality of Meris on Envisat; • Land surface temperature, at least at the level of quality of AATSR on Envisat; • Land ice topography and inland water surface height data. • Vegetation products, based on synergetic measurements from optical instruments

3.3 Ground Segment System Overview

3.3.1 GROUND SEGMENT OPERATIONAL CONCEPT The GMES Sentinel-3 Ground Segment will support the mission operations of a system of two Satellites in orbit over a period of at least 15 years following the launch of the first Satellite.

Over that period, the Ground Segment will be able to support different Sentinel-3 mission configurations, involving up to three satellites in orbit (either being operational, in commissioning, or in stand-by). The operational in orbit twin Satellite configuration will be monitored and controlled through a single Ground Station during the routine phase. Two or more ground stations may be used during the LEOP phase of each satellite. The mission data will be stored on-board and transmitted to X-band ground stations. For sizing purposes, a single receiving station located in Svalbard will be assumed. In case of temporary un-availability of this station, alternative receiving stations would be used. In addition, a set of local stations (not forming part of the Sentinel-3 System) will be used to receive real time data, acquired during the time the satellite is in visibility from these stations. Dumping data to the local stations will not affect the contents of the data transmitted to the reference X-band stations.



page 21 of 203

3.3.2 GROUND SEGMENT FUNCTIONS The GMES Sentinel-3 Ground Segment will encompass the Flight Operations Segment (FOS) and the Payload Data Ground Segment (PDGS). More specifically these two major Ground Segment functionalities will provide: a) Flight Operations (ensured for all Sentinel-3 satellites in flight)

• Mission Planning by means of a long term plan of spacecraft and payload activities, covering a complete orbit cycle of 27 days and repeating itself indefinitely, and by means of short term planning nominally every 2 weeks, in the form of updated mission schedules,

• Spacecraft status monitoring by means of processing the housekeeping telemetry such that the status of all spacecraft subsystems, and the attitude can be monitored. This function will be ensured for all Sentinel-3 satellites in flight.

• Spacecraft control, taking control actions by means of telecommands, based on the monitoring and following the Flight Operations Plan and the short-term plan.

• Orbit determination and control, using tracking data and implementing orbit manoeuvres, such that required orbital conditions are achieved.

• Attitude determination and control based on the processed attitude sensor data in the spacecraft monitoring and by commanded updates of control parameters in the on-board attitude control system.

• On-board software maintenance, integrating software images received from the spacecraft manufacturer (pre-launch and post-launch), including the instruments, into the telecommand process.

• Communications (TM/TC) with one satellite at a time b) Payload Data Operations (ensured for all operational Sentinel-3 satellites in flight)

• Acquisition of Mission data (X-band) from one satellite at a time • Production of Level-0 data, encompassing in particular de-cyphering,

demultiplexing and decompression • Production of L1 data • Production of L2 data (when applicable), using auxiliary data generated externally

from the Sentinel-3 system • Product Quality Control • Instrument calibration • Instrument monitoring • Long-term Archiving

The Ground Segment will also provide security functions as follows:

• Generation of the necessary set of crypto keys to govern the Sentinel-3 overall security system

• Encryption and authentication/signing of TC sent to the Satellites • Satellite X-Band Mission data decryption • Generation, periodic renewal, and distribution of core and local User Stations decryption

keys • Encrypted data transfer over ground networks



page 22 of 203

• Access control to Ground Segment archives and databases • Secure protection of database information containing sensitive Satellite or User data • Data de-classification strategy and potential impact on ground-segment facilities

including processing and User interfaces

3.3.3 GROUND SEGMENT PRODUCTS The ground segment of Sentinel-3 will deliver the following types of operational products:

• Surface colour products, produced from observations provided by OLCI • Surface temperature products, produced from SLST • Land vegetation products obtained by the synergetic processing of OLCI and SLST data • Surface topography products, derived from the combination of data produced by the:

Radar Altimeter, microwave radiometer and GNSS receiver. Additional auxiliary data from external sources will also be required to produce level-2 products.

Sentinel-3 data are provided at three level of timeliness:

• Near real-time (NRT) products, delivered to the users in less than 3 hours after the acquisition

• Short time critical (STC) products, delivered to the users in less than 48 hours after the acquisition

• Non-time critical (NTC) products, delivered 1 month after acquisition and archived A more detailed description of the different products is provided in the next sections.

3.3.3.1 Surface Colour Surface colour will be produced at level 1b. The level 1b data will be radiometrically calibrated, and ortho-geo-located. This product will be annotated with satellite position and attitude, geo-location information (Lat, Lon, Altitude) spectral characteristics (smile), geophysical information (ECMWF) and preliminary pixel classification (land, water, clouds ). The level 1b product consists of top of atmosphere spectral radiances in W m s2 sr-1 µm-1 for all the channels produced by the OLCI instrument and for the solar reflective channels of SLST. (Note: two separate products can be foreseen , one for OLCI and an other for SLST) These products will be provided with two level of timeliness:

• Level 1b , NRT 3 hours product, assuming 1 hour for ground processing and 2 hours for satellite acquisition and downlink.

• Archived product without any specific timeliness requirement

With adequate atmospheric correction, the Level 1b products can be further transformed into Level-2 Bottom of the Atmosphere surface leaving reflectance.

3.3.3.2 Surface temperature Surface temperature will be produced at level 1b. The level 1b data will be radiometrically calibrated, and ortho-geo-located. This product will be annotated with satellite position and attitude,



page 23 of 203

geo-location information (Lat, Lon, Altitude), geophysical information (ECMWF) and preliminary pixel classification (land, water, clouds ). The level 1b product consists of top of atmosphere brightness temperature in the thermal channels produced by the SLST instrument. As above, this product will be provided with two levels of timeliness:

• Level 1b, NRT 3 hours product, assuming 1 hour for ground processing and 2 hours for satellite acquisition and downlink

• Archived product without any specific timeliness requirement With adequate atmospheric correction, the Level 1b product can be further transformed into Level-2 surface temperature estimations.

3.3.3.3 Vegetation products Vegetation products will be produced at level 1c. This product will include all SLST and OLCI bands. The level 1b data will be radiometrically calibrated, and ortho-rectified (taking into account the different scanning pattern of both instruments this synergetic product will be re-sampled on a specific geographic grid using suitable interpolation techniques). This product will be annotated with satellite position and attitude, geo-location information (Lat, Lon, Altitude), geophysical information (ECMWF) and preliminary pixel classification (land, water, clouds ). As before this synergetic level 1c product will be delivered with two levels of timeliness:

• Level 1c , NRT 3 hours product, assuming 1 hour for ground processing and 2 hours for satellite acquisition and downlink.

• Archived product without any specific timeliness requirement With adequate atmospheric correction processing, the Level 1c products can be transformed into Level-2 Bottom of the Atmosphere geophysical parameters.

3.3.3.4 Surface Topography Surface topography will be produced at level 1b. The level 1b data are geo-located and calibrated radar echoes. This product will be annotated with all ancillary information needed for subsequent conversion into range from the satellite to the surface. Two Level 1b products are foreseen depending on the instrument mode (SAR or LRM). These products will be provided with three levels of timeliness:

• NRT 3 hours product, assuming 1 hour for ground processing and 2 hours for satellite acquisition and downlink. This product is equivalent to Fast Delivery Geophysical Data Records –FGDR

• STC, delivered in less than 2 days after the acquisition. At this stage, laser ranging from SLR ground stations will be used to improve and validate the quality of the precise orbit determination. This product is equivalent to Intermediate Geophysical Data Records (IGDR).



page 24 of 203

• Archived product without any specific timeliness requirement, equivalent to Geophysical

Data Records (GDR). After re-tracking and with the adequate propagation corrections applied, these level 1b products will be transformed into Level-2 surface elevation data.

3.4 Mission Phases

3.4.1 PRE-LAUNCH PHASE The Pre-Launch phase, even if not considerable as a real “mission” phase, can be intended to cover the launch campaign activities performed on the Sentinel-3 Satellite after its acceptance at the FAR until the lift-off. This period covers the last preparatory activities at the Integrator site and the Launch preparatory activities at the launch site.

3.4.2 LAUNCH AND EARLY ORBIT PHASE (LEOP) The LEOP will have a maximum duration of 3days. It will include the following events, starting at the switchover from ground-supplied power to the satellite internal batteries:

• Internally powered pre-launch phase, during the count-down • Launch phase, from the launch until separation of the Spacecraft from the launcher • Acquisition phase, including:

- Attitude rate reduction, attitude acquisition - Deployments (solar arrays, instruments and other appendages) - Delivery of power from the solar array

• Orbit correction phase, in which the manoeuvres from the injection orbit to the nominal orbit are performed to correct for the launcher dispersion errors

• Initial switch-on, in which communication is established between the Command and Control Subsystem (CCS) and other Spacecraft subsystems or Payload instruments

The network of ground stations to be assumed for the LEOP analysis will be selected from <RD9>.

3.4.3 COMMISSIONING PHASE During the Commissioning Phase the overall satellite, including the payload, will be brought into a fully operational state. Relevant adjustments may be made to the payload operational parameters or software to optimise performance. Specific activities may include:

• satellite functional checkout, in which overall satellite basic functions and health are verified;

• calibration of instruments; • verification of instrument measurements; • characterisation of instrument performance; • optimisation of on-board operations; • optimisation of payload operating parameters.



page 25 of 203

The nominal duration of the Commissioning Phase is 5 months for the first satellite and will be reduced to 3 months for the next satellites.

3.4.4 ROUTINE PHASE During the Routine Phase the instruments will operate nominally. Modifications of payload operating parameters or software may occur occasionally.

3.4.5 EMERGENCY PHASE In the case of major failure which could endanger the survival of the Spacecraft the following sequence is foreseen:

• On-board anomaly or failure detection • Automatic transition to Safe Mode • Downlink of TM during the next available ground station pass and during subsequent

passes in support to ground diagnosis • Recovery to the Routine Phase under ground control

3.4.6 DISPOSAL PHASE The Disposal Phase will occur at the end of the satellite operational life upon decision to be taken by the Agency and according to the recommendations of <RD10>. The orbit in which the satellite will be placed shall be defined at the time of the disposal.



page 26 of 203

4 SYSTEM REQUIREMENTS

4.1 Sentinel-3 Space Segment The Sentinel-3 mission shall be designed from the outset as a multi-satellite system, covering a period of at least 15 years lifetime.This means that even if its deployment starts with only one satellite, the aim is to design and develop a system in which the simultaneous operation of several satellites is planned and optimised and this over a duration of at least 15 years.

SY-SS-010* The Sentinel-3 mission shall be designed to accommodate two satellites simultaneously operational in orbit and a third satellite in non operational state (e.g. on-ground spare or satellite launched but still in in-orbit commissioning phase). The third satellite in non operational state can typically be in on-ground for long-term storage or launched but still undergoing its commissioning phase.

SY-SS-020 At the beginning of the mission, and in case of failure of one of the two in orbit satellites, the single in orbit satellite shall fulfil all mission requirements with the exception of the coverage requirements, which can be degraded accordingly. Coverage requirements are included in chapter 4.3 (Observation requirements).

4.2 Sentinel-3 Payload

SY-PL-010 In order to fulfil its mission objectives, each Sentinel-3 spacecraft shall embark a payload comprising: • An Ocean and Land Colour Instrument (OLCI) • A Sea and Land Surface Temperature (SLST) Instrument • A Radar Altimeter (RA) • A Microwave Radiometer (MWR) • A GNSS Receiver, suitable for Precise Orbit Determination (POD) • A Laser retro-reflector (LRR) • A Fire Monitoring Instrument (FIRE), considered as a CFI (option)



page 27 of 203

4.3 Observation requirements

4.3.1 COVERAGE

4.3.1.1 Surface Colour Surface colour measurements are obtained using information provided mainly by OLCI supported by SLST, e.g. for improved atmospheric correction

SY-OB-010* The ocean surface shall be covered in less than 2 days by the common swath of OLCI and SLST instruments. This is a purely geometrical requirement for which clouds do not need to be taken into account. On the other hand, being non-random, the impact of sun-glint must be taken into account in the coverage calculations. This requirement shall be fulfilled considering a single view swath for SLST.

SY-OB-020* The land surface shall be covered in less than 2 days (goal 1 day) by the common swath of OLCI and SLST instruments. This is a purely geometrical requirement for which neither clouds nor Sun-glint need to be taken into account (Sun-glint does not affect the land surface). This requirement shall be fulfilled considering a single view swath for SLST.

SY-OB-030 Surface colour data shall be acquired continuously during the daylight part of the orbit. Daylight is defined in section 5.2.2

4.3.1.2 Surface Temperature Surface temperature observations are provided by SLST. Therefore these requirements shall be fulfilled by SLST only.

SY-OB-040 The surface temperature shall be observed quasi-simultaneously with two views: a near-nadir view and an inclined view. There are 2 types of surface temperature products: high accuracy ones, which require the double view and low accuracy ones, which need only the near-nadir observation.

SY-OB-050* The surface shall be totally covered with the near nadir view in less than 1 day. This will provide faster revisit lower accuracy data.

SY-OB-060* The surface shall be totally covered with both views in less than 4 days. This will provide lower revisit higher accuracy data. The oblique view is necessary to alleviate the effect of aerosols and other atmospheric effects in the highest quality climate observations.



page 28 of 203

SY-OB-070 Surface temperature data shall be acquired continuously.

4.3.1.3 Surface topography Surface topography products are obtained by the RA instrument in synergy with the MWR, the GNSS receiver and the Laser Tracking stations measurements.

SY-OB-080 The surfaces to be observed by the topography payload are: • Open ocean • Coastal zones • Sea ice • Ice sheet interiors • Ice sheet margins • In-land water (rivers and lakes)

SY-OB-090 For the the purpose of establishing the reference mission scenario, the extend of ice surfaces (i.e. Ice sheet interiors, Ice sheet margins and Sea ice), shall be as defined in Figure 4.3.1-1

Figure 4.3.1-1: Extend of ice surfaces: sea-ice (green), ice sheet margins (blue), ice sheet interiors (red)

The extend of the areas above will vary during the year. For sizing the system elements, the Contractor can use similar maps provided by the Agency in digital format during the course of Phase B2, in a format to be agreed, and covering different periods of the year.



page 29 of 203

SY-OB-100 For the the purpose of establishing the reference mission scenario, the extend of

ocean surfaces to be observed by the topography payload shall be defined as follows: • Coastal zone: Sea surface extending from the coast up to 300km offshore • Open ocean: All sea surfaces being at least 300km offshore and free from Sea ice

SY-OB-110 For the the purpose of establishing the reference mission scenario, the extend of land surfaces (i.e. in-land water surfaces) to be observed by the topography payload, shall be as defined in the mask of in-land water, given in Figure 4.3.1-2. This does not imply that observations will be limited to these areas only. It shall be possible to extend the observations over land as long as data can be stored. For sizing the system elements, the Contractor can use similar maps provided by the Agency in digital format during the course of Phase B2 and in a format to be agreed.

Figure 4.3.1-2: Extend of in-land water surfaces (in yellow)

4.3.2 POINTING AND GEOLOCATION OF MEASUREMENTS

SY-OB-200 All observations shall be acquired in Earth pointing/Yaw steering mode, as defined in section 6.1.2.4

SY-OB-210 The space segment and the associated processing shall be designed to ensure a geo-location accuracy better than 1 SSD rms for Level 1b data of OLCI and SLST instruments over land and coastal zones and without the need for any Ground Control Points.



page 30 of 203

SY-OB-220 The space segment and the associated processing shall be designed to ensure a geo-

location accuracy better than 0.5 SSD rms for Level 1b data of OLCI and SLST, using if necessary Ground Control Points.

SY-OB-230 The space segment and the associated processing shall be designed to ensure a geolocation accuracy of the altimeter measurements as specified in section 5.4.6

SY-OB-240 The pointing of the satellite shall ensure a collocation of MWR and RA measurements with the accuracy specified in 5.5.1.2

SY-OB-250 Radar Altimeter data shall be acquired with a maximum mispointing angle of 0.2 deg. with respect to the local normal to the reference ellipsoid.

4.3.3 TIMELINESS REQUIREMENTS

SY-OB-300 All mission data shall be transmitted and available in the Core Ground Station less than 2 hours after acquisition.

SY-OB-310 Mission data transmitted to the Local Ground Stations shall have a maximum latency of 12 minutes.

4.4 Orbit

4.4.1 INJECTION ORBIT

SY-OR-010 The Satellite injection will optimally be made by the launcher within its operational reference orbit. The Satellite shall be capable of operating in its operational reference orbit, with due account for the injection errors specified in the launcher manual.

4.4.2 INITIAL ORBIT ACQUISITION

SY-OR-100 The Spacecraft shall be able to acquire the operational orbit within 3 days after separation from the launch vehicle with the orbit injections errors, attitude angles and rates identified in the corresponding launcher users manual, compensating for all nominal dispersions. This requirement shall apply for a launch at any time within the nominal launch window.

4.4.3 OPERATIONAL REFERENCE ORBIT

SY-OR-200 The following operational reference orbit shall be adopted for optimisation of the mission definition: • Type: Near-Polar frozen Sun-Synchronous • Mean Local Solar Time at descending node: between 10:00 and 10:30h • Repeat Cycle: 27 days (14+7/27) • Reference altitude: ~800km



page 31 of 203

• Cycle Length: 385 orbits

SY-OR-210* The second operational satellite shall be placed in the same reference operational orbit as the first operational satellite with a different mean anomaly in order to reach a constant phasing angle of 180°.

SY-OR-220* The mean local solar time at descending node of each satellite shall be controlled within ± 5 minutes.

SY-OR-230 The actual satellite ground track shall differ from the nominal one by less than ±1km max.

SY-OR-240 The orbital parameters for the reference operational orbit shall be computed with respect to the inertial frame, as defined appendix A.1.

SY-OR-250 Computations of drag shall assume atmospheric parameters defined in the ECSS Standard on Space Environment <SD3>.

4.4.4 LAUNCH WINDOW

SY-OR-300 The Spacecraft shall be compatible with a launch window of at least 10 minutes, every day. This requirement means that the Satellite shall not be designed with the concept of a fixed launch time; for example if post-launch events are programmed with an absolute time, they shall be updateable

4.5 Launcher Requirements

SY-LA-010 The satellite shall be compatible with VEGA as primary launcher as per VEGA User’s Manual <ND7>.

SY-LA-020 The satellite shall be compatible with a back-up launcher to be proposed by the Contractor and agreed with the Agency.

SY-LA-030 Interface requirements on the satellite from the launcher shall be as defined in the relevant launcher User’s Manuals.

SY-LA-040 The launcher performance, injection accuracy and kinematics conditions at separation shall be considered as defined in the relevant launcher User’s Manuals.

SY-LA-050 The launcher induced environment, dynamics, acoustics, thermal, EMI and cleanliness shall be considered as defined in the relevant launcher User’s Manuals.

SY-LA-060 The satellite and the relevant parts of the Ground Support Equipment (GSE) shall be compatible with the launcher and launch site requirements, defined in the relevant launcher User’s Manuals



page 32 of 203

4.6 Ground Segment Interfaces

SY-GR-010 The Spacecraft shall communicate with the ground segment facilities by means of two links: one for data dump of Mission Data in X-band and one for TT&C in S-band.

4.6.1 TT&C

SY-GR-100 The TT&C shall cover commanding of the spacecraft, housekeeping telemetry and ranging.

SY-GR-110 The satellite design, including the TT&C subsystem, shall be compatible with nominal operations via a single S-band Ground Station, located either in Kiruna or Svalbard. Use of both stations during the same orbit may be required in non-nominal situations. For mission analysis, Kiruna shall be considered as the primary station.

SY-GR-120 The satellite design shall be compatible with a requirement to switch off the S-band transmitter when not in view of the TT&C ground station. See Space Frequency Coordination Group Recommendation 12-4R2.

4.6.2 MISSION DATA The Mission Data encompass all instrument data, ancillary data and housekeeping telemetry stored in the mass memory on-board and downlinked via X-band

SY-GR-200 The satellite design shall be compatible with nominal operations with a single Core X-band Station for reception of Mission Data, located in Svalbard.

SY-GR-210 In addition, it shall be possible to operate the satellite using Kiruna as primary Core station and Svalbard as secondary Core X-band Station during Kiruna blind orbits.

SY-GR-220 The satellite design shall be compatible with the occasional unavailability of the X-band Core Ground Station during one pass without loss of data. (TBC) In this case, it is acceptable that the timeliness requirements might not be met for part of the acquired data. The required data storage margins for the nominal case are not applicable in this case.

SY-GR-230 The satellite design shall be compatible with nominal operations with two Core stations, located close to each Pole of the Earth. This implies downloading mission data twice per orbit. In this case, data transmitted to one station, need not be downloaded again to the other station.



page 33 of 203

SY-GR-240 It shall be possible to operate the satellite according to any of the above operational

concepts (defined in SY-GR-200, SY-GR-210 and SY-GR-230) at any time after launch.

SY-GR-250 Power Flux Density limitations, in accordance with Article S21, Section 5, of the ITU Radio Regulations <SD35>, shall be taken into account.

SY-GR-260 In addition to the Core X-band station, the satellite shall be able to transmit Mission data to Local X-band stations, acquired during the visibility period from each station. The implementation of this feature shall not constitute a design driver. Possible impacts on the design -driven by this requirement- shall be discussed with the Agency and agreed before implementation.

SY-GR-270 The satellite shall be able to interface with up to 6 Local X-band Stations in a single orbit.

SY-GR-280 The satellite shall be able to interface with an average of up to 3 Local X-band Stations per orbit. In case of overlapping visibility circles, it can be assumed that the data downlink will be executed sequentially in time to each station

SY-GR-290 Transmission of data to Local X-band Stations shall not influence in any way the contents of the data transmitted to the Core X-band Stations. This means in particular that the data shall not be erased from the memory after transmission to a Local station. In addition, in case of overlapping visibility, it shall be assumed that the Core Station has priority.

4.7 Protection of Radio Frequency Services

SY-RF-010 Wanted and unwanted emissions from the spacecraft falling into frequency bands of the Deep Space Network shall comply with Recommendation ITU-R.SA-1157 of <SD35>.

SY-RF-020 Wanted and unwanted emissions from the spacecraft falling into frequency bands of the Radio Astronomy Service shall comply with Recommendation ITU-R.RA-769-2 of <SD35>.

SY-RF-030 Wanted and unwanted emissions from the spacecraft falling into frequency bands of the Radio Location Service shall comply with Recommendation ITU-R.RS-1280 of <SD35>.

SY-RF-040 Wanted and unwanted emissions from the spacecraft falling into frequency bands of the Radio Location Service shall comply with Recommendation ITU-R.RS-1281 of <SD35>.

These requirements are applicable to all transmitters on-board, including communications and payload



page 34 of 203

4.8 Satellite Modes

4.8.1 SATELLITE MODES GENERAL REQUIREMENTS A Satellite Mode is defined as an operationally significant and stable Satellite configuration.

SY-MO-010 The number of Satellite Modes shall be kept to the strict minimum required to meet the requirements.

SY-MO-020 Satellite Modes transition shall be automatic, except for the return from safe mode to observation mode.

SY-MO-030 All automatic mode transitions shall be checked for validity prior to execution against a pre-defined automatic mode transition table.

SY-MO-040 The pre-defined automatic mode transition table shall be updatable from ground.

SY-MO-050 A distinction may be made between Satellite modes, platform modes and instrument modes. The space segment shall at all times be in a clearly identified mode covering both hardware and software. This may be characterised as a combination of platform mode and instrument(s) mode. Depending of its nature, transitions between modes will be controlled autonomously or by ground command.

SY-MO-060 An on-board logic shall be available to prevent incorrect commanding of forbidden s/w based mode transitions. The allowed and forbidden mode transitions between all possible pairs of modes shall be implemented in s/w and thus updateable by means of table update commands.

SY-MO-070 The satellite shall be able to return autonomously to the nominal mode from any nominal orbital manoeuvres without requiring direct commanding.

SY-MO-080 The instruments shall at all times be in a defined and identifiable mode that is unique.

SY-MO-090 It shall be possible to force by ground command any possible mode transition of the Satellite, platform or payload.

SY-MO-100 Non operational nominal modes of operations such as calibration and orbit control modes shall be specified and designed so as to minimise nominal mission interruption.

SY-MO-110 Initialisation of a Mode (at Satellite, subsystem, instrument or unit level) shall include configuration of the necessary hardware and software, activation of a default periodic telemetry format configuration, a frequency of telemetry parameters acquisition, and all of the automatic processes required to achieve the Mode, monitor its health status, and stay within in a stable manner.



page 35 of 203

4.8.2 SATELLITE MODE BEFORE LAUNCH

SY-MO-200 The Satellite shall have a Mode defined from the moment of transfer of power provision supplied from Ground to autonomous use of on-board batteries before launch

4.8.3 SATELLITE MODE DURING LEOP The Satellite LEOP starts at lift-off and ends when the Satellite reaches a state in which it can remain stable and healthy indefinitely given the allocation of consumables.

SY-MO-300 The Satellite shall automatically initiate the initial switch-on sequence from launch vehicle event and/or separation signals without the need for ground commands.

SY-MO-310 The Satellite shall be capable to run an automatic sequence without ground intervention which will, as a minimum, undertake all deployments (including the solar array, antennas as relevant) and mechanisms unlocking and initiate and complete attitude acquisition to end up in a stable configuration.

SY-MO-320 The LEOP sequence shall be able to recover autonomously any single failure.

SY-MO-330 The Satellite shall be able to survive at least 72 hours in LEOP in nominal and in single failure situations, without ground intervention. For nominal LEOP and in case of single-failure per functional assembly situation, the initial switch-on sequence shall automatically achieve a Satellite self sustainable safe configuration with nominal attitude control

SY-MO-340 It shall be possible to override the initial LEOP switch-on sequence and to perform LEOP activities or part of by ground commands.

SY-MO-350 The Satellite shall ensure that Sun illumination will not cause any damage to sensitive Satellite elements.

SY-MO-360 Contacts between the Satellite and the LEOP Ground Stations shall be possible independently of the Satellite attitude in orbit.

SY-MO-370 The Satellite shall be able to report all onboard events and statuses to the Ground Segment during the LEOP phase, such as any anomaly not autonomously recovered by the Satellite can be effectively analysed and timely recovered by the Ground Segment.

4.8.4 SATELLITE MODES DURING COMMISSIONING AND ROUTINE PHASE

SY-MO-400 The Satellite Commissioning and Routine Mode of operations shall provide all functions for the execution of the nominal Sentinel-3 Mission.



page 36 of 203

SY-MO-410 It shall be possible to program the Satellite for fully autonomous operations not

requiring commanding by the Ground Segment for at least a period of 14 days.

SY-MO-420 The Satellite shall permit in-orbit initialisation, disabling, re-initialisation and check-out of all Satellite functionalities through Ground commanding.

SY-MO-430 Any initialisation or switch-off sequence of Satellite operations shall start from or end with a fully defined configuration status involving all relevant hardware and software, and with a complete and consistent record of housekeeping information to be sent to the Ground Segment.

SY-MO-440 In the case of major failure which could endanger the survival of the Satellite, the following sequence is foreseen: • On-board anomaly detection, isolation and autonomous recovery as far as

possible, with housekeeping telemetry generation for further reporting to the Ground Segment.

• If autonomous recovery is impossible automatic transition to Safe Mode. • Downlink of housekeeping telemetry during the next available ground station pass

and during subsequent passes in support to ground diagnosis. • Recovery to the Routine Phase under ground control.

SY-MO-450 No single failure shall lead to Safe Mode Any exception shall be agreed with the Agency

4.8.5 SATELLITE SAFE MODE

SY-MO-500 In case of autonomously unrecoverable major failure threatening the health of the Satellite, or one of its function required to fulfil the specified mission, the Satellite shall be autonomously switched over to a Safe Mode in which the Satellite will only require minimal resources and can remain stable for unlimited duration given the availability of onboard consumables.

SY-MO-510 The satellite Safe Mode shall guarantee the availability of minimal resources in the area of onboard command and control, ground communications, power and energy management, attitude control and thermal environment, preferably provided by hardware or software functions not involved in the other modes of operations.

SY-MO-520 Satellite onboard redundancies shall be implemented such as to minimise the probability to use Safe Mode during the specified operational life of the Satellite.

SY-MO-530 Transition to Safe Mode shall not endanger the Satellite or any of its elements, irrespective of the moment at which Safe Mode is invoked.

SY-MO-540 In Safe Mode the satellite shall generate a set of telemetry packets that allow unambiguous and immediate identification of Safe Mode and its correct operation. All data and history of on-board events required to unambiguously determine the



page 37 of 203

reason for triggering safe mode shall also be accessible in TM either as real-time TM or as data stored in memory areas that can be dumped and reset by ground.

SY-MO-550 Satellite Safe Mode shall be able to trigger autonomously during all mission phases and modes, with a capability to selectively enable or disable Safe Mode by Ground Command.

SY-MO-560 The safe mode software shall permit to download the nominal software image for investigation and to patch locally or upload a new full software version.

SY-MO-570 Satellite Safe Mode shall ensure two-ways command and control communications with the ground segment provided Ground Station coverage.

SY-MO-580 In addition to the nominal operational configuration, the Satellite Safe Mode shall be compatible with the incomplete deployment of any structure that is remaining in stowed and/or partly deployed configuration

SY-MO-590 No Satellite nominal operation shall require inhibition of the Safe Mode, nor a forced entry into Safe Mode.

SY-MO-600 Transition from Safe Mode to another satellite mode shall be triggered by telecommand sent to the Satellite by the Ground Segment.

SY-MO-610 All Satellite failure cases and scenarios leading to Safe Mode shall be identified and analysed.

4.8.6 PAYLOAD MODES The Payload Modes are defined in the relevant instrument sections of Chapter 5 (Payload Requirements).

4.9 Operability Requirements

4.9.1 GENERAL REQUIREMENTS

SY-OP-010 The Satellite shall provide the capability to the Ground Segment to command and program all its configurable items, in relation to: • Mission phases and modes of operations • Control of the performance of all Satellite functions including Payload • Exploitation of all Satellite functions • Analysis and recovery from anomalies • Replacement of all or any part of the on-board software loaded in RAM or

EEPROM

SY-OP-020 The Satellite shall permit manual override or inhibit/enable of all automated functions individually, from Ground using commands.



page 38 of 203

Exception will be made for fuses and functions whose inappropriate inhibition combined with a failure may propagate and lead to a catastrophic or serious failure (e.g. LCL's). All automated functions whose inhibition could lead to such a catastrophic or serious failure will be identified.

SY-OP-030 Simultaneous Mission data sensing, recording and Mission data downlink shall be possible.

SY-OP-040 It shall be possible, whenever the Satellite is in visibility from its command and control Ground Station to continuously monitor and control the Satellite.

SY-OP-050 The Satellite monitoring and housekeeping telemetry downlink capability shall cover all Satellite in-orbit phases, all operating modes and configurations of the Satellite, including any orbit transfers, orbit maintenance, calibration.

SY-OP-060 For all Satellite reconfigurations following the mission timeline or based on request from ground, the Satellite software shall reconfigure as necessary, with minimum interference to the operation of the onboard subsystems and instruments.

SY-OP-070 The Sentinel-3 on-board software shall implement the necessary functions and services to monitor and control the satellite (including instruments and subsystems) by the ground in accordance with the operational interface requirements as specified in <ND3>.

SY-OP-080 The implementation of these services shall conform to the Telemetry and Telecommand packet utilization standard (PUS) <SD27>.

SY-OP-090 Non standard PUS services shall not be used when standard PUS services can implement the required function.

SY-OP-100 Unused services shall not be present as code.

4.9.2 OBSERVABILITY REQUIREMENTS

SY-OP-150 The satellite shall provide in its housekeeping telemetry all data required for the monitoring and execution of all nominal and foreseen contingency operations throughout the entire mission.

SY-OP-160 It shall be possible for the ground to determine the status of the S/W and H/W of each on-board subsystem and the instruments unambiguously from real-time housekeeping telemetry without knowing the history of the telecommands, the history of autonomous on-board actions or information delivered in previous telemetry.

SY-OP-170 Essential (high-priority) telemetry enabling a reliable determination of the current status of the on-board vital equipment under all circumstances shall always be available for real-time downlink in any s/c mode (including safe mode).



page 39 of 203

SY-OP-180 The availability of telemetry information shall be compatible with the required

response times monitoring and control activity implemented on ground. These responses times shall be controlled through the Space to Ground ICD and shall be reported in the FOM.

SY-OP-190 Telemetry shall always be provided to unambiguously identify the conditions required for execution of all possible configuration dependant telecommands. A configuration dependant telecommand is defined as a telecommand that should only be executed if a particular subsystem or instrument condition is satisfied.

SY-OP-200 Status information in telemetry shall be provided from direct measurements from operating units rather than from secondary effects. This is particularly essential for the status of all on-board relays.

SY-OP-210 All Satellite mission critical functions as identified in the FOM shall be observable by at least two independently obtained measurements.

SY-OP-220 All inputs and outputs to on-board autonomous processes shall be accessible to the ground via telemetry.

SY-OP-230 Information to indicate all actions of operational significance as identified in the FOM taken by on-board software shall be available in telemetry.

SY-OP-240 Software status telemetry shall include all commandable parameters such as monitoring and control thresholds, software tables and flags as well as any global variables.

SY-OP-250 Telemetry shall always be available to determine the health status of all units that manage the generation and routing of (other) telemetry data.

SY-OP-260 The effect of high-priority command (see <ND3>) shall be observable on the ground using high-priority telemetry data.

SY-OP-270 The ground segment shall be provided with all telemetry data required to verify reception, acceptance and execution of each telecommand unambiguously. This shall include any telecommand sent from ground for immediate, delayed (orbit position or time-tagged) execution, or sent from an on-board application.

SY-OP-280 The handling of on-board telemetry shall be hierarchically structured such that the on/off status of a unit is available and valid in telemetry data that are not managed by the unit itself. This allows the monitoring and assessment of the status of a unit even if it is switched off.



page 40 of 203

SY-OP-290 The Satellite shall provide sufficient information to allow the Ground Segment to

diagnose and recover by commands anomalies not autonomously detected and passivated by the Satellite.

SY-OP-300 The monitoring of all on-board events and parameters shall be automatic and their reporting within the housekeeping telemetry autonomous.

SY-OP-310 Housekeeping telemetry reporting shall be such that continuous observability by the Ground Segment is ensured with accurate time tagging of all telemetry events.

SY-OP-320 Housekeeping telemetry shall be acquired sequentially by the Satellite according to programmable tables with a selectable acquisition order.

SY-OP-330 The value of a telemetry parameter shall be transmitted in contiguous bits within one packet.

SY-OP-340 It shall be possible to program different housekeeping telemetry packets suitable for specific Satellite operational modes or contingency situations.

SY-OP-350 All Satellite modes, including switch-down, down to equipment level shall be observable via housekeeping telemetry data. The maximum sampling rate shall be sufficient to allow meaningful analysis in failure situations.

SY-OP-360 It shall be possible to perform in-flight monitoring and activation for maintenance purposes of a non-operating unit without interfereing with the nominal operation of the Satellite. This shall in particular allow patching a cold-redundant unit, whithout interruption of the nominal mission

SY-OP-370 All Satellite unit parameters or software status parameters shall be available for inclusion in housekeeping telemetry packets.

SY-OP-380 Acquisition of housekeeping data shall be performed for all instruments and platform subsystems, such that their state of health can be assessed for any time, either off-line or during passes. Housekeeping data shall be unambiguous, with update frequencies compatible with the characteristics of the signal sources.

SY-OP-390 The sampling rates of housekeeping telemetry parameters shall be programmable to allow meaningful monitoring of each parameter by onboard processes or by the Ground Segment.

SY-OP-400 The downlink telemetry shall be adequately split in physical and/or virtual channels such that the real-time housekeeping telemetry can be transmitted on ground and processed independently from any other type of telemetry (i.e. idle transfer frames, housekeeping telemetry played back from the on-board storage and measurement data).



page 41 of 203

Note: This allows to use the same VCID on both S-band and X-band links. This should typically be done for idle frames, i.e. the same VCID should be used on both downlinks. For other meaningful VCs, the use of the complete set of available VCIDs should be considered first.

SY-OP-410 In order to maintain a constant bit rate on the physical channel used for housekeeping TM (e.g. S-Band), a dedicated virtual channel with idle frames shall be used. Note: this means that a constant bit rate shall not be maintained by means of idle packet introduction in the housekeeping TM VCs. The production of idle packets shall be reserved for the cases when it is necessary to complete a frame already containing a meaningful packet, and that otherwise would not be down-linked in an acceptable time (e.g. last packet of a dump in a dedicated virtual channel, scarce packet production by the onboard software, etc).

SY-OP-420 A ‘system log’ of the satellite anomalies, autonomous switch-downs, command failure reports, etc., shall be maintained on-board and available for downlink on request from the ground (as part of the real-time housekeeping TM virtual channel). Note: It is not required that the ‘system log’ contains the nominal events generated on-board.

SY-OP-430 The system log shall be able to cover a period of at least 3 days.

SY-OP-440 The system log shall not be overwritten when the buffer is full.

SY-OP-450 It shall be possible to clear the current content of the system log on ground request.

SY-OP-460 The system log shall be regularly saved on-board such that its contents are available for downlink also after a reconfiguration and/or cold restart of the DHS main equipment.

SY-OP-470 It shall be possible for ground to enable/disable the storage of selected HK Telemetry generated on-board. Details related to the overwriting of stored data when the on-board storage is full are specified in <ND3>

SY-OP-480 It shall be possible for ground to downlink stored HK telemetry both via X-band and S-band.

SY-OP-490 Housekeeping Telemetry packets, which during nominal operations are only to be routed to the relevant Mass Memory Storage, should have a different APID from packets that are to be sent on the real-time downlink. This is to prevent discontinuities in the Source Sequence Counter for packets that arrive on the real-time downlink.



page 42 of 203

SY-OP-500 The on-board storage capacity at EOL shall be sufficient to store all housekeeping

packets generated on-board for at least 72 hours for all phases of the mission.

SY-OP-510 It shall be possible to downlink the housekeeping telemetry recorded over the period of time corresponding to the maximum on-board storage capacity within a period of 24 hours. This requirement is applicable to the downlink of recorded HK telemetry via X-band and S-band.

SY-OP-520 It shall be possible to request Diagnostic Reports as well as to define, modify, and remove definitions of Diagnostic Reports. Diagnostic Reports will be used to support the download of additional parameters more frequently than down-linked in nominal telemetry.

SY-OP-530 The Satellite shall execute Mode and configuration-dependent limit check of parameters of its own systems and Payload as necessary for system management and protection against critical situations.

SY-OP-540 It shall be possible to program an upper and lower limit, and when adequate a filter, for each monitored parameter, and to selectively modify, enable and inhibit these limits from ground.

SY-OP-550 The Satellite shall report to ground in its telemetry all out-of-limit and inhibited conditions.

SY-OP-560 Exceeding parameters limits and re-entry into limits shall be recorded and reported to ground.

SY-OP-570 The simultaneous reporting of stored and real-time housekeeping telemetry data shall be possible.

SY-OP-580 The Sentinel-3 software shall be able to simultaneously report stored housekeeping data and to store new housekeeping data to ensure continuous observability of Satellite operations for onboard processes and for the Ground Segment.

SY-OP-590 It shall be possible to clear selective onboard data storage areas by ground command.

4.9.3 COMMANDABILITY REQUIREMENTS

SY-OP-700 The satellite shall be able to receive and process a continuous uplink of any sequence of telecommand packets (with any combination of APID’s) at the nominal uplink rate in all of its operational modes (including safe mode). This requirement (amongst others) includes the case that all commands are destined to the same APID and they are of the same type (e.g. Memory Load commands).



page 43 of 203

SY-OP-710 Execution of vital functions (to be agreed by ESA), if commandable, shall be

implemented by a nominal and a redundant telecommand. Vital functions are those that, if not executed, or wrongly executed, could cause permanent mission degradation.

SY-OP-720 Redundant telecommands for vital functions shall be separately routed from their corresponding nominal telecommands destined to nominal units.

SY-OP-730 A telecommand packet shall contain a single telecommand function only. A telecommand function is an operationally self-contained control action. A telecommand function may comprise or invoke one or more low-level control actions.

SY-OP-740 It shall be possible to individually command all on-board equipment directly from the ground.

SY-OP-750 It shall be possible to command the satellite or any subsystem or the instrument into each of their operational modes by means of a single telecommand.

SY-OP-760 A telecommand that does not conform to the packet telecommand standard <SD27>, and/or is not recognized as a valid Sentinel-3 telecommand shall be rejected at the earliest possible stage in the on-board reception, acceptance and execution process.

SY-OP-770 The on-board reception, processing and execution of telecommands destined to a given unit shall not affect the performance of any other on-going processes.

SY-OP-780 It shall be possible to change on-board data or software parameters by means of dedicated telecommand(s) The general-purpose memory load telecommand shall not be used for the above. Use of this telecommand to fulfill specific instances of the above requirement may be permissible if the data and software parameter locations remain fixed, independent of the software version (i.e. if it can be defined as a dedicated command in the ground Data-Base, where the addresses are fixed in the command structure).

SY-OP-790 Readouts of loaded on-board data or software parameters shall be requested via dedicated telecommand(s). The general-purpose memory dump telecommand shall not be used for the above. Use of this telecommand to fulfill specific instances of the above requirements may be permissible if the data and software parameter locations remain fixed, independent of the software version (i.e. if it can be defined as a dedicated command in the ground Data-Base, where the addresses are fixed in the command structure).

SY-OP-800 The failure on the acceptance and/or in the execution of the on-board issued commands as identified in the FOM shall be notified to ground by means of an anomaly event packet.



page 44 of 203

Commands issued on-board are all commands which do not directly originate from the ground (for immediate or time-tagged execution) and addressed to packet terminals or another function within the same terminal or to a hardware device.

SY-OP-810 The on-board capacity for storage of the Mission Schedule shall be sufficient to contain the commands needed for a full repeat cycle of 27 days of Satellite nominal operations, including a margin of 25%. After the first uploading of the full cycle, each subsequent uploading will only cover the update of the nominal operations associated to the next 14 days mission planning.

SY-OP-820 The software shall provide adequate capability to allow for the change of mission-modes and mission-profiles at ground-defined future time periods, including periods of no ground visibility, according to the mission needs. This can be done using time-tagged or orbital position tagged commands, or higher level applications executing, e.g. On-Board Control Procedures, to be selected upon principles of simplicity, safety, robustness and economical use of resources.

SY-OP-830 The Sentinel-3 software shall support the on-board mission planning as defined in <ND3> and in this section.

SY-OP-840 Programming of mission profiles shall be done using dedicated telecommands without a need for patching

SY-OP-850 PUS compatible commands for uploading, reporting and authorisation of mission parameters shall be available.

SY-OP-860 In case of non-nominal de-activation of equipment units, it shall be possible to set the unit to a defined configuration status with known relay settings before to switch them on again.

SY-OP-870 It shall be possible to modify all parameters related to any onboard monitoring (e.g. enable/inhibit status, thresholds/limits) by dedicated telecommands without a need for patching.

SY-OP-880 It shall be possible to enable/disable, as well as modify/re-program any on-board autonomous action by dedicated telecommands without a need for patching.

SY-OP-890 25% margin for additional monitoring and autonomous actions shall be available at Satellite FAR.

SY-OP-900 The Satellite housekeeping telemetry shall reflect successful or failed command execution, for all commands sent by the ground and for commands generated autonomously on-board



page 45 of 203

4.10 Security Requirements The following requirements on Security shall be analysed during phase B2 and will be consolidated at Kick-Off + 4)

SY-SE-010 The Satellite shall provide the capability to enable the following security crypto functions for space links encryption and decryption: • Authentication and decryption of telecommands sent to the Satellite through the

S-band data communications link by the Ground Segment • Encryption of the Mission data telemetry link sent by the Satellite to the Ground

Segment in X-band. • Encryption of the housekeeping data telemetry or part of.

SY-SE-020 Encryption of telecommands shall be autonomously disabled when Satellite enters safe mode or mission critical failure management modes to allow the Satellite direct telecommand capability to the Ground Segment during Satellite failure management modes.

SY-SE-030 Implementation of Security functions shall be by dedicated unit(s).

SY-SE-040 The Satellite shall be capable to deliver in its housekeeping telemetry data all necessary information to the Flight Operations Segment in order to monitor the proper operation of the security functions without transfer of security sensitive data that would require encryption of housekeeping telemetry data.

SY-SE-050 Implementation of Telecommand and Telemetry security features will be functionally and architecturally separate from the security functions for the mission data

SY-SE-060 A capability for securely enabling or disabling individually the Satellite crypto functions (Telecommand, telemetry, or mission data) onboard the Satellite from the Ground Segment shall be implemented. In particular, as indicated above, the Satellite commanding shall be possible by use of Authentication Only or Authentication and Encryption together, or neither

SY-SE-070 The Sentinel-3 Satellite security functions design shall be consistent with <RD11>.

SY-SE-080 A capability for ensuring the integrity of TC, TM and payload data shall be implemented

SY-SE-090 A capability for protection against TC Replay shall be implemented

SY-SE-100 A capability for managing keys shall be implemented based on a combination of: • Keys which are initially stored on the spacecraft and never exchanged with the

ground • Keys regularly uplinked to the spacecraft from the ground



page 46 of 203

• Keys with lifetimes that allow keys for TCs to change with every TC uplink

session and keys for TM and payload downlink to change at least with every downlink session. Longer lifetimes shall be configurable.

4.11 Autonomy and fault management

4.11.1 AUTONOMY

SY-AU-010 Satellite nominal operations shall be based on a combination of: • Time-tagged commands (see <ND3>, paragraph 3.10) • Periodic commands specified at positions along the mission repeat cycle by an

orbit number and argument of latitude (see <ND3>, paragraph 3.10)

SY-AU-020 The uplink from the ground of nominal command sequences shall not occur more frequently than 14 days.

SY-AU-030 The Satellite shall ensure its own long term safety for all credible failures.

4.11.2 FAULT MANAGEMENT

SY-AU-100 Fault Detection, Isolation and Recovery shall be performed within the Satellite in a hierarchical manner with the aim of isolating and recovering faults at unit, subsystems or instrument level as far as necessary to preserve the Satellite health and operability.

SY-AU-110 All satellite units that perform regular or on-request self-check shall report them within the Satellite housekeeping telemetry data.

SY-AU-120 Anomalies and the actions taken to recover from them shall be reported in event driven packets within the Satellite housekeeping telemetry data.

SY-AU-130 During nominal operations, Satellite autonomous reconfigurations that are necessary to keep continuity of mission operations shall be implemented.

SY-AU-140 Following an anomaly, only autonomous reconfigurations necessary to preserve the safety of the Satellite shall be allowed.

SY-AU-150 The fault management functions at all levels shall be able to access lower level telemetry data produced by subsystems and instruments, with the exception of science data. This includes in particular non-periodic event packets that can be used to trigger recovery actions at system or subsystem level as a result of an anomaly occurred (and detected) in another subsystem.



page 47 of 203

SY-AU-160 The Satellite fault management functions at all levels shall carry out consistency

verification checks on independent or redundant sensor readings whenever available before starting the recovery actions.

SY-AU-170 Failure detection algorithms shall avoid continuous production of the same anomaly report packet if the same failure is detected within a specified number of monitoring cycles.

SY-AU-180 Failure detection algorithms shall be able to generate all support telemetry packets as necessary for the on-ground analysis of the failure and identified in the FOM.

SY-AU-190 It shall be possible for the ground to enable, disable or override each individual fault management function implemented in software at single parameter level. Fault management functions implemented by hardware shall be overridable as a design goal. Any non-overridable function shall be defined and agreed by ESA.

SY-AU-200 All parameters used for autonomous operations (e.g. thresholds for limit checking or thresholds and biases for attitude control) including fault management, orbit and attitude control parameters, and onboard failure detection, isolation and recovery shall be updateable by telecommand, and their value or status available in Satellite housekeeping telemetry.

SY-AU-210 The satellite shall have the knowledge of the actual health status of all the hardware units required for any mode start that is potentially hazardous (e.g. attitude control modes). It shall be possible to override this information by telecommand, and it shall be available in telemetry.

SY-AU-220 The Satellite shall be able to maintain nominal operations even in presence of single failure cases affecting a subsystem, and without any need for telecommands from the ground control stations, for a period of at least 14 days.

SY-AU-230 In case of Satellite failures preventing the use of the on-board command and control functions to command and monitor the subsystems or payload, the Satellite shall send switch-off signals allowing an organised switch-off of the subsystems or payload.

SY-AU-240 A fault or out-of-limit identified during the execution of the Mission timeline shall not cause a change or discontinuation of the nominal Mission timeline.

SY-AU-250 Should onboard reconfiguration triggered by the Satellite failure detection and recovery system raise conflicts with the Mission timeline, then its execution shall be inhibited, autonomously recovered after anomaly passivation, and if not possible, recovered by the Ground Segment later-on.

SY-AU-260 Commands shall be verified on-board the Satellite for their plausibility before their execution. Interlocks, for example in the form of Safe/Arm functions, shall be provided for critical commands and for the commands that would result in



page 48 of 203

uncontrolled depletion of resources, or irrecoverable anomalous operation modes in the event of their erroneous activation.

SY-AU-270 The Ground Segment shall be able to command any Satellite autonomous failure recovery process.

SY-AU-280 The Ground Segment shall be able to enable or disable by command any Satellite autonomous failure detection, isolation and recovery process.

SY-AU-290 A Satellite safety protection shall be available to prevent inadvertent commanding through a single command of forbidden critical actions or mode transitions.

SY-AU-300 The Satellite fault management function shall include functions to detect software malfunctions, using e.g. watchdog timers to detect software lockout situations at functional level and at the level of hardware to software interfaces.

SY-AU-310 Software faults or failures shall not result in hazardous hardware operation.

SY-AU-320 Hardware failures shall not result in software executing hazardous operations

4.12 Time management

SY-TM-010 The Satellite shall maintain an On-Board master Time that will be used to ensure the On-Board Time (OBT) function.

SY-TM-020 The Sentinel-3 system shall use the Absolute Reference Time (ART) defined in Appendix B: as absolute time reference.

SY-TM-030 The On-Board time shall be correlated on board with ART realised by the GNSS instrument once per second with accuracy better than 1 microsec. (TBC)

SY-TM-040 The Satellite master clock shall be strictly monotonous and without wrap around for the duration of the mission including any possible mission extension, covering a period of at least 15 years. Complete satellite power-down or ground commands are the only exceptions to the monotonicity requirement.

SY-TM-050 The Satellite master clock shall be in format CUC according to the CCSDS time code standard <SD30>. Coarse and fine time fields shall be sized according to the system performance requirements.

SY-TM-060 It shall be possible to preset the Satellite master clock by ground command.

SY-TM-070 The Satellite master clock shall have the following stability: • better than 1x10E-6 initial setting • better than 5x10E-8 over one day • better than 5x10E-6 over 1 year



page 49 of 203

• better than 6x10E-7 around each orbit

SY-TM-080 Telecommands shall be time-tagged in On-board Time.

SY-TM-090 Housekeeping Telemetry and mission data shall be time tagged and contain correlation information to ART with an accuracy according to the mission performance requirements. The TM packet time-stamp can be used to implicitly tag the data it contains provided this is compatible with the required accuracy

SY-TM-100 The availability of valid time correlation data shall be flagged on-board and in the housekeeping telemetry.

SY-TM-110 It shall be possible to upload time correlation information from ground. The correlation between OBT and ART is achieved on ground and can be used in case GNSS would stop providing ART information on board

SY-TM-120 In case of GNSS unavailability, it shall be possible to operate the spacecraft based on its Master Clock. Performance might be degraded though.

SY-TM-130 For equipment and instruments using a local clock, either for their own telecommand time-tagging or for measurements datation, the Satellite shall provide the necessary means (e.g. time values and time and frequency signals) for correlating this local time reference with ART within the mission accuracy requirements.

SY-TM-140 Equipments and payload instruments time correlation data shall be included in their respective housekeeping telemetry channel. The time correlation information shall be transmitted as part of the Mission data through X-band.

SY-TM-150 On-board software functions shall have access to OBT with minimum jitter This typically means that the on-board scheduler reads or estimates the OBT value at each RTC interruption and provides this to all tasks being scheduled on that RTC interruption

SY-TM-160 The On-Board Time (OBT) shall be correlated to UTC (or any other selected Ground reference time) in the TT&C ground station with an accuracy of 1msec, on the leading edge of the first bit of the sync word of the S-band telemetry frame. Standard telemetry time packets shall be transmitted in hardware at least every 30 seconds. The inaccuracy of this leading edge as transmitted with respect to the Satellite clock is to be considered as part of the on-board contribution to the correlation measurement.



page 50 of 203

SY-TM-170 The packet time-stamp shall correspond to the end of sampling and shall allow

determining the actual sampling time of all the data in the packet.

SY-TM-180 In case there is more than one time source on-board used for datation, all the housekeeping TM shall nevertheless be time stamped using the same source (OBT in time field)

SY-TM-190 A specific “time/ops synch packet” shall be provided including the on-board position (if available, specified as orbit number and angle) to allow the verification of the time/position as used by the OPS/MTL schedulers (see <ND3>, par. 3.10) as well as auxiliary flags to report the on-board time correlation status.

SY-TM-200 If an on-board subsystem or instrument has operationally not been correlated to the on-board Master clock after a power reset or swtch-on, this shall be indicated within the “time/ops synch packet” auxiliary flags



page 51 of 203

5 PAYLOAD REQUIREMENTS

5.1 General

5.1.1 OPTICAL PAYLOAD The optical payload of the Sentinel-3 consists of two instruments hereafter referred to as OLCI (Ocean Land Surface Colour Instrument) and SLST (Sea and Land Surface Temperature).

5.1.1.1 Terms and definitions for Optical Payload Absolute localisation accuracy: Difference between the estimated position of any spatial sample and its true position on the reference Earth geoid. Absolute radiometric accuracy: Unknown bias error (difference between measured value and true value) of the values associated to the samples in an image when a stable and spatially uniform scene is imaged. The absolute accuracy shall be demonstrated by averaging a sufficiently large number of samples such that the residual temporal variation does not dominate the calculation Air mass ratio: Ratio of the cosine of the OZA in the nadir view to the cosine of the OZA in inclined view related to the same target on Earth Daytime: Part of the orbit where the sun zenith angle at satellite ground track is lower than 80º. Defect A spatial sample is considered as a defect spatial sample if, - For solar channels, at reference TOA radiance its SNR is less than half (TBC) of the specified

SNR value or if it is completely blind or saturated - For infrared channels, at reference brightness temperature its NEDT is larger than twice (TBC)

of the specified NEDT value or if it is completely blind or saturated Image: Ensemble of data acquired over a two-dimensional scene with equal number of spatial samples in the cross and along track direction. The number of spatial samples in cross track is defined by the instrument swath and spatial sampling interval. Note: not applicable for SLST Image swath: Maximum distance on ground between the positions of two spatial samples belonging to the same row.



page 52 of 203

Image length: Maximum distance on ground between the positions of two spatial samples belonging to the same column Inter-channel spatial co-registration: Maximum equivalent ground distance between the positions of all pairs of spatial samples acquired in two spectral channels and related to the same target on Earth Inter-channel temporal co-registration: Maximum time interval between the acquisitions of spectral channels related to the same target on Earth Inter-channel radiometric accuracy Unknown bias error (difference between measured value and true value) of the ratio of spectral radiances measured in two spectral channels and associated to the same target on Earth. The inter-channel radiometric accuracy shall be demonstrated by averaging a sufficiently large number of samples such that the residual temporal variation does not dominate the calculation. Modulation Transfer Function (MTF): Ratio of the modulation in the image to the modulation in the object as a function of spatial frequency of a sine wave object. Suppose a radiance signal at the entrance of the instrument, constant in the along track direction and varying in the across track direction according to:

)2sin(.22

),( minmaxminmax ufyLLLL

ufL +−

++

= π

Where f is the spatial frequency (cycles per unit distance) y is the distance across track u is the sample scene phase parameter Then the across track modulation transfer function MTFact(f) is defined as

MTFact ( f ) =max[ xmax( f ,u)− xmin( f ,u)

xmax( f ,u)+ xmin( f ,u)]

Lmax( f ,u)− Lmin( f ,u)Lmax( f ,u)+ Lmin( f ,u)

where xmax(f,u) and xmin(f,u) are respectively the maximum and minimum instrument response to the sinusoidal radiance, after detector equalisation.

The along track modulation transfer function MTFalt(f) is similarly defined. The system MTF includes all the perturbations induced by the image acquisition process (e.g. instrument, platform, etc.). Observation Zenith Angle (OZA): Angle between the satellite viewing direction and the local zenith defined in the surface target reference frame (i.e., zenith – target – satellite) Point Spread Function (PSF) of a spatial sample:



page 53 of 203

For a spatial sample i observing in channel j with central wavelength λo a stable scene of spectrally integrated radiance Lij(λo, x, y), the measured spectral radiance L’ij is given by:

∫ ∫∞

∞−

∞

∞−

= dxdyyxLyxPSFL oijijij ),,(),(' λ

where PSFij(x,y) is the system Point Spread Function for spatial sample i in a channel j. The system PSF is the integral over dwell time of the instantaneous PSF, including optics, detectors, electronics and nominal pointing variation during dwell time, but excluding effects due to unknown LOS instability. The spatial integral of the PSFij(x,y) is normalised to 1 Polarisation sensitivity: Assuming measurement of a stable, spatially uniform, linearly polarized scene, the polarization sensitivity is defined as

minmax

minmax

SSSS

P+−

=

where Smax and Smin are the maximum and minimum sample values obtained when the polarization is gradually rotated over 180 deg. Position of sample: Geographic location of the barycentre of the system PSF. Radiometric resolution: Radiometric resolution is expressed in Signal-to-Noise ratio (SNR) or Noise Equivalent Differential Radiance (NEDL) for the solar channels and Noise Equivalent Differential Temperature (NEDT) for the infra-red channels, where

NEDL =L

SNR

and

NEDT =NEDL

dLdT

For infra-red channels the radiance L is given by the Planck function. The Noise Equivalent Differential Radiance (NEDL) is the RMS deviation of the retrieved radiance associated to the samples of an image acquired over a stable and spatially uniform scene. Relative localisation accuracy: Difference between the estimated distance and the true distance between any two spatial samples of an image on the reference Earth geoid. Relative Radiometric Accuracy (repeatability) The relative radiometric accuracy defines the range of variability of the measured radiances L(t) for the solar channels and brightness temperatures Tb(t) for the thermal channels, over a time-stable scene observed at any two times tj , tk within a specified time period τ:

<∗−

100)(

)()(

k

jk

tLtLtL

Relative Accuracy in [%] for the solar channels

and



page 54 of 203

<− )()( jbkb tTtT Relative Accuracy in [K] for the infrared channels

Solar channels: Channels with centre wavelength lower than 3.0 µm. Spatial radiometric accuracy: RMS deviation of the values associated to the samples in a row of the 2D array forming a spectral image when a stable and spatially uniform scene is imaged. Spatial Resolution The spatial resolution is the FWHM of the (instantaneous TBC) PSF Spatial Sample A spatial sample is a Level 1b measurement associated with system PSF. The centre of the spatial sample is the system PSF barycentre. Spatial Sampling Distance (SSD) The barycenter-to-barycenter distance between adjacent spatial samples on the Earth’s surface Spatial Sampling Angle (SSA) The Spatial Sampling Angle (SSA) is defined as the angle subtended by the spatial sampling distance at SSP or where the observation view crosses the satellite track, as seen from the satellite. Spectral misregistration: Maximum difference between the spectral channel centre wavelengths of all the samples acquired in a given channel over an image. Spectral channel centre wavelength: Wavelength of the centroid of the spectral response. Spectral channel width: Full-Width-at-Half-Maximum of the spectral response of a sample. Spectral response of a sample: The spectral response R(λ) relates the radiometrically calibrated, spectrally integrated radiance L’(λο) measured in a spectral channel with the spectral radiance L(λ) emanating from a spatially homogeneous scene. The spectral response is normalised such that its spectral integral yields 1. The spectral response R(λ) is defined by:

λλλλλ dLRL oo )(.),()('0∫∞

=

Sun Zenith Angle (SZA): Angle between the sun direction and the local zenith at target level (i.e., zenith – target – sun) Thermal channels: Channels with centre wavelength larger than 3.0 µm.



page 55 of 203

5.1.1.2 Geophysical Assumptions

5.1.1.2.1 Signal Levels

Typical levels of signals at the entrance of the instruments are specified hereafter. For the solar channels:

• Lmin Minimum radiance of the dynamic range • Lref Reference radiance • Lmax Maximum radiance of the dynamic range • Lsg Sun-glint radiance

For the thermal channels: • Tmin Minimum brightness temperature • Tref Reference brightness temperature • Tmax Maximum brightness temperature

The maximum radiance Lmax of the solar channels is defined by:

πθ ))](cos().([ min jjEMax

L ssjcl =

The sun-glint radiance Lsg of the solar channels is defined by:

))cos(1(2)]([

021.0s

sjsg

jEMaxL

απ −=

Where: • Es is the extraterrestrial solar irradiance • min

sθ is the minimum solar zenith angle over the orbit and over the instrument field of view

• j is the julian day • sα is half the angle subtended by the sun (16 arcmin)

5.1.1.2.2 Sun-Glint Zone

Data acquired over water will be corrupted by sun-glint contamination. The probability of a spatial sample being contaminated by sun-glint is given by:

22

2

2 ))cos().(cos())cos()(cos())cos().sin().sin()cos().cos(1(2

exp(1

sv

svsvsvsgP

θθσθθφθθθθ

πσ ++−∆++

−=

where θs is the sun zenith angle (SZA) at the viewed spatial sample θv is the observation zenith angle (OZA) at the viewed spatial sample ∆φ is the relative azimuth angle at the viewed spatial sample

σ2 is the mean square surface slope which is function of wind speed Ws [m/s] sW.00512.0003.02 +=σ

The sun-glint reflectance is given by:



page 56 of 203

sgvs

sg Pr)(cos).cos().cos(.4

.4 βθθ

πρ =

where r = 0.02 (Fresnel water reflection coefficient)

β is the angle formed by the reflecting facet normal and the local normal defined by

)2cos(.22)cos()cos(

)cos(ωθθ

β+

+= sv

where ω is the specular reflection angle defined by )cos().sin().sin()cos().cos()2cos( φθθθθω ∆+= svsv

Data acquired in the solar channels over water with a sun-glint reflectance exceeding 0.0005, assuming a wind speed Ws: threshold 5 m/s, target 7.5 m/s, shall be discarded. The sun-glint model shall be used for the sole purpose of assessing the coverage performance over waters.

5.1.1.2.3 Extraterrestrial solar irradiance

PL-OP-010 The reference solar spectral irradiance data shall be as per <SD34>. The data are for a distance Earth-Sun of 1 astronomical unit (AU)

5.1.1.3 Inter-Instruments requirements

PL-OP-020 The across-track field of view of OLCI shall be contained within the across-track field of view of SLST near-nadir view.

PL-OP-030 The OLCI and SLST channels shall be resampled on a common grid and co-registered within 0.1 SSD of the highest resolution instrument (TBC).

5.1.2 SURFACE TOPOGRAPHY PAYLOAD The topography payload consists of a dual-frequency radar altimeter for ranging and ionospheric delay correction, of a microwave radiometer (MWR) for wet tropospheric delay correction, a GNSS receiver and a Laser Retroreflector (LRR) for precise orbit determination.

5.1.2.1 Terms and definitions for the Topography Payload Impulse response: The Impulse Response is the power profile response of the surface topography payload as it passes over an ideal point target of unit reflectivity, placed on the sub-satellite track, neglecting noise contributions and when the signal is integrated over a specified distance. The Range Impulse Response is the central cut of the Impulse Response along the range (nadir) direction. The Along-Track Impulse Response (also referred to as Azimuth Impulse Response) is the cut of the Impulse Response along the sub-satellite track.



page 57 of 203

The Along-Track Resolution (or Azimuth Resolution) is the width of the Along-Track Impulse Response at – 3 dB (half-power) point along the flight-path. Radiometric accuracy: The radiometric accuracy defines performance of the end-to-end radar system in terms of capability to measure the power profile of the backscattered signal, or the brightness temperature of the observed surface. The absolute radiometric accuracy includes all errors, such as variation and drifts of accuracy of external or internal calibrations. Radiometric stability: It represents the medium/long-term drift of the error in the measurement of power of the backscattered signal or the brightness temperature of a given scene. This error is assumed to be a residual error after application of appropriate calibration corrections, unless otherwise specified. Range Ambiguities: The range ambiguities arise from two distinct mechanisms: 1) Range sidelobe contribution Prsl along the nominal signal path: The pulse compression after the signal reception introduces range sidelobes beyond the nominal compressed pulse. The leading sidelobes interacting with the Earth surface superimpose on the echo of the nominal pulse. 2) Off-nadir contributions Pasl through antenna sidelobes: The Earth surface and topographic features surrounding the nominal sensing area interact with the radar pulses transmitted in off-nadir directions through antenna sidelobes. For a given observation window, the nominal pulse and those preceding it will contribute to the ambiguous echo returns. Both the topographic features and the corresponding sigma-0 of the surrounding surfaces influence the severity of the ambiguous signal. Sigma-0: Per-unit-surface radar cross-section of surface. It generally depends on characteristics of the surface, frequency and incident angle.

5.2 Ocean and Land Colour Instrument (OLCI) OLCI is an imaging spectrometer. The imaging principle is based on pushbroom mode. The across track scanning is performed electronically. The along track scanning is performed by the motion of the satellite.


OL-GE-010 Unless otherwise stated the observational requirements shall be met



page 58 of 203

• for the full signal dynamic range; • for each spectral channel; • for each spatial sample acquired within an image; • for level 1b data; • over the specified mission duration.

OL-GE-020 For off-nadir spatial samples the spatial requirements shall be extrapolated with distance scaled after projection on the Earth and assuming constant SSA.

5.2.2 FUNCTIONAL AND OPERATIONAL REQUIREMENTS

OL-OP-010 In nominal operation the instrument shall continuously perform measurements in orbit with no gaps over the daytime of the orbit (SZA at SSP ≤80˚).

OL-OP-020 The on-board calibration shall be performed outside the daytime part of the orbit

OP-OP-030 The on board calibration occurrence shall be kept to the strict minimum required to meet the instrument requirements with a frequency not exceeding in average once every two weeks.

OL-OP-040 All raw data acquired during on-board calibration shall be transmitted to ground.

OL-OP-050 The radiometric calibration processing shall be performed on ground. The radiometric calibration is here referred to as the process of converting the digital data into TOA spectral radiance or brightness temperature through the correction of all radiometric errors introduced by the instrument (e.g. electronic gain and offset correction).

OL-OP-060 The “correction” functions performed on-board, if any, shall be reversible.

OL-OP-070 All gain and offset parameters applied on-board that modify the measurement data shall be transmitted.

OL-OP-080 The instrument shall be capable of transmitting unprocessed data to allow for testing and verification of the on-board correction functions.

OL-OP-090 The number of modes and on board correction functions shall be kept to the strict minimum required to meet the requirements.

OL-OP-100 The spectral channels shall be programmable by macrocommand • in spectral width down to one spectral sample width • in spectral position within the range 390 nm – 1040 nm • in gain setting to adapt for any change of spectral channels and/or change of the

instrument end-to-end response



page 59 of 203

For the purpose of verification it is acceptable to limit the instrument performance characterisation to the spectral channels specified in Table 5.2.5-1 provided that: - performance of the instrument between the specified channels can be computed on the basis of a validated performance model - evidence is given that no instrument performance degradation occurs between the specified spectral channels The dynamic range (full, reduced or intermediate) to be considered for the performance verification shall be agreed with the Agency.

5.2.3 CONTAMINATION

OL-CO-010 The instrument design (venting and other measures) shall minimise the contamination sources and the related consequences on the instrument performance so that the compliance to the instrument performance is not compromised by contamination of optical surfaces

OL-CO-020 Purging and other contamination protection measures shall be implemented during all instrument and satellite phases whenever needed.

5.2.4 INSTRUMENT MODES

OL-MO-010 The instrument shall operate in the following observation modes: • Full Spatial Resolution (FR) mode over Land and Coastal Zones: • Reduced Spatial Resolution (RR) mode over Open Ocean:, obtained by on-board

or, preferably, on-ground combination of 4 adjacent FR samples across-track over 4 consecutive lines

• Raw Spectral mode for which the instrument shall transmit 45 (TBC) spectral channels all with the highest spectral resolution

• Nominal Spectral mode for which the instrument shall transmit all or a subset of the spectral channels specified in Table 5.2.5-1.

It shall be investigated whether the RR data can be obtained by on-ground processing rather than on-board processing. This would allow simplifying the instrument concept in limiting the measurement mode to the FR measurement mode only at the expense of an increased data volume. The Raw Spectral mode is mainly intended for the wavelength calibration of the instrument.

OL-MO-020 The instrument shall provide the following calibration modes: • Dark calibration • Radiometric calibration • Wavelength calibration

OL-MO-030 The instrument calibration shall be performed using the features of the observation modes as per the table below:



page 60 of 203

Spatial Mode Spectral Mode Dark calibration FR Nominal Radiometric calibration FR Nominal Wavelength calibration FR Raw

For MERIS/Envisat the images acquired during the on-board calibration were averaged over large number of consecutive frames. Instead all frames acquired in the calibration modes shall preferably be individually transmitted for further processing on-ground.

5.2.5 DESIGN REQUIREMENTS All design requirements below shall be met for level 0 and higher level data.

5.2.5.1 Spectral Requirements

OL-DE-010 The instrument shall measure scene radiance in 21 spectral channels. The channels shall have the characteristics specified in Table 5.2.5-1.

Center Spectral width Lmin Lref Lsat Lmax SNR Ref SSDλcenter ∆λ @ Ref Signalnm nm @ Ref SSD

O 1 400 15 21.60 62.95 167.39 Lmax (1) 2,239 RRO 2 412.5 10 25.93 74.14 196.80 Lmax (1) 2,006 RRO 3 442.5 10 23.96 65.61 182.33 Lmax (1) 2,087 RRO 4 490 10 19.78 51.21 163.03 Lmax (1) 1,683 RRO 5 510 10 17.45 44.39 154.35 Lmax (1) 1,629 RRO 6 560 10 12.73 31.49 133.13 Lmax (1) 1,481 RRO 7 620 10 8.86 21.14 115.76 Lmax (1) 1,131 RRO 8 665 10 7.12 16.38 102.26 Lmax (1) 1,022 RRO 9 681.25 7.5 6.65 15.11 97.43 Lmax (1) 829 RRO 10 708.75 10 5.66 12.73 88.75 Lmax (1) 956 RRO 11 753.75 7.5 4.70 10.33 Lmax (1) Lmax (1) 673 RRO 12 761.25 2.5 2.53 6.09 Lmax (1) Lmax (1) 317 RRO 13 764.375 3.75 3.00 7.13 Lmax (1) Lmax (1) 440 RRO 14 773.75 5 17.21 79.29 247.90 Lmax (1) 2,157 RRO 15 781.25 10 4.22 9.18 73.32 Lmax (1) 810 RRO 16 862.5 15 2.88 6.17 55.95 Lmax (1) 688 RRO 17 872.5 5 13.89 66.40 195.40 Lmax (1) 1,582 RRO 18 885 10 2.80 6.00 Lmax (1) Lmax (1) 417 RRO 19 900 10 2.05 4.73 Lmax (1) Lmax (1) 312 RRO 20 940 20 0.94 2.39 Lmax (1) Lmax (1) 230 RRO 21 1020 40 1.81 3.86 48.23 Lmax (1) 146 RR

(1) Lmax is specified in section 5.1.1.1.1 (Geophysical assumptions)

Band

# Wm-2sr-1µm-1

Table 5.2.5-1: OLCI Spectral Channels

OL-DE-020 The spectral misregistration shall be less than 0.001 µm (goal: 0.0002 µm)

OL-DE-030 For any spectral channel, the out-of-band integrated signal, as defined in the following equation, shall be less than 1 % of the total integrated signal:

01.0)()(

)()(1 20

3.0

<−

∫

∫∆+

∆−m

m

dRL

dRLcenter

center

µ

µ

λλ

λλ

λλλ

λλλ



page 61 of 203

5.2.5.2 Geometrical Requirements

OL-DE-100 The instrument shall image the Earth in nadir view. The field of view shall be centred along-track with respect to a plane perpendicular to Xsc axis of the spacecraft control reference frame (see Appendix A.8): • Centering shall be better than 10 SSA • Centering shall be stable within 1 SSA Xged axis points in the nominal velocity direction (roll axis)

OL-DE-110 The across track field of view (FOV) shall be sized to meet the global Earth coverage performance specified in SY-OB-010 and SY-OB-020 The coverage performance over waters shall account for sun-glint contamination, as described in section 5.1.1.2.2.

OL-DE-120 The OZA of all samples acquired shall never exceed 55º

OL-DE-130 The spatial sampling distance at SSP shall never exceed the values specified in Table 5.2.5-2.

Across Track

direction

Along Track

direction

Area Of Interest

km

Instrument Spatial Mode

Open Ocean 1.2 1.2 RR Coastal Zone 0.3 0. 3 FR

Land 0. 3 0. 3 FR Table 5.2.5-2: Spatial Sampling Distance

OL-DE-140 The spatial sampling distance at SSP in the cross- and along-track direction shall differ by less than 10%.

OL-DE-150 The angular sampling interval across track shall be constant with a distortion less than 1%.

OL-DE-160 The inter-channel spatial co-registration shall be less than 0.3 FR SSD.

5.2.5.3 MTF

OL-DE-200 The system modulation transfer function (MTF), at Nyquist frequency, shall be larger than 0.25.

OL-DE -210 The OLCI MTF along track and across track shall not differ by more than 0.2 (0.1 goal) between 0 km-1 and the Nyquist frequency.



page 62 of 203

5.2.5.4 Polarisation

OL-DE-300 The polarisation sensitivity shall be less than 0.01

5.2.5.5 Recovery from bright target

OL-DE-400 The specified instrument requirements shall be achieved within 5 spatial sampling distances after observation of sun-glint radiance Lsg

OL-DE-410 The instrument shall be able to recover from direct sun exposure during TBD second and maintain full compliance to the instrument observational requirements after such event

5.2.5.6 Straylight

OL-DE-500 Let assume an image composed of two uniform regions centred one with respect to the other. The outer region is of infinite size limited by the Earth. The inner region is of square shape with dimension 10 FR SSD. The radiance in the outer region is the maximum radiance Lmax. The radiance of the inner region is zero. The straylight in level 0 data at the centre of the inner region shall be less than • 6 % (4% goal) at spectral channel O2 • 4 % (3% goal) at spectral channel O19 The requirement for all other channels shall be obtained by linear interpolation between O2 and O19.

OL-DE-510 Let assume an image composed of two uniform regions of infinite size limited by the Earth and of different radiance. The radiance in one region is the maximum radiance Lmax. The radiance of the other region is comprised between the specified minimum radiance Lmin and the maximum radiance Lmax. The two regions are separated by a column or a row. The residual straylight after processing (level 1b data) shall be less than: • 2 % (1% goal) in spectral channel O2 and 6% (4% goal) on spectral channel O19,

within a distance range comprised between 10 FR SSD and 50 FR SSD on each side of the boundary column/row

• 1 % in spectral channel O2 and 2% in spectral channel O19, at a distance larger than 50 FR SSD on each side of the boundary column/row

The requirement for all other channels shall be obtained by linear interpolation between O2 and O19.

5.2.6 IMAGE QUALITY REQUIREMENTS

5.2.6.1 Radiometric Image Quality All requirements in this section are RMS values.



page 63 of 203

OL-IQ-010 The Signal-to-Noise Ratio (SNR) of the solar channels shall be higher than the

values specified in Table 5.2.5-1. 1. The SNR is specified - at the reference radiance defined in Table 5.2.5-1 - at the reference spatial sampling distance defined in Table 5.2.5-1. - and assuming no saturation over the full signal dynamic range 2. The SNR shall be estimated over the full signal dynamic range.

OL-IQ-020 The level 0 data Least Significant Bit (LSB) shall be smaller than the achieved NEDL.

OL-IQ-030 The minimum radiance Lmin and maximum radiance Lmax of Table 5.2.5-1 specify the full signal dynamic range. The minimum radiance Lmin and saturation radiance Lsat of Table 5.2.5-1 specify the reduced signal dynamic range. The instrument sizing (e.g. video gain) shall be optimised for both the full and reduced signal dynamic range. The SNR shall be estimated for the later case.

OL-IQ-040 The absolute radiometric accuracy of the data acquired in the solar channels shall be smaller than 2% traceable to SI units.

OL-IQ-050 The inter-channel radiometric accuracy shall be smaller than 0.2%.

OL-IQ-060 Assuming a stable and spatially uniform scene, the level 0 data shall be constant to better than 0.1% over the day time part of the orbit

5.2.6.2 Spectrometric Image Quality

OL-IQ-100 The position of the solar channels centre shall not vary by more than 0.001µm (goal: 0.0002 µm) RMS.

5.2.7 PRE-LAUNCH CHARACTERISATION

OL-CH-010 The instrument shall be subject to a comprehensive characterisation programme before launch to supply data to the Characterisation and Calibration Database. The minimum characterisation to be performed is specified in Table 5.2.7-1. All the characterisation measurements shall be performed in an environment representative of the in-flight operation conditions, including the nominal, cold and hot case of the instrument environmental temperatures. All parameters shall be measured with an accuracy better than 10%. Any deviation from these requirements shall be subject to the Agency’s approval.

Name Definition Pointing directions

Pointing direction in terms of unit vector projections with respect to the instrument optical reference cube. Values to be provided for the edge pixels, central pixel, nadir pixel and TBD pixels in the field of



page 64 of 203

view and for all spectral channels.

Spatial co-registration

Inter-channel pointing direction in terms of unit vector projections with respect to the instrument optical reference cube. Values to be provided for the edge pixels, central pixel, nadir pixel and TBD pixels in the field of view and for all spectral channels.

Image distortion

Angular pointing direction (across and along track) from the theoretical value of any pixel relative to the central pixel. Values to be provided for TBD pixels in the field of view and for all spectral channels.

BRDF diffuser

Bi-directional reflectance distribution function of the solar diffusers as a function of azimuth and elevation illumination angles. Values to be provided for TBD pixels in the field of view and for all spectral solar channels. The characterisation shall cover the complete range of elevation and azimuth with reasonable spacing. It shall also include the complete elevation range allowed by the sun baffle.

Spectral response

Instrument spectral response R(λ). Values to be provided for TBD pixels in the field of view and for all spectral channels as a function of wavelength over the range [λcenter – ∆λ50%, λcenter –+∆λ50%]

Detector signal dynamics

Detector response as a function of incident illumination. Values to be provided for TBD pixels in the field of view and for all spectral channels as a function of the detector incident irradiance over the range [0, 1.2 Emax], where Emax is the detector irradiance for an instrument incident radiation of Lmax

Instrument signal dynamics

Instrument response as a function of incident radiation. Values to be provided for TBD pixels in the field of view and for all spectral channels as a function of the instrument incident radiance over the range [0, 1.2 Lmax] (resp. [0, 1.2 Tmax]) for the solar channels

Detector response linearity

Instrument response linearity

Detector Response map

Normalised pixel response at detector level. Values to be provided for all pixels in the field of view and for all spectral channels.

Detector PRNU

Pixel response non-uniformity at detector level. 1σ, 2 σ, and 3 σ values to be provided for all spectral channels.

Detector dark signal map

Pixel dark signal non-uniformity at detector level. 1σ, 2 σ, and 3 σ values to be provided for all pixels in the field of view and for all spectral channels.

Detector DSNU

Pixel dark signal non-uniformity at detector level. 1σ, 2 σ, and 3 σ values to be provided for all spectral channels.

Offset stability

Offset variation over time, temperature

Gain Gain variation over time, temperature



page 65 of 203

stability

Spectral transmission/reflection of the optics subassembly. Values to be provided for TBD pixels in the field of view and for all spectral channels.

Optics spectral transmission / reflection Spectral transmission/reflection of the optical components. Optics focal length

Focal length of the optics subassembly at field of view edges and center

Polarisation sensitivity

Sensitivity of the instrument on the polarisation of the incident electromagnetic radiation. Values to be provided for TBD pixels in the field of view and for all spectral channels.

MTF Modulation transfer function of the instrument. PSF System point spread function. Values to be provided for TBD pixels

in the field of view and for all spectral channels. Straylight PSF

Straylight point spread function aiming at characterising diffusion slope and ghosts

“Optical “elements BRDF / BTDF

Representative BRDF/BTDF data of the major instrument straylight sources (windows, mirrors, lenses, …)

Table 5.2.7-1: Pre-launch Instrument Characterisation Requirements

5.3 SLST SLST is a conical imaging radiometer with a dual view capability: a near-nadir view and an inclined view.


SL-GE-010 Unless otherwise stated the observational requirements shall be met: • for the full signal dynamic range; • for each spectral channel; • for each spatial sample acquired within an image; • for level 1b data; • over the specified mission duration.

5.3.2 FUNCTIONAL AND OPERATIONAL REQUIREMENTS

SL-OP-010 In nominal operation the instrument shall continuously perform measurements in orbit (both daytime and night time) with no gaps.

SL-OP-020 Interruption of the imaging mode for calibration shall be limited as much as possible and shall be in agreement with availability requirements of section 6.9.3.

SL-OP-030 All raw data acquired during on-board calibration shall be transmitted to ground.



page 66 of 203

SL-OP-040 The radiometric calibration processing shall be performed on ground.

The radiometric calibration is here referred to as the process of converting the digital data into TOA spectral radiance or brightness temperature through the correction of all radiometric errors introduced by the instrument (e.g. electronic gain and offset correction).

SL-OP-050 The “correction” functions performed on-board, if any, shall be reversible.

SL-OP-060 All gain and offset parameters applied on-board that modify the measurement data shall be transmitted.

SL-OP-070 The instrument shall be capable of transmitting unprocessed data to allow for testing and verification of the on-board correction functions.

SL-OP-080 The number of modes and on board correction functions shall be kept to the strict minimum required to meet the requirements.

5.3.3 CONTAMINATION

SL-CO-010 The instrument design (venting and other measures) shall minimise the contamination sources and the related consequences on the instrument performance so that the compliance to the instrument performance is not compromised by contamination of optical surfaces

SL-CO-020 Purging and other contamination protection measures shall be implemented during all instrument and satellite phases whenever needed.

SL-CO-030 The instrument shall be designed with a decontamination system to prevent the cooled parts of the imager from degradation by particulate or chemical contamination. However, the decontamination shall result in a minimum number of outages of the imaging mission and shall be in agreement with availability requirements of section 6.9.3.


SL-MO-010 The instrument shall provide the following calibration data: • Dark calibration • Radiometric calibration (solar for the solar channels, blackbody for thermal

channels)

SL-MO-020 The radiometric calibration processing shall be kept to the strict minimum required to meet the instrument requirements with a frequency not exceeding in average once every two weeks (TBC).



page 67 of 203

5.3.5 DESIGN REQUIREMENTS All design requirements shall be met for level 0 and higher level data.

5.3.5.1 Spectral Requirements

SL-DE-010 The instrument shall measure scene radiance in 9 spectral channels. The channels shall have the characteristics specified in Table 5.3.5-1.

Center Spectral width Tolerance Slope Lmin/Tmin Lmax/Tmax Refλcenter ∆λ on 50% points 5% - 80% Low High @ Lref Low @ Lref High SSDµm µm µm µm km

S 1 0.555 0.02 ± 0.003 < 0.008 2.92 2.92 - Lmax(3) 20 - 0.5S 2 0.659 0.02 ± 0.003 < 0.008 2.43 2.43 - Lmax(3) 20 - 0.5S 3 0.865 0.02 ± 0.003 < 0.008 1.53 1.53 - Lmax(3) 20 - 0.5S 4 1.375 0.015 TBS TBS 0.58 0.58 6.0 Lmax(3) 20 75 0.5S 5 1.61 0.06 + 0.01 / -0.04 < 0.030 0.39 0.39 38 Lmax(3) 20 250 0.5S 6 2.25 0.05 TBS TBS 0.13 0.13 1.0 Lmax(3) 20 110 0.5S 7 3.74 0.38 ± 0.06 < 0.12 200 K 270 K - 323 K 0.05 - 1S 8 10.85 0.9 ± 0.09 < 0.34 200 K 270 K - 321 K 0.03 - 1S 9 12 1.0 ± 0.09 < 0.37 200 K 270 K - 318 K 0.03 - 1

(1) TOA radiance for solar channels, Brightness temperature for thermal channel(2) SNR for solar channels, NEDT (K) for IR channel(3) Lmax is specified in section 5.1.1.1 (Geophysical assumptions)

Lref/Tref SNR/NEDT (2)

@ Ref SSD

Band

# W.m-2.sr-1.µm-1 / K (1)

Table 5.3.5-1: SLST Spectral Channels

Note: The specification on tolerance and slope shall be traded-off against the specification on the spectral template

SL-DE-020 The spectral response of the instrument normalised by its maximum shall meet the spectral template plotted in Figure 5.3.5-1.



page 68 of 203

A/A' B/B' C/C' D/D' E/E' F/F'

(λ-λcenter)/∆λ ± 1 ± 0.6 ± 0.6 ± 0.4 ± 0.4 ± 0.2NSR 0.02 0.5 1 0 0.5 0.8

Figure 5.3.5-1: SLST Spectral Response Template

Channels shall have as similar a spectral shape as practicable to those on AATSR

SL-DE-030 For any spectral channel, the out-of-band integrated signal, as defined in the following equation, shall be less than 1 % of the total integrated signal.

5.3.5.2 Geometrical Requirements

SL-DE-100 The instrument shall image the Earth in two observation views: • Near-nadir view • Inclined view with an OZA of 55º ± 0.5º.

SL-DE-110 The instrument across track field of view (FOV) shall be sized to meet the global Earth coverage performance specified in section 4.3.1

SL-DE-120 The air mass ratio shall always exceed 1.53 over the FOV common to the nadir and inclined view

SL-DE-130 For any given channel the instrument shall acquire samples in both the near nadir and inclined views that are equally spaced in time with TBD tolerance.

SL-DE-140 The spatial sampling distance along track where the near-nadir and inclined views crosses the satellite track shall never exceed 0.5 km in the solar channels and 1.0 km in the thermal channels.

SL-DE-150 The spatial sampling distance across track where the near-nadir view crosses the satellite track shall never exceed 0.5 km in the solar channels and 1.0 km in the thermal channels.

SL-DE-160 The inter-channel spatial co-registration shall never exceed 0.1 SSD

SL-DE-170 The spatial resolution where the near-nadir view crosses the satellite track shall be smaller than 0.5 km in the solar channels and 1.0 km in the thermal channels.

SL-DE-180 The instrument IFOV shall be constant and identical in both the inclined and nadir view within ± 1.5%

01.0)()(

)()(1 20

3.0

<−

∫

∫∆+

∆−m

m

dRL

dRLcenter

center

µ

µ

λλ

λλ

λλλ

λλλ



page 69 of 203

The IFOV is defined by the angle subtended by the spatial resolution in the near nadir view when acquiring the “nadir” pixel as seen by the satellite

5.3.5.3 Polarisation

SL-DE-200 The polarisation sensitivity shall be less than: • 0.05 (o.02 goal) in the solar channels • 0.10 in the thermal channels

SL-DE-210 The variation of polarisation sensitivity across the field of view shall be less than 0.01 (TBC).

5.3.5.4 Recovery from bright target

SL-DE-300 The specified observational requirements shall be achieved within 5 spatial sampling distances after observation of sun-glint radiance Lsg

SL-DE-310 The instrument shall be able to recover from direct sun exposure during TBD second and maintain full compliance to the instrument observational requirements after such event

5.3.5.5 Straylight

SL-DE-400 Let assume an image composed of two uniform parts of infinite size and of different radiance. The radiance in one part is the maximum radiance Lmax. The radiance of the other part is comprised between the specified minimum radiance Lmin and the maximum radiance Lmax. The two parts are separated by a column or a row. The instrument requirements shall be achieved for spatial samples located at a distance larger than 3 km on each side of the boundary column/row. Straylight performance is specified for non-uniform scenes to control pollution of low-radiance parts of an image by stray optical and electrical signal originating from high-radiance parts. Both optical and electrical cross-talk contribute to the effect

SL-DE-410 Assuming a hot scene of 900 K of 10x10 km size, the instrument requirements shall be achieved for spatial samples located at a distance larger than 3 km (TBC) outside the hot scene.

5.3.6 IMAGE QUALITY REQUIREMENTS

5.3.6.1 Radiometric Image Quality All requirements in this section are RMS values.

SL-IQ-010 The Signal-to-Noise Ratio (SNR) of the solar channels shall be higher than the values specified in Table 5.3.5-1.



page 70 of 203

The SNR is specified at the reference radiance and reference spatial sampling distance defined in Table 5.3.5-1. The SNR of solar channels shall be estimated over the full dynamic range.

SL-IQ-020 The Noise Equivalent Differential Temperature (NEDT) of the IR channels shall be smaller than the values specified in Table 5.3.5-1. The NEDT is specified at the reference brightness temperature and reference spatial sampling distance defined in Table 5.3.5-1. The NEDT of the thermal channels shall be estimated over the full dynamic range.

SL-IQ-030 The level 0 data Least Significant Bit (LSB) shall be smaller than the achieved NEDL

SL-IQ-040 The minimum and maximum signal of Table 5.3.5-1 specify the instrument signal full dynamic range

SL-IQ-050 The absolute radiometric accuracy of the data acquired in the solar channels shall be smaller than 2% traceable to SI Units

SL-IQ-060 The absolute radiometric accuracy of the data acquired in the IR channels shall be smaller than 0.2 K (0.1 K goal) traceable to the ITS-90

SL-IQ-070 Assuming a stable and spatially uniform scene, the level 1b data acquired in the solar channels shall be constant to better than 0.1% over the day time part of the orbit

SL-IQ-080 Assuming a stable and spatially uniform blackbody scene, the level 1b data acquired in the thermal channels shall be constant to better than 0.08 K (goal: 0.02 K) over the orbit

5.3.7 ACTIVE FIRES As an option, SLST shall have the capability to support Active Fires applications. Active Fires requirements shall not be allowed to drive the SLST design in a significant way and by no means endanger the quality of the Sea Surface Temperature products.

SL-FI-010 SLST shall measure Fire Scene radiance over land in two additional spectral channels. The channels shall have the characteristics specified in Table 5.3.7-1.

Band Center Spectral

width Tmin Tmax NEDT Ref SSD

λcenter ∆λ '@ Ref SSD

# µm µm K km F 1 3.74 0.38 350 500 (634 goal) 1.0 1 F 2 10.85 0.9 330 400 0.5 1



page 71 of 203

The noise requirement is applicable over the complete dynamic range

Table 5.3.7-1: Fire Spectral Channels

Channels F1 and F2 spectral characteristics are TBC and can be tailored would it be required by industry.

SL-FI-020 The absolute radiometric accuracy of the data acquired in channels F1 and F2 shall be smaller than 3 K (TBC) traceable to the ITS-90

5.3.8 PRE-LAUNCH CHARACTERISATION

OL-CH-010 The instrument shall be subject to a comprehensive characterisation programme before launch to supply data to the Characterisation and Calibration Database. The minimum characterisation to be performed is specified in Table 5.3.8-1. All the characterisation measurements shall be performed in an environment representative of the in-flight operation conditions, including the nominal, cold and hot case of the instrument environmental temperatures. All parameters shall be measured with an accuracy better than 10%. Any deviation from these requirements shall be subject to the Agency’s approval.

Name Definition Pointing directions

Pointing direction in terms of unit vector projections with respect to the instrument optical reference cube. Values to be provided for the edge pixels, central pixel, nadir pixel and TBD pixels in the field of view and for all spectral channels.

Spatial co-registration

Inter-channel pointing direction in terms of unit vector projections with respect to the instrument optical reference cube. Values to be provided for the edge pixels, central pixel, nadir pixel and TBD pixels in the field of view and for all spectral channels.

Image distortion

Angular pointing direction (across and along track) from the theoretical value of any pixel relative to the central pixel. Values to be provided for TBD pixels in the field of view and for all spectral channels.

BRDF diffuser

Bi-directional reflectance distribution function of the solar diffusers as a function of azimuth and elevation illumination angles. Values to be provided for TBD pixels in the field of view and for all spectral solar channels. The characterisation shall cover the complete range of elevation and azimuth with reasonable spacing. It shall also include the complete elevation range allowed by the sun baffle.

Blackbody emissivity / radiance

Emissivity/radiance (incl non uniformity) as function of wavelength and temperature

Blackbody temperature

Accurate characterisation of the blackbody temperature



page 72 of 203

Spectral response

Instrument spectral response R(λ). Values to be provided for TBD pixels in the field of view and for all spectral channels as a function of wavelength over the range [λcenter – ∆λ50%, λcenter –+∆λ50%]

Detector signal dynamics

Detector response as a function of incident illumination. Values to be provided for TBD pixels in the field of view and for all spectral channels as a function of the detector incident irradiance over the range [0, 1.2 Emax], where Emax is the detector irradiance for an instrument incident radiation of Lmax in the solar channels and Tmax in TIR channels.

Instrument signal dynamics

Instrument response as a function of incident radiation. Values to be provided for TBD pixels in the field of view and for all spectral channels as a function of the instrument incident radiance (resp. brightness temperature) over the range [0, 1.2 Lmax] (resp. [0, 1.2 Tmax]) for the solar channels (resp.TIR channels)

Detector response linearity

Instrument response linearity

Detector Response map

Normalised pixel response at detector level. Values to be provided for all pixels in the field of view and for all spectral channels.

Detector PRNU

Pixel response non-uniformity at detector level. 1σ, 2 σ, and 3 σ values to be provided for all spectral channels.

Detector dark signal map

Pixel dark signal non-uniformity at detector level. 1σ, 2 σ, and 3 σ values to be provided for all pixels in the field of view and for all spectral channels.

Detector DSNU

Pixel dark signal non-uniformity at detector level. 1σ, 2 σ, and 3 σ values to be provided for all spectral channels.

Offset stability

Offset variation over time, temperature

Gain stability Gain variation over time, temperature Spectral transmission/reflection of the optics subassembly. Values to be provided for TBD pixels in the field of view and for all spectral channels.

Optics spectral transmission / reflection Spectral transmission/reflection/emissivity of the optical

components. Optics focal length

Focal length of the optics subassembly at field of view edges and center

Polarisation sensitivity

Sensitivity of the instrument on the polarisation of the incident electromagnetic radiation. Values to be provided for TBD pixels in the field of view and for all spectral channels.

MTF Modulation transfer function of the instrument (see section 5.4.2 for definition).

PSF System point spread function. Values to be provided for TBD pixels



page 73 of 203

in the field of view and for all spectral channels.

Straylight PSF

Straylight point spread function aiming at characterising diffusion slope and ghosts

“Optical “elements BRDF/BTDF

Representative BRDF/BTDF data of the major instrument straylight sources (windows, mirrors, lenses, …)

Table 5.3.8-1: Pre-launch Instrument Characterisation Requirements

5.4 Radar altimeter instrument Sentinel-3 Radar Altimeter is a dual-frequency nadir looking altimeter, employing the full-deramp pulse compression principle and has Synthetic Aperture capability, for improved along-track resolution.


RA-GE-010 The altimeter shall operate in 2 carrier frequencies in Ku and C-band in the range defined below (Table 5.4.1-1).

Band Range of allocation C-band 5 250 - 5 570 MHz Ku-band 13.25 - 13.75 GHz

Table 5.4.1-1 Band allocation

RA-GE-020 The antenna 3-dB beamwidth shall be 1.2 deg +/- 0.1 deg in Ku-band.

RA-GE-030 The field of view of the instrument shall be fixed and directed towards nadir.

RA-GE-040 Transmission of C-band pulses shall be interleaved with sequences of Ku-band pulses using a repetitive pattern, allowing to determine the propagation delay through the ionosphere with an accuracy as defined in requirements of section 5.4.4.4 This requirement applies for all measurement modes

RA-GE-050 The transmitted radar signals shall be linearly frequency-modulated pulses with either a positive or a negative modulation slope.

RA-GE-060 The bandwidth of these pulses shall be in the range [320MHz-350MHz] in Ku-band, and in the range [290MHz-320MHz] in C-band.


5.4.2.1 Measurement and Tracking Modes

RA-MO-010 The instrument shall have at least two measurement modes:



page 74 of 203

• Conventional pulse-limited mode, called Low Resolution Mode (LRM); • A high along-track resolution mode based on Synthetic Aperture Radar technique,

called SAR Mode;

RA-MO-020 The instrument shall be able to operate in open-loop tracking mode or in closed-loop tracking mode in either measurement mode specified above.

RA-MO-030 For the purpose of sizing the spacecraft resources and operations, the following reference operational scenario shall be considered:

Surface type Measurement mode Tracking mode Open ocean LRM Closed loop Coastal zone SAR Open loop/Closed loop (1) Sea ice SAR Closed loop Ice sheet interiors LRM Closed loop Ice sheet margins SAR Open loop In-land water SAR Open loop Other Depends on S/C resources Depends on S/C resources

(1) Closed loop is acceptable far from the coast and up to a distance equal to the footprint size.

Table 5.4.2-1: Reference scenario for Measurement/Tracking modes

RA-MO-040 In closed-loop tracking mode the position of the tracking window shall be autonomously adapted in order to ensure continuous tracking of the earliest detectable part of the echoes, over all surfaces defined in section 4.3.1.3.

RA-MO-050 In closed-loop tracking mode, the gain of the receive chain shall be autonomously controlled to accommodate the full instantaneous dynamic range of the echo power.

RA-MO-060 It shall be possible to modify the parameters used in closed-loop tracking, including reference points for height and gain tracking, filter coefficients etc., by ground command, without software patches.

RA-MO-070 In closed-loop tracking mode, the gain loop in Ku-band and in C-band shall be independent

RA-MO-080 It shall be possible to select between 2 predetermined reference points for gain tracking without the need of extra commands. This shall apply in closed loop tracking and in both measurement modes (i.e LRM and SAR).

RA-MO-090 In open loop tracking mode, the position and rate of the tracking window as well as the gain of the receive chain shall be controlled based on the a-priori knowledge of the surface characteristics. This means that the tracker shall either be driven by DEM and sigma-0 information stored in the altimeter, or by commands received from the platform.



page 75 of 203

RA-MO-100 The open-loop tracker control commands shall be updated at a maximum rate of at

least 1 command per km along the satellite track.

RA-MO-120 The along-track error in the execution of any open-loop tracking control command shall be less than +/-500m.

RA-MO-130 It shall be possible to update the information used to control the open-loop tracker (i.e. DEM) from ground. However, the design of the tracking concept shall not require regular updates of this information in order to operate. This means that the DEM or the commands covering a complete cycle shall be stored on board (either in the altimeter or in the on-board computer). It is not acceptable to cover only part of the cycle, as this would imply regular uploads during a cycle. In addition, any fine adjustment of the tracking commands needed to account for the actual location of the satellite, shall be made autonomously on board.

5.4.2.2 Calibration modes

RA-MO-200 Calibration modes shall be defined by the Contractor, in order to meet the calibration requirements of section 5.4.5.2

5.4.2.3 Support modes

RA-MO-300 The instrument shall have support modes in which measurements are not made. These shall include at least: • 1) Self Test mode • 2) Stand-by mode

RA-MO-310 In self-test mode the instrument shall generate a pre-determined science data pattern. In addition to provide a test of some digital functions and interfaces in-flight, this capability may be used on-ground to support the AIV activities

RA-MO-320 Stand-by mode shall be a reduced power mode, with no constraints with respect to its maximum duration.

5.4.2.4 Mode transitions

RA-MO-400 The instrument shall be able to remain continuously in any measurements mode, both on-ground and in-flight. The objective of this requirement is to ensure that there is no characteristic of the instrument which limits the measurement duration (e.g. thermal equilibrium). There may be operational limits due to resource availability, but this is not relevant to this requirement



page 76 of 203

RA-MO-410 The instrument shall be able to reach any measurement mode from Stand-by mode

within 10 s.

RA-MO-420 Transitions from any measurement mode to any support (or calibration) mode shall be possible at any time by ground command or upon command from the platform.

RA-MO-430 Switching between measurement modes shall be possible with a maximum loss of data of 2 km along the satellite track.

RA-MO-440 Switching between tracking modes within a given measurement mode shall be possible without a maximum loss of data of 1km along the satellite track.

RA-MO-450 Any mode switching shall be programmable from ground with an accuracy better than 2 km (TBC) along the satellite track.

RA-MO-460 It shall be possible to abort by telecommand any mode that has an execution time longer than 60s (TBC).

RA-MO-470 It shall be possible to initially command the instrument in a open-loop tracking mode with a time limit parameter, after which the loop shall be closed autonomously. It is clear that it must be possible to disable this feature, for example by setting the limit parameter to a unused value, like a negative value.

5.4.3 FUNCTIONAL REQUIREMENTS

5.4.3.1 Low Resolution Mode Functional Requirements In this mode the instrument will provide averages of the power spectra of the acquired echoes.

RA-FU-010 The Radar Pulse Repetition Frequency (PRF) shall be fixed and shall not exceed the decorrelation limit.

RA-LR-020 The transmitted pulse length shall be fixed.

RA-FU-030 All received echoes, after the deramp process, shall be converted to echo power profiles in frequency domain with, at minimum, 128 samples.

RA-FU-040 The sample spacing in the frequency domain, when expressed at echo time delay, shall be equal to the reciprocal of the useful (processed) bandwidth.

RA-FU-050 Groups of consecutive echo power spectra shall be averaged together to yield average Spectra (called waveforms) at a constant rate. These spectra shall be transmitted to the ground at a fixed rate in the range 20±4 Hz.

RA-FU-060 During the averaging period, the position of the tracking window shall be adjusted at PRF rate with a linear variation and with a resolution of at least 1/64th of a range gate.



page 77 of 203

RA-FU-070 During the averaging period the gain of the receive chain shall be fixed.

RA-FU-080 Waveform samples shall be coded with at least 16 bits.

RA-FU-090 For each averaged echo waveform, the instrument shall provide the delay (called waveform delay) of a time reference point within the waveform with respect to the transmitted instant with a resolution better than 50ps. This requirement refers to resolution, which is to the coding of the delay information (e.g. number of bits). The time reference point will typically be the centre of the window.

RA-FU-100 For each averaged echo waveform, the instrument shall provide the means to relate a time reference point within the waveform to the ART, with a resolution of typically 2µs.

RA-FU-110 For each averaged echo waveform, the instrument shall provide the ratio of a reference received power value within the waveform with respect to the (nominal) power level of the transmitted pulse with a resolution of better than 0.02dB. In principle this requirement has the same intention, to control the coding of the relevant value in the science data. The received power is the object of the requirement, although to find the Sigma-0 the transmit power is also needed. We commonly assume that the transmitter is stable over long periods, and have appropriate means of verifying this (e.g. transmit power monitor, internal calibration). The received echo has an unpredictable shape, so it is inconvenient to try to specify how this might be measured. Therefore we assume a reference power level is defined (for example half the full scale of the ADC) and will use this to scale the telemetered echo samples.

5.4.3.2 SAR Mode Functional Requirement

RA-FU-200 In this mode the instrument shall operate with bursts.

RA-FU-210 In this mode the instrument shall provide sequences of individual, consecutive echoes represented as complex samples in the time domain and acquired coherently.

RA-FU-220 The Radar Pulse Repetition Frequency (PRF) within a burst shall be comprised between 1.15 and 1.25 times the Doppler bandwidth associated with the 3dB beamwidth along-track.

RA-FU-230 Every received echo, after deramp process, shall be sampled with, at minimum, 128 complex samples.

RA-FU-240 Samples shall be coded with at least 16 bits per complex sample. This means 8 bits I and 8 bits Q. This level of precision is needed to avoid saturation.



page 78 of 203

RA-FU-250 The sampling frequency of the complex samples and the IF bandwidth shall be

compatible with a range window width of at least 60 m.

RA-FU-260 All received echoes of each burst shall be grouped such that they may be processed together.

RA-FU-270 The Burst Repetition Frequency shall be 80 Hz ± 10%. A high Burst Repetition Frequency is required to observe sea ice. The very specular nature of the water between the ice floes (which is often smooth because protected by the wind), results in the ocean echo appearing only in the central few beams. Thus, to get a good estimate of the elevation of this water surface, the number of looks available may be considerably fewer than implied by the number of beams.

RA-FU-280 For each burst of echoes, the instrument shall provide the delay of a time reference point, within a defined echo, with respect to the transmit instant relevant to this echo (this shall be called burst delay). This burst delay shall be the same for all the echoes of the same burst.

RA-FU-290 The time interval between successive transmit pulses and between bursts shall be known to the same precision as the instrument master clock.

RA-FU-300 For each burst of echoes, the instrument shall provide the delay of a time reference point, within a defined echo of the burst, with respect to ART, with a resolution of typically 2µs.

RA-FU-310 For each burst of echoes, the instrument shall provide the ratio of a reference power value within a defined echo of the burst, with respect to the power level of the transmitted pulse relevant to this echo. This relative power measurement shall be the same for all the echoes of the same burst. This means that no gain corrections (or changes) are permitted during the burst. It also implies that a single value shall be transmitted for all the pulses of the burst (instead of repeating the value for each echo of the burst).

RA-FU-320 In SAR mode, changes of tracking window position and gain setting are not allowed within a burst. This requirement is applicable for both tracking modes (open or closed-loop).

RA-FU-330 The spectral domain echoes used for SAR mode closed-loop tracking shall be telemetered to ground.



page 79 of 203

5.4.4 PERFORMANCE REQUIREMENTS

5.4.4.1 General Performance Requirements

5.4.4.1.1 General Radiometric Performance Requirements

RA-PE-010 All performances shall be met for the different surfaces and the corresponding sigma-0 range and echo shapes as specified in Table 5.4.4-1: Surface type σ0 Ku-band σ0 C-band Ku-band echo type Open ocean 6dB … 25dB 12 dB … 30 dB Echo 1 Coastal zone 6dB … 25dB 12 dB … 30 dB Echo 1 Sea ice 0dB … 55dB not specified Echo 2, 3 and 4 Ice sheet interiors 0dB …. 40dB not specified Echo 2 and Echo 3 Ice sheet margins -10dB … 40dB not specified Echo 1, 2 and 3 In-land water 6 dB … 55dB 12 dB … 40 dB Echo 2, 3 and 4

With echo types defined as follows:

• Echo 1: ocean echo (described in <RD13>); • Echo 2: ice/water echo with a trailing edge slope of -0.125 dB/ns and sigma-0 up

to 40 dB; • Echo 3: ice/water echo with a trailing edge slope of -0.5 dB/ns and sigma-0 up to

40 dB; • Echo 4: ice/water echo with a total echo power of an ocean echo with a sigma-0

of 40dB, integrated across the range window. The trailing edge of Echo 4 is variable and depends on the specified sigma-0.

Table 5.4.4-1: Sigma-0 range and assumed echo shapes

RA-PE-020 The total absolute accuracy of the sigma-0 measurement shall be better than ±1.0 dB rms, after appropriate calibration.

RA-PE-030 The long-term drift error of the sigma-0 internal calibration shall be less than 0.3dB during the mission life-time (TBC)

RA-PE-040 The receiver chain, including digital sections, shall accommodate a pulse-to-pulse variation in echo power of ±10 dB in the time domain.

5.4.4.1.2 General Timing Performance Requirements

RA-PE-050 The accuracy of the knowledge of the waveform delay or the burst delay shall be less than 50 ps.

RA-PE-060 The error in the knowledge of the bias in waveform delay or burst delay, combined with the error in the knowledge of propagation time through waveguides and other components up to the antenna phase centre, shall not exceed 120 ps.



page 80 of 203

5.4.4.1.3 General Echo Fidelity Requirements

RA-PE-070 The noise floor present in the tracking window in the spectral domain shall be lower than –50 dB with respect to the power associated with a pure spectral line of maximum non-saturating level at the ADC input. This requirement only applies to the FFT generation. The noise floor is defined as the average power of all spectral lines excluding the line associated with the test signal

RA-PE-080 The level of any spurious line present in the tracking window and generated by non-linearity of the ADC, leakages, imperfect balance of mixers, or any other interfering signal, shall be lower than –40 dB with respect to the power associated with a pure spectral line of maximum non-saturating level at the ADC input.

RA-PE-090 Power variations of ±10dB within the dynamic range of the receiver shall produce a phase variation of less than 1° in the receiver and a gain change of less than 0.1dB.

RA-PE-100 The gain ripple of the receive chain after deramp and over the frequency band covered by the tracking window shall be lower than 0.5 dB peak-to-peak. Gain ripple is typically dominated by the anti-alias filter.

RA-PE-110 The peaks of the side-lobes of the range impulse response shall deviate from the peaks of the ideal sinc response by less than 1 dB for any side-lobe higher than -25 dB with respect to the peak. The main lobe widening compared to the ideal impulse response shall be <5%. This shall apply to a range impulse response centred anywhere in the central 80% of the range window.

RA-PE-120 The level of any aliased signal resulting from echo sampling shall be attenuated by more than 40 dB over at least 80% of the range window.

5.4.4.2 Low Resolution Mode Performance Requirements

5.4.4.2.1 Radiometric requirements

RA-PE-200 The signal-to-noise ratio of averaged waveforms of Ocean echoes as specified in Table 5.4.4-1, and in the range gate with the maximum average power, shall be ≥ 10 dB in Ku-band.

RA-PE-210 The signal-to-noise ratio of averaged waveforms of Ice sheet interior echoes as specified in Table 5.4.4-1, and in the range gate with the maximum average power, shall be ≥ 6 dB in Ku-band.

RA-PE-220 The signal-to-noise ratio of averaged waveforms of Ocean echoes as specified in Table 5.4.4-1, and in the range gate with the maximum average power, shall be ≥ 10 dB in C-band.



page 81 of 203

All radiometric requirements above shall be met for the highest satellite altitude and a system margin of 1.5 dB. Two-way atmospheric losses of 1 dB shall be considered n Ku-band and 0.1dB in C-band. The use of the term “averaged” here indicates that the link budget shall be computed considering an echo without speckle.

5.4.4.2.2 Tracking

RA-PE-230 In closed loop tracking, the gain tracker shall automatically adjust the gain of the receiver to nominally scale the standard deviation of the digitised signal at 1/5th of the ADC full scale.

5.4.4.3 SAR Mode Performance Requirements

5.4.4.3.1 Radiometric Requirements

RA-PE-300 Over Sea-Ice surfaces (as specified in Table 5.4.4-1), the signal-to-noise ratio of Doppler processed echoes in Ku-band, in the most favorable synthetic beam (nadir beam) shall be ≥ 18 dB, assuming a diffuse, flat surface orthogonal to the antenna boresight.

RA-PE-310 The signal-to-noise ratio of averaged waveforms used for closed-loop tracking over Sea-Ice surfaces (as specified in Table 5.4.4-1), in the range gate with the maximum average power, shall be ≥ 6 dB in Ku-band.

RA-PE-320 The signal-to-noise ratio of averaged waveforms of Coastal zone and Inland-water echoes as specified in Table 5.4.4-1, and in the range gate with the maximum average power, shall be ≥ 10 dB in C-band. All radiometric requirements above shall be met for the highest satellite altitude and a system margin of 1.5 dB. Two-way atmospheric losses of 1 dB shall be considered in Ku-band and 0.1dB in C-band.

5.4.4.3.2 Tracking

RA-PE-330 In closed loop tracking, the gain tracker shall automatically adjust the gain of the receiver to nominally scale the standard deviation of the digitised signal such that 4 bits of headroom remain in the ADC.

5.4.4.3.3 Along-Track Impulse Response

RA-PE-340 The azimuth (along-track) impulse response shall have a main lobe width on the surface of nominally 300m, when the satellite is at the mean altitude.

RA-PE-350 The azimuth impulse response shall have a sidelobe level outside below -13 dB (with no weighting function applied).



page 82 of 203

5.4.4.3.4 Range Ambiguities

RA-PE-360 The Range Ambiguity Ratio (RAR) shall be lower than –55 dB on a uniform backscattering surface (flat earth model).

5.4.4.4 End-to-end performance requirements

RA-PE-400 The space segment (and in particular the topography payload) and the associated ground processing shall meet the range estimation accuracy breakdown as defined in Table 5.4.4-2, over Ocean and Coastal zones

Error type Error

Altimeter random error 1.3 cm

Sea state bias / altimeter bias 2.0 cm

Ionosphere propagation correction error 0.7 cm

Dry Troposphere prop. correction error 0.7 cm

Wet Troposphere prop. correction error 1.4 cm

Total range error (rms) 2.94 cm

Table 5.4.4-2: Altimeter range estimation error breakdown

All values are specified for measurements integrated over 1s and for Significant Wave Height (SWH) of 2m. The specified altimeter random error assumes perfect Brown model <RD13>(or Haynes model <RD14>) echoes.

RA-PE-410 Deviations with respect to values specified in Table 5.4.4-2 are allowed, provided that the overall range estimation error remains below 3cm rms.

5.4.5 CALIBRATION REQUIREMENTS In order to meet the specified performance requirements, calibration shall be performed. This shall include appropriate measurements before launch (on-ground characterisation) and after launch (in-flight calibration):

5.4.5.1 On-Ground Characterisation

RA-CA-010 Any elements of the instrument that have an impact on the instrument performance shall be calibrated and characterised on-ground. Appropriate correction values or models for these elements shall then be derived.



page 83 of 203

The term characterisation means that not only the value of a parameter shall be measured, but also its fluctuations due for example to temperature variations, voltage, signal level, pointing angle etc..

RA-CA-020 The range measurement bias of the nominal instrument relatively to that of the redundant instrument shall be characterised prior to with an accuracy better than 1cm.

5.4.5.2 In-flight Calibration

5.4.5.2.1 Internal Calibration

RA-CA-100 The instrument shall make measurements of internal parameters in order to guarantee that the measurement performance is met under all environmental conditions (e.g. thermal variations, ageing, etc.). This requirement may be met through the use of dedicated calibration modes

RA-CA-110 The instrument shall be able to measure, in-flight, its range impulse response function. Computation of the range impulse response may be done on ground using telemetered I and Q samples

RA-CA-120 The instrument shall be able to measure, over the full measurement bandwidth, the amplitude distortions after deramp, with an accuracy of 0.05 dB. The accurate knowledge of the amplitude ripple over the bandwidth is required to compensate for the corresponding bias in the retrieval. This is especially true for retrieval algorithms based on echo shape fitting (MLE). The accuracy of the method used may depend on the accumulation time of measurements.

5.4.5.2.2 External Calibration

RA-CA-130 An end-to-end, absolute radiometric calibration shall be made in order to ensure the radiometric performance requirements of section 5.4.4.1.1 Such a calibration may be achieved in two different ways: (a) by measuring sigma-0 of a well-characterised natural surface; (b) by using an artificial target such as a well-characterised reflector or an active transponder.

5.4.6 DATATION REQUIREMENTS

RA-DA-010 Instrument measurement data shall be labelled with a time-tag related to ART.

RA-DA-020 The accuracy and precision of the time-tag shall be such that the measurement data may be localised with an uncertainty of 1 m along-track. This requirement is related to the height error induced by the localisation error in the presence of height rate. Illustration: Assume a height rate of 25m/s (or 25m



page 84 of 203

vertical for a displacement of the satellite of 7000m since the velocity is roughly 7000/s). An error of 1m along track induces an error in height of 0.35 cm.

5.5 Microwave Radiometer (MWR) The Sentinel-3 microwave radiometer (MWR) shall support the radar altimeter (RA) to achieve the overall altimeter mission performance by providing the wet atmosphere correction. Such correction could be achieved in two different ways as described under the requirement MR-GE-020.


MR-GE-010 The MWR shall be a balanced Dicke radiometer with Noise-Injection as baseline or a conventional Dicke-type radiometer as a fall-back option.

MR-GE-020 Two possible approaches for determining the wet tropospheric delay using a MW radiometer shall be considered: • Approach 1: 3-channel MW radiometer for estimating the ocean surface

emissivity, column water vapour and cloud water contents; • Approach 2: 2-channel MW radiometer for estimating the column water

vapour and cloud water content, and calibrated sigma-0 from the radar altimeter for estimating the ocean surface emissivity.

5.5.1.1 Frequency Channels and Integration Time

MR-GE-100 The MWR shall measure the radiation in 3 channels for Approach 1 or in 2 channels for Approach 2.

MR-GE-110 The channel centre frequencies shall be 23.8 GHz in channel 1, 36.5 GHz in channel 2 for Approach 2, and additionally 18.7 GHz in channel 3 for Approach 1.

MR-GE-120 The accuracy of the centre frequencies shall be ≤ 10 MHz.

MR-GE-130 The channel bandwidth of the MWR channels shall be 200 MHz.

MR-GE-140 The on-board integration time shall be 0.15 s +/-5%

5.5.1.2 Measurement Geometry

MR-GE-200 The beam-centre separation shall be minimised.

MR-GE-210 The MWR shall have a footprint of 20 km ±≤ 10 % for channels 1 and 2, and ≤ 25 km for channel 3 in case of Approach 1.

MR-GE-220 The beam-centres shall be collocated with that of the RA in across-track direction with an accuracy of ≤ 10% of the smallest footprint



page 85 of 203

MR-GE-230 The spatial separation of the MWR measurement centres shall be such that

collocation within ≤ 10% of the smallest MWR footprint is achieved, after ground processing if necessary.

5.5.1.3 Instrument Modes

MR-GE-300 The MWR shall have at least the following modes of operation: • Power-off state • Initialisation mode • Standby mode • Nominal Operation mode

5.5.1.4 Field-of View Interface Requirement

MR-GE-400 For the accommodation of the MWR on the spacecraft, the Contractor shall ensure an unobstructed field of view starting at the antenna rim and forming a cone of an angle of 4 deg. with respect to the boresight.


MR-FU-010 In Nominal Operation mode, the MWR shall be capable of operating continuously without interruption.

MR-FU-020 MWR shall be capable of continuous operation when the RA is in any of its measurement modes, except in case of interruptions by command.

MR-FU-030 Any of the modes listed under 6.6.1.4 shall be reachable upon ground commands.


MR-PE-010 The MWR shall provide a wet atmosphere correction to an accuracy of ≤ 1.2 cm as target and ≤ 2.0 cm as threshold.

5.5.3.1 Radiometric performance

MR-PE-100 The radiometric dynamic range shall sufficient to meet the calibration and the scene temperature requirements.

MR-PE-110 The radiometric accuracy of each channel shall be ≤ 1 K as target and ≤ 3 K as threshold for scene temperatures between150 K and 313 K.

MR-PE-120 The radiometric stability for all channels shall be ≤ 0.6 K over the lifetime.

MR-PE-130 The radiometric sensitivity of each channel shall be ≤ 0.3 K as target and ≤ 0.6 K as threshold for scene temperatures between 150 K and 313 K.



page 86 of 203

MR-PE-140 The inter-channel radiometric accuracy shall be ≤ TBD K for scene temperatures

between 150 K and 313 K.

5.5.3.2 Antenna Performance

MR-PE-200 The antenna beam efficiency shall be better than 90 %.

MR-PE-210 The antenna sidelobes shall be better than -20 dB of the main-beam peak.

MR-PE-230 The antenna pattern knowledge shall be better than -30 dB of the main-beam peak over complete angular range. (TBC)

MR-PE-240 The beam pointing knowledge shall be ≤ 0.1°.

5.5.3.3 Radiofrequency Interference

MR-PE-300 The MWR shall be accommodated and operated in a way that the maximum disturbance from the RA does not exceed 10% of the accuracy in MR-PE-110 (TBC).

MR-PE-310 In case a blanking function is implemented to prevent interference during RA transmission time interval, it shall be possible to disable this blanking function by ground command.

5.5.4 CALIBRATION REQUIREMENTS

5.5.4.1 On-Ground Calibration/Characterisation

MR-CA-010 Any element of the instrument that has an impact on its performance shall be characterised and calibrated prior to launch.

MR-CA-020 The result of these characterisations shall be used for the on-ground performance verification. The result of such calibration measurements that cannot be repeated in-flight (e.g. antenna characterisations) shall be used for defining the on-ground algorithms.

5.5.4.2 In-Flight Calibration

MR-CA-100 The MWR shall include autonomous internal calibration imbedded within the Nominal Operation mode.

MR-CA-110 An end-to-end, absolute radiometric calibration shall be made in order to ensure the radiometric accuracy (MR-PE-110) and stability (MR-PE-120) requirements. Specifically selected Earth surfaces with homogeneous and well-characterised brightness temperature shall be used for this purpose.



page 87 of 203


MR-DA-010 The MWR data shall be labelled with a time-stamp related to ART.

MR-DA-020 The accuracy and precision of the time-stamp shall be such that the MWR measurements for all channels can be collocated horizontally with the RA measurements with an accuracy better than 10% of the smallest footprint after ground processing.

5.6 GNSS Tracking Equipment The Sentinel 3 GNSS receiver will provide the data necessary for the precise orbit determination (POD) –processed on ground- to achieve the overall altimeter mission performance .Real time navigation and datation information from this equipment will drive spacecraft navigation and datation functions as well as the control of the Radar Altimeter open-loop tracking function.


GN-GE-010 The GNSS shall provide carrier phases, code phases, pseudo-ranges, UTC time, 3D position, 3D velocity and signal-to-noise ratio at a sampling rate of 1Hz.

GN-GE-020 The GNSS shall be a dual frequency receiver for the GPS and a dual frequency receiver for the Galileo satellite system.

GR-GE-030 The GNSS shall allow tracking of signals from up to 12 satellites of each of the included satellite systems.

GR-GE-040 The GNSS shall support tracking of the following signals: • GPS L1 C/A • GPS L1C • GPS L1 P(Y) (semi-codeless) • GPS L2C • GPS L2 P(Y) (semi-codeless) • GPS L5 • Galileo L1BC • Galileo E5a

GN-GE-050 For the first satellite it is acceptable that the system only operates with the GPS satellite system and supports tracking of the following signals: • GPS L1 C/A • GPS L1 P(Y) (semi-codeless) • GPS L2 P(Y) (semi-codeless) • Optionally: GPS L2C



page 88 of 203

GN-GE-060 It shall be possible to upgrade this first system to be compliant with GN-GE-020,

030 and 040 with minimum instrument modifications.

5.6.1.1 Instrument Modes

GN-GE-100 The GNSS shall have at least the following modes of operation: • Power-off state • Initialisation mode • Navigation mode

5.6.1.2 Coverage

GN-GE-200 The GNSS shall enable robust tracking for elevations down to 5° (10° for semi-codeless P(Y) code) and robust acquisitions down to 10° (15°for semi-codeless P(Y) code).

5.6.1.3 Lifetime and Reliability

GN-GE-300 The minimum lifetime shall be compatible with the Satellite lifetime as specified in this SRD.

GN-GE-310 The reliability of the GNSS at the end of the specified lifetime shall exceed 95%.


GN-FU-010 The GNSS Receiver shall at all times be in a defined and identifiable mode.

GN-FU-020 In navigation mode, the MWR shall be capable of operating continuously without interruption.

GN-FU-030 Any of the modes listed under 5.6.1.1 shall be reachable upon ground commands.

GN-FU-040 The GNSS shall achieve a cold start time to first fix of <5 minutes as a target and <10 minutes as a threshold in 90% of all cases.

GN-FU-050 The GNSS shall allow tracking of unhealthy satellites. Tracking of healthy satellites shall have priority.

GN-FU-060 The GNSS shall allow the specification of an elevation mask by ground command.

GN-FU-070 The GNSS shall accept the input of current time, orbital elements and GNSS almanac to enable a warm start.


GN-PE-010 Multipath effects shall be limited to:



page 89 of 203

• <1m peak and <0.3m RMS for ionosphere-free pseudorange combinations above

10 degrees elevation. • <15mm peak, <5mm RMS for ionosphere-free carrier phase combinations above

10 degrees elevation.

5.6.3.1 Near Real Time

GN-PE-100 The GNSS and the associated ground processing shall provide in near real time (<3h) the satellite position to an accuracy of 8cm in nadir direction.

5.6.3.2 Slow Time Critical

GN-PE-200 The GNSS and the associated ground processing shall provide within 2 days the satellite position to an accuracy of 3cm in nadir direction.

5.6.3.3 Non Time Critical

GN-PE-300 The GNSS and the associated ground processing shall provide the satellite position to an accuracy of 2cm in nadir direction.

5.6.3.4 Real Time Navigation Solution

GN-PE-400 The GNSS shall provide a real time navigation solution comprising: • The Cartesian position in the Earth fixed reference frame (WGS84/ITRF) • The Cartesian velocity in the Earth fixed reference frame (WGS84/ITRF) • The Cartesian position in the Inertial reference frame (see Appendix A.1) • The Cartesian velocity in the Inertial reference frame (see Appendix A.1) • The receiver clock offset • The receiver clock drift • The estimated GPS-Galileo clock offset (if applicable)

GN-PE-410 The GNSS shall generate the navigation solution at a rate of 1Hz.

GN-PE-420 The GNSS shall provide position and velocity relative to the adopted reference system to support the altimeter open loop operation including: • Geographic east longitude • Geographic latitude • Height above reference ellipsoid • Flight azimuth • Ground speed • Altitude rate as derived from the Cartesian navigation solution Alternative parameters can be proposed by the Contractor, if appropriate



page 90 of 203

GN-PE-430 The root mean square error of the navigation solution shall be less than:

• 3m and 10cm/s in radial direction • 6m and 10cm/s in along and across track direction

GN-PE-440 The GNSS shall allow the generation of purely kinematic and dynamically filtered solutions.

GN-PE-450 The GNSS shall accept an antenna offset vector in the spacecraft-fixed system to refer the computed position to the centre of gravity.

GN-PE-460 The GNSS shall generate a one pulse per second signal that can be related to ART with an accuracy of 1µs.


GN-DA-010 The GNSS shall provide accurate time to the satellite bus such that all time related performances, in particular the geo-location of the altimeter data can be achieved.

GN-DA-020 The GNSS measurements shall be referred to receiver time.

GN-DA-030 The GNSS measurements shall be collected at integer seconds of the receiver time.

GN-DA-040 The GNSS receiver time shall be controlled such as to deviate from ART time by less than 1ms. Clock adjustments shall be confined to integer multiples of 1ms and shall be monitored.

GN-DA-050 The GNSS measurements output interval shall be adjustable to 1s, 5s, 10s and 30s and the time-of-day of the output epoch shall be an integer multiple of the sampling interval.

5.7 Laser retroreflector (LRR)

PL-LR-010 A laser retroreflector (LRR) for precise range measurements from ground-based Satellite Laser Ranging (SLR) stations shall be provided.

PL-LR-020 The LRR shall be located with a field of view towards the earth such that it is visible from ground-based satellite laser ranging stations when the spacecraft is at all elevations above the horizon and for all azimuths. Minor occultations due to satellite appendages are allowed.

PL-LR-030 The location of each phase centre of the LRR in the Satellite Control Reference Frame (see appendix A.8) shall be known with a maximum error of 3 mm.

PL-LR-040 The contribution of the LRR to the overall accuracy of laser ranging shall not exceed 7 mm.



page 91 of 203

PL-LR-050 The LRR shall be designed to be compatible with SLR stations operating at

wavelengths of 532 nm and/or 694 nm.

5.8 Fire Instrument

PL-FI-010 The Satellite shall provision engineering and operational resources for the optional accommodation of the FIRE instrument according to <ND6>.



page 92 of 203

6 SATELLITE REQUIREMENTS

SA-SY-010 System-level functional design and analysis shall be done according to the requirements of <SD4>

6.1 Attitude and orbit determination and control

6.1.1 AOCS GENERAL REQUIREMENTS

AO-GE-010 The AOCS design shall follow the requirements of <SD26>

AO-GE-020 The satellite shall provide an Attitude and Orbit Control Subsystem (AOCS) that shall be able to: • provide attitude control around three orthogonal axes during all mission phases

and for all mission modes of operation • correct for worst case launcher injection errors, • perform orbit corrections to maintain the orbit parameters within the required

range during the mission life, • supply sensor data to allow on-ground attitude and orbit determination, • protect the payload from sun intrusion into its sensitive field of view for longer

than the specified time, • maintain the satellite and payload in a safe attitude at all times in the case of full

propellant tanks as well as in the case of partially filled propellant tanks.

AO-GE-030 The AOCS shall provide all necessary capabilities and performances to satisfy the attitude and orbit control, and measurement requirements of all mission phases and operational modes.

AO-GE-040 All AOCS functions shall provide cold redundancy.

AO-GE-050 All nominal AOCS operations shall be fully automatic and autonomous. Ground intervention shall be limited to support for recovery operations after multiple failures.

AO-GE-060 The AOCS operations shall allow direct and time tagged telecommanding.

AO-GE-070 The AOCS shall allow reconfiguration and parameter updating upon ground command. No patch commands shall be used for this purpose

AO-GE-080 Without the need for telemetry reprogramming, the AOCS shall provide the ground with sufficient measurement information to permit the satellite position and



page 93 of 203

instrument pointing reconstitution with the accuracy required by the mission, system and operational requirements, throughout the relevant mission phases.

AO-GE-090 Upon ground command or by specific telemetry packets, the AOCS shall provide sufficient information to ground to allow diagnosis of on-board failures.

6.1.2 GUIDANCE MODES

AO-GM-010 The AOCS shall be able to execute the following guidance modes: • Initial Rate damping • Emergency Safe Attitude mode • Earth pointing mode The guidance function defines the reference frame to be used as control target for the attitude. It also computes the necessary feed-forward terms

6.1.2.1 Initial Rate damping

AO-GM-100 The satellite shall allow, after separation from the launch vehicle, to damp out residual angular rates and to bring the satellite into the Emergency Safe Attitude mode autonomously within a time compatible with the satellite internal power. The SA deployment is commanded at some TBD point during this mode

6.1.2.2 Emergency Safe Attitude mode (ESAM)

AO-GM-200 Emergency Safe Attitude Mode shall be defined by the sun pointing frame (see Appendix A.7).

AO-GM-210 The satellite shall be able to maintain the ESAM for an unlimited period of time waiting ready to receive ground commands

AO-GM-220 The attitude sensors and actuators involved in the ESAM shall be different from the sensors and actuators involved in the nominal Earth pointing mode. This is to ensure independence between the nominal and safe mode functionalities

AO-GM-230 The maintenance of the Sun pointed safe mode shall not require the use of the thrusters. This will made the safe mode more robust and will ensure that the permanence in safe mode does not reduce the expected life for the satellite

AO-GM-240 The satellite shall guarantee that, in Safe Mode the pointing inaccuracy of the axis pointed towards the Sun with respect to Sun direction is less than 30˚ (TBC)



page 94 of 203

AO-GM-250 The maximum convergence time towards the ESAM shall be less than 4 hours on

transition from the worst case attitude state, including failures.

6.1.2.3 Earth pointing mode (EPM)

AO-GM-300 The AOCS shall acquire and maintain a three-axis Earth Pointing Mode by aligning the Spacecraft Control frame with the Orbital frame (see Appendix A.7)

AO-GM-310 The nominal guidance mode used during the mission shall be the EPM variant with simultaneous yaw steering and geodetic pointing (see below)

AO-GM-320 In EPM, the absolute measurement error (AME, see Appendix C.3) shall be less than 0.25 mrad 3 sigma for each axis or less if so required to meet the mission product geo-location requirements.

AO-GM-330 In EPM, the absolute pointing error (APE, see Appendix C.3) shall be less than 1.75 mrad 3 sigma for each axis or less if so required to meet the mission product geo-location requirements.

AO-GM-340 In EPM, the 3 sigma relative pointing error (RPE, see Appendix C.3) shall be specified to be compatible with the optical instruments requirements and in particular with requirements of section 5.2.5.3 (MTF)

AO-GM-350 The AOCS shall be able to acquire nominal Earth pointing attitude and rates from any Satellite initial attitude and under 1.5 times the worst case rates at separation from the launcher. Note: the pointing performance at this time may be degraded with respect to Operational Phase requirements, but should be good enough to satisfy the satellite power and thermal safety requirements.

6.1.2.4 Yaw steering sub-mode

AO-GM-400 The spacecraft shall allow a variant of the EPM, where the reference frame is the yaw steering frame defined in Appendix A.5 instead of the orbital frame. All other EPM requirements are maintained.

AO-GM-410 It shall be possible to perform yaw steering in conjunction with geodetic pointing or in isolation. The Appendix A: specifies this distinction.

6.1.2.5 Geodetic pointing sub-mode

AO-GM-500 The spacecraft shall allow a variant of the EPM, where the reference frame is the geodetic pointing frame instead of the orbital frame. All other EPM requirements are maintained



page 95 of 203

6.1.2.6 Flight path pointing sub-mode

AO-GM-600 The spacecraft shall allow a variant of the EPM where the reference frame is the flight path frame defined in Appendix A: instead of the orbital frame. All other EPM requirements are maintained with the exception of the pointing error. The flight path pointing sub-mode is better suited to orient the thrust direction with respect to the spacecraft velocity, no matter the eccentricity of the orbit

AO-GM-610 In flight path pointing sub-mode, the pointing accuracy shall be compatible with the required thrust accuracy and fuel efficiency.

6.1.3 NAVIGATION

AO-NA-010 The satellite shall be capable of performing autonomously in-orbit navigation. The navigation function is defined as the determination of the attitude and orbit state of the spacecraft by the use of sensors

AO-NA-020 The navigation accuracy shall be accounted for in the spacecraft performance budget for pointing and geo-location.

AO-NA-030 The navigation function shall merge the measurements of the sensors available or a subset of them. A sensor is available if it has been configured for the commanded guidance mode

AO-NA-040 The navigation function shall cope with sensor data outage. This allows some robustness against “holes” in data without going to safe mode prematurely

AO-NA-050 The navigation function shall reject invalid or outdated sensor data

AO-NA-060 The navigation function shall account for the datation of the input measurement.

AO-NA-070 It shall be possible to reset or initialise the navigation function from ground.

AO-NA-080 It shall be possible to observe and assess the performance of the navigation function by using housekeeping telemetry of raw sensor data, navigation results, residues, state covariances, validities, etc

AO-NA-090 It shall be possible to tune the navigation function in-orbit

AO-NA-100 The states of the navigation function shall be numerically limited to physically realistic values and actively avoid any numerical exception.

AO-NA-110 The navigation function shall flag anomalies (excessive residues, divergence, invalid inputs, etc) to the FDIR function.



page 96 of 203

AO-NA-120 The navigation function shall flag on-board and in the telemetry the validity of its

results.

AO-NA-130 The navigation function results shall be systematically dated in ART to a precision compatible with the mission performance requirements.

AO-NA-140 Any on-board ephemeris (e.g. Earth, Sun, stars) shall nominally not require any regular update from the ground.

6.1.3.1 Attitude navigation

AO-NA-200 The attitude navigation function shall determine continuously in real time the attitude state of the spacecraft using the sensors configured for the actual mode.

AO-NA-210 The autonomy of the navigation function shall be supported by a star tracker with a “lost in space” acquisition capability.

AO-NA-220 The attitude navigation function shall use at least two star tracker heads. This is required to optimise the accuracy which is poorer around the LOS with only one head

AO-NA-230 The attitude navigation function shall account for the state of all moving parts. This includes any reaction wheels and moving solar array

AO-NA-240 The attitude navigation function shall perform nominally with 1 minute outage of the sensor data or at least 5 star tracker re-acquisition times, whichever is longest.

6.1.3.2 Orbit navigation

AO-NA-300 The orbit navigation function shall determine continuously in real time the orbital state of the spacecraft using the GNSS instrument part of the payload.

AO-NA-310 The orbit navigation function shall cope with one orbit period outage of the GNSS instrument without degradation of the mission performances. This implies the implementation of an orbit propagator within the orbital navigation

AO-NA-320 The precision of the orbital navigation shall have an error in the determination of the radial distance to the Earth, compatible with the Radar Altimeter open-loop tracking requirements.

AO-NA-330 The precision of the orbital navigation shall have an error along track compatible with the mission performance requirements

AO-NA-340 The precision of the orbital navigation shall have an error across track compatible with the mission performance requirements



page 97 of 203

6.1.3.2.1 Orbital events prediction

AO-NA-350 The orbit navigation function shall continuously predict the following orbital events by providing the time, in ART, up to the event and after the event, which ever nearest: • Eclipse entry • Eclipse exit • Conventional day entry and exit, defined as the sun being 10deg above the

horizon at the target point (see Appendix A: about reference frames) • Ground station fly-by for at least 8 locations commanded from ground (TBC) • Ascending node passage • Descending node passage These functions are used when defining autonomous operations. The fly-by is defined as the time when the satellite is at the highest point in the sky as seen by the Ground station

6.1.3.2.1.1 Local altitude determination

AO-NA-360 The orbit navigation function shall continuously determine in real time the height of the spacecraft above the local vertical target point. In support of altimeter tracking

6.1.3.2.2 Orbit reconstruction

AO-NA-370 The Satellite shall provide in the telemetry, the full raw navigation data from the GNSS instrument (i.e. pseudo-ranges, carrier phases, system data, etc.), the full raw attitude measurement and other ancillary data (e.g. solar array position, fuel gauge) for Precise Orbit Determination processing on ground.

6.1.3.2.3 Navigation in Rate damping mode and ESAM

The attitude and orbit navigation requirements don't apply during Initial Rate Damping and ESAM

AO-NA-380 During initial rate damping and ESAM, the navigation function shall be limited to the minimum processing of the sensors required by the control. Complex filtering algorithms, possibly not extremely robust, are then avoided in those critical modes.

AO-NA-390 During initial rate damping and ESAM, a sun sensor shall define the sun direction.



page 98 of 203

6.1.4 CONTROL

6.1.4.1 Attitude control

AO-CO-010 The attitude control function shall aim at minimising the distance between the desired state, defined by the commanded guidance, and the actual state, estimated by the navigation.

AO-CO-020 The attitude control of the satellite shall be fully autonomous from ground for all guidance modes.

AO-CO-030 The attitude control shall not use thrusters, except during initial rate damping (if necessary)

AO-CO-040 The attitude control function shall periodically command actuators with minimum period jitter. This means the control loop delay is always an integer number of cycle and doesn't try to actuate earlier even if the computation is finished. This decouples the AOCS software functions from the other functions also running on the same computer.

AO-CO-050 The attitude control algorithms shall use feed-forward terms (TBC)

6.1.4.1.1 Attitude control during ESAM

AO-CO-060 The AOCS shall allow to autonomously recover a three-axis stabilised Earth pointing attitude upon ESAM exit.

AO-CO-070 In case the sun cannot be acquired by any sensor during ESAM, the attitude control function shall implement a search strategy.

6.1.4.1.2 Sun avoidance

AO-CO-080 The attitude control of the satellite shall avoid Sun intrusion on sensitive surfaces during: initial attitude acquisition following the launch, safe mode and transitions between modes This avoidance could be implemented by adding functionalities to the satellite attitude control, to the instrument, e.g. shutters, or to both

6.1.4.1.3 Attitude offset

AO-CO-090 It shall be possible to command any attitude offset from the actual guidance mode.

6.1.4.1.4 Autonomous slewing

AO-CO-100 Large attitude errors shall be compensated by minimum-time autonomous slewing compatible with the sun avoidance requirement.



page 99 of 203

AO-CO-110 The satellite shall be able to perform a 90˚ slew manoeuvre in less than 10 minutes

This is a reasonable value to have fast preparation for orbital changes when needed

6.1.4.1.5 Robustness

AO-CO-120 The AOCS shall be able to function and meet its performance requirements for any day of launch.

AO-CO-130 The AOCS shall acquire and maintain a nominal three-axis stabilised earth pointing control throughout its orbital life (except when in ESAM) in the presence of environmental and internal perturbation torques, satellite flexible modes, solar array motion or liquid propellant sloshing during all mission phases and operational modes.

AO-CO-140 The AOCS performances shall be guaranteed against all parametric and dynamic uncertainties or errors.

AO-CO-150 The AOCS performances shall be nominal for any filling level of the propellant tanks

AO-CO-160 Firing of the thrusters for orbit maintenance shall have a minimum impact on the AOCS performances.

AO-CO-170 The pointing performance shall be achieved in-orbit and include all mounting tolerances, effects of the launch loads, ageing over lifetime and distortions generated by the in-orbit environment.

AO-CO-180 The AOCS shall be able to cope with worst case initial conditions during mode transition and initial separation from the launcher.

AO-CO-190 The satellite shall provide an Attitude and Orbit Control Subsystem (AOCS) that shall be able to minimise the effects of the magneto torques on the magnetometers performances.

6.1.4.1.6 Tuning

AO-CO-200 It shall be possible to observe and tune the attitude control algorithms from the ground, using specific telecommands. Generic patch commands shall not be used for this function

6.1.4.2 Orbit control (propulsion)

AO-CO-300 The Propulsion Subsystem design shall be compliant with the applicable standard for Liquid Propulsion Handling and Storage <SD11> as defined in appendix E.9.

AO-CO-310 The satellite shall include the functions necessary to perform, under ground command, attitude and orbit correction manoeuvres as needed by:



page 100 of 203

• initial rate damping, • nominal orbit maintenance and phasing, • collision avoidance • calibration • end of life disposal

AO-CO-320 The implementation of orbit control manoeuvres shall minimise the overall loss of data and shall be compatible with the overall availability requirements specified in section 6.9.3.

AO-CO-330 The Propulsion Subsystem shall perform nominally for a period including: • the pre-launch lifetime, • the satellite storage requirement, • the mission lifetime.

AO-CO-340 The Propulsion Subsystem shall provide impulse and steady state thrust capability for control and orbit manoeuvres

AO-CO-350 The accommodation of the propellant tanks shall be optimised for the pointing requirements. The variation of the Centre of Gravity caused by the use of propellant throughout the satellite lifetime shall be considered

AO-CO-360 The location of the thrusters shall minimise contamination on sensitive surfaces, especially on optical surfaces

AO-CO-370 The characteristics of the thrusters and their accommodation (incl. misalignment error) on the satellite shall not cause any adverse effects on either the satellite or the payload during the mission.

AO-CO-380 No thruster shall be obstructed at any time by appendages

AO-CO-390 The availability and use of recorded housekeeping telemetry values around the orbit, to determine limit cycle characteristics, shall be considered when sizing sensors

AO-CO-400 It shall be possible to load, unload and decontaminate the propulsion elements in the launch configuration on the launch site

AO-CO-410 The propulsion elements shall be capable to remain loaded for minimum of 6 months prior to launch in a controlled environment and under launch pressure

AO-CO-420 The propulsion elements ground operations performed at the launch site shall be done in agreement with the launch site applicable Safety Regulations. Safety regulations applicable for the nominal and back-up launcher will be identified during the course of the Programme.



page 101 of 203

6.1.4.2.1 Propulsion system performances

AO-CO-430 The propulsion subsystem shall be sized in order to correct the launcher injection errors and to maintain the orbit parameters within the required conditions.

AO-CO-440 The Satellite shall have thrust and propellant storage capabilities for: • Attitude acquisition after separation from the launch vehicle • Attitude re-acquisition after failure or anomaly • Orbit acquisition • Maintenance 12 years of routine operations. The worst case launch date w.r.t. the

solar activity cycle shall be considered for the derivation of the propellant budget of the operating orbit within specified ranges for 7 years

• Orbit phasing in case a second satellite is put into orbit • Deorbiting Delta-V • Collision Avoidances • Inaccuracy in the fuel mass measurement method • A 20% margin policy

AO-CO-450 Three sigma values of dispersion errors and perturbations (e.g. atmospheric density, thruster misalignment, thruster efficiency, pressurant loading) shall be considered in the determination of propellant budgets.

AO-CO-460 For all the orbital change manoeuvres, except for end of life disposal, the Delta-V range shall be 0.002 m/s – 5 m/s for in plane manoeuvres and 0.1 m/s -10 m/s for out of plane manoeuvres.

AO-CO-470 For all the orbital change manoeuvres, except for end of life disposal orbital change the manoeuvres realisation shall be better than 5%.

6.1.4.2.2 Propulsion fuel gauging

AO-CO-480 The AOCS shall provide adequate means for determination of the remaining propellant quantities and the position of the satellite COG

AO-CO-490 Fuel gauging accuracy shall be such as to maximise fuel usage in the Operational Phase but ensure that sufficient fuel is available: • to terminate Routine Operations and undertake a controlled re-entry, if this design

option is retained, • in the Operational Phase, to predict the end of the mission with an accuracy of

three months.

6.1.4.2.3 Orbit maintenance

AO-CO-500 In order to minimise the mission unavailability duration it shall be possible to perform the in-plane orbital manoeuvres in the nominal pointing attitude, without slewing the satellite



page 102 of 203

6.1.4.2.4 Actuator calibration

AO-CO-510 Following the launch of the Satellite, small orbital manoeuvres will be allowed so that unwanted torque disturbances generated during thrusters firing can be characterised. The use of such characterisation manoeuvres shall be considered when sizing actuators

6.1.4.2.5 Collision avoidance

AO-CO-520 The design shall allow the performance of 1 in plane collision avoidance manoeuvre per year, each one consisting in a 1km variation of altitude and subsequent re-acquisition of nominal orbit. It shall be assumed that the avoidance manoeuvre will be announced at least 12hrs before the collision event and take place 1 orbit before the event

6.1.4.2.6 End-of-life disposal

AO-CO-530 It shall be possible to perform the end of life disposal manoeuvre in compliance with European code of conduct for Space debris mitigation <RD10> The end of life manoeuvre will be normally performed after 10 years in orbit.

AO-CO-540 After performing end of life orbit altitude reduction, the satellite shall be left in a state that avoids subsequent tank explosion

6.1.4.3 Momentum control

AO-CO-600 The system angular momentum shall be controlled by using magnetic torquers bars in order to avoid reaction wheel saturation.

AO-CO-610 The minimum and maximum thresholds for controlling the system momentum shall be commandable from ground.

AO-CO-620 The momentum control function shall not degrade the nominal pointing performances.

6.1.5 FDIR

AO-FD-010 The AOCS shall be capable of autonomous Failure Detection, Isolation and Recovery (FDIR)

AO-FD-020 The primary objective of the AOCS FDIR shall be to detect any s/c condition (attitude, rates, orbit changes) that present a potential threat to the safety of the mission and to correct any such condition and isolate the cause by means of transition to Safe Mode.

AO-FD-030 The secondary objective of the AOCS FDIR shall be to maintain the Operational condition of the s/c as much as reasonably possible by the correct, timely and



page 103 of 203

unambiguous detection of equipment and software failures, errors and anomalies and the recovery of such failures, errors and anomalies by automatic software action and/or hardware reconfiguration.

AO-FD-040 The mechanisms implementing the two objectives of the AOCS FDIR shall be kept as separate as possible and meeting the primary objective shall always have priority.

AO-FD-050 In case of anomalies not resolved by autonomous on-board redundancy, reconfigurations, compensations or back-up actions, the satellite shall enter ESAM.

AO-FD-060 The AOCS function shall trigger ESAM when the navigation function is invalid for more than 60 sec. For example after an excessive sensor data outage.

AO-FD-070 Speed saturation of one wheel shall provoke the autonomous reconfiguration to a redundant wheel.

AO-FD-080 The AOCS function shall implement a specific protection mechanism against sign errors during the initial rate damping and ESAM. Sign errors are not unlikely and a protection is necessary in case the separation from launcher is not performed under visibility from the ground

AO-FD-090 The norm of the measured earth magnetic field vector shall be monitored against a physically realistic range. The magnetometer shall be switched to redundant when out-of-range to trigger reconfiguration.

AO-FD-100 Thrusters actuation shall implement in hardware an arm and safe function.

AO-FD-110 The maximum thruster pulse duration shall be limited in hardware.

6.2 Communications


SA-CO-010 The design of the spacecraft for Radio Frequency and Modulation shall be compliant with <SD24>, with applicability as defined in appendix E.17.

SA-CO-020 Satellite Radio Frequency emissions shall be kept at a level such that they do not interfere with users of other bands. (Section 5.5.1 of <SD24>)

SA-CO-030 The Power Flux Density limits on the Earth’s surface shall not be exceeded during all mission phases except potentially during the launch and ascent phase. (Section 5.5.3 of <SD24>).

SA-CO-040 The architecture of the data handling shall comply with the recommendations of <SD19>.



page 104 of 203

6.2.2 TRACKING, TELEMETRY AND COMMAND (TT&C) REQUIREMENTS

6.2.2.1 Functional requirements

SA-CO-100 The S-band TT&C Communication Subsystem shall provide all Tracking, Telemetry and Command services during all mission phases to ensure satellite command and control as well as satellite range and range rate measurements.

SA-CO-110 During nominal situations, the satellite shall ensure S-band bi-directional communications at pre-programmed intervals as required for satellite operations and unambiguous determination of satellite performance

SA-CO-120 The S-band TT&C subsystem shall be able to simultaneously receive and demodulate commands, to modulate and transmit telemetry, and to process the ranging signal.

SA-CO-130 The S-band TT&C subsystem shall be compliant with the requirement on RF emissions imposed by the launcher authorities. (Section 5.5.1.4 of <SD24>)

SA-CO-140 The S-band uplink physical layer RF transmission and modulation shall comply with the requirements of <SD24>.

SA-CO-150 The S-band uplink data link layer shall comply with the requirements of <SD23>. The COP 1 sequence control and expedite services shall be implemented.

SA-CO-160 The S-band uplink network layer shall comply with the requirements of <SD32>. APID definition and allocation shall be specified by the Contractor and approved by the Agency.

SA-CO-170 The S-band downlink physical layer RF transmission and modulation shall comply with the requirements of <SD24>.

SA-CO-180 The S-band downlink data-link synchronisation and coding sub-layer shall comply with the requirements of <SD20>.

SA-CO-190 The S-band downlink data link layer protocols shall comply with the requirements of <SD22>: • The number and usage of Virtual Channels shall be specified by the Contractor

and approved by the Agency. • The mechanism used for maintaining the link synchronous in the absence of data

shall be specified by the Contractor.

SA-CO-200 The S-band downlink network layer shall comply with requirements of <SD32>. APID and allocation shall be specified by the Contractor.

SA-CO-210 The S-band TT&C link shall support range and range-rate measurements according to <SD21>, with applicability as defined in E.16.



page 105 of 203

SA-CO-220 The S-band TT&C function shall allow TM/TC and ranging operations.

SA-CO-230 The S-Band subsystem shall be compatible with the ground station characteristics for LEOP and routine operations, as defined in <ND3>.

SA-CO-240 The S-band TT&C subsystem shall receive and process the uplink telecommand signal from ground for subsequent transmission to the CDHS.

SA-CO-250 The S-band TT&C subsystem shall receive and modulate housekeeping telemetry data stream from the CDHS and transmit these data to the ground.

SA-CO-260 Hot redundancy shall be provided for the S-band TT&C receive function and cold redundancy for the transmit function.

SA-CO-270 The S-band TT&C and CDHS subsystems shall be fully cross-trapped for Telecommand and housekeeping Telemetry data transfer from and to the Ground Station.

SA-CO-280 The S-band TT&C subsystem configuration shall be such that both receivers can receive and both decoders can decode simultaneously.

SA-CO-290 Each S-band subsystem shall be able to operate either in non-coherent or in coherent mode. This functionality shall be selectable by telecommand.

SA-CO-300 The TT&C subsystem shall be designed so that the transmitters can be switched ON and OFF at any time by the Ground Segment. It is clear that switching off the receivers shall not be possible

SA-CO-310 The design of the spacecraft shall be compatible with switching-off the transmitters when not in visibility from the S-band Ground Station

SA-CO-320 The S-band receivers shall provide indication of the received signal quality to the CDHS.

SA-CO-330 The S-band TT&C subsystem shall provide the required telecommand, telemetry and ranging capabilities in any satellite attitude.

SA-CO-340 The S-band antenna configuration shall ensure omni-directional coverage of the satellite from the ground stations network, whilst ensuring compliance with all other TT&C subsystem requirements, for all mission phases and for all satellite attitudes.

SA-CO-350 The S-band TT&C communications links shall be capable of operating to within specification during all expected Doppler shift and Doppler rate conditions, experienced during the different mission phases.

SA-CO-360 The S-band TT&C subsystem shall be capable of recovering from a failure autonomously, with possible override of the autonomous recovery action by use of ground commands.



page 106 of 203

6.2.2.2 Performance requirements

SA-CO-370 The link budget calculations for TM/TC and Ranging and associated margins shall be according toAnnex D of <SD24> with: • Nominal margin >3dB • RSS worst-case margin >0dB • Mean - 3σ margin >0dB

SA-CO-380 The TT&C subsystem modulation schemes shall be selected according to the guidelines provided in <SD24>, whilst trying to minimise the occupied bandwidth of the transmitted signals.

SA-CO-390 Uplink budget margins shall be met for a BER of 10-5 at the input to the telecommand decoder.

SA-CO-400 The S-band housekeeping telemetry data link shall have a probability of frame loss better than 10-7

SA-CO-410 The downlink frame rejection rate should be less than 10-5 (based on raw channel before coding)

SA-CO-420 The probability of undetected frame-error shall be better than 10-9

SA-CO-430 The S-band TT&C function shall support the following telecommand and telemetry data rates: • TC uplink = 4 kbps or 64 kbps (TBC) • TM downlink = up to 1 Mbps The higher uplink rate is intended to relax the operational constraints that may rise from large uploads and/or large number of commands. The feasibility of implementing 64 kbps shall be analysed at the beginning of Phase B2 by the Contractor.

SA-CO-440 All Satellite housekeeping data (both recorded and real-time housekeeping data) shall be down-linked in S-band.

6.2.3 X-BAND MISSION DATA TELEMETRY DOWNLINK (MDTD) REQUIREMENTS


SA-CO-500 The satellite shall ensure X-band communications at pre-programmed intervals as required for contacts with the Core and Local Ground Stations

SA-CO-510 The X-band communication speed shall be defined to allow: • the downloading of all mission data acquired during one orbit to the Core Ground



page 107 of 203

Station(s) during one pass

• the downloading of the NRT data to Local Users

6.2.3.2 Design requirements

SA-CO-520 The X-band downlink physical layer RF transmission and modulation shall comply with the requirements of <SD24>.

SA-CO-530 The X-band downlink data-link synchronisation and coding sub-layer shall comply with the requirements of ECSS E-50-01, <SD19>.

SA-CO-540 The X-band downlink data-link layer protocols shall comply with CCSDS requirements of <SD31>. • The number and usage of Virtual Channels shall be specified by the Contractor

and approved by the Agency. • The mechanism used for maintaining the link synchronous in the absence of data

shall be specified by the Contractor.

SA-CO-550 The X-band downlink network layer shall comply with CCSDS requirements of <SD32>. The number and usage of Virtual Channels shall be specified by the Contractor and approved by the Agency. .

SA-CO-560 Where image data compression is required, it shall be implemented in accordance with CCSDS requirements of <SD33>.

SA-CO-570 The MTDT Subsystem shall provide the capability to transmit the Mission data to the X-band Ground Stations, assuming a G/T of 33.8 dB/K (including rain and scintillation losses). Appendix G: defines the list of X-band Ground Stations to be used for analysis and simulation purposes.

SA-CO-580 All the data required for the Payload Data Processing (including Payload Instrument data, relevant housekeeping data and other ancillary data such as spacecraft attitude, time correlation packets etc) shall be down-linked in X-band.

SA-CO-590 It shall be possible to switch the MDTD transmit function into OFF and ON-mode by ground command.

SA-CO-600 The MDTD antenna concept shall ensure a constant power flux density for X-band ground stations from acquisition of signal until loss of signal.

SA-CO-610 The MDTD operating frequency band shall be selected from the frequency bands allocated by the ITU and be commensurate with the intended Mission data rate required to meet the Sentinel-3 Mission data requirements, according to <SD24> (Sections 4.1 and 4.2 ECSS-E-50-05A).



page 108 of 203

SA-CO-620 The MDTD downlink modulation scheme shall be selected according to the

guidelines provided in <SD24>, whilst trying to minimise the occupied bandwidth of the transmitted signals.

SA-CO-630 Each of the MDTD data transmission chains shall be individually operable by ground command.

SA-CO-640 Mission data communications to ground shall be packet-based according to <SD31>

6.2.3.3 Performance requirements

SA-CO-650 The MDTD data rate shall be defined by the Contractor for both Core X-band stations and local X-band stations.

SA-CO-660 The link budget calculations for MDTD and associated margins shall be according to Annex D of <SD24> with: • Nominal margin >3dB • RSS worst-case margin >0dB • Mean - 3σ margin >0dB

SA-CO-670 The MDTD frame rejection rate shall be < 10-5

SA-CO-680 The MDTD telemetry probability of transfer frame loss shall be < 10-8

SA-CO-690 The X-band Mission data Communication Subsystem shall provide the capability to transmit the Mission data to the X-band Ground Stations, assuming a G/T of 33.8 dB/K (including rain and scintillation losses).

SA-CO-700 All Satellite recorded housekeeping data shall be down-linked in X-band.

6.3 Command, data handling, monitoring and control

SA-CD-010 The CDH function shall be consistent with the mission objectives and support the implementation of the Operational Interface and Satellite autonomy requirements.

SA-CD-020 The CDH function shall provide adequate interfacing between the Satellite elements to support commanding from the ground and within the Satellite itself, equipments and onboard software control, time synchronisation, datation signal dissemination, and housekeeping and mission data collection, encoding, formatting, recording and transfer to the telecommunication subsystems as relevant.

SA-CD-030 The CDH function shall provide cold redundancy.

SA-CD-040 The CDH function shall provide the capability of direct commanding from ground for essential satellite equipments without on-board software processing.



page 109 of 203

SA-CD-050 The CDH function shall provide essential telemetry data without on-board software

processing

SA-CD-060 The CDH function shall interface with the ground via telecommand and telemetry packets according to the Operational Interface requirements <ND3>.

SA-CD-070 The CDH function shall allow for ground to start the boot-up process from the on-board memory by means of a telecommand. Note that this requirement covers both warm and cold start.

SA-CD-080 The CDH function shall handle at least 10 (TBC) telecommands per second

SA-CD-090 The CDH function shall allow sending any command to any equipment or instrument by direct commanding.

SA-CD-100 The CDH function shall acquire housekeeping data, including explicit or implicit time tag, and transmit them to ground according to the Operational Interface requirements <ND3>. A time tag is implicit when it is relative to the telemetry packet creation time

SA-CD-110 Satellite housekeeping telemetry gathered and stored by the CDH shall be sufficient to allow the Ground to determine the precise health status of all Satellite units and software functions, including the ones that manage the generation and routing of housekeeping telemetry data.

SA-CD-120 The CDH function shall allow sending and collecting raw data from any interface and report them by telemetry. This is intended for troubleshooting

SA-CD-130 The CDH function shall provide data storage and handle it according to Operational interface requirements <ND3>.

SA-CD-140 The data storage size shall include a margin of 25% at EOL.

SA-CD-150 The data storage shall allow simultaneous read and write access. In particular, it shall be possible to continue storing data while transmitting to ground.

SA-CD-160 The data storage shall provide error detection and correction with a residual error rate of 10-12 error/day (TBC).

SA-CD-170 The data storage shall degrade gracefully in case of failure.

SA-CD-180 The CDH function shall maintain the commanded state of all units and instruments and report it in the telemetry.

SA-CD-190 The CDH function shall maintain the availability state of all units and instruments and report it in the telemetry.



page 110 of 203

SA-CD-200 The CDH function shall monitor on-board parameters and report events according to

the Operational Interface requirements <ND3>.

SA-CD-210 The mission performance shall not rely on time accurate execution of software or time accurate data transmission. This is to decouple the functions sharing the CDH

6.4 Electrical Requirements

6.4.1 POWER GENERATION AND DISTRIBUTION

6.4.1.1 Functional Requirements

SA-PO-010 The power subsystem shall generate, store, condition, protect and distribute electrical power as required fulfilling the mission performance requirements during all mission phases and modes of operation including ground testing and pre-launch.

SA-PO-020 The power subsystem shall provide adequate status monitoring and telecommand interfaces necessary for operation, evaluation of its performance and failure detection and recovery. Telemetry shall be implemented to monitor the evolution of the power-energy resources and the sources temperature during the mission. The monitoring of the battery modules shall enable a state of charge prediction with an accuracy better than 10%

SA-PO-030 The power subsystem shall accept power supply from an umbilical external source during ground and launch operations.

SA-PO-040 During ground operations, it shall be possible to isolate the battery from the bus by telecommand and to charge the battery through the umbilical

SA-PO-050 Electrical power shall be distributed in accordance with the load interface requirements, both static and dynamic, as well as the characteristics of the power source

SA-PO-060 The satellite power distribution electronics shall provide full protection against short circuit or overload on any load path

SA-PO-070 Power supply to pyrotechnics devices shall be provided through dedicated distribution lines

SA-PO-080 The power subsystem protection functions shall be able to operate without the support from other spacecraft subsystems and under all operational conditions of the mission including contingency situations. No damage or degradation shall result from intermittent or cycled operation.



page 111 of 203

SA-PO-090 The power subsystem shall autonomously perform the energy management and bus

regulation (when applicable) without support from the other spacecraft subsystems under all operational conditions of the mission including contingency situations.

SA-PO-100 The power outlets shall be switchable by telecommand, with the exception of the power outlets supplying the TC reception chain and other essential equipment.

SA-PO-110 At power up, restart and upon recovery from any power loss, the power subsystem shall set the spacecraft electrical configuration into a known deterministic and reproducible state. This state shall be safe (full battery charging capability and minimum power bus loading) and shall allow a predefined recovery of the spacecraft and of its subsystems.

SA-PO-120 When indefinitely resetable current limiters are used instead of fold-back current limiters, the periodicity of resets after a fault condition shall be such that • no system EMC requirements are violated • the thermal stress resulting from the failed load current does not compromise the

limiter operation i.e. components remain within their deratings.

SA-PO-130 In case the distribution lines are protected by latching, fold-back or periodically reset current limiters, it shall be verified by analysis or test that the transient current peaks at current limiter intervention are within the rated stress limits of the components used for worst case conditions (minimum series impedance case).

6.4.1.2 Design requirements on power system

6.4.1.2.1 General

SA-PO-200 The Power subsystem shall be designed according to <SD5> as defined below in E.3

SA-PO-210 Additional requirements to chapter 5 of <SD5> have been defined within this chapter and their method of verification will be agreed with the Agency following definition by the Prime Contractor

SA-PO-220 The power resources shall be dimensioned with adequate margin providing power up to the end of the mission as defined in <SD5>, however, the margins shall be at least 10% at EOL at the most severe condition between EOL and the most critical phase of the mission power/energy wise .

SA-PO-230 The power subsystem shall be capable to restart automatically after the occurrence of a power interruption as soon as the power from the solar arrays is available again.

SA-PO-240 The power subsystem shall be tested at system level including the redundancy of essential functions and protection features, simulating a worst case power degradation and its recovery.



page 112 of 203

SA-PO-250 The power subsystem shall be able to accept modification of operation parameters

under ground command. Such parameters shall be identified, justified and submitted for Agency’s approval.

SA-PO-260 The power subsystem shall be able to start up from any of the power source irrespective of the status of the other power source (connected or not)

SA-PO-270 The power subsystem shall support the connection of external power sources during ground and launch operations.

SA-PO-280 With the exception of protection features backed-up by functional redundancy at equipment level, provision shall be made to override and disable all other automatic protection features. Note: this requirement replaces requirement 5.3b of ECSS-E-20A

SA-PO-290 Any inhibition of a protection feature which can lead to the loss of the main primary power bus in case of a single failure at satellite level is strictly forbidden

SA-PO-300 The electrical power interface between the solar array(s) and the power control units and between batteries and power control units shall: • be defined • result in the specification of the input impedance seen by the power conditioning

units.

SA-PO-310 Provision shall be made against potential failure propagation in case of short circuit failure of a solar array section and its connection to the power subsystem.

SA-PO-320 When using maximum power point trackers (MPPT) and the resulting differences in the I/V curves of the different strings or panel lead to multiple local maximum power points and mismatches, reducing the transferred power, the resulting MPPT performance shall be included in the power budget

SA-PO-330 All latching protection devices shall be re-settable, this feature having to be periodically autonomous in the case of the TC reception chain and other essential equipment.

SA-PO-340 In the case of a regulated bus, all non–essential loads shall be switched off automatically in the event of a bus undervoltage of more than 10% below the minimum value

SA-PO-350 In the case of an unregulated bus (or battery supply), all non-essential loads shall be switched off automatically in the event of reaching a voltage level corresponding to the battery energy that is able to maintain all essential loads for a time guaranteeing safe recovery. Note: these 2 requirements replace requirement 5.6.2a of ECSS-E-20A



page 113 of 203

SA-PO-360 The non essential load disconnection shall produce a hard-wired signal within the

power subsystem and shall be one failure tolerant.

SA-PO-370 For converters and regulators of the power subsystem (solar array regulator, battery chargers and dischargers) the phase margin shall be at least 60 deg. and the gain margin 10 dB for worst case end of life conditions with representative loading. The phase margin of converters and regulators not belonging to the spacecraft power subsystem shall be at least 50°. Note: this requirement replaces requirement 5.6.3a of ECSS-E-20A

SA-PO-380 The stability of the current limiters shall be ensured for the actual load characteristics, verified by analysis under worst case conditions, and tested under a set of cases agreed with the customer.

SA-PO-390 In case the distribution lines are protected by latching, or periodically reset current limiters, it shall be ensured by worst case analysis and test that the inrush energy demanded by the load in normal switch-on does not cause the trip-off of the latching protection with a margin of 20 %. This requirement will be verified by electrical/thermal analysis under worst case conditions and tested under most representative set of cases.

SA-PO-400 If fuses are used to protect main bus distribution lines, the design shall ensure that the power generation system can fuse them within less than 20ms in case of load short circuit. Note: this requirement replaces requirement 5.7.1.h of ECSS-E-20A

SA-PO-410 For fuses protected bus, the delay before non-essential loads disconnection in the event of a bus undervoltage of more than 10% below the minimum value shall be at least 50ms,

SA-PO-420 In the power distribution, whenever two or more blocks are connected in cascade, the stability of the cascade between each source block and load block shall be ensured by: meeting the Nyquist criterion or, demonstrating that |ZSource| << |ZLoad| by one decade.

SA-PO-430 In the case of hot redundant essential functions, • either latching protection shall not be used, or it shall have an autonomous

periodic reset; • override of critical on-board autonomous functions shall be implemented only if a

safety interlock is implemented preventing the activation of the override feature on both hot and redundant functions.

SA-PO-440 Any protection latch, which does not have autonomous reset capability, shall be at least re-settable from ground command



page 114 of 203

6.4.1.2.2 Solar array

SA-PO-500 The Solar Array shall be developed according to <SD5> and <SD7> as defined below in Appendix E.3 and E.5.

SA-PO-520 The solar array design shall satisfy the power requirements for the mission, including the required margin, as defined in section 6.4.1.2.1.

SA-PO-530 Requirements for the solar array shall be established for all mission phases (ie. Including test, pre-launch, launch, commissioning etc. as well as normal operation)

SA-PO-540 A solar array performance prediction analysis shall be performed and shall include all mission phases, considering all effects having an impact upon performance (e.g. temperature, radiation, contamination, sun intensity, solar aspect angle, UV, micrometeorites, coverglassing, calibration losses, mismatch losses, by-pass and blocking diode losses, all pointing errors including spacecraft attitude and solar array drive related aspects, random failures) and shall be based on accepted cell degradation figures and actual cell performance measurements

SA-PO-550 The solar array design margins shall include the assumption of the loss of one (or more, TBD) electrical string(s), to be accounted in all calculations as a direct loss. In order to meet the solar array reliability requirements, the impact of other loss factors may lead to the addition of other spare strings

SA-PO-560 The solar array shall be designed such that the performance of each string and section allows the efficient use of the selected bus regulation principle during all mission phases

SA-PO-570 The solar array design shall provide protection against short circuit of cells to the structure, shadowing due to antennas or appendages and electrical transients, including discharges (ESD).

SA-PO-580 For ESD, a maximum value of voltage difference between adjacent cells, correlated to a minimum cell gap, shall be derived and applied to the electrical network.

SA-PO-590 The solar array design analysis shall evaluate the impacts of the discharge phenomena on the electrical network and shall provide an inventory of the possible electrical transients that the solar array may be submitted to during the mission

SA-PO-600 All solar array strings shall have individual blocking diodes, where required

SA-PO-610 Solar cells shall be protected against ‘hot spots’ (ie. any deleterious reverse-bias conditions) by the use of by-pass diodes to protect individual cells or groups of cells, as appropriate.

SA-PO-620 The photovoltaic assembly layout shall be designed to minimise the resulting magnetic moment.



page 115 of 203

SA-PO-630 The solar array shall be designed to survive the atomic-oxygen orbit environment

without performance degradation, unless an acceptable level of performance degradation is defined in the requirements

SA-PO-640 All current carrying tracks after blocking diodes shall have double isolation

SA-PO-650 The values of solar array section equivalent capacitance and inductance shall be calculated, in worst case conditions

SA-PO-660 The solar array shall be single-failure tolerant

SA-PO-670 The qualification of the electrical network (e.g. solar cells, SCA’s, by-pass integral diode and relevant assembly) shall include the following tests: • Long duration test of the by-pass diode assembly including reverse/forward bias

testing enveloping the mission environments and requirements • Electrical transient test addressing the inventory of the possible electrical

transients that the solar array may be submitted to during the mission • Frequency domain capacitance test, or analysis if based on existing test data A methodology for the formulation of long duration tests and transient tests on by-pass diodes is outlined in <RD5>

SA-PO-680 For acceptance, each SA wing shall perform full deployment at ambient conditions, as well as flasher test before and after structural and environmental testing.

6.4.1.2.3 Battery

SA-PO-800 The batteries shall be designed to ensure a lifetime compatible with the satellite lifetime with an additional margin of 5 years for the in-flight operations (TBC). Derived from requirement 5.5.1a of ECSS-E-20A

SA-PO-810 Energy storage elements, batteries, shall be protected against overcharge, under voltage and adverse temperature conditions

SA-PO-820 In case of autonomous commanded bypass of a battery cell, the maximum numbers of cells that can be bypassed shall be equal to the number of failures allowed by the specific mission design.

SA-PO-830 Transients occurring when two or more separate strings of series connected battery cells are connected together in parallel or when a cell fails short-circuit in a battery composed of parallel strings shall not result in exceeding the peak cell current rating

SA-PO-840 The battery charging technique shall ensure that any lifetime related maximum cell voltage and temperature limit, as stated by the manufacturer for the particular cell technology are respected. Note: this requirement replaces requirement 5.5.2c of ECSS-E-20A



page 116 of 203

SA-PO-850 The battery charge current and end of charge control shall be autonomous and one

fault tolerant. Note: this requirement replaces requirement 5.5.2d of ECSS-E-20A

SA-PO-860 The switching between main and redundant charging management devices shall be completely autonomous and independent from on-board computer control.

SA-PO-870 Protection shall be provided at cell, battery or system level to ensure that no cell violates any lifetime related to minimum or maximum voltage under normal operating conditions as well as maximum charge or maximum discharge current

SA-PO-880 Any special in-flight measures to ensure that the batteries meet their performance requirements (e.g. in orbit reconditioning for Ni-Cd and Ni-H2, cell state of charge balancing for some lithium-ion technologies) that impose operational constraints shall be identified at system level for implementation from the design phase.

SA-PO-890 Any test equipment interfacing with the battery shall include an associated undervoltage, over-voltage, over-current and over-temperature activated isolation switch.

SA-PO-900 Except for lithium-ion, battery chargers shall be designed to ensure charging of a battery down to zero volts.

SA-PO-910 The battery charge rate shall not be less than C/10, where C is the battery nominal baseplate capacity

SA-PO-920 Procured battery cells shall be originating from the same production lot, with the same operational history.

SA-PO-930 Conducting cases of battery cells in a battery package shall be double-isolated from each other and from battery structure, with an isolation between any cell and the structure greater than 10MΩ (measured at 500V DC).

SA-PO-940 Where flight batteries are used for ground operations, their flight worthiness shall be verified (e.g. by capacity measurements) after these ground operations are completed but in time to allow possible replacement. Note: Whenever possible, flight batteries shall not be used for ground operations to prevent any possible damage and subsequent degradation of life performance.

SA-PO-950 The design of the spacecraft shall allow for removal and replacement of cells or batteries at any time prior to launch without affecting the acceptance status of the rest of the spacecraft.



page 117 of 203

6.4.2 GENERAL ELECTRICAL DESIGN REQUIREMENTS

6.4.2.1 Harness The harness provides electrical connections between all electrical equipment. It includes harnesses for power supplies, analogue/digital and pyrotechnic pulses. It also includes harnesses for connections with the umbilicals and skin/test connectors. All fixation plates, bond straps, clamps support bracketry, metallic brackets used for interface connectors grommets, edge protection, connector savers and thermal insulation are by definition also part of the harness.

SA-EL-010 The harness shall provide adequate distribution and separation of all power supply, analogue and digital lines, command and actuation pulse and stimuli lines between all units, the test connectors, the safe/arm brackets and connectors and the umbilical connectors.

SA-EL-020 The signal deterioration due to resistive, inductive and capacitive behaviour of the interconnection lines or coax cables shall be such that all the relevant applicable sub-system specifications are met in the integrated satellite.

SA-EL-030 The isolation requirements between leads, which are not connected together and between shield and centre conductor and shield to shield shall be at least 10MΩ under 500V DC at both polarities.

SA-EL-040 The mechanical construction of the harness shall assure the reliable operation of the spacecraft under all environmental conditions. The stress, which occurs during manufacturing, integration, test, transport, launch preparation, launch and in-orbit operation shall cause no changes in the harness, which might affect the correct functioning of the system.

SA-EL-050 Physical separation along common lines of the categories listed below (power, signals and lines for the mechanisms, if applicable) shall be retained between these categories up to and inclusive of the module interface connectors. Exceptions can be only the routing of harnesses down to connectors in the satellite separation plane. • Category 1: All supply lines from power sources to users • Category 2: All signal lines with the exception of the sensitive analogue signals • Category 3: Lines for the mechanisms/pyrotechnics • Category 4: Sensitive analogue signal

SA-EL-060 All equipment shall use a separate connector dedicated to its functional interface, according to the categories listed above.

SA-EL-070 Wiring of redundant systems, sub-systems or units of subsystems shall be routed through separate connectors and wire bundles.

SA-EL-080 Cross strapping of redundant paths and circuits shall not be carried out in the harness



page 118 of 203

SA-EL-090 All harness and all box and bracket mounted connectors supplying power shall have

socket contacts that are not exposed to possible short during mating/de-mating.

SA-EL-100 Where it is necessary to have a shield connection through a connector, separate pins shall be used.

SA-EL-110 All individual wire-to-pin interfaces shall be covered with transparent heat shrink sleeves.

SA-EL-120 The harness shall be fixed onto the structure in order to avoid any damage during the launch phase. As a general rule it will be fixed: • At equipment level: the harness connectors shall be fitted onto the equipment

connectors by appropriate locking systems • At the structure level • At interface level: the connectors shall be fixed on metallic brackets themselves

fixed onto the structure

SA-EL-130 The harness restraining systems on the structure shall not bring about any stress at connector level.

SA-EL-140 Permanent connections installed for purposes of test at integrated satellite level shall be routed to skin connectors of the modules concerned (module interface connectors are no longer accessible at that level).

SA-EL-150 Skin connectors shall also be provided to make or break power circuits.

SA-EL-160 Caps, bridging connectors, and thermal insulation for flight shall close all these skin connectors. During testing activities these connectors shall be protected by connector savers.

SA-EL-170 There shall be umbilical and test connectors to provide electrical interfaces respectively with the launcher and with the EGSE. Functions provided shall include all those necessary for supporting AIT and launch site activities such as: • power the satellite (including switching to satellite own batteries) • monitor the spacecraft health status • upload SW and flight parameters

SA-EL-180 Skin test connectors shall be provided to support AIT activities in order to: • monitor spacecraft operation • maintain synchronisation between satellite, EGSE and real time simulators • put the satellite in a defined operation scenario (e.g. quick upload of SW or mass

memory images)

SA-EL-190 Test harness shall be provided so that the satellite can be stimulated and monitored during functional testing. Test harness end connectors shall be located at the skin of the spacecraft so that they are accessible also when the spacecraft is fully equipped



page 119 of 203

with MLI. Design of the test harness shall take into account critical lengths, Wherever possible the test harness shall be removed for the flight configuration.

SA-EL-200 Safe and arming plugs shall be provided for disabling of functions with hazardous, catastrophic or critical consequences

SA-EL-210 For new equipment development, when the connection is not aligned to a defined standard, 10% spare contacts at unit PDR and at least 5% at CDR shall be achieved with, in any case, a minimum of two spare contacts at CDR.

6.4.2.2 Data bus

SA-EL-300 If SpaceWire is used, the implementation shall be compliant with <SD25>

6.4.2.3 Electromagnetic compatibility

SA-EL-400 The satellite EMC design and performance shall be compliant with the requirements of chapter 6 of <SD5>. The applicability of the ECSS-E-20A requirements for EMC/RFC, electrostatic charging protection, is defined in Appendix E.3.

SA-EL-410 The electrical architecture shall be based on the Distributed Single Point Grounding Concept, which requires primary power leads to be referenced to the structure at one point only, preferably the regulation point. Secondary power lines shall be referenced to the structure locally with isolation as high as possible between primary and secondary, for both DC and AC, in order to minimise common mode currents.

SA-EL-420 The structure shall not be used as DC or AC current path and only serve as a ground reference and to provide shielding against emitted electromagnetic fields and from such fields externally generated. Ground loops shall be avoided.

6.4.2.4 Multipaction and gas discharge

SA-EL-500 The satellite EMC design and performance shall be compliant with the requirements of <SD6> as defined in Appendix E.4.

6.4.2.5 Radiation tolerant design

SA-EL-600 Electronics shall be free of single event latch-up or protected agaisnt them. Latch-up protection switches shall be verified by test.

SA-EL-610 Electronics shall be free of single event burn-out.

SA-EL-620 Electronics shall be free of single event transient or the design shall demonstrate robustness against them.



page 120 of 203

SA-EL-630 Electronics shall recover from single event upset. Storage functions shall handle

single or multiple event upset without losing any data with a probability better than the reliability of the function.

SA-EL-640 Electrostatic discharges due to solar or auroral events shall be avoided by design.

6.5 Structure, Mechanisms and Pyrotechnics Requirements The applicability of the ECSS standards is defined in:

• E.7 for Structural <SD9> • E.8 for Mechanisms <SD10> • E.10for Pyrotechnics <SD12> • E.11 for Mechanical Parts <SD13> • E.12 for Materials <SD14> • E.13 for Modal Survey <SD16>

6.5.1 STRUCTURE


SA-ST-010 The satellite structure shall provide the physical interface to the launch vehicle.

SA-ST-020 The Satellite structure shall maintain the necessary alignment between all Satellite elements during ground and in-orbit operations. In particular the structure shall ensure alignments between satellite references, sensors and instruments as required for attitude determination, pointing, observation geo-location, including co-registration between the instruments themselves if relevant.

SA-ST-030 The lowest frequencies and the effective masses of the satellite in launch configuration, hard mounted to the launch vehicle interface shall be in accordance with the applicable Launch Vehicle User’s Manual.

SA-ST-040 The structural design shall provide a minimum margin of +15% over the specified frequencies before verification of the satellite dynamic properties by test.

SA-ST-050 The satellite shall withstand the static and dynamic loads induced by the launch vehicle, including the mechanical environment as deduced from the coupled analysis with the launch vehicle.

SA-ST-060 The satellite shall comply with the dynamic envelope requirements in the Launch Vehicle User’s Manual applicable to ground handling, transportation and launch when subject to the worst case combination of limit loads and root-mean-square manufacturing tolerances.



page 121 of 203


6.5.1.2.1 General

SA-ST-100 The structural design of the satellite shall pass successfully the qualification static, sine vibration, random vibration, acoustic and shock tests required by the Launcher Authority.

SA-ST-110 The satellite shall pass successfully the acceptance static, sine vibration, random vibration, acoustic and shock tests required by Launcher Authority.

SA-ST-120 The following failure modes, for the satellite and all equipment at all levels of integration, shall be prevented: • Permanent deformation, • Rupture, • Instability and buckling, • Gapping of bolted joints • Degradation of bonded joints, • Vibration induced mounting interface slip, • Loss of alignment of equipment and payloads subject to alignment stability

requirements, • Excessive strains or stresses impairing mechanisms operation, release, or

deployment, • Distortion violating any specified envelope, • Distortion causing functional failure or short circuit.

SA-ST-130 Structure shall be designed with sufficient redundancy to ensure that the failure of one structural element does not cause general failure of the entire structure with catastrophic consequences (e.g. loss of launcher, endangerment of human life) Failure may be considered as rupture, collapse, seizure, excessive wear or any other phenomenon resulting in an inability to sustain limit loads, pressures or environments. Definition in ECSS-E-30-Part 2A Section 3.1.10.

SA-ST-140 To be considered as fail-safe, a design implementation shall be such that the failure of one structural element in the load path does not affect the stiffness of the structure significantly.

SA-ST-150 Redundancy concepts (fail-safe) shall be considered whenever possible to minimise single-point failures. Where a single-point failure mode is identified and redundancy cannot be provided the required strength and lifetime shall be demonstrated (safe-life). Derived from: ECSS-E-30 Part 2A Section 4.6.5. b



page 122 of 203

SA-ST-160 Non-metallic structural items (e.g. composites, glass, bonded joints) shall be proof-

tested at 1.2 times the limit load. Derived from ECSS-E-30-01A Section 11.2 d

SA-ST-170 Fasteners shall be classified and analysed as any other structural item.

SA-ST-180 Fasteners smaller than diameter 5 mm shall not be used in safe life applications.

SA-ST-190 For fasteners equal to or larger than diameter 5 mm, the following requirements apply: • Titanium alloy fasteners shall not be used in safe life applications. • All potential fracture-critical fasteners shall be procured and tested according to

aerospace standards or specifications with equivalent requirements. • All safe life fasteners shall be marked and stored separately following NDI or

proof testing. ECSS-E-30-01A Section 8.6

SA-ST-200 No yielding is allowed at proof load/proof pressure.

SA-ST-210 Protoflight hardware shall not yield during testing.

6.5.1.2.2 Fracture control requirements

SA-ST-300 Fracture control principles shall be applied where structural failure can result in a catastrophic or critical hazard. A fracture control plan shall be implemented. Derived from ECSS-E-30-01A Sections 4 and 3.1 Catastrophic hazard: A potential risk situation that can result in loss of life, in life-threatening or permanently disabling injury, in occupational illness, loss of an element of an interfacing manned flight system, loss of launch site facilities or long term detrimental environmental effects. Critical hazard: A potential risk situation that can result in: - Temporarily disabling but not life-threatening injury, or temporary occupational illness; - Loss of, or major damage to, flight systems, major flight system elements or ground facilities; - Loss of, or major damage to, public or private property; or short-term detrimental environmental effects.

SA-ST-310 The non fail-safe structural elements shall be Potential Fracture Critical Items (PFCIs).

SA-ST-320 Pressure vessels shall be potential fracture critical items (PFCIs). A pressure vessel is a pressurised container which:



page 123 of 203

- contains stored energy of 19310 joules or more, the amount being based on the adiabatic expansion of a perfect gas; or - contains a gas or liquid which will create a hazard if released; or - will experience a maximum design pressure (MDP) greater than 0.69 Mpa. Derived from ECSS-E-30-01A Section 8.1.2

SA-ST-330 Sealed containers shall be potential fracture critical items (PFCIs) unless they meet the following criteria: • The container is not part of a system with a pressure source and is individually

sealed. • and leakage of the contained gas does not result in a catastrophic hazard • and the container/housing is made from a conventional alloy of steel, aluminium,

nickel, copper or titanium. • and the MDP does not exceed 151.98 kPa. • and the free volume within the container does not exceed 0.0509 m 3 (1.8 cubic

feet) at 151.98 kPa or 0.0764 m 3 at 101.325 kPa, or any pres-sure/ volume combination not exceeding a stored energy potential of 19310 joules.

A sealed container is a pressurised container, compartment or housing that is individually sealed to maintain an internal gaseous environment, but does not classify as a pressure vessel.

SA-ST-340 Sealed containers with a MDP higher than 151.98 kPa, but less than 689.01 kPa, and a potential energy not exceeding 19310 joules are also acceptable if the minimum factor of safety is 2.5 × MDP, an acceptable stress analysis on test has been performed, and requirements a, b, and c above are met.

SA-ST-350 In addition to the criteria presented herein, all sealed containers shall be capable of sustaining 101.325 kPa pressure with a minimum safety factor of 1,5 . Derived from ECSS-E-30-01A Section 8.1.4

SA-ST-360 Rotating machinery shall be potential fracture critical items (PFCIs). Rotating machinery: Any rotating mechanical assembly that has a kinetic energy of 19 300 joules or more, the amount being based on 0,5 I ω2 where I is the moment of inertia (kg.m2 ) and ω is the angular velocity (rad/s). Derived from ECSS-E-30-01A Section 11.2 a

SA-ST-370 Fasteners used in safe life applications, items fabricated using welding, forging or casting and which are used at limit stress levels exceeding 25 % of the ultimate tensile strength of the material, and non-metallic structural items shall be potential fracture critical items (PFCIs). Derived from ECSS-E-30-01A Section 11.2 a 3, 4 and 5

SA-ST-380 PFCIs shall comply with <SD15> in full.



page 124 of 203

6.5.1.2.3 Strength

SA-ST-400 Satellite design shall ensure the survival of the structure under the worst feasible combination of mechanical and thermal loads for the complete lifetime of the satellite. The lifetime shall include: manufacturing, assembly, testing, transport, launch and in-orbit operations.

SA-ST-410 A strength analysis shall be performed and demonstrate a positive margin of safety and include, if applicable, yield load analysis, ultimate load analysis and buckling load analysis. Derived from ECSS-E-30 Part 8A Section 4.3.1 a & b

6.5.1.2.4 Mechanical Loads Factors

SA-ST-500 Load multipliers specified by the launcher design authority (e.g. development factor, uncertainty factor, acceptance factor, qualification factor, test factor) apply in addition to the design safety factors.

SA-ST-510 Margins of safety (MOS) shall be calculated by the following formula: ( )

( ) 1_

_−

×=

FOSloadappliedloadallowableMOS

where: • allowable load: allowable load under specified functional conditions (e.g. yield,

buckling, ultimate) • applied load: computed or measured load under defined load condition (design

loads) • FOS: Factor of safety applicable to the specified functional conditions including

the specified load conditions (e.g. yield, ultimate, buckling) NOTE: Margins of safety express the margin of the applied load multiplied by a factor of safety against the allowed load. Loads can be replaced by stresses if the load-stress relation-ship is linear.

SA-ST-520 All margins of safety (MOS) shall be positive. ECSS-E-30 Part 2A Section 4.6.14

SA-ST-530 The relationship between Loads and factors shall be the following:



page 125 of 203

The following apply to this approach:

SA-ST-540 The mechanical part of the LL shall be derived from the launcher manual (e.g. quasistatic loads, minimum requested test loads) either directly or indirectly (via adequate analysis, e.g. frequency response).

SA-ST-550 The project factor KP shall account for possible mass increase at the start of the satellite design.

SA-ST-560 The model factor KM shall account for the uncertainty at the start of the satellite design with respect to mathematical model used to establish the design.

SA-ST-570 The qualification load QL to be considered at the beginning of the programme shall, as a minimum, be equal to the DL loads. NOTE: As a result of the satellite-launcher coupled dynamic analysis (LCDA) performed during the project design and verification phases, the knowledge of the LL might be modified in the course of the project. The DL and QL might follow this evolution.

SA-ST-580 Qualification loads QL and acceptance loads AL shall be as a minimum: • KQ× LL final for qualification • KA× LL final for acceptance • where LL final is the best knowledge of the LL as resulting from the LCDA (or an

envelope thereof) approved by the launcher authorities.

SA-ST-590 The above loads or factors relationship applies to the quasistatic and dynamic loads for general design, dimensioning and testing.

SA-ST-600 The following factors shall be used: • KM = 1.00 Maximum Predicted Mass shall be taken into account • KP = 1.25 prior to verification of the structural dynamic model of

the satellite by dynamic testing • KP = 1.00 after verification of the structural dynamic model of the

satellite by dynamic testing • FOSD = 1.25



page 126 of 203

• FOSY = 1.1 • FOSU = 1.5 • KQ = 1.25 • KA = 1.1 These assume the use of classical materials (metallic or composites) for which the coefficient of variation (COV) of the ultimate properties is lower or equal to 5 %. In case the COV of a material exceeds this value, new adequate factors of safety need to be defined according to approved standards. Derived from ECSS-E-30 Part 2A Annex D Section D2

SA-ST-610 The structure shall be testable at the design load (DL). Derived from ECSS-E-30 Part 2A Annex D Section D2

SA-ST-620 Minimum Factors of Safety against ultimate shall be: • Pressure Vessels 1.5 • Lines and Fittings smaller than 38 mm diameter 4.0 • Lines and Fittings 38 mm diameter or greater 2.0 • Valves, Filters, Regulators, Other Pressurised Components 2.5

SA-ST-630 For combined loads where L(P) is the load due to maximum expected operating pressure and L(M) is the non-pressure limit load, the factored, ultimate load case shall be: 1.5 L(M) + 1.5 L(P)

SA-ST-640 For load cases involving thermal and/or moisture de-sorption loads, the thermal/moisture de-sorption stress at the applicable temperature shall be factored by 1.5 to determine the equivalent ultimate thermal/ moisture de-sorption load and this shall be added to 1.5 times the non-pressure load and/or the pressure load.

SA-ST-650 Where pressure and/or temperature and/or moisture de-sorption relieves the non-pressure load a Factor of Safety of 1.0 shall be used for the pressure and/or thermal and/or moisture de-sorption loads. In this case the pressure load shall be based on the minimum operating pressure.

SA-ST-660 The satellite Structural/Thermal Model shall be able to survive 4 times all mechanical qualification tests.

SA-ST-670 The satellite Flight Model shall be able to survive 4 times all mechanical acceptance tests plus one launch.

6.5.1.2.5 Notching

SA-ST-700 Primary notching, i.e. notching to keep the accelerations of the centre of mass of Sentinel-3 at the design loads, is allowed.

SA-ST-710 Secondary notching, i.e.:



page 127 of 203

• notching to protect internal equipment • notching to protect the instrument or • notching to achieve accelerations at the centre of mass of Sentinel-3 lower than

the design loads

is generally not allowed and shall be approved by ESA.

6.5.1.2.6 Corrosion

SA-ST-800 The selection of a material for corrosion resistance shall be in accordance with <SD28> and shall take into account the specific environment, the design and fabrication of individual and assembled components, compatibility of dissimilar materials, susceptibility to fretting and crack initiation. NOTE Corrosion can be regarded as any deterioration in the physical and chemical properties of a material due to the chemical environment.

SA-ST-810 In cases where the behaviour of a material in a specific environment is not known, corrosion tests of representative materials (composition and condition) shall be performed, either under appropriate service conditions, or in more severe conditions (accelerated testing). See <SD14>. ECSS-E-30 Part 2A – Section 4.2.5 Corrosion effects

SA-ST-820 Metallic structural products shall be selected from preferred lists of alloys with high resistance to stress corrosion cracking, as indicated in Table 1 of <SD29>.

SA-ST-830 The metallic components proposed for use in most satellite shall be screened to prevent failures resulting from stress corrosion cracking (SCC). NOTE Stress corrosion cracking (SCC), defined as the combined action of a sustained tensile stress and corrosion, can cause the premature failure of metals.

SA-ST-840 Only those products found to possess a high resistance to stress corrosion cracking shall have unrestricted use in structural applications.

SA-ST-850 Materials intended for structural applications shall possess a high resistance to stress corrosion cracking, if they are • exposed to a long-term storage on ground (terrestrial), • flown on the Space Transportation System (STS), • classified as fracture critical items, or • parts associated with the fabrication of launch vehicles.

SA-ST-860 The technical criteria, for the selection of materials, of ECSS-Q-70 shall apply. ECSS-E-30 Part 8A – Section 4.3.8 Stress corrosion

SA-ST-870 The structural and thermal interfaces shall be designed to allow analysis of the modules and their interaction.



page 128 of 203

SA-ST-880 The mechanical design shall provide access to connectors.

SA-ST-890 The mechanical design shall allow removal and maintenance of all secondary structures, equipment and the payload.

6.5.2 MECHANISMS

6.5.2.1 Functional Requirements

SA-ME-010 Deployment mechanism shall allow contingency operations to correct deployment anomalies (e.g. possibility to power up redundant winding of deployment motors, reverse operation of motors) by design features which do not introduce significant additional complexity.

SA-ME-020 The mechanisms shall provide sufficient data to monitor their status and operation condition. These data shall be transmitted as part of the housekeeping telemetry.

SA-ME-030 It shall be possible to command all mechanisms from ground.

SA-ME-040 Failure of mechanisms at instrument level shall not affect other instruments or the rest of the satellite.


6.5.2.2.1 Reliability

SA-ME-100 All mechanisms shall demonstrate conformance to the required reliability figure. NOTE: The method to achieve by design, derive by analysis, and demonstrate the required reliability figure can be found in ECSS-Q-30B. Derived from ECSS-E-30 Part 3A – Section 4.2.3.2 a

6.5.2.2.2 Redundancy

SA-ME-200 During the design of the mechanism all single point failure modes shall be identified. Derived from ECSS-E-30 Part 3A – Section 4.2.3.4 b

SA-ME-210 All single points of failure shall be eliminated by redundant components where practicable. Derived from ECSS-E-30 Part 3A – Section 4.2.3.4 c

SA-ME-220 Unless redundancy is achieved by the provision of a complete redundant mechanism, active elements of mechanisms such as sensors, motor windings (and brushes where applicable), actuators, switches and electronics shall be redundant. Derived from ECSS-E-30 Part 3A – Section 4.2.3.4 f



page 129 of 203

SA-ME-230 Failure of one element or part shall not prevent the other redundant element or part

from performing its intended function, nor the equipment from meeting its performance requirements. Derived from ECSS-E-30 Part 3A – Section 4.2.3.4 g

6.5.2.2.3 Factors of safety (FOS)

SA-ME-300 In the computation of safety margins the following minimum factors of safety shall be used for standard metallic materials: • yield stress factor of safety 1.25 • ultimate stress factor of safety 1.5 • minimum fatigue factor (cycles) 4 Derived from ECSS-E-30 Part 3A – Section 4.7.4.2.8

SA-ME-310 Other materials shall require customer approval of required factors of safety on a case by case basis.

SA-ME-320 The following specific factors of safety shall apply on the components identified below • cables, stress factor of safety against rupture 3 • stops, shaft shoulders and recesses, against yield 2 Derived from ECSS-E-30 Part 3A – Section 4.7.4.2.8

6.5.2.2.4 Functional dimensioning (motorisation)

SA-ME-400 The mechanisms engineering shall conform to the motorisation factor requirements on quasi-static torque (or force) ratio and where applicable on dynamic torque (or force) ratio as defined in the following sub-clauses. ECSS-E-30 Part 3A – Section 4.7.4.3.1

SA-ME-410 The quasi-static torque (or force) ratio is applicable to mechanisms where the moving function is performed without imposing design driving requirements on the functional performance due to time constraints. (e.g. deployment systems, unfolding devices). NOTE the quasi-static torque (or force) ratio is defined as the actuation torque (or force) divided by the sum of the factored worst case resistive components opposing the movement of the mechanism plus any required deliverable output torque or force. ECSS-E-30 Part 3A – Section 4.7.4.3.2

SA-ME-420 The dynamic torque (or force) ratio requirement is applicable to mechanisms which have to fulfil a specified acceleration requirement or for which an indirect acceleration requirement can be deduced from speed/time or other (dynamic) requirements.



page 130 of 203

NOTE The ratio is defined as the dynamic actuation torques (or forces) divided by the sum of the factored dynamic worst case resistive components and the additional factored inertial torque (or force) induced by the acceleration of the mechanism moving assembly plus any required deliverable output torque or force. ECSS-E-30 Part 3A – Section 4.7.4.3.3

6.5.2.2.4.1 Motorisation factor - Quasi-static torque or force ratio

SA-ME-430 Actuators (electrical, mechanical, thermal and others) shall be sized to provide throughout the operational lifetime and over the full range of travel actuation torques (or forces) which exceed at least two times the combined factored worst case resistive torque or forces in addition to any required deliverable output torque or force.

SA-ME-440 In order to derive the factored worst case quasi-static resistive torques (or forces), the components of resistance, considering worst case conditions, shall be multiplied by the following minimum uncertainty factors (see Table 2).

SA-ME-450 The minimum required actuation torque (or force) is defined by the two equations: • Minimum required actuation torque (Tmin)

Tmin =2.0×(1,1IT +1.2S +3 FR +3 HY +3 HA +3 HD )+TL • Minimum required actuation force (Fmin)

Fmin =2.0×(1,1IF +1.2S +3 FR +3 HY +3 HA +3 HD )+FL

SA-ME-460 When a function of the mechanism is to deliver an output torques or forces TL /FL, for further actuation, the output torque or force shall be derived according to the above torque or force requirements considering the specified uncertainty factors on the individual components of resistance as appropriate and the motorisation factor of two shall also be applied to TL /FL . The deliverable output torque or force is only applicable if specified by the customer. Derived from ECSS-E-30 Part 3A – Section 4.7.4.3.4

SA-ME-470 The inertia resistance term (IT or IF ) in the required minimum actuation torque (or force) equation is applicable to mechanisms being mounted in an accelerating frame



page 131 of 203

of reference (e.g. spinning satellite, payload or other) and shall be derived considering the imposed inertial resistance load. Derived from ECSS-E-30 Part 3A – Section 4.7.4.3.4

SA-ME-480 The specified uncertainty factors marked by # in Table 2 may be reduced to 1.5 providing that the worst case measured torque or force resistive components to which they refer are determined by measurement according to a test procedure approved by the customer and demonstrate the adequacy of the uncertainty factor with respect to the dispersions of the resistive component functional performances. Derived from ECSS-E-30 Part 3A – Section 4.7.4.3.4

SA-ME-490 The kinetic energy of the moving components shall not be considered in the provision of actuation torques (or forces). Derived from ECSS-E-30 Part 3A – Section 4.7.4.3.4

SA-ME-500 Environmental effects shall be accounted for separately in addition to the use of the above uncertainty factors when deriving the worst case resistive torques (or forces). ECSS-E-30 Part 3A – Section 4.7.4.3.4

6.5.2.2.4.2 Motorisation factor - Dynamic torque or force ratio

SA-ME-510 Actuators (electrical, mechanical, thermal and others) shall be sized to provide throughout the operational lifetime and over the full range of travel actuation torques (or forces) which exceed the sum of at least two times the combined worst case dynamic resistive torque (or forces) and 1,25 times the inertial resistance torque (or force) caused by the required worst case acceleration function.

SA-ME-520 In order to derive the worst case dynamic resistive torques (or forces), the components of resistance considering the worst case conditions shall be multiplied by the minimum uncertainty factors (see Table 2 in Req. SA-ME-440).

SA-ME-530 The minimum required actuation torque (Tmin)/ force (Fmin) to meet the dynamic torque/force ratio requirements is given by the formula: • Tmin =2.0×(1,1IT +1.2S +3 FR +3 HY +3 HA +3 HD ) + 1.25 TD • where TD is the dynamic torque. • Fmin =2.0×(1,1IF +1.2S +3 FR +3 HY +3 HA +3 HD ) + 1.25 FD • where FD is the dynamic force.

SA-ME-540 The inertia resistance term (IT or IF ) in the required minimum actuation torque (or force) equation is applicable to mechanisms being mounted in an accelerating frame of reference (e.g. spinning satellite, payload or other) and shall be derived considering the imposed inertial resistance load. ECSS-E-30 Part 3A – Section 4.7.4.3.5



page 132 of 203

SA-ME-550 The specified uncertainty factors marked by # in table 2 may be reduced to 1.5

providing that the worst case measured torque or force resistive components to which they refer are determined by measurement according to a test procedure approved by the customer and demonstrating adequacy of the uncertainty factor with respect to the dispersions of the resistive component functional performances. ECSS-E-30 Part 3A – Section 4.7.4.3.5

SA-ME-560 The kinetic energy of the moving components shall not be considered in the provision of actuation torques (or forces). ECSS-E-30 Part 3A – Section 4.7.4.3.5

SA-ME-570 Environmental effects shall be accounted for separately in addition to the use of the above uncertainty factors when deriving the worst case resistive torques (or forces). ECSS-E-30 Part 3A – Section 4.7.4.3.5

6.5.2.2.4.3 Actuation torque or force

SA-ME-580 When the actuation torque (or force) is supplied by a spring actuator, the worst case actuation torque required in the equations specified above shall be derived considering worst case conditions and shall be multiplied by the maximum uncertainty factor of 0.8. ECSS-E-30 Part 3A – Section 4.7.4.3.6

SA-ME-590 Spring actuators shall be redundant unless agreed by the customer, and unless it is demonstrated by analysis and test that appropriately conservative spring sizing and functional performance characteristics guarantee the required reliability of the mission. The appropriate spring sizing shall demonstrate that a spring failure can be excluded as potential failure mode. ECSS-E-30 Part 3A – Section 4.7.4.3.6

SA-ME-600 Actuating torques or forces based on hysteresis, harness generated, or any item whose primary function is not to provide torques or forces, shall not be used as a motorisation source. ECSS-E-30 Part 3A – Section 4.7.4.3.6

SA-ME-610 If torques (or forces) from harness or other above excluded actuator sources are relied upon to meet the motorisation requirements their use shall be justified, agreed with the customer and the adequacy of the uncertainly factor with respect to the dispersion of the component actuation functional performances shall be demonstrated. ECSS-E-30 Part 3A – Section 4.7.4.3.6



page 133 of 203

6.5.2.2.5 Status monitoring

SA-ME-700 Unless monitored at satellite system level, the design of mechanisms shall include appropriate means to monitor the execution of its main functions.

SA-ME-710 Mission critical mechanisms shall be designed in such way that monitoring information of its critical function(s) is accessible to the satellite telemetry. ECSS-E-30 Part 3A – Section 4.7.4.4.2

SA-ME-720 The mechanism design shall be compatible with operation on ground in ambient and thermal vacuum conditions. The permissible operations and the constraints for the operations in ambient shall be defined. ECSS-E-30 Part 3A – Section 4.8.3.1 b

6.5.2.2.6 Life test duration

SA-ME-800 The lifetime qualification shall be demonstrated using the factored sum of the predicted nominal ground test cycles and the in-orbit operation cycles.

SA-ME-810 For the test demonstration, the number of predicted cycles shall be multiplied by the following factors in Table 3:

SA-ME-820 The cycle definition is subject to agreement with the customer and shall consider as a minimum, the number of motions over the same location, motion amplitude and number of reversals. Derived ECSS-E-30 Part 3A – Section 4.8.3.3.11

SA-ME-830 In order to determine the lifetime to be demonstrated by test, an accumulation of cycles multiplied by their individual factors shall be used. Derived ECSS-E-30 Part 3A – Section 4.8.3.3.11

SA-ME-840 Life test of the mechanisms shall be successfully completed prior to flight.

SA-ME-850 All mechanisms shall be able to perform nominally after a storage period of up to two years at satellite level without requiring any additional testing.



page 134 of 203

Storage configuration should preferably consist of the integrated Satellite, however mechanism do not need to be in flight configuration.

6.5.3 PYROTECHNICS REQUIREMENTS

SA-PY-010 Pyrotechnics application and design shall be approved by ESA.

SA-PY-020 All pyrotechnics shall be initiated via a satellite dedicated unit. This unit shall incorporate the safety inhibits.

SA-PY-030 All pyrotechnics shall be initiated via a dedicated module which is mechanically segregated, electrically independent and screened, and thermally decoupled from the rest of the unit that houses it. This module shall incorporate the safety inhibits.

SA-PY-040 The unit initiating thermal knives, if any, shall incorporate inhibits.

SA-PY-050 The pyrotechnics shall fulfil the requirements of <SD12>.

6.6 Satellite Configuration Requirements

SA-CF-010 The satellite configuration shall ensure unobstructed field of view for the payload (for observation and calibration purposes) and the communication and navigation antennae.

SA-CF-020 The satellite configuration shall ensure minimisation of multipath to the antennae embarked on the satellite.

SA-CF-030 The mechanical design and layout shall provide sufficient accessibility to allow easy integration, removal and maintenance activities of all secondary structures, equipment and the payload.

SA-CF-040 Items requiring integration or adjustment at the launch site (for safety, logistic or life reasons) shall be accessible without removing any equipment or instrument.

SA-CF-050 The Satellite configuration shall minimise the dismounting activities required to access items that may require periodical health check during long-term on-ground storage.

SA-CF-060 The mechanical design shall provide access to connectors.

SA-CF-070 The satellite structure configuration shall allow the repetitive split of the satellite in parts to optimise the assembly process and the re-assembly of the parts minimising relative alignment errors between the different parts. The number of assembly and re-assembly events shall be as required by the satellite assembly and verification approach.



page 135 of 203

SA-CF-080 The satellite configuration shall minimise centre of masses movement along the

mission. Specifically fuel depletion induced changes on centre of masses shall be: minimised, predictable and, if unavoidable, preferably along the flight direction. This is required by the POD needs of the satellite

SA-CF-090 Satellite configuration shall minimise atmospheric drag forces and torques This will optimise the quality of the precise orbit determination needed by this mission

SA-CF-100 Satellite configuration shall maximise the surface area with view of deep space This will simplify the thermal design for the instruments and the platform

6.7 Thermal Requirements

6.7.1 GENERAL The requirements apply to all items that fulfil thermal control functions in the satellite, including the payload. The applicability of the ECSS standard (ECSS-E-30 Part 1A) is defined in Appendix E: section E.6

SA-TH-010 Applicable terms and definitions relevant to the satellite and payload thermal control shall follow definition presented in paragraph 3.1, 3.2 and 3.3 of <SD8>.

SA-TH-020 Mission phases, parameters and environmental conditions shall follow definition of paragraph. 4.1.1 to 4.1.4 of <SD8>.

SA-TH-030 Applicable performance requirements shall follow definition of paragraph. 4.2.1 to 4.2.4 of <SD8>.

SA-TH-040 TCS development methodology: the preferred approach is defined in Annex D of <SD8>. Major deviations between <SD8> and Contractor preferred approach shall be highlighted for discussion and agreement with the Agency.


SA-TH-100 The Thermal control shall provide the satellite and payload thermal environment (temperatures, gradients, stability, heat fluxes) which ensure full performance of the satellite in all mission phases and operational/non operational modes, for the complete duration of the mission.

SA-TH-110 The thermal control of the satellite and payload shall withstand, operate and perform as specified, taking into account the natural and induced environmental conditions which they will experience throughout their lifetime, both on ground and on orbit.



page 136 of 203

SA-TH-120 For each mission phase, as a minimum, the extreme/worst hot and cold case shall be

defined and analysed.

SA-TH-130 For the main mission phases a “nominal” case taking into account “nominal” environmental conditions, dissipations, shall be defined and analysed.

SA-TH-140 During nominal operations the Thermal Control of satellite and payload shall be able to recover from failure situations by autonomously selecting a redundant functional path.

SA-TH-150 Thermal Control shall allow manual override and inhibition/enabling of all automated functions individually from ground.

6.7.3 DESIGN REQUIREMENTS This chapter defines the applicable thermal control design requirements. The applicability of the ECSS standard (ECSS-E-30 Part 1A) is defined in Appendix E: section E.6

SA-TH-200 The thermal control design of the satellite and payload shall be achieved, in principle, by passive means (conductively and radiatively controlled) with limited use of heaters where proven to be necessary to maintain specified operational or minimum survival, switch-on temperatures. The thermal control design shall consider in addition the requirements of para. 4.4.1 of <SD8>.

SA-TH-210 To allow separate development and verification, the thermal control of the satellite and payload shall be independent from each other to the maximum practical extent.

SA-TH-220 The thermal control design of the satellite and payload shall be verifiable by analysis, by use of the correlated thermal mathematical models and by ground testing. Paragraph 4.5.1 to 4.5.7 <SD8> are applicable.

SA-TH-230 The extreme design conditions to be applied for the thermal design shall consider the variation associated to the following parameters: • environment parameters, solar flux, albedo, earthshine including their variation

with latitude • degradation of thermal properties over lifetime • variations in internal power dissipation (e.g. for different operating modes) • transient effects (orbital variations, duty cycles) • orbital attitude (phases and modes) • failure modes

SA-TH-240 Predictability and testability: Paragraph. 4.4.6 of <SD8> is fully applicable.



page 137 of 203

SA-TH-250 Flexibility: paragraph 4.4.7 of <SD8> is fully applicable.

SA-TH-260 Accessibility: paragraph 4.4.8 of <SD8> is fully applicable.

SA-TH-270 Interchangeability: paragraph 4.4.11 of <SD8> is fully applicable

SA-TH-280 Cleanliness: paragraph 4.4.13 of <SD8> is fully applicable

SA-TH-290 Lifetime: paragraph 4.4.5 of <SD8> is fully applicable.

SA-TH-300 The thermal control shall clearly define and select a redundancy approach that reduce system risks, remove single points failures, meet the required reliability figures.

SA-TH-310 The thermal control design of the satellite and payload shall conform to the defined interface requirements and shall avoid/minimise constraints on other subsystems or system. Requirements defined in paragraphs 4.3.1 to 4.3.8 of <SD8> are also applicable.

SA-TH-320 In co-operation with the unit manufacturers Thermal Control shall define temperature reference points (TRP) which are representative of the thermal status of the units and payload.

SA-TH-330 Temperatures at the TRP shall be guaranteed by Thermal Control for all mission phases and modes of operations.

SA-TH-340 Temperatures at the TRP shall be used to drive the temperatures during acceptance and qualification thermal vacuum tests.

SA-TH-350 Thermal Control of the satellite and payload shall comprise sufficient temperature sensors, specifically at TRPs, to enable adequate temperature monitoring and control during nominal and non-nominal mission phases.

SA-TH-360 Thermal Control design of the satellite and payload shall be optimised to achieve the required performances with the minimum resources i.e. lowest power consumption, mass. In addition paragraph. 4.4.2 of <SD8> is applicable.

SA-TH-370 The satellite/payload shall have the capability of detecting, overcoming, isolating failures of Thermal Control for continuation of nominal flight operations. As a minimum the following failures shall be considered: • thermistors and thermostats • heater mats/lines • violation of temperature limits

SA-TH-380 Thermal Control design of the satellite and payload shall allow easy repair and as a minimum:



page 138 of 203

• adjustment of radiator size • removal and/or replacement of insulation blankets , foils • in place refurbishment of thermal control coatings and surface treatments

SA-TH-390 In case Thermal control includes cryogenic cooling, Annex B of <SD8> is applicable.

SA-TH-400 Production, manufacturing and Storage requirements defined in paragraph 4.6 of <SD8> are applicable to thermal hardware.

SA-TH-410 Parts, Materials, Processes: para 4.4.3 of <SD8> is applicable.

SA-TH-420 EEE Components: para 4.4.4 of <SD8> is applicable.

6.7.4 THERMAL ANALYSIS AND VERIFICATION REQUIREMENTS

SA-TH-500 Thermal verification shall be performed in accordance with the requirements of <SD8> Para 4.5.

SA-TH-510 Final flight temperature predictions shall be performed by use of revised thermal mathematical models correlated to the test temperatures within the agreed deviation.

SA-TH-520 A set of design temperatures shall be defined according to the requirements of <SD8> para 4.2.2

SA-TH-530 The qualification temperature limits are equal to the acceptance limits extended at both ends by the qualification margin of 10 [oC].

SA-TH-540 The acceptance temperature limits are equal to the design limits extended at both ends by the acceptance margin of 10 [oC].

SA-TH-550 Reduction of acceptance and qualification margins as defined in the SRD shall be agreed with the Agency if justified i.e. use of recurring units from other projects.

SA-TH-560 Uncertainties associated to the thermal parameters involved in the design shall be calculated by means of sensitivity analysis, added to the analytically predicted temperatures and to the systematic errors (i.e. modelling error, typically 3 [ºC]) to define the design temperature range. Annex A1 of <SD8> provide the recommended approach to uncertainties and sensitivity analysis. Major deviations between <SD8> and contractor preferred approach shall be highlighted for discussion and agreement with the agency.

SA-TH-570 The Thermal Balance (TB) test configuration shall be representative of the (worst) case environment and mission flight conditions.

SA-TH-580 The Thermal Balance (TB) test(s) shall follow test approach and test success criteria unambiguously defined and agreed with the Agency.



page 139 of 203

Annex A3 of <SD8> provide the recommended approach on this topic. Major deviations between <SD8> and contractor preferred approach shall be highlighted for discussion and agreement with the agency.

SA-TH-590 The correlation success criteria shall be agreed with the Agency. Annex A4 of <SD8> provide the recommended approach and guidelines on this topic. Major deviations between <SD8> and contractor preferred approach shall be highlighted for discussion and agreement with the agency.

SA-TH-600 The satellite and the payload Geometrical and Thermal Mathematical Models (GMM and TMM) shall be established in ESARAD or Thermica and ESATAN. Use of other S/W codes is only acceptable if previously agreed with the Agency.

SA-TH-610 The satellite and the payload Geometrical and Thermal Mathematical Models (GMM and TMM) shall allow performing separate as well as combined thermal analysis by mating the individual GMMs and TMMs. Annex 5 of <SD8> provides the recommended approach on thermal analysis. Major deviations between <SD8> and contractor preferred approach shall be highlighted for discussion and agreement with the agency.

SA-TH-620 Reduced GMM and TMM of the satellite and the payload assembly shall be established (following the requirements of the Launcher Authority) to enable the Launcher Authority to perform coupled launcher/satellite thermal analysis.

SA-TH-630 Whenever simplified/reduced models are used, correlation criteria between the detailed and simplified/reduced models shall be specified and agreed with the Agency.

SA-TH-640 Temperature inputs for the structure thermo-elastic analysis shall consider the requirements of the structural mathematical models.

6.8 Space Environment Models, Constants and Units

SA-EV-010 The satellite shall be designed to perform nominally and withstand, with margins, within the space environment defined in <SD3> and as completed below In case the Contractor proposes alternative modelling, he shall do so in agreement with the agency.

6.8.1 MEASUREMENT UNITS

SA-EV-020 All drawings, specifications and engineering data shall use the International System of Units (SI).



page 140 of 203

6.8.2 GRAVITY MODEL AND REFERENCE ELLIPSOID

SA-EV-030 The coefficients of the gravity model Eigen-GL04C (see <RD2>) shall be used for mission analysis purposes for the Sentinel-3 satellite with an order compatible with the mission requirements.

SA-EV-040 The reference ellipsoid WGS-84 (see <RD3>) shall be used for calculations of position, altitude and attitude.

6.8.3 MAGNETIC FIELD

SA-EV-050 The magnetic model IGRF-10 <RD4> shall be used for analysis and design purposes.

6.8.4 ATOMIC OXYGEN ENVIRONMENT

SA-EV-060 The integrated values of atomic oxygen fluxes shall be calculated according to <SD3>.

6.8.5 CHARGED PARTICLE RADIATION

SA-EV-070 The trapped radiation models specified in <SD3> shall be used for the Sentinel-3 radiation environment determination. Transient fluxes in the auroral zone shall be taken into account.

SA-EV-080 The radiation environment due to cosmic rays shall be evaluated from the empirical model provided in <SD3>.

6.8.6 ATMOSPHERE

SA-EV-090 The model specified in <SD3> shall be used to define atmospheric density for Sentinel-3 mission analysis.

SA-EV-100 The Ionospheric Plasma environment as defined in <SD3> shall be applicable to the Sentinel-3 design.

6.8.7 SOLAR ACTIVITY

SA-EV-110 The solar activity conditions applicable to the Sentinel-3 satellite design shall assume 11 years solar cycle with 7 years at high index value and 4 years at low index value (see <SD3>). The relevant minimum and maximum worst case values shall be derived for the mission beginning at any time in the cycle



page 141 of 203

6.8.8 THERMAL ENVIRONMENT

6.8.8.1 Solar constant

SA-EV-120 The mean, winter solstice and summer solstice values for the solar constant used for analysis and design shall be as specified in <SD3>.

6.8.8.2 Earth Albedo and Infrared Emission

SA-EV-130 The earth albedo and infrared emission used for analysis and design shall be as specified in <SD3> and as supplemented by <RD15>.

6.9 Dependability

6.9.1 LIFETIME

SA-LI-010 The Spacecraft shall be designed for a nominal life time in orbit of 7 years following a maximum on-ground storage of 10 years (under conditions to be specified by the Contractor) and following the in-orbit commissioning.

SA-LI-020 Consumables (e.g. propellant) of each satellite shall include margins allowing an extension of the lifetime of the corresponding satellite by 5 years.

SA-LI-030 The batteries (which are life-limited items) of each satellite shall include margins allowing an extension of the lifetime of the corresponding satellite by 5 years.

SA-LI-040 Life-limited items (except for batteries) of the satellites shall be sized according to the nominal lifetime of the mission. Nevertheless, the impact of potential mission extension on life-limited items shall be carefully assessed (e.g. on performances, reliability, power margins).

SA-LI-050 In determining the lifetime of relevant Spacecraft elements worst case parameters shall be used.

6.9.2 RELIABILITY

SA-RE-010 The reliability of the platform shall be better than 0.90 over the specified lifetime. The platform is defined as the satellite bus only, excluding payload instruments. Failures (of redundant elements) are permitted within these definitions.

SA-RE-020 The reliability of the platform combined with the reliability of anyone of the main instruments (or group of instruments in the case of Topography) shall be better than 0.75 over the specified lifetime. The main instruments are SLST, OLCI and the Topography group, composed of RA, MWR, LRR and GNSS



page 142 of 203

6.9.3 AVAILABILITY

SA-AV-010 The Spacecraft shall be designed to provide a monthly averaged availability in-orbit of grater than 97% over the lifetime, after acquisition of the operational orbit and commissioning and taking into account the effects of space environment. Availability is defined as the probability that the space segment and the link to the ground segment provides the required data service to the ground segment, excluding the effects of non-recoverable failures. All sources of unavailability shall be considered. Examples are planned and unplanned orbital excursions, link outages due to atmospheric effects; single event upsets due to cosmic ray effects, instrument calibration requiring interruption of nominal measurements.

SA-AV-020 Recovery times following anomalies shall include a time interval of 12 hours, to account for a worst case delay between the occurrence of the anomaly and its detection by the TT&C station, assuming 2 TT&C passes per day in routine operation. In-flight operational anomalies due to operational error or ground station malfunction or non-availability are not included in this specification.

SA-AV-030 Interruption of Satellite observations due to orbit corrections and calibration shall be minimised.

6.9.4 MAINTAINABILITY The following requirements apply only to on-ground maintenance.

SA-MA-010 It shall be possible to repair, remove or replace any satellite unit or instrument, should it require maintenance, repair or modification, with minimum disturbance to the Satellite design elements or activities.

SA-MA-020 The satellite shall be compatible with a storage period of up to 10 years in a suitable environment and with specific maintenance activities to be specified by the Contractor.

SA-MA-030 Items that may require late integration or adjustment, servicing or maintenance close to launch, e.g. pyrotechnics and fuses, shall be easily accessible.

6.9.5 FAULT-TOLERANCE FAILURE PROPAGATION

SA-FT-010 The failure consequence severity categories shall be as defined in the Product Assurance Requirements document <ND2>.

SA-FT-020 No single satellite failure (including hardware failure, software failure or human error) shall lead to mission critical or safety critical consequences.

SA-FT-030 The failure tolerance needs not to be applied to:



page 143 of 203

• primary structures • load-carrying structures • structural fasteners • load-carrying elements of mechanisms • pressure vessels For these items, fracture control shall apply.

SA-FT-040 No double failure (including hardware failure, software failure or human error) shall lead to catastrophic consequences.

SA-FT-050 A failure in one satellite equipment shall not cause a failure or a degradation of another equipment

6.10 Software requirements

6.10.1 SOFTWARE ENGINEERING REQUIREMENTS Requirements listed under this section are applicable for each software element embarked on-board Sentinel-3, i.e. platform and instruments.

SA-SW-010 The Sentinel-3 on-board software engineering processes shall be performed in accordance with the requirements defined in the applicable standard <SD17> with the applicability matrix defined in Appendix E:, section E.14.

SA-SW-020 The software documentation to be delivered shall be compliant with the applicable standard <SD18> with the applicability matrix defined in Appendix E:, section E.15.

SA-SW-030 The Sentinel-3 on-board software shall implement functions and services, which are necessary to fulfil all the Satellite mission objectives under the specific Sentinel-3 operational conditions. Exactly which functions and services to implement in software will have to be specified in the Requirements Baseline (RB) as the result of hardware/software trade-off analysis and system partitioning, see <SD17>, chapter 5.2

SA-SW-040 A system and software criticality analysis shall be performed in order to define the software level criticality, see <SD17> chapter 5.2.2, and establish a list of critical software functions

SA-SW-050 As a minimum, the list of critical software functions shall include: • Start-up from initial loading • Separation detection • Fault management • Memory patch and dump • Writing to System Log



page 144 of 203

• Safe mode

SA-SW-060 The software validation approach shall derive from the criticality analysis of the software.

SA-SW-070 100% code branch coverage at unit testing level for critical software functions shall be achieved

SA-SW-080 In cases when new or complex functionality is required, the requirements baseline shall be pre-validated by simulation, prototyping or other modeling activities before being released for software implementation. This applies in particular for: • AOCS algorithms • AOCS FDIR functions • on-board bus protocol functions • re-configuration logic, • any other critical HW/SW interfaces

SA-SW-090 The requirements baseline shall include all interfaces between the software and the system, in particular: • software interfaces with other software in the system (operating system, database

management system, or the application software) • hardware interfaces to the specific hardware configuration • communication interfaces (particular network protocol for example)

SA-SW-100 The system database shall be specified and made applicable for use to the software supplier in the RB to ensure the consistency of common data, for example by use of the database to produce automatically configured software (generation of tables, constant data, initial values).

SA-SW-110 Development constraints for the software supplier shall be defined to support Sentinel-3 harmonisation efforts, for example for: • Operating system to be used • COTS software to be used • database to be used • harmonised Software development environment (SDE) to be used • harmonised Software validation facility (SVF)

SA-SW-120 The RB shall include the specification of reusability requirements that apply for the development to enable future reuse of the software. Future reuse is improved by early identification and definition of development constraints.

SA-SW-130 The RB shall include the definition and specification of software maintenance requirements.



page 145 of 203

SA-SW-140 The RB shall include the definition and specification of requirements related to

Independent Software Verification and Validation (ISVV), in particular: • a provision that the software supplier shall deliver elements of the software

development process, like documentation or source code to the ISVV contractor at the various stages of the development

• a provision that the software suppliers shall accept comments from the ISVV contractor and give support to clarify whether the ISVV comment is justified, and when necessary, to implement the steps to rectify the problem.

SA-SW-150 For onboard software elements which combine AOCS, Command and Control, and Mission data processing software in the same processor, an incremental software development approach shall be defined to allow and ensure early hardware operation and test on equipment, subsystem and system level.

SA-SW-160 The distribution of functionality for the increments shall be defined in accordance with the AIT needs, in particular to allow independent testing of AOCS, Command and Control, and Mission data processing functions.

SA-SW-170 The incremental approach and the needs of higher level AIT shall be specified to the software supplier level in the respective requirements baseline documentation, see <SD17>, chapter 5.2.5.8.

SA-SW-180 Software re-used from other projects shall be identified. Compatibility with the system requirements and compliance to the applicable project requirements shall be demonstrated before reuse.

SA-SW-190 Reused software shall always be tested when integrated in its new environment.

SA-SW-200 The Sentinel-3 software shall be written in a high-level language to be approved by the Agency. Use of a low-level language must be strictly limited and justified.

SA-SW-210 The Sentinel-3 software shall be modular, minimising the interdependency between software modules in order to allow independent development, testing, and modification of software modules.

SA-SW-220 The on-board software shall be designed in a layered structure to allow for software maintenance (before and during flight).

SA-SW-230 Fixed areas of the onboard memory shall be dedicated to: a.) code, b.) constant data, c.) variable data. Each area shall be built such to facilitate the future in-orbit maintenance (e.g. space reserved within the areas). Those memory areas shall be clearly documented in the Spacecraft Flight Operations manual.

SA-SW-240 The Sentinel-3 software shall be able to schedule on-board processes (tasks) both cyclically at pre-defined task-activation frequency, and event-driven (asynchronously).



page 146 of 203

SA-SW-250 Software execution shall be deterministic. Under all load conditions permitted by the

Flight Operation Manual the software shall complete its functions within the required time. This means that there shall be no schedule overruns leading to uncompleted tasks. This requirement implies that only the MAXIMUM execution times for a task shall be controlled and thus SW can tolerate execution time jitters that are below that maximum.

SA-SW-260 Critical software shall be protected from inadvertent operation and modification.

SA-SW-270 There shall be no “dead code” code in the critical flight software. For all other software, identification and justification of the dead code are required.

SA-SW-280 The flight software shall not contain any code still running in-flight needed only for on-ground testing.

SA-SW-290 The Sentinel-3 software shall maintain a 25% margin on CPU-load for an agreed set of reference scenarios at launch time.

SA-SW-300 The Sentinel-3 software shall have a 25% margin on memory usage at launch time on all memory (volatile and non-volatile).

SA-SW-310 The Sentinel-3 software shall have a 25% margin on bus utilisation at launch time for an agreed set of worst-case traffic scenarios.

SA-SW-320 The Sentinel-3 software shall have a 25% margin on telemetry and telecommand channels at launch time for an agreed set of worst-case traffic scenarios.

SA-SW-330 The number of write accesses to NVRAM shall not exceed 50% of the number specified to be allowed in total

6.10.2 SOFTWARE FUNCTIONAL AND OPERATIONAL REQUIREMENTS Requirements listed under this section are applicable for each software element embarked on-board Sentinel-3, i.e. platform and instruments.

SA-SW-400 All on-board software for the execution of operational procedures, including boot procedures, shall be stored in a non-volatile memory. A default configuration shall always be available in the event of malfunctions.

SA-SW-410 It shall be possible to replace this default configuration totally or partially with software up-linked from ground.

SA-SW-420 It shall be possible to copy to the Ground Segment the contents of the software default configuration.

SA-SW-430 At initialisation, the Satellite onboard software shall be downloaded from non-volatile memory to RAM for execution.



page 147 of 203

SA-SW-440 All Satellite software shall execute from RAM, except for the downloading function

and software for loading of non-volatile memory. Critical software might execute from PROM. In that case, it must be ensured that the functionality loaded in PROM is reduced to the absolute minimum.

SA-SW-450 Patch and dump of all RAM and re-writable non-volatile memory areas shall be possible, individually and down to byte level, with the exception of any memory area used for storage of secret keys.

SA-SW-460 The number of write accesses to re-writable non-volatile memories shall be logged on-ground throughout the lifetime of the devices (on-ground and in-orbit)

SA-SW-470 Dump of all PROM areas shall be possible, individually, with the exception of any memory area used for storage of secret keys.

SA-SW-480 It shall be possible to dump the software from a Satellite memory area without interrupting the Satellite operational mission.

SA-SW-490 Software uploads to platform, instruments or equipment computers shall be kept in an intermediate storage area so that there is no need for re-uplink after the power-off of any of these computers.

SA-SW-500 If compression is used for the storage of a software image on-board, patches shall be kept separated from the onboard image.

SA-SW-510 The Software image shall include a software version identifier, which can be reported by a specific TM parameter.

SA-SW-520 At initialisation, the software shall perform a self check.

SA-SW-530 On-board software shall ensure: • High level of autonomy both under nominal and non-nominal conditions • The support of all operational modes, including ground testing, pre-launch, launch

and nominal operations, and • A robustness against malfunctions at software and hardware level Depending on the on-board software, the above should be ensured at system, subsystem and equipment level.

SA-SW-540 The on-board FDIR shall avoid unnecessary mission-outages.

SA-SW-550 When running, the software shall monitor its execution with the help of a watchdog mechanism.

SA-SW-560 In case of unexpected interruptions (incl. Re-boot) or exceptions, the software handler shall report within TM (or save) the full details of the error. Then the handler will apply the treatment defined by the FDIR requirements. The error context shall include at least the identification of the exception, a time-stamp and the CPU context



page 148 of 203

(i.e. Registers and the last stack entries) to facilitate the ground investigations. In case of storage limitation and consecutives errors, the first occurrences will be saved until ground reporting.

SA-SW-570 In case of EDAC usage, a memory scrubbing shall be performed to avoid the accumulation of single bit errors due to SEU. It shall be possible to mask EDAC interrupts on ground request.

SA-SW-580 It shall be possible to perform checkout/self-test and S/W maintenance on the non-active processor module while performing nominal operations using the active one. Such maintenance operations shall have no impact on the nominal operations of the S/C.

SA-SW-590 All re-writable memory areas shall be protected against SEU and bit errors.

SA-SW-600 For all Satellite and Payload reconfiguration in orbit, based on requests from MTL or directly from ground, the Satellite software shall reconfigure as necessary, with minimum interference to the operation of the active Payload instruments.

SA-SW-610 The Sentinel-3 software shall maintain an On-board Elapsed Time (OBT)

SA-SW-620 The Sentinel-3 software shall provide the necessary functions and services to allow ground to correlate the OBT with UTC with an accuracy in line with the timing requirement specified in this SRD.

SA-SW-630 It shall be possible for the Satellite software to time-stamp events of significance for reporting in the Satellite housekeeping telemetry.

SA-SW-640 The software shall provide the necessary functions for the management and handling of the data handling bus.

SA-SW-650 The execution accuracy for time-tagged or position-driven telecommands shall be such to not affect mission performance requirements.

SA-SW-660 The Sentinel-3 software shall allow spacing of time-tagged telecommands of 125 ms or less, or equivalent spacing in position-driven telecommands.

SA-SW-670 The on-board software shall manage conflicts between time-tagged and position driven telecommands

6.11 Satellite budgets

6.11.1 GENERAL

SA-BU-010 A comprehensive margin policy shall be defined and documented. The satellite(s) budgets shall clearly identify the levels of margins.



page 149 of 203

SA-BU-020 All resource requirements and engineering parameters shall be documented and

controlled in the form of budgets. This shall include, but not be limited to: • mass and mass properties, • alignments, • power and energy, • heat generation and dissipation, • radio frequency links, • telecommand and telemetry data, • observation data, • software and memory usage, • computer load, • propellant, • attitude pointing accuracy, stability and knowledge, • torque and momentum, • geo-location and co-registration of observation data, • timing.

6.11.2 MASS

SA-MA-010 A 10% system margin for the dry mass shall be added to the total satellite mass budget.

SA-MA-020 The following additional maturity mass margin factors shall be applied for each satellite unit to account for the hardware development status. • Completely new development: 20 % • New development derived from existing hardware: 15 % • Existing unit requiring minor / medium modification: 10 % • Existing unit: 3 %

6.11.3 POWER

SA-PW-010 A 10% system margin shall be added to the total satellite power budget.

SA-PW-020 The following additional maturity power margin factors shall be applied for each satellite unit to account for the hardware development status. • Completely new developments: 30 % • New developments derived from existing hardware: 20 % • Existing units requiring minor / medium modification: 10 % • Existing units: 5 %



page 150 of 203

6.11.4 POINTING, GEO-LOCATION AND CO-REGISTRATION

SA-PG-010 Pointing, geo-location and co-registration budgets shall be established in accordance with Appendix C: and Appendix D:

6.11.5 RADIO COMMUNICATION LINK BUDGETS Margins on Radio Communication link budgets are specified in Section 6.2



page 151 of 203

7 SATELLITE ASSEMBLY, INTEGRATION AND VERIFICATION REQUIREMENTS

This section covers the specific set of requirements applicable to the Satellite and all its elements during their full lifetime on ground, from assembly through testing until launch.

7.1 Terrestrial Environment

AI-EN-010 The Spacecraft and its Ground Support Equipment (GSE) shall be protected from, or designed to survive without performance degradation the applicable ambient natural environment during commercial air, sea and road transportation and handling in Europe and at the launch site.

AI-EN-020 Where it is not feasible or cost-effective to design the flight hardware to withstand the terrestrial environment directly, the flight hardware shall be protected by suitable GSE and maintained within the environmental envelope specified for launch and on-orbit operations.

AI-EN-030 The Satellite and its GSE shall be designed to allow the performance of all ground Assembly, Integration and Test (AIT) activities, including storage, both in Europe and at the launch site, in a controlled environment with a minimum cleanliness level of Class 100000 as defined in FED.STD.209.

AI-EN-040 Where this cleanliness level would impair the operation of mechanisms or other equipment, or reduce the accuracy, resolution or performance of the instruments, the Contractor shall establish and provide the required minimum cleanliness level for the processes or operations involved.

AI-EN-050 Contamination and cleanliness environment during launch preparation and ascent phases, as defined by the corresponding launcher user manual, shall be taken into account for the evaluation of in-orbit performances.

AI-EN-060 The Contractor shall establish the requirement of maximum molecular and particulate contamination allowed by each Sentinel-3 element at the time of the launch, define the acceptable contamination budget for each phase of the AIT programme (including transportation and launch campaign) and identify the means required to measure the level of contamination on the relevant flight items.

AI-EN-070 Ground covers shall be provided to protect the ingress of contamination into apertures except when such apertures are specifically required to be open.



page 152 of 203

7.2 Integration Requirements

AI-IN-010 The Satellite design shall allow for easy access to onboard units during AIV. Skin test connectors and test points shall be provided.

AI-IN-020 Satellite equipment level maintenance operations shall be possible without need to disconnect and de-integrate the equipment, like in the case of PROM access for processors or crypto modules.

AI-IN-030 The satellite design shall allow for late and fast integration of units and consumables that need to be done at a late stage of the AIT programme (e.g. at the launch site) or that could require removal for prolonged storage or periodic health check. This requirement shall be achieved without requiring dismounting and retesting of already integrated flight units

AI-IN-040 Security related units (e.g. authentication/encryption/decryption units) shall be easily accessible and replaceable at all times during the ground activities, until encapsulation within the Launch fairing. This includes as well the required accessibility to special connectors/access doors for security keys loading

AI-IN-050 Fuses for the protection of units against failure propagation from the power bus into the unit shall be accessible from the outside of the unit without major intervention being required for their replacement

AI-IN-060 The status of fuses for the protection of units against failure propagation originating in the unit itself shall be detectable unambiguously when they have been damaged during operation.

AI-IN-070 The integrity of all interfaces, which are mated/demated during AIV for integration or replacement of units or for tests, shall be verified by test.

AI-IN-080 Equipment and instrument electrical integration on the Spacecraft shall always include verification of the electrical interfaces with the platform such as grounding/isolation, command signals, telemetry response signals, in-rush current and power consumption.

7.3 Verification Requirements

AI-VE-010 The Verification programme shall ensure that the design and performance requirements of the Satellite and all its elements (Instrument, Subsystem, equipment) are met before launch.

AI-VE-020 The Verification Plan shall present the verification programme by specifying the method (test, analysis, inspection or review of design), the level (Satellite, instrument, subsystem, and equipment), the means and the techniques to which the



page 153 of 203

requirements will be verified and shall be compliant with <SD1> according to the applicability matrix defined in Appendix E.1

AI-VE-030 All satellite functions shall be verifiable by review-of-design, similarity, analysis, simulation, combinations thereof or test.

AI-VE-040 Verification methods based on simulations rather than testing shall be applied only when significant cost savings can be demonstrated or testing is not feasible. In other cases, testing shall be the baseline verification method. Approaches based on early utilisation of system performance test benches, which are progressively upgraded to the system performance bench, including hardware and software in the loop, ground segment interfaces and operational procedures shall be encouraged.

AI-VE-050 The Verification Plan shall address: • Design qualification, i.e. demonstration that the design of the Satellite, of the GSE

and other items specified as part of the programme comply with adequate margin with the requirements

• Acceptance of products generated in the programme, by demonstrating that hardware and software are free from workmanship errors and material faults, that they conform with the design baseline, and that they perform and function as required in the specified flight environment

• Delivery of correct documentation

AI-VE-060 The Verification Control Documents shall record in matrix form compliance with the design and performance requirements as defined in this SRD and lower tier documents.

AI-VE-070 The verification programme shall cover all performance parameters in a hierarchical structure such that all mission objectives, broken-down to lower levels, can be fully traced.

AI-VE-080 End-to-end verification shall be performed to ensure that all system elements contributing to mission success are covered. In particular, a mission representative operational scenario shall be defined, agreed with ESA and run to demonstrate overall system operability and performance prior to the launch.

AI-VE-090 For requirements that can only be directly verified in orbit, indirect verification methods shall be implemented before launch based on ground test with complementary analysis and simulations for in-orbit conditions.

AI-VE-100 Operational interfaces between Satellite elements and between the Satellite and the Ground Segment shall be verified by test. This refers “inter-alia” to testing of the command and control interfaces by connection of the Satellite to the Flight Operations ground control center, i.e. to cover the System Verification Test (SVT) programme.



page 154 of 203

7.3.1 TEST REQUIREMENTS

AI-VE-200 The Satellite Test Plan shall specify the means and techniques selected for each test planned on Sentinel-3 elements and shall be compliant with <SD2> as defined in E.2.

AI-VE-210 All defined operational modes of hardware and software items shall be tested to the extent verifiable on-ground, including redundancies, cross-strapping and back-up, emergency modes

AI-VE-220 The Payload instruments shall be designed to be functionally self contained with minimal interfaces (mechanical, electrical, software, etc.) with the Platform so as to ensure they can be tested independently of the Platform and to permit flexibility in the Satellite AIT activities

AI-VE-230 An adequate set of performance tests shall be conducted incrementally at Instrument/Equipment, Spacecraft and Satellite levels

AI-VE-240 Repeatability and reproducibility of tests shall be maintained throughout the AIT programme

AI-VE-250 The main elements of the instrument/equipment test procedures shall be reusable during the higher level Satellite tests.

AI-VE-260 The AIT programme shall be conducted on the basis of AIT procedures and Data base information that can be reused for flight operations.

AI-VE-270 The Spacecraft Reference Data Base shall be compliant with <ND4>

AI-VE-280 Selected S-band and X-Band data from Satellite level tests shall be made available in annotated form to the Customer in a computer compatible format to assist the verification of ground segment compatibility. This format shall be proposed by the Contractor and agreed by the Agency

AI-VE-290 Interfaces to electrical check-out equipment shall be accessible at Satellite, Payload and Platform level

AI-VE-300 Mounting provisions shall be provided for test fixtures and non-flight items as required

7.4 Model Philosophy

AI-MO-010 The Spacecraft development shall distinguish between a Spacecraft, Platform and Payload specific approach

AI-MO-020 The development concept shall be based on a Model Philosophy to be defined by the Contractor and agreed by the Agency



page 155 of 203

NOTE: In case Structural Thermal Model (STM) or Engineering Model (EM) are being used in the development approach, hardware refurbishment or reuse for FM's is encouraged

AI-MO-030 In case a Satellite Protoflight approach is proposed, qualification testing that could endanger the flight worthiness of the Flight item (e.g. for possible deformations/damages or fatigue effects) shall be performed in advanced on dedicated models (e.g. Structural Thermal Models).

7.5 Ground Support Equipment

AI-GS-010 The GSE shall be designed to allow the execution in all necessary engineering fields of incremental Assembly, Integration, and Test from unit to Satellite level, transportation, launch support, and for maintenance of Satellite during storage period or of spare models. As GSE it is intended: Mechanical GSE (MGSE), Electrical GSE (EGSE) including Software, Optical GSE (OGSE) and Fluidic GSE (FGSE).

AI-GS-020 The GSE hardware and software developed for testing at unit, assembly, instrument and subsystem level shall be designed to allow maximum re-use at higher level tests.

AI-GS-030 The GSE shall comply with requirements and safety standard imposed by the facility in which it has to operate.

AI-GS-040 No GSE fault or unwanted emission of any kind shall propagate through the interface with flight hardware.

AI-GS-050 The GSE shall provide the capability for all functional interfaces to be verified before connection to flight hardware.

AI-GS-060 The satellite GSE shall provide all necessary interfaces with external equipments that are required to support system level testing and flight readiness (such as the NDIU for the SVT programme) without preventing the local monitoring of operations, which could endanger the Satellite safety.

AI-GS-070 The GSE shall be capable of producing transportable (via Media support device and/or FTP) housekeeping and Mission data sets of various durations for external utilisation at System level, and of acquiring the Satellite software in formats compatible with <ND5>.

AI-GS-080 The GSE shall allow storing all data, both measurement and housekeeping, in real time, provide means of archiving them and provide access to all the test contexts such as to quickly reconfigure units, subsystems, instruments of the complete Satellite, in order to resume or to repeat a specific test or for off-line post-test processing.



page 156 of 203

AI-GS-090 The GSE design shall take into account the constraints related to thermal balance /

thermal vacuum test campaigns.

AI-GS-100 The GSE shall be designed for a minimum lifetime of 20 years.

AI-GS-110 The MGSE design and the associated handling procedures shall ensure that the loads and the environments applied to the Flight Hardware are never exceeding the flight acceptance levels. In other words, the MGSE design shall not drive the Flight Hardware design.

AI-GS-120 The EGSE shall support the utilisation of the Satellite Reference Database, and its export to the Flight Operation Database

AI-GS-130 The EGSE shall support the development and testing of operational procedures.

7.5.1 SOFTWARE DEVELOPMENT AND VERIFICATION ENVIRONMENT

AI-GS-200 The SDVE shall support on-board software development and testing prior to integration with the flight hardware and shall support flight software maintenance.

AI-GS-210 The SDVE shall support module, functional and validation test of the flight software.

AI-GS-220 The SDVE shall include software simulation of the satellite environment in which the software operates (e.g. AOCS, data bus, TM/TC-interfaces, etc.) to present a flight-representative environment.

AI-GS-230 The SDVE shall be transportable

AI-GS-240 All on-board SW elements shall use a SW Validation Facility (SVF) running on an instruction-level simulator for testing. HW, interfaces and environment shall be implemented via simulation models. The SVF is considered part of the SDVE

AI-GS-250 It shall be ensured that the SVF is representative wrt. the flight hardware as much as possible.

AI-GS-260 The SDVE shall include and support tests of AOCS dynamic models.

AI-GS-270 The operational interface to the SVF shall be achieved via the system database.

AI-GS-280 For SW-level testing of AOCS functions, the SVDE shall ensure the possibility that such AOCS SW can be tested in closed loop.



page 157 of 203

7.5.2 RF SUITCASE

7.5.2.1 S-band

AI-GS-300 The S-band RF suitcase shall be capable of demonstrating the compatibility between the Satellite and the command and control Ground station

AI-GS-310 The S-band RF suitcase shall reliably represent the performance of the bi-directional S-band communication between the Satellite and the S-band Ground Stations including: • Command and Control protocol • Crypto functions • Data format

AI-GS-320 The S-band RF suitcase shall be transportable and be able to support the Ground Stations compatibility tests as defined within the Statement of Work <ND1>

AI-GS-330 The S-band RF suitcase shall be equipped with suitable local monitor in order to allow quick health diagnostics. It is intended to use this suitcase on the field

AI-GS-340 The S-band RF suitcase shall be self-contained and capable to meet the above listed requirements without any external test or support equipment, like transformers, voltmeters, signal generators, data format generators and recording equipment.

7.5.2.2 X-band

AI-GS-400 The X-band RF suitcase shall be capable of demonstrating the compatibility between the Satellite and the core or local X-band Ground stations

AI-GS-410 The X-band RF suitcase shall represent reliably the performance of the X-band Communication subsystem with the Satellite, including the generation of properly formatted, encoded and encrypted Mission data (content not required to be realistic).

AI-GS-420 The X-band RF suitcase shall be equipped with suitable local monitor in order to allow quick health diagnostics. It is intended to use this suitcase on the field

AI-GS-430 The X-band RF suitcase shall be transportable and be able to support the Ground stations compatibility tests as defined in the Statement of Work <ND1>

AI-GS-440 The X-band RF-suitcase shall be self-contained to permit the performance of bit error rate tests



page 158 of 203

8 GROUND PROCESSING AND SYSTEM SIMULATION REQUIREMENTS

8.1 System Performance Simulator The purpose of the System Performance Simulator is: - to support the development of the instruments - to support validation of the operational Level-1 processor - to evaluate along the development programme the end-to end mission performance

GP-SS-010 For the Payload Instruments providing measurement data [OLCI, SLST, RA, MWR, GNSS], the System Performance Simulator shall be capable of generating simulated reference data sets, representative of all the stages from the generation to the final processing. These shall in particular include Instrument Source Packets (ISP), L0, L1a, L1b, L1c where applicable, and simplified L2 data.

GP-SS-020 The System Performance Simulator shall integrate a number of modular functions, including in particular: • A scene generator, able to generate a scene of geophysical parameters to be

observed (i.e image of reflectance/temperature/emissivity at the Bottom of the Atmosphere (BOA), surface DEM/field of waves etc)

• An instrument stimuli generator, converting the scene into signals observed by the instrument and taking into account the geometry of the observation (the stimuli are Top of the Atmosphere (TOA) parameters, ideal radar echoes etc)

• A function producing ancillary data needed for the processing (i.e. attitude, navigation, housekeeping temperatures etc…)

• An instrument simulator, converting the stimuli into engineering measurements using an instrument model, together with instrument calibration and characterisation data

• A formatting unit, converting the engineering measurements into instrument source packets and including switchable compression and switchable encryption as appropriate.

• A Ground Processor Prototype, ensuring all the on-ground data processing tasks up to and including L1. This function shall also include de-compression and decryption.

• A Basic L2 Processor, converting processed L1 data into geophysical parameters, comparable to those produced by the scene generator

• An analysis function, able to compare and analyse the performance at different stages of the simulation



page 159 of 203

GP-SS-030 It shall be possible for the user to select the level of complexity of the different

functions used in a given simulation, in order to maintain a reasonable balance between the execution time and the simulation accuracy.

GP-SS-040 The System Performance Simulator shall allow to estimate System performances, in particular the temporal and the spatial sampling of the observations, as well as the geo-location and co-registration performance under worst case conditions.

GP-SS-050 All input parameters used to run a particular simulation shall be stored in a log file accessible and reprogrammable by the user.

GP-SS-060 It shall be possible to store the data generated by the simulator at different stages and resume an interrupted simulation using the already generated data (not having to re-run the corresponding functions)

GP-SS-070 The System Performance Simulator shall be capable of simulating all modes of the Payload Instruments and shall generate representative instrument source packets. This shall cover in particular data produced during normal observation and during calibration (both internal or external calibration) and shall include any ancillary data.

GP-SS-080 The System Performance Simulator shall make use of the Mission software CFI library provided by ESA for orbit and attitude computations.

GP-SS-090 The System Performance Simulator shall be able to ingest ACE <RD6>and GLOBE <RD7> Digital Elevation Models for building simulation scenarios.

GP-SS-100 The System Performance simulator shall be able to assess the performance of all relevant Payload instruments. This includes in particular the tracking performance of the Radar Altimeter.

8.2 Ground Processor Prototype

GP-PP-010 The Sentinel-3 Payload L0/1a/b/c Ground Processor Prototype shall be capable of generating Level-0 to Level-1b -and Level-1c when applicable- Mission data products for operational processor validation (such as in running comparative processing with the operational processor), optimisation of Satellite or Instrument parameters (monitoring the instrument design and effect of characterisation data), and for analysing the overall Satellite and Instrument compliance to the SRD performance requirements.

GP-PP-020 The GPP shall be designed to ingest simulated instrument source packets (ISP) and ancillary data coming from the System Performance Simulator, or real ISP and ancillary data recorded during the Satellite and Instrument development phase via the GSE or XSVE. The GPP shall in particular include fully flight representative decryption and decompression functionalities.



page 160 of 203

GP-PP-030 The GPP shall be designed in a modular manner such as each instrument chain is

independently operable.

GP-PP-040 All products generated by the GPP shall be stored in separate files. These files shall be used as input data for the next stage of the processing and shall be according to the standard given in <RD8>.

GP-PP-050 The Contractor shall define and implement within the GPP a set of key performance parameters and quality indicators to be monitored in the L0 and/or L1 data products to be monitored during development and in orbit operations.

GP-PP-060 The GPP shall be capable to generate data products for part of an orbit or for a programmable number of complete orbits.

GP-PP-070 A GPP man/machine interface shall be provided to allow operational control of the available modes of operations (e.g. nominal mode, calibration mode, compression parameters), and re-programming of the Satellite and Instrument modelling based on a an accurate Instrument design and performance model.

GP-PP-080 The GPP shall process and generate data that are compliant with the Instrument Measurement Data Definition (IMDD).

GP-PP-090 The GPP shall be capable to orderly store processing runs and associated products such as to allow their retrieval at any time of the programme

GP-PP-100 The GPP shall make use of the Mission software CFI library provided by ESA for orbit and attitude computations.

GP-PP-110 The GPP shall preferably be developed under LINUX operating system and in C or C++ language.

8.3 Level-2 Basic Processor

GP-L2-010 The Sentinel-3 Payload Level-2 Basic Processor shall be capable of generating key elementary Leve-2 product parameters, necessary to validate the end-to-end performance by simulation. The Level-2 Basic Processor is a simplified L2 processor, used for operational processor validation (such as in running comparative processing with the operational processor) and for analysing the end-to-end product quality during the development Phase

GP-L2-020 The L2 Basic Processor shall be able to ingest L1 data coming from the GPP.

GP-L2-030 The L2 Basic Processor for Topography Products, shall be able to assess the Altimeter range measurement accuracy over any specified surface and in any Altimeter measurement mode. This implies the implementation of a re-tracker for LRM and SAR modes



page 161 of 203

GP-L2-040 The L2 Basic Processor for Topography Products shall be able to assess the accuracy

of the Ionospheric and Wet-Troposphere corrections

GP-L2-050 The L2 Basic Processor shall be able to assess the POD performance derived form GNSS receiver data

GP-L2-060 The L2 Basic Processor for Optical Products shall provide BOA geophysical parameters.

GP-L2-070 The L2 Basic Processor for Land products shall be able to assess the accuracy of atmospheric corrections using synergetic measurements from SLST and OLCI.



page 162 of 203

APPENDIX A: REFERENCE FRAMES

A.1 Inertial Reference frame. The Inertial Reference frame to be used for Sentinel-3 is the Geocentric mean of date J2000 Note: In case a more accurate inertial frame is deemed to be necessary, then the International Celestial Reference Frame (ICRF) -adopted by the International Astronomical Union (IAU)- shall be considered and proposed by the Contractor for agreement with the Agency.

A.2 Terrestrial Reference frame. The terrestrial reference frame used for precision positional of target on ground, to identify the position of the sub-satellite point shall be the International Terrestrial Reference Frame (ITRF) adopted by the International Astronomical Union (IAU).

A.3 Orbital frame The orbital reference frame shall have the origin of the frame in the centre of mass of the satellite,

Xorb forms with Yorb, Zorb a right-handed reference frame. (Xorb belongs to the orbital plane with a positive projection onto the satellite velocity)

Yorb is perpendicular to the orbital plane, in the opposite direction of the orbital momentum. Zorb is in the opposite direction of the satellite centre of mass position vector from the earth

centre.

A.4 Geodetic pointing frame. The geodetic reference frame shall have its origin in the centre of mass of the Satellite.

Xged belongs to the orbital plane with a positive projection onto the satellite velocity Yged forms with Xged,Yged,Zged a right-handed reference frame. Zged points towards the earth along the local vertical defined above the WGS84 ellipsoid.

(The target point of this vertical on the elipsoid is on the same meridian as the sub-satellite point defined by the intersection of the earth centred position vector with the elipsoid)

A.5 Yaw steering frame. The (Xyst,Yyst,Zyst) yaw-steering reference frame shall differ from the geodetic pointing frame by a rotation around the Zged axis.



page 163 of 203

The velocity of the target point (at the local vertical) relative to the earth surface shall be perpendicular to the intersection of the Yyst,Zyst plane with the ellipsoid. In case yaw steering is applied without geodetic pointing, the target point shall be replaced by the sub-satellite point

A.6 Flight path frame The Xflp,Yflp,Zflp flight path reference frame shall its origin at the centre of mass of the satellite

Xflp is in the direction of flight aligned with the velocity vector. Yflp is perpendicular to the orbital plane, in the opposite direction of the orbital momentum. Zflp shall form with Xflp,Yflp,Zflp a right-handed reference frame

A.7 Sun pointing frame The frame is TBD. The solar array shall be towards the sun and the other axis shall optimise ground coverage.

A.8 SC control frame. The SC control shall be defined by the Prime contractor. The purpose of the attitude control function is to align this frame w.r.t to the target frame defined by the guidance function. Rotation around the axis of this frame shall be identified with the three angles Roll,pitch and yaw (resp around Xsc,Ysc,Zsc)



page 164 of 203

APPENDIX B: TIME REFERENCES Absolute Reference Time (ART): The international atomic time (TAI) shall be used as absolute reference time. Alternatively, a better suited epoch can be defined by the Contractor (for example, by choosing a GPS week number)



page 165 of 203

APPENDIX C: POINTING METRICS The pointing metrics and the budget are in accordance with <RD12> and hereafter reported as a summary.

C.1 Attitude pointing error The Attitude Pointing Error (APE) is the separation between the actual and the commanded pointing vectors.

C.2 Relative pointing error The Relative Pointing Error (RPE) is the separation between the actual pointing vector and the median pointing vector over a time interval ∆T.

C.3 Absolute measurement error The Absolute Measurement Error (AME) is the separation between the actual and the measured pointing vector. Others pointing metrics will be considered if needed, in accordance with the ESA Pointing Handbook.

C.4 Budgets summation rule The budget summation rules will be in accordance with the guideline described:

C.5 APE summation rule All error affecting the APE will be grouped according to the following table. And the contribution to the APE budget will be according to the summation rule defined inside each group.



page 166 of 203

Error Grouping Brief description Summation methodology

Group N - Total Noise Errors

Errors that vary relatively quickly and can be associated with a Gaussian distribution with zero mean and given variance. Whenever the mean value is non-zero it will contribute to the bias terms.

This contributor is the quadratic sum of the noise standard deviations, where Ni is the standard deviation (RMS) or sigma value of the single random error component.

∑= 2iN Nσ

Group S - Total Short Term Errors

This takes into account of transitory effects.

Shall be summed quadratically, Si is the maximum possible short term error.

∑= 2SiSσ

Group H - Total Harmonic Errors

Harmonic errors are sinusoidal in time. Eventually they can be split in frequency groups

Harmonic errors shall be first summed linearly when having the same period, unless non-zero phasing can be demonstrated. Afterwards they shall be summed quadratically.

Arms,i is the RMS value of the sinusoidal error, that means the amplitude over sqrt(2). Api is the sum of sinusoidal error with period P.

When the amplitude of the periodic error is a random variable its RMS value should be assigned as Arms,i.

∑= iRMSP AA ,

∑= 2PiH Aσ

Group B - Total Bias Error

long term or independent of time

Bias and drift errors shall be summed up quadratically.

Where Bi is the RMS value of the possible bias error.

∑= )( 2BiBσ

Total Error as summation of the listed groups is

)( 222NHBSAPE σσσσσ +++=

This sum approximate the pointing error associated to a probability of 67.5%, since RMS values are considered in within each class. Whenever the specification is given differently, respectively 2-σ or 3-σ, this requirement has to be transferred into each class and for all classes the stochastic component 2-σ or 3-σ will be used instead of 1-σ. The summation rule will represent a good1 estimate of the pointing associated to the specified probability if:

• It is possible to perform a good characterisation of each component. • There is a good balance over different classes of error, i.e. a wrong estimation of the

probability can be obtained if there are few systematic components dominating the sum. In order to have a clear budget is needed to: 1 It is reminded that the summation rule is an approximation of the computation done via PDF, as it is, it will work for most of the common cases giving a reasonable estimation of the error, but for unusual situation or if better accuracy is required may be necessary to go into more mathematical details see <RD12>



page 167 of 203

• Perform a detailed analysis of each single contributor; to justify its value (for example in

case of calibration) and to attribute it to the right class or error. • Specify clearly level of confidence associated to the requirement (1σ, 2σ or 3σ) and show

that this has been considered adequately for each component.

C.6 RPE summation rule The RPE summation rule will be the same as the APE with the exception that low frequency errors are not counted in the sum. In particular are not summed in the budget bias terms, Group B, and part of the Periodic component, group P, which frequency is lower than

RPET∆≤

101ν

Total RPE budget is then computed as summation of the groups

)( 22* NHSRPE σσσσ ++= .

Where factor 2 or 3 on the RMS values are considered according to the specification.

C.7 AME summation rule The AME summation rule will be the same as the AME, the same error groups will apply, but only measurement errors will be taken into account.



page 168 of 203

APPENDIX D: GENERAL ERROR DEFINITION AND ERROR COMPILATION METHOD

D.1 Scope This method is applicable for the behaviour of specified parameters, such as instrument performance parameters, which are not verified by direct measurement but by a combination of test results, simulations and analyses. Contributing parameters to these specified values shall be governed by this Appendix.

D.2 Error Characterisation For General Error Sources Error components ie shall be classified according to their time dependence as follows:

D.2.1 BIAS ERRORS

ii be = where:

ie is a residual fixed offset error which is stable throughout the mission by definition. Biases shall be assumed to have an uniform distribution such that ii Bb <

D.2.2 DRIFT ERRORS ( )tde ii =

where:

ie is a variation due to aging effects, which appears as a slow variation with time, but has no periodic character, with the possibility also of discrete steps.

NOTE: For pointing budgets drift contributions shall be taken with their worst value and treated as biases.

D.2.3 HARMONIC ERRORS

( )⎟⎟⎠

⎞⎜⎜⎝

⎛+

⋅⋅⋅= t

Tthe i

iii ξπ2sin

where:



page 169 of 203

the period of oscillation iT is normally of the order of the orbital or half orbital period ( iT may however be much smaller or much longer in some cases).

The error has a mean of zero in that it does not contribute to bias error. The amplitude ( )thi and phase ( )tiξ may be drifting. NOTE: For pointing budgets the worst ( )thi value, iH shall be taken.

D.2.4 RANDOM ERRORS ( )tre ii =

where:

ie varies in an unpredictable manner, relatively quickly in relation to an orbital period, in which there is no correlation between successive realisations.

These errors shall be assumed as having a Gaussian distribution with standard deviation iσ

D.3 Compilation Of Error Sources

D.3.1 BIAS AND DRIFT ERRORS Biases and drifts shall be summed quadratically:

∑=j

ji Bb 2

34

However, if ib is greater than ∑ jB , then ∑= ji Bb

D.3.2 HARMONIC ERRORS Harmonic errors shall be first summed linearly when having the same period, unless non-zero phasing can be demonstrated.

∑= pj Hh Afterwards they shall be summed quadratically:

∑⋅= 22 ji hh However, if ih is greater than ∑ jh , then ∑= ji hh



page 170 of 203

D.3.3 RANDOM ERRORS

Random errors shall be summed quadratically:

∑⋅=1

214 σir

D.3.4 TOTAL ERRORS Total errors are either specified separately for biases, the combination harmonic and random, and for the overall combination of all categories. Biases Total ib

Harmonic and Random Total 22ii rh +

Overall Total 222iii rhb ++

D.3.5 CALIBRATION Calibration can be used to reduce the effect of bias, drift and harmonic errors. The value of the concerned error then has to be replaced by the calibration error and the inter-calibration interval residual error which must both be identified with their appropriate error classification. If calibration is not performed frequently enough and with sufficiently accurate references, aliasing and calibration errors will adversely affect the overall accuracy. Note: Aliasing errors are introduced when harmonic errors at the time of calibration cannot be differentiated from bias and drift errors.



page 171 of 203

APPENDIX E: APPLICABILITY OF ECSS STANDARDS For the ECSS standards referenced in the following sections, the indicated requirements apply to the current System Requirements Document.

E.1 ECSS-E-10-02A Verification (17 November 1998) See <SD1> Chapter Section Paragraph Subject 1 Scope 1.1 General 1.2 Relationship with other standards 3.1 Definitions 3.2 Abbreviations 4.1 Verification objectives 4.2 Verification process logic 4.3 Verification methods 4.4 Verification levels 4.5.1 Qualification 4.5.2 Acceptance 4.5.3 Pre-launch 4.5.4 In-orbit 5.1 Requirements classification 5.2 Selection of methods, levels and stages of

verification 5.3 Selection of models 5.4 Verification by test 5.5 Verification by analysis 5.6 Verification by Review-of-design 5.7 Verification by inspection 6.1 Verification responsibilities 6.2 Verification planning 6.3 Verification tools 6.4 Verification execution and control 6.5 Verification documentation Annex A (normative) Verification documents C.1 Introduction C.2 Scope and applicability C.3 References C.4 Definitions, abbreviations and symbols C.5 Description and purpose



page 172 of 203

Chapter Section Paragraph Subject C.6 Application and interrelationship C.7 Verification matrix preliminary elements C.8 Content D.1 Introduction D.2 Scope and applicability D.3 References D.4 Definitions, abbreviations and symbols D.5 Description and purpose D.6 Application and interrelationship D.7 AIV plan preliminar y elements D.8 Content E.1 Introduction E.2 Scope and applicability E.3 References E.4 Definitions, abbreviations and symbols E.5 Description and purpose E.6 Application and Interrelationship E.7 VCD preliminar y elements E.8 Content F.1 Introduction F.2 Scope and applicability F.3 References F.4 Definitions, abbreviations and symbols F.5 Description and purpose F.6 Application and interrelationship F.7 Test specification preliminar y elements F.8 Content G.1 Introduction G.2 Scope and applicability G.3 References G.4 Definitions, abbreviations and symbols G.5 Description and purpose G.6 Application and interrelationship G.7 Test procedure preliminar y elements G.8 Content H.1 Introduction H.2 Scope and applicability H.3 References H.4 Definitions, abbreviations and symbols H.5 Description and purpose H.6 Application and interrelationship H.7 Test report preliminar y elements H.8 Content



page 173 of 203

Chapter Section Paragraph Subject I.1 Introduction I.2 Scope and applicability I.3 References I.4 Definitions, abbreviations and symbols I.5 Description and purpose I.6 Application and interrelationship I.7 Analysis report preliminar y elements I.8 Content J.1 Introduction J.2 Scope and applicability J.3 References J.4 Definitions, abbreviations and symbols J.5 Description and purpose J.6 Application and interrelationship J.7 ROD report preliminar y elements J.8 Content K.1 Introduction K.2 Scope and applicability K.3 References K.4 Definitions, abbreviations and symbols K.5 Description and purpose K.6 Application and interrelationship K.7 Inspection report preliminar y elements K.8 Content L.1 Introduction L.2 Scope and applicability L.3 References L.4 Definitions, abbreviations and symbols L.5 Description and purpose L.6 Application and interrelationship L.7 Verification report preliminar y elements L.8 Content

E.2 ECSS-E-10-03A Testing (15 February 2002) See <SD2> Chapter Section Paragraph Subject 1 Scope 1.1 General 1.2 Tailoring 3.1 Terms and definitions



page 174 of 203

Chapter Section Paragraph Subject 3.2 Abbreviated terms 4.1 Testing philosophy 4.2.1 4.2.1 4.3 Development testing 4.4 Qualification testing 4.5 Acceptance testing 4.6 Protoflight testing 4.7 Retesting 4.8 Test conditions and tolerances 4.9 Operations validation testing 4.10 Test data 4.11 Test documentation 5.1.1 Introduction 5.1.2 Equipment classification 5.1.3 Rules for test programme 5.1.4 Phisicalproperties measurements, equipment qualification 5.1.5 Functional and performance test, equipment qualification 5.1.6 Humidity test, equipment qualification 5.1.7 Leakage test, equipment qualification 5.1.8 Pressure test, equipment qualification 5.1.9 Constant acceleration test, equipment qualification 5.1.10 Sinusoidal vibration test, equipment qualification 5.1.11 Random vibration test, equipment qualification 5.1.12 Acoustic test, equipment qualification 5.1.13 Shock test, equipment qualification 5.1.14 Corona arcing detection, equipment qualification 5.1.15 Thermal vacuum test, equipment qualification 5.1.16 Thermal cycling test, equipment qualification 5.1.17 EMC and ESD test, equipment qualification 5.1.18 Life test, equipment qualification 5.1.19 Microgravity compatibility test description 5.2 Subsystem test requirements 5.3.1 General 5.3.2 Space vehicle test requirements 5.3.3 Structural qualification tests 5.3.4 Structural integrity 5.3.5 Thermal qualification tests 5.3.7 Electromagnetic qualification tests 5.3.8 Functional qualification tests 5.3.10 Mission specific tests 5.4 System qualification test 6.1 Equipment test requirements 6.2 Subsystem test requirements



page 175 of 203

Chapter Section Paragraph Subject 6.3.1 General 6.3.2 Subsystem test requirements 6.3.3 Element test requirements 6.3.4 Structural integrity 6.3.5 Thermal acceptance tests 6.3.6 Electromagnetic acceptance tests 6.3.7 Functional acceptance tests 6.4 System test requirements 7.1 Equipment test requirements 7.2 Subsystem test requirements 7.3.1 Space vehicle tests 7.4 System test requirements 8.1 General 8.2 Functional tests 8.3 Propulsion tests 8.4 Integrated launch system test 9 In-orbit testing B.3 Influence of equipment temperature limits on thermal design B.4 Verification by analysis concerning accuracy and level of

confidence B.6 Standardisation of thermal vacuum and cycling test

conditions C.1 Introduction C.2 Scope and applicability C.3 References C.4 Definitions, abbreviations and symbols C.5 Description and purpose C.6 Application and interrelationship C.7 Test requirement specification preliminar y elements C.8 Content

E.3 ECSS-E-20A Electrical and Electronic (4 October 1999) See <SD5> Chapter Section Paragraph Subject 1 Scope 3.1 Terms and defintions 3.2 Abbreviated terms 4.1.1 Signal Interfaces 4.1.2 Commands 4.1.3 telementry



page 176 of 203

Chapter Section Paragraph Subject 4.2.1 Failure contaiment and redundancy 4.2.3 Electrical connectors 4.2.4 Testing 5.2 Power requirements and budgets 5.3 Failure containment and redundancy 5.4.1 Solar cell requirements 5.4.2 Solar array 5.4.3 Solar array power 5.5.1 Battery requirements 5.5.2 Battery charge and discharge management 5.5.3 Battery cell requirements 5.5.4 Battery use and storage 5.5.5 Battery safety requirements 5.6.1 Spacecraft bus 5.6.2 Bus under/overvoltage 5.6.3 Power regulators/converters 5.6.4 Payload interaction 5.7.1 General 5.7.2 Harness 5.8 Safety 5.10 Verification 6.1 Policy 6.1.1 System level EMC Programme 6.1.2 EMC Control Plan 6.1.3 Electromagnetic Interference Safety Margin (EISM) 6.2.1 Electromagnetic Interference (EMI) control 6.2.2 Antenna-to-antenna (RF) compatibility 6.2.3 Electrical Bonding 6.2.4 Grounding and wiring design 6.3.1 General 6.3.2 Performance 6.3.3 Design 6.4.1 General 6.4.2 Intra-system electromagnetic compatibility 6.4.3 Safety demonstration for critical or EED circuit 6.4.4 Electromagnetic Interference (EMI) control 6.4.5 External electromagnetic environment 6.4.6 Antenna-to-antenna (RF) compatibility 6.4.7 Electrical Bonding 6.4.8 Antenna counterpoise 6.4.9 RF potentials 6.4.10 Static discharge 6.4.11 Spacecraft charging



page 177 of 203

Chapter Section Paragraph Subject 7.1 Functional description 7.2 General 7.3 Antenna 7.4 Multipaction and Gas discharge 7.5 Passive intermodulation 7.6 Safety 7.7 Verification Annex A Annex B Annex C

E.4 ECSS-E-20-01A Multipaction design and test (5 May 2003) See <SD6> Chapter Subject 3 Terms, definition and abbreviated terms 4 Verification 5 Design analyses 6 Test conditions 7 Methods of detection 8 Test procedures Annex C Cleaning, handlind, storage and contamination Annex D Electron seeding

E.5 ECSS-E-20-08A Photovoltaic assemblies and components (30 November 2004)

All Chapters of <SD7> are applicable, with the exceptions / comments of the table below:

Chapt./sect. SubSect. Subject Comment 6.4.3.9 Humidity and temperature (HT) Title

6.4.3.9.1 Purpose Only applicable in the case of conductive coverglass


6.4.3.10 Coating adherence (CA) Title


6.4.3.10.2 Process Only applicable in the case of



page 178 of 203

conductive coverglass

6.4.3.14 Surface conductivity (SC) Title


6.4.3.14.2 Process Only applicable in the case of conductive coverglass

6.4.3.14.3 Pass-fail criteria Only applicable in the case of conductive coverglass

Annex H

all sections

Single junction solar cell capacitance measurement

In the current version, annexe H is applicable only in the case of single junction cells; a separate requirement needs to be defined in case of use of triple-junction cells

Qualification test plan for SCA: Title Group C Applicable, with 20 SCAs

Table 4 Group D

Only applicable in the case of conductive coverglass

Qualification test plan for bare solar cells: Title

Group B Applicable, replaceable by Group B of Table 4

Group C1 Not Applicable

Table 7 Group C2

Applicable, replaceable by Group C of Table 4

E.6 ECSS-E-30 Part 1A Mechanical - Part 1 Thermal Control (25 April 2000)l

See <SD8> Chapter Section Paragraph Subject 1 Scope 3.1 Terms and defintions 3.2 Definition for unit internal design 3.3 Abbreviated terms 4.1.1 General 4.1.2 Ground and prelaunch 4.1.3 Launch and ascent 4.1.4 Planetary orbital phases 4.2.1 General 4.2.2 Temperatures 4.2.3 Functionality 4.2.4 Additional and other performance requirements



page 179 of 203

Chapter Section Paragraph Subject 4.3.1 General 4.3.2 Mechanical interface 4.3.3 Electrical interface 4.3.4 AOCS interface 4.3.5 TM/TC interface 4.3.6 OBDH and S/W interface 4.3.7 Launcher interface 4.3.8 GSE interface 4.4.1 General 4.4.2 Budgets 4.4.3 PMP 4.4.4 EEE components 4.4.5 Lifetime 4.4.6 Predictability and testability 4.4.7 Flexibility 4.4.8 Accessibility 4.4.11 Interchangeability 4.4.13 Cleanliness 4.5.1 General 4.5.2 Review of design 4.5.3 Verifcation by similatity 4.5.4 Verification by inspection 4.5.5 Verification by analysis 4.5.6 Verification by test 4.5.7 Thermal Balance test 4.6.1 General 4.6.2 Manufacturing process 4.6.3 Manufacturing drawings 4.6.4 Quality management 4.6.5 Cleanliness 4.6.6 Procurement 4.6.7 Tooling 4.6.8 Integration 4.6.9 Marking 4.6.10 Packaging,handling , transportation 4.6.11 Storage 4.6.12 Repair Annex A Annex B Annex C



page 180 of 203

E.7 ECSS-E-30 Part 2A Mechanical - Part 2 Structural (25

April 2000) See <SD9> Chapter Section Paragraph Subject 1 Scope 3.1 Terms and definitions 3.2 Abbreviated terms 3.3 Units 4.1 General 4.3 Functionality 4.4 Constraints 4.5 Interface 4.6 Design 4.8 Production and manufacturing 4.1 Data exchange 4.12.1 General 4.12.2 Documents Annex A (normative) Document description list Annex B (informative) Effective mass definition Annex C (informative) Typical acronyms for loads and factors of

safety D.1 Development assumptions

E.8 ECSS-E-30 Part 3A Mechanical - Part 3 Mechanisms (25 April 2000)

See <SD10>.

Chapter Section Paragraph SubPara. Subject and Comment 1 Scope 2 Normative references 3.1 Terms and definitions 3.2 Symbols and abbreviated terms 4.2.2.1 Marking and labelling 4.2.2.2 Specific identification 4.2.2.3 Parts and components 4.2.2.4 Marking of bearings 4.2.2.5 Interchangeability 4.2.2.6 Maintainability 4.2.3.2 Reliability 4.2.3.3 Structural reliability



page 181 of 203

4.2.3.4 Redundancy 4.2.4 Flushing and purging 4.3.2 Mission 4.3.3 Environment 4.4.2 System performance 4.4.3 Mechanism function 4.5.2.1 Climatic protection and specific environment

constraints 4.5.2.2 Sterilisation 4.5.3.1 Mechanical and physical properties of materials

covered by ECSS E30 Part 8 4.5.3.2 Material selection (cf ECSS Q 70-71 and 70-04) 4.5.3.3 Corrosion, 4.5.3.4 Dissimilar metals 4.5.3.5 Stress corrosion cracking

covered by ECSS Q 70-36 and 70-37 4.5.3.6 Material allowables (A) 4.5.3.7 Fungus protection (A) 4.5.3.8 Flammable, toxic and unstable materials (A) 4.5.3.9 Induces emissions (stray-light protection) (A) 4.5.3.10 Radiation (A) 4.5.3.11 Atomic oxygen (A) 4.5.4 Operational constraints (A) 4.6.2 Structural surfaces (A) 4.6.3 Thermal Interfaces (A) 4.6.4 Thermo-mechanical interfaces (A) 4.6.5 Data interfaces (A) 4.6.6 Data interfaces (A) 4.6.7 Physical interfaces (A) 4.6.8 Other interfaces (A) 4.7.2.1 General tribolgy requirements (A) 4.7.2.2 Dry lubrication (A) 4.7.2.3 Fluid lubrication (A) 4.7.2.4.1 Material for tribological surfaces (A) 4.7.2.4.2 Bearing pre-loading (A) 4.7.2.4.3 Mechanical cables (A) 4.7.3.2 Thermal engineering

covered by ECSS E30 Part 1 4.7.3.3 Mechanisms thermal design and sizing

requirements 4.7.3.4 Multi-layer insulation (MLI) requirements 4.7.4.1 General 4.7.4.2.1 Structural engineering requirements

covered by ECSS-E-30 Part 2 4.7.4.2.2 General 4.7.4.2.3 Loads



page 182 of 203

4.7.4.2.4 Limit loads 4.7.4.2.5 Design loads, covered by ECSS-E-30 Part 2 4.7.4.2.6 Material allowables 4.7.4.2.7 Margin of safety (MOS) 4.7.4.2.8 Factor of safety (FOS) 4.7.4.3.1 General 4.7.4.3.2 Quasi-static torque applicability 4.7.4.3.3 Dynamic torque applicability 4.7.4.3.4 Motorisation factor - "quasi-static" torque (or

force) ratio 4.7.4.3.5 Motorisation factor - dynamic torque (or force)

ratio 4.7.4.3.6 Actuation torque (or force( dimensioning 4.7.4.4.1 Replaceable elements 4.7.4.4.2 Status monitoring 4.7.4.4.3 Latching or locking 4.7.4.4.4 End stops 4.7.4.4.5 Separable contact surfaces (not applicable to

…) 4.7.4.4.6 Ball bearings - sizing for static loads (cf ISO76) 4.7.4.4.7 Gears (cf ISO 6336) 4.7.4.4.8 Mechanical clearances 4.7.4.4.9 MLI clearance 4.7.4.4.10 Threaded parts or locating devices 4.7.4.4.11 Venting 4.7.4.4.12 Release and locking device with pyrotechnics or

other actuators 4.7.5 Pyrotechnics, covered by ECSS E 30 Part 6 4.7.6.1 General (cf ECSS E 20) 4.7.6.2 Electrical design 4.7.6.3 Insulation 4.7.6.4 Dielectric 4.7.6.5 Grounding 4.7.6.6 Electrical connectors 4.7.6.7 Over current protection 4.7.6.8 Strain on wires 4.7.6.9 Magnetic cleanliness and ESD or EMC

protection 4.7.7.2 4.7.7.3 4.7.7.4 4.7.7.5 4.7.7.6 4.7.7.7 4.7.7.8



page 183 of 203

4.7.7.9 4.7.7.10 4.7.7.11 4.7.7.12 4.7.7.13 4.8.1 General 4.8.2.1 General 4.8.2.2 Worst cases identification 4.8.2.3 Thermal analysis, covered by ECSS E 30 Part 1 4.8.2.4 Structural analysis 4.8.2.5 Functional performance analysis 4.8.2.6 Pre-load and tolerance budget analysis 4.8.2.7 Hertzian contact and contact stress 4.8.2.8 Torque or force ratio analysis 4.8.2.9 Reliability analysis, FMECA

covered by ECSS Q 30 4.8.2.10 Gear analysis, covered by ISO 6336 4.8.2.11 Shock generation and susceptibility 4.8.2.12 Disturbance generation (emission) and

susceptibility 4.8.2.13 Analysis of control systems 4.8.2.14 Lubrication analysis 4.8.2.15 Lifetime analysis 4.8.2.16 Magnetic and electromagnetic 4.8.2.17 Radiation analysis 4.8.2.18 Electrical analysis, covered by ECSS Q 30 06 4.8.3.1 General 4.8.3.2.1 Model requirements 4.8.3.2.2 test 4.8.3.3.1 General 4.8.3.3.2 Structural qualification testing

covered by ECSS E 30 Part1 4.8.3.3.3 Thermal vacuum qualification testing 4.8.3.3.4 Functional qualification testing 4.8.3.3.5 Energy or shock 4.8.3.3.6 Solid lubricated ball bearing verification 4.8.3.3.7 Liquid lubricated ball bearing lubrication 4.8.3.3.8 Lifetime calculation 4.8.3.3.9 Life test model requirements 4.8.3.3.10 Life test profile 4.8.3.3.11 Life test duration 4.8.3.3.12 Lifetime testing success criteria 4.8.3.3.13 Accelerated lifetime testing 4.8.3.3.14 Post-test inspection 4.8.3.3.15 EMC or ESD qualification testing



page 184 of 203

4.8.3.3.16 Electrical qualification testing 4.8.3.3.17 Control system qualification testing 4.8.3.4.1 Mechanical micro-setting and thermal

stabilisation 4.8.3.4.2 Acceptance tests 4.8.3.4.3 Dielectric test 4.9.1 Manufacturing process 4.9.2 Manufacturing drawings, covered by ISO 128 4.9.3 Marking and labelling 4.9.4 Assembly 4.10 In-service 4.11 Deliverables 4.12 Use of this standard to define project

requirements

E.9 ECSS-E-30 Part 5.1A: Mechanical - Part 5.1: Liquid and electric propulsion for Spacecraft (2 April 2002)

See <SD11> Chapter Section Paragraph Subject 1.1 Object 1.2 Applicability 1.3 Tailoring 2 Normative references 3.1 Terms and defintions 3.2 Definition of Masses 3.3 Abbreviated terms 3.4 Symbols 4.1.1 Characteristics of Propulsion Systems 4.1.2 Structure of Requirements 4.2.1 Introduction 4.2.2 General 4.2.3 Standards 4.2.4 Quality System 4.2.5 Design 4.2.6 Materials 4.2.7 Maximum expected operating pressure (MEOP) 4.2.8 Documentation 5.1 General 5.2.1 Mission 5.2.2 Functions 5.3.1 Accelerations



page 185 of 203

Chapter Section Paragraph Subject 5.3.2 Pressure vessels and pressurised components 5.3.3 Induced and environmental temperatures 5.3.4 Thruster surroundings 5.3.5 Thruster arrangement 5.4 Interfaces 5.5.1 General 5.5.2 Selection 5.5.3 Sizing 5.5.4 Development 5.5.5 External Contamination 5.5.6 Internal Contamination 5.5.7 Explosion Risk 5.5.8 Component Guidelines 5.5.9 Mass Imbalance 5.5.10 Ground Support Equipment (GSE) 5.5.11 Filters 5.5.12 Draining 5.5.13 Blow-Down ratio 5.5.14 Pyrotechnic devices 5.5.15 Pressure vessels 5.5.16 Propellant Tanks 5.5.17 Thrusters 5.5.18 Thrust-vector control (TVC) 5.5.19 Monitoring 5.6.1 General 5.6.2 Verification by analysis 5.6.3 Verification by test 5.6.4 Data exchange for models 5.7.1 Reliability 5.7.2 Production and manufacturing process 5.8.1 General 5.8.2 Operations on ground 5.8.3 Tank operation 5.8.4 Disposal 5.9 Support A.1 Rational A.2.1 Storable propellants A.2.3 Liquid A.3 Pressurants A.4 Simulants A.5 Cleaning agents



page 186 of 203

E.10 ECSS-E-30 Part 6A Mechanical - Part 6 Pyrotechnics (25

April 2000) See <SD12> Chapter Section Paragraph Subject and Comment 1 Scope 2 Normative references 3.1 Terms and definitions 4.1.3 Stability of properties 4.1.4 Subsystem performance 4.1.5 response time 4.2 Mission 4.3 Functionality 4.4.1 Survival and operation conditions 4.4.2.1 General 4.4.2.2 Tolerances 4.4.2.3 Lifetime 4.4.2.4 Disturbance 4.4.2.5 Contamination, debris, particles 4.4.2.6 Fire resistance 4.4.2.7 Materials compatibility 4.4.2.8 After functioning 4.4.3.1 Mass 4.4.3.2 Dimensions 4.4.3.3 Strength 4.4.3.4 Reaction 4.4.3.5 Dynamic environment 4.4.4.1 Circuit independence 4.4.4.2 Energy source for firing 4.4.4.3 Power system overload 4.4.4.4 Electromagnetic compatibility (EMC),

covered by MIL-STD-1576 and ECSS E 20 4.5.1 Functional 4.5.2 Internal 4.5.3 External 4.6.1 Prevention of unintentional function 4.6.2 Protection 4.6.3 Monitoring 4.6.4 Avoidance of single-point failures 4.6.5.1 Integrity 4.6.5.2 Main fixings 4.6.5.3 Modularity of elements and components 4.6.5.4 Interchangeability 4.6.5.5 Accessibility



page 187 of 203

4.6.5.6 Inert models 4.6.6.1 Firing sequence: simultaneous or sequential 4.6.6.2 Firing pulse 4.6.6.3 Electrostatic discharge 4.6.6.4 Voltage drop 4.6.6.5 Grounding 4.6.6.6 Isolation 4.6.6.7 Insulation resistance 4.6.6.8 Dielectric strength 4.6.6.9 Sensitivity to RF energy 4.6.6.10 Electromagnetic compatibility (EMC), covered by ECSS E

20 4.6.6.11 Magnetic cleanliness 4.6.6.12 Continuity current 4.6.6.13 Lightning 4.6.7 Thermal design 4.6.8.1 Connectors 4.6.8.2 Permanent connection, covered by ECSS E 20 4.6.8.3 Wiring 4.6.8.4 Shielding 4.6.8.5 Power conditioning 4.6.8.6 Pre-arm function 4.6.8.7 Arm function 4.6.8.8 Fire function 4.6.8.9 Safe and arm connector 4.6.8.10 Safe plug 4.6.8.11 Arming plug 4.6.8.12 Test plug 4.6.8.13 EED harness connector 4.6.8.14 EED test substitute 4.6.8.15 Pyrotechnics components 4.6.8.16 Interface elements 4.6.8.17 Software 4.6.8.18 Tools 4.6.8.19 Mechanical ground support equipment 4.6.8.20 Electrical ground support equipment 4.6.8.21 Launch site 4.7.1 General 4.7.2 Methods 4.7.3 Essential confirmation 4.7.4 Routing tests 4.7.5 End-to-end tests 4.7.6 Operators 4.7.7 Subsystem testing 4.8.1 Elements



page 188 of 203

4.8.2 Transport and handling 4.8.3 Facilities 4.8.4 Electrostatic charge 4.8.5 Pyrotechnics installation, test and replacement 4.8.6 Special-purpose aids 4.8.7 Pyrotechnics hardware tracking 4.9.1 Launch facilities 4.9.2 Information feedback 4.9.3 Launch site procedures 4.9.4 Commands 4.9.5 Monitoring 4.9.6 Recovery 4.9.7 Disposal of flight equipment 4.9.8 Final activities 4.10.1.1 Application and use 4.10.1.2 Precautions 4.10.1.3 Facilities 4.10.1.4 Media 4.10.1.5 Facility monitoring 4.10.1.6 Status monitoring 4.10.2.1 Safety data package 4.10.2.2 Review documentation 4.10.2.3 Flight readiness 4.11.1 General 4.11.2 Design and verification

covered by ECSS Q 20 and ECSS E 10 4.11.3 Dependability 4.11.4 Safety 4.11.5.1 General, covered by ECSS Q 20 4.11.5.2 Equipment and components 4.11.5.3 Lot definition 4.11.5.4 Identification and marking 4.11.5.5 Workmanship, covered by ECSS Q 20 4.11.5.6 Responsibility for inspection and test, (A) 4.11.5.7 Logbook, covered by ECSS Q 70 4.11.6.1 Overall 4.11.6.2 Fired pyrotechnics hardware 4.11.7.1 General 4.11.7.2 Element qualification 4.11.7.3 Interface qualification 4.11.7.4 Subsystem qualification 4.11.7.5 Life 4.11.7.6 Post qualification activities 4.11.8.1 General 4.11.8.2 Element acceptance



page 189 of 203

4.11.8.3 Interface acceptance 4.11.8.4 Subsystem acceptance 4.11.8.5 Subsystem acceptance testing 4.11.9 Post acceptance activities 4.11.10 Control of pyrotechnics hardware 4.12.1 General 4.12.2 Documentation

E.11 ECSS-E-30 Part 7A Mechanical - Part 7 Mechanical parts (25 April 2000)

See <SD13> Chapter Section Paragraph Subject 1 Scope 3.1 Terms and definitions 3.2 Abbreviated terms 4.1 General 4.2 Mission 4.3 Functionality 4.4 Constraints 4.5 Interface 4.6 Design 4.8 Production and manufacturing 4.9 In-service 4.11 Deliverables Annex A Example of a testing matrix (informative)

E.12 ECSS-E-30 Part 8A Mechanical - Part 8 Materials (25 April 2000)

See <SD14> Chapter Section Paragraph Subject 1 Scope 3.1 Terms and defintions 3.2 Abbreviated terms 4.1.2 Applicability 4.1.3 Controlling documentation 4.3.1 Strength 4.3.2 Elastic Modulus



page 190 of 203

4.3.3 Fatigue 4.3.4 Fracture Toughness 4.3.5 Creep 4.3.6 Micro-yielding 4.3.7 Coefficient of thermal expansion and coefficient of

moisture expansion 4.3.8 Stress corrosion 4.3.9 Corrosion fatigue 4.3.10 Hydrogen embrittlement 4.3.11 Mechanical contact surface effects 4.4.1 General 4.4.2 Temperature 4.4.3 Thermal cycling 4.4.4 Vacuum (outgassing) 4.4.10 Radiation 4.4.11 Electrical charge and discharge 4.4.12 Lightning strike 4.4.13 Chemical (corrosion) 4.4.14 Fluid compatibility 4.4.15 Galvanic compatibility 4.4.16 Atomic oxygen 4.4.17 Micrometeoroids and debris 4.4.18 Moisture absorption and desorption 4.5.1 General 4.5.2 Passivation layers 4.5.3 Anodizing 4.5.4 Chemical conversion 4.5.5 Metallic coatings (overlay and diffusion) 4.5.6 Hard coatings 4.5.7 High temperature oxidation protective coatings 4.5.8 Thermal barriers 4.5.9 Moisture barriers 4.5.10 Diffusion barriers 4.5.11 Coatings on CFRP 4.6.2.1 General 4.6.2.2 Bolted joints 4.6.2.3 Riveted joints 4.6.2.4 Inserts 4.6.3 Adhesive bonding 4.6.4.1 General 4.6.4.2 Soldering 4.6.4.3 Brazing 4.6.4.4 Welding 4.7.1 General 4.7.2 Material design allowables



page 191 of 203

4.7.3 Metal design allowables 4.7.4 Composite design allowables 4.7.5 Composite sandwich constructions 4.7.6 Aluminium 4.7.7.1 High strength steel 4.7.7.2 Corrosion resistant steel 4.7.7.3 Precipitation hardening steel 4.7.8 Titanium 4.7.9 Magnesium alloys 4.7.10 Beryllium and beryllium alloys 4.7.11 Mercury 4.7.12 Refractory alloys 4.7.13 Superalloys 4.7.14 Other metals 4.7.15 Castings 4.7.16 Forgings 4.7.17 Glass and ceramics 4.7.18 Ceramic Matrix Composites - CMC (including carbon-

carbon) 4.7.19 Polymers (thermosets and thermoplastics) 4.7.20 Rubbers (excluding adhesive rubbers) 4.7.21 Lubricants 4.7.22 Thermal control insulants (including ablative materials) 4.7.23 Optical materials 4.8.1 General 4.8.2 Metallic materials 4.8.3 Composite materials - laminates 4.8.4 Mechanical and physical test methods 4.8.5 Test methods on metals 4.8.6 Test methods on composites 4.8.7 Non-destructive inspection (NDI) 4.8.8 Proof testing 4.9.1 General 4.9.2 Procurement 4.9.3 Manufacturer 4.9.4 Supplier 4.10.2 Maintenance 4.10.3 Inspection 4.10.4 Repair 4.11 Data exchange 4.12 Product assurance 4.13 Deliverables



page 192 of 203

E.13 ECSS-E-30-11A Modal survey assessment (20 September

2005) See <SD16> Chapter Section Subject 1 Scope 3.1 Terms and definitions 3.2 Abbreviated terms 3.3 Notations 4.1 Modal survey test objectives 4.2 Modal survey test general requirements 5.1 General 5.2 Test planning 5.3 Test set-up 5.4 Test performance 5.5 Modal identification methods 5.6 Modal parameter estimation methods 5.7 Test data 5.8 Test-analysis correlation 6.1 Purpose 6.2 Modal survey test FEM 6.3 Test analysis model (TAM) 6.4 Documentation Annex A (normative) DRD list B.1 General B.2 Purpose and classification B.3 Excitation methods

E.14 ECSS-E-40 Part 1B Software – Part 1: Principles and requirements (28 November 2003)

See <SD17> Chap. Sect. Subject Comments 3 Terms, definition and abbreviated terms 4 Space system software engineering 5 Requirements 5.1 Introduction 5.2 System engineering processes related to

software normative, except for 5.2.2.3 and 5.2.2.4

5.3 Software management process normative 5.4 Software requirements and architecture normative, except for 5.4.2.6



page 193 of 203

Chap. Sect. Subject Comments

engineering process 5.5 Software design and implementation

engineering process normative

5.6 Software validation process normative 5.7 Software delivery and acceptance process normative 5.8 Software verification process normative 5.9 Software operation process normative 5.10 Software maintenance process normative Annex A Software documentation normative

E.15 ECSS-E-40 Part 2B Software – Part 2: Document requirements definitions (31 March 2005)

See <SD18> Chapter Section Subject Comment 3 Terms, definitions and abbreviated terms 3.1 Terms and definitions 3.2 Abbreviated terms 4 Document requirements definitions

(DRD) list Simplification/combination to be proposed by the Contractor for Agency's approval

Annex A Software system specification (SSS) DRD Normative Annex B Software requirements specification

(SRS) DRD Normative

Annex C Software design document (SDD) DRD Normative Annex D Software release document (SRelD) DRD Normative Annex E Software [unit/integration] test plan

(SUITP) DRD Normative

Annex F Software validation testing specification (SVTS) DRD

Normative

Annex G Software verification plan (SVerP) DRD Normative Annex H Software validation plan (SValP) DRD Normative Annex I Software reuse file (SRF) DRD Normative Annex J Software development plan (SDP) DRD Normative Annex K Software product assurance plan (SPAP)

DRD Normative



page 194 of 203

E.16 ECSS-E-50-02A Ranging and Doppler tracking (24

November 2005) See <SD21> Chapter Paragraph Subject Comment 3.1 Terms and definitions 4.1 Functional 4.2 Frequency assignment, modulation and spectral

sharing

4.3 Carrier frequency stability 4.4 Earth station 4.5 Spacecraft transponder 4.6 Performance Annex B Transponder ranging technological loss (informative)

E.17 ECSS-E-50-05A Radio frequency and modulation (24 January 2003)

See <SD24> Chapter Section Subject Comment 3.1 Terms and definitions 4.1 Frequency allocations to the Space

Operation, Space Research and Earth Exploration Satellite services

4.2 Specific conditions for the use of certain frequency bands

5.1 Turnaround frequency ratio for coherent transponders

5.2 Carrier frequency stability 5.3 Polarisation 5.4 Bandwidth considerations 5.5 Emissions 6.1 Phase modulation with residual

carriers

6.2 Suppressed carrier modulation 6.3 Spectral roll-off Annex E GMSK modulation format If GMSK is a selected modulation Annex F 8PSK TCM modulation format If 8PSK TCM is a selected

modulation



page 195 of 203

E.18 ECSS-E-60A Control Engineering (4 September 2004)

See <SD26>. Chapter Section Paragraph Subject 1 Scope 3.1 Terms and defintions 3.2 Abbreviated terms 4.1.1 the general control structure 4.1.2 control engineering activities 4.1.3 organisation of this standard 4.1.4 relationship with other standards 4.2 Definition of the control engineering process 4.3 control engineering tasks per project phase 5.1.1 general 5.1.2 organisation and planning of CE activities 5.1.3 contribution to system engineering data base and doc. 5.1.4 management of interfaces with other disciplines 5.1.6 budget and margin philosophy for control 5.1.7 assessment of control technology and cost effectiveness 5.1.8 risk management 5.1.9 support to control components procurement 5.1.10 support to change management involving control 5.1.11 control enginnering capability assessment and 5.2.1 general 5.2.2 generation of control requirements 5.2.3 allocation of control requirements to control components 5.2.4 control verification requirements 5.2.5 control operations requirements 5.3.1 general 5.3.2 analysis tasks, methods and tools 5.3.3 requirements analysis 5.3.4 disturbance analysis 5.3.5 performance analysis 5.4.1 general 5.4.2 functional design 5.4.3 operational design 5.4.4 control implementation architecture 5.4.5 controller design 5.5.1 general 5.5.2 definition of control verification strategy



page 196 of 203

E.19 ECSS-E-70-41A Ground systems & operations: Telemetry

& Telecommand packet utilization (30 January 2003) The following applicability table is defined pending the tailoring of the ECSS standard to be done by the Contractor as required. See <SD27>. Chapter Paragraph Subject 3.1 Terms and definitions 3.2 Abbreviated terms 4 PUS operations concepts 5 Service specification 6 Telecommand verification service 7 Device command distribution service 8 Housekeeping and diagnostic data reporting service 9 Parameter statistics reporting service 10 Event reporting service 11 Memory management service 12 Function management service 13 Time management service 14 On-board operations scheduling service 15 On-board monitoring service 16 Large data transfer service 17 Packet forwarding control service 18 On-board storage and retrieval service 19 Test service 20 On-board operations procedure service 21 Event-action service 22 Summary of service requests and reports 23 Parameter types and structure rules



page 197 of 203

APPENDIX F: LIST OF ACRONYMS AATSR Advanced Along Track Scanning Radiometer AC Alternating Current ADC Analog to Digital Converter AIT Assembly, Integration and Test AIV Assembly, Integration and Verification AME Absolute Measurement Error AOCS Attitude and Orbit Control System APE Attitude Pointing Error APID Application Identification number ART Absolute Reference Time AU Astronomical Unit BER Bit Error Rate BOA Bottom Of Atmosphere CCS Command and Control Subsystem CDH Control and Data Handling CDHS Control and Data Handling Subsystem CCSDS Consultative Committee for Space Data Systems CFI Customer Furnished Item COG Centre Of Gravity COTS Commercial Off The Shelf COV Coefficient Of Variation CPU Central Processing Unit CUC CCSDS Unsegmented Code DC Direct Current DEM Digital Elevation Model DHS Data Handling Subsystem DL Design Load ECSS European Cooperation for Space Standardisation EDAC Error Detection And Correction EEE Electrical, Electronic and Electromechanical EEPROM Electrically Erasable and Programmable Read Only Memory EGSE Electrical Ground Support Equipment EMC Electromagnetic Compatibility EMI Electromagnetic Interference EOL End Of Life EPM Earth Pointing Mode ESA European Space Agency ESAM Emergency Safe Attitude Mode ESD Electrostatic Discharge FDIR Failure Detection, Isolation and Recovery FFT Fast Fourier Transform FGDR Fast Geophysical Data Record FGSE Fluidic Ground Support Equipment



page 198 of 203

FOM Flight Operations Manual FOS Flight Operations Segment FOS Factor Of Safety FOV Filed Of View FR Full Resolution FTP File Transfer Protocol GDR Geophysical Data Record GMES Global Monitoring for Environment and Security GMM Geometrical Mathematical Model GNSS Global Navigation Satellite System GPP Ground Processor Prototype GPS Global Positioning System GSE Ground Support Equipment HK Housekeeping H/W Hardware IAU International Astronomical Union ICD Interface Control Document ICRF International Celestial Reference Frame IF Intermediate Frequency I/F Interface IFOV Instantaneous Field Of View IGDR Interim Geophysical Data Record IMDD Instrument Measurement Data Definition IR Infrared ISP Instrument Source Packet ISVV Independent Software Verification and Validation ITRF International Terrestrial Reference Frame ITU International Telecommunication Union LCDA Satellite-Launcher Coupled Analysis LCL Latching Current Limiter LEOP Launch and Early Orbit Phase LOS Line Of Sight LRM Low Resolution Mode LRR Laser Retro-Reflector LSB Least Significant Bit MDP Maximum Design Pressure MDTD Mission Data Telemetry Downlink MERIS Medium Resolution Imaging Spectrometer MGSE Mechanical Ground Support Equipment MLE Maximum Likelihood Estimation MOS Margins Of Safety MPPT Maximum Power Point Tracker MTF Modulation Transfer Function MTL Mission Timeline MWR Microwave Radiometer NDI Non-Destructive Inspection NDIU Network Data Interface Unit



page 199 of 203

NEDL Noise Equivalent Differential Luminance NEDT Noise Equivalent Differential Temperature NRT Near Real Time NTC Non Time Critical NVRAM Non-Volatile RAM OBT On-Board Time OGSE Optical Ground Support Equipment OLCI Ocean and Land Colour Instrument OZA Observation Zenith Angle PFCI Potential Fracture Critical Item PDGS Payload Data Ground Segment POD Precise Orbit Determination PRF Pulse Repetition Frequency PROM Programmable Read Only Memory PUS Packet Utilisation Standard QL Qualification Load RA Radar Altimeter RAM Random Access Memory RAR Range Ambiguity Ratio RB Requirements Baseline RF Radio Frequency RMS Root Mean Square RPE Relative Pointing Error RR Reduced Resolution RSS Root Sum Square RTC Real Time Clock SA Solar Array SAR Synthetic aperture Radar SCA Solar Cell Assembly SCC Stress Corrosion Cracking SDE Software Development Environment SDVE Software Development and Verification Environment SEU Single Event Upset SI Système International SLST Sea and Land Surface Temperature instrument SLR Satellite Laser Ranging SNR Signal to Noise Ratio SPF Single Point Failure SRD System Requirements Document SSA Spatial Sampling Angle SSD Spatial Sampling Distance SSP Sub-Satellite Point SST Sea Surface Temperature SVT System Validation Test STC Short Time Critical STS Space Transportation System SVF Software Validation Facility



page 200 of 203

S/W Software SWH Significant Wave Height SZA Solar Zenith Angle TAI Temps Atomique International TB Thermal Balance TC Telecommand TM Telemetry TMM Thermal Mathematical Model TOA Top Of the Atmosphere TRP Temperature Reference Point TT&C Telemetry, Tracking and Command TBC To Be Confirmed TBD To Be Defined UTC Universal Time Code UV Ultra Violet VC Virtual Channel VCID Virtual Channel Identifier WRT With Respect To XSVE X-band Subsystem Validation Equipment



page 201 of 203

APPENDIX G: GROUND STATIONS

G.1.1 TTC GROUND STATIONS S-Band Ground stations characteristics to be considered for nominal operations and for LEOP are defined in <RD9> and <ND3>.

G.1.2 CORE MISION DATA GROUND STATIONS The following combination of Core X-band Ground Stations shall be considered

Case 1): Svalbard Case 2): Kiruna and Svalbard (for Kiruna blind orbits) Case 3) Svalbard and Troll simultaneously.

The minimum elevation contact angle is 5 deg. The Table below shows the coordinates of the above mentioned ground stations:

Ground Station Latitude [deg] Longitude [deg] Svalvard 78.22 15.38 Kiruna 67.88 20.25 Troll -72.00 2.53

Latitude and Longitude of core Mission data Ground Stations

G.1.3 LOCAL MISSION DATA GROUND STATIONS The reference mission scenario shall based on a subset of stations derived from the Table below. The exact list will be fixed at the beginning of Phase B2. The minimum elevation contact angle to be considered is 5 deg.



page 202 of 203

Ground Station Latitude

[deg] Longitude [deg] Altitude [m]

Fucino (Italy) 41.978 13.604 663 Maspalomas (Spain) 27.7627 -15.6316 155 Fairbanks (Alaska) 64.8599 -147.8473 225 Cotopaxi (Equador) 0.6225 -78.5794 3567 Gatineau (Canada) 45.5813 -75.8062 292 Tromsoe (Norway) 69.5000 19.0000 0 Alice Spring (Australia) -23.7590 133.8824 578 Hyderabad (India) 17.0286 78.1894 625 Kumamoto (Japan) 32.5000 130.5000 0 Prince Albert (Canada) 53.2126 -105.9353 489 West Freugh (UK) 54.8500 -4.9500 15 O’Higgins (Antarctic) -63.1916 -57.5464 10 Hatoyama (Japan) 36.0038 139.3486 95 Pari-Pari (Indonesia) -3.9773 119.6493 90 Syowa (Antarctic) -69.0061 39.5900 10 Rhyad (Saudi Arabia) 24.6200 46.6800 646 Bangkok (Thailand) 13.7300 100.7900 2 Aussaguel (France) 44.5000 1.5000 0 Hobart (Australia) -42.9252 147.4209 160 Cuiaba (Brazil) -15.5522 -56.0727 295 Beijing (China) 40.4517 116.8578 108 Libreville (Gabon) 0.4536 9.6733 6 Atlanta (USA) 33.9310 -84.1090 600 Taiwan (China) 24.9706 121.1706 158 Israel (Israel) 32.0281 34.9035 108 Johannesburg (South Africa) -25.8864 27.7070 1543 McMurdo (USA) -77.8500 166.6667 152 Singapore (Singapore) 1.2922 103.7839 55 Norman (USA) 35.1798 -97.5651 369 Neusterlitz (Germany) 53.3301 13.0745 78 Cordoba (Argentina) -31.55241 -64.4636 730 Malindi (Kenya) -2.9956 40.1945 12 Ulan Bator (Mongolia) 47.9253 106.9592 1450 Honolulu (Hawai) 21.3172 202.1117 5 Bishkek (Kyrgyzstan) 42.4314 74.3894 800 Kitab (Uzbekistan) 38.9465 66.8854 620 Matera (Italy) 40.3852 16.4210 527 Istambul (Turkey) 41.1027 29.0245 145 Moscow (Russia) 55.8508 37.6175 200 Miami (USA) 25.6138 279.6156 16



page 203 of 203

Khanty Mansyisk (Russia) 61.0191 -69.0133 75 Mexico City (Mexico) 18.5333 271.7167 25

Potential Local Mission data Ground Stations