Skip to content
Stewarded by Vyovrinda

SatOS

SatOS is the on-board software foundation for the group's spacecraft work: command and data handling, telemetry, stored command sequences, mode management and — the part that matters most — a safe mode simple enough to be trusted when everything above it has failed.

How determinism shows up here

Safe mode is deliberately the simplest software on the spacecraft. Simple enough to verify completely is the whole point of it.

What it does

Inside the platform

01

Command & data handling

Command ingest and validation, telemetry generation, and mass memory management against the next ground contact.

02

Mode management

Defined operating modes with explicit, tested transitions between them.

03

Fault detection & safe mode

Detection, isolation and recovery, with a deterministic safe mode sitting beneath the sophisticated software rather than inside it.

04

Memory protection

Error detection and correction with background scrubbing, catching a radiation-induced bit flip before a second one makes it uncorrectable.

How it fits together

The shape of the work

Every mode has one way down

Moving up the chain takes a ground command and a passed condition. Moving down takes nothing at all — any detected fault drops the spacecraft to safe mode without asking. That asymmetry is the design: the hard direction is deliberate, the easy direction is automatic.

ENTRY CONDITIONSBoot → Detumble — self-test passedDetumble → Safe — rates below threshold, sun acquiredSafe → Nominal — power positive, ground commandNominal → Payload — attitude stable, ground commandBootPower-onSelf-testDetumbleRates downSun acquiredSafeSun-pointingRadio listeningNominalAttitude heldHousekeepingPayloadMission opsData captureUp the chain: ground command + entry condition met + transition testedfault detectedfault detected — no ground contact requiredWhy safe mode is the least sophisticated software on boardIt does not depend on the payload computer, the stored command sequence, or the ground link. Simple enough to verify completely is the entire point.Memory is scrubbed in the background throughout — a single radiation-induced bit flip is corrected before a second one makes it uncorrectable.Transitions are tested in both directions. An untested transition is an untested failure path.
Who builds on it

Used across the group

  • Vyovrinda satellite programmes and subsystems

Ownership

A domain platform, stewarded by Vyovrinda — the unit with the deepest knowledge of the problem. P9e owns it and licenses it across the group; stewardship is responsibility for maintaining it, not ownership of it.

How we decide what is shared

Building something that needs SatOS?

Tell us the constraints and we will come back with how this platform would carry them — or say plainly if it would not.