Building the orbital power utility.
Power harvested from orbital kinetic energy, beamed wirelessly to customer satellites.
Three forces are converging — and every current solution assumes every spacecraft launches its own solar arrays. That doesn't scale.
Eric Schmidt told a US House Energy & Commerce hearing in April 2025 that AI data centres will need an additional ~67 GW by 2030. Holding compute on the ground keeps that demand on the ground. Starcloud, Project Suncatcher (Google), and Axiom Space are taking it off it.
Direct-to-cell, high-bandwidth, and AI-edge payloads layer onto Starlink- and Kuiper-class buses faster than solar arrays scale. Per-spacecraft power requirements are an order of magnitude higher than they were five years ago.
Imaging, radar, and signals constellations want surge capacity for specific passes — not a permanent power budget. Launching extra arrays for peak moments is the wrong answer when those arrays burn duty cycle the other 95% of the orbit.
Every current answer says: each spacecraft launches its own solar arrays. There's a structurally cheaper way — separate generation from station-keeping, the way ground utilities did a century ago.
Generation and station-keeping compete in any single-spacecraft design. We separate them.
// schematic. altitudes, scale, and beam geometry compressed for legibility.
Each generator is a small platform trailing a long conductive cable. As it moves through Earth's magnetic field, motional EMF along the cable produces usable current — the Electrodynamic Tether (EDT) effect demonstrated by NASA's TSS-1R in 1996. The harvested power is beamed up to the collector tier at 35 GHz.
A generator has a useful life of 6–12 months at this altitude before atmospheric drag deorbits it naturally. That's a feature, not a flaw — no on-orbit debris liability, no service mission to recover hardware, and the cost of the platform is amortised over a known, bounded service interval.
Collectors aggregate power from multiple generators, store it, and deliver it on demand to paying customer satellites. At their higher altitude, drag is negligible — station-keeping needs are modest, and small solar arrays cover house power. The work the collector specialises in is power management, not generation.
The pattern is what made every prior utility cheap: durable infrastructure plus consumable supply. Cell towers plus handsets. Power plants plus fuel. Persistent collectors plus disposable generators. Capex sits on the durable tier; the consumable tier scales independently with demand.
Single-tier architectures — one platform that both generates and persists — pay the full station-keeping bill on every megawatt-hour of harvest hardware launched. Split the two functions, and station-keeping only sits on the durable tier. The generator tier doesn't need to last long, doesn't need precision pointing, and doesn't need a large bus. That's where the cost asymmetry comes from.
We're not inventing the physics. Most of what we need has already flown — or been demonstrated in a lab — by NASA, ESA, JAXA, and others. Tap any card to see the receipts. Where the heritage runs out, we say so plainly.
Long electrical cables in orbit can act like generators. NASA, ESA, and the US Naval Research Lab have flown the idea four times — we're scaling it down so it can be mass-produced.
Electrodynamic tethers have been demonstrated in orbit four separate times. We are not inventing the physics — we are productionising it at the right scale.
Sending energy wirelessly with microwaves is a 50-year-old technology. The 35 GHz band we use punches through the atmosphere with very little loss, and works just as cleanly between satellites.
Wireless power transmission has been a working technology for fifty years. The path is band selection, antenna scaling, and pointing — not physics.
Once a collector satellite is on station, two well-proven techniques — electric thrusters and the same tether-thrust trick — keep it parked there for years.
Both of the techniques a collector needs are mature. Solar-electric propulsion flies on every large LEO commsat today; tether thrust mode has been demonstrated on orbit.
Every spacecraft in this architecture runs ICARUS OS — our flight-computer brain. It's already shipping today as an open-source product, separately from the power system.
We've already built the substrate. ICARUS OS coordinates generators, collectors, and customer handshakes under hardware-level fault isolation — and it's an open-source kernel shipping today.
Most of the technology is mature. There are two specific problems nobody has solved at the size we need — here they are, and here's how we retire each one on the ground before any flight hardware is committed.
// we list these because investor and customer due diligence will list them anyway. the path is to retire each on the ground before flight hardware exists.
Four phases, each gated on a technical and a commercial milestone. We publish the journey, not the capital stack.
// dates are working targets. flight-hardware schedules slip when ground demonstrators reveal what the engineering reviews can't.
The architecture above needs a flight-software substrate that can coordinate generators, collectors, and customer handshakes deterministically under hardware-level fault isolation. We built one. We also sell it as a standalone product to CubeSat operators today.
CubeSat teams shouldn't need NASA-scale infrastructure to fly reliable missions. A satellite OBC software platform with our own ICARUS OS kernel, CCSDS-compliant telecommand and telemetry, and autonomous fault recovery — in a third of the codebase of cFS.
7 fault types, 5 escalation levels. From retry to safe mode — automatically.
Hierarchical response: log → retry → restart task → mode SAFE → reset. Faults include deadline miss, watchdog timeout, undervolt, link loss, memory corruption, sensor failure, and SEU. Escalation chains are ground-loadable.
Standards-compliant telecommand and telemetry. Binary from origin, not sprintf on the flight CPU.
Space Packet Protocol with 6-byte primary header (APID, sequence, payload). Command dispatch for mode transitions, fault clearing, and HK requests. Structured binary events — no flight-side string formatting.
Time-tagged and conditional command execution. Runs autonomously through contact gaps.
Scripts are ground-loadable via TBL_SEQ_SCRIPT. The satellite keeps executing science operations even when out of contact — no ground intervention required.
File transfer in ~2K SLOC. Class 1 best-effort and Class 2 NAK-based retransmission.
A subset of full CFDP (~15K SLOC) that still handles the common cases: unacknowledged delivery and NAK-based retransmission with bitmap tracking of missing chunks. Static 4 KB RAM buffer, no filesystem dependency.
5 table types, double-buffered, CRC-validated. Update config from the ground without reflashing.
FDIR rules, scheduler slots, limit watchpoints, sequencer scripts, HK selection. Each table is CRC-validated on upload and atomically swapped via double buffering. Your mission config evolves without touching firmware.
MPU-based per-task isolation. A misbehaving task can't corrupt flight-critical state.
Hardware MPU with per-task regions across DTCM, RAM_D2 pools, and kernel state. 71 SVC gates enforce privilege separation. A sensor driver can't accidentally scribble on the mode manager's memory.
Battery-backed BKPRAM survives resets. Warm restart without losing mission context.
64 KB VBAT-backed SRAM with magic word + CRC16 validation. Persists MET, last mode, boot count, per-fault counts, and FDIR restart count. A reset in orbit doesn't mean starting from scratch.
React dashboard + WebSocket bridge. Real-time telemetry, commanding, and file transfer — no COSMOS needed.
Python async WebSocket bridge handles USB CDC to the flight CPU. React dashboard with live telemetry graphs, command dispatch, and CFDP file transfers. Ships with the OBC — no separate integration project.
Self-testing CRC scanner validates 8 code regions using STM32H7 hardware CRC engine. Faults feed directly into FDIR.
Background task walks 8 flash regions using the STM32H7's hardware CRC peripheral — no CPU burn. On mismatch, raises FAULT_MEMORY_CORRUPTION straight into the FDIR pipeline. Catches SEU-induced bit flips in .text.
Single-event upset detection with configurable bit-flip injection for ground testing. Radiation-aware from day one.
Deterministic LFSR-based bit-flip injector validates the full Checksum → FDIR → safe-mode recovery chain. Same seed produces the same corruption pattern — reproducible radiation testing without a beam facility.
On-device inference from exact instruction pointer and program context. Predicts faults before they cascade — not after.
Lightweight on-device model trained on instruction-pointer traces and program state snapshots. Flags anomalies in the hot path before they trip the FDIR escalation chain. Proactive, not reactive.
Resume from exact program context after a fault. Not from boot — from the instruction you left off on.
Periodic snapshots of CPU registers, stack frames, and task state pinned to BKPRAM. After a transient fault, the task resumes at its last checkpoint instead of restarting from scratch. Hours of orbital science, not minutes of re-init.
We read the cFS codebase so you don't have to.
// column shows ICARUS OBC Prime. Orbit ships a subset (see editions table below).
// claims validated against public vendor docs & web sources on 2026-04-13.
| Feature | ICARUS OBC Prime | NASA cFS | KubOS | Bright Ascension | ISIS iOBC | Hubris | FreeRTOS DIY |
|---|---|---|---|---|---|---|---|
| CCSDS TC/TM | TC/TM + PUS-lite, hot-swappable router | Full PUS-C suite | PUS via service | PUS-C compliant | Add-on module | — | — |
| FDIR | 7 fault types × 5 escalation levels | Basic Health & Safety app | — | Hooks for custom logic | Primitives only | — | — |
| Onboard sequencing | Native time + event sequencer | Via Stored Command app | Via mission services | Native scheduler | Native scheduler | — | — |
| CFDP file transfer | CFDP-Lite (~2K SLOC) | Full CFDP class 1–4 | Full CFDP | Full CFDP | — | — | — |
| Ground-loadable tables | 5 types, double-buffered atomic swap | Standard cFS tables | DB-backed config | Parameter tables | Limited support | — | — |
| MPU isolation | Per-task hardware MPU | Partial via OSAL | Linux / SELinux | Unclear | — | Per-task hardware MPU | — |
| Persistent state | BKPRAM + CRC16 verified | Unclear | U-Boot env vars | Unclear | FRAM / SD card | — | — |
| SEU detection | EDAC + memory scrub | — | — | Hooks for custom | — | — | — |
| HW CRC monitor | 8 regions, HW engine, zero CPU | Software checksum | — | Unclear | — | — | — |
| Ground station | Included — React + WebSocket | — | Major Tom (paid SaaS) | MCS (commercial add-on) | — | — | — |
| Deterministic RTOS | Custom hard-RT kernel | OS-dependent | Partial (RT + Linux) | RTOS-backed | FreeRTOS-based | Hard RT (Rust) | Soft RT |
| DO-178C docs Roadmap | Planned | — | — | — | — | — | — |
| Target hardware | Cortex-M7 (STM32H7) | ARM / PowerPC | Linux SBCs | MCU + Linux | ARM9 (iOBC) | Cortex-M | Cortex-M |
| Language | C | C | Rust + Python | C / C++ | C | Rust | C |
| License | OBC: Commercial • Kernel: Apache 2.0 | Apache 2.0 | Open source | Commercial | Commercial | MPL-2.0 | MIT (kernel) |
| Codebase | ~5.6K LOC, ~68 KB flash | ~100K+ LOC | Large | Unclear | Unclear | ~50K LOC | Varies |
| Community | New | Large (NASA-led) | Active | Enterprise | Enterprise | Growing | Massive |
| Flight heritage | Pre-launch | 40+ incl. JWST, LRO | Limited public data | 50+ deployments | Flown since 2014 | No space heritage | CubeSats (varies) |
| AI fault prediction Roadmap | Planned (PC + reg context) | — | — | — | — | — | — |
| Execution checkpoint Roadmap | Planned (resume-from-state) | — | — | — | — | — | — |
| MISRA C compliance Roadmap | Planned | — | — | — | — | — | — |
| Payload drivers Roadmap | Planned | Library available | Library available | Library available | Library available | — | — |
| Safety traceability Roadmap | Planned | — | — | — | — | — | — |
// from orbit to prime. upgrade path built in.
| Feature | Orbit Reach orbit. Stay there. |
Mission Critical
Prime The flight-grade moat. |
|---|---|---|
| OS kernel | Core (Apache 2.0) | Reaper (commercial) |
| CCSDS TC/TM | ✓ | ✓ |
| Sequencer | ✓ | ✓ |
| CFDP-Lite | ✓ | ✓ |
| GL tables Prime | ✓ Basic tables; no double-buffered atomic swap | 5 types, double-buf Atomic swap with CRC validation. Update config in orbit. Zero-downtime reconfig. |
| Persistent state | BKPRAM + CRC16 | BKPRAM + CRC16 |
| MPU isolation | Per-task HW MPU | Per-task HW MPU |
| SEU detection | ✓ | ✓ |
| HW CRC Prime | ✓ SW-assisted — slower scan, lower CPU budget | 8 regions, HW engine Hardware-accelerated. Continuous 8-region scan with zero CPU load. Catches SEU bit-flips the moment they happen. |
| FDIR Prime | Basic (3 levels) One bad day and you're scrambling on ground | 7 types × 5 levels Hierarchical escalation: retry → isolate → swap → safe → recover. The satellite saves itself while you sleep. |
| Ground station Prime | CLI No live dashboard. You build the UI yourself. | React + WebSocket Real-time telemetry dashboard out of the box. Live plots, alerts, command uplink. Ops starts on day one. |
| AI fault prediction Prime | — Faults still surprise you — you react, not predict | On-device inference Lightweight model trained on instruction-pointer + program context. Catches anomalies before the FDIR chain fires. Predict, not react. |
| Execution checkpoint Prime | — Every fault = full reboot. Hours of orbital re-init. | Resume from state Snapshots of registers, stack frames, and task state pinned to BKPRAM. After a fault, your task resumes from the last instruction — not from boot. Hours of science saved per anomaly. |
| Support Prime | Email Async only. No pager for your 3 AM anomaly. | On-call engineer Dedicated engineer on pager rotation. Real humans answer when your sat starts misbehaving. Mission success is a shared KPI. |
| Mission integration Prime | — You own the integration work end-to-end | Full loop Weekly syncs, flight config reviews, pre-launch readiness checks. We own the integration outcome with you, not just the codebase. |
| Start a mission | Go for launch |
The open-source RTOS kernel. Preemptive scheduler, MPU isolation, SVC gates. Fly it, fork it, use it commercially. Included in Orbit.
View on GitHubCommercial kernel fork with the advanced features — AI fault prediction, execution checkpoint, AI runtime + SDK (bounded-WCET inference for quantized models), extended MPU, priority support. Sold standalone OR bundled with Prime.
Contact for licensing// most RTOSes schedule tasks. ours also catches radiation.
// claims validated against public vendor docs & web sources on 2026-04-13.
| Feature | ICARUS Core | ICARUS Reaper | FreeRTOS | Zephyr | RTEMS | Hubris | VxWorks |
|---|---|---|---|---|---|---|---|
| License | Apache 2.0 | Commercial | MIT | Apache 2.0 | GPL-2.0 / BSD | MPL-2.0 | Commercial |
| Language | C | C | C | C | C | Rust | C / C++ |
| Target hardware | Cortex-M7 | Cortex-M7 | Many MCUs | Many archs | 18 archs, 200 BSPs | Cortex-M (MPU) | Many |
| Per-task MPU isolation | ✓ | yes (extended) | Partial (MPU port) | ✓ | Partial | yes (required) | ✓ |
| Preemptive scheduler | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Persistent state (BKPRAM) | ✓ | ✓ | — | — | — | — | Via apps |
| HW CRC integrity scan | ✓ | ✓ | — | — | — | — | Via apps |
| SEU detection | ✓ | ✓ | — | — | — | — | Via apps |
| AI fault prediction | — | Planned | — | — | — | — | — |
| AI runtime + SDK (bounded WCET) | — | Planned | TFLM (app-level) | TFLM / microTVM module | — | — | TFLite + LEIP |
| Execution checkpoint | — | Planned | — | — | — | — | — |
| Kernel footprint | ~6 KB ITCM / ~52 KB flash | ~8 KB ITCM (est.) | 6–12 KB ROM | ~30–60 KB | Larger | ~10 KB ROM | Larger |
| Space flight heritage | Pre-launch | Pre-launch | CubeSats | Growing | Mars, TGO, ISS | None | Mars, InSight, Clementine |
| DO-178C certification | — | Planned | no (SafeRTOS is separate) | — | — | — | DAL A available |
| Community / ecosystem | New | New | Massive | Large | Medium (space) | Small | Paid enterprise |
| Price | Free | Per-mission | Free | Free | Free | Free | High ($$$) |
// note: cert and heritage go to VxWorks and RTEMS. We don't pretend otherwise. Our edge is the integration of space-specific fault tooling (HW CRC, SEU, persistent state, AI prediction) in a small Cortex-M kernel — not decades of deep-space missions.
Power systems can't be statistical. Every cycle accounted for in flight software, every beam timed, every handover scheduled. ITCM-resident hot paths and deterministic scheduling under the hood.
Hardware-level fault isolation across the whole architecture — generator-side, collector-side, customer-side. 5-level fault escalation, hardware CRC monitoring, SEU-tested, MISRA-C on the roadmap. Evidence, not promises.
A power utility is a long-term commitment, not a launch event. Ground-loadable configuration. State that survives resets. Hardware sized for known service intervals. Built to outlast each mission contract.
Latest from the Avionics Desk
Spacecraft tools
Power budgets, link budgets, drag-decay timelines, tether output. Run the numbers, then let ENKI break down what they mean for your mission — flow charts and diagrams included.
AI explainer Free spacecraft calculators, each with ENKI on hand to diagram what the numbers mean. →
Whether you're building something that needs to fly,
or something that needs to scale.
We've got your message and we're on it.
Check your inbox — we've sent you a confirmation from letstalk@hawklogicsystems.com.
Expect a response from somebody @hawklogicsystems.com within 24-48 hours.
We couldn't send your message. Our servers might be having a moment.
Try again or email us directly at founders@hawklogicsystems.com
Or email us directly at founders@hawklogicsystems.com
