ICARUS OS — flight software for CubeSats

ICARUS Satellite OBC Platform

A deterministic flight-software substrate that runs the whole mission — telecommand, telemetry, and autonomous fault recovery — under hardware-level fault isolation. We built it from the kernel up, and we sell it as a standalone onboard-computer platform to CubeSat operators today.

RTOS written from scratch. Open source — icarus-os-core
~68 KB flash footprint on Cortex-M7. No Linux required.

CubeSat teams shouldn't need NASA-scale infrastructure to fly reliable missions. A satellite OBC software platform with our own ICARUS OS kernel, CCSDS-compliant telecommand and telemetry, and autonomous fault recovery — in a third of the codebase of cFS.

$
cFS = ~100K LOC + ARM / PowerPC SBC
KubOS = full Linux distro on a BeagleBone
ICARUS = ~5.6K LOC in ~68 KB of flash
~68 KB Flash used
~9 KB ITCM hot path
Cortex-M7 480 MHz
5.6K LOC
522 Tests

FDIR

7 fault types, 5 escalation levels. From retry to safe mode — automatically.

FDIR

Hierarchical response: log → retry → restart task → mode SAFE → reset. Faults include deadline miss, watchdog timeout, undervolt, link loss, memory corruption, sensor failure, and SEU. Escalation chains are ground-loadable.

CCSDS TC/TM

Standards-compliant telecommand and telemetry. Binary from origin, not sprintf on the flight CPU.

CCSDS TC/TM

Space Packet Protocol with 6-byte primary header (APID, sequence, payload). Command dispatch for mode transitions, fault clearing, and HK requests. Structured binary events — no flight-side string formatting.

Onboard Sequencer

Time-tagged and conditional command execution. Runs autonomously through contact gaps.

Onboard Sequencer

Scripts are ground-loadable via TBL_SEQ_SCRIPT. The satellite keeps executing science operations even when out of contact — no ground intervention required.

CFDP-Lite

File transfer in ~2K SLOC. Class 1 best-effort and Class 2 NAK-based retransmission.

CFDP-Lite

A subset of full CFDP (~15K SLOC) that still handles the common cases: unacknowledged delivery and NAK-based retransmission with bitmap tracking of missing chunks. Static 4 KB RAM buffer, no filesystem dependency.

Ground-Loadable Tables

5 table types, double-buffered, CRC-validated. Update config from the ground without reflashing.

Ground-Loadable Tables

FDIR rules, scheduler slots, limit watchpoints, sequencer scripts, HK selection. Each table is CRC-validated on upload and atomically swapped via double buffering. Your mission config evolves without touching firmware.

Memory Protection

MPU-based per-task isolation. A misbehaving task can't corrupt flight-critical state.

Memory Protection

Hardware MPU with per-task regions across DTCM, RAM_D2 pools, and kernel state. 71 SVC gates enforce privilege separation. A sensor driver can't accidentally scribble on the mode manager's memory.

Persistent State

Battery-backed BKPRAM survives resets. Warm restart without losing mission context.

Persistent State

64 KB VBAT-backed SRAM with magic word + CRC16 validation. Persists MET, last mode, boot count, per-fault counts, and FDIR restart count. A reset in orbit doesn't mean starting from scratch.

Ground Station

React dashboard + WebSocket bridge. Real-time telemetry, commanding, and file transfer — no COSMOS needed.

Ground Station

Python async WebSocket bridge handles USB CDC to the flight CPU. React dashboard with live telemetry graphs, command dispatch, and CFDP file transfers. Ships with the OBC — no separate integration project.

HW CRC Monitor

Self-testing CRC scanner validates 8 code regions using STM32H7 hardware CRC engine. Faults feed directly into FDIR.

HW CRC Monitor

Background task walks 8 flash regions using the STM32H7's hardware CRC peripheral — no CPU burn. On mismatch, raises FAULT_MEMORY_CORRUPTION straight into the FDIR pipeline. Catches SEU-induced bit flips in .text.

SEU Detection

Single-event upset detection with configurable bit-flip injection for ground testing. Radiation-aware from day one.

SEU Detection

Deterministic LFSR-based bit-flip injector validates the full Checksum → FDIR → safe-mode recovery chain. Same seed produces the same corruption pattern — reproducible radiation testing without a beam facility.

Pro

AI Fault Prediction

On-device inference from exact instruction pointer and program context. Predicts faults before they cascade — not after.

AI Fault Prediction

Lightweight on-device model trained on instruction-pointer traces and program state snapshots. Flags anomalies in the hot path before they trip the FDIR escalation chain. Proactive, not reactive.

Pro

Execution Checkpoint

Resume from exact program context after a fault. Not from boot — from the instruction you left off on.

Execution Checkpoint

Periodic snapshots of CPU registers, stack frames, and task state pinned to BKPRAM. After a transient fault, the task resumes at its last checkpoint instead of restarting from scratch. Hours of orbital science, not minutes of re-init.

How we compare ← swipe →

We read the cFS codebase so you don't have to.

// column shows ICARUS OBC Prime. Orbit ships a subset (see editions table below).

// claims validated against public vendor docs & web sources on 2026-04-13.

Feature ICARUS OBC Prime NASA cFS KubOS Bright Ascension ISIS iOBC Hubris FreeRTOS DIY
CCSDS TC/TM TC/TM + PUS-lite, hot-swappable router Full PUS-C suite PUS via service PUS-C compliant Add-on module
FDIR 7 fault types × 5 escalation levels Basic Health & Safety app Hooks for custom logic Primitives only
Onboard sequencing Native time + event sequencer Via Stored Command app Via mission services Native scheduler Native scheduler
CFDP file transfer CFDP-Lite (~2K SLOC) Full CFDP class 1–4 Full CFDP Full CFDP
Ground-loadable tables 5 types, double-buffered atomic swap Standard cFS tables DB-backed config Parameter tables Limited support
MPU isolation Per-task hardware MPU Partial via OSAL Linux / SELinux Unclear Per-task hardware MPU
Persistent state BKPRAM + CRC16 verified Unclear U-Boot env vars Unclear FRAM / SD card
SEU detection EDAC + memory scrub Hooks for custom
HW CRC monitor 8 regions, HW engine, zero CPU Software checksum Unclear
Ground station Included — React + WebSocket Major Tom (paid SaaS) MCS (commercial add-on)
Deterministic RTOS Custom hard-RT kernel OS-dependent Partial (RT + Linux) RTOS-backed FreeRTOS-based Hard RT (Rust) Soft RT
DO-178C docs Roadmap Planned
Target hardware Cortex-M7 (STM32H7) ARM / PowerPC Linux SBCs MCU + Linux ARM9 (iOBC) Cortex-M Cortex-M
Language C C Rust + Python C / C++ C Rust C
License OBC: Commercial • Kernel: Apache 2.0 Apache 2.0 Open source Commercial Commercial MPL-2.0 MIT (kernel)
Codebase ~5.6K LOC, ~68 KB flash ~100K+ LOC Large Unclear Unclear ~50K LOC Varies
Community New Large (NASA-led) Active Enterprise Enterprise Growing Massive
Flight heritage Pre-launch 40+ incl. JWST, LRO Limited public data 50+ deployments Flown since 2014 No space heritage CubeSats (varies)
AI fault prediction Roadmap Planned (PC + reg context)
Execution checkpoint Roadmap Planned (resume-from-state)
MISRA C compliance Roadmap Planned
Payload drivers Roadmap Planned Library available Library available Library available Library available
Safety traceability Roadmap Planned
Two editions

// from orbit to prime. upgrade path built in.

Feature
Orbit

Reach orbit. Stay there.

Mission Critical
Prime

The flight-grade moat.

OS kernel
Core (Apache 2.0)
Reaper (commercial)
CCSDS TC/TM
Sequencer
CFDP-Lite
GL tables Prime
Basic tables; no double-buffered atomic swap
5 types, double-buf
Atomic swap with CRC validation. Update config in orbit. Zero-downtime reconfig.
Persistent state
BKPRAM + CRC16
BKPRAM + CRC16
MPU isolation
Per-task HW MPU
Per-task HW MPU
SEU detection
HW CRC Prime
SW-assisted — slower scan, lower CPU budget
8 regions, HW engine
Hardware-accelerated. Continuous 8-region scan with zero CPU load. Catches SEU bit-flips the moment they happen.
FDIR Prime
Basic (3 levels)
One bad day and you're scrambling on ground
7 types × 5 levels
Hierarchical escalation: retry → isolate → swap → safe → recover. The satellite saves itself while you sleep.
Ground station Prime
CLI
No live dashboard. You build the UI yourself.
React + WebSocket
Real-time telemetry dashboard out of the box. Live plots, alerts, command uplink. Ops starts on day one.
AI fault prediction Prime
Faults still surprise you — you react, not predict
On-device inference
Lightweight model trained on instruction-pointer + program context. Catches anomalies before the FDIR chain fires. Predict, not react.
Execution checkpoint Prime
Every fault = full reboot. Hours of orbital re-init.
Resume from state
Snapshots of registers, stack frames, and task state pinned to BKPRAM. After a fault, your task resumes from the last instruction — not from boot. Hours of science saved per anomaly.
Support Prime
Email
Async only. No pager for your 3 AM anomaly.
On-call engineer
Dedicated engineer on pager rotation. Real humans answer when your sat starts misbehaving. Mission success is a shared KPI.
Mission integration Prime
You own the integration work end-to-end
Full loop
Weekly syncs, flight config reviews, pre-launch readiness checks. We own the integration outcome with you, not just the codebase.
Start a mission Go for launch
Kernel vs the field ← swipe →

// most RTOSes schedule tasks. ours also catches radiation.

// claims validated against public vendor docs & web sources on 2026-04-13.

Feature ICARUS Core ICARUS Reaper FreeRTOS Zephyr RTEMS Hubris VxWorks
License Apache 2.0 Commercial MIT Apache 2.0 GPL-2.0 / BSD MPL-2.0 Commercial
Language C C C C C Rust C / C++
Target hardware Cortex-M7 Cortex-M7 Many MCUs Many archs 18 archs, 200 BSPs Cortex-M (MPU) Many
Per-task MPU isolation yes (extended) Partial (MPU port) Partial yes (required)
Preemptive scheduler
Persistent state (BKPRAM) Via apps
HW CRC integrity scan Via apps
SEU detection Via apps
AI fault prediction Planned
AI runtime + SDK (bounded WCET) Planned TFLM (app-level) TFLM / microTVM module TFLite + LEIP
Execution checkpoint Planned
Kernel footprint ~6 KB ITCM / ~52 KB flash ~8 KB ITCM (est.) 6–12 KB ROM ~30–60 KB Larger ~10 KB ROM Larger
Space flight heritage Pre-launch Pre-launch CubeSats Growing Mars, TGO, ISS None Mars, InSight, Clementine
DO-178C certification Planned no (SafeRTOS is separate) DAL A available
Community / ecosystem New New Massive Large Medium (space) Small Paid enterprise
Price Free Per-mission Free Free Free Free High ($$$)

// note: cert and heritage go to VxWorks and RTEMS. We don't pretend otherwise. Our edge is the integration of space-specific fault tooling (HW CRC, SEU, persistent state, AI prediction) in a small Cortex-M kernel — not decades of deep-space missions.

Satellite Mode State Machine // five modes. no surprises. mostly.
SAFE DETUMBLE NOMINAL SCI LOW_POWER

Go deeper

Let's talk.

Whether you're building something that needs to fly, or something that needs to scale.

Or email us directly at founders@hawklogicsystems.com