ICARUS Satellite OBC Platform
A deterministic flight-software substrate that runs the whole mission (telecommand, telemetry, and autonomous fault recovery) under hardware-level fault isolation. We built it from the kernel up, and we sell it as a standalone onboard-computer platform to CubeSat operators today.
CubeSat teams shouldn't need NASA-scale infrastructure to fly reliable missions. A satellite OBC software platform with our own ICARUS OS kernel, CCSDS-compliant telecommand and telemetry, and autonomous fault recovery: in roughly a twentieth of the codebase of cFS.
KubOS = full Linux distro on a BeagleBone
ICARUS = ~5.6K LOC in ~68 KB of flash
FDIR
7 fault types, 5 escalation levels. From retry to safe mode, automatically.
FDIR
Hierarchical response: log → retry → restart task → mode SAFE → reset. Faults include deadline miss, watchdog timeout, undervolt, link loss, memory corruption, sensor failure, and SEU. Escalation chains are ground-loadable.
CCSDS TC/TM
Standards-compliant telecommand and telemetry. Binary from origin, not sprintf on the flight CPU.
CCSDS TC/TM
Space Packet Protocol with 6-byte primary header (APID, sequence, payload). Command dispatch for mode transitions, fault clearing, and HK requests. Structured binary events: no flight-side string formatting.
Onboard Sequencer
Time-tagged and conditional command execution. Runs autonomously through contact gaps.
Onboard Sequencer
Scripts are ground-loadable via TBL_SEQ_SCRIPT. The satellite keeps executing science operations even when out of contact: no ground intervention required.
CFDP-Lite
File transfer in ~2K SLOC. Class 1 best-effort and Class 2 NAK-based retransmission.
CFDP-Lite
A subset of full CFDP (~15K SLOC) that still handles the common cases: unacknowledged delivery and NAK-based retransmission with bitmap tracking of missing chunks. Static 4 KB RAM buffer, no filesystem dependency.
Ground-Loadable Tables
5 table types, double-buffered, CRC-validated. Update config from the ground without reflashing.
Ground-Loadable Tables
FDIR rules, scheduler slots, limit watchpoints, sequencer scripts, HK selection. Each table is CRC-validated on upload and atomically swapped via double buffering. Your mission config evolves without touching firmware.
Memory Protection
MPU-based per-task isolation. A misbehaving task can't corrupt flight-critical state.
Memory Protection
Hardware MPU with per-task regions across DTCM, RAM_D2 pools, and kernel state. 40 SVC gates enforce privilege separation. A sensor driver can't accidentally scribble on the mode manager's memory.
Persistent State
Battery-backed BKPRAM survives resets. Warm restart without losing mission context.
Persistent State
64 KB VBAT-backed SRAM with magic word + CRC16 validation. Persists MET, last mode, boot count, per-fault counts, and FDIR restart count. A reset in orbit doesn't mean starting from scratch.
Ground Station
React dashboard + WebSocket bridge. Real-time telemetry, commanding, and file transfer: no COSMOS needed.
Ground Station
Python async WebSocket bridge handles USB CDC to the flight CPU. React dashboard with live telemetry graphs, command dispatch, and CFDP file transfers. Ships with the OBC: no separate integration project.
HW CRC Monitor
Self-testing CRC scanner validates 8 code regions using STM32H7 hardware CRC engine. Faults feed directly into FDIR.
HW CRC Monitor
Background task walks 8 flash regions using the STM32H7's hardware CRC peripheral: no CPU burn. On mismatch, raises FAULT_MEMORY_CORRUPTION straight into the FDIR pipeline. Catches SEU-induced bit flips in .text.
SEU Detection
Single-event upset detection with configurable bit-flip injection for ground testing. Radiation-aware from day one.
SEU Detection
Deterministic LFSR-based bit-flip injector validates the full Checksum → FDIR → safe-mode recovery chain. Same seed produces the same corruption pattern: reproducible radiation testing without a beam facility.
AI Fault Prediction
On-device inference from exact instruction pointer and program context. Predicts faults before they cascade, not after.
AI Fault Prediction
Lightweight on-device model trained on instruction-pointer traces and program state snapshots. Flags anomalies in the hot path before they trip the FDIR escalation chain. Proactive, not reactive.
Execution Checkpoint
Resume from exact program context after a fault. Not from boot, from the instruction you left off on.
Execution Checkpoint
Periodic snapshots of CPU registers, stack frames, and task state pinned to BKPRAM. After a transient fault, the task resumes at its last checkpoint instead of restarting from scratch. Hours of orbital science, not minutes of re-init.
We read the cFS codebase so you don't have to.
// column shows ICARUS OBC Prime, the one commercial edition (detail below).
// claims validated against public vendor docs & web sources on 2026-04-13.
| Feature | ICARUS OBC Prime | NASA cFS | KubOS | Bright Ascension | ISIS iOBC | Hubris | FreeRTOS DIY |
|---|---|---|---|---|---|---|---|
| CCSDS TC/TM | TC/TM + PUS-lite, hot-swappable router | Full PUS-C suite | PUS via service | PUS-C compliant | Add-on module | n/a | n/a |
| FDIR | 7 fault types × 5 escalation levels | Basic Health & Safety app | n/a | Hooks for custom logic | Primitives only | n/a | n/a |
| Onboard sequencing | Native time + event sequencer | Via Stored Command app | Via mission services | Native scheduler | Native scheduler | n/a | n/a |
| CFDP file transfer | CFDP-Lite (~2K SLOC) | Full CFDP class 1–4 | Full CFDP | Full CFDP | n/a | n/a | n/a |
| Ground-loadable tables | 5 types, double-buffered atomic swap | Standard cFS tables | DB-backed config | Parameter tables | Limited support | n/a | n/a |
| MPU isolation | Per-task hardware MPU | Partial via OSAL | Linux / SELinux | Unclear | n/a | Per-task hardware MPU | n/a |
| Persistent state | BKPRAM + CRC16 verified | Unclear | U-Boot env vars | Unclear | FRAM / SD card | n/a | n/a |
| SEU detection | EDAC + memory scrub | n/a | n/a | Hooks for custom | n/a | n/a | n/a |
| HW CRC monitor | 8 regions, HW engine, zero CPU | Software checksum | n/a | Unclear | n/a | n/a | n/a |
| Ground station | Included: React + WebSocket | n/a | Major Tom (paid SaaS) | MCS (commercial add-on) | n/a | n/a | n/a |
| Deterministic RTOS | Custom hard-RT kernel | OS-dependent | Partial (RT + Linux) | RTOS-backed | FreeRTOS-based | Hard RT (Rust) | Soft RT |
| DO-178C docs Roadmap | Planned | n/a | n/a | n/a | n/a | n/a | n/a |
| Target hardware | Cortex-M7 (STM32H7) | ARM / PowerPC | Linux SBCs | MCU + Linux | ARM9 (iOBC) | Cortex-M | Cortex-M |
| Language | C | C | Rust + Python | C / C++ | C | Rust | C |
| License | OBC: Commercial • Kernel: Apache 2.0 | Apache 2.0 | Open source | Commercial | Commercial | MPL-2.0 | MIT (kernel) |
| Codebase | ~5.6K LOC, ~68 KB flash | ~100K+ LOC | Large | Unclear | Unclear | ~50K LOC | Varies |
| Community | New | Large (NASA-led) | Active | Enterprise | Enterprise | Growing | Massive |
| Flight heritage | Pre-launch | 40+ incl. JWST, LRO | Limited public data | 50+ deployments | Flown since 2014 | No space heritage | CubeSats (varies) |
| AI fault prediction Roadmap | Planned (PC + reg context) | n/a | n/a | n/a | n/a | n/a | n/a |
| Execution checkpoint Roadmap | Planned (resume-from-state) | n/a | n/a | n/a | n/a | n/a | n/a |
| MISRA C compliance Roadmap | Planned | n/a | n/a | n/a | n/a | n/a | n/a |
| Payload drivers Roadmap | Planned | Library available | Library available | Library available | Library available | n/a | n/a |
| Safety traceability Roadmap | Planned | n/a | n/a | n/a | n/a | n/a | n/a |
// icarus obc prime. the complete flight stack.
| Feature |
Mission Critical
Prime The flight-grade moat. |
|---|---|
| OS kernel | Prime (commercial) A commercial fork of the open-source ICARUS Core kernel: everything in Core, plus the advanced fault-tolerance primitives. |
| CCSDS TC/TM | ✓ |
| Sequencer | ✓ |
| CFDP-Lite | ✓ |
| GL tables | 5 types, double-buf Atomic swap with CRC validation. Update config in orbit. Zero-downtime reconfig. |
| Persistent state | BKPRAM + CRC16 |
| MPU isolation | Per-task HW MPU |
| SEU detection | ✓ |
| HW CRC | 8 regions, HW engine Hardware-accelerated. Continuous 8-region scan with zero CPU load. Catches SEU bit-flips the moment they happen. |
| FDIR | 7 types × 5 levels Hierarchical escalation: retry → isolate → swap → safe → recover. The satellite saves itself while you sleep. |
| Ground station | React + WebSocket Real-time telemetry dashboard out of the box. Live plots, alerts, command uplink. Ops starts on day one. |
| AI fault prediction Roadmap | On-device inference Lightweight model trained on instruction-pointer + program context. Catches anomalies before the FDIR chain fires. Predict, not react. |
| Execution checkpoint Roadmap | Resume from state Snapshots of registers, stack frames, and task state pinned to BKPRAM. After a fault, your task resumes from the last instruction, not from boot. Hours of science saved per anomaly. |
| Support | On-call engineer Dedicated engineer on pager rotation. Real humans answer when your sat starts misbehaving. Mission success is a shared KPI. |
| Mission integration | Full loop Weekly syncs, flight config reviews, pre-launch readiness checks. We own the integration outcome with you, not just the codebase. |
ICARUS OS Core
Apache 2.0The open-source RTOS kernel. Preemptive scheduler, MPU isolation, SVC gates. Fly it, fork it, use it commercially. The commercial ICARUS Prime kernel is forked from it.
View on GitHubICARUS Prime
CommercialCommercial kernel fork: everything in Core plus extended MPU and priority support. On the roadmap: AI fault prediction, execution checkpoint, AI runtime + SDK (bounded-WCET inference for quantized models). Sold standalone OR bundled with the Prime edition.
Contact for licensing// most RTOSes schedule tasks. ours also catches radiation.
// claims validated against public vendor docs & web sources on 2026-04-13.
| Feature | ICARUS Core | ICARUS Prime | FreeRTOS | Zephyr | RTEMS | Hubris | VxWorks |
|---|---|---|---|---|---|---|---|
| License | Apache 2.0 | Commercial | MIT | Apache 2.0 | GPL-2.0 / BSD | MPL-2.0 | Commercial |
| Language | C | C | C | C | C | Rust | C / C++ |
| Target hardware | Cortex-M7 | Cortex-M7 | Many MCUs | Many archs | 18 archs, 200 BSPs | Cortex-M (MPU) | Many |
| Per-task MPU isolation | ✓ | yes (extended) | Partial (MPU port) | ✓ | Partial | yes (required) | ✓ |
| Preemptive scheduler | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Persistent state (BKPRAM) | ✓ | ✓ | · | · | · | · | Via apps |
| HW CRC integrity scan | ✓ | ✓ | · | · | · | · | Via apps |
| SEU detection | ✓ | ✓ | · | · | · | · | Via apps |
| AI fault prediction | · | Planned | · | · | · | · | · |
| AI runtime + SDK (bounded WCET) | · | Planned | TFLM (app-level) | TFLM / microTVM module | · | · | TFLite + LEIP |
| Execution checkpoint | · | Planned | · | · | · | · | · |
| Kernel footprint | ~6 KB ITCM / ~52 KB flash | ~8 KB ITCM (est.) | 6–12 KB ROM | ~30–60 KB | Larger | ~10 KB ROM | Larger |
| Space flight heritage | Pre-launch | Pre-launch | CubeSats | Growing | Mars, TGO, ISS | None | Mars, InSight, Clementine |
| DO-178C certification | · | Planned | no (SafeRTOS is separate) | · | · | · | DAL A available |
| Community / ecosystem | New | New | Massive | Large | Medium (space) | Small | Paid enterprise |
| Price | Free | Per-mission | Free | Free | Free | Free | High ($$$) |
// note: cert and heritage go to VxWorks and RTEMS. We don't pretend otherwise. Our edge is the integration of space-specific fault tooling (HW CRC, SEU, persistent state, AI prediction) in a small Cortex-M kernel, not decades of deep-space missions.
Go deeper
- From the engineering blog: How we fit a satellite flight computer in 68 KB of flash: the design decisions behind the platform on this page, measured from the linker map.
- The radiation environment ICARUS's SEU detection and FDIR exist for, quantified: total ionizing dose vs. shielding and the single-event-upset rate your parts will actually see on orbit: both free calculators.
- All HawkLogic products: the catalogue, from the free calculator wing to flight software.
Let's talk.
Whether you're building something that needs to fly,
or something that needs to scale.
Message sent!
We've got your message and we're on it.
Check your inbox: we've sent you a confirmation from support@hawklogicsystems.com.
Expect a response from somebody @hawklogicsystems.com within 24-48 hours.
Something went wrong
We couldn't send your message. Our servers might be having a moment.
Try again or email us directly at founders@hawklogicsystems.com
