On-Board Computing, Radiation SEU & Watchdogs

The on-board computer and command-and-data-handling (OBC/CDH) subsystem forms the operational core of a small satellite: it validates and executes ground telecommands, collects and frames housekeeping telemetry, schedules payload tasks, maintains spacecraft time, and governs autonomous mode transitions. In a centralized topology a single microcontroller drives peripheral devices directly, whereas distributed avionics place local microcontrollers on each board so faults can be isolated across deterministic serial buses.

Small-satellite backbones pair short-haul board interfaces such as I²C, SPI, and UART with noise-immune differential links including RS-485, CAN, or high-rate SpaceWire on larger platforms. For 42.0 × 42.0 mm PocketQube stacks, the PQ9 interface replaces bulky CubeSat pass-through connectors with a lean 9-pin RS-485 bus and unregulated power lines—flown on the 3P Delfi-PQ—while its 14-pin CS14 counterpart brings the same compact philosophy to modular CubeSat backplanes.

Processor selection balances energy per instruction against single-event resilience. Constrained 1P and 1U missions favour FRAM-based MSP430FR devices or Arm Cortex-M4 STM32 microcontrollers running lightweight kernels such as FreeRTOS, Zephyr, or hard real-time RTEMS, whereas radiation-tolerant Cortex-M7 parts (SAMV71Q21RT) and Arm-plus-FPGA systems-on-chip (Zynq-7000, Cyclone V) execute image compression and software-defined radio chains. Because the reference 1P power budget allocates only ≈15 mW average to the OBC out of ≈0.55 W orbit-average generation, the processor remains asleep for most of every 95.1-minute orbit.

In 500–550 km Sun-synchronous low Earth orbits, picosatellites and nanosatellites carry thin structural shielding—typically 1.0–1.5 mm of aluminium or 1.6 mm of FR-4 laminate—yet their 1.5–3 year orbital lifetimes limit cumulative Total Ionizing Dose (TID) to roughly 1–4 krad(Si) (≈0.5–2.5 krad(Si) per year behind 1 mm Al). Modern commercial off-the-shelf (COTS) CMOS microcontrollers, transceivers, and linear regulators routinely survive 5–20 krad(Si), and commercial OBC assemblies declare 10–300 krad(Si) tolerance.

The dominant avionics hazard in LEO is therefore not gradual threshold-voltage drift from TID, but instantaneous Single-Event Effects (SEEs) triggered by energetic protons (>30 MeV) trapped in the South Atlantic Anomaly (SAA) and by polar galactic cosmic rays. A non-destructive Single-Event Upset (SEU) flips a bit inside SRAM, CPU registers, or Flash configuration cells, whereas a Single-Event Latch-up (SEL) fires a parasitic thyristor across bulk CMOS, creating a low-impedance supply-to-ground short that thermally destroys the die unless quenched within milliseconds.

Resilient memory hierarchies segregate bulk storage from critical state. NAND/NOR Flash provides high density for payload files but endures only ~10⁵ write cycles with slow page-erase latency. Ferroelectric RAM (FRAM, enduring up to 10¹⁴ write cycles with fast, low-energy writes) and Magnetoresistive RAM (MRAM, ~10¹³ cycles) store boot counters, orbital parameters, and inhibit timers in non-volatile polarization or magnetic states immune to proton bit flips, reinforced by Triple Modular Redundancy (TMR) voting and periodic CRC-32 scrubbing.

Flight software is structured as a deterministic finite-state machine spanning four operating modes. Upon deployer separation, Launch / Deployment Wait keeps RF amplifiers and thermal knives strictly off until an elapsed-time counter reaches 30–45 minutes; storing that counter in FRAM ensures a cold-eclipse brown-out resumes the countdown rather than restarting from zero. Next, Detumbling & Antenna Release executes B-dot magnetic damping and fires primary and backup burn resistors before entering Nominal operations (beacons every 30–120 s and payload scheduling when V_bat ≥ 3.75 V) or dropping into Safe Mode below V_bat < 3.45 V.

Because SEUs, I²C bus lockups, and brown-out transients are routine in orbit, flight-proven small satellites implement a three-tier recovery chain. In Tier 1, a software supervisor task verifies heartbeat flags from communications, attitude, and sensor threads before pulsing the watchdog line. In Tier 2, an independent external hardware window-watchdog IC toggles hard reset if the MCU core, crystal oscillator, or internal peripheral timer freezes simultaneously during a radiation event.

Tier 3 resides in the electrical power system: fast per-rail current-limiting switches (t_trip < 1 ms) quench destructive SEL currents and re-power the branch after a cooldown delay, while an autonomous EPS bus timer executes a hard power-cycle if valid I²C or RS-485 frames from the OBC stop for 12–24 hours. Direct hardware cross-links add further resilience—on Grizu-263A, a lost radio-to-OBC link triggered the transceiver to report an error code directly to the EPS—while dual-image bootloaders with integrity checks provide safe fallback during in-orbit software updates.

Downlink protocol design determines whether marginal low-elevation passes deliver usable science or are discarded. Legacy amateur CubeSats relied on uncoded AX.25 UI frames with 16–20 B callsign headers, 2 B CRC checks, and HDLC bit-stuffing, which aborts an entire frame if a single bit flips inside an 0x7E flag while requiring E_b/N_0 ≈ 13.4 dB for BER = 10⁻⁵ on non-coherent 2-FSK. Wrapping CubeSat Space Protocol (CSP, 4 B header) in a CCSDS RS(255,223) block code (correcting up to 16 byte errors) or concatenating rate-1/2, constraint-length-7 convolutional or CCSDS LDPC codes yields 4–7 dB of coding gain.

Net daily data volume scales with station contact geometry and framing overhead. A 525 km SSO spacecraft (~15.14 revolutions/day) provides ~22–25 minutes of visibility per day across four to six passes above a 10° elevation mask at 40° latitude—cut by more than half if local noise forces a 20° mask. Accounting for 8–16 B preambles, 4 B sync markers, parity bytes (η_frame ≈ 0.78 for AX.25 on 128 B payloads vs. ≈0.85 for CSP + RS), and 70–85% half-duplex transmit duty, a 4800 bit/s UHF link delivers ~520 kB/day gross (~350–450 kB/day payload net of ~40 kB/day beacons).

Telemetry content and open decoding multiply operational reach. On the 237 g 1P Grizu-263A, each beacon packed 31 housekeeping fields—identification and timestamps, internal temperature, 14 currents and voltages across seven INA-type monitors, and nine IMU channels—transmitted at five frames every 10 s. Publishing unencrypted Kaitai Struct (.ksy) and gr-satellites descriptors before launch enabled worldwide SatNOGS stations to decode frames automatically from early passes while authenticated telecommands protected the mandatory ITU transmitter shut-down link.