Resurrecting a Decade-Old Satellite: The BIRD-1 Recovery Story
0:00:47 Introduction to Disaster Recovery: The concept of disaster recovery in data centers is introduced, highlighting the importance of backup plans and recovery objectives. The talk transitions to discuss disaster recovery in the context of a satellite, comparing it to rocket science.
0:01:19 The Challenge: The speaker, a computer science student, details the mission to save a defunct satellite, BIRD-1, from becoming space junk.
0:01:41 Background on BIRD-1: Launched by TU Berlin, BIRD-1 is a 10x10x10 cm CubeSat designed for a one-year mission but placed in a 20+ year orbit. It experienced anomalies in 2011 and 2013, rendering it non-functional.
0:03:46 The Plan: The team's plan involved understanding the satellite's operation, diagnosing the problem, fixing it, and regaining satellite functionality.
0:04:02 Satellite Components and Communication: An overview of the satellite's subsystems, including the communication system and onboard computer, is provided. The communication system uses a half-duplex protocol, alternating between transmitting telemetry and receiving commands.
0:06:23 Satellite Location and Orbit: BIRD-1 is in a 700 km orbit, moving at 7.5 km/s, completing a revolution every 100 minutes. It passes over the ground station in Berlin twice daily, allowing for 10-15 minute communication windows.
0:08:08 Offline Telemetry: The satellite stores telemetry data every 90 seconds in flash memory and transmits it in bursts during each pass, along with live telemetry.
0:08:46 Diagnosing the Anomaly: The 2013 anomaly resulted in empty telemetry frames and a failure to stop transmitting after 60 seconds. Analysis revealed that configuration parameters were likely corrupted.
0:11:23 Flowchart Analysis: A detailed flowchart of the telemetry generation and transmission process is presented, pinpointing the faulty components related to configuration parameters stored in flash memory.
0:13:51 Theory of Corruption: The theory is that the boot counter update process, which erases and rewrites a flash page on every reboot, could corrupt the configuration parameters if a reset occurs during the process.
0:16:37 Testing the Theory: A telecommand was used to temporarily adjust the telemetry assembly time, successfully retrieving telemetry and confirming the theory.
0:18:04 Development Setup: Due to the original engineering model being dismantled, a Frankenstein model was created using parts from a later satellite model (BIRD-9).
0:19:15 Software Challenges: The team recovered source code and binaries but lacked symbol maps, requiring manual disassembly and symbol mapping.
0:19:51 Permanent Fix Strategy: The plan involved patching the onboard software to add upload functionality, allowing for both a software update and direct parameter fix.
0:21:05 Limitations and Risks: Challenges included limited time per pass, potential for resets wiping SRAM, and the risk of permanently corrupting flash memory.
0:22:37 Code Execution and Persistence: The team utilized a telecommand ("jump to image") to gain code execution and employed C++ virtual function tables to hijack control flow without modifying the original software in flash.
0:27:50 Bandwidth Issues: The limited bandwidth (4 bytes per telecommand, one command per second) posed a challenge for uploading the software update.
0:28:29 Workaround for Bandwidth Limitation: The team discovered and fixed an incompatibility in the telecommand protocol, enabling longer telecommands and faster data transfer by hijacking the interrupt handler.
0:30:49 Implementation and Testing: A three-step plan was devised, involving a safety image, a loader image, and the main software image. The safety image was uploaded to the least important parameter section to mitigate risks.
0:32:30 Unexpected Camera Activation: During the main image upload, an accidental flash dump command inadvertently activated the camera, which was previously thought to be non-functional.
0:33:58 Camera Functionality: The camera was discovered to be operational, capturing images of Earth, although with some exposure issues.
0:38:39 Current Status: Most of the satellite's subsystems are functioning, with only a minor sensor issue remaining.
0:39:03 Reliability Discussion: The talk concludes with a discussion on CubeSat reliability, highlighting BIRD-1's exceptional longevity compared to the average.
0:40:11 Q&A: The speaker answers questions about computer redundancy, documentation availability, satellite reboot frequency, flash memory retention, security, and more. They also explain why certain design choices were made and discuss potential future work.