Ground segment nominal UTC ----.--.-- --:--:--

Mission Control

The operational picture for a small satellite operation. Contact windows computed from your elements, uplink commands queued with approval, downlink priority per spacecraft, and alert rules that fire on engineering values rather than on log lines.

Contact windows Command queue Role-based access Audit log Threshold alerts
14
Passes planned per spacecraft per day
6 min
Default alert evaluation period
100 %
Operator actions written to audit log
4
Roles available out of the box

Contact windows

A schedule is a set of windows with a start, an end and a usable arc. Everything in Mission Control is built around computing those windows honestly.

Computation

Upload a set of orbital elements — two-line elements, an CCSDS OEM file, or an ephemeris in the formats your propagator already produces. Helion propagates the orbit, computes the antenna look angles against each station's latitude, longitude and elevation, and reports the interval where the elevation mask is satisfied.

Three numbers come out of that computation for every pass: acquisition of signal, loss of signal, and the usable duration between them. The margin above the mask at the closest approach is reported alongside, because a pass that clears the mask by four degrees is a different pass from one that clears it by thirty.

  • Station coordinates from a built-in list or from your own file
  • Per-station elevation and azimuth masks
  • Propagation from SGP4, including the SGP4.2 corrections
  • Recomputation whenever the elements change
Visibility map with coverage zones and three ground station markers
Fig. 1 — Visibility zones with a 10° elevation mask. HA-CM-0033 rev D.

Overlaps and contention

When two spacecraft are visible from the same station at the same time, the station cannot serve both at full rate. Mission Control surfaces the overlap explicitly, ranks the candidates by downlink priority and by how long the other option would have to wait, and leaves the decision with the operator. Silent priority resolution is not offered, because the trade-off usually depends on which spacecraft is more tolerant of a delayed pass.

Missed passes

A pass that passed without downlink is recorded as a missed pass with the reason: the station did not connect, the acquisition failed, the spacecraft was not commanded, or the pass was intentionally skipped. The reason drives the alert rule, so a configuration mistake alerts differently from a hardware fault.

Uplink command queue

A command is an object with an author, an approval state and a delivery attempt. Nothing reaches the spacecraft without passing through the queue.

01 / DRAFT

Authored

The command is defined against a spacecraft and a command dictionary: an identifier, a payload, a timeout and a criticality flag. It sits in draft until submitted. Drafts are private to their author.

02 / REVIEW

Approved

Critical commands require a second operator to approve. The approver cannot be the author. Every approval is recorded with a timestamp and the identity of the approver, and the command becomes eligible for the next window.

03 / QUEUED

Scheduled

The command is attached to a contact window. Helion holds it until acquisition of signal and releases it inside the window, with the configured pre-transmission lead time applied so the command lands after the spacecraft has stabilised.

04 / SENT

Transmitted

Transmission is attempted with a bounded retry count. The attempt history, the round-trip time and the acknowledgement status are recorded against the command. A command that is not acknowledged before the window closes is marked expired, not sent.

05 / VERIFIED

Confirmed

Where the spacecraft returns a verification packet for the command, the verification is matched to the command by correlation identifier. The operator sees confirmed, unverified or rejected, with the verification packet attached.

06 / EXPIRED

Closed out

A command that did not make its window is expired and can be rescheduled against a later window without re-authoring. Expired commands are retained in the log; they are never deleted silently.

Idempotency keys. Every command carries a caller-supplied idempotency key. Submitting the same key twice returns the original command rather than queueing a second transmission, which matters when the client is retrying after a timeout it cannot distinguish from a failure.

Alerting

Rules are written against decoded parameters with units attached, evaluated on a rolling window, and delivered through channels that reach a human.

Rule types

THRESHOLD
Value above or below a limit, with a configurable dwell time so a single noisy sample does not page anyone.
TREND
Slope over a window, expressed per hour, with a minimum sample count. Useful for a battery that is trending down before it reaches a limit.
GAP
Telemetry gap longer than a configured duration for a spacecraft or virtual channel.
PASS
Missed pass, acquisition failure, or a downlink that completed below an expected volume.
COMMAND
Command expired, rejected, or unverified after transmission.

Delivery

Alerts route to email, to a webhook, or to a chat integration. Routing is per rule, so a battery warning can go to the operations channel while a pass failure goes to the person on call. Every alert records its evaluation, its state change and its delivery attempts.

Escalation

A rule can escalate: if it stays unacknowledged for fifteen minutes, it is re-routed to a second recipient group. Acknowledgement is explicit and is written to the audit log, because the question that matters after an anomaly is not whether the alert fired but who saw it.

Roles and access

Four roles out of the box, with grants scoped per spacecraft. The point is not the role names but what each one is allowed to do.

RoleView telemetryAuthor commandsApprove criticalManage accessChange rules
OwnerYesYesYesYesYes
OperatorYesYesYesNoYes
ViewerYesNoNoNoNo
AutomationScopedPre-approved setNoNoNo

Audit log

Every operator action is written to an append-only log: sign-ins, role changes, command authoring, approval, transmission, rule edits, exports and deletions. Each entry carries the actor, the action, the target, the timestamp in UTC and the request identifier, so an export of the log can be reconciled against an API call log.

Service accounts

Automation uses scoped tokens rather than operator credentials. A token carries an explicit list of permitted actions and an expiry, and it can be limited to a single spacecraft. Token creation and revocation are themselves audited, and a token cannot approve a critical command.

Integration

Mission Control is designed to be driven by software as much as by people, because most small operations already run their ground segment from scripts.

API

REST over HTTPS

Windows, commands, rules and grants are all available through the API. Idempotency keys on writes, cursor pagination on reads, and a versioned path so a breaking change is never silent.

WEBHOOKS

Signed callbacks

Pass events, command transitions and alert state changes are delivered as signed webhooks with a retry ladder and a replay window. Payloads are versioned alongside the API.

EXPORT

Schedules out

The contact window catalogue exports as CSV and JSON on a schedule, so an existing planning tool can read it, or a print of the week can go to the wall of the room where the passes are actually watched.

Plan the week, not the pass

Bring your elements and your station list. We will compute a week of windows and show you the overlap before you commit.