Telemetry Hub

Ingest edge

A regional collector terminates mutual TLS from the station and buffers the stream on local disk before acknowledging. The acknowledgement means the frame is on durable storage at the edge, not that it has been committed downstream. A station that loses uplink mid-pass retransmits from its own queue; the edge deduplicates on spacecraft, APID and sequence counter.

Frame validator

Primary header checks run first: version, spacecraft identifier, virtual channel, frame count and the frame length against the declared size. The secondary header follows, then the CRC where the frame carries one. Each rejection carries a reason code and lands in the rejection ledger, visible in the API and exportable as a CSV.

Packet demultiplexer

Valid frames are split into space packets on the packet length field in the primary header. Packets are routed by APID to the spacecraft's mission dictionary. An APID with no mapping is written to an unmapped bucket with its bytes intact, which turns an incomplete dictionary into a visible queue instead of a silent loss.

Decoder

The secondary header is interpreted according to the spacecraft's declared header type: a packed time code, a coarse-fine time pair, or a raw counter to be scaled. Payload fields are scaled and offset into engineering units, and the scale factors are recorded with the value so a later change to the dictionary does not rewrite history.

Commit and export

Decoded parameters are committed to a columnar store keyed by spacecraft, APID, parameter and spacecraft time. The raw frame is written to your object storage bucket under a deterministic path. The write is idempotent: the same frame submitted twice produces one record and one object.

Query and delivery

The API exposes parameter history over HTTP, filtered by spacecraft, APID, parameter and time range. Scheduled exports write CDF, CSV or Parquet to your bucket on a cron expression you define, and the API can trigger an on-demand export of a single pass.

Common Data Format

CDF, as used across the planetary science community. Each parameter becomes a variable inside a CDF file with its own metadata: units, valid minimum and maximum, fill values and the offset used at decode time. CDF is the right choice when the next consumer of the data is a tool that already speaks it.

CSV

Long-format CSV, one row per sample: spacecraft, apid, parameter, value, unit, spacecraft time, receive time, quality flag. It is unglamorous and it opens in anything, which is exactly why it survives contact with a spreadsheet at eleven in the evening during an anomaly review.

Parquet

Columnar Parquet with Snappy compression, partitioned by spacecraft and day and written with statistics that let a query engine prune files before opening them. This is the format to pick when the destination is a warehouse and the questions are aggregations rather than single samples.

Amazon S3

Exports write to a bucket in any supported region through an IAM role or an access key pair scoped to a single prefix. Objects are written with server-side encryption using your key or an AWS-managed key. Lifecycle rules on the destination bucket are respected by Helion as the source of truth for object expiry.

For operators already using S3 as the archive of record, the raw frame prefix and the derived prefix can be separated so that access policy on the raw archive can be stricter than on the derived data.

Google Cloud Storage

Exports use a service account with the roles needed for object creation on a single bucket. Customer-managed encryption keys are supported, so an operator with a key-management policy applies it to the archive rather than trusting a platform default.

BigQuery external tables can be pointed at the Parquet prefix directly, which removes the copy step between an export and an analytics query.

Everything else

Any endpoint that speaks the S3 API is accepted: Ceph RADOS Gateway, MinIO, Wasabi, Cloudflare R2 and comparable private storage. Helion is tested against Ceph and MinIO in the integration suite, so the behaviour is not inferred from API compatibility alone.

Private connectivity

Where a policy forbids a public endpoint, a dedicated egress IP can be allow-listed, or a private link can be established into your region. The ingest edge supports both, and the station stream terminates on the same endpoint regardless of which path is used.