Glossary

Product names

Parsimoni Platform

Parsimoni Platform is the product that includes Space CLI, Space Store, Space CCSDS, and SpaceOS. The overview defines the role of each component.

Space CLI

Space CLI is the space command-line client. The CLI reference lists its commands.

Space Store

Space Store is the Platform application catalog. run.space is the hosted service.

Space CCSDS

Space CCSDS is the Platform's OCaml implementation of CCSDS protocols.

SpaceOS

SpaceOS is the on-board runtime for payload workloads. Platform architecture describes what runs on a node.

Platform terms, for space engineers

Composition

A composition is a signed system release. It records partitions and services. It also records shared storage and service interfaces.

Partition

A partition is the unit of isolation and supervision for one project's services. Its workloads run in a machine that belongs to it alone, and it can contain unikernels and Linux containers.

Tenant

A tenant is the trust domain a service runs in. In a project it is one partition; in a deploy that combines several projects it is one partition of one project.

Target and node

A target is a machine you deploy to, recorded on your computer by space target connect. A node is the SpaceOS system running on a target: a VM on your computer, a bench board, a cloud instance, or a payload computer in orbit.

Relay

The relay forwards frames from one source partition to the other partitions and the ground that space.yaml names, and carries telecommands back the reverse way. It authenticates each frame with SDLS and drops a frame that fails the check or exceeds the source's rate limit. The relay fields set its route and limits.

Supervision page

A supervision page is shared memory between the host and a partition. It carries liveness state and mission time. It also carries health state and the safe-mode command word.

Blue/green rollout

A blue/green rollout starts a new workload generation beside the active generation. A health check controls the switch.

Content store and root flip

The content store holds bootable images by digest. A root flip changes the pointer that selects the next image.

OCI image

An OCI image is a manifest and a set of content-addressed layers in the Open Container Initiative image format. SpaceOS uses this format to package Linux applications and unikernels. Platform architecture explains how a build packages them.

Registry

A registry stores and serves OCI images by name or digest.

Container

A Linux container isolates processes with kernel namespaces and resource limits, and shares the kernel of the machine it runs in. runc is the OCI container runtime SpaceOS uses, and a SpaceOS container runs inside its tenant's own machine.

Unikernel

A unikernel links one application with the operating-system libraries it needs. The result is a single-purpose machine image. Platform architecture explains how SpaceOS builds and runs them.

Solo5 and tenders

Solo5 defines a host interface for unikernels. A tender is the host executable that creates a sandbox and loads the unikernel: solo5-hvt runs it in a KVM virtual machine, and solo5-spt runs it as a seccomp-confined process.

dom0

dom0 is the control domain in a Xen system. It runs the management toolstack and can provide device backends. A dom0less Xen system starts guests without a control domain. SpaceOS has no Xen backend.

Content-addressed

Content-addressed data is named by a cryptographic digest of its bytes. The same bytes produce the same digest. A mutable tag such as :latest is not a content address.

IOMMU

An input-output memory management unit (IOMMU) restricts the physical memory that a device may access.

TPM

A Trusted Platform Module (TPM) stores cryptographic keys and monotonic counters outside the main processor.

dm-verity

dm-verity is the Linux block-integrity mechanism. It verifies filesystem blocks against a hash tree whose root is trusted by the boot configuration.

TUF

The Update Framework (TUF) is a model for signed update metadata. It uses a pinned root key, delegated roles, signature thresholds, and version checks.

CBOR

Concise Binary Object Representation (CBOR) is the binary data format defined by RFC 8949. It supports maps, arrays, strings, numbers, and byte strings.

COSE

CBOR Object Signing and Encryption (COSE) defines security envelopes for CBOR data. RFC 9052 defines the message structures.

Capability envelope

A capability envelope is the signed list of resources a partition may access.

Measured launch

A measured launch records the release selected for a boot before any of its services start. A target with a TPM holds that record in platform configuration register 11, which space-init extends with the release's 32-byte identity: the TPM sets the register to the SHA-256 of its old value followed by that identity, and no command can set it directly. Measured boot evidence says what the value proves.

SBOM

A software bill of materials (SBOM) is a machine-readable inventory of software components. SPDX and CycloneDX are common SBOM formats. space show --sbom prints the SBOM of a project, as the overview shows.

Ground

A ground is a control-plane endpoint named by URL. A connected target records the ground that serves it; commands can also select one with --ground.

Healthcheck

A healthcheck is a probe that reports whether an application can serve work.

Spacecraft terms, for software engineers

CCSDS

The Consultative Committee for Space Data Systems (CCSDS) publishes standards for spacecraft communications and data handling.

Telemetry and telecommand (TM/TC)

Telemetry (TM) carries measurements and state from a spacecraft. Telecommand (TC) carries instructions to a spacecraft.

APID

An Application Process Identifier (APID) is an 11-bit CCSDS packet label. It identifies the application data stream carried by a packet.

Frame bus

The frame bus is the on-board message channel between partitions, the flight domain, and the ground link. Each message is a fixed 256-byte frame, an 8-byte header and a 248-byte payload, labeled with an APID. The relay sends a frame's payload toward the ground inside a CCSDS Space Packet. The workload runtime contract gives the byte layout.

SCID / VCID

The Spacecraft Identifier (SCID) selects a spacecraft at the CCSDS link layer. The Virtual Channel Identifier (VCID) selects a logical channel within that spacecraft link.

SDLS

Space Data Link Security (SDLS), CCSDS 355.0-B, authenticates data-link frames. It can also encrypt them. SDLS protection terminates at each link hop.

OTAR and ML-KEM

Over-the-air rekeying (OTAR) replaces a link session key through the link. ML-KEM is the post-quantum key-encapsulation algorithm defined by NIST FIPS 203.

DTN

Delay- and disruption-tolerant networking (DTN) assumes that an end-to-end path may be unavailable. Nodes store data until a forwarding link is available.

BPv7 / BPSec

Bundle Protocol version 7 (BPv7) is the DTN protocol defined by RFC 9171. Bundle Protocol Security (BPSec) adds the security blocks defined by RFC 9172.

Endpoint ID and convergence layer

An endpoint ID names a BPv7 node or service. For example, ipn:7.1 names service 1 on node 7. A convergence layer carries bundles over a transport. Its convergence-layer adapter address identifies the transport endpoint.

CFDP

The CCSDS File Delivery Protocol (CFDP), CCSDS 727.0-B, transfers files over space links. It supports checkpoints and selective retransmission. A transfer can resume in a later contact window.

Payload

The payload is the part of a satellite that does the mission's work: its instruments and the payload computer that runs the mission's own applications. The flight computer that keeps the spacecraft alive is not part of it.

Pass

A pass is one overflight of a ground station. In low Earth orbit, a few hundred kilometers up, a pass lasts about ten minutes at most, and one station sees a few passes a day.

Contact window

A contact window is the period when a spacecraft can communicate with a specific ground station.

Uplink

Uplink is the ground-to-spacecraft direction of a communications link.

Downlink

Downlink is the spacecraft-to-ground direction of a communications link. The term also describes the act of sending data in that direction.

Acquisition

An acquisition is one observation recorded by an instrument. An Earth observation acquisition includes its capture time and ground footprint. It also records the map projection used for its pixels.

TLE

A two-line element set (TLE) describes an orbit at a stated epoch. Orbit propagation combines it with a ground station location to calculate contact times.

OBC

An on-board computer (OBC) is a computer installed on a spacecraft.

BSP

A board support package (BSP) contains the software needed to boot an operating system on one board. It normally includes the bootloader and kernel. It also includes the device tree and drivers.

RTOS

A real-time operating system (RTOS) provides bounded timing guarantees for specified operations.

Separation kernel

A separation kernel isolates partitions in memory and time. It can keep flight and payload trust domains separate on one physical computer.

Flight software / bus software

Flight software is the safety-critical software that controls the spacecraft. Bus software is the flight software that manages the spacecraft platform and its shared devices.

FDIR

Fault detection, isolation, and recovery (FDIR) covers fault detection, containment, and service recovery.

SEU

A single-event upset (SEU) is a state change caused by ionizing radiation. A bit flip in memory is a common example.

Ground segment

The ground segment contains the systems on Earth that operate a spacecraft and process its data. It includes ground stations and mission operations systems.