LES-5 – Hacking the Telemetry Beacon?

LES-5 was recovered on March 24, 2020.  Since then I have completed a fair amount of research on the spacecraft and collected a number of published papers on the results of the experimental mission.  From those papers, I will lay out some possible methods to analyse the decoded telemetry from LES-5 such that we may be able to determine if the command receiver is still active.

Telemetry Beacon

The LES-5 telemetry beacon emits on 236.750MHz.  It uses BPSK at 100 bps.

"The doubled carrier is biphase-modulated (±90°) by the 100/sec telemetry bit stream."

Page 39, Lincoln Experimental Satellite-5 (LES-5) Transponder Performance in Orbit

The sampling interval of the telemetry beacon is 10.24 seconds.  Therefore, at 100 bps that provides 1024 bits of telemetry or 128 bytes.

"The basic sampling interval for LES-5 telemetry is 10.24 sec. The spin period of the satellite is about 5.3 sec."

Page 56, Lincoln Experimental Satellite-5 (LES-5) Transponder Performance in Orbit

I have so far be unable to find a paper documenting the telemetry format of the LES-5 satellite.  In order to understand some of the telemetry we will need to reverse engineer it.  As we will see there is an interesting possibility to perhaps do this using the RFI experiment on LES-5 which could lead to a path to determine if the command receiver is still operational.

Despite the lack of organized information Daniel Estévez has decoded the beacon’s telemetry.  After reviewing about an hours worth of telemetry before and after a solar eclipse used to identify LES-5 Daniel noted interesting patterns in the data he was decoding.  These observations make it possible that with some level of understanding about how some of the systems work on LES-5 that we could reverse engineer a means to determine if the command receiver still operates.

The RFI (Radio Frequency Interference) Experiment

The command receiver for LES-5 is shared with the RFI experiment in an interesting way.  In fact, a design flaw within the satellite causes the spacecraft to be unable to receive commands or provide useful RFI data during most of it’s orbit. Understanding the design and the flaws in the system could allow for the determination of the status of the command receiver and determine whether it is still operational.

Page 4, Lincoln Experimental Satellite-5 (LES-5) Transponder Performance in Orbit

The RFI experiment can scan 283MHz through 253MHz band in 256 steps.  This 30MHz wide spectrum is therefore subdivided into 117.1875KHz channels.  The system is designed to dwell on each step for 2.56 seconds.  Therefore, it will take 2.56s x 256 steps = 655.36 seconds (~11 minutes) to complete a scan.

"The LES-5 RFI instrument is a double-conversion, swept-superheterodyne receiver. The receiver is designed to tune from 283 MHz to 253 MHz in 256 steps of approximately 120 kHz each, dwelling at each step for 2. 56 sec. The time for a complete frequency scan is approximately 11 minutes. Fixed-frequency operation is available upon programmed control from the spacecraft timing system. frequency modes, the RFI instrument functions as a command receiver spacecraft."

Page 5, The Results of the LES-5 and LES-6 RFI Experiments

Two pieces of information are telemetered to Earth from the RFI experiment.  “Average Power” and “Peak to Average Power Ratio”.  Note the use of a crystal marker system.

Page 6, The Results of the LES-5 and LES-6 RFI Experiments

As you will have noted the RFI scan rate is 1/4 that of the telemetry sampling period of 10.24 seconds.  Therefore, four RFI samples can be collected within a telemetry sampling period.  This requires the spacecraft to have a way to parse those four samples into the telemetry sampling period.  This appears to be done by shifting the four samples into registers that are read out when the telemetry system reads out and sends the current telemetry sample period.  Therefore, eight bytes of telemetry data will be required for the RFI experiment’s data.

Page 12, The Results of the LES-5 and LES-6 RFI Experiments

As noted above the command receiver and the RFI experiment share the same hardware.  In order to do that they are sequenced to share the ~11 minute ‘scan’ cycle. Note the inclusion of the RFI with internal crystal frequency reference markers every 3rd RFI sweep cycle.

Page 8, The Results of the LES-5 and LES-6 RFI Experiments

With the knowledge of where the frequency markers are and the sequence interval of the RFI system it may be possible, assuming the related hardware is still operating, to find those telemetry frames with this data as they should repeat at a predicable interval.

Page 8, The Results of the LES-5 and LES-6 RFI Experiments

Therefore, at least once an hour for ~11 minutes there should be telemetry frames showing the calibration markers that are not visible in the rest of the hours telemetry frames.

Things That Go Bump in the Night…

It turns out there is also a design flaw in the timing system on LES-5 that was not discovered until the spacecraft was in orbit.

B. Principal Singular Effects for LES-5

"It was found after launch that the LES-5 RFI instrument stepped across its frequency range about twice as fast as it should. Experience has shown that this asynchronism, with the associated degradations of telemetry data, holds sway for about 17 hours of each 22-hour orbit (Fig. 9). The predictability with which the intervals of regular timing occur with respect to the orbit of LES-5 suggests that there is some on-board interaction between the command-logic unit on the one hand and the Earth and Sun sensors and their associated electronics on the other. Perhaps a train of extraneous pulses leaks into the VCO staircase generator during intervals of double-rate timing and, in combination with the proper pulse train, sends the stepper up the staircase faster than it should go. It can be seen by hindsight that the system testing of LES-5 before launch may not have been sufficiently extensive to uncover all such possible interactions."

Page 13 and 15, The Results of the LES-5 and LES-6 RFI Experiments

This means that during 17 hours of the orbit centred on the Sun and Earth being within the spacecraft sensors range the timing will be corrupted and the data from the RFI experiment will be useless.  But given that the effect is predictable data centred around local midnight will be useful to conduct the tests.

Page 14, The Results of the LES-5 and LES-6 RFI Experiments

Further complicating the situation is a known issue with the receiver for the system suffering a 17dB degradation on a seasonal basis.  This should only affect later testing to see if the receiver is actually working by sensing real world signals.

"An intermittent circuit failure in the transponder drastically affects the effective sensitivity of the LES-5 RFI instrument. The sensitivity was reduced by 17 db (near 255 MHz) during the interval 18 March - 14 November 1968. There followed several months of full-sensitivity operation, another such degradation occurring some time between 3 and 13 March 1969. It is expected that this cycle of performance states, probably associated with the seasonal variation of sun angle and on-board temperatures, will recur during the useful life of the spacecraft.*

*Note added in proof - It was noted on 2 December 1969 that the LES-5 transponder receiver had once again regained its full sensitivity."

Page 15, The Results of the LES-5 and LES-6 RFI Experiments

Conclusion

Assuming the crystal reference oscillator and related downstream hardware are still operational to the telemetry system, then it could be possible to identify the 8 bytes in the telemetry frames that are related to the RFI experiment.  Once identified further tests could be planned to determine if the command receiver is operational.

Advertisement