Helios-RH
Flight computers and sensor buses that keep working inside a reactor hall and beyond the Van Allen belts.
VGA-AFC · Integrated flight control
Aegis-FCS
Three lanes that are allowed to disagree, and a rule that settles it in eight milliseconds.
Aegis-FCS is a triplex flight control and display suite for transport-category aircraft, certified to DO-178C Design Assurance Level A and DO-254 at the same level. It is the programme most of our flight hours sit on.
DAL-ADO-178C
Design assurance
100Hz
Control loop
< 8ms
Sensor-to-surface latency
4.2million
Fleet hours
01 — Why it is built this way
Three lanes, dissimilar where it matters
Three independent computing lanes run the same control law on two different processor architectures compiled by two different toolchains. Identical hardware running identical software triplicates the hardware faults and none of the design faults.
A voter you can explain to an auditor
Mid-value selection with a bounded disagreement window and a documented lane-isolation rule. No heuristics, no tuning constants that somebody set empirically in 2011 and nobody can now justify.
The evidence is written as the code is
Requirements, code and verification cases are produced together and traced continuously, not reconstructed before a stage-of-involvement audit. It is slower for the first six months and much faster for the following two years.
Reversion that has been flown, not just analysed
The direct-law reversion path has been exercised in flight test, not only demonstrated in the rig. Every failure mode in the safety assessment has a corresponding test report.
02 — Origin
Why there are three and not two
Two lanes can tell you that something is wrong. They cannot tell you which one is lying. That single sentence is the whole architecture.
Aegis began as a retrofit programme in 2009 for a regional turboprop operator whose existing dual-channel system was generating nuisance disconnects. The disconnects were not faults — they were the system correctly detecting a disagreement it had no way to resolve, and taking the only safe action available to it.
Adding a third lane turned an unresolvable disagreement into an outvoted one. Nuisance disconnects fell to near zero in the first year of the retrofit fleet, and the architecture has not changed in principle since.
03 — Architecture
Aegis-FCS triplex architecture
The three lanes, the cross-lane comparison and the reversion path. Select a callout for detail.
Callout 01
Dissimilar lanes
Lanes A and C run one processor architecture; Lane B runs another, compiled by a different toolchain from the same requirements. A compiler defect or an architecture erratum cannot take all three lanes at once.
Callout 02
Cross-lane comparison
Each lane publishes its computed command and its own health assessment. Comparison happens every frame at 100 Hz, with a disagreement window sized from the sensor error budget rather than picked by feel.
Callout 03
Mid-value voter
The middle of three values is selected. A lane outside the window for more than three consecutive frames is isolated, annunciated and excluded until maintenance action. The rule is four lines long and fully specified.
Callout 04
Direct-law reversion
If fewer than two lanes remain valid the system reverts to a direct law with a simplified control path and a clear crew annunciation. This path has been exercised in flight test.
Callout 05
Built-in test
Continuous background monitoring plus a power-up self-test. Findings are stored to non-volatile memory with a timestamp and downloaded at maintenance rather than only being shown on the flight deck.
Callout 06
Triplicated sensing
Three independent air data and inertial sources. Sensor disagreement is resolved by the same voting rule as the control lanes, so there is one comparison philosophy in the aircraft, not two.
04 — Detail
The certification argument
The hard part of a DAL-A programme is not the code. It is being able to show, two years later, why every line of it exists.
Software, DO-178C DAL-A
Requirements-based testing
Every test case traces to a high-level or low-level requirement. Tests written to chase coverage without a requirement behind them are rejected in review.
Modified condition/decision coverage
Full MC/DC on the airborne software, with the analysis produced from the same harness used for functional test rather than a separate instrumented build.
Tool qualification
The verification tools that could fail to detect an error are qualified to TQL-5, with their own qualification data package.
Hardware, DO-254 DAL-A
Elemental analysis
Applied to the programmable logic devices, with the analysis traced to requirements the same way the software is.
Single-event effects
Neutron-induced upset assessed at altitude flux, with mitigation in the fabric rather than a reliance on the watchdog.
Independence
Hardware verification is performed by engineers who did not produce the design data. This is a staffing cost and it is not negotiable.
| Architecture | Triplex, dissimilar |
|---|---|
| Design assurance level | ADO-178C / DO-254 |
| Control loop rate | 100Hz |
| Sensor-to-surface latency | < 8ms |
| Lane disagreement window | ±0.6 of sensor error budget |
| Isolation threshold | 3 consecutive frames |
| Data buses | ARINC 429, ARINC 664 p7 |
| Display interface | ARINC 661 server |
| MTBF, per lane | 42,000hours |
| Weight, per lane | 6.2kg |
| Cooling | Conduction, no forced air |
| Fleet hours accumulated | 4,210,000hours |
Full interface control documents, environmental qualification reports and the traceability matrix are released under NDA. Ask for the document index rather than a brochure.
Request the document index05 — Qualification
How a unit gets signed off
PHASE 01
Certification planning
Plan for Software Aspects of Certification and the hardware equivalent agreed with the authority before design work starts. Getting this wrong is the single most expensive mistake available on a DAL-A programme.
PHASE 02
Requirements capture and review
High-level requirements reviewed with the airframer and the authority. Every subsequent artefact traces here.
PHASE 03
Design and implementation
Code and hardware produced against reviewed requirements with continuous traceability, not a reconstruction exercise before the audit.
PHASE 04
Rig integration
Full triplex integration against a simulated airframe on the iron bird at Wichita, including injected faults for every case in the safety assessment.
PHASE 05
Stage-of-involvement reviews
Four formal reviews with the authority. We run a full internal rehearsal before each one — see the story on what that costs and what it saves.
PHASE 06
Flight test and certification
Including a flown demonstration of the direct-law reversion path rather than an analytical argument for it.
06 — Where it is built
Wichita, where it meets an airframe
Aegis is designed in Chantilly and integrated in Wichita, on an iron-bird rig that carries a full triplex installation against a simulated airframe. Every fault in the safety assessment is injected on that rig before anything is installed on an aircraft.
The rig is deliberately over-instrumented. We record more than we need because the questions that matter during certification are usually the ones nobody thought to ask during design.
Certification support for European operators runs out of Toulouse, close to the authority and to the airframers we work with most.
07 — Who uses it
Regional operators
Retrofit installations across three regional turboprop and jet fleets since 2011.
Airframers
Forward-fit on two clean-sheet programmes, in both cases as a subsystem under the airframer's type certificate.
MRO networks
Line-replaceable unit exchange and repair through four approved maintenance organisations.
Next step
Send us the environment, not the part number.
Tell us what it has to survive and how long it has to keep working. We will tell you whether Aegis-FCS is the right answer — including when it is not.
Talk to an engineer