Aegis-FCS
A triplex flight control and display suite certified to DO-178C Design Assurance Level A.
VGA-HRH · Radiation-hardened avionics
Helios-RH
A flight computer that does not care how much radiation it has already absorbed.
Helios-RH is our radiation-tolerant processing family: a flight computer, a sensor front end and a bus interface that share one qualification pedigree. It flies on small satellites, and it sits behind shielding in reactor halls where nobody is going to swap a board out.
300krad(Si)
Total ionising dose
> 85MeV·cm²/mg
Latch-up immunity
−55 to +125°C
Operating range
1.84kg
Module mass
01 — Why it is built this way
Nothing on the board is there by accident
Every active part carries a radiation lot acceptance test we either witnessed or commissioned. Where a part had no usable data we tested it ourselves at a cyclotron rather than derating on a guess. The parts list is an argument, and it is written down.
Triple redundancy that fails quietly
The processing core is triple-modular-redundant with a hardware voter. A single-event upset in one lane is corrected, logged and reported over the housekeeping channel. The host system never sees a glitch — it sees a counter increment.
Memory that scrubs itself
All SRAM is protected by single-error-correct double-error-detect coding with a background scrubber that walks the full array every 90 seconds. Multi-bit accumulation is the thing that kills long missions, and scrubbing is what stops it.
Qualified once, reused honestly
Because the satellite variant and the reactor variant share a core, a customer in one domain inherits eleven years of flight and operating history from the other. We publish which parts of the evidence carry across and which do not.
02 — Origin
Named for a problem, not a god
Helios started in 2014 as an internal rebuild of a customer's failed telemetry board. The unit had been flying an eight-month sun-synchronous mission and its housekeeping data had been degrading steadily since week three. The customer assumed a thermal problem.
It was not thermal. The SRAM had no error correction and the mission had accumulated enough upsets that the calibration table was quietly corrupting. Nobody had specified scrubbing because nobody had specified a dose budget.
We rebuilt the board with EDAC and a scrubber, and then rebuilt the process that had let it ship without one. Helios-RH is the second thing — the process — with hardware attached.
03 — Architecture
Helios-RH signal chain
The processing chain from sensor head to host bus. Hover or select a callout to read what each stage is responsible for.
Callout 01
Triplicated analogue front end
Three independent gain chains measure the same input. Divergence between lanes past 0.4% of full scale raises a flag before any value reaches the converter, which catches a degrading channel long before it produces a plausible-but-wrong reading.
Callout 02
Triple-modular-redundant core
The processing core runs three copies of the same logic into a hardware majority voter. A single-event upset is outvoted and the affected lane is re-initialised within one frame. Nothing downstream observes an interruption.
Callout 03
Scrubbed program and data store
Single-error-correct double-error-detect coding on every word, with a background scrubber that walks the full array every 90 seconds. This is what prevents slow multi-bit accumulation over a seven-year mission.
Callout 04
Independent watchdog
Deliberately on its own die, its own oscillator and its own power rail. A watchdog that shares a supply with the thing it is watching is decoration.
Callout 05
Latch-up protected supplies
Each rail is current-limited below the destructive latch-up threshold measured during the heavy-ion campaign, with an autonomous power cycle and an event log entry if the limit trips.
Callout 06
Housekeeping and upset accounting
Every corrected upset, scrub hit and lane re-initialisation is counted and downlinked. Operators get a live picture of how much margin the mission has actually used.
04 — Detail
What is actually inside
Helios-RH ships in three build standards that share a core and differ in their interface and qualification package.
Build standards
HRH-100 — orbital
Sun-synchronous and low Earth orbit smallsat platforms. SpaceWire and CAN interfaces, conformal coated, 7-year design life.
HRH-200 — in-plant
Reactor hall and hot-cell installations behind fixed shielding. 1553B and hardwired SIL-rated discrete outputs, 25-year design life.
HRH-050 — evaluation
Functionally identical, commercially screened parts, no radiation pedigree. For software development so the flight units are not burned in on lab work.
Design choices we will defend
No commercial DRAM anywhere
Density is tempting and the upset cross-section is not worth it. All volatile storage is SRAM with EDAC.
Analogue redundancy, not just digital
Most radiation-tolerant designs triplicate the processor and leave a single analogue path. The front end is where slow degradation actually shows first.
One bootloader, immutable
The boot path is in fuse-programmed storage and cannot be updated in the field. Every remote update risk we have seen traces back to a writable boot image.
| Processing core | RH FPGA, TMR soft core |
|---|---|
| Total ionising dose | 300krad(Si) |
| Single-event latch-up | None to 85MeV·cm²/mg |
| Upset rate, 705 km SSO | < 1.2 × 10⁻⁵upsets/device/day |
| Analogue channels | 24 differential |
| Converter resolution | 16bit |
| Sample rate | 200kSPS/channel |
| Host interfaces | MIL-STD-1553B, SpaceWire, CAN |
| Power, typical | 9.4W |
| Mass | 1.84kg |
| Operating temperature | −55 to +125°C |
| Design life | 7 (orbital) / 25 (in-plant)years |
Full interface control documents, environmental qualification reports and the traceability matrix are released under NDA. Ask for the document index rather than a brochure.
Request the document index05 — Qualification
How a unit gets signed off
STEP 01
Part selection and radiation survey
Every candidate active part is screened against existing lot data. Anything without usable evidence goes on the test list rather than into a derating assumption.
STEP 02
Total ionising dose campaign
Cobalt-60 exposure in stepped increments with bias applied throughout, measured at each step rather than only at the end, so the failure mode is visible and not just the failure point.
STEP 03
Heavy-ion single-event testing
Beam time to establish latch-up threshold and upset cross-section across the linear energy transfer range the mission actually sees.
STEP 04
Thermal vacuum and thermal cycling
Eight cycles across the full operating range under vacuum, with functional test at both extremes rather than only at ambient.
STEP 05
Vibration and shock
Random vibration to the launch environment, then a full functional and a re-run of the analogue calibration to catch anything that shifted.
STEP 06
EMI/EMC qualification
MIL-STD-461G emissions and susceptibility, including the conducted-susceptibility cases that most schedules skip.
06 — Where it is built
Built in Chantilly, proved in three places
Helios boards are assembled and integrated at our Chantilly facility, in a controlled area that handles the radiation-screened part inventory separately from everything else. Traceability runs to the lot, not the part number.
Irradiation is done externally — we do not own a cyclotron and would not pretend to. Campaigns are witnessed by our own engineers, and the raw data comes back to us rather than a summary certificate.
Software verification runs out of Ottawa, where the independent V&V team is organisationally separate from the developers. They get the requirements and the binary, not the source commentary.
07 — Who uses it
Orbital operators
Four smallsat constellation operators fly Helios-derived avionics, the earliest continuously since 2019.
Research reactors
Two university research reactors and one national laboratory run HRH-200 measurement chains.
Defence primes
Used as a qualified subassembly inside larger mission systems where the prime owns the certification.
Next step
Send us the environment, not the part number.
Tell us what it has to survive and how long it has to keep working. We will tell you whether Helios-RH is the right answer — including when it is not.
Talk to an engineer