Helios-RH
Flight computers and sensor buses that keep working inside a reactor hall and beyond the Van Allen belts.
VGA-SNT · Ground and air traffic systems
Sentinel-ATM
One track per aircraft, assembled from six sources that never quite agree.
Sentinel-ATM is surveillance data fusion and controller tooling for regional air navigation service providers — the layer between a collection of sensors and a controller who needs one unambiguous picture.
6supported
Sensor types
1,200
Tracks, concurrent
1s
Display update
99.99%
Availability
01 — Why it is built this way
Fusion, not selection
A track is built from every source that can see the aircraft, weighted by each source's measured accuracy in that volume. Systems that simply pick a preferred sensor inherit that sensor's blind spots wholesale.
Disagreement is displayed, not hidden
When sources disagree beyond the expected envelope the controller is told. Quietly averaging a conflict away produces a confident display and an uninformed controller.
Recording that satisfies an investigator
Every input, every fused track and every display state is recorded and replayable. An investigation should not depend on what somebody remembered to screenshot.
Built for the size of service that exists
Most air navigation providers are not continental. Sentinel is sized and priced for regional operations, and it does not require a programme office to run.
02 — Origin
The aircraft that was in two places
A regional provider asked us to look at intermittent duplicate tracks — one aircraft appearing twice, a few hundred metres apart, for a few seconds at a time, always in the same sector.
The cause was a boundary between two radar coverage volumes where the existing system switched preferred source. During the switch it briefly maintained both tracks. Every individual component was working exactly as specified.
Fusing rather than selecting removed the class of problem rather than that instance of it. That distinction — fixing the class, not the instance — is what the programme is built around.
03 — Architecture
Sentinel-ATM fusion pipeline
Six input classes, one track store, and a recording tap that sees everything.
Callout 01
Normalisation and time alignment
Sources report on different cadences with different latencies. Everything is brought to a common time base before fusion, because fusing misaligned reports produces a smooth track that is confidently wrong.
Callout 02
Weighted fusion
Each source contributes in proportion to its measured accuracy in that volume — measured from the provider's own recorded data, not taken from a datasheet.
Callout 03
Track store
Up to 1,200 concurrent tracks with full history. Identity is maintained across coverage boundaries, which is precisely where naive systems drop and re-acquire.
Callout 04
Safety nets
Short-term conflict alert and minimum safe altitude warning computed from the fused picture, with thresholds tuned against replayed live traffic rather than defaults.
Callout 05
Recording and replay
Every input, every fused track and every display state, replayable at any speed. Investigations and controller training run from the same archive.
Callout 06
Controller working position
Designed with the controllers who will use it, over successive sessions against replayed traffic. Label decluttering rules in particular cannot be designed from a specification.
04 — Detail
Fitting an existing operation
Nobody replaces an air traffic system in one step. Sentinel is built to arrive alongside what is already there.
Transition
Shadow mode
Runs alongside the incumbent system on live data for as long as the provider wants, producing a comparison record rather than an assurance.
Source by source
Sensors are migrated individually. There is no day when everything changes at once.
Rollback
A documented and rehearsed path back to the incumbent, exercised during commissioning rather than assumed.
Interfaces
ASTERIX throughout
Standard EUROCONTROL categories for input and output, so the system is replaceable — including by something that is not ours.
Open recording format
The archive is documented and readable without our software. A recording you can only read with the vendor's tool is not really evidence.
Flight data integration
AFTN and flight plan correlation with manual override where the correlation is ambiguous.
| Input categories | ASTERIX CAT 001/002/021/034/048/062 |
|---|---|
| Output category | ASTERIX CAT 062 |
| Concurrent tracks | 1,200 |
| Display update rate | 1s |
| Fusion cycle | 250ms |
| Safety nets | STCA, MSAW, APW |
| Recording | All inputs, tracks and display state |
| Replay speed | 0.25× to 16× |
| Availability, dual node | 99.99% |
| Failover time | < 4s |
| Flight data | AFTN, FPL correlation |
| Working positions | up to 24 |
Full interface control documents, environmental qualification reports and the traceability matrix are released under NDA. Ask for the document index rather than a brochure.
Request the document index05 — Qualification
How a unit gets signed off
STEP 01
Coverage survey
Actual sensor performance measured across the operational volume from the provider's own recordings, rather than assumed from siting data.
STEP 02
Fusion tuning
Source weightings derived from that survey, so the model matches the real installation and not a generic one.
STEP 03
Shadow operation
Sentinel runs alongside the incumbent on live data, producing a continuous comparison record for as long as the provider wants it.
STEP 04
Controller evaluation
Working position design refined with the controllers who will use it, against replayed live traffic.
STEP 05
Safety case
Built from shadow-mode evidence, which means it rests on measurement rather than on argument.
STEP 06
Progressive cutover
Source by source, position by position, with a rehearsed rollback at every step.
06 — Where it is built
Farnborough and Singapore
Sentinel is developed and supported from Farnborough, with Asia-Pacific installations supported out of Singapore. Both sites keep a full replay environment loaded with each customer's recorded traffic.
That matters more than it sounds. When a provider reports odd behaviour we reproduce it against their own data, in their own airspace geometry, usually the same day.
Controller evaluation sessions are run at the customer's operations room wherever possible. A simulator in our building tells you less than a bad afternoon in theirs.
07 — Who uses it
Regional ANSPs
Three regional air navigation providers run Sentinel operationally.
Military airfields
Two joint-use airfields with mixed civil and military traffic.
Training organisations
Replay environments supplied for controller training at two academies.
Next step
Send us the environment, not the part number.
Tell us what it has to survive and how long it has to keep working. We will tell you whether Sentinel-ATM is the right answer — including when it is not.
Talk to an engineer