The box that
keeps
counting
Flight computers, power electronics and the software that runs on them. Nine point seven million on-orbit hours so far, and one watchdog reset we still talk about.
MARLIN‑3
Radiation-tolerant flight computer
A single-board computer built around a rad-tolerant SoC with lockstep cores, ECC on everything that holds state, and a supervisor that can power-cycle the main processor without losing the housekeeping log. Conformal coated, screened and burnt in for 72 hours before it ships.
| Processor | Dual-core lockstep, 800 MHz, rad-tolerant SoC |
|---|---|
| Memory | 512 MB DDR3 with ECC · 8 GB NAND, wear-levelled |
| Total ionising dose | 30 krad(Si) qualified |
| Single-event latch-up | Immune to 62 MeV·cm²/mg |
| Interfaces | SpaceWire ×4, CAN ×2, RS-422 ×8, Gigabit Ethernet ×2 |
| Power | 7.4 W typical, 11 W peak at 28 V |
| Mass | 1.24 kg with chassis |
| Status | Qualified 2023 · 47 units in orbit |
Every commit runs the full regression on real hardware, not an emulator. The rack has eleven engineering models in it and a queue that clears in about forty minutes.
SEINE
flight stack
A layered flight software framework we have shipped on 41 programmes. Customers can take the whole thing, or take the scheduler and telemetry layers and write their own application on top.
Core services
Deterministic scheduler, PUS-compliant telemetry and telecommand, on-board file store, time synchronisation to better than 250 µs.
GNC
Attitude determination from star tracker, magnetometer and gyro, reaction wheel and magnetorquer control, orbit propagation and manoeuvre planning.
FDIR
Fault detection, isolation and recovery with a survival mode that has recovered four spacecraft, two of them ours and two somebody else's.
Ground interface
Mission control adapters, automated pass scheduling, and a simulator that runs the same binary you are about to uplink.
-
SW-01
Requirements to code
Requirements held in DOORS Next, traced to source files and to tests. Nothing merges without both links. Reviewers are named in the record.
-
SW-02
Static analysis
MISRA C:2012 with a documented deviation list, plus abstract interpretation for runtime errors. Deviations need an engineer's signature and a reason that is not “legacy”.
-
SW-03
Hardware-in-the-loop
Eleven benches running flight-representative boards. Overnight campaigns inject bit flips, dropped packets and power interruptions at randomised phases of the control cycle.
-
SW-04
Independent verification
A separate team writes the verification cases from the requirements, without reading the implementation. It is slower and it is the reason the FDIR works.
If you cannot reproduce the fault on a bench, you have not found it. You have just stopped seeing it.
Power and
signal conditioning
The unglamorous boxes that sit between a solar array and everything else. We build these to order more often than we sell them from a catalogue.
Power conditioning & distribution
Up to 640 W, MPPT input, per-channel latching current limiters with telemetry on every rail. Battery management for lithium-ion packs to 28 V.
Remote interface units
Analogue and digital acquisition close to the sensor, so the harness carries data rather than millivolts. 64 channels, 16-bit, sub-millisecond timestamping.
FPGA payload processing
Rad-tolerant FPGA cards for on-board image compression and detection, with a partial reconfiguration path so the algorithm can change on orbit.
Borrow an engineering model
for ninety days
MARLIN-3 EM, breakout board, SEINE source under licence and two days of support. We ask for a report at the end, good or bad.