Power and safety-critical control

Batteries and termination systems are the two subsystems where a design shortcut is not recoverable in flight. We treat both as safety-critical, because they are.

Switched-mode power stage: paralleled transformers, heatsinked switching devices and bulk capacitors.

Smart power

A battery that reports voltage is telling you almost nothing useful. We build power systems that know their own condition and say so in time to act — cell-level monitoring, temperature management across the real operating range, state-of-health tracking across cycles, and CAN bus integration so the vehicle and the ground both see the same truth.

That matters most in the cold, at altitude and late in a pack's service life — the three conditions where a nominal-looking battery stops being able to deliver what the airframe is about to ask of it.

Supports the rocketry and termination half of the page.

Termination, shutoff and bleed control

We build systems whose job is to stop something safely: motor cut-off and flight termination for aircraft, and shutoff and bleed control for rocketry, where an abort must be commanded reliably and the propellant path made safe on a schedule that does not depend on anything else still working.

Safety-critical control is a different discipline from flight software. It is built to be independent of the system it protects, to fail in a known direction, and to remain commandable when the primary avionics are the thing that has failed. We design the authority boundaries, the interlocks and the arming logic accordingly, and we test the abort path far more than the nominal one.

Products, not prototypes

This is the part of our work that ships as hardware. Our motor cut-off and parachute systems are the visible example: installed without voiding aircraft warranty, independent of the flight controller, keeping avionics and video alive through descent so the aircraft can still be located.

What you get

  • Power systems that warn before they fail, not while failing
  • An abort path independent of the system it protects
  • Hardware built to be installed and serviced by the operator

Related work

Talk to us about your system

The most useful first message describes the constraint you cannot get past.

Start a conversation