Engineering services for safety-critical software.

Systems engineering and requirements

Requirements defects cost far less to fix before design starts than after integration. We work with your architects and product owners to elicit, structure and verify requirements before a model block is drawn, using INCOSE-aligned practice and MBSE tooling that keeps the programme traceable end to end.

Control system design

Control algorithms for batteries, high-voltage switching, thermal systems, vehicle motion and now flight, designed so every model element traces to a requirement and every safety boundary is designed in rather than retrofitted.

Model-based design

Model-based design lets requirements be tested before code exists and architecture be validated before hardware arrives, with production code generated from the verified model. In aerospace we apply it under DO-331, the model-based supplement to DO-178C.

Embedded software

Whether the path is autocode or hand-written C, every line we deliver is MISRA-compliant, reviewed, statically analysed and traced to its requirement. Our engineers have deployed embedded software to production ECUs from ASIL A to ASIL D.

AUTOSAR Classic

AUTOSAR Classic application software components, from model-based design to compliant C and ARXML, ready to integrate with your basic software stack.

Verification and validation

Verification is planned before design begins and runs through every stage. Every test case traces to a requirement, and every structural coverage gap is closed or justified, so the evidence holds up under independent assessment.

MiL, SiL and HiL testing

The earlier a defect is found, the cheaper it is to fix. Model-in-the-loop finds algorithm errors before an ECU exists; software-in-the-loop confirms the generated code behaves like the model; hardware-in-the-loop exercises the final software against real I/O and timing. We run all three with the same test cases and one coverage report.

Functional safety and certification

Safety is an architecture decision, not a document at the end. We support airborne software to DO-178C and automotive software to ISO 26262 Part 6, with engineers who have produced certification evidence on live programmes.

Read our DO-178C certification lifecycle practitioner guide.

ASPICE process

Automotive OEMs expect suppliers to demonstrate ASPICE capability, with Level 2 as the entry point and Level 3 increasingly required for safety systems. We set up, run and mature compliant processes across the system, software, support and management groups.

Toolchain and CI

A poorly configured toolchain is a common cause of programme delay and failed assessments. We set up toolchains where every commit runs traceability checks, model build, code generation, static analysis, testing and coverage, with no manual steps between gates.