Open Standards How the FACE Standard Enables Modular, Open and Future-Proof Avionics Systems

FACE and MOSA create the foundation for modular, open avionics systems. The standard promotes interoperability, reusability, and certifiability—technically and strategically relevant for both military and civilian aviation projects.

In recent years, the rapid pace of technological advancement in both military and civilian aviation has fundamentally transformed the development of avionics systems. At the heart of this transformation is the technical standard Future Airborne Capability Environment (FACE). Together with the Modular Open Systems Approach (MOSA), FACE forms the foundation for modern, open software architectures for airborne platforms. However, FACE is more than just another industry standard. It represents a decisive step away from monolithic, proprietary systems toward open, modular, and reusable software components. In this article, Sysgo explores the background of FACE's development, its relationship to existing standards, and the challenges and benefits for companies of all sizes. Additionally, it explains how FACE allows for the faster development, more cost-effective operation, and safer certification of future military and civilian aviation systems.

Legal foundations of FACE and relations to existing standards

FACE was developed to address the persistent challenges of integrating manufacturer-specific avionics systems, which are difficult to maintain, incur high operating costs, and hinder interoperability between systems. Since 2019, U.S. law has mandated compliance with MOSA principles for all major defence acquisition programs (MDAPs). While there is no comparable legal requirement in Europe, national procurement agencies in Germany, France, and Italy are increasingly demanding the inclusion of modular procurement logic in tenders. Many NATO countries are currently examining how their national projects can be aligned with FACE. Overall, it is clear: MOSA has laid the strategic foundation for open, connected, and future-proof international systems, while FACE provides the specific, verifiable software architecture for technical airborne systems. Alongside FACE, the Open Mission Systems (OMS) framework and the Universal Command and Control Interface (UCI) have also become established in military software architectures and are increasingly gaining importance in civilian aviation. There are no content overlaps among the three standards, making them complementary rather than competitive. In practice, therefore, an airborne platform can be built to be FACE-compliant while also utilizing OMS architectures and UCI data interfaces.

Technical architecture of FACE

The technical architecture of FACE divides software into five clearly defined segments:

• Operating System Segment (OSS);
• Transport Services Segment (TSS);
• I/O Services Segment (IOS);
• Portable Components Segment (PCS); and
• Platform-Specific Services Segment (PSS).

Each component is connected to the overall system through defined interfaces. The OSS is a component of the FACE standard, which Sysgo's PikeOS real-time operating system and hypervisor can implement, with ELinOS (embedded Linux as a guest operating system) able to run within a FACE-compliant system.

FACE defines three OSS profiles, enabling the adaptation of operating system APIs, programming languages and functions, runtime environments, frameworks, and graphic capabilities to the requirements of software components with different priority levels:

• Security (IT security): Restricts OS APIs to a minimal but functional set to enable the evaluation of highly secure functions running as a single process.
• Safety (Functional safety): Less restrictive than Security but allows only OS APIs with a proven safety-certified history.
• General Purpose: The least restrictive, supports OS APIs for both real-time deterministic and non-real-time, non-deterministic requirements—depending on system or subsystem operation.

A central role is also played by the Shared Data Model, which serves as the semantic foundation for all messages.

FACE also utilizes a variety of established standards, including:

• ARINC 653 (Partitioning for Safety)
• ARINC 661 (Cockpit displays)
• POSIX APIs (Portability)
• OpenGL (Graphics interfaces)
• Ada, C++, Java (Programming languages)

By integrating these standards, FACE becomes an interoperable platform that offers system integrators high flexibility. This model supports strongly typed data structures and ensures that position data, sensor measurements, or status information are consistently interpreted throughout the avionics system.

The introduction of FACE opens up new possibilities

The implementation of the FACE standard is an investment that creates sustainable value. While an initial technical effort is required, the benefits can be substantial—especially for system providers working across platforms or pursuing long-term software product strategies. By separating platform architecture from functional logic, FACE enables true reusability and modularity. Proven modules can be used in various projects without the need for costly redevelopment. Standardized interfaces also facilitate collaboration with partners and subcontractors, accelerate integration, and reduce risks. Most importantly, FACE certification increases market visibility and provides manufacturers access to the public registry of certified modules, enabling faster responses to new tenders. In short, FACE not only enhances engineering but also boosts competitiveness and growth potential.

Furthermore, FACE creates new opportunities for smaller and specialized software providers that were previously excluded from large system integration projects and unable to compete with established prime contractors. The complexity of proprietary systems was traditionally a barrier, which FACE now eliminates. By clearly separating modules and system responsibilities, smaller companies can focus on well-defined software functions, have them certified, and independently market them through the FACE registry. This approach expands market access, reduces business risk, and fosters a more competitive environment where quality, innovation, and interface compliance matter more than established customer relationships. This dynamic is especially promising in rapidly growing areas such as artificial intelligence, sensor fusion, and real-time systems.

The FACE registry is the gateway to visibility, credibility, and new business opportunities. It acts as a publicly accessible "app store" for military software components, enabling program managers, system integrators, and developers to quickly find and compare certified Units of Conformance (UoCs). Each listed component has undergone a rigorous certification process, ensuring seamless interoperability within the FACE architecture. For manufacturers, the registry is more than a directory—it is direct market access. Certified UoCs and UoC packages can be showcased to the entire defence ecosystem, opening up opportunities for new programs, platform integrations, and partnerships. With its standardized registration process, the FACE registry turns certification into a competitive advantage, making it easier to stand out with high-quality solutions and secure contracts.

Security and Safety with FACE

Modern avionics systems are increasingly interconnected, and the shift toward software-defined platforms makes security a central priority. While FACE is not a security certification authority itself, it has early on integrated mechanisms to address security-critical requirements. The Security Subcommittee of the FACE Technical Working Group plays a central role by developing recommendations, security profiles, and integration patterns that enable components with different security requirements to operate together in a FACE-compliant system. A key focus is on Multilevel Security (MLS), which ensures the physical or logical separation of modules with different classification levels when integrated on a shared computing platform. FACE also supports the integration of domain-specific security measures such as data encryption and access control, without compromising the interoperability of the overall system. Combined with standardized data models, these measures provide a security level that meets the highest military requirements—making FACE equally attractive for critical infrastructure and civilian aviation systems. From a safety perspective, FACE does not replace existing standards but complements them. Developers of safety-critical software for FACE benefit from:

• modular architectures;
• isolated tests; and
• automated verification.

Companies like Sysgo support developers and system architects adopting the FACE standard with a wide range of resources. These include not only specifications and testing procedures but also an extensive array of open tools, documentation, and training resources. A key resource is the BALSA Reference Project, a minimalist yet functional example environment that demonstrates how to create a simple, fully FACE-compliant application. BALSA serves as an ideal starting point for custom developments and is complemented by comprehensive guides for software vendors, integrators, and project managers, as well as regularly updated training programs. These are offered by the consortium or accredited partners and are designed for both technical teams and decision-makers. Topics range from architecture modeling and data description to the integration of transport services and middleware. This knowledge foundation helps projects start on the right track from the beginning and avoid costly mistakes.

Additionally, Sysgo supports the development of FACE systems and software through its extensive experience in complex avionics projects. The senior engineers design architectures that meet the highest safety and security standards and contribute their expertise in all phases: from specification and requirements management to verification, validation, and testing. Thanks to their deep understanding of certification requirements, Sysgo's team ensures that every development step aligns with the overall project plan. The code is developed to meet the requirements while remaining easily testable, enabling efficient and certifiable development from the outset. Certification complexity is reduced by breaking down large systems into subsystems with varying levels of criticality. This increases security while minimizing effort and costs. Through separation and virtualization, Sysgo delivers highly secure architectures at an industrial scale. A network of proven hardware and software partners—from hardware debuggers and coverage analyzers to static and dynamic analysis solutions—ensures that appropriate resources are available for every project phase.

Together with MOSA, FACE paves the way for a new generation of open, maintainable, cost-efficient, and secure avionics systems. By closely aligning with laws, technical standards, and formal certification processes, FACE fosters a growing ecosystem that combines innovation with robust security. For all stakeholders in military and civilian aviation, FACE represents a new paradigm in system development: modular, open, and future-proof.

(sg)

*Joe Richmond-Knight has been working as an FAE/Solutions Architect at Sysgo since 2022. He has extensive experience in the use of embedded systems for the "Internet of Things" (IoT) as well as in the development and implementation of complex data acquisition systems.