Flexibility: the Distributed Integrated Platform Software
In a rapidly changing world, with emerging disruptive technologies, having an aircraft that can change its capabilities at squadron level, such as radar and weapons parameters, in a simple and quick way, allows the fighter to stay relevant, something of key importance. “Incremental development, modular hardware and software, and layered systems architecture, provide continuous growth capability over the lifecycle at increasing pace,” Johan Segertoft, VP and Head of Business Unit Gripen Weapon Design at Saab Aeronautics tells the audience, addressing the flexibility issue, a design philosophy that Saab started to apply since the Viggen era. “We started to focus on the Gripen E avionic system in 2010, and in hindsight we saw three key things that we needed to take care of,” he says. While many factors, for example thrust-to-weight ratio, developed in a linear way along years, and are thus predictable, this was not true for computer power per dollar as this increased exponentially. The second issue is complexity, which relates to the type of computer we have now, compared to that of 10 years ago, once again an exponential increase. What we new is that we were going to get something better,” so modularity allows replacing legacy hardware with state-of-the-art one. Both those issues are not unique to aviation. “The third issue, and this one is peculiar to aviation is safety. This requires a lot of time as systems have to be certified, flight-critical software being required to run a 1,000 years, 365 days per year, 24/7, and in that period of time you are allowed to have one error,” Johan Segertoft underlines, adding that that error must be mitigated in order not to cause a catastrophe.
Getting to Gripen E he explains that “here avionics is not only integrated, it is also distributed, as we have fully separated hardware from software, and we also capsulated flight critical elements from tactical ones.” EDR On-Line understood that during development missions the aircraft operates with flight critical software running together with prototype software, thanks to the aforementioned avionics platform, which at Saab is known as DIPS (Distributed Integrated Platform Software). “This gives us development speed, the ability to try new things, while remaining totally safe,” Johan Segertoft explains adding that “we can exchange computers, and we did it to get more computing power. As an example, we had three computers and we saw that we needed multiple processing, so we changed them in a few days, virtualising new ones as 96 computers, getting the power of nearly 300 computers. We are the only company who does this, as it is insanely difficult, the tricky point being formal verification, as we developed a system that re-verifies itself all the time. It is assured to the highest standard of RTCA DO-178B [1], so we had to work together with the authorities as standards didn’t foresee a system this difficult, and the Tempest FCAS programme PYRAMID Open Mission System apparently follows our vision.”
The Gripen E is obviously designed for the typical linear growth, however the Saab software expert underlines that the avionics platform caters for the exponential growth. Aircraft sensors and actuators talk through a data point making all information available to all software, which makes the system sensor agnostic, the developer only needing an API (Application Programming Interface) and a development kit. All this allows to speed up the upgrade process; “in a normal aircraft new developments are first tested in a rig, which runs on UNIX stations that interpret binary numbers in reverse as Linux, so you have to compile twice, and doing this you may introduce errors, as the software running in the rig is not the same that runs on the aircraft, while in our system you compile just once, and engineers can ‘fly’ it on their own computers, reducing complexity.” To illustrate the advantages of the system Johan Segertoft goes through the development timeframe.
“We started in 2010, and the first seven years were blood, sweat and tears. Then on 15 June 2017 we flew the first time with ship 39-8. Roughly one year later we flew 39-9, the second test aircraft, and all its computers were upgraded. It took less than one week, the rest was functional growth on top of it. We then added all tactical hardware, within a few months, 39-10 flying in early 2019, then we went in serial Batch #1.” EDR On-Line understood that the first four Batch #1 aircraft are fitted with three Head-Down Displays (HDD) and an old Head-Up Display (HUD), while the six following aircraft fielded a few months later are fitted with the final cockpit configuration featuring small HDDs, a new HUD and the Wide Area Display (WAD).
“This allows appreciating the pace of the improvements; on average we released a new flight software every four weeks, we did Agile development all since 2010, and this was possible because the product supports it,” the Saab representative adds. Of course the customer will not update its aircraft at the same pace, the four weeks tempo being something used for development. Discussions are ongoing on those aspects with customers, as the Gripen E changes the paradigm even under that aspect, which consequently will modify behaviours. “One of our test pilots said that from Christmas 2021 to summer 2022 the aircraft was a completely different platform, thanks to the number of upgrades induced into development platforms.”
Developments come from a beneficial collaboration between Saab and the customers, Air Forces and Acquisition Bureaus. “In some areas we get requirements that push us towards the limits of what is not feasible today, and we try to get closer to those. In the Gripen C/D, which is a very capable aircraft from the software perspective but does not features the DIPS, it took around 12 months to test a new idea in a real setting. Now we stretched the Agile concept to include the flight test programme, which we call ADAPT for Agile Design And Permit To fly, and this allows to do the same test in four weeks, and the fastest add-on of a safety critical application took us probably seven to eight days.”
Another key issue is the capability to fly in GPS-denied areas maintaining accurate positioning, “as errors would immediately affect situational awareness,” Jussi Halmetoja points out.
Due to his
operational background, he could not avoid concluding his presentation talking
about training and operations. “To fight efficiently and for real you need to
train real, with real aircraft in real environment, against real threats, so
don’t replace your training with synthetic or simulated training, these must be
combined,” the right mix between real and simulated flight hours being the
issue.
[1] The DO-178B is a document jointly developed by the safety-critical working group RTCA SC-167 of the Radio Technical Commission for Aeronautics (RTCA) and WG-12 of the European Organisation for Civil Aviation Equipment (EUROCAE) about Software Considerations in Airborne Systems and Equipment Certification.
