Hamilton-Sundstrand’s Dynamic Controls division relies on DDC-I’s TADS toolset to upgrade and support the AH-64D Apache helicopter flight control module

Product: TADS i960

In September 1999, the AH-64D Apache Longbow, the world’s only fourth-generation attack helicopter, performed a series of loops, rolls, hammerhead stalls, and split-S maneuvers at weights never before flown in public demonstrations. The dramatic series of aerobatic maneuvers showcased its flight performance, agility, and an unmatched ability to provide combat pilots a decisive edge in the sky.

Reporting that the helicopter performed even better than its predecessor, the combat-proven AH-64A Apache, Boeing pilots also confirmed the rock-solid performance of the Apache Longbow’s advanced avionics suite, including the safety-critical embedded systems within the primary flight controls, designed and built by DCHS, the Dynamic Controls division of Hamilton-Sundstrand.

A recognized industry leader in design and development of electronic and electro-mechanical controls and systems for the military and commercial aerospace markets, Dynamic Controls was acquired in 1996 by then Hamilton Standard, which was merged with Sundstrand by parent United Technologies in 1999.

Also presented NASA’s highest recognition for vendor quality in 1996, the George M. Low award, for its contributions to the space program, Hamilton has designed and built an impressive collection of high-profile systems. From the life support and environmental controls onboard Apollo 11 to multiple systems flying on the maiden voyage of the Space Shuttle Columbia, as well as over 100 components currently orbiting in the International Space Station, DCHS programmers genuinely understand the meaning of safety-critical.

“The safety-critcal aspects of real-time embedded systems developed by DCHS are addressed right from the beginning on every project, in the system requirements phase,” says Kate Goldstone, the Senior Engineer responsible for the systems and software groups within the flight control enterprise at DCHS.

Goldstone explains that the Ada programming language and the Tartan Ada Development System (TADS) are used to create the embedded code targeting the i960 processor in a recently upgraded flight control module. The Apache’s previous module, designed a decade ago, contains the earlier ceramic version of the Intel chip, which is no longer manufactured and has since been replaced by a plastic version.

“The Apache program is obviously a mature one, and what we were actually doing was performing an upgrade on the system due to obsolescence issues with the old processor,” she says.

According to Goldstone, Hamilton purchased their initial TADS toolset from Tartan and stayed with the original delivery for eight years, never making contact with Texas Instruments during its tenure with TADS. Not until 1999, when the Apache flight control module underwent a complete redesign, did they purchase the latest version of TADS-i960 from DDC-I.

“We ended up with a couple cases where changes [over the eight year interval] caused some features we had utilized in the past not to work very well. Being able to specify where code would go based on memory map I/O, that was our biggest issue. We’ve been able to get around those things, but I’ll admit it was a little painful, and a little time consuming, to get through the conversion,” she adds.

However, Goldstone takes a pragmatic approach to what the flight control team at DCHS went through to bring the TADS toolset up to speed.

“I think it’s a normal thing when you change compilers and vendors to find some new quirks, and I think when DDC-I acquired the system from Texas Instruments, there wasn’t a lot of knowledge transfer from TI. What I found was that it was a functional product, but DDC-I was playing catch-up to discover what was wrong with the system and set it straight,” she comments.

An expert in Ada development for safety-critical real-time embedded systems, DDC-I acquired Tartan from TI in early 1998, to round out their arsenal of Ada development systems. Confirming Goldstone’s sense of the product, TADS had been largely unsupported under TI ownership, and DDC-I’s first goal for the mature TADS products targeting the venerable Intel i960, Motorola 68XXX, and MIL-STD-1750A processors was to beef up engineering services and support.

Headquartered in Lyngby, Denmark and Phoenix, Arizona, DDC-I is a long-standing developer of Ada systems and tools, from compilers, run time systems, and debuggers to fully integrated development environments. DDC-I also offers consulting and support services, maintaining a distinguished list of civil, commercial, and defense clients, including Boeing, Sikorsky, and Lockheed-Martin.

The flight controls enterprise at DCHS also serves a who’s who in the civil, commercial, and defense aerospace industries, and Goldstone’s role is pivotal to the timely completion of each project. Responsible for scheduling, staffing, and budgets for every program within the group, including the flight controls and vehicle management for the Lockheed-Martin Joint Strike Fighter, her position affords her a bird’s eye view of the safety-critical embedded systems industry and the challenges confronting contractors today.

“If you’ve developed per mil-standard in the past you’ve got all of your processes and certifications in place and you stick with the game plan,” she says.

She explains that developers working on embedded systems for military projects have no choice but to have proven processes in place, while in recent years there’s been a trend on the commercial side in the US — which started much earlier in Europe — toward developing better process framework, due to a few high-profile failures as a result of ad hoc development. As an experienced military developer, all DCHS safety-critical design processes flow in accordance with a thoroughly tested design development manual.

Support is also a completely different beast in the defense sector according to Goldstone, which is why DCHS chose to contact DDC-I about upgrading their TADS environment. Under contract, they are required to support the upgraded Apache flight control systems until 2010.

The Ultra 60 running Solaris that hosts the TADS toolset is a modern platform, but the computing platforms at DCHS run the gamut, due to their obligation to support programs until the contract expires. While they also use NT and other contemporary systems, they still maintain DEC VAX gear, and one program even requires propping up an ancient PDP-11, which the Smithsonian is interested in when it is finally retired.

“This is a situation where the commercial world would throw it out and move forward, but in the world of military contracts ten years is the minimum support requirement,” she says.

Goldstone adds that a major problem felt across technology industries, the shortage of qualified talent to fill programming and engineering positions, is also impacting DCHS. It’s her feeling that the booming Internet economy and the “sky’s the limit” salary structure in the Web world is also pushing salaries artificially high, and making it difficult for the less sexy realm of embedded systems to attract top talent.

“We’re struggling to bring people into the embedded systems field, which is a big reason behind our desire for more efficient, automated, integrated programming tools. In the end it’s all cost driven, and everybody in the embedded systems industry is struggling with the same issue,” she says.

Goldstone also sees the consumer markets nearly insatiable desire for new electronic devices like mobile phones and PDAs as a driving force for change in the safety-critical real-time embedded systems field, as the accelerating rate of change in the consumer sector forces organizations like DCHS to use increasing numbers of commercial parts, which have a tendency to become obsolete more quickly.

“Fortunately, commercial parts aren’t a problem for us, since we anticipated the trend and significantly improved our screening processes in the early 1990’s,” she says. “Today, evaluating them is just another part of our development process, and all of our hardware designs pass through prediction tools that we use to help track how long specific parts should remain available.”

While development tools like TADS are firmly ensconced at DCHS due to contractual obligations for projects like the Apache flight control systems, another trend impacting their choice of future development environments is the movement toward commercial DSP chips in lieu of traditional processors.

“I think our sector of the embedded systems industry is increasingly moving toward miniaturization, just like everyone else,” she adds. “They all want to find a way to generate more compact and efficient designs; basically everyone is saying, ‘how many more parts can we get off the board and on this chip?’”

She adds that DCHS is increasingly using C/C++ in their newer safety-critical system designs using DSPs for their speed, lower cost, and smaller size, and that she is currently struggling with the fact that the manufacturer of their DSP of choice — the Intel TMS series — isn’t allowing tool vendors like DDC-I the access required to create programming tools for real-time safety-critical applications.

“Intel’s limit on access is forcing us to use programming tools that are awful, some of the worst I’ve seen in a long time,” she says.

She feels that integrated development environments capable of increasing the efficiency of both the individual engineer and the team are becoming essential. She specifically cites automated test generation tools, requirements generation that “flows,” and a fully integrated toolset as required elements.

Goldstone also agrees with DDC-I’s “partnership” approach to tools development: “I think they will be able to team up with hardware vendors using the DSPs and RISC-based processors to streamline the run time systems, since the embedded world doesn’t use ninety percent of most kernels due to testing criticality.”

In the end, she sees DDC-I’s efforts with TADS positively. “From a customer support perspective DDC-I has been phenomenal. We had them create a support tool for us to handle unit test on a stand-alone board and they struggled incredibly to make it happen. I feel that they learned a lot [in the process] and provided a lot more depth in their group as a result,” she adds.

As a Hamilton-Sundstrand employee and DoD contractor Goldstone can’t officially endorse products or companies, but her final words on the level of support provided by DDC-I are quite clear: “They have the right approach and I think that they’re doing the right thing.”