Designing the world’s best control system

A Note to the Reader

This section describes how an entirely new and unique control system for military fighter aircraft was developed during the 1980s and 1990s. It will describe in detail how the development work was carried out for the JAS 39 Gripen (hereinafter referred to as Gripen) control system. The Gripen is a modern statically unstable aircraft with unique performance which cuts through the air with little energy loss.

In this chapter you will find a description on how to handle complex aeronautical problems by employing an extremely well-structured working procedure.

It will also cover how to deal with the progress made in electronics and computing in order to future-proof the different functions and systems.

In the case of specific problems such as accidents, it is important to analyse systematically the issue and try out different possible solutions. In such cases we will look at detailed descriptions of how to work in a practical fashion in which considerations and decisions had to be made.

In addition, this chapter will also include a specific practical description of the aeronautical problems which arise in large complex system development Projects.


Here at Saab, one of our greatest advantages is how closely our different technical disciplines and groups work in conjunction. Saab has a relatively small team in the respective technical disciplines, and our informal working procedure means that our teams can work closely together. The result? It is much easier to rethink ideas and results and to then come up with better decisions, with the pilot actively involved in all discussions and decisions.

Recommended reading

The author recommends the following texts that relate to this story: In chapter Creating value for customers under the heading Development of Technology Demonstrators in chapter Keeping unique development skills under the heading Technical capability development for control systems and under the heading Methodology and analysis in design work.

The text refers to the highlighted areas in the journey of change in the aircraft industry


Designing a modern statically unstable aircraft such as the Gripen requires close cooperation between different technical disciplines. The common goal was to develop a flight control system in the Gripen so that the required functions and performance were met.

Experience from earlier aircraft showed that automatic limitation of the load factor, the angle of attack and structural loads relieved the pilot from monitoring these flight parameters.

In a statically unstable basic aircraft, the flight control system is able to create handling and flight characteristics that can range all the way from a slow bomber aircraft up to a highly manoeuvrable fighter aircraft within the aircraft design’s physical limits.

The system needs to have as short time delay as possible in order to stabilise and create exact and correct handling and flight characteristics all the way from the control stick and sensors through the computers and all the way on to the control servos and the control surfaces. Large time delays in the system are extremely difficult to compensate at a later stage in the design process.

For the pilot, it is just to put the flight vector symbol in the head-up display at the place they want to land for example. The Gripen is capable of landing on narrow roads in the terrain and it can land wherever necessary.

Thanks to our investigations into PIO (pilot-induced oscillations) on the Gripen which involved a theoretical studies and comprehensive practical flight testing, Saab was and remains a world leader in knowledge regarding PIO-related problems.

By carrying out a simple analysis and comparison with the single-seater version of the Gripen which offered excellent pilot in-the-loop stability (no PIO), we were able to adjust the pilot’s commands in the twin-seater version. By adjusting the flight control laws in the twin-seater version of the Gripen, it was possible to eliminate PIO in the twin-seater version, giving it the same excellent characteristics as the single-seater.

Description of the contents

  • Designing a modern statically unstable aircraft such as the Gripen requires close cooperation between different technical disciplines.
  • In order to ensure that all components in the flight control system cooperate and are capable of stabilising the statically unstable basic aircraft. All of the components and systems included are working together as one unit.
  • A large part of the development work consisted of different types of flight testing.
  • A large number of different types of simulation were used in the methodology for developing the control system.
  • This new flight control system, which was developed in the mid-1990s, still remains unique to this day.

Developing the World’s Best Control System.

Designing a modern statically unstable aircraft such as the Gripen requires close cooperation between different technical disciplines. The common goal was to develop a flight control system in the Gripen so that the required functions and performance were met.

Contact between the different members of the technical disciplines is very close, especially the flight control systems and aerodynamics teams which practically "sit on each other’s laps". The different technical disciplines work together to ascertain the different forces, moments and control surface moments which can affect the aircraft. Furthermore, they ensure that performance can be upheld at different speeds and that there is the possibility of keeping the aircraft under control using the control surfaces at all times.

The structure, mass and centre of gravity are all essential when it comes to turning at 9G and in order to stabilise the aircraft, and all will affect the rigidity required for the wings and control surfaces. Rigidity is required on the control surfaces in order for them to function effectively and to stabilise the aircraft in all positions, as well as achieving the best performance.

As the control system limits the loads on the aircraft, canards and trailing edge control surfaces in different speed ranges so as not to overload the aircraft structure, no additional structural weight (mass) needs to be added. The main idea is to keep the aircraft as light as possible, meaning that everyone works actively to keep the weight down and control the centre of gravity. To this end, a number of the different technical disciplines work together in close contact.

The control system also needs to keep aeroelastic effects such as flutter under control. Calculation checks for flutter are used to ensure the correct amplification level during the design of the flight control system.

It is a question of having the power to control the control surfaces quickly in order to stabilise the very unstable aircraft. The control servos are subjected to hydraulic pressure from the hydraulic system. This caused a great deal of discussion between the technical disciplines when constructing the hydraulic system and in the variation in the hydraulic pressure according to the engine rpm.

When carrying out tactical manoeuvres with the aircraft, it is essential that control symbols shown in the SI (sighting indicator) and the head-up display are user-friendly. In order to be able to aim and hit targets, coordination between the technical disciplines in the areas of presentation, manoeuvring and aiming are all required.

The control system must also be designed in such a way as to ensure that the aircraft achieves good stabilisation and very good handling characteristics for the pilot; this is achieved with the control system’s hardware and software. The control system must also be designed to ensure that any failures can be dealt with minimal degradation of performance, handling and flight characteristics.

Close corporation between the technical disciplines is also required during the intense, interactive flight testing.

Locating the different technical disciplines in the same close area after the accident in 1989 has also been one of the main reasons for the success of the Gripen. The office for the flight control system has been placed physically close to the other technical disciplines such as flight testing, the aircraft in the hangar and the pilot. Another reason for the success has been that these locations also offer access to a simulator (STYRSIM) in which different solutions can be tested easily and various flight testing scenarios can be carried out.

Saab’s processes for developing airworthy aircraft are well-founded thanks to our many years of experience. Focus remains on the aircraft functions and capabilities to ensure optimum levels of efficiency without adding excessive amount of documentary.

Important parameters for the flight control laws

A great range of different parameters needs to be taken into account when designing a flight control system and its flight control laws. The following section gives a few examples of design parameters which are crucial.

For aerodynamics and flight characteristics, the following factors are decisive:

  1. Required stabilisation of the aircraft in pitch, roll and yaw.
  2. Excellent handling characteristics for the pilot.
  3. Required take-off and landing characteristics for take-off or landing on narrow or short runways.
  4. Required turning performance both stationary and in stationary.
  5. Good handling and flight characteristics at both low and high speeds at all altitudes.
  6. Required roll performance and minimum drag during turns.
  7. Perform turn coordination to minimise sideslip and loads on the fin.
  8. Limiting maximum load factor and angle of attack in flight without overshoot stalling limits in alpha or structural limits for the load factor.
  9. Minimise transonic transient.
  10. Minimize the delays in the flight control system.

The most important questions when working with structure loads, are:

  1. Aircraft weight, centre of gravity, load factor, loads on the canards and the trailing edge control surfaces, roll performance as a function of load factor, fuel consumption and external stores mounted.
  2. Wing and rudder stiffness.
  3. Control servo design and its loads and hinge moments.

The design of the flight control system and fuel system is based mainly on:

  1. Centre of gravity; fuel consumption.
  2. External stores and its integration.

A different area requiring special handling is aeroelastic characteristics so as to avoid possible aeroelastic oscillations (flutter).

The primary functions in a flight control system affecting the hydraulics are:

  1. Hydraulic supply and pressure as a function of the thrust and engine rpm.
  2. Control servo rate.

The following factors are important for the specifications in a flight control system:

  1. Redundancy handling in case of failure.
  2. Testing and maintenance.
  3. Different cost-related aspects.

Design of the flight control laws

This section describes the areas which are important to remember when designing the flight control laws.

The figure below shows the primary functions affected, followed by a more detailed description.

The following section gives more detailed information on the design of the flight control laws for the technical disciplines shown on the top of the image.


When designing flight control laws for a statically unstable basic aircraft such as the Gripen, a thorough understanding of the forces and moments during different control surface movements is essential. As part of the investigations, a smaller scale model of the Gripen was studied in several different wind tunnels with several fixed external stores such as wingtip guided missiles, stores for sea targets (Sjömål 1), asymmetrical "Load C" store and Jakt1ÖYB.

An asymmetrical store has more weight hanging from one wing than from the other.

The results from the data received were used to design the characteristics of the basic unstable aircraft and then the flight control laws and simulations. In addition, a binder was put together with all the plots form with all the measurements from the wind tunnel.

53 different points (different speeds, altitudes, angles of attack and load factors) from within the flight envelope were selected for the design the flight control laws. For the different flight conditions, the following details were logged: speed, altitude, angle of attack, load factor, derivatives in pitch, roll and yaw, and control surface position (PCC data) for designing the flight control laws.

The design of the control laws should give level 1 flight characteristics for all flight conditions and store configurations according to military specifications. By selecting the correct gains and filtering in different flight conditions, it is possible to create desirable flight characteristics that fall within level 1.

Structure, weight and structural strength

In order to achieve the best possible performance of the aircraft without adding additional structural weight, effective limitation devices are required to ensure the aircraft does not exceed structural limits for load factor, roll rate with load factor, lateral load factor, canard load and control surface hinge moments.

Flight control laws within a flight control system can very accurately control and limit loads on an aircraft. The pilot can pull the control stick right back and reach the load factor limit without actually overloading the aircraft. If the pilot pulls the control stick all the way back and gives the command for maximum roll to the right or left, the load factor and the roll rate are limited so that the aircraft does not become overloaded.

This process is described in more detail in the chapter entitled "Technical capability development for flight control systems" under the heading "Care-free manoeuvring".

The load on the canards and trailing edge control surface can also be controlled and limited by limiting the canard deflexions so the load on the canards do not exceed the limit and that the servos are always in command. This limitation is mainly applicable at supersonic speeds when the forces on the control surfaces are at the greatest and when the aircraft is statically stable. The load and the control surface hinge moment on the trailing edge control surfaces are also controlled and limited so as to avoid control servo stall at supersonic speeds.

It is essential to monitor the aircraft mass and centre of gravity as they have a direct effect on its stability, performance and load.

Fuel system

It is important to keep the aircraft’s centre of gravity within admissible limits, especially with regard to fuel volume. As a result, the tanks must be emptied in a certain order so as to avoid variation in the centre of gravity as far as possible.

Stores and stores integration

The control system needs to know the weight of the mounted stores on the aircraft and its effect on the centre of gravity in order to stabilise the aircraft and to give it the best possible flight characteristics. In addition, certain types of stores can require extra stabilizing feedback gains by the flight control system.

Aeroelastic characteristics: flutter

The aircraft should not be subjected to aeroelastic oscillation (flutter) with the flight control system engaged.

This means that the design of the flight control laws is simpler and the flight characteristics can be improved.

 This means that the amplitude at flutter frequencies must not exceed -6dB.


The aircraft’s flight characteristics depend on specifications such as, for example, MIL 8785C and the Project Specifications for the Gripen. These documents specify the frequency, damping and control stick sensitivity, etc., the aircraft should have. These specifications can sometimes be quite generous, meaning it is not always possible to know the characteristics the pilot wishes to have in the aircraft.

Experience gained during flight testing on the experimental JA 37 ESS01 was used to discover how the pilot likes to control the aircraft and what flight characteristics it should have. It is essential that the aircraft have level 1 characteristics (the highest levels of handling) according to the Cooper–Harper rating scale.

Cooper-Harper ratings are a well-established scale in the aviation industry, where pilots make subjective assessments and give scores to the flight and handling characteristics of an aircraft.

Naturally the idea is to take full advantage of the potential characteristics of a modern statically unstable aircraft. This is why it is important to fly the aircraft with as little loss of energy and drag as possible when turning or also during level flight. The canards and trailing edges must be commanded in minimum drag position for all different types of load factor and flight conditions. This will make the aircraft preserve the energy resulting in improved stationary turning performance.

The following section describes the most important factors to consider when designing the flight control laws shown in the lower half of the image (no 7/8).

Control system hardware

Quick, precise aircraft sensors such as the gyros in pitch, roll and yaw, angle of attack sensors and accelerometers are essential for stabilising the modern statically unstable basic aircraft such as the Gripen and for taking full advantages of its performance. The signals from the sensors must be handled in the flight control laws and flight control system computer to create stabilising commands to the flight control system servos which command to the control Surfaces.

Unnecessary delay results in loss of phase which makes it more difficult to stabilise statically unstable basic aircraft.

Experience from the JA 37 resulted in the design of a mini control stick with a high bandwidth. The reason for this was to eliminate the non-linearities in the large control stick and the destabilising effect from the mass force from the long control stick/arm. Originally the mini control stick was undamped and was designed to be used in conjunction with a power motor which would offer the required gain and damping, however this had to be abandoned due to excessive heating. The sensors all have high bandwidth so there is little loss of phase.

The design had three asynchronous computers calculating the midvalue of three signals incoming from the sensors. As a result, the computers all received the same sensor information and output from the computers to the respective servos was midvalue selected.

Saab needed to have analogue control servo loops due to an Analogue Back Up system in the early versions.

Hydraulic Systems

In order to balance the unstable tendencies of the aircraft and to control and stabilise the aircraft in accordance with the given specifications and pilot requests, servos which can control the control surfaces with sufficient rate were required.

The basic instability of the Gripen also has an effect on the control servo rate and moment which the canard, wing and rudder control servos needed to achieve. The hydraulic pressure and flow affect the different control servos’ rate and forces.

As a result, the hydraulic supply and pressure needs to be sufficiently high for the different manoeuvres in the flight envelope. In addition to that the use of the hydraulic fluid for secondary control surfaces such as the leading edge flaps and the air brake is necessary. At take-off and landing, this also includes the extension and retraction of the landing gear. The hydraulic pressure depends on the engine rpm and therefore also the throttle.

Ground Tests

This section describes the ground testing and simulations carried out on the Gripen 39-1 aircraft before first flight.

In order to ensure that all components in the control system operate as designed and intended and are capable of stabilising the statically unstable basic aircraft, all of the components and systems included are working together with the flight control system and simulated as one whole unit. This is tested on a rig including all the latest hardware. These actions are taken to check for possible delays and non-linearities in the system. When stabilising a modern statically unstable aircraft artificially, it is essential to have control on all the hardware components, their function, any delays and any other possible non-linearities.

To do this, a MAHS (manoeuvre and hydraulic simulator) was built. This is a rig for comprehensive simulation where current hardware as well as the flight control system and different other systems are installed. Furthermore, all the hardware operating as part of the flight control system was included. The primary control surfaces such as the canard servo, wing control servos and lateral rudder servo were installed on a girder construction ("iron horse"). Other secondary control surfaces such as the leading edge flaps and air brake were also installed on the same construction and the landing gear could be extended and retracted. Forces from a nose wheel plate could be used to control the nose landing gear control in the autopilot.

The simulator consisted of hardware such as the control stick, sensor inputs, computers and servos. The control system servos were operated via the hydraulic system on the rig. As the servos and control surfaces were exposed to real wind forces, powerful air pressure servos were installed to provide force to the control surfaces which acted on the servos like real forces from the air during flight.

The aircraft’s aerodynamics and flight mechanics were simulated in computers in the simulation department responsible for computer simulations. Gyro and load factor signals from the simulation computers were entered into the MAHS rig and then into the flight control system.

The flight control system computers calculated the control surface commands and the control servos moved the surfaces into the desired position using the hydraulic system. The control surface positions were measured and fed into the simulation computers which then calculated the new values for the gyro signals, load factors, etc. Other than the flight control system’s computers, the aircraft’s other computers are also included in the MAHS. This is known as a "closed loop simulation".

The pilot controlled the control surfaces on the aircraft in the MAHS rig from a cabin located in another room in order to avoid the noise from the hydraulic system. This cabin had a control stick, pedals, throttle, landing gear control, a warning panel and a few other details required for control system simulation.

The visual simulation for the pilot was rudimentary, consisting of a line to represent the horizon and a simple runway in the form of a grid with a flight vector symbol.

The disadvantage of this type of visual simulation was that the aircraft response when rolling was perceived as being slow so it tended to be increased. This was one of the contributing factors in why the controls (particularly in the roll) were too sensitive and resulted in the first accident involving the 39-1.

In order to be able to stabilise a modern statically unstable aircraft, it is essential to control the delay from the control stick, pedals and sensors until the control surfaces move and to make sure that the sensor had the right sign and that the scaling were correct. In order to avoid residual oscillations and ensure a good level of accuracy, it was also important to take the resolution into account on the control servos.

Before the first flight of the 39-1, a number of ground tests were carried out by connecting the 39-1 aircraft to the simulators and computers in a closed loop. The aircraft’s hydraulic system was driven by a hydraulic unit. During ground testing, all signals in the aircraft were checked to make sure they had the correct sign and that all of the data transfer from the control stick, pedal and sensors to the control servos were correct.

To check the sign on the moment gyros, they were placed on a plate which could be rotated. The sign from the accelerometers and the signals from the inertial navigation system were also checked as this showed that the coordination between the control system, hydraulic system and other systems was working according to the specifications.

This is especially the case for a statically unstable aircraft. Saab used this technique for the JA 37 automatic aiming, the JA 37-21 ESS01 and the Gripen.

The image below shows the different systems involved in the 39-1 aircraft closed loop testing.

Test Flights

Flights with the Gripen 39-1

The maiden flight of the Gripen took place on 9 December 1988. This first-ever flight was held in very mild weather conditions with no turbulence or winds. It took place without any significant issues. During the debriefing, the pilot commented that the aircraft felt sensitive in roll.

Flight testing continued, but the opinion on the aircraft’s characteristics continued to be that it was sensitive when rolling and felt jerky in gusts of wind.

After a few tests with the first pilot, a new pilot had the opportunity to discover the aircraft’s characteristics. This time a failure occurred and the flight control system changed to a reserve mode (DBU) due to an error in the air data. Speed information was missing and was not passed to the flight control system. The flight home passed without incident with the DBU being tested "involuntarily"; the next flight test with the same pilot passed without failure.

These two pilots controlled the aircraft with relatively little control stick deflection: one used little stick deflection but with a high frequency, and the other with small, soft control stick movements.

The next pilot to test the aircraft– pilot number 3– controlled the aircraft with medium frequency and with large, quick movements. The undamped control stick combined with the sensitive flight control system in roll meant that the pilot ended up in a divergent PIO during landing which resulted in a crash on Saab’s airfield.

The pilot escaped with minor injuries. The undamped control stick and the sensitive flight control system in roll contributed to the PIO upon landing; the sensitive flight control system with the undamped stick was not ready for such a forced test plan.

The investigations of the incident concluded that the sensitivity of the flight control system needed to be adjusted. As a result, Saab started using the MAHS (manoeuvre and hydraulic simulator). The visual simulation in the MAHS was deemed insufficient for providing the correct sensitivity and good landing characteristics.

The lessons drawn from the accident were as follows:

  1. The visual simulation in the MAHS used for developing the flight control laws did not give an accurate picture of the aircraft’s characteristics.
  2. Having the different members of the technical disciplines located in separate offices was a disadvantage when communicating between the teams.
    In order to correct this, new offices were built so that designers, flight testing engineers and pilots could be located more closely together. The result was that all of the different teams came closer together and could therefore achieve better results. This relocation resulted in excellent progress for the development of the Gripen, and which other aircraft manufacturers have shown interest in and copied ever since.
  3. he undamped control stick, which was originally intended to work in conjunction with a force motor to provide attenuation and damping, ended up being problematic. In the end, the control stick had to be damped.
  4. It was important to concentrate on PIO.

Redesigning the flight control laws based on test flights

This resulted in redesign the flight control laws in pitch, roll and yaw for all subsonic speeds including landing speeds in order to reduce the aircraft’s sensitivity.

It was not possible to use the simple visual simulation in the MAHS in order to test the new flight control laws. The decision was made to test the new flight control law design in the Calspan NT-33A instead. This is a twin-seater aircraft simulator designed for advanced testing known as "in-flight simulations". This device provided an accurate visual simulation with the correct flight sensitivity and the correct forces acting on the pilot.

Calspan was a company specialised in in-flight simulations using a Lockheed NT-33A.

The simulator offered the opportunity to program in the Gripen’s flight control laws into the NT-33A’s computer and to then test them in flight. The Saab the pilot sat in the front seat with the safety pilot in the back seat who could connect the aircraft’s basic flight safety control system if there were any problems.

It was possible to take off using the basic control system and to fly up to the test altitude and speed after which the Gripen control systems could be connected in order to continue the testing. The pilot in the front seat flew using the Gripen flight control laws when he was connected which meant that landing simulations could be carried out in a realistic manner. A large number of landing tests were carried out using the Gripen’s normal mode in the flight control system and the reconfiguration mode for air data errors (DBU: In the DBU the pilot was able to fly the aircraft without speed information to the flight control system).

The new designed flight control laws tested in the in-flight simulations using the Calspan NT-33A aircraft were then fed into the Gripen actual flight control system. In order to achieve the correct level of sensitivity, aircraft behaviour and control and flight characteristics, additional modifications were made at Saab on the flight control laws sensitivity in the rest of the flight envelope where the NT-33A could not reach due to its limited speed and altitude performance.

That design remains valid up to this day.

Designing the flight control laws

The design of the flight control laws was carried out based on previous experience from work on the automatic aiming on the JA 37, as well as the JA 37-21 ESS01 experimental Aircraft.

The experience gained from working on the JA 37 Viggen’s automatic aiming and on the JA 37-21 ESS01 showed that pilots attempt to eliminate different types of control errors, for example when aiming.

The aircraft handling and flight characteristics should not be too rapid– "hot"– as this results in the pilot having to "slow down" the control. The aircraft handling and flight characteristics should not be too sluggish– "lazy" - slow– either as this result in the pilot wanting to over-compensate predict and speed up the response. The best control characteristics can be achieved when the pilot can simply act as a gain in the control loop.

On the aircraft shown in the section on ground testing is statically unstable and is stabilised with the help of feedback signals from different sensors such as the angle of attack sensor and the rate gyros. The figure below shows a flow chart with information on stabilising an unstable aircraft with stabilising feedback.

For example, the angle of attack sensor can be fed back with a suitable gain to the canards and trailing edge control surfaces which will artificially modify the aircraft’s unstable Cmalpha to a stable value.

This is shown in the figure below. This is how you can stabilise the aircraft and give the aircraft the desired flight characteristics (FQ Flying Qualities). Designing the flight control laws with the help of modern control systems technique, LQ, it is also possible to achieve good handling characteristics (HQ handling qualities) for the pilot.

The figure below gives an overview stabilising and unstable aircraft using stabilising feedback (FQ Flying Qualities).

Reviewing the flight control system with international participation

With the flight control laws from the Calspan NT-33A "in-flight simulations" and the new design for flight control laws in the flight control system, flights the Gripen 39-2 started once more on a calm evening in May 1990.

The landing characteristics were given priority so that the test flight could be continued ensuring the landing. The flight control laws tested in the Calspan NT-33 proved to offer simple, precise control during the entire landing phase. The pilot’s responses during the landing were also reviewed to investigate whether the control system with the control stick and flight control laws was too sensitive for the pilot during pitch, roll and yaw manoeuvres. In addition, it was also important to investigate the landing characteristics in different winds, wind gusts and side winds.

Flight testing with landings in different wind, gust and side wind situations were carried out in order to expand the wind envelope. A simulator program was also started in order to predict analytically the flight characteristics in flying in different winds, gusts and side winds before further test flights in corresponding winds.

In order to create an applicable diagram to judge the landing characteristics, a moving simulator at the Netherlands Aerospace Centre NLR in the Holland was used. The simulations involving pilots and their pilot ratings (with scores according to the Cooper-Harper rating scale) resulted in a diagram of how the characteristics changed depending on the different wind and gust situations. Actual flight results were then plotted onto this diagram.

In this way, it was possible to verify the diagram and to predict whether there was margin for good landing conditions before the next stage in the flights to expand the wind envelope.

The flight control law design described above and the heavy focus on flight testing in different wind conditions has made the Gripen an aircraft which is very easy to land.

Stress in the transonic speed range

Test flights involving the 39-2 also showed that there was a problem during deceleration from supersonic to subsonic flight in the transonic speed range during turns with load factor. The transient (disturbance) arising during deceleration when turning through the transonic speed range ("sound barrier") with load factor was very large.

In order to visualise the transonic transient phenomena, a camera was mounted on the aircraft to make it possible to see the upper side of the wing during turning manoeuvre with a high load factor within the transonic range. "Tufts" were added to the wing to make it easier to see the wind flow. The film showed a drop in pressure in front of the trailing edge control surfaces which led to the powerful transient (disturbance).

Besides flight testing in the transonic range, other test flights were made involving additional stores hanging on the weapons pylons on the aircraft. Later on in the development stage it became necessary to fly with very heavy weight store configurations on the aircraft in order to comply with NATO’s requirements for export of the Gripen. This will be looked at later on in the document.

The flight control law design proved itself to be very robust for the above mentioned external store configurations mounted on the different pylons. The pilot hardly noticed that he was flying with the heavy anti-ship missiles. The performance at higher speeds and the load factor limit were naturally affected, but it did not feel like flying a heavier aircraft. It was most noticeable at the alpha limit.

The figure below shows a test flight with the pitch rate response on a pilot command when making a pitch stick step for a light aircraft carrying missiles on the wing tips compared with the heavy store configuration aircraft with anti-ship missiles and missiles when both aircraft configurations have the same alpha and load factor limit.

Aircraft PIO characteristics

Another decision made from the accident investigation after the first accident was to look closer into the aircraft’s PIO (pilot-induced oscillations or APC: aircraft pilot couplings).

A great deal of emphasis was placed on investigating whether the Gripen had a tendency for PIO when flying with the pilot in the loop. A whole range of different known PIO criteria were used to carry out theoretical studies to predict whether there was a tendency for PIO in the Gripen. Criteria such as the Neal-Smith criterion, bandwidth criterion, Gibson criterion, Ralph Smith criterion, etc., were used and it was hard to interpret results. They showed that the Gripen was free from PIO, i.e. the aircraft had no natural tendency for pilot-induced oscillations.

Simulator studies with pilots were carried out in which the pilot should follow control orders in pitch and roll presented in the simulator’s heads-up display as shown in the figure below.

This figure shows an example of the commands which the pilot was meant to follow in the simulator and during flight testing to find out if the aircraft had a tendency for PIO. The X-axis plots show the time and the Y-axis shows the pitch angle or the roll angle in the HUD (radians).

A control order was shown on the aircraft’s heads-up display (HUD), which the pilot was then supposed to follow as exactly as possible. The scale on the Y-axis is the pitch or roll angle on the HUD given in radians. 0.5 radiant is 0.5x57.3=28.6 degrees.

During flight, the pilot was supposed to follow the command on the HUD by moving the "X-axis" of the aircraft on the HUD to follow the order. No tendency for PIO could be found during these test flights.

The figure below shows the PIO investigations for formation flight testing to check PIO tendencies.

Flight testing was also carried out in formation flying; see figure above. The pilot in aircraft 2 (wingman) was supposed to be able to see aircraft 1’s and the mark on aircraft 1’s fuselage.

The pilot in aircraft was meant to fly in formation so that aircraft 1’s wingtip was located inside the circle drawn on aircraft 1. Aircraft 1 was then to perform different manoeuvres which aircraft 2 had to follow.

Later on you will find a more detailed description of PIO and how Saab is a world leader in handling it.

Methodology For Model-Based Development

In the design of the flight control laws in the flight control system on the Gripen, each component in the flight control systems hardware and software was modelled.

Model-based design was used right from the beginning when developing the flight control system on the Gripen.

Both hardware and software were modelled using Fortran code. The Fortran code was then implemented in the simulation tool for 6DoF batch simulations with the Gripen. The Fortran code was also implemented in simulators for simulation with pilots.

Simulations using the simulation tool were first carried out, followed by simulations with the pilot. Afterwards, modifications could be made in the SA 10 flight control system computer. Once this was completed, simulations were carried out in the MAHS. The control laws were manually coded in assembly code with routines for filtering and other frequently-used functions.

The SA 10 was a fixed-value computer where scaling and scale limitations had to be carried out for each signal chain in the data program, something which was difficult and time-consuming. On the other hand it was easy to make more minor program modifications directly into the computer program (patches) when carrying out simulations in the MAHS; this speeded up testing.

The assembly code in the SA 10 was also compared bit for bit with the Fortran code for the autopilot from the simulator tool and simulators

The aircraft handling and flight characteristics were checked in the simulators. The MAHS hydraulic system rig was used for this purpose, but with full knowledge of the system’s limited visual simulation.

Review and flight testing

Modifications in the flight control system were reviewed by various independent review groups from different disciplines with the help of pilots. The implemented code was also reviewed by an independent group specialised in code review.

The code implemented in the SA 10 then went through a very large number of verification and validation tests with the pilot before the new version of the flight control system was ready for flight. The modifications were then reviewed once more by an extra, independent review group. The entire above mentioned procedure must be carried out before flight test approval (abbreviation in Swedish: FUT). Once the authorities had given their approval, flights could then take place with the new code in the flight control system.

Test flights were also carried out on a series of reserve modes which occurred in the case of different errors in the flight control system. Among other things, this included an error in the air date information, i.e. disconnection to the DBU with a number of pilots.

The environmental durability of the SA 10 components could result in problems with ionising radiation. It was necessary to have a reserve mode with analog technology in case there was an error in the SA 10 flight control system computer or if the same software error occurred in the normal mode.

This reserve mode– an analog backup (ABU)– would be switched to if there were errors in 2 of the digital normal mode processors. The ABU mode was flight-tested with poor handling and flight characteristics.

The disconnection to this analog backup mode resulted in an unpleasant transient because the canards were unloaded and could float freely; with the canards moving like this it was very difficult to achieve good handling and flight characteristics. The analog backup mode was designed together with the German Deutsche Forschungsanstalt für Luft- und Raumfahrt DLR. It proved very difficult to achieve sufficiently good flight characteristics in a backup mode with free-floating canards.

Accident during the Stockholm Water Festival

Another accident took place in August 1993 during the Stockholm Water Festival.

Investigations of the crash protected memory (CPM) and film footage showed that the accident was the result of pilot-induced oscillations (PIO). The category III PIO was caused by non-linear elements in the flight control system and the undamped stick with the possibility to command very rapid large pilot command in sequence.

Saab made participated in the accident investigations. A construction group was formed to investigate the accident and began the work of finding a solution to the problem and the research was monitored by a number of international reviewers.

Categories of pilot-induced oscillations (PIO)

  1. Category I – linear pilot-vehicle system oscillations.
  2. Category II – quasi-linear pilot-vehicle system oscillations with rate or position limiting.
  3. Category III – non-linear pilot-vehicle system oscillations with multiple non-linear transitions.

PIO can occur when the pilot needs to carry out a controlled manoeuvre which requires a high level of concentration. These kind of manoeuvres are the ones which require increased attention and increased pilot gain from the pilot such as landing, formation flying, low-altitude flying or aiming.

In PIO Category I, the control system is too sensitive when the pilot wishes to carry out the desired controlled manoeuvre. This sensitivity is independent of the amplitude with which the pilot applies the command. In contrast, the sensitivity can vary according to the frequency at which the pilot attempts to carry out the command.

In the case of PIO categories II and III, the sensitivity of the control system may be correct and without a tendency for PIO until the magnitude and/or rate of the pilot’s command signals hits the non-linear element in the flight control system. This can have a drastic effect on pilot–in-the-loop stability.

As Saab was the first in the world to develop a modern statically unstable aircraft, we had to investigate the problems which can arise with statically unstable aircraft. We came up against the problem with the conventional rate limitations for control surface commands from the pilot and feedback. The system can become unstable if the loss of phase, i.e. the time delay, becomes too large between the aeroplane movements and the stabilizing flight control command from the pilot and the stabilizing feedbacks.

In the control system version which was in use at the time of the crash at the Water Festival in Stockholm in 1993, there was a conventional rate limiter from the pilot command and also one on the sum of the stabilising feedback command and the pilot command. The undamped control stick could easily produce an exaggerated command from the pilot which resulted in saturation in the flight control laws and stabilisation commands to the control surfaces. This resulted in large time delays which meant that the aircraft became unstable and ultimately crashed.

This resulted in the control and stabilisation commands required for a statically unstable aircraft to become delayed and resulted in "non-linear" PIO.

Up until that point the investigations had only been concentrated on linear PIO for which there are many theoretical criteria to check against the tendency for PIO, e.g. Neal-Smith, Gibson, etc. There were no theoretical criteria which dealt with PIO with non-linear elements in the system.

Aircraft subjected to different PIO categories

This section will look at a series of aircraft which have been exposed to PIO. This has implied bad, pilot-in-the-loop stability.

Aircraft Date Description


Development of A New Autopilot

During the development of the version Gripen 39B subseries 2, a new more modern autopilot called SA 11 was develloped. At the beginning of the 1990s, the possibility for improving the autopilot was possible. Additional development work to adapt the flight control laws and testing were then carried out.

There were several reasons to modernise the flight control system computer, for example weight on the old SA 10 version was over 20kg. In addition, additional power was required and the calculation capacity was not sufficient for the new functions to be installed. A new and better development environment was required, as well as changing outdated electronics.

There had been huge developments within electronics during the 1980s. Specially integrated circuits and processes had improved considerably.

The first version of the autopilot system on the Gripen had been designed at the start of the 1980s with the technology that was available at the time. It became possible to offer improved durability, lower weights and volumes as well as a greater computation capacity. It also made it possible to switch from machine assembly programming with whole number calculations to a higher level language and floating point calculations which resulted in considerable progress in programming. At that time, Ada was the recommended language in this type of integrated system.

Requirement for capability development for the new flight control system computer

Thanks to experience gained from the SA 10 autopilot, it was decided that there were a number of different improvements and additional capabilities that could be carried out when developing the new SA 11 flight control system computer system.

The SA 10 processor had limited calculation capacity and a limited memory; as a result, the durability of the processor could cause issues in the case of ionising radiation, e.g. when flying at high altitude. New processes are manufacturing integrated circuits during the 1980s reduced this problem considerably.

The absence of floating point calculations was obstructive and meant time and effort intensive manual control. The scaling of variables and checking that there was no overflow in the calculations also had to be done manually. The changeover from fixed-value with manual scaling to floating point calculations has proven in other programs to save more work that the change from assembly to higher level language.

It was essential to ensure the availability of components. At the time, it was expected that the availability of some of the components used in the SA 10 could become problematic.

The programming language and programming itself needed to be changed and improved.. The Ada programming language was used in the SA 10 to describe functions. With this as a basis, the computers were then programmed in assembly code. The flight control laws were programmed into a fixed-value computer with a 16 bit processor called the Z8002. Unfortunately there was no available compiler for the Z8002 which would make it possible to use higher-level language. In addition, it was also very uncertain whether the code which had been generated automatically would be comprehensive enough to be used. Programming in an assembly is a very slow and time-consuming process.

It was important to simplify work when updating software on apparatus and aircraft.

Monitoring of functions during test flights is important and needed to be improved and developed further. Certain functions were introduced into the hardware which resulted in problems with the function, weight and volume. In addition, this made it considerably more difficult to test before and to monitor during flight, compared to if a similar function had been implemented in the software. Automatic testing of these functions was complicated, especially in the case of the analog backup mode. It was not possible to test them during the time that was available before commencing flights.

The speed of the front edge flaps was monitored continually so that they could be stopped quickly in case of, for example, a break on the drive axle to avoid breaking them. This required faster decision-making. Originally this was done with hardware logic as the calculations in the processor would have been too slow. The circuits, however, were problematic during testing and could come back with incorrect readings during flight. By high-pass filtering the flap position signal before digitalisation to determine the speed, logic could be applied in the software with calculations at 400 Hz in the new SA 11.

In all aircraft design, weight is a primary factor to be taken into account. As a result, it was essential to reduce weight for all of the components involved in the control system.

New SA 11 autopilot

A comprehensive study was carried out in order to modernise the autopilot. This work was carried out in conjunction with the component supplier of the time.

A number of work packages were defined for each quarter autumn 1991 and for the following year. Within each period, many different areas were reported during the close of quarter meeting.

Selecting the processors for the SA 11 autopilot

A major point during the first quarter of the upgrade studies was selecting the process of calculating the control functions and managing incoming and outgoing data. A number of possible candidates were chosen by studying the construction of the processors are available on the market in specialised magazines.

The calculating capacity for them was tested with a preliminary version of the Gripens control system software; a high calculating capacity was a deciding factor in the final choice of processor made. Saab’s tests were compared with standard tests for the evaluation of processor performance. The studies found large discrepancies, as Saab required a great deal of calculations involving floating points but little data management.

The future availability of components used was also essential to a system which was to be produced from many decades and to be used for a long time. Access to a good development environment was also important, and these factors had a considerable effect on the final choice of processor.

A preliminary design was made to taking into account the weight, volume and power consumption in order to evaluate differences.

Taking into account the aforementioned, the list of candidates could be whittled down to a final decision. The final processor chosen was the Motorola 68040, mainly thanks to its high calculation capacity. The Texas TMS320C30 was selected as the processor for incoming/outgoing data due to its simple integration into incoming/outgoing circuits, its high calculation capacity, the possibility of its use for floating point calculations and its durability in the case of ionising radiation.

The method for evaluating processor performance has proven itself very successful, even being used in several successive development programmes such as Neuron Avionik and MIDCAS.

Implementation of the new autopilot in the Gripen 39B

Subseries 2 of the Gripen designed during the mid-1990s also saw the development of a special version called the Gripen 39B which was a twin-seater (training) version. A mechanically damped control stick which improved sensitivity and control was designed especially for this purpose.

The flight control laws the autopilot needed to be customised as the 39B had different accelerometer placement. Apart from that, no great modifications needed to be made to the flight control laws in the control system.

In the JAS 39 Gripen 39B, there were 2 control sticks from which the commands were summed in the flight control laws. If necessary, the trainer was able to disconnect the pupil and take over the control by pressing on the ‘quick disengage’ button. The pilot’s forward commands were also adapted to the more front-heavy 39B.

Test flights with the 39B quickly showed sensitivity problems in pilot-in-the-loop scenarios with a tendency towards PIO Category I issues at certain high subsonic speeds.

PIO testing on the Gripen 39B – twin-seater design

The test assumes that the single-seater version of the Gripen is PIO-free.

  • The loop is closed over theta (c with a fictitious pilot which is, in this case, just a gain.
  • The pilot gain is increased in the (Gripen single-seater) loop to the extent that the pilot control shows as little oscillation as can be seed in the figure below.
  • After that, the same pilot gain used in the single-seater version is fed into the twin-seater version loop; as can be seen in the figure below, this result in a clear drop in pilot-in-the-loop stability with a high number of oscillations.
  • After that, the pilot’s command events (in the twin-seater version) are adjusted to the same pilot-in-the-loop stability as in the single-seater version.

The figure below shoes the PIO Category I with the JAS 39 B Gripen (twin-seater version) at high subsonic and low altitude, compared with the JAS 39 A Gripen (single-seater version). 

Flight characteristics and backup mode

Earlier versions of the SA 10 autopilot included an analogue backup mode as it was assumed that the safety system was not capable of detecting and isolating all dangerous error functions in the digital system. In addition, the software was a single point with a risk of generating error functions; in addition, it was also problematic that the system would need to be operated in a very disadvantageous environment.

During the 1980s, developments within electronics led to digital components becoming considerably more durable when faced with ionising radiation. Experiences from the software with critical calculations was also positive, and so the decision was made that an analogue backup function was no longer required.

Different concepts for the backup were studied

One concept involved having a completely independent computer for control functions running in parallel with the other computers; this would have been a very radical way of ensuring independent functioning. The plan was to introduce this solution towards the start of the 1990s, with a single-chip computer on each channel with input and output handling parallel with the other processors. In case of an incident, this processor could then take over and offer a simplified control function.

Another concept was to introduce backup system functions in the input/output processor software, which would have been the simplest implementation as all of the data in the system would have been found in this single processor. By selecting an I/O processor with floating point calculations in a high calculation capacity, it became easy to implement the functions within the software. This design would also make it possible to reduce weight and volume. As a result, this was the design that was finally chosen.

By introducing a digital backup, there was also the possibility of introducing better flight characteristics in order to reduce the risk of flying in backup mode. This meant:

  1. Variable gains depending on the speed and altitude.
  2. Monitoring of the control servos.
  3. Mid Value Select of sensor signals control servo command outputs.

As the characteristics of the aircraft change considerably depending on speed and altitude, the backup gains need to vary.

The aircraft angle of attack (alfa, α) depends on the speed and load factor (nz). The α/nz ratio gives a measure of the speed and the idea of using this figure to calculate the gains in backup mode arose during the development of the SA 11. The α/nz is very dynamic when manoeuvring and the value is not useful when nz is close to zero or when the difference in the angle of attack at speeds of over Mach 0.7 is low. Such cases require a logic and filter.

In order to further improve the characteristics, it was also concluded that it was possible to use speed information from the air data system calculated from the pressure measurements.

A comprehensive logic with filtering was required in order to ensure that the correct signal of the four was selected so as to ensure stable speed compensation. The selected flight control law also had to work with fixed amplification at speeds of over 0.7 Mach at low altitude and the equivalent at higher altitudes as the change in the angle of attack was low as speed changed. As a result, DBU flight control laws were used as a basis and selected gains could be made as a function of speed.

The author´s reflections