Modern weapon systems increasingly derive their capabilities from software. Real-time scheduling and memory-based isolation keep safety-critical functions separated from innovative software components.
Tanks, frigates, and combat aircraft remain in service for decades, yet their operational effectiveness increasingly depends on the software that controls their functions, processes situational data, and enables connectivity. Software-Defined Defence (SDD) shifts the focus of capability development from the mechanical platform to modular software components that can be updated at short intervals. Together with the industry associations BDSV, BDLI, and Bitkom, the German Federal Ministry of Defence has described this approach as a guiding principle for the future development of the armed forces [4]. The concept combines a virtual abstraction layer, real-time partitioning, and partition-level certification.
The abstraction layer between hardware and capability
Traditional defence programmes tightly couple safety-relevant functions to hardware and firmware. Adding new capabilities required replacing assemblies or retrofitting additional modules, resulting in additional costs and lengthy downtime [1]. SDD reverses this logic. A virtualisation layer is placed between the physical platform and the application logic, decoupling military functions from the underlying electronics. Individual software modules run on this layer as isolated units that can be replaced, extended, or instantiated simultaneously across multiple systems [4].
The technical foundation for this separation is a hypervisor with a separation kernel. It divides a single computing platform into multiple independent partitions and assigns dedicated processing time and memory regions to each partition. SYSGO implements this principle with the PikeOS real-time operating system, which combines hypervisor functionality and hard real-time capabilities in a single kernel [9]. Partitioning allows safety-critical and non-critical applications to run on the same hardware without interfering with one another. A mission computer can therefore execute a certified control function and experimental analytics software in parallel while keeping them strictly isolated.
Real-time scheduling and memory-based isolation
The coexistence of critical and innovative software is based on temporal and spatial partitioning. Temporal partitioning assigns each partition fixed processor time slots, ensuring that a compute-intensive AI component cannot deprive a flight-critical control loop of CPU time. Spatial partitioning uses hardware-supported memory isolation so that a fault in a non-critical application cannot overwrite the memory of a safety-critical function.
PikeOS implements this time and space partitioning architecture and supports mixed-criticality systems in which applications with different criticality levels coexist [9]. Standardised interfaces such as ARINC 653 can be used to define avionics partitions with deterministic behaviour. The operating system supports a range of guest environments, including Linux, Android, Windows, and POSIX runtime environments, and runs on x86, Arm, PowerPC, and RISC-V architectures. For less critical, connected components, SYSGO offers ELinOS, an industrial-grade embedded Linux distribution that can be integrated into the same system landscape.
The Fraunhofer Institute for Cognitive Systems IKS describes the higher-level concept as an adaptive architecture with a control loop that monitors system status, analyses problems, and, when required, plans and implements behavioural changes [8]. A central knowledge base provides the information required for this adaptation. The advantage is that system mechanisms can be updated without hardware modifications or system downtime.
Certification at partition level
Partition separation fundamentally changes the certification of safety-critical systems. Instead of reassessing the entire system after every modification, certification activities can be limited to the affected partition. An isolated partition containing a flight-critical function can retain its certification even when new software is deployed in an adjacent partition.
Functional safety and cybersecurity are addressed through separate assurance paths in PikeOS. For functional safety, the operating system can be developed and qualified for use in accordance with DO-178C in avionics and ISO 26262 in the automotive domain. These standards address systematic and random failures and system behaviour under technical fault conditions. Protection against a deliberate attacker requires a separate assurance process with its own evaluation criteria; this is provided by security certification under the Common Criteria.
The PikeOS separation kernel in version 5.1.3 has achieved EAL5+ under ISO 15408 for Armv8, x86-64, and PowerPC architectures [9]. The assurance level has a specific meaning in terms of the assumed attacker. From EAL5 onward, the design is described semi-formally and evaluated against attacks whose successful exploitation requires substantially greater effort, tools, and expertise than at lower assurance levels. The evaluation addresses threats such as sabotage and data theft. For system architects, this provides substantiated assurance regarding the effectiveness of the isolation mechanisms against an active adversary, independently of functional-safety considerations.
Cybersecurity is a dedicated development focus at SYSGO alongside functional safety. The portfolio includes Secure Boot for a signature-verified boot chain, a Trusted Execution Environment for isolated cryptographic operations, an Intrusion Detection System for detecting attacks during operation, and secure routing functions between partitions with different confidentiality levels [9]. The kernel follows the MILS approach, allowing multiple independent security levels to coexist on one platform while keeping data of different classifications separated. A mission computer can therefore process classified command-and-control information and unclassified sensor data on the same hardware without allowing information to cross between confidentiality domains.
The kernel itself remains small and provides only a limited number of system calls. This small trusted computing base reduces the attack surface and makes comprehensive evaluation of security-relevant code feasible, something that becomes impractical with large operating-system kernels. An accompanying EAL5+ certification kit can reduce the effort required to certify a device built on the platform, as evidence, test results, and documentation from the kernel evaluation can be reused in the device manufacturer’s certification process.
The solution’s ITAR-free status enables deployment without US export restrictions and keeps control of safety- and security-critical components in Europe. In this context, SYSGO supports programmes at Airbus Defence and Space and provides a foundation for systems developed by Rheinmetall [9].
The position paper issued by the strategic industry dialogue identifies the adaptation of testing and verification processes as an outstanding task [4]. Once new software or AI functions have passed acceptance, responsibility for their subsequent operational use must be defined contractually. The German Federal Office for Information Security (BSI) is also adapting its verification procedures accordingly.
AI components as deployable software updates
Within the SDD paradigm, AI is considered a driver of numerous capability-enhancing applications. Through the abstraction layer, AI algorithms can be deployed as software components without modifying the underlying platform. New threat signatures, improved target recognition, or pattern recognition for camouflage and radio-frequency signals can thus be delivered to existing systems via software updates [4]. For military use, these models must be retrained, tested, certified, and distributed down to the tactical level.
A practical example is the Minesweeper software currently being tested by Airborne Engineer Company 270 in Seedorf [3]. It combines drone technology with AI, analyses magnetic fields captured by sensors, and generates maps marking mined and cleared areas. Integration with the SitaWare command-and-control system is planned; SitaWare is used by more than 50 nations, including NATO members and the Bundeswehr [3]. Originally developed by the startup ASDRO to detect unexploded ordnance in construction sites, the software was adapted to military requirements together with the Bundeswehr Cyber Innovation Hub.
Another initiative illustrates the pace of innovation enabled by this approach. In the field of CBRN defence, the Yggdrasil project connects sensors ranging from drones to wearable warning devices through standardised interfaces in a shared data space [11]. The open-source HYDRIS orchestration layer combines data from nuclear, biological, and chemical sensors with weather information and makes the results available in the SitaWare and NEWS battle management systems. The Prisma AI layer correlates sensor data, weather models, and open-source information to generate probabilistic situational assessments and prioritised courses of action. New threat signatures can be introduced through software updates, allowing CBRN defence capabilities to adapt on a weekly rather than annual cycle. The human-in-the-loop principle remains in place, with responsibility ultimately remaining with human operators [11][8].
Rapid development and deployment
Short update cycles require a change in development methodology. Rigid waterfall models are being replaced by iterative approaches involving early prototypes, regular updates, and feedback from operational use [5]. The position paper groups these activities under Rapid Development and Deployment and calls for agile, user-centric methods, a high degree of automation through standardisation, and open interfaces designed according to Security-by-Design principles [4].
The ability to update individual partitions independently supports faster deployment of new software packages. Signed offline updates can reach strictly isolated air-gapped networks without opening their security perimeter. Rolling updates and blue-green deployments enable security patches to be introduced during operation while critical services remain available. Over-the-air updates can also update systems deployed in the field [3].
Model-based methods support this process. Model-Based Systems Engineering (MBSE) represents complex systems virtually before physical implementation and enables early simulation of hardware-software interaction [5]. Version 2 of the SysML modelling language, adopted in 2024, improves interoperability between modelling and simulation tools and links architectural models directly with executable code. The result is an end-to-end digital thread extending from requirements management through operation.
Open architecture and interoperability
The value of SDD depends on open interfaces and common standards. The German Bundeswehr has structured its IT landscape into nine clusters based on the NATO C3 Taxonomy and placed them under common portfolio management [4]. On this basis, the Foundation@SDDBw approach separates the IT platform from application logic and integrates platform-specific capabilities in support of federation in accordance with Federated Mission Networking (FMN). Recommendations include dynamic provisioning of new partitions (VMs), comprehensive API management, and pilot projects for a software-defined defence system.
At the industry level, several vendors address this architectural layer. With its MDOcore software suite, HENSOLDT connects sensors, effectors, and command-and-control assets across the land, air, maritime, cyber, and space domains and enables its own sensors for SDD through open interfaces and containerised services [6]. The Orchestra integration platform from soffico follows the principles of a Modular Open Systems Approach and uses open NATO standards such as STANAG and the Multilateral Interoperability Programme (MIP), with the NATO Generic Vehicle Architecture (NGVA) serving as a reference. Prebuilt adapters for these standards shorten integration with partner networks and reduce certification effort. Major programs such as the Future Combat Air System (FCAS) rely on an Air Combat Cloud through which combat aircraft and unmanned aerial vehicles communicate with one another and with other defence systems [9].
As the Bundeswehr’s digitalisation partner, BWI describes SDD as the creation of an Internet of Military Things in which an integrating IT platform connects different systems through common standards [2]. Lieutenant General Michael Vetter, Head of the Cyber/Information Technology Department at the German Federal Ministry of Defence, summarises the prerequisite as follows: “Proprietary solutions must become a thing of the past” [3].
Information security in the SDD paradigm
Faster software distribution improves information security while simultaneously creating new attack surfaces. Security patches can reach systems faster and more precisely, but greater connectivity also increases architectural complexity [4]. Security by Design and Security by Default must therefore be incorporated from the outset, complemented by approaches such as Zero Trust and fundamental capabilities for encryption and authentication.
A secure data backbone connects systems across all security zones. Protocol translation, priority-based routing, and a cross-domain gateway ensure that information remains encrypted and fully auditable. Crypto-agile frameworks prepare systems for migration to post-quantum algorithms and reduce dependence on individual vendors. Fraunhofer IKS applies Safety-by-Design principles throughout the entire lifecycle and subjects AI functions to formal validation and verification processes to ensure that adaptive and AI-driven decisions remain within defined safety boundaries.
The supply chain remains an open issue. The position paper calls for securing software deployment and establishing supply chain transparency, accompanied by further development of risk management and adapted classification requirements [4]. A Software Bill of Materials records every deployed component, including its version and origin, making it possible to determine quickly which platforms are affected when a vulnerability is disclosed. The legal origin of components is equally important: an ITAR-free foundation removes foreign-government approval requirements from the supply chain and allows modification and export without third-party authorisation. SYSGO supplies PikeOS and ELinOS ITAR-free from Europe, thereby keeping the lowest system layer under European control [8].
Economic and contractual prerequisites
SDD changes the commercial foundations of the defence industry. System-specific IT has traditionally resulted in low production volumes and high complexity under stringent regulatory requirements [4]. Modular software with open interfaces reduces lifecycle costs and promotes competition because modules developed once can be reused across multiple programs. Capabilities can be added through software instead of costly hardware upgrades, while virtualisation reduces the number of physical devices required.
The legal framework requires new contractual arrangements. Copyright, intellectual property, usage rights for systems, and rights to operational data must all be addressed contractually [4]. Traditional OEM contracts for weapon systems are becoming more open, while functional responsibility and the allocation of liability among the parties involved require clear definition. In parallel, the Bundeswehr is building its own software expertise as a catalyst, while ensuring that industry retains access to the software modules.
What decision-makers should plan for now
The transition to SDD follows a step-by-step approach. Fraunhofer IKS recommends first assessing the existing architecture to identify tightly coupled hardware-software dependencies, then mapping the applicable safety and security standards, and finally implementing a pilot of the new architecture [7].
The applicable standards depend on the domain and the criticality of the respective partition. Airborne systems are subject to DO-178C and the partitioning requirements of ARINC 653; land-based platforms may be governed by ISO 26262; and industrial control components by the IEC 62443 series. Cybersecurity follows a separate assurance path, with ISO 15408/Common Criteria used to evaluate isolation mechanisms and ISO 27001 addressing the overarching information security management system. Additional requirements imposed by public-sector customers include German classified-information regulations and BSI verification procedures [4].
For CIOs and CTOs, the primary benefit is greater speed and control, as existing platforms can be kept current through software updates, and their service life can be extended. CISOs benefit from partition-level certification and end-to-end auditability, which help contain risks and simplify security assurance. Compliance officers and data protection officers can use tamper-resistant versioning to maintain traceable evidence for auditors. Enterprise architects gain reusable patterns that reduce duplicate effort and accelerate the integration of new capabilities.
Investment signals support this direction. In 2023, more than 60% of Germany’s €100 billion special defence fund had been placed under contract [2]. Software-Defined Defence provides the guiding principle for translating such investment into capabilities that remain adaptable over the long term, from sensors to command-and-control applications.
Sources
[1] PTC, whitepaper “Zeit ist Sicherheit” (“Time Is Security”), April 2025, https://www.ptc.com/de/industries/aerospace-and-defense
[2] BWI GmbH, “Neue Chancen durch Software Defined Defence” (“New Opportunities through Software Defined Defence”), 7 February 2024, https://www.bwi.de
[3] Bundeswehr, Cyber and Information Domain, “Moderner per Mausklick” (“Modernization at the Click of a Mouse”), 26 February 2026, https://www.bundeswehr.de
[4] BDSV, BDLI, Bitkom, BMVg, “Positionspapier Software Defined Defence” (“Position Paper on Software Defined Defence”), version dated 31 October 2023
[5] itemis AG, “Software Defined Defence”, 22 March 2025, https://www.itemis.com
[6] HENSOLDT AG, “Software-Defined Defence”, https://www.hensoldt.net
[7] Fraunhofer IKS, “Ein Turbo für die Verteidigung” (“A Turbocharger for Defense”), 11 February 2026, https://www.iks.fraunhofer.de
[8] SYSGO GmbH, “Defense” and “PikeOS”, https://www.sysgo.com/defense
[9] T-Systems, whitepaper “Aerospace und Defense”, November 2022, https://www.t-systems.com
[10] Bundeswehr Cyber Innovation Hub (Sven Weizenegger), Yggdrasil and Prisma innovation projects, LinkedInhttps://www.ptc.com/de/industries/aerospace-and-defensehttps://www.bwi.dehttps://www.bundeswehr.dehttps://www.itemis.comhttps://www.hensoldt.nethttps://www.iks.fraunhofer.dehttps://www.sysgo.com/defensehttps://www.t-systems.com
