The instrument does
the flying math.

Attitude, heading, turn rate, slip, load factor, barometric altitude against the pilot's QNH, vertical speed and GNSS position — all computed on the instrument and streamed to the display as one atomic frame, sixty times a second. No phone sensor takes part: the picture is the same on any device, propped at any angle.

The attitude travels as a complete quaternion — all four components on the wire. A display that rebuilds the fourth component from the other three loses precision exactly at 180° from its reference, and the horizon trembles there from quantization noise alone. Nothing is reconstructed display-side: every attitude renders with the same precision, the instrument upside-down included.

A mechanical altimeter keeps its QNH when you swap the glass in front of it. Joran extends that idea to the whole panel: the altimeter setting, display units, auxiliary field and alarm thresholds are stored on the instrument. Any display that connects adopts them within a second — swap the tablet for a phone mid-flight and the cockpit looks exactly the same. Change a unit on one display and every display follows, because the instrument is the single source of truth.

Alarms originate on Joran, not in an app — a display that happens to connect can neither miss them nor silence them by accident. Two levels, aviation-style: an amber caution (a soft double note, no acknowledgement owed) and a red alarm that stays until the pilot explicitly acknowledges it. Battery warning and critical voltages are the pilot's to set, and they persist on the instrument.

Joran records its raw sensor stream on board and replays it faithfully — the same filter, the same numbers, the same display, every time. Calibrations (magnetometer, accelerometer, installation) run on the instrument with guided maneuvers and audible cues, straight from the PFD's settings panel — including the gyro measurement range, selectable 1000 or 2000°/s and stored on the instrument. The app's two-pane file manager moves recordings between the instrument's card, the tablet and flysys.ch, every hop checksum-verified. Firmware updates arrive over Bluetooth, in the field, with integrity checks end to end.

How the Primary Flight System fits together: the instrument, the link, and the screen.

Joran — our own AHRS & Air Data Computer — computes everything on board: attitude, heading, turn rate, slip, load factor, barometric altitude against QNH, vertical speed and GNSS position. It streams ready-made flight data over Bluetooth LE; the Android device is a pure display. Joran is a proprietary FlySys instrument, developed in-house.

Every calibration below runs on Joran — started from the PFD’s settings panel (CAL MAG, CAL 2D, CAL ACC, ALIGN), guided with audible cues, judged by the instrument and persisted on board. Swap the display: the calibrations stay.

The three calibrations enter Joran's signal chain at different points — the accelerometer fix is applied to the raw signal before the filter, the gyro alignment happens inside the filter, and the magnetometer fix feeds heading. All of it on the instrument; the display only presses the buttons.

Metal and avionics distort the local magnetic field in two ways. Hard-iron comes from permanently magnetised material — speakers, screws, magnets — and adds a fixed offset that shifts the whole field; it moves the centre c. Soft-iron comes from ferromagnetic material that bends and re-scales the field differently with heading; it stretches the sphere of readings into a tilted ellipsoid — the shape W. Calibration maps both and corrects them, so magnetic heading reads true in the installed environment — not just on the bench.

The fit. Started with CAL MAG, the instrument collects while you turn it slowly through all orientations; the raw samples trace an off-centre, squashed sphere. A full ellipsoid fit — linear least-squares (Merayo-style) on the quadric — recovers the hard-iron centre c and a soft-iron 3×3 shape W that maps the ellipsoid back to a sphere. Installed in the aircraft, where you can't tumble the airframe, CAL 2D fits a 2D ellipse from one level turn instead. A residual-RMS (root-mean-square) and an axis-ratio check reject a bad fit — the instrument announces the verdict.

Continuous calibration in flight. Hard-iron is not constant: the battery's nickel re-magnetises with its state of charge, and the centre c drifts within one or two hours of a fresh calibration — enough to bend the heading by several degrees. The instrument therefore keeps a background estimator running (on by default): a recursive least-squares sphere fit (Kása method, with exponential forgetting) re-solves the hard-iron centre every two seconds from the samples the flight itself provides, gated by gyro rate and heading diversity — a thermal circle is all it needs. Because near-level flight cannot observe the vertical centre, the solve is Tikhonov-regularised (ridge) toward the stored calibration: the horizontal centre — the part that steers heading — follows the data, the vertical stays anchored. The correction rides as a bounded overlay on top of the stored fit, is slew-limited so the heading never jumps, persists across reboots, and latches a SATURATED alarm if the drift exceeds what an overlay should absorb — the sign to redo CAL MAG. The switch and its live state are on the app's settings panel; a deliberate off persists on the instrument.

The sensor clock audits itself. Every rotation is an integral of rate over time, so the IMU's sample clock is measured continuously against the MCU's crystal timebase and the measured period — not the nominal one — drives the integration. At every lock the live measurement is cross-checked against the sensor's own factory trim of its oscillator, read back from the silicon: two independent witnesses that must agree. A disagreement beyond what post-factory drift can explain raises the sensor-configuration alarm — the check that reduced a field case of a wrongly-inherited sample-rate register (a clean 6/5 clock error, invisible to every downstream consistency test) from a day of diagnosis to one status line. At boot the instrument also resets the sensors' configuration registers, so nothing survives from any firmware the hardware ran before.

Fast when it matters, quiet when it doesn't. The heading correction runs on one curve with three regimes: softened during rotation (map disagreement is paid slowly, the horizon flows), fast for two seconds after the rotation stops (right after a maneuver the residual is real by construction — the last degrees settle in under a second), then innovation-gated at rest (field noise below half a degree does not move the needle; a genuine drift above two degrees does). Measured on the turntable: within 0.4° of the final heading 1.1 s after a 90° step, with an at-rest band of ±0.15°.

Re-run when the environment changes — a new mounting, added avionics or a different airframe all shift the field. Recalibrate to keep the map current; the continuous estimator absorbs slow drift, not a re-arranged cockpit.

Keyed by what actually affects it — the 3D calibrations (the accelerometer 6-face fit and the magnetometer sensor fit) characterise the sensor itself, so they are stored per IMU (by its address) and stay valid at any mounting. Only the in-aircraft 2D magnetometer fit depends on the install orientation, so it is stored per IMU and per mounting preset. Swap IMUs or change the mounting and the app loads the matching calibrations automatically — and a 3D calibration is never re-run just because the mounting changed.

A small per-axis offset or scale error tilts the measured gravity vector and shows up as a bank error growing toward 45°. A classic six-point fit removes it. Hold the unit still on each of its six faces in turn:

Each axis is bracketed by its + and − faces, giving a per-axis offset and scale — an axis-aligned ellipsoid mapped to a sphere whose radius is the mean of the three axis radii, with no absolute-gravity assumption. The result is applied to the raw accelerometer before the filters, so every estimator benefits.

Every gyro has a small zero-rate bias that, uncorrected, would drift heading and attitude. A short static "Align" window at power-up — held still on the ground — measures and removes it automatically.

The discipline behind the numbers — vibration, manoeuvre load, dropped links, stale data — running at 240 Hz on the instrument, with a zero-loss acquisition and one rule for live and replay.

Airframe and engine vibration ride on the raw accelerometer and gyro. The instrument fights it at the source: every rate cascade step is a windowed mean — anti-aliased by construction, no phase surprises — and the fusion filter adds trust gates that reject measurements taken while the sensor is being shaken or saturated. The display applies its own final smoothing to what it renders. Vibration that cannot be filtered is engineered away: the mounting isolation is chosen with the on-board spectral monitor (microphone PSD) pointing at the offending frequencies.

The accelerometer only tells you "down" when it's measuring pure gravity. In a turn, under braking, in turbulence, it isn't — so its correction is gated. And the reference gravity magnitude is learned per device (a slow exponential moving average (EMA), τ≈16 s) rather than assumed to be 9.81 m/s² — MEMS (Micro-Electro-Mechanical Systems) units often read ~10.2 — so a scale bias can't quietly tilt the horizon.

Gating the accelerometer would leave the filter blind through a long turn — so it is never the only correction. The ESKF (Error-State Kalman Filter) runs a set of independent measurement updates, each watching a different observable and weighted by its own σ. When gravity can't be trusted, these are what hold a true attitude.

With the GPS receiver now on board, the next updates on the roadmap bring its observables into the same set: coordinated-turn bank from track rate, flight-path pitch from vertical speed, and GPS track as a heading fallback.

The load-factor bank is the quiet workhorse: acos(1/N) reads the bank straight off the g-load with no GPS at all — so a coordinated turn stays true even with no satellites and the accelerometer gated off.

Small touches that matter in the cockpit: the tape digits roll over with hysteresis so they never flicker on the boundary, and if the data goes quiet the display tells you — it doesn't pretend.

Bluetooth in a metal cockpit drops. When it does, the reader reconnects on its own and re-seeds the attitude from the current orientation, so the horizon snaps back upright instead of tumbling.

The IMU module fuses natively in ENU (East-North-Up); the PFD's attitude pipeline works in NED (North-East-Down). The app re-expresses the solution ENU→NED at ingestion, so every filter, the horizon and the slip ball share one consistent frame.

Every session can be recorded on the instrument's own card — the raw sensors and the filter's answers, two halves of one recording. The app's file manager moves those records over the air: card → tablet → flysys.ch → another card. A flight recorded in one city replays on a bench in another the same evening, through the same filter, sample for sample.

No Bluetooth hardware? The internal-sensor, simulator and replay paths run on an emulator, so you can try the full display before wiring anything up.