Recorded, then proven.
What the instrument does, and how it is proven. Every result on this page comes from a recording that was judged sample by sample and compared with a reference the instrument does not use.
Joran and the FlySys display are tested as one system: the sensors and their acquisition, the navigation filter that computes attitude, heading, altitude, position, velocity and the wind, and the display that draws them. The position reaches the instrument without a cable, over Bluetooth Low Energy (BLE): indoors from an ultra-wideband (UWB) ranging tag, outdoors from our own satellite (GNSS) receiver. The instrument chooses the source: the tag, the receiver, or automatic, which takes the tag when it is in range and the receiver otherwise. Both paths are tested. Every test starts from a recording made on the instrument: the raw sensor data with the calibrations and settings in force, which replays through the same filter at any time.
Every sample, counted by an independent judge
The sensor stamps its data with its own clock, and a separate program reads the recording and checks every interval. A recording is accepted only if no sample is lost: proven from the file, never asserted by the instrument. The judge itself was put on trial with faults injected into a clean recording, and caught every one.
Every change, the same test
A change is reviewed adversarially before it reaches the bench, then passes the same judged 10-minute recording before it ships. A single lost sample is a failure, and the change waits until its cause is known.
Two independent implementations
The instrument's filter and a desktop version written separately run the same recordings and are compared row by row. Where they differ, one of them has a defect until the difference is explained. Holding the two together has found faults that neither showed alone.
Independent references
The indoor test train runs on a track whose shape is known from the geometry of the floor alone, owing nothing to radio. Simulated flights carry a truth known exactly: turns, wind, a restart in the air, built on real recordings that keep the sensors' real noise and timing.
The filter checks itself
A filter can give a good position and still understate its error. Statistical tests on every validation recording check that the filter's uncertainties match its actual errors, and a measurement that disagrees with the prediction beyond them is refused and counted.
Every failure gives its cause
A failure writes its reason in the instrument's journal; nothing is hidden or silently repaired, and a value that is not a number prints as nan, never as zero. Faults are provoked on purpose (a stalled card write, a wrong sensor setting) to prove that the fix holds.
A replay writes nothing
A replay takes its whole context from the recording: its sensors and the settings it was made with. It changes nothing on the instrument, and two replays of one recording give the same trace, row for row.
Every recording kept
Every recording is archived with the calibrations and settings in force, in a local copy and an off-site one, so any result here can be computed again from its data.
- Continuous recording
- 26.5 h without a lost sample, the verdict read from the file
- Test train, position against its track
- 3.7 cm median, 6.4 cm for 90 % of the time; the radio ranges alone: 4.7 and 10.8 cm
- Test train, no position fix after the first lap
- once the heading is learnt from the first lap, four more laps on the inertial sensors, the wheel constraint and one stop alone stay within 5 to 8 cm (median) of the track; the drift takes off in the sixth lap
- Cold restart in flight
- 14 restarts in turns of 25 to 45°, in S-turns and on the take-off roll: horizon within 0.4° five seconds later, every time
- Horizon over a whole flight
- within 0.55° at worst, with GNSS
- Heading over a whole flight
- within 0.7° of the truth for 90 % of the time, with GNSS
- Wind, estimated in flight
- within 0.1 to 0.4 m/s after the first turn, in a 15 m/s wind
- Statistical consistency
- the uncertainties match the errors on every validation recording
- Gyroscope noise
- at or under the catalogue figure on all three axes, over a full day and night at rest
- IMU calibration, on the instrument
- one pass of 14 positions in about 5 minutes, no computer: the accelerometer's offset and scale at the local gravity, the gyroscope's scale and the alignment between the two; on a synthetic pass replayed on the instrument the injected scale errors come back within 70 ppm and the alignment within 20 µrad
- Compass in a weak field
- the calibration converges to the same centre at 19.1 µT (Cumbuco, Brazil) and at about 48 µT (Geneva)
- Compass plausibility
- the magnetic heading is used only while the measured field is within 0.7 to 1.3 of the calibrated strength; outside, the sample is counted and ignored and the heading is carried by the gyroscopes and GNSS
- A limit, measured
- without GNSS and without airspeed, a sustained acceleration on the take-off roll cannot be told from a pitch-up: 13° in the simulation
The flight results come from simulated flights with GNSS, built on real recordings and replayed on the instrument; the train results from the indoor UWB test track.
On the bench
Done. Long recordings judged sample by sample, the turntable, the UWB test train and balancing robot, simulated flights and drives, the GNSS chain over BLE with a computer posing as the receiver.
Next. Every change keeps passing the judged recording.
In the field
Done. The compass calibrated in the weakest magnetic field on Earth, the South Atlantic Anomaly, and in Geneva.
Next. The instrument in a car with our GNSS receiver, restarted in curves.
In the aircraft
Done. The flight simulated on real recordings: turns, wind, restarts in the air.
Next. Joran and the display in a Robin DR400, checked against references they do not use.