Avionics & Systems Engineering
Flight electronics and managing complex systems: requirements and the V-model, interfaces, reliability and redundancy, safety analysis, data buses, navigation sensors, Kalman filtering, ADS-B surveillance, real-time software, and verification, with six labs. Free, self-paced, and tied to Landsat 9, Hubble’s gyros, Dragonfly’s autonomy and FAA air traffic.
Courses › AERO 450
About this course
This is a free self-study course outline written by Saving Planets. It is not a university course, it carries no academic credit, and no school is involved.
Its scope follows a one-semester senior course in avionics and systems engineering. It is modeled on the topics and depth of MIT 16.842 Fundamentals of Systems Engineering (free on MIT OpenCourseWare) and the NASA Systems Engineering Handbook, which we link where they help. Neither MIT nor NASA endorses this page.
What we add: every unit ties to real work with a cited public source (Landsat 9, Hubble, Dragonfly and the FAA’s air traffic system), every number on the page is re-computed by a checking script before it goes live, and every lab has a free simulation or a spreadsheet.
Work through it in order. Each unit has goals, key ideas, equations, step-by-step examples, practice with full answers, common mistakes, flashcards and a quiz. Your progress is saved only in this browser.
How this course helps save the planet
Earth-observing satellites, weather spacecraft and efficient air traffic all depend on avionics that work for years without a repair visit, and on systems engineering that makes thousands of parts behave as one.
Good requirements, redundancy and testing are what let a satellite keep measuring forests, ice and oceans long past its design life. Each unit ends with a short, sourced section. Values that are not from a source are labeled as sample or textbook values.
Before you start
Prerequisites
- Circuits: voltage, current, resistance and digital signals.
- Probability & Statistics: probability rules, exponential distribution and variance.
- Flight Dynamics & Controls: feedback, sensors and actuators.
- Intro to Programming: loops, functions and timing.
How to study
- Start every problem from the requirement it serves.
- Draw block diagrams and interfaces before computing anything.
- Keep probabilities as numbers between 0 and 1 and check that they stay there.
- Track units: bits, bytes, seconds, hertz, decibels.
- Ask “what happens if this part fails?” for every box you draw.
- Do every practice problem on paper before opening the answer, and retake the quizzes a few days later.
Lab equipment (for the wet labs)
- A computer or tablet for the free PhET Circuit Construction Kit: DC simulation.
- Spreadsheet software (any free one works), or Python.
- The free NASA Systems Engineering Handbook in a web browser.
- A calculator.
Suggested 15-week schedule
About 6 to 9 hours a week: reading, practice problems and, in lab weeks, the lab.
| Week | Unit | Topics | Reading |
|---|---|---|---|
| 1 | The Systems Engineering Life Cycle and Requirements | Life cycle and requirements | NASA SE Handbook |
| 2 | Architecture, Interfaces and Integration | Architecture and interfaces; Lab A | MIT 16.842 |
| 3 | Reliability and Redundancy | Reliability models | NASA SE Handbook |
| 4 | Reliability and Redundancy | Redundancy; Lab B | NASA Hubble |
| 5 | Safety Analysis: FMEA and Fault Trees | FMEA and fault trees; Lab C | NASA SE Handbook |
| 6 | Digital Avionics and Data Buses | Digital avionics | MIT 16.842 |
| 7 | Digital Avionics and Data Buses | Data buses; Lab D; midterm practice | NASA Landsat 9 |
| 8 | Navigation Sensors: IMUs, GNSS, Cameras and Lidar | Navigation sensors | NASA Dragonfly |
| 9 | Sensor Fusion and the Kalman Filter | Sensor fusion and Kalman filters; Lab E | MIT 16.842 |
| 10 | Communication and Surveillance: ADS-B | Communication and ADS-B | FAA ADS-B |
| 11 | Real-Time Flight Software | Real-time software | MIT 16.842 |
| 12 | Real-Time Flight Software | Fault protection; Lab F | NASA Hubble |
| 13 | Integration, Verification and Operations | Integration and verification | NASA SE Handbook |
| 14 | Integration, Verification and Operations | Testbeds and fault injection | NASA Dragonfly |
| 15 | Integration, Verification and Operations | Review; final practice | MIT 16.842 |
Your progress
Tick units and labs as you finish them, and take the quizzes. Progress and quiz scores are saved only in this browser, never sent to us.
Turn on JavaScript to track progress.
Unit 1 · Week 1
The Systems Engineering Life Cycle and Requirements
Stakeholders, the V-model, life-cycle phases and reviews, good requirements, technical performance measures and margins.
Learning objectives
By the end of this unit you can:
- Describe the V-model.
- Write verifiable requirements.
- Compute margins against a requirement.
- Track a technical performance measure.
Key concepts
- Systems engineering turns stakeholder needs into a system that works, on time and on budget, across its whole life.
- The V-model goes down the left side (requirements, architecture, design) and up the right (integration, verification, validation).
- A good requirement is necessary, clear, feasible and verifiable, with a number, a unit and a test method.
- Technical performance measures such as mass, power and data rate are tracked against allocations with margin.
- Reviews (concept, preliminary design, critical design) gate each phase; MIT 16.842 students prepare a preliminary-design-review-level design.
Key equations
Worked examples, step by step
Example 1.1 NASA requires Landsat 9 to collect at least 400 scenes a day; it collects 740. Find the margin.
Show the steps
- (740 − 400)/400.
Answer: 85% above the requirement.
Example 1.2 An avionics box is estimated at 12 kg. Allocate with 25% margin (sample values).
Show the steps
- 12 × 1.25.
Answer: 15 kg.
Example 1.3 Option A scores 7 (cost) and 8 (reliability); B scores 9 and 6. Weights 0.3 and 0.7. Which wins?
Show the steps
- A = 2.1 + 5.6 = 7.7.
- B = 2.7 + 4.2 = 6.9.
Answer: A, 7.7 to 6.9.
Practice problems
Work each on paper first, then check.
Landsat 9 design life is 5 years and consumables last 10 years. Ratio?
Show answer
2.
Allocate 400 W of power at 30% margin.
Show answer
520 W.
Rewrite “the radio shall be fast” as a verifiable requirement.
Show answer
For example: “The radio shall downlink at least 300 Mbit/s, verified by test.”
Which side of the V holds verification?
Show answer
The right side.
Common misconceptions
Myth: Requirements describe the design.
Actually: They state what is needed, not how.
Myth: Margin is waste.
Actually: It absorbs growth and surprises.
Myth: Verification and validation are the same.
Actually: Verification: built right; validation: right thing built.
Flashcards
V-model
Decompose down, integrate and verify up.
Requirement
Verifiable need.
TPM
Tracked technical performance measure.
PDR
Preliminary design review.
Verification
Built right.
Validation
Right thing built.
Self-check quiz
How this helps save the planet
NASA lists Landsat 9’s requirements, including at least 400 scenes a day and a 5-year design life; Landsat 9 collects 740 scenes a day, almost double the minimum, and carries enough fuel to operate for at least 10 years.
With Landsat 8, it observes the same place every 8 days, enabling near-weekly tropical deforestation alerts, water-quality monitoring and crop reports, payoffs of requirements written and met with margin.
On Saving Planets: Earth Observation · Spacecraft Design
Sources: NASA Science: Landsat 9
Free learning resources
- NASA Systems Engineering Handbook: Free NASA handbook, Sections 3–4.
- MIT OpenCourseWare 16.842 Fundamentals of Systems Engineering (Fall 2015): Free MIT lectures.
Unit 2 · Week 2
Architecture, Interfaces and Integration
Functional and physical architecture, interface control, N² diagrams, model-based systems engineering and why interfaces grow fast.
Learning objectives
By the end of this unit you can:
- Map functions to components.
- Count potential interfaces.
- Read an N² diagram.
- Explain model-based systems engineering.
Key concepts
- A functional architecture says what the system does; a physical architecture says which boxes do it.
- Every pair of components could need an interface, so potential interfaces grow as n(n − 1)/2.
- An N² diagram puts components on the diagonal and the data or power between them off the diagonal.
- Interface control documents fix connectors, signals, timing and data formats so teams can build in parallel.
- NASA notes its handbook update includes Model-Based Systems Engineering, which keeps requirements, architecture and analyses in one connected model.
Key equations
Worked examples, step by step
Example 2.1 An avionics suite has 8 boxes. How many potential interfaces?
Show the steps
- 8 × 7/2.
Answer: 28.
Example 2.2 Add 4 boxes (n = 12).
Show the steps
- 12 × 11/2.
Answer: 66, more than double.
Example 2.3 Three boxes send 20, 35 and 15 kbit/s on a 100 kbit/s bus. Utilization?
Show the steps
- 70/100.
Answer: 70%.
Practice problems
Work each on paper first, then check.
Off-diagonal N² cells for n = 8?
Show answer
56.
Interfaces for n = 4?
Show answer
6.
Why keep bus utilization below 100%?
Show answer
Room for growth, retries and timing jitter.
What is an ICD?
Show answer
Interface control document.
Common misconceptions
Myth: Interfaces grow linearly.
Actually: They grow roughly as n².
Myth: Architecture is just a parts list.
Actually: It includes functions and connections.
Myth: MBSE replaces engineers.
Actually: It connects their work.
Flashcards
Architecture
Functions mapped to components.
N² diagram
Interface matrix.
ICD
Interface control document.
MBSE
Model-based systems engineering.
Integration
Joining components.
Bus load
Sum of data rates.
Self-check quiz
How this helps save the planet
NASA says its Systems Engineering Handbook was updated to include Model-Based Systems Engineering, drawing on lessons from missions and mishaps.
Clear interfaces let instrument and spacecraft teams build in parallel, which is how Earth-observing missions such as Landsat 9 reach orbit on schedule.
On Saving Planets: Spacecraft Design · Earth Observation
Sources: NASA Systems Engineering Handbook
Free learning resources
- NASA Systems Engineering Handbook: Free NASA handbook, Section 4.
- MIT OpenCourseWare 16.842 Fundamentals of Systems Engineering (Fall 2015): Free MIT lectures.
Unit 3 · Weeks 3–4
Reliability and Redundancy
Failure rates, exponential reliability, MTBF, series and parallel systems, triple modular redundancy, k-of-n systems and availability.
Learning objectives
By the end of this unit you can:
- Compute reliability from a failure rate.
- Combine series and parallel blocks.
- Compute 2-of-3 voting reliability.
- Compute availability.
Key concepts
- With a constant failure rate λ, reliability falls as e^(−λt) and the mean time between failures is 1/λ.
- Series systems fail if any part fails, so reliabilities multiply.
- Parallel (redundant) systems fail only if all parts fail.
- Triple modular redundancy votes 2 of 3; it beats a single unit early in life but not after R drops below 0.5.
- Availability is the fraction of time a system works: MTBF/(MTBF + MTTR).
Key equations
Worked examples, step by step
Example 3.1 A unit has λ = 10⁻⁵ per hour. Reliability over 10,000 h?
Show the steps
- e^(−0.1).
Answer: 0.905.
Example 3.2 Two such units in parallel?
Show the steps
- 1 − (1 − 0.9048)².
Answer: 0.991.
Example 3.3 Three units voting 2 of 3?
Show the steps
- 3(0.9048)² − 2(0.9048)³.
Answer: 0.975.
Practice problems
Work each on paper first, then check.
MTBF for λ = 10⁻⁵ /h?
Show answer
100,000 h.
Single, dual and TMR at 50,000 h?
Show answer
0.607, 0.845, 0.657.
Availability with MTBF 1000 h and MTTR 2 h?
Show answer
0.998.
Hubble needs one of three working gyros. Which model?
Show answer
1-of-3 (parallel).
Common misconceptions
Myth: Redundancy always helps.
Actually: TMR loses to a single unit once R < 0.5.
Myth: MTBF is guaranteed life.
Actually: It is a mean; many fail sooner.
Myth: Series reliability adds.
Actually: It multiplies.
Flashcards
Failure rate
Failures per hour.
MTBF
Mean time between failures.
Redundancy
Backup units.
TMR
Triple modular redundancy, 2-of-3 voting.
Availability
Fraction of time working.
k-of-n
Works if k of n work.
Self-check quiz
How this helps save the planet
NASA says Hubble received six new gyroscopes in 2009, three remained operational, and when one returned faulty readings NASA moved Hubble to one-gyro mode while keeping another in reserve.
Launched in 1990, Hubble has more than doubled its expected design lifetime; redundancy planned decades earlier keeps a working observatory in orbit instead of a replacement.
On Saving Planets: Flight Dynamics & Controls · Spacecraft Design
Sources: NASA Science: NASA to change how it points Hubble Space Telescope
Free learning resources
- NASA Systems Engineering Handbook: Free NASA handbook.
- NASA Science: NASA to change how it points Hubble Space Telescope: NASA Hubble gyro story.
Unit 4 · Week 5
Safety Analysis: FMEA and Fault Trees
Hazards, failure modes and effects analysis, risk priority numbers, fault trees with AND and OR gates, and safety-critical design.
Learning objectives
By the end of this unit you can:
- Run a simple FMEA.
- Compute a risk priority number.
- Evaluate AND and OR gates.
- Choose mitigations.
Key concepts
- FMEA works bottom-up: for each part, list how it can fail, the effect, and how it will be detected.
- A risk priority number multiplies severity, occurrence and detection scores (each 1–10, textbook scale).
- A fault tree works top-down from an unwanted event; OR gates add risk, AND gates (redundancy) shrink it.
- For small independent probabilities, an OR gate is nearly the sum and an AND gate is the product.
- Lessons from accidents shape practice; NASA notes its handbook drew on the Columbia Accident Investigation Board and other reports.
Key equations
Worked examples, step by step
Example 4.1 A sensor failure scores S = 8, O = 4, D = 5. RPN?
Show the steps
- 8 × 4 × 5.
Answer: 160.
Example 4.2 Either of two faults (p = 10⁻³ and 2 × 10⁻³) causes loss of data. Probability?
Show the steps
- 1 − (0.999)(0.998).
Answer: 2.998 × 10⁻³.
Example 4.3 Loss needs both faults (redundant design).
Show the steps
- 10⁻³ × 2 × 10⁻³.
Answer: 2 × 10⁻⁶.
Practice problems
Work each on paper first, then check.
Better detection drops D to 2. New RPN?
Show answer
64.
Rare-event approximation for the OR gate?
Show answer
3 × 10⁻³.
Which gate does redundancy create?
Show answer
AND.
Top-down or bottom-up: fault tree?
Show answer
Top-down.
Common misconceptions
Myth: RPN is a probability.
Actually: It is a ranking score.
Myth: OR gates multiply.
Actually: AND gates multiply.
Myth: Redundant parts fail independently.
Actually: Common causes can fail both.
Flashcards
FMEA
Failure modes and effects analysis.
RPN
Severity × occurrence × detection.
Fault tree
Top-down logic of failure.
OR gate
Any input causes the event.
AND gate
All inputs needed.
Common cause
One event failing several parts.
Self-check quiz
How this helps save the planet
NASA says lessons documented by the Columbia Accident Investigation Board, the NASA Integrated Action Team and others, plus mishaps in ground operations and commercial spaceflight, shaped its systems engineering handbook.
The same safety tools protect the satellites that track wildfires, storms and sea ice. Probabilities in this unit are sample values.
On Saving Planets: Solutions · Earth Observation
Sources: NASA Systems Engineering Handbook
Free learning resources
- NASA Systems Engineering Handbook: Free NASA handbook, Section 6.
- MIT OpenCourseWare 16.842 Fundamentals of Systems Engineering (Fall 2015): Free MIT lectures.
Unit 5 · Weeks 6–7
Digital Avionics and Data Buses
Binary data, analog-to-digital conversion, quantization, serial data buses (ARINC 429, MIL-STD-1553), message timing and data volume.
Learning objectives
By the end of this unit you can:
- Compute ADC resolution and SNR.
- Compute message transmission time.
- Compare bus types.
- Estimate data volume.
Key concepts
- An N-bit converter divides its input range into 2ᴺ levels; one step is the least significant bit.
- Ideal quantization SNR is about 6.02N + 1.76 dB.
- ARINC 429 is a one-transmitter, many-receiver bus at 100 kbit/s high speed (textbook value); MIL-STD-1553 is a command/response bus at 1 Mbit/s (textbook value).
- Message time is bits divided by bit rate; overhead and gaps add to it.
- Higher radiometric resolution (more bits) shows finer differences but makes more data.
Key equations
Worked examples, step by step
Example 5.1 A 12-bit ADC spans 10 V. Step size?
Show the steps
- 10/4096.
Answer: 2.44 mV.
Example 5.2 Its ideal SNR?
Show the steps
- 6.02 × 12 + 1.76.
Answer: 74.0 dB.
Example 5.3 A 32-bit ARINC 429 word at 100 kbit/s takes how long?
Show the steps
- 32/100,000.
Answer: 0.32 ms.
Practice problems
Work each on paper first, then check.
Landsat 9 has 14-bit radiometric resolution. Levels?
Show answer
16,384.
SNR for 8 bits?
Show answer
49.9 dB.
Same 32-bit word on a 1 Mbit/s bus?
Show answer
0.032 ms.
Step for 16 bits over 10 V?
Show answer
0.153 mV.
Common misconceptions
Myth: More bits means more accuracy automatically.
Actually: Noise and calibration also limit it.
Myth: Bit rate equals data rate of useful data.
Actually: Overhead takes a share.
Myth: One bus fits all.
Actually: Pick by timing, integrity and cost.
Flashcards
ADC
Analog-to-digital converter.
LSB
Least significant bit step.
ARINC 429
One-way avionics bus.
MIL-STD-1553
Command/response bus.
Quantization
Rounding to levels.
Bit rate
Bits per second.
Self-check quiz
How this helps save the planet
NASA lists Landsat 9 with 14-bit radiometric resolution, 11 spectral bands and more than 700 scenes a day, each 185 km by 180 km.
Fine radiometric steps let scientists see subtle changes in water quality and vegetation health, at the cost of more data for the avionics to store and send.
On Saving Planets: Earth Observation · Circuits
Sources: NASA Science: Landsat 9
Free learning resources
- MIT OpenCourseWare 16.842 Fundamentals of Systems Engineering (Fall 2015): Free MIT lectures.
- NASA Systems Engineering Handbook: Free NASA handbook.
Unit 6 · Week 8
Navigation Sensors: IMUs, GNSS, Cameras and Lidar
Gyros and accelerometers, inertial navigation drift, satellite navigation ranging, and vision and lidar sensors for autonomy.
Learning objectives
By the end of this unit you can:
- Compute drift from an accelerometer bias.
- Relate timing error to range error.
- Compare sensor strengths.
- Explain why sensors are combined.
Key concepts
- An inertial measurement unit (IMU) measures rotation rates (gyros) and specific force (accelerometers).
- Integrating twice turns a small accelerometer bias into a position error that grows with t².
- Satellite navigation measures range from signal travel time; 1 µs of clock error is about 300 m of range.
- Cameras and lidar measure the surroundings directly, giving position and hazard information that does not drift.
- No single sensor is enough: IMUs are fast but drift; external sensors are slower but bounded.
Key equations
Worked examples, step by step
Example 6.1 An accelerometer bias of 1 milli-g (9.807 × 10⁻³ m/s²) runs uncorrected for 60 s. Position error?
Show the steps
- ½ × 9.807 × 10⁻³ × 60².
Answer: 17.7 m.
Example 6.2 After 600 s?
Show the steps
- ½ × 9.807 × 10⁻³ × 600².
Answer: 1765 m, 100 times worse for 10 times the time.
Example 6.3 A receiver clock is off by 1 µs. Range error?
Show the steps
- 299,792,458 × 10⁻⁶.
Answer: 300 m.
Practice problems
Work each on paper first, then check.
Error after 10 s with the same bias?
Show answer
0.49 m.
Gyro bias 0.01°/h for 10 h?
Show answer
0.1° of heading.
Why does Dragonfly need lidar at Titan?
Show answer
To measure terrain altitude and slope and spot hazards.
Clock error for 3 m of range?
Show answer
10 ns.
Common misconceptions
Myth: IMUs never need correction.
Actually: Their errors grow with time.
Myth: GNSS works everywhere.
Actually: Not indoors, underwater or at Titan.
Myth: Drift grows linearly.
Actually: Bias drift grows with t².
Flashcards
IMU
Gyros and accelerometers.
Dead reckoning
Navigation by integration.
GNSS
Satellite navigation.
Lidar
Laser ranging.
Bias
Constant sensor offset.
Pseudorange
Range including clock error.
Self-check quiz
How this helps save the planet
NASA says Dragonfly’s recent “first flight” test ran flight software and flight-like avionics with simulated data from its navigation cameras, inertial measurement units and lidar.
Lidar measures terrain altitude and slope and identifies hazards, letting the rotorcraft choose a safe landing site on Titan, where it is due to arrive in 2034.
On Saving Planets: Flight Dynamics & Controls · Earth Observation
Sources: NASA Science: Dragonfly completes first simulated flight (Oct. 23, 2026)
Free learning resources
- NASA Science: Dragonfly completes first simulated flight (Oct. 23, 2026): NASA Dragonfly story.
- MIT OpenCourseWare 16.842 Fundamentals of Systems Engineering (Fall 2015): Free MIT lectures.
Unit 7 · Week 9
Sensor Fusion and the Kalman Filter
Combining noisy measurements, inverse-variance weighting, the scalar Kalman filter and its predict-update cycle.
Learning objectives
By the end of this unit you can:
- Fuse two measurements by variance.
- Compute a Kalman gain.
- Run one predict-update step.
- Explain why fusion beats either sensor.
Key concepts
- Two independent estimates are best combined by weighting each by the inverse of its variance.
- The fused variance is smaller than either input variance.
- The Kalman filter predicts the state forward, then corrects it with a measurement using gain K.
- K = P/(P + R): trust the measurement more when the prediction is uncertain (large P) and the sensor is good (small R).
- Navigation systems fuse fast IMU predictions with slower camera, lidar or GNSS updates.
Key equations
Worked examples, step by step
Example 7.1 Sensors with σ = 4 m and 3 m are fused. Fused σ?
Show the steps
- σ² = 16 × 9/25 = 5.76.
- σ = √5.76.
Answer: 2.4 m.
Example 7.2 Prediction variance P = 16 m², measurement R = 9 m². Gain?
Show the steps
- 16/25.
Answer: 0.64.
Example 7.3 Prediction 100 m, measurement 105 m. Update and new variance?
Show the steps
- x = 100 + 0.64 × 5 = 103.2 m.
- P = 0.36 × 16.
Answer: 103.2 m with variance 5.76 m².
Practice problems
Work each on paper first, then check.
Fuse two equal sensors of σ = 2 m.
Show answer
σ = 1.41 m.
Gain if R = 0?
Show answer
1: trust the measurement fully.
Gain if R is huge?
Show answer
Near 0: keep the prediction.
What grows P between updates?
Show answer
Process noise in the prediction.
Common misconceptions
Myth: Average sensors equally.
Actually: Weight by inverse variance.
Myth: Fusion can’t beat the best sensor.
Actually: It beats both.
Myth: Kalman filters remove all error.
Actually: They minimize variance under assumptions.
Flashcards
Sensor fusion
Combining measurements.
Kalman gain
Weight on the measurement.
Covariance
Uncertainty of the estimate.
Predict
Propagate the state.
Update
Correct with a measurement.
Innovation
Measurement minus prediction.
Self-check quiz
How this helps save the planet
NASA reports that Dragonfly’s team added sensors and capabilities step by step, ending with lidar, the final piece needed to fully simulate what the rotorcraft will encounter on Titan.
A camera emulator rendered each simulated Titan scene in roughly the 20 to 70 millisecond exposure times the cameras will use, so fusion software saw realistic timing. Variances in this unit are sample values.
On Saving Planets: Flight Dynamics & Controls · Spacecraft Design
Sources: NASA Science: Dragonfly completes first simulated flight (Oct. 23, 2026)
Free learning resources
- MIT OpenCourseWare 16.842 Fundamentals of Systems Engineering (Fall 2015): Free MIT lectures.
- NASA Science: Dragonfly completes first simulated flight (Oct. 23, 2026): NASA Dragonfly story.
Unit 8 · Week 10
Communication and Surveillance: ADS-B
Aircraft radios, line-of-sight range, free-space path loss, ADS-B Out and In, and how surveillance supports air traffic control.
Learning objectives
By the end of this unit you can:
- Compute radio horizon range.
- Compute free-space path loss.
- Explain ADS-B Out and In.
- Put FAA traffic numbers in scale.
Key concepts
- VHF and higher frequencies travel by line of sight, so range depends on antenna heights.
- Free-space path loss grows with distance and frequency, 20 log₁₀(4πd/λ).
- With ADS-B Out, an aircraft broadcasts its satellite-derived position; ADS-B In lets other aircraft and the ground receive it.
- The FAA calls real-time ADS-B the preferred method of surveillance for air traffic control in the National Airspace System.
- In the U.S., aircraft must carry ADS-B Out to fly in the airspace defined in 14 CFR 91.225.
Key equations
Worked examples, step by step
Example 8.1 An aircraft at 10,000 m and a ground antenna at 10 m. Radio horizon?
Show the steps
- 4.12(100 + 3.162).
Answer: 425 km.
Example 8.2 Path loss at 1090 MHz over 200 km.
Show the steps
- λ = 0.2750 m.
- 20 log₁₀(4π × 2 × 10⁵/0.2750).
Answer: 139.2 dB.
Example 8.3 The FAA serves more than 44,000 flights a day. Average per hour?
Show the steps
- 44,000/24.
Answer: About 1833.
Practice problems
Work each on paper first, then check.
Double the distance: added path loss?
Show answer
6.02 dB.
Wavelength at 1090 MHz?
Show answer
0.275 m.
Passengers per flight from 3 million and 44,000?
Show answer
About 68.
What does ADS-B Out require on board?
Show answer
A transmitter broadcasting position.
Common misconceptions
Myth: Radio range is unlimited.
Actually: Line of sight limits it.
Myth: ADS-B uses radar.
Actually: Aircraft broadcast their own position.
Myth: Path loss is linear in distance.
Actually: It grows as 20 log₁₀ d.
Flashcards
ADS-B
Automatic dependent surveillance-broadcast.
ADS-B Out
Broadcasts own position.
ADS-B In
Receives traffic and weather.
Path loss
Signal spreading loss.
Radio horizon
Line-of-sight limit.
NAS
National Airspace System.
Self-check quiz
How this helps save the planet
The FAA says ADS-B improves safety and efficiency in the air and on runways, reduces costs, and lessens harmful effects on the environment.
The FAA’s Air Traffic Organization serves more than 44,000 flights and more than 3 million airline passengers a day across more than 29 million square miles of airspace (FY24 figures), so small efficiency gains add up.
On Saving Planets: Aircraft Performance · Solutions
Sources: FAA: Automatic Dependent Surveillance-Broadcast (ADS-B) · FAA: Air Traffic By The Numbers
Free learning resources
- FAA: Automatic Dependent Surveillance-Broadcast (ADS-B): FAA overview.
- FAA: Air Traffic By The Numbers: FAA facts.
Unit 9 · Weeks 11–12
Real-Time Flight Software
Tasks, periods and deadlines, CPU utilization, rate-monotonic scheduling, frame rates, watchdogs and fault protection.
Learning objectives
By the end of this unit you can:
- Compute CPU utilization.
- Apply the rate-monotonic bound.
- Relate frame rate and period.
- Describe fault protection.
Key concepts
- Flight software runs periodic tasks that must finish before their deadlines, not just quickly on average.
- Utilization is the sum of each task’s run time divided by its period.
- Rate-monotonic scheduling gives higher priority to shorter periods; it is guaranteed when U ≤ n(2^(1/n) − 1).
- Watchdog timers reset a processor that stops responding; fault protection puts a spacecraft in a safe mode.
- Autonomy matters when ground help is far away; NASA says Dragonfly must fly without real-time help from Earth.
Key equations
Worked examples, step by step
Example 9.1 Tasks take 2, 3 and 5 ms with periods 10, 20 and 50 ms. Utilization?
Show the steps
- 0.2 + 0.15 + 0.1.
Answer: 0.45.
Example 9.2 Rate-monotonic bound for three tasks?
Show the steps
- 3(2^(1/3) − 1).
Answer: 0.780, so 0.45 is guaranteed schedulable.
Example 9.3 Dragonfly’s camera exposures run about 20 to 70 ms. Matching frame rates?
Show the steps
- 1/0.07 and 1/0.02.
Answer: About 14.3 to 50 Hz.
Practice problems
Work each on paper first, then check.
Bound for n = 2?
Show answer
0.828.
Bound for n = 4?
Show answer
0.757.
Slack with U = 0.45?
Show answer
0.55.
Why safe mode?
Show answer
To keep the vehicle stable and wait for help or a fix.
Common misconceptions
Myth: Fast on average is enough.
Actually: Every deadline matters.
Myth: U ≤ 1 always means schedulable under RMS.
Actually: Only the bound guarantees it.
Myth: Safe mode means failure.
Actually: It protects the mission.
Flashcards
Deadline
Latest finish time.
Utilization
CPU fraction used.
Rate-monotonic
Shorter period, higher priority.
Watchdog
Reset timer.
Safe mode
Protective configuration.
Autonomy
Acting without ground help.
Self-check quiz
How this helps save the planet
NASA reports Hubble entered safe mode several times when a gyro gave faulty readings, suspending science while the telescope awaited instructions; fault protection kept it safe.
NASA says Dragonfly engineers will deliberately introduce faults in tests so the rotorcraft can respond autonomously, because everything it does on Titan must happen without real-time help from Earth.
On Saving Planets: Intro to Programming · Flight Dynamics & Controls
Sources: NASA Science: NASA to change how it points Hubble Space Telescope · NASA Science: Dragonfly completes first simulated flight (Oct. 23, 2026)
Free learning resources
- MIT OpenCourseWare 16.842 Fundamentals of Systems Engineering (Fall 2015): Free MIT lectures.
- NASA Science: Dragonfly completes first simulated flight (Oct. 23, 2026): NASA Dragonfly story.
Unit 10 · Weeks 13–15
Integration, Verification and Operations
Incremental integration, verification methods, hardware-in-the-loop testing, fault injection, commissioning and life extension.
Learning objectives
By the end of this unit you can:
- Name the four verification methods.
- Plan incremental integration.
- Explain hardware-in-the-loop testing.
- Connect operations to mission life.
Key concepts
- Requirements are verified by test, analysis, inspection or demonstration.
- Integration goes step by step so a problem can be traced to the last thing added.
- Hardware-in-the-loop and flight-like testbeds run real flight software against simulated sensors.
- Fault-injection tests prove the system responds correctly when something breaks.
- Good operations, spares and consumables can stretch a mission well past its design life.
Key equations
Worked examples, step by step
Example 10.1 NASA says Dragonfly launches no earlier than 2028 on a six-year voyage. Earliest arrival?
Show the steps
- 2028 + 6.
Answer: 2034, matching NASA.
Example 10.2 Landsat 9 consumables last at least 10 years against a 5-year design life. Extension ratio?
Show the steps
- 10/5.
Answer: 2.
Example 10.3 Dragonfly will spend three years flying at Titan. Mission end at the earliest?
Show the steps
- 2034 + 3.
Answer: 2037 (computed).
Practice problems
Work each on paper first, then check.
Name the four verification methods.
Show answer
Test, analysis, inspection, demonstration.
Why integrate incrementally?
Show answer
To trace problems to the last change.
Hubble launched in 1990; its 34th anniversary was in which year?
Show answer
2024.
What is fault injection?
Show answer
Deliberately causing faults in test.
Common misconceptions
Myth: Test everything at the end.
Actually: Integrate and test in steps.
Myth: Analysis is weaker than test.
Actually: Each method fits different requirements.
Myth: Design life is the end.
Actually: Missions often run longer.
Flashcards
Verification by test
Measure it.
Analysis
Prove by calculation.
Inspection
Look at it.
Demonstration
Show it works.
HIL
Hardware-in-the-loop.
Commissioning
Checkout after launch.
Self-check quiz
How this helps save the planet
NASA says Dragonfly’s team built flight capabilities incrementally, from spinning a single rotor to a full simulated first flight, and plans to repeat it on the actual flight system.
NASA notes Landsat 9’s onboard calibration and redundancy keep its data accurate and reliable for the mission’s life, extending the longest record of Earth observation.
On Saving Planets: Earth Observation · Spacecraft Design
Sources: NASA Science: Dragonfly completes first simulated flight (Oct. 23, 2026) · NASA Science: Landsat 9
Free learning resources
- NASA Systems Engineering Handbook: Free NASA handbook, Section 5.
- MIT OpenCourseWare 16.842 Fundamentals of Systems Engineering (Fall 2015): Free MIT lectures.
The lab (Avionics and systems lab)
The lab is the hands-on part of the course. Here it is free and for practice only, with no credit.
Every lab runs in a free simulation or a spreadsheet, so there are no electrical hazards. Do not open or modify real aircraft, drone or vehicle electronics for this course. Take screen breaks, sit with good posture, and keep cables out of walkways.
Safety reference: OSHA: Walking-working surfaces (slip, trip and fall hazards)
Lab A: Interface growth and an N² diagram
Week 2
Goal: Build an N² diagram for a small avionics suite and see how potential interfaces grow with the number of boxes.
Procedure
- List boxes: flight computer, IMU, GNSS receiver, radio, display, power unit, air data, autopilot.
- Draw an 8 × 8 grid with boxes on the diagonal and mark which pairs exchange data.
- Compute n(n − 1)/2 for n = 4, 8 and 12.
- Count your marked cells and compare with the maximum.
Data table
| Boxes n | Potential interfaces |
|---|---|
| 4 | 6 |
| 8 | 28 |
| 12 | 66 |
Computed values.
Sample calculation
- 8 × 7/2 = 28.
- 12 × 11/2 = 66.
Safety
- Computer only.
Home or virtual alternative
- Any spreadsheet works.
NASA Systems Engineering Handbook
Planet link: NASA: its handbook update includes Model-Based Systems Engineering. NASA Systems Engineering Handbook
Lab B: Reliability of single, dual and triple units
Week 4
Goal: Compare a single unit, a parallel pair and 2-of-3 voting over time in a spreadsheet.
Procedure
- Enter λ = 10⁻⁵ per hour.
- Compute R = e^(−λt) for t = 1000, 10,000 and 50,000 h.
- Compute the parallel pair and 2-of-3 voting.
- Find where 2-of-3 drops below a single unit (R = 0.5).
Data table
| t (h) | Single | Dual | 2-of-3 |
|---|---|---|---|
| 1000 | 0.990 | 0.9999 | 0.9997 |
| 10,000 | 0.905 | 0.991 | 0.975 |
| 50,000 | 0.607 | 0.845 | 0.657 |
Computed sample values.
Sample calculation
- R(50,000) = e^(−0.5) = 0.607.
- 2-of-3 = 3(0.607)² − 2(0.607)³ = 0.657.
Safety
- Computer only.
Home or virtual alternative
- Any spreadsheet works.
NASA Systems Engineering Handbook
Planet link: NASA: Hubble can make science observations with only one working gyro. NASA Science: NASA to change how it points Hubble Space Telescope
Lab C: Redundant circuits
Week 5
Goal: Use PhET Circuit Construction Kit: DC to compare series and parallel bulbs when one fails.
Procedure
- Build two 10 Ω bulbs in series on a 12 V battery, then break one wire.
- Rebuild them in parallel and break one branch.
- Measure current before and after each failure.
- Relate the result to series and parallel reliability.
Data table
| Circuit | Resistance (Ω) | Current at 12 V (A) |
|---|---|---|
| Parallel, both good | 5 | 2.4 |
| Parallel, one failed | 10 | 1.2 |
| Series, both good | 20 | 0.6 |
Computed sample values.
Sample calculation
- 10 × 10/20 = 5 Ω.
- 12/5 = 2.4 A.
Safety
- Computer only.
Home or virtual alternative
- Runs in a browser.
PhET: Circuit Construction Kit: DC
Planet link: NASA: Landsat 9’s onboard redundancy keeps its data reliable. NASA Science: Landsat 9
Lab D: ADC resolution and data volume
Week 7
Goal: Compute step size and SNR for several converter resolutions.
Procedure
- Enter a 10 V full scale.
- Compute step and SNR for 8, 12 and 16 bits.
- Compute word time for 32 bits at 100 kbit/s and 1 Mbit/s.
- Discuss why Landsat 9 uses 14 bits.
Data table
| Bits | Step (mV) | SNR (dB) |
|---|---|---|
| 8 | 39.06 | 49.9 |
| 12 | 2.441 | 74.0 |
| 16 | 0.1526 | 98.1 |
Computed values.
Sample calculation
- 10/256 = 39.06 mV.
- 6.02 × 16 + 1.76 = 98.1 dB.
Safety
- Computer only.
Home or virtual alternative
- Any spreadsheet works.
Planet link: NASA: Landsat 9 has 14-bit radiometric resolution. NASA Science: Landsat 9
Lab E: Inertial drift and sensor fusion
Week 9
Goal: Model position drift from an accelerometer bias, then fuse two position sensors.
Procedure
- Enter b = 9.807 × 10⁻³ m/s² (1 milli-g).
- Compute error at 10, 60 and 600 s.
- Fuse σ = 4 m and 3 m sensors and compute the Kalman gain for P = 16, R = 9.
- Add noise with a random-number column and watch the filter.
Data table
| t (s) | Error (m) |
|---|---|
| 10 | 0.49 |
| 60 | 17.65 |
| 600 | 1765 |
Computed sample values.
Sample calculation
- ½ × 9.807 × 10⁻³ × 100 = 0.49 m.
- Fused σ = √5.76 = 2.4 m.
Safety
- Computer only.
Home or virtual alternative
- Any spreadsheet works.
NASA Science: Dragonfly completes first simulated flight (Oct. 23, 2026)
Planet link: NASA: Dragonfly’s test used simulated camera, IMU and lidar data. NASA Science: Dragonfly completes first simulated flight (Oct. 23, 2026)
Lab F: Rate-monotonic schedulability
Week 12
Goal: Compute utilization bounds and test task sets in a spreadsheet.
Procedure
- Compute the bound for n = 1 to 4.
- Enter Unit 9’s task set and compute U.
- Add a task until U exceeds the bound.
- Discuss what to do when the bound fails.
Data table
| n | Bound |
|---|---|
| 1 | 1.000 |
| 2 | 0.828 |
| 3 | 0.780 |
| 4 | 0.757 |
Computed values.
Sample calculation
- 2(√2 − 1) = 0.828.
- 4(2^(1/4) − 1) = 0.757.
Safety
- Computer only.
Home or virtual alternative
- Any spreadsheet works.
MIT OpenCourseWare 16.842 Fundamentals of Systems Engineering (Fall 2015)
Planet link: NASA: Dragonfly must fly autonomously, without real-time help from Earth. NASA Science: Dragonfly completes first simulated flight (Oct. 23, 2026)
Exam prep practice sets
Time yourself: about 10 minutes per problem. Then compare with the full solutions.
Midterm practice set (Units 1–5)
Potential interfaces for 10 boxes?
Show full solution
- 10 × 9/2.
Answer: 45.
Parallel pair, λ = 2 × 10⁻⁵ /h over 5000 h?
Show full solution
- R = e^(−0.1) = 0.905.
- 1 − 0.095².
Answer: 0.991.
RPN for S = 6, O = 3, D = 7?
Show full solution
- 6 × 3 × 7.
Answer: 126.
Step of a 10-bit ADC over 5 V?
Show full solution
- 5/1024.
Answer: 4.88 mV.
Ideal SNR for 10 bits?
Show full solution
- 6.02 × 10 + 1.76.
Answer: 62.0 dB.
Final practice set (Units 1–10)
Drift after 30 s with a 2 milli-g bias?
Show full solution
- ½ × 0.01961 × 900.
Answer: 8.83 m.
Fuse two sensors of σ = 5 m.
Show full solution
- σ² = 12.5.
Answer: 3.54 m.
Kalman gain for P = 4, R = 1?
Show full solution
- 4/5.
Answer: 0.8.
Radio horizon from 1000 m to a 10 m antenna?
Show full solution
- 4.12(31.62 + 3.162).
Answer: 143.3 km.
Utilization for tasks 1/5, 2/10, 3/30 ms?
Show full solution
- 0.2 + 0.2 + 0.1.
Answer: 0.5.
Availability, MTBF 500 h, MTTR 5 h?
Show full solution
- 500/505.
Answer: 0.990.
Formula sheet
Constants
| Constant | Value |
|---|---|
| Speed of light | c = 299,792,458 m/s (exact) |
| Standard gravity | g = 9.80665 m/s² |
| ADS-B frequency (textbook value) | 1090 MHz |
| ARINC 429 high speed (textbook value) | 100 kbit/s |
| MIL-STD-1553 (textbook value) | 1 Mbit/s |
| Hours per year | 8760 h |
Free texts and simulations
Use these free texts, lectures and simulations alongside the course.
- NASA Systems Engineering Handbook: Free NASA handbook.
- MIT OpenCourseWare 16.842 Fundamentals of Systems Engineering (Fall 2015): Free MIT lectures.
- FAA: Automatic Dependent Surveillance-Broadcast (ADS-B): FAA overview.
- PhET: Circuit Construction Kit: DC: Circuits and redundancy.
- NASA Science: Dragonfly completes first simulated flight (Oct. 23, 2026): Avionics testing story.
- NASA Science: NASA to change how it points Hubble Space Telescope: Redundancy in practice.
Glossary
- ADS-B
- Automatic dependent surveillance-broadcast.
- ARINC 429
- One-way avionics data bus.
- Availability
- Fraction of time a system works.
- FMEA
- Failure modes and effects analysis.
- Fault tree
- Top-down failure logic.
- Hardware-in-the-loop
- Real software and hardware with simulated inputs.
- IMU
- Inertial measurement unit.
- Interface control document
- Agreement on an interface.
- Kalman filter
- Optimal recursive estimator.
- Lidar
- Laser ranging.
- MBSE
- Model-based systems engineering.
- MIL-STD-1553
- Command/response data bus.
- MTBF
- Mean time between failures.
- N² diagram
- Interface matrix.
- Rate-monotonic scheduling
- Shorter period gets higher priority.
- Redundancy
- Extra units for backup.
- Requirement
- Verifiable statement of need.
- Safe mode
- Protective spacecraft configuration.
- V-model
- Decompose then integrate and verify.
- Watchdog timer
- Resets a hung processor.
Self-assessment rubric
No grade or credit is given. Use this to judge honestly where you are in each unit.
| Level | What it looks like |
|---|---|
| 4 · Mastery | Traces every design choice to a requirement, checks interfaces and failure cases, keeps units and probabilities consistent, and explains trades in plain words. |
| 3 · Proficient | Solves the practice and exam sets with minor slips and checks units. |
| 2 · Developing | Follows worked examples but mixes up series and parallel reliability or OR and AND gates. |
| 1 · Beginning | Computes without a requirement or block diagram; needs to revisit the unit. |
Suggested weighting if you want a score
| Part | Weight |
|---|---|
| Practice problems | 20% |
| Labs | 25% |
| Midterm practice set | 25% |
| Final practice set | 30% |
Aim for level 3 or better in every unit before moving to the next course.