Inside a Level D Flight Simulator

A pilot flies with more than eyes. Vision, the inner ear, the forces on the controls and the vibration through the seat all report what the aircraft is doing, and a simulator has to feed every channel and keep them in agreement. When the cues disagree, people get simulator sickness; the sensory conflict theory is the standard account of why.

The picture sits in a mirror, not on a screen. On an ordinary screen a short way in front of the crew, the angle to the runway depends on where you sit: the captain sees it to one side, the first officer to the other. A collimated display sends the light from every point of the picture out in parallel rays, so the image behaves as if it were far away and the runway appears straight ahead to both crew members (14 CFR Part 60, Appendix C, Attachment 2, §18).

The motion borrows gravity. Six actuators can tilt and slide the cabin in all six degrees of freedom (pitch, roll, yaw, heave, sway, surge; Levels C and D require them), but only a short way. A take-off's sustained push cannot be reproduced by moving forward, so the platform gives a brief forward shove for the onset and then tilts the cabin nose-up, slowly enough that the rotation goes unnoticed: Part 60 describes exactly this onset cue and nose-up tilt for the sustained force. It works because the otolith organs of the inner ear sense the sum of gravity and acceleration and cannot tell the two apart, the equivalence principle at the scale of the inner ear. A tilt of θ supplies g·sin θ, so 0.25 g of acceleration needs about 14.5°. The visual system moves with the cabin, so the runway stays level in front of the pilot while gravity presses them into the seat. Then the platform creeps back to the middle below the perception threshold, ready for the next cue.

Level D is earned test by test. Full-flight simulators are qualified at Levels A to D (FAA Part 60; EASA CS-FSTD(A)), and D is the highest. Qualification is a test campaign: each objective test replays a manoeuvre the real aircraft flew on a flight test, and the simulator's response has to stay inside a stated tolerance around the aircraft's. At Levels C and D a driver program runs the tests automatically. At Level D even the cockpit sound is an objective test, and a device that misses its sound tolerances can only be qualified at Level C.

And it never stops proving it. Every appropriate objective test is run again each year, and the device needs a functional preflight check within the 24 hours before anyone trains in it (14 CFR 60.19(a)).

That is what buys the trust. Under EASA's zero flight time training, a pilot with at least 500 hours or 100 route sectors on multi-pilot aeroplanes can complete a type rating course entirely in a Level D simulator, then fly the first take-offs and landings in line operations under a type rating instructor (FCL.730.A). The United States allows the equivalent at Levels C and D (14 CFR Part 121, Appendix H).

150 ms is a gate, not a target. Transport delay is the total system processing time from a pilot primary-flight-control input until the motion, visual or instrument systems respond. FAA Part 60 and EASA CS-FSTD(A) cap it at 150 ms for Level C/D aeroplane devices. EASA's CS-FSTD Issue 1, published in July 2026 for the initial qualification of new devices, tightens that to 100 ms for motion, instruments and visual at its highest fidelity level (Subpart D, test 6.a.1). Exceed the applicable ceiling in the qualification test and the device does not meet that requirement.

A deadline is never met on average. At 60 Hz each frame gets 16.67 ms. A mean of 8.6 ms looks like a system with half its budget spare, but the mean is the wrong statistic: what matters is the tail mass past the deadline. A four-hour session is 864,000 frames, so E[K] = N·p: one bad frame in a hundred thousand still costs ~9 overruns a session, and a 99.9% success rate costs 864 of them.

The count does not describe the clustering. E[K] = N·p holds whenever each frame has the same marginal miss probability p; independence is not required. Correlation changes how failures cluster and the distribution of the count. A garbage-collection pause, a page fault or a network stall can take out consecutive frames, producing a visible stutter.

Distributed systems compose badly, in two directions at once. A full-flight simulator is a rack: flight model, avionics, three visual channels, sound, motion, instructor station. The frame closes when the last host publishes, so latency composes as a maximum: one straggler at 19 ms makes the frame late for everyone. If host successes are independent, reliability composes as a product: nine hosts at three nines each give 0.999⁹ ≈ 99.1% clean frames, about 7,800 bad frames per session under that assumption. Shared-resource stalls can violate independence. This is why the budget must be allocated and enforced per host: a system-wide average is not something anyone can engineer against.

Ship the instrument with the system. Sampled step time can miss a spike that happens between two polls; an overrun counter is incremented by the runtime at the moment the deadline breaks and cannot be missed. Monotonic counters are the trustworthy primitive for deadline compliance; sampled gauges are for trend. Determinism is not optimised in at the end: it is a budget, allocated per host, enforced every frame, and proven by telemetry that is part of the deliverable.

Trust rests on two kinds of evidence. A Level D simulator is not trusted because it is impressive. It is trusted because it can show two things: that it behaves like the real aircraft, in tests against flight data, and that it answers on time on every frame, in counters that cannot miss a late one.

Why AI would enter the loop at all. The reason is fidelity. Some of an aircraft's behaviour is hard to write down from physics and hard to validate: the stall and beyond it, icing, ground effect. A model learned from flight data could capture what an equation misses. The image generator could draw a richer world with neural rendering inside the same frame budget. Adaptive instruction and assessment would also use AI, but they sit beside the loop rather than in it.

And why that is hard. A learned model that moves into the chain inherits its clock. Some models take time that depends on the input (a generative model's answer length, a detector's number of objects), and even a fixed-size network can stall when it shares memory, buses or a scheduler with the rest of the host. A model that samples, or a GPU kernel that sums in a different order, can also give a different answer to the same input, and a qualification test is only evidence if the same input gives the same result.

The thesis. AI can make a simulator more realistic, and that is worth doing. Inside the loop, though, it has to be as predictable as everything else: the same answer for the same input, delivered within its share of every frame, and proven by tests and counters rather than claimed by an average. A fixed-size network on dedicated, measured hardware can meet that bar; a model that cannot show it does not belong inside the loop. This is my view and an open research direction, not a published result; AI Meets the Deadline explores one architecture for keeping such a model out of the waiting path.