Binder_DVT_Industry_Day_Briefs_061021.pdf

Presented to: Navigation System Industry Partners

By: Iann Washington, Contracting Officer, AAQ-340

Date: June 10, 2021

Federal Aviation Administration

Welcome

DME – Distance Measuring Equipment VOR – Very High Frequency Omnidirectional Range TACAN – Tactical Air Navigation

DVT Sustainment Program

Federal Aviation Administration 2

DVT Industry Engagement Event June 10, 2021

Agenda

TIME TOPICS

9:00 – 9:15 am FAA Introduction: DVT Industry Engagement

9:15 – 9:30 am Navigation Programs Overview

9:30 – 9:45 am DVT Sustainment Program Overview

9:45 – 10:30 am Discussion on DVT Safety Assurance Determination

10:30 – 10:45 am Break

10:45 – 12:00 pm Discussion on DVT Safety Assurance Determination, Continued

12:00 – 1:30pm LUNCH

1:30pm – 5:00pm Open Forum Q&A

Administration 3

DVT Industry Engagement Event June 10, 2021

Virtual Meeting Ground Rules

• Please mute your line during the FAA presentations

• Hold all Questions until the Q&A session in the afternoon

– Questions can be submitted to the Chat Window at any time

• Please turn off Individual Cameras

– They can be turned ON to ask questions during the Q&A session

Administration 4

DVT Industry Engagement Event June 10, 2021

Industry Day Purpose

• Explain the FAA Safety Management System

(SMS) and its associated processes

• Provide information on how the FAA derived the

Development Assurance Levels for the DVT Sustainment

• Open exchange of ideas with industry partners

• Address industry questions and concerns

Administration 5

DVT Industry Engagement Event June 10, 2021

Rules of Engagement

• Points of contact throughout the acquisition process are the

Contracting Officer, Ms. Iann Washington, (202) 267-4346, iann.washington@faa.gov; or Contracting Officer, Mr. Richard Simons, (202) 267-9902, Richard.j.simons@faa.gov.

• The DVT Sustainment Program general email box is: 9-awa-aaq-dvtacquisition@faa.gov

• Nothing provided today will be contractually binding and will only be for planning purposes. Questions will be answered to the best of the team’s knowledge as it exists at this time.

• No agreements, promises, or other commitments are made or implied by the Government or Contractors participating in Industry Day and the one-on-one sessions.

mailto:Richard.j.simons@faa.gov

Administration 6

DVT Industry Engagement Event June 10, 2021

Disclaimer

• The remarks today of Government officials involved in the

Distance Measuring Equipment (DME), Very High Frequency (VHF) Omnidirectional Range (VOR), and Tactical Air Navigation (TACAN) (DVT) Sustainment Program shall not be considered a guarantee of the Government’s course of action in proceeding with the program.

• The information provided today reflects current Government intentions of how the program may be carried out, and is subject to change based on a variety of circumstances, including input from prospective contractors.

• This briefing does not constitute an invitation for bid or request for proposal and is not to be construed as a commitment by the Government.

Presented to: Navigation System Industry Partners

By: Deborah Lawrence, Group Manager, AJM-32

Date: June 10, 2021

Federal Aviation Administration

Welcome

DME – Distance Measuring Equipment VOR – Very High Frequency Omnidirectional Range TACAN – Tactical Air Navigation

Presented to:

By:

Date:

Federal Aviation Administration

DME – Distance Measuring Equipment VOR – Very High Frequency Omnidirectional Range TACAN – Tactical Air Navigation

DVT Sustainment Program DVT Program Overview

Navigation Systems Industry Partners

10 June 2021 Nnaemeka Nnamani, AJM-3241

Administration

Contents

• Program Description

• FY21 Program Accomplishments

• Program Phased Approach

• Program Strategy for Acquisition

• TACAN Antenna Acquisition

• Next Steps

Program Description

• The DVT Sustainment Program will sustain DMEs, VORs, and

TACANs in support of a resilient Ground-Based Navigation Infrastructure

– DVT systems represent a significant portion of this resilient infrastructure

• DMEs provide slant range (Distance) information to all aircraft and enables RNAV service for air carrier aircraft. Area navigation (RNAV) is a method of instrument flight rules (IFR) navigation that allows an aircraft to choose any course within a network of navigation beacons, rather than navigate point to point.

• VORs provide azimuth (position) information for en-route navigation and approach services. VOR navigation allows an aircraft to fly point to point along established airways between VORs.

• TACANs provide azimuth information to military aircraft and slant range information to military and civilian aircraft.

– Most DVT systems are over 30 years old and must be sustained to provide resiliency during Global Positioning System (GPS) Service Interruptions.

Program Accomplishments

• Received Approval on the FAA AMS Investment

Analysis Readiness Decision

• Completed the DVT Sustainment Program Operational

Safety Assessment (OSA)

• Released draft versions of TACAN Antenna specification

• Released draft versions TACAN Transponder specification

• Released the draft TACAN Antenna Contract Statement of Work and Task Orders 1 & 2

Program Phased Approach

PHASE 1 ~ 2022 - 2028 PHASES 2 – 4 ~ 2029 - 2045

TACAN Antenna Market Survey

Specification

SIR

Contract Award

Testing Qualification

IARD for the Program – 4QFY20

FID for Phase 1– 4QFY22

Strategic

NavAid Procurements New Technology Qualification Rapid Supply Chain Key Sites

Tactical

Equipment obsolescence Facility conditions Long lead time repair items Site Assessments

Testing and Qualification

Pre-planned Product Improvement

TACAN Antennas Continue Implementation

Tactical Additional identified needs based on

Sustainment Analysis

Critical sites

DVT Planning Congressional

Communications Specifications

SIR

Contract Award

Vendor Engagement Prioritization

Implementation at Key Sites

Implementation at n# SDPs based on priorities

DVT Contract Award (multi-Phase)

FID for Phase 2 FIDs for Phases 3-4

Tactical Additional identified needs based on

Sustainment Analysis

TACAN Antennas Coupled with DVT Implementations

• Engaging Vendors throughout the process per AMS guidelines

• Follow FAA AMS Process for acquisitions

• Develop Procurement packages and artifacts

• Award a competitive small business set-aside TACAN Antenna acquisition contract

• Award a competitive DVT Sustainment acquisition contract

Program Strategy for Acquisition

Strategy Decision

FY20 FY21

RFI

Released

October

RFI

Responses Received

December

Industry Day

November

FID DVT

Contract Award

IARD

FY23

TACAN

Antenna Contract Award

DVT System Specifications

Ready

FY22 June 2019

TACAN

Antenna

Specification Ready

TACAN Antenna Acquisition

FY20 FY21 FY22

FAA Stakeholder approval Market Survey Release Develop Draft Specification

• Complete TACAN Antenna SIR

• Complete TACAN Antenna

Specification

• Award TACAN Antenna Contract

• Goals

• Reduce backlog at the FAA Logistics Center

• Reduce TACAN Antenna Operational Impacts

• Support NextGen DME and VOR MON Programs Frequency

Changes

• Provide improvements for safety and issues related to the

Antennas

• Status

• TACAN Antenna specification pending approval

• Procurement package pending approval

Next Steps

• Award the TACAN Antenna contract

• Continue Safety Analysis work

• Finalize work on specifications

• Complete the Final Investment Decision process for the DVT Sustainment Program

• Award the DVT Sustainment Contract (s)

Presented to:

By:

Date:

Federal Aviation Administration

DVT Safety Risk Management t

Program Safety Team

10 June 2021

Navigation Systems Industry Partners

DME – Distance Measuring Equipment VOR – Very High Frequency Omnidirectional Range TACAN – Tactical Air Navigation

DVT Industry Engagement

10 June 2021

DVT Safety Risk Management Outline

• Orientation

– FAA safety culture

– Safety Risk Management (SRM) of collision risk

– FAA Safety Management System (SMS)

– FAA Acquisition Lifecycle

• Completed DVT Safety Analyses

– Analysis techniques

– Operational Safety Assessment (OSA)

• Overview

• DVT OSA

– Functional Fault Hazard Analysis (FFHA)

• Overview

• TACAN Antenna System FFHA

– SRM role in the development of ground equipment specifications

DVT Industry Engagement

10 June 2021

ORIENTATION

DVT Industry Engagement

10 June 2021

FAA Safety Culture Mission

• Cultivate a safety culture that places a pervasive emphasis on safety as an organizational priority

• One that promotes

– An inherently questioning attitude

– A resistance to complacency

– A commitment to excellence

– The development and implementation of integrated and continuous programs and processes that nurture the improvement of safety within the National Airspace System (NAS)

– The involvement and accountability of management and labor

– The fostering of personal accountability and corporate self-regulation in safety matters

• The DVT safety program strives to embody and contribute to the spirit of the FAA’s safety culture

DVT Industry Engagement

10 June 2021

SRM of Collision Risk (1/2)

• Risk - Collision with terrain or obstacles during flight operations is known risk

• Flight operations below 20,000 feet MSL at risk

• See and avoid capabilities of the crew impaired during low-visibility conditions

– Nighttime operations

– Instrument Meteorological Conditions (IMC)

• Treatment - Mitigated risk to an acceptable level by totality of the NAS “Safety Net”

• Defenses in Depth approach

• Complementary Communication, Navigation, and Surveillance Services

– Ground equipment standards, specifications, and design assurance requirements

– Aircraft certification requirements

– Flight inspection of installed system performance

• Crew/Controller training and established procedures

• TERPS and instrument procedure design requirements/best practices

• Ground proximity warning systems (i.e., TAWS, MSAW)

DVT Industry Engagement

10 June 2021

SRM of Collision Risk (2/2)

• Failures – Cause gaps in defensive layers

– Objective is to proactively close known gaps

• Safety Risk Management (SRM)

• Safety Assurance Principles

• Use established, structured processes

• Navigation Services is one defensive layer of the safety net

– Navigation equipment is an integral component of this layer

– The effect of equipment failures on both functional and safety performance must be determined, evaluated, and treated when the risk caused by such effects is deemed unacceptable

– SRM is an integral part of the AMS process

– FAA conducts safety analyses prior to contract award

• Operational Safety Assessment

• Comparative Safety Assessment (N/A for sustainment programs)

• Preliminary Hazard Analysis

– Functional Fault Hazard Analysis

DVT Industry Engagement

10 June 2021

What is Safety Management?

• The FAA’s Safety Management System (SMS) is a systematic approach to managing safety

• Ensure acceptable safety risk is maintained as changes in the NAS are implemented

– Identify, analyze, assess, manage, and monitor

– Stakeholder coordination is essential

• System Acquisition - Funding is contingent on a safety analysis

• Safety Risk Management Guidance for System Acquisitions

(SRMGSA)

• Depth of analysis commensurate with concept/system development progression

• System development – integrate early to identify, validate, and track safety requirements through to verification

• Rigor (assurance level) determined by hazard severity

DVT Industry Engagement

10 June 2021

Key Definitions Failure Condition – a condition having an effect on the airplane and/or its occupants, either direct or consequential, which is caused or contributed to by one or more failures or errors, considering flight phase and relevant adverse operational or environmental conditions, or external events Hazard – a condition resulting from failures, external events, errors, or combinations thereof where safety is affected Cause – origin of a hazard Effect – the real or credible harmful outcome that has occurred or can be expected if the hazard occurs in the defined system state Severity – consequence or impact of a hazard’s effect or outcome in terms of loss or harm; severity is independent of likelihood Control/Mitigation – a means of reducing a hazard’s causes or effect Credible – reasonable to expect the cause or effect to occur within the operational environment

DVT Industry Engagement

10 June 2021

General SRM Analysis Process

• Describe the System

– Scope & objectives

– Stakeholders

– Criteria & plan for SRM efforts

– Define system or change

• Identify Hazards

– Structured approach

– Lessons learned & experience, supplemented by checklists

• Analyze & Assess Risk

– Identify controls

– Determine severity and likelihood; risk level

• Treat Risk

– Management strategies; monitor performance, corrective actions when required

DVT Industry Engagement

10 June 2021

FAA Acquisition Lifecycle

Acquisition Phase

Legend

1. Mission Need Decision (MND)

2. Investment Analysis Readiness Decision (IARD)

3. Initial Investment Decision (IID)

4. Final Investment Decision (FID)

5. In-Service Decision (ISD)

AMS Decision Point

DVT Industry Engagement

10 June 2021

Big Picture – Safety Documents

Time (not necessarily linear)

Product Lifecycle 1 2 3 4 5

ONCE AROUND THE ACQUISTION LIFECYCLE LOOP

CSA

Comparative Safety Assessment

PSP

Program Safety Plan

OSA

Operational Safety Assessment

PHA

Preliminary Hazard Assessment

FHA

Functional Hazard Analysis

PSSA

Preliminary System Safety Assessment

CCA

Common Cause Analysis

SSA

System Safety Assessment

SSAR

System Safety Assessment Report

Contract AwardFAA Developed Vendor Developed

N/A for sustainment programs

DVT Industry Engagement

10 June 2021

Safety Risk Management & Assurance

•From Figure 2.2 [1]

Operational/Service Need

C yc le T hr ou gh O

SA

, P

H A

, F H

A , C

C A

, e tc

DVT Industry Engagement

10 June 2021

Defenses in Depth & System Design

Defenses in Depth (NAS Safety Net) Safety Order of Precedence

1) Design for Minimum Risk

2) Incorporate Safety Devices

3) Provide Warnings

4) Procedures and Training

Nav. System design Navigation System

DVT Industry Engagement

10 June 2021

COMPLETED DVT SAFETY

ANALYSES

DVT Industry Engagement

10 June 2021

Hazard Identification/Analysis Techniques

Component of OSA

Known from DVT OSA and TACAN Antenna System FFHA

An FFHA when performed at the functional level

DVT Industry Engagement

10 June 2021

OSA OVERVIEW

DVT Industry Engagement

10 June 2021

OSA Supports Investment Analysis Readiness Decision (IARD)

Operational Safety

Assessment

Early in the cycle, the OSA identifies and assesses the hazards in a system, defines safety requirements, and builds a foundation for follow-on safety analyses

DVT Industry Engagement

10 June 2021

OSA Objectives

• Support Investment Analysis Readiness Decision (IARD) and transition of the concept to an implementing organization

• Define safety requirements based on hazard severity assessments and provide a foundation for follow-on analyses

• Determine whether safety concerns identified early during concept development may impact concept feasibility

• DVT: Legacy systems have met operational performance expectations. However, the majority were acquired prior to implementation of a formal SMS and application of current methods for safety requirements development, validation, and assessment must now be applied. Complexity of modern digital electronics and related software necessitate a “how good does it have to be for safety?” methodology

– Safety may not be the primary driver (for example, supportability may drive higher reliability), but compliance with safety requirements still needs to be validated through the appropriate safety process

DVT Industry Engagement

10 June 2021

OSA is NOT a Risk Assessment

• It is a tool for identifying hazards and developing safety requirements early in the lifecycle of a system

• It tells us what hazard likelihood is required to achieve the safety objective (acceptable risk)

BUT –

• It does not assess risk – that is left for follow-on analyses

DVT Industry Engagement

10 June 2021

Defining Objectives vs Analyzing Risk

Defining Safety Objectives

• Know severity from analysis phase

• Know minimum requirement for acceptable risk (Medium)

• Know desired risk level (Low)

• Program objective is to drive risks to Low within constraints of cost, schedule, and design

Analyzing Risk

• Know severity from analysis phase

• Know probability of hazard effect occurring from analysis of a specific design

• Analysis performed at assembly/piece/part level

• Worst-case probability used to provide conservative estimate

Applies to OSA

DVT Industry Engagement

10 June 2021

OSA - Three Constituents

• Operational Services Environment Description (OSED)

– Description of the system’s and environment’s physical and functional characteristics, and air traffic services and operational procedures

• 5M Model: Mission, Machine, HuMan, Management, Media

• Operational Hazard Assessment (OHA)

– A qualitative severity assessment of the hazards associated with the system

• Allocation of Safety Objectives and Requirements (ASOR)

– A process of using hazard severity to determine the safety objectives and requirements of the system

DVT Industry Engagement

10 June 2021

DVT OSA

DVT Industry Engagement

10 June 2021

Methodology Overview (1/2)

• Built upon successful DME OSA v3.1 (2016)

• Program Safety Team expertise plus SME input

– SME Meetings (5)

• ATC Operations (1)

• Aircraft Certification (2)

• Flight Standards (2)

– SRM Panel Meetings (2)

– Extensive AJI peer review

• Scope: navigation guidance via ranging and azimuth services, including DME/DME RNAV

• Describe current systems and environment

• Hazard identification by function

– Loss of function

– Malfunction

DVT Industry Engagement

10 June 2021

Methodology Overview (2/2)

• Partition hazards by flight application to determine operational consequences

• Capture assumptions relating to effects

• Assess severity of hazard effects

– ATO SMS Manual and AC/AMJ 25.1309

• Classify hazards according to highest severity level of the credible effects

• Determine safety objectives (likelihoods) and requirements from hazard severity

• Assess requirement allocation amongst air and ground systems

DVT Industry Engagement

10 June 2021

Analysis Methodology - FMEA

By Function

• Ranging

• Azimuth

Record the Results in the HAW

Q1- Is inaccurate (Out-of-tolerance) Q2- Is not received Q3- Is the wrong range/azimuth

What Happens When Function:

• Flight Crew Workload

• ATC Workload

• Aircraft Capability

• Safety Margin

• Cabin Crew & Passengers

Assess/Determine Effect on:

By Flight Application

• En route Nav

• En route Nav w/ RNAV

• Departure

• Arrival

• Non-precision approach

• Precision approach

DVT Industry Engagement

10 June 2021

Flight Applications Application Ranging Azimuth

(A) En Route Navigation

Along published Airways using DVT Ranging information for locating fixes, changing MEAs, and identifying changeover points.

Along published Airways using DVT Azimuth information for lateral navigation guidance.

(B) En Route Navigation using RNAV procedures

Typically uses an FMS and direct routing (e.g., using Q- Routes or not using published airways). In this method, DVT Ranging information is commonly used to provide aircraft positioning information using rho-rho navigation.

Typically using a FMS and direct routing (e.g., using Q- Routes or not using published airways); DVT Azimuth information is not used to provide aircraft positioning information.

(C) Departure Procedures

Predetermined methods for an aircraft to leave an airport and the terminal environment using published procedures (SIDs & ODPs).

Predetermined methods for an aircraft to leave an airport and the terminal environment using published procedures (SIDs & ODPs).

(D) Arrival Procedures

Predetermined methods for aircraft to approach an airport and its terminal environment using published procedures (STARs).

Predetermined methods for aircraft to approach an airport and its terminal environment using published procedures (STARs).

(E) Non-precision Approach Procedures

DVT Ranging information is used to support a SIAP to a runway; lateral guidance is provided by a VOR or LOC, but no vertical guidance information other than altimeter is provided. The DVT Ranging information defines the location of stepdown fixes, missed approach points, and the final approach fix.

DVT Azimuth information is used to support a SIAP to a runway; lateral guidance is provided by a DVT Azimuth station or LOC, but no vertical guidance information other than altimeter is provided. DVT Azimuth information may also be used as the primary NAVAID defining the final approach course to the runway.

(F) Precision Approach Procedures

DVT Ranging is used to support a SIAP to a runway;

lateral and vertical guidance are provided by an ILS. DVT Ranging information may also be used to support the missed approach procedure portion of the SIAP.

DVT Azimuth information is not used to support an SIAP to a runway; lateral and vertical guidance are provided by an Instrument Landing System (ILS). However, DVT Azimuth information may be used to support the missed approach procedure portion of the SIAP.

DVT Industry Engagement

10 June 2021

DVT Event Trees

Flight Applications

1. En route Nav

2. En route Nav w/ RNAV

3. Departure

4. Arrival

5. Non-precision approach

6. Precision approach

DVT Industry Engagement

10 June 2021

Operational Consequences

• Considering the flight application and assumptions pertaining to the hazard, what credible effects may be experienced in terms of:

– Flight crew workload

– ATC workload

– Aircraft capability

– Effect on safety margin

– Cabin crew/passengers

• Generally fall into one or more categories:

– Incorrect distance, azimuth, and/or position (RNAV) information

– Loss of distance, azimuth, and/or position (RNAV) information

– Decreased separation/containment (terrain, obstacles, and/or aircraft)

– Loss of separation/containment (terrain, obstacles, and/or aircraft)

– Violation of airspace boundaries or procedure violation

• Identify controls that may significantly reduce or preclude an effect (not credible)

DVT Industry Engagement

10 June 2021

Severity Assessment of Effects Classification/ Hazard

Minimal (1)

Minor (2)

Major (3)

Hazardous (4)

Catastrophic (5)

Flight Crew Workload

Inconvenienced Slight increase Significant increase

Physical distress, excessive/ unmanageable

N/A – crew fatalities may result

ATC Workload Slight increase Significant increase

Large increase N/A N/A

Aircraft Capability None Slight reduction Significant reduction

Large reduction Loss of aircraft

Safety Margin None Slight reduction Significant reduction

Large reduction N/A

Occupants excl.

Flight Crew

Minimal injury/ discomfort

Discomfort, with minor injury to ≤ 10% possible

Discomfort, with minor injury to > 10% possible

Serious injury to persons on board

Fatal injuries to persons on board

***Informed by AC/AMJ 25.1309 and ATO SMS Manual

DVT Industry Engagement

10 June 2021

Relevant NAS Safety Net Assumptions

• Relevant meaning the origin of the worst-case severity classification of Catastrophic

• DVT OSA assumptions

– Cross checks assumed unavailable

• Not required by policy or guidance

• Practice is to provide when infrastructure permits

• DVT operation required during a GNSS outage

• VOR/TACAN MON will reduce ground system network

– ATC Safety Alerting unavailable

• Lack of radar coverage (operations during GNSS outage precludes use of ADS-B)

• Controller workload becomes an issue because multiple aircraft are impacted when navigation system is the cause of an out-of-tolerance NSE condition

– Traffic density has increased significantly

– Automation plus PBN procedures affect controller proficiency in simultaneously vectoring multiple aircraft (≥ 3 aircraft)

– MSAW, TAWS, and TCAS unavailable

– TERPS criteria does not protect against an out-of-tolerance NSE condition

DVT Industry Engagement

10 June 2021

Example Hazard Discussion (1/3) AZM-001 – Inaccurate Azimuth Hazard

Hazards AZM 001A-001F (Table 3 8), where azimuth information is available but inaccurate, are conditions which cannot readily be detected by the user or the aircraft’s Flight Management System. Two example scenarios where this may cause detrimental effects are when the primary course guidance is azimuth-based and/or when the azimuth information is used as a crossing radial to identify the location of a navigation fix. The presence of an inaccurate azimuth condition may result in the flight crew steering the aircraft towards/into terrain/obstacles or prematurely changing to a lower altitude where the risk of colliding with terrain /obstacles is increased.

While the magnitude of the effect that may result from this condition could be controlled by the availability of TAWS, it is an advisory system that is not mandatory for IFR certified aircraft nor does it have any continuing certification requirements ensuring that the underlying database used remains current [16]. Likewise, while MSAW may reduce the magnitude of the effect that may result from this condition, the underlying radar coverage required to enable this alerting could be lacking [6]. Therefore, this analysis assumes that TAWS warnings and ATC intervention are unavailable to limit a reduction in terrain/obstacle clearance, penetration of the Obstacle Clearance Surface or the worst-case possibility of a collision with that terrain or obstacle.

Additionally, the inaccurate azimuth condition will simultaneously affect all aircraft using the faulty ground station.

Discussions with ATC Subject Matter Experts (SMEs) revealed that the situation requiring ATC intervention in busy airspace for more than two aircraft simultaneously would rapidly escalate the controller workload to an unmanageable level [7]. Therefore, even if radar coverage could be assumed everywhere, no presumption is asserted that ATC intervention will provide the appropriate course corrections or altitude changes to all affected aircraft or all affected aircraft in a timely enough fashion.

Hazard analysis by flight application follows introductory hazard discussion

DVT Industry Engagement

10 June 2021

Example Hazard Discussion (2/3) AZM-001 – Inaccurate Azimuth Hazard

a. AZM-001A – En Route/Airway. In the en route application, DVT azimuth information is used for lateral guidance between azimuth ground stations and intersections. DVT azimuth information can also be used to define intersections, change over points, and points along airways at which minimum en route altitude changes occur.

Since azimuth information is used for steering guidance and the identification of fixes along the flight path, both inaccurate lateral positioning and/or inaccurate fix identification is possible.

Inaccurate azimuth may result in steering out of an airway corridor towards high terrain or cause the flight crew to not execute the expected climb, descent or turn procedure when required. In some instances, ATC may monitor those en route aircraft and issue verbal commands to the crew if the aircraft is deviating from the intended flight path or is at a lower-than-expected altitude. Such intervention is not assumed for the purpose of hazard assessment because radar coverage may not always be available, nor may the controller have the capacity to effectively intervene with multiple aircraft simultaneously. Therefore, there are no mitigating factors to assure terrain/obstacle clearance in the event of a deviation from the intended course. The analysis indicates inaccuracy could result in:

• Incorrect azimuth/course guidance/position information

• Decreased separation/containment (terrain, obstacles, aircraft)

• Loss of separation/containment (terrain, obstacles, aircraft)

• Violation of airspace boundaries or procedure violation

DVT Industry Engagement

10 June 2021

Example Hazard Discussion (3/3) AZM-001 – Inaccurate Azimuth Hazard

The nature of the fault conditions does not inherently provide a bound on the maximum azimuth error possible, thus the error could be large enough that a complete loss of separation from terrain, obstacles, and aircraft occurs.

Expected worst-case effects from an inaccurate azimuth are:

• Loss of the aircraft

• Multiple fatalities

The outcome of this assessment is that the worst, credible severity classification is Catastrophic. Achieving an acceptable risk level requires the likelihood of the worst-case effect occurring to be no greater than Extremely Improbable.

DVT Industry Engagement

10 June 2021

Example Hazard Discussion (1/3) RNG-001 – Inaccurate Range Hazard

Hazards RNG-001A-001F (Table 3-5), where slant range information is available but inaccurate (e.g., out-of-tolerance). The presence of this hazard results in misleading ranging information being provided by the airborne equipment. These are conditions which cannot readily be detected by the user or the aircraft’s Flight Management System. An example scenario in which this may cause a detrimental effect is when slant range is used to identify fixes where a change to a lower altitude may occur. The presence of an inaccurate slant range condition may result in a premature change to a lower altitude, which brings risk of collision when rising terrain or objects are present.

While the magnitude of the effect that may result from this condition could be controlled by the availability of TAWS, it is an advisory system that is not mandatory for IFR certified aircraft nor does it have any continuing certification requirements ensuring that the underlying database used remains current [16]. Likewise, while MSAW may reduce the magnitude of the effect that may result from this condition, the underlying radar coverage required to enable this alerting could be lacking [6]. Therefore, this analysis assumes that TAWS warnings and ATC intervention are unavailable to limit a reduction in terrain/obstacle clearance, penetration of the Obstacle Clearance Surface or the worst-case possibility of a collision with that terrain or obstacle.

Additionally, the inaccurate slant range condition will simultaneously affect all aircraft using the faulty ground station.

Discussions with ATC Subject Matter Experts (SMEs) revealed that the situation requiring ATC intervention in busy airspace for more than two aircraft simultaneously would rapidly escalate the controller workload to an unmanageable level [7]. Therefore, even if radar coverage could be assumed everywhere, no presumption is asserted that ATC intervention will provide the appropriate course corrections or altitude changes to all affected aircraft or all affected aircraft in a timely enough fashion.

Hazard analysis by flight application follows introductory hazard discussion

DVT Industry Engagement

10 June 2021

Example Hazard Discussion (2/3) RNG-001 – Inaccurate Range Hazard

a. RNG-001A – En Route/Airway. In the en route application, slant range can be used to define intersections, change over points, points along airways at which minimum en route altitude changes occur, and fixes for established holding patterns. Although slant range is used solely to identify fixes along the flight path, such fixes may be identified at inaccurate locations.

Inaccurate range value causes the flight crew to not execute the expected climb, descent or turn procedure when required. In some instances, ATC may monitor those en route aircraft and issue verbal commands to the crew if the aircraft is at a lower-than-expected altitude or deviating from the intended flight path due to missing a fix. Such intervention is not assumed for the purpose of hazard assessment because radar coverage may not always be available, nor may the controller have the capacity to effectively intervene with multiple aircraft simultaneously.

Therefore, there are no mitigating factors to assure terrain/obstacle clearance in the event of a misidentification of a fix. The analysis indicates inaccuracy could result in:

• Incorrect distance/position information

• Decreased separation/containment (terrain, obstacles, aircraft)

• Loss of separation/containment (terrain, obstacles, aircraft)

• Violation of airspace boundaries or procedure violation

DVT Industry Engagement

10 June 2021

Example Hazard Discussion (3/3) RNG-001 – Inaccurate Range Hazard

The nature of the fault conditions does not inherently provide a bound on the maximum range error possible, thus the error could be large enough that a complete loss of separation from terrain, obstacles, or other aircraft occurs.

Expected worst-case effects from an inaccurate slant range distance are:

• Loss of the aircraft

• Multiple fatalities

The outcome of this assessment is that the worst, credible severity classification is Catastrophic. Achieving an acceptable risk level requires the likelihood of the worst-case effect occurring to be no greater than Extremely Improbable.

DVT Industry Engagement

10 June 2021

DVT OSA Outcomes (1/3) ID Description Applications with

Highest Severity Severity

Classification Source

AC GRD

RNG-001 Inaccurate Slant Range All except en route RNAV Catastrophic x x

RNG-002 Loss of Slant Range All except en route airway Major x x

RNG-003 Incorrect Slant Range All except en route RNAV Catastrophic x x

AZM-001 Inaccurate Azimuth All except en route RNAV* Catastrophic x x

AZM-002 Loss of Azimuth All except en route RNAV* Major x x

AZM-003 Incorrect Azimuth All except en route RNAV* Catastrophic x x

Flight Applications A. En route airway B. En route RNAV C. Departure D. Arrival E. Non-precision approach F. Precision approach

Assurance Level Ground equipment ranging and azimuth functionality shall be verified to SAE ARP 4754 Functional Development Assurance Level (DAL) A

* Flight application N/A, only DVT range information is used to support RNAV flight operations.

NAS Safety Net Less than 100% credit taken for mitigations provided by NAS Safety Net based on SME input

DVT Industry Engagement

10 June 2021

DVT OSA Outcomes (2/3)

RANGING

DVT Industry Engagement

10 June 2021

DVT OSA Outcomes (3/3)

AZIMUTH

DVT Industry Engagement

10 June 2021

TACAN Antenna FFHA

DVT Industry Engagement

10 June 2021

FHA Description

• “The Fault Hazard Analysis is a deductive method of analysis that can be used exclusively as a qualitative analysis or, if desired, can expand to a quantitative one. The Fault Hazard Analysis requires a detailed investigation of sub-systems to determine component hazard modes, causes of these hazards, and resultant effects on the sub-system and its operation.”1

• The approach described above will be tailored to provide a design agnostic approach that investigates the cause and effects of subsystem functional failures (i.e., FFHA will be performed)

• Supporting analysis methods1

– Fault Tree Analysis

– What-If Analysis

• Conducted using outcomes from the DVT OSA

• Purpose

– Validation of safety requirements contained in equipment specifications

– Lay groundwork for follow-on PHA development effort

1 Table 3.1, ATO Safety Management System Manual, April 2019

DVT Industry Engagement

10 June 2021

Methodology Overview (1/4)

TACAN Ground Station Generic Solution Architecture

Electronic Subsystem

Antenna Subsystem Functional Decomposition

Functional decomposition into an electronic subsystem (transponder) and an antenna subsystem is required because the performance requirements for a TACAN ground station are levied in two specifications

DVT Industry Engagement

10 June 2021

Methodology Overview (2/4)

DVT Industry Engagement

10 June 2021

Methodology Overview (3/4)

DVT Industry Engagement

10 June 2021

Methodology Overview (4/4)

Operational Hazard/ID

TACAN Antenna Subsystem Requirement

FAA-E-2828B Paragraph Requirement

RNG-001

Inaccurate Range

System verified to

SAE ARP 4754

DAL A

N/A Antenna Subsystem not a source of hazard

Probability of Occurrence (P) < 1x10-9

N/A Antenna Subsystem not a source of hazard

No single event/failure causes hazard with Catastrophic effect

N/A Antenna Subsystem not a source of hazard

Accuracy IAW specifications

N/A Antenna Subsystem not a source of hazard

Reply-delay monitoring

N/A Antenna Subsystem not a source of hazard

Mechanisms to prevent unintended change to system parameters

N/A Antenna Subsystem not a source of hazard

RNG-002

Loss of Range

Probability of Occurrence (P)2 < 2.283x10-4

3.3.5 NOTE: A probability of

occurrence value is not stated however the equivalent requirement in terms of MTBF performance is satisfied in the requirement in paragraph 3.3.5.

System reliability

IAW

specifications

(MTBF > 4380

hours) 2

3.3.5 a. For equipment installed outdoors, the TACAN antenna system components shall have a specified mean time between failures (MTBF) of at least 25000 hours as a serial reliability model.

b. For equipment installed indoors, the TACAN antenna system components shall have a specified MTBF of at least 8760 hours as a serial reliability model.

Signal strength monitoring

3.2.10.2 Two coupling probes for

monitoring the RF signal level of the driven antenna element(s) shall be provided within the antenna assembly.

NOTE: The requirement stated in 3.2.10.2 enables compliance with the safety objective provided signal strength monitoring is accomplished by the TACAN Electronic Subsystem (ES).

Mechanisms to prevent unintended change to system parameters

This requirement is not directly/indirectly addressed.

RNG-003

Incorrect Range Reception (Co-channel

Reception)

Probability of Occurrence (P)2 < 2.283x10-4

3.3.5 NOTE: A probability of

occurrence value is not stated however the equivalent requirement in terms of MTBF performance is satisfied in the requirement in paragraph 3.3.5.

System reliability

IAW

specifications

(MTBF > 4380

hours) 2

3.3.5 a. For equipment installed outdoors, the TACAN antenna system components shall have a specified mean time between failures (MTBF) of at least 25000 hours as a serial reliability model.

b. For equipment installed indoors, the TACAN antenna system components shall have a specified MTBF of at least 8760 hours as a serial reliability model.

Signal strength monitoring

3.2.10.2 Two coupling probes for

monitoring the RF signal level of the driven antenna element(s) shall be provided within the antenna assembly.

NOTE: The requirement stated in 3.2.10.2 enables compliance with the safety objective provided signal strength monitoring is accomplished by the TACAN Electronic Subsystem (ES).

Mechanisms to prevent unintended change to system parameters

This requirement is not directly/indirectly addressed.

Operational Hazard/ID

TACAN Antenna Subsystem Requirement

FAA-E-2828B Paragraph Requirement

AZM-001

Inaccurate Azimuth

System verified to

SAE ARP 4754

DAL A

N/A

Probability of Occurrence (P) < 0.5x10-9

3.2.18 The integrity of the TACAN

signal modulation, expressed as a probability of not radiating false guidance signals, shall be equal to or greater than 0.9999999995, which is equivalent to 1-(5 x 10-10).

No single event/failure causes hazard with Catastrophic effect

This requirement is not directly/indirectly addressed.

Section 3.2.10.1.c states that “ Failure of any part of the monitor itself shall automatically produce the same results as the malfunctioning of the element(s) being monitored.” That is, the implemented monitor design must be fail-safe.

Accuracy IAW specifications

3.2.4.b

3.2.4.c

3.2.5.d

b. The deviation in azimuth degrees from the coincidence of the 15 Hz modulation signal and the main reference pulse θ, shall be less than or equal to 3.5 azimuth degrees root mean square (RMS) with peak value not to exceed ± 8 azimuth degrees.

c. The deviation in azimuth degrees from the coincidence of the 135 Hz modulation signal and the auxiliary or 40-degree pulse φ, shall be less than or equal to 0.5 azimuth degrees RMS with peak value not to exceed ± 2 azimuth degrees.

d. Forty degrees after the north trigger pulse, an auxiliary trigger pulse shall be generated at each of eight consecutive angular increments of 40 degrees ± 0.01 degree.

Azimuth Accuracy monitoring

3.2.10.1.a

3.2.10.1.b

3.2.10.1.c

a. Independent of the ground transponder equipment, the antenna system shall detect faults that affect accuracy along any azimuth radial.

b. Accuracy monitoring shall report an azimuth accuracy fault for any out-of-tolerance condition listed in 3.2.4.

c. Failure of any part of the monitor itself shall automatically produce the same results as the malfunctioning of the element(s) being monitored.

Mechanisms to prevent unintended change to system parameters

This requirement is not directly/indirectly addressed.

AZM-002

Loss of Azimuth

Probability of Occurrence (P)2 < 2.283x10-4

3.3.5 NOTE: A probability of

occurrence value is not stated however the equivalent requirement in terms of MTBF performance is satisfied in the requirement in paragraph 3.3.5.

System reliability IAW specifications

(MTBF > 4380

hours) 2

3.3.5 a. For equipment installed outdoors, the TACAN antenna system components shall have a specified mean time between failures (MTBF) of at least 25000 hours as a serial reliability model.

b. For equipment installed indoors, the TACAN antenna system components shall have a specified MTBF of at least 8760 hours as a serial reliability model.

Signal strength monitoring

3.2.10.2 Two coupling probes for

monitoring the RF signal level of the driven antenna element(s) shall be provided within the antenna assembly.

NOTE: The requirement stated in 3.2.10.2 enables compliance with the safety objective provided signal strength monitoring is accomplished by the TACAN Electronic Subsystem (ES).

Mechanisms to prevent unintended change to system parameters

This requirement is not directly/indirectly addressed.

AZM-003

Incorrect Azimuth Reception (Co-channel

Reception)

Probability of Occurrence (P)2 < 2.283x10-4

3.3.5 NOTE: A probability of

occurrence value is not stated however the equivalent requirement in terms of MTBF performance is satisfied in the requirement in paragraph 3.3.5.

System reliability IAW specifications

(MTBF > 4380

hours)2

3.3.5 a. For equipment installed outdoors, the TACAN antenna system components shall have a specified mean time between failures (MTBF) of at least 25000 hours as a serial reliability model.

b. For equipment installed indoors, the TACAN antenna system components shall have a specified MTBF of at least 8760 hours as a serial reliability model.

Signal strength monitoring

3.2.10.2 Two coupling probes for

monitoring the RF signal level of the driven antenna element(s) shall be provided within the antenna assembly.

NOTE: The requirement stated in 3.2.10.2 enables compliance with the safety objective provided signal strength monitoring is accomplished by the TACAN Electronic Subsystem (ES).

Mechanisms to prevent unintended change to system parameters

This requirement is not directly/indirectly addressed.

Define safety requirements

Audit specification

Record and report outcomes

DVT Industry Engagement

10 June 2021

Conclusion

• A Functional Fault Hazard Analysis (FFHA) is a design agnostic approach that investigates the causes and effects of subsystem functional failures

• An FFHA was conducted for the TACAN antenna system

– Subsystem of the TACAN ground station

– Identified failures that cause the inaccurate azimuth hazard

(aka AZM-001)

• The occurrence of AZM-001 can cause Catastrophic effects

• Failures are not detectable by electronic subsystem (transponder electronics) when electronically scanned antennas are used

• Thus, the TACAN antenna system must be verified to DAL A

DVT Industry Engagement

10 June 2021

Safety Requirement Interpretation

Assurance Level Requirement

Ground equipment ranging and azimuth functionality shall be verified to SAE ARP 4754 Functional Development Assurance Level (DAL) A

TACAN Antenna System Functional Fault Hazard Analysis, Figure 6-2

Intended

Interpreted?

Interpretation Issue?

There may be differences in how this requirement is interpreted vs what is intended depending on how the phrase “ranging and azimuth functionality” is understood by the reader

DVT Industry Engagement

10 June 2021

Questions and Discussion

DVT Industry Engagement

10 June 2021

BACKUP SLIDES

DVT Industry Engagement

10 June 2021

Why DAL A Now?

DVT Industry Engagement

10 June 2021

DME OSA

• DME transponder was the first ground-based navaid assessed under the FAA’s formalized Safety Management System (SMS)

– Initial OSA conducted and documented circa 2010

– No other safety documents, formal or informal, had been previously developed for DME

– Examined effects caused by failures of the DME ranging function (i.e., either malfunction or loss of function) for seven flight applications

– Unmitigated worst-case hazard effects have Catastrophic severity

– 100% credit taken for mitigations provided by the NAS Safety Net

– Mitigated worst-case hazard effects have Hazardous severity

• Most recent update in support of the NextGen DME program (v3.1, 2016)

• Outcomes

– Worst-case severity classification assessed to be Hazardous

– Required system development/verification to Development Assurance

Level (DAL) B

DVT Industry Engagement

10 June 2021

DVT OSA

• Built upon successful DME OSA v3.1 (2016)

– Significant SME input from program safety team, ATC operations, aircraft certification, and flight standards during OSA development

– Extensive SRM Panel review and AJI peer-review

– Examined effects caused by failures of the DVT ranging and azimuth functions for six flight applications

– < 100% credit taken for mitigations provided by NAS Safety

Net based on SME input

• Outcomes

– Worst-case severity classification assessed to be Catastrophic

– Requires system development/verification to DAL A

DVT Industry Engagement

10 June 2021

TACAN Antenna FFHA

• A Functional Fault Hazard Analysis (FFHA) is a design agnostic approach that investigates the causes and effects of subsystem functional failures

• An FFHA was conducted for the TACAN antenna system

– Subsystem of the TACAN ground station

– Identified failures that cause the inaccurate azimuth hazard

(aka AZM-001)

• The occurrence of AZM-001 can cause Catastrophic effects

• Failures are not detectable by electronic subsystem (transponder) when electronically scanned antennas are used

• Thus, the TACAN antenna system must be verified to DAL A

DVT Industry Engagement

10 June 2021

Conclusions

• DAL A determination for DVT services

– Analysis produced a more informed and vetted understanding regarding the extent to which the NAS Safety Net mitigates hazard effects for the six flight applications analyzed

– It was determined that a small threat space exists where DVT hazards can have Catastrophic effects

• DAL A determination for TACAN antenna systems

– Failures of eScan antenna functions can cause Catastrophic effects

– Failures must be treated/detected by the antenna system

DVT Industry Engagement

10 June 2021

Why do WAAS and DVT Differ?

DVT Industry Engagement

10 June 2021

Why do WAAS and DVT Differ?

• The DALs differ due to dissimilarities in

– System architectures

– Hazard assessment methodologies

– The resulting outcomes are not apples to apples

• The WAAS assurance questioned pertains to the software assurance requirement

• DVT assurance is a system level assurance requirement

DVT Industry Engagement

10 June 2021

DRAFT INDUSTRY DAY

PRESENTATION DONE TO HERE

DVT Industry Engagement

10 June 2021

Other Backup Slides

DVT Industry Engagement

10 June 2021

DME OSA Outcomes ID Description Applications with

Highest Severity Severity Classification

RNG-001 Inaccurate Slant Range A, B, E, and F Hazardous

RNG-002 Loss of Slant Range All flight applications Minor*

RNG-003 Incorrect Slant Range A, B, E, and F Hazardous

Flight Applications A. En route airway B. En route RNAV C. Departure D. Arrival E. Radius-to-Fix F. Non-precision approach G. Precision approach

Assurance Level Ground equipment shall be verified to SAE ARP 4754 Functional Development Assurance Level (DAL) B

* Requires alternative means of navigation or ATC assistance to be available

DVT Industry Engagement

10 June 2021

DVT OSA Outcomes ID Description Applications with

Highest Severity Severity Classification

RNG-001 Inaccurate Slant Range All except en route RNAV Catastrophic

RNG-002 Loss of Slant Range All except en route airway Major

RNG-003 Incorrect Slant Range All except en route RNAV Catastrophic

AZM-001 Inaccurate Azimuth All except en route RNAV* Catastrophic

AZM-002 Loss of Azimuth All except en route RNAV* Major

AZM-003 Incorrect Azimuth All except en route RNAV* Catastrophic

Flight Applications A. En route airway B. En route RNAV C. Departure D. Arrival E. Non-precision approach F. Precision approach

Assurance Level Ground equipment ranging and azimuth functionality shall be verified to SAE ARP 4754 Functional Development Assurance Level (DAL) A

* Flight application N/A, only DVT range information is used to support RNAV flight operations.

DVT Industry Engagement

10 June 2021

TACAN Antenna FFHA Outcome, Azimuth