Tactical Air Navigation (TACAN) Antenna System Functional Fault Hazard Analysis (FFHA).pdf

Tactical Air Navigation (TACAN) Antenna System

Functional Fault Hazard Analysis (FFHA)

ATO Enterprise Services Navigation Programs Group (AJM-32)

Version 1.2

May 21, 2021

Federal Aviation Administration 800 Independence Avenue

Washington, DC 20591

TACAN Antenna System FFHA, Version 1.2 May 21, 2021 ii

SIGNATURE PAGE

Submitted By:_________________________________Date: __________________ Nnaemeka Nnamani, Program Manager DVT Sustainment Program, AJM-3241

Approved By:__________________________________Date: __________________ Deborah Lawrence Manager, Navigation Programs, AJM-32

Approved By:__________________________________Date: __________________ Malcolm Andrews Director, Enterprise Services, AJM-3 iii

REVISIONS

Version Change Date Description Version 0.1 February 5, 2021 Ninety-percent complete draft for initial SME

Panel review.

Version 1.0 March 5, 2021 Incorporated comments from SME Panel review.

Version 1.1 Admin March 10, 2021 Updated the DVT OSA information in the reference section to note the approval date Version 1.2 Admin May 21, 2021 Updated TACAN Antenna Specification number to FAA-E-7869 iv

TABLE OF CONTENTS

EXECUTIVE SUMMARY ........................................................................................................ IX

1 INTRODUCTION

1.1 Methodology Development and Overview

1.2 Objective

1.3 Scope

1.4 Subject Matter Expert Panel Participants

2 SYSTEM DESCRIPTION

3 OPERATIONAL SAFETY ASSESSMENT OVERVIEW

3.1 Service Level Hazards and Safety Objectives

3.2 Operational Hazard Assessment

3.3 Safety Objectives and Requirement Allocations

4 FURTHER ANALYSIS OF HAZARDS RNG-003 AND AZM-003

4.1 Hazard Mitigation by the Flight Crew

4.2 Hazard Mitigation from Lack of Available Power

4.3 Hazard Analysis Summary

5 DETAILED THEORY OF OPERATION

5.1 Range Information

5.2 Channel Identification

5.3 Bearing Information

5.3.1 Coarse Bearing Information

5.3.2 Fine Bearing Information

5.3.3 Electronically Modulated Antenna

5.4 Signal-in-Space

5.5 Effect of Functional Failures

5.5.1 North/Aux Burst Transmission Timing

5.5.2 Pattern Distortion

5.5.3 Rate of Pattern Rotation

v

6 HAZARD ANALYSIS

6.1 Generic Solution Architecture

6.1.1 Electronic Subsystem Generic Solution Architecture

6.1.2 Antenna Subsystem Generic Solution Architecture

6.2 Hazard and Safety Objectives Review

6.3 Functional Fault Hazard Analysis

6.3.1 RNG-001 Inaccurate Slant Range

6.3.1.1 Electronic Subsystem

6.3.1.2 Antenna Subsystem

6.3.2 RNG-002 Loss of Slant Range

6.3.2.1 Electronic Subsystem

6.3.2.2 Antenna Subsystem

6.3.3 RNG-003 Incorrect Slant Range

6.3.3.1 Electronic Subsystem

6.3.3.2 Antenna Subsystem

6.3.4 AZM-001 Inaccurate Azimuth

6.3.4.1 Electronic Subsystem

6.3.4.2 Antenna Subsystem

6.3.5 AZM-002 Loss of Azimuth

6.3.5.1 Electronic Subsystem

6.3.5.2 Antenna Subsystem

6.3.6 AZM-003 Incorrect Azimuth

6.3.6.1 Electronic Subsystem

6.3.6.2 Antenna Subsystem

6.3.7 New Hazard Identification

6.4 Hazard Analysis Summary

7 GROUND STATION ASOR

7.1 Ranging Ground Equipment ASOR

7.2 Azimuth Ground Equipment ASOR

8 TACAN ANTENNA SUBSYSTEM SAFETY REQUIREMENTS

9 ANALYSIS OF FAA-E-7869 SAFETY REQUIREMENTS

10 RISK ASSESSMENT

11 REFERENCES

APPENDIX A: DME RELIABILITY-RELATED SAFETY PARAMETER ANALYSIS .. 1

vi

LIST OF TABLES

Table ES-0-1. DVT Hazard ID, Hazard Description, Safety Objective, and Source. ................... x Table 1-1. SME Panel Participants Table 3-1. DVT Ranging Service Hazards and Objectives Table 3-2. DVT Ranging Service Applications Table 3-3. DVT Azimuth Service Flight Applications Table 3-4. Operational Hazard Assessment Assumptions Table 3-5. DVT Operational Hazard Analysis, RNG-001 Table 3-6. DVT Operational Hazard Analysis, RNG-002 Table 3-7. DVT Operational Hazard Analysis, RNG-003 Table 3-8. DVT Operational Hazard Analysis, AZM-001 Table 3-9. DVT Operational Hazard Analysis, AZM-002 Table 3-10. DVT Operational Hazard Analysis, AZM-003 Table 3-11. Service-level Likelihood Requirements for Ranging Service Table 3-12. Service-level Likelihood Requirements for Azimuth Service Table 4-1. Change in Range by Navigation Regions of Interest for RNG-003 Hazard Table 4-2. Change in Azimuth by Navigation Regions of Interest for AZM-003 Hazard Table 4-3. Ground Station Likelihood Requirements for Ranging Service Table 4-4. Ground Station Likelihood Requirements for Azimuth Service Table 6-1. ID, Description, and Objectives for Hazards Caused by Ground Equipment Faults or Failures Table 6-2. Summary of the RNG hazard analysis performed Table 6-3. Summary of the AZM hazard analysis performed Table 6-4. TACAN Ground Station Subsystem Allocations for Ranging Service Table 6-5. TACAN Ground Station Subsystem Allocations for Azimuth Service Table 7-1. Ground Equipment Maximum Likelihoods for Hazards RNG-001/002/003 Table 7-2. Ground Equipment ASOR for Ranging Table 7-3. Ground Equipment Maximum Likelihood for Hazards AZM-001/002/003 Table 7-4. Ground Equipment ASOR for Azimuth Table 8-1. Ranging Service Safety Requirements Apportioned to the Antenna Subsystem Table 8-2. Azimuth Service Safety Requirements Apportioned to the Antenna Subsystem Table 9-1. TACAN Antenna System Specification Audit Results for Range Service Table 9-2. TACAN Antenna System Specification Audit Results for Azimuth Service

LIST OF FIGURES

Figure 1-1 Safety Requirements Verification Methodology Flow Chart Figure 1-2. FFHA Scope and TACAN Ground Station Decomposition Figure 2-1. TACAN-only System Configuration Figure 2-2. VORTAC System Configuration Figure 2-3. DME Two-Way Ranging Concept Figure 2-4. TACAN Bearing Determination Concept Figure 3-1. Top-Level DVT Ranging Service Event Tree and Associated Hazards Figure 3-2. Top-Level DVT Azimuth Service Event Tree and Associated Hazards vii

Figure 4-1. DME/TACAN Co-channel Separations Figure 4-2. TACAN Service Volumes and Associated Station Power Output Figure 4-3. Top-Down View of High-Altitude TACAN Service Volumes Geometry Figure 4-4. Regions of Interest for Navigation in Desired Service Volume Figure 4-5. Power Available Requirements for Navaid Receivers Figure 4-6. Plan View of High-Altitude TACAN Service Volumes with Power Available Graph Overlay Figure 4-7. Power Available Graph for a TACAN Station Operating at 5000 Watts Upper Bound (High Altitude) Figure 4-8. Top-Down View of Low Altitude DME Service Volumes Geometry Figure 4-9. Power Available Graph for a DME station operating at 100 Watts (Low Altitude). 34 Figure 4-10. Power Available Graph for a DME station operating at 1000 Watts (Low Altitude).

Figure 4-11. Top-Down View of Terminal Class DME Service Volumes Geometry Figure 4-12. Power Available Graph for a DME station operating at 100 Watts (Terminal) Figure 5-1. TACAN Rho-Theta Navigational System Figure 5-2. Round-Trip Travel Time Figure 5-3. Transponder Pulse Train X-Channel Figure 5-4. Transponder Pulse Train Y-Channel Figure 5-5. Ident Burst Timing Figure 5-6. Antenna Arrangement for 15 Hz Signal Figure 5-7. Limacon Pattern Mapped to Received Amplitude Modulated Pulses Figure 5-8. Antenna Arrangement for 135 Hz Signal Figure 5-9. Radiated Pattern from TACAN Antenna and the Composite Modulation Envelope.

Figure 5-10. Radio Output Received South of the Ground Beacon Figure 5-11. Example Showing What Receiver Decodes for an Aircraft at a Bearing of 180°. . 52 Figure 5-12. DoR Measurement Between North Burst and Coincidence of Positive-Going Zero Crossings of 15 Hz and 135 Hz Signals for Aircraft Due South of TACAN Facility Figure 5-13. DoR Measurement Between North Burst and Coincidence of Positive-Going Zero Crossings of 15 Hz and 135 Hz Signals for Aircraft Due Southwest of TACAN Facility Figure 5-14. DoR Measurement Between North Burst and Coincidence of Positive-Going Zero Crossings of 15 Hz and 135 Hz Signals for Aircraft Due North of TACAN Facility Figure 5-15. DoR Measurement Between North Burst and Coincidence of Positive-Going Zero Crossings of 15 Hz and 135 Hz Signals for Aircraft Due East of TACAN Facility Figure 5-16. DoR Measurement Showing Impact of Early or Late North Burst Figure 5-17. DoR Measurement for Aircraft Due North of TACAN Facility when received signals are distorted Figure 5-18. Effect of pattern distortion on 15 Hz and 135 Hz signals positive-going zero crossings -Example 1 Figure 5-19. Effect of pattern distortion on 15 Hz and 135 Hz signals positive-going zero crossings -Example 2 Figure 5-20. Effect of pattern distortion on 15 Hz and 135 Hz signals positive-going zero crossings -Example 3 Figure 6-1. TACAN Functional Generic Solution Architecture viii

Figure 6-2. Postulated TACAN Parallel Channel, Active Monitor Safety Architecture Fault Tree Figure 6-3. Electronic Subsystem Functional Generic Solution Architecture Figure 6-4. Antenna Subsystem Generic Solution Architecture Figure 6-5. Generic Fault Tree Figure 10-1. Ranging Risk Matrix Figure 10-2. Azimuth Risk Matrix

This portion of the page intentionally left blank ix

EXECUTIVE SUMMARY

Background: The Federal Aviation Administration (FAA) operates and maintains three independent systems that provide ranging and azimuth services in the United States National Airspace System (NAS): Distance Measuring Equipment (DME), Very High Frequency Omni- Directional Range (VOR), and Tactical Air Navigation (TACAN), known collectively as DVT.

These systems have been operating in the United States National Airspace System (NAS) for decades and support both terminal and en route navigational services. They facilitate flight operations by providing slant range distance and azimuth between the airborne equipment and the ground facility antennas. Operational, functional, and safety requirements are well established.

Program Objective: An FAA initiative referred to as the DVT Sustainment Program seeks to ensure long-term sustainment of DME, VOR, and TACAN services. The primary objective of the program is to leverage this sustainment to support a resilient navigation infrastructure [1].

Collectively, these systems will serve as part of a robust backup navigation network to facilitate strategic FAA initiatives – such as Performance-Based Navigation – in the event of a Global Positioning System (GPS) service disruption. Further details can be found in the DVT Program Safety Plan [1].

The DVT Sustainment Program will implement a multi-phased approach over its lifecycle. Each phase will consist of a collection of projects that are prioritized based on their importance to the program. Early planning indicates that the initial phase will include acquisition of TACAN antenna systems as a first priority [1].

In support of this first priority, the DVT Requirements Working Group (RWG) has developed a new TACAN antenna system specification. The RWG used the existing specification, FAA-E- 2828A [2], as a starting point for the development effort and the new version of the specification is designated FAA-E-7869 [3]. The new specification contains both functional performance and safety-related requirements (aka safety requirements), and the development activities include verification of these requirements. As coordinated with AJI Safety and Technical Training, the safety requirements will be verified by performing a Functional Fault Hazard Analysis (FFHA).

FFHA Overview and Scope: The purpose of this FFHA is to assess the necessity, suitability, and completeness of the existing safety requirements contained in FAA-E-7869. It was developed using the strategy coordinated with AJI Safety and Technical Training [4] to ensure compliance with the requirements of the Air Traffic Organization (ATO) Safety Management System Manual (April 2019) and Safety Risk Management Guidance for System Acquisitions (March 2020). This FFHA was developed to document the analysis performed and safety requirement verification outcomes.

An approved DVT Operational Safety Assessment (OSA) exists [5] and was used as an input to generate this FFHA; a summary of the OSA is provided in Section 3. Likewise, the NextGen DME Preliminary Hazard Assessment (PHA) [6] also served as an input and was used to guide the analysis methodology utilized.

The DVT Operational Hazard Assessment identified the six hazards given in Table ES-0-1 below. For each hazard condition, an analysis was performed that considered the flight x application, ATC environment, meteorological conditions, associated navaids, and other relevant commentary that comprise each service application that uses DVT information. Six flight applications were analyzed for each of the six hazards, resulting in a total of thirty-six hazard scenarios.

Table ES-0-1. DVT Hazard ID, Hazard Description, Safety Objective, and Source.

Hazard ID # Hazard Description Safety Objective Source

AC GND

RNG-001 Inaccurate Slant Range Extremely Improbable X X RNG-002 Loss of Slant Range Remote X X RNG-003 Incorrect Range Reception Extremely Improbable X X AZM-001 Inaccurate Azimuth Extremely Improbable X X AZM-002 Loss of Azimuth Remote X X AZM-003 Incorrect Azimuth Reception Extremely Improbable X X

Based on the analysis of all credible effects, worst-case severity classifications applicable to DVT services are “Catastrophic” or lower. Considering these severities, safety objectives were established setting the greatest acceptable likelihoods whose outcome would result in no greater than a Medium risk. The resulting safety objectives were then allocated to the air and ground equipment.

Using the outcomes from the OSA, a functional decomposition of the TACAN ground station was performed to describe the subsystem partitions to be analyzed. Generic solution architectures for the electronic and antenna subsystems were then formulated based on required signal-in-space characteristics and known system designs. A full FFHA was performed on the antenna subsystem architecture, and the electronic subsystem architecture was analyzed to the extent necessary to determine if functional failures of this subsystem could cause service-level hazards to occur (i.e., partial FFHA). No new hazards nor changes in potential risks were identified by the FFHA performed.

It was determined that functional failures of the two subsystems can cause the occurrence of the service-level hazards. Thus, safety objectives and requirements were defined that ensure attaining the likelihood criteria required to achieve acceptable risk level for each hazard based on its worst-case severity classification. For each hazard, these objectives and requirements were apportioned to the antenna and electronic subsystems pursuant to the potential of the subsystem to cause the hazard.

Safety Requirements Verification Outcomes: Further evaluation of only those safety requirements for the DVT ranging and azimuth services that are apportioned to the antenna subsystem evaluation followed. This evaluation entailed providing detailed information for each operational hazard regarding system-level objectives, safety requirements, and the identification of the specific program document governing those requirements. An audit of FAA-E-7869 was conducted to assess the necessity, suitability, and completeness of the existing safety requirements. Two safety requirement shortfalls were identified and fully addressed by the March 4, 2021 version produced by the DVT RWG.

1 INTRODUCTION

The Federal Aviation Administration (FAA) operates and maintains three independent systems that provide ranging and azimuth services in the United States National Airspace System (NAS):

Distance Measuring Equipment (DME), Very High Frequency Omni-Directional Range (VOR), and Tactical Air Navigation (TACAN), known collectively as DVT. These systems have been operating in the United States National Airspace System (NAS) for decades and support both terminal and en route navigational services. They facilitate flight operations by providing slant range distance and azimuth between the airborne equipment and the ground facility antennas.

Operational, functional, and safety requirements are well established.

An FAA initiative referred to as the DVT Sustainment Program seeks to ensure long-term sustainment of DME, VOR, and TACAN services. The primary objective of the program is to leverage this sustainment to support a resilient navigation infrastructure [1]. Collectively, these systems will serve as part of a robust backup navigation network to facilitate strategic FAA initiatives – such as Performance-Based Navigation – in the event of a Global Positioning System (GPS) service disruption. Further details can be found in the DVT Program Safety Plan [1].

The DVT Sustainment Program will implement a multi-phased approach over its lifecycle. Each phase will consist of a collection of projects that are prioritized based on their importance to the program. Early planning indicates that the initial phase will include acquisition of TACAN antenna systems as a first priority [1].

In support of this first priority, the DVT Requirements Working Group (RWG) has developed a new TACAN antenna system specification. The RWG used the existing specification, FAA-E- 2828A [2], as a starting point for the development effort and the new version of the specification is designated FAA-E-7869 [3]. The new specification contains both functional performance and safety-related requirements (aka safety requirements), and the development activities include verification of these requirements. As coordinated with AJI Safety and Technical Training [4], the safety requirements will be verified by performing a functional fault hazard analysis (FFHA), and the outcomes of this analysis provide a means of accomplishing verification of the safety-related requirements contained in FAA-E-7869.

1.1 Methodology Development and Overview

A Fault Hazard Analysis (FHA) is a deductive method of analysis that can be used exclusively as a qualitative analysis or, if desired, can expand to a quantitative one. The FHA requires a detailed investigation of sub-systems to determine component hazard modes, causes of these hazards, and resultant effects on the sub-system and its operation [7]. The approach used for performing this analysis was tailored to provide a design agnostic method that investigates the causes and effects of subsystem-level functional failures (i.e., an FFHA was performed). The FFHA is the foundation upon which a verification methodology was built, and the flow diagram for this methodology is shown in Figure 1-1. The guidance in Appendix E

Figure 1-1 Safety Requirements Verification Methodology Flow Chart.

(Preliminary Hazard Analysis) of the Safety Risk Management Guidance for System Acquisition [8] and the approved Distance Measuring Equipment Preliminary Hazard Analysis [9] informed the methodology development process. The methodology outlined in Figure 1-1 provides a structured approach and ensures the analysis and requirements verification process is conducted with an appropriate level of rigor.

Steps 1-3 are addressed in the subsections that follow. The approved DVT OSA [5] addresses the activities to be accomplished in Steps 4-5, and the OSA assessment activities and outcomes are summarized in Section 3. In accordance with Step 6, TACAN system concepts and antenna designs were reviewed and the detailed information gathered is presented in Section 5. The activities, analysis and outcomes for Steps 7 and 8 are documented in Sections 6-8, with the finding from the requirements verification effort (Step 9) presented in Section 9.

1.2 Objective

The objective for conducting this FFHA is to assess the necessity, suitability, and completeness of the existing safety requirements contained in FAA-E-7869. It was developed using the strategy coordinated with AJI Safety and Technical Training [4] to ensure compliance with the requirements of the Air Traffic Organization (ATO) Safety Management System Manual (April 2019) and Safety Risk Management Guidance for System Acquisitions (March 2020). Key items addressed by the FFHA development strategy included:

a) Identification of safety requirements

b) Verification criteria

c) Verification methodology

d) Review of OSA outcomes

e) Strategy for accomplishing the FFHA

f) Approach for documenting the analysis performed

g) Communication of safety requirement verification outcomes

1.3 Scope

The scope of the effort includes performing an FFHA, using the FFHA outcomes to identify or derive safety objectives and requirements, and verification or refinement of the safety requirements contained in FAA-E-7869.

The scope of the FFHA effort is shown in Figure 1-2. A functional decomposition of the TACAN ground station will be performed and the subsystem partitions to be analyzed will be described. Based on the descriptions developed, generic solution architectures for the antenna and electronic subsystems will be developed. The development effort will consider the required signal-in-space characteristics, design of existing TACAN systems, and the ground equipment performance specifications being developed by the DVT Sustainment Program.

A full FFHA will be conducted for the antenna subsystem. It should be noted that the functional and safety requirements for a TACAN ground station are levied in two separate equipment specifications [3][10]. That is, one specification addresses antenna subsystem requirements, and another specification addresses requirements for the electronics subsystem (aka transponder electronics). Thus, the possibility for functional failures to cause a service-level hazard to occur must be determined for each subsystem. For example, such determinations inform when the maximum permitted likelihood for a hazard occurrence must be apportioned between the antenna and electronic subsystem. Therefore, an FFHA will be conducted on the electronic subsystem as necessary for determining if a functional failure of this subsystem can cause service-level hazards to occur.

Figure 1-2. FFHA Scope and TACAN Ground Station Decomposition.

1.4 Subject Matter Expert Panel Participants

A panel of Subject Matter Experts (SME) was formed and conducted a peer-review of the FFHA and safety requirements verification outcomes. The nature of the methodology, objective and scope discussed were considered to determine the requisite knowledge, experience, and background required to be an effective panel participant. It was concluded that panel participants should understand, or have experience with, one or more of the following items:

TACAN system concept of operation; existing TACAN antenna designs; experience performing functional decomposition of navigation systems; and/or conducting fault hazard analyses for such systems. A panel was formed based on the preceding criteria, and the SME Panel that participated in the development of this FFHA is listed in Table 1-1.

Table 1-1. SME Panel Participants.

Name Organization Title/Input Email Nnaemeka Nnamani

AJM-3241 DVT Portfolio Manager nnaemeka.nnamani@faa.gov

Jim Rizzolo AJM-324 Senior Systems Engineer james.rizzolo@faa.gov Dale Courtney AJW-292 National Resource Engineer for

Navigation dale.courtney@faa.gov

Frank Flotteron AJW-E24A Operations Engineering Support Group frank.flotteron@faa.gov

Steve Hard AJW-1432 Second Level Engineering steve.hard@faa.gov Michael Goff AJW-C24B Operations Engineering Support

Group michael.goff@faa.gov

Mike Gehringer ANG-E63/WJHTC Air Transportation System Evaluation Navigation and Landing mike.gehringer@faa.gov

Martin Fitzgerald ANG-E63/WJHTC Physical Scientist martin.ctr.fitzgerald@faa.gov Don McGough AJF-170 Airspace System Inspection Pilot donald.mcgough@faa.gov Larry Greene AJI Safety Case Lead, Safety and

Technical Training larry.greene@faa.gov

Jim Roberts DAF Service Lead james.roberts.35@us.af.mil Douglas McNeill DAF SME douglas.mcneill.1@us.af.mil David Manville US Army Aviation Service Lead david.l.manville.civ@mail.mil Ray Lewis Department of Navy Service Lead ray.lewis@navy.mil John Clark Department of Navy SME john.w.clark@navy.mil Brett Easler ATCSI SME bkeasler@myatcsi.com Mike DiBenedetto Ohio University SME, Safety and Requirements dibenede@ohio.edu Carl Hawes Ohio University SME, Safety and Requirements hawes@ohio.edu Jamie Edwards Ohio University SME, Safety and Requirements edwardsj@ohio.edu Simbo Odunaiya Ohio University SME odunaiya@ohio.edu Mary Thomas Ohio University SME Thomasm8@ohio.edu Bill Pittman NAVTAC/TetraTech Program Support william.ctr.pittman@faa.gov Jamie Kirk NAVTAC/SEI NAVTAC Safety jkirk@systems-enginuity.com Mark McCoy NAVTAC/SEI NAVTAC Safety and Requirements mmccoy@systems-enginuity.com Kurt Rieke NAVTAC/TetraTech SME kurt.ctr.rieke@faa.gov

The SME Panel members listed above reviewed v0.1 of this FFHA, and an SME Panel meeting to discuss the resulting comments occurred on February 22-23, 2021. During this meeting, SMEs from across the agency were invited to leverage their operational experience with the design, implementation, and operation of TACAN antenna systems. The comments provided by meeting participants were addressed either by making real-time revisions to the document or outlining the actions to be accomplished post-meeting for a few of the more complex updates (e.g., drawing revisions). Experts in the Safety Risk Management Process were present to maintain the integrity of this review process.

2 SYSTEM DESCRIPTION

The TACAN navaid is composed of a ground- or ship-based UHF transmitting system and an integrated ranging system. This navaid enables the pilot of a TACAN-receiver-equipped aircraft to identify the ground station and determine an azimuth1 (relative to magnetic North) from the

1 Azimuth is the compass angle in the direction of the aircraft when viewed from the ground facility. Bearing is the direction of the ground facility when viewed from the aircraft.

mailto:Nnaemeka.nnamani@faa.gov mailto:donald.mcgough@faa.gov mailto:mmccoy@systems-enginuity.com station to the aircraft as well as slant-range distance. Both the ground/ship and airborne components are provided by the U.S. Government (i.e., both the DOD and FAA). TACAN is utilized primarily by military aircraft although civilian aircraft also use the system, typically for DME/DME Area Navigation (RNAV).

Ground facilities may consist of a TACAN system only or a TACAN collocated with a VOR.

The latter configuration, which is referred to as a VORTAC, is common within the NAS and allows efficient use of property where the ground equipment is located. The TACAN-only and VORTAC system configurations are shown in Figure 2-1 and Figure 2-2, respectively.

Figure 2-1. TACAN-only System Configuration.

Figure 2-2. VORTAC System Configuration.

TACAN range/azimuth information is used to support en route, arrival, and departure operations, as well as approach, landing, and missed-approach operations. For these applications, TACAN may be used in conjunction with other navaids such as precision approach RADAR and the Instrument Landing System (ILS). In addition, pilots use TACAN azimuth information for published flight procedures and routes during both Instrument and Visual Meteorological Conditions (IMC and VMC, respectively).

The TACAN system furnishes azimuth and distance information with a high degree of accuracy.

Signals can be received at distances up to 200 nautical miles (nmi) at line-of-sight altitude with a worst-case accuracy of ±6.5 degrees [11]; typical accuracies are on the order of ±2.0 degrees [12]. It is important to note that the TACAN system azimuth information is more accurate than a standard VOR.

The ranging portion of the TACAN system operates in the same manner as the FAA DME system, i.e., a two-way ranging technique is utilized as illustrated in Figure 2-3. The complete uplink/downlink cycle starts with the generation of a trigger in the interrogator. This trigger initiates both the transmission2 of an encoded interrogation signal (pulse pair) and the start of a

2 TACAN ground-to-air transmissions use the 960-1215 MHz band.

timer (ranging circuit) after a predetermined time known as the zero-mile delay3. The transponder receives and decodes the interrogation pulse pair, and – for each validated interrogator signal – waits a specified (fixed) amount of time before transmitting a reply signal.

This fixed amount of time is referred to as the “reply delay.” Upon reception/decoding of the reply signal, the interrogator uses the elapsed time from interrogation transmission to reply reception – accounting for the known reply delay – to compute the slant range.

Figure 2-3. DME Two-Way Ranging Concept.

Unlike the ranging information, which is only transmitted upon demand, TACAN azimuth information is continuously transmitted and is solely a function of the ground equipment. The ground antenna, which either physically rotates or is electronically steered to produce a rotating pattern, is of primary importance in generating the azimuth intelligence. As the antenna pattern is rotated around the station at a 15 Hz rate, reference pulse groups are triggered and broadcast at known reference azimuth angles. Specifically, a North Reference Burst (NRB) of pulses is transmitted each time the maximum of the rotating pattern points East, and Auxiliary Reference Bursts (ARB) of pulses are transmitted at every 40-degree passage of the rotating antenna pattern and are coincident with zero crossings of the 135 Hz waveform discussed below.

The transmitter feeds a repetitive string of pulses to the antenna system, which includes both the aforementioned NRBs and ARBs, as well as DME ranging, filler (squitter), and identification

3 The zero-mile delay and the reply delay have the same numerical time value. Different terms are used to distinguish airborne equipment functionality versus ground equipment functionality. While having the same value, these delays occur at different points in the overall interrogation and reply time sequence.

Slant Range

Interrogator Pulse Pair (“Interrogation”)

Transponder Antenna

Interrogator

Propagation Delay (Down Link) Reply Delay

Propagation Delay (Up Link)

Elapsed Time Measured by Interrogator

Transponder Pulse Pair (“Reply”) microseconds

Transponder

(X channel: 50 µs) (Y channel: 56 µs) pulses (Morse code)4. The combination of the rotating antenna and the shape of the antenna radiation pattern amplitude modulate the total pulse output train with 15 Hz and 135 Hz audio frequencies. Determination of the TACAN receiver bearing to the station can be accomplished by simply measuring the elapsed time between transmission of the NRB and when the demodulated 15 Hz and 135 Hz waveforms both achieve a zero-crossing.

The TACAN bearing determination concept is shown diagrammatically in Figure 2-4.

Figure 2-4. TACAN Bearing Determination Concept.

4 The broadcast identification pulses are down converted by the airborne equipment to a pulse train that is (a) sent to the Morse code audio tone generator for aural monitoring by the crew, and/or (b) transformed to a digital representation for output to other avionics equipment such as a flight management system (FMS).

3 OPERATIONAL SAFETY ASSESSMENT OVERVIEW

As noted previously, a DVT OSA was developed and approved [5] and was used to generate this FFHA. Given that DME, VOR, and TACAN have been operating in the NAS for decades, the OSA was developed with substantial prior knowledge of associated hazards, mitigations, and equipment architecture. Decades of operational experience indicate that existing controls and requirements are sufficient to ensure that the safety objectives, in terms of the likelihood required to achieve an acceptable risk, will be met for the flight applications addressed in the OSA. This section provides a summary of the OSA focusing on those topics relevant to conducting an

FFHA.

3.1 Service Level Hazards and Safety Objectives

The DVT OSA addressed hazards and safety objectives in terms of ranging and azimuth “services” as opposed to the specific systems providing these services (i.e., DME, VOR, and TACAN). The top-level ranging and azimuth service event trees – as presented in the OSA – are shown in Figure 3-1 and Figure 3-2, respectively. The six service-level hazards identified are described below and Table 3-1 lists the safety objective for each.

Hazard RNG-001: A scenario in which slant range information is available but inaccurate (e.g., out-of-tolerance). The presence of this hazard results in misleading ranging information being provided by the airborne equipment. These are conditions which cannot readily be detected by the user or the aircraft’s FMS. An example scenario in which this may cause a detrimental effect is when slant range is used to identify fixes where a change to a lower altitude may occur. The presence of an inaccurate slant range condition may result in a premature change to a lower altitude, which brings risk of collision when rising terrain or objects are present.

Hazard RNG-002: A scenario in which the complete loss of slant range information (i.e., DVT slant-range source failure) can be detected by the user or the aircraft’s FMS. When caused by a ground equipment fault, the loss of slant range condition will simultaneously affect all aircraft using the inoperative ground station. Appropriate mitigating actions can be taken at the cost of an increase in flight crew and Air Traffic Control (ATC) workload. Discussions with ATC Subject Matter Experts (SMEs) revealed that the situation requiring ATC intervention in busy airspace for more than two aircraft simultaneously would rapidly escalate the controller workload to an unmanageable level [13]. The level of intervention (if needed) by ATC will be dependent on the application and the level of crew workload necessary to mitigate the hazard.

Hazard RNG-003: A scenario in which ranging information from a properly operating but an improperly selected DVT facility is received. These are conditions which cannot always be readily detected by the user or the aircraft’s FMS. The presence of this hazard can be caused by an airborne equipment error, crew error, or ground equipment error. In general, the effects of this hazard are similar or identical in nature to Hazard RNG-001. That is, the magnitude of resulting range error can be too large for the procedure being conducted whether it be inaccurate (i.e., RNG-001) or incorrect (i.e., RNG-003).

Hazard AZM-001: A scenario in which azimuth information is available but inaccurate. These are conditions which cannot readily be detected by the user or the aircraft’s FMS. Two example scenarios where this may cause detrimental effects are when the primary course guidance is azimuth-based and/or when the azimuth information is used as a crossing radial to identify the location of a navigation fix. The presence of an inaccurate azimuth condition may result in the flight crew steering the aircraft towards/into terrain/obstacles or prematurely changing to a lower altitude where the risk of colliding with terrain /obstacles is increased.

Hazard AZM-002: A scenario in which the complete loss of azimuth information (i.e., DVT azimuth source failure) can be detected by the user or the aircraft’s FMS. When caused by a ground equipment fault, the loss of azimuth condition will simultaneously affect all aircraft using the inoperative ground station. Appropriate mitigating actions can be taken at the cost of an increase in flight crew and ATC workload. Discussions with ATC SMEs revealed that the situation requiring ATC intervention in busy airspace for more than two aircraft simultaneously would rapidly escalate the controller workload to an unmanageable level [13]. The level of intervention (if needed) by ATC will be dependent on the application and the level of crew workload necessary to mitigate the hazard.

Hazard AZM-003: A scenario in which azimuth information from a properly-operating but an improperly selected DVT facility is received. These are conditions which cannot always be readily detected by the user or the aircraft’s FMS. The presence of this hazard can be caused by an airborne equipment error, crew error, or ground equipment error. In general, the effects of this hazard are similar or identical in nature to Hazard AZM-001. That is, the magnitude of resulting azimuth error can be too large for the procedure being conducted whether it be inaccurate (i.e., AZM-001) or incorrect (i.e., AZM-003).

Figure 3-1. Top-Level DVT Ranging Service Event Tree and Associated Hazards.

Ranging

Rcvd Not Rcvd

Correct Incorrect

Inaccurate Range Wrong Range

Inaccurate Slant Range Hazard RNG-001

Incorrect Range Reception Hazard RNG-003

Loss of Slant Range Hazard RNG-002

Figure 3-2. Top-Level DVT Azimuth Service Event Tree and Associated Hazards.

Table 3-1. DVT Ranging Service Hazards and Objectives.

Hazard ID # Hazard Description Safety Objective

RNG-001 Inaccurate Slant Range Extremely Improbable RNG-002 Loss of Slant Range Remote RNG-003 Incorrect Range Reception Extremely Improbable AZM-001 Inaccurate Azimuth Extremely Improbable AZM-002 Loss of Azimuth Remote AZM-003 Incorrect Azimuth Reception Extremely Improbable

3.2 Operational Hazard Assessment

Six flight applications using DVT ranging and azimuth services were identified in the OSA, and these applications are summarized in Table 3-2 and Table 3-3. For each application, the tables indicate the ATC environment; meteorological conditions under which the flight operation may be conducted; the associated navaids that may be used; and pertinent comments. When the flight applications are combined with the hazards listed in Section 3.1 above, a total of thirty-six hazard conditions result (eighteen each for ranging and azimuth). For the purposes of this document, the hazard and application combinations are designated RNG-00xA through RNG- 00xF and AZM-00xA through AZM-00xF. In this nomenclature, “x” represents the service level hazard (e.g., Inaccurate Slant Range) and A through F indicates the flight application (e.g., Departure).

Azimuth (Bearing)

Rcvd Not Rcvd

Correct Incorrect

Inaccurate Azimuth Wrong Azimuth

Inaccurate Azimuth Hazard AZM-001

Incorrect Azimuth Reception Hazard AZM-003

Loss of Azimuth Hazard AZM-002

For each hazard condition, an analysis was performed that considered the ATC environment; the worst-case meteorological condition; whether the DVT service is used with an associated navaid;

and whether the role of the DVT service is to provide situational awareness or position determination (e.g., DME RNAV). The assumptions utilized in conducting this analysis are listed in Table 3-4 below. The possible effects were identified, the severity of those effects was assessed, and safety objectives and requirements were developed. The results of the Operational Hazard Assessment (OHA) analysis are summarized in Table 3-5 through Table 3-10.

Table 3-2. DVT Ranging Service Applications.

Flight

Application

ATC

Environment Meteorology Used With

Comments

En Route (Airways)

En Route or none VMC, IMC, Day, Night

VOR/TACAN, GPS

available/unavailable

Generally, 2-D only, z-axis by altimeter; fly left/right is provided by the other navaids. DVT ranging is used solely to identify fixes along the flight path.

En Route

(RNAV)

En Route or none VMC, IMC, Day, Night

a. Other DVT ranging stations via an FMS – navigation mode is rho-rho, and only DVT ranging stations are used;

all 2-D positioning is determined via multiple DVT ranging stations.

b. Multi-sensor FMS -- These incorporate other navaids such as GPS, LOC, and DVT ranging station – along with DVT ranging stations – into a single navigation solution.

c. Inertial Navigation System (INS)

a. Fly up/down can be determined by calculation against a database of coordinates.

b. In this case, varying amounts of error detection and removal can be accomplished.

c. Generally, these platforms are disciplined by an internal GPS receiver.

Departures Terminal VMC, IMC, Day, Night

DVT ranging station, LOC, GPS, or radar vectoring for positioning information; z-axis not generally a factor due to rapid climb rates.

DVT ranging used for fix identification.

Arrivals Terminal VMC, IMC, Day, Night

DVT ranging station, GPS, or radar vectoring for positioning information; altimeter for z-axis.

DVT ranging used for definition of fixes, holding patterns, and stepdowns.

Non-precision approaches

Terminal VMC, IMC, Day, Night

DVT ranging, LOC, LDA

DVT ranging used for initial, stepdown, and final approach fixes.

ILS Precision approaches

Terminal VMC, IMC, Day, Night

ILS DVT used for initial and final approach fixes and missed approach fixes; may also be used to define locations of altitude floor changes.

Table 3-3. DVT Azimuth Service Flight Applications.

Flight

Application

ATC

Environment Meteorology Used With

Comments

(Airways)

En Route or none VMC, IMC, Day, Night

VOR/TACAN, GPS

available/unavailable

Generally, 2-D only, z-axis by altimeter; fly left/right is provided by these navaids

(RNAV)

En Route or none VMC, IMC, Day, Night

a. Other DVT information via an FMS

– navigation mode is rho-rho, and DVT azimuth information is not used;

all 2-D positioning is determined via multiple DMEs

b. Multi-sensor FMS -- These incorporate other navaids, such as GPS, LOC, and DVT ranging and azimuth information into a single navigation solution

c. Inertial Navigation System (INS)

a. Fly up/down can be determined by calculation against a database of coordinates

b. In this case, varying amounts of error detection and removal can be accomplished

c. Generally, INS platforms are periodically re-calibrated by a GPS receiver

Departures Terminal VMC, IMC, Day, Night

DVT azimuth information, LOC, GPS, or radar vectoring for azimuth guidance; z-axis not generally a factor due to rapid climb rates

DVT azimuth information used for lateral guidance

Arrivals Terminal VMC, IMC, Day, Night

DVT azimuth information, GPS, or radar vectoring for azimuth guidance;

altimeter for z-axis

DVT azimuth information used for lateral guidance

Non-precision approaches

Terminal VMC, IMC, Day, Night

DVT azimuth information, LOC, LDA

DVT azimuth information used for approach course and missed approach lateral guidance

ILS Precision approaches

Terminal VMC, IMC, Day, Night

ILS DVT azimuth information used for missed approach lateral guidance

Table 3-4. Operational Hazard Assessment Assumptions.

1. General Assumptions

a. Prior knowledge of equipment architecture and design is not considered.

b. A navigational fix can be defined by a point in space (i.e., two-dimensional position). This point can be defined by two azimuths (i.e., a course azimuth and a crossing radial), an azimuth (i.e., the course azimuth) and a slant range, or two slant ranges (i.e., range arc for course and an intersecting range).

c. The flight crew acts in a prudent manner regarding flight planning and aircraft operation;

adheres to standard practices regarding the potential loss, complete loss, or inconsistent presentation of guidance information; but, has not been trained on ground equipment failure modes.

d. In many instances, an additional azimuth or range may be available that would be used by the flight crew (see item 1.c above) to cross-check the location of a navigation fix during the execution of a flight procedure. However, the use of such a crosscheck procedure is not assumed during the hazard analysis because a redundant navaid may not always be available. The identification of a fix defined by only two DVT navaids represents the worst-case condition because a cross-check cannot be performed.

e. Except as noted for RNAV service (see item 4 below), normal assistance from ATC for aircraft and terrain separation is assumed to be unavailable when conducting the OHA because portions of the NAS rely on non-radar procedures. While safety alerting is a first-priority duty for controllers per JO-7110.65 [14], discussions with SME indicated that it may not always be available [15][13]. Conflict alerting or Minimum Safe Altitude Warnings (MSAWs) can be rendered unavailable due to lack of radar surveillance or become ineffective due to the excessive controller workload generated by a hazard affecting multiple aircraft simultaneously.

f. While aircraft-based Terrain Awareness and Warning System (TAWS) and/or Traffic Alert and Collision Avoidance System (TCAS) functionalities may be available in some instances, they are not required for all Instrument Flight Rules (IFR) certified aircraft.

Thus, these systems are assumed to be unavailable when conducting the OHA.

g. It is assumed that Standard for Terminal Instrument Procedures (TERPS) criteria do not provide protection against, or mitigation of, the effects caused by an out-of-tolerance (OT) Navigation Sensor Error (NSE) condition. Discussion with SMEs indicated that TERPS assumes the navaid is performing within standard tolerances [11]. At 50 miles or more from the facility, TERPS only provides the lateral clearance needed to protect against the maximum in-tolerance NSE condition. Inside 50 miles, additional clearance is provided;

however, this clearance may or may not provide protection from an OT NSE condition depending on the magnitude of the error [16].

2. DVT Ranging Service Assumptions

a. The operational requirement is to provide a ranging service with a stated accuracy and adequate availability to provide the required level of operational efficacy and safety.

b. DVT ranging operation is unassisted5.

c. The accuracy of a single DVT ranging facility can directly affect the accuracy to which the location of a navigation fix can be identified. Guidance material related to how a fix may be identified was reviewed [17][18][19][20]. Redundancy in terms of ways used to identify a fix is not assumed because providing such redundancy may not always be possible. Discussion with SMEs indicated that procedural fixes are commonly identified

5 Other than tuning the correct channel, no action other than visual observation is required by the crew to facilitate range determination, and no support from other aircraft systems is required.

by just two navigational aids (navaids) [15], which may include fixes identified by a course line (e.g., VOR radial) and a single DVT range. In this case, an undetected out-of-tolerance ranging error results in misleading range information from the DVT ranging interrogator (e.g., airborne receiver) and may result in misidentifying when an aircraft has arrived at a fix.

d. The use of TACAN to support shipboard and air-to-air flight operations is not addressed, as facilities supporting those functions are owned and operated by the DOD.

3. DVT Azimuth Service Assumptions

a. The operational requirement is to provide an azimuth service with a stated accuracy and adequate availability to provide the required level of operational efficacy and safety.

b. Azimuth operation is unassisted6.

c. The accuracy of a single DVT azimuth facility can directly affect the accuracy to which the location of a navigation fix can be identified. An undetected out-of-tolerance azimuth error results in misleading azimuth information from the DVT azimuth airborne receiver and may result in misidentifying when an aircraft has arrived at a fix. The rationale for this assumption is provided in item 1 above.

d. The use of TACAN to support shipboard and air-to-air flight operations is not addressed, as facilities supporting those functions are owned and operated by the DOD.

4. RNAV Flight Application Assumptions

a. Only DVT range information is used to support RNAV flight operations.

b. The loss of a single DME may result in loss of DME/DME RNAV capability.

c. Approved DME/DME RNAV systems provide warning/alerting to the crew when loss of navigation occurs.

d. Existing RNAV services will be improved for Class A airspace and the busiest Navigation Service Group 1 and 2 airports. It is anticipated that this improvement will be accomplished by adding ranging infrastructure and/or expanding service volumes.

e. Where required, ranging systems categorized as a Critical DME will have this categorization removed (i.e., categorized as a normal DME) by adding the DME infrastructure needed to enable authorized DVT ranging RNAV operations to be conducted without the requirement for an inertial reference unit (IRU). It is anticipated that this will be accomplished by adding DVT ranging infrastructure and/or expanding service volumes.

f. Radar is required for point-to-point DME/DME RNAV flight operations to be authorized per JO-7110.65Y, except along ATS routes. These routes include low altitude (i.e., Victor Airways and T-Routes) and high altitude (i.e., Jet Routes, Q-Routes) routes. Note: T- Routes require GPS, and thus are not applicable to DME/DME RNAV operations.

g. Normal assistance from ATC for aircraft and terrain separation is assumed to be available when radar coverage is required, see item 4.f above. Controller workload is assessed by flight application to determine the effectiveness of safety alerting when the occurrence of a hazard affects multiple aircraft simultaneously. See item 1.e above for additional information.

6 Other than tuning the correct channel and selecting desired azimuth, no action other than visual observation is required by the crew to facilitate azimuth angle determination, and no support from other aircraft systems is required.

Table 3-5. DVT Operational Hazard Analysis, RNG-001.

HAZARD RNG 001: INACCURATE SLANT RANGE

Cause: Incorrect station coordinates, faulty airborne interrogator, faulty ground-based transponder System State: Low Visibility Weather Worst-Case Likelihood -- Extremely Improbable

Hazard No. Application Possible Effects Severity/Rationale Maximum

Likelihood

RNG-

001A

En route Airway Incorrect distance/position information Decreased separation/containment Loss of separation/containment Violation of airspace boundaries or procedure violation

1-Catastrophic Loss of the aircraft Multiple fatalities

Extremely Improbable

RNG-

001B

En route RNAV Incorrect distance/position information Decreased separation/containment

3-Major Slight increase in crew workload Large increase in ATC workload Slight reduction in aircraft capabilities Slight reduction in safety margin

Remote

RNG-

001C

Departure Incorrect distance/position information Decreased separation/containment Loss of separation/containment Violation of airspace boundaries or procedure violation

1-Catastrophic Loss of the aircraft Multiple…