**Appendix C - Comparative Safety Assessment**

# Introduction {#introduction .Appendix-1}

## Purpose and Scope {#purpose-and-scope .Appendix-2}

Since ADS-B technology is heavily dependent on a Global Navigation
Satellite System, the Surveillance and Broadcast Services (SBS) program
was required to identify a backup system or strategy in the event of a
GNSS outage - local or global. This Comparative Safety Assessment (CSA)
was performed to identify and assess the system safety hazards
associated with the proposed alternatives for the backup strategy. The
results of this assessment, coupled with the technical evaluations, will
serve in selecting the appropriate backup strategy. The CSA provides a
listing of system safety hazards associated with each backup strategy
alternative, along with a risk assessment for each alternative-hazard
combination. The CSA will aid in identifying the lowest risk
alternative(s), from a system safety perspective.

As stated in section 3.1.6 of the Final Program Requirements (FPR) for
SBS, the scope of the backup strategy is to maintain ATC Surveillance in
the event of a GNSS failure:

a.  ATC Surveillance application *[shall]{.underline}* continue to
    operate in the event of GNSS failure.

> b\. A backup system or strategy *[shall]{.underline}* be provided with
> the ADS-B system to ensure that the ATC surveillance application can
> be provided in the event the navigation source is operating in a
> degraded state.

The CSA does not address the in-cockpit applications, since the backup
strategy is not intended to enable the continued operation of these
applications in the event of GNSS failure or navigation source
degradation.

The strategies under consideration utilize various technologies to
obtain an aircraft's position. Strategy 1 (Secondary Radar) uses
existing primary and secondary surveillance radar (SSR) sensors to
determine the aircraft position. Strategy 2 (Passive Multilateration) is
comprised of several ground stations that triangulate the location of
the aircraft based on the time of arrival of the ADS-B message. Strategy
3 (Active Multilateration) uses ground stations to interrogate aircraft
transponders to determine position. Strategy 4 (SSR, DME/DME/IRU for Air
Transport (AT) and SSR, eLoran for General Aviation (GA)) uses Secondary
Radar in high density airspace, and in medium density airspace, the
position is obtained on the aircraft through Distance Measuring
Equipment (DME) (Air Transport) or eLoran (General Aviation). Equipment
on the aircraft communicates with ground-based facilities and uses the
time of arrival to calculate position. Strategy 5 (SSR, DME/DME/IRU,
SATNAV for AT and SSR, SATNAV for GA) uses the DME/DME/IRU technology as
well as additional satellite positioning systems that are to be
developed in the near future. Strategy 6 (SATNAV only) provides a more
diverse and robust GNSS instead of an alternate technology system,
backing up the current GPS L1 with GPS L5 and/or Galileo. Strategy 7
(Terminal SSR and SATNAV) uses SSR in terminal airspace and SATNAV in en
route airspace.

## Background {#background .Appendix-2}

Automatic Dependent Surveillance-Broadcast (ADS-B) is an advanced
surveillance technology that enables equipped aircraft or surface
vehicles to broadcast their identification, position, altitude,
velocity, and other information. Since the position information is
normally derived from the Global Positioning System (GPS) and broadcast
approximately once per second, it provides improved accuracy and more
timely information updates than conventional surveillance. The improved
positional accuracy and the ability to provide additional
aircraft-derived flight parameters (flight objects or flight data
message elements) will result in enhanced surveillance in the NAS. ADS-B
is automatic because no external stimulus is required; it is dependent
because it relies on on-board navigation sources and onboard broadcast
transmission systems to provide surveillance information to other users.
The aircraft or vehicle originating the broadcast may or may not have
knowledge of which users, aircraft or ground-based, are receiving its
broadcast.

ADS-B technology also enables the implementation of Traffic Information
Service-Broadcast (TIS-B), ADS-B Rebroadcast (ADS-R), and Flight
Information Service-Broadcast (FIS-B) to support enhanced situational
awareness and other applications intended for air crews. TIS-B service
provides traffic information to receiver-equipped aircraft and surface
vehicles based on the conventional radar returns received for non-ADS-B
equipped aircraft. ADS-R provides traffic information to equipped
aircraft based on ADS-B transmission from aircraft on independent data
links. FIS-B provides weather and NAS Status information to equipped
aircraft.

Per the FAA's ADS-B Link Decision, two data link technologies, the 1090
MHz extended squitter (1090ES) and the 978 MHz Universal Access
Transceiver (UAT) have been approved for use in the NAS. It is
anticipated that air transport category aircraft will equip with the
1090ES link and general aviation will equip with the UAT link. Both the
UAT and 1090ES links support TIS-B and ADS-R services. Only UAT supports
FIS-B service.

The Surveillance and Broadcast Services Safety Risk Management Panel
prepared and conducted the Preliminary Hazard Analysis (PHA) for seven
applications selected for the near-term NAS implementation:

-   ATC Surveillance

-   Weather and NAS Status Situational Awareness

-   Enhanced Visual Acquisition

-   Enhanced Visual Approaches

-   Final Approach and Runway Occupancy Awareness

-   Airport Surface Situational Awareness

-   Conflict Detection

Rulemaking is planned to require aircraft equipage with ADS-B transmit
capability to support the ATC Surveillance application. On the other
hand, equipping with avionics necessary to support the remaining
applications is voluntary.

## SBS Description {#sbs-description .Appendix-2}

### System Description {#system-description .Appendix-3}

ADS-B is an advanced surveillance technology that enables equipped
aircraft, or surface vehicles, to broadcast their identification,
position, altitude, velocity, and other information. Since the position
information is normally derived from the Global Positioning System (GPS)
and broadcast approximately once per second, it provides improved
accuracy and more timely information updates than conventional
surveillance. The superior positional accuracy and the ability to
provide additional aircraft-derived flight parameters (flight objects or
flight data message elements) will result in enhanced surveillance in
the NAS. ADS-B is automatic because no external stimulus is required; it
is dependent because it relies on on-board navigation sources and
onboard broadcast transmission systems to provide surveillance
information to other users. The aircraft or vehicle originating the
broadcast may or may not have knowledge of which users, aircraft or
ground-based, are receiving its broadcast.

ADS-B technology additionally facilitates the implementation of Traffic
Information Service-Broadcast (TIS-B), ADS-B Rebroadcast (ADS-R), and
Flight Information Service-Broadcast (FIS-B) to support enhanced
situational awareness and other applications. TIS-B service provides
traffic information to equipped aircraft and surface vehicles based on
the conventional radar returns received for non-equipped aircraft. ADS-R
provides traffic information to equipped aircraft based on ADS-B
transmission from aircraft on independent data links. FIS-B provides
weather and NAS Status information to equipped aircraft.

Per the FAA's ADS-B Link Decision, two data link technologies, the 1090
MHz extended squitter (1090ES) and the 978 MHz Universal Access
Transceiver (UAT) have been approved for use in the NAS. It is
anticipated that air transport category aircraft will equip with the
1090ES link and general aviation will equip with the UAT link.

The introduction of ADS-B services into the NAS will enable some well
established applications, currently supported by radar and other
existing surveillance sources, and facilitate the introduction of new
applications, that promise to improve safety and increase capacity. See
the FAA's Surveillance and Broadcast Services Concept of Operations
(CONOPS) for further details on ADS-B Services and Applications. Table
C1-1 summarizes the relationship between ADS-B related applications,
services, and SBS system operational system functions (described in
Section 1.3.2).

Table C1‑1: Applications, Services, and Functions

+---------------------------+----------+------+------+------+-------+
| **ADS-B Enabled           | **Se     | >    | >    | > *  | >     |
| Applications**            | rvices** |  **B |  **L | *ATC | **Air |
|                           |          | road | ink- | >    | craft |
|                           |          | cast | Spec | Auto | > /   |
|                           |          | >    | ific | mati | > Ve  |
|                           |          | Serv | > Pr | on** | hicle |
|                           |          | ices | oces | >    | >     |
|                           |          | > Fu | sing | >    | Funct |
|                           |          | ncti | > Fu | **Fu | ion** |
|                           |          | on** | ncti | ncti |       |
|                           |          |      | on** | on** |       |
+---------------------------+----------+------+------+------+-------+
| ATC Surveillance          | ADS-B    |      | X    | X    | X     |
|                           |          |      |      |      | (Tran |
|                           |          |      |      |      | smit) |
+---------------------------+----------+------+------+------+-------+
| Airport Surface           | ADS-B    | X    | X    |      | X     |
| Situational Awareness     | (only    |      |      |      |       |
| (ASSA)                    | A        |      |      |      | (Rec  |
|                           | ircraft/ |      |      |      | eive) |
| Final Approach Runway     | Vehicle  |      |      |      |       |
| Occupancy (FAROA)         | Funct    |      |      |      |       |
|                           | ionality |      |      |      |       |
| Enhanced Visual           | R        |      |      |      |       |
| Acquisition (EVAcq)       | equired) |      |      |      |       |
|                           |          |      |      |      |       |
| Enhanced Visual Approach  | ADS-R    |      |      |      |       |
| (EVApp)                   |          |      |      |      |       |
|                           | TIS-B\*  |      |      |      |       |
| Conflict Detection (CD)   |          |      |      |      |       |
+---------------------------+----------+------+------+------+-------+
| Weather and NAS Status    | FIS-B    | X    | X    |      | X     |
| Situational Awareness     |          |      |      |      |       |
|                           |          |      |      |      | (Rec  |
|                           |          |      |      |      | eive) |
+---------------------------+----------+------+------+------+-------+

> \* TIS-B, as specified herein, supports the ASSA and EVAcq
> applications only

The Surveillance and Broadcast Services System's functions
(Aircraft/Vehicle, Link Specific Processing, Broadcast Services, and ATC
Automation) provide the ADS-B services that support ADS-B applications.
Figure C1-1 shows the relationship between the principle and sub-system
components:

-   The Aircraft/Vehicle function is identified as the components
    located in the avionics section at the top of the illustration.

-   The Link Specific function is identified as the air interfaces and
    1090ES and UAT receive/transmit components located mid-illustration.

-   The Broadcast Services function is identified as the ground
    interfaces and associated TIS-B and FIS-B processors.

-   ATC Automation.

TIS-B and FIS-B services require all functions except ATC Automation.
The ADS-B Rebroadcast (ADS-R) Service is a subset of the fundamental
TIS-B Service.

![](media/image1.wmf){width="6.175in" height="4.71875in"}

Figure C1‑1: SBS Architecture

### Functional Description {#functional-description .Appendix-3}

The ADS-B System can be logically divided into five major functions (see
Figure C1-2):

1.  Aircraft/Vehicle Function

2.  Link-Specific Processing (LSP) Function

3.  Broadcast Services (BCS) Function

4.  ATC Automation Function

5.  Maintenance Function

The first four functions are operational, while the Maintenance Function
provides for the control and monitoring of the operational functions.
Note that only the operational functions are listed in Table C1-1, as
the Maintenance Function supports the services and applications in an
indirect manner. The Aircraft/Vehicle Function resides in participant
aircraft and surface vehicles. The ATC Automation Function resides in
participant automation systems. The Link-Specific Processing, Broadcast
Services, and Maintenance Functions form the ADS-B ground
infrastructure.

![](media/image2.wmf){width="5.992361111111111in"
height="4.057638888888889in"}

Figure C1‑2: SBS System Functions

The ADS-B System receives surveillance reports, from various NAS
systems, to support the TIS-B service and weather and NAS status
information, from government and commercial sources, to support the
FIS-B service. The ADS-B system distributes ADS-B Reports to authorized
user systems. The status of the GNSS and other NAS systems is also an
input to the ADS-B System to determine degraded operations or an outage
of these systems.

[Aircraft/Vehicle Function]{.underline}

The Aircraft/Vehicle includes a transmit capability that supports all
applications and a receive capability for aircraft/vehicle based
applications.

The Aircraft/Vehicle Function is the source of ADS-B information. The
Function derives state vector information, using GNSS or another
navigation source, and determines the associated integrity and accuracy
indicators. The Aircraft/Vehicle function also ascertains altitude
information from a qualified barometric altitude source. Vehicles for
surface use only could use a pre-programmed source for altitude
information. The Function collects other ownship data, potentially
including weather related measurements, and provides a means for crew
input of additional information, such as aircraft identification data.
The Aircraft/Vehicle Function encodes and broadcasts ADS-B Messages,
conveying the collected information.

The Aircraft/Vehicle Function receives and decodes ADS-B Messages
transmitted by other Aircraft/Vehicles equipped with the same data link
and TIS-B and ADS-R Messages transmitted by the ADS-B LSP Function.
Aircraft/Vehicle Functions equipped with the UAT data link additionally
receive and decode FIS-B Messages transmitted by the LSP Function. The
Aircraft/Vehicle Function processes and displays the information
conveyed in received messages.

###  {#section .unnumbered}

[Link-Specific Processing Function]{.underline}

The LSP Function provides the ADS-B System transmit/receive
functionality on the ground. The Function receives ADS-B Messages from
equipped aircraft and surface vehicles, formats the associated ADS-B
Reports, and distributes them to ATC Automation, the BCS Function, and
other authorized users. LSP transmits TIS-B, ADS-R, and FIS-B Messages
as directed by the BCS Function. This Function supports all services and
applications.

###  {#section-1 .unnumbered}

[Broadcast Services Function]{.underline}

The BCS Function processes, including tracking, filtering, and applying
quality indicators, surveillance reports from external sources and ADS-B
Messages from the LSP Function. Broadcast Services generates TIS-B and
ADS-R Reports for transmission as TIS-B and ADS-R Messages by LSP. The
BCS Function additionally processes weather and NAS status data from
external sources and generates applicable FIS-B Reports for transmission
as FIS-B Messages by LSP. This Function supports TIS-B, ADS-R, and FIS-B
Services, but is not required for ADS-B. It supports all applications
except ATC Surveillance.

[ATC Automation Function]{.underline}

The ATC Automation Function uses ADS-B surveillance data similar to its
use of radar system surveillance information. The Function supports
environments with only ADS-B Surveillance as well as those having both
ADS-B and radar surveillance. ATC Automation validates the position
information provided in ADS-B Reports by comparing it with reports from
other surveillance sources, as available. The Function associates the
ADS-B Report data with filed flight plans, creates and updates tracks,
and displays target and emergency information to Air Traffic
Specialists. ATC Automation performs safety function processing,
including Minimum Safe Altitude Warning, Conflict Alert, and Restricted
Airspace Monitoring, using ADS-B and radar data, as available, and
displays any associated alerts.

[Maintenance Function]{.underline}

The Maintenance Function provides for the control and monitoring of the
ADS-B ground infrastructure operational functions, Link-Specific
Processing and Broadcast Services. Control includes the setting of
configuration items, the download of new software, the request for read
back of monitored parameter values, and any other actions necessary to
control the operation and support the maintenance of the system.
Monitoring includes the generation of alerts and alarms as well as the
injection of Health Status Messages (test targets) into the LSP
Function, and any other monitoring activities necessary to support the
operation and maintenance of the system. The Maintenance Function uses
information gathered in monitoring the system to generate Status
Reports, containing high-level alarm and alert information and system
counts, such as number of ADS-B Messages received, number of TIS-B
Reports generated, etc. and distributing them to the ATC Automation
Function.

The Maintenance Function additionally monitors ADS-B reception and the
GNSS to analyze coverage and identify potential quality issues with
Aircraft/Vehicle performance. The Function provides an interface to
systems engineers and technicians for use in control and monitoring of
the ADS-B System.

# Backup Strategy Alternatives {#backup-strategy-alternatives .Appendix-1}

Addressing the requirement from the fPR, the backup strategy
alternatives listed below provide a means for obtaining aircraft
position in order to enable the ATC Surveillance application.

Each alternative uses primary radar to mitigate single-aircraft avionics
failures in the terminal domain but not in the en route domain.
Therefore, primary radar functions shown in each block diagram only
apply to terminal surveillance. The primary radar transmits a radio
frequency (RF) pulse. The radar system processes the reflected signal to
determine azimuth and slant range. This information is supplied to
automation and displayed to ATC.

## Alternative 1: Secondary Radar {#alternative-1-secondary-radar .Appendix-2}

The secondary radar alternative involves using existing secondary radar
sensors to interrogate aircraft equipped with ATCRBS and/or Mode S
transponders. The aircraft responds with aircraft information, such as
beacon code and altitude. The radar receives the reply and processes the
antenna position and time of reply to determine the azimuth and slant
range for the aircraft. The target report is generated for the aircraft
and sent to automation for tracking and alerting.

This alternative employs a reduced version of the current secondary
radar network to cover the required airspace and primary radars in
terminal areas.

## Alternative 2: Passive Multilateration {#alternative-2-passive-multilateration .Appendix-2}

The passive multilateration alternative obtains the aircraft position by
using three or more ground stations that receive the broadcast ADS-B
message. The time-of-arrival (TOA) of the messages are measured for each
of the ground stations. The ground stations are synchronized through a
reference signal or clock, and this point of reference is used to
calculate a time-difference-of-arrival (TDOA). A central processor uses
this information to determine the aircraft position. Other target data,
such as aircraft identity and barometric altitude, are obtained by
decoding the ADS-B message.

![](media/image3.png){width="4.696527777777778in"
height="3.761111111111111in"}

Figure C2‑1: Functions of Secondary Radar Alternative

![](media/image4.png){width="3.901388888888889in"
height="4.197916666666667in"}

Figure C2-2: Functions of Passive Multilateration Alternative

## Alternative 3: Active Multilateration {#alternative-3-active-multilateration .Appendix-2}

Active multilateration relies on three or more geographically
distributed ground stations successfully interrogating aircraft equipped
with ATCRBS and/or Mode S transponders. The ground stations measure the
TOA for the same transponder reply. As with passive multilateration, the
aircraft position is determined by joint processing of the TDOA
measurements, which are calculated with respect to the synchronized time
source. Aircraft identity and barometric altitude are determined by
decoding the information in the transponder replies.

![](media/image5.png){width="5.926388888888889in"
height="3.4784722222222224in"}

Figure C2-3: Functions of Active Multilateration Alternative

## Alternative 4: SSR, DME/DME/IRU for AT and SSR, eLoran for GA {#alternative-4-ssr-dmedmeiru-for-at-and-ssr-eloran-for-ga .Appendix-2}

Distance Measuring Equipment (DME) and Enhanced LOng RAnge Navigation
(eLoran) are both navigation systems, with DME common to Air Transport
(AT) and eLoran common to General Aviation (GA). The position is
obtained on the aircraft and provided to ATC Surveillance via the ADS-B
broadcast message.

The DME/DME/IRU approach consists of equipment on the aircraft that
interrogates DME ground facilities. The ground facilities respond with a
fixed delay. The aircraft uses the TOAs from the responses from two or
more DME facilities and the known locations of the DME facilities (from
a database on the aircraft) to determine the aircraft position. Inertial
Reference Unit (IRU) is used to augment DME by mitigating the impact of
gaps in coverage. IRU determines the aircraft position by using inertial
metrics and last-known positions.

DME/DME/IRU is not able to support five nautical mile separation in
medium density airspace.

The present Loran system, Loran-C, is comprised of a series of ground
station groups (chains). The chains are made up of three to six ground
stations, with one station serving as the master. The other stations are
synchronized to the master through a radio frequency (RF) pulse that is
transmitted by the master station. Most of the 24 U.S. Loran stations
have been modernized to support eLoran performance. When that process is
complete, the stations will operate in an "all-in-view" mode, which
provides better system availability and integrity. All stations will be
synchronized to Coordinated Universal Time (UTC).

The ground stations transmit a periodic series of nine RF pulses in the
90-110 kHz frequency band. The aircraft uses the TOAs of the pulses from
three or more ground stations and the known locations of the ground
stations (from a database on the aircraft) to determine the
two-dimensional position of the aircraft. The ninth pulse in each
broadcast is modulated to capture differential accuracy corrections (for
maritime applications), station identification, and integrity
information.

![](media/image6.png){width="6.645138888888889in"
height="3.8722222222222222in"}

Figure C2-4: Functions of SSR, DME/DME/IRU for AT and SSR,

eLoran for GA Alternative

## Alternative 5: SSR, DME/DME/IRU, SATNAV for AT and SSR, SATNAV for GA {#alternative-5-ssr-dmedmeiru-satnav-for-at-and-ssr-satnav-for-ga .Appendix-2}

This alternative uses SSR in high-density airspace. For AT in medium
density airspace, DME/DME/IRU and Satellite Navigation (SATNAV, see
Section C2.6) are used for backup. For GA in medium density airspace,
SATNAV is used.

![](media/image7.png){width="5.634027777777778in"
height="4.021527777777778in"}

Figure C2-5: Functions of SSR, DME/DME/IRU, and SATNAV for AT,

and SSR and SATNAV for GA

## Alternative 6: SATNAV Only {#alternative-6-satnav-only .Appendix-2}

The SATNAV alternative continues to use a form of GNSS as its source for
position, however, the probability of loss compared to GPS alone
decreases significantly by providing more backup satellite sources.
Currently, Global Positioning System (GPS) L1 is the only GNSS source
used by ADS-B. The L5 GPS signal and the European Galileo system provide
additional signals that are to be implemented within the next ten years.
In the event of a GPS L1 loss of service, the ADS-B would default to one
of the other GNSS signals to obtain the aircraft position.

Although this approach mitigates the likelihood of a GNSS outage, it
does not mitigate multi-frequency interference.

![](media/image8.png){width="3.0909722222222222in"
height="3.296527777777778in"}

Figure C2-6: Functions of SATNAV Only Alternative

## Alternative 7: Terminal SSR and SATNAV {#alternative-7-terminal-ssr-and-satnav .Appendix-2}

By using secondary radar in high-density terminal areas in addition to
the SATNAV strategy, the multi-frequency interference is mitigated.

![](media/image9.png){width="4.711805555555555in"
height="3.4680555555555554in"}

Figure C2-7: Functions of Terminal SSR and SATNAV Alternative

# Assessment Methodology {#assessment-methodology .Appendix-1}

This CSA was developed by the SBS Program Office as a quick turn-around
safety assessment using guidance contained in the NAS System Safety
Handbook (SSH). This assessment, which has not yet been reviewed by the
ATO-S System Safety Working Group (SSWG), will require an update to
comply with the CSA content and format requirements outlined in the NAS
Systems Safety Management Program (SSMP).

After determining and analyzing the pertinent system functions for
providing ATC Surveillance, an initial set of hazards was identified.
Only ATC Surveillance application hazards were evaluated in the CSA,
since the purpose of the backup strategy is to maintain ATC Surveillance
in the event of a GNSS failure. No new hazards were evaluated for any
strategy, though a hazard for loss of aircraft navigation should be
considered in a future analysis.

The following ATC Surveillance hazards were evaluated in the CSA:

-   H1 Loss of ATC Surveillance (All Aircraft)

-   H2 Loss of Surveillance (Single Aircraft)

-   H17 Loss of Surveillance (Multiple Aircraft)

Hazards associated with inaccurate position, altitude, and
identification are addressed in the SBS Preliminary Hazard Analysis
(PHA). It was not necessary to address these hazards in the CSA for
several reasons. First, the backup strategies were defined to ensure
that accuracy requirements for terminal and en route ATC separation
standards are met; therefore, hazards that dealt with inaccurate
position would not function as a discriminator in comparing the
alternatives. Also, the source for altitude and identification data was
not affected by any of the backup strategies, and the risk already
identified in the SBS PHA does not change as a function of alternative.

While the hazards evaluated in this CSA are similar to those addressed
in the SBS PHA, system states that affected the risk assessment varied.
For example, the hazards in the SBS PHA were analyzed for the terminal
domain, whereas the CSA considered both en route and terminal domains.
Therefore, the assessed risk levels from the CSA should not be compared
to those assessed in the SBS PHA, as it would not be an equivalent
comparison. The hazards identified in the SBS PHA will ultimately be
re-evaluated based on the selected backup strategy.

A multi-step process was employed to determine the risk associated with
each strategy -- hazard combination. First, functional flow block
diagrams, provided in Section 5, were developed for each backup strategy
alternative based on the draft technical descriptions. These block
diagrams were used to identify potential faults or failure modes for
each backup strategy that could cause a hazard. Fault trees, provided in
Section 8, were prepared using the functional flow block diagrams and
technical descriptions of each strategy. Each fault tree represents the
SBS system and backup strategy faults that, if present in a certain
combination, result in a hazard. Individual faults were assigned a
likelihood of occurrence derived from requirements documentation,
technical description information, engineering judgment, or a
combination thereof. Fault tree analysis software was used to calculate
the probability of the top-level fault occurring (i.e., the hazard).
Next, event trees, provided in Section 8, were developed for each hazard
to represent the possible system state variables, actions subsequent to
the hazard, and resultant range of hazard effects. Probabilities
associated with certain system state variables were also modified from
the original event trees presented in the SBS PHA. Effects and
severities were assigned to each path (i.e., set of branches) in the
event trees, and likelihoods for each path were calculated. For each
event tree path, the combined likelihood of the hazard occurring and
that particular path was calculated. Worst case risk was determined by
comparing the total likelihood and severity pairs, and selecting the
maximum resultant risk.

## Risk Definitions {#risk-definitions .Appendix-2}

Severity and likelihood definitions contained in the NAS SSMP are
provided below. For more information regarding these definitions, refer
to FAA Advisory Circular 25.1309-1A, "System Design Analysis".

Table C3-1: Severity Definitions

+-----+------------+------------+------------+------------+------------+
| **  | **Hazard   |            |            |            |            |
| Eff | Severity   |            |            |            |            |
| ect | Classi     |            |            |            |            |
| o   | fication** |            |            |            |            |
| n** |            |            |            |            |            |
+=====+============+============+============+============+============+
|     | **No       | **Minor**  | **Major**  | **H        | **Cata     |
|     | Safety     |            |            | azardous** | strophic** |
|     | Effect     | **(4)**    | **(3)**    |            |            |
|     | (5)**      |            |            | **(2)**    | **(1)**    |
+-----+------------+------------+------------+------------+------------+
| **  |            | Does not   | Reduces    | Reduces    | Total loss |
| Gen |            | sig        | the        | the        | of systems |
| era |            | nificantly | capability | capability | control    |
| l** |            | reduce     | of the     | of the     | such that  |
|     |            | system     | system or  | system or  | (see       |
|     |            | safety.    | operators  | the        | below):    |
|     |            | Required   | to cope    | o          |            |
|     |            | actions    | with       | perator\'s |            |
|     |            | are within | adverse    | ability to |            |
|     |            | o          | operating  | cope with  |            |
|     |            | perator\'s | condition  | adverse    |            |
|     |            | cap        | to the     | conditions |            |
|     |            | abilities. | extent     | to the     |            |
|     |            | Includes   | that there | extent     |            |
|     |            | (see       | would be a | that there |            |
|     |            | below):    | (see       | would be a |            |
|     |            |            | below):    | (see       |            |
|     |            |            |            | below):    |            |
+-----+------------+------------+------------+------------+------------+
| **  | Slight     | Slight     | Reduction  | Reduction  | Collision  |
| Air | increase   | reduction  | in         | in         | with other |
| T   | in ATC     | in ATC     | separation | separation | aircraft,  |
| raf | workload   | c          | as defined | as defined | obstacles, |
| fic |            | apability, | by a       | by a high  | or terrain |
| Con |            | or         | lo         | severity   |            |
| tro |            | s          | w/moderate | o          |            |
| l** |            | ignificant | severity   | perational |            |
|     |            | increase   | o          | error (as  |            |
|     |            | in ATC     | perational | defined in |            |
|     |            | workload   | error (as  | FAA Order  |            |
|     |            |            | defined in | 7210.56),  |            |
|     |            |            | FAA Order  | or a total |            |
|     |            |            | 7210.56),  | loss of    |            |
|     |            |            | or         | ATC (ATC   |            |
|     |            |            | s          | Zero)      |            |
|     |            |            | ignificant |            |            |
|     |            |            | reduction  |            |            |
|     |            |            | in ATC     |            |            |
|     |            |            | capability |            |            |
+-----+------------+------------+------------+------------+------------+
| **  | \- No      | \- Slight  | \-         | \- Large   | Outcome    |
| Fly | effect on  | increase   | S          | reduction  | would      |
| ing | flight     | in         | ignificant | in safety  | result in: |
| Pu  | crew       | workload   | increase   | margin or  |            |
| bli |            |            | in flight  | functional | \- Hull    |
| c** | \- Has no  | \- Slight  | crew       | capability | loss       |
|     | effect on  | reduction  | workload   |            |            |
|     | safety     | in safety  |            | \- Serious | \-         |
|     |            | margin or  | \-         | or fatal   | Multiple   |
|     | -Inc       | functional | S          | injury to  | fatalities |
|     | onvenience | ca         | ignificant | small      |            |
|     |            | pabilities | reduction  | number     |            |
|     |            |            | in safety  |            |            |
|     |            | \- Minor   | margin or  | \-         |            |
|     |            | illness or | functional | Physical   |            |
|     |            | damage     | capability | distress/  |            |
|     |            |            |            | excessive  |            |
|     |            | \- Some    | \- Major   | workload   |            |
|     |            | physical   | illness,   |            |            |
|     |            | discomfort | injury, or |            |            |
|     |            |            | damage     |            |            |
|     |            |            |            |            |            |
|     |            |            | \-         |            |            |
|     |            |            | Physical   |            |            |
|     |            |            | distress   |            |            |
+-----+------------+------------+------------+------------+------------+

Table C3-2: Likelihood Definitions

+--------+----------+---------+---------+----------+-------+--------+
|        | **NAS    |         |         | **Flight | **ATC |        |
|        | S        |         |         | Proc     | Ope   |        |
|        | ystems** |         |         | edures** | ratio |        |
|        |          |         |         |          | nal** |        |
+========+==========+=========+=========+==========+=======+========+
|        | **Quanti | *       |         |          | **Per |        |
|        | tative** | *Qualit |         |          | iodic |        |
|        |          | ative** |         |          | ity** |        |
+--------+----------+---------+---------+----------+-------+--------+
|        |          | **Ind   | **ATC   |          | **Per | **NAS- |
|        |          | ividual | S       |          | Facil | wide** |
|        |          | Item/S  | ervice/ |          | ity** |        |
|        |          | ystem** | NAS     |          |       |        |
|        |          |         | Level   |          |       |        |
|        |          |         | S       |          |       |        |
|        |          |         | ystem** |          |       |        |
+--------+----------+---------+---------+----------+-------+--------+
| **Freq | > Pro    | E       | Expe    | P ≥ 1 x  | Exp   | Ex     |
| uent** | bability | xpected | rienced | 10^-5^   | ected | pected |
|        | > of     | to      |         |          | to    | to     |
| **A**  | > oc     | occur   | conti   |          | occur | occur  |
|        | currence | about   | nuously |          | more  | more   |
|        | > per    | once    | in the  |          | than  | than   |
|        | > op     | every 3 | system  |          | once  | every  |
|        | eration/ | months  |         |          | per   | 1-2    |
|        | > ope    | for an  |         |          | week  | days   |
|        | rational | item    |         |          |       |        |
|        | > hour   |         |         |          |       |        |
|        | > is     |         |         |          |       |        |
|        | > equal  |         |         |          |       |        |
|        | > to or  |         |         |          |       |        |
|        | >        |         |         |          |       |        |
|        |  greater |         |         |          |       |        |
|        | > than   |         |         |          |       |        |
|        | >        |         |         |          |       |        |
|        | 1x10^-3^ |         |         |          |       |        |
+--------+----------+---------+---------+----------+-------+--------+
| **Prob | Pro      | E       | E       |          | Exp   | Ex     |
| able** | bability | xpected | xpected |          | ected | pected |
|        | of       | to      | to      |          | to    | to     |
| **B**  | oc       | occur   | occur   |          | occur | occur  |
|        | currence | about   | fre     |          | about | about  |
|        | per      | once    | quently |          | once  | s      |
|        | op       | per     | in the  |          | every | everal |
|        | eration/ | year    | system  |          | month | times  |
|        | ope      | for an  |         |          |       | per    |
|        | rational | item    |         |          |       | month  |
|        | hour is  |         |         |          |       |        |
|        | less     |         |         |          |       |        |
|        | than     |         |         |          |       |        |
|        | 1        |         |         |          |       |        |
|        | x10^-3^, |         |         |          |       |        |
|        | but      |         |         |          |       |        |
|        | equal to |         |         |          |       |        |
|        | or       |         |         |          |       |        |
|        | greater  |         |         |          |       |        |
|        | than     |         |         |          |       |        |
|        | 1x10^-5^ |         |         |          |       |        |
+--------+----------+---------+---------+----------+-------+--------+
| **Re   | Pro      | E       | E       | 10^-5^   | Exp   | Ex     |
| mote** | bability | xpected | xpected | \> P ≥   | ected | pected |
|        | of       | to      | to      | 10^-7^   | to    | to     |
| **C**  | oc       | occur   | occur   |          | occur | occur  |
|        | currence | several | n       |          | about | about  |
|        | per      | times   | umerous |          | once  | once   |
|        | op       | in life | times   |          | every | every  |
|        | eration/ | cycle   | in      |          | year  | few    |
|        | ope      | of an   | system  |          |       | months |
|        | rational | item    | life    |          |       |        |
|        | hour is  |         | cycle   |          |       |        |
|        | less     |         |         |          |       |        |
|        | than or  |         |         |          |       |        |
|        | equal to |         |         |          |       |        |
|        | 1x10^-5^ |         |         |          |       |        |
|        | but      |         |         |          |       |        |
|        | equal to |         |         |          |       |        |
|        | or       |         |         |          |       |        |
|        | greater  |         |         |          |       |        |
|        | than     |         |         |          |       |        |
|        | 1x10^-7^ |         |         |          |       |        |
+--------+----------+---------+---------+----------+-------+--------+
| *      | Pro      | U       | E       | 10^-7^   | Exp   | Ex     |
| *Extre | bability | nlikely | xpected | \> P ≥   | ected | pected |
| mely** | of       | to      | to      | 10^-9^   | to    | to     |
|        | oc       | occur,  | occur   |          | occur | occur  |
| **Re   | currence | but     | several |          | about | about  |
| mote** | per      | p       | times   |          | once  | once   |
|        | op       | ossible | in the  |          | every | every  |
| **D**  | eration/ | in an   | s       |          |       | 3      |
|        | ope      | item's  | ystem's |          | 1     | years  |
|        | rational | life    | life    |          | 0-100 |        |
|        | hour is  | cycle   | cycle   |          | years |        |
|        | less     |         |         |          |       |        |
|        | than or  |         |         |          |       |        |
|        | equal to |         |         |          |       |        |
|        | 1x10^-7^ |         |         |          |       |        |
|        | but      |         |         |          |       |        |
|        | equal to |         |         |          |       |        |
|        | or       |         |         |          |       |        |
|        | greater  |         |         |          |       |        |
|        | than     |         |         |          |       |        |
|        | 1x10^-9^ |         |         |          |       |        |
+--------+----------+---------+---------+----------+-------+--------+
| **Ext  | Pro      | So      | U       | P \<     | Exp   | Ex     |
| remely | bability | u       | nlikely | 10^-9^   | ected | pected |
| Improb | of       | nlikely | to      |          | to    | to     |
| able** | oc       | that it | occur,  |          | occur | occur  |
|        | currence | can be  | but     |          | less  | less   |
| **E**  | per      | assumed | p       |          | than  | than   |
|        | op       | that it | ossible |          | once  | once   |
|        | eration/ | will    | in      |          | every | every  |
|        | ope      | not     | system  |          | 100   | 30     |
|        | rational | occur   | life    |          | years | years  |
|        | hour is  | in an   | cycle   |          |       |        |
|        | less     | item's  |         |          |       |        |
|        | than     | life    |         |          |       |        |
|        | 1x10^-9^ | cycle   |         |          |       |        |
+--------+----------+---------+---------+----------+-------+--------+

[Note]{.underline}: Table C3-2 includes corrections for errata contained
in SSMP version 10 Table 4.2-2. Likelihood definitions for "Probable"
and "Frequent" (which are reversed in the SSMP) and mathematical
inequality expressions are corrected in the table above.

+-----------+-----------+-----------+-----------+-----------+-----------+
|           | **No      | **Minor** | **Major** | **Ha      | **Catas   |
|           | Safety    |           |           | zardous** | trophic** |
|           | Effect**  | **4**     | **3**     |           |           |
|           |           |           |           | **2**     | **1**     |
|           | **5**     |           |           |           |           |
+-----------+-----------+-----------+-----------+-----------+-----------+
| **F       |           |           |           |           |           |
| requent** |           |           |           |           |           |
|           |           |           |           |           |           |
| **A**     |           |           |           |           |           |
+-----------+-----------+-----------+-----------+-----------+-----------+
| **P       |           |           |           |           |           |
| robable** |           |           |           |           |           |
|           |           |           |           |           |           |
| **B**     |           |           |           |           |           |
+-----------+-----------+-----------+-----------+-----------+-----------+
| *         |           |           |           |           |           |
| *Remote** |           |           |           |           |           |
|           |           |           |           |           |           |
| **C**     |           |           |           |           |           |
+-----------+-----------+-----------+-----------+-----------+-----------+
| **        |           |           |           |           |           |
| Extremely |           |           |           |           |           |
| Remote**  |           |           |           |           |           |
|           |           |           |           |           |           |
| **D**     |           |           |           |           |           |
+-----------+-----------+-----------+-----------+-----------+-----------+
| **        |           |           |           |           |           |
| Extremely |           |           |           |           |           |
| Imp       |           |           |           |           |           |
| robable** |           |           |           |           |           |
|           |           |           |           |           |           |
| **E**     |           |           |           |           |           |
+-----------+-----------+-----------+-----------+-----------+-----------+
|           |           |           |           |           |           |
+-----------+-----------+-----------+-----------+-----------+-----------+
|           |           | **High**  |           | \*        |           |
|           |           |           |           | Una       |           |
|           |           |           |           | cceptable |           |
|           |           |           |           | with      |           |
|           |           |           |           | single    |           |
|           |           |           |           | point and |           |
|           |           |           |           | common    |           |
|           |           |           |           | cause     |           |
|           |           |           |           | failures  |           |
+-----------+-----------+-----------+-----------+-----------+-----------+
|           |           | *         |           |           |           |
|           |           | *Medium** |           |           |           |
+-----------+-----------+-----------+-----------+-----------+-----------+
|           |           | **Low**   |           |           |           |
+-----------+-----------+-----------+-----------+-----------+-----------+

Figure C3-3: Risk Assessment Matrix

## Assumptions {#assumptions .Appendix-2}

In identifying and assessing the hazards that apply to the SBS backup
strategy, the following assumptions were made. The SBS FPR only
explicitly called out the ATC Surveillance application to be supported
by the backup strategy. Though some of the strategies presented may
still have the capability to support the other applications, hazards
specific to those applications were not addressed in this assessment, as
they may not apply to all of the strategies. Accordingly, since these
applications may not be available in the event of a switchover to
backup, it is assumed the pilot and ATC would be notified.

## Data Sources {#data-sources .Appendix-2}

Quantitative data was used whenever it was available. If quantitative
data was not available, qualitative numbers were provided by subject
matter experts (SMEs). Probability of failure numbers for existing
systems in the NAS were calculated from availability specifications for
the most common systems currently in use (ASR-9, ATCBI-6, ASDE-X). The
availability of DME/DME/IRU and eLoran were each 99.9%, as indicated in
the technical descriptions provided by the SMEs. The SATNAV system was
given a single-frequency availability of 99.9%, as a worst-case value.
Probabilities of detection for SSR, PSR and Multilateration were taken
from the system specifications and used for hazards H2 and H17.
Transponder probability of failure was given as 10^-5^ for GA; the
probability would only be lower for Air Transport (AT), so 10^-5^ was
used for transponder failure in general. This number was also applied
for other avionics, such as DME and eLoran.

# Results {#results .Appendix-1}

## Risk Assessment Ratings {#risk-assessment-ratings .Appendix-2}

Based on the CSA, each alternative had acceptable levels of risk (i.e.,
there were no high risks). The assessed risk for each alternative --
hazard combination is plotted in the risk matrix and listed in the table
below. Different symbols are used to represent the alternative backup
strategies. Each symbol is annotated with the number of hazards.

![](media/image11.png){width="6.054861111111111in"
height="4.297916666666667in"}

Figure C4-1: Risk Assessment Matrix for Backup Strategies

Table C4-1: Risk per Alternative-Hazard Combination

+----+------------------+-----+-----+-----+-----+-----+-----+-----+
| *  | **Hazard**       | > * | > * | > * | > * | > * | > * | > * |
| *N |                  | *1: | *2: | *3: | *4: | *5: | *6: | *7: |
| o. |                  | >   | > P | >   | > S | > S | >   | >   |
| ** |                  |  SS | ass | Act | SR, | SR, | SAT | SAT |
|    |                  | R** | ive | ive | >   | >   | NAV | NAV |
|    |                  |     | > M | > M | DDI | DDI | >   | > & |
|    |                  |     | L** | L** | > & | > & | Onl | >   |
|    |                  |     |     |     | >   | >   | y** |  SS |
|    |                  |     |     |     |  eL |  SA |     | R** |
|    |                  |     |     |     | ora | TNA |     |     |
|    |                  |     |     |     | n** | V** |     |     |
+----+------------------+-----+-----+-----+-----+-----+-----+-----+
| H1 | Loss of ATC      | 4B  | 4B  | 4B  | 4B  | 4B  | 4B  | 4B  |
|    | Surveillance     |     |     |     |     |     |     |     |
|    |                  | (M  | (M  | (M  | (M  | (M  | (M  | (M  |
|    | (All Aircraft)   | ed) | ed) | ed) | ed) | ed) | ed) | ed) |
+----+------------------+-----+-----+-----+-----+-----+-----+-----+
| H2 | Loss of          | 4A  | 4A  | 4A  | 4A  | 4A  | 4A  | 4A  |
|    | Surveillance     |     |     |     |     |     |     |     |
|    |                  | (M  | (M  | (M  | (M  | (M  | (M  | (M  |
|    | (Single          | ed) | ed) | ed) | ed) | ed) | ed) | ed) |
|    | Aircraft)        |     |     |     |     |     |     |     |
+----+------------------+-----+-----+-----+-----+-----+-----+-----+
| H  | Loss of          | 4C  | 4B  | 4B  | 4A  | 4A  | 4A  | 4C  |
| 17 | Surveillance     |     |     |     |     |     |     |     |
|    |                  | (L  | (M  | (M  | (M  | (M  | (M  | (L  |
|    | (Multiple        | ow) | ed) | ed) | ed) | ed) | ed) | ow) |
|    | Aircraft)        |     |     |     |     |     |     |     |
+----+------------------+-----+-----+-----+-----+-----+-----+-----+

The worst, credible outcome for each of the hazards was a significant
increase in ATC workload, which is classified as a "Minor" (4) severity.
While higher severity outcomes were evaluated, the likelihood of
occurrence for those scenarios was often several orders of magnitude
below "Extremely Improbable," and therefore deemed not credible from an
SMS perspective. The likelihood for the loss of surveillance for all
aircraft (H1) did not vary with the different strategies, as automation
and power system failures were the primary drivers for the hazard (the
alternative backup strategies are not intended to mitigate the
probability of automation or power system failure). The likelihood for
the loss of surveillance for a single aircraft (H2) is primarily
influenced by avionics failures. For the analysis, it was assumed that
the probability of failures of ADS-B avionics, DME/DME/IRU avionics, and
transponders were equivalent. The likelihoods varied from "Remote" (C)
to "Frequent" (A) for the risk of losing surveillance for multiple
aircraft (H17). The likelihood for hazard H17 was driven by the
probability of detection for SSR (for alternative 1) and Multilateration
(for alternatives 2 and 3). The probability of ground station faults
influence the likelihood for hazard H17 in the case of navigation based
alternatives. Because systems employed for each alternative depended on
the type of airspace, hazards were evaluated separately for terminal and
en route airspace. Then the maximum resultant risk was assigned to that
hazard. For hazards H2 and H17, the en route airspace resulted in the
maximum risk, primarily due to the lack of Primary Surveillance Radar.

The table below summarizes the results of the fault tree and event tree
analyses used to determine the overall risk for each alternative-hazard
combination.

##   {#section-2 .unnumbered}

Table C4-2: Likelihood Components per Alternative-Hazard Combination

<table style="width:100%;">
<colgroup>
<col style="width: 6%" />
<col style="width: 6%" />
<col style="width: 27%" />
<col style="width: 8%" />
<col style="width: 8%" />
<col style="width: 8%" />
<col style="width: 11%" />
<col style="width: 8%" />
<col style="width: 6%" />
<col style="width: 8%" />
</colgroup>
<tbody>
<tr class="odd">
<td rowspan="2"><strong>Strategy</strong></td>
<td rowspan="2"><strong>Hazard / Cause ID</strong></td>
<td rowspan="2"><strong>Description</strong></td>
<td colspan="2"><strong>Fault Tree Top-Level Event Likelihood
(A)</strong></td>
<td rowspan="2"><p><strong>Worst Case, Credible</strong></p>
<p><strong>Event Tree Path</strong></p></td>
<td rowspan="2"><p><strong>Likelihood for Event</strong></p>
<p><strong>Tree Path N (B)</strong></p></td>
<td rowspan="2"><strong>Hazard Likelihood<br />
(A) x (B)</strong></td>
<td rowspan="2"><strong>Hazard Severity</strong></td>
<td rowspan="2"><strong>Risk</strong></td>
</tr>
<tr class="even">
<td><strong>Terminal</strong></td>
<td><strong>En Route</strong></td>
</tr>
<tr class="odd">
<td>Alt 1</td>
<td>H1</td>
<td>Loss of ATC surveillance (all aircraft)</td>
<td>10<sup>-5</sup></td>
<td><strong>10<sup>-5</sup></strong></td>
<td>vi</td>
<td>0.999999</td>
<td><strong>10<sup>-5</sup></strong></td>
<td>4</td>
<td>4B (Med)</td>
</tr>
<tr class="even">
<td>Alt 1</td>
<td>H2</td>
<td>Loss of surveillance (single aircraft)</td>
<td>10<sup>-3</sup></td>
<td><strong>10<sup>-2</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-2</sup></strong></td>
<td>4</td>
<td>4A (Med)</td>
</tr>
<tr class="odd">
<td>Alt 1</td>
<td>H17</td>
<td>Loss of surveillance (multiple aircraft)</td>
<td>10<sup>-10</sup></td>
<td><strong>10<sup>-6</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-6</sup></strong></td>
<td>4</td>
<td>4C (Low)</td>
</tr>
<tr class="even">
<td>Alt 2</td>
<td>H1</td>
<td>Loss of ATC surveillance (all aircraft)</td>
<td>10<sup>-5</sup></td>
<td><strong>10<sup>-5</sup></strong></td>
<td>vi</td>
<td>0.999999</td>
<td><strong>10<sup>-5</sup></strong></td>
<td>4</td>
<td>4B (Med)</td>
</tr>
<tr class="odd">
<td>Alt 2</td>
<td>H2</td>
<td>Loss of surveillance (single aircraft)</td>
<td>10<sup>-4</sup></td>
<td><strong>10<sup>-2</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-2</sup></strong></td>
<td>4</td>
<td>4A (Med)</td>
</tr>
<tr class="even">
<td>Alt 2</td>
<td>H17</td>
<td>Loss of surveillance (multiple aircraft)</td>
<td>10<sup>-9</sup></td>
<td><strong>10<sup>-5</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-5</sup></strong></td>
<td>4</td>
<td>4B (Med)</td>
</tr>
<tr class="odd">
<td>Alt 3</td>
<td>H1</td>
<td>Loss of ATC surveillance (all aircraft)</td>
<td>10<sup>-5</sup></td>
<td><strong>10<sup>-5</sup></strong></td>
<td>vi</td>
<td>0.999999</td>
<td><strong>10<sup>-5</sup></strong></td>
<td>4</td>
<td>4B (Med)</td>
</tr>
<tr class="even">
<td>Alt 3</td>
<td>H2</td>
<td>Loss of surveillance (single aircraft)</td>
<td>10<sup>-3</sup></td>
<td><strong>10<sup>-2</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-2</sup></strong></td>
<td>4</td>
<td>4A (Med)</td>
</tr>
<tr class="odd">
<td>Alt 3</td>
<td>H17</td>
<td>Loss of surveillance (multiple aircraft)</td>
<td>10<sup>-9</sup></td>
<td><strong>10<sup>-5</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-5</sup></strong></td>
<td>4</td>
<td>4B (Med)</td>
</tr>
<tr class="even">
<td>Alt 4</td>
<td>H1</td>
<td>Loss of ATC surveillance (all aircraft)</td>
<td>10<sup>-5</sup></td>
<td><strong>10<sup>-5</sup></strong></td>
<td>vi</td>
<td>0.999999</td>
<td><strong>10<sup>-5</sup></strong></td>
<td>4</td>
<td>4B (Med)</td>
</tr>
<tr class="odd">
<td>Alt 4</td>
<td>H2</td>
<td>Loss of surveillance (single aircraft)</td>
<td>10<sup>-3</sup></td>
<td><strong>10<sup>-3</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-3</sup></strong></td>
<td>4</td>
<td>4A (Med)</td>
</tr>
<tr class="even">
<td>Alt 4</td>
<td>H17</td>
<td>Loss of surveillance (multiple aircraft)</td>
<td>10<sup>-10</sup></td>
<td><strong>10<sup>-2</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-2</sup></strong></td>
<td>4</td>
<td>4A (Med)</td>
</tr>
<tr class="odd">
<td>Alt 5</td>
<td>H1</td>
<td>Loss of ATC surveillance (all aircraft)</td>
<td>10<sup>-5</sup></td>
<td><strong>10<sup>-5</sup></strong></td>
<td>vi</td>
<td>0.999999</td>
<td><strong>10<sup>-5</sup></strong></td>
<td>4</td>
<td>4B (Med)</td>
</tr>
<tr class="even">
<td>Alt 5</td>
<td>H2</td>
<td>Loss of surveillance (single aircraft)</td>
<td>10<sup>-3</sup></td>
<td><strong>10<sup>-3</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-3</sup></strong></td>
<td>4</td>
<td>4A (Med)</td>
</tr>
<tr class="odd">
<td>Alt 5</td>
<td>H17</td>
<td>Loss of surveillance (multiple aircraft)</td>
<td>10<sup>-10</sup></td>
<td><strong>10<sup>-2</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-2</sup></strong></td>
<td>4</td>
<td>4A (Med)</td>
</tr>
<tr class="even">
<td>Alt 6</td>
<td>H1</td>
<td>Loss of ATC surveillance (all aircraft)</td>
<td>10<sup>-5</sup></td>
<td><strong>10<sup>-5</sup></strong></td>
<td>vi</td>
<td>0.999999</td>
<td><strong>10<sup>-5</sup></strong></td>
<td>4</td>
<td>4B (Med)</td>
</tr>
<tr class="odd">
<td>Alt 6</td>
<td>H2</td>
<td>Loss of surveillance (single aircraft)</td>
<td>10<sup>-3</sup></td>
<td><strong>10<sup>-3</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-3</sup></strong></td>
<td>4</td>
<td>4A (Med)</td>
</tr>
<tr class="even">
<td>Alt 6</td>
<td>H17</td>
<td>Loss of surveillance (multiple aircraft)</td>
<td>10<sup>-2</sup></td>
<td><strong>10<sup>-2</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-2</sup></strong></td>
<td>4</td>
<td>4A (Med)</td>
</tr>
</tbody>
</table>

Table C4-2 (ctd): Likelihood Components per Alternative-Hazard
Combination

<table style="width:100%;">
<colgroup>
<col style="width: 6%" />
<col style="width: 6%" />
<col style="width: 27%" />
<col style="width: 8%" />
<col style="width: 8%" />
<col style="width: 8%" />
<col style="width: 11%" />
<col style="width: 8%" />
<col style="width: 6%" />
<col style="width: 8%" />
</colgroup>
<thead>
<tr class="header">
<th rowspan="2"><strong>Strategy</strong></th>
<th rowspan="2"><strong>Hazard / Cause ID</strong></th>
<th rowspan="2"><strong>Description</strong></th>
<th colspan="2"><strong>Fault Tree Top-Level Event Likelihood
(A)</strong></th>
<th rowspan="2"><p><strong>Worst Case, Credible</strong></p>
<p><strong>Event Tree Path</strong></p></th>
<th rowspan="2"><p><strong>Likelihood for Event</strong></p>
<p><strong>Tree Path N (B)</strong></p></th>
<th rowspan="2"><strong>Hazard Likelihood<br />
(A) x (B)</strong></th>
<th rowspan="2"><strong>Hazard Severity</strong></th>
<th rowspan="2"><strong>Risk</strong></th>
</tr>
<tr class="odd">
<th><strong>Terminal</strong></th>
<th><strong>En Route</strong></th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>Alt 7</td>
<td>H1</td>
<td>Loss of ATC surveillance (all aircraft)</td>
<td>10<sup>-5</sup></td>
<td><strong>10<sup>-5</sup></strong></td>
<td>vi</td>
<td>0.999999</td>
<td><strong>10<sup>-5</sup></strong></td>
<td>4</td>
<td>4B (Med)</td>
</tr>
<tr class="even">
<td>Alt 7</td>
<td>H2</td>
<td>Loss of surveillance (single aircraft)</td>
<td>10<sup>-3</sup></td>
<td><strong>10<sup>-2</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-2</sup></strong></td>
<td>4</td>
<td>4A (Med)</td>
</tr>
<tr class="odd">
<td>Alt 7</td>
<td>H17</td>
<td>Loss of surveillance (multiple aircraft)</td>
<td>10<sup>-10</sup></td>
<td><strong>10<sup>-6</sup></strong></td>
<td>vii</td>
<td>0.999999</td>
<td><strong>10<sup>-6</sup></strong></td>
<td>4</td>
<td>4C (Low)</td>
</tr>
</tbody>
</table>

# Analysis Backup {#analysis-backup .Appendix-1}

## Fault Trees {#fault-trees .Appendix-2}

Fault trees were used as to determine one component of the overall
hazard likelihood. One fault tree is shown for each alternative-hazard
combination. Some alternatives used a different system for terminal
airspace and en route airspace. In the alternatives where a Primary
Surveillance Radar (PSR) was not present, the faults associated with the
PSR were mathematically removed (though still shown in the fault tree)
by assigning a probability of 0% if it was under an "OR" gate or
assigning a probability of 100% if it was under an "AND" gate. Shaded
events in each tree denote backup strategy specific faults.

Table C5-1 indicates which fault trees were used to calculate the
likelihood, based on the technical descriptions for the alternatives.

## Event Trees {#event-trees .Appendix-2}

Event trees are used in combination with fault trees to aid in
identifying the worst, credible outcome. Since the severity of a hazard
is greatly influenced by the circumstances under which it occurs, the
event trees help identify the most severe outcome that can realistically
happen. While it is possible that a collision could occur with any of
the hazards examined in this assessment, certain conditions would have
to be present in a particular combination and several existing controls
would have to fail. Therefore, the likelihood of a collision occurring
is not credible.

Table C5-1: Fault Trees by Airspace

+-------+--------+------+------+------+------+------+------+------+
| **Haz | **Airs | *    | *    | *    | *    | *    | *    | *    |
| ard** | pace** | *Alt | *Alt | *Alt | *Alt | *Alt | *Alt | *Alt |
|       |        | 1**  | 2**  | 3**  | 4**  | 5**  | 6**  | 7**  |
+-------+--------+------+------+------+------+------+------+------+
| H1    | > Te   | Fig. | Fig. | Fig. | Fig. | Fig. | Fig. | Fig. |
|       | rminal |      |      |      |      |      |      |      |
|       |        | C5-1 | C5-4 | C5-7 | C5-1 | C5-1 | C    | C    |
|       |        |      |      |      |      |      | 5-16 | 5-19 |
+-------+--------+------+------+------+------+------+------+------+
|       | > En   | Fig. | Fig. | Fig. | Fig. | Fig. | Fig. | Fig. |
|       | >      |      |      |      |      |      |      |      |
|       |  Route | C5-1 | C5-4 | C5-7 | C    | C    | C    | C    |
|       |        |      |      |      | 5-10 | 5-13 | 5-16 | 5-16 |
+-------+--------+------+------+------+------+------+------+------+
| H2    | > Te   | Fig. | Fig. | Fig. | Fig. | Fig. | Fig. | Fig. |
|       | rminal |      |      |      |      |      |      |      |
|       |        | C5-2 | C5-5 | C5-8 | C5-2 | C5-2 | C    | C    |
|       |        |      |      |      |      |      | 5-17 | 5-20 |
+-------+--------+------+------+------+------+------+------+------+
|       | > En   | Fig. | Fig. | Fig. | Fig. | Fig. | Fig. | Fig. |
|       | >      |      |      |      |      |      |      |      |
|       |  Route | C5-2 | C5-5 | C5-8 | C    | C    | C    | C    |
|       |        |      |      |      | 5-11 | 5-14 | 5-17 | 5-17 |
+-------+--------+------+------+------+------+------+------+------+
| H17   | > Te   | Fig. | Fig. | Fig. | Fig. | Fig. | Fig. | Fig. |
|       | rminal |      |      |      |      |      |      |      |
|       |        | C5-3 | C5-6 | C5-9 | C5-3 | C5-3 | C    | C    |
|       |        |      |      |      |      |      | 5-18 | 5-21 |
+-------+--------+------+------+------+------+------+------+------+
|       | > En   | Fig. | Fig. | Fig. | Fig. | Fig. | Fig. | Fig. |
|       | >      |      |      |      |      |      |      |      |
|       |  Route | C5-3 | C5-6 | C5-9 | C    | C    | C    | C    |
|       |        |      |      |      | 5-12 | 5-15 | 5-18 | 5-18 |
+-------+--------+------+------+------+------+------+------+------+

![](media/image12.png){width="9.02361111111111in"
height="7.642361111111111in"}

Figure C5-1: Strategy 1 - Hazard H1

![](media/image13.png){width="16.292361111111113in"
height="7.490277777777778in"}

Figure C5-2: Strategy 1 - Hazard H2

![](media/image14.png){width="14.559027777777779in"
height="8.134722222222223in"}

Figure C5-3: Strategy 1 - Hazard H17

![](media/image15.png){width="11.524305555555555in"
height="7.288888888888889in"}

Figure C5-4: Strategy 2 - Hazard H1

![](media/image16.png){width="15.911111111111111in" height="7.625in"}

Figure C5-5: Strategy 2 - Hazard H2

![](media/image17.png){width="14.676388888888889in"
height="7.4319444444444445in"}

Figure C5-6: Strategy 2 - Hazard H17

![](media/image18.png){width="13.0in" height="7.6875in"}

Figure C5-7: Strategy 3 - Hazard H1

![](media/image19.png){width="16.375in" height="7.96875in"}

Figure C5-8: Strategy 3 - Hazard H2

![](media/image20.png){width="13.894444444444444in"
height="7.904166666666667in"}

Figure C5-9: Strategy 3 - Hazard H17

![](media/image21.png){width="11.219444444444445in"
height="8.47638888888889in"}

Figure C5-10: Strategy 4 - Hazard H1

![](media/image22.png){width="13.433333333333334in" height="8.9375in"}

Figure C5-11: Strategy 4 - Hazard H2

![](media/image23.png){width="10.510416666666666in"
height="8.770833333333334in"}

Figure C5-12: Strategy 4 - Hazard H17

![](media/image24.png){width="12.333333333333334in"
height="8.645833333333334in"}

Figure C5-13: Strategy 5 - Hazard H1

![](media/image25.png){width="14.270833333333334in"
height="8.677083333333334in"}

Figure C5-14: Strategy 5 - Hazard H2

![](media/image26.png){width="11.526388888888889in" height="8.90625in"}

Figure C5-15: Strategy 5 - Hazard H17

![](media/image27.png){width="11.54375in" height="8.731944444444444in"}

Figure C5-16: Strategy 6 - Hazard H1

![](media/image28.png){width="14.797222222222222in"
height="8.80486111111111in"}

Figure C5-17: Strategy 6 - Hazard H2

![](media/image29.png){width="10.760416666666666in"
height="8.197916666666666in"}

Figure C5-18: Strategy 6 - Hazard H17

![](media/image30.png){width="12.61875in" height="8.844444444444445in"}

Figure C5-19: Strategy 7 - Hazard H1

![](media/image31.png){width="16.051388888888887in"
height="7.366666666666666in"}

Figure C5-20: Strategy 7 - Hazard H2

![](media/image32.png){width="14.409027777777778in"
height="8.55486111111111in"}

Figure C5-21: Strategy 7 - Hazard H17

**This page intentionally blank**

  ------------ ----------- ---------- --------------- ------------- --------------
  H1           Aircraft on TCAS       TCAS            See and avoid Consequence
               collision   present?   success-fully   / maneuver    
               course?                resolves        successful?   
                                      traffic                       
                                      conflict?                     

                                                                    

                           Yes        Yes             Null          Major (3) --
                                                                    Signif.
                                                                    reduction in
                                                                    safety margin

                                                                    

                                                      Yes           Hazardous (2)
                                                                    -- Large
                                                                    reduction in
                                                                    safety margin

                                      No                            

               Yes                                    No            Catastrophic
                                                                    (1) -
                                                                    Collision

  Failure:                 No                                       
  Hazard                                                            
  occurs                                                            

                                                      Yes           Major (3) --
                                                                    Signif.
                                                                    reduction in
                                                                    safety margin

                                      Null                          

                                                      No            Catastrophic
                                                                    (1) -
                                                                    Collision

                                                                    

               No          Null       Null            Null          Minor (4) --
                                                                    Signif. ATC
                                                                    workload
                                                                    increase

                                                                    
  ------------ ----------- ---------- --------------- ------------- --------------

**Figure C5-22: Event Tree for Hazard H1**

  ----------- ----------- ---------- ---------- --------------- ------------- --------------
  H2, H17     Aircraft on ATC        TCAS       TCAS            See and avoid Consequence
              collision   detects &  present?   success-fully   / maneuver    
              course?     resolves              resolves        successful?   
                          problem?              traffic                       
                                                conflict?                     

                                                                              

                          Yes        Null       Null            Null          Minor (4) --
                                                                              Signif. ATC
                                                                              workload
                                                                              increase

                                                                              

                                                Yes             Null          Major (3) --
                                                                              Signif.
                                                                              reduction in
                                                                              safety margin

                                                                              

                                     Yes                        Yes           Hazardous (2)
                                                                              -- Large
                                                                              reduction in
                                                                              safety margin

              Yes                               No                            

  Failure:                No                                    No            Catastrophic
  Hazard                                                                      (1) -
  occurs                                                                      Collision

                                                                              

                                                                Yes           Major (3) --
                                                                              Signif.
                                                                              reduction in
                                                                              safety margin

                                     No         Null                          

                                                                No            Catastrophic
                                                                              (1) -
                                                                              Collision

                                                                              

                          Yes        Null       Null            Null          Minor (4) --
                                                                              Signif. ATC
                                                                              workload
                                                                              increase

              No                                                              

                          No         Null       Null            Null          Minor (4) --
                                                                              Signif. ATC
                                                                              workload
                                                                              increase

                                                                              
  ----------- ----------- ---------- ---------- --------------- ------------- --------------

Figure C5-23: Event Tree for Hazards H2, H17

Table C5-2: Event Tree Paths for Hazard H1

  --------- ----------- ---------------- ------------- ---------------- --------------- ---------------- --------------- ---------------- -------------- --------------
  **Event   **On        **Likelihood**   **TCAS        **Likelihood**   **TCAS          **Likelihood**   **See & avoid   **Likelihood**   **Event Tree   **Severity**
  Tree      collision                    equipped?**                    successful?**                    successful?**                    Calc.          
  Path**    course?**                                                                                                                     Likelihood**   

  i         Y           1.00000E-06      Y             0.6              Y               0.9              Null            N/A              5.40000E-07    3

  ii        Y           1.00000E-06      Y             0.6              N               0.1              Y               0.001            6.00000E-11    2

  iii       Y           1.00000E-06      Y             0.6              N               0.1              N               0.999            5.99400E-08    1

  iv        Y           1.00000E-06      N             0.4              Null            N/A              Y               0.001            4.00000E-10    3

  v         Y           1.00000E-06      N             0.4              Null            N/A              N               0.999            3.99600E-07    1

  vi        N           9.99999E-01      Null                           Null                             Null                             9.99999E-01    4
  --------- ----------- ---------------- ------------- ---------------- --------------- ---------------- --------------- ---------------- -------------- --------------

[Note]{.underline}: Event tree path ii is considered "not credible"
based on likelihood \< = 10^-11^

Table C5-3: Event Tree Paths for Hazard H2

  --------- ----------- ---------------- ------------- ---------------- ------------- ---------------- --------------- ---------------- --------------- ---------------- -------------- --------------
  **Event   **On        **Likelihood**   **ATC detects **Likelihood**   **TCAS        **Likelihood**   **TCAS          **Likelihood**   **See & avoid   **Likelihood**   **Event Tree   **Severity**
  Tree      collision                    & corrects?**                  equipped?**                    successful?**                    successful?**                    Calc.          
  Path**    course?**                                                                                                                                                    Likelihood**   

  i         Y           1.00000E-06      Y             0.9              Null          N/A              Null            N/A              Null            N/A              9.00000E-07    4

  ii        Y           1.00000E-06      N             0.1              Y             0.6              Y               0.9              Null            N/A              5.40000E-08    3

  iii       Y           1.00000E-06      N             0.1              Y             0.6              N               0.1              Y               0.001            6.00000E-12    2

  iv        Y           1.00000E-06      N             0.1              Y             0.6              N               0.1              N               0.999            5.99400E-09    1

  v         Y           1.00000E-06      N             0.1              N             0.4              Null            N/A              Y               0.001            4.00000E-11    3

  vi        Y           1.00000E-06      N             0.1              N             0.4              Null            N/A              N               0.999            3.99600E-08    1

  vii       N           9.99999E-01      Null                           Null                           Null                             Null                             9.99999E-01    4
  --------- ----------- ---------------- ------------- ---------------- ------------- ---------------- --------------- ---------------- --------------- ---------------- -------------- --------------

[Note]{.underline}: Event tree paths iii and v are considered "not
credible" based on likelihood \< = 10^-11^

Table C5-4: Event Tree Paths for Hazard H17

  --------- ----------- ---------------- ------------- ---------------- ------------- ---------------- --------------- ---------------- --------------- ---------------- -------------- --------------
  **Event   **On        **Likelihood**   **ATC detects **Likelihood**   **TCAS        **Likelihood**   **TCAS          **Likelihood**   **See & avoid   **Likelihood**   **Event Tree   **Severity**
  Tree      collision                    & corrects?**                  equipped?**                    successful?**                    successful?**                    Calc.          
  Path**    course?**                                                                                                                                                    Likelihood**   

  i         Y           1.00000E-06      Y             0.999            Null          N/A              Null            N/A              Null            N/A              9.99000E-07    4

  ii        Y           1.00000E-06      N             0.001            Y             0.6              Y               0.9              Null            N/A              5.40000E-10    3

  iii       Y           1.00000E-06      N             0.001            Y             0.6              N               0.1              Y               0.001            6.00000E-14    2

  iv        Y           1.00000E-06      N             0.001            Y             0.6              N               0.1              N               0.999            5.99400E-11    1

  v         Y           1.00000E-06      N             0.001            N             0.4              Null            N/A              Y               0.001            4.00000E-13    3

  vi        Y           1.00000E-06      N             0.001            N             0.4              Null            N/A              N               0.999            3.99600E-10    1

  vii       N           9.99999E-01      Y             0.999            Null          N/A              Null            N/A              Null            N/A              9.99999E-01    4

  viii      N           9.99999E-01      N              0.001           Null           N/A             Null             N/A             Null             N/A             9.99999E-04    4
  --------- ----------- ---------------- ------------- ---------------- ------------- ---------------- --------------- ---------------- --------------- ---------------- -------------- --------------

[Note]{.underline}: Event tree paths iii, iv, and v are considered "not
credible" based on likelihood \< = 10^-11^

This page intentionally blank