Survivability is an aircraft's capability to avoid or withstand a man-made hostile environment. Failing to avoid is susceptibility, measured by \(P_H\); failing to withstand is vulnerability, measured by \(P_{K|H}\). A kill needs both: \(P_K = P_H\,P_{K|H}\) and \(P_S = 1 - P_K\).
\(P_K = P_D\,P_{T|D}\,P_{I|T}\,P_{H|I}\,P_{K|H}\) — detect, track given detect, identify given track, hit given identify, kill given hit. The first four make up the susceptibility \(P_H\); the last is the vulnerability.
Each factor is conditional on every link before it succeeding — \(P_{T|D}\) is the chance of holding a track given a detection. Multiplying conditionals is the chain rule of probability, so no independence between the links is assumed.
It is the limit case: drive one factor to zero and \(P_K = 0\). Real levers rarely zero a link — they shrink it, and a shrunken factor lowers \(P_K\) by multiplication.
The one that removes the larger fraction of its link — whichever link it sits on. A lever that multiplies one factor by \(f\) multiplies the whole product \(P_K\) by \(f\), so taking 0.15 off a link at 0.3 (half of it) beats taking 0.25 off a link at 0.75 (a third). What the algebra leaves out decides the rest: the cost of that cut, and its reach — how many threats one lever acts on.
Threat warning; noise and deception jamming; signature reduction; expendables (chaff, flares, decoys); threat suppression (SEAD); and tactics (route, altitude, timing, terrain masking, maneuver). All of them lower \(P_H\).
Component redundancy with separation; component location; passive damage suppression; active damage suppression; component shielding; and component elimination or replacement. All of them lower \(P_{K|H}\).
Does it change whether they hit you (susceptibility, \(P_H\)) or what a hit does to you (vulnerability, \(P_{K|H}\))? Where it is installed does not matter — radar-absorbing material is bolted to the airframe but is a susceptibility lever.
Detect: B1's range law and threshold, B3's signatures and EMCON, B2's noise jamming. Track: B2's deception and chaff, B1's Doppler notch. Identify: emission discipline (B2, B3). Engage: B3's flares and DIRCM, B2's towed decoys. Kill: airframe design (vulnerability). Block 4 adds no link — it decides how many times the chain runs.
In defended airspace with no friendly traffic, anything unknown is treated as hostile, so identification rarely fails. A link already near 1 has little room to shrink, which makes Identify usually the weakest lever.
You must survive all of them, so survivals multiply: \(P_S = \prod_i (1 - P_{K,i})\). Small risks compound — twenty 4% shots leave \(P_S = 0.96^{20} = 0.44\). Independence is an assumption: a radar that cues every SAM couples their detections.
\(r = -\ln P_S = \sum_i -\ln(1 - P_{K,i})\), and \(P_S = e^{-r}\). For small \(P_K\), \(r_i \approx P_{K,i}\), but \(-\ln(1-p) = p + p^2/2 + \dots\) is always larger than \(p\), so the shortcut understates the risk.
A shortest-path search (Dijkstra, L34) minimizes a sum of edge costs. The logs sum exactly to \(-\ln P_S\), so the least-cost route is exactly the most survivable one. Summing the \(p\) values is right only to first order.
Its risk per kilometer of exposure. Inside its lethal zone (detection contour and MEZ) the site shoots every \(\Delta s\) km; each shot kills with the chain after detection, \(p_\text{shot} = P_{T|D}\,P_{I|T}\,P_{H|I}\,P_{K|H}\). Then \(\lambda_i = -\ln(1 - p_\text{shot})/\Delta s\) and \(P_{S,i} = e^{-\lambda_i \ell_i}\) for \(\ell_i\) km inside.
Because the site gets one shot per \(\Delta s\) km, so \(\ell\) km buys it \(\ell/\Delta s\) independent shots, and each shot adds the same \(-\ln(1 - p_\text{shot})\) to the risk. Twice the kilometers, twice the risk: \(r_i = \lambda_i \ell_i\).
The survival metric (task T2): per-site chain, hazard and route \(P_S\), ingress and egress separately. The project is issued at L31; a required, feedback-only checkpoint is at L35; the complete draft is due at the start of L39 for peer review; the final paper is due at the start of L41.