Reading — Survivability and the PK Chain

By the end of this lesson you should be able to:

1. Define survivability, susceptibility, and vulnerability in Ball’s sense, and classify a lever as susceptibility reduction or vulnerability reduction.

2. Decompose one engagement’s \(P_K\) along the L1 kill chain as a product of conditional link probabilities.

3. Combine independent encounters into a mission survival probability \(P_S = \prod_i (1 - P_{K,i})\).

4. Convert \(P_S\) to additive risk, \(r = -\ln P_S\), and explain why a route planner needs a cost that adds.

Three toolkits, one number

Blocks 1–3 each handed you a toolkit. Block 1 built the threat’s physics: the fourth-power range law, detection thresholds, Doppler and the radar horizon. Block 2 fought in the RF spectrum: support, protect, attack, and the deception that walks a tracker off the aircraft. Block 3 moved to the infrared and the airframe itself: seekers and flares, radar cross-section, absorbers, emission control, and the rule that you are only as quiet as your loudest band.

Each of those toolkits broke a link of the L1 kill chain — Detect → Track → Identify → Engage → Kill. What none of them did was tell you how much a whole engagement, or a whole route, is worth. Is a 10 dB signature cut worth more than a flare program? Than a route that stays out of one missile zone? You cannot compare levers that act on different links until every link carries a number and the numbers combine into one. That number is the aircraft’s survivability, and it is the survival metric of the Final Project issued today.

Survivability: avoid the hit, or withstand it

The anchor text for Block 4 is Robert Ball’s The Fundamentals of Aircraft Combat Survivability Analysis and Design. Ball defines survivability as an aircraft’s capability to avoid or withstand a man-made hostile environment, and the two verbs split the subject cleanly:

• Susceptibility is the inability to avoid being hit. It is measured by \(P_H\), the probability that the threat’s weapon reaches the aircraft — a warhead detonating close enough, or a projectile striking it.

• Vulnerability is the inability to withstand the hit. It is measured by \(P_{K|H}\), the probability that a hit, once it happens, kills the aircraft.

A kill needs both, so

\[ P_K = P_H \, P_{K|H}, \qquad P_S = 1 - P_K . \]

The split matters because the two halves are fought with different tools by different people. Susceptibility is the EW engineer’s and the tactician’s problem: signatures, jamming, warning, routes. Vulnerability is the airframe designer’s problem: what happens to the hydraulics, the fuel and the flight controls when fragments arrive. This course lives almost entirely on the susceptibility side, but the product treats the two alike: a vulnerability lever multiplies \(P_K\) exactly as a susceptibility lever does.

The L1 chain as a product of conditional probabilities

L1 said the threat must complete every link of the chain, in order, and that breaking any one link saves the aircraft. Put a probability on each link and that sentence becomes a formula:

\[ P_K = P_D \; P_{T|D} \; P_{I|T} \; P_{H|I} \; P_{K|H} . \]

Read each factor as a conditional: \(P_D\) is the probability the threat detects you; \(P_{T|D}\) is the probability it forms and holds a track given that it detected you; \(P_{I|T}\) is the probability it classifies you as hostile given a track; \(P_{H|I}\) is the probability the engagement it then commits produces a hit; and \(P_{K|H}\) is the probability that hit kills. The product is simply the chain rule of probability — each factor is conditioned on every link before it succeeding, so no independence between links is assumed. The first four factors together are the susceptibility, \(P_H = P_D\,P_{T|D}\,P_{I|T}\,P_{H|I}\); the last is the vulnerability.

A worked example makes the bookkeeping concrete. A site that detects you 80% of the time, holds a track on 75% of those detections, never hesitates over identification, and guides a hit on half of its engagements has \(P_H = 0.8 \times 0.75 \times 1 \times 0.5 = 0.30\). If a hit kills 70% of the time, \(P_K = 0.30 \times 0.7 = 0.21\) and \(P_S = 0.79\) for that one engagement.

Two details are worth carrying forward. First, the Identify link is often the weakest lever: in defended airspace with no friendly traffic, anything unknown is treated as hostile, so \(P_{I|T}\) sits near 1 and there is little to shrink. Second, Ball splits susceptibility more finely than this — whether the threat is active at all, whether it launches, whether the weapon guides and fuzes. This course keeps L1’s five links so that the chain you already know carries the math.

Key Concept

L1’s “break any link and the aircraft survives” is the limit case of a product: drive one factor to zero and \(P_K\) is zero. Real levers rarely zero a link; they shrink it. A signature cut lowers \(P_D\), a deception jammer lowers \(P_{T|D}\), a flare lowers \(P_{H|I}\), a self-sealing tank lowers \(P_{K|H}\) — and every one of them lowers \(P_K\) by multiplication.

Which block bought which lever

Every lever from Blocks 1–3 lands on a link. The map below is worth rebuilding yourself from the lessons, because it is the bridge from “things we studied” to “things we can spend”:

Link	Levers you already own	Block (lessons)
Detect, \(P_D\)	range law and detection threshold; RCS, IR signature, EMCON; noise jamming	B1 (L1, L3, L8) · B3 (L22, L25–L27) · B2 (L17)
Track, \(P_{T\vert D}\)	deception jamming, chaff; the Doppler notch	B2 (L18) · B1 (L5)
Identify, \(P_{I\vert T}\)	emission discipline — no emitter to fingerprint	B2 (L12) · B3 (L27)
Engage, \(P_{H\vert I}\)	flares, IRCCM-aware tactics, DIRCM; towed decoys	B3 (L23–L24) · B2 (L18)
Kill, \(P_{K\vert H}\)	airframe design — Ball’s vulnerability toolkit	named here, not taught
Exposure (how many shots)	route, standoff jamming, SEAD	B4 (L32–L36)

The last row is the one to notice. Block 4 does not add a sixth link. It decides how many times the threat gets to run the chain — how many sites see you, and for how long each one gets to shoot. That is a lever on the product across encounters, which is where the next two sections go.

Ball’s two toolkits

Ball organizes the levers into two lists, one per half of the product. Learn both lists and the one test that separates them.

Susceptibility reduction — shrink \(P_H\):

• Threat warning — sensors that tell the crew a threat is looking or shooting (an RWR is L12’s electromagnetic support turned inward), so tactics and countermeasures can be used in time.

• Noise and deception jamming — raise a receiver’s noise floor (L17) or feed it false range, velocity or angle (L18).

• Signature reduction — shaping, absorbers, IR suppression and emission control: Block 3.

• Expendables — chaff, flares and expendable decoys, spent to seduce a tracker or a seeker (L18, L24).

• Threat suppression — degrade or destroy the defense before or during the engagement: SEAD (L36).

• Tactics — route, altitude, timing, terrain masking and maneuver: Block 4.

Vulnerability reduction — shrink \(P_{K|H}\):

• Component redundancy, with separation — two of a critical component, far enough apart that one hit cannot take out both.

• Component location — place critical components where they are least likely to be hit, or where other structure stands in the way.

• Passive damage suppression — design that contains damage without any action after the hit: fire-resistant materials, self-sealing or inerted fuel tanks, damage-tolerant structure.

• Active damage suppression — systems that sense damage and act: fire detection and extinguishing, isolating a leaking line.

• Component shielding — armor, or a less critical component, placed between the threat and a critical one.

• Component elimination or replacement — remove a vulnerable component, or swap it for one with fewer ways to fail.

Key Concept

The test for any lever: does it change whether they hit you, or what a hit does to you? The first is susceptibility reduction (\(P_H\)), the second vulnerability reduction (\(P_{K|H}\)). A flare, a jammer, a quieter signature and a smarter route all act before the hit. Redundancy, separation, shielding and fire suppression all act after it.

Many encounters, one mission

A route through an integrated air defense is not one engagement. It meets several sites, and a site with time to work can shoot more than once. If each shot is an independent chance to die, you must survive all of them, and survival probabilities multiply:

\[ P_S = \prod_i \left(1 - P_{K,i}\right). \]

Small risks compound faster than intuition expects. Twenty independent shots at 4% each do not leave you 96% safe, and they do not add to an 80% chance of death either: \(P_S = 0.96^{20} = 0.44\). More than half the time, one of the twenty gets you.

The product rests on independence, and that is an assumption to state out loud. An early-warning radar that detects you once and cues every SAM in the network ties their detections together: if it sees you, they all effectively do. Block 4 handles that by folding the cueing into the SAMs’ links (inside early-warning coverage a site’s \(P_{T|D}\) rises), which keeps the encounters separate enough for the product to hold.

Take the log: risk adds

A product is awkward to reason about and awkward to optimize. The logarithm turns it into a sum. Define the additive risk

\[ r = -\ln P_S = \sum_i -\ln\left(1 - P_{K,i}\right) = \sum_i r_i . \]

Each term \(r_i = -\ln(1 - P_{K,i})\) belongs to one encounter, so the sum shows you where the risk lives: the encounter with the largest \(r_i\) is the one pulling \(P_S\) down hardest. Going back is one exponential, \(P_S = e^{-r}\).

For small probabilities \(r_i \approx P_{K,i}\), because \(-\ln(1-p) = p + p^2/2 + \dots\) At \(P_K = 0.1\) the risk is \(r = 0.105\); at \(P_K = 0.25\) it is already \(0.288\). The shortcut always understates the risk, and it is only a convenience — the definition is the logarithm.

Why insist on a sum? Because of what comes next. L34 plans routes with a shortest-path search, and a shortest-path search (Dijkstra’s algorithm) minimizes a sum of edge costs. If each leg of a route carries the cost \(r_e = -\ln(1 - p_e)\), then the route with the least total cost is exactly the route with the greatest \(P_S\) — no approximation anywhere. Adding the \(P_K\) values themselves would only be right to first order.

Key Concept

Survival multiplies; risk adds. \(P_S = \prod_i (1 - P_{K,i})\) and \(r = -\ln P_S = \sum_i -\ln(1 - P_{K,i})\) are the same statement, and the second is the one an optimizer can use: minimize total risk and you have maximized survival.

Type-along

One chain and a menu of four levers — each one cuts a single link to a new value — then a route of three encounters. Type this and read what it prints:

% L31 -- the chain is a product; risk is a sum
p  = [0.9 0.8 0.9 0.5 0.6];   % P_D P_T|D P_I|T P_H|I P_K|H
fprintf('%-9s  P_S = %.3f\n', 'baseline', 1 - prod(p));
nm = {'RAM','deception','flares','armor'};
k  = [1 2 4 5];               % the link each lever cuts
v  = [0.6 0.6 0.3 0.45];      % that link's new value
for i = 1:4
    q = p;  q(k(i)) = v(i);
    fprintf('%-9s  P_S = %.3f\n', nm{i}, 1 - prod(q));
end
PKi = [prod(p) 0.12 0.06];    % three independent encounters
r   = -log(1 - PKi);          % risk of each encounter
fprintf('P_S = %.3f   -ln P_S = %.3f   sum(r) = %.3f\n', ...
        prod(1 - PKi), -log(prod(1 - PKi)), sum(r));

Then answer these two:

1. Which lever wins — and what do the winners have in common?

2. Deception and armor tie, on different links. What would halving each link do?

Solution

baseline   P_S = 0.806
RAM        P_S = 0.870
deception  P_S = 0.854
flares     P_S = 0.883
armor      P_S = 0.854
P_S = 0.666   -ln P_S = 0.406   sum(r) = 0.406

1. Flares win (\(P_S = 0.883\)), then RAM (0.870), then deception and armor together (0.854). Rank the levers by the fraction of their link they remove and you get the same order: flares take 40% off \(P_{H|I}\) (\(0.5 \to 0.3\)), RAM a third off \(P_D\) (\(0.9 \to 0.6\)), deception and armor 25% each (\(0.8 \to 0.6\), \(0.6 \to 0.45\)). RAM makes the biggest absolute cut, 0.30, and still loses to flares’ 0.20, because \(P_K\) is a product: what a lever does to \(P_K\) is the fraction it removes from its link, whichever link that is. Deception is a susceptibility lever and armor a vulnerability lever, and the product cannot tell them apart.

2. Every row would print the same \(P_S = 0.903\), because halving any factor halves the product (\(0.194 \to 0.097\)). That five-way tie is the proof of the rule: the link does not matter, only the fraction. What the algebra leaves out is what decides a real program — what it costs to take that fraction off each link, and reach: one signature cut lowers \(P_D\) on every radar that sees you, while flares act only on IR shots.

The last line checks the bridge to L34: \(-\ln P_S\) and \(\sum r\) agree to every digit, because the log turned the product into a sum.

Quick problem — Three Layers, One Lever

A notional penetrator crosses three layered SAMs and takes one independent shot from each.

• Links in chain order: \(P_D,\ P_{T|D},\ P_{I|T},\ P_{H|I},\ P_{K|H}\)

• Long-range SAM (outer): 0.8, 0.5, 1, 0.4, 0.5

• Medium-range SAM: 0.7, 0.8, 1, 0.5, 0.5

• Short-range SAM (at the target): 0.9, 0.8, 1, 0.5, 0.5

(a) \(P_K\) for each SAM; the mission \(P_S\).
(b) The additive risk \(r = -\ln P_S\), and the SAM that carries the most of it.
(c) The single link-halving that buys the most \(P_S\), and the new \(P_S\).

Solution

(a) Multiply along each chain: long-range \(0.8 \times 0.5 \times 1 \times 0.4 \times 0.5 = 0.08\), medium-range \(0.7 \times 0.8 \times 1 \times 0.5 \times 0.5 = 0.14\), short-range \(0.9 \times 0.8 \times 1 \times 0.5 \times 0.5 = 0.18\) — so 0.08, 0.14, 0.18. The mission survives all three: \(P_S = 0.92 \times 0.86 \times 0.82 = 0.6488 \approx\) 0.649.

(b) Carry the unrounded product: \(r = -\ln 0.6488 =\) 0.433. Per SAM, \(-\ln 0.92 = 0.0834\), \(-\ln 0.86 = 0.1508\) and \(-\ln 0.82 = 0.1985\), which sum to the same 0.433. The short-range SAM carries the most, 0.198 — nearly half.

(c) Halving any link of a SAM halves that SAM’s \(P_K\), so the question is which SAM, not which link. The short-range SAM goes from 0.18 to 0.09 and \(P_S = 0.92 \times 0.86 \times 0.91 =\) 0.720 — any short-range link. The same lever on the medium-range SAM reaches 0.702, and on the long-range SAM only 0.677.

So what: the outer layer, with the most impressive reach, carries the least risk; the point defense at the target carries the most. The lever goes where \(r\) is largest, and inside that SAM every link pays the same — so buy the cheapest one.

Exposure: risk by the kilometer

The type-along and the quick problem counted encounters by hand. A route planner needs to count them from geometry, and that is the idea Block 4 builds its survival metric on.

A SAM site cannot shoot at what it cannot see and cannot reach. Call the stretch of your route that lies inside both its detection contour and its missile engagement zone (MEZ) the site’s lethal zone — L32 draws both boundaries. Inside that zone the site fires on a cycle: a shot, a pause to assess and reload, another shot. At your airspeed that cycle corresponds to a fixed distance \(\Delta s\) of your track, so the site gets one shot every \(\Delta s\) kilometers you spend inside its zone.

Detection is already settled by the geometry — you are inside the contour or you are not — so each shot kills with the rest of the chain, \(p_{\text{shot}} = P_{T|D}\,P_{I|T}\,P_{H|I}\,P_{K|H}\). Fly \(\ell\) km inside the zone and you give the site \(\ell/\Delta s\) independent shots. Twice the kilometers, twice the shots, twice the risk. Written out,

\[ P_{S,i} = \left(1 - p_{\text{shot}}\right)^{\ell/\Delta s} = e^{-\lambda_i \ell}, \qquad \lambda_i = \frac{-\ln\left(1 - p_{\text{shot}}\right)}{\Delta s}, \]

where the hazard \(\lambda_i\) is the site’s risk per kilometer of exposure. Over a whole route the risks add, \(r = \sum_i \lambda_i \ell_i\), and \(P_S = e^{-r}\). This is the survival metric of the Final Project (task T2, computed separately for ingress and egress), and L34 turns it into the cost of every edge in a route graph.

Revisit: the Kill Chain Explorer

The in-class demo today is L1’s Kill Chain Explorer, revisited. Open it again and click each link. This time, for every discipline the side panel lists, answer two questions of your own: which block gave you that lever, and which symbol of \(P_K = P_D\,P_{T|D}\,P_{I|T}\,P_{H|I}\,P_{K|H}\) it shrinks. Watch the Kill panel in particular — not everything on it is vulnerability reduction. The ES / EP / EA drill below the chain is still worth a pass if you have not seen it since L1.

MATLAB bundle · L31_PKChain.m↓

The companion script L31_PKChain.m puts numbers on the same chain for a notional four-threat route. Its lever menu is realistic about reach: a signature cut buys less against a low-band radar, a self-protect jammer is burned through by a close-in SAM, flares fool only an IR seeker, and hardening acts on every hit. It tabulates the \(P_S\) gain of every lever against every threat — the zeros are where a lever does not apply — adds a route that denies one site a shot, and ranks them all for the whole route. Run it and ask why the winner wins.

Block 4 and the Final Project

Block 4 is built around one capstone: an individual Final Project, 20% of the grade and in lieu of a final exam, in which you route a B-21 through an integrated threat and write the analysis up as an IEEE journal paper. It is issued today, and every lesson adds a layer:

• L31 — the survival metric: per-site chain, hazard and route \(P_S\) (T2).

• L32 — the threat map: aspect-dependent detection contours, MEZ and LEZ (T1).

• L33 — their track on you: how well the adversary’s passive network can locate you along your route (T4).

• L34 — the route: Dijkstra on a risk graph, the risk-versus-length trade, and a fuel-limited choice (T3).

• L35 — the pop-up threat: localizing a new emitter on the next leg (T6).

• L36 — the support package: a standoff jammer and one SEAD nomination (T5).

• L37 — limitations and future threats.

The milestones: a required checkpoint at L35 (feedback only — your approach, a first T1 laydown figure, and the four course lessons, one per block, you plan to cite), a work day at L38, a complete draft at the start of L39 for in-class peer review, a second review due before L40, a revision day at L40, and the final paper at the start of L41 with your response to reviewers, your code, and any AI transcripts. The handout on the Final Project page carries the full rules, including what AI may and may not do for the paper.

Wrap-Up

Survivability is the ability to avoid or withstand the threat, and Ball’s split makes that a product: \(P_K = P_H\,P_{K|H}\), susceptibility times vulnerability. Along the L1 chain, one engagement’s \(P_K\) is the product of five conditional links, so every lever you own — from any block — shrinks one factor, and Ball’s two toolkits sort those levers by whether they act before the hit or after it. Across a route, independent encounters multiply, \(P_S = \prod_i(1 - P_{K,i})\), and the logarithm turns that product into a sum of risks, \(r = -\ln P_S\), which is exactly the kind of cost a route planner can minimize. Next, L32 draws the geometry that decides which sites get to shoot at all: detection contours, the radar horizon, and the MEZ and LEZ rings.