Jherrod ThomasThe Lion of Functional Safety™

May 9, 2026 · 14 min read

ARP4761DO-178C / DO-254DO-160G

When Ham Radio Crashes the Transponder

An $8 million FAA airworthiness directive on the Boeing 787 doesn't read like a software bug or a hardware defect. It reads like a missing row in a Functional Hazard Assessment, a missing entry in a DO-160G test envelope, and a Common Mode Analysis no one wrote down. The fix is a part-number swap. The lesson is much older.

The public story is short: the FAA published AD 2026-04832 on March 12, 2026, made it effective April 16, and gave US operators four years to swap out the left and right Integrated Surveillance System Processor Units (ISSPUs) on roughly 150 US-registered Boeing 787-8 / -9 / -10 aircraft. Per-aircraft cost: about $53,001 — call it $7.95 million across the US fleet. The trigger was multiple reports of the Mode S transponder dropping out when the airplane entered airspace with continuous-wave (CW) RF interference present: amateur radio, military beacons, anything narrow-band and persistent in the right slice of spectrum. The transponder failed silently. ATC stopped seeing replies. TCAS — the airborne collision-avoidance system — stops working when the transponder it depends on stops talking.

This is an aerospace story, so the standards lens is ARP4754A / ARP4761 / DO-178C / DO-254 / DO-160G, not ISO 26262. The DAL letters here are A through E, not ASIL A through D. But the structural failure — a credible operating environment that didn't make it into the qualification envelope — is the same one I write up every other week from the automotive and industrial worlds. Different acronyms, identical failure mode in the safety lifecycle.

Let me put the rows in the table.

1. The public record

What the regulator said, what the manufacturer said, and what the press did with it.

The FAA AD. AD 2026-04832, published in the Federal Register Vol. 91, No. 48 on March 12, 2026, adopts a final rule replacing notice of proposed rulemaking 2024-04032 (Federal Register 2026-04832). The AD's Discussion section is, for once, refreshingly plain:

"This AD was prompted by a report of multiple instances of loss of transponder for airplanes entering airspace in the presence of continuous wave (CW) interference where the transponder did not meet the minimum operational performance standards (MOPS) requirement of transponder response in the presence of CW interference in that the transponder did not correctly reply to at least 90 percent of the interrogations."

The MOPS in question is RTCA DO-181 (Mode S airborne equipment). DO-181 has long required a transponder to keep replying to at least 90 percent of valid interrogations under specified interference conditions. The 787 ISSPU did not.

The unsafe condition the FAA names directly: "un-annunciated loss of Mode S transponder function and subsequent un-annunciated loss of traffic collision avoidance system advisory messages, which could lead to loss of separation from other airplanes and a mid-air collision." Two words there are doing all the work: un-annunciated (twice). The pilots don't know. ATC doesn't know. TCAS doesn't know. The hole in the safety net is invisible from inside the cockpit.

The fix. Replace ISSPU part numbers 822-2120-101 and 822-2120-102 with 822-2120-113, per Boeing Alert Requirements Bulletin B787-81205-SB340065-00 RB, Issue 001, dated February 11, 2025 (Justia mirror of the Federal Register entry).

Cost & fleet impact. The FAA estimated 150 US-registered aircraft, $340 labor + $52,661 parts per ship, $7.95M total (Aeronautics Online). Affected operators: United, American, Alaska. Compliance window: four years.

What the press chose to focus on. The reporting fixated on the irony — amateur radio is grounding airliners — which is good copy and bad framing. CW interference is not exotic; it's a known RF environment. The interesting question is why the qualification envelope didn't catch it. (Paddle Your Own Kanoo, Aviation A2Z.)

2. The standards lens

This is where my notes diverge from the trade-press version. The 787's ISSPU is a Collins Aerospace box — the integrated successor to a stack of separate transponder, TCAS, terrain, and weather radar LRUs (Collins Aerospace ISS family). Integration buys weight and power savings. It also creates shared failure modes between functions that, on legacy aircraft, lived in independent boxes and could not fail the same way at the same time. That is exactly the territory ARP4761 was written for.

Walk through the V-model the way a certification credit chain actually requires:

ARP4754A (system development) / ARP4761 (safety assessment). The very first artifact is the Functional Hazard Assessment (FHA). At the aircraft level, "loss of Mode S transponder function" is not a new hazard — it has been written up since the 1970s. The aircraft-level FHA classifies it. The relevant function (let's call it F-XPDR-01: Provide ATC and TCAS with valid Mode S replies under all in-flight conditions) maps to a failure condition FC-XPDR-01: Un-annunciated loss of Mode S replies to ground and airborne interrogators. Per the standard FAA failure-condition severity ladder (Catastrophic / Hazardous / Major / Minor / NSE), the un-annunciated case sits at Hazardous (HAZ) in cruise and Catastrophic (CAT) in dense terminal airspace if loss of separation results. That maps to DAL B at the system level for software (DO-178C) and complex hardware (DO-254). The requirement that flows from this — the transponder must be available within a quantified probability budget under the full operating environment — is older than I am.

Where the trace breaks. The CW-interference scenario is supposed to be caught in two places.

  1. Equipment-level qualification: DO-160G Section 20 (Radio Frequency Susceptibility). Section 20 specifies conducted susceptibility from 10 kHz to 400 MHz and radiated susceptibility from 100 MHz upward, with equipment categories that are intentionally tied to HIRF criticality (RTCA DO-160 Section 20 — ATEC). The Mode S receiver is in band — interrogations are at 1030 MHz, replies at 1090 MHz — but the susceptibility test envelope has historically focused on out-of-band CW and pulsed energy near safety-critical frequencies. If the ISSPU's analog front-end has a desensitisation mechanism (intermod, AGC capture, or LNA compression) excited by a narrow CW carrier in a band the bench plan didn't specifically sweep, it walks straight through the Section 20 sign-off.
  2. System-level Common Mode Analysis (CMA) and Particular Risks Analysis (PRA) per ARP4761. CMA asks whether two channels that the FHA has assumed independent can fail together for a single root cause. The 787 has two ISSPUs — left and right — exactly so the loss of one doesn't take the function down. But two identical units exposed to the same external CW field at the same antenna group will fail at the same instant. That is by definition a common-mode failure, and a competent CMA should have written that row.

The MOPS conformance gap (DO-181's 90-percent-reply rule) is downstream of both of these. The MOPS describes what good looks like at the equipment boundary. It doesn't tell you which environments to test against — that's DO-160G's job for environment, ARP4761's job for architecture. When the bulletin reads "the transponder did not correctly reply to at least 90 percent", the question to ask is not "why didn't the box pass DO-181?" — it's "why did the integration test plan let a box ship that doesn't?"

The honest answer, given that the fix is a hardware part-number change to the same module from the same supplier, is that the qualification envelope didn't include the right CW spectral profile. The new ISSPU 822-2120-113 is presumably better-shielded or has improved selectivity at the offending frequencies. Same form, same fit, slightly different function. That tells you the design intent was correct and the test envelope was the artifact that failed.

3. A worked snippet — FHA row, DO-160G test row, fault tree

3.1 Functional Hazard Assessment (system level)

| ID | Function | Failure Condition | Phase | Effect on Aircraft / Crew | Classification | DAL | Mitigation already in design | |---|---|---|---|---|---|---|---| | FHA-XPDR-01 | F-XPDR-01: Provide Mode S replies to ATC & TCAS interrogations under all in-flight environmental conditions | FC-XPDR-01: Un-annunciated loss of Mode S replies on both ISSPUs simultaneously due to common external RF environment | Cruise / dense-terminal | ATC loses surveillance; airborne TCAS RAs not generated against ego; risk of loss of separation; Catastrophic in dense terminal airspace, Hazardous in cruise | HAZ → CAT | DAL B (software DO-178C; complex HW DO-254) | Dual-channel ISSPU, dual antennas, BIT (built-in test) at power-up | | FHA-XPDR-02 | F-XPDR-01 | FC-XPDR-02: ISSPU is alive but replies fall below MOPS 90% under in-band/near-band CW illumination | Any | Same as FC-XPDR-01 with no BIT trigger | HAZ → CAT | DAL B | (None — gap. BIT does not detect partial reply failure under CW.) |

The second row is the one nobody had. That is the missing artifact. The mitigation column has the word "(None — gap.)" in it because the in-service BIT cannot tell the difference between "no interrogation arrived" and "the interrogation arrived but the reply path was suppressed by RF capture in my own front-end."

3.2 DO-160G Section 20 test row (illustrative, not the actual qual report)

| Parameter | Original Section 20 entry (legacy) | Required entry | Gap | |---|---|---|---| | Conducted susceptibility frequency sweep | 10 kHz – 400 MHz, swept at category H levels | Same | Pass | | Radiated susceptibility frequency sweep | 100 MHz – 18 GHz, anechoic chamber, category Y levels | Same | Pass | | CW dwell time at narrowband carriers within ±50 MHz of 1030 / 1090 MHz | Swept-only, no dwell | Dwell ≥ 60 s at 1 dB below the desensitisation threshold predicted by the LNA model, swept across the in-band exclusion zone in 100 kHz steps | Open — added as test envelope change for ISSPU -113 | | Antenna-port intermod susceptibility (two-tone, in-band + nearby CW) | Not in plan | Two-tone with f1 = 1030 MHz interrogation, f2 = swept CW carrier 800–1300 MHz; reply rate measured per DO-181 §2.2.x | Open — added | | Acceptance criterion | DO-181 reply success ≥ 90 % under interference profiles A–C | DO-181 reply success ≥ 90 % under profiles A–C and a documented CW-stress profile representative of operational airspace | Open |

That last column — "Open" — is what an internal DER would have written. Three "Open" rows on the test envelope of a DAL-B function are not a footnote.

3.3 Fault tree (top event: un-annunciated loss of Mode S replies, both channels)

Top: Un-annunciated loss of Mode S replies, BOTH ISSPUs, in cruise/terminal
        AND
        ├── Channel L ISSPU fails to reply ≥ 10% of interrogations (silent)
        │       OR
        │       ├── L1. RF front-end desensitisation by external CW (in/near band)
        │       ├── L2. AGC capture at LNA by narrowband interferer
        │       ├── L3. Receiver intermod product lands on Mode S detector
        │       └── L4. BIT does not flag partial reply failure (no error path)
        ├── Channel R ISSPU fails to reply ≥ 10% of interrogations (silent)
        │       OR
        │       ├── R1. (same modes as L1–L4, identical front-end design)
        │       └── R2. (same antenna group → correlated illumination)
        └── Common external CW environment exists at both antennas at same instant
                OR
                ├── E1. Aircraft transits airspace with high-power CW emitter
                └── E2. Onboard unintentional emitter (aux equipment) excites front-end

The interesting topology of the tree is the AND at the top with identical OR branches beneath. ARP4761 calls this a dual-channel common-mode failure. The architectural intent (two channels) gives you redundancy against uncorrelated failures. CW-induced desensitisation on a shared external environment is correlated. Two channels of the same susceptible part = one channel for the purpose of this hazard.

This is the row that the Common Mode Analysis was supposed to write. If it was written and accepted, someone owes a written rationale. If it was not written, that is the corrective action.

4. Derived requirements (excerpt)

These are the requirements I would write into the Tier-1's Problem Report and the OEM's Service Bulletin trace before signing off on the new ISSPU -113.

The numbering convention (REQ-XPDR-1xx) is mine — a real program would slot these into its own DOORS / Polarion / Codebeamer module — but the shape is the deliverable: stable IDs, allocated to a level (System / Architecture / Verification / Process), with a verification method that someone can bid on.

5. What the headline really tells us

The trade press leaned on the amateur radio grounded airliners angle. That's the irony hook. The engineering hook is much less satisfying:

A DAL-B aircraft surveillance function shipped with a qualification envelope that didn't include the dominant in-band CW environment of its actual operating airspace, and a redundant architecture whose two channels were identically susceptible to the same common-mode RF condition.

The fix is a part-number change because the design intent was always right. The failure is not in the silicon. The failure is in the test plan and the Common Mode Analysis row that was never written. Those are documents. Documents are cheap to fix once and very, very expensive to fix 150 airplanes at a time.

Every week I get asked, by OEMs and Tier-1s in every domain I work in — automotive, aerospace, robotics, industrial — "how do we avoid this kind of headline?" The answer is the same in every domain: the headline is downstream of an artifact you didn't fill out. Find the empty cell in the FHA / HARA / TARA / FMEA before the regulator finds it for you.

If you operate a 787 fleet, the AD compliance work is its own conversation. If you build any DAL-B (or ASIL-B-and-up, or SIL-2-and-up) sensor whose failure is un-annunciated, the conversation is older than the AD: what's your detection of a silent partial failure, and is it diverse from the failure path it's supposed to catch?

If you want to walk through what an updated CMA, FHA-row patch, and DO-160G test envelope change would look like for your own program, the contact link on the main site is the fastest way to reach me.

— Jherrod Thomas, The Lion of Functional Safety™

Sources