Modern Beyond Line of Sight T&E with Autonomous Systems

A sentiment often touted by testing professionals, at least in U.S. military arenas, is that the complexity of the testing phase required to get to the “promised land” of a fielded system is often underemphasized in planning by the larger team. This article will delve into a specific field that continues to see this burden realized across the services, specifically on the testing of missile systems. Like all systems governed by the acquisition framework, these systems must pass a rigorous testing phase to deploy, however, the technology required to support this is cumbersome, redundant, complex, subjected to harsh environmental conditions, and limited by challenging Size, Weight, and Power (SWAP) constraints. Additionally, as will be discussed further, such paradigms are quickly becoming obsolete due to the required cadence of test and deployment. The specific technology being referred to are Telemetry Modules and Flight Termination Systems or TM/FTSs.

Even though the telemetry functionality and the flight termination functionality are separate and governed by different policy, their complimentary nature has them generally referred to as one unit. TM/FTSs are part of a system of systems, and on DoW systems, are reliant on line-of-sight radio systems, except for vertical launch applications which are adopting modern technologies to be discussed later. Each part of the TM/FTS system must be qualified and approved and if any portion of the system fails it either precludes the launch or will likely result in a flight termination event during the test event.

The aerial units are qualified through formal processes and are certified by a Range Safety Engineer, first at the component level, then at the module level, then at the all-up-round level. Additionally, the required signals and range infrastructure sending and receiving those signals are certified. The Range Safety Officer, who is ultimately responsible for keeping operations contained in a safe environment and responsible for the flight termination decision and action if a barrier excursion is imminent, holds the final responsibility for the operation of the TM/FTS, the range, and the test event that supports a military system’s development.

In addition to the constraints above, the TM/FTS itself has a requirement for reliability of components that are part of the flight termination system, governed by Range Commander’s Council 319 Flight Termination Commonality Standards of .999 with 95% confidence [1]. This concept is ubiquitous across DoW for systems that require a TM/FTS to test. The AGM-88 High-speed Anti-Radiation Missile (HARM) is one of the oldest of the systems in this category and it was approved for full rate production in March of 1983 [2]. Even though the missile stopped being produced in the early 2000s, there is still a production team that supports new TM/FTS systems for the missiles to support test events. Although the spectrum bands used have changed over time to accommodate more information flow required by more modern systems than the AGM-88 HARM, the same line-of-sight and reliability constraints exist today. As such, TM/FTS architectures as they exist today are rapidly becoming inadequate. Constrained to line of sight and a constant high-fidelity tone, current TM/FTSs are not prepared to meet the demands of systems in development with ranges that go well beyond the horizon, let alone the scarcity of available spectrum to test. Modern technologies need to be used to remedy this obsolescence; NASA and the U.S. Space Force are already doing it. In an article from 2022, US Space Force Colonel Pat Youngson discusses the benefits of Autonomous Flight Safety Systems and how the legacy methods have a complex amount of infrastructure on the ground required to support flight events and how those systems are vulnerable to weather phenomena and even factors like wildlife digging and chewing near the radar systems. [3] Autonomous safety systems eliminate the need for that infrastructure and its inherent vulnerabilities altogether. The desired transition to autonomous safety systems is not new but is rather over 20 years old. NASA began research and development efforts in the early 2000’s and began flying test hardware in 2006. The first test article, known as Test Article 1 (TA1), “was flown on a two-stage NASA Sounding Rocket from White Sands Missile Range on April 5, 2006. It consisted of a single chassis, dual processor unit with inputs from two GPS receivers” [4].

1. Exploring Beyond Line-Of Sight

Beyond line-of-sight (BLOS) telemetry is a cornerstone capability for modern flight testing of high-performance vehicles, unmanned aerial systems (UAS), and hypersonic platforms. Traditional ground-based telemetry links become increasingly unreliable and bandwidth-limited as test articles travel beyond radio horizon distances (typically 40-60 km) [5]. Compounding this are stringent safety requirements imposed by range authorities, mandating rapid fail-safe termination if telemetry or command links degrade below critical thresholds [6]-[7]. Existing BLOS solutions—including tropospheric scatter, high-frequency (HF) skywave propagation, satellite relays, and airborne command relays—introduce unacceptable latency, excessive path loss, spectrum congestion, and infrastructure costs that undermine test cadence [8]-[9], [10]-[12]. To sustain the accelerating pace of vehicle development—driven by both commercial launch providers and defense hypersonic initiatives—ranges must adopt architectures that (1) secure continuous safety-critical command and telemetry BLOS, (2) minimize ground support footprint, and (3) compress turn-around times between tests. Autonomous Flight Termination Systems (AFTS) promise to satisfy these imperatives by relocating key safety logic onboard the vehicle itself [13]. In further discussion this paper will examine the technical challenges of BLOS data collection, surveys existing telemetry mitigation strategies, traces the evolution of flight termination systems (FTS), and provides an in-depth analysis of AFTS design, certification, and operational performance. Case studies highlight real-world deployments, and prospective research directions are identified.

2. Survey of BLOS Telemetry Methods

The implementation of telemetry can vary depending on the platform it will be installed on. Traditionally, telemetry operates under a RF line-of-sight operation where the System under Test (SuT) has a direct communication path between itself and receiver system. Therefore, when considering beyond-line-of-sight system, another system in between the SuT and the receiver system must be utilized to “relay” the information from the SuT to the receiver due to the loss of a direct communication path. Therefore, various architectures have been surveyed with the BLOS telemetry options fall into five broad categories: tropospheric scatter, HF skywave, geostationary relays, airborne relays, and LEO/mesh networks. Each presents tradeoffs that affect reliability, latency, and cost.

Troposcatter systems project energy into the lower troposphere and receive a small, scattered fraction beyond the horizon. Prediction models and recent NTIA work show troposcatter entails very large excess losses relative to LOS and that losses grow rapidly with range and modest antenna aperture. Examples from public propagation materials illustrate total link losses for some 100-km troposcatter configurations in roughly the 120–155 dB range depending on frequency and antenna choices, and measured channels often exhibit deep fades that demand diversity or large margins to sustain continuous links. From current literature, these losses and fading characteristics make troposcatter difficult to deploy as the sole safety-critical, low-latency path without substantial infrastructure and cost [14]. Another challenge is that these losses and fading characteristics may introduce significant bit-error rate (BER) which would require significant Eb/N0 that a receiver system may not be able to support given a particular size, weight, and power requirement.

HF skywave propagation can cover continental distances, but ITU prediction guidance documents significant diurnal, seasonal, and solar-activity dependence that alters path reliability on minutes-to-hours timescales. HF channels exhibit multipath dispersion therefore have time-varying delay and reliability characteristics unsuitable for a deterministic sub-second termination channel unless supplemented with redundant sensing and conservative safety margins. Such communication supplements would yield a larger infrastructure and may not be suitable for most current and modern ranges. System designers therefore typically treat HF as a lower-priority backup or as situational telemetry rather than as the primary fail-safe termination channel [15].

Airborne relays decrease path loss and latency compared to distant ground stations, but they create operational burdens: flight coordination, additional platforms/crew, refueling cycles, and spectrum coordination. In practice a decision to use an airborne relay involves this tradeoff, they can be highly effective for specific missions but raise logistical complexity and incremental program cost that must be quantified on a per-mission basis [16].

GEO relays provide broad, continuous coverage and high aggregate capacity at the cost of propagation delay. A straightforward equatorial up/down calculation yields a minimum one-hop round-trip propagation delay on the order of ∼240 ms; practical GEO use adds gateway switching and processing delays on top of this physics baseline. As a result, GEO may be used but LEO architectures may be more suitable for telemetry. LEO architectures (commercial constellations and mesh networks) offer much lower propagation delay than GEO and, under favorable conditions, median latencies in the low tens of milliseconds with multi-Mbps throughput. Public operator documentation and independent measurements document these improvements [17], but handover robustness, service-level agreements, and certification to range-safety-critical use remain unsettled operational and regulatory topics.

Other possible solutions involve integrating the same ground-based receiver system onto unmanned surface vessels (USV’s) or unmanned aerial vehicles (UAV’s); however, these are still solutions that modify the existing infrastructure at a basic level. The challenge of a single legacy BLOS method that simultaneously meets the needs for deterministic sub-second fail-safe termination, low operational cost, and minimal instrumentation for all mission types is still very much an unknown solution especially in considering possible changes at the SuT level, especially considering that such relay or “middle-man” solutions may create undesirable delays for a range to qualify such an overall architecture when considering critical safety data. With these limitations, motivation exists in relocating the final termination decision onboard the vehicle under a well-documented AFTS safety case.

3. Evolution of Flight Termination Systems

FTS designs have evolved from simple, ground-command tone systems to sophisticated digital links and finally to onboard autonomous termination.

Early FTS relied on continuous ground beacons; loss of tone or frame integrity would be treated as a command failure and—after a specified timeout per the range/equipment acceptance criteria—could lead to termination. Range guidance describes test procedures and acceptance checks but does not prescribe a single global frequency band or fixed timeout; these are defined in range-specific and equipment-specific documentation. Tone systems were simple and robust for LOS but are vulnerable when RF links are blocked or when ground infrastructure is unavailable [16].

Later generations introduced spread-spectrum and forward-error-corrected command links, which improve anti-jam and multipath performance. Extending coverage through airborne or surface relays permitted BLOS operations but increased logistical overhead. Relay-augmented networks can be effective for specific missions but add cost, scheduling complexity, and additional single points of failure unless carefully engineered with redundancy [14], [16].

The move to onboard termination logic began with demonstration programs that integrated redundant GNSS, inertial sensing, and mission-rule evaluation into vehicle-resident avionics. NASA’s AFSS program documented Phase activities, test articles, and design goals showing that relocating the decision loop onboard reduces reliance on downrange assets and shortens the operator dependency chain. AFSS materials, and the later NASA NAFTU initiative which released reference software to industry, articulate that numerical performance characteristics such as navigation update rates and termination latencies are implementation-dependent and must be established during vendor qualification and range acceptance testing. The literature therefore frames AFTS as an architectural shift that trades some ground complexity for onboard verification and certification work [18]-[19]. It is in an AFTS system that enables mitigation for beyond line of sight use cases at the SuT level rather than at the ground receiver or infrastructure level.

4. AFTS Architectural Deep-Dive

AFTUs are engineered as no-single-point-of-failure systems combining redundant sensing, a safety-certified software kernel, and redundant initiation hardware. Vendors and program materials emphasize environmental hardening and formal qualification steps.

Public vendor pages and NASA program documentation describe AFTU hardware baselines that include multiple GNSS receivers and antennas, inertial measurement units for short-term navigation during GNSS degradation, barometric altimeters for cross-checking altitude, dual-lane or lockstep processors for computational redundancy, watchdog supervisors for processor health monitoring, and redundant squib/ignition drivers with separate initiation paths. These hardware building blocks are assembled so that a single component failure does not produce inadvertent termination; exact sampling rates, IMU class, and GNSS update rates are component-specific and are verified during supplier qualification and range acceptance tests, specifically given RCC-319 requirements. The manufacturer product briefs and program documentation therefore present architecture tenants rather than a universal parts list; the safety argument depends on the components selected and the demonstration evidence provided during certification [18].

Software in an AFTU follows airborne assurance best practices. Typical functional blocks are input validation, time-synchronized data conditioning, sensor fusion (commonly an extended Kalman filter or equivalent), mission-rule/geofence evaluation, arming and inhibit logic, event logging, and a command sequencer that drives redundant hardware initiation paths. Program and vendor documentation highlight the use of software-in-the-loop (SIL) and hardware-in-the-loop (HIL) testing, model-based analyses, and—where appropriate—formal verification methods; detailed test plans, test counts, and coverage metrics are presented in program- and vendor-specific qualification reports rather than in high-level summaries [18], [20].

AFTUs use fused GNSS/INS solutions to create a resilient navigation state. Mission geofences (polygons, spherical capsules, and other mission constraints) are pre-computed during mission planning, encoded into mission-data tables, and signature-protected during loading. During flight the safety kernel evaluates the vehicle state against these constraints at rates sufficient for the safety case; the required update rate is a derived property of vehicle dynamics, sensor latency, filter bandwidth, and the termination decision time budget. Range guidance (RCC family and NAFTU artifacts) prescribes tools and workflows for geofence generation, checksum/signature checks, and pre-load verification; constrained in-flight updates can be supported but require additional verification and explicit range approval [16]-[19].

To prevent inadvertent activation, acceptance cases include arming and inhibit logic (arming only in well-defined mission phases), mechanical and electrical interlocks, dual-channel initiation circuitry, and post-fire telemetry capture where practical. Initiation circuitry is designed so that a single-point hardware failure cannot produce a destructive event. Vendor product briefs and range technical guidance document typical dual-path initiation designs and the need for acceptance testing that demonstrates integrity under environmental and electromagnetic stress.

AFTU qualification is a multi-domain activity. Environmental testing typically follows MIL-STD families (vibration, shock, temperature cycling), and EMC/EMI testing commonly references MIL-STD-461 and MIL-STD-464 series baselines in supplier test plans. Software assurance evidence (unit tests, integration tests, SIL/HIL test matrices, and where applicable, formal analysis results) is collected and presented to the range in a complete safety package. Qualification requirements stem from RCC-319 standards which include fault-injection and recovery testing, interface compatibility tests with vehicle avionics, and end-to-end functional testing with simulated and live mission-data loads. The exact test magnitudes, sequences, and acceptance criteria are recorded in the supplier qualification reports and the range acceptance documentation.

5. AFTS Use Case and Future Directions

Public program material and vendor reporting provide examples of the design posture, verification approaches, and operational impacts of AFTS.
NASA’s AFSS program materials and associated phase reports document the program objectives, hardware/software architecture, and multiple demonstration activities (road tests, sounding rocket flights, and launch integration exercises). AFSS reporting frames the onboard decision approach to shorten operator dependency chains and to reduce reliance on downrange RF assets; AFSS program documents present the program’s test configurations and the evidence collected during demonstrations while reserving implementation-specific performance metrics for the program test reports and vendor qualification documents. In short, AFSS demonstrations validated the concept and provided program-specific data that are included in the AFSS program test records [18].

NAFTU release provided reference implementations and integration guidance to speed industry adoption of onboard termination logic. NAFTU materials show recommended mission-data workflows, verification tooling, and integration checkpoints that vendors and range authorities can adopt. Industry press and vendor inquiries reflect active evaluation and adoption plans informed by NAFTU reference material; vendors typically include NAFTU-conforming test modes in their qualification matrices when pursuing range acceptance [19].

Vendor product briefs and public reporting from range and defense outlets indicate that, when validated AFTUs are carried onboard, the number of special-purpose downrange relays and the scale of certain ground instrumentation needs are reduced for many mission profiles. That operational simplification often translates into increased schedule flexibility and reduced logistics load. Precise program-level cost and timing savings are mission-dependent; quantified impacts should be reported from the applicable procurement or after-action study that generated the metric. Range offices and industry reporting emphasize the need to base any universal numeric claim on the underlying program test reports and contracting deliverables [21].

AFTS shifts complexity from range infrastructure into the qualification and verification domain. The net operational benefit is realized when the safety case, qualification evidence, and mission-data handling workflows reduce the need for costly relay platforms and permit denser launch/testing cadence without compromising public safety. The path to adoption therefore emphasizes rigorous supplier qualification, transparent acceptance evidence, and explicit range procedures for mission-data management.

Legacy LOS-dependent TM/FTS architectures have delivered decades of safe operations, but physics, programmatic realities, and modern test envelopes expose limitations in reliability, latency, and cost when operating beyond the radio horizon. Traditional BLOS telemetry approaches struggle to meet simultaneous requirements for low latency, high reliability, and affordable operations. By relocating termination authority onboard, AFTS eliminates LOS dependencies and many single-point ground failures, while achieving stringent detection-to-termination timelines under rigorous certification regimes.

Felipe Jauregui
Andrew Starn
Frank Heinsohn
Leonard “Lenny” Meuse
Andy Corzine
Greg “Crewser” Crewse
Tom Dowd, SES
Holli Galletti, SES
Don Blottenberger, SES

Distribution Statement A: Approved for public release; distribution is unlimited. NAWCWD PR25-0204.

[1] Range Commanders Council, Flight Termination Systems Commonality Standard (RCC 319-25), White Sands Missile Range, NM, June 2025.

[2] United States Air Force, AGM-88 HARM Fact Sheet, Washington, DC: U.S. Air Force, Mar. 1983. [Online]. Available: https://www.af.mil/About-Us/Fact-Sheets/Display/Article/104574/agm-88-harm/

[3] A. Mahshie, “Automating Launch Safety Is Helping the Space Force Speed Up the Tempo,” Air & Space Forces Magazine, Mar. 11, 2022.

[4] J. B. Bull and R. J. Lanzi, Autonomous Flight Safety System, NASA Glenn Research Center, Cleveland, OH, NASA Technical Report, Sept. 2007.

[5] R. Miura, K. Honda, and Y. Tanaka, “Performance of Multi-hop Command and Telemetry Communication System in 169 MHz Band for Operation of Drones Beyond Line-of-Sight,” Robotics & Mechanical Engineering Journal, vol. 5, no. 2, pp. 112–121, 2022.

[6] NASA, Range Flight Safety Requirements (NASA-STD-8719.25, Baseline with Change 1), Feb. 5, 2018. [Online]. Available: https://standards.nasa.gov/sites/default/files/standards/NASA/Baseline/1/nasa-std-871925_baseline_with_change_1.pdf

[7] Federal Aviation Administration, Advisory Circular AC 450.115-1B: Flight Safety Systems, Washington, DC, Aug. 2024.

[8] International Telecommunication Union, Method for the Prediction of the Performance of HF Circuits (Recommendation ITU-R P.533-14), Geneva, Switzerland, Aug. 2019. [Online]. Available: https://www.itu.int/dms_pubrec/itu-r/rec/p/R-REC-P.533-14-201908-I%21%21PDF-E.pdf.

[9] International Telecommunication Union, A Method to Predict the Statistics of Clutter Loss for Earth-Space and Aeronautical Paths (Report ITU-R P.2402-0), Geneva, Switzerland, Mar. 2017. [Online]. Available: https://www.itu.int/pub/R-REP-P.2402-2017

[10] S. Watts and L. Rosenberg, “Challenges in radar sea clutter modelling,” IET Radar, Sonar & Navigation, 2022.

[11] International Telecommunication Union, Propagation data and prediction methods required for the design of Earth-space telecommunication systems (Recommendation ITU-R P.618-14), Geneva, Switzerland, Sept. 2023. [Online]. Available: https://www.itu.int/rec/R-REC-P.618.

[12] E. M. Jean Paul Santos, “RF Transmission Through Unique Environments in Communication Systems,” in Proc. 2024 IEEE INC-USNC-URSI Radio Science Meeting (Joint with AP-S Symposium), pp. 235–235, 2024.

[13] J. C. Simpson, “Autonomous Flight Safety System (AFSS): A Prototype Development Project of GSFC Wallops and KSC,” NASA Technical Report, NASA/TM–2010-36666, 2010. Available: https://ntrs.nasa.gov/api/citations/20100036666/downloads/20100036666.pdf.

[14] R. A. Dalke et al., “TR-22-557: Tropospheric Scattering: Theory, Predictive Models, and Worked Examples,” NTIA, Feb. 2022. Available: https://its.ntia.gov/publications/download/TR-22-557.pdf.

[15] ITU-R, “Rec. P.533 — Propagation data and prediction methods required for the design of HF radiocommunication systems,” ITU. Available: https://www.itu.int/dms_pubrec/itu-r/rec/p/R-REC-P.533-14-201908-I!!PDF-E.pdf.

[16] Range Commanders Council, Telemetry Applications Handbook, RCC-119-06, May 2006. Available: https://www.trmc.osd.mil/wiki/download/attachments/113019893/119-06_Telemetry_Applications_Handbook.pdf?api=v2.

[17] SES S.A., How Does Orbital Altitude Affect Satellite Network Performance, Blog post, Betzdorf, Luxembourg: SES, Apr. 1 , 2021. [Online]. Available: https://www.ses.com/blog/how-does-orbital-altitude-affect-satellite-network-performance

[18] NASA, “Autonomous Flight Safety System (AFSS) — Phase III Technical Summary,” NASA NTRS, 2009. Available: https://ntrs.nasa.gov/api/citations/20090022215/downloads/20090022215.pdf.

[19] NASA Wallops Flight Facility, “NASA releases Autonomous Flight Termination Unit (NAFTU) software to industry,” Jan. 2022. Available: https://www.nasa.gov/centers/wallops/news/press-releases/2022/nasa-releases-autonomous-flight-termination-unit-software-to-industry.

[20] RTCA, “DO-178C: Software Considerations in Airborne Systems and Equipment Certification,” RTCA. Available: https://www.rtca.org/content/do-178c.

[21] J. Mahshie, “Automating launch safety is helping the Space Force speed up the tempo,” Air & Space Forces Magazine, Mar. 2022. Available: https://www.airandspaceforces.com/autonomous-flight-safety-systems-helping-the-space-force-speed-up-the-tempo/.