Commercial aviation can be protected from the threat of explosives in two ways, either by preventing explosives from reaching the aircraft (e.g., by using explosives-detection technologies) or by mitigating the effects of an explosive by protecting the aircraft from an onboard explosion (e.g., via aircraft hardening and hardened containers). A combination of these two approaches may provide the best protection of commercial aviation. In this chapter the panel discusses the development of aircraft-hardening concepts in general and blast-resistant (hardened) containers in particular.
Despite more than 50 bombing incidents in the 25 years prior to the 1988 terrorist bombing of Pan Am Flight 103, the U.S. government and the commercial aircraft manufacturers of the time (i.e., Boeing, Lockheed, McDonnell Douglas, and Airbus) had limited knowledge of the characteristics of internal bomb blasts and the related vulnerabilities of commercial aircraft. All that was known was that blast forces exceeded the design loads of the aircraft, which were never designed to survive a bombing attack. Little, if any, blast data were available, and few analysis techniques were applicable to commercial aircraft. Furthermore, not much was known about protection techniques.
As a result of nearly 10 years of joint FAA, Department of Defense, and industry research, several tools and resources have been identified and, in some cases, developed to characterize internal blasts and to measure the response of aircraft to certain types of bomb blasts. Data are now available defining the effects of "bare-charge" explosives in narrow-body aircraft (via both testing and analysis) and suitcase-contained explosives in both narrow-body aircraft (via testing only) and ULDs in wide-body aircraft (via testing only) (National Institute for Aerospace Studies and Services, 1996; McDonnell Douglas, 1997). The characteristics of bomb blasts and fragmentation from suitcase-contained explosives and suitcase-contained explosives in fully loaded containers have been defined through extensive testing. And the behavior of fuselage skin panels and joints under high-strain rates (i.e., under bomb blast conditions) is now better understood.
As the commercial aviation industry has become much more aware of internal blast-damage mechanisms, it has begun to identify methods for protecting aircraft. This new information has already been a factor in design considerations for reducing the vulnerabilities of aircraft systems and structures to an internal blast in the cargo hold areas of new commercial aircraft. Despite this progress, viable near-term solutions have yet to be demonstrated for protecting the current commercial fleet through retrofitting. Current aircraft designs are, however, already fairly resistant to internal explosionsas evidenced by the 57 percent survival rate of aircraft for all in-flight bombing incidents (35 events) in the past 25 years (Schwartz et al., 1995). Nevertheless, a single bombing event that results in the loss of life or property is not acceptable to the airlines, the economy, or society as a whole.
Although the direct hardening of aircraft does not appear to be feasible for the current fleet, hardened containers are being investigated by the FAA and other international air-worthiness authorities as an alternative near-term solution. Using HULDs (hardened unit-loading devices) to protect aircraft from explosive attacks is not a new concept. Airlines that operate in high-risk areas of the world have been using custom-built containers since well before the Pan Am 103 tragedy. However, because these containers are much too heavy for general use, only one or two are used per aircraft for carrying select items.
As a result of the back-to-back bombings of two wide-body aircraftPan Am 103 in 1988 and UTA Flight 772 in
1989international accident investigation organizations, congressional committees, and other government authoritiesbegan to promote research into methods of hardening aircraft and ULDs against explosives. In the United States, the FAA began funding research on hardened containers, including blast characterization analyses and the development of blast-tolerant design concepts. The basic goal was to develop operationally feasible HULDs that could withstand the blast and fragmentation forces of an explosion.
Initial operational concepts were based on the idea that an aircraft could be protected by using blast-resistant HULDs in place of all standard ULDs. However, for this idea to be feasible, HULDs would require similar cost, weight, and operational capabilities as standard ULDs.
Design Guidelines and Procurement
Following Pan Am 103, the British Air Accident Investigations Branch recommended that "airworthiness authorities and aircraft manufacturers undertake a systematic study with a view to identify measures that might mitigate the effects of explosive devices" (British Air Accident Investigation Branch, 1990). Major initiatives on hardened containers were begun in the early 1990s, when the FAA launched a series of concept studies, including analyses, testing, and development, with approximately 15 different contractors and support organizations (similar efforts were undertaken in Europe). Studies included government-funded research and development by the U.S. Navy, U.S. Air Force, U.S. Army, Boeing, Northrop, Jaycor, Galaxy Scientific Corporation, the Great Lakes Composites Consortium (GLCC), and others. In addition, many companies initiated internally funded independent efforts on the assumption that hardened containers represented an emerging market area. Research and development continued through the mid-1990s and produced data on blast characteristics, material properties, the feasibility and effectiveness of HULD concepts, and modeling and simulation requirements.
After about five years, however, because of slow progress on an effective, feasible design conceptand because of a less than enthusiastic response from the airlinesno major breakthroughs had been made. Although many concepts were investigated, none was identified as a "silver bullet" that would immediately replace current ULDs. Research did not lead to a hardened container that looked, behaved, and cost the same as a standard ULD, and airlines were not willing to support concepts that would add weight, cost, or operational constraints to their infrastructures.
Although the FAA has considered many approaches to deploying HULDs, in the past few years the focus has been on HULDs as an integral component of the entire security system that would be deployed at the level of one or two per aircraft in conjunction with passenger screening and CAPS (this approach is consistent with the TAAS approach recommended in this report). Only a small percentage of passenger bags carried in the HULD would be based on predetermined selection criteria. The FAA hoped this approach would be acceptable to the airline industry because it would reduce the requirements for the deployment of HULDs.
In 1996, the FAA announced the first of two procurement solicitations for hardened containers that could contain an explosion from a defined explosive threat size and could be deployed into normal airline operations. Six proposals were submitted by various suppliers. However, after determining that none of the proposed concepts would meet the design blast criteria, the FAA decided not to award any contracts (Hacker, 1998a). After redefining the requirements, the FAA released a second solicitation in January 1997 (FAA, 1997d). The requirements for the second solicitation are given in Box 5-1. The FAA received eight proposals in response to the second solicitation, and two proposals, by Jaycor and Galaxy, were selected for development and testing. Both were required to demonstrate compliance with the standards listed in Box 5-2.
Under the terms of the FAA HULD contracts, Jaycor and Galaxy were contracted to provide prototype HULDs that could withstand the blast effects from a bomb of a certain size and configuration (the blast-resistance criteria for HULDs are classified [ISO 6517]). Each company was required to demonstrate the survivability of its HULD design either through a blast test or a simulation analysis. Both companies decided to meet this requirement through blast tests.
Prior to 1997, the FAA and industry had conducted numerous blast tests on earlier designs and had developed test standards (ISO 6517) for the two candidate HULD designs. The HULD test program, which was initiated in late 1997 in Tucson, Arizona, was performed in a salvaged, unpressurized, lower cargo-hold section from a Boeing 747 aircraft that included the basic aircraft structure (e.g., airframe, stringers, skin panels, shear clips, wall liners, cargo floor beams, and passenger floor beams), as shown in Figure 5-1. Although most of the major aircraft systems had been removed, much of the wiring, cables, and air ducts were intact. Each HULD was placed separately into the cargo-hold area at a standard container lock-down location. No other containers were included in the tests. Test objectives included verification (1) that the HULD could withstand the explosive blast with no rupture or fragmentation; (2) that no fragments penetrated the HULD or the aircraft structure; (3) that the HULD had not moved or jumped causing structural damage to the aircraft (i.e., airframe, cargo floor, or passenger floor); and (4) that no fire had erupted after the blast.
The blast tests took place at a private facility adjacent to Davis-Monthan Air Force Base in Tucson. Four different HULD concepts were tested: the Jaycor and Galaxy HULDs, a third HULD concept developed by Contemporary Products (funded independently), and an FAA-sponsored "foam-offset" protection method using a standard aluminum LD-3 container. Table 5-1 provides basic descriptions of the four containers.
The first container tested was the Galaxy HULD concept in October 1997. The container failed the test when the floor base separated from the wall, mainly along a manufacturing joint. Galaxy reviewed the failure mode, modified the design, and performed a second test with the FAA in March 1998. This time the HULD survived the blast test (see Figures 5-2 and 5-3). The blast caused some external deformation of the container and some minor deformation to one of the 747 passenger floor beams but no serious structural damage to the aircraft. The temperature inside the HULD peaked at 400°F, after which fire-safety personnel applied water to the HULD. The HULD contained the blast, fragments, and
also any potential fire. This Galaxy container meets all of the FAA design and blast criteria and has been certified. The FAA Transport Airplane Directorate Certification Office documented the certification on July 29, 1998 (FAA, 1998). A second Galaxy Scientific design passed the FAA blast test required for certification in January 1999.
The first prototype of the Jaycor HULD was tested in March 1998. In this test, the HULD failed because of separation of the composite ceiling material and the failure of the container door. Jaycor reviewed the failure mode and modified the prototype for a second test that was conducted in January 1999. However, the HULD again failed the blast test because of a failure around the door area.
Blast tests were also conducted on a HULD developed by Contemporary Products. This container, developed with funding from the state of Wisconsin, was made of an E-glass-based composite and weighed 1,100 pounds (four times more than a standard ULD). When the unit was tested, the HULD split at a manufacturing line, and the door separated in an explosive manner. Although the unit itself failed the test, there was minimal damage to the airframe structure. In flight, however, damage could have been much more extensive because of the presence of other containers and pressurization.
The foam-offset concept consisted of a standard aluminum LD-3 with a 12-inch-thick rigid-foam block on the sloped panel of the ULD. This configuration prevents the placement of luggage adjacent to the sloped wall of the LD-3, thus ensuring standoff distance between an explosive device and the aircraft skin panels to reduce shockholing and, potentially, blast forces. The foam offset was originally tested by the British in the Bruntingthorpe test and showed very promising results (Morrocc, 1997). The idea was especially attractive because it was low cost, added little weight, and required little retrofitting.
For the FAA test, the explosives-containing suitcase was placed near the bottom of the container close to the sloping panel. The explosive blast and attendant fragmentation ripped through the foam offset, the LD-3 aluminum wall, and the skin of the aircraft. It also caused some damage to
the floor beams. Thus, despite the positive results from Bruntingthorpe, the test under the FAA blast criteria was an obvious failure. Table 5-2 summarizes the test results.
Even though a certified HULD is now available, the FAA has not developed a deployment plan for airline service. The idea of replacing all existing containers with HULDs has been abandoned because of its impracticality in terms of weight, cost, and operational factors. The alternative deployment scenarios range from 100 percent utilization on international flights to single-container usage on all flights or on selected flights. Table 5-3 shows the estimated costs of the single HULD per aircraft scenario. The cost to cover the fleet for a single HULD per plane is estimated to be $125 million in acquisition costs plus an unknown recurring cost, which could be substantial. If all standard ULDs were converted to HULDs, the acquisition costs alone could reach $2.5 billion.
If a single HULD is used per flight or for selected flights, the contents of the HULD would have to be carefully selected. Contents could include the following items:
• selectees' bags from CAPS
• selected bags from cleared EDS alarms
• unaccompanied luggage
• mail and other cargo
The FAA reports that an initial deployment plan will be developed after the initial purchase of several Galaxy HULD units and a test deployment with an airline (Hacker, 1998b). The test deployment will enable the FAA to assess operational implications, such as maintenance requirements, repairability, and baggage flow. The FAA will also be able to determine if a HULD maintains its blast strength after
being subjected to the typical wear and tear of airline operations. Originally, the FAA planned to purchase and deploy as many as 60 containers for this assessment. However, because of program changes and budget constraints, the number has been reduced to 10, which are currently being tested by two air carriers.
The concerns listed below have been raised by the airline industry through the International Air Transport Association (IATA) and the ATA about the cost and operational aspects of HULDs (Rork, 1994; IATA, 1995):
• HULDs weigh more than ULDs (weight affects aircraft range and payload capacity).
• HULD procurement costs are higher than ULD costs.
• HULDs may require extra maintenance (e.g., non-traditional materials, training, and testing).
• Certain HULDs could reduce cargo volume (which could cause a loss of revenue).
• Airline costs could be higher because of extra weight and maintenance.
• HULDs may not be available for every flight if maintenance problems arise.
In addition to these general concerns, the airlines have also questioned the utility of the recently certified HULD design, which some have called "inadequate" because of the design and location of the door, which uses the entire in-board (aircraft centerline) side of the container and swings open as a single hinged unit that sweeps a large arc. This rear-door design is not compatible with the design of airline bag rooms, bag carts, and loading processes. Despite these problems, some carriers say they may be amenable to using HULDs if they are limited to one per aircraft.
The FAA has procured 10 HULDs in the current configuration (rear door) from Galaxy for airline deployment. Three airlines volunteered to use these HULDs for a one-year trial period. In addition, the FAA procured a new HULD prototype (from Galaxy) with a side door (the traditional location) that passed the blast certification test in January 1999.
Conclusions and Recommendations
Overall, the FAA has conducted a reasonable effort in sponsoring and driving the development of HULDs. As a result of FAA/industry efforts, a certified airworthy HULD design is available for deployment. Nevertheless, the panel believes that significant improvements could be made in HULD designs, testing, and operations.
The panel's greatest concern is that research and development on HULDs have not been conducted on an SOS (system-of-systems) approach. The HULD has largely been developed and designed as a single stand-alone entity, and limited research has been done on its role and integration into a TAAS (total architecture for aviation security). Coordination with the airlines, airports, and aircraft manufacturers has been mainly in the areas of specific design and utility requirements. The FAA and airlines have not focused on the interactions, boundary conditions, and trade-offs of using HULDs along with other security measures, such as passenger profiling and baggage screening. The panel believes that alternative, more practical, HULD designs could still be developed.
The FAA should not deploy hardened unit load devices unless they are determined to be a necessary security feature of the total architecture for aviation security (TAAS), as determined by the FAA and other stakeholders, on the basis of cost, operational, and deployment studies.
The FAA should go forward with the planned operational testing of hardened unit load devices.
The FAA's approach to HULD design has been focused primarily on three areas: airworthiness, ground handling, and blast resistance. Little attention has been given to operational and support (O&S) issues or systems-integration issues. O&S considerations, which, include inspection, certification, and repair, should be addressed concurrently with HULD development. These issues are very important, even in the early development phase. A HULD that cannot be supported or repaired would be essentially useless to the industry. Therefore HULDs should be "designed for supportability."
The research and development of hardened containers for narrow-body aircraft are lagging far behind the work on containers for wide-body aircraft. This panel believes that a HULD for narrow-body aircraft must be available before the FAA recommends, mandates, or regulates the use of hardened containers for airline operations. Both narrow-body and wide-body aircraft are used on many international routes, especially to Central and South America, and even on several routes between the United States and Europe. Flying narrow-body aircraft without hardened containers and wide-body aircraft with hardened containers on the same routes would be analogous to flying certain types of aircraft over water without "life vests." The risk is still the same, but the level of protection is lower.
The FAA should continue to support research and development on hardened unit-loading devices. In addition to performance, operational considerations (e.g., operability, supportability, inspection, and repair) should also be addressed.
Before the FAA recommends, mandates, or regulates the use of hardened containers for airline operations, the issue of containing explosions aboard narrow-body aircraft must be resolved. The FAA should pursue the development of hardened unit-loading devices for narrow-body aircraft.
The FAA has successfully tested two HULD prototypes produced by Galaxy Scientific, in the cargo hold of a salvaged aircraft. One had a rear-door configuration, the other a side-door configuration. Both HULDs survived the blast, and no fire was observed. In the panel's opinion, certifying a HULD on the basis of one blast test is not credible for the following reasons:
• The FAA requires "self-extinguishing" of any fire initiated in a HULD, but fire safety (in the panel's opinion) cannot be verified by a single test.
• A single full-scale blast test (in addition to component and material tests) does not rigorously test the HULD. Although there is a fairly good understanding of test requirements and procedures, single-test certification is questionable because of the variability in test parameters, such as bomb placement in the HULD, explosive charge performance, differences in luggage, and differences in luggage contents.
The FAA could remedy this situation in two ways. First, a more rigorous test plan could involve a series of tests in a pressurized aircraft (or representative test facility) over a range of conditions (e.g., explosive configurations, baggage-load scenarios). Second, Monte Carlo analyses (i.e., probability distributions to estimate the outcome of a statistical event) could be used to test a range of conditions.
The FAA should implement a more rigorous test plan for certifying hardened unit-loading devices. The plan should include a series of blast tests, as well as modeling and simulation (e.g., Monte Carlo analyses). To carry out this test plan, the FAA will probably have to improve its modeling and simulation capability and construct more robust testing facilities.
HULD Deployment and Operation
Although the FAA has recently certified two HULD prototypes and initiated a limited deployment, no comprehensive plan for integrating HULDs into the container logistics system of an airline has been developed. Issues that remain to be addressed include type of aircraft, number of HULDs per aircraft, and the type of baggage or cargo put into HULDs.
A deployment strategy to use HULDs to transport the bags of CAPS selectees and bags cleared by an operator after an explosives-detection equipment alarm raises legal issues. On the one hand, airlines have expressed concerns about their liability if a container (i.e., a HULD) known to contain bags considered more of a threat than other bags is put aboard an aircraft. On the other hand, if there were an inflight explosion resulting in hull loss, the airlines might be held liable for not using available HULD technology.
The deployment strategy described above also raises some logistical issues. Introducing hardened containers into the airline system, especially in small numbers, would reduce aircraft loading flexibility. Airlines currently separate baggage by class of service and destination to expedite handling. This process begins in the baggage make-up area, where specific containers are allocated to different destinations and then separated by class of service. Selectee bags that varied by destination and/or class of service would require either multiple hardened containers or changing the baggage-handling and sorting process.
The hardened containers tested to date exceed the acceptable weight criteria specified by the airlines through ATA (Rork, 1994). Container weight has a significant impact both on ground handling systems and aircraft loading systems. In addition, for structural survivability, a "best location" is identified for HULD(s) aboard each aircraft type, which may conflict with optimum weight and balance requirements. Also, to accommodate late-check-in "selectees," the HULD(s) would have to be one of the last containers loaded onto the aircraft and might require that containers already onboard be off-loaded to ensure proper loading arrangement by destination, weight, and cargo classification. Finally, a means of tracking would have to be developed to ensure that HULDs were available for each flight.
Container weight also has a significant impact on fuel and revenue displacement. IATA's preliminary cost estimates for the procurement and support of HULDs included a fleet-wide annual recurrent cost of more than $5.0 billion1 and a nonrecurrent cost of $600 million. However, in the panel's opinion, some of the assumptions underlying these calculations are not accurate, and the costs are overestimated. The panel's estimate for a single HULD per wide-body aircraft is substantially lower. The recurring O&S costs (which could be very substantial) cannot be estimated yet, but other recurrent costs are estimated to be about $11 million for an inventory of one HULD per aircraft. The panel estimates that the nonrecurrent cost would be $125 million.
The FAA should work closely with airlines on the development and deployment of hardened unit-loading devices.
In consultation with the airlines, the FAA should develop cost estimates for recurring and non-recurring costs to the airlines for the deployment and operation of hardened unit-loading devices (HULDs) based on a single HULD per flight for both wide-body and narrow-body aircraft and for 100 percent deployment.
1 The $5 billion per year recurring cost projected by IATA reflects lost commerce because of the weight of HULDs. For example, if HULDs increase the weight of an airplane, an equal amount of cargo cannot be shipped on the plane. IATA categorized this loss of revenue as a recurring cost.