Airliner Air Force: Survivability for Militarized Commercial Aircraft
by Dr. Torg Anderson and Dr. Lenny Truett
As an attractive, cost-saving measure, the Services are looking more and
more at large commercial aircraft to accomplish select missions. While this may avoid the high development costs of a new platform, the savings go beyond the purchase price, since tried-and-true commercial airplanes have demonstrated low operating costs and high reliability. To further support this argument, the manufacturer and airline logistics systems can be adopted to reduce operational costs.
While this cost saving may be extremely appealing, there are hidden costs that must be understood. In the area of survivability, you get what you pay for.
There are numerous recent examples—
- The infamous KC–767 Air Force tanker is no longer in the plan,
but it wasn’t even going to be purchased by the Air Force—it
was a lease arrangement.
- The Air Force is proceeding withthe Multi-Mission Command and Control Aircraft (MC2A), or E–10A platform, to replace a number of current aircraft that provide Intelligence, Surveillance, and Reconnaissance (ISR) capabilities
and will be fully interoperable with other aircraft and systems. The E–10A will use an extended range version of the Boeing 767, adding electronics and sensors to accomplish its mission.
- The Army leads the Aerial Common Sensor (ACS) program using a modified Lockheed-Martin Embraer ERJ–145 regional jet with electronic sensors to monitor enemy electronic emissions. This is intended to replace the Army’s RC–12 Guardrail and the Navy’s EP–3E ARIES II aircraft.
- The Navy has selected a variation of the Boeing 737 as the platform for its Multi-Mission Maritime Aircraft (MMA) to replace the aging P–3 Orions for anti-submarine warfare. This system is expected to be extremely versatile and capable of conducting a wide range of other combat and non-combat missions.
Since commercial aircraft weren’t designed to operate in a combat environment, survivability wasn’t considered in their designs. Safety is a major requirement for the airlines,but this is only a starting point for combat vulnerability requirements.
For some systems, such as the MMA, confrontations with enemy threats
are expected during combat missions. For others like the E–10A, the Services indicate that the system operate clear of the threats and be shielded by suitable support aircraft.
However, if these aircraft accomplish their missions effectively, they will
be central features of the U.S. battle force and, as such, will be high value
targets for enemies with resourcefulness and capabilities to reach them.
The ability to add vulnerability reduction to a commercial platform varies as much with each program as it does with the platforms. One thing is certain though—it’s more difficult to include these features in existing commercial designs for numerous reasons—
- The whole reason for purchasing a commercial system is the attractive low cost. Expensive changes in design are contrary to this initial philosophy.
- Since the design is virtually complete when the Service program begins, the manufacturer and the program resist any significant design changes. This
simply adds time and cost.
- The pre-existing aircraft design puts vulnerability analyses and vulnerability reduction further behind the schedule than usual. It’s hard to sell extensive test requirements that would further delay the program.
- To exacerbate the problem, manufacturers are reluctant to release design details because of intellectual property concerns.This also interferes with the
vulnerability reduction effort, putting it further behind.
Whether designed for commercial or military use, though, aircraft have some common vulnerability issues when considered for combat. Most of these are obvious. The aircraft structure is directly vulnerable to ballistic impacts. The flight controls are also directly vulnerable or may be incapable of compensating for structural or aerodynamic damage from a combat threat. Fuel tanks introduce vulnerabilities related to hydrodynamic ram structural damage or fires generated in the air space within the tanks. Dry bays provide
opportunities for sustained fire when combustibles are ignited directly by ballistic threats or by other ignition sources through cascade damage mechanisms. Survivability common solutions can be brought to bear.
Redundancy and separation of systems are obvious vulnerability reduction
methods that can be applied to commercial aircraft if the basic design is
not extensively affected. Redundancy in flight controls, hydraulic systems
and structural members can significantly reduce vulnerability by preventing
single ballistic encounters from affecting critical functions. These considerations come with cost, weight and reliability penalties, though. For commercial applications, component and system reliabilities may be such
that redundancy isn’t necessary. In military applications, the penalties
may still be significant, but the advantages to vulnerability reduction are
Two vulnerability reduction technologies developed for combat aircraft over the last couple of decades offer significant improvements for survivability in many platforms. Fuel tank ullage inerting replaces combustible air with nitrogen in the fuel tank air space so that an ignition source is not sufficient to start a fire or create an explosion.
The C–5 Galaxy employs an inerting system using liquid nitrogen. Commercially available on-board inert gas generating systems (OBIGGS) are capable of
separating nitrogen from the air for this purpose. The weight and volume
of these systems is significant, but may be acceptable on larger platforms
such as commercial aircraft. Survivability analyses and the appropriate trade studies can evaluate the
effectiveness of this capability.
Dry Bay Fire Suppression (DBFS) systems have also demonstrated their
effectiveness in live-fire tests. These consist of fire detectors, control systems and suppressors that discharge agents in response to fire indications.
These agents interfere with the combustion chain reactions and extinguish
the fires. Since dry bay fires are a significant contribution to the potential vulnerability of an aircraft, DBFS systems can greatly improve survivability. These components are compact and can easily be accommodated in commercial aircraft designs with little penalty, but there is a significant
design and test effort required to ensure their effectiveness.
Another advantage of commercial aircraft designs is their extensive operational history that can be used to identify possible design issues. Maybe more importantly, accident and incident histories provide insight into the differences in commercial and military design philosophies that affect vulnerability.
Some specific examples can illustrate this—
- Cargo doors on two DC–10’s were improperly latched on the ground and were blown off the aircraft as they climbed above 10,000 feet. The resulting
explosive decompression created a pressure differential that buckled the cabin floor, causing interference with the flight controls. In one case, control of the
aircraft was lost and it crashed with the loss of 346 passengers and crew. Corrective action was repair of the cargo door to prevent improper latching.
- Loss of hydraulic power and resulting loss of all aircraft controls resulted when the fan disk on the #2 engine of a DC–10 disintegrated and ruptured
hydraulic lines in the tail of the airplane. A landing was attempted using differential engine control, but the aircraft crashed. One-hundred eleven
out of 296 people on board were killed.
- An ullage explosion in the center wing fuel tank of a Boeing 747 resulted from an electrical short outside of the tank that created an electrical arc in the ullage space (postulated cause, but never proven). The aircraft
disintegrated killing 212 people.
- Loss of rudder control and a hard-over rudder resulted in loss of control of 737’s in three instances. In one case, control of the aircraft was regained. In
the others, the aircraft crashed killing 157 people. The likely cause was associated with the single hydraulic rudder control actuator, although the specifics were never determined.
Perhaps the most apparent difference between commercial and military aircraft
design is in the philosophy used to address potential cascade failures.
The DC–10 cargo door cases demonstrate this most vividly. In these examples,
safety depends on preventing the initiating event to disrupt the cascade
chain. The corrective action was to fix the cargo door design and eliminate
the possibility of that event. The potential for the remaining cascade
remained, but presented no problems in subsequent operations. Similarly,
there would have been no problem in the DC–10 hydraulic failure and the
747 ullage explosion events without the initiating event.
When designing for vulnerability reduction, though, the initial event is a ballistic encounter and is given (thus, Pk/h is the probability of a kill given a hit). Survivability must depend on design features that break or eliminate the subsequent cascade chains.
As mentioned earlier, redundancy and separation of systems treated the same in commercial and military designs. In commercial aircraft, cost saving can be made using single but very reliable components and routing aircraft systems
to common “service centers” so that they can be easily accessed from a
single location. Vulnerability reduction in combat aircraft suggests
that redundancy and separation of redundant systems should be applied
at the expense of reliability and ease of maintenance. The DC–10 hydraulic
failure and 737 examples expose critical subsystems in these specific
commercial aircraft that could be extremely vulnerable to single ballistic
encounters. These subsystems would be prime candidates for redesign
if these aircraft were to be used in military applications.
Commercial aircraft designs can provide huge cost benefits when applied to military program needs, but programs should consider that, in part, these savings result from reduced survivability. The programs must recognize and accept the costs necessary to get survivability back into the system. Two general aspects of vulnerability reduction need to be considered.
Some basic vulnerability reduction techniques can be effective for any
large platforms and should be considered for every commercial platform
used in a military application. Ullage inerting and dry-bay fire suppression
significantly improve survivability as has been demonstrated in numerous
live-fire test programs. These systems can be implemented as addons
to the basic aircraft and have little impact on the platform’s basic design. Programs should plan for the expenses of these systems and the design efforts necessary to ensure their effective implementation.
Programs need to understand the differences in philosophy in designing
commercial versus combat aircraft and evaluate the design with these differences in mind. This may help to identify survivability weaknesses that might have otherwise been overlooked. This gives the program a chance to correct these deficiencies and make significant improvements in the aircraft’s overall effectiveness.