1
Review of Current Methodologies Used to Assess Aircraft Vulnerability and Identification of Applications of the Results1

What Are the Threats to Military Aircraft?

When the military began to use aircraft in war, the opposing forces began using weapons in an attempt to destroy them. In the first half of the twentieth century, guns were the primary weapons used against aircraft. These guns were either surface-based or carried by enemy aircraft. They ranged from the small arms weapons, such as the 0.3/0.303-inch (7.62/7.7-millimeter) and 0.50-caliber (12.7-millimeter) machine guns, to anti-aircraft artillery (AAA), such as the 40-millimeter and 88-millimeter caliber guns of World War II (WW II). Contemporary guns that can be used against aircraft include the 5.56-millimeter, 7.62-millimeter, 12.7-millimeter, 14.5-millimeter, and 20-millimeter small arms, and the 23-millimeter, 30-millimeter, 37-millimeter, 57-millimeter, 76-millimeter, 85-millimeter, and 120-millimeter AAA. The small arms weapons typically fire ball ammunition, or armor-piercing projectiles, known as AP rounds, or AP projectiles with incendiaries, known as API rounds. The AAA weapons and the larger-caliber aircraft guns usually fire ballistic projectiles with a high-explosive (HE) core and a surrounding metal case. These are referred to as HE warheads or HEI warheads when incendiaries are included.2 The HE warheads may detonate on contact with the aircraft (contact-fuzed HE warheads), after an elapsed time since firing (time-fuzed HE warheads), or in proximity to the aircraft (proximity-fuzed HE warheads).

After World War II, guided missiles, both surface-based and airborne, were developed to kill aircraft. These anti-air weapons typically carry contact- or proximity-fuzed HE warheads designed to kill aircraft with fragments and blast. Guns and guided missiles are still the primary threat faced by aircraft today. However, several new threats to aircraft are in development. Directed energy weapons, in the form of low-to-medium power lasers and high-power microwaves, have the potential to damage or destroy sensors on the aircraft and the weapons they are carrying; and high-power lasers can damage major aircraft structure. Chemical and biological weapons pose a threat to aircraft, particularly on the surface, and nuclear weapons are a threat to aircraft on the surface and in the air.

What Is Aircraft Vulnerability?

Aircraft survive a mission into hostile territory by “avoiding” the damage-causing mechanisms of the enemy’s air defense and by “withstanding” the damage caused by these mechanisms when they cannot be avoided. The aircraft attribute known as susceptibility refers to the inability of

1

Much of the material presented in this chapter is based upon Ball (1985).

2

Some of the small-caliber AAA also fire API rounds.



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 11
typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original Review of Current Methodologies Used to Assess and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. Aircraft Vulnerability and Identification of Applications of the Results1 1 warheads when incendiaries are included.2 The HE warheads What Are the Threats to Military Aircraft? may detonate on contact with the aircraft (contact-fuzed HE warheads), after an elapsed time since firing (time-fuzed HE When the military began to use aircraft in war, the opposing warheads), or in proximity to the aircraft (proximity-fuzed HE forces began using weapons in an attempt to destroy them. In warheads). the first half of the twentieth century, guns were the primary After World War II, guided missiles, both surface-based and weapons used against aircraft. These guns were either surface- airborne, were developed to kill aircraft. These anti-air based or carried by enemy aircraft. They ranged from the small weapons typically carry contact- or proximity-fuzed HE arms weapons, such as the 0.3/0.303-inch (7.62/7.7- warheads designed to kill aircraft with fragments and blast. millimeter) and 0.50-caliber (12.7-millimeter) machine guns, Guns and guided missiles are still the primary threat faced by to anti-aircraft artillery (AAA), such as the 40-millimeter and aircraft today. However, several new threats to aircraft are in 88-millimeter caliber guns of World War II (WW II). development. Directed energy weapons, in the form of low-to- Contemporary guns that can be used against aircraft include medium power lasers and high-power microwaves, have the the 5.56-millimeter, 7.62-millimeter, 12.7-millimeter, 14.5- potential to damage or destroy sensors on the aircraft and the millimeter, and 20-millimeter small arms, and the 23- weapons they are carrying; and high-power lasers can damage millimeter, 30-millimeter, 37-millimeter, 57-millimeter, 76- major aircraft structure. Chemical and biological weapons millimeter, 85-millimeter, and 120-millimeter AAA. The small pose a threat to aircraft, particularly on the surface, and arms weapons typically fire ball ammunition, or armor- nuclear weapons are a threat to aircraft on the surface and in piercing projectiles, known as AP rounds, or AP projectiles the air. with incendiaries, known as API rounds. The AAA weapons and the larger-caliber aircraft guns usually fire ballistic projectiles with a high-explosive (HE) core and a surrounding What Is Aircraft Vulnerability? metal case. These are referred to as HE warheads or HEI Aircraft survive a mission into hostile territory by “avoiding” the damage-causing mechanisms of the enemy’s air defense and by “withstanding” the damage caused by these 1 Much of the material presented in this chapter is based upon Ball mechanisms when they cannot be avoided. The aircraft (1985). 2 Some of the small-caliber AAA also fire API rounds. attribute known as susceptibility refers to the inability of 11

OCR for page 11
12 VULNERABILITY ASSESSMENT OF AIRCRAFT the aircraft to avoid (being damaged by) the man-made hostile components whose kill result in the loss of an essential typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original environment and is measured by PH, the probability the aircraft function. Essential functions are those functions required to is hit by a weapon while on its mission. The aircraft attribute prevent an aircraft kill. The essential functions that prevent an known as vulnerability refers to the inability of the aircraft to attrition kill are lift, thrust, and control of flight, and the withstand (the damage caused by the) hostile environment and ability to land safely. Navigation and weapons delivery are and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. is measured by PK/H, the probability the aircraft is killed3 given two possible essential functions for a mission abort kill. An that it is hit. The probability the aircraft is killed by a particular example of a critical component for the attrition kill is the weapon while on the mission is PK, which is equal to PH•PK/H. single pilot who controls the flight of the aircraft. If the pilot is The probability the aircraft survives the encounter with the killed (i.e., he/she is unable to perform the essential function weapon is PS, which is equal to 1–PK, which is the same as 1– of control of the aircraft) the aircraft is also killed. An example PH•PK/H. Thus, reducing an aircraft’s susceptibility (PH) and of a critical component on an attack aircraft for the mission vulnerability (PK/H) to the weapons likely to be encountered in abort kill is the weapons delivery computer. If the computer is combat increases its survivability. An aircraft’s susceptibility killed, the weapons cannot be released at the correct time; can be reduced by destroying the enemy air defense elements, consequently, the pilot will return to base prior to mission by reducing the aircraft’s signatures (stealth), by employing on- completion. board and off-board threat warning systems and electronic Components that do not contribute to any of the essential countermeasures, and by the tactics employed. An aircraft’s functions become critical when their response to a hit (i.e., vulnerability can be reduced by using redundant and separated their kill mode) causes the kill of another component that is components, by locating components to minimize the critical because it contributes to an essential function. For possibility and extent of damage, by designing components to example, consider the bombs carried on-board an attack contain or withstand the effects of damage, by adding special aircraft. The bombs do not contribute to the essential equipment to suppress the damage, by shielding components, functions for flight of lift, thrust, and control. However, if one and by removing vulnerable components from the design. A of the bombs explodes when hit by a fragment or bullet, and very important aspect of vulnerability reduction is that many the explosion kills the pilot or any other critical components design features are effective against a number of different threat on the aircraft, the bombs are critical components because weapons. For example, locating redundant flight control their kill mode (explosion) eventually leads to a kill of the hydraulic components on opposite sides of the aircraft and aircraft.5 The propagation of damage from the hit component inerting the fuel tank ullages will provide protection from both to other components is known as cascading damage. gun projectiles and proximity-fuzed missiles in most situations. Pyrotechnic items, such as infrared flares, are also critical Thus, in many situations it is not necessary to consider all of the components when their reaction to a hit leads to a fire and the individual threats when designing the aircraft. eventual loss of the aircraft. The critical components can be nonredundant, such as the Critical Components and Essential Functions. Each single pilot and single engine on a single-piloted, single- component in the aircraft has a level, degree, or amount of engined aircraft, or redundant, such as the two engines on a vulnerability to the damage-causing mechanisms4 generated two-engined aircraft. When the critical components are by the threat weapon; and each component’s vulnerability redundant, a kill of more than one of the redundant contributes in some measure to the vulnerability of the total components is required for a kill of the aircraft. In general, the aircraft. The critical components on an aircraft are those critical components on a particular aircraft depend only upon the selected kill category (and level, if appropriate) and the assumed kill mode(s), and not upon the threat weapon.6 3 The word kill is used here in a general sense. The vulnerability The procedure used to determine all of the nonredundant assessment community uses several definitions of kill. Two categories of and redundant critical components on an aircraft is known as kill are the attrition kill and the mission abort kill. There are several levels of attrition kill based upon the elapsed time of kill after the hit. For the critical component analysis. Two different types of example, the K-level attrition kill is defined as a kill in which the aircraft analyses can be used, the Failure Mode and Effects Analysis falls out of control within 30 seconds after the hit, and the A level is (FMEA) and the Fault Tree Analysis (FTA). In the FMEA, all defined as a kill in which the aircraft falls out of control within 5 minutes after the hit. possible failure, damage, or kill modes of a component or 4 Damage, threat, or kill mechanisms are the output of the threat subsystem are identified and the consequence of each warhead that cause damage to the aircraft. The types of damage mechanisms associated with penetrator and high-explosive warheads are penetrators, fragments, incendiaries, and blast. Damage processes refer 5 The treatment of the on-board munitions when assessing aircraft to the interaction of the damage mechanism with the aircraft and its vulnerability is a major concern to the committee, particularly for aircraft components. The damage processes associated with the damage with internal ordnance storage. This concern is examined in detail in mechanisms listed here include ballistic impact, penetration, combustion Chapters 2 and 4. (in the form of a fire or explosion), hydraulic or hydrodynamic ram, 6 Refer to footnote 3 for several examples of kill definitions. and blast loading.

OCR for page 11
REVIEW OF CURRENT METHODOLOGIES AND IDENTIFICATION OF APPLICATIONS 13 TABLE 1–1 List of Some Subsystem Damage-Caused Failure (Kill) Modes [Ball, 1985] typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original Propulsion Subsystem Fuel Subsystem Flight Control Subsystem Fuel ingestion Fuel supply depletion Disruption of control path Foreign object ingestion In–tank fire/explosion Loss of control power and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. Inlet flow distortion Void space fire/explosion Loss of aircraft motion data Lubrication starvation Sustained exterior fire Damage to control surfaces Compressor case perforation Hydraulic ram Hydraulic fluid fire Combustor case perforation Turbine section failure Power Train/Rotor Structural Subsystem Structural removal Blade!Propellor Subsystem Exhaust duct failure Loss of lubrication Pressure overload Engine control/accessories Mechanical/structural damage Thermal weakening failure Penetration Electrical Subsystem Severing or grounding Crew Subsystem Mechanical failure Injury, incapacitation, or death Avionics Subsystem Overheating Penetrator/fragment damage Fire/explosion/overheat Armament Subsystem Fire/explosion component failure/damage/kill mode upon each of the causes a jam of the actuator and a loss of control of the control essential functions is determined. 7 In the FTA, those surface. An example of the latter is a fuel ingestion kill of an component or subsystem kill modes required to cause the loss engine due to a hit on a fuel tank adjacent to the air inlet. of the essential functions are determined. Reducing the vulnerability of an aircraft to the threat weapons and their damage mechanisms involves reducing Kill Modes. For many years, the aircraft vulnerability the likelihood the kill modes given in Table 1-1 will occur community has observed the results of live fire testing of when the aircraft is hit. components, subsystems, and aircraft and has examined the combat data on damaged and killed aircraft in order to The Failure Mode and Effects Analysis (FMEA). As an determine all of the kill modes associated with each of the example of the FMEA process, consider a single-engine aircraft subsystems. For example, there are five kill modes aircraft with only two fuel tanks, one in each wing. The tanks associated with the fuel subsystem. When a fuel tank is holed are partially full, and there are fuel vapors in the ullage8 of the by a penetrator or fragment, a catastrophic explosion or major tanks. The possible kill modes for the fuel subsystem are fire may occur inside the tank, or fuel may leak from the hole given in Table 1-1. One fuel tank kill mode is an explosion in the tank into an adjacent void space or dry bay and catch inside the tank. If the consequence of the internal explosion fire, or hydraulic ram damage to the fuel tank wall may cause a in either wing tank is the destruction of the wing containing major structural failure of the tank or allow fuel to dump into the tank, which then causes a kill of the aircraft due to loss of engine intake ducts, causing an engine kill. A list of some of lift, both wing fuel tanks are nonredundant critical the possible kill modes for each of the major subsystems on an components for the attrition kill for the internal explosion aircraft has been compiled based upon these observations and kill mode. On the other hand, suppose the kill mode of the studies. This list is presented in Table 1-1. tanks is a loss of fuel storage capability due to one or more The kill modes listed in Table 1-1 describe different types holes in the bottom of the tank. If this kill mode occurs in of reaction that components or subsystems in the aircraft only one tank, this will not lead to a loss of thrust due to fuel exhibit when the aircraft is hit. In some of the kill modes, the supply depletion when the undamaged tank can provide fuel component hit is the only component killed, whereas in to the engine. However, if both tanks are holed and lose their others, the component hit reacts to the hit in a mode that kills storage capability, then a fuel supply depletion other components. An example of the former is the loss of flight control due to a hit in a hydraulic power actuator that 7 The relation between a component or system failure mode and combatcaused damage or kill modes is developed in the Damage Mode 8 The ullage is the volume of the tank above the fuel level. Fuel vapors and Effects Analysis. accumulate in the ullage.

OCR for page 11
14 VULNERABILITY ASSESSMENT OF AIRCRAFT tree,9 such as the one shown in Figure 1-1 for an attrition kill kill will occur, the aircraft will lose thrust, and an attrition kill typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original will result. Thus, for this kill mode, the fuel tanks are of a two-engined, two-piloted helicopter. A complete redundant critical components. horizontal or diagonal cut through the tree trunk anywhere along the trunk will cause a kill. For example, a kill of the The Fault Tree Analysis (FTA). In the FTA process, the selected pilot and either the copilot or the copilot’s controls will cause and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. kill category (and possibly level) is defined as the top-level a kill, as will a kill of the drive train or any of the three cyclic undesirable event, and the component kill required to cause actuators. If the kill mode of the left- and right-hand fuel the undesirable event are determined. The component kill that tanks is fuel supply depletion, both tanks must be killed to result in the undesired event are linked together in the fault cause a kill of the aircraft. On the other hand, if the kill mode tree by using logical AND and OR gates. For example, is a fuel fire or explosion, then a kill of either tank will kill consider an aircraft with components A, B, C, and D. An the aircraft. Once the critical components have been identified undesirable kill will occur if either component A OR B is and arranged in the kill tree, a vulnerability assessment can killed, or it may occur if both components C AND D are killed. be performed. Thus, components A and B are nonredundant critical components, and components C and D are redundant critical components. In using FTA for the fuel tank example given What Is a Vulnerability Assessment? above, one undesirable event leading to an attrition kill is loss of lift. If loss of lift occurs due to an explosion inside the left A vulnerability assessment is broadly defined here as the wing fuel tank, a component A kill, OR if it occurs due to an systematic description, delineation, test and evaluation, explosion inside the right wing tank, a component B kill, both analysis, or quantification of the vulnerability of the individual wing fuel tanks are nonredundant critical components for the critical components and of the total aircraft. When an aircraft explosion kill mode. On the other hand, a loss of thrust will is hit by one or more damage mechanisms generated by the occur if wing tanks A AND B are killed (by the fuel supply threat weapon, the outcome of those hits is not deterministic; depletion kill mode). Thus, the tanks are redundant critical it is random or stochastic.10 For example, when 15 fragments components for this kill mode. As another example of FTA, from a proximity-fuzed high-explosive warhead penetrate the consider a two-engined aircraft. The undesired event of loss of upper wall of an aircraft’s wing fuel tank, the flammable vapor thrust, which leads to an attrition kill, will occur when the left inside the tank may explode, destroying the wing and killing engine AND the right engine are killed. Thus, these two the aircraft; or the vapor may not components are redundant critical components. A list of the typical critical components on a single-piloted, two-engined 9 The kill tree is also referred to as the fault tree. helicopter is given in Table 1-2. 10 A deterministic process has a repeatable outcome that can be predicted with certainty if all of the influencing parameters and governing laws are known. Random or stochastic processes have multiple or various The Kill Tree. A visual illustration of all of the critical outcomes, any one of which may or may not occur on any one trial. components and their redundancies is provided by the kill TABLE 1-2 List of Topical Nqnredundant and Redundant Critical Components on a Single-Piloted, Two-Engined Helicopter (Ball, 1985) Nonredundant Critical Components Redundant Critical Components Flight Control Subsystem Components Propulsion Subsystem Components Rods, bellcranks, pitch links, swashplate. Engines and engine mounts hydraulic actuators, collective lever, and control pedals Hydraulic Subsystem Components Hydraulic reservoirs, lines, and components Rutar Blade and Power Train Components Blades, drive shafts, rotor heads, main Structural Subsystem Components transmission, and gearboxes Redundant structural elements Fuel Subsystem Components Fuel cells, sump, lines, and valves Structural Subsystem Components Tail boom

OCR for page 11
REVIEW OF CURRENT METHODOLOGIES AND IDENTIFICATION OF APPLICATIONS 15 typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. FIGURE 1-1 The attrition kill tree for a two-piloted, two-engined helicopter (Ball, 1985). Copyright © AIAA 1985—Used with permission. explode, and the aircraft survives the 15 hits. The likelihood The metrics used to quantify the vulnerability of the of an explosion inside the tank depends upon many random aircraft to a single random hit by a penetrator or contactfuzed variables, such as the amount of fuel vapor, the oxygen warhead include PK/H, the probability the aircraft is killed concentration in the vicinity of the fragments, and the given a random hit on the aircraft and Av, the aircraft’s single temperature of the fragments. hit vulnerable area. 12 The metric used to quantify the vulnerability of an aircraft to the proximity- and time-fuzed HE warheads on AAA projectiles and guided missiles is PK/D, the probability the aircraft is killed given an external How Is Vulnerability Measured? detonation by a high-explosive warhead. The P K/D is a function of the location of the detonation point with respect to As a consequence of the random nature of vulnerability, the the aircraft. metric most often used to quantify the vulnerability of an aircraft’s critical components is Pk/h, the probability the component is killed given a random hit on the component by What Are the Two Methodologies Used to a threat weapon or damage mechanism.11 The value of Pk/h depends upon the intensity of the terminal effects Assess Vulnerability? parameters associated with the damage mechanism, such as mass and impact velocity on the component for penetrators In general, there are two methodologies used to assess and fragments. The set of component P k/h values for aircraft vulnerability. One method is the a priori prediction different masses and impact velocities is known as the Pk/h of aircraft vulnerability by using analyses or modeling. This function. A second metric used to quantify a component’s method is nearly always supported by prior live fire test data vulnerability is Av, the vulnerable area of the component. on component P k/h values for the various kill modes. Component vulnerable area is defined as the presented area However, the data have often been obtained on older of the component that, if hit, would cause a kill of the equipment. The other method is the a posteriori observation component and is equal to the product of the component’s and presented area AP in the threat approach direction and its Pk/ h, i.e., Av=AP•Pk/h. 12 Lowercase subscripts refer to a component and uppercase subscripts refer to the aircraft. Thus, Pk/h is the probability a component is killed 11 Other metrics sometimes used for component vulnerability are Pd/h, given a random hit on the component, Pk/H is the probability a component the probability a component is damaged given a hit, area removal, energy is killed given a random hit on the aircraft, and PK/H is the probability the density, and blast. aircraft is killed given a random hit on the aircraft.

OCR for page 11
16 VULNERABILITY ASSESSMENT OF AIRCRAFT possible measurement of aircraft vulnerability by using manpower, many small non-critical components that are not typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original empirical data obtained from either actual combat, aircraft expected to influence the results are often omitted.15 Another accidents, or controlled live fire testing.13 This method is subsystem that has often been omitted in vulnerability nearly always supported by a priori predictions of assessments is the on-board ordnance in the form of bombs, vulnerability prior to testing to define the test conditions and missile warheads and propellants, and ammunition drums. On and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. by a posteriori analyses or evaluation of the data. A brief most aircraft, bombs and missiles are carried externally. In this review of the state-of-the-art of vulnerability analysis/ position, they may shield other components from projectiles modeling and vulnerability testing is given below. and fragments, or they may react violently to a ballistic impact (e.g., detonate) and destroy the aircraft. The new stealth Analysis/Modeling. The prediction of an aircraft’s vulnerability aircraft carry ordnance internally in order to reduce signatures. to the ballistic projectiles and guided missiles likely to be Adverse reactions of any internally carried ordnance, such as a encountered in combat can be accomplished by using deflagration or a detonation, have an even greater probability standardized computer programs.14 One set of programs is of destroying the aircraft. The omission of on-board ordnance applicable to a single hit by impacting penetrator or fragment. from the assessment is discussed in more detail in Chapters 2 Computation of Vulnerable Area and Repair Time (COVART) and 4. is the Joint Technical Coordinating Group on Aircraft Another input requirement for the assessment is the kill tree Survivability (JTCG/AS) standard program for computing the (or logical kill expression) for the selected kill category (and critical component vulnerable areas Av and the aircraft’s level if appropriate). This tree defines the redundant and vulnerable area Av for a single random hit by a penetrator or nonredundant components that if killed individually (the fragment (JTCG/ME, 1984). Another set of programs computes single engine on a single-engined aircraft) or in combination aircraft vulnerability to contact-fuzed HE warheads that (both engines on a two-engined aircraft) will cause an aircraft detonate on the surface or within the aircraft. High Explosive kill. Associated with each critical component on the tree is a Vulnerable Area and Repair Time (HEVART) (BRL, 1978 and data base that contains the Pk/h or Av value for the component HEI Vulnerability Assessment Model (HEIVAM) (Datatec Inc., that is based upon the selected threat weapon or damage 1979) are examples of this type of program. A third set, known mechanism and the possible range of impact velocities on the as endgame programs, computes the probability an aircraft is installed component, for the kill modes considered in the killed due to an external burst of an HE warhead. SCAN (Dayton critical component analysis. University Ohio Research Institute, 1976) is the current JTCG/ AS endgame model for computing an aircraft’s PK/D. Modular Vulnerability to a Single Hit by a Penetrator or Fragment. All Endgame Computer Assessment (MECA), Joint Services of the vulnerability assessment programs contain an Endgame Model (JSEM), SESTEM II (ASD/WPAFB, 1981), assumption as to how the damage mechanisms associated with and SHAZAM (Air Force Armament Lab./Eglin AFB, 1983) are the weapon proceed through the aircraft. The COVART four other widely used endgame programs. methodology assumes that the penetrator or fragment from any selected direction16 is equally likely to impact the aircraft All of these vulnerability assessment programs require as input a three-dimensional data base that defines the geometric at any location and that it propagates along a straight line, model of the aircraft. The geometric model may be contained known as a shotline, through the aircraft, slowing down and within the vulnerability assessment program, as in SCAN, or it possibly breaking up as it penetrates the various components. may be developed in a separate program, such as MAGIC, The amount of fragment or penetrator slowdown is determined Ballistic Research Laboratory Computer-Aided Design (BRL- by the penetration equations that are a part of the built-in data CAD) package, or FASTGEN III, which are used as base. Ricochet of the fragment or penetrator is not considered. preprocessors for COVART. This model should contain all of An additional assumption often made is that only the the aircraft’s components, equipment, and supplies, including components that are intersected by one shotline can be killed such items as fuel, hydraulic fluid, and ordnance. However, by the hit along that shotline. This assumption rules out the possibility of cascading damage away from the shotline.17 In because of the limitations on program size, available time, and the analysis, the presented area of the aircraft 13 Combat and accident data are extremely valuable as adjuncts to the other methodologies, but they are limited in scope, limited in the information on the nature of the event, and not always available for 15 direct application. The COVART model for the F-22 contains 2,213 components, of 14 The Joint Technical Coordinating Group on Aircraft Survivability which nearly half are critical. 16 has established a library of computer programs for assessing the The directions usually selected include the six cardinal views of susceptibility, vulnerability, and Survivability of aircraft. The library is front, back, top, bottom, left side, and right side, and may include the maintained and operated by the Survivability/Vulnerability Information twenty 45-degree angles between these six views. 17 and Analysis Center (SURVIAC) at the Wright Aeronautical It is possible to modify the intersected component’s Pk/h to account Laboratories. for kills of adjacent components.

OCR for page 11
REVIEW OF CURRENT METHODOLOGIES AND IDENTIFICATION OF APPLICATIONS 17 typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. FIGURE 1-2 Example of a grid and random shotlines from FASTGEN for COVART (Ball, 1985). Copyright © AIAA 1985—Used with permission. from the selected direction is covered by a uniform grid, and divided by AP, the aircraft’s presented area from the selected one shotline is randomly located within each cell. An example direction. of the random shotlines within the cells for a particular aircraft is shown in Figure 1-2. Vulnerability to a Contact-Fuzed High-Explosive Warhead. The user has the option of selecting the uniform cell size. Essentially the same analytical procedure is followed for contact- Typical cell sizes range from 12 inches to 1 inch on a side, fuzed high-explosive warheads. A geometric model of the aircraft, with 2 inches being typical. A preprocessor program, known the kill tree, and the critical component Pk/h or Av data are as a shotline generator program, such as MAGIC, BRL-CAD, required. A grid is superimposed on the aircraft and a shotline is or FASTGEN III, identifies all of the critical components randomly located within each cell. The difference between this intersected by each shotline. This information is input data analysis for the contact-fuzed HE warhead and the analysis for for COVART. COVART computes the vulnerable area of each the single penetrator or fragment is the fact that components in critical component and the aircraft’s single hit vulnerable the vicinity of the shotline can be killed by the blast and area, as well as the probability the aircraft is killed by a fragments from the detonation of the HE warhead. Thus, random hit. For component vulnerable areas, each grid cell redundant critical components that are relatively close together containing a shotline that intersects a component has a can be killed by a single hit, causing a kill of the aircraft. Figure vulnerable area equal to the product of the presented area of 1-3 shows the grid cell and randomly located shotlines for this the cell and the Pk/h for the shotline through the component. type of analysis. Note that in this figure the HE warhead The total vulnerable area of the component is the sum of the detonation can cause a kill of both the fuel tank and the engine vulnerable areas of those cells with shotlines that intersect even though neither component was hit directly by the weapon. the component. For the aircraft vulnerable area Av, each grid cell shown in Figure 1-2 contributes a vulnerable area equal Vulnerability to an Externally Detonating High-Explosive to the product of the presented area of the cell and the Warhead. The analysis for the externally detonating HE warhead, probability the aircraft is killed by a hit along the shotline in shown in Figure 1-4, follows the same procedure used for the that cell.18 The total aircraft vulnerable area is equal to the single penetrator or fragment, except that the fragment shotlines sum of the vulnerable areas of each of the cells. emanating from the external detonation are radial rather than Consequently, redundant components, if separated, that parallel, and the aircraft can suffer multiple fragment impacts both are not intersected by one shotline, do not contribute to over its surface rather than a single hit. In addition, the blast the aircraft’s single hit vulnerable area for that shotline.19 from the detonation can kill the aircraft. The assessment of the The PK/H for the aircraft is equal to the AV of the aircraft kill of the aircraft by external blast is usually made independently from the fragment assessment. Three-dimensional blast contours around the aircraft are determined as a function of HE weight. Within a particular blast kill contour for particular explosive 18 When more than one nonredundant critical component is intersected charge weight, a detonation of a warhead with that charge weight by a shotline, the probability the aircraft is killed is equal to the union of or larger will kill the aircraft. the component probabilities of kill. 19 This is the result of the assumption that only those components intersected by the shotline can be killed. A modification of the Pk/h value Results from the Analyses. The results or information obtained for a component can be made to allow a hit on one component to cause from an analytical assessment of aircraft vulnerability a kill of another component due to cascading damage.

OCR for page 11
18 VULNERABILITY ASSESSMENT OF AIRCRAFT typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. FIGURE 1-3 Grid cells and shotlines for the contact-fuzed high explosive weapon (Ball, 1985). Copyright © AIAA 1985—Used with permission. FIGURE 1-4 Aircraft vulnerability to the externally detonating HE warhead (Ball, 1985). Copyright © AIAA 1985—Used with permission. for the single hit by a penetrator or fragment typically consists contact-fuzed high-explosive warhead consist of the aircraft of predictions of the values of vulnerable area Av for all of the vulnerable area AV and the probability of kill given a random critical components, the aircraft vulnerable area AV, the hit on the aircraft PK/H. The results of an assessment for the probability the aircraft is killed given a hit within each grid externally detonating warhead consist of the probability of cell, and the probability the aircraft is killed given a random kill of the critical components intersected by the fragment hit PK/H. The assessment results for the single hit by the shotlines from the warhead detonation, the probability

OCR for page 11
REVIEW OF CURRENT METHODOLOGIES AND IDENTIFICATION OF APPLICATIONS 19 of aircraft kill due to blast, and the probability of aircraft kill computed, and the frequency of occurrence of the elements in typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original given a detonation PK/D. these damage vectors is produced as an intermediate result. Input kill or fault trees are used to develop estimates of target The Stochastic Qualitative Analysis of System Hierarchies and individual subsystem kill probabilities. (SQuASH) Model. One of the primary criticisms of the current Some difficulties associated with SQuASH are the lack of and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. aircraft vulnerability models is the straight shotline data with respect to the broken paths and component damage, assumption. Fragments and penetrators usually do not penetrate especially synergistic damage, and the problems associated through the aircraft in a straight line. In an attempt to account with relating component damage to degradation in for the random, irregular path of penetrators and fragments performance. Another difficulty is the magnitude of the through armored vehicles, Ballistic Research Laboratory (BRL) number of possible outcomes from one event. This number is developed the SQuASH model (Deitz et al., 1990). SQuASH is dependent upon the number of components that can be killed. applicable to both penetrator and high-explosive weapons. It There may be a large number of components to consider for a allows for deflections of the penetrators and fragments from particular shot; perhaps between 10 and 100. The number of the straight shotline, the creation of spall, and it tracks the components in an entire aircraft might be on the order of pieces of fractured penetrators. The present version of SQuASH 1,000. The damage vector consists of these M components, was developed for the vulnerability analysis of armored ground and each of the M components or elements in the vector is vehicles. However, its methodology could be applied to either a 0 (no damage) or a 1 (damage), and the sample space is aircraft. said to have dimension M. The sample space of possible The model introduces the concept of Spaces. All possible combinations of components that might be damaged by a warhead and target conditions at the time of the hit form the particular shot is 2M. Thus, the sample space for a given shot Initial Conditions Space, or Space 1. A particular set of can be quite large. Some sort of metric is needed to reduce the conditions, such as the type and operational status of the sample space to one with a more manageable size. One target and the location of the hit on the target, is one point in approach might be to create some sort of metric that quantifies the Initial Conditions Space. Due to the hit, some components the “nearness” of various damage vectors (similar to a will be damaged, and some will be killed. These damaged and Hamming distance). killed components, and all other post-event observables, such as holes in plates and other terminal effects, form the damage Testing. As a result of the random nature of the vulnerability vector. All possible damage vectors for the target form the problem, the multitude of known component or subsystem Damage Space, or Space 2, and the specific damage vector kill modes, the possible existence of unknown or previously containing the components damaged or killed by the hit is unobserved kill modes or cascading damage, and the difficulty one point in the Damage Space. All possible target in quantifying the vulnerability of the components and capabilities after the hit form the Capabilities Space, or Space subsystems for each of these kill modes, the use of combat data21 and the results from controlled live fire22 tests have always 4, and the particular target capabilities remaining after the hit represent one point in the Capabilities Space. 20 The been integral parts of vulnerability assessment. These data vulnerability event starts with a point in the Initial Conditions provide insight into the component and subsystem kill modes Space. This point is mapped to the Damage Space either by a and any cascading damage that can occur. Furthermore, when live fire test or by the SQuASH model. Note that because the a sufficiently large number of identical tests are performed, vulnerability event is nondeterministic, one point in the statistical data on vulnerability are generated. However, because Initial Conditions Space can map to many different points in of the expenses and difficulty associated with obtaining large the Damage Space. The mapping from the Damage Space to quantities of useful results from either combat or testing, there the Target Capabilities Space is accomplished currently by is a general reluctance to engage in large-scale efforts that may using the Damage Assessment List. In the future, the Degraded provide little useful data or may have little applicability to States methodology will be used for this mapping. present or future aircraft or analytical models. Nevertheless, SQuASH is a Monte Carlo model. Each shot at the target is many live fire tests have been conducted since WW II on targets replicated (typically 1,000 times) with slight variations in its ranging initial conditions. For each replication or trial, random drawings determine which events (such as kill of a component 21 The combat data gathered in past conflicts is stored in the Combat that is hit) occur. The resulting damage vector for that shot is Data Information Center, which is part of the Survivability/Vulnerability Information and Analysis Center. SURVIAC is located at Wright-Patterson Air Force Base, Ohio. 22 The term “live fire testing” is used here in the general sense to 20 Space 3 represents objective Measures of Performance and is not mean firing live (both explosive and non-explosive) ammunition or modeled. fragments at the target (and hitting it).

OCR for page 11
20 VULNERABILITY ASSESSMENT OF AIRCRAFT TABLE 1-3 Definitions of Types of Test Articles and Type of Tests (GAO, 1987) typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original Loading Scale Full-Up Inert and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. Complete system wiih Complete system without Fall-Kale combustibles combustibles (Complete System) Components, subsystems, or Components subsystems, or Sub-scale subasscmblies with subassemblies without (Partial System) combustibles combustibles from individual components to actual aircraft. Of particular end of the program. Particular shots that have the potential to interest here are the current Joint Live Fire (JLF) program and destroy the target, although of vital interest, may not be the congressionally mandated Live Fire Test and Evaluation conducted at all. Preparation for testing consists of the (LFT&E) program. preparation of the test site, the weapon, and the target. After each test, the target is repaired and returned to a condition as General Procedure for Testing. Before reviewing the JLF and similar to the original condition as possible. If the weapon is a LFT programs, the general procedure for testing that has been non-explosive penetrator or fragment, the amount of damage established by the vulnerability testing community is is usually small, the repairs are relatively simple, and the target described. Briefly, one or more targets and weapons are can be hit in essentially the same location again. However, if obtained and prepared for testing. The target can be one the weapon contains a high-explosive warhead, the damage is component, a subassembly, a subsystem, several subsystems, more severe and extensive, the repair is more difficult, and it portions of the aircraft, or the aircraft weapon system. According may not be possible to return the aircraft to its original to the General Accounting Office (GAO), tests conducted on condition. In this situation, the shotline for a second shot must the complete weapon system are known as full-scale tests, and be sufficiently separated from the first shotline so that the tests on less than full-scale targets are known as sub-scale tests. damage and subsequent repair of the first shot do not influence Corresponding definitions also used in this report are complete the results of the second shot. system tests and partial system tests. A surrogate target or Some of the important test considerations are the external weapon is an existing target or weapon that is similar to the and internal environmental conditions at the time of the test, intended target or weapon. If the target, either the complete such as the requirements for external air flow over the target, system or a partial system, contains all of the appropriate and the proper fuel vapor states and temperatures inside the combustibles, such as fuel, hydraulic fluid, ordnance, and target; the requirement for jig arrangements to introduce loads stowage items normally found on the aircraft when operating on the aircraft structure; and the requirement for all of the in combat, the tests are known as full-up tests. Inert targets equipment to be operating at the time of the hit. For example, lack all of the appropriate combustibles, and semi-inert targets must a helicopter rotor blade or tail rotor drive shaft be turning contain some of the combustibles. Table 1-3 contains these when it is hit by the weapon? Must the hydraulic fluid be at definitions, which are used throughout this report. the normal operating temperature when the line is hit? What internal structural loads are appropriate for the test, those The Test Plan and Some Important Considerations. The test associated with normal flight, or those associated with a plan contains the test objectives and the issues the tests are violently maneuvering aircraft? supposed to provide information on, the weapon to be used, the selection and placement of test instrumentation, the The Test Results. The results or information obtained from selection of the number of shots, the shotline directions, the controlled live fire tests typically consists of a list of the impact locations, and any analytical methods that will be used. components that were damaged or killed, the nature and The test plan may contain a number of random shots as well as severity of the damage, the kill modes observed and any a number of selected shots. The tests are scheduled so those cascading damage, and an estimate or measurement of the shots that are expected to cause minimum damage to the target ability of the aircraft to continue the operation of essential are conducted early in the program. Those tests that are functions. Specific events, such as the initiation of a fire and expected to cause more severe damage are conducted at the the intensity and duration of the fire, are also noted.

OCR for page 11
REVIEW OF CURRENT METHODOLOGIES AND IDENTIFICATION OF APPLICATIONS 21 Due to the randomness of the reactions to the hit, some of the combat; and (B) that is a major system within the meaning of typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original observed results in one test may not be observed in any of the that term is section 2303(5) of title 10” (U.S. Congress, 1986– other tests. For example, firing a 12.7-millimeter API into a 1989). A major system is one that costs $75 million in Research partially empty fuel tank may not result in an internal Development, Testing, and Evaluation and/or $300 million in explosion on the first test shot, but the second shot may cause procurement, in 1980 dollars, and is determined by the and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. an explosion that destroys the tank. On the first firing of a Secretary of Defense not to be a highly classified (i.e., black) 12.7-millimeter API projectile into a helicopter engine nacelle, program. Several modifications have been made to the law since FY1987.23 the projectile may ricochet into the cockpit; on the second shot, it may ricochet into the transmission. According to the LFT Test Guidelines established by the law, “Survivability and lethality tests required under subsection (a) shall be carried out sufficiently early in the development phase of the system or program to allow any What Are the Joint Live Fire and Live Fire design deficiency demonstrated by the testing to be corrected Test Programs? in the design of the system, munition, or missile before proceeding beyond low-rate initial production.” Note that Joint Live Fire. In 1983, the Office, Secretary of Defense (OSD) survivability is used when vulnerability is intended. The Director, Defense Testing and Evaluation nominated to the primary requirement of the law is that “a covered system may Services a joint test and evaluation initiative for the live fire of not proceed beyond low-rate initial production until realistic munitions, foreign and U.S., made against currently operational survivability testing of the system is completed” Realistic full-scale targets, both U.S. and foreign. This program is known survivability testing is defined as “testing for vulnerability of as the Joint Live Fire program. The U.S. targets originally the system in combat by firing munitions likely to be included land, sea, and air; however, the sea targets were encountered in combat (or munitions with a capability eventually excluded from the program. Candidate aircraft similar to such munitions) at the system configured for included the F-15, F-16, F/A-18, AV-8B, fixed wing aircraft, combat, with the primary emphasis on testing vulnerability and the UH-60 and AH-64 helicopters. The threats initially with respect to potential user casualties and taking into considered consisted of armor-piercing projectiles with equal consideration the susceptibility to attack and combat incendiaries (12.7-millimeter, 14.5-millimeter, 23-millimeter, performance of the system.” “The term configured for combat, and 30-millimeter API), warhead fragments (45, 70, 110, and with respect to a weapon system, platform, or vehicle, means 220 grains), and contact-fuzed high-explosive rounds with loaded or equipped with all dangerous materials (including incendiaries (23-millimeter and 30-millimeter HEI). A number all flammables and explosives) that would normally be of specific tests on various components and subsystems of carried in combat” these aircraft have been conducted, such as tests on the UH-60 A waiver from the law is provided. “The Secretary of main rotor blade, the F-15 and F-16 hydraulic fluid, the F-15 Defense may waive the application of the survivability and and F-16 steady state and quick dump fuel ingestion, and the lethality tests of this section to a covered system, if the F-16 emergency power subsystem. In 1989, the results of the Secretary, before the system or program enters full-scale JLF tests were presented to more than 100 industry, government, engineering development, certifies to Congress that live-fire and military specialists in vulnerability and vulnerability testing of such system or program would be unreasonably testing. The JLF program is still active. The test data gathered expensive and impractical.” Also, “the Secretary shall during the tests are currently being examined to determine the include with any such certification a report explaining how Pk/h values for the tested components, and the empirical values the Secretary plans to evaluate the survivability or the are being compared to the previous values in order to decide lethality of the system or program and assessing possible whether the previous values should be revised. alternatives to realistic survivability testing of the system or program” (U.S. Congress, 1986–1989). The Live Fire Test Law. As a result of the controversy over the The intent of the LFT law is to determine the inherent vulnerability testing of the U.S. Army’s Bradley Fighting strengths and weaknesses of adversary, U.S., and allied Vehicle, Congress in fiscal year 1987 amended title 10 of the weapon systems sufficiently early in the program to allow any U.S. Code, adding Section 2366. “Major Systems and Munitions design deficiency to be corrected. According to the FY1988– Programs: Survivability and Lethality Testing; Operational 1989 DoD Authorization Act Conference Report, Congress Testing.” This legislation, known as the Live Fire Test (LFT) intended that the Secretary of Defense implement law, applies to covered systems. According to the law, “A covered system means a vehicle, weapon platform, or conventional weapon system that (A) includes features 23 The law and the amendments to the law are included in this report in designed to provide some degree of protection to users in Appendix A.

OCR for page 11
22 VULNERABILITY ASSESSMENT OF AIRCRAFT the LFT law “in a manner which encourages the conduct of later at the full-scale level mandated in the legislation” (U.S. typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original full-up vulnerability and lethality tests under realistic Congress, 1988). Furthermore, the events that led to the law combat conditions, first at the sub-scale level as they are and the fact that Congress included a waiver process in the law developed, and later at the full-scale level mandated in the are further evidence that Congress intended that live fire tests legislation” (U.S. Congress, 1988). All live fire tests be conducted on full-scale, full-up systems. If tests on the full- and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. conducted as part of the program to satisfy the Live Fire Test scale, full-up system were not intended, no waiver would be law will be referred to here as Live Fire Tests. Developmental necessary, and any live fire tests would suffice, as long as they tests using live fire that are not intended to be part of the were realistic. Based upon the evidence gathered by the mandated LFT&E program will be referred to as live fire committee and its study of the law, the committee is unanimous tests, with no capital letters. The distinction between the two in the opinion that the LFT law requires a full-scale, full-up categories of tests is important. aircraft to be tested, regardless of the outcome of the sub-scale In response to the law, the Department of Defense (DoD) tests, unless a waiver is granted. chartered an administering office, the Director of Live Fire Testing, under the Office of the Director of Defense Research What Are the Applications of the Results of and Engineering. The responsibilities of this office include the Assessments? the establishment of policies under which Live Fire Testing is conducted by the Service components, the approval of the Services’ Live Fire Test strategy and test plans for each Vulnerability assessments are a part of the weapon system covered program, the review of the test results, and the acquisition process. This process is described in DoD performance of an independent assessment that is forwarded, Instruction (DODI) 5000.2, February 23, 1991. According to via the Secretary of Defense, to the Congress (O’Bryon, DoDI 5000.2, survivability is identified as a critical system 1991). characteristic and consequently must be addressed in cost- schedule-performance trade-offs throughout the acquisition What Does the Law Require? During the course of the process. This instruction requires that survivability be committee’s examination of the current direction of Live Fire considered from all threats found in the various levels of Testing and Evaluation, it became apparent that because of conflict, including the conventional gun and missile threats, the ambiguity of the law’s requirements regarding the system the nuclear, biological, and chemical threats, and the testing, there were different interpretations of the LFT law. advanced directed energy weapons. At Milestone 0, the One interpretation was that the law did not explicitly stipulate expected threat environment is identified and discussed in the that a complete system had to be tested, even though no waiver Mission Need Statement. At Milestone I, the system threat from the law was requested. The opinion was held that the law assessment identifies the expected likelihood for each threat. was satisfied by an LFT&E program in which Live Fire Testing In addition, initial survivability objectives are defined and was conducted only on components and subsystems, provided validation criteria established in the Operational that these tests showed that no complete system testing was Requirements Document (ORD). Key objectives are included necessary; all vulnerabilities had been found in the partial in the Concept Baseline. Critical survivability characteristics system tests. In an attempt to determine the intent of Congress and issues that require test and evaluation are identified and as to the meaning of realistic survivability testing, members of included in the Test and Evaluation Master Plan; this includes the committee interviewed Mr. Joseph Cirincione, the the Live Fire Test program. Critical survivability technology congressional staff member who drafted the Live Fire Test shortfalls are identified and research requirements legislation in 1987. Mr. Cirincione believes that the intent of established. At Milestone II, survivability issues are addressed the law, as seen by the Congress, is “full-scale, full-up” testing. in the Integrated Program Summary; at Milestone III, an This, to him, means that the complete aircraft must be tested assessment of how well the survivability objectives have been and must be configured for combat (i.e., engine running, fuel met has been completed, and all survivability issues should in the tanks, loaded with ammunition, etc.). He believes that have been resolved. anything other than full-scale, full-up testing requires a waiver Vulnerability objectives are part of the survivability in accord with the terms of the above paragraph. In support of objectives required by DoDI 5000.2.24 If any vulnerability his position is the statement in the FY1988–1989 DoD objectives or requirements have been defined in the ORD, Authorization Act Conference report that says “the conferees they are satisfied and validated by using vulnerability intend that the Secretary of Defense implement this section in assessments a manner which encourages the conduct of full-up vulnerability 24 Note that only survivability objectives are required. Thus, a system and lethality tests under realistic combat conditions, first at could meet the requirements in DoD 5000.2 by requirements on the sub-scale level as sub-scale systems are developed, and susceptibility alone.

OCR for page 11
REVIEW OF CURRENT METHODOLOGIES AND IDENTIFICATION OF APPLICATIONS 23 in the form of analysis/modeling and testing. Thus, the this type is the use of the results from the analytical typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original primary application of a vulnerability assessment in the vulnerability assessments in trade-off and campaign or similar weapon system acquisition process is to aid in the design of large-scale war game models that require an aircraft attrition the aircraft and in the validation of the design. Additional data base. applications are to satisfy program requirements, to develop and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. data bases in support of subsequent analytical assessments, to Predict Test Outcomes. The results of an analytical predict test outcomes, to satisfy the requirements of the Live vulnerability assessment can be used to predict the possible Fire Test law, and to support acquisition decisions. outcomes of a controlled test prior to the conduct of the test. The particular components that will be damaged or killed by Aid in Design and Design Validation. The results of a the weapon or by any cascading effects can be identified, and vulnerability assessment must be available early in the the consequences of the damage or kill of these components to development cycle of an aircraft and used to influence the the essential functions can be predicted. However, due to the design. Analytical modeling can provide guidance on the random nature of vulnerability, no deterministic prediction of placement of the critical components and the protection that the test outcome can be made. Consequently, predictions take should be given to the various contributors to vulnerability, the form of statements such as “the flammable vapors in the such as the fuel subsystem, flight control subsystem, and wing tank have a 0.3 probability of exploding and destroying propulsion subsystem. Controlled live fire developmental tests the wing when the tank is hit by a 12.7-millimeter API.” can be conducted on early designs of components, and possibly subsystems, to determine any adverse reactions, either Satisfy the Requirements of the Live Fire Test Law. The Live expected or unexpected. Any design vulnerabilities revealed Fire Test law requires that a full-scale (the complete weapon by the full-scale, full-up LFTs should also impact the design. system), full-up (configured for combat) aircraft be tested for For design validation, the analytical models provide vulnerability using munitions likely to be encountered in information on vulnerable area, PK/H, and PK/D; and live fire combat, unless a waiver is given from the law. A primary intent tests are conducted to verify that certain vulnerability of the law is to obtain information on any design weaknesses in requirements for the design of the aircraft have been satisfied. time to allow them to be corrected. Thus, the testing required by For example, if an aircraft has a design requirement to be able the law is in some sense an aid in the design (a discovered to take a single hit by a 12.7-millimeter API anywhere on the weakness can be corrected) as well as a validation of the design aircraft and fly for 30 minutes after the hit, live fire testing of (if no weaknesses are discovered, the design is presumably the design is the best procedure for verifying the compliance validated). Analytical vulnerability assessments can assist in of the design.25 determining the issues that require examination in the Live Fire Test program. The Live Fire Test plan is developed using the Satisfy Program Requirements. The DoD MIL-STD 2069, information provided in the Live Fire Test and Evaluation “Requirements for Aircraft Nonnuclear Survivability Program,” Planning Guide. A typical Live Fire Test plan will include early requires that analytical vulnerability assessments be made as testing of components, sub-systems, and sub-assemblies, both part of the normal development process. Aircraft development inert and full-up, and later testing of full-scale, full-up targets. programs that stipulate MIL-STD-2069 will have assessments conducted throughout the development cycle. Support Acquisition Decisions. One of the principal applications of both analysis/modeling and Live Fire Testing Development of Data Bases in Support of Subsequent Ana is to provide information in support of acquisition decisions. lytical Assessments. As data from live fire tests on a variety of This is accomplished by providing timely information on the components and subsystems are gathered, qualitative vulnerability of the complete system to decision-making information on kill modes and cascading damage effects and bodies, such as the Defense Acquisition Board. quantitative information on individual component P k/h Table 1-4 presents a summary of the applications of the functions can be put into a data base and used to improve analysis/modeling methodology and the Live Fire Testing subsequent analytical assessments. The JLF program is an methodology, including both sub-scale and full-scale testing. example of this application in action. Another application of Previous Studies of Vulnerability Assessment 25 The design requirement that an aircraft be able to withstand a single with Emphasis on Live Fire Testing hit by a particular weapon and continue to fly for a specified period of time does not automatically mean that the aircraft will be unable to withstand a second hit. Building into the aircraft an ability to take a Two previous studies of the vulnerability assessment and live single hit anywhere also gives the aircraft a significant capability to fire testing of military vehicles have been conducted; withstand multiple hits.

OCR for page 11
24 VULNERABILITY ASSESSMENT OF AIRCRAFT TABLE 1-4 Applications of the Methodologies typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original Predict Satify Aid in Design Support Satisfy Develop Test Design Validation Program Data Bases Require- Acquisition Outcomes Require- in Support ments of Decisions and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. ments of Analytical LFT law Assessments X X Analysis/ X X X X (MIL- modeling (War games) STD- 2069) X X Sub- X X X Live Fire (with scale Testing waiver) (Pk/h Full- X X X X values) scale the 1987 U.S. General Accounting Office study Live Fire aircraft program. Consequently, the major issues and Testing, Evaluating DoD’s Programs (GAO, 1987) and the conclusions of these two studies as they apply to aircraft are 1989 Board on Army Science and Technology (BAST), presented in Appendixes B and C. National Research Council (NRC, 1989), study Armored Combat Vehicle Vulnerability to Anti-Armor Weapons: A Review of the Army’s Assessment Methodology. Both studies References addressed vulnerability issues similar to those reviewed here. However, the GAO study, which was conducted at the same • Aeronautical Systems Division (ASD), 1981. Impacts of time the LFT legislation was enacted, concentrated primarily Engine Vulnerability Uncertainties on Aircraft on the JLF program. The purpose of this study was to answer Survivabilities, Wright-Patterson Air Force Base, Ohio, AD four questions: (1) What is the status of each system originally Number:C037839. scheduled for live-fire testing under the JLF program? (2) • Air Force Armament Laboratory, 1983. User Manual for the What has been the methodological quality of the test and Air-to-Air Missile Program SHAZAM, Eglin Air Force Base, evaluation process? (3) What are the advantages and Fla., AD Number:B104959. limitations of full-up live fire testing, and how do other • Ball, R.E., 1985. The Fundamentals of Aircraft Survivability methods complement full-up testing? (4) How can live-fire Analysis and Design, American Institute of Aeronautics and testing be improved? Of interest here are questions 2, 3, and 4. Astronautics, Inc., New York. The BAST study examined the Army’s assessment • Ballistic Research Laboratory (BRL), 1978. HEVART-An methodology, including both analysis and live fire testing, for Interim Simulation Program for the Computation of HEI armored vehicles. The committee conducted an independent Vulnerable Areas and Repair Times, Aberdeen Proving review to (1) address issues that will help the Army define the Ground, Md., AD Number:C030817L. objectives of its vulnerability assessment program, (2) define • Datatec Inc., 1979. High-Explosive Incendiary Vulnerability and analyze alternative ways to balance computation and live Model (HEIVAM), Volume 1, User Manual, Fort Walton fire testing in reaching conclusions about vehicle Beach, Fla., AD Number:B107811L. vulnerability, (3) identify technical deficiencies where they • Dayton University Ohio Research Institute, 1976. SCAN-A exist, and (4) suggest alternatives for improvement as Computer Program for Survivability Analysis, Volume 1, appropriate. All four tasks are of interest here. User Manual, AD Number:B068149L. Although neither study specifically addressed the Live • Deitz, P.H., et al., 1990. Current Simulation Methods in Fire Test legislation and the DoD LFT&E program, and the Military Systems Vulnerability Assessment, Ballistic BAST study did not consider aircraft, both studies examined Research Laboratory, Aberdeen Proving Ground, Md., BRL- issues and arrived at conclusions that are pertinent here. MR-3880. Furthermore, the personnel and organizations involved in the • Joint Technical Coordinating Group for Munitions JLF aircraft program also are the ones involved in the LFT Effectiveness

OCR for page 11
REVIEW OF CURRENT METHODOLOGIES AND IDENTIFICATION OF APPLICATIONS 25 (JTCG/ME), COVART II—A Simulation Program for • O’Bryon, James F., 1991. Presentation made to the typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original Computation of Vulnerable Areas and Repair Times—Users Committee on Weapons Effects on Airborne Systems, Manual, 1984. Government Report Number:61 JTCG/ME July 24. 84-3. • U.S. Congress, 1986–1989. Survivability and Lethality • National Research Council (NRC), 1989. Armored Combat Testing of Major Systems, DoD Authorization Acts, FY86— and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. Vehicle Vulnerability to Anti-armor Weapons, A Review of Sec. 123, FY87—Sec. 910—Sec. 910, FY88–89—Sec. 802. the Army’s Assessment Methodology, Committee on a • U.S. Congress, 1988. FY88–89 DoD Authorization Act Review of Army Vulnerability Assessment Methods, Board Conference Report, Live-Fire Testing (Sec. 802). on Army Science and Technology, Commission on • U.S. General Accounting Office (GAO), 1987. Live Fire Engineering and Technical Systems, Washington, D.C.: Testing, Evaluating DOD’s Programs, GAO/PEMD-87-17, National Academy Press. Washington, D.C.: U.S. Government Printing Office.