rate requirements with acceptable false alarm rate and cost without being vulnerable to defeat by likely countermeasures. These requirements will strongly influence the architecture of an explosive detection system.¹ To date, no single instrumental method has been shown to be a "silver bullet" which can satisfy all of the requirements. Therefore, it is highly likely that two or more complementary instrumental methods (i.e. EDDs) will be required. The following discussion summarizes the key considerations relating to the internal logic of integrating the responses from multiple detectors which sense different physical characteristics so that the responses are independent of one another.

The trade-off between the acceptable system level of detection probability (when there is an explosive) and the false-alarm rate (when there is no explosive) is crucial to the system architecture; specific trade-off decisions cannot be made without data on individual instruments. Thus, statistically sound, detailed parametric performance data for individual EDDs must be available for the analyses. Chapter 2 discusses key considerations for obtaining such data.

It is generally assumed that all baggage made available for EDS testing will indeed be examined by the EDS. However, in the analogous industrial context of monitoring the quality of manufactured products and seeking to find defective items, one can easily imagine inspection sampling plans in which some portion of products bypass examination. Such a plan conceivably could be cost effective when the financial costs of sampling and failing to detect a flawed item are well understood and when the latter penalty is relatively low (e.g., routine warranty costs and no possibility of excessive litigation). But, in the screening for an explosive in baggage the actual and perceived costs of failing to detect an explosive are no doubt extremely high, and exact values cannot be definitively quantified. One can imagine the public outcry that would arise if an airplane is destroyed by an explosive that could have been readily detected by the EDS, but was instead randomly designated to bypass testing.

Moreover, any potential gain in efficiency attained via subsampling is necessarily limited by the prescribed high value for the EDS probability of detection, P_D. For example, if the required P_D threshold is 0.95 then clearly no more than five percent of the baggage can be permitted to bypass inspection (even when the EDS is infallible).

All alarms will have to be cleared. At least three alternatives are available: re-run the bag through the unit; operator interpretation of the EDS-generated image of the bag; or hand searching the suspect bag. The impact of each of these alternatives could be examined with the simulation tools. Additional complexity in the search strategy can be envisioned. For instance, the results from passenger profiling as part of a pre-screening operation could be used to cue the detector threshold levels in the instruments (i.e. lower the detection level for the higher "risk" passengers). In some

FRONT MATTER (R1-R19)

EXECUTIVE SUMMARY (1-14)

1 SYSTEMS CONSIDERATIONS (15-22)

2 TESTING PROTOCOLS AND PERFORMANCE CRITERIA (23-34)

REFERENCES (35-36)

A: A GENERAL TESTING PROTOCOL FOR BULK EXPLOSIVE DETECTION SYSTEMS (37-80)

B: GLOSSARY OF TERMS (81-84)

C: BIOGRAPHICAL SKETCHES OF COMMITTEE MEMBERS (85-87)