Analysis of Current and Prior Building Protection Programs and Studies
Although protection of buildings and building occupants from biological and chemical airborne threats has received increased attention over the past decade, few projects to date have incorporated a set of integrated building protection strategies. All the systems considered in this report have passive protection elements, but some of them complement passive protection with active response or control approaches. These few projects provide important insights into future development of building protection approaches and architectures. Each system, however, is uniquely tailored to address specific protection goals and, thus, has different levels of performance. Therefore, broad conclusions cannot be drawn about the economic feasibility or general applicability of the systems to other buildings.
DEMONSTRATION AND IMPLEMENTATION
Smart Building (Demonstration)
In 1999, the Defense Threat Reduction Agency (DTRA) commissioned the design, development, and implementation of the Smart Building program, with the goal of demonstrating a comprehensive biological, chemical, and radiological protection system. The demonstration focused on the building that housed the Olympic Coordination Center (OCC) of the Utah Olympic Public Safety Command (UOPSC) and the Federal Bureau of Investigation’s Joint Operation Center (JOC). UOPSC was a multijurisdictional entity that consisted of local, state, and
federal organizations responsible for emergency response and law enforcement during the 2002 Winter Olympics in Salt Lake City, Utah.
Building protection features were retrofitted (the building was about four years old at the time) into a six-story commercial building totaling approximately 16,700 m2 (180,000 ft2) of floor space plus three levels of underground parking. OCC and JOC occupied the fifth and sixth floors of about 5600 m2 (60,000 ft2). A detailed description of the Smart Building is given in a six-volume series of reports (see Allen et al., 2006, for an executive summary and listing of the reports). The protection features of the Smart Building system were in place from two months prior to the 2002 Winter Olympics and the Paralympics to two months after the events. The system protected about 50 occupants on the fifth and sixth floors, and its estimated total cost was $22.2 million over its four years of operation. The protection system has since been dismantled and the building restored to its original configuration.
The building protection system consisted of collective protection (CP)1 for the fifth and sixth floors and a multiple sensor system that could trigger a change in ventilation system for the first to fourth floors. Therefore, the Smart Building protection system for the fifth and sixth floors can be regarded as a high-level passive protection system (LP-2). Although the heating, ventilating, and air-conditioning (HVAC) system for the first to fourth floors included only standard particle filters and no gas-phase chemical filtration, the sensor-activated responses were LP-4. In addition, physical security systems were installed and response training and plans implemented for the entire building. Entry to the fifth and sixth floors involved additional security and passage through a decontamination air lock in the event that contaminated (or potentially contaminated) personnel had to gain entry to OCC.
The key elements in the implementation of the CP system for the fifth and sixth floors were building modifications to eliminate air leakage into those floors and the mechanical system of the collective protection air handlers that supply chemical- and aerosol-filtered air. Building modifications that provide LP-1 and LP-2 focused on finding and, to the extent feasible, eliminating leakage between the CP floors and the outside and between the CP region and the floors below. These modifications reduced the airflow requirements to maintain the positive indoor-outdoor pressure gradient and the infiltration from the floors below. The existing HVAC system was also modified so that it serviced only the lower four floors. An entirely separate air-handling system for maintaining the CP overpressurization was installed to provide about 560 m3 min−1 (20,000 ft3 min−1) of air that was filtered by a high-efficiency particulate (HEPA) air filter and activated carbon filter units to maintain the CP overpressurization units. The design requirement was to maintain overpressurization at the building shell for wind loads
up to 6.7 m s−1 (15 mi h−1). The CP HVAC system was entirely once-through (see Chapter 3), with heating and cooling loads handled by separate space-conditioning systems on each of the two floors. These were air-based systems located in a room on each floor where the filtered outside air was mixed with recirculated air from the rest of the floor (no deliberate cross-floor air circulation). All the space conditioning was handled by these units. Thus, all the conditioned air delivered to the fifth and sixth floors was exhausted through bathroom exhaust systems or through incidental leakage paths to the outdoors or to the floors below.
Protection of the first four floors, which were occupied by other government and nongovernmental tenants, relied on physical security at the ground floor entrances and HVAC control procedures that could be initiated by an alarm from one of the chemical or radiation sensors deployed within the building and at external sites in the vicinity of the building. The chemical and radiation sensors were commercial off-the-shelf systems. The typical building ventilation response options—programmed for automatic initiation by the sensors—were an HVAC purge mode if an internal release was identified and HVAC system shutdown for an external detection. There was also a similar, operator-initiated response capability that could be implemented on the basis of information obtained from law enforcement and other agencies.
The biosensor and response system used a tiered approach. Samples of airborne biological material were taken continuously by the Joint Biological Point Detection System (JBPDS) equipment, which was not commercially available. Operation of these systems was monitored continuously at a separate control facility. Initial detection by the JBPDS equipment was followed by a second-tier assay analysis that, if positive, would result in physical collection of sampled material for additional analysis off-site. The confirmed second-tier analysis would result in notification of JBPDS leadership and shipment of a sample to the Utah Department of Health for further laboratory analysis. Because the confirmatory test would take 12-24 hours to complete, the primary function of the higher-tiered detection was to define treatment and decontamination responses (LP-3 options). Change in building or HVAC operation on the fifth and sixth floors would not be initiated until the Utah Department of Health analysis confirmed detection of a biological threat agent.
The principal requirement of the Smart Building program was to ensure continuous operation of essential functions by OCC and JOC. Building protection for operational continuity was achieved primarily through LP-2-type options—continuous overpressurization with filtered air of the fifth and sixth floors. Treatment and decontamination responses were provided by LP-3-type options. Physical security (LP-1- and LP-2- type options) at the building and at the entrances to the fifth and sixth floors provided additional protection primarily to minimize
the threat of a biological, chemical, or radiological attack within the CP zone. Assurance of continuity of operation of OCC was critical. A standby emergency generator was included to provide power for the CP HVAC system and for continued operation of the OCC functions. If key personnel were outside OCC at the time of an attack, airlocks and a decontamination procedure (LP-2-type options) were available to provide safe entry.
Because OCC was in operation for a short duration and because of its attendant protection requirements, few data on the long-term operating demands and costs of any of the systems were collected. The summary report (Allen et al., 2006) noted that there were challenges to retrofitting a protection system into an existing building. For example, integration of the Smart Building control system with the existing building management system was not seamless partly because some elements of the existing control system were designed to prevent damage to the HVAC system.
Washington Metropolitan Area Transit Authority
The Washington Metropolitan Area Transit Authority (WMATA) has installed an early warning crisis management system to detect releases of threat agents in the subway (metro) system to aid immediate and medium-term response. Initiated in 1997, the protection system has been a cooperative effort among WMATA and the U.S. Departments of Energy, Transportation, Justice, and, more recently, Homeland Security (DHS). Much of the technical work has been conducted by Argonne and Sandia National Laboratories. The collaboration established the Program for Response Options and Technological Enhancements (PROTECT). A summary of PROTECT is given in Campbell et al. (2004).
The PROTECT architecture consists of sensors deployed in various subway stations, complemented by closed-circuit television (CCTV) cameras that have automated and manual pan-tilt-zoom capabilities. These sensor and camera combinations provide data continuously to a centralized chemical-biological emergency management information system (CB-EMIS developed by Argonne National Laboratory) located in a centralized WMATA operations control center. In addition to the sensor and video data from the stations, train operation data and ambient meteorological data are also ported to the CB-EMIS system. Under normal operations, CB-EMIS can provide operator access to the multiple fixed and movable cameras throughout the metro system to assist law enforcement officers or firefighters. It also monitors the status of the sensor systems deployed in the metro.
When a sensor alerts, the signal is provided both to the CB-EMIS system (where a visual indicator is displayed in the operations control center) and to the movable camera system(s) in the station, which focus on predetermined locations
associated with sensor locations. The video observations are then used by personnel in the operational control center to determine whether station patrons are in distress, thus providing confirmation of the sensor alarm. The linkage between the sensor alarm and the video camera motion is the only automated element within the response system.
In addition to providing situational awareness, CB-EMIS contains a belowground and aboveground dispersion modeling capability. Information on agent concentration obtained from one or more sensors is combined with information on train movement and the ambient meteorology to estimate the location, strength, and fate of the release. This information is also used to estimate the transport and dispersion of the threat agent within the subway system and the aboveground dispersion as a result of emissions from the station entrances and vent shafts. The model outputs are used to identify the hazardous zones within and adjacent to the subway system and are updated as additional data and information become available. To provide situational awareness to first responders on-site, communications access stations are located outside the subway stations.
Establishment of predetermined response strategies to support decision making by WMATA and other emergency responders during an incident is key to the operation of the PROTECT system. Response options include stopping trains (some or all) or moving trains away from the affected areas. The video information also can help in the deployment of emergency response personnel to the affected station(s).
PROTECT, as currently implemented for WMATA, relies on “human-in-the-loop” response and decision making, except for the initial automated camera response triggered by sensors. Verification of detection, performed by staff in the operational control center (alerted to do so by the sensor alarm), is a necessary first step before any responsive actions are taken. CB-EMIS has been developed as a situational awareness tool where all event and supplemental (such as data on hazardous chemicals) information can be accessed and displayed. CB-EMIS also provides estimates of threat agent dispersion, the location of hazardous areas, and predetermined response strategies. These functions provide important inputs to the response decision making.
Immune Building Program Demonstration
In 2001, the Defense Advanced Research Projects Agency (DARPA) initiated the Immune Building Program with the goal of making military buildings and their occupants less attractive targets for attack by biological and chemical
threat agents. DARPA recognized that one of the most difficult aspects of the effort was protection from agent releases within a building because of the small amount of mass required for a successful attack (compared with most external attacks) and the possibility of direct exposure of occupants before the threat agent could be removed by mitigation approaches such as filtration. In addition to protecting occupants, the objectives of the Immune Building Program were timely restoration of service and the preservation of forensic evidence. In establishing this program, DARPA recognized that active response protection of building occupants (LP-4) had not been demonstrated in the context of biological and chemical threats to buildings. Full-scale end-to-end tests, data, and models to examine various approaches and trade-offs did not exist. Moreover, many of the required technologies or components were unreliable or not yet available at the time the program began.
The Immune Building Program was started with two parallel efforts. Phase 1 included a set of analysis and modeling studies designed to define the problems, issues, and their scope. It also included a development and demonstration program for new technologies that could be tested later in Phase 2 test beds or deployed as part of the operational demonstration. Concurrently, a modeling and simulation tool resource called the Building Protection Toolkit (BPTK) was developed to reduce risk in the design phase and to optimize strategies, components, and concept of operations (CONOPS) in the test bed.
In Phase 2, full-scale experiments were conducted at existing (but extensively modified) buildings at the Nevada Test Site and at the decommissioned Fort McClellan U.S. Army base near Anniston, Alabama. The Phase 2 tests were designed, in part, to examine combinations of passive and active control strategies to prevent or reduce occupant exposures from an internal release. The goal was to have an optimized design that could serve as the basis for the operational system deployed as part of the operational demonstration. Phase 2 tests provided an opportunity to collect experimental data on the dispersion of particles and gases in indoor spaces and to compare the data with indoor dispersion models. Phase 2 also provided a limited evaluation of new technology developments.
In Phase 3, the final element of the Immune Building Program was an operational demonstration of the system in an occupied military building under real-world operation conditions. The selected site was Nord Hall, a building that houses certain functions of the U.S. Army Chemical School at Fort Leonard Wood, Missouri. At the time this report was written, full deployment and efficacy testing had not been completed, nor had CONOPS been fully developed and tested.
As was the case for the DTRA Smart Building program, deployment of the Immune Building system was retrofitted to an existing building (built in the mid-1990s). The main components of the protection system at Nord Hall are upgraded absorption and particle filters on the HVAC system (LP-2 options) and active HVAC pressure and airflow control triggered by the sensor system to provide pro-
tection from internal releases. Because of the limited availability of interior space and the costs of modifying interior spaces, one of the outside air-conditioning units for incoming air was located at ground level outside the building. This location is not desirable from a security perspective. The air treatment systems included standard military off-the-shelf technology for particle and gas filtration. The passive system provides protection against external releases. However, the building itself is not regarded as being collectively protected (that is, it does not maintain a positive pressure gradient—inside to outside—everywhere across the building shell). The active system is linked to a series of biological and chemical sensors that are set to take air samples continuously from the various zones within the building. The sampler and response architectures are described below.
A centralized equipment room houses all of the biological and chemical sensor systems. Tubing was installed throughout the building to deliver air samples from various locations continuously to the equipment room. Studies were done to determine the acceptability of the air transit time relative to the other time delays in the sensor system, such as sample processing. Transport efficiencies for both gas and particle samples between the sampling sites and the sensors were also assessed empirically. Overall, these studies considered the trade-offs of cost, transport time, and transport losses with different sensor technology choices. The studies illustrate how compromises driven by technology can impact the performance of the system in secondary ways, emphasizing the need for a systematic plan for building protection.
The building interior is divided into several active zones, and air samples are taken in each zone. Air samples from the tubing transport system are processed by a series of biological and chemical detectors using a tiered detection-response approach. A fast but lower-accuracy sensor in each active zone triggers a slower confirmatory sensor if a threat agent is detected. The primary response option for building protection is changing the state of the HVAC system to limit spread of the initially localized internal threat.
The metrics used in the Immune Building Program are the fraction of building exposed (FBE) and the fraction of occupants exposed (FOE). Both metrics make assumptions about the current HVAC state and occupancy of the building. In the preliminary evaluations of the protection system, FBE and FOE are estimated over time. FBE and FOE can be converted into numbers infected and likely incapacitation and mortality rates if a variety of assumptions are made.
Because the Immune Building system was retrofitted to an existing building, challenges arose in coordinating the required changes in the existing HVAC system. The optimal solution was to have a control system for response in parallel with the control systems for normal operations. Because testing of the configuration at the Nord Hall test bed had not been completed at the time this report
was written, the committee did not have sufficient information to evaluate the system or to evaluate the utility of the data to other deployments. A comparison of deployment choices made with other test beds and deployments suggest that Nord Hall represents a typical state-of-the-art system that is a compromise between limitations of current sensor technologies (in both performance and cost) and the development of a working system. A comprehensive evaluation of Nord Hall protection requires that the planned test of the technical performance of the system be completed and that integrated building protection systems that include operational responses be developed and tested. An important lesson learned is that test beds cannot be technology-only demonstrations; they must also demonstrate an integrated system that involves all components of an actual operating system including the response.
The building protection system of the Pentagon represents the highest standard among the protection systems that the committee examined, and it is continuously being evaluated and improved. Although information on the building protection deployed at the Pentagon is limited, a general description and remarks can nevertheless be made in this report. The system uses all levels of protection (LPs as described in Chapter 3) and the choices of deployment corresponding to each level of protection.
LP-1: The Pentagon has won numerous awards for providing a healthy working environment by minimizing natural air contaminants.
LP-2: Many additional filtrations, including local air-washes, are deployed and combined with segmented protected spaces to provide optimized passive protection and to localize airborne threats.
LP-3 and LP-4: The Pentagon uses a variety of sensor technologies in a tiered approach, both temporally and spatially separated, to provide fast low-regret response with longer-term confirmatory identification for treatment. The protection system also integrates remote external sensing with aerosol transport and dispersion, meteorological data, and airflow models to optimize response options. Similar integrated technologies are used within the building to supplement sensor information on the status of an event and to optimize response options. Visual monitoring systems are integrated into the sensor systems. Although certain functions are automated, the protection system obtains a high performance through regular training of personnel and evaluations of the systems.
Two main observations about the protection system can be made. First, although the Pentagon represents a high-value asset where cost considerations are less important than other Department of Defense (DOD) facilities, the deployment represents the likely future paradigm of balancing and integrating all aspects of technology and operations to provide a robust, high-performance, and maintainable protection system. Second, because the Pentagon protection system is in a large and complex facility that captures many of the aspects of smaller buildings, use of the acquired data on performance and costs for modeling and to guide other deployments is highly desirable.
High-Asset Federal Building Deployment
The committee also considered other deployment across the federal complex to protect high-asset buildings, including the Joint Program Executive Office for Chemical and Biological Defense’s Guardian Program and the Environmental Protection Agency’s (EPA) Safe Building. Because of the breadth of the building types and the levels of protection required, only broad descriptions and observations can be made.
The types of buildings being protected represented a variety of existing and new buildings, and the following conclusions are drawn from the deployments:
A case-by-case analysis is required.
LP-1 and LP-2 options (no sensors) are the most broadly applicable options for most buildings given the current sensor technology and cost restrictions.
Recommissioning and continual commissioning are essential to sustain performance of the LP-1 and LP-2 options.
Testing (of air infiltration in particular) is essential.
If the risk warrants, segmented internal spaces with cascading pressure zones maintained by simple control systems are deployed.
If the risk warrants, separate air-handling units are used to isolate public, nonpublic, and safe areas.
Models and simulations are useful to show areas of concern where insufficient data are available on airflow, air pathways, airtightness, and opening descriptions, for example.
The above guidelines and observations do not represent the gold standard of building protection but, rather, the affordable complex-wide options for building protection given the cost and limitations of current sensor technologies.
DESIGN AND SELECTION TOOLS
Building Protection Toolkit (Immune Building Program)
Within the Immune Building Program, an extended effort and substantial resources were focused on developing a multipurpose toolkit to support planning for building protection. To a lesser degree, the toolkit provides real-time response to determine dosages of occupants after an event. The BPTK integrates a collection of resources from many developers and covers the following:
User input: architectural drawings, population data, scenarios involving different threat types, and external threat environments
Conversion tools: creation of three-dimensional building representations, databases, and models of threat types and Immune Building technologies;
Tools for assessing protective architectures: fast-running contaminant transport models—both indoor and outdoor; occupant mobility models for evacuation and gaming; and graphical interfaces for investigating multiple threat scenarios and Immune Building technologies, including cost estimations
The output of the toolkit captures the time-resolved history of FBE and FOE (metrics used in the Immune Building Program) as a function of cost. Use of the toolkit is aided by having predefined libraries of threat agents, filters, and sensors.
Although the BPTK has not been fully developed or deployed, it is an attempt to provide a complete resource for building protection design. It integrates many of the component efforts around the country. Given the wide threat spectrum, variations in target buildings, and their complex interaction with other factors, a comprehensive analysis of the protection and cost options for a facility is difficult. Sophisticated tools such as BPTK have the potential to provide such analysis on a cost-effective and case-by-case basis and to allow generalization of data obtained from the few test beds and deployments.
The BPTK was developed as part of the Immune Building Program. Other government agencies have also supported the development of analysis and decision-making tools. Like the BPTK, these tools are new and have received only limited testing and application use.
Life-Cycle Cost Analysis Tool for Building Protection
The National Institute of Standards and Technology’s Building and Fire Research Laboratory developed a tool for analyzing life-cycle cost with sponsorship
from the EPA’s Safe Buildings program to provide guidance to decision makers (of public facilities in particular) who are considering retrofitting their buildings to protect against biological and chemical attacks (NIST, 2006b). The Life-Cycle Cost Analysis Tool (LCAT) for building protection from biological and chemical airborne threats is based on economic tools that allow decision makers to consider options for protection components, installation, operation, and maintenance of a system (NIST, 2007). Use of the LCAT allows consistent comparison and contrast of the likelihood of different options to reach both protection and budget goals. The LCAT can be used to plan a building protection system and to evaluate its efficacy and cost, including unexpected expenses. LCAT is available publicly at http://www2.bfrl.nist.gov/software/LCCchembio/index.htm.
BPTK and LCAT are useful tools, but other design tools for building protection exist. For example, the Chemical-Biological Protection Tool (a tool for screening potential security upgrades) developed by the Technical Support Working Group and CONTAM PWC (a modified version of the publicly available CONTAM multizone modeling program) developed by the United Technologies Research Center have useful applications to building protection. Any plans for building protection design or the design of selection tools should consider as many available resources as possible prior to the design of building protection systems or the selection of tools.
Security Design Criteria
Following the 1995 attack on the Alfred P. Murrah Federal Office Building in Oklahoma City, the U.S. Marshals Service was commissioned to perform a national study on vulnerabilities of federal buildings to terrorist attack. The report, Vulnerability Assessment for Federal Facilities (DOJ, 1995), was released in June 1995, and among its recommendations was the creation of a permanent Interagency Security Committee (ISC) by executive order (EO) to address physical security concerns of the federal government, including development of government-wide standards. ISC was established by EO 12977 in October 1995 and comprises 14 agencies. Currently under DHS, ISC has published and updated the Security Design Criteria (ISC, 2004a,b) for all nonmilitary, federally owned and leased properties. Although the security design criteria were primarily driven by considerations of blast mitigation, Chapter 5 of the report, “Mechanical Engineering,” addresses some aspects of chemical, biological, and radiological threats. The ISC Security Design Criteria is a “for official use only” document. Some federal agencies have supplemented these security design criteria to cover specialized needs for such institutions as the National Institutes of Health and the Department of Veterans Affairs.
Unified Facilities Criteria
In 2003, DOD, through multiple uniformed services, developed the Unified Facilities Criteria (UFC): DOD Minimum Antiterrorism Standards for Buildings UFC 4-010-10 (DOD, 2003). Similar to the ISC security design criteria, the UFC criteria are directed primarily at blast mitigation. However, the U.S. Army Corps of Engineers also drafted Protecting Buildings and Their Occupants from Airborne Hazards in 2001 (U.S. Army Corps of Engineers, 2001). These documents are for unrestricted distribution.
After the terrorist attacks on September 11, 2001, guidance on building protection shifted not only from incidents that could be effectively controlled by security to incidents that require detailed strategy and planning of systems but also from being primarily provided by the government to government designers to being provided by a broad spectrum of key entities. Many guidance documents on how to reduce the impact of airborne biological and chemical attacks have been issued. In the case of airborne releases, the HVAC system can be an important weapon for thwarting or responding to an attack. Thus, these documents present a substantial reference library that can be used to guide building protection strategies that encompass risk management, physical security, protective technology, protective action, maintenance and commissioning to improve building security and response to attacks by using the HVAC system. The guidance documents include the following:
Building Security Through Design (AIA, 2001)
DOD Minimum Antiterrorism Standards for Buildings (DOD, 2003)
Design and O&M: Mass Notification Systems (DOD, 2002)
Securing Buildings and Saving Energy: Opportunities in the Federal Sector (Harris et al., 2002)
Addressing the Threat of Terrorism: Guidelines for Prevention and Response (IFMA, 2002)
Protecting Buildings from a Biological or Chemical Attack: Actions to Take Before or During a Release (LBNL, 2003)
National Air Filtration Association Position Statement on Bio-Terrorism (NAFA, 2001)
Sheltering in Place as a Public Protective Action (NICS, 2001)
Guidance for Protecting Building Environments from Airborne Chemical, Biological, or Radiological Attacks (NIOSH, 2002)
Guidance for Filtration and Air-Cleaning Systems to Protect Building Environments from Airborne Chemical, Biological, or Radiological Attacks (NIOSH, 2003)
Protecting Buildings and Their Occupants from Airborne Hazards (USACE, 2001)
It would be wise to consult a variety of available resources to develop the best overall building protection strategy.
Information collected from test beds and current deployments is insufficient to provide comprehensive guidance on protection options for buildings across the DOD complex. Although many lessons were learned, the ability to extrapolate data and results that are specific to one facility to other facilities and situations is difficult to assess. Some observations can be made despite these limitations. (The role of test bed and decision support tools in a process for deployment of building protection is discussed in detail in Chapter 6.)
When the different groups of threat agents are considered (see Chapter 2), the group to which most buildings are most vulnerable—“cannot detect and cannot treat”—is not addressed by the more advanced technologies of LP-4. The only options to address these greatest vulnerabilities are the LP-1 and LP-2 options. Therefore, the building protection systems deployed in many high-asset federal buildings focus on LP-1 and LP-2 approaches.
The committee observed that some existing programs considered the initial costs of a building protection system and paid less attention to maintenance and operation costs, which have to be sustained by operational funds or some other continuous funding source. Both initial and life-cycle costs (that is, initial costs plus maintenance and operation costs) are higher for active than passive protection. The increase in cost limits the sustainability of active protection at present, except in the highest-asset facilities. The cost is likely to decrease and sustainability is likely to improve as the accuracy and reliability of sensor systems improve over time. Decision support tools such as BPTK will become important integrative tools for the design and implementation of building protection, particularly if these tools become repositories for performance data and costs of current and future deployments.