Download - Flight Deck Security Improvement Details

Fokker Services B.V.

- 1 -

The Development of Flight Deck Security L. van der Laan Fokker Services BV

1 Introduction On September 11th, 2001 terrorist attacks took place in the United States in which civil aircraft were used. The attacks resulted in a high number of casualties. The images of the two towers of the World Trade Center collapsing after being hit by two wide-body commercial airliners will remain the horrifying examples of terrorism. It was evident that something had to be done to prevent reoccurrence. Crew training programs were introduced and airport security was increased. Also the need to enhance security on board of the aircraft was considered essential as a so-called last line of defense. The FAA issued SFAR 92 on October 9th 2001 as a first step to increase flight deck security. This SFAR 92 allowed US operators to take immediate action to enhance security by allowing them to block the flight deck door during flight. As part of this action (called phase 1) a temporary relief on airworthiness requirements was given.


- 2 -

It was obvious that the relief of airworthiness requirements like decompression and flight crew egress would only be allowed for a limited time and therefore SFAR 92 also included a requirement that US operators would issue a plan for conversion at of before April 9th, 2002 focussed on converting all FAA registered aircraft by April 9th, 2003. This conversion should bring the aircraft again in compliance with the original requirements but also new requirements to permanently enhance security. The actions primary focussed on the flight deck door and the access to the flight deck. By the end of 2001, Fokker Services as a Type Certificate Holder of the Fokker aircraft, started a development program to design a new flight deck door and flight deck access system for the Fokker 100 en Fokker 70. It was the start of a very complex program in which rulemaking and interpretation thereof were developing in parallel to the design process. The latter resulted in numerous design changes and re-testing. At the same time, a very sportive compliance date was set and operators needed the modification quickly in order to modify their aircraft in time.

Figure 1: Example of Phase 1- Flight deck door lock On January 10th 2003, the first installation and certification of the reinforced flight deck door was completed successfully on a Fokker 100 of a US operator. An overview of the development program is given.


- 3 -

2 Requirements

2.1 FAA, JAA and ICAO responses On January 15th, 2002, the FAA issued the following Advisory Circulars (ACs): AC 25.795-1, "Flightdeck Intrusion Resistance" AC 25.795-2, "Flightdeck Penetration Resistance The compliance date was April 9th, 2003 for FAA registered aircraft. The ACs included new requirements for the flight deck door and access system but did not include requirements for bulkhead protection yet. In addition to the ACs, any new design would have to meet the original requirements as well i.e. decompression, crew egress, fireworthiness etc. ICAO recommended operators to comply with the new FAA standard at or before November 1st, 2003. Aircraft with a seating capacity less than 60 passengers and/or a weight below 45,5 tonnes were excluded. JAA responded by issuing NPAs 25D-336, NPA 26-16 and NPA 26-18 and adopted the ICAO recommendation of November 1st, 2003. However, the CAA-UK Department for Transport decided to set the compliance date for UK registered aircraft to April 30th, 2003 and announced to perform a study to investigate the possibility to extend the requirement also for smaller aircraft (>19 pax). The study was to be completed by April 2003

2.2 New requirements The following is a summary of requirements needed to be demonstrated for new door designs Penetration resistance, ref AC25.795-2

Bullet-resistant to National Institute of Justice IIIA standard Intrusion resistance, ref AC25.795-1

Resist impact of 300 Joule (several locations) Resist 250-lb. pull on doorknob.

Decompression Fireworthiness Crew egress Crew incapacitation


- 4 -

2.3 Requirements in motion A complicating factor was that the interpretation of AC25-795 did change during the months after the issue. Examples are: After decompression; no intrusion resistance will be required In case forceful opening of panels/door cannot be prevented, intrusion must not

be possible (small openings only) Being able to point a gun through an opening in the door and posing a threat is

not acceptable The need to testing all gaps, inserts, interfaces etc. Effects of material combinations to be verified/demonstrated As a result, the engineers of the new designs, like Fokker Services, were required to change the designs over and over again to find a solution meeting all requirements

Memorandum by FAA

Explanation Interpretation

AC25-795

Emails/Forums/Discussion

Testing/experience

JAA/ICAO


- 5 -

3 Fokker solution 3.1 Fokker Services approach Fokker Services decided to split the development program into two steps: Step 1: Develop a modification of the Fo100/70 existing design instead of a completely new door

Use practical approach and proven designs Use existing designs as much as possible Standardize as much as feasible

Step 2: Develop derivatives for other aircraft types (F28, F27 and F50) based on knowledge gained in step 1.

3.2 Original Fo100/70 cockpit door design

Figure 2: Fokker original flight deck door design The typical design of the flight deck door of the Fokker 100 and Fokker 70 includes: Flat panel door set at an angle of 26 degrees Door is opening to cabin side Locks on the RH side wall Hinge at LH side wall Size 53 cm x 190 cm (21 x 74.8 inches)

Cockpit door


- 6 -

The door consists of two door panels (upper/lower). Both are made of 18 mm honeycomb with two layers of glass fabric on each side (Phenol-resin). Furthermore a dcor/covering was applied to each side of the door. The lower door panel includes a flight crew egress possibility (kick-out panel) and also detaches in case of the decompression on the flight deck or in the cabin.

Figure 3: Lower door panel interface

3.3 The Fo100/70 door modification With respect to the intrusion and penetration resistance, a detailed analysis was made. It was obvious that the existing lower panel was too large and too easy for intrusion. Fortunately, analysis of decompression scenarios showed that size reduction could be justified. It was decided to keep decompression panels as small as possible to improve intrusion resistance. The concept chosen for the new door was to be based on: Installation basically unchanged to keep advantage of 26 degree angle Honeycomb door strengthened by Dyneema panels installed on flight deck side

by means of screw/inserts. Rearrangement of decompression panels New steel piano hinge to replace aluminum hinges Manual release for crew egress


- 7 -

3.4 Impact testing In order to be sure that the combination of the existing door and the Dyneema panels bolted onto the honeycomb would be able to sustain multiple impacts of 300 Joule, 2 series of tests were performed at NLR Test Center in the Netherlands. The test set-up included a 45 kg ram compliant with AC25.795-1. The ram was dropped vertically onto a representative panel with an energy level 300 Joule. The tests demonstrated that a panel that was re-enforced with Dyneema could withstand 300 Joule impacts without significant degradation Also, a steel piano hinge in combination with a steel U-shaped profile was able to withstand a 300 Joule impact directly next to hinge line without significant degradation.

Figure 4: Intrusion resistance 45 kg Ram and proof of concept test


- 8 -

Subsequently, full-scale tests were performed at NLR Test Center for which a reinforced door was installed in a cockpit section. Seven impact zones were defined and subsequently hit several times by the 45 kg ram. For this purpose, the ram was installed in a sling to enable it to hit the door perpendiculary. All tests passed and were witnessed by CAA-NL. Only one door was needed for all impacts instead of the three doors that were originally planned.

Figure 5: Intrusion resistance full scale testing at NLR

3.5 Bullet resistance The concept that was selected to make the door bullet resistant was a design that was previously used by Fokker. It consisted of bolted-on panels at flight deck side. This concept has good characteristic for absorbing the energy of the bullet at impact. It was decided to use Dyneema because of its superior performance compared to Kevlar (less weight at same costs, better protection also under angle). Also, Dyneema was able to exceed the NIJ IIIa standard (that was referenced in AC25.795) at a thickness of only 5 mm. In addition, Dyneema showed superior performance compared to Kevlar when a bullet hits under an angle. The latter was important because the Fokker 100/70 door was installed under an angle of 26 degrees.

Figure 6: Dyneema base material


- 9 -

The entire door needed to be covered including the decompression panels. Also, a glass top layer was added to the Dyneema panels to enable paint application or dcor. The (new) application of Dyneema was developed and certified by a team of Fokker Services, Fokker Special Products and DSM - High Performance Fibers. Tests were performed at TNO center for ballistic research in Rijswijk (Netherlands). The program included shots to be fired at all locks and build-on equipment on the door, all gaps, panels, inserts and protective (steel) plates as applicable. However, a lot of problems were identified which were all solved eventually. Examples are: Decompression relief panels need to be able to open at low differential pressure.

Yet, no bullets were allowed to pass through the interfaces of these panels and the door.

Several combinations of materials were used, some of which needed to be changed during the test program in order to meet the requirements

Locations of the bolts and inserts needed for the Dyneema panels were weak points in the door that needed special attention. A .44 Magnum pointed exactly at this installation would go through the door.

The door lock needed to be protected as well because a bullet that would damage the doorlock might allow the door to be opened

All tests finally passed and were witnessed by CAA-NL.

Figure7: Penetration resistance testing at TNO

. Figure 8: Penetration resistance test panels


- 10 -

3.6 Decompression One of the most difficult requirements to meet was the requirement to provide pressure relief in case of decompression of the flight deck or the cabin. During decompression, the load on the door and bulkhead would exceed the structural limits in case no pressure relief would be provided. It is obvious that a feature to provide this pressure relief would also be a possible weak part with respect to intrusion and penetration resistance. In order to keep the openings after decompression as small as possible, it was decided to install three decompression panels that swing towards the flight deck only. Edges of the panel and interfaces were protected by steel U-shaped profiles (CRES) with extra ballistic protection. All gaps around the panel were covered by Z-shaped profiles. The lower panel was split into two parts to ensure pressure relief when observer seat is used (upper part abuts against observer seat.). To ensure that the panels would not open in case somebody tries to enter the flight deck by hitting on the door, pressure relief latches were installed. These pressure relief latches prevent the panel from opening towards the flight deck and can sustain the impact tests. In case of decompression on the flight deck, the latch will be operated by the sudden pressure drop and unlatch the panel.

Figure 9: Decompression panel lay-out


- 11 -

In case of decompression in the cabin, a different more simple approach was used. The loading of the lower door panel at the moment of decompression will exceed a spring load applied by a spring installed on the flight deck side of the door. The lower section will subsequently swing open as a door.

3.7 Flight crew egress The airworthiness requirements also include a facility for flight crew egress in case of an emergency when the door is blocked. For this purpose, the flight deck door design include a manual release bolt which is only accessible from flight deck side. Release of the manual release bolt allows the lower door part to be opened.

Figure 10: Egress spring

3.8 Fireworthiness All materials used in the aircraft need to comply with fireworthiness requirements. This also applied to the door design. Therefore tests were performed on the Dyneema and the combination of Dyneema and the existing door build-up. These tests were completed successfully.

Figure 11: Fire test test samples


- 12 -

3.9 Rescue demonstration One of the most conflicting requirements was the requirement that rescue personnel should be able to enter the flight deck within 10 minutes using hand tools only and without prior knowledge of the design. A demonstration at Schiphol airport proved that the design also meets this airworthiness requirement.

Figure 12: Rescue test

3.10 Remote Lock and Access Systems A reinforced flightdeck door does not provide sufficient protection against unauthorized access in case the door lock system is not designed to the same standards. The interpretation of the requirements in 2002 resulted in the need for a feature to lock or unlock the door from each pilot station. In addition, two modes of operation were defined:

3.10.1 Normal/routine This access procedure is initiated by establishing contact with the flight crew from the cabin by means of the interphone or knocking on the door. Subsequently, the flight crew would perform verification by means of an observer window in line with companys procedures. If the request is found acceptable, the door would be opened with caution.

3.10.2 Emergency (crew incapacitation) This access procedure would only be used in case the normal/routine procedure fails. The procedure is intended to enable access to the flight deck in case of crew incapacitation or a minor crash. The procedure would need to be started by entering a code on a keypad in the cabin. However, also other means are acceptable.


- 13 -

This initiation is followed by an aural and visual alert on flight deck for 30 to 60 seconds which allows the flight crew to deny access by means of pressing a button. If no deny is given, door unlocks after the delay of 30 60 seconds. In case of a 'deny', the door remains locked and the access mode will be disabled for 5 min.

A typical system set up consisted of: Solenoid operated mechanical lock/striker assembly Flight crew interface Keypad or unique device used in case of emergency access Control unit/electrical logic

Figure 13: Door access system components


- 14 -

3.11 Miscellaneous door features

Two items of the new reinforced flight deck door, have not been mentioned: Ballistic resistant peephole or observer window Mechanical lock to allow dispatch of the aircraft in case the electrical access

system has failed. This would be allowed for a limited amount of flights only( MMEL dispatch)

Figure 13: Miscellaneous door parts


- 15 -

4 Entrance monitoring Systems

4.1 General The need to visually monitor the area outside the flight deck door to identify persons requesting entry to the flight crew compartment and to detect suspicious behavior or potential threat is of vital importance to enhance flight deck security. Opening the reinforced door should only be done in case the flight crew is absolutely sure. This has resulted in a discussion regarding the need for an entrance monitoring system. Such a system would provide the flight crew an overview of the entrance area and in general would most likely consist of a video system. The discussions of regulatory level are currently focussing on whether or not it is necessary for the flight crew to operate/view any controls and displays while seated with the seat belt and shoulder harnesses fastened. It is yet unclear if it will be required to install a entrance monitoring system that allows monitoring of the entrance area by the flight crew from their seated position or that an observer windows (with more limited view) in combination with company procedures would be sufficient.

4.2 Video Surveillance System Fokker Services has developed a video surveillance system for the Fokker 100 and Fokker 70 together with Goodrich Sensors. The standard system includes: One 6-inch display 2 cameras with night vision capabilities Controls in pedestal (center section of

the flight deck)

Figure 14: Video Surveillance System


- 16 -

5 Future developments Future developments to further enhance the security include: A phase III/IV variant of AC25.795 for new-build aircraft that also includes

bulkhead protection Introduction of Hijack code transponders. This would allow flight crews to send a

hijack code to the ground that can not be reset. The installation is nicknamed the Please shoot me down button

Video surveillance Combat training of crew members (already introduced at some airlines) Security officers on-board (already introduced at some airlines) Guns for flight crew

6 Summary and conclusions The development of a reinforced flight deck door to enhance flight deck security has been a complex task with many conflicting requirements. However, solutions have been found. It should however be realized that anti-terrorist protection is never 100 %. The Flight deck security modification nevertheless improves safety and security on board of the aircraft. It is clear that harmonization between FAA/JAA is needed and that requirements and interpretation processes should be completed in the very early phase of the development. This allows manufactures to design solutions that comply with the new requirements in an effective and efficient manner.