Development of Fire Detection Systems for Special Freighter ConversionsKeywords: “Dry Run” AAR Pump, Multi-Criteria Smoke Detector, Military Commercial Derivative
Aircraft (MCDA)
military aerial refueling and strategic military
transport aircraft developed by Boeing from its
767 jet airliner. The tanker was selected by the
United States Air Force (USAF) to replace older
Boeing KC-135 Stratotankers.
Figure 1: Boeing KC-46A
The Pegasus is a variant of the Boeing 767 and is
a widebody, low-wing cantilever monoplane with
a conventional tail unit featuring a single fin and
rudder. It has a retractable tricycle landing
gear and a hydraulic flight control system. The
Pegasus is powered by two Pratt & Whitney
PW4062 engines, one mounted under each wing.
The KC-46A has been described as combining
the 767-200ER's fuselage, with the 767-300F's
wing, gear, cargo door and floor, with the 767-
400ER digital flight deck and flaps.
The flight deck has room for a crew of four
with a forward crew compartment with seats for
15 crew members and in the rear fuselage either
palletized passenger seating for 58, or 18 pallets in
cargo configuration. The rear compartment can
also be used in an aero-medical configuration for
54 patients (24 on litters).
There is a ladder that can be pulled down near the
front landing gear to provide for quick ingress to
the aircraft by crew for rapid deployment
situations.
refueling boom (1200 GPM) supplemented by
Wing Air Refueling Pods at each wingtip (400
GPM @ 50 ±5 PSIG at Coupling MA-4) and a
Centerline Drogue System under the rear fuselage
(over 400 GPM).
Transport (MRTT) (Figure 2) is an aerial
refueling tanker aircraft based on the
civilian Airbus A330.
The Airbus A330 MRTT is a military derivative
of the A330-200 airliner. It is designed as a dual-
role air-to-air refueling and transport aircraft. For
air-to-air refueling missions the A330 MRTT can
be equipped with a combination of any of the
following systems:
System (ARBS) for receptacle-
Figure 3: Advanced aerial air refueling boom
system
for probe-equipped receiver aircraft.
(FRU) for probe-equipped receiver aircraft.
• Being refueled:
in-flight refueling (Figure 4).
slipway installation (UARRSI)
“second-hand” B767-200ER/-300ER passenger to
a Multi-Mission Tanker-Transport (MMTT)
refueling via wingtips pods. The modification of
the B767-200ER to MMTT aircraft allows air
refueling operations in both FREIGHT and
TROOPS configurations including VIP, and/or
Medical Evacuation (Medevac) (Figure 5).
Figure 5: IAI B767-200 “Smart Tanker” MMTT
+ C4I (Command, Control, Communication,
(Figure 6 - 8).
Figure 7: Probe & drogue air refueling control
panel
Conversion of second-hand aircraft provides best
value for money, outstanding performance, and
high-dispatch reliability, multiple solutions and
capabilities, enhanced mission flexibility, built-in
operational experience, and total maintenance,
engineering & logistics support.
operation of second-hand Multi-Mission Tanker-
Transport (MMTT) and discusses the engineering
challenges through aerodynamic, aeroelasticity,
systems, mechanical systems and interior
modifications required to cope with the Military
Commercial Derivative Aircraft (MCDA)
six-step program:
collection including: wing deflections and
fuselage pressurization to verify strains at
critical loads and locations, and environmental
control system (ECS) performance (Figure 9).
Figure 9: Accelerometers installation Map
• Wind-tunnel aerodynamic tests to verify air
flow patterns and aeroelasticity and flutter
envelope at the wingtip pod & pylon interfaces
(Figure 10).
ILAN BERLOWITZ
surface weak shock
(Figure 11).
reinforcement
electrical & avionics systems following the
guidelines of aviation industry standards,
including SAE ARP 4754 (Systems), RTCA
DO-160G (Environmental), DO-254
ARP 4761 (Safety).
with wingtip pods following the military
guidelines of NATO ATP-56 (B) [Air to Air
Refueling] and MIL-A-19736 [Air Refueling
Systems, General Specification for].
demonstrate airworthiness by verifying
requirements and applicable to the USA
Department of Defense (DoD) Military
Commercial Derivative Aircraft standards and
methods MIL-HDBK-516 [Airworthiness
Methodology
• Removal of all passenger amenities in the
passenger compartment; seats, bins,
fuselage structure.
(MDCD).
configuration to Class “E” cargo compartment
(Class “C” in terms of flammability
specifications) with an in-flight personnel
access.
smoke detection & Halon fire extinguishing
systems. Same smoke detectors in the main
MULTI-MISSION TANKER-TRANSPORT CONVERSION
for commonality.
compartments between the flight deck and the
main deck cargo compartment. The added
compartments include escape devices for
flight crew & supernumeraries. It also includes
installation of a new heater enables additional
heating capability to the supernumerary
distribution system, and all required
installations to provide access to the main deck
cargo compartment.
• Four air refueling pumps hydraulic motor
driven, “dry run” type, submerged into the
central auxiliary fuel tank ("center tank")
(Figure 12 - 13).
refueling system schematic
installation
pumps.
to allow fuel transfer by gravity from the left
and right main wing tanks to the center tank
(Figure 14).
avoid over-pressurization of the left and/or
right main wing tanks in case of rupture of the
air refueling line (Figure 15).
Figure 15: Wing tank protection system
• Installation of fuel surge protection system
(mechanical and pneumatic) to avoid over-
pressurization of the air refueling system in
case of AAR pumps operation or receiver
aircraft disconnect.
ILAN BERLOWITZ
(not containing fuel), self hydraulically
powered.
Operation (RARO) station facing aft with two
operator seats.
viewing system to provide day & night IR
sensitive, for real picture of the air refueling
process (Figure 16).
• Combines Civil & Military Flight
control of the military radios and navigational
equipment to allow the flight crew to select
either to fly in civil mode using the original
civil aircraft equipment data or in military
mode of operation (Figure 17).
Figure 17: Flight deck control panels
• The air refueling pod consists of the following
sub-systems (Figure 18 - 19):
Hydraulic power supply system
consist of (Figure 20):
barrier to meet emergency landing
requirements and to provide sealing and
pressure differential, and occupant's protection
in case of main deck fire.
• Installation of a cargo loading system (CLS),
guiding assemblies, restraints and additional
seat tracks to provide additional support for
the CLS.
water accumulation within the airplane
structure and to prevent corrosion.
• Modification of the air conditioning system
and air distribution ducts rerouting, to
accommodate freighter configuration (Figure
• Improving cabin air quality by using carbon-
based chemical filtration systems for removal
of odors from recirculated cabin air, combined
with high-efficiency particulate air (HEPA).
• Modification of the temperature control of the
main deck cargo compartment to maintain
temperature at 2-4°C for perishable cargo
transport.
detection system, meeting the 1-minute rule
detection time required by the latest
regulations.
downstream of the air cycle machines to cut
air supply to the main deck cargo compartment
in case of fire/smoke in the main deck.
• Replacement of flow control and shutoff
valves (FCVs) by new valves with a low flow
mode to allow reduced fresh airflow to the
occupied areas in case of fire/smoke in the
main deck.
controls/landing gear cables, pitot-static and
hydraulic tubing to accommodate the loading
of high pallets.
ceiling, decompression & maintenance panels,
should meet most severe flammability
procedures required in FAA 14 CFR Part 25
Appendix F Part III [Test Method to
Determine Flame Penetration Resistance of
Cargo Compartment Liners].
emitting diode (LED) lighting system
permanent and flashing type.
compartment.
and voice date recorder (VDR) to allow access
when aircraft is fully loaded with containers
(Figure 22).
ILAN BERLOWITZ
ambient smoke detectors as required by the
FAA/NTSB safety recommendation A-09-53.
comply with FAA 14 CFR 25.795(c)(2)
[Security considerations] and the guidelines of
AC 25.795-7 [Survivability of systems].
Regulations
legally binding the civil aviation community. The
widely Federal Aviation Regulations (FARs)
issued by the US Federal Aviation Administration
(FAA) and certification specifications (CSs)
issued by the European Aviation Safety Agency
(EASA) are referenced in this paper. Conversion
changes a certified airplane. These changes do not
require a new Type Certificate, but needs to be
covered by a Supplemental Type Certificate
(STC). The original Type Certificate plus the
approved changes in type design equal a STC. The
most important regulation for passenger-to-
freighter conversion is FAR/CS Part 25
Airworthiness Standards, Transport Category
significant change at product level. The product
individual changes are classified according to the
FAA guidelines of the changed product rule
(CPR). All changes and affected areas comply
with the latest amendments except for earlier
amendments, but not earlier than the type
certificate (TC) amendment level, in the following
cases:
Payload - Range Chart
different aircraft models, payload-range charts are
used. The point at the lower right end of the chart
(P1) shows ferry range, the aircraft carries no
payload and starts flight with full fuel tanks
(Figure 23).
at maximum tank capacity. At (P2) the maximum
takeoff weight (MTOW) is reached. To further
increase payload towards (P3), the amount of fuel
has to be reduced so the range decrease per added
payload. At (P3) the sum of operating empty
weight (OEW) and payload equals the maximum
zero fuel weight (MZFW) and further increase of
payload is impossible. Reducing OEW but leaving
both MZFW and MTOW unchanged, the payload-
range chart in the range from (P1) to (P4) of the
original aircraft is moved right parallel to the
payload-axis by the amount of the reduction.
Figure 23: Payload - Range Chart
Flight Deck
deck configuration and create a dedicated area for
non-crewmembers, known as supernumeraries, or
enlarge the existing flight deck for seating of
supernumeraries.
existing flight deck aft wall is removed and the
flight deck is extended aft up to the new rigid
cargo barrier. The existing left hand observer seat
is removed and the right hand observer seat is
retained as is. Three supernumerary seats are
mounted on the forward face of the rigid barrier.
A new flush type lavatory is installed on the
right hand side of the flight deck and a new dry
galley including storage cabinet installed on the
left hand side aft of entry door L1 (Figure 24).
MULTI-MISSION TANKER-TRANSPORT CONVERSION
Figure 24: B767-300 enlarge flight deck
Unit Load Devices Rapid loading and unloading can be achieved by
utilizing loads. Unit load devices (ULDs) include
aircraft pallets and containers, which interface
directly with the cargo handling and restraint
system. ULDs ensure that cargo is moved safely,
quickly and cost effectively. An aircraft container
is a completely enclosed ULD composed of a
base, walls, doors and a roof as assembled panels
or as a single shell. An aircraft pallet is a platform
with a standard dimensions undersurface on which
goods are assembled and secured with a net
(Figure 25).
Main Deck Cargo Configuration
available to optimize the volume of freighter being
loaded into the main deck cargo compartment via
the newly installed main deck side cargo door.
Modularity is the key word for cargo loading since
a whole range of containers and/or pallets may be
loaded (Figure 26 & Table 1).
Figure 26: B767-300 loading configuration 88" x
108" x 82”
Characteristics
368,172 309,000
Maximum Landing
Weight (MLW)(Lbs.)
390,218 326,000
26
Structure Modifications
in design weights and high cargo loads in the main
deck while retaining the aircraft external
geometry, flight characteristics and performance.
The changes include replacement/reinforcement
frames reinforcements are also part of the
structure modifications. Some of the new floor
beams are machined from aluminum plate to
enhance structural integrity. Fuselage frames are
also reinforced.
capacity and payload revenue, 9g safety net or 9g
rigid barrier configurations is designed to prevent
movement of containers and meet emergency
landing requirements. The 9g rigid barrier allows
the operator to load an additional pallet/container
due to its shape. A large cutout is performed on the
left hand side of the aircraft and replaced by
reinforced surrounding structure and the main
deck cargo door via segmented hinges.
Several analyses are used for substantiation of
the structure modifications. The methodology of
substantiation is based on:
the passenger flight envelope, no increase in
landing gear loads above the passenger
aircraft. Weight and center of gravity
limitations are introduced for cargo loading to
ensure that the passenger airplane design loads
are not exceeded.
a comparative dynamic analysis of the
complete aircraft models before and after
conversion, aimed to showing negligible
differences in the relevant frequencies and
mode shapes.
and the structure repair manual (SRM) are
used to perform damage tolerance analysis to
comply with FAR/CS 25.571. A fatigue
spectrum is developed for the freighter versus
passenger configuration.
and properties of the converted airplane are
taken into account to build a finite element
model (FEM) and conduct a finite element
analysis with a highly accurate loads
distribution. The analysis includes various
parameters such as internal load, mechanical
constraints, 9g forward crash condition, gear
loads, flight envelope, main deck floor loads
and decompression loads. An internal pressure
tests with strain gages instrumentation provide
FEM validation to the structural change on the
aircraft structure (Figure 27).
with MDCD open
location with reference to the landing gear, the
aircraft is first weighed in a level attitude on the
wheels; and to determine the center of gravity
height, the aircraft is then weighed at different
attitudes. This pre-conversion process allows to
derivate the aircraft center of gravity position
taking into account the aircraft dimensions.
Main Deck Cargo Door (MDCD)
Main deck cargo door (MDCD) is typically an
outwards and upwards opening side door. An
upward opening door ensure an easy access to the
main deck, reduces the risk of damaging the door
or its hinges and to some extent protects the
interior from precipitation during ground
operations. An isolated electrical circuit controls
door opening and closing (Figure 28).
Manual operation of the door is normally
provided as a backup in case of a system failure.
Several catastrophic accidents have demonstrated
the need for visual inspections of door locking
mechanism and provisions to prevent
depressurization when the door is not fully closed
and locked. To ensure pressure equalization across
the door prior to opening, a pressure relief door is
fitted. Current door designs allow operation in
winds up to 40 knots.
The MDCD has been certified by the FAA to
FAR 25.783 amendment 25-88 and by EASA to
JAR 25.783 including NPA 25-301 (similar to
FAR 25.783 Amdt 25-114). Therefore the MDCD
design meets latest requirements FAR 25.783
Amdt 25-114 May 3, 2004. The MDCD is
installed on the left hand side of the fuselage
forward of the wing and is hinged at the top.
The door is operated through three
mechanisms: lock, latch and lift. Each mechanism
is mechanically independent, but electrically
sequenced with the other mechanisms in the
opening and closing cycles.
MULTI-MISSION TANKER-TRANSPORT CONVERSION
operated via two control switches available on the
door control panel: the first switch operates the
lock and latch mechanisms while the second
switch operates the lift mechanism only. Electrical
sequencing of the lock, latch and lift actuators are
accomplished by limit switches and relays. The
MDCD and other operational doors have a master
caution & warning and EICAS caution message if
left open or unlocked. An aural warning inhibits
above the decision speed (V1) during takeoff. In
addition to the indication lights available on the
MDCD control panel and to the indication light in
the flight deck reporting a potential unsafe
condition of the door, and several decals are
installed on the outside of the MDCD next to each
of the locking units to provide the operator a very
sharp way to determine whether the door is safe or
not. A white flag can be seen at each of the view
ports if the locking units have reached their
position required for safe conditions.
Environmental Control System
modified to accommodate special freighter
configuration by deleting items unique to the
passenger configuration (main deck sidewall
outlets) and by adding items unique to the special
freighter configuration (fire protection related
valves).
better airflow rate, temperature control, duct
pressure and noise levels as before the conversion
and to meet FAR 25.831 [Ventilation]
requirements in terms of airflow rate, temperature
control and carbon monoxide (CO) and carbon
dioxide (CO2) concentrations.
temperature in the flight deck between 19C
(66F)-29C (84F), in the main deck cargo
compartment between 19C (66F) - 29C (84F)
in case of normal temperature selection and
between 2C (38F) - 19C (66F) in case of
temperature selection required by perishable
goods.
• Sidewall ducts and associated outlets are
removed.
distribution ducting.
fighting emergency procedure requiring:
cargo compartment via closure of the Class
“E” shutoff valves.
provide a sufficient amount (reduced
airflow) of fresh air to the occupied areas.
Fwd & mid E/E cooling system
reconfiguration to supply fresh air to the
avionics equipment.
includes air heater for supplemental heating of
the supernumerary compartment.
(E/E) cooling system to match the freighter
aircraft requirements.
recirculated air to the different compartments.
Therefore, the cabin air re-circulation system and
associated control logic and switches are retained.
After conversion, the air distribution system is
balanced and tested to satisfy the defined criteria
of success. Fine tuning of the system is performed
by introducing screen restrictors thus balancing
the airflow delivered to the occupied areas (flight
deck and supernumerary area), to the main deck
compartment and to the lower cargo compartment
and electronic bay.
Freighters evolve a problem that is not an issue on
a passenger configuration: main deck cargo
compartment fire and smoke. FAR Part 25
requires that smoke evacuation from the cockpit
area must be "readily accomplished, starting with
full pressurization and without depressurizing
beyond safe limits". Fire suppression on Class “E”
cargo compartment requires complete stoppage of
airflow to the cargo area in order to minimize
oxygen, while still supplying fresh air to the
occupied areas to replace smoke in the cabin and
sustain a pressure differential across the smoke
barrier. As a consequence, modification of the air-
conditioning system is necessary. During normal
operations, aircraft cabin is fed by a mixture of
engine bleed air, conditioned in the air cycle
ILAN BERLOWITZ
supplied from the mix manifold separately to the
main and flight cabins. Three possible
modification options:
duct. These valves shut down the airflow in a
fire situation to prevent air from entering the
main deck. Smoke evacuation and air supply
to other areas can be accomplished with the
otherwise unchanged system.
allowing just a small amount of fresh airflow
to the occupied areas.
supply to the airplane as a whole (all flow
valves are shut off). The airplane is then
depressurized and the ram air inlet supplies
fresh air only to the occupied areas. Air and
smoke are drawn overboard through the
overboard extraction valve. By manipulating
cabin outflow valves, a positive pressure
differential across the smoke barrier can be
established, helping to keep the occupied areas
smoke free.
Fire Protection
detection and fire extinguishing/suppression
systems as detailed below:
o APU fire detection.
system smoke detection.
o Wing leading edge overheat detection.
o Tail cone overheat detection.
o Main & lower cargo compartment smoke
Detection (Figure 29 - 32).
o Lavatory smoke detector.
extinguishing/suppression.
for the addition of a new main deck cargo smoke
detection system and of fire suppression means in
case of fire in the main deck.
The main deck cargo smoke detection system
is single loop logic and meets the 1-minute rule.
The system 2-LRUs (Line Replaceable Unit)
architecture uses a cockpit control panel and FAA
TSO-C1e approved smoke detectors ("duct" or
"ambient") having their sensitivity set to provide
an alarm at light transmissibility of 97% (3%
obscuration rate). The entire electronics is built in
the cockpit control panel.
light attenuation, reflection, refraction and
absorption of certain wavelengths.
architecture
(MCR) smoke detectors include dual optical
chamber, two temperature sensors, and a humidity
sensor.
smoke detector
fire type (open or smoldering) and adjust the
sensitivity accordingly. Temperature criteria and
MULTI-MISSION TANKER-TRANSPORT CONVERSION
adjust detector's sensitivity to detect smoke and to
prevent deceptive signals due to high humidity
variation. The performance of a smoke detector is
optimized by adjusting detection logic according
to environmental conditions, and smoke
properties. Environmental conditions analysis
significant reduction of false alarms, compared to
conventional detectors.
The MCR smoke detectors are incorporated in
state-of-the-art cargo smoke detection systems, for
the main & lower cargo compartments. The
systems provide:
temperature significantly below structural
configurations and conditions.
Considering the probability for a fire event to be
less than 1.7 E-07 per operating hour (OH), system
reliability calculations are conducted and
compliance with safety requirements of FAR
25.1309 is demonstrated in the following Table 2.
Table 2: Smoke detection system functional
hazard analysis (FHA)
twenty multi-criteria PMC11 smoke detectors,
FAA TSO C1e approved, mounted within
recessed cavities on the ceiling panels and a
cockpit control panel, located on the P5 aft
overhead panel. The new system is integrated into
the existing aircraft systems to provide the
standard fire alerts and fault indications via the fire
warning and master caution lights and annunciator
system. It contains a Built-In Test Equipment
(BITE) capability for self-checking.
detection system
the guidelines of FAA AC 25-9A, to demonstrate
detection time anywhere within the cargo areas
and through the entire aircraft flight envelope.
Each test is conducted by generating a small
amount of smoke at numerous locations within the
cargo compartments. Figure 33 shows a Kidde
Aerospace smoke generator producing smoke
according to AC 25-9A.
Fault Conditions Classification
Major < 1.00 E-05
fire
penetration test is conducted, to demonstrate
sealing-proofing of occupied areas. The test also
supports demonstration of no inadvertent
operation of smoke detection for adjacent
compartments; smoke is detected only in the
compartment where it originates.
suppression system" that does not necessarily
extinguish fire, but rather suppresses it to ensure
safe landing. Currently, the most effective and
most commonly used suppression agent is Halon.
Although production and usage of Halon is
restricted by international agreements due to its
effect on the ozone layer, continued use for aircraft
fire suppression is supported by the FAA and the
US Environmental Protection Agency.
concentration levels. According to FAA
Airworthiness Directive, a minimum initial
concentration of 5 percent is required throughout
the compartment to suppress combustion to
controllable levels, thereafter, the system must
sustain a minimum of 3 percent for 60 minutes to
prevent re-ignition or spreading of combustion,
and for airplanes certified for extended-range
twin-engine operations (ETOPS), the fire-
suppression system must be able to sustain a 3
percent concentration of Halon within the
compartment for a maximum of 180 minutes.
However, according to FAA Amendment 25-93,
the often-quoted Halon concentration of 3 percent
is not a requirement, but is typically used.
A fire-suppression installation typically
suppression nozzles, electronic units and a flight
deck control panel. Depending on airplane model
and its configuration, fire-suppression and
detection systems may add up to 300 pounds (136
Kg) to the empty weight of an airplane.
Electrical and Avionics Changes
smoke detection, communication, lighting, and
indications. Electrical system components are
removed, modified or changed to support all
changes that include: circuit breakers, switches,
wire bundles, indications, etc. The wiring design
and installation is performed in accordance with
Process Specifications which are equivalent to
Boeing standards to ensure satisfying quality.
Wires for modified systems are same standard as
the existing or an alternative compatible type, in
accordance with Boeing D6-54446 Standard
Wiring Practices Manual.
with the actual electrical load and wire gage. Six
inches clearance between new and modified wires
and between wires connected to equipment
installed inside of the fuel tanks are kept. The
existing wire bundles, located along left side of the
aircraft are relocated and rerouted to bypass the
main cargo door cutout.
their functionality. The rerouting is supported by a
series of tests performed on each rerouted cable
system to ensure same ratio between cockpit input
displacement and cable-end displacement before
and after conversion. The tests also allowed to
ensure losses within the system remain acceptable
compared to their pre-conversion levels.
Every cable is tested from the pilots' hand grip
or foot-hold, e.g. stick, pedal, lever, handle, etc.,
to a location downstream of the proposed
modification. The cockpit control is gradually
loaded and the loads are monitored. The load is
resisted as far as possible along the cable,
depending on the type of test (proof or
operational) and control system involved by either
of two methods:
system.
conversion, the loads (forces and moments) are
continuously monitored not to exceed the
allowable limits. Load levels are prescribed by
FAR 25.397 and 25.405. The loads refer to pilot’s
grip position location on the column, pedal, lever,
etc. Displacement gauges measure the control
travel displacment (linear or angular). The intent
of this test is to apply 100% of pilot limit loads to
comply with the requirements of FAR 25.681 and
25.683, and to produce cables slack conditions, to
MULTI-MISSION TANKER-TRANSPORT CONVERSION
Compliance with the regulations is considered
fulfilled also when cockpit control stops are
reached under less than 100% of limit load
(Figure 34).
& pressure bulkhead modification
special freighter includes the simplification of the
basic water & waste system supported by the
replacement of large potable water tank by a
smaller tank for weight saving as only a limited
quantity of water is necessary for freighter
airplanes. Simplification of the waste system and
deletion of half of the basic vacuum waste system
is also performed for the same reasons (Figure 35).
Figure 35: MMTT simplified water System
Oxygen Systems
of the existing oxygen systems to provide oxygen
to the crew and to the supernumeraries at each user
inhalation. The system is based on two oxygen
cylinders located in the forward cargo
compartment and on gaseous diluter demand
masks available at each flight deck
occupant/supernumerary station. The oxygen
capabilities in case of failure of the crew oxygen
cylinder. A portable oxygen system is also
provided in the lavatory and for access to the main
deck cargo compartment in case of required return
to seat due to sudden decompression or cargo fire
(Figure 36).
Main Deck Cargo Loading System (CLS)
A typical cargo loading system (CLS) (Figure 37)
consists of necessary equipment to provide
movement, guiding and restraint of cargo. Power
drive unit (PDU) may be installed to move ULDs
semi-automatically. These items can be attached
either directly or via tray assemblies and floor
fittings to seat tracks and floor structure. System
selection depends, to a certain extent, on how good
the ULDs layout with its required restraint
installations fits floor structure and seat tracks.
Elements and layout of a CLS are determined
by the fact that a system of ULDs is already used
worldwide and by the need to maintain the
interlining capability with the system.
Figure 37: Cargo loading system (CLS)
Tray assemblies provide moveable restraint for
various parts of the CLS like locks and rollers.
ILAN BERLOWITZ
tracks in both directions. Brake rollers restrict the
movement of ULDs to one direction. They prevent
unintended movement of ULDs in cargo
compartments with a sloping floor, particularly
towards the doorway area.
containers. Restraint requirements are found in
NAS 3610. The mechanism of
longitudinal/vertical restraint locks can be
retracted below the roll plane to enable loading
and unloading. Tray-mounted locks can be moved
along the tracks and locked to them by shear pins.
End stop assemblies provide longitudinal and
vertical restraint for cargo pallets and containers at
the beginning and end of a ULD row. They may
be retractable to ease unloading. Outboard guide
rails can be installed throughout the aircraft on
both sides of the door to protect the fuselage from
damage and may contain side locks. Side locks are
used to provide vertical and transversal restraint.
They are mounted either directly or via fittings
onto existing structure. Centerline guide
assemblies are installed along the aircraft
centerline. They guide and restrain ULDs that are
loaded side-by-side along the centerline.
Doorsill protector assemblies are installed at
the opening of the cargo door. They are attached
to seat tracks by tie down studs and are positioned
by shear plungers. These units are hinged to
enable upwards folding when not in use. Rollers
and caster assemblies are mounted on the doorsill
protectors to provide friction-reduced travel for
loading and unloading containers. A hinged side
guide is mounted on the outside edge of the
doorsill protector. The side guide is raised during
use to guide containers into the cargo door.
Compared to purely manual loading, PDUs
make ground operations more efficient. PDUs add
considerable weight to the OEW and require
power during ground operations. There are floor
mounted and track mounted PDUs. The latter are
small enough to fit into trays and are lighter, but
have to be provided at a greater numbers. Quality
of rubber coating on the small rollers is essential
for satisfactory operation. To allow ULD
movement in all directions and rotation necessary
in door areas, there are steerable floor-mounted
PDUs. Alternatively, a set of PDUs in
perpendicular layout can be installed. A
centralized control unit is necessary to ensure
efficient and safe operation and only PDUs needed
to move ULDs at their actual position are
powered. Spacing of PDUs is a tradeoff between
the number and weight of all PDUs. Tray mounted
PDUs are typically spaced at around 30 inches.
Floor mounted PDUs may be spaced wider. If
spacing is too wide, badly warped ULDs with bent
base edges may stall as PDUs lose contact with the
ULDs during transport. In wet conditions, a poor
ULD contact with the PDUs may cause conveying
difficulties.
compartment consist of:
ventilation flow.
compartment illumination.
requirements of FAR 25.853 and 25.855 as
demonstrated by flammability testing (FAR Part
25 Appendix F). Passenger emergency equipment
including life rafts and aft door slides are
removed. The existing emergency equipment in
the flight deck retain unchanged. TSO approved 4-
man life rafts are installed in flight deck. Two TSO
approved cabin attendant life vests are retained in
their stowage positions for use by
supernumeraries. TSO approved portable ELT is
installed on inboard galley wall. 2.5 lbs fire
extinguisher is installed on the 9g rigid barrier,
adjacent to the galley.
and for the supernumeraries remain unchanged:
forward cabin doors 1L and 1R (including slides)
and flight deck LH & RH #2 windows.
Emergency Equipment
a number of emergency equipment items. Several
already exist, but some major items need to be
added. 9g rigid barrier is designed to resist the 9g
longitudinal loading of main deck cargo
compartment per FAR/CS 25.561 (Figure 40).
MULTI-MISSION TANKER-TRANSPORT CONVERSION
Allowable of material are required to prove the
ability of the barrier to withstand the uniform
pressure due to load under 9g emergency landing
condition. Specimen's tests are performed for
bending, shear and compression to evaluate the
design values in compliance with FAR
25.613(a)(b). Several tests are conducted to
provide enough statistical data for determination
of the statistical based design values (Figure 41).
Figure 41: 9g barrier shear & bending tests
Main Deck Floor Drain
A floor drain system is provided for the main deck
cargo compartment. The floor drain is connected
to the existing forward and aft drain masts. The
forward crew lavatory and galley drain (gray
water) is retained. The main deck cargo
compartment floor is sealed and water dams are
installed along the side walls, aft bulkhead and
forward at the anchor beam, to prevent water
seepage (Figure 42).
Rotor Burst
(APU) rotor failure. Modified items potentially
affected by rotor burst are flight control and
electrical wires routed in the main deck floor
and/or ceiling. All flight controls have backup
system, allowing a continued safe flight and
landing. Electrical wirings for flight control are
located in raceways under the main deck floor
beams, away from the risk zone. The design
should meet the requirements of FAR 25.903(d)
and AC 20-128A [Design Considerations for
Minimizing Hazards Caused by Uncontained
Turbine Engine and Auxiliary Power Unit Rotor
Failure].
to avoid rotor burst damage. The verification
shows that in case of rotor burst there is no effect
on the continued safe aircraft flight and landing
(Figure 43).
Reliability & Flight Safety
the average probability of occurrences and
established as a maximum of 1 x 10-9 for each
failure condition with a catastrophic effect.
MIL-STD-882E [System Safety] identifies and
classifies military systems hazards and is
ILAN BERLOWITZ
defense agencies within the United States
Department of Defense (DoD).
(ALoSP) is generally based on an acceptable
accident rate. The associated probability of
occurrence for military aircraft might be higher
than the equivalent civil aircraft due to the nature
of their purpose. ALoSP for military aircraft may
be based on a risk assessment process.
A higher accident rate should be considered
for military aircraft. A factor of 10 is often used
when comparing a military aircraft with an
equivalent civil aircraft (see Figure 44).
Figure 44: Acceptable level of safety
performance
maximum probability levels of failure per flight
hour are higher than civil aircraft systems. When
military standard is required the Severity Category
Catastrophic/Probability Level Improbable - the
On the other hand, commercial equipment
exhibits a significantly lower Mean-Time-
Between-Failure (MTBF) in military service.
Therefore, risk and as low as reasonably
practicable (ALARP) evaluation is required for
each case, to identify where systems meet
tolerability criteria, and where further action is
required to achieve this.
certification procedures are a major flight safety
issue of MCDA and should be given considerable
attention (Figure 45).
development processes
[Certification Considerations for Highly-
performed before development to validate that
architecture can meet safety objectives and
identify necessary redundancies and define
(DAL). Safety System Assessment (SSA)
performed after development process
implementation including: Reliability Prediction,
failure), Common Mode Analyses (CMA) and
Fault Tree Analysis (FTA) (Table 3 - 4).
The reliability parameters are defined down to
the component level. Component failure rate is
constant during the system life period, i.e. failure
rate distribution assumed as exponential. The
components failure rates prediction is based on
one of the following reliability data sources: MIL-
HDBK-217F, Notice 2, NPRD-95, EPRD-97,
Vendor’s reliability data. The FMECA is
performed in accordance with MIL-STD-1629A.
The method used in the FMECA is the
hardware/functional approach. The FMECA
analyzes each single item failure as if it were the
only failure within the system. The criticality
numbers are calculated for 3 hours as average
flight & 1 hour for refueling mission duration. The
MULTI-MISSION TANKER-TRANSPORT CONVERSION
from the FMD-97.
Table 4: Aerial Air refueling system failure
conditions
Maintainability
quantitative maintainability of the added/modified
systems. It shall be used to determine, whether the
quantitative maintainability parameters can be
achieved with the proposed design.
Maintainability modeling process as defined
by MIL-HDBK-472, procedure V is used in order
to established Mean Time to Repair (MTTR) and
Mean Corrective Time (MCT) and Mean Man-
Hours (MMH).
MIL-HDBK-472 standard times and/or
performance (payload, range, endurance), while
civil standards mainly focus on safety.
A Military Commercial Derivative Aircraft
(MCDA) is a commercially produced aircraft with
an FAA Type Certificate (TC) and produced under
FAA Production Certificate (PC) - commercial
off-the-shelf product. Military modifications may
be fully or partially FAA approved to civil statutes
for the purpose of retaining airworthiness
certification.
the starting point for substantiation of the military
modifications based on utilization of FAA Order
8110.101A [Type Certification Procedures for
Military Commercial Derivative Aircraft] and
Advisory Circular AC 20-169 [Guidance for
Certification of Military Special Mission
Modifications and Equipment for Commercial
Derivative Aircraft (CDA)] are provided.
Figure 46: Graphic chart of Title 14 of the Code
of Federal Regulations
hours per day (actually, a commercial aircraft
Severity
Number
Severity
Category
Description
I Catastrophic Failure conditions, which would result in multiple fatalities, usually with the loss of the
airplane
II Hazardous Failure conditions, which would reduce the capability of the airplane or the ability of the
crew to cope with adverse operating conditions to the extent that there would be:
(i)       A large reduction in safety margins or functional capabilities
(ii)     Physical distress or excessive workload such that the flight crew cannot be relied
upon to perform their tasks accurately or completely, or
(iii)    Serious of fatal injury to a relatively small number of the occupants other than
the flight crew
III Major Failure conditions, which would reduce the capability of the airplane or the ability of the
crew to cope with adverse operating conditions to the extent that there would be, for
example:
(i)       A significant reduction in safety margins or functional capabilities,
(ii)     A significant increase in crew workload or in conditions impairing crew efficiency,
(iii)    Or discomfort to the flight crew
(iv)    Or physical distress to passengers or cabin crew, possibly including injuries
IV Minor Failure Conditions which would not significantly reduce airplane safety, and which
involve crew actions that are well within their capabilities
Category Probability
No Probability Requirement
B Probable Failure Conditions having an Average Probability per flight hour of
the order of 10 -3
or less, but greater than the order of 10 -5
C Remote Failure Conditions having an Average Probability per flight hour of
the order of10 -5
or less, but greater than the order of 10 -7
D Extremely Remote Failure Conditions having an Average Probability per flight hour of
the order of 1x10-7 or less, but greater than the order of 10 -9
E Extremely
hour of the order of 10 -9
or less
ID Hazard Description Safety Objectives
1 Inability to refuel from L/H or R/H wing POD Minor (<1.0E-3)
2 Inability to refuel from both wing PODs Major (<1.0E-5)
3 Uncontrolled overpressure in wing tanks Catastrophic (<1.0E-9)
4 Uncontrolled overpressure in PODs Major (<1.0E-5)
5 Fuel spillage from the system during flight Major (<1.0E-5)
6 Electrical sparks and arcing during flight Major (<1.0E-5)
7 Possible fire or explosion due to Fuel spillage
and electrical sparks and arcing
Catastrophic (<1.0E-9)
inability to activate guilliotine
as a mission/military aircraft of similar age).
Furthermore, and in contrast to the predictable
profiles of the civil commercial flights, mainly
constrained by the international air traffic rules,
the mission and military aircraft are designed to
operate in changing scenarios with highly
demanding missions (Figure 47). Typical profile
for civil aircraft generally corresponding to climb
up to optimum cruise level, cruise at optimum
speed and descent and landing, and also for
mission aircraft, usually including several climbs
and descents, loiters, and/or special maneuvers
such as air refueling. The cruise altitude, generally
optimum for transport flights, may vary for
military aircraft from a few thousand feet to the
aircraft ceiling, being both conditions equally
probable. In a similar way, for a given flight
profile in terms of altitude or duration, the number
and/or kind of maneuvers made by the aircraft
may differ significantly depending on the intended
usage.
The guidelines of AC 25.1302-1 [Installed
Systems and Equipment for Use by the Flight
Crew] and AC 25.1322-1 [Flight Crew Alerting]
are used in the design and installation of the
controls and displays.
flight deck modifications, the Modified Cooper-
Harper Rating Scale (Bedford Workload Scale) is
used (Figure 48).
(Bedford workload scale)
to meet new technology, the increase the flight
crew workload, operational procedures, and not to
change the way the crew interacts with other
systems, and not introduce new ways of operating
existing systems.
• STC #1 aircraft is modified to include the
provisions for military equipment including
both structural and systems modifications that
remain as part of the basic aircraft
configuration regardless of role. Items such as
additional fuel tubing, wiring harnesses, bus-
bars, pumps, valves, hydraulic and certain
structural modifications to accommodate the
air refueling installation are also included as
part of STC #1. The aircraft have certain
operational modifications including additional
installation of additional equipment.
but not activated (safe carriage). STC #2
have, in addition to STC #1, the facility to fit
pylons and wingtip AAR pods, the Fuselage
Refueling Unit (FRU), Defensive Aid System
(DAS) and an inspection camera.
Additionally, equipment are fitted to facilitate
certain military applications are included but
not activated. The flight deck configuration
was changed to include the AAR Mission
System Operators (MSO) station to conduct
AAR operations plus other flight deck panel
adjustments.
additional items which are not included at the
“fitted for civil approved STC #1 and STC #2
configurations. It includes specific military under
wing and fuselage markings for AAR operation
purposes. Any additional modifications required
to allow the activation in the “fitted with
configuration are included (Figure 49).
Figure 49: MMTT conversion certified variants
Copyright Statement
The author confirms that he, and/or his company or
organization, holds copyright on all of the original material
included in this paper. The author also confirm that he has
obtained permission, from the copyright holder of any third
party material included in this paper, to publish it as part of
his paper. The author confirm that he gives permission, or
has obtained permission from the copyright holder of this
paper, for the publication and distribution of this paper as
part of the ICAS2021 proceedings or as individual off-prints
from the proceedings.