Documente Academic
Documente Profesional
Documente Cultură
Robert G. Eastin*
INTRODUCTION
Two well known and widely applied sets of damage tolerance requirements are
those that must be adhered to for the design of USAF aircraft and those that must be
used for the certification of civil aircraft type designs in the United States.
Although each set is commonly referred to using the words damage tolerance
significant differences exist in intent and application. This paper examines some of
these differences.
In conducting any comparison it is important to clearly define exactly what is
being compared. The USAF damage tolerance requirements have been subject to
revisions since they were first adopted and often custom tailored to specific aircraft
systems. However the basic philosophy and intent has remained unchanged since
ASIP 2005
the first requirements were published in 1974. Therefore for the purposes of this
discussion the USAF requirements being compared are those in [1].
Extra care must be taken when identifying what FAA requirements will be
compared. This is because somewhat different requirements have evolved over the
years for small airplanes, transport airplanes, small rotorcraft and large rotorcraft.
These requirements are contained in parts 23, 25, 27 and 29 respectively of [2] and
the differences have been discussed by Eastin [3]. In the discussion that follows the
FAA requirements that will be compared are a subset of those that were originally
published for transport airplanes in [4]. This subset is included in paragraphs (a)
and (b) of section 25.571 of [2] as amended by [4]. Other requirements are
included in paragraphs (c), (d) and (e) of section 25.571. These are Fatigue (safelife) evaluation, Sonic fatigue strength and Damage-tolerance (discrete
source) evaluation respectively and are beyond the scope of this discussion since
they have no similar counterparts in the requirements of [1].
CATEGORIES OF FATIGUE
The author believes it can be useful to separate fatigue into three categories. This
was first proposed in [5] and this convention will also be used here to facilitate the
discussion. The categories are normal, anomalous and unexpected normal, and are
described below.
Normal Fatigue
ASIP 2005
There are many examples of unexpected and premature fatigue that cant be blamed
on an off nominal physical condition. Some typical root causes include incorrect
external loads and/or internal loads/stress, overly severe usage (as compared to
design assumptions) and other shortfalls in our ability to accurately model the
structure and predict the future. In hindsight this category of fatigue has to be
considered normal and we typically do well at postdiction once we correct our
input data. In most cases unexpected normal fatigue is representative of the fleet
and should be addressed accordingly.
BACKGROUND
A review of key events leading up to the adoption of the requirements is considered
helpful in understanding the differences that exist. As noted below the USAF and
the FAA had uniquely different experiences that resulted in somewhat different
conclusions, objectives and requirements.
ASIP 2005
USAF
Key events and experience that lead to the adoption of damage tolerance
requirements by the USAF have been reviewed by Lincoln [8], [9], [10]. A
summary illustration is provided by Figure 1 below.
1950
B-47
F-111
ACCIDENTS
ACCIDENT
1960
1958
1970
1969
1980
1974
Fatigue
(8866/8867/Durability)
BOTH
Damage Tolerance
(83444)
ASIP 2005
had to be addressed such that it would not be expected in fielded aircraft during
their service lives.
Although the new USAF safe-life requirement forced the aircraft designers to
consider fatigue, in addition to static overload, as a threat to structural integrity it
was soon realized that it did not prevent the use of low ductility materials operating
at high stress levels. The example of this most commonly cited is the F-111. The
F-111 experience painfully illustrated how such design decisions combined with an
unexpected defect could be devastating. As part of the F-111 engineering
development program a successful full scale fatigue test of the wing box was
accomplished to 16,000 simulated flight hours. Accounting for test spectrum
severity the USAF interpreted the results as demonstrating a safe-life of 6000 hours
using a scatter factor of four. Nevertheless on December 22, 1969 an F-111 crashed
as a result of a fatigue failure in the lower plate of the left wing pivot fitting. The
total time in service at the time of the accident was 100 hours. This failure was
attributed to a defect that was produced during manufacture of the forging that the
plate was fabricated from. This and other service incidents convinced the USAF
that the existing fatigue requirements needed to be augmented. It was reasoned that
the requirement to fatigue test by itself could still result in designs that were not
sufficiently tolerant to manufacturing and service induced defects. To achieve the
desired tolerance something had to be done to positively affect the design relative to
material choices, stress levels and design details. That something was determined
to be prescriptive crack growth and residual strength requirements assuming that
defects are present when the airplane first enters service.
In summary what motivated the USAF to adopt their damage tolerance
requirements was the conclusion that the safe-life approach by itself had not
delivered the overall structural integrity desired. Specifically they were missing a
level of robustness largely due to unfortunate choices of materials and stress levels
that were not influenced by the fatigue requirements that were on the books at the
time. The added requirements directly influence material selection and stress levels
at the design stage. It should also be noted that the USAF damage tolerance
requirements were supplemental to the fatigue requirements already embodied in
[11] and [12]. That is, the USAF did not get rid of the existing requirements but
simply added to them to achieve the overall desired result.
FAA
A summary of key events that are important in the evolution of FAA damage
tolerance requirements is provided by Figure 2 below.
COMET
LUSAKA
ACCIDENTS
ACCIDENT
1950
1954
1956
Fatigue (Safe-life)
1960
1970
EITHER
Fail-safe
1980
1977
1978
Yes
Is DT
Impractical?
No
Damage-tolerance
(Amdt 45)
ASIP 2005
ASIP 2005
advance at the time. It was the first commercial jet and was designed for relatively
high altitude operation. Shortly after entry into service a Comet flying at 30,000
feet disintegrated and crashed into the Mediterranean Sea. All airplanes were
removed from service and were not returned until fleet modifications were made to
correct what was thought to be the cause of the accident. However shortly
thereafter a second Comet disintegrated at 35,000 feet and crashed into the
Mediterranean. The accident investigation that followed included a full scale
fatigue test of the fuselage and revealed fatigue critical locations at openings in the
pressurized fuselage that had not been identified previously. It also was found that
the critical crack size was relatively small and could not be expected to be detected
during normal maintenance.
The Comet experience reinforced the thought that the fail-safe approach might
be an acceptable and even superior alternative to the safe-life approach. Consistent
with this the FAA revised the CARs in March 1956 [14] and added fail-safety as an
option to the safe-life approach.
Fail-safe became the option of choice for the majority of large transport aircraft
certified in the 1960s and 1970s. This included the Airbus A300; Boeing
707/720, 727, 737, 747; Douglas DC-8, DC-9/MD-80, DC-10; Fokker F-28; and
Lockheed L-1011. The fail-safe approach was very attractive for several reasons.
If a structure can be designed such that cracking will be readily detected before it
becomes dangerous it can be reasoned that cracking in itself is not a safety issue.
Additionally the knowledge of when cracking might be expected becomes an
economic issue and is not necessary to insure safety. Consistent with this the failsafe rule did not include a requirement to perform full scale fatigue testing or
identify any special directed inspections to supplement normal maintenance.
Compared to what safe-life required of both the applicant and their customers the
attraction of fail-safe is easily understood.
Although the fail-safe option was widely applied there was an underlying
concern by many relative to its effectiveness in the long term. Maxwell [15]
discussed this and considered some of the potential dangers that have developed
in the application of the fail-safe approach over the years. One of the biggest
concerns was the eventual loss of fail-safety as the airplane ages and normal fatigue
cracking becomes more and more probable. This is because a structures fail-safe
characteristics are dependent on successful redistribution of load from failed or
partially failed elements to intact surrounding structure. In many cases success is
dependent on the surrounding structure being in near pristine condition. At some
point in the life of the structure normal fatigue wear out makes this an unrealistic
expectation. It is at this point that the fail-safe concept can no longer be relied on
for safety.
The concern over long term reliance on fail-safety for continued airworthiness
became more widespread within the aviation community as the jet transports that
ASIP 2005
had been originally certified using the fail-safe option started to approach their
design service goals. Ultimately this concern is what prompted the Civil Aviation
Authority (CAA), in the United Kingdom (UK), in the early 1970s to limit the
operational life of large transport aircraft that had been certified as fail-safe. For
example all Boeing 707 airplanes in UK registry were limited to 60,000 flight
hours. The British Authorities also announced that for these aircraft to be allowed
to operate beyond the specified life limits something more would need to be done.
In the midst of all the concern over the long term effectiveness of fail-safety an
accident occurred that is considered by many to be the key event that served to
solidify and accelerate changes in civil aviation requirements and policies dealing
with the threat of metal fatigue in primary airframe structures. This was the crash
of a Boeing 707-300C, operating under British registry, during final approach to
Lusaka airport on May 17, 1977. The details of this accident and its impact on
airworthiness requirements have been discussed by Eastin and Bristow [16]. An
extremely thorough accident investigation concluded that the crash was a
consequence of the loss of the horizontal stabilizer due to undetected fatigue and
subsequent failure of the aft upper spar chord. This was in spite of the fact that the
design had been certified in accordance with the fail-safe rules of CAR 4b.270 by
both the FAA and CAA. This is a classic example of structure certified as fail-safe
that did not, in service, fail in a safe manner. The failure of fail-safety in this case
was due to insufficient attention given to detectability, a lack of understanding of
the external loads and incorrect assumptions made about the fatigue and residual
strength characteristics of the structure.
As noted previously the Lusaka accident hastened major changes to civil
aviation requirements that were already being considered. Consideration was
already being given to requiring special directed inspections for fatigue cracking
based on quantified crack growth and residual strength characteristics. This became
know as the damage tolerance approach. Guidance for the use of this approach
for protecting the safety of older aircraft was published by the FAA in [17].
Manufacturers of the fail-safe certified aircraft previously noted voluntarily
followed the guidelines and produced Supplementary Inspection Documents (SIDs)
that were mandated by Airworthiness Directives starting in the mid 1980s.
Consistent with the change of philosophy for continued airworthiness for older
aircraft was a change to the certification requirements for new type designs.
Amendment 45 to part 25 was issued in 1978 [4]. This revision removed the failsafe option completely and added damage tolerance as the approach that must be
used unless shown to be impractical. In the past there has been some debate on
whether or not fail-safety was actually removed and if so whether or not it was
intentional. Some light is shed on these questions by the response to a comment on
proposed deletion of the parenthetical expression fail-safe from the heading of
section 25.571(b). The response is included in [18] and is as follows;
ASIP 2005
Date
Airplane Model
Fatigue Design Basis
Fatigue Test
Design Life (DL)
Component Involved
Material Involved
Total Time in Service at
F-111
Lusaka
F-111
B707-300
Safe-life
No
6,000 Hours
20,000 Flights/60,000
Hours
100 Hours
7079-T6 Aluminum
ASIP 2005
10
ASIP 2005
USAF
FAA
Safe-life approach
inadequate
Fail-safe approach
inadequate
Applicability:
Objective:
Safety indefinitely
Outcome:
Incorporation philosophy:
Replace safe-life
Replace fail-safe
Threats addressed:
No (Addressed by
durability requirements)
Yes
Anomalous fatigue
Yes
Yes
No
No
No
Yes (Safe-life)
No
No
Yes
No
Yes
No
Cracking scenarios
Yes
No
Yes
No
Inspection intervals
Yes
No
Residual strength
Yes
Yes
Normal fatigue
Prescribed requirements:
11
ASIP 2005
USAF
12
ASIP 2005
possible. Swift [6] articulated this when he wrote .the Rogue Flawed Aircraft
needs to be accounted for. This is the one or two aircraft in the fleet having some
kind of initial manufacturing damage not representative of the rest of the fleet.
In accordance with prescribed initial condition assumptions, the initial cracking
array, if holes are present in the structure, would typically consist of a singular .05
crack located on one side of the most critical hole along with .005 cracks located
in all other holes. The subsequent cracking scenario to be assumed is also specified
and addresses the growth of the rogue .05 crack and also growth of the .005
cracks. Assumptions to be made relative to continuing growth patterns are also
included in the requirements.
The USAF requirements also allow the manufacturer some latitude relative to inservice inspection. Under certain circumstances it may be assumed that in-service
inspections will occur. If this is done the requirements prescribe what size cracks
should be assumed subsequent to inspection and how much crack growth life the
structure must possess with those cracks present.
In all cases the structure must always retain a minimum level of strength.
Residual strength requirements are specified as a function of the level of inspection
required to detect the postulated cracking.
The USAF requirements leave little undefined or open to interpretation. They
are intended to insure that the structure has a minimum amount of robustness
relative to defects that might be unintentionally introduced. To achieve this the
structure must possess specified crack growth and residual strength attributes. In
this context they are design requirements.
FAA
It has been and is the general policy of the FAA not to dictate design. This is the
case with the damage tolerance requirements and this was clarified in a response to
public comments to the requirements as originally proposed. The Notice of
Proposed Rulemaking [21] included text that could be interpreted to mean that the
design had to have certain intrinsic properties. Several comments objected to the
wording contending that it would impose an absolute requirement that would be
impossible to comply with. In response to these comments in the Discussion of
Specific Comments section of [4] the FAA noted that, The purpose of the
proposal was to establish an evaluation requirement rather than an absolute
requirement for the strength, detail design, and fabrication of the structure.
Consistent with this the wording was changed for clarification.
Like the USAF requirements the FAA requirements leave it up to the
manufacturer to decide on the design concept to be used. Both single and multiple
load path structural designs are allowed. This was made clear in the Preamble
Information section of [21]. Here it states that:
13
ASIP 2005
14
ASIP 2005
FAA Pre-Amd 45
Yes
Yes
Yes
Yes
Design Attributes
Yes
No
No
In-service detectable
crack sizes
Yes
No
Cracking scenarios
before and after
primary failure*
Yes
No
Minimum crack
growth life before and
after primary failure*
Yes
No
Determined by
manufacturer.
Yes
Yes
Included as
Approach:
Optional
Prescribed requirements:
Initial crack size for
intact structure
Damage size after
primary failure*
Inspectability of
primary failure*
Residual
strength
* Stable
load path
failure or crack arrest.
Table
3. Comparison
of USAFinto
and USAF
FAA Fail-Safe
Fail-safety
is fully integrated
damage Requirements
tolerance requirements as an
approach that can be used for qualification of certain types of structure. The other
approach is referred to as slow crack growth and can be used for all types of
15
ASIP 2005
structure. In the context of the USAF requirements fail-safe is a design concept that
must be matched with a degree of inspectability to identify a damage tolerance
category. Detail requirements are prescribed, as previously discussed in the section
on Requirements, and depend on the category.
If the fail-safe option is selected there are prescribed requirements for both the
intact structure and the structure subsequent to a load path failure or crack arrest.
This makes qualification of structure as fail-safe relatively onerous and since the
selection of category is left up to the manufacturer it has been avoided in the past.
It is noted in [22] that, at the time of publication of that document, there were no
aircraft in the USAF inventory that had been originally designed and qualified to
the USAF fail-safe requirements. The author believes that this still holds true
today.
FAA
Prior to amendment 45 the fail-safe approach was included as an option to the safelife approach. The requirements were include in 14 CFR, section 25.571, paragraph
(c) Fail safe strength, where it stated the following:
It must be shown by analysis, test, or both, that catastrophic failure or
excessive structural deformation, that could adversely affect the flight
characteristics of the airplane, are not probable after fatigue failure or
obvious partial failure of a single principal structural element. After these
types of failure of a single principal structural element, the remaining
structure must be able to withstand static loads corresponding to the
following:
The specified static loads were associated with design envelope type conditions.
Swift [6] succinctly summarized the generally accepted approach used for
compliance with the above requirements when he wrote the following:
Generally, manufacturers satisfying the requirements under the fail-safe
concept merely substantiated the structures for failure of single principal
elements under static loading conditions. Although it was recognized that
inspections were necessary there were no specific requirements to
determine safe inspection periods based on crack growth or remaining life
of secondary structure in the event the primary member failure was not
immediately obvious.
Swift [23] has also noted that reliance was placed completely on the
correctness of the arbitrary selection of sites and the final size of damage chosen
for residual strength substantiation. Goranson [24] speaking to this same issue
wrote that, This would often lead to residual strength demonstration by analysis of
defined obvious failures rather than showing that all the partial failures with
16
ASIP 2005
Airplane
Model
Skin
Crack
Size
40
DC-9
20
B737
20
B727
20
B747
12 skin crack.
12
20
DC-101
L10112
1.
2.
17
ASIP 2005
18
ASIP 2005
(5) Eastin, R.G., Strategies for Ensuring Rotorcraft Structural Integrity, North
Atlantic Treaty Organization Research and Technology Organization Meeting
Proceedings 24 (RTO-MP-24), Corfu, Greece, April 1999.
(6) Swift, T., Verification of Methods for Damage Tolerance Evaluation of
Aircraft Structures to FAA Requirements, Proceedings of the 12th Symposium
of the International Committee on Aeronautical Fatigue, Toulouse, France,
1983.
(7) Tiffany, C.F., Durability and Damage Tolerance Assessments of United States
Air Force Aircraft, Proceedings of the 9th Symposium of the International
Committee on Aeronautical Fatigue, Darmstadt, Germany, pp. 4.4/1-4.4/31,
1977.
(8) Lincoln, J.W., Life Management Approach for USAF Aircraft, AGARD
Conference Proceedings 506.
(9) Lincoln, J.W., Significant Fatigue Cracking Experience in the USAF,
Proceedings of the 22nd International Congress of Aeronautical Sciences,
August 2000.
(10) Lincoln, J.W., Damage Tolerance USAF Experience, Proceedings of the 13th
Symposium of the International Committee on Aeronautical Fatigue, Pisa,
Italy, 1985.
(11) Military Specification, Mil-A-008866A(USAF), Airplane Strength and
Rigidity Requirements, Repeated Loads and Fatigue, 31 March 1971.
(12) Military Specification, Mil-A-008867A(USAF), Airplane Strength and
Rigidity Ground Tests, 31 March 1971.
(13) Swift, T., Damage Tolerance in Pressurized Fuselages, 11th Plantema
Memorial Lecture, Proceedings of the 14th Symposium of the International
Committee on Aeronautical Fatigue, June 10-12, 1987.
(14) Civil Aeronautics Board, Airplane Airworthiness Transport Categories, Part
4b-3 paragraph 270, March 1956.
(15) Maxwell, R.D.J., Fail-Safe Philosophy: An Introduction to the Symposium,
Proceedings of the 7th International Committee on Aeronautical Fatigue
Symposium, London, England, July 1973.
(16) Eastin R.G., Bristow, J.W., Looking at Lusakas Lessons, Proceedings of the
2003 USAF Aircraft Structural Integrity Program Conference, December 2-4,
2003.
(17) FAA Advisory Circular No. 91-56, Supplemental Structural Inspection
Program for Large Transport Category Airplanes, May 6, 1981.
19
ASIP 2005
(18) FAR Final Rule, Federal Register: July 20, 1990 (Volume 55, Number 140),
14 CFR Part 25 (Docket No. 24344; Amendment No. 25-72).
(19) Wood, H.W., Application of Fracture Mechanics to Aircraft Structural Safety,
Engineering Fracture Mechanics, Vol. 7, 1975, pp. 557-564, Pergamon Press.
(20) Eastin, R.G., Pearson, R.M., C-17A Structural Development and
Qualification, presented at 36th AIAA/ASME/ASCE/AHS/ASC Structures,
Structural Dynamics and Materials Conference, April 10-12, 1995, New
Orleans.
(21) FAR Notice of Proposed Rulemaking, Federal Register: August 15, 1977
(Volume 42, Number 157), 14 CFR Part 25 (Docket No. 16280; Notice No. 7715).
(22) Joint Service Specification Guide, JSSG-2006,
Department of Defense, 30 October 1998.
Aircraft
Structures,
(23) Swift, T., Damage Tolerance Technology Phase I, FAA Class Notes,
1999.
(24) Goranson, U.G., Damage Tolerance Facts and Fiction, 14th Plantema
Memorial Lecture, 17th Symposium of the International Committee on
Aeronautical Fatigue, June 9, 1993.
20