Damage tolerance is a property of a structure relating to its ability to sustain defects safely until

repair can be effected. The approach to engineering design to account for damage tolerance is based on
the assumption that flaws can exist in any structure and such flaws propagate with usage. This approach
is commonly used in aerospace engineering to manage the extension of cracks in structure through the
application of the principles of fracture mechanics. In aerospace engineering, structure is considered to
be damage tolerant if a maintenance program has been implemented that will result in the detection
and repair of accidental damage, corrosion and fatigue cracking before such damage reduces the
residual strength of the structure below an acceptable limit. As one such approach to crack repair, the
placement of a hole at a crack tip to reduce stress concentration and inhibit crack propagation is widely
studied and implemented.

Damage tolerance analysis

1. assumed initial damaged condition of the structure

2. stresses in the structure (both fatigue and operational maximum stresses) that cause crack
growth from the damaged condition
3. geometry of the material which intensifies or reduces the stresses on the crack tip
4. ability of the material to withstand cracking due to stresses in the expected environment
5. largest crack size that the structure can endure before catastrophic failure
6. likelihood that a particular inspection method will reveal a crack
7. acceptable level of risk that a certain structure will be completely failed
8. expected duration after manufacture until a detectable crack will form
assumption of failure in adjacent components which may have the effect of changing stresses in
the structure of interest
Difference between fail safe and damage tolerant design
Fail-safe generally means a design such that the airplane can survive the failure of an
element of a system or, in some instances one or more entire systems, without
catastrophic consequences. Fail-safe, as applied to structures prior to Amendment 25-45,
meant complete element failure or obvious partial failure of large panels. It was assumed
that a complete element failure or partial failure would be obvious during a general area
inspection and would be corrected within a very short time. The probability of detecting
damage during routine inspections before it could progress to catastrophic limits was
very high. Damage-tolerance, on the other hand, does not require consideration of
complete element failures or obvious partial failures, although fail-safe features may be
included in structure that is designed to damage-tolerance requirements. A part may be
designed to meet the damage-tolerance requirements of Sec. 25.571(b) even though
cracks may develop in that part. In order to ensure that such cracks are detected before
they grow to critical lengths, damage-tolerance requires an inspection program tailored to
the crack progression characteristics of the particular part when subject to the loading
spectrum expected in service. Damage-tolerance places a much higher emphasis on
these inspections to detect cracks before they progress to unsafe limits, whereas fail-safe
allows cracks to grow to obvious and easily detected dimensions.
Damage Tolerant Design: Long Life for Today's Aircraft
Jul 1, 1999By Richard N. Aarons Bombardier's Global Express and Learjet 45, Gulfstream's G-V, Cessna's
Citation X and Excel, and Raytheon's Horizon are each unique in design and fabrication, yet they share at
least one thing -- all are certified under the damage tolerance concepts of FAR Part 25.571. While it may be
tempting simply to acknowledge that fact and move on, it turns out that operators of modern transport
category aircraft should understand the basics of damage tolerant (DT) design and certification. Not only do
DT techniques assure you of a structurally sound airplane today, but also they guarantee a practically
limitless operational life for your aircraft as long as you play by the inspection and repair rules. Certification
regulations changed significantly when DT concepts appeared in 1978 with Amendment 45 of Part 25.571.
This rule requires all new transport category airplanes to be designed, tested and certified to damage
tolerance specifications. Prior to that time, newly certified airplanes were designed to fail-safe and safe-life
standards -- the concepts still in use for today's Part 23 airplanes. The first business aviation DT airplane
was Bombardier's Challenger. The Boeing 757/767 was the first airline transport to win DT certification.
(Some derivative business jet models have been introduced in the interim under the older standards using
the STC process.) So what changed with the emergence of damage tolerant design? In the words of Cessna's
Dennis Longhofer, supervisor of durability and damage tolerance, ``Nothing . . . and everything.'' There is no
reason, Longhofer told B/CA, that an aircraft designed by any manufacturer as damage tolerant will require
any changes to the manufacturing procedures that are now in place. ``The structure doesn't look any
different and the tolerances haven't changed. The close attention to detail that the manufacturer has always
had will still be there, and the items that are of prime importance have not changed either.'' What did change,
however, was the set of starting assumptions, and those can be understood in historical context. All
certification standards for aircraft structure ultimately boil down to strength and fatigue life. In the 1940s,
airplanes were designed for strength alone with little attention paid to fatigue life; nevertheless, fatigue life
concepts turned out to be critical. As we all learned by playing with paper clips, metal fails when it is
subjected to repeated bending -- fatigue cycles, as the engineers say. The cumulative effects of fatigue on
early metal aircraft caused endless maintenance headaches, and, in some cases, catastrophic inflight break-
ups. As the aircraft industry matured, the certification focus shifted to fatigue. By the early 1950s, the FAA
had addressed the matter with a set of safe-life certification requirements. The idea was to assign a design-
life to an aircraft structural component and ensure that fatigue cracks would not develop within that safe life.
The idea was good, but its implementation was imperfect. After a time, airplanes designed to be free of
fatigue problems developed cracks before they reached their established safe-life limits. The problem was
that inac- curacies in early fatigue test and analysis procedures created vulnerabilities. Once cracks started,
they often went unde-tected due to lack of required structural inspections or fabrication techniques that hid
parts, making routine visible inspection impossible. That problem was addressed in the late 1950s with the
introduction of the fail-safe concept. The regulations were amended once more, this time to ensure that even
when a primary part fails, the remaining structure has sufficient strength to carry the load. Engineers
designed critical structures with multiple load paths -- laminated spar caps, for example, and doublers
around window and door cutouts. ``The fail-safe philosophy was well and good,'' says Longhofer, ``except
that it lacked an important ingredient -- a requirement for a detailed structural inspection to find cracks and
failures in primary load as the aircraft aged.'' In a sense, there was an assumption pre-1978 that aircraft were
perfectly designed and that there were no rogue flaws in the manufacturing process. The assumption also
prevailed that good routine maintenance programs would detect damage before it became critical. In
structures where multiple load paths were practical -- wing spars and caps, cutouts, etc. -- the design itself
would protect against failure. John Taylor, Bombardier's vice president-product development, and Francois
Casa, the company's director of technical engineering, explained that a formal approach to inspections was
the ultimate fix for this problem. Hidden cracks could develop (even in multiple load path structures) and
cause significant mischief and, sometimes, catastrophic loss. (Remember the Aloha Airlines B737 that
landed with the first-class cabin structure missing down to the floor panels?) Damage tolerance certification
adds an inspection element to the design and test process. Safe-Life vs. Fail-Safe vs. DT Under the safe-life
philosophy, (1) a part is assumed to have been manufactured flawlessly and (2) that part must be retired from
service before cracks are expected to appear. A fat cycle margin is built into the part's service life. (Today, a
manufacturer has to demonstrate a safe-life of five times more cycles than will be permitted in the field. This
ensures structural safety, but economic inefficiency. Theoretically, at least, operators of aging aircraft are
discarding expensive parts with four more lifetimes remaining.) The designer of a safe-life component
assumes that routine inspections will be performed during the aircraft's life, but usually does not establish a
requirement for rigorous, detailed inspection using advanced techniques. Makers of modern transport
category aircraft limit safe-life design to ground loaded structures -- the landing gear and its components. As
is the case with safe-life parts, a fail-safe component is assumed to have been manufactured without flaws.
Fail-safe components -- a wing spar, for example -- have no restrictive safe-life and can be flown indefinitely.
But the manufacturer assumes the operator will conduct well-defined structural inspections to determine if
one of the primary load-carrying elements in multiple load path parts may already be failed. Finally, damage
tolerance concepts assume that the world is imperfect and manufacturing flaws are possible, if not
altogether likely. DT parts are designed so that the component can safely carry the required load with a flaw
present, and that it can do so for a long time -- at least until any crack that initiates from the flaw can be
detected at a regularly scheduled, part-specific inspection. This means that the manufacturer must define a
structural inspection program for each critical structure, and, of course, it also means that operators must
carry out those inspections if the aircraft is to remain airworthy. For design purposes, the FAA assumes a
worst-case manufacturing flaw of 0.05 inch (usually in the edge of a fastener hole) and that a crack will
propagate from that flaw slowly until it reaches some point where the cracked part will fail. The initial
structural inspection for this part is then based on the crack growth time from the initial flaw size to the
critical crack size. While DT rules allow a designer to avoid multiple load paths in DT structures, none do so.
The good news, then, for the operator of a modern aircraft is that critical structures -- principal structure
elements, or PSEs as the regs call them -- employ both multiple load path design and DT analysis. (It's sort of
like the old saw about the lawyer defending a dog bite case. ``My client's dog doesn't bite; and even if he
were to bite, he has no teeth; and, besides, my client doesn't own a dog.) Designing a DT Aircraft A DT
design begins when the manufacturer decides on a service life goal for the airplane. These service lifetimes
are long -- 12,000 hours, for example, for new Citation models. Although the DT philosophy applies to the
entire aircraft, the manufacturer initially looks at PSEs individually. Typically, these are parts that will be
under repetitive tension loads. (In the wing, for exam-ple, which is usually under upward loads, PSEs might
include lower caps, lower stringers and lower splices; in the horizontal stabilizer, usually working under
downloads, PSEs include the upper caps, upper stringers and attachment fittings.) Ultimately, after much
analysis and test, the manufacturer decides on inspection intervals and techniques for each PSE. This
information becomes part of the aircraft's continuing maintenance certification manual and the airplane
remains airworthy only when the operator undertakes the inspections in the manner prescribed. No
deviations are permitted without new engineering analysis. ``For operator convenience you'd obviously like
DT inspection intervals to be as long as possible,'' says Andy Kasowski, Cessna's manager of structural
integrity programs, ``but there are limitations. You could build it in steel and you'd probably never have to
inspect it for cracks; however, it would never fly -- at least not economically. So there is always a
compromise between what gives the operator the least amount of maintenance, but is consistent with
safety.'' The proof of the DT design is uncovered in full-scale testing on computer- controlled, hydraulic
fixtures that twist and bend the aircraft, replicating the stresses generated in all flight phases. (See the
accompanying photos.) In a process called spectrum loading, engineers develop design missions for short-,
medium- and long-range flights. The computer-driven actuator loading simulates the loading for whole
aircraft. Bombardier's program is representative of that used by most manufacturers. As Taylor explains:
``First, we simulate one lifetime of testing on the entire aircraft to verify for durability; that's 15,000 flight
cycles on the Global Express.'' One test cycle represents a flight and each flight has some 200 endpoints or
test manipulations. Typical endpoints include: takeoff, taxi, climb, top-of-cruise, initial cruise, climb to
another flight level, top of descent, pressurization cycles, descent landing, taxi, etc. Each endpoint has its
own tortures. For example, in the cruise modes, most loading comes from simulated gusts. During landing
and taxi, ground loads prevail. In Global Express testing, one ``flight'' is simulated in just under 10 minutes.
These durability tests are done to verify that projected endpoints and stress concentrations in the PSIs were
adequately identified in earlier design stages. ``Basically,'' says Bombardier's Casa, ``we want to be sure at
this stage that we don't have any areas initiating cracks and that we have a good understanding of what the
stress levels are.'' During the second lifetime on the test facility, engineers use jewelers' tools to introduce
artificial flaws in areas of the PSEs under high stress. The induced flaws produce points of very high stress
concentration from which a crack will grow. Then they repeat the test cycles with the same spectrum
loadings used in the first lifetime tests, stopping every 2,000 cycles or so to monitor the flaws for crack
growth. This carries on until two lifetimes have been flown. Because individual parts are often tested alone
before they join the rest of the airplane in full-scale DT test, the net effect can be that a PSE is tested to four
or five lifetimes. Cessna, for example, will run three lifetimes of cycles on an article to see if the cracks
develop naturally, and then induce flaws at critical locations and conduct another two lifetimes. In the end,
the manufacturer bends battered PSEs in residual strength tests until they break to be sure they can handle
ultimate design loads. Cracks are manually elongated some more to determine maximum crack length at
design and ultimate loads. Inspections and Repairs When the testing is complete, the manufacturer knows
when and why cracks can propagate in PSEs. Sometimes PSEs are redesigned for longer service life. In any
event, inspection schedules and techniques are developed based on the tests. Cessna's Kasowski points out
that ``inspectability then becomes a primary design goal, because you have to be able to tell the operator
when to go look, and where to go look, and how to look in order to detect failures in those PSEs.'' In a perfect
world, the manufacturers would end up with airplanes in which all PSEs require their first inspection
sometime near the end of their design service life -- 12,000 to 15,000 hours on typical business jets with
follow-on inspections every 2,500 hours or so thereafter. Usually, however, some structures need to be
inspected before the target service life. Descriptions of what to inspect and how to do it become a part of the
official certification paperwork. No freelancing is allowed. Manufacturers make training available to operators
and approved service facilities in the special techniques required for their aircraft. Some of the inspection
tools are quite sophisticated -- technologies such as surface eddy current ultrasonics are common. Repairs
to DT aircraft must be done with the original testing and certification in mind. Generic repairs -- hangar rash,
cart damage and the like -- are specified in the aircraft's maintenance manual and can be accomplished
routinely. But the operator will have to turn to the factory's engineering department or a DT-certified DER for
guidance when undertaking non-generic repairs. The amount of engine- ering required depends on the
extent of damage. Consider a damaged spar cap, a PSE by definition. Any repair to a spar cap other than a
complete removal and replacement would have to be evaluated for DT characteristics in addition to static
strength. The DT evaluation of the repair might generate altered inspection criteria. A 10,000-hour initial spar
inspection might be reduced to 5,000 hours. This is a buyer beware situation in the resale market. The repair
history of a DT-certified aircraft is important and should be researched carefully. Composite Structures The
introduction of composite structures into modern aircraft presents special challenges for the DT experts.
Raytheon had to negotiate an entirely new certification plan when it designed the carbon-composite
Starship. Ric Abbott, Sr., Raytheon's principal composites engineer, explains that the familiar metal-type
crack propagation that occurs with repetitive bending cycles (the paper clip phenomenon) just doesn't
happen to composite structures. ``Therefore, the principle of [DT] composite certification is to assure long-
term safety based on inspections, which themselves [methods, intervals, equipment] are based on some
kind of analysis and testing.'' Manufacturing processes in composites fabrication must be intrinsically
sound, even more so than that in metal structures work. Because composites don't fatigue or corrode, the
DT engineer concentrates on design strength and the avoidance (and discovery) of rogue flaws in the
fabrication process. Non-destructive testing is especially challenging with composites because you can't see
quality in a composite structure. If something has gone wrong in the process -- porosity, lack of pressure,
curing times, etc. -- the material can delaminate. Composite aircraft face the classical full-scale tests that
their conventional counterparts undergo. The test items are exposed to two operational lifetimes with the
tortures of all mission loads -- takeoff, maneuvering, gust, pressurization, land-ing. Damage is inflicted to
simulate impact, lightning (using an arc-welding torch) and ramp rash. ``One difference with composites,''
said Abbott, ``is that we don't have established analytical methods. With aluminum we've had over 50 years
of fatigue and fracture experience. For composites, we have lots of Ph.D. papers, but nothing concrete. So,
we design empirically. We look at each structure and determine what flaw growth is possible, how long it
takes to detect it, what does it do to the structure. Principle is exactly the same, we just have to work at it
harder.'' Despite the challenges of working with composites, the results from a DT perspective are excellent.
The Starship had been fully tested through two lifetimes when it entered service. The field experience has
been surprisingly good, said Abbott, with far fewer surprises than are normally encountered in conventional
aircraft. | Business & Commercial Aviation