certification is being done, then we consider the fitting assembly as having failed when one part has failed, and our answer is no.”
2-18. Can I use a full-scale test scatter factor lower than that obtained from Equation 4?
You should not use a full-scale test scatter factor less than that obtained from Equation 4 unless you substantiate compliance to fail-safe design requirements. Reference 1 allowed reduction of the scatter factor from 4.0 down to 3.0 with an inspection program based on the results of testing that today we recognize as crack growth testing. Industry practice and FAA regulation, policy, and guidance have evolved considerably since the guidance provided in Reference 3. Today, we do not allow a type certificate (TC), amended type certificate, or supplemental type certificate (STC) program to rely on inspections alone, without demonstrated residual strength, as a means of maintaining continued airworthiness. Use of scatter factors less than those obtained from Equation 4 without the compensating features of fail-safe design features or significant residual strength capability does not provide adequate structural reliability.
2-19. What about the ‘3-sigma’ meth od of computing the safe-life?
a. Some industries and manufacturers use a method of safe-life computation known as the “3-sigma” method, wherein the safe-life is determined by subtracting three standard deviations from the mean fatigue test life. While this method is in common use, it will not provide the same probability of a detectable fatigue crack at the safe-life as our scatter factor model.
(1) Our scatter factor model uses 3.511 standard deviations to obtain the required probability, compared to 3.0 standard deviations in the ‘3-sigma’ method.
(2) Our scatter factor model incorporates an adjustment to account for the number of fatigue specimens tested.
(3) Our scatter factor model incorporates values for the standard deviation of fatigue life based on historically accepted values for the standard deviation.
b. To ensure standardization of fatigue safe-life evaluations, applicants should use the scatter factor model approach to compute the safe-life based on full-scale test results.
2-20. How do you substantiate a fatigu e safe-life with component tests?
a. You can also substantiate the safe-life of a structure with component tests that use less than the complete structure or major subassembly. Examples of component tests include testing of the wing spar and testing of the wing-center section joint. When testing at the component level, take great care to ensure that the test stresses are valid and that you have included all critical details in your test. See paragraph 2-9 for a discussion of validation of test stresses.
b. Review the design, stress analysis, static test, strain surveys, tests of similar structural configurations, and service experience to make sure that you have identified all structural details that are significant for fatigue. It is acceptable to use component specimens that include portions of immediately adjacent structural elements such as skins, webs, rib attachments and fasteners (without separately loading such elements) to simulate fretting action. The test specimen and surface conditions should be representative of the production article. Special attention should be given to areas of stress concentration such as holes, joints, changes in section, sharp corners, and rough surface finish.
c. Component testing is usually limited to simple and determinate structure that is free of stresses due to eccentricities, assembly preload, and so forth, unless enough adjacent structure is included to ensure valid test stresses.
d. You should validate the test stresses, including the peak local stresses, by strain survey comparisons with complete structures for the test loading conditions. Validation of the test stresses is necessary to account for omitted structure and to gain an accurate knowledge of the stress state in the full-scale component. Additional guidance on validation of the internal loads for component testing is given in paragraphs 2-8 and 2-9 of this AC.
2-21. What loads do I apply in a component test?
There are two types of loadings used in component tests, as follows:
a. Spectrum loading, similar to full-scale testing, intended to accurately simulate operational loadings and stress distributions.
b. Constant amplitude, or S-N testing. This testing is intended to define the mean S-N curve for use in a cumulative damage analysis. Although the loads are constant amplitude, the stress distributions in the test specimen and the magnitudes of the applied loads should accurately simulate the stress distributions in the full-scale structure and duplicate the range of expected operational loadings.
2-22. For component testing, how many specimens do I need to test?
a. If you test using spectrum loading, you should test at least three specimens representative of the most critical location of each type of detail.
b. If you are testing using constant amplitude, or S-N testing, test a sufficient number of specimens to define the mean S-N curve. Chapter 9 in Reference 6 provides guidance on methods of defining the mean S-N curve.
2-23. For component testing, what scatter factor should I use?
a. If your test uses spectrum loading, the scatter factor and safe-life are calculated similarly as for a full-scale test. The following equation defines the minimum scatter factor for component testing with spectrum loading.
Scatter FactorCT = 1.5× ScatterFactorFST Equation 5 where: CT stands for component test FST stands for full-scale test
b. The following example calculation shows the use of Equation 5.
Given: Three (3) component aluminum specimens From Equation 4: Scatter Factor FST = 3.70 Using Equation 5: Scatter Factor CT = 1.5 x 3.70 = 5.55
c. A scatter factor larger than that given by Equation 5 may be necessary if the component test specimen and test loading do not accurately simulate operational loadings, stress distributions, and the full-scale structure. An a pplicant may propose a lower scatter factor if the component test accurately simulates a full-scale test. Any reduced scatter factor must be coordinated with the Small Airplane Directorate Standards Office.
d. For constant amplitude, or S-N testing, the component test results are used to develop the mean S-N curve for use in a cumulative damage analysis. The scatter factors, or statistical adjustments, applied to cumulative damage analysis are discussed in the following paragraphs.
2-24. How do you substantiate a fatigue safe -life with analysis supported by test evidence?
a. You may substantiate the fatigue safe-life of a structure by fatigue analysis supported by test evidence. The analysis method most commonly used is the Palm gren-Miner hypothesis, also known as Miner’s Linear Cumulative Damage Theory.
b. The basic philosophy of Miner’s Theory is that the fatigue damage introduced by a given stress level is proportional to the number of applied cycles at that stress level divided by the total number of cycles to failure at that stress level. This ratio is called a cycle ratio and is used to measure damage. If you apply various levels of stress amplitude to the structure, the total damage is the sum of the cycle ratios. Failure is predicted to occur when the sum of the cycle ratios is equal to one, or the following:
k n n n ni 1 2 k ∑ = 1.0 = + + ...... + Equation 6 i=1 Ni N1 N2 Nk where: ni is the fatigue damage due to the applied number of cycles at a certain stress level Ni is the number of cycles to failure at that stress level.
k is the number of intervals the stress spectrum is divided into. Typically, the stress spectrum is divided into increments corresponding to 0.2g.
c. Reference 7 provides a sample calculation using Miner’s Theory. The Small Airplane Directorate has developed a computer program based on Miner’s Theory. The Directorate makes this software available to airframe Designated Engineering Representatives (DERs). For additional information on the software, please see Reference 8.
2-25. What are some concerns with substantiation by fatigue analysis?
a. Accuracy of the cumulative damage hypothesis. Several references, including Reference 9, compare spectrum test results to cumulative damage predictions. These references show that fatigue failure may occur between damage summations between 0.5 to 2.0, depending on various loading parameters. In particular, severe usage, including acrobatic and agricultural usage, may significantly reduce the accuracy of the cumulative damage calculation.
b. Adequacy of S-N data.
(1) Reference 6, formerly MIL-HDBK-5, includes the following disclaimer regarding handbook S-N data:
“The S-N or ε–N curves may not apply directly to the design of structures because they may not take into account the effect of specific concentration associated with reentrant corners, notches, holes, joints, rough surfaces, and other similar conditions, which are present in fabricated parts.”
(2) Handbook S-N data may also not be directly applicable to your structure due to small differences in the material used to develop the handbook curves and the material used in your structure. Also, data for th e exact stress concentration factors in your structure may not be available in the handbook data.
(3) Applicants may address these issues by adjusting the S-N curves to account for differences between the actual structure and the structure, or coupon, used to develop the S-N curves. Applicants should adju st the S-N curves for differences in geometry, bearing and bypass stress, including eccentric loads and orientation of principal stresses. You may use component testing or previous testing experience with similar structural details to select and adjust the most applicable S-N curves. In determining the applicability of S-N data, similar structures are those:
(a) Constructed of the same material (same form, same heat treat).
(b) Constructed with the same or similar manufacturing methods.
(c) With the same or similar structural function and geometry.
(d) With the same or similar stress concentration factor.
(e) With the same or similar stress level and loading spectrum.
(f) With the same or similar principal stresses, for example axial and bending loads.
For complex details, including joints and fittings, you should not use S-N data without first adjusting the data for applicable component level or full-scale test results.
c. Accuracy in determining the stress concentration factor, Kt. Identify all areas of stress concentration in the structure and determine the magnitude of the stress concentration factor, Kt, associated with each of these details. Accurate determination of Kt is necessary to make sure that you are using the correct S-N data in your fatigue analysis. You may determine stress concentration factors for some details, including open holes, radii, filets, and so forth, from handbook references. Stress concentration factors for more complex details, including fittings and joints, may require detail analysis, including validated finite element methods. In this case, the determination of Kt should include consideration of eccentric loadings and the bearing and bypass stresses at each bolt or rivet in a joint.
d. Accuracy in determining the stress level. Since you will not conduct full-scale fatigue tests or spectrum loading component level tests on your structure, the quality, detail, and completeness of your stress analysis is important. In fatigue substantiation by analysis, we rely completely on the stress analysis to identify all fatigue critical details. Applicants should follow the guidance in paragraphs 2-8 and 2-9 of this AC to validate the stresses used in a fatigue analysis.
2-26. What scatter factors do I use in a fatigue analysis?
The scatter factor you use in a fatigue analysis is larger than the scatter factors you would apply to full-scale and component level test results. This is due to the uncertainties in a fatigue analysis outlined in the previous paragraph. The scatter factor used in an analysis depends on the type of metal, statistical basis, and applicability of the S-N data used in the analysis.
a. For aluminum structures, you may use the following:
(1) You may use the S-N data provided in Appendix 2. This S-N data is applicable to conventional built-up aluminum structure with no fittings (other than continuous splice fittings), no parts with high residual stresses, no unique structural features, and no stress concentrations greater than Kt = 4. This data is carried over from th e guidance provided in Reference 3. Use of this S-N data, combined with a scatter factor of 8.0, has provided satisfactory service experience.
(2) You may use proprietary, handbook, or material supplier mean S-N curves adjusted for any differences between the actual structure and the structure or coupon used to
develop the base S-N curves. Test adjusted data is recommended for lugs, joints, and fittings. In this case, you may use a minimum scatter factor of 8.0.
b. Adjustments to the typical scatter factor of 8.0 must be made for the following:
(1) Structures made out of metals other than aluminum.
(2) Structures, including aluminum, whose S-N curves have a statistical basis other than the mean (for example, curves based on 99 percent probability of survival). (Note: The S-N data provided in Reference 6 represent the mean S-N curve, with no adjustments for confidence intervals.)
(3) Any adjustments to the scatter factor must be coordinated with the Small Airplane Directorate Standards Office.
2-27. How can I extend the safe-life, or retirement life, of my airplane?
a. Extensions of the safe-life are accomplished either as an amended type certificate (TC) by the TC holder or as a supplemental type certificate (STC) either by the TC holder or an STC applicant. In formulating a life extension program, applicants should consider the following:
(1) Inspection programs alone are not sufficient to extend the safe-life of an airplane.
(2) The safe-life of a structural component is usually set to the detail that has the shortest fatigue life. An applicant should addre ss the possibility that other structural details or components may have nearly as short a fatigue life as the detail you are extending the life of. To avoid the development of unforeseen fatigue cracks in other parts of the structure, you should complete a fatigue evaluation of the entire structure.
b. One method of extending the safe-life is a thorough re-evaluation of the fatigue performance of the structure.
(1) A re-evaluation of the fatigue performance requires detailed knowledge of the data, including the loading spectra, stress levels, stress concentration factors, and S/N curves, used to substantiate the original type design. STC applicants are at a particular disadvantage in fatigue life extensions since they typically do not own or possess the type design data.
(2) It may be difficult for you to substantiate a life extension through analysis alone.
An analytical approach would require you to show that the type design analysis was overly conservative or that your analysis, including assumptions and data, is more accurate than that used in the type design substantiation.
(3) A full-scale fatigue test of the airplane’s structure is the preferred method of extending the original safe-life, especially if you know that the original design was substantiated by analysis. In this case, follow the guidance provided in this AC for full-scale fatigue testing, including mission profile development, selection of load spectra, and validation of internal loads.
Consider in-flight measurements of loads and stresses to further justify the life extension.
(4) In your fatigue test, you should use an airframe with zero flight time. This is necessary since we do not know the usage history of any structural member that has accumulated flight time. It is also possible that an airframe that has accumulated flight time may have experienced an overload event that may have altered the fatigue performance of the structure.
c. One life extension method that applicants have used successfully has been to provide fail-safe design features to an existing safe-life design. In this approach, an applicant completes all of the following:
(1) Incorporates redundant structure into the existing design. For example, an external spar strap that provides the required residual strength capability.
(2) Inspects the structure for cracks. Any pa rts with existing cracks are replaced.
(3) Oversizes existing bolt and rivet holes to remove any small cracks not detected during inspection.
(4) Incorporates cold working of holes and stress concentrations to improve fatigue performance.
(5) Develops an inspection program for the fail-safe and redundant structure.
d. Life extensions must be approved by the responsible Aircraft Certification Office (ACO) and coordinated with the Small Airplane Directorate Standards Office.
CHAPTER 3. FAIL-SAFE DESIGN
3-1. What is a fail-safe design?
A fail-safe design is a design that retains its required residual strength after the failure or partial failure of a principal structural element. A fail-safe design typically consists of the fail-safe component or primary structural element, and a redundant or backup structural element. A failsafe design is, therefore, often said to be a redundant design or a multi-load path design. Failure in a multi-load path design is the inability to support the required residual strength loads or the inability to prevent excessive deformation that interferes with continued safe flight and landing.
Follow the general guidance in sections 2-4, 2-7, 2-8, 2-9, and 2-11 of this AC for developing the loading spectra, mission profile, and test plan for evaluating your fail-safe design.
3-2. What is the histor y of fail-safe design?
a. Fail-safe design has been an option available to applicants since the first specific fatigue requirement in Amendment 3-2 to CAR 3. A fail-safe evaluation generally includes the following:
(1) Establish the components you will make fail-safe. This includes identifying which primary structural elements will have redundant load paths.
(2) Define the loading conditions, including the magnitude of external loads. This step includes determining the internal loads in the primary and redundant structure in both the pristine and damaged conditions.
(3) Determine the extent of damage for which you will design the fail-safe structure.
(4) Conduct structural tests and analyses to substantiate that you have achieved the fail-safe design objective.
(5) Establish inspection programs aimed at early detection of fatigue damage.
b. In the more than 45 years since CAR Amendment 3-2 first introduced the fail-safe option for addressing fatigue requirements, the redundant structure provided by fail-safe design has prevented otherwise catastrophic failures. However, there are well-documented cases in which a design thought to be fail-safe was not, and the design failed to prevent a catastrophic failure. Several references, including Refere nces 10 and 11, identify the following potential problems of designs mistakenly thought to be fail-safe:
(1) Potential loss of fail-safe attributes with time due to normal fatigue wear-out.
(2) Difficulty in making an accurate prediction and validation of failure modes.
(3) Incorrect assumptions that a design is sufficiently and consistently selfannunciating.
(4) Loss of type design strength due to inadequate crack detection. If a crack or other damage is not found by inspections or is not so obvious as to be detected before further flight, the capability of the structure may be below the design limit and ultimate load capability.
(5) Inadequate residual life with obvious damage present. Redundant structure may not have sufficient safe-life to ensure that damaged structure will be found by inspections.
3-3. How can I assure that my design complies with the fail-safe design requirements?
a.
The historical guidance provided in Reference 3 described the importance of repeated inspections in maintaining the continued airworthiness of a fail-safe design. Detecting fatigue cracks before they become dangerous is the ultimate control to ensure the fail-safe characteristics of flight structure and pressurized cabin. For a fail-safe design, applicants should develop an inspection program capable of detecting fatigue cracks and other partial failures. Applicants should provide enough guidance information to aid operators in establishing the frequency and extent of the repeated inspections of the critical structures or critical areas. Include instructions for these inspections, including inspection schedule and inspection methods, in the information required for § 23.1529.
b. You could develop an inspection program based on:
(1) A service history based approach. For guidance on service history based inspections, see AC 91-60.
(2) A damage tolerance approach.
(3) A hybrid approach in which the inspection threshold equals the safe-life determined using Equation 1 and repeat inspection intervals based on crack growth analysis.
3-4. What are some design considerati ons in achieving a fail-safe design?
a. Use of multipath construction and providing crack stoppers to limit the growth of cracks.
b. Use of composite (more than one element) duplicate structures so a fatigue failure occurring in one-half of the composite member will be confined to the failed half. Also, the remaining structure will still possess the load carrying ability required by § 23.571 and § 23.572.
c. Use of backup structure wherein one member carries the entire load, with a second member available that can assume the extra load if the primary member fails.
d. Selection of stress levels and materials with low notch sensitivity (particularly for components with high stress concentration) that provide a controlled slow rate of crack propagation combined with a high residual strength after initiation of cracks.
e. Arrangement of design details to allow easy detection of failures in all critical structural elements before the failures can become dangerous or result in a loss of strength below that required by § 23.571 and § 23.572. You s hould also arrange design details to allow replacement or repair.
Note: The last two items are examples of good design practice and improve fail-safe design concepts, but they cannot be used alone to achieve fail-safe design.
3-5. What is a Principal Structural Element?
A principal structural element (PSE) is an element that contributes significantly to carrying flight, ground, or cabin pressurization loads, and whose integrity is essential in maintaining the overall structural integrity of the airplane. (N ote: Part 23 fatigue evaluation requirements do not apply to landing gear or unpressurized fuselage structure; however, ground loads are to be included to the extent that they affect wing, empennage, canard or pressurized cabin structure.)
Typical examples of PSEs are as follows:
a. Wing, horizontal stabilizer, vertical fin, canard, forward wing, winglets/tip fins:
(1) Fixed surface, stabilator, or trimmable stabilizer attachment fittings;
(2) Integrally stiffened plates;
(3) Primary fittings;
(4) Principal splices;
(5) Skin or reinforcement around cutouts or discontinuities;
(6) Skin-stringer combinations;
(7) Spar caps; and
(8) Spar webs.
b. Pressurized cabin:
(1) Circumferential frames and adjacent skin;
(2) Pressure bulkheads;
(3) Cockpit window posts;
(4) Skin and any single frame or stiffener element around a cutout;
(5) Skin or skin splices, or both, under circumferential loads;
(6) Skin or skin splices, or both, under fore and aft loads;
(7) Skin around a cutout;
(8) Skin and stiffener combinations under fore and aft loads;
(9) Door frames, skins, and latches; and
(10) Window frames.
3-6. How much fatigue damage should I consider in my fail-safe evaluation?
Each particular design should be carefully assessed to establish appropriate damage criteria. As discussed in Reference 10, you should not rely on the detection of an “obvious partial failure.”
Instead, you should consider fatigue damage in terms of the complete failure of the single element involved. Typical examples of the fatigue damage you should consider are outlined below:
a. Skin cracks in splice joints and those emanating from the edge of structural openings or cutouts that can be readily detected by visual inspection of the area.
b. Failure of one element where dual construction is used in components such as spar caps, window posts, window or door frames, and skin structure.
c. The presence of a fatigue failure in at least the tension portion of the spar web or similar elements.
d. Failure of one element of primary attachments, such as wing and empennage fixed surface, or stabilator attach fittings.
e. Excessive loss of stiffness under load as evidenced by excessive deformation.
f. Failure of skin, frames, stringers, and pressure bulkheads in pressurized cabins.
3-7. How do I address inaccessible areas?
Designers should make every reasonable effort to ensure all principal structural elements can be inspected, as required by § 23.611. If inaccessible or blind areas are unavoidable, place emphasis on determining crack propagation and residual strength of the particular fatiguedamaged structure to ensure continued airworthiness of the structure with reasonable inspection methods and controls by the operator. Also consider providing additional fatigue strength to preclude fatigue cracking in the blind element or to conduct fatigue tests of the blind areas to establish that a high service life is provided. Pay particular attention to corrosion prevention in inaccessible areas.
3-8. How do I account for dynamic effects?
Apply the dynamic magnification factor of 1.15, required by §§ 23.571 and 23.572, to all loads, including pressure cabin loads. You may also ma ke fail-safe cuts under load to show a different value for the factor, or you may show that the dynamic effects are negligible by comparison to dynamic test data from a similar structure.
3-9. How do I test principal structural elements?
a. The nature and extent of tests on either a complete structure or portions of the primary structure, or both, will depend upon previous experience with similar types of structures and the crack propagation characteristics of the structure. Single elements or members, such as stringers and spar caps, should be completely severed and 1.15 times the critical fail-safe load applied after severing. If defi nite evidence is furnished that the dynamic failure effects are not present, the 1.15 factor may be eliminated or reduced in accordance with the effects noted. The required residual strength of the remaining structure is a static ultimate load factor of 75 percent of the critical limit load factor at VC, per §§ 23.571 and 23.572.
b. You may apply the fail-safe loads to the structure before severing and omit the 1.15 factor. In this case, the test sp ecimen and test fixture must be carefully designed to ensure that the correct dynamic effects are obtained. If you are testing distributed members, such as a sheetstringer combination or an integrally stiffened tension skin, make a cut to represent an initial crack in the element under test. If there is no failure, you may increase the length of the cut with the fail-safe load applied until one of the following occurs:
(1) The fail-safe damage has been simulated; or
(2) The crack propagation rate decreases due to redistribution of load paths; or
(3) Crack propagation stops due to a crack stopper.
c. The simulated cracks should be as representative as possible of actual fatigue damage. If it is not practical to produce actual fatigue cracks, damage may be simulated by cuts made with a fine saw, sharp blades, or a guillotine. If saw-cuts in primary structure are used to simulate sharp fatigue cracks, sufficient evidence should be available from element tests to indicate equivalent residual strength. If it is necessary to simulate damage at joints or fittings, bolts may be removed to simulate the failure if this condition represents an actual failure.
d. Failure is the inability of the redundant structure to support the required residual strength loads or the inability to prevent excessive deformation that would interfere with safe flight and landing.
3-10. Can I use analysis to subs tantiate a fail-safe design?
a. Sometimes you can substantiate fail-safe characteristics analytically. You may use an analytical approach when the structural configuration involved is similar to one already verified by fail-safe tests, whether conducted on a previously approved type design or on other similar areas of the design currently being evaluated.
b. You may also use the analytical approach when conservative failures are assumed.
However, the failure must be detected long before the critical crack length is approached, and the margins of safety resulting from the analysis must be considerably more than the fail-safe residual static strength level. In any such analysis, include the 1.15 dynamic magnification factor unless it can be shown that this factor is not required.
3-11. How do I select the critical areas?
Paragraph 3-5 of this AC lists typical single principal structural elements and detail design points that require fail-safe evaluation. The process of determining where you should simulate fail-safe damage in an element, such as a wing spar cap or fuselage frame, requires use of sound engineering judgment that considers various factors, such as the following:
a. Conducting an analysis to locate areas of maximum stress and a low margin of safety.
b. Conducting strain gage surveys on undamaged structure to establish points of high stress concentration as well as the magnitude of such concentration.
c. Examining static test results to determine locations where excessive deformations occurred.
d. Determining from repeated load tests where failure may have initiated or where the crack propagation rate is a maximum.
e. Selecting location in an element (such as a spar cap) where the stresses in adjacent elements (such as the spar web or wing skin) would be the maximum with the spar cap failed.
f. Selecting points in an element (such as a spar web or frame) in which high stress concentrations are present in the residual structure with the web failed.
g. Assessing detail design areas that service experience records of similarly designed components indicate are prone to fatigue damage.
h. Locating areas susceptible to operational damage, such as foreign object damage, corrosion, and so forth.
CHAPTER 4. DAMAGE TOLERANCE EVALUATION The FAA has not developed guidance unique to part 23 damage tolerance evaluations. For damage tolerance evaluations, use the guidance provided in AC 25.571C, Damage Tolerance and Fatigue Evaluation of Structure. Follow the general guidance in sections 2-4, 2-7, 2-8, 2-9, and 2-11 of this AC for developing the loading spectra, mission profile, and test plan for evaluating your damage tolerant design.
4-1. Are there any differences between the part 23 and part 25 damage tolerance regulations?
There is one significant regulatory difference between part 23 and part 25. Part 25 includes a discrete source damage requirement. There is no requirement for substantiation of discrete source damage capability in part 23. However, be aware that a discrete source damage analysis might be necessary to show compliance to rotorburst requirements.