CRITICAL CRACK LENGTH FOR LIMIT LOAD
FLAW SIZE
FIELD DETECTABLE FLAW SIZE
FLAW SIZE CONTROLLEDT
BY MANUFACTURING QUALITY LIFE FIGURE AC 29.MG 11-1 CRACK GROWTH FOR SINGLE ELEMENT STRUCTURE Page MG 11 - 13
29-2C, Chg 1 2/12/03 (B) For a multi-element load path structure substantiated by test:
(1) Obtain a complete failure of the critical load path, either by initiating and propagating a crack or by artificially disabling it.
(2) Damage (i.e. crack growth starting from nominal flaw or crack initiation) accumulated in the structure prior to load path failure should be considered in establishing Lr .
(3) Note when the residual strength of the remaining elements decreases to limit load due to crack growth, provided with a load margin if appropriate.
(4) From Figure AC 29.MG 11-2, set repetitive inspection intervals at Lr /3.
Page MG 11 - 14
FLAVY SIZE
FAILURE OF
CRITICAL CRACK LENGTH FOR LIMIT LOAD CRITICAL MEMBER,
FOR REMAINING MEMBERS OR ELEMENT
AFTER FAILURE OF CRITICAL MEMBER
IN CRITICAL REMAINING
DETECTABLE FLAW SIZE FLAW GROWTH GROWTH FLAW LIFE FIGURE AC 29 MG 11-2 CRACK GROWTH FOR REMAINING ELEMENTS
OF MULTIPLE ELEMENT STRUCTURE
(vil) No/Benign Crack Growth Page MG 11 - 15
29-2C, Chg 1 2/12/03 (A) This method depends on replacement rather than inspection to ensure the continued airworthiness of a PSE. The replacement time is established based on consideration of crack growth characteristics.
(B) To substantiate a structure in the no/benign crack growth category requires demonstration either by analysis, testing, or both, that the rogue crack (aR), which is the most severe crack consistent with manufacturing, maintenance and service environment, will not grow or will not grow to critical size (aCRIT) under the service loading and environment before the structure is replaced. The crack should be assumed at the critical location, as defined by the largest stress intensity factor range under the expected service loading range including the ground–air–ground cycle.
(C) To determine the replacement time, the rogue cracks should be assumed at the critical location and the crack growth characteristics should be determined for the expected load/environment spectrum. There are three different scenarios that could result from a crack growth assessment and be used for establishing a replacement time. These scenarios are illustrated in Figures AC 29.MG 11-3, -4 and –5.
(D) The no crack growth scenario is illustrated in Figure AC.29.MG 11-3.
In this figure, the rogue flaw does not grow or growth is insignificant. In this case the replacement time should not exceed the design service life (LDES).
Page MG 11 - 16
a
CRA CK S IZ E R
LDES TIME
(E) Figure AC 29.M G 11-4 illustrates the scenario where the rogue crack grows relatively slowly but becomes critical prior to becoming detectable (aDET). In this case the replacement time should be set equal to the total crack growth life (LT) divided by a factor N.
CRA CK S IZ E a DE T L T a CRI T a R TIME Page MG 11 - 17
29-2C, Chg 1 2/12/03 (F) Figure AC 29.MG 11-5 illustrates the scenario where the rogue crack grows to a detectable size (at L1) before becoming critical (at L1+L2). In this case the replacement time should be set equal to the total crack growth life (L1+L2) divided by a factor N.
CRA CK S IZ E a R a DE T a CRI T L 1 L 2 TIME Page MG 11 - 18
(G) In determining the factor of N to be used for determining the replacement time, consideration should be given to the crack growth data used (e.g., top of scatter data versus average data, number of specimens used to generate data, etc.).
(H) The minimum suggested N value should be (1) N=2 in the case where the conservative top-of-scatter crack growth data are used in the crack growth analysis, or (2) N=4 when the average crack growth data are used in the crack growth analysis, or when the crack growth life is obtained from the crack growth test of one specimen (for two or more full scale specimens, N=3 of the shortest crack growth life can be used).
(I) It should also be noted that, in the no/benign crack growth category, the validity of the crack growth threshold, ∆KITH, is especially important since there is no element of inspection to ensure continued airworthiness. Consistent with this, additional attention may be required relative to validating the crack growth threshold value(s) used in the analyses. Consideration should be given to the influence of the test procedure used to develop values, microstructure, heat treatment, crack size, loading conditions, environment, grain size and orientation, etc. In general a coupon testing program may be necessary to develop a consistent ∆KITH data base and the use of bibliographic data might require additional conservatism.
(viii) Testing of Principal Structural Elements.
(A) The nature and extent of tests on complete structures or on portions of the primary structure will depend upon applicable previous design, construction, tests, and service experience in connection with similar structures. For fail -safe testing considering crack propagation, simulated cracks should be as representative as possible of actual fatigue damage. Where it is not practical to produce actual fatigue cracks, flaws can be simulated by cuts made with a fine saw, sharp blade, guillotine, Electrical Discharge Machine, or other suitable means. The validity of saw cuts, etc., should be verified by comparison to coupon tests of a cracked specimen of the same material. In those cases where bolt failure, or its equivalent, is to be simulated as part of a possible flaw configuration in joints or fittings, bolts can be removed to provide that part of the simulation.
(B) Other test and inspection programs may be used if shown to have comparable or better probability of assuring that a catastrophic fatigue failure will not occur.
(ix) Analytical Evaluation The fail safe characteristics can also be shown analytically, by reliable and conservative methods, by demonstrating that the repeated loads and limit load stresses do not exceed those of previously verified fail safe designs of similar configuration, materials, and inspectability. Analytical models should be properly validated to assure that:
Page MG 11 - 19
29-2C, Chg 1 2/12/03 (A) Stress analysis is sufficiently accurate. This can be achieved by similarity with full scale strain surveys, thermography, or other suitable testing approaches.
(B) Fracture mechanics is properly applied.
(C) Load interaction models are verified for the specific load histories.
(D) Consistent material data base is used.
(x) Inspection plan. Detection of flaws before they become dangerous is the ultimate control in ensuring the flaw tolerance characteristics of the structure.
Therefore, the applicant should provide sufficient guidance information to assist operators in establishing the frequency, extent, and methods of inspection of the critical structure, and this kind of information should, under § 29.571(a)(2), be included in the maintenance manual required by § 29.1529. Due to the inherent, complex interactions of the many parameters affecting flaw tolerance, such as operating practices, environmental effects, load sequence on flaw growth, and variations in inspection methods, related operational experience should be taken into account in establishing inspection procedures. Comparative analysis can be used to guide the changes from successful past practice, when necessary. Therefore, maintenance and inspection requirements should recognize the dependence on experience and should be specified in a document that provides for revision as a result of operational experience, such as the one containing the operator’s FAA/AUTHORITY-approved structural inspection program developed through the Maintenance Review Board (MRB) procedures for FAR Part 121 operators.
(4) Safe-Life Demonstration
(i) Information to guide fatigue evaluation based on the safe-life approach is described in details in AC 27-1B MG 11. The safe- life approach is used when both the fail-safe and flaw-tolerant safe-life methods are verified to be impractical due to considerations of inspectability, geometry, or good design practice as described above in paragraph d(2).
(ii) The safe-life approach may not account for flaws and imperfections due to manufacturing and in service conditions as compared to the flaw tolerant approaches. Therefore, conservative factors that adjust for variations in both load and strength are generally utilized when substantiating by the safe-life method.
(5) Combining Methods.
(i) Components may be managed by a retirement time based on the Flaw Tolerant Safe-Life method, paragraph g(2); by an inspection program based on the Fail-Safe method, paragraph g(3); or, if approved, a retirement time based on conventional Safe Life, paragraph g(4). In some cases it may be appropriate to Page MG 11 - 20
establish a retirement time based on the lowest from several methods, and in some cases it may be appropriate to establish both a retirement time and an inspection program for a given structure.
(ii) Retirement Times. The conventional Safe- Life retirement time determined from as-manufactured parts and conventional working curves may be lower than that determined from a Flaw Tolerant Safe-Life evaluation. In this event, the lower of the two retirement times should be used. Additionally, inspection intervals resulting from a Fail-Safe evaluation may be used as retirement times if practical, which removes the need to conduct that specific inspection. In this event, the conventional safe life retirement time should be used if lower.
Page MG 11 - 21
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 12. § 29.865 (Amendment 29-43) EXTERNAL LOADS.
This AC MG paragraph material is now contained in AC 29.865B, in Subpart D.
AC Page MG 12 - 1
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 13. SYSTEMS CERTIF ICATION CONSIDERATIONS.
a. Supporting Systems.
(1) Purpose Definitions.
. The purpose of this AC paragraph is to provide guidance on how to show compliance to Part 29 regulations as they apply to supporting systems for other systems that provide required functions. The applicability of this material to “systems” is defined by AC 29.1309.a.(1). The system s that require support from supporting systems are defined as dependent systems in the following guidance. Application of recent technology is one of the predominant causes of more dependent/supporting systems relationships. More systems are employing technology that is dependent on supporting systems such as electrical, hydraulic, and/or other power sources or signal inputs. Certification of systems that are dependent on supporting systems to provide required functionality must consider the issues associated with this interdependent relationship.
(2)
(i) Integrity. The term “integrit y” for the purpose of this AC paragraph includes the hardware quality requirements, including reliability (availability); as well as the software level requirements, as defined in RTCA/DO-178B.
(ii) Criticality. The term “criticality” refers to the five levels of criticality addressed in this document in paragraph AC 29.1309.b.(1).
(iii) Supporting System(s). The term “supporting system(s)” as used in this paragraph means any system(s) that provides an input to another “dependent” system, such that these dependent system(s) cannot function correctly without that input being present/correct.
(iv) Dependent System(s). The term “dependent system(s)” as used in this paragraph means any system/s that receives an input from another system or sensor.
(3) Related Documents.
(i) Federal Aviation Regulations (FARs) Paragraphs 29.1301, 29.1309,
29.1351, and 29.1435.
(ii) Standards - Latest revision of RTCA/DO178 and RTCA/DO 160; Parts of SAE documents ARP4754 and ARP4761.
Page MG 13 - 1
AC 29-2C, Chg 1 2/12/03
(4) History: Applications of recent technology for systems have, in many cases, resulted in systems that are dependent on one or more supporting system(s) for inputs such as power or signal sources of any type. This relationship creates concerns for recognition that the criticality of the supporting system may be higher because of its role of supporting a dependent system of high criticality. The example of Liquid Crystal Displays (LCD) for engine instruments, in particular, has caused concern about the integrity of the supporting electrical power system. Pa st designs for engine instruments did not require electrical power for operation, but present designs with LCDs do require electrical power. Additionally, engine inst ruments of those older helicopter designs were driven from a mixture of sources such as independent wet line, pneumatic, and electrical drive (Tach Generator) inputs, and thus had independent failure modes from the sensor/power input aspect(s). This means that the integrity of the electrical power supplied to the dependent system must be commensurate withthe level of integrity as required for the highest criticality engine instrument application(s). This also stimulates the concern that the electrical power system can become a common point for failure of all engine instruments simultaneously, as well as anything else powered by the electrical system. For this example, t hese considerations represent an increase of integrity requirements for the electrical power system over previous designs of electrical systems for VFR helicopters. In the past, these electrical systems did not support required functions of higher criticality and were allowed to be simple in design with low design integrity and susceptible to single point faults. Application of recent technologies for systems resulting in dependent systems that require supporting systems must address the concerns for higher integrity and single point faults.
(5) : Integrity of supporti ng systems must be sufficient to support the required integ Discussion rity of their associated dependent systems. The relationship of supporting systems to dependent systems is similar to an analogy of them being links in a chain, where the weakest link must be able to support the required integrity level that is consistent with the associated criticality category assessment. This principle is not new, but there may not be recognition that systems previously accepted at low integrity levels may not be acceptable because of their new role as supporting system(s). New emphasis must be applied to determine acceptability of previous designs that have become supporting systems through application of new technology or changes of system architecture. This is particularl y true for derivative designs, or changes to existing design by either supplemental type certificate (STC) or field approval, where new technology system applications, or system architecture changes have been applied, that created a dependent/supporting system relationship. The main concerns are for systems such as electronic displays that are installed and supported by nonupgraded systems, such as single source and/or low reliability power generation and distribution systems. However the concerns related to supporting systems are not limited to displays for dependent systems, since control systems could also be affected.
Integrity for fault considerations must be addressed for supporting systems in relation to dependent systems when the dependent system’s provided functions are assessed at criticality levels of Major, Hazardous/Severe-Major, or Catastrophic. These integrity and fault considerations must address not only a particular dependent system, but also the Page MG 13 - 2