(C) For each PSE, a threat assessment must be made of the probable locations, types, and sizes of damage considering fatigue, environmental effects, intrinsic and discrete flaws, and impact or other accidental damage. This determination must be submitted with accompanying rationale to the FAA/AUTHORITY for approval.
This rationale may include experience with similar materials, designs, processes (manufacturing, maintenance, and overhaul), structural details, or structure, and may also include service failure evaluations, manufacturing records, overhauls and repair reports, field service reports, incident and accident investigations, service impact surveys, inspectability surveys, and engineering judgment. Consideration should also be given to factors that:
- Reduce scatter and deviations from nominal structures, such as frozen processes, Flight Critical Parts programs, and materials and manufacturing processes to mitigate intrinsic flaws (inclusions and defects).
- Preclude a type of damage by use of a specific design feature (material selection, surface treatment, protective coating, or shielding), a specific stress level (for fatigue damage), or a specific manufacturing inspection process (if it can be shown to be highly reliable, well-controlled, documented, and systematically required).
The assessment should include:
• A systematic evaluation of all the location, types, and sizes of damage and their estimated probability of occurrence.
• A selection or elimination of this damage based on the above estimate.
• A verification that the inspection method selected is capable of detecting the damage at the size and location determined.
The types of damage to consider include:
(1) Intrinsic Flaws (imperfections), which are probable to exist in an asmanufactured structure based on the evaluation of the details and potential sensitivities of the specific manufacturing work processes used. The types of flaws to be considered include voids, disbonds, inclusions, foreign objects, resin-rich and resinstarved areas, and improper ply orientation or ply ending. The sizes of the intrinsic flaws considered should be based on the limits established under the manufacturing inspection and acceptance criteria and are expected to remain in service for the life of the structure.
(2) Impact Damage, which may occur during manufacturing and in service based on an evaluation of the threats by means of an impact survey and/or service experiences. This type of damage can include dents, penetrations, goug es, abrasions, and scratches. A threat assessment is needed to identify impact damage Page C - 149
AC 29-2C, Chg 4 12/1/2011 severity and detectability for design and maintenance. A threat assessment usually includes damage data collected from service plus an impact survey. An impact survey consists of impact tests performed with configured structure, which is subjected to boundary conditions characteristic of the structure. Many different impact scenarios and locations are typically considered in the survey, which has a goal of identifying the most critical impacts (i.e., those causing the most serious damage but are least detectable). When simulating accidental impact damage, blunt or sharp impactors should be selected to represent the maximum criticality versus detectability, according to the load conditions (e.g., tension, compression or shear). Until sufficient service experience exists to make good engineering judgments on energy and impactor variables, impact surveys should consider a wide range of conceivable impacts, including runway or ground debris, hail, tool drops, and vehicle collisions. Service data collected over time, can better define impact surveys and design criteria for subsequent products, as well as establish more rational inspection intervals and maintenance practice. Refer to paragraph f.(6)(ii)(H) for various combinations of detectability and energy levels to be considered in the damage tolerance and fatigue evaluation.
(3) Discrete Source Damage. The structure should be able to withstand limit static loads (considered as ultimate loads) and fatigue loads, which are reasonably expected during a completion of a flight on which damage resulting from obvious discrete source occurs (e.g., hail damage, bird strike, uncontained engine failure, and uncontained high energy rotating machinery failure). The extent of damage should be based on a rational assessment of service mission and potential damage relating to each discrete source.
(D) The use of composite secondary bonding in manufacturing or maintenance requires strict process and quality controls to achieve the reliability needed to use such technology in critical structures (see AC 21-26). Assuming good process and quality controls, service history has shown that additional damage tolerant design considerations are also needed to ensure the safety of structure with secondary bonds (i.e., random, but an unacceptable number of weak bonds discovered in service).
Unless the ultimate strength of each critical bonded joint can be reliably substantiated in production by NDI techniques (or other equivalent, approved techniques), then the limit load capability should be ensured by any or a combination of the following:
(1) Consider isolated disbonds and weak bonds (represented by zero bond strength) in structural elements that use secondary bonding for primary load transfer. The associated disbond size should be up to the limitations provided by redundant design features (i.e., mechanical fasteners or a separate bonding detail).
The structure containing such damage should be shown to carry limit load by tests, analyses, or some combination of both. For purposes of test or analysis demonstration, each disbond should be considered separately as a random occurrence (i.e., it is not necessary to demonstrate residual strength with all structural elements disbonded simultaneously).
Page C - 150
(2) Each critical bonded joint on each production article should be proof-tested to the critical limit load.
(3) Critical bonded joints that have high static margins of safety (e.g., some rotor blades) may be accepted based on satisfactory service history of like or similar components.
(E) The fatigue load spectrum developed for fatigue testing and analysis purposes should be representative of the anticipated service usage. Low amplitude load levels that can be shown not to contribute to fatigue damage may be omitted (truncated). Reducing maximum load levels (clipping) is generally not accepted.
(F) Environmental effects (temperature and humidity representative of the expected service usage) on the static and fatigue behavior and damage growth should be considered. Unless tested in the environment, appropriate environmental knock down factors for the static and the fatigue test articles should be derived and applied in the evaluation.
(G) Variability in fatigue behavior should be covered by appropriate load or life scatter factors and these factors should take into account the number of specimens tested.
(H) The following Figure AC 29.573-2 illustrates the extent of the impact damage that needs to be considered in the damage tolerance and fatigue evaluation.
Page C - 151
Detectability Obvious Damage ~ ~ Detectable damage [ Barely Detectable Impac~ Damage + Undetectable damage + I Zone 1 I + Level of energy selected for compliance with §§ 29.305, 29.307 (Static Strength) and fl:5)(vi) of this AC.
Maximum level of energy selected for the Damage Tolerance evaluation. This level should not be exceeded in service.
Energy AC 29-2C, Chg 4 12/1/2011 Figure AC 29.573-2: Characterization of Impact Damage.
(1) Both the energy level associated with the static strength demonstration and the maximum energy level associated with the damage tolerance evaluation (depicted in Figure AC 29.573-2) are dependent on the part of the structure under evaluation and a threat assessment.
(2) Obvious impact damage is used to define the threshold from which damage is readily detectable and appropriate actions may be taken before the next flight.
(3) Barely Detectable Impact Damage (BDID) is the state of damage at the threshold of detectability for the approved inspection procedure. Barely Visible Impact Damage (BVID) is that threshold of visually detectable damage associated with a detailed visual inspection procedure.
(4) Detectable Damage is the state of damage that can be reliably detected at scheduled inspection intervals. Visible Impact Damage (VID) is that threshold associated with the type of damage that should be detectable during a detailed visual inspection.
(5) Three Zones are depicted by this figure:
Page C - 152
Zone 1: Since the damage is not detectable, Ultimate Load capability is required. The provisions of paragraph f.(5) provide a means of compliance.
Zone 2: Since the damage can be detected at a scheduled inspection, Limit Load (considered as Ultimate load) capability is the minimum requirement for this damage.
Zone 3: Since the damage is not detectable with the proposed inservice inspection procedures, ultimate load capability is required, unless an alternate procedure can show an equivalent level of safety. For example, residual strength lower than ultimate may be used in association with improved inspection procedures or with a probabilistic approach showing that the occurrence of energy levels is low enough so that an acceptable level of safety can be achieved.
Of the three zones, only Zone 3 may have a residual strength requirement that can vary with alternate procedures or the probability of damage occurrence or both. In either case, any compromise for residual strength requirements less than the ultimate load requirement should only be considered when pursuing one of the options under the damage tolerant fail-safe means of compliance, as described in the following section,
f.(6)(iii)(B). One example of the use of alternate procedures is for the rare damage threat from a high energy, blunt impact (e.g., service vehicle collision). Depending on the selected maintenance inspection scheme, such damage may fall under Zone 3.
When considering such damage in the design of a part, it may be shown to be damage tolerant fail safe, even though the damage is not detectable, based on a very low probability of occurrence. As a result, the design may have sufficiently high residual strength (e.g., below Ultimate, but well above limit load capability to ensure safety without detection for long periods of time). If it is further determined that such impact events usually occur with the knowledge of maintenance or aircraft service personnel, then the alternate procedures may be added to the Instructions for Continued Airworthiness. For example, advanced inspection methods, which can detect damage from high-energy blunt impacts, may be used as alternate procedures to minimize the risk of catastrophic failure for such Zone 3 damage.
(iii) Means of compliance. For each PSE, inspections, replacement times, or other procedures must be established as necessary to avoid catastrophic failure.
Compliance with the requirements of § 29.573(d) and (e) should be shown by one, or a combination of, the methods described subsequently. Generally, replacement times are established using Damage Tolerance Safe Life Evaluations and Inspection Intervals are established using Fail Safe Evaluations. From current state- of-the-art rotorcraft applications, it is widely accepted that composite materials have good flaw and damage tolerance capabilities and therefore the supplemental procedures may only be rarely necessary. Damage tolerance evaluations are best suited for composite structures, particularly those with structural redundancy and inherent resistance to damage growth.
Damage resulting from anomalous or accidental events must be considered in the damage tolerant evaluations. The damage tolerant evaluation for replacement times and inspection intervals is to be used unless it is established that neither can be Page C - 153
AC 29-2C, Chg 4 12/1/2011 achieved within the limitations of geometry, inspectability, or good design practice. In that case, supplemental procedures must be established and submitted to the FAA for approval. In any case, the FAA must approve the methodology used for compliance to § 29.573. The substantiation method(s) should be chosen so that the structure is protected against catastrophic failure from each of the threats identified in paragraph
f.(6)(ii)(C) of this AC by a specific procedure (inspection, replacement time, or other procedure). For example, a manufacturing -related void of a specific allowable size could be substantiated by means of a replacement time method with no scheduled inspection. An accidental impact in the same area could be substantiated by an inspection method with no specific replacement time. The result could be one structure with several different inspection requirements (location, method, and interval) and a fixed replacement time as well. This combination of procedures assures that each threat is covered. The fatigue substantiation should include sufficient coupon, element, sub-element, or component tests to establish the fatigue scatter, curve shapes, and the environmental effects. The substantiation should include full -scale, component, or subcomponent fatigue testing but also may be accomplished by analysis supported by test evidence. When spectrum testing is used, the lowest load levels can be eliminated from the spectrum if they can be shown to be non-damaging. The substantiation should include a static strength evaluation to show that the required residual strength and adequate stiffness, accounting for the effects of environment, are retained for the life of the structure or the appropriate inspection interval. Damage as determined in paragraph f.(6)(ii) of this AC for the specific structure being substantiated should be imposed at each critical area of the structure.
(A) Damage Tolerant Safe-Life Evaluation. This is a “No -Growth” method in which the structure, with damage present, is able to withstand repeated loads of variable magnitude without detectable damage growth for the life of the rotorcraft or within a specified replacement time. This evaluation may be used to substantiate any type of damage that will remain in-service for the life of the part. No specific inspection requirements are generated from the test program in this method. However, compliance with routine inspections for cracking, delaminations, and service damage and other limitations prescribed in accordance with § 29.1529 are always required.
Compliance using full-scale, component, or sub-component fatigue testing can be accomplished by either of the following methods:
(1) S-N Method. This method is based on determining the point where initiation of growth occurs for the damage present at critical locations in the structure.
AC 27-1B, AC 27 MG 11, provides guidance that may be appropriate for this method.
The method utilizes one or more full-scale, component, or sub-component test specimens subjected to constant-amplitude or spectrum loading applied in a distribution on the structure that is representative of critical flight conditions. Any indication of growth of the imposed damage and defects, or structurally significant cracking, disbonding, splintering, or delaminating of the composite, defines the fatigue initiation characteristic of the structure in terms of applied load and cycles. Working S -N curves are established from the mean curve using strength or cycle reductions or both to account for fatigue scatter and environmental effects. Flight loads are compared to this Page C - 154
working curve, and if any intercepts occur, a cumulative damage calculation is conducted to establish the component retirement time. Compliance with the ultimate load requirements should be demonstrated at the completion of the fatigue test.
(2) Life-Test Method. This method uses spectrum fatigue testing to verify the absence of damage growth over a large number of cycles that are equivalent to a lifetime of expected usage. The method uses one or more full -scale, component, or sub-component test specimens subjected to spectrum fatigue loading applied in a representative distribution of flight loads, including Ground-Air-Ground (GAG) loads.
Fatigue test loads should be increased by factors for environment and fatigue strength scatter. The load may also be increased using an S -N curve approach to reduce the duration of the test. Any significant growth of the imposed damage, or structurally significant cracking, disbonding, splintering, or delamination of the composite during the test constitutes failure to achieve the desired lifetime. However, the equivalent life demonstrated at the time of inception of damage growth or cracking can be used as a retirement time for the component. Compliance with the ultimate load requirements should be demonstrated at the completion of the fatigue test.
(B) Damage Tolerant Fail-Safe (Residual Strength with Detectable Damage) Evaluation. This method establishes inspection intervals to ensure that the structure remaining after a partial failure is able to withstand design limit loads without failure or excessive structural deformations within a specified inspection interval. If the damage is detected in an inspection, the structure should be either replaced or repaired to restore ultimate load capability. Evaluation of Zone 3 damage should have sufficiently high residual strength and, if necessary, supplemental procedures should be established to minimize the risk of catastrophic failure. Full- scale, component, or subcomponent testing should be accomplished using one or more specimens subjected to constant amplitude or spectrum loading applied in a manner representative of flight load conditions. The test loads should be increased by factors that account for environment and fatigue strength scatter. The results of the testing can be used to manage the structure in one or a combination of the three methods described subsequently.
(1) No Growth Evaluation. This approach is appropriate for inspectable in-service damage, which does not grow in service (see Figure AC 29.573-3). Damage growth should be substantiated using either method described in f.(6)(iii)(B)(2) or
f.(6)(iii)(B)(3). Structural details, elements, sub-comp onents, and components of critical structural areas, or full-scale structures, should be tested under repeated loads for validating a no-growth approach to the damage tolerance requirements. The number of cycles applied to validate a no-growth concept should be statistically significant, and may be determined by load or life considerations or both. Residual strength testing or evaluations should be performed after repeated load cycling demonstrating that the residual strength of the structure is equal to or greater than limit load considered as ultimate. Moreover, it should be shown that stiffness properties have not changed beyond acceptable levels. Inspection intervals should be established, considering the residual strength capability associated with the assumed damage. The intent of this is to assure that structure is not exposed to an excessive period of time with static margins Page C - 155
---.....
~ t ~ , AC 29-2C, Chg 4 12/1/2011 less than ultimate, providing a lower safety level than in the typical slow growth situation, as illustrated by the Figure AC 29.573-3. Once the damage is detected, the component is either repaired to restore ultimate load capability or replaced.
Da mage init iation Re s id u a l s t re n g th T i me No -g ro wt h a p p ro a c h ** Slo w-g ro wt h a p p ro a c h * Ult i ma t e lo a d s L i mit lo a d s o r o c c u rre n c e * Re p a ir t o Re s t o re U lt i ma t e St re n g t h * * No g ro wt h wit h o u t re p a ir is n o t a c c e p t a b le Figure AC 29.573-3: Residual Strength vs. Time.
The lower the residual strength of a structure after an accidental damage event, the shorter the inspection interval should be. Considerations of both inspectability and impact surveys (including probability of occurrence) for specific structure may be used to isolate the most critical threats to consider in setting a maintenance inspection interval. Knowledge of the residual strength for a given critical damage is also needed for such an evaluation. If it is known that the design is capable of handling large and clearly detectable damage, while maintaining a residual strength well above limit load, a less rigorous engineering approach may be applied in establishing the inspection interval.
Slow Growth Evaluation. (2) This method is applicable when the damage grows in the test and the growth rate is shown to be slow, stable, and predictable, as illustrated in Figure AC 29.573-4. An inspection program should be developed consisting of the frequency, extent, and methods of inspection for inclusion in the maintenance plan. Inspection intervals should be established so that the damage will have a very high probability of detection between the time it becomes initially inspectable and the time at which the extent of the damage reduces the residual static strength to limit load (considered as ultimate), including the effects of environment. For any damage size that reduces the load capability below ultimate, the component is either repaired to restore ultimate load capability or replaced. Should functional impairment (such as unacceptable loss of stiffness) occur before the damage becomes Page C - 156
L_ I ______ _ -----------_ _J i _J r-· _ ..... , .......... ,.1 ........ , ... , ....... , ... , ... • .. , ... , ....... , ... , ...... .
12/1/2011 AC 29-2C, Chg 4 otherwise critical, this should be accounted for in the development of the inspection program.
Damage Size Static Strength time Ultimate Limit Slow Growth Arrested Growth Slow Growth Critical Size Arrested Growth Slow Growth No Gr owth Threshold of Detectability Inspection Interval Basis Figure AC 29.573-4: Illustration of Residual Strength and Damage Size Relationships for Fail-Safe Substantiation.
(3) Arrested Growth Evaluation. This method is applicable when the damage grows, but the growth is mechanically arrested or terminated before becoming critical (residual static strength reduced to limit load), as illustrated in Figure AC 29.573-4. Arrested Growth may occur due to design features such as a geometry change, reinforcement, thickness change, or a structural joint. This approach is appropriate for inspectable arrested growth damage. Structural details, elements, and sub-components of critical structural areas, or full-scale structures, should be tested under repeated loads for validating an arrested growth approach to the flaw tolerance requirements. The number of cycles applied to validate an arrested growth concept should be statistically significant, and may be determined by load or life considerations, or both. Residual strength testing or evaluation should be performed after repeated load cycling and a demonstration that the residual strength of the structure is equal to or greater than limit load considered as ultimate. Moreover, it should be shown that stiffness properties have not changed beyond acceptable levels. Inspection intervals should be established, considering the residual strength capability associated with the arrested growth damage. The intent of this is to assure that structure is not exposed to an excessive period of time with static margins less than ultimate, providing a lower safety level than in the typical slow growth situation, as illustrated by Figure AC 29.573-3. For any damage size that reduces the load capability below ultimate, the component is either repaired to restore ultimate load capability or replaced. The lower the residual strength of a structure after an arrested growth event, the shorter the Page C - 157
AC 29-2C, Chg 4 12/1/2011 inspection interval should be. Considerations of both inspectability and impact surveys (including probability of occurrence) for specific structure may be used to isolate the most critical threats to consider in setting a maintenance inspection interval.
Knowledge of the residual strength for a given critical damage is also needed for such an evaluation. If it is known that the design is capable of handling large and clearly detectable damage, while maintaining a residual strength well above limit load, a less rigorous engineering approach may be applied in establishing the inspection interval.
(C) Combination of Damage Tolerant Safe Life and Fail Safe Evaluations.
Generally, it may be appropriate to establish both a replacement time and an inspection program for a given structure as calculated by the Damage Tolerant Safe Life and Fail Safe Evaluations.
(D) Other Procedures. Other procedures are allowed according to § 29.573(d). Such alternative procedures must still provide the same degree of damage tolerance to the same identified threats as the replacement time or inspection interval methods. One possible alternate approach is the use of indirect damage detection methods instead of the specific mandated inspection procedures that are determined in the Fail Safe Evaluations of f.(6)(iii)(B). These indirect detection methods should be documented and shown to have the same degree of reliability, repeatability, and margin provided by a conventional inspection approach. These methods could include: (1) establishing measurable vibration or blade out -of-track conditions and limits, (2) defining indirect inspections, which would detect damage, and (3) in-flight detecting of damage by means of monitoring and warning devices.
(E) Supplemental Procedures. If the damage tolerant evaluations as described previously cannot be achieved within the limitations of geometry, inspectability, or good design practice, a fatigue evaluation using supplemental procedures may be proposed to the FAA/AUTHORITY per § 29.573(e). The applicant must establish that the damage tolerance criteria are impracticable and cannot be satisfied for the specific PSE, locations, and threats considered. In addition, the types of damage considered in the evaluations must be identified. Finally, supplemental procedures must be established to minimize the risk of catastrophic failure with the damages considered.
(iv) Additional considerations for damage tolerance and fatigue evaluations.
(A) Experience with the application of methods of fatigue and damage tolerance evaluations indicates that a relevant test background should exist in order to achieve the design objective. It is the general practice within industry to conduct damage tolerance tests for design information and guidance purposes. It is crucial that the critical structure be identified and tested to the proper flight and ground loads.
(B) Identification of the structure to be considered in each evaluation (a failure mode and effects analysis or similar method should be used).
Page C - 158
(1) Identification of Principal Structural Elements. Principal structural elements are those that contribute significantly to carrying flight and ground loads and whose failure could result in catastrophic failure of the rotorcraft. Typical examples of such elements are:
(i) Rotor blades and attachment fittings.
(ii) Rotor heads, including hubs, hinges, and some main rotor dampers.
(iii) Control system components subject to repeated loading, including control rods, servo structure, and swashplates.
(iv) Rotor supporting structure (lift path from airframe to rotorhead).
(v) Fuselage, including stabilizers and auxiliary lifting surfaces, airframe provisions for engine and transmission mountings.
(vi) Main fixed or retractable landing gear and fuselage attachment structure.
(2) Identification of Locations Within Principal Structural Elements to be Evaluated. The locations of damage to structure for damage tolerance evaluation can be determined by analysis or by fatigue test on complete structures or subcomponents. However, tests will be necessary when the basis for analytical prediction is not reliable, such as for complex components. If less than the complete structure is tested, care should be taken to ensure that the internal loads and boundary conditions are valid. The following should be considered:
(i) strain gauge data on undamaged structure to establish points of high stress concentration as well as the magnitude of the concentration;
(ii) locations where analysis shows high stress or low margins of safety;
(iii) locations where permanent deformation occurred in static tests;
(iv) locations of potential fatigue damage identified by fatigue analysis;
(v) locations where the stresses in adjacent elements will be at a maximum with an element in the location failed;
(vi) partial fracture locations in an element where high stress concentrations are present in the residual structure;
Page C - 159
AC 29-2C, Chg 4 12/1/2011
(vii) locations where detection would be difficult; and
(viii) design details that service experience of similarly designed components indicates are prone to fatigue or other damage.
(3) In addition, the areas of probable damage from sources such as a severe corrosive or fretting environment, a wear or galling environment, or a high maintenance environment should be determined from a review of the design and past service experience.
(C) The stresses and strains (steady and oscillatory) associated with all representative steady and maneuvering operating conditions expected in service.
(D) The frequency of occurrences of various flight conditions and the corresponding spectrum of loadings and stresses.
(E) The fatigue strength, fatigue crack propagation characteristics of the materials used and of the structure, and the residual strength of the damaged structure.
(F) Inspectability, inspection methods, and detectable flaw sizes.
(G) Variability of the measured stresses of paragraph f.(6)(iv)(C), the actual flight condition occurrences of paragraph f.(6)(iv)(D), and the fatigue strength material properties of paragraph f.(6)(iv)(E).
(v) Flight strain measurement program.
(A) General. Subsequent to design analysis, in which aircraft loads and associated stresses are derived, the stress level or loads are to be verified by a carefully controlled flight strain measurement program. (This guidance is similar to that of AC 27-1B, MG 11.)
(B) Instrumentation.
(1) The instrumentation system used in the flight strain measurement program should accurately measure and record the critical strains under test conditions associated with normal operation and specific maneuvers. The location and distribution of the strain gauges should be based on a rational evaluation of the critical stress areas.
This may be accomplished by appropriate analytical means supplemented, when necessary, by strain sensitive coatings or photoelastic methods. The distribution and number of strain gauges should cover the load spectrum adequately for each part essential to the safe operation of the rotorcraft as identified in § 29.573(d)(1). Other devices such as accelerometers may be used as appropriate.
(2) The corresponding flight parameters (airspeed, rotor RPM, centerof-gravity accelerations, etc.) should also be recorded simultaneously by appropriate Page C - 160