FIGURE 1. OVERVIEW OF A FATIGUE MANAGEMENT SYSTEM Suspected Risk of Catastrophic Failure Due to Fatigue Does a Demonstrated Risk of Catastrophic Failure Due to Fatigue Exist?
(See Appendix 2) No Fatigue Management Program Required YES NO Develop Fatigue Management Program (FMP) (See paragraph 10)
1.) For Structural Elements Directly Related to the Unsafe Condition:
Develop: Damage-Tolerance Based Inspection Program (See paragraph 10b) or,
Replacement / Modification Program
(See paragraph 10c)
2.) For Other Fatigue Critical Structure:
Develop/Reassess: Proactive Inspection Program (See paragraph 10d) Document FMP in Instructions for Continued Airworthiness (ICA) (See paragraph 10e) FAA Approval of FMP (See paragraph 11) Implement FMP (See paragraph 12) 12
8/23/11 AC 91-82A FIGURE 2. DEVELOPING AN FMP Does a Demonstrated Risk of Catastrophic Failure Due to Fatigue Exist?
(See Appendix 2) YES Select Fatigue Management Action for Unsafe Condition (See paragraph 10a(1)) Determine TIS for Part Replacement / Modification (See paragraph 10c(1)) Define Part Replacement / Modification Program (See paragraphs 10c(2) and 10c(3)) Document Fatigue Management Program for Specific Unsafe Condition in the Airworthiness Limitations Section of the ICA (See paragraph 10e) Define Inspection Program, Including Instructions, Procedures, Threshold and Repeat Intervals (See paragraph 10b(7)) Define Inspection Program for Other Fatigue Critical Structure (See paragraph 10d) Document Fatigue Management Program for the Other Fatigue Critical Structure in the Airworthiness Limitations Section of the ICA (See paragraph 10e) FAA Approval of FMP (See paragraph 11) Inspection Based Program Part Replacement / Modification Program Complete Damage-Tolerance Evaluation (See paragraphs 10b(1) – 10b(6))Inspection IS NOT Safe or Effective Inspection IS Safe and Effective FMP Component for Specific Unsafe Condition FMP Component for Other Fatigue Critical Structure 13
(c) In addition to the effectiveness of an FMP, an applicant should also consider the practicality of each potential inspection and part replacement/modification program. An applicant should consider:
• Availability of parts needed for a replacement or modification program;
• Availability of qualified facilities, mechanics, and necessary tooling to complete the part replacement or modification;
• Risk of damaging surrounding structure during part replacement or modification;
• Complexity of inspection program, including inspection method and potential modification of structure to gain access to inspection sites;
• Availability of qualified NDE inspectors and proper equipment;
• Burden of repetitive inspections and associated reporting;
• Risk of damage to structure when performing inspections – usually damage to fastener holes when removing and reinstalling fasteners; and
• Preference of operators. Some operato rs may prefer an inspection program while others may prefer a one-time fix by either replacing a part or modifying structure.
(d) For some airplane type designs, certain fatigue management actions such as component life limits, life-extending modifications, or a Supplemental Inspection Program (SIP) are already in place to maintain the continued operational safety of that fleet (an existing FMP).
Actions contained in an existing FMP for structural elements directly related to the unsafe condition that did not adequately consider this demonstrated risk should be reassessed.
(i) If the existing FMP action is an inspection, the FMP holder should determine why the existing inspection method, procedure, threshold, and/or interval was not adequate. The FMP holder should adjust the inspection program accordingly.
(ii) If the existing FMP action is a safe-life limit, part replacement, or modification, the FMP holder should determine why the action did not prevent the unsafe condition and adjust the safe-life limit, replacement/modification threshold, and/or modification actions accordingly. An FMP holder typically bases the safe-life limit on the most fatigue critical area in the structure. Therefore, if modifications or replacements extend this limit, the FMP holder should show there are not other areas in the structure more limiting than the extended limit.
(iii) If the existing FMP does not include actions for structural elements directly related to the unsafe condition, the FMP holder should develop appropriate actions as explained in paragraphs 10a(1)(b) and 10a(1)(c).
(e) Generally, the FAA will issue an AD requiring the selected program to address the demonstrated risk effectively.
(2) Inspections of Other Fatigue Critical Structure. This component of an FMP includes directed inspections of specific areas of other fatigue critical structure in the airplane. The purpose of this component is to proactively inspect for indications that may be precursors to an unsafe condition. The most likely areas are those where it is determined fatigue cracking may be expected to occur prior to their surrounding areas. These areas typically include the most fatigue sensitive details of joints, cutouts, run-outs and other discontinuities where local peak stresses are higher than the surrounding areas due to local geometry. The inspection requirements (e.g., where to look, how to look, how often to look, and when to start looking) may be service history or damage-tolerance based depending on whether or not an FMP already exists and what it contains.
(a) No Existing FMP or Safe-Life Based FMP. For a type design with a demonstrated risk that does not have an FMP or when the existing FMP contains only safe-life limits or life-extending modifications, the FAA expects an applicant to develop service history based inspections. An applicant may base these inspections on service history and engineering judgment. These types of inspections have been successful, in some cases, at detecting cracking before an incident occurs. However, an applicant does not typically qua ntify or validate the inspection effectiveness.
(b) Existing FMP – Damage-Tolerance Based. For a type design with a demonstrated risk and an existing FMP with damage-tolerance based inspections, the FAA expects an applicant to re-evaluate the inspections in that FMP. The applicant should take into account the lessons learned from the unsafe condition and revise and/or supplement the FMP as needed.
b. Damage-Tolerance Based Inspections. In considering a damage-tolerance based inspection program to address the demonstrated risk (paragraph 10a(1)), an applicant should complete a damage-tolerance evaluation. A thorough damage-tolerance evaluation will identify the crack location, scenario, critical crack size, the detectable crack size, inspection threshold, and the inspection interval (in number of flights or flight hours time in service) during which the crack grows from the detectable crack size to the critical crack size. AC 25.571-1D and the reference listed in paragraph 6c(3) provide additional information on performing a damagetolerance evaluation.
(1) Evaluation Considerations. The damage-tolerance evaluation should consider the actual sites, cracking scenarios, and crack progression observed in the unsafe condition. Actual cracking scenarios can be complex, involve multiple sites, and at some point, include crack interaction.
(a) When performing a damage-tolerance evaluation to predict the residual strength and crack growth life, the applicant should address the most probable cracking scenario and appropriate loading conditions. If the scenario includes cracks in multiple elements, or multiple cracks in one element, the applicant must account for that in determining where, when, how, and how often to inspect for cracks.
(b) The damage-tolerance evaluation should not use an easily evaluated solution if it is not a representative scenario (for example, a handbook solution for a single crack growing from a hole when the actual scenario involves multiple cracks). Such an evaluation could result in an ineffective inspection program. However, in many cases, it may be acceptable to evaluate a conservative, but easier to analyze, scenario than the actual scenario. If an applicant uses such an approach, the applicant should explain and justify all simplifying assumptions.
(2) Critical Crack Size. The critical crack size is the size of crack that degrades the strength of the structure to the minimum strength required. The applicant should use fracture mechanics analysis, supported by test evidence, to determine the relationship between crack size and residual strength. The minimu m strength requirements for determining the critical crack size are listed in (a) through (e) below.
(a) For airplanes certificated in the primary, normal, utility, acrobatic, and commuter categories, § 23.573(b), current amendment level, defines the residual strength requirement.
(b) For airplanes certificated in the transport category, § 25.571(b), current amendment level, defines the residual strength requirement.
(c) For airplanes certificated in the restricted category, the residual strength requirements should be consistent with the airplane category used for type certification under § 21.25.
(d) The FAA may require higher levels of minimum strength in instances of high probability of in-service cracking (several reports of cracks) or in airplanes with severe operational profiles such as aerobatics, aerial application, and low-level survey.
(e) For an individual airplane with a known crack in the structure, the FAA may impose specific requirements before the FAA will allow further flight. See AC 23-13A for the FAA Small Airplane Directorate’s policy for flight with known cracks in small airplane structure.
(3) Detectable Crack Size. The detectable crack size is the minimum size crack that an inspector can find reliably and repeatedly. The first prerequisite for an effective inspection program is that the detectable crack size must be smaller than the critical crack size. An applicant should address, at a minimum, the following issues in determining the detectable crack size:
• What inspection methods are potential candidates for this specific application?
• What crack size is detectable using these candidate methods in this specific application?
• What is the probability of detection for the average inspector given the specific application? (See the reference in paragraph 6c(6) for information on probability of detection.)
• What qualifications will the inspector need to have? Will qualified inspectors be available?
• How accessible is the structure? In some cases, the inspector or mechanic may need to remove or modify the structure to gain access.
• Does sealant or paint cover the area? Can an inspector or mechanic easily remove the sealant or paint? Does the inspector or mechanic need to reapply the sealant or paint after the inspection?
• Will the inspector need to have fasteners removed to complete the inspection? If so, what is the potential for damaging the structure in this process?
• Will the fastener holes require additional reaming before inspection? Is the edge margin adequate? Will the reinstallation require special oversize fasteners?
In addressing these and other related issues, the applicant is ensuring the average inspector can find a crack of a given size with a high probability of detection (POD). Any applicant using inspection data (including probability of detection) from industry, military, or the National Aeronautics and Space Administration (NASA) sources should be able to justify their use and applicability. For example, a published probability of detection does not mean it is acceptable to the FAA if the personnel, equipment, or conditions (lighting, cleanliness, etc.) on which the POD is based are not reasonably expected to exist for each inspection.
(4) Crack Growth Life. Crack growth life is the time (in number of flights or flight hours time in service) it takes the detectable crack to grow to critical size. The second prerequisite for a viable inspection program is that the crack growth life has to be sufficiently long to allow for practical inspection.
(a) An applicant typically determines the crack growth life based on a fracture mechanics-based crack growth analysis. However, in some cases, it may be possible to determine crack growth life by counting the striations on the fracture surface of the accident, incident, or test structure.
(b) If the crack growth life for the initially selected inspection method does not result in sufficient time between when the crack reaches the detectable crack size and when it reaches the critical crack size, inspections may not be a safe and effective method for addressing the demonstrated risk. In some instances, an applicant may want to consider other inspection methods that may be able to increase the crack growth life based on detecting smaller cracks. An applicant will often base their preference of inspection method on method sensitivity and cost versus inspection frequency. If the applicant cannot show the inspection program is safe and effective, then the applicant should pursue a part replacement/modification program as explained in paragraph 10c of this AC.
(5) Inspection Repeat Interval. The inspection repeat interval is typically a fraction of the length of time for the crack to grow from the detectable crack size to the critical crack size.
Appendix 4 provides acceptable methods for determining the repeat inspection interval. It is the applicant’s option to determine how complex or simple the analysis should be. The applicant may determine that a simple analysis using conservative assumptions and scatter factors produces an acceptable inspection interval. An applicant may also use a more detailed analysis 17
to justify a longer inspection interval. The applicant should explain and justify all simplifying assumptions.
(6) Inspection Threshold. The inspection threshold is the time when the operator must perform the first inspection. The FAA has accepted several different methods for determining the inspection threshold. No matter what method an applicant uses, the applicant should always ensure that the thresholds are rational, given the accident, incident, or in-service findings. For example, if cracks are found in-service at 5,000 hours time in service, it is rational to set the inspection threshold at some time well before 5,000 hours, even if analysis produces a larger threshold.
(a) The applicant may determine the inspection threshold based on information learned from the airplane involved in an accident, incident, or in-service finding. Probabilistic methods, including Weibull analysis, allow an applicant to estimate the probability of a crack at a specific time in service. For small airplanes, the FAA’s Small Airplane Directorate typically accepts an inspection threshold corresponding to the time in service when the probability of developing a crack reaches 1-in-1,000.
(b) The applicant may determine the inspection threshold using a fatigue (stress-life or strain-life) evaluation. The applicant should correlate the results of the fatigue evaluation with the time in service of the airplanes involved in the accident, incident, or in-service findings. See AC 23-13A for guidance on performing small airplane fatigue evaluations.
(c) The inspection threshold may also be based on crack growth analysis results.
There are two accepted crack growth based approaches. In the first approach, the inspection threshold is set equal to the repeat inspection interval. In the second approach the inspection threshold is based on the time (divided by a factor) a crack would grow from an initial assumed size to the time that the crack reaches the critical crack length. The reference in paragraph 6c(3) provides additional detail on the crack growth method.
(d) Ample literature is available that describes the details of any of the above analysis approaches. Whichever approach an applicant ch ooses, it is the applicant’s option to determine how complex or simple the analysis should be. The applicant may determine that a simple analysis using conservative assumptions and scatter factors produces an acceptable inspection threshold. An applicant may also use a more de tailed analysis to justify a longer inspection threshold. The applicant should explain and justify all simplifying assumptions.
(e) If any airplanes in a fleet exceed the inspection threshold, the FAA expects inspection of those airplanes as soon as possible, allowing an appropriate grace period to prevent unnecessary disruption.
(7) Define Inspection Requirements and Procedures. An applicant should document the inspection program in sufficient detail to support implementation of the program as an airworthiness limitation item. The inspection program documentation should include, but not necessarily be limited to:
• Reasons for the inspection, including applicable ADs and Service Bulletins (SB);
• Description of the inspection area, including illustrations depicting the inspection area, anticipated crack locations, probe/transducer placement, and crack signal;
• Instructions for preparing the inspection site, including required access, cleaning requirements, fastener removal, and safety (e.g., fuel tank purging);
• Description of inspection method; for example, dye penetrant, ultrasound, high/low frequency eddy current, visual, or magnetic particle;
• Required equipment, including any crack calibration standards used to calibrate inspection equipment;
• Calibration requirements;
• Required qualifications of inspectors;
• Accept/reject criteria;
• Repeat inspection interval (as determined in paragraph 10b(5));
• Inspection threshold (as determined in paragraph 10b(6));
• Reporting requirements; and
• Approval and revision status of the inspection instructions.
(8) Criteria for Developing a Damage Tolerance Based Inspection Program. When a demonstrated risk is identified in a type design, the criteria used for developing an inspection program need to be tailored to the demonstrated risk being considered. These criteria may deviate from the criteria specified in the certification basis for that type design. This is because at the time of certification, criteria apply to potential fatigue not yet realized in service and its probability of occurrence should be relatively low when the inspections start. This is not the case for a demonstrated risk. Th erefore, the applicant should work with the FAA to establish tailored criteria appropriate for the demonstrated risk being addressed. Items to address include, but are not limited to, the residual strength that must be assured, inspection threshold methodology, establishment of the inspection interval, and inspection POD.
c. Part Replacement/Modification Programs. There are three reasons why an applicant may select a part replacement/modification program.
• Part replacement/modification may be necessary if a damage-tolerance based inspection program is not safe or effective.
• Part replacement/modification may provide a more efficient solution to the demonstrated risk than a damage-tolerance based inspection program.
• The applicant may desire a part replacement/modification program.
(1) An applicant must determine the time in service at which to accomplish the part replacement/modification, substantiate compliance to the applicable regulations, and develop detailed instructions for accomplishing the part replacement/modification. The applicant should be aware that by strengthening the location where the fatigue cracking occurred, the load path may change and transfer load to surrounding structure, creating a new fatigue location.
(2) Determine Time in Service for Part Replacement/Modification.
(a) The time in service for part replacement/modification is the point in the operational life of each airplane at which the operator must modify or replace the structure, regardless of condition. The applicant should es tablish the time in service to minimize the probability of having a crack initiate in the structure.
(b) For small airplanes, the FAA’s Small Airplane Directorate has accepted a time in service corresponding to a probability of 1-in-1,000 of developing cracks in structure. The applicant typically uses a fatigue analysis correlated to in-service findings or a probabilistic analysis of all in-service crack findings to determine the time in service for part replacement/modification.
(c) Under certain circumstances, a fleet may be operated beyond an established time in service for parts replacement/modification. For instance, parts for all affected airplanes may not be immediately available. Or, there may be limited maintenance facilities with appropriate tooling, equipment, or expertise readily available. The FAA may allow an alternative schedule under these circumstances if the risk can be reduced to an acceptable level with an interim inspection program. To determine the rate of fleet part replacement/modification compliance, a data-driven risk assessment approach using fleet demographics should be used. Individual airplane and fleet risk should be assessed for any such alternative schedule. The FAA may approve the plan if the risk is acceptable.
(3) Method of Compliance for Part Replacement/Modification. An applicant must demonstrate compliance to the applicable regulations for any replacement or modification of existing structure. Since the applicant knows th e location is critical in fatigue, any part replacement or modification should demonstrate compliance to the most appropriate amendment fatigue regulations regardless of certification basis. In all cases, an applicant should establish a safe-life limit or develop a damage-tolerance based inspection program for both the modified or replaced structure and existing surrounding structure it affects.
(a) For small airplanes, Amendment 23-48 to §§ 23.571 and 23.572 are appropriate.
(b) For transport airplanes certificated prior to Amendment 25-45, use § 25.571 at Amendment 25-45.
(c) For transport airplanes certificated under Amendment 25-45 or later, use § 25.571 at the amendment level used for its TC basis.
(4) Instructions for Part Replacement/Modification. An applicant should document the part replacement/modification instructions in sufficient detail to support implementation as an airworthiness limitation item. Details of the mandatory actions include, but are not limited to:
• Development of service kit details,
• Determination of a part replacement/modification threshold and any part replacement/modification intervals, and
• Development of inspection and reporting instructions for structure prior to modification.
(a) Inspections and reporting instructions may be necessary as part of the service kit instructions or replacement procedures. One of the purposes of these inspections is to ensure the modified structure is crack free. These a dditional instructions should provide detailed procedures to inspect for cracks in the affected parts. (Paragraph 10b(7) discusses inspection procedures.) These instructions should also outline procedures for reporting the inspection findings to the applicant and crack findings to the FAA. Appendix 3 contains examples of reporting requirement language suitable for FAA ADs that mandate an FMP.
(b) If cracks are found, the FMP holder should make arrangements and subsequently develop instructions to provide for the return of removed parts (or the applicable portions of removed parts) to the FMP holder or the FAA for evaluation. In either case, the instructions should encourage maintenance facilities to return removed parts to the FMP holder for evaluation.
(c) Accurate inspection and reporting can facilitate further refinement of modification/replacement thresholds and intervals. This refinement may be beneficial where the original analysis was conservative, there are few or no Service Difficulty Reports (SDR), the FMP holder suspects anomalies exist, or where modifications and replacements are difficult, costly, or time-consuming.
d. Inspections for Other Fatigue Critical Structure. In addition to dealing with the known unsafe condition, an FMP that addresses a type design with a demonstrated risk should include other fatigue critical structure inspections (see paragraph 10a(2)). As explained in paragraph 10a(1), inspection or modification/replacement of a specific part or parts mitigates a demonstrated risk for a known unsafe condition. However, continued operation allows more fatigue cycles to accumulate on other likely fatigue critical structure and may lead to another unsafe condition. Historically, fatigue cracking in another part of the structure follows fatigue cracking in one location of the airplane structure. This occurs because fatigue cracking is time in service related and a type design typically uses similar materials, construction techniques, and attention to fatigue detail throughout the structure. If the affected type design has an existing FMP with damage-tolerance based inspections, these inspections should be reviewed for necessary revisions as discussed in paragraph (1) below. If the affected type design has no FMP or the existing FMP only includes safe-life limits, an inspection program should be developed as discussed in paragraph (2) below.
(1) Type Designs with Existing FMPs that Include Damage-Tolerance Based Inspections.
(a) For some airplane type designs, FMPs already exist that include damage-tolerance based inspections and may also include safe-life limits and/or mandatory 21
replacement/modifications. The applicant should examine the existing FMP maintenance actions for these designs to determine their adequacy based on lessons learned from the unsafe condition. Existing life limits, modification/repl acement times, inspection thresholds, inspection intervals, inspection methods, procedures, etc., should be revised as necessary.
(b) The applicant should also assess other fatigue critical structure for design similarity to the unsafe condition and determine if any new FMP maintenance actions are required for similar structures. The assessment should include a service history review as discussed in paragraph (3) below. The FMP should adequately address structural details of areas historically prone to fatigue. A generic list of such areas is included in paragraph (4) below. Any new inspections should be damage-tolerance based.
(2) Type Designs Without an Existing FMP or With an FMP with Safe-Life Limits Only.
Some type designs may have no FMP because the certification basis was based on fail-safe requirements or did not include any fatigue requirements. The applicant should develop an inspection program to address other fatigue critical structure for these type designs and type designs where an existing FMP contains only safe-life limits. The applicant should include this component in the new FMP or add it to the existing FMP along with the actions developed to address the demonstrated risk as described in paragraph 10b and 10c. An applicant may base this component of the FMP on service history and engineering judgment. Additionally, an applicant may limit this component to directed visual inspections of details in areas known to be problematic in other type designs. Paragraph (3) below provides a list of potential sources of relevant service history and paragraph (4) provides a generic list of areas that past experience has shown can be problematic from a fatigue perspective. The resulting inspection program may provide some protection from future catastrophic failure due to fatigue. Directed inspections of probable cracking locations (beyond routine annual or other scheduled inspections) are generally beneficial. These types of inspections have prevented catastrophic failures. However, they may not provide the same level of safety as a damage-tolerance based inspection program.
(3) Service History Review. In reassessing ex isting fatigue management actions or in developing new actions, an applicant should thoroughly review the type design’s service history.
A review should look for precursors such as repeated repairs, working or broken rivets, fretting, chafing, fluid or pressurization leaks, part replacement, etc. Service history is an important aspect of setting up or adjusting an FMP. Sources of relevant service history information include:
• Existing mandatory actions, including ADs and the Airworthiness Limitations Section (ALS) of ICAs;
• Manufacturer’s SBs;
• FAA SDR database;
• In-service findings reported according to § 21.3;
• Repairs that received field approvals;
• History of part replacement;
• Discussions with type clubs of the specific type design; and
• Discussions with repair facilities that maintain the specific type design.
(4) Areas of Fatigue Critical Structure to Consider for Inspection. As defined in this AC, all fatigue critical structure with few exceptions can be expected to develop fatigue cracks eventually. However, based on past experience ther e are certain areas of fatigue critical structure that may be expected to develop fatigue cracks prior to its surrounding structure. These are typically areas of relatively high-tension stress combined with geometric features and/or internal load redistribution that result in high local stresses at detail design points (e.g., holes, door corners, transition radii, eccentricities, notches). Examples of such areas are given below:
• Wing and empennage joints, splices, and cut-outs of tension dominant load path,
e.g., lower spar caps, skins, stringers, fittings, bolts, etc;
• Fuselage carry-through structure areas similar to the above items, as applicable;
• Maximum tension bending moment location on the wing, horizontal tail, and vertical tail;
• Areas in primary wing load path where other loads are introduced such as engine or landing gear attachments;
• Wing strut attachments – both ends;
• Empennage attach areas;
• Pressurized fuselage joints, splices, and cut-outs.
e. Documenting the FMP. For FMPs that address a demonstrated risk, the applicant should incorporate instructions associated with both components of an FMP into a document suitable for FAA approval and for use by maintenance personnel.
(1) If the airplane model has an ICA, the applicant should add the FMP to the existing ALS of the ICA. If the airplane model does no t have an ICA (or an ALS associated with the ICA), then the applicant should write the FMP instructions in a document that contains pertinent information equivalent to the ALS portion of an ICA.
(2) Write instructions in plain English and provide clear and concise instructions for completing the tasks. The instructions should include, but not necessarily be limited to, the following:
• The type and the extent of inspection programs;
• Steps involved in part replacement or modification;