1

Grandt

AAE 554 Homework Assignment #1

Due 27 January 2014

As discussed in class, fatigue is a complex subject that has been treated by a number of different engineering approaches. The attached paper by R. G. Eastin1 entitled A Critical Review of Strategies Used to Deal with Metal Fatigue presented at the 2003 International Conference on Aeronautical Fatigue, for example, reviews various fatigue strategies employed by the aircraft industry. Please read this paper and answer the following questions. 1. How does Mr. Eastins define fatigue? 2. Briefly list and describe in your own words the three categories of fatigue discussed by Mr. Eastin. How are they similar? How are they different. 3. How do the safe-life and fail-safe methods differ in their approach to fatigue design? What are some other terms used by Mr. Eastin to refer to these two approaches? 4. Briefly summarize in your own words the Safety-By-Retirement strategy for fatigue design. 5. Briefly summarize in your own words the Safety-By-Inspection strategy for fatigue design. 6. Briefly summarize in your own words the Safety-By-Design strategy for fatigue design. 7. Although Mr. Eastins paper is directed toward aircraft applications, how could his comments relate to the manner in which the following industries might approach fatigue design? a. Ground vehicle industry b. Civil engineering (e.g., bridge design) c. Medical devices (e.g. knee replacements, etc.)

Robert G. Eastin is Chief Scientific/Technical Advisor for Fracture Mechanics with the Federal Aviation Administration.

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

A CRITICAL REVIEW OF STRATEGIES USED TO DEAL WITH METAL FATIGUE

Robert G. Eastin*

Fatigue has long been recognized as a significant threat to the continued airworthiness of all categories of aircraft. Consequently, requirements have been established to minimize catastrophic fatigue failures. Requirements applicable to various categories of civil aircraft are contained in Title 14 of the Code of Federal Regulations (14 CFR)[1] and must be complied with to receive Federal Aviation Administration type certification. These requirements have evolved over many years. Viewed collectively they present a somewhat confused landscape. Depending on aircraft category these requirements can result in different control actions or strategies that are all meant to achieve the same objective. This paper takes a close look at the regulatory landscape and critically reviews the resulting strategies. Observations are made and questions raised concerning the lack of uniformity between aircraft categories and the traditional application and resulting effectiveness of the various strategies. The paper concludes with some proposals on moving forward. These include (1) revising the current rules to make them more performance-based and consistent across aircraft categories and (2) adoption of hybrid strategies that combine the best elements of strategies that have traditionally been applied singularly.

INTRODUCTION What is the best approach to avoid catastrophic failures due to fatigue? There doesnt appear to be a general consensus on this question. Additionally, the 14 CFR fatigue requirements dont provide a definitive answer since significant differences exist depending on aircraft category (see Figure 1). Even discussing this question can be confusing due to inconsistencies in terminology that exist in 14 CFR and the aviation community. This paper addresses the question posed above. In doing so, three categories of fatigue are first identified based on causal factors or sources. This is considered
*

Federal Aviation Administration, Los Angeles Aircraft Certification Office

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

useful when strategies are reviewed for their ability to deal with each category of fatigue. Based on this review, a best way forward is proposed. SOURCES/CATEGORIES OF FATIGUE Within the context of this paper, the word fatigue refers to a degradation process of metallic structure subject to repeated loads that usually involves five phases (e.g. nucleation of many micro-cracks, coalescence of some micro-cracks to one macrocrack, stable crack growth, elastic tearing, and final fast fracture). Key characteristics of the complete fatigue process are illustrated in Figure 2. The boundaries between phases are, in practice, not always easily defined. Crack initiation methods (e.g. using S-N data and Miners Rule) are generally used to address the first two phases, while fracture mechanics based methods (e.g. using da/dN vs. K vs. R and fracture toughness data) are used for the later phases. As illustrated there is some point in the process where the crack(s) have a detrimental impact on static strength, and the resulting strength capability degrades as the crack(s) increase in size. If and how the fatigue process will proceed in a structure is dependent on a number of different variables. Contributing variables can generally be divided into those associated with physical attributes and conditions and those associated with loading. When discussing fatigue requirements and strategies it is believed to be reasonable and useful to use the categories described below. These categories were first proposed by Eastin [2] and are based on considering the contributing variables for any particular fatigue event being either anticipated or examined retrospectively.
Normal Fatigue

Normal fatigue is the inevitable accumulation of damage with resultant cracking that can be expected to occur at some point in time in any structure that is subjected to cyclic loading of sufficient magnitude and frequency. It is assumed that the structure is designed and manufactured without error, operated as planned, and serviced as expected. As defined, normal fatigue is predictable and the probability of it occurring is steadily increasing with time. Traditional fatigue testing is performed to characterize normal fatigue at the detail, component, and aircraft level. If one defines a discrete endpoint to life, such as the appearance of a 1 mm crack, the time to reach that endpoint typically follows a statistical distribution. If the endpoint is characterized in terms of static strength capability, the normal fatigue threat can be looked at as depicted in Figure 3. Two probability distribution functions (PDFs) are shown for two different fatigue states. One is the PDF for the time required to generate a crack of a size that would be critical at design limit load and the other is the time to ultimate load critical crack size. The horizontal and then descending solid line going through points A and B represents the 50th percentile

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

time dependent strength degradation due to normal fatigue. Key to addressing normal fatigue is estimating the time to a given fatigue state. Various methodologies have been and are used to do this. The most common approach employs a stress-life (-N) characterization of fatigue performance and a linear cumulative damage algorithm. Another similar approach uses a local strain-life (-N) characterization of fatigue performance. Fracture mechanics based approaches have also been proposed and used. It is worth noting that recent Aviation Rulemaking Advisory Committee (ARAC) recommendations contained in [3] describe methodologies that combine crack initiation methods with fracture mechanics based methods to predict the total life to reach specific fatigue states associated with multiple site damage (MSD).
Anomalous Fatigue

The phrase anomalous fatigue is used herein to refer to all fatigue that is due to some sort of off nominal physical condition. It is, by definition, unexpected and unpredictable. Classical sources of anomalous fatigue include material defects, tools marks, and poor quality holes. Other sources of anomalous fatigue include serviceinduced damage such as corrosion pits and dings and scratches. All the sources mentioned above are by their nature unpredictable. Considerable effort is made during design and manufacture to mitigate the risk of introducing anomalous fatigue sources. Likewise, controls are typically put in place once an aircraft enters service to minimize the risk of service related anomalies. In contrast to Figure 3, the degradation of structural integrity due to anomalous fatigue can be conceptually depicted as shown in Figure 4. Curve 1 represents the predictable effect of normal fatigue and is included for reference. Curves 2-4 depict degradation due to anomalous fatigue. As illustrated, the time of occurrence of the anomaly and its severity are unpredictable by definition and there is no associated PDF.
Unexpected Normal Fatigue

There are many examples of unexpected fatigue cracking that cant be blamed on an off nominal physical condition. Some typical root causes include poorly estimating internal loads and/or stresses, more severe usage (as compared to design assumptions), errors in external load predictions, and other common shortfalls in our ability to accurately model the structure and predict the future. In hindsight this category of fatigue has to be considered normal and we typically do well at after the fact prediction of the cracking once we have been made aware of the original shortcomings of our assumptions. Accordingly, this category is referred to as unexpected normal fatigue.

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

14 CFR REQUIREMENTS
Strength and Airworthiness

Basic static strength requirements that must be met are given in Sections 23.305, 25.305, 27.305 and 29.305 of [1] for the various aircraft categories. The design must be shown to be able to support limit loads without detrimental or permanent deformation and ultimate loads (defined as 1.5. times limit) without failure. It has always been intended to maintain this level of structural integrity as long as the structure is operated. Section 21.183 of [1] establishes this expectation when it says that one of the prerequisites for being considered airworthy (and thus eligible for an airworthiness certificate) is conformance with type design. Consistent with this is the FAAs flyable cracks policy that requires showing ultimate load capability, with any known crack, as a fundamental prerequisite for considering continued operation without repair. Also consistent with this line of thinking is the requirement to apply the basic type design strength requirements of [1] to any modifications or repairs to operational aircraft regardless of age. There is no allowance in [1] for relaxing type design strength requirements as the aircraft ages. Accordingly, maintenance of type design strength should always be considered when evaluating strategies used to avoid catastrophic failures due to fatigue.
Fatigue

Fatigue Evaluation requirements are contained in [1] for, (1) normal, utility, acrobatic, and commuter category airplanes, (2) transport category airplanes, (3) normal category rotorcraft, and (4) transport category rotorcraft, in parts 23, 25, 27, and 29 respectively. The stated objective is the same for all aircraft categories, and that is to avoid catastrophic failures due to fatigue. However, significant differences exist relative to terminology used and strategies that are considered acceptable and/or preferred. An overall summary is included in Table 1. A review of 14 CFR parts 23, 25, 27, and 29 indicates that there are at least five different approaches available for the applicant to choose from when addressing metal fatigue. However, the choices are somewhat different from one part to another. It should be noted that, with the exception of E, these are generally applied singularly. Under part 23 and 27 the choice of approach is left entirely up to the applicant, while under parts 25 and 29 the applicant is directed to a preferred approach. All these approaches result in one of three control actions or basic strategies. These are (1) retire the part, (2) inspect the part or (3) do nothing based on inherent fail safe design characteristics. Accordingly, the terms safety-byretirement (SBR), safety-by-inspection (SBI), and safety-by-design (SBD) have been adopted. Use of this terminology has been suggested in part by others.

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

The reader is directed to Swift [4] for a compelling discussion of supporting rationale for use of the terms SBR and SBI.

TABLE 1

14 CFR Fatigue Requirements.

14 CFR 27 (3) x 29 (4) x x x x x x x x 23 (1) x 25 (2) x

R ule T erm inology A B C D E S afe-L ife (Fatigue Strength) Flaw T olerant S afe-L ife Fail-Safe D am age T olerance (Fail-Safe) A+D

C O N T R O L A C T IO N Safety-by-R etirem ent Safety-by-R etirem ent Safety-by -D esign Safety -by-Inspection

(1) (2) (3) (4)

Safety-by-R etirem ent and Safety -by-Inspection A pplicant can select any one of three. (E xcept for com m uters.) D m ust be used unless show n to be im practical. A pplicant can select any one of three. B or D m ust be used unless show n to be im practical.

Part 23 The requirements under part 23 for normal, utility and acrobatic category airplanes allow the applicant to select any one of three approaches. Using part 23 terminology, a fatigue strength investigation would result in SBR, a fail safe strength investigation would result in SBD and a damage tolerance evaluation would result in SBI. It is emphasized that it is left entirely up to the applicant to select any one of the three allowed. The situation is markedly different under part 23 for commuter category airplanes. For this category the applicant is required to perform a damage tolerance evaluation resulting in SBI unless it is shown to be impractical. If impracticality is established, to the satisfaction of the authorities, the applicant is allowed to perform a fatigue evaluation resulting in SBR. Only two strategies are allowed and SBD is not one of them. Part 25 The requirements under part 25 for transport category airplanes are the same as for commuter category airplanes under part 23. The applicant is required to perform a

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

damage tolerance evaluation resulting in SBI unless it is shown to be impractical. If impracticality is established, to the satisfaction of the authorities, the applicant is allowed to perform a fatigue evaluation resulting in SBR. Only two strategies are allowed and SBD is not one of them. Part 27 The requirements under part 27 for normal category rotorcraft are similar to those under part 23 (except for commuter category) in that the applicant is allowed to choose freely amongst several options. However, there are differences in the choices available and the terminology used is significantly different. One option, using part 27 terminology, requires a replacement time evaluation resulting in SBR. Another option requires a fail-safe evaluation, but in the context of part 27 this is equivalent to a part 23 or part 25 damage tolerance evaluation, and results in SBI. A third option, specifically identified as a combination of replacement time and failsafe evaluations, results in SBR supplemented by SBI. Part 29 The requirements under part 29 for transport category rotorcraft are different from those under the other parts previously discussed. Additionally, some of the terminology used is unique to this part only. The terms tolerance to flaws and flaw tolerance are used in part 29. This addresses what has previously been described as anomalous fatigue. Although the severity of the anomaly is not quantified, the intent is clear in that the requirement states that the fatigue tolerance evaluationalso must include a determination of the probable locations and modes of damage caused by fatigue, considering environmental effects, intrinsic/discrete flaws, or accidental damage. Two significantly different approaches are identified as acceptable flaw tolerant methods and the applicant is required to use one of them unless he establishes that this is not possible within the limitations of geometry, inspectability, or good design practice. The two flaw tolerant options are referred to as flaw tolerant safe life and fail-safe. Application of the former option results in SBR, while the latter results in SBI. It should be noted that the term fail-safe, as used in part 29, has the same meaning as in part 27 (i.e. inspections based on crack growth and residual strength characteristics). The third approach identified in part 29 is referred to as safe life. This also results in SBR but is not considered a flaw tolerant method and is only available as a default option when it is shown that the flaw tolerant methods are impractical.

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

Observations and Questions An assessment of the fatigue requirements across all parts of [1] reveals that differences and even inconsistencies exist. Some of the more significant ones are summarized below. There are at least four different terms used to refer to the process used to support establishing retirement times wherein the effects of flaws are not accounted for. These are fatigue strength evaluation (part 23), fatigue (safe-life) evaluation (part 23 commuters and part 25), replacement time evaluation (part 27) and safe-life evaluation (part 29). There are at least two different terms used to refer to the process used to support establishing inspection requirements based on a structures crack growth and residual strength characteristics. These are damage tolerance evaluation (part 23 and 25) and fail-safe evaluation (parts 27 and 29). There are two completely different meanings for the term fail-safe. In part 23 it is what was deleted from part 25 with [5]. In practice, this typically involves showing residual strength capability with a single structural member completely failed and without the use of fracture mechanics based methods. In parts 27 and 29, the term fail-safe is used to refer to the fracture mechanics based process of determining the crack growth and residual strength characteristics needed to establish inspection requirements. Fatigue certification based on showing that catastrophic failure of the structure is not probable after fatigue failure, or obvious partial failure, of a principal structural element is presently only allowed under part 23. The flaw tolerant safe life approach is only allowed under part 29. Under part 27 and part 23 (except for commuters) the applicant is free to choose any of the identified options. Under part 23 (for commuters), part 25 and part 29 the applicant must use specified approaches unless impracticality is demonstrated. The combining of approaches is only specifically identified as an option under part 27. The only common denominator between parts is that they all are written prescriptively.

When one considers the fact that the stated objective of all the requirements is exactly the same, the following questions come to mind.

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

Why do the separate approaches, prescribed to meet the same objective, vary so much depending on aircraft category? Why is the applicant given equal options for some categories but constrained to only certain approaches unless impracticality can be demonstrated on others? Why does part 23 allow the fail safe option in light of the fact that this approach was intentionally removed from part 25 with [5]?

The author believes that the general answer to the questions noted above is that the requirements evolved somewhat independently, and with separate organizations and groups of individuals involved. Also, as noted above, the only completely common thread is that in each case a prescriptive philosophy was adopted in formulating the requirements. Beyond that, the prescriptions vary significantly. While this answer may explain why the requirements are so different, it certainly doesnt justify the differences. Further, it is suggested that there really is not any technical justification for the differences that exist. This is because fatigue in metals is in general the same, whether it is occurring in a small or large airplane, or a fixed wing airplane, or a rotorcraft. Perhaps if a more performance-based philosophy had been adopted, more uniformity would exist. I will return to this idea a little later. It was previously noted that all the approaches prescribed, regardless of what they are called, lead to one of three strategies or control actions. One of these involves retirement of the structure at a specified time (e.g. hours or flight cycles). The term Safety-by-Retirement is used for this outcome. The second resulting control action is periodic inspection of the part for fatigue crack(s). Accordingly, the term Safety-by-Inspection is used for this outcome. The last control action is really a non-action and only the fail-safe approach under part 23 currently results in this outcome, which says that retirement or inspection is unnecessary to prevent catastrophic failure, based on the fail-safe attributes of the design. Hence the term Safety-by-Design is used for this outcome. Each of these control actions are discussed in more detail below. SAFETY-BY-RETIREMENT Safety-by-retirement is the oldest strategy existing in [1] and is included in all fixed wing airplane and rotorcraft sections as indicated in Table 1. The only mandated control action is part replacement or modification
Application

The process used to establish a safe life (or replacement time) is conceptually depicted in Figure 5. The average or mean time to a specified fatigue state is first established and a factor, f, is applied to this life to establish a replacement time

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

when the part must be removed from service. The fatigue state indicated in Figure 5 is consistent with the safe-life requirements of Section 25.571(c) of [1] wherein the words without detectable cracks are use to define the acceptable fatigue state. The preamble material included in [5] provides clarification with: Therefore, if it is shown that no detectable cracks will be initiated during the service life of the structure, the FAA considers that no reduction in ultimate strength will occur. The factor used is chosen to achieve a certain level of reliability that parts are retired before the specified fatigue state is reached. The safety of all the parts in a population of parts is protected with one replacement time. The result is that a high percentage of parts will be retired before they have individually exhausted their safe life.
Effectiveness

SBR, when implemented correctly, has proven successful in dealing with normal fatigue. For example, experience with critical rotorcraft and turbine engine components indicates that the vast majority of parts are operated to retirement without detectable cracking. Fatigue incidents that have occurred are typically due to anomalous or unexpected normal fatigue. Since maintenance of type design strength is an explicit consideration of SBR, strength degradation during operation should not be an issue. This is not the case with SBI or SBD, as will be discussed later. Conceptually SBR can also be used to address anomalous fatigue. In fact this is what the part 29 flaw tolerant safe life approach is all about. However, adequately addressing potential anomalous fatigue threats could prove to be impractical depending on severity. The specific anomalies to be addressed must first be quantified so that coupons and/or parts can be preconditioned with appropriate defects prior to testing. It is envisioned that some worst case defect might be used to develop a bounding replacement time that would provide the desired reliability for even the most severe defect. However, before the fact quantification of anomalies could present a major challenge and resulting replacement times could be grossly conservative for parts that are not subject to the anomalies. There are no specific elements of SBR that help with unexpected normal fatigue. If external loads, usage, internals stresses, etc. are incorrect then the replacement time will be incorrect and the desired reliability of maintaining type design strength will not be realized. Based on the above it is suggested that SBR should only be relied on for protection against normal fatigue.

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

SAFETY-BY-INSPECTION Safety-by-inspection is the newest strategy to be included in [1]. It appears in all parts as either an option or preferred approach. It involves a mandatory inspection for fatigue cracks(s) based on the crack growth and residual strength characteristics of the structure.
Application

The process used to establish inspection requirements involves quantifying the crack growth and residual strength characteristics of the structure being considered. To do this, a fatigue-cracking scenario must be assumed and addressed. This is typically done analytically and supported by testing at least at the coupon level. Once these characteristics are quantified, inspection methods and intervals are defined that will facilitate crack detection before strength degrades below required levels. Additionally, it is common practice not to require the inspection to start immediately. An inspection threshold is typically determined based on assumptions about the condition of the structure at the time it enters service (e.g. lower bound initial quality). Once established, these inspections become a mandatory part of the operators maintenance plan.
Effectiveness

SBI can be a very effective strategy if prudently applied. However, there are a number of key issues that should be addressed. These include (1) maintaining type design strength capability, (2) the inspection threshold, (3) the cracking scenario(s) assumed, and (4) reliance on redundancy. In the opinion of the author, continued airworthiness is not adequately addressed in the certification rules of [1] relative to SBI. Consistent with the requirements of [1], if SBI is used, structural inspection requirements are established to insure that cracking is detected before residual strength degrades below a specified level. In general, this level is at or near design limit load. This is reasonable during the period of time that normal fatigue cracking is not expected to occur. However, when cracking becomes probable, and inspections are continued, it becomes more and more likely that type design strength is no longer present. The loss of strength with time due to normal fatigue cracking was notionally depicted in Figure 3. Figure 6 shows this and also illustrates how a minimum residual strength capability (i.e. PR) can be insured if inspections are taking place. However, if we continue to operate the entire fleet based purely on inspection, we will eventually be allowing operation with degraded strength (e.g. as low as zero margin). As the probability of normal fatigue cracking increases, the probability of having type design strength goes to zero. This should not be generally allowed to occur. When inspections first detect

10

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

cracking in the fleet, and this cracking is determined to be due to normal fatigue, replacement times should be established to insure that the overall fleet maintains type design strength capability with a high reliability. For example, if inspection findings indicate a PDF for the life to limit critical crack size as shown in Figure 6, continuing to inspect beyond some point in time, like T0, is counter to maintaining type design strength. SBI in its most undiluted form assumes fatigue cracking will occur, and then the time it will take for cracks to grow from detectable to critical sizes (for specified residual strength loads) is determined. This life is then used to set inspection intervals such that cracking will be detected before the strength degrades below required levels. Ideally, the inspections will start as soon as the aircraft enters service (i.e. no thresholds). If this philosophy is followed, the source of the cracking becomes irrelevant and the inspections will provide protection against fatigue failures from the beginning, regardless of the source. In practice this is seldom done. Typically, the start of inspections is delayed, based on the rationale that it is unlikely that significant cracking will appear early in the life of the aircraft. The longer this delay, however, the weaker the argument that the inspections are protecting against anomalies. If delayed long enough, the most we can say is that they are mitigating the normal fatigue threat. However, this will only be true if the inspection is based on assumed cracking that covers the normal cracking scenario for the structure in question. If it does not we are left with a situation where the inspections start too late to be effective in mitigating the anomalous fatigue threat, and are ineffective in providing adequate protection from normal fatigue. The net result may only be a false sense of security. In SBI, the importance of the cracking scenario assumed cannot be over emphasized. For example, consider a row of fastener holes that are all stressed approximately the same. If one hole was flawed during manufacture (the widely assumed USAF rogue flaw event) the resulting scenario would be characterized by a singular crack early on, resulting in a large dominant lead crack with little or no concurrent cracking in adjacent holes, up until it reaches critical size. In order to prevent a failure due to this kind of cracking, the required detectable crack size might be relatively large and the inspection interval quite long. On the other hand, if all the holes end up nominally the same, and no anomalies occur in service, the only threat is normal fatigue and the cracking scenario proceeds quite differently. This will be the classic multiple site damage (MSD) cracking scenario, wherein multiple cracks of various small sizes will eventually develop and interact (e.g. link-up). To prevent a failure due to this kind of cracking, the required detectable crack size will be relatively small, and the interval short. Table 2 contrasts the differences between these two types of cracking. Because of these inherent differences it is doubtful that one inspection protocol could be equally effective and practical for both types.

11

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

TABLE 2 General characteristics of two types of fatigue cracking in a row of fastener holes.

Type of Fatigue Cracking Anomalous Rogue Expected occurrence Crack growth life Critical configuration Detectability Inspection Interval Early in life Long Single large crack Easy Long Normal MSD Late in life Short Multiple small cracks Difficult Short

Redundancy can be very beneficial, especially with respect to anomalous fatigue that might occur early in the life of a structure. However, too much reliance on redundancy as the structure ages may result in unacceptable risk. If a structure has been designed to tolerate complete element(s) failure, in combination with partial cracking of adjacent element(s), it might be reasonable to use this capability in establishing inspection requirements. For this kind of structure it might be proposed that only rudimentary inspections (e.g. zonal visual inspections) are needed to reliably detect failed element(s) and/or relatively large fatigue cracks prior to loss of required residual strength. If this approach is taken, extra consideration should be given to the issues of type design strength, early detection of normal fatigue cracking by some other means, full scale test validation, and loss of redundancy with time. When the detectable fatigue damage, upon which an inspection is based, is relatively large, the strength capability of the structure may already be well below type design requirements at the threshold of detectability. This kind of inspection cannot be considered effective in detecting normal fatigue cracking in its early stages, and therefore reduces the potential effectiveness of SBI relative to normal fatigue. The resulting inspection protocol (i.e. only looking for very large cracks and/or failed members) could also result in a high probability that some aircraft will operate with significantly reduced strength for a period of time before cracking is detected and fleet modification is accomplished. Where this is the case, consideration should be given to supplemental inspections that are capable of detecting much smaller cracks. Predicting how a structure will behave with a large amount of damage present, and being able to count on it always behaving the same way, involves major challenges. Full-scale test validation of both crack growth and residual strength

12

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

characteristics should be performed for validation. This is also a major issue with SBD and is discussed in more detail later. If the success of an inspection protocol depends on a certain level of redundant capability, then the loss of redundancy with time must be addressed. This is also a major issue with SBD and is discussed in more detail later. Based on the above, it is suggested that SBI can provide effective protection against anomalous fatigue, provided inspections start early in the life of the aircraft. However, delaying the start of inspections can work against this benefit since there is no protection until the inspections start. SBI can provide effective protection from normal fatigue provided the inspection technique is effective in detecting relatively small cracks. Also, if these inspections are implemented, it can be argued that replacement times can be established based on in-service data, as opposed to defining them at type certification. SBI has the potential to provide some protection against unexpected normal fatigue if inspections start early enough and are directed to the right locations. Although the intervals may not be correct due to load/stress oversights, incorrect usage assumptions, etc., they would have some chance of precluding a failure simply because they are occurring. SAFETY-BY-DESIGN Safety-by-design (SBD) is the second oldest strategy existing in [1] although it currently is only an option in part 23 for other than commuter aircraft. SBD is dependent on achieving a design where fatigue cracking will be obvious during normal maintenance and operation before it becomes unsafe. Given this, there is no retirement, special inspection or any other specific action required. Conceptually, SBD is an extremely attractive option. Using it potentially eliminates the need for retirement of the structure at predetermined times and/or special in-service inspections. It is a business as usual strategy and normal maintenance and operation practices are deemed sufficient for maintaining adequate safety. Economic burdens once the structure is put into service are non-existent. Additionally, if a self-annunciating design is achieved, it can be argued that the question of when fatigue cracking will initiate becomes of academic interest only since by definition it will, by one obvious means or another, make its presence known before it presents an unacceptable risk. Acceptance of this argument can lead to reduced emphasis on understanding and quantifying the basic fatigue characteristics of the structure. Traditional fatigue analyses and tests become a matter of economics only, and can be scaled back or even deleted. If SBD is adopted, the attendant cost and schedule burdens on the engineering development

13

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

program (e.g. full scale fatigue testing) can be (and have been in the past) greatly reduced or eliminated.
Application

With SBD the emphasis is on achieving a level of redundancy such that it can be shown that the structure can tolerate a single element failure, or a partial failure of a significant portion of the structure, and still support the specified residual strength loads without catastrophic failure. Obvious detectability of the failed single element or partial failure has, in the past, been more assumed than demonstrated. The redundancy demonstration is largely by static analysis of failure scenarios that have been agreed upon with the authorities as being rational interpretations of the requirement to address a fatigue failure or obvious partial failure of a principle structural element. In the past there was no real standardization and the amount of damage postulated has tended to vary significantly from model to model. As succinctly stated by Goranson [6]: This would often lead to residual strength demonstration by analysis of defined obvious failures rather than showing that all the partial failures with insufficient residual strength were obvious.
Effectiveness

If SBD sounds too good to be true, it just may be. It only works if a truly selfannunciating design can be achieved for all possible fatigue scenarios. Past experience shows that, especially when normal fatigue is the threat, such a design is not generally achievable. This conclusion led to the eventual elimination of failsafety as an option in Section 25.571 of [1]. The supporting rationale behind elimination is included in the Preamble Information of [5] and [7]. It was decided that, as applied, it was sufficiently ineffective as to merit deletion as an acceptable approach. Shortcomings of SBD have long been recognized, documented and discussed. R. D. J. Maxwell in his 1973 ICAF paper [8] addresses some of the potential dangers that have developed in the application of the fail-safe approach over the years. Ulf Goranson in his ICAF 14th Plantema Memorial Lecture [6] noted that: In terms of fatigue damage, particularly in cases of aging airplanes subjected to damage at multiple sites, structural redundancies are not always efficient based on obvious damage design and inspection considerations. More recently Abraham Brot in his 2001 ICAF paper [9] stated: However, upon closer examination, the weakness of the fail-safe concept emerges. Some of the more significant issues that make SBD questionable include the following: The eventual loss of fail-safe attributes with time due to normal fatigue wearout. Accurate prediction and validation of failure modes.

14

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

Successful achievement of a design that is sufficiently and consistently selfannunciating. Maintenance of type design strength. The residual life with obvious damage present.

Perhaps the biggest issue with SBD is whether or not the primary structural attribute, the residual strength capability of the structure surrounding the damage, can be depended on. For SBD to have any chance of success, the structure must first be able to support the required residual strength loads without failing. Beyond that, it must hold together long enough to be found and repaired; but thats another issue. The required loads are typically on the order of design limit, and present a challenge even for well designed undamaged structure. With damage that is obviously detectable, this level of loading can result in local internal stresses and strains well in excess of the elastic limit, as internal loads must redistribute from the failed structure to the surrounding structure. The ability of the entire structure to withstand the specified loads becomes very dependent on the condition (local damage state) of the structure surrounding the obvious damage. In many cases, failure can be expected if the surrounding structure is anything less than pristine, and the probability of being pristine starts dropping as soon as the structure enters operation. Maxwell [8] and Brot [9] address this issue and discuss the escalating risk of failure of fail-safe structures as they age. It is also cautioned [8] that: The behavior of structures in the later stages of their lives, when cracking is becoming prevalent, needs careful consideration. Subsequent experience indicates that this caution was not always heeded. In studying [10], it appears that this was as least in the background as a causal factor in the Aloha Airlines incident of 1988. The Boeing 737 aircraft fuselage structure was originally certified in the mid 1960s as fail safe. A damage tolerance evaluation was subsequently performed, and a Supplemental Structural Inspection Document was developed in accordance with [11] and mandated by Airworthiness Directive in the early 1980s. Despite these actions, the resulting inspection program did not include any special inspections of the basic fuselage pressure shell. This is not necessarily surprising since this structure was originally shown by the OEM and found by the authorities to be fail safe. It appears that this finding was carried over into the OEMs damage tolerance evaluation process that identified this structure as Category 2. As indicated in [6], this category of structure does not require any special inspections based on its self-annunciating attributes. Unfortunately its old age behavior was not considered carefully enough. Clearly the structure involved could not, by any measure, have been considered fail safe at the time of the incident, or probably for a considerable period before. This and other similar experiences illustrate that when it comes to normal fatigue wearout, SBD becomes more and more unreliable as the probability of the threat increases.

15

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

Accurately predicting the behavior of a structure with obviously detectable fatigue cracking can be a challenging task. As previously noted, significant load redistribution typically takes place, and under the required residual strength loading the problem may involve nonlinear material and geometric behavior. Correctly anticipating local failure modes and criteria can be difficult but is essential to the correct prediction of overall collapse. The Lusaka Boeing 707 tailplane accident [12] is an excellent case study that illustrates how everyone can be surprised by how the structure really behaves as compared to how it was assumed it would behave. In this case the true behavior was only fully understood after post accident full scale testing was performed. Full scale testing, if done correctly, can reveal the true behavior and may be the only means to reliably validate predictions. However, this in itself presents another obstacle to successfully applying SBD. Full scale testing requires time and money. How many full scale test fail safe demonstrations could be practically included as part of a new type design certification program? As mentioned previously, SBD is extremely dependent on structure having and retaining specific attributes. Obviously detectable fatigue cracking must be tolerated until found and repaired. A key feature of this strategy is no structural failure if the required residual strength loads are experienced. However, achieving all this with high reliability in typical aircraft structures appears to be the exception rather than the norm. For example, in some cases it has been generally assumed that cracks greater than a certain size would be obviously detected. Experience has shown, however, that the obviously detectable size is very dependent on location, even if the basic structure is the same. A two bay skin crack in fuselage structure may be obvious in the basic shell, but what if it is located in a splice? Most typical splice configurations have at least one or two locations where even a very long crack may be undetectable without a special inspection. This assertion is borne out by service and test experience, where very long cracks have gone unnoticed for very long periods of time. Achieving the attributes necessary to support SBD may be the most difficult in precisely those locations where a reliable strategy to avoid fatigue failures is needed the most. Another approach to SBD that has been used in the past is to take advantage of the detectability of the consequences of cracking rather than the cracking itself. Examples include safe cabin depressurization due to fuselage skin flapping and fuel leakage associated with safe cracks breaching the fuel boundary in wing box structure. While the leak before rupture approach may be viable for certain structure in certain areas, this graceful failure mode must be both reliable and consistent (e.g. fuselage skin must always flap). Unfortunately, past service experience has not been encouraging in this regard. SBD does not address the maintenance of type design strength. By definition, structure is allowed to operate until cracking is obvious and strength potentially has degraded to the specified residual strength level. All design margin is therefore

16

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

potentially gone when cracking is found and repaired. If obvious means detectable via normal maintenance and operation before further flight, then it can be argued that at least operation with zero margin will not occur. However, even if it is walk around evident what can be said about strength margin up to the time of detection? More than likely we are accepting that there is a significant period of time that the aircraft will be operating with reduced margin (e.g. just above limit design strength). SBD by itself will allow every aircraft to proceed through this scenario The last of the five issues summarized above is not the least and has defeated SBD more than once. This has to do with how much residual life the structure really has with obvious cracking present. Ideally, the cracking will be walk around evident and then the question of residual life is irrelevant. If it is not, then it becomes extremely relevant. Experience indicates that structures with cracking that can really be considered obvious have relatively little residual life before failure can be expected, even if the required residual strength loads are never experienced. Depending on a significant amount of residual life after a major load path failure, for example, appears to be unrealistic in most cases. Based on the above, it is concluded that removal of SBD from part 25 with [5] was appropriate, and it should also be removed from part 23. A PROPOSED WAY FORWARD In moving forward, it is suggested that the rules should be revised to be more performance-based and less prescriptive. Such rule changes should be applied equally across all aircraft categories, and could, for the first time, achieve true standardization, at least at the rule level. The selection of strategies and supporting methodologies used to achieve the objective would be left up to the applicant, with guidance provided in appropriate advisory material. Additionally, the use of multiple strategies should be encouraged if not expected since experience indicates that relying completely on one may be too myopic and inefficient.
A Performance-Based Rule

Why not a rule that could be the same across all parts? This doesnt appear to be unreasonable, considering that the basic fatigue process is the same regardless of aircraft category. Additionally, the fundamental objective across all parts is the same. Maybe, as suggested in [4], there has been too much of a focus and preoccupation with the means to the end rather than the end itself. Lets consider being more objective and less prescriptive. This approach is consistent with the current FAA/JAA philosophy and policy for rulemaking. The primary elements of a performanced-based rule could be as follows:

17

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

Catastrophic failure due to fatigue must be avoided. All potential sources of fatigue should be considered (e.g. a threat assessment should be conducted). All structure where fatigue cracking, if left undetected, could lead to a catastrophic failure should be subject to a fatigue evaluation. Based on the results of the fatigue evaluation inspections, replacement times and other procedures should be established to avoid catastrophic fatigue failures.

It is worth noting that a recent ARAC activity has resulted in pending recommendations for revisions to Section 29.571 of [1]. The primary elements of the recommended rule were recently made public [13] and are summarized in Figure 7. This could serve as a template for similar revisions to parts 23, 25 and 27.
Hybrid Strategies

All three of the strategies previously discussed have their pros and cons. In considering these, it appears that an optimum approach for minimizing catastrophic failures due to all categories of fatigue might include elements of each. As previously noted, Section 27.571(e) of [1] currently allows for the combination of replacement time and failsafe evaluations for small helicopters. That is to say SBR, plus SBI. Instead of this kind of approach being an obscure option in only one part out of four in the regulations, could not it be generally applied? In this way the strong points of each single strategy could be used to develop an optimum approach. Because of the predictable nature of normal fatigue, SBR appears to be a rational approach. The structure is operated and retired/modified at a hard life limit without any special inspections. However, this approach applied singularly leaves us vulnerable to premature fatigue cracking caused by physical discrepancies (i.e. anomalous fatigue) and errors in assumptions and data used in supporting fatigue evaluations (i.e. unexpected normal fatigue). Adding SBI could provide protection against anomalous fatigue. Additionally, inspection findings (and non-findings) could potentially be used to provide a check on SBR replacement times. Of course this would depend on the capability of the inspections to reliably detect normal fatigue in its early stages. If the capability existed, replacement times established to support type design certification could be later modified, based on actual service performance. Therefore, SBI would not only provide protection from anomalous fatigue, but inspection results could potentially be used to soften the hard life limits established at certification. It could thus provide potential safety and economic enhancements relative to normal fatigue while being the primary defense against anomalous fatigue. Unexpected normal fatigue may be the hardest threat of all to deal with. The safe-life strategy in itself does not help much, since the retirement/modification life

18

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

is premised on correctly predicting or measuring the loads, stresses, Kts, operational spectrum, etc. Even the best analysis may miss, and if it is by much cracking and possible failures could occur before the part is due to be retired/modified. Likewise, SBI comes up short since the crack growth and residual strength predictions that we base our inspection requirements on are no better than the inputs. The FAA rules do not include anything that deals directly with unexpected normal fatigue and should not. Getting the inputs correct is left to the applicants, and any factors they may choose to account for any shortcomings are also left up to them. In spite of all this, the mere act of periodically inspecting for cracks has, on many occasions, lead to the discovery of cracking due to what is eventually identified as normal fatigue. Even though the inspection method and intervals established may have been incorrect (due to errors in the loads, stresses, usage, etc.), catastrophic failure was avoided as a result of the inspection. This ancillary benefit of SBI provides another compelling argument for its application. Given all of the above, it still may be argued that there may be threats that produce fatigue cracking that the inspections do not pick up, and replacement times come too late to help. If practical, an element of SBD may provide an extra element of protection. Some level of redundancy could be designed in to provide extra forgiveness relative to unknown factors. How much additional safety the redundancy would provide is hard to quantify. However, as previously noted, it has on occasion been a factor in the past in preventing catastrophic failures. In this context it should be treated as an extra, and should not relied on explicitly without substantial and rigorous validation. The application of approaches that combine elements of existing strategies appear to be on the horizon. The recently developed ARAC recommendations for rotorcraft, briefly described earlier, combine SBR and SBI. Additionally, another ARAC working group, tasked with considering revisions to Section 25.571 of [1], has developed recommendations that include the general application of SBI, along with elements of SBR to mitigate the threat of widespread fatigue damage (WFD). Additionally, a level of redundancy is being required for certain types of structure to ensure a minimum level of robustness as a potential extra, and separate line of defense. CLOSURE If one considers all types of aircraft, there are different strategies that have been and are being used to avoid catastrophic failures due to fatigue. This is not surprising in light of the differences existing in [1] relative to fatigue evaluation requirements. However, there does not appear to be any technical justification for these differences, and it is concluded that requirements could and should be made more uniform.

19

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

A critical review of commonly applied strategies and their potential effectiveness relative to avoiding fatigue failures has been performed. Based on this review, it is concluded that consideration should be given to hybrid strategies that combine elements of existing strategies that have traditionally been applied singularly. This would provide optimum protection from fatigue failures, regardless of source. In order to facilitate moving towards more uniformity and effectiveness, changes to the fatigue evaluation requirements of [1] are needed. The requirements should be more performance-based and allow applicants more latitude in selecting an approach specifically tailored to the structure being addressed. REFERENCE LIST (1) Code of Federal Regulations, Title 14, Chapter 1 Federal Aviation Administration Department of Transportation. (2) Eastin, R.G., Strategies for Ensuring Rotorcraft Structural Integrity, North Atlantic Treaty Organization Research and Technology Organization Meeting Proceedings 24 (RTO-MP-24), Corfu, Greece, April 1999. (3) Recommendations for Regulatory Action to Prevent Widespread Fatigue Damage in the Commercial Airplane Fleet, A Report of the Airworthiness Assurance Working Group for the Aviation Rulemaking Advisory Committee Transport Aircraft and Engine Issues, March 11, 1999; (Revision A, June 29, 1999). (4) Swift, S., Gnats and Camels, Proceedings for the 1999 (Seattle) ICAF, Vol. 2, p. 685. (5) FAR Final Rule, Federal Register: October 5, 1978 (Volume 43, Number 194), 14 CFR Part 25 (Docket No. 16280; Amendment No. 25-45). (6) Goranson, U. G., Damage Tolerance Facts and Fiction, Proceedings of the17th International Committee on Aeronautical Fatigue (ICAF) Symposium, Stockholm, Sweden, June 1993. (7) FAR Final Rule, Federal Register: July 20, 1990 (Volume 55, Number 140), 14 CFR Part 25 (Docket No. 24344; Amendment No. 25-72). (8) Maxwell, R. D. J., Fail-Safe Philosophy: An Introduction to the Symposium, Proceedings of the 7th ICAF Symposium, London, England, July 1973. (9) Brot, A., Assessing the Reliability of Fail-Safe Structures, Proceedings of the 21st ICAF Symposium, Toulouse, France, June 2001. (10) Aircraft Accident Report No. NTSB/AAR-89/03, Aloha Airlines, Flight 243, Boeing 737-200, N73711, Near Maui, Hawaii April 28, 1988, National Transportation Safety Board, June 1989.

20

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

(11) FAA Advisory Circular No. 91-56, Supplemental Structural Inspection Program for Large Transport Category Airplanes, 5/6/81. (12) AIRCRAFT ACCIDENT INVESTIGATION REPORT 9/78, Boeing 707 321C G-BEBP Report on the accident near Lusaka International Airport, Zambia, on 14 May 1977, Department of Trade, Accidents Investigation Branch, published 8 June 1979, Her Majestys Stationary Office, London. (13) Miles, S., Proposed Regulatory Rule Fatigue Tolerance of Metallic Structure An Overview, Workshop on Fatigue Design of Helicopters, Dipartimento di Ingegneria Aerospaziale dellUniversit di Pisa, Pisa, Italy, September 2002.

21

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

FIGURE 1 A confusing landscape.

Normal, Utility, Acrobatic & Commuter Airplanes (Part 23)

Category of Aircraft ?
Transport Rotorcraft (Part 29) Normal Rotorcraft (Part 27)

Commuter ? No

Yes

Transport Airplanes (Part 25)

Is Damage Tolerance Impractical ? Yes Choose One

Is Flaw Tolerance Impractical? Choose One No

No No

Yes Retire & Inspect

Do Nothing

Retire

Inspect

FIGURE 2 The fatigue process.

ULT

Residual Strength
STRENGTH CAPABILITY

CRACK SIZE

Crack Growth

aDET

Micro crack nucleation and coalescence TIME

Macro crack growth to fracture

22

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

FIGURE 3 Degradation of strength with time due to normal fatigue (50% probability).

STRENGTH CAPABILITY

ULT.

LIMIT

PDF For Life to Critical Crack Size at Ultimate

PDF For Life to Critical Crack Size at Limit

TIME

FIGURE 4 Degradation of strength with time due to anomalous fatigue.

STRENGTH CAPABILITY

NORMAL ULT.

4
LIMIT

ANOMALIES

PDF For Life to Critical Crack Size at Limit

TIME

23

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

FIGURE 5 Application of safety-by-retirement.

REPLACEMENT TIME

STRENGTH CAPABILITY

ULT.

FAR 2x.305 Requirement

LIMIT

ANOMALIES

PDF For Life to Defined Fatigue State

N/f

TIME

FIGURE 6 Application of safety-by-inspection.

1.0
Probability that Strength = ULT.

STRENGTH CAPABILITY

ULT.
Anomaly

FAR 2x.305 Requirement Normal Fatigue Wearout

PR

FAR 2x.571 (PR)

With Inspections Without Inspections T0

PDF For Life to Critical Crack Size at PR

TIME

24

ICAF 2003 FATIGUE

OF

AERONAUTICAL STRUCTURES AS AN ENGINEERING CHALLENGE

FIGURE 7 Section 29.571 proposed rule for transport rotorcraft.

Fatigue Tolerance Evaluation of Metallic Structure Establish appropriate actions to avoid catastrophic failure during the operational life of the rotorcraft 1) 2) 3) 4) 5) 6) Submit compliance methodology to the regulatory authority for approval Identify PSEs Assess threats/Damage Determine the fatigue tolerance characteristics for the PSEs with damage. Determine residual strength allowable damage size Establish inspections and retirement times

If inspections for any of the damage cannot be established within the limitations of geometry, inspectability, or good design practice, then

Supplemental procedures must be established that will minimize the risk of each type of damage being present or leading to catastrophic failure

25