MIL-HDBK-17-3F Volume 3,Chapter 7-Damage Resistance,Durability,and Damage Tolerance 7.2.2.1 Compliance with static strength requirements(civil aviation) As far as impact damage is concerned,the AC 20-107A(S 6g)proposes the following means for complying with the regulations:It should be shown that impact damage that can be realistically expected from manufacturing and service,but no more than the established threshold of detectability for the selected inspection procedure,will not reduce the structural strength below Ultimate Load capability. This sentence explicitly defines energy cut-offs and detection thresholds,which are illustrated in Fig- ure 7.2.2.1.The first cut-off threshold is the established threshold of detectability for the inspection method used.The second cut-off threshold is the maximum impact energy that the structure can be ex- pected to tolerate during manufacturing and in service.These two thresholds are assumed to describe accidental damage for new structure representative of the minimum quality.Minimum values of these cut- offs and thresholds need to be established so that there is consistency between the detectable size and the selected NDT procedure plus consideration of realistic energy levels. Damage size (for detectability) Thin skin area(e.g.sandwich construction for control surfaces) established threshold of detectability for the selected inspection procedure 000 Thickness 1 ena t2 t3 Thick skin area (e.g.solid laminate construction for wings t1<t2<t3<.<tn tn and empennages) Energy level Energy level that can be realistically expected from manufacturing and service FIGURE 7.2.2.1 Damage size as a function of impact energy for different laminate thickness. Establishing the energy cut-off values requires defining the energy level associated with the word re- alistic.The rectangle in Figure 7.2.2.1 represents the domain in which structure is capable of withstanding Ultimate Loads,without necessary repairs.This applies to the start of service life,when the aircraft rolls out of the manufacturer's plant,as well as at the end of lifetime when composite parts are likely to have accumulated some accidental damage below the detectability thresholds.Damages that are above the rectangle in Figure 7.2.2.1,are assumed to be detected and repaired with cosmetic or structural solutions so that the structure's residual capability to withstand Ultimate Loads is preserved or restored,respec- tively. The purpose of"damage tolerance"is to address situations with only a limited occurrence;therefore, a large majority of the aircraft structure should retain Ultimate Load capability during the service life.A discussion of one method of estimating these realistic energy levels is given in Section 7.3.3. 7-11
MIL-HDBK-17-3F Volume 3, Chapter 7 - Damage Resistance, Durability, and Damage Tolerance 7-11 7.2.2.1 Compliance with static strength requirements (civil aviation) As far as impact damage is concerned, the AC 20-107A (§ 6g) proposes the following means for complying with the regulations: It should be shown that impact damage that can be realistically expected from manufacturing and service, but no more than the established threshold of detectability for the selected inspection procedure, will not reduce the structural strength below Ultimate Load capability. This sentence explicitly defines energy cut-offs and detection thresholds, which are illustrated in Figure 7.2.2.1. The first cut-off threshold is the established threshold of detectability for the inspection method used. The second cut-off threshold is the maximum impact energy that the structure can be expected to tolerate during manufacturing and in service. These two thresholds are assumed to describe accidental damage for new structure representative of the minimum quality. Minimum values of these cutoffs and thresholds need to be established so that there is consistency between the detectable size and the selected NDT procedure plus consideration of realistic energy levels. Damage size (for detectability) Energy level that can be realistically expected from manufacturing and service Thin skin area (e.g. sandwich construction for control surfaces) Thickness 1 t2 t3 t1 < t2 < t3 <...< tn tn Thick skin area (e.g. solid laminate construction for wings and empennages) Energy level established threshold of detectability for the selected inspection procedure t4 Through penetration FIGURE 7.2.2.1 Damage size as a function of impact energy for different laminate thickness. Establishing the energy cut-off values requires defining the energy level associated with the word realistic. The rectangle in Figure 7.2.2.1 represents the domain in which structure is capable of withstanding Ultimate Loads, without necessary repairs. This applies to the start of service life, when the aircraft rolls out of the manufacturer's plant, as well as at the end of lifetime when composite parts are likely to have accumulated some accidental damage below the detectability thresholds. Damages that are above the rectangle in Figure 7.2.2.1, are assumed to be detected and repaired with cosmetic or structural solutions so that the structure's residual capability to withstand Ultimate Loads is preserved or restored, respectively. The purpose of “damage tolerance” is to address situations with only a limited occurrence; therefore, a large majority of the aircraft structure should retain Ultimate Load capability during the service life. A discussion of one method of estimating these realistic energy levels is given in Section 7.3.3
MIL-HDBK-17-3F Volume 3,Chapter 7-Damage Resistance,Durability,and Damage Tolerance 7.2.2.2 Compliance with damage tolerance requirements(civil aviation) Damage tolerance has to address the situation where,due to fatigue,corrosion or accidental occur- rence,Ultimate Load strength capability may not exist and will have to be restored before the damage becomes critical.As far as accidental impact is concerned,two situations have to be addressed.The first case involves those damages that meet static strength requirements (as per 25.305)and that might evolve during fatigue loading,while still remaining undetectable with the selected inspection procedure. The second case involves those damages that are outside the coverage illustrated by Figure 7.2.2.1,due to higher energy levels that will produce: More easily detectable damages associated with additional strength reduction for thin gage lami- nates(detectability threshold situation), Additional strength reduction without visual detection capability,in case of energy cut-off(E>Eco). Obviously.there will be an intermediate situation where damages that were not previously detectable will become detectable.The damages that have to be addressed in a damage tolerance substantiation are illustrated in Figure 7.2.2.2(a). Residual Astrength No large additional strength reduction may be expected Detect.threshold Energy Residual strength dent size Large additional strength reduction may be expected Detect.threshold Energy Energy x damages addressed for meeting 25 305 requirements additional damages to be addressed for $25 571 requirements FIGURE 7.2.2.2(a)Damages beyond those for Ultimate Load considerations. Depending on their detectability,different S 25 571 sub-paragraphs will apply: For those accidental impacts that will never be detected by the selected(visual)inspection pro- cedure,meaning those already accounted for in the scope of static strength requirements plus those with an increased energy,damage tolerance as per 25 571(b)is impractical.Then,dem- onstration will have to be made according to sub paragraph 25 571(c),fatigue(safe-life)evalua- tion.In fact,due to the presence of initial damage in that fatigue demonstration,the latter is usu- ally called"safe-life flaw tolerant"or"enhanced safe-life"demonstration. For those visually detectable accidental impacts,damage tolerance as per s 25 571(b)applies 7-12
MIL-HDBK-17-3F Volume 3, Chapter 7 - Damage Resistance, Durability, and Damage Tolerance 7-12 7.2.2.2 Compliance with damage tolerance requirements (civil aviation) Damage tolerance has to address the situation where, due to fatigue, corrosion or accidental occurrence, Ultimate Load strength capability may not exist and will have to be restored before the damage becomes critical. As far as accidental impact is concerned, two situations have to be addressed. The first case involves those damages that meet static strength requirements (as per 25.305) and that might evolve during fatigue loading, while still remaining undetectable with the selected inspection procedure. The second case involves those damages that are outside the coverage illustrated by Figure 7.2.2.1, due to higher energy levels that will produce: • More easily detectable damages associated with additional strength reduction for thin gage laminates (detectability threshold situation), • Additional strength reduction without visual detection capability, in case of energy cut-off (E>Eco). Obviously, there will be an intermediate situation where damages that were not previously detectable will become detectable. The damages that have to be addressed in a damage tolerance substantiation are illustrated in Figure 7.2.2.2(a). dent size Energy x x x x x x x damages addressed for meeting § 25 305 requirements additional damages to be addressed for § 25 571 requirements Residual strength No large additional strength reduction may be expected Energy Detect. threshold Large additional strength reduction may be expected Energy Detect. threshold Residual strength FIGURE 7.2.2.2(a) Damages beyond those for Ultimate Load considerations. Depending on their detectability, different § 25 571 sub-paragraphs will apply: • For those accidental impacts that will never be detected by the selected (visual) inspection procedure, meaning those already accounted for in the scope of static strength requirements plus those with an increased energy, damage tolerance as per 25 571 (b) is impractical. Then, demonstration will have to be made according to sub paragraph 25 571 (c), fatigue (safe-life) evaluation. In fact, due to the presence of initial damage in that fatigue demonstration, the latter is usually called “safe-life flaw tolerant” or “enhanced safe-life” demonstration. • For those visually detectable accidental impacts, damage tolerance as per § 25 571 (b) applies
MIL-HDBK-17-3F Volume 3,Chapter 7-Damage Resistance,Durability,and Damage Tolerance As for 25 305 requirements,new cut-offs and thresholds have to be defined: A new energy cut-off level limited to the maximum value that is to be assumed in a risk analysis and that should correspond to extremely improbable events(less than 10 per hour according to ACJ251309), A new detectability threshold above which damage will become "obvious"(detectable within a very small number of flights by walk-around inspection). Between the damage size detectable at detailed scheduled inspections and this new threshold,resid- ual static strength requirements are laid down in the regulatory documents 25 571(b).There is no re- sidual strength requirement associated with"obvious"damage.However,aircraft take off is not allowed in such situations before assessment and restoration of Ultimate Load capability There is a third detectability threshold which corresponds to the situation where the flight crew is at once aware of the event;then,lower loads(per 25 571(e))are required.This situation is referred to as "discrete source"damage.All these new thresholds are illustrated in Figure 7.2.2.2(b). Damage size Discrete source Obvious Threshold of detectability for scheduled inspection (e.g 1C.2C,4C) t1 t2 tl<t2<t3<...<tn t切 Energy level Energy level that can be realistically expected from manufacturing and service. Order of magnitude:105 to 10-6 per flight hour Limitation of the analysis to a probability of 10 E-9/flight hour FIGURE 7.2.2.2(b)Additional damage size and energy level thresholds. As discussed previously,impact damage can cause an immediate drop in composite residual strength.In most cases,such damage does not grow due to the generally good fatigue resistance of composites.The fact that an accidental impact damage in a composite structure is generally not ex- pected to propagate in fatigue raises a specific issue for interpreting 25 571(b),as illustrated in Figure 7.2.2.2(c).This sketch shows the difference that can be found between non-growing impact damage in a composite structure and a,prone to grow,fatigue crack in a metallic one.Whatever the damage source is, damage tolerance per s 25 571(b)requires the following:"The residual strength evaluation must show that the remaining structure is able to withstand loads(considered as Ultimate Loads)corresponding to the following conditions...".As shown with the metal curve in Figure 7.2.2.2(c),an inspection interval can 7-13
MIL-HDBK-17-3F Volume 3, Chapter 7 - Damage Resistance, Durability, and Damage Tolerance 7-13 As for § 25 305 requirements, new cut-offs and thresholds have to be defined: • A new energy cut-off level limited to the maximum value that is to be assumed in a risk analysis and that should correspond to extremely improbable events (less than 10-9 per hour according to ACJ 25 1309), • A new detectability threshold above which damage will become “obvious” (detectable within a very small number of flights by walk-around inspection). Between the damage size detectable at detailed scheduled inspections and this new threshold, residual static strength requirements are laid down in the regulatory documents § 25 571(b). There is no residual strength requirement associated with “obvious” damage. However, aircraft take off is not allowed in such situations before assessment and restoration of Ultimate Load capability There is a third detectability threshold which corresponds to the situation where the flight crew is at once aware of the event; then, lower loads (per § 25 571(e)) are required. This situation is referred to as “discrete source” damage. All these new thresholds are illustrated in Figure 7.2.2.2(b). Energy level that can be realistically expected from manufacturing and service. Order of magnitude : 10-5 to 10 -6 per flight hour t 1 t2 t3 tn t1 < t2 < t3 <...< tn Energy level Threshold of detectability for scheduled inspection (e.g. 1C, 2C, 4C) Obvious Limitation of the analysis to a probability of 10 E-9 / flight hour Discrete source Damage size FIGURE 7.2.2.2(b) Additional damage size and energy level thresholds. As discussed previously, impact damage can cause an immediate drop in composite residual strength. In most cases, such damage does not grow due to the generally good fatigue resistance of composites. The fact that an accidental impact damage in a composite structure is generally not expected to propagate in fatigue raises a specific issue for interpreting § 25 571 (b), as illustrated in Figure 7.2.2.2(c). This sketch shows the difference that can be found between non-growing impact damage in a composite structure and a, prone to grow, fatigue crack in a metallic one. Whatever the damage source is, damage tolerance per § 25 571(b) requires the following: "The residual strength evaluation must show that the remaining structure is able to withstand loads (considered as Ultimate Loads) corresponding to the following conditions...". As shown with the metal curve in Figure 7.2.2.2(c), an inspection interval can
MIL-HDBK-17-3F Volume 3,Chapter 7-Damage Resistance,Durability,and Damage Tolerance be rationally derived such that fatigue damage in metallic structure is safely detected and repaired before the strength drops below Limit Loads.Metal crack growth analyses and tests have matured to support such an assessment. Possible long duration below UL Composite under impact Short duration below UL Metallic under fatigue UL L Damage detection and repair to restore UL carrying capability time FIGURE 7.2.2.2(c) Comparison of composite non-growing damage and metal fatigue crack damage (Ultimate Load,UL,and Limit Load,LL). For the case of the no-growth,composite concept,a structure with impact damage could sustain a long duration below Ultimate Load without a threat of the residual strength further dropping to the critical threshold defined by 25 571(b)(i.e.,Limit Load).This interpretation could lead to the situation of a composite structure allowed to fly a long time with residual strength just above Limit Loads,as illustrated in Figure 7.2.2.2(c).Regardless of the damage growth resistance of composite structure,damage that lowers the residual strength below Ultimate Load must be detected and repaired when found.Hence,the issue becomes one of defining a rationale inspection interval to attain equivalent or higher levels of safety than metal practice. The advisory circular AC 20 107A,addresses the issue illustrated in Figure 7.2.2.2(c)in the para- graph 7a(4),which is related to the selection of inspection intervals:"For the case of the no-growth con- cept,inspection intervals should be established as part of the maintenance program.In selecting such intervals,the residual strength associated with the assumed damages should be considered".In other words,the larger the strength reduction is,the sooner the damage should be detected.Also,the prob- ability of damage occurrence plays a major role in deriving inspection intervals.For instance,more fre- quent inspections should normally be required for a flap,which is subjected to more damage threats,than for a vertical fin.In other words,both the capability of the composite structure and service history should be considered in defining the inspection intervals.Although metal structure has similar considerations for accidental damage,an inherent resistance to foreign object impact makes fatigue damage growth a domi- nant factor in defining inspection intervals for metal parts. In considering the issues of damage severity and probability of occurrence for a composite structure, damage reducing residual strength to Limit Load should be extremely unlikely.The residual strength curve,damage growth resistance,service databases and user maintenance practices should all be con- sidered in establishing the inspection intervals.In addition,the design criteria and certification approach used to substantiate the composite structure for damage tolerance should be coupled with subsequent maintenance practices.In the end,the composite structure should be sufficiently tolerant to damage such 7-14
MIL-HDBK-17-3F Volume 3, Chapter 7 - Damage Resistance, Durability, and Damage Tolerance 7-14 be rationally derived such that fatigue damage in metallic structure is safely detected and repaired before the strength drops below Limit Loads. Metal crack growth analyses and tests have matured to support such an assessment. Damage detection and repair to restore UL carrying capability Metallic under fatigue Composite under impact UL LL Short duration below UL time Strength Possible long duration below UL FIGURE 7.2.2.2(c) Comparison of composite non-growing damage and metal fatigue crack damage (Ultimate Load, UL, and Limit Load, LL). For the case of the no-growth, composite concept, a structure with impact damage could sustain a long duration below Ultimate Load without a threat of the residual strength further dropping to the critical threshold defined by § 25 571(b) (i.e., Limit Load). This interpretation could lead to the situation of a composite structure allowed to fly a long time with residual strength just above Limit Loads, as illustrated in Figure 7.2.2.2(c). Regardless of the damage growth resistance of composite structure, damage that lowers the residual strength below Ultimate Load must be detected and repaired when found. Hence, the issue becomes one of defining a rationale inspection interval to attain equivalent or higher levels of safety than metal practice. The advisory circular AC 20 107A, addresses the issue illustrated in Figure 7.2.2.2(c) in the paragraph 7a (4), which is related to the selection of inspection intervals: "For the case of the no-growth concept, inspection intervals should be established as part of the maintenance program. In selecting such intervals, the residual strength associated with the assumed damages should be considered". In other words, the larger the strength reduction is, the sooner the damage should be detected. Also, the probability of damage occurrence plays a major role in deriving inspection intervals. For instance, more frequent inspections should normally be required for a flap, which is subjected to more damage threats, than for a vertical fin. In other words, both the capability of the composite structure and service history should be considered in defining the inspection intervals. Although metal structure has similar considerations for accidental damage, an inherent resistance to foreign object impact makes fatigue damage growth a dominant factor in defining inspection intervals for metal parts. In considering the issues of damage severity and probability of occurrence for a composite structure, damage reducing residual strength to Limit Load should be extremely unlikely. The residual strength curve, damage growth resistance, service databases and user maintenance practices should all be considered in establishing the inspection intervals. In addition, the design criteria and certification approach used to substantiate the composite structure for damage tolerance should be coupled with subsequent maintenance practices. In the end, the composite structure should be sufficiently tolerant to damage such
MIL-HDBK-17-3F Volume 3,Chapter 7-Damage Resistance,Durability,and Damage Tolerance that economical maintenance practices can be safely implemented (e.g.,detailed damage inspections and repair at scheduled maintenance intervals). 7.2.2.3 Deterministic compliance method(civil aviation example) This section describes an analysis and testing methodology to support certification and maintenance of composite structures based on:(a)establishing residual-strength-versus-damage-size relationships; (b)establishing methods of damage detection and minimum detectable damage sizes;and(c)determin- ing damage sizes that reduce capability to both to Ultimate Load and Limit Load.Flow charts outlining an approach for achieving damage tolerant and fail-safe designs are presented. Several composite primary structures,such as the Boeing 777 empennage and NASA-ACEE/Boeing 737 horizontal stabilizers,have been certified per FAR 25 and JAR 25.The 737 stabilizers have demon- strated excellent service performance (Reference 7.2.2.3(a)).This service experience,as well as com- ponent testing (References 7.2.2.3(b)through 7.2.2.3(e)),has shown that current composite primary air- craft structure has excellent resistance to environmental deterioration and fatigue damage.This leaves accidental damage as the primary consideration for damage tolerance design and maintenance planning for the relatively thicker-gage composites associated with primary structure. In-service damage resistance and repair of thin gage composite structure has become a major issue for the commercial airlines.In order to make composites cost effective for the airlines,allowable damage limits(ADLs)must be as large as possible while still meeting regulatory Ultimate Load requirements.To achieve this goal,test data and analytical methods encompassing the complete range of potential dam- age sizes and types are required. This discussion presents a design approach to ensure that composite structures have low in-service maintenance costs as well as adequate damage tolerance.Several damage sizes based on detectability levels are described,and requirements for each damage size relative to FAA and JAA regulations are dis- cussed.Suggestions are made for developing appropriate databases to satisfy regulatory damage toler- ance requirements and achieve low maintenance costs. Several methods for improving the performance of impacted composite panels and components have been proposed(References 7.2.2.3(f)and (g)).One approach is to increase the inherent toughness of the composite by using tougher resin matrices;this is only appropriate for medium to thick gage laminates as increased toughness has little benefit for thin laminates or sandwich facesheets.Although this method improves damage resistance and reduces maintenance costs,increased material costs,reductions in ma- trix stiffness at elevated temperatures,and potential reductions in large notch residual strengths must be considered in the final selection. In metallic structures,damage tolerance has been demonstrated using fracture mechanics to charac- terize crack growth under cyclic loading,predict the rate of crack growth in the structure under anticipated service loads,and establish inspection intervals based on realistic damage detection reliability considera- tions(Reference 7.2.2.3(h)).Since typical CFRP composites have relatively flat S-N curves,and because these damages do not propagate under aircraft wing/empennage operational loading spectra,the above method normally cannot be used to establish inspection plans.Instead,a no-growth approach has been used to demonstrate compliance with damage tolerance requirements for composite primary structures on commercial aircraft for current composite structures. The types and sizes of damages that are barely detectable or larger are classified into several groups based on the likelihood of damage detection,as shown in Figure 7.2.2.3(a).The selection of damage sizes must be consistent with the established inspection program and with the corresponding reduction in static strength.The following paragraphs describe the different damage types and sizes: 7-15
MIL-HDBK-17-3F Volume 3, Chapter 7 - Damage Resistance, Durability, and Damage Tolerance 7-15 that economical maintenance practices can be safely implemented (e.g., detailed damage inspections and repair at scheduled maintenance intervals). 7.2.2.3 Deterministic compliance method (civil aviation example) This section describes an analysis and testing methodology to support certification and maintenance of composite structures based on: (a) establishing residual-strength-versus-damage-size relationships; (b) establishing methods of damage detection and minimum detectable damage sizes; and (c) determining damage sizes that reduce capability to both to Ultimate Load and Limit Load. Flow charts outlining an approach for achieving damage tolerant and fail-safe designs are presented. Several composite primary structures, such as the Boeing 777 empennage and NASA-ACEE/Boeing 737 horizontal stabilizers, have been certified per FAR 25 and JAR 25. The 737 stabilizers have demonstrated excellent service performance (Reference 7.2.2.3(a)). This service experience, as well as component testing (References 7.2.2.3(b) through 7.2.2.3(e)), has shown that current composite primary aircraft structure has excellent resistance to environmental deterioration and fatigue damage. This leaves accidental damage as the primary consideration for damage tolerance design and maintenance planning for the relatively thicker-gage composites associated with primary structure. In-service damage resistance and repair of thin gage composite structure has become a major issue for the commercial airlines. In order to make composites cost effective for the airlines, allowable damage limits (ADLs) must be as large as possible while still meeting regulatory Ultimate Load requirements. To achieve this goal, test data and analytical methods encompassing the complete range of potential damage sizes and types are required. This discussion presents a design approach to ensure that composite structures have low in-service maintenance costs as well as adequate damage tolerance. Several damage sizes based on detectability levels are described, and requirements for each damage size relative to FAA and JAA regulations are discussed. Suggestions are made for developing appropriate databases to satisfy regulatory damage tolerance requirements and achieve low maintenance costs. Several methods for improving the performance of impacted composite panels and components have been proposed (References 7.2.2.3(f) and (g)). One approach is to increase the inherent toughness of the composite by using tougher resin matrices; this is only appropriate for medium to thick gage laminates as increased toughness has little benefit for thin laminates or sandwich facesheets. Although this method improves damage resistance and reduces maintenance costs, increased material costs, reductions in matrix stiffness at elevated temperatures, and potential reductions in large notch residual strengths must be considered in the final selection. In metallic structures, damage tolerance has been demonstrated using fracture mechanics to characterize crack growth under cyclic loading, predict the rate of crack growth in the structure under anticipated service loads, and establish inspection intervals based on realistic damage detection reliability considerations (Reference 7.2.2.3(h)). Since typical CFRP composites have relatively flat S-N curves, and because these damages do not propagate under aircraft wing/empennage operational loading spectra, the above method normally cannot be used to establish inspection plans. Instead, a no-growth approach has been used to demonstrate compliance with damage tolerance requirements for composite primary structures on commercial aircraft for current composite structures. The types and sizes of damages that are barely detectable or larger are classified into several groups based on the likelihood of damage detection, as shown in Figure 7.2.2.3(a). The selection of damage sizes must be consistent with the established inspection program and with the corresponding reduction in static strength. The following paragraphs describe the different damage types and sizes: