User login


You are here

Certification for Damage Tolerance

Mike Ciavarella's picture

I wonder if anyone in Imechanica follows or deals with Damage Tolerance of Aircraft Structures.  Not having to deal with everyday certification nor having direct experience, I know only what is reported in academic books, but I am confused about what is the standard in industry and certification, assuming there is one!




Safe-Life design

This means that the entire airframe is designed to achieve a satisfactory fatigue life with no significant damage, i.e. cracking.


Fail-Safe design

The structure is designed first—as before—to achieve a satisfactory life with no significant damage. However, the structure is also designed to be inspectable in service and able to sustain significant and easily detectable damage (obvious damage) before safety is compromised.


Damage Tolerance design

This approach differs from the original Fail-Safe design principles in two major respects:

      (1)  The possibility of cracks or flaws in a new structure must be considered.

            (2)        Fatigue cracks must be detected before the safety is compromised, but unlike Fail- Safety there is no premise that cracking will become obvious before it reduces the  residual strength below the required safety level.

Short crack growth

An importantissue for the Damage Tolerance approach is that the prediction of early (short) crack growth only using LEFM analytical models is problematical. A hybrid approach using LEFM and empirical modelling can be used where justified by Quantitative Fractography (QF) data obtained from service, Full-Scale Fatigue Tests (FSFT) and component and coupon tests.


Widespread fatigue Damage (WFD)

WFD is a major issue because it can rapidly decrease the residual strength, with a loss of Fail-Safe capability both in terms of residual strength and adequate time for inspection. Avoidance of WFD requires identifying susceptible areas, based on tests and service experience; fatigue analyses linking safety and durability; assessment of inspection possibilities; and terminating actions (repair, replacement, or retirement). However, it is noteworthy that more consideration is being given to the terminating actions of replacement or retirement instead of ensuring safety by (frequent) repetitive inspections and necessary repairs, and also repairs of repairs. This leads to the Limit Of Validity (LOV) concept.  


Limit Of Validity (LOV)

In 2011 the FAA introduced the concept Of Limit of Validity (LOV) for transport aircraft over 75,000 lb (34,000 kg). The LOV concept requires full-scale fatigue testing to determine the onset of WFD, and as such effectively sets a Safe-Life equivalent for these aircraft.



So an attempt of a few conclusions, so far for metallic structures:


1) Certification is done on Full Scale Fatigue Testing (FSFT) with components which does NOT include prescribed damage in the form of quite large cracks. Sometimes, residual strength testing is done. 


2) Certification is then based on FSFT on "Load Enhancement Factors" or "Life Enhancement Factors" which are obtained from large database of fatigue tests, which however do not include large or artificial cracks


3) Damage Tolerance is required at design stage (and in this sense also Certified) but not directly tested.  Scatter for long cracks like these is limited, and correspond to the kind of Virkler data scatter with long cracks, probably a Weibull shape parameters of the order of 12 or so (almost deterministic scatter), whereas databases report for metals under spectrum loading alfa weibull of 6-12 max.


4) Residual strength tests can be and are done on the FSFT articles after fatigue testing, but not necessarily. There may (will) be artificial damage introduced after the fatigue test to ensure e.g. a 2-bay crack in a stiffened structure.  So indeed one may regard these as two types of tests to demonstrate/meet DT (or ASIP) requirements.


5) Companies therefore do deterministic DT analyses with (perhaps) application of scatter factors based on ‘engineering experience’.


In a sense, I see some inconsistencies between the 2 types of approches -- which probably makes things safer, but confused. 


A) DT is introduced so that possibly large manufacturing defects which escape from pre-service testing or that initiate during life, lead to dramatic consequences before the next inspection interval.   However, this is not really "tested"


B) FSFT is introduced to certify that there is some level of statistical safety --- so one increases Load or Life (Load Enhancement Factor, Life Enhancement Factor) with a single test, to meet the requirement of 10^-x failures that one would obtained from 10^x tests which are clearly impractical.   However, in a single test there is unlikely a big manufacturing defect.


I guess by ensuring both approaches (A, B), one is safe.  But they remain inconsistent.  To complicate the matter, there is this "Lead Crack Methodology", which is perhaps more consistent?


In composites, to obtain the same statistical significance that I am mentioning for metals, given the Weibull shape factors are much lower, Life Enhancement Factor would be too high, and a Load Enhancement Factor instead is used, with a number of details, truncations of low levels, truncation for too large levels etc.  


The Paris power law concept is useful in composites, and in the development of the LEF acceleration factor and for assessing the reduction of stress for damage repairs. Its use in damage repairs has been common in metallic structures since the 1980's. The Paris Law power = 2 is not generally correct of course, and it was perhaps a mistake to mix it with the "Lead Crack methodology" --- which probably could survive without it, it is material and failure mode dependent coefficient. It is also sensitive to Load Ratios that contribute to the "retardation" of crack growth complicating the design of the full scale structural demonstration. 

The FSFT test is not only to demonstrate acceptable or nearly no-growth behavior but also has a  discovery function to find local conditions that could limit structural capability. Be careful with the "Lead Crack" concept - it is useful to validate crack growth simulations in a metal component but is not an alternative to Damage Tolerance methodology.



Perhaps some clarification comes from the historical discussion of the metallic versus composite damage tolerance practice from John Halpin, at


See an extract here.


What should be the duration for the FSFT?

– Design Service Goal (DSG) x Scatter Factor (SF)

– What should be the Scatter Factor?

• “Safe Life” reliability Scatter Factor (99%prob/95conf)

• Inspection based Scatter Factor

• What is the inspection reliability%

– 90%prob/95% confidence of detection (practical implementation)

• Damage Tolerance SF = 2 (with reoccurring in-service inspection at 1⁄2 of the residual life)



A required period of unrepaired service usage was selected as two service lifetimes demonstrated with a FSFT. The Scatter Factor of two was selected to cover various uncertainties associated with damage &/or crack growth during service usage, variability in material properties, manufacturing quality and inspection reliability.

Reoccurring in-service inspections at increments of 1⁄2 demonstrated & expected life would accommodate variations in inspection reliability.


Simplistic BUT it works.


Composites (1980s), What Should be Done?

• Initial concept was a modified Safe Life concept with a SF reliability of 90%prob/95%conf (the Wear-out model)

– Resistance in Composite community and Industry to Damage Tolerance

– Composite sensitivities differ from metallics

• Notch sensitivity recognized as manageable

• Carbon fiber fatigue resistant

– Sendecky (1981) removes power law from 1973 Wearout model

– NavAir prefers “safe Life” minimize aircraft carrier workload

• Whithead et al 1986 -1997

• Accelerated FSFT using Load enhancement, LEF

– Composite Scatter factor (Interlaminar fatigue sensitivity)

• A level reliability, (SF)A ≅ 42

• B level reliability, (SF)B ≅ 5

– A310/300 composite vertical tail [1984]

• Safe-life, Minimum MFG quality (Category 1)

• Damage Tolerance demo.

• One Lifetime with Load Enhancement Factor validate ” No-Growth”

• (SF)B ≅ 5, for 1 FSFT LEF ≅ 1.15

• Inspection strategy?

– Accidental damage



Entered 2000’s with 3 Approaches


• Single load path protecting against structural failure using the damage tolerance (DT) concept of slow crack growth or “nearly-no-growth” and DT-based inspections;

– FSFT with SF ≅ 2

– Typical (average) fleet usage

• Single load path protecting against structural failure using a reliability based “safe-life” “nearly-no-growth” damage tolerance;

– FSFT with SF ≅ B-level reliability

– Load enhancement to accelerate test

– Average to Aggressive (USNav) usage

• Fail-safe design combined with slow crack growth or “nearly-no-growth” damage tolerance analysis and inspection concept;

– FSFT with SF ≅ 2

– Typical (average) fleet usage

• Common inspection (damage detection) B-level reliability



Tentative general conclusion:  If in metals the situation is not clear, in composites, the coulds are dominating!

The folks that work composites in real applications don’t have all the answers to the scientific complexities that currently exist but they adopt design criteria and engineering solutions that time has proven to work.  If we had more precise requirements (e.g., prescribed damage states that represent a range of all that is possible from likely to extreme) and years of knowledge that only time can bring, we could remove some conservatism but that isn’t the current case.  As a result, composite damage tolerance currently takes some maintenance advantage (e.g., relatively large allowable damage limits and visual detection methods for no-growth design criteria) of current structural performance, while still achieving significant weight savings.  Any further advantage would be met with maintenance and certification cost penalties owed to the additional rigor needed. 


The confusion comes, partly I think, from lumping together metallic and composite design methods. They are two separate animals. FSFT is part of DT. For metals we talk about fatigue cracks, their nucleation, and growth. But for composites we have to consider inherent discontinuities such as disbonds, delaminations and BVID, and the growth of these discontinuities during FSFT and service. Inspections are different in nature from those for metallic structures, and different parameters are measured, notably the loss of stiffness owing to the growth of discontinuities, and the detection of delamination growth. For composites, things are very much under development.


But the personal opinion I have formed is the following:-


1) full scale certification is conducted sometimes with artificial defects, sometimes not.  One can do one, or the other.... It is unclear how to make this choice.



2) the scatter factors assumed in databases are confused between the two cases, while obviously scatter should be extremely different in the two cases:   for metals, I estimate Weibull modulus respectively 12, or 6.   For composites, I don't have exact numbers for "cracked" composites, but surely Weibull must be much larger than the 1.25 assumed in Navy databases which mix everything.



3) Now while the question is not too important for metals, as life factor even with low Weibull is anyway just 2 ---- we could reduce it to 1.5 at most?, certainly it is not so intelligent for composites, where the LF is in principle 13 or 14, which is exagerated for cracked components.  This should and I would indeed reduce it.   If people anyway use LEF instead of LF, still I would reduce the 1.25 or whatever corresponds to LF of 13.


Or if we want to have a more positive approach, we could also say the following:


In principle, there are two parts in a FSFT: First, a crack free life demonstration (also called a durability test) and then a damage tolerance demonstration with inflicted severe damages. This is whatever the material, metal or composites.

For metals, this two-phase FSFT remains in use with very good reasons.

For composite structures, the first phase is more and more cancelled, due to their demonstrated very well behavior in fatigue and, then, the FSFT focusses on the DT phase only. Nevertheless, when the first phase was performed in the past, the usual practice was to start with a structure provided with maximum tolerable defects as BVID`s for instance.

This only applies to fixed wing structures (CS-25) and helicopter fuselages. For rotating parts, the philosophy is different.








Whitehead RS, Kan HP, Cordero R and Saether ES. Certification Testing Methodology for Composite Structures, Vol I and II. Naval Air Development Centre Report No. 87042-60 (DOT/FAA/CT-86-39), 1986. 

Molent, L., Barter, S. A., & Wanhill, R. J. H. (2011). The lead crack fatigue lifing framework. International Journal of Fatigue, 33(3), 323-331.

historical discussion of the metallic versus composite damage tolerance practice. You can download it at

FAA Advisory Circular AC 20-107B (attached)

PDF icon AC 20-107B w-ch 1.pdf563.51 KB
Mike Ciavarella's picture

Follows a discussion with an industry expert on my questions.  I repeat them for general interest


1) Certification is done on full scala testing with components which include prescribed damage in the form of quite large cracks --- correct? 


Damage tolerance testing for composites, includes large-scale testing and a range of damage sizes from smaller (allowable damage sizes) to very large penetrations (note I’m avoiding the word “cracks” for the range of damage scenarios considered for composites).  Please note that most these damages are not “prescribed”.  The allowable damage sizes (e.g., barely detectable damage, per the selected inspection method) are essentially a fatigue resistance demonstration, followed by Ultimate loads to show “no growth”.  This helps justify the damage being in the structure for a lifetime of loading without loss of the full design capability (including load factors of safety).  Fatigue demonstrations for “damage tolerance” are performed with typically “easily detectable” damage (which, depending on your definition of “quite large cracks”, are consistent with the thoughts you shared) and serve as a basis for substantiating the inspection repeat intervals and damage detection/inspection procedures.  Large penetrating damage, which may rarely occur and are still part of damage tolerance, are considered obvious or discrete source (e.g., rotor burst) and are not subjected to the fatigue demonstrations (i.e., residual strength considerations only).




2) Certification is then based on "Load Enhancement Factors" or "Life Enhancement Factors" which are obtained from large database of fatigue tests, which however do NOT include cracks, correct? 


Historically, LEF used for fatigue and damage tolerance testing have been derived using different specimen types, some with damage and others without.  As you note in your subsequent thoughts shared for questions 3 and 4, use of LEF from specimens without damage (or even realistic design details) are quite conservative because they are attempting to correct for fatigue data scatter coming from many sources and damage localization scenarios.  Since composites are notch sensitive and most structures have design details that include holes for mechanically assembling parts into a structure or allowing attachments or maintenance access (or other stress concentrations), residual strength and fatigue scatter will typically be reduced based on design details that affect damage localization.  When considering the smaller damages used in fatigue demonstrations for allowable or non-detectable damage, the LEF will typically also have less scatter than is observed for pristine specimens (loaded without design details or damage).  Finally, the larger damages used for “damage tolerance” testing have even less scatter (again as you imply in your questions 3) and 4).




3) if 2) is wrong, then scatter would be extremely limited, and correspond to the kind of Virkler data scatter with long cracks, which correspond to Weibull shape parameters very large, of the order of 12 or so, whereas databases report for metals under spectrum loading alfa weibull of 6-12 max. 


Your thoughts on limited scatter with larger “cracks” or damage are correct but many composite large-scale fatigue demonstrations have used LEF derived from databases without design details or damage, making them quite conservative.  If they maintain the same LEF for structures with larger damages, characteristic of composite “damage tolerance” testing, than the conservatism is further emphasized.




4) if 2) is correct, then scatter in real components with long cracks should be very small, and we can use much reduced LEFs, so we should suggests a change in certifications? 


This question is assuming that certification for composite damage tolerance testing is not allowing a more structured approach with less conservatism LEF.  This is not true in that regulatory authorities are not forcing their applicants to derive LEF factors without design details or damage present in the specimens.  I think that you would appreciate the challenges of size scaling for composites and the realization that it may be better to accept some conservatism to avoid having to scale the structural coupons or elements used for basic fatigue data generation.  Another factor that comes into play is deriving a “LEF” that is suitable for an entire structure, which is assembled with many stress concentrations (from design details, allowable damages or manufacturing defects and the damage fatigued in damage tolerance testing), is that it would be very difficult to define a single value that would be acceptable for everything (including a multitude of different failure modes) it is trying to cover, without accepting some conservatism.


Mike Ciavarella's picture

It seems I must read all the documents about Damage Tolerance again, see another answer to my questions:



1) Certification is done on full scala testing with components which include prescribed damage in the form of quite large cracks --- correct?


2) Certification is then based on "Load Enhancement Factors" or "Life Enhancement Factors" which are obtained from large database of fatigue tests, which however do NOT include cracks, correct? 


3) if 2) is wrong, then scatter would be extremely limited, and correspond to the kind of Virkler data scatter with long cracks, which correspond to Weibull shape parameters very large, of the order of 12 or so, whereas databases report for metals under spectrum loading alfa weibull of 6-12 max.


4) if 2) is correct, then scatter in real components with long cracks should be very small, and we can use much reduced LEFs, so we should suggests a change in certifications?


Please what do you think?


1) Correct. Damage must be large enough to be detectable at scheduled inspections (every few years) but not immediately detectable (I mean obvious).

2) correct for composites, but not for metals where the usual factor of 2 on life is in line with a alpha weibull in the range of 4-5.

3) Regarding composites, the damage tolerance evaluation consists in the demonstration of the no-growth of severe accidental damages only detectable at schedules inspections (cf 1) ). Severe Load/Life enhancement factors developed in the mid eighties (e.g. 1.15 on loads combined with 1.5 on life) have been successfully used so far, without complain, since such a demonstration was in general very easy to achieve. The problem came when it was anticipated to perform the DT demonstration on hybrid structures (metal/composites) with a unique fatigue spectrum covering both. in this case, the composite tailored fatigue spectrum was too severe for metals. For this purpose, and in te frame of the A350 certification, Airbus has challenged the old coefficient proposing new ones that have been accepted by EASA. It is correct to think that those new factors should be based on the scatter of delamination growth for composites.


mohammedlamine's picture

Dear Ciavarella,

Fatigue methods correspond to dynamic applied loads. SF=2 is a great value which can be reduced due to the following assumptions. The damage has to be quantified by several methods. Stochastic method can be one of the existing methods. If one can compute the dynamic applied stresses (s) and knows the material strength (S) it is convenient and efficient in probability theory to work with the limits such that the reliability (survival probability) is  P(SF≥1)  where SF=safety factor defined with SF=(S/s) or  the same probability with  P(m≥0)  where  m=security margin  defined with  m=(S-s). 

Mike Ciavarella's picture

Thanks for your comment.  SF = 2 is not too big, if you consider in composites they would need to take SF=LF=13 (from Weibull modulus = 1.25). 

However, in principle, SF=2 is corresponds to alfa weibull = 4 or 5 which is still lower than I would expect from typical aluminum specimen with long crack (see the classical Virkler tests which I have recently reconsidered, and soon I'll share a paper on this).  They show alfa = 12 or so, so I agree SF could be reduced.   

But there are other issues.  Convincing EASA and FAA would not be easy.



The focus of the Damage Tolerance concepts is an inspection focus, a certification of tolerance to Barely Visible Damage, BVD, and other size damages, to be established by the OEM and a demonstration of Residual Strength capability, Flutter, ect. and a nearly no-damage-growth in a defined usage environment for a minimum of 2 Design Service Lives. Demonstrate the Safety margins on the last flight for the Design Life Goal. The Full Scale Fatigue Test verifies the nearly no-damage-growth objective and the Fail Safe damage demonstration is in the next test increment. The "Service Life" can be extended by continuing the test duration. Operators are authorized to fly for 1/2 of the demonstrated test life. The factor of 2 is explained in the briefing as assuring multiple inspections to assure a very high probability of damage detection (typically 3 or 4 chances to see the damage) in the operational word. The Full Scale Fatigue test supplements the Full Scale Static Strength test demonstration that includes the Ultimate Strength capability of BVD and some Fail Safety demonstrations. 


The implanted damage sites are determined by the OEM's and industries service experience not by an arbitrary regulatory criterion. The policy is "you must demonstrate safety with damage states that you cannot inspect for and repair".


In metallic aiging a/c issue is that damage sites, typically intergranular voids develop,combine into microcracks  and then into the dominate fracture mechanisms size cracking. The concern is the generalized cracking micro and macro will eventually compromise the Fail Safe design provisions. This is a topic that the composite community is also working. 

Hope this helps.


mohammedlamine's picture


To obtain a SF=2 you need to reduce the effect of the operating stresses by 0.5*s. I understand that one isn't trustful in general composites formula used during the computations because there are several assumptions but measured ones under cyclic (periodic and linear) loads can be good values. For unidirectional composites the stresses formulations in static analyses are significant and better.


Subscribe to Comments for "Certification for Damage Tolerance"

Recent comments

More comments


Subscribe to Syndicate