46th AIAA/ASME/ASCE/AHS/ASC Structures, Structural Dynamics & Materials Conference AIAA 2005-2162

18 - 21 April 2005, Austin, Texas

Validation and Certification of Aircraft Structures

Michael Mohaghegh, Ph.D., S.E. *

Engineering Technology Development
Boeing Commercial Airplanes

Nomenclature
BVID Barely Visible Impact Damage JAR Joint Aviation Requirements
CAA Civil Aviation Authority LCPT Life Cycle Product Team
CATIA Computer-Aided Three-Dimensional LOV Limit of Validity
Interactive Application
CDR Critical Design Review M&PT Material and Process Technology
CFD Computational Fluid Dynamic NASA National Aeronautics and Space Adminis tration
CFRP Carbon Fiber Reinforced Plastic NDI Nondestructive Inspection
CIPR Critical Integrated Product Review ODA Organization Designation Authorization
DPA Digital Preassembly PDR Preliminary Design Review
DSO Design Service Objective PIN Part Identification Number
DTR Damage Tolerance Rating PIPR Preliminary Integrated Product Review
DUL Design Ultimate Loads PRR Production Revision Record
EDI Electronic Deflection Indicator PSE Principal Structural Element
FAA Federal Aviation Administration SCN Strength Check Notes
FAR Federal Aviation Regulation SIPD Structural Inspection Planning Data
FEA Finite Element Analysis TDPA Transparent Digital Preassembly
FEM Finite Element Method TIA Type Inspection Authorization
FRF Fatigue Reliability Factor VID Visible Impact Damage
JAA Joint Aviation Authorities WFD Widespread Fatigue Damage

I. Introduction
Validation of aircraft structures is critical to the design process in that it provides assurance that the structure will
perform as intended in all respects: form, fit, function, producibility, durability, and, above all, safety and reliability.
Structures design and analysis is substantiated by extensive testing. Although the validation process is essential for
certification to regulatory requirements, in total it is much more far reaching. It is the process by which we gain
confidence that the structure will deliver all the reliable performance our customers expect and demand.
The materials and design features of any new or derivative airframe structure will generally be a mixture of
existing proven elements and new features being used for the first time. In each case, it is essential to validate that
the structure will perform as intended as early as possible in the design process, preferably before the design has
been committed to production and while any necessary changes can be made without major impact to the program.
When existing materials and design concepts are extended to a new or derivative design, the validation process
should be relatively straightforward. The primary effort will be to ensure that the available database justifies the
proposed design. One must vigorously examine subtle changes from established materials and concepts that could
affect performance and require unique substantiation.
For new materials and design features, the available database may well be limited or nonexistent. In this case,
the need for validation is more imperative and is more difficult to achieve. Therefore, selection of new

*
AIAA Associate Fellow, Boeing Technical Fellow

1
American Institute of Aeronautics and Astronautics

Copyright © 2005 by the American Institute of Aeronautics and Astronautics, Inc.

The U.S. Government has a royalty-free license to exercise all rights under the copyright claimed herein for Governmental purposes.
All other rights are reserved by the copyright owner.
materials/concepts should always be made early enough in the airplane program to permit a reasonable level of
validation through preliminary analysis and testing prior to commitment. Some risk will always remain until full-
scale test and service experience has fully validated the new concepts. Consequently, wherever possible, such
designs should be amenable to relatively simple corrective modification if the need arises.

II. The Building-Block Approach

The validation and certification approach is primarily analytical, supported by test evidence at the coupon,
element, subcomponent, and component levels and full-scale limit or ultimate load test at ambient environment as
shown in Figure 1. The environmental effects on the structure are characterized at the coupon, element, and
subcomponent levels and are accounted for in the structural analysis. Supporting evidence includes testing through
the traditional building-block approach that obtains material characterization, allowable and analysis methods
development, design concept verification, and final proof of structure. The effects of temperature and moisture are
accounted for in design values and strength properties. Thermal and moisture strains may be calculated using finite
element model for each critical condition. Structural testing is described in sections V – VIII.

Figure 1. Building-block approach

III. Design Criteria

It is important to understand all the design requirements and how they are each validated. The principal
structural design requirements consist of ten core elements shown in Figure 2. This figure also acts as a roadmap to
the next level of detail in the structures design requirements and criteria. It can be used as a checklist by the designer
to make sure that all requirements for a given design have been met. Each design requirement is typically verified
by analysis and further validated by test using the building block approach.

2
American Institute of Aeronautics and Astronautics
 Discrete events Design loads A. Design Loads
Materials/ Boeing design loads requirements are derived from both
Maintainability fasteners internal criteria and from the regulatory agency standards. Early
design requirements were more straightforward than today. They
Structures had their roots in a philosophy that mandated criteria that had
Static
strength historically been shown to provide a level of passenger safety.
Producibility Design
Criteria These requirements were continually augmented by additional
criteria that were found to be necessary due to accidents, incidents,
Crashworthiness Stiffness or new features on the airplanes. Today’s trend is toward an
increasing reliance on a more probabilistic approach, where fleet
Damage tolerance/ Durability statistics are utilized to derive criteria that will produce expected
Fail safety/Safe life load levels, such as limit load, the maximum load expected in
Figure 2. Principal structural design service. An example of this is evident in the recent development of
requirements new gust regulations, where new gust intensities have been
derived from thousands of hours of in-service airline data.
Improvements in methodologies for loads predictions have evolved simultaneously with the increases in
knowledge and computing capabilities. From simple beam models using strip theory for an aeroelastic solution, to
highly complex, total airplane finite element models and Computational Fluid Dynamics (CFD) applications,
increased computer power has allowed for dramatic advances in how loads are calculated (see Fig. 3). The
improvements in the accuracy of the tools, the ability to solve more complex problems, and a better understanding
of the important parameters have allowed for optimized structural solutions for performance, while maintaining or
improving stringent safety levels. Aerodynamics, mass properties, and structural representations have all been
improved. Input data such as aerodynamics, which used to be taken strictly from wind tunnel testing, have been
augmented by running CFD models , allowing for greater accuracy in the final results. The tools and methods have
been validated using data collected during flight testing on the new airplane programs. These new methods, which
allow for better, more accurate loads analysis, are also being used to develop advanced airfoil designs to further
benefit aircraft performance. The increase in requirements and the complexity of the analysis have caused a large
increase in work required and computing power and have fed downstream customers with increased numbers and
variety of load conditions they have to consider in structural design. The number of design conditions has escalated
from less than 100 on early Boeing models to numbers in the thousands on more recent projects.

(a) FEM Model (b) Beam Model

Figure 3. External loads model

B. Internal Loads and Stresses

In today’s structural design environment, major, highly complex components and mechanisms can be more
accurately modeled in order to determine detailed stresses for ultimate, fatigue or damage tolerance requirements,
often eliminating what previously had to be done by expensive structural tests . Furthermore, much of the pre- and
post-processing of the analytical models has become increasingly automated and in the future will be tied more
closely to the design tools than today (see Fig. 4).

3
American Institute of Aeronautics and Astronautics
 Over time, computing capacity has increased, finite
element tools have been enhanced, structural
idealizations have improved, and increasing acreage of
the airplane structure has been covered. These trends
have allowed Boeing not only to optimize structure for
improved performance and safety, but also to eliminate
some expensive testing.
Credibility in using the FEM for major structural
analysis was developed by validating analysis results
with test data such as shown in Figure 5.

C. Stiffness/Flutter
• Half model shown
Flutter characteristics of airplanes are validated
• Total airplane model
during the design phase by wind tunnel testing. Ground • 35 meshes (substructures)
vibration tests and flight tests are conducted to validate • 60,000 nodes
the structural stiffness, as described by mode shapes and • 150,000 elements
frequencies and demonstrate that the airplane is free • 225,000 degrees of freedom
from flutter within the design speed envelope. Figure 4. FEM model for internal loads/stresses
Flight tests up to the airplane dive speed are
60
conducted to validate that the airplane is free of
Predicted stress
flutter. 50 Crown stringer stress distribution
Actual test sress

40
D. Static Strength
Validation testing is conducted where 30
Stress, ksi

sufficient confidence does not exist for the

20
analysis or if specific validation testing is
(2.50 maneuver w/ 9.1 psl body pressure)
required for certification (FAR 25.307). One 10
requirement is to validate that the airplane test
0
that airplane remains elastic up to the design limit
loads. Static failure of metallic airplane -10
structures has been predicted by an increasingly (-1.00 maneuver w/ 9.1 psl body pressure)
-20
high level of accuracy (see Figure 12).
-30
400 600 800 1000 1200 1400 1600 1800 2000 2200 2400
E. Durability/ Fatigue Performance
Body station
Extensive fatigue testing including a
minimum of two lifetime testing is conducted to Figure 5. Crown stringer stress distribution
validate airplane fatigue performance in service.
Historically, fatigue testing has been conducted to find any problem areas and correct the design to minimize fatigue
problems experienced by the customer. There is a new FAA requirement to run full-scale fatigue tests to
demonstrate that Widespread Fatigue Damage (WFD) does not occur during the airplane design service objective
(see Table 1). Full-scale fatigue tests to multiple anticipated service lifetimes may either pinpoint the anticipated
onset of WFD, or, if none occurs on test, a conservative threshold can be reasonably predicted. Likewise, special
intense in-service inspections of high time airplanes can be conducted as well as tear down inspections of high time
out-of-service airplanes. Ultimately, however, it may be that safety can only be guaranteed by structural
modifications or even retirement from service. One of the new requirements is a concept called Limit of Validity
(LOV). The LOV is a point in the structural life of an airplane where there are significantly increased uncertainties
in structural performance and increased probability of development of WFD. Additional fatigue test evidence and
validation of the maintenance program for effectiveness against WFD is required to extend an established LOV.

F. Damage Tolerance
The evolution of FAR 25.571 (see Table 1) shows how design requirements for fail safety and damage tolerance
emerged as a result of the service experience described in Reference 2. These additional requirements profoundly
influence airframe design today. Damage tolerance testing is conducted with various size specimens including built-
up panels and full-scale fuselage sections. There is a Boeing requirement that airplane structures must have limit
load capability with large damage. This is a critical design requirement, and sizeable tests to validate this residual
strength are often run early in the airplane design phase.

4
American Institute of Aeronautics and Astronautics
 Table 1. FAR 25.571 Amendments related to fail safety and damage tolerance
Amendment
Title Summary of Changes to FAR 25.571
Level & Date
25-0 (12/24/64) Fatigue evaluation of (c) Fail safe strength.
flight structure. “It must be shown by analysis, tests, or both, that catastrophic failure
or excessive deformation, that could adversely affect the flight
characteristics of the airplane, are not probable after fatigue or
obvious partial failure of a single PSE.
25-45 Damage-tolerance and (b) Damage-tolerance (fail-safe) evaluation.
(12/1/78) fatigue evaluation of “The evaluation must include a determination of the probable
structure. locations and modes of damage due to fatigue, corrosion, or
accidental damage. The residual strength evaluation must show that
the remaining structure is able to withstand loads corresponding to ...”
25-96 Damage-tolerance and (b) Damage-tolerance evaluation, for WFD
(4/30/98) fatigue evaluation of Initial flaw of maximum probable size from manufacturing defect or
structure. service induced damage used to set inspection thresholds; sufficient
full scale fatigue test evidence must demonstrate that WFD will not
occur within DSO (no airplane may be operated beyond cycles equal
to ½ the cycles on fatigue test article until testing is completed).

G. Composite Structures
FAA issued AC 20-107A, Composite
Aircraft Structure, in 1984. The certification
of composite primary structures has followed
the guidelines contained in AC 20-107A. For
damage tolerance, composite structure
certification has been based on demonstrating
the “no-growth” of damage of sizes up to the
damage limit. Environmental degradation
caused by temperature, humidity, and so on
must be considered. The residual strength
versus damage size criteria is shown in
Figure 6. The airplane is designed to maintain
ultimate strength with barely visible impact
damage, limit strength with visible impact
damage, and 70% of limit strength with large
accidental damage. Figure 6. Residual strength versus damage size or notch length

5
American Institute of Aeronautics and Astronautics
 IV. Design Validation
Design validation is the process of ensuring
that all of the design requirements are met. This
should happen continually from conceptual
design through drawing release. This section
discusses the methods used to validate that the
design requirements have been met by applying
the appropriate processes and tools. Figure 7
shows some of the methods used for design
validation.
The designer has the responsibility for
design validation. There is no single method or
process to ensure design validation; it is a
combination of methods. This section will
elaborate on some of these. There is no optimal
cookbook method, but if this validation does
not happen concurrently in the process, there is
a high risk of either not meeting all the design
requirements or driving up costs.

H. Structural Integration
A design process that utilizes built-in Figure 7. Design Validation Methods
checks and balances will help ensure well integrated structure that meets all the design requirements. Here are a few
methods to validate the integration of the design:
Interface Agreements. Agreements need to be negotiated between groups for each part-to-part interface. There
are many different ways to document these agreements based on the program or team. The documented agreement
makes validation easier and more visible. Some interfaces are simply agreements between engineers with no official
documentation, and the validation happens within the digital mockup.
Digital Mockup. DPA (digital preassembly) in CATIA is the cornerstone of the current design process, allowing
the designer to create a digital mockup to integrate the design. With this mockup we can validate part-to-part
interferences using Fly Thrus, TDPA (transparent digital preassembly), fit check, 4D navigator, or any of the
functionality of CATIA. Part interference is only one area we need to validate. Part function includes gaps,
clearances, maintenance access, producibility, tooling, electrical grounding, and a host of other requirements that
need to be checked. Unfortunately, this validation is not automated like part interferences, so it must be analyzed
using the digital mockup.
Physical Mockup. The digital mockup has some limitations for validating the design. To reduce the risk of these
limitations, sometimes a physical mockup is appropriate. These mockups could be in a variety of forms, such as a
foam core mockup built by the designer, a wood or metal mockup built by the mockup shop, or a mockup built by
stereolithography. Stereolithography is particularly well suited for small parts and assemblies. An example of the
mockup purpose is validation of assembly sequence, tool clearance, and ergonomics. A more indirect purpose
would be to get the product team/ mechanic buy-in to a design before it is committed; sometimes this is difficult to
do with only digital mockups.

I. Design Reviews
Design reviews help validate the design by allowing a diverse population to critique a design concept.
Requirements are identified and scrutinized with a free-form flow of potential solutions. During all reviews, some
engineering requirements are not negotiable and should not be compromised; it is the responsibility of engineering
to identify these to the team. Some of the reviews that take place are:
• Functional reviews
• PDRs (preliminary design review)
• CDRs (critical design review)
• LCPTs (Life cycle product team) reviews
• PIPR (preliminary integrated product review)
• CIPRs (critical integrated product review)

6
American Institute of Aeronautics and Astronautics
 Some reviews can be made by a few people around a CATIA terminal or drafting board. Structured meetings are
not always the best method for information exchange, but getting the right people to review the design is critical.
There is no right answer as to how many reviews are required; judgment on how much risk is involved by delaying
validation will dictate the frequency.

J. Reliabi lity Based Design and Validation

There is considerable effort
being applied to probabilistic
methods for structures similar to
those used for systems design (see
Figure 8). The incentive is to
better understand and quantify the
uncertainties in structural design
so that some worst-case
conservatism can be avoided
while designing to a desirable
safety level, especially with new
materials. The quantifiable risk or
safety level can be treated as a
measurement of structural
performance and used as a design
and maintenance metric to ensure
consistent safety throughout the
life cycle. The core of this
Figure 8. Probabilistic life cycle management
approach is the ability to
characterize the uncertainties needed in the design analyses. Availability of data needed for uncertainty
characterization so far has been the biggest challenge, especially for new materials and applications. However, it
has much to do with the lack of processes and requirement for such data in the past because of the current mostly
deterministic design approach. More research is still required in several areas to develop an adequate level of
maturity before its full implementation by the industry. One imminent example is how to support certification with
the probabilistic design approach. Although there have been some successes, more collaboration between
government agencies and manufacturers will be critical to the success of making this revolutionary change of design
and certification approach. If validated, this approach may lead to structures that are both lighter and safer at the
same time. The use of this approach is expanded to include effects like the environment on the allowables of
composite structures.

V. Structural Testing
The amount of validation testing on a new airplane depends on the amo unt of change that exists in the new
design. Testing can include ultimate strength, fatigue, crack growth, residual strength, material properties and
corrosion resistance, fastener shear and tension strength, and joint strength.
Testing begins with small coupons, then panel
tests, followed by component tests and then full-
scale airplane static and fatigue tests as shown in
Figure 9. If aerodynamic heating is involved, the
above tests usually are repeated at various
temperatures. To account for the effects of engine
or thrust reverser noise, sonic fatigue tests may be
necessary. If boundary layer noise or shock wave
effects are appreciable high, cabin noise
transmission tests may be conducted.
Windshield and passenger window strength tests
must typically be conducted, including bird strike
tests on a windshield, mounted in a representative
cab structure that has the correct sill and post
Figure 9. Levels of structural testing
stiffnesses.

7
American Institute of Aeronautics and Astronautics
 Full-scale static tests are required to demonstrate the validity of both internal loads and design allowables.
Fatigue full-scale tests are conducted to validate the fatigue performance of the structure and make any design
changes that might be needed if problems are discovered during the test. They also validate that the new design has
accounted for any forced deflections that occur at the wing/body joint, stabilizer/body joint, and fin/body joint.
The full-scale test is also needed to demonstrate that thermal strain compatibility has been accounted for when a
graphic epoxy component is fastened to an aluminum component, or any other combination of materials having
different modulus of elasticity and coefficient of thermal expansion.

K. Requirements for Testing

One of the most important reasons for testing is to evaluate structural behavior when reliable analysis methods
are not available or when the assumptions needed to make use of these methods are open to some question. In fact,
part 25 of the Federal Aviation Regulations, Airworthiness Standards, makes testing mandatory in such cases.
When new materials are being considered for use, testing of coupon samples must be undertaken to determine
such properties as Ftu , Fty , Fcy, and E. Depending upon the anticipated environment, such properties may have to
be obtained over a wide range of temperatures. Such testing is usually performed on relatively small but numerous
specimens of standard configurations. This type of testing is generally conducted under the direction of the
Allowables Group. Such testing is directed toward finding the actual properties of materials tested as a step toward
using the test results to calculate standard material properties.
Components are also tested to verify the applicability of analysis methods to new materials. For example, a
series of compression tests have been performed on skin-stiffener panels in 7075-T6, 7150-T6, 7150-T6, Ti 6A1-4V,
and Ti 8A I-Mo-IV to determine the applicability of the Johnson-Euler formula to aluminum and titanium structures.
Testing of a complete airplane to destruction is customarily done on all new models at Boeing. This is done to
establish growth potential and als o to substantiate the analysis methods employed.
Fatigue testing of a complete airplane has become more common and has become a requirement in recent years.
This type of "accelerated life" testing makes possible the discovery of potential trouble areas that would be
encountered in service. Thus, if alterations to structure become necessary, they can be made either in advance of the
airplane's entry into service or when an in-service airplane is scheduled for major inspection or maintenance.

L. Types of Testing
There are several valid reasons for performing the various types of tests to validate the design. The guidelines to
help in determining the requirement for new testing are based on the following reasons for testing. These are
divided into larger categories and summarized as follows:
1. Material Property/Allowables Development
• Testing of standard coupons to establish material properties and allowables is required whenever a new
material is introduced. This paper will include details on the testing required to establish static,
durability, and damage tolerance allowables.
• The basis of a static allowable provides the user the statistical basis of the values published. FAR 25
defines the type of structure for which an allowable is applicable by the basis of that value. The
required basis may also impact the number of tests required to obtain the value. Table 2 provides
descriptions of the three classifications.
Table 2. Design allowables descriptions
Basis Description Typical Use
A A value which 99% of the measured values will exceed Single loadpath structures
associated with a 95% confidence level.
B A value which 90% of the measured values will exceed Multiple loadpath
associated with a 95% confidence level. structures
S A value associated with specification acceptance values. No Initial designs, or when
statistical significance may be assumed. properties will be verified
on a part-by-part basis
2. Design Value Development
• Develops design values for a specific detail (e.g., crippling values for a particular stringer cross-section).
• Small specimen tests or sub-component tests are required to establish design values only if analytical
methods for predicting the design values are not available and design values are not available from

8
American Institute of Aeronautics and Astronautics
 testing of comparable designs on earlier airplane models. The use of analytical methods validated by
test data is preferred because the analytical methods can cover a range of configurations and sizing.
3. Development Testing
• Development tests are used to evaluate alternative new designs that offer substantial savings in cost or
weight, and for which there are substantial unknowns compared to previous designs that can be
quantified only by testing. Development testing typically involves small-scale test articles but may
include sub-component size articles or larger.
• Compares relative efficiencies of alternative designs.
• Obtains information concerning modes of failure, or secondary effects, and so on that can be used to
refine existing analysis methods or to develop new analysis methods, if required.
4. Analysis Verification
• Verification testing is required when design configurations requirements, or materials, are used that differ
significantly from those used to verify existing analysis methods. New tests, which generally involve
small specimen or sub-component test articles, should be designed to fill in the primary unknowns,
building on the previous knowledge base. Note that information obtained from verification tests,
including full-scale tests, can contribute to the analysis verification.
• Obtains information to ensure that the analysis methods used to predict failure modes, loads, deflections,
and so on are adequate and sufficient to cover the various designs and sizing ranges used on a particular
airplane model.
• Generally, only the most critical locations are selected for representation in sub-component or component
tests.
5. Qualification Testing (for reliability of processes, tools and techniques)
• Qualification tests are required when equipment, such as riveting, bolting, and so on, is new, undergoes
major maintenance, or exceeds previous limitations. This type of qualification testing is primarily
composed of small-scale test specimens.
• New equipment or new applications of equipment is typically qualification tested to ensure engineering
standards are met (e.g., Gemcor machine riveting).
6. Functional Tests
• These tests are used to validate the ability of the design to meet functional requirements. For example,
tests are conducted to validate requirements such as electrical bonding, corrosion resistance, impact
resistance, and sealing. Boeing Materials & Processes Technology conducts many of these tests for the
designer’s benefit, and the information is reflected in design guides and documents.
7. Producibility Tests
• These tests are used to validate the ability of the design to meet producibility requirements. For example,
test parts prove machine capability relating to a wide array of tolerance requirements, and
Manufacturing gains experience working with new alloys or processes. Producibility tests may also be
used in trade studies either for cost data or for make/buy decisions. The object is to obtain data prior to
committing the design, thereby validating the design as early in the design process as possible.

VI. Airplane Static Test

The full-scale static test program is typically part of the certification requirements of a new airplane model. A
structurally complete airplane is built solely for test purposes, which subject the structurally significant items to
design limit load levels. The static test program is used to show compliance with the following regulatory agency
requirements:
FAR 25.305 and JAR 25.305 Strength and Deformation
• Deformations do not interfere with safe operation at any load up to Design Limit Load.
• No detrimental permanent deformation at Design Limit Load.
FAR 25.307 and JAR 25.307 Proof of Structure
• Compliance for each critical load condition shown by analysis.
• Analytical prediction of internal loads/stresses validated by testing at up to Design Limit or Ultimate
Load.

9
American Institute of Aeronautics and Astronautics
 The number of individual test conditions, amount of structure tested to limit loads, test schedule, and sequence
must be presented to and concurred with by the regulatory agencies as part of the overall certification plan.
Additionally, several unit load conditions are applied to the airplane to verify analytical predictions and look for
potential highly stressed areas. To determine inherent wing growth capability for derivative models, the last test of
the program typically takes the wing to ultimate load levels and beyond, until failure occurs.
Static testing to limit load is mainly of value validating the methods used to determine external deflections and
internal load distributions (i.e., finite element analyses). Where the stress variation up to limit load is linear or well
understood, this validation can be accomplished at load levels less than limit.
Static testing to ultimate load validates the use of component panel testing to establish allowable stresses. When
the methods of establishing allowables from component panel testing are understood and proven by the prior static
test results, testing to ultimate load is normally of little value because the test is really only applicable at one location
under one specific design condition. The only value is if there has been some error made in design/analysis of the
structure, or taking advantage of any growth due to failure being significantly above DUL (i.e., > 5%). The latter is
unlikely to occur using current analysis methods and materials.

M. Past Models
A static test program has been completed on every major Pressure Case 1 – 13.0 psi
commercial jet airplane model, since the Boeing 707. The Positive maneuver Case 2/3 – 2.5g
Positive envelope
number of limit and discrete unit load applications is varied Negative maneuver Case 5 – (-1g)
for each model, depending on test load combination potential Lateral loads Case 6 – Max fin bending
and amount of data that is required. Figure 10 compares the Case 7 – Max fin torsion
Case 8 – Lateral gust
limit load tests performed for the Boeing 777 airplane. The
Section 48 Case 4 – Pitch initiation
777 major tests will be used as an example to provide detail Case 17 – Stall buffet
information on test methods. Ground loads Case 14A – 2 Pt braked roll
Case 14B – 2.4 g Taxi
Case 14C – Dynamic braking
N. Configuration Case 15 – Unit loads
The static test airplane is structurally complete with no Strut loads Case 13 – 10 Conditions/strut
payload or systems installations except for the brackets that (gust loads, thrust, etc.)
tie to the primary structure. The passenger floor installation Control surfaces
Case 12 – Inboard &
is complete, primarily for ease of access. All potential cargo outboard
floor load carrying members, such as roller trays and shear Case 10 – spoilers 4 and 6
decks, are installed. All wing control surfaces were installed Case 9, 12 – aileron, flaperon
on the left wing; the right wing consisted only of the Case 11 – slats #2, 5, and 7
Stabilizer Case S1 – Pitch initiation
wingbox and fixed leading edge. The horizontal stabilizer
(Separate test) Case S2 – Checkback
has typically been tested separately, as its three-point attach Case S3 – Stall buffet
system (hinge fittings and jackscrew) allows for a simplified Figure 10. Static test limit load condition
and more efficient separate test program. Separate static comparisons
testing was performed on the nose and main landing gears,
the horizontal stabilizer, Rolls -Royce strut, and inboard flap.
FAA conformity inspections for production hardware and test hardware installations that attach directly to the
airplane are required, because this is a certification test. These inspections must be defined early in the program in
order to be included into the airplane manufacturing plan.

O. Applied Loads
The 777 limit load static test program was composed of 14 major airplane load conditions, and two conditions
run on the separate horizontal stabilizer. Test loads were established to produce shears, moments, and torsions that
closely approximated the airplane design values. For certain test cases, several areas of the airplane were tested
beyond limit load to meet or exceed shear and bending moment envelopes and still provide a balanced airplane
condition. This allowed for a reduced number of test conditions. An ELFINI finite element analysis solution, using
methods identical to the 777 certification analysis models, was generated for each test condition utilizing the load
applied by test hardware fittings. This solution was used to generate stress, strain, load, and deflection predictions
for the instrumentation setup chosen for each particular test condition.

10
American Institute of Aeronautics and Astronautics
P. Schedule
Static testing should be scheduled to allow for test
documentation to be submitted prior to initial certification of
a model. The critical tests include positive and negative
maneuvers, lateral loads, proof pressure, and control surface,
strut and stabilizer loads. The tests also satisfied Type
Inspection Authorization (TIA) requirements. Issuance of
the TIA cleared the way for certification flights to begin.

Q. Wing Destruct Testing

Following the completion of limit load static proof tests,
the wing of the test airplane is typically tested beyond
ultimate load until failure occurs. This provides data to
determine potential wing growth for derivative models, as
well as determining any non-linear effects, and verifying
material allowable properties. For the 777, failure occurred
at 103% of design ultimate load in the upper panels at
approximately mid-span. Data from load actuators and strain
gauges was monitored continuously at 100 scans per second,
in order to pinpoint the exact loads and stresses at the
moment of failure. The failure location, mode (compression Figure 11. 777 Airplane static test
buckling), and stress levels were as analytically predicted
according to the wing finite element stress analysis,
component testing, and other analysis. This was confirmed by high-speed video of both wings, as well as a post-test
inspection and metallurgical analysis of the fracture area. The largest measured wing tip deflection was more than
24 feet (see Figure 11). In order to ensure a wing failure, forward and aft body moments were reduced to below
limit load levels by reacting a large portion of the wing loads near the center section. Some local stringer
reinforcements were added in the body center section to prevent potential body damage. All wing control surfaces
were removed prior to the test. Wing destruct test results for previous Boeing commercial airplanes are shown in
Figure 12.

Airplane model 707 727 737 747 767 757 777

(KC135)

% wing ultimate design 110% 110% 106% 115% 99.4% 111% 103%
load @ failure •

Failure location Lower Upper Upper Upper No wing Upper Upper

panel panel panel panel failure failsafe panel
chord
• No wing failure; test terminated due to failure of non-representative body.
Figure 12. Full scale airplane static test results

11
American Institute of Aeronautics and Astronautics
 VII. Airplane Fatigue Test
Full-scale fatigue testing of airplanes is a
major part of Boeing structural performance
data development. Next to monitoring in-
service airplanes, this is the optimum method of
obtaining fatigue data as it exposes a full-scale,
three-dimensional, structurally complete
airplane (Figure 13) to the operating loads that
closely approximate those experienced by an
airplane fleet. In addition to providing the
validation of aircraft design concepts, full-scale
fatigue testing is often used to identify any
preventive maintenance actions for the fleet, if
the fatigue testing is done at the time of
certification of a new model of jet transport Figure 13. 777 Airplane fatigue test
(which has primarily been the case). Full-scale fatigue tes ting to at least twice the design service objective is
required for a new model. Significant test results are shared with the regulatory agencies on an informal basis.
The test objective is to lead the fleet in locating areas that might exhibit early fatigue problems. Fatigue testing
also provides opportunities to develop and verify inspection, maintenance, and repair procedures. However, the test
is not an alternative to inspections required by the maintenance program to ensure structural integrity over the life on
an airplane in service. Separate testing is typically performed on the nose and main landing gears and gear support
structure to establish life limits for continued airworthiness in accordance with FAA / JAA requirements.
Environmental effects, such as corrosion and climate variables critical for composite structure, are typically
accounted for in component rather than full-scale testing.

R. Past Models
Fatigue testing has been performed on every major commercial jet airplane model, starting with the 707, which
was tested in a water tank for safety purposes. Figure 14 shows the Boeing airplane models, the minimum design
service objective (DSO) in flight cycles, and the number of cycles achieved during full-scale fatigue testing. It may
be seen from Figure 2 that full-scale testing is generally accomplished to twice the minimum 20-year DSO, with
several exceptions. The first is the model 727, which was originally fatigue tested to its DSO of 60,000 flight
cycles. In order to stay ahead of the fleet leaders in terms of flight cycles, an in-service 727 airplane with 47,000
accumulated flight cycles was acquired, and the fuselage was cyclic pressure tested for an additional 76,000 cycles.
The second exception is the model 747, which was originally fatigue tested to the DSO of 20,000 flight cycles. As in
the case of the 727, Boeing acquired a 747 airplane with 20,000 accumulated flight cycles and cyclic pressure tested
the fuselage an additional 20,000 cycles. In addition, the fuselage sections 41 and 42 of the derivative model 747-
400 were cyclic pressure tested to 60,000 cycles, representing three DSOs.

12
American Institute of Aeronautics and Astronautics
 Airplane Minimum design Fatigue test Remarks
service objectives cycles
707 20,000 50,000 Fuselage Hydro-fatigue test
727 60,000 (a) 60,000 Complete airframe
(b) 170,000 Complete fuselage 47,000 cycles in service, plus
123,000 pressure test cycles
737 75,000 (a) 150,000 Fuselage section/pressure and shear
(b) 129,000 Complete aft fuselage 59,000 cycles in service,
plus 70,000 pressure test cycles
747 20,000 (a) 20,000 Complete airframe
(b) 40,000 Complete airframe 20,000 cycles in service, plus
20,000 pressure test cycles.
(c) 60,000 747-400 sections 41 and 42 pressure test cycles
757 50,000 100,000 Complete airframe
767 50,000 100,000 Complete airframe
777 44,000 120,000 plus Complete wing and fuselage airframe
20,000 pressure
cycles
Figure 14. Boeing Airplanes are Fatigue Tested Far Beyond Their Design Service Objectives
The 777 was the first full-scale test to be subjected to twice the airplane’s 30-year design service objective, as it
completed a total of 120,000 cycles plus 20,000 pressure cycles. This extended testing also provided opportunities
to extend the widespread fatigue damage and damage tolerance inspection thresholds, as well as to obtain data to
economically operate an aging fleet. The 777 major fatigue test will be used as an example to provide detail
information on test methods.

S. Applied Loads
Development of
the 777 fatigue test
loads spectrum,
represented in Figure
15, was based on the
concept of applying
loads as realistically
as possible, while
conforming to time
and economic
constraints and test
equipment
limitations. Test
loads were derived
from the 777-200
short flight (1.5
hour) mission Figure 15. Aircraft fatigue loads overview
because this requires
the maximum number of flight cycles (44,000 cycles for a 20-year design service objective). Actuator loads were
calculated to produce shears, moments, torsions, and point loads equivalent to design values. Fatigue test loads are
applied in blocks of 5,000 flights using five different flight types. These five flight types (A, B, C, D, and E) are
composed of five alternating load levels (I, II, III, IV, and V) for load conditions simulating gust and maneuver type
loadings. The A flight contains the highest loads but is applied only once per 5,000 flight block. The E flight has
the smallest loads and is applied most frequently. Figure 16 shows the flight types, their frequencies of occurrence,
and typical associated gust and maneuver levels for the 777 cruise segment. Figure 17 demonstrates the wing tip
deflections for each of the flights. The combination of all of these applied flights statistically represents the desired

13
American Institute of Aeronautics and Astronautics
1.5-hour, in-service, short-haul mission. The 777 test consisted of 24 blocks of 5,000 flights. The A and B flights
were specified within each block to aid in marker band identification for striation counts. The C, D, and E flights
were located randomly in the flight blocks.
Flight Final climb Cruise maneuver
Flights/block Control points Actual time
type gust levels ‘g’ levels
A 1 1,834 49:02 +/- 27.96 fps 1 g +/- 0.652 g's
B 13 1,534 33:47 +/- 22.49 fps 1 g +/- 0.563 g's
C 215 760 14:33 +/- 13.56 fps 1 g +/- 0.400 g's
D 1,067 432 6:44 +/- 8.37 fps 1 g +/- 0.274 g's
E 3,704 220 2:02 +/- 5.78 fps 1 g +/- 0.186 g's
5,000 total 292 avg 3:40 avg
Figure 16. Fatigue test loads 5 x 5 s pectrum statistics
Wing vertical deflection, inches

Figure 17. Fatigue test deflections

The procedures for this so-called 5×5 variable amplitude fatigue test spectrum were standardized for the full-
scale testing of the 757 and 767. A total of 364 unique balanced airplane load conditions were developed and
utilized for the five different flights. An internal loads solution and a special program template were generated to
verify that test load damage and loads closely represented those used for design of the structure. In addition to flight
loads, fuselage pressurization to 8.6 psi was accomplished for each flight cycle.

T. Instrumentation
Approximately 1,000 strain gauges and calibrated parts were monitored and recorded initially, and at the
completion of each design service objective, to help identify any changes in stress levels resulting from potential
airplane fatigue damage. Locations for instrumentation consisted primarily of anticipated hot-spots, as well as to
verify proper load introductions. Correlation with analysis was done using the static test article, which had more
than four times the number of strain gauges installed. Gauges were also added throughout the test in order to obtain
detailed stress level information at areas where damage had occurred.

14
American Institute of Aeronautics and Astronautics
U. Inspection Procedures and Intervals
Inspection requirements for detection of potential fatigue damage were based on the structural inspection plan
(SIPD) developed for the 777 fleet with customer airlines and regulatory agencies. The test inspection zones and
methods agree with the SIPD. However, the inspection intervals and thresholds were extended and phased to
maximize test efficiency. A bi-weekly inspection of critical fatigue areas, and areas where damage had already
occurred, was also conducted. Some damage was monitored on a daily basis, to obtain crack growth information
and protect the test article as required. Full airplane inspections, including all damage tolerance inspections, took
place at the completion of each design service objective. This test provided an opportunity to verify the inspection
methods, particularly non-destructive (NDI) methods, prior to them being required by the operators.

V. Data Collection for Damaged Structure

After discovery of damage on the test airplane, a thorough engineering review of the area was accomplished.
Included was a review of strain gauge readings, a comparison of test loads versus design loads in the region,
inspectability of the structure, consequence of part failure, a check of design loads not incorporated on the test, any
special configuration differences to production airplanes, and a review of related problems in the existing Boeing
fleet. As applicable, the Materials Technology group performed a lab analysis on the damaged part to verify and
determine material properties, geometry, crack origins, and, if possible, striation counts to determine the number of
cycles from crack origin to damage discovery.
Several options were available to disposition the damage on the test airplane. The crack could be left unrepaired
and monitored at a frequent interval to obtain crack growth information and the effects of damage on the
surrounding structure. This was done more frequently toward the end of the test. Strain gauges could be added to
enhance the understanding of stress levels in the area. Simpler parts were often removed and replaced, in order to
provide additional data. For complex damage, a repair drawing was prepared to specify airplane modifications.
Removed parts, or pieces of damaged structure many times were given to the Materials group for evaluation. In
some cases, a modified part was installed on the airplane to verify the redesign used for production changes or fleet
rework action.

W. Design Change Policy

The process to determine incorporation requirements of production and/or fleet actions following the discovery
of structural damage consists of three primary phases. The first is the engineering data collection as described
above. Next is a statistical analysis to determine the actual test-demonstrated life of the part, and the anticipated
amount of fleet damage. This is dependent on the number of cracked and uncracked similar details and the validity
of the test loading in the particular region. Full-scale
Boeing test reduction factors are used to accomplish
this. Finally, an economic trade study to evaluate the
costs of structural changes to the airplane is
undertaken. This model determines the net present
costs of releasing a design change, releasing a service
bulletin, or making no change and repairing the fleet
as required, according to the estimated amount of fleet
damage. The object of this policy is to provide the
Structures engineer with appropriate engineering as
well as economic data to make a rational decision
regarding rework of structural details that exhibit
damage on the 777 major fatigue test.
The number of damage reports for each model, and
the subsequent design changes, have decreased for Figure 18. Design changes during full-scale
each model (Figure 18), thereby demonstrating the fatigue testing
benefit of incorporating lessons learned from the
previous full-scale testing.

VIII. Horizontal Stabilizer Tests

Boeing tested the 777 horizontal stabilizer and elevators separately from the airplane because the attachment to
the body is determinate. The test specimen was a structurally complete production article (Figure 19). The test plan

15
American Institute of Aeronautics and Astronautics
 omitted nonstructural components and systems not
essential to the structural performance or induced
loading of the stabilizer.
The strakelet and tip fairings were not installed,
and the elevator actuators were replaced by rigid
links. The test specimen was fabricated by the same
construction methods and governed by the same
specification require ments as other production
structure. Inspectors maintained FAA conformity on
a majority of the parts during fabrication. Tests
began in April 1994 and were complete in June
1995.
Engineers computed test loads for each static
load condition to match the required shear, moment,
and torsion values. These test loads were applied to
the stabilizer using hydraulic actuators connected to
attachment fittings, mounted on the stabilizer
structure. The stabilizer was mounted in the test
fixture at the pivot and jackscrew fittings, as it
would be in an airplane. The test article was
Figure 19. 777 Horizontal stabilizer test setup
instrumented with strain gauges, electronic
deflection indicators (EDI), and calibrated load-
cells at selected locations. Instrumentation
monitored structural responses and provided data
for correlation to analytical predictions during all
strain surveys. Testing was conducted outdoors
at ambient conditions.
The test included three critical static load
conditions: up, down, and unsymmetric bending.
Figure 20 depicts the loading sequence. As in the
preproduction test box, limit load strain survey
results demonstrated the predictive capability of
the FEA model. Calculations accurately
predicted measured strains (Figure 21). Overall
deflection along the span of the stabilizer
correlated well (Figure 22). There were no signs
of permanent deformation.
Figure 20. 777 Horizontal stabilizer test sequence

Figure 21. 777 Horizontal stabilizer

test, predicted versus actual strains Figure 22. 777 Horizontal stabilizer test,
predicted versus actual deflection

16
American Institute of Aeronautics and Astronautics
 Additional testing that was not required for certification included fatigue, ultimate load, and destruct testing.
The horizontal stabilizer was subjected to 120,000 flights of spectrum fatigue loading to satisfy the program
objectives. This test verified the fatigue characteristics of the metallic portion of the stabilizer. The preproduction
test box described earlier verified the composite structure.
Ultimate load and destruct testing supplemented the data that was acquired as part of the certification program.
The test team ran three load cases representative of up, down, and unsymmetric bending. The critical down bending
load case became the destruct run. The test box was subjected to barely visible impact damage and loaded to failure.
Engineers accurately identified the failure location and predicted the failure load within 3%. Final failure occurred
above the required load level.
The 777 horizontal stabilizer test program met the following goals:
Verified compliance with FAR/JAR 25.305 and 25.307. The test article sustained limit load for critical
conditions without permanent deformation.
Verified predictive capability of analysis methods coupled with subcomponent tests. Strains and deflections
closely matched the analysis.
Verified the design service goals of the 777 horizontal stabilizer.
Verified the absence of widespread damage due to fatigue.

IX. Vertical Stabilizer Test

Boeing tested the 777 vertical stabilizer, including
the rudder, as part of the airplane full-scale test
(Figure 23). Again, the purpose was to show limit
load capability and verify the accuracy of analytically
calculated strains and deflections. Tests began in June
1994 as part of the full-scale airplane test and were
completed in April 1995. Boeing used a second
airplane with vertical stabilizer and rudder in the
major fatigue test, which began in January 1995.
The static test article was the second production
airplane built. The aft portion of the aircraft was
structurally complete except for nonstructural
components and systems; the horizontal stabilizer was
replaced by a load fixture attached at the pivot
bulkhead and jackscrew attachment. The leading edge
and tip were not installed on the vertical stabilizer,
and the rudder actuators were replaced by rigid links.
As described for the horizontal stabilizer test,
engineers computed loads for critical cases, based on
the external load conditions, and applied them through Figure 23. 777 Vertical stabilizer test setup
a series of actuators, fixtures, and pads. The test
article contained a full set of instrumentation to monitor
behavior and collect data for comparison with the analysis.
Testing was conducted indoors at ambient conditions.
Three critical conditions tested included maximum
bending (engine-out), maximum torsion (hinge moment),
and maximum shear (lateral gust). Technicians applied
other test conditions as part of the overall airplane test
sequence, which were not critical for the vertical stabilizer.
In comparison with the analysis, measured strains were
accurately predicted (Figure 24).
A completely separate test using another production
airframe verified the fatigue behavior of the 777. This test
subjected the vertical stabilizer and rudder to 120,000
flights of spectrum fatigue loading. The 777 vertical
Figure 24. Vertical Stabilizer Test,
stabilizer test program exceeded the same goals as
described for the horizontal stabilizer test. Predicted Versus Actual Strains

17
American Institute of Aeronautics and Astronautics
 X. Distributed Certification
The plan for partner/supplier engagement in new airplane development, such as the 787 Dreamliner, will result
in more delegated authority for those partners and suppliers than historical programs. The new airplane plan will
have partners and suppliers engaged earlier than previous programs. These partners and suppliers will be a
combination of domestic and international companies and have access to certification offices and agencies
potentially far removed from the Seattle office. These partners and suppliers will be engaged in and have
responsibility for necessary technology development and subsequently be responsible for design definition and
hardware production of their particular component. Boeing will provide for proper integration and consistency
across the airframe by the requirements that are defined and levied on the partners. Depending on the degree of
delegation, the partners will then execute their work statement with a greater degree of autonomy and authority than
granted on previous programs. For example, a partner that has previously displayed a high degree of expertise and
competence in a design development and engineering release process might be controlled by requirements defined at
a relatively high level. These requirements would ensure that the partner component would integrate properly and
be consistent with the rest of the airframe but would not control the details of execution. That partner could define
requirements in addition to the FARs that they deem appropriate; use their own design criteria, tools, and processes;
select materials from their knowledge and experience base; release and approve the engineering through their own
local system; maintain the engineering data; and sustain the product. The ultimate vision of delegation would have
that partner certify that hardware through the most proximate (domestic or foreign) certification agency or office. A
partner with less delegation authority would have a more complete requirement set to meet. The future airplane
models will have a large diversified partner and supplier base that will have many and varying levels of delegation
authority. The details and processes of an efficient, integrated certification plan must be defined to enable this
global engineering and certification working model. These details and processes must also recognize and account
for Boeing working toward receiving Organization Designated Authorization (ODA).

XI. Summary
Design and analysis of structure must be validated per Boeing and regulatory requirements. All requirements are
satisfied by analysis, and tests are run to validate the analysis of new or modified structure with different material or
geometry. Considerable experience and judgment are required to determine the number and types of tests on a new
or derivative program. Analytical structural models are generally based on those methods previously validated on
successful existing aircraft, including correlation with static test and flight loads or strain surveys. Aspects of the
models are further verified by ground vibration tests, engine blade-loss tests, and component structural tests. In the
event that new analytical methods are introduced on a program, validation can be achieved through their application
on a previous airplane and the subsequent correlation of results with those achieved earlier by using the original
analysis method. Certification agencies, on the basis of FAR/JAR 25.307, 25.301, and 25.305, often require that
analytical predictions be corroborated by comparison with static test and/or flight test results.

XII. References
1. Al Fawcett, Jess Trostle, and Steve Ward, “777 Empennage Certification Approach,” presented at the 11th
International Conference on Composite Materials, Gold Coast, Queensland, Australia, July 14-18, 1997.
2. Michael Mohaghegh, “Evolution of Design Philosophy and Criteria,” presented at the 45th Annual SDM
Conference, Palm Springs, California, April 19-22, 2004.
3. FAA Advisory Circular 20-107A, “Composite Aircraft Structure,” 1984; and companion document by the
JAA, ACJ 25.603, “Composite Aircraft Structure (Acceptable Means of Compliance),” 1986.
4. Code of Federal Regulations, Aeronautics and Space, Part 25, “Airworthiness Standards: Transport Category
Airplanes.”
5. Joint Aviation Requirements, JAR-25, “Large Aeroplanes.”
6. MIL-Handbook 17, “Composite Materials Handbook.”

18
American Institute of Aeronautics and Astronautics