Space engineering

Fracture control

Foreword

This Standard is one of the series of ECSS Standards intended to be applied together for the management, engineering and product assurance in space projects and applications. ECSS is a cooperative effort of the European Space Agency, national space agencies and European industry associations for the purpose of developing and maintaining common standards. Requirements in this Standard are defined in terms of what shall be accomplished, rather than in terms of how to organize and perform the necessary work. This allows existing organizational structures and methods to be applied where they are effective, and for the structures and methods to evolve as necessary without rewriting the standards.

This Standard has been prepared by the ECSS-E-ST-32-01 Working Group, reviewed by the ECSS Executive Secretariat and approved by the ECSS Technical Authority.

Disclaimer

ECSS does not provide any warranty whatsoever, whether expressed, implied, or statutory, including, but not limited to, any warranty of merchantability or fitness for a particular purpose or any warranty that the contents of the item are error-free. In no respect shall ECSS incur any liability for any damages, including, but not limited to, direct, indirect, special, or consequential damages arising out of, resulting from, or in any way connected to the use of this Standard, whether or not based upon warranty, business agreement, tort, or otherwise; whether or not injury was sustained by persons or property or otherwise; and whether or not loss was sustained from, or arose out of, the results of, the item, or any services that may be provided by ECSS.

Published by:     ESA Requirements and Standards Division
    ESTEC, P.O. Box 299,
    2200 AG Noordwijk
    The
Copyright:     2009 © by the European Space Agency for the members of ECSS

Change log

ECSS-E-30-01A 13 April 1999	First issue
ECSS-E-ST-32-01B	Never issued
ECSS-E-ST-32-01C 15 November 2008	Second issue The main changes are summarized below: 6.3.5 – metallic low risk fracture items are introduced. 6.4.4 – fracture control summary report introduced. 7 – various improvements, incl. B-values for lower bound properties and application of EPFM where appropriate. 8.2 – reference is now made to ECSS-E-ST-32-02 for pressurized hardware; pressurized structures and hazardous fluid containers are introduced. 8.3 – requirements for welding are updated and include now reference to standardized nomenclature. 8.4 & 10.5 – requirements for composite, bonded and sandwich items are significantly updated: major changes are made in order to address the risk of degradation due to impact damage and to complement the existing verification by means of proof testing (also applicable to clause 11). 8.7 – requirements for glass components are updated (incl. improved coherence with SSP 30560A). 8.8 – requirements for fasteners are updated. 10.3 – requirements for NDI are updated and include now more details on standard NDI; the Table 2 of ECSS-E-31-01A is now deleted. 10.7 – requirements for detected defects are introduced. 11 – updated to include highly loaded metallic safe life items; some special requirements are deleted. For DRDs of fracture control documentation, reference is now made to ECSS-E-ST-32. Coherence with other structural ECSS standards has been checked. Coordination with recent developments in fracture control standardization at NASA, e.g. reflected in NASA-STD-5019, NASA-STD-5009 and MSFC-RQMT-3479. Substantial editing of the text to comply with ECSS drafting rules.
ECSS-E-ST-32-01C Rev. 1 6 March 2009	Second issue revision 1 Changes with respect to version C (15 November2008) are identified with revision tracking. Main changes are: Requirement 8.7c., on page 59, contained duplicated requirements. The duplicates were removed. Clause 8.7 contains in total 9 requirements (8.7a. to 8.7.i). Correction of normative references. Split of terms “catastrophic hazard” and “crack aspect ratio, a/c” into two terms. Addition of missing abbreviated terms for “Fty, Ftu and KC. The single requirement of clause 10.5.2.2.3 “Proof test monitoring” moved to 10.5.2.2.1 as requirement “e.”, clause header 10.5.2.2.3 deleted. Deletion of clause header 11.2.2.2 “Identification of potential fracture-critical items” (which had essentially the same title as 11.2.2.1), causing a renumbering of its only requirement to requirement 11.2.2.1b., and renumbering of following clauses. Editorial changes

Scope

This ECSS Engineering Standard specifies the fracture control requirements to be imposed on space segments of space systems and their related GSE.

The fracture control programme is applicable for space systems and related GSE when required by ECSS-Q-ST-40 or by the NASA document NST 1700.7, incl. ISS addendum.

The requirements contained in this Standard, when implemented, also satisfy the fracture control requirements applicable to the NASA STS and ISS as specified in the NASA document NSTS 1700.7 (incl. the ISS Addendum).

The NASA nomenclature differs in some cases from that used by ECSS. When STS/ISS-specific requirements and nomenclature are included, they are identified as such.

This standard may be tailored for the specific characteristic and constrains of a space project in conformance with ECSS-S-ST-00.

Normative references

The following normative documents contain provisions which, through reference in this text, constitute provisions of this ECSS Standard. For dated references, subsequent amendments to, or revision of any of these publications do not apply, However, parties to agreements based on this ECSS Standard are encouraged to investigate the possibility of applying the more recent editions of the normative documents indicated below. For undated references, the latest edition of the publication referred to applies.

ECSS-S-ST-00-01	ECSS system – Glossary of terms
ECSS-E-ST-32	Space engineering – Structural
ECSS-E-ST-32-02	Space engineering – Structural design and verification of pressurized hardware
ECSS-Q-ST-20	Space product assurance – Quality assurance
ECSS-Q-ST-40	Space product assurance – Safety
ECSS-Q-ST-70	Space product assurance – Materials, mechanical parts and processes
ECSS-Q-ST-70-36	Space product assurance – Material selection for controlling stress-corrosion cracking
ECSS-Q-ST-70-45	Space product assurance – Mechanical testing of metallic materials
ASTM E 164	Standard Practice for Ultrasonic Contact Examination of Weldments
ASTM E 426	Standard Practice for Electromagnetic (Eddy-Current) Examination of Seamless and Welded Tubular Products, Austenitic Stainless Steel and Similar Alloys
ASTM E 1417	Standard Practice for Liquid Penetrant Examination
ASTM E 1444	Standard Practice for Magnetic Particle Examination
ASTM E 1742	Standard Practice for Radiographic Examination
DOT/FAA/AR-MMPDS	Metallic Materials Properties Development and Standardization (MMPDS) (former MIL-HDBK-5)
EN 4179	Aerospace – Qualification and Authorization of Personnel for Non-destructive Testing
EN ISO 6520-1	Welding and allied processes – Classification of geometric imperfections in metallic materials – Part 1: Fusion welding
ISO 17659	Welding – Multilingual terms for welded joints with illustrations
MIL-HDBK-6870	Inspection program requirements, nondestructive, for aircraft and missile materials and parts
NAS-410	Nondestructive testing personnel qualification and certification
NSTS 1700.7	Safety Policy and Requirements For Payloads Using the Space Transportation System (STS)
NSTS 1700.7 ISS Addendum	Safety Policy and Requirements For Payloads Using the International Space Station
SAE AMS-STD-2154	Process for inspection, ultrasonic, wrought metals
SAE AMS 2644	Inspection Material, Penetrant
NSTS/ISS 13830	Payload Safety Review and Data Submittal Requirements For Payloads Using the Space Shuttle & International Space Station

Terms, definitions and abbreviated terms

Terms from other standards

For the purpose of this Standard, the terms and definitions from ECSS-ST-00-01 apply, in particular for the following terms:

customer

In this standard, the customer is considered to represent the responsible fracture control or safety authority.

For the purpose of this Standard, the following term and definition from ECSS-E-ST-10-03 apply:

proof test

For the purpose of this Standard, the following terms and definitions from ECSS-E-ST-32 apply:

flaw

The term defect is used as a synonymous.

maximum design pressure (MDP)

service life

For the purpose of this Standard, the following term and definition from ECSS-E-ST-32-02 apply:

burst pressure

hazardous fluid container

leak before burst, LBB

pressure component

pressure vessel

pressurized structure

sealed container

special pressurized equipment

visual damage threshold, VDT

1 For typical implementation of thin-walled composite structure, the VDT is sometimes more specifically defined as the impact energy of an impactor with a hemi-spherical tip of 16 mm diameter resulting in 0,3 mm or more remaining surface deflection, after sufficiently long time to cover potential evolution of the indentation over time (due to e.g. wet ageing, fatigue loading, viscoelasticity of the resin) between impact and inspection.
2 It can be time consuming to determine the VDT based on remaining surface deflection of 0,3 mm (see NOTE 1) after a sufficiently long time. Therefore, tests which cause mechanical damage corresponding to a deflection of at least 1 mm, immediately after impact, are sometimes used to determine the VDT.
For the purpose of this Standard, the following term and definition from ECSS-Q-ST-40 apply:

catastrophic hazard

critical hazard

Terms specific to the present standard

aggressive environment
combination of liquid or gaseous media and temperature that alters static or fatigue crack-growth characteristics from normal behaviour associated with an ambient temperature and laboratory air environment

analytical life
life evaluated analytically by crack-growth analysis or fatigue analysis

catastrophic hazard
<other than NASA STS or ISS payloads> see ECSS-Q-ST-40B

catastrophic hazard
<NASA STS or ISS payloads> potential risk situation that can result in a disabling or fatal personnel injury, loss of the NASA orbiter, ISS, ground facilities, or STS/ISS equipment

[NSTS 1700.7 incl. ISS Addendum, paragraph 302]

close visual inspection
close proximity, intense visual examination of the internal and external surfaces of a structure, including structural details or locations, for indications of impact damage, flaws, and other surface defects

The inspection capability is evaluated by the surface deflection measurement (impact depth). The close visual inspection is considered to detect reliably a deflection larger than the visual damage threshold (VDT).

containment
damage tolerance design principle that, if a part fails, prevents the propagation of failure effects beyond the container boundaries

1 A contained part is not considered PFCI, unless its release can cause a hazard inside the container. The container is a PFCI, and its structural integrity after impact is verified as part of fracture control activities.
2 In this standard, the term containment in most cases also covers items which are e.g. restrained by a tether to prevent the occurrence of hazardous events due to failure of the item.
crack-like defect
defect that has the same mechanical behaviour as a crack
1 “Crack” and “crack-like defect” are considered synonymous in this standard.
2 Crack-like defects can, for example, be initiated during material production, fabrication or testing or developed during the service life of a component.
3 The term “crack-like defect” can include:
For metallic materials flaws, inclusions, pores and other similar defects.
For non-metallic materials, debonding, broken fibres, delamination, impact damage and other specific defects depending on the material.
crack aspect ratio, a/c
<part-through surface crack> ratio of crack depth to half crack length

crack aspect ratio, a/c
<part-through corner crack> ratio of crack depth to crack length

crack growth rate
rate of change of crack dimension with respect to the number of load cycles or time

For example da/dN, dc/dN, da/dt and dc/dt.

crack growth retardation
reduction of crack-growth rate due to overloading of the cracked structural member

critical crack size
the crack size at which the structure fails under the maximum specified load

The maximum specified load is in many cases the limit load, but sometimes higher than the limit load (e.g. for detected defects, composites and glass items)

critical initial defect, CID
critical (i.e., maximum) initial crack size for which the structure can survive the specified number of lifetimes.

critical stress-intensity factor
value of the stress-intensity factor at the tip of a crack at which unstable propagation of the crack occurs

1 This value is also called the fracture toughness. The parameter KIC is the fracture toughness for plane strain and is an inherent property of the material. For stress conditions other than plane strain, the fracture toughness is denoted KC. In fracture mechanics analyses, failure is assumed to be imminent when the applied stress-intensity factor is equal to or exceeds its critical value, i.e. the fracture toughness. See 3.2.25.
2 The term fracture toughness is used as a synonymous.
cyclic loading
fluctuating load (or pressure) characterized by relative degrees of loading and unloading of a structure

For example, loads due to transient responses, vibro-acoustic excitation, flutter, pressure cycling and oscillating or reciprocating mechanical equipment.

damage tolerance threshold strain
<composite structural items> maximum strain level below which damage compatible with the sizes established by non-destructive inspection (NDI), special visual inspection, the damage threat assessment, or the minimum sizes imposed does not grow in 106 cycles (108 cycles for rotating hardware) at a load ratio appropriate to the application

1 Strain level is the maximum absolute value of strain in a load cycle.
2 The damage tolerance threshold strain is a function of the material type and lay-up and is determined from test data in the design environment to the applicable or worst type and orientation of strain and flaw for a particular design and flaw size (e.g. the size determined by the VDT).
damage tolerant
characteristic of a structure for which the amount of general degradation or the size and distribution of local defects expected during operation, or both, do not lead to structural degradation below specified performance

defect
see ‘flaw’ (3.1)

detected defect
defect known to exist in the hardware

fail-safe
<structures> damage-tolerance design principle, where a structure has redundancy to ensure that failure of one structural element does not cause general failure of the entire structure during the remaining lifetime

fastener
item that joins other structural items and transfers loads from one to the other across a joint

fatigue
cumulative irreversible damage incurred by cyclic application of loads to materials and structures

1 Fatigue can initiate and extend cracks, which degrade the strength of materials and structures.
2 Examples of factors influencing fatigue behaviour of the material are the environment, surface condition and part dimensions
fracture critical item
item classified as such

fracture limited life item
hardware item that requires periodic re-inspection or replacement to be in conformance with fracture control requirements

fracture toughness
materials’ resistance to the unstable propagation of a crack

See critical stress intensity factor, 3.2.14.

initial crack size
maximum crack size, as defined by non-destructive inspection, for performing a fracture control evaluation

joint
element that connects other structural elements and transfers loads from one to the other across a connection

load enhancement factor, LEF
factor to be applied on the load level of the spectrum of fatigue test(s) in order to demonstrate with the test(s) a specified level of reliability and confidence

1 The LEF is dependent upon the material or construction, the number of test articles, and the duration of the tests.
2 MIL-HDBK-17F, Volume 3, Section 7.6.3 gives an approach for calculating the LEF for composite structures.
loading event
condition, phenomenon, environment or mission phase to which the structural system is exposed and which induces loads in the structure

load spectrum
representation of the cumulative static and dynamic loadings anticipated for a structural element during its service life

Load spectrum is also called load history.

mechanical damage
induced flaw in a composite hardware item that is caused by external influences, such as surface abrasions, cuts, or impacts

potential fracture critical item, PFCI
item for which the initiation or propagation of cracks in structural items during the service life can result in a catastrophic or critical hazard, or NASA STS/ISS catastrophic hazardous consequences

Pressure vessels and rotating machinery are always considered PFCI. See Figure 51.

R-ratio
ratio of the minimum stress to maximum stress

residual stress
stress that remains in the structure, owing to processing, fabrication, assembly or prior loading

rotating machinery
rotating mechanical assembly that has a kinetic energy of 19300 joules or more, or an angular momentum of 136 Nms or more

The amount of kinetic energy is based on 0,5 I2 where I is the moment of inertia (kg.m2) and is the angular velocity (rad/s).

safe life
fracture-control design principle, for which the largest undetected defect that can exist in the part does not grow to failure when subjected to the cyclic and sustained loads and environments encountered in the service life

special NDI
NDI methods that are capable of detecting cracks or crack-like flaws smaller than those assumed detectable by Standard NDI or do not conform to the requirements for Standard NDI

1 See 10.4.2.1 and 10.4.3.
2 Special NDI methods are not limited to fluorescent penetrant, radiography, ultrasonic, eddy current, and magnetic particle. See also 10.4.2.2.
standard NDI
NDI methods of metallic materials for which the required statistically based flaw detection capability has been established. and it is listed in Table 101
1 For standard NDI, see clauses 10.4.2.1 and 10.4.3.
2 For required statistically based flaw detection capability, see 10.4.2.1e.
2 Limitations on the applicability of standard NDI to radiographic NDI can be found in 10.4.2.1f and 10.4.2.1g.
4 Standard NDI methods addressed by this document are limited to fluorescent penetrant, radiography, ultrasonic, eddy current, and magnetic particle.
stress-corrosion cracking, SCC
initiation or propagation, or both, of cracks, owing to the combined action of applied sustained stresses, material properties and aggressive environmental effects

The maximum value of the stress-intensity factor for a given material at which no environmentally induced crack growth occurs at sustained load for the specified environment is KISCC.

stress intensity factor, K
calculated quantity that is used in fracture mechanics analyses as a measure of the stress-field intensity near the tip of an idealised crack

Calculated for a specific crack size, applied stress level and part geometry. See 3.2.14.

threshold stress intensity range, Kth
stress-intensity range below which crack growth does not occur under cyclic loading

variable amplitude spectrum
load spectrum or history whose amplitude varies with time

Abbreviated terms

For the purpose of this Standard, the abbreviated terms from ECSS-S-ST-00-01 and the following apply:

Abbreviation	Meaning
a/c	crack aspect ratio (see 3.2.8)
AR	acceptance review
ASME	American Society of Mechanical Engineers
ASTM	American Society for Testing and Materials
BS	British Standard
CDR	critical design review
CID	critical initial defect
COPV	composite overwrapped pressure vessel
DOT	United States Department of Transportation
DRD	document requirements definition
EN	European Standard
EPFM	elastic-plastic fracture mechanics
ESA	European Space Agency
FAD	failure assessment diagram
FCI	fracture-critical item
FCIL	fracture-critical items list
FE	finite element
FLLI	fracture-limited life item
FLLIL	fracture-limited life items list
FOD	foreign object debris
Fty	design tensile yield strength (in MPa)
Ftu	design tensile ultimate strength (in MPa)
GSE	ground support equipment
ISO	International Organisation for Standardisation
ISS	International Space Station
J-R curve	resistance curve based on J-integral
K-R curve	resistance curve based on stress intensity factor (K)
LBB	leak before burst
LEF	load enhancement factor
LEFM	linear elastic fracture mechanics
KC	fracture toughness for stress conditions other than plane strain NOTE: See NOTE 1 of definition 3.2.14.
KIC	plane strain fracture toughness
KISCC	threshold stress-intensity factor for stress-corrosion cracking
Kth	threshold stress-intensity range
MDP	maximum design pressure
MEOP	maximum expected operating pressure
NASA	National Aeronautics and Space Administration
NDI	non-destructive inspection
NHLBB	non-hazardous leak before burst
NSTS	National Space Transportation System (NASA Space Shuttle)
PDR	preliminary design review
PFCI	potential fracture-critical item
PFCIL	potential fracture-critical items list
R	ratio of the minimum stress to maximum stress
RFCP	reduced fracture-control programme
SAE	Society of Automotive Engineers
SCC	stress-corrosion cracking
SI	international system of units
SRR	system requirements review
STS	Space Transportation System (US Space Shuttle)
US	ultrasonic
VDT	visual damage threshold

Principles

The following assumptions and prerequisites are the basis of the implementation of the requirements contained in this standard. They can be used as reference for example when alternative approaches, not directly covered by the requirements of this standard, are assessed for equivalent safety or reliability.

All structural elements contain crack-like defects located in the most critical area of the component in the most unfavourable orientation. The inability of non-destructive inspection (NDI) techniques to detect such defects does not negate this assumption, but merely establishes an upper bound on the initial size of the cracks which result from these defects. For conservatism, this crack size then becomes the smallest allowable size to be used in any analysis or assessment.

After undergoing a sufficient number of cycles at sufficiently high stress amplitude, materials exhibit a tendency to propagate cracks, even in non-aggressive environments.

Whether, under cyclic or sustained tensile stress, a pre-existing (or load-induced) crack does or does not propagate depends on:

the material behaviour with crack;

the initial size and geometry of the crack;

the presence of an aggressive environment;

the geometry of the item;

the magnitude and number of loading cycles;

the duration of sustained load;

the temperature of the material.

For metallic materials, the engineering discipline of linear elastic fracture mechanics (LEFM) provides analytical tools for the prediction of crack propagation and critical crack size. Validity of LEFM, depends on stress level, crack configuration and structural geometry. The engineering discipline of elastic-plastic fracture mechanics (EPFM) provides analytical tools for the prediction of crack initiation, stable ductile crack growth and critical crack size.

For non-metallic materials (other than glass and other brittle materials) and fibre-reinforced composites (both with metal and with polymer matrix), linear elastic fracture mechanics technology is agreed by most authorities to be inadequate, with the exception of interlaminar fracture mechanics applied to debonding and delamination. Fracture control of these materials relies on the techniques of safe life assessment supported by tests, containment, fail safe assessment, and proof testing. Composite, bonded and sandwich items are manufactured and verified to high quality control standards to assure aerospace quality hardware. The hardware developer of composite, bonded and sandwich items uses only manufacturing processes and controls (NDI, coupon tests, sampling techniques, etc.) that are demonstrated to be reliable and consistent with established aerospace industry practices for composite/bonded structures.

The observed scatter in measured material properties and fracture mechanics analysis uncertainties is considered.

For example, scatter factor and LEF

For NSTS and ISS payloads, entities controlling the pressure are two-fault tolerant, see NSTS 1700.7 (incl. ISS Addendum).

For example, regulators, relief devices and thermal control systems

Fracture control programme

General

A fracture control programme shall be implemented by the supplier for space systems and their related GSE in conformance with this Standard, when required by ECSS-Q-ST-40 or the NASA document NSTS 1700.7, incl. ISS Addendum (clause 208.1).
Fracture control requirements as defined in this standard shall be applied where structural failure can result in a catastrophic or critical hazard.

In NASA NSTS 1700.7 (Safety Policy and Requirements For Payloads Using the Space Transportation System [STS]), incl. ISS Addendum, the payload structural design is based on fracture control procedures when the failure of a structural item can result in a catastrophic event.

Implementation of fracture control for structural GSE may be limited to items which are not covered by other structural safety requirements.

In many cases this limits fracture control verification to elements directly interfacing with flight hardware.

Items for which implementation of fracture control programme is required shall be selected in conformance with Figure 51.
For unmanned, single-mission, space vehicles and their payloads, and GSE the reduced fracture control programme, specified in clause 11, may be implemented.

Fracture control plan

The supplier shall prepare and implement a fracture control plan in conformance with ECSS-E-ST-32 ‘Fracture control plan – DRD’.
The fracture control plan shall be subject to approval by the customer.
Figure 51: Identification of PFCI

Reviews

General

Fracture control activities and status shall be reported during all project reviews.

For project reviews, see ECSS-M-ST-10.

Safety and project reviews

The schedule of fracture control activities shall be related to, and support, the project safety review schedule.

As specified in ECSS-Q-ST-40, safety reviews are performed in parallel with major project reviews.

Fracture control documentation shall be provided for the reviews as follows:

For a system requirements review (SRR)The results of preliminary hazard analysis and fracture control screening (which follows the methodology given in Figure 51) and a written statement as to whether or not fracture control is applicable.
For a preliminary design review (PDR)
- A written statement which either confirms that fracture control is required or else provides a justification for not implementing fracture control.
- Identification of fracture control-related project activities in the fracture control plan including:
  Definition of the scope of planned fracture control activities dependent upon the results of the hazard-analysis and fracture control screening performed.

Identification of low-risk fracture items.

Identification of primary design requirements and constraints which are affected by or affecting fracture control implementation.

For the fracture control plan, see 5.2.

* Submission of the fracture control plan to the customer for approval.  
* Lists of potential fracture critical items and fracture critical items in conformance with clause 6.4.2.

For a critical design review (CDR)
- A final fracture control plan which is approved by the customer.
- Verification requirements for inspection procedures and personnel.
- The status of fracture control activities, together with a specific schedule for completion of the verification activities.
- A description and summary of the results of pertinent analyses and tests.

See clause 6.4.

* List of potential fracture critical items in conformance with clause 6.4.2.  
* List of fracture critical items in conformance with clause 6.4.2.  
* List of fracture limited-life items in conformance with clause 6.4.2.

For an acceptance review (AR) or qualification review (QR)
- A fracture control summary report in conformance with clause 6.4.4, showing completion of all fracture control verification activities.
- Relevant test, inspection, procurement and analysis reports in conformance with clause 6.4.
- List of potential fracture critical items in conformance with clause 6.4.2.
- List of fracture critical items in conformance with clause 6.4.2.
- List of fracture limited-life items in conformance with clause 6.4.2.
- Pressure-vessel summary log, and, for payloads of the NSTS and ISS, in conformance with NSTS/ISS 13830 clauses 7.2 and 7.12.

Identification and evaluation of PFCI

Identification of PFCIs

Fracture control screening of structural elements (structural screening) shall be performed to identify PFCI for the complete structure, including related GSE directly connected to the flight structure, except when clause 11 applies.

Evaluation of PFCIs

Damage tolerance

Each PFCI shall be damage tolerant.
For the damage tolerance evaluation of PFCI, one of the following design principles shall be used in conformance with 6.3:
Safe life, or

Fail-safe, or

Low-risk fracture

1 An overview of the fracture control evaluation procedure, including damage tolerance design approaches, classification of Potential Fracture Critical Items and the relevant documentation is illustrated in Figure 61.
2 Another way to implement damage tolerance is containment. Containment verification is considered a fracture control activity (see clause 6.3.4). The container (or restraint) is a PFCI (see 6.1f). Contained (or restrained) items are however not considered PFCI (see Figure 51).
Figure 61: Fracture control evaluation procedures

Fracture critical item classification

The following items shall be classified as fracture critical item (FCI):

Composite, bonded, sandwich or other non-metallic PFCI, unless fail safe, low-risk fracture or contained.
Metallic PFCI which require NDI better than standard NDI, as specified in clause 10.3.
Pressure vessels in conformance with clause 8.2.2, or pressurised structures specified fracture critical in clause 8.2.3.
PFCI which require periodic re-inspection or replacement in order to achieve the required life.
1 Such items are called fracture limited-life items (FLLI) as a subset of FCI.
2 Having FLLI is not always desirable from programmatic considerations.
Rotating machinery as specified in clause 3.2.35.

Compliance procedures

General

The verification of PFCIs shall be done by analysis or by test or both.

For various items special compliance procedure requirements are specified in clause 8.

The methodology applied for evaluation by test shall be subject to customer approval.

Customer approval is specified, because evaluation by test is not specified to the same level of detail than evaluation by analysis. Evaluation by test is similar to evaluation by analysis, where appropriate and not specified otherwise.

Safe life items

The evaluation procedure for a PFCI considered as a safe life item shall be in conformance with Figure 63, for metallic items, and Figure 64, for composite, bonded and sandwich items.
Except where it is explicitly specified otherwise, the initial crack or damage size used for the verification (by analysis or test) of safe life items shall be detectable by the applied NDI with at least 90% probability and 95% confidence.
For metallic materials, the worst crack-like defect in the part shall not grow to such an extent that the minimum specified performance is no longer assured within a specified safe life interval, using a design life factor of at least four (4).

For example, minimum specified performance can be the limit-load capability (no failure or burst or excessive deformation) or no-leak, depending on the hazard to be prevented.

For metallic materials the maximum sustained stress-intensity factor Kmax, shall not exceed the threshold stress-intensity factor for stress-corrosion cracking KISCC.
For composite, bonded and sandwich items, the worst damage in the part shall not grow within a safe life interval, using a design life factor of 1 and a load enhancement factor of 1,15, after which the structure is still able to assure ultimate load capability.
For limited life items, a reduced service life shall be verified, which allows re-inspection or replacement of the items when:

The analytical life is less than 2 flights, for manned Shuttle-mission.

This is to allow for a potential aborted mission and subsequent reflight.

The analytical life is less than one flight, for any other case. For metallic materials, safe life analysis shall be performed as specified in clause 7.
Safe life items made of non-metallic materials, other than composite, bonded and sandwich items, shall be in conformance with 8.5 and 8.7.

Fail-safe items

The evaluation procedure for a PFCI considered as fail-safe item shall be as specified in Figure 64.
The structure remaining after failure of any element of the PFCI shall sustain the limit loads with a safety factor of 1,0 for metallic and glass items or 1,15 for composite, bonded and sandwich items, without losing minimum specified performance.

Minimum specified performance includes prevention of large scale yielding.

The failure of the item shall not result in the release of any part or fragment which can create a catastrophic or critical hazard.

For payloads on the NSTS or ISS, including transportation events to ISS, as minimum the mass and momentum limits defined in 6.1e are used. More in general, the maximum acceptable mass and velocity of released items is based on the results of the hazard analysis.

For metallic parts the fatigue life of the remaining structure shall be evaluated by linear damage accumulation rule (Miner's rule).
For metallic parts, mean fatigue life material characteristics and a design life factor of at least four (4) shall be used.
For composite, bonded and sandwich parts the fatigue assessment shall be performed using the mean fatigue life material characteristics, a design life factor of 1 and a load enhancement factor of 1,15.
In the case that no fatigue data are available, the fatigue analysis for metallic parts may be replaced by a crack growth analysis using an equivalent initial crack size of a = c = 0,125 mm (corner or surface crack), and demonstrating no failure after four (4) times the service life.
For limited life items, a reduced service life shall be verified, which allows replacement of the items when:

Less than 2 flight lives remain, for manned Shuttle-mission.

This is to allow for a potential aborted mission and subsequent re-launch.

Less than one flight life remains, for any other case. Fail-safe items made of non-metallic materials, other than composite, bonded, sandwich and glass items, shall be in conformance with 8.5.

Contained items

It shall be verified by analysis or test that the release of any loose item which can create a catastrophic or critical hazard is effectively prevented by an enclosure, protective cover or restraining element.

Successful containment verification implies not to consider the contained items as PFCI. The containing or restraining elements are PFCI (see 6.1).

For payloads of the NASA STS or ISS, it shall be verified by analysis or test that any loose item exceeding the allowable mass defined in clause 6.1e is prevented from being released into the cargo bay or crew compartments.
For metallic enclosures, it shall be verified that the loose item does not penetrate or fracture the enclosure with a safety factor of 1,5 on its kinetic energy.
For composite, bonded and sandwich enclosures, it shall be verified by test (or analysis supported by test) that the loose part does not penetrate or fracture the enclosure with a safety factor of 1,5 on its kinetic energy.
Composite, bonded and sandwich enclosures shall not be fracture critical in conformance with clause 6.2.2, for reasons such as providing a single point of failure support that can create a catastrophic or critical hazard if the enclosure failed.
Engineering judgment supported by documented technical rationale may be used when it is obvious that an enclosure, a barrier, or a restraint prevents the part from escaping.

Examples of such enclosures that have obvious containment capability include metallic boxes containing closely packed electronics, detectors, cameras, and electric motors; pumps and gearboxes having conventional housings; and shrouded or enclosed fans not exceeding 200 mm in diameter and an 8 000 revolutions per minute (rpm) speed.

When enclosures are designed to be opened the closure devices shall be single failure tolerant against failure to close if they are required to be closed again to establish containment for a later phase of the mission.

Low-risk fracture items

General

Metallic low-risk fracture items shall be in conformance with 6.3.5.2 and 6.3.5.3.

Composite, bonded and sandwich low-risk fracture items shall be in conformance with 8.4.4.3.

Limitations on applicability for metallic parts

The following PFCI shall not be accepted as low risk fracture items:

Pressure shells of human-tended modules or personnel compartments.
Pressure vessels.
Pressurized components in a pressurized system containing a hazardous fluid.
High-energy or high momentum rotating machinery.
Fasteners. The maximum tensile stress based on net cross-sectional area in the part at limit load shall be no greater than 30 percent of the ultimate tensile strength for the metal used.
The use of low-risk fracture classification shall be agreed with the customer.

Inherent assurance against catastrophic or critical failure from a flaw for metallic parts

Remote possibility of significant crack-like defect

The following criteria shall be met:

Low-risk fracture items are fabricated from a well-characterized metal, procured in conformance with an aerospace standard or equivalent standard approved by the customer, which is selected from Table 5-1 (Alloys with high resistance to stresscorrosion cracking) of ECSS-Q-ST-70-36 and therefore not sensitive to stress corrosion cracking in environmental conditions addressed by ECSS-Q-ST-70-36.
Low-risk fracture items are not fabricated using a process that has a recognized risk of causing significant crack-like defects, such as welding, forging, casting, or quenching heat treatment (for materials susceptible to cracking during heat treatment quenching) unless specific NDI or testing, which has been approved by the customer, is applied to sufficiently screen for defects.
1 It can be assumed that significant crack-like defects do not occur during machining of sheet, bar, and plate products from materials that are known to have good machinability properties, do not have low fracture toughness (i.e. when the ratio KIc/Fty < 1,66 mm; for steel bolts with unknown KIc, low fracture toughness is assumed when Ftu > 1240 MPa), and are metals or alloys produced in conformance with aerospace specifications and standards or equivalent grade specifications.
2 Low-risk fracture items meet inspection standards consistent with aerospace practices to ensure aerospace-quality flight hardware. This includes raw material inspection.
Low-risk fracture items receive visual inspection of 100% of the surface of the finished part.
Low-risk fracture items are inspected at the individual part level

This is to assure maximum accessibility.

Low-risk fracture items are rejected in case of detected surface damage that can affect part life.

Remote possibility of significant crack growth

One of the following criteria shall be met:
Low-risk fracture items are not subjected to fatigue loading beyond acceptance or normal protoflight testing (if any), transportation, and one mission (including a potential aborted mission), or

Low-risk fracture items are shown to possess acceptable resistance to crack growth from potential initial defects caused by machining, assembly, and handling, by demonstrating that assumed initial surface cracks of 3 mm depth and 6 mm length and corner cracks of 3 mm radius from holes and edges do not grow to failure in less than four complete service lifetimes.

Figure 62: Safe life item evaluation procedure for metallic materials

Figure 63: Safe life item evaluation procedure for composite, bonded and sandwich items

Figure 64: Evaluation procedure for fail-safe items

Documentation requirements

Fracture control plan

A fracture control plan shall be provided in conformance with clause 5.2.

Lists

A PFCIL, FCIL and FLLIL shall be provided in conformance with ECSS-E-ST-32 ‘Fracture control items lists (PFCIL, FCIL and FLLIL) - DRD’

1 The potential fracture-critical item list (PFCIL) is compiled from the results of the fracture control screening.
2 The fracture-critical item list (FCIL) includes the same information as the PFCIL for each FCI, and in addition specifies a reference to the document which shows for each item the fracture analysis and/or test results and the analytical life.
3 The fracture limited-life item list (FLLIL) includes the same information as the FCIL for each FLLI, and in addition specify the inspection method and period, and identifies the maintenance manual in which inspection procedures are defined.
4 The above three lists can be reported in one document.

Analysis and test documents

The analysis of all PFCIs, FCIs, contained and restrained items shall be documented in a fracture control analysis report in conformance with ECSS-E-ST-32 ‘Fracture control analysis (FCA) - DRD’.
When testing is used in addition to analysis of PFCIs, FCIs, contained and restrained items, the test method and test results shall be documented in test plans, specifications, procedures and reports in conformance with:

ECSS-E-ST-10-02 ‘Verification plan - DRD’,
ECSS-E-ST-10-03 ‘Test specification (TSPE) - DRD’,
ECSS-E-ST-10-03 ‘Test procedure (TPRO) - DRD’,
ECSS-E-ST-10-02 ‘Test report (TRPT) - DRD’.

The “Verification plan” can be limited to a “Test plan”.

Fracture control summary report

A fracture control summary report shall be provided with each deliverable flight hardware item.
The fracture control summary report shall contain the following:

Summary of identified PFCI, FCI, FLLI and applied NDI methods, with specific reference to low risk fracture PFCI, pressurized PFCI, safe life fasteners, composite PFCI, bonded PFCI, sandwich PFCI, glass and other shatterable/brittle PFCI, other non-metallic PFCI, and detected defects that remain in PFCI.
A summary discussion of alternative approaches or specialised assessment applied and tests performed.
A statement that inspections or tests specified for fracture control were, in fact, applied in conformance with requirements, and that the proper use of the approved materials has been verified.
A statement that hardware configuration of PFCI and their assemblies has been physically verified.
References to supporting documentation.

For example, analysis reports, test reports, NDI reports, structural screening results and associated lists.

Fracture mechanics analysis

General

Fracture mechanics analysis shall be performed to determine the analytical life of a safe life metallic item.
The following data shall be made available in order to enable crack growth prediction and critical crack-size calculation:

Stress distribution
Load spectra
Material properties
Initial crack size
Stress intensity factor solutions. For the fracture mechanics analysis, the latest version of the software package ESACRACK may be used.
1 Additional information on this software package can be found in Annex A, which also addresses some of the limitations of this software.
2 In general, existing fracture control analysis is not updated for each new update of the ESACRACK software. Update of the existing analysis using the latest version is normally performed, for example, in cases where the analysis is used to support the acceptance of detected defects (see 10.7), or in specific cases where there is a clear indication that the existing analysis made with an older version can be inadequate.
In cases where the latest version of the software package ESACRACK is not used, the alternative methods used and their validation shall be submitted to the customer for approval prior to their use.
A fracture mechanics analysis shall include the following two items:
Crack-growth calculation in conformance with 7.2.
Critical crack-size calculations in conformance with 7.3.

In most cases the fracture mechanics analysis demonstrates a margin on the required lifetime and crack size, based on initial crack sizes defined for standard or special NDI. As alternative, the critical (i.e., maximum) initial defect (CID) size for which the item can survive four times the required service life can be calculated iteratively, after which it can be verified by inspection that the probability of having cracks greater than or equal to this size is sufficiently small. This CID approach is specifically appropriate for analysis of cracks to be screened by proof testing. The CID approach can require careful scrutiny of the validity of the analysis, because it does not demonstrate any margin in the analysis results.

Analytical life prediction

Identification of all load events

The service-life profile of the item shall be defined in order to identify all cyclic and sustained load events to be included in the stress spectrum.
All load events expected for the item shall be included in the service-life profile.

Examples of load events expected throughout the service life are:

manufacturing and assembly;
testing;
pressurisations on ground
handling, e.g. by a dolly or a hoist;
transportation by land, sea and air;
ascent (launch);
stay in orbit, including thermally induced loads and operational loads;
descent (re-entry);
landing.
For Shuttle missions, an aborted mission and subsequent reflight shall be included in the service-life profile of the item.

Identification of the most critical location and orientation of the crack

The most critical location and orientation of the crack on the item shall be identified for the analysis.
To identify the most critical location, the following parameters shall be considered:

The maximum level of local stress.
The range of cycling stress.
Locations with high stresses or stress intensities.
Areas where material fracture properties can be low.
Stresses which, combined with the environment, result in reduced fracture resistance.
Stress-concentration, environmental and fretting effects.
Severity of stress spectrum In cases where the most critical location or orientation of the initial crack is not obvious, the analysis shall consider a sufficient number of locations and orientations.

Derivation of stresses for the critical location

For the critical location, as identified in 7.2.2, the principal stresses shall be derived which are caused by the load components which act on the item during the load events identified in 7.2.1.

For example, principal stresses due to translational and rotational accelerations, pressure, temperature and loads induced by adjacent structure.

The stresses shall be derived for the worst credible combination of all influencing aspects

For example, influencing aspects to be considered include: geometrical discontinuities and imperfections, manufacturing defects, residual stresses

Derivation of the stress spectrum

A stress spectrum shall be derived for the critical location identified in 7.2.2, based on the load events identified in 7.2.1 and the stresses derived in 7.2.3.
In the stress spectrum, the number of cycles in each step, and the upper and lower values of the stress components in each step shall be defined.

For example, stress components are remote tension stress, remote bending stress and pin bearing stress.

The stress spectrum shall be provided to the customer for approval.

Derivation of material data

Material properties used in the analytical evaluation shall be valid for the anticipated environment, grain direction, material thickness, specimen width and load ratio (R).

Where the operational temperature range overlaps with the ductile to brittle fracture transition temperature range of the material, the variation of material behaviour as function of temperature effect over this temperature range is taken into account in the analysis.

Mean values of crack growth rate (da/dN, da/dt) shall be used.
Mean value of threshold stress intensity range (Kth) shall be used.
Lower boundary values shall be used, for:

Critical stress intensity factor, KIC or KC (fracture toughness), and other residual strength related properties (e.g. flow stress).
Environmentally controlled threshold stress intensity for sustained loading, KISCC. Lower boundary values shall be derived as follows:
values with a 90% probability and 95% confidence level of being exceeded (B-value as defined in DOT/FAA/AR-MMPDS), or
in cases where insufficient test data are available: 70 % of the mean values. For the derivation of the proof loading to be applied for identification of initial crack sizes, upper boundary values, defined as 1,3 times the mean values, shall be used for the critical stress intensity factor, KIC or KC.
For the derivation of the proof loading to be applied for identification of initial crack sizes, in the case of through cracks, and in case the elastic-plastic approach is applicable, a factor of 1,3 shall be applied to the complete K-R curve, or an equivalent factor 1,69 if the J-R curve is used.
For those materials where a significant reduction of the KC for thin sheets is observed, the reduced value shall be used in the analysis.

This reduction of fracture toughness is not automatically accounted for in the ESACRACK software.

Mechanical testing of metallic materials shall be performed in conformance with ECSS-Q-ST-70-45.

Identification of the initial crack size and shape

The initial crack shape shall be identified by considering the geometry of the item and the critical location, in line with Figure 101, Figure 102, and Figure 103.
The initial crack sizes used in the analysis shall be defined based on the inspection level or proof load screening used for the item.

Identification of an applicable stress intensity factor solution

Stress intensity factor solutions for the relevant item geometry, crack shape, crack size and loading shall be used.
Local stresses caused by stress concentrations shall be included in the applied stress spectrum if their effect is not fully included in the used stress intensity factor solutions used in 7.2.7a.

Performance of crack growth calculations

Crack growth calculations shall be performed using the variables as defined in 7.2.1 to 7.2.7.
The analysis methodology used shall account for the two-dimensional growth characteristics of cracks, multiple loading events with variation in amplitude, excursions between mean stress levels and negative stress ratios.
The complete loading spectrum shall be analytically imposed at least four (4) times in sequence, one after another.
The loading spectrum shall be an envelope of all the credible load events that can be encountered during the design life.
Growth of cracks beyond the critical crack size shall not be considered in the crack growth analysis.
In cases where leakage is hazardous, growth of cracks through the thickness shall not be considered in the crack growth analysis.
Beneficial retardation effects on crack growth rates from variable amplitude spectrum loading shall not be considered without the approval of the customer.
For components where a crack grows into a hole, the analysis shall assume that the crack propagation is not arrested or retarded by the hole.
For cyclic plastic deformation, EPFM crack-growth methodology shall be used, which is subject to customer approval.
For manufacturing steps, which can cause crack extension without the possibility of subsequent NDI the maximum possible crack growth shall be considered in the safe life calculation.

For example, the autofrettage pressure cycle during manufacturing of a COPV which can lead to crack growth by linear or non-linear material behaviour. Especially the non-linear material behaviour can lead to stable crack growth (ductile tearing) which can be considerably underestimated.

Shear (i.e. mode II or mode III) loading of the crack shall be considered, using an analysis method agreed with the customer.

Critical crack-size calculation

The critical crack-size (ac) shall be calculated by means of LEFM:
where Si are the maximum specified stresses and Fi are the stress intensity magnification factors for the different load cases (which depend on the crack size a) and KC is the critical stress intensity factor.

The maximum specified load is in many cases the limit load, but sometimes higher than the limit load (e.g. for detected defects, composites and glass items).

In those cases outside the range of validity of LEFM, the critical crack size shall be evaluated by appropriate EPFM methods or by a structure representative test.

1 This applies also to crack extension under non-linear material behaviour. For example ductile tearing.
2 The consideration of structure representative conditions is of great importance in the case of EPFM, where for example stress multi-axiality effects can significantly influence the results of the analysis or test.
3 In the NASGRO module of the ESACRACK software a simplified verification can be performed to ensure that no premature failure under elastic-plastic conditions occurs, based on comparison of the so-called net-section stress and flow stress. In most of the common applications this can be considered as adequate. For e.g. verification of highly critical, highly stressed (e.g. pressure vessels, launcher tanks) applications and detected defects it can be necessary to performed more advanced EPFM analysis or testing.
The material properties used for the critical crack size calculation shall be in conformance with 7.2.5.

Special requirements

Introduction

Except where it is explicitly specified that they replace requirements, these special requirements apply in addition to those specified in clauses 4 to 7 and 9 to 11.

Pressurized hardware

General

All pressurized systems in NSTS and ISS payloads shall be in conformance with the requirements of NSTS 1700.7 (incl. ISS Addendum).

1 Pressurized hardware (including pressure vessels, pressurized structures, pressure components, and special pressurized equipment) comply with ECSS-E-ST-32-02.
2 For the attachments of pressurized hardware, which are not part of the pressurized shell, no special requirements are specified in 8.2. They follow the normal rules of this standard (e.g. be verified safe life or fail safe) to prevent catastrophic or critical hazards.

Pressure vessels

Overview

Pressure vessels are classified as fracture critical, in conformance with 6.2.2.

Pressure vessels are subject to the implementation of fracture critical item tracking, control and documentation procedures, in conformance with 10.6.

Requirements

In addition to the maximum design pressure (MDP), as defined in clause 3.1 of this standard, all external loads shall be included in the fracture control verification.

Example of external loads are vehicle acceleration loads.

Fracture mechanics verification of metallic pressure vessels and metallic liners of COPV shall, when required in conformance with ECSS-E-ST-32-02, be performed in conformance with Figure 81 and clauses 6.3.2 and 7.
The verification of 8.2.2.2b, shall demonstrate safe life against hazardous leakage and burst.
For non-hazardous leak before burst (NHLBB) vessels, all areas which cannot be verified LBB, shall be verified as safe life.

For example, at load introduction (e.g. boss area) and in other thick-walled regions, when agreed with the customer.

Figure 81: Procedure for metallic pressure vessel and metallic liner evaluation

Pressurized structures

General

A pressurized structure shall be classified as a fracture critical item, when any of the following applies:

It is the pressure shell of a manned module.
It contains stored energy of 19310 joules (14240 foot-pounds) or more, the amount being based on the adiabatic expansion of a perfect gas.
It contains a gas or liquid which creates a hazard if released.
It is subjected to a maximum design pressure (MDP) greater than 0,69 MPa (100 psi). Pressurized structures shall be in conformance with ECSS-E-ST-32-02, clause 4.4.
Pressurized structures conforming to ECSS-E-ST-32-02 which have composite overwrap or are fully made of composite shall not be implemented for STS or ISS missions without approval of the customer.

For such pressurized structures, see clauses 4.4.2, 4.4.3 and 4.4.4 of ECSS-E-ST-32-02.

Fracture mechanics verification of metallic pressurized structures and metallic liners of overwrapped pressurized structures shall, when required in conformance with 8.2.3.1b, be performed in conformance with clauses 6.3.2 and 7 of this Standard.
The verification of 8.2.3.1d, shall demonstrate safe life against hazardous leakage and burst.

Manned pressurized structures

The design of manned pressurized structures shall be in conformance with the LBB criterion, in conformance with ECSS-E-ST-32-02, clause on “Failure mode demonstration”.
The design shall be safe life to leakage.

Pressure components

For pressure components, the complete pressure system shall be proof tested and leak checked in addition to an acceptance proof test of the individual items.
Safe life analysis may be omitted if the item is proof tested to a level of 1,5 or more times the design limit load, including MDP and vehicle accelerations.
All fusion joints shall be 100 % inspected by means of a qualified NDI method.
Concurrence of the customer shall be obtained where 100 % NDI is not considered practicable.

Low risk sealed containers

Additional fracture assessment need not be performed on sealed containers meeting the following criteria:

The container is not part of a system with a pressure source and is individually sealed.
Leakage of the contained gas does not result in a catastrophic hazard and the pressure shell is verified leak before burst (LBB).
The container or housing is made from a conventional alloy of steel, aluminium, nickel, copper or titanium.
The MDP does not exceed 0,15 MPa.
The free volume within the container does not exceed 0,051 m3 (1,8 cubic feet) at 0,15 MPa (22 psi) or 0,076 m3 (2,7 cubic feet) at 0,10 MPa (15 psi), or any pressure-volume combination not exceeding a stored energy potential of 19310 joules (14240 foot-pounds). For sealed containers with a MDP higher than 0,15 MPa (22 psi), but less than 0,69 MPa (15 psi), and a potential energy not exceeding 19310 joules (14240 foot-pounds) meeting criteria 8.2.5a.1, 8.2.5a.2 and 8.2.5a.3, additional fracture assessment need not be performed if the following apply:
the minimum factor of safety is 2,5 × MDP (verified by stress analysis or test), or
the container is proof-tested to a minimum of 1,5 × MDP All sealed containers shall be capable of sustaining 0,10 MPa (15 psi) pressure difference with a minimum safety factor of 1,5.

Hazardous fluid containers

Subject to approval of the customer, hazardous fluid containers shall comply with the following:

Have a stored energy of less than 19310 Joules (14240 foot-pounds) with an internal pressure of less than 0,69 MPa (100 psi).
Have a minimum safety factor of 2,5 times MDP.
Be in conformance with the fracture control requirements for pressure components specified in clause 8.2.4.
When agreed with the customer not to use a proof test to a minimum factor of 1,5, safe-life can be assured by NDI application and crack growth analysis.
Integrity against leakage is verified by test at a minimum pressure of 1,0 times MDP. If provision 8.2.6a is not met, hazardous fluid containers shall:
Have safe-life against rupture and leakage.
Be treated and certified the same as pressure vessels when the contained fluid has a delta pressure greater than one atmosphere.

Welds

Nomenclature

The standardised nomenclature for the different types of welds and their characteristics, including imperfections, as presented in ISO 17659 and EN ISO 6520-1 shall be used.

Safe life analysis of welds

For welds, the fracture mechanics analysis shall be performed with the aid of the material properties of the weldments, including weldment repairs.
When the material properties specified in 8.3.2a are not available, they shall be derived by means of a test programme covering:

Ultimate and yield strength for all welding conditions used, including mechanical properties (as in 8.3.2a) in the presence of different misalignments, angles between joints or typical defects, and their consequences.
Fracture toughness KC, stress-corrosion cracking threshold KISCC, and crack propagation parameters for each type of thickness.
Young’s modulus for weld material:
- Evaluated by test only in those cases, where a significant amount of a second phase with a different modulus compared to the base material appears.
- If the microstructure with respect to the different phases does not change, the base material Young’s modulus applies also for weld material.
  The test programme specified in 8.3.2b shall be performed on a number of specimens agreed with the customer, but not less than 5, in order to permit a statistical evaluation of final values.
  The fracture mechanics assessment shall be performed under consideration of any potential weld geometrical imperfection as follows:
In a first step, a screening of the applied weld process and material is performed to identify all potential weld geometrical imperfections.

See EN ISO 6520-1

Acceptance limits for the identified geometrical imperfections are determined and included in the fracture mechanics analysis. Any residual stresses, both in the weld and in the heat-affected zone, shall be used in the safe life analysis.
Except in the case specified in 8.3.2g, even though inspected for embedded flaws and pores, the initial crack geometry for the analysis shall always be assumed to be a surface part-through-crack or through-crack, as specified in clause 10.
Embedded crack cases shall not be used in cases other than those where NDI methods are used which enable the determination of the relative distance of the embedded flaw to the surface.

For example, embedded cracks (see Figure 101 geometry 6) can be used when ultrasonic inspection is applied.

Composite, bonded and sandwich structures

General

PFCI made of fibre-reinforced composite, including bonded joints, sandwiches and potted inserts, which are classified safe life and which are not low-risk fracture items in conformance with 8.4.4.3, shall be treated as fracture critical items.
All PFCI falling into the category fibre-reinforced composites, bonded and sandwich structures shall comply with clauses 8.4.2 to 8.4.4.

This includes adhesive bonds in metallic structures.

Composite overwraps of COPV and other composite overwrapped pressurized hardware shall be in conformance with clause 8.2 and ECSS-E-ST-32-02, as minimum.

1 This means that these composite PFCI do not need to be fully compliant with the detailed requirements of this clause 8.4.
2 For the attachments of pressurized hardware, which are not part of the pressurized shell, no special requirements are specified in 8.2 and ECSS-E-ST-32-02. Composite, bonded and sandwich attachment hardware follows the rules of this clause 8.4 to prevent catastrophic or critical hazards.

Defect assessment

Manufacturing defects

A list of potential manufacturing defects, including their maximum acceptable size (or ratio for porosity), shall be established, covering all applied manufacturing processes.

For example, the following defects, depending on the manufacturing process, can be considered:

High porosity ratio
Delamination
Fibre misalignment
Cut or broken fibres
Joint debonding.
The maximum acceptable defect size (or ratio) considered in the verification shall be detectable by the applied NDI, in conformance with 10.3 and 10.5.

With approval of the customer, acceptable defect size (or ratio) consistent with the manufacturing process (including process control) are sometimes used in the fracture control verification for certain manufacturing defect types, instead of defects based on NDI.

The effects of the potential manufacturing defects on the structural integrity shall be established, documented and verified.

Examples of such effects are strength, stability, and fatigue.

Acceptance criteria based on a fracture control methodology, as defined in this clause 8.4, shall be established for those manufacturing defects for which the effect is not already included in material properties used for structural design and qualification.

For example, in conformance with 8.4.2.1c and 8.4.2.1d porosity can be excluded from verification by means of a fracture control methodology, if the detectable ratio by means of NDI is fully represented in the derivation of strength and fatigue allowables.

Mechanical damage

Mechanical damage shall be considered in conformance with the damage threat assessment as specified in clause 8.4.3

For example, the following mechanical damage due to events which can occur during the service life, can be considered:

Impact
Scratch
Abrasion.

Defect assessment procedures

The following types of defects shall be included in the safe life verification in conformance with 8.4.4.2:

Mechanical damage at the maximum expected level, as specified in clause 8.4.4.2 and 8.4.3.
Manufacturing defects at the maximum size (or ratio) in conformance with applied inspection methods as specified in clause 8.4.2.1.
Detected defects in conformance with clause 10.7. For fail safe verification in conformance with 8.4.4.1, detected defects shall be included in conformance with clause 10.7.
Low-risk fracture verification in conformance with 8.4.4.3 shall consider the damage associated with the visual damage threshold (VDT) or larger.

For detected defects in low-risk fracture items, see clause 10.7.

Damage threat assessment

Introduction

The objectives of the damage threat assessment are to:

Determine the upper level of mechanical damage which is taken into account in the safe life verification.

Ensure that the verification of fail-safe and low-risk fracture items is based on valid assumptions, i.e.: to consider only detected defects for fail safe items, and VDT for low-risk fracture items.

The damage threat assessment takes into account damage protection, inspection and indication performed throughout the service life of the item.

The damage threat assessment is also applied to those safe life items screened for manufacturing defects by proof testing, in conformance with 8.4.4.2g, to ensure that no detrimental damage occurs after proof testing.

Identification of potentially damaging events and resulting mechanical damage

The events that can cause mechanical damage during the service life, shall be identified and documented in the fracture control analysis report.

1 The service life includes the following phases:
Handling,
Test,
Transportation,
In-service use,
Maintenance,
The manufacturing phase, which are not covered by NDI.
2 The following are examples of credible events:
Tool drop
Bumping or falling during handling
Scratch during assembly.
For the events identified in 8.4.3.2a the type and maximum credible magnitude of the associated threats to the integrity of the hardware during those events shall be identified.

For example, the magnitude of the threat can be described by the energy at impact, the shape, material and orientation of the impactor and the worst impact location.

The assessment shall include the potential consequences of impact of items considered as low mass or low momentum (in conformance with 6.1), or due to items considered as contained or restrained (in conformance with 6.3.4), in case they are released.
For the type and maximum magnitude of the threat during each event that can cause mechanical damage, as identified in 8.4.3.2a, 8.4.3.2b and 8.4.3.2c, the resulting mechanical damage shall be identified with its type and size or level.

1 Types of damage are for example: impact damage (including delamination, broken fibres and perforation), scratch, and abrasion.
2 Damage size or level can be characterised, for example, by energy level for impact, or depth and length for a scratch.

Mechanical damage protection

In the case where protective devices are used to reduce the effects of events, to avoid some events, or to protect the structure, the effectiveness of the devices shall be demonstrated by test.

Mechanical damage inspection and indicators

Close visual inspection shall be performed for each PFCI and FCI, just before each launch or just before closeout of surrounding structure after which mechanical damage is no longer credible, as determined in 8.4.3.2.
NDI shall meet the requirements of clause 10.3.
In case mechanical damage indicators are applied to provide positive evidence of a mechanical damage event, their effectiveness shall be demonstrated by test.

Compliance procedures

Fail safe items

A fail safe item shall meet all the requirements for the fail safe approach described in clauses 6.2, 6.3, and 10.7.
For a fail safe item it shall be demonstrated by test or analysis supported by test that there is no unacceptable degradation (in conformance with 8.4.4.1a) of the alternative load path, due to cyclic loads or environmental effects.

No damage needs to be considered for the alternative load path, unless detected defects exist (see clause 8.4.2.3).

A fail safe item shall be inspected at least by close visual inspection covering hundred per cent of the item before each flight, in addition to NDI during manufacturing.

Safe life items

A safe life item shall meet all the requirements for the safe life approach described in clauses 6.2, 6.3, and 10.7.

Low-risk fracture items

A low-risk fracture item shall not be a pressure vessel, high energy rotating machinery, habitable module or otherwise fracture critical pressurized structure, and not contain a hazardous fluid.
For a low-risk fracture item, the result of the damage threat assessment shall be that, as a result of damage inspection and protection, no damage larger than the visual damage threshold is expected.
A low-risk fracture item shall be inspected, as a minimum, by close visual inspection covering hundred per cent of the item before each flight, in addition to NDI during manufacturing.
A low-risk fracture item shall not include a single point failure bonded area.
For a low-risk fracture item the strain at the limit load shall be below the damage tolerance threshold strain.
With approval of the customer, it may be considered that the strain is below the damage tolerance threshold strain without specific testing, when:

At the limit load the maximum tensile stresses, taken into account the stress concentration factor, is lower than 40 % of the material ultimate capability.
At the limit load the maximum compressive stresses, taken into account the stress concentration factor, is lower than 25 % of the material ultimate capability.

Non-metallic items other than composite, bonded, sandwich and glass items

Potential fracture critical items made of non-metallic material, other than those covered by clause 8.4 (composite, bonded and sandwich items) and clause 8.7 (glass), which are safe life, shall be treated as fracture critical items.

For example, ceramic, C/SiC, C/C.

Fracture control implementation for PFCI made of non-metallic material shall be subject to customer approval.
An item shall not be accepted as a fail safe item unless it meets the following two conditions:

It meets all the requirements for the fail safe approach described in clauses 6.2 and 6.3.
It has been demonstrated that, for the item, there is no unacceptable degradation of the alternative load path, due to cyclic loads or environmental effects. An item shall not be accepted as a safe life item unless it meets the following two conditions:
It has been demonstrated by fatigue analysis (accounting for the effects of cyclic and sustained loading) supported by tests that, during a time period of four times the service life, there is no unacceptable degradation due to cyclic loads or environmental effects in the presence of induced defects, compatible with applied NDI techniques, using representative coupons.

Results of representative earlier tests can be used to support the analysis, when approved by the customer

It undergoes a proof-test of all flight hardware to not less than one and two tenth (1,2) times the limit load. In those cases where problems arise to fulfil the proof test requirement, these shall be treated on a case by case basis.

For example, the region of high load transfer where compliance with the proof test requirements for the non-metallic structure introduces yielding of the metal component.

Test loads on the non-metallic item shall not exceed 80% percent of ultimate strength.

Rotating machinery

Rotating machinery shall be proof (spin) tested and subjected to NDI before and after proof testing.
The proof test factor shall be derived by means of fracture mechanics analysis, but not be less than 1,1.

Rotating hardware not considered as rotating machinery in conformance with 3.2.35 is treated as any structural item.

Glass components

The verification of all potential fracture critical glass components, except those verified as fail-safe or contained, shall include an analysis of crack growth under conditions of the stresses and the environments encountered during their service life.
A fracture mechanics analysis for potential sustained crack growth (da/dt) shall be performed in conformance with clauses 7, 8.7c, 8.7d, 8.7e and 8.7f for each safe life glass item, in order to demonstrate that the item sustains after four (4) times its service life at least one and four tenths (1,4) times the design limit load without fracture.
The sustained crack growth analysis shall apply factors to the sustained stresses of the stress spectrum as specified in Table 81, depending on the duration of each load event that induces sustained stress.
The initial crack depth used for design and analysis of glass items shall:

Not be smaller than three (3) times the detectable flaw depth based on the NDI methods used.
Be subject to approval by the customer. The smallest crack aspect ratio used for analytical life predictions shall be a/c = 0,1.
Crack growth properties at 100 % moisture shall be used for life predictions.
Proof testing or NDI, consistent with the loading expected during service life, shall be conducted to screen for manufacturing flaws in each potential fracture-critical glass item based on the result of the fracture mechanics analysis, with the following conditions:
Proof testing is performed for acceptance of pressurized glass components (such as windows and viewports) to screen the flaws larger than the initial crack depth, with minimum proof pressure of two (2) times the MDP.
Proof testing is performed in an environment suitable to limit flaw growth during test.
Humidity and encapsulated water is removed from the surface of the glass before proof testing.

Encapsulated water can be accumulated during e.g. storage before proof testing

If a factor of safety on strength of 5 or greater can be shown, and if approved by the customer, the proof test in conformance with 8.7g.1 may be omitted.
It shall be demonstrated that glass inside a habitable area is safe from breakage by safe life verification in conformance with 8.7b, or is contained, or that released particles are smaller than 50 µm.
Table 81: Factor on stress for sustained crack growth analysis of glass items

Duration of sustained stress event	Factor on stress
life 1 week	1,4
1 week < life 1 month	1,3
1 month < life 1 year	1,2
life > 1 year	1,1
NOTE The factor on stress is larger for shorter design life because of the flaw growth velocity sensitivity to small variations in the stress intensity

Fasteners

Fasteners smaller than diameter 5 mm (or 3/16”) shall not be used in safe life applications.
Titanium alloy fasteners shall not be used in safe life applications.
All potential fracture-critical fasteners shall be procured and tested in conformance with aerospace standards for structural fasteners or equivalent specifications agreed with the customer.

For example, LN, AIR and NAS standards, or ISO, EN and national standards which are explicitly intended for aerospace applications.

Fasteners procured and tested in conformance with aerospace standards for non-structural fasteners shall not be used.

For those secondary connections where significant redundancy exists and fatigue is not a major concern, sometimes such non-structural fasteners are applied. This is agreed with the customer on a case by case basis.

All safe life fasteners shall be marked and stored separately following NDI or proof testing.
Safe life fasteners shall be NDI-inspected by the eddy current method in the shank, head fillet, and thread areas.
The standard crack size to be considered in the thread and fillet area for the safe life fasteners, inspected as required in 8.8f, shall be a = c = 1,91 mm.

This assumes rolled thread and fillet, in conformance with 8.8c.

Application of rivets shall conform to the requirements for fail-safe items of clause 6.3.2.

Rivets are permanently deformed during their installation, and therefore cannot be adequately inspected for cracks in the installed condition.

Material selection

Materials shall be selected and controlled in conformance with ECSS-Q-ST-70 “Materials, mechanical parts and processes”.

The material selection process takes into account structural and non-structural requirements. The materials selected possess the appropriate fracture toughness, crack-growth characteristics, and structural properties, such as Young’s modulus and yield strength, in specified environmental conditions.

Where validated properties for analysis are not available, or available properties are not validated by standard or other test procedures agreed with the customer, the statistical basis for average and minimum values shall be established by tests.
For applications where failure of a material can result in catastrophic or critical hazard, alloys which possess high resistance to stress-corrosion cracking in conformance with Table 5-1 (Alloys with high resistance to stresscorrosion cracking) of ECSS-Q-ST-70-36 shall be used.

Strength, fracture and fatigue properties for a large number of aerospace materials are documented in the ESA developed materials database “FRAMES-2”, which can be obtained from Mechanical Systems Department, ESA.

Further examples of frequently used sources for material data are the Metallic Materials Handbook (DOT/FAA/AR-MMPDS) and Aerospace Structural Metals Handbook (CINDAS/ Purdue)

Quality assurance and Inspection

Overview

For quality assurance requirements see ECSS-Q-ST-20 “Quality assurance”. For materials selection and quality control requirements see ECSS-Q-ST-70 “Materials, mechanical parts and processes”.

Nonconformances

For dispositioning of nonconformances for PFCIs, a reassessment of these items to verify conformance with the fracture control requirements shall be performed.

For nonconformances control see ECSS-Q-ST-10-09.

All nonconformances which affect fracture-critical items and primary structural hardware designed to safe life principles shall be dispositioned as “major nonconformances”.

Inspection of PFCI

General

All PFCI shall be subject to an inspection programme, in order to validate the analytical life predictions and to permit hardware to be released as acceptable.
NDI shall be performed for the complete items.

The NDI to be applied to an item (or region of an item) is based on the most critical location of the item (or region of the item).

Detected defects shall be treated as specified in clause 10.7.
Inspections shall be implemented for limited life items, as needed.
Rolled threads shall not be etched.

This refers to both the inspection for cracks of safe life fasteners (where eddy current inspection is preferred in conformance with 8.8f), and penetrant inspection of other fasteners which is sometimes performed as part of process control.

Verification of structural redundancy for fail-safe items shall be performed before each flight.
Post test NDI shall be performed for all proof-tested items (where the proof test is not the NDI method).

With approval of the customer, the post test NDI can focus on areas with increased probability of defects, e.g. focusing on welds, castings, forgings, bonds, and composite parts.

Inspection of all welds shall include a search for surface flaws as well as embedded flaws.
100 % inspection of all fusion joints of pressurized lines shall be performed before and after proof test, using a qualified NDI method.

After proof testing the NDI can be limited to 100% surface flaw inspection, and re-inspection of areas with detected pores/porosity.

NDI requirements shall be stated on design and manufacturing documentation.
Inspection shall be performed by qualified personnel, certified for the relevant inspection method, in conformance with NAS 410, or EN 4179 or equivalent standard agreed with the customer.
The applied NDI procedures and the justification of their crack detection capability shall be approved by the customer.

This applies to all NDI procedures applied for implementation of fracture control, including standard NDI procedures. See also 10.4.2.1c.

Dedicated jigs, fixtures and equipment needed to perform re-inspection after delivery shall be delivered with fracture-critical items.

Inspection of raw material

Raw materials for all safe life, fail-safe and low-risk fracture items shall be inspected to ensure conformance with the general material quality specification and absence of unacceptable embedded flaws.
For metallic items, the raw material inspection shall be performed in conformance with AMS-STD-2154, Class A as a minimum.

Alternative equivalent inspection methods are subject to customer approval.

For safe life items requiring special NDI, the raw material inspection shall be performed in conformance with SAE AMS-STD-2154, Class AA as a minimum.
The hardware developer of composite, bonded and sandwich items shall enforce a rigorous programme to control contamination and foreign object debris (FOD) during processing.
Glass items shall be inspected and proof tested in conformance with clause 8.7.
Other non-metallic items shall be inspected and proof tested in conformance with clause 8.5.

Inspection of safe life finished items

Inspection of all finished safe life items by the NDI method relevant to the assumed initial flaw size shall be performed.
Metallic safe life items shall be inspected in conformance with clause 10.4.
Items to be inspected using penetrant, shall have their mechanically disturbed surfaces etched prior to inspection.

See also clause 10.4.3.2 for the case of standard penetrant NDI.

Where etching or inspection cannot be performed on the finished part, that etching and penetrant-inspection shall be performed at the latest practical stage of finishing.

For example, before final machining of parts with precision tolerances, or at the assembly level before holes are drilled.

Composite, bonded and sandwich safe life items shall be inspected and proof tested in conformance with clause 10.5.
Safe life items made of glass shall be inspected and proof tested in conformance with clause 8.7.
Safe life items made of other non-metallic materials shall be inspected and proof tested in conformance with clause 8.5.
For transparent optical elements, a standard initial crack size of 2,54 mm length shall be used when visual inspection with 10 times or higher magnification is performed with lighting applied at right angles to the actual flaw orientation.

1 Example of such transparent optical elements are windows and lenses.
2 This visual inspection method detects both surface and embedded flaws.
Except for glass items, visual inspection shall not be the only NDI.

Non-destructive inspection of metallic materials

General

Non-destructive inspection (NDI) levels shall be categorized as standard NDI, special NDI or proof testing NDI.
The responsible for planning, definition and supervision of special NDI activities shall have a qualification level 3 in conformance with NAS 410 or EN 4179.

NDI categories versus initial crack size

Standard NDI

The initial crack sizes and geometries as defined in Table 101 shall apply for standard NDI of metallic materials.

Initial crack geometries are shown in Figure 101, Figure 102 and Figure 103.

For the standard NDI level of inspection one or more of the following standard industrial NDI techniques applied to metallic materials shall be used:
Fluorescent penetrant

X-ray

Ultrasonic

Eddy current, or

magnetic particle.

Implementation of standard NDI on metallic parts based on the crack sizes of Table 101 may be performed without a formal demonstration of the crack detection capability specified in 10.4.2.1d.

The crack size data in Table 101 are based principally on NDI capability studies that were conducted on flat, fatigue cracked panels. When the component’s geometrical features, such as sharp radii, fillets, recesses, surface finish and cleanliness, material selection, reduced accessibility and other conditions can influence the detection capability of the applied standard NDI method, the method is evaluated based on similarity with proven applications or demonstration testing on a small number of samples representative of the minimum detectable crack size. This is done to ensure that the detection capability of the applied standard NDI inspection is not influenced.

Standard NDI shall be performed in conformance with MIL-HDBK-6870.
Standard NDI shall provide crack detection to at least 95 % confidence and 90 % probability level.

Table 101 gives, for various NDI techniques and part geometries, the largest crack sizes that can remain undetected at these probability and confidence levels.

Radiographic NDI standard flaw sizes (that are only applicable for flaw orientation in the X-radiation plane) shall not apply to very tight flaws.

For example, tight flaws are: forging flaws, heat treatment induced flaws, welding induced cracks, fatigue cracks, flaws in compressive stress field.

For tight flaws referred to in 10.4.2.1f, special NDI requirements shall apply as defined in 10.4.2.2.

Special NDI

Special NDI shall be used only in special cases where limited life is demonstrated for standard initial crack sizes and serious problems can occur as a result of redesign or acceptance of the limited life, and its application is subject to approval by the customer.
A statistical demonstration of 90 % probability of detection with 95 % confidence shall be performed for the special NDI method.

The demonstration is specific to the relevant procedure, part and individual inspector.

The demonstration specified in 10.4.2.2b shall be carried out on specimens representative of the actual configuration to be inspected.
For NDI processes which are fully automated, the statistical demonstration of 10.4.2.2b may be replaced by verification by test of process parameters and their tolerances which can affect the sensitivity.

For example, automated eddy current scanning.

In the verification by test specified in 10.4.2.2d, a minimum of 5 samples shall be used, which cover the full range of parameters of the cracks to be detected by the automated process, in combination with the structural details to be inspected.

Crack Screening Proof Test

Where proof testing of a flight item is performed as a screening or inspection technique for cracks, which are larger than the initial cracks used in the analytical life prediction, in the proof tests performed, procedures and stress analysis predictions shall ensure that the predicted stress level and distribution are actually achieved, and that the absence of test failure ensures that the cracks of the sizes to be screened out are not present in any critical location or in any orientation of the item.
Where proof testing of a flight item is performed as a screening or inspection technique for cracks, which are larger than the initial cracks used in the analytical life prediction, cracks screened by proof test shall have aspect ratios identical to the initial cracks applied in the analytical life prediction.
Where proof testing of a flight item is performed as a screening or inspection technique for cracks, which are larger than the initial cracks used in the analytical life prediction, the justification of the proof test procedure shall be provided, which includes all effects that can affect the proof test definition, including as a minimum:

Potential of stable crack growth beyond the crack size to be screened during the proof test.

This results in unacceptable degradation of the flight hardware.

Weld and parent material inhomogeneities if welds are present.
Environment, if testing and operations are at different environmental conditions. Where proof testing of a flight item is performed as a screening or inspection technique for cracks, which are larger than the initial cracks used in the analytical life prediction, proof test procedures shall be submitted to the customer for approval prior to the start of testing.
1 Proof testing can result in the application of loads substantially in excess of those usually imposed on flight hardware in order to screen for cracks of sufficiently small size. This can result in significant risk to damage and reject otherwise acceptable hardware.
2 Requirements for crack growth and critical crack size analysis are specified in clause 7. A significant amount of test data can be necessary to validate or complement the analysis results in order to limit the risk of damage to flight hardware. Advanced non-linear fracture analysis methodology is normally applied to accurately predict the behaviour of cracks under proof loading, except for e.g. thick-walled items with part-through cracks where the minimum remaining ligament (material thickness ahead of crack tip) is greater than 2,5 (K1c/ y)2. A crack screening proof test of thin-walled items is generally not recommended because of the increased risk of damage due to stable crack growth during the proof test.
Table 101: Initial crack size summary, standard NDI

NDI method	Crack location	Part thicknesst[mm]	Crack configuration number(see NOTE 1)	Crack type	Crack deptha[mm]	Crack lengthc[mm]
Eddy current NDI	Open surface	t  1,27t  1,27	41, 3, 8	through surface	t0,511,27	1,272,541,27
	Edge or hole	t  1,91t  1,91	5, 92, 7	through corner	t1,91	2,541,91
	Cylinder	N/A	10	surface	see NOTE 2	1,27
Penetrant NDI Sensitivity Level ≥3	Open surface	t  1,271,27  t 1,91t  1,91	441, 3, 8	throughthroughsurface	tt0,811,91	2,543,82 - t4,051,91
	Edge or hole	t  2,50t  2,50	5, 92, 7	throughcorner	t2,54	2,542,54
	Cylinder	N/A	10	surface	see NOTE 2	1,91
Penetrant NDI of titanium alloys, welds and Sensitivity Level < 3 for all other materials	Open surface	t  3,0t  3,0	41, 3, 8	throughsurface	t3,001,50	3,003,007,50
	Edge or hole	t  3,0t  3,0	5, 92, 7	throughsurface	t3,00	3,003,00
	Cylinder	N/A	10	surface	see NOTE 2	3,00
Magnetic Particle NDI	Open surface	t  1,91t  1,91	41, 3, 8	throughsurface	t0,971,91	3,184,783,18
	Edge or hole	t  1,91t  1,91	5, 92, 7	throughcorner	t1,91	6,356,35
	Cylinder	N/A	10	surface	see NOTE 2	3,18
Radiographic NDI	Open surface	0,63  t 2,72t  2,72	1, 2, 3, 7, 8	surface	0,7  t0,7  t	1,910,7  t
Ultrasonic NDI	Open surface	t  2,54	1, 2, 3, 7, 8	surface	0,761,65	3,811,65
NOTE 1 The crack configuration numbers refer to the crack configurations shown in Figure 101, Figure 102 and Figure 103. NOTE 2 For cylindrically shaped items (see Figure 103) the crack depth a can be derived from the crack length c of this table for a/c = 1,0 with the following formula: Exception: fastener thread and fillets, see clause 8.8.

Inspection procedure requirements for standard NDI

Standard radiographic NDI

Radiographic inspection for the detection of volumetric flaws shall be performed in conformance with ASTM E 1742.
The radiographic quality level shall be equal or better than 2-1T (clause 6.9 of ASTM E 1742).
The radiation of the beam shall be within 5 of the orientation of the plane of the crack to be detected.

Radiographic exposures at different orientations can be needed to ensure that the complete volume of an item is sufficiently inspected for potentially critical cracks that can be in a wide range of orientations.

Standard penetrant NDI

Penetrant NDI standard flaw sizes shall only be applied to fluorescent dye penetrants of level 3 sensitivity or better as defined in ASTM E 1417 or SAE AMS 2644.

Fluorescent penetrants of level 2 sensitivity or better as defined in ISO 3452-2 can be considered equivalent.

For metals other than titanium, inspected with fluorescent penetrant to less than level 3 sensitivity as defined in 10.4.3.2a, the standard crack sizes of Table 101, defined for titanium alloys shall be applied.
All machined, or otherwise mechanically disturbed surfaces, to be penetrant inspected, shall be etched to assure removal of masking material prior to penetrant application for all processes and materials, where masking can appear.
For welds, the standard crack sizes of Table 101, defined for titanium alloys, shall be used in all cases, unless the weld surface is smoothened after welding to a level agreed with the customer.

Limited verification of the crack detection capability of the actual weld inspection can be appropriate. See also 10.4.2.1c.

Interface surface finish shall be Ra=3,2 m or lower.

Standard ultrasonic NDI

Ultrasonic inspection shall be in conformance with SAE AMS-STD-2154 Class A as a minimum.
Linear discontinuities of any length shall not be accepted.
Ultrasonic inspection shall be performed using longitudinal or shear waves, applied via unobstructed bare flat surfaces, at right-angles to all possible orientations of the cracks to be detected.
Interface surface finish shall be Ra=3,2 m or lower.
Ultrasonic inspection for surface or embedded flaws in welds or in parent material surrounding the welds shall be in conformance with ASTM E 164.

Standard eddy current NDI

Eddy Current inspection shall be in conformance with ASTM E 426 or a standard approved by the customer.
A minimum signal-to-noise ratio of 3:1 shall be achieved for standard NDI.
For automated inspection or inspection with signal recording and analysis a reduction of this ratio, as approved by the customer, may be applied.
The interface surface finish shall be Ra = 3,2 m or lower.

Standard magnetic particle NDI

Magnetic particle inspection shall be in conformance with ASTM E 1444.
The wet process, continuous method technique, with fluorescent particles shall be used.
Interface surface finish shall be Ra = 3,2 m or lower.
Figure 101: Initial crack geometries for parts without holes

Figure 102: Initial crack geometries for parts with holes

(10)

Figure 103: Initial crack geometries for cylindrical parts

NDI for composites, bonded and sandwich parts

General

The standards EN 4179 or NAS 410 shall be applied for all NDI methods explicitly addressed by these standards.

If NDI methods are used which are not explicitly addressed by EN 4179 or NAS 410, apply clause 10.5.2.2.2a.

The inspectors shall be certified to at least level 2 for the NDI method used.
The NDI procedure shall be approved by a level 3 inspector.
The capability of each applied NDI shall be demonstrated by the supplier in conformance with clause 10.5.2.2.

The concepts of standard NDI and special NDI are not applicable for composite, bonded and sandwich parts.

Inspection requirements

Close visual inspection

The maximum distance to perform the inspection shall be 0,3 m;
An inspection procedure shall be written, which specifies:

Access requirements
Distance between eyes and inspected area
Optimum lighting
Cleaning
The location of the successive inspected area
The minimum inspection time needed to inspect each area.

A formal statistical capability demonstration of the detectability of the VDT by means of close visual inspection is not needed, but the procedure is agreed between customer and supplier.

When an indication is found, optical magnification (lenses) and other NDI methods shall be applied to determine whether it or not to consider it as a detected defect in conformance with 10.7.

NDI methods other than close visual inspection

General

Applied NDI methods shall provide crack detection to at least 90 % probability level (confidence level 95 %) in conformance with 10.5.2.2.1b.
The capability of an NDI method (i.e. the reliably detectable defect size) shall be demonstrated by test on specimens with induced defects.
Specimens with induced defects shall be used in the inspection procedure as standard for calibration.
The capability of the inspection method shall be investigated on at least 5 specimens in order to analyse all defect parameters.

1 Defect parameters to be investigated include defect type, position, size, shape and orientation.
2 Depending on e.g. the complexity of the item to be inspected and the criticality of the defects to be found the number of samples to be used can be significantly higher than 5.
The cases where proof test monitoring by acoustic emission can be performed instead of post testing NDI shall be agreed with the customer.

The proof test can be used to screen for manufacturing defects as specified in clause 8.4.4.2.

Other NDI methods but those addressed in EN 4179 or NAS 410

In the cases other than those addressed by 10.5.1a, the procedure shall be written by an expert for the NDI method.

For example, the procedure can be written by an operator practicing this method.

In the cases other than those addressed by 10.5.1a, the procedure shall be approved by a level 3 inspector for a similar NDI method covered by EN 4179 or NAS 410.

1 The certification of the level 3 inspector can be considered similar when obtained for a method applicable to composite parts and based on the most similar physical principle.
2 For example, X-ray certification for tomography method.
In the cases other than those addressed by 10.5.1a, the procedure shall be based on the same rules as those used for NDI methods explicitly addressed by the standards EN 4179 or NAS 410.
In the cases other than those addressed by 10.5.1a, the implemented NDI method shall be documented and the physical principles used explained.

Traceability

General

Traceability of PFCI and the materials they are made of shall be implemented in conformance with ECSS-Q-ST-20 to provide assurance that:

The material used in the manufacture of structural hardware has properties fully representative of those used in the analysis or verification tests.
Structural hardware is manufactured and inspected in conformance with the specific requirements for the implementation of the fracture control programme.

Requirements

All associated drawings, manufacturing and quality control documentation shall identify that the item is a potential fracture-critical item (unless when it is a fail-safe or low-risk fracture metallic item) or a fracture critical item.
Each fracture-critical item shall be traceable by its own unique serial number.
Each fracture-critical item shall be identified as fracture-critical on its accompanying tag and data package.
For each fracture-critical item a log shall be maintained, which documents the environmental and operational aspects (including fluid exposure for pressure vessels) of all storage conditions during the life of the item.
For each fracture-critical item a log shall be maintained, which documents all loadings due to testing, assembly and operation, including pressure cycles and torqueing of fasteners.

Detected defects

General

Safe life and fail safe items with detected defects with a size larger than the following, shall be subjected to additional verification requirements as defined in clause 10.7.2:
The acceptance criteria used in the manufacturing process; or

50 % of the maximum allowed detectable NDI size in any dimension; or

50 % of the standard NDI size defined in Table 101, for metallic materials

1 Acceptance criteria for flaws in the manufacturing process ensure that material property values are not reduced below the qualified minimum values used for design.
Detailed requirements for acceptance criteria for flaws other than crack-like defects are not within the scope of this ECSS standard.
2 For example, definition of acceptance criteria for defects includes consideration of ultimate strength, fatigue life, leakage.
Any PFCI containing detected defects shall not be used without approval of the customer.
1 The first option to be considered when a defect is detected in flight hardware is to remove or repair the defect.
2 For highly critical hardware (especially when used for manned spaceflight), more conservative verification methodology can be requested by the customer (see e.g. NASA-HDBK-5010).
Low risk fracture items shall not contain detected defects.

Acceptability verification

Safe life parts with a detected defect

General

The detected defect shall be verified as crack-like defect, and a fracture mechanics analysis or test performed to verify the acceptability of this defect.

Only in the case of a well-known type of defect (e.g. pores) for which a data base of representative test data is available, an assessment without replacing the defect by a crack can be used.

The analysis or test shall be performed as follows:

Define the dimensions and location of the detected defect conservatively (e.g. for a surface crack the length and depth).
In the case of irregular defect shapes or grouped defects, make a recharacterisation for the analytical prediction (in the case of metallic part) or for test with induced defect (for metallic or composite part).

For metallic parts, flaw characterization as proposed by BS 7910 or ASME boiler and pressure vessel code Section XI, article IGA-3000 can be applied.

Demonstrate by analysis that the stresses used are conservative.

Improved analysis methods, which are subjected to customer approval, can be needed to achieve this.

There shall be no indication that the cause of the defect affects the validity of the material properties used in the safe life verification.
The analysis or test shall demonstrate ultimate load capability at the beginning of life.

For metallic parts

The safe life crack growth analysis shall be performed as specified in 7, with the complete load spectrum applied 6 times in sequence.
Cases where the analysis specified in 10.7.2.1.1a can be replaced by a representative fatigue test of a part containing a representative defect other than a crack shall be agreed with the customer.

This is agreed only in the case of a well-known type of defect.

The fatigue test specified in 10.7.2.1.2b shall demonstrate limit load capability after application of the complete load spectrum 6 times in sequence.

For composite, bonded and sandwich parts

The safe life verification shall be performed in conformance with clause 8.4.

Fail safe parts with a detected defect

The part shall meet the requirements in 6.3 for safe parts using the detected defect in conformance with 10.7.2.2b.
For the verification of 10.7.2.2a, the detected defect shall be assumed in the most unfavourable situation.

1 This means the situation where the choice of the failed part places the detected defect in the most unfavourably loaded remaining part.
2 This includes fatigue, verification, considering the detected defects. Alternatively, it can be demonstrated that the structure can withstand the failure of any other part, in addition to failure of parts containing detected defects (using safety factors as specified in 6.3.3, and without considering a defect in the remaining structure).
For metallic parts the detected defect shall be verified as crack-like defect, and a fracture mechanics analysis or test shall be performed to verify the acceptability of this defect.

Only in the case of a well-known type of defect (e.g. pores) for which a data base of representative test data is available, an assessment without replacing the defect by a crack can be used.

For composite, bonded and sandwich parts the fatigue verification shall be based on tests of representative defects.

Improved probability of detection

If the origin of a detected defect is not uniquely determined and eliminated, and regular occurrence of significant crack-like defects is not excluded by means of improvement of the manufacturing process, an improved NDI method approved by the customer shall be used, such that it provides a probability higher than 90% of detection of unacceptable defects.

Reduced fracture control programme

Applicability

As specified in 5.1 for unmanned, single-mission, space vehicles and their payloads, and for GSE, a reduced fracture control programme (RFCP) as defined in this clause can be implemented, instead of the general fracture control programme.

Requirements

General

A reduced fracture control programme shall be in conformance with all the requirements given in this standard, with the modifications specified in 11.2.2.

Modifications

Identification of PFCIs

The identification of PFCIs may be limited to the following items:

Pressurized systems.
Rotating machinery.
Fasteners used in safe life applications.
Items fabricated using welding, forging or casting and which are used at limit stress levels exceeding 25 % of the ultimate tensile strength of the material.
Non-metallic structural items.
Metallic structural items used in safe life applications, with limit stress levels exceeding 50% of the yield tensile strength of the material.
1 When approved by the customer, the scope of this requirement can be reduced to single point of failure items loaded in tension with relatively small cross-section (examples: lugs, iso-static mounts, small strut or pin, GSE interface).
2 For PFCIs, see 6.1.
The identification of potential fracture-critical items shall be performed in conformance with the procedure given in Figure 51.

Documentation requirements

The information specified in clause 6.4.2 may be consolidated into one list; separate lists need not be prepared.

Glass and non-metallic items other than composites, bonded and sandwich items

The requirements of clauses 8.5 and 8.7 may be replaced by the following requirement: structural glass and other non-metallic items (other than composites, bonded and sandwich items) shall be proof-tested at 1,2 times the limit load.

It is well-known that glass and other brittle items subjected to static load can be sensitive to growth of inherent flaws (i.e. static fatigue). This effect is normally considered in the structural verification, taking into account empirical data (e.g. statistical methods, taking into account the surface roughness of the item).

Rotating machinery

The requirements of clause 8.6 may be replaced by the following requirement: ‘rotating machinery (wheels and gyros) shall be proof-spin-tested at one and one tenth (1,1) times nominal operational speed.

ANNEX(informative)The ESACRACK software package

The ESACRACK software package is intended to be used for damage tolerance analysis of spaceflight vehicles and payloads as well as ground support equipment. The package consists of various analysis tools that enable the user to:

Generate load and stress spectra (ESALOAD)

Perform fracture mechanics analysis (NASGRO® module NASFLA)

Generate stress intensity factor solutions (NASGRO® module NASBEM)

Process crack growth material data (NASGRO® module NASMAT)

Perform fatigue analysis (ESAFATIG).

The flight load spectra distributed with ESACRACK have been derived for payloads of the NSTS, and cannot be used for other structures without adequate verification.

The software package ESACRACK can be obtained from Mechanical Systems Department of ESA.

The data contained in the standard materials data bases provided with the NASGRO and ESAFATIG software, and the stress intensity and net section stress solutions implemented in the NASGRO software, are generally acceptable for fracture control analysis. The judgement of the applicability of these data for the actual hardware remains the responsibility of the user of the software, however.

The material data in the NASGRO database are mean or typical values, and a reduction as specified in clause 7.2.5 is therefore applied for the toughness parameters. A reduction option is implemented in older versions of the ESACRACK software.

Caution: The NASGRO software offers a number of advanced analysis options which are potentially unconservative and not allowed by this standard, or require specifically validated material data (e.g. retardation models like the strip-yield model, elastic-plastic analysis, shakedown analysis). Application of such options is normally subject to customer approval.

In some cases (e.g. for fracture analysis of detected cracks, for determination of defect acceptance criteria or proof test crack screening capability, or for crack growth prediction where the spectrum can cause acceleration of crack growth) the application of such advanced options in NASGRO or other fracture analysis software can be necessary.

ANNEX(informative)References

[R1] Broek, ‘The practical use of fracture mechanics’, 1989, Kluwer, ISBN 90-247-3707-9.

[R2] Berger, Blauel, Pyttel & Hodulak, ‘FKM Guideline – Fracture Mechanics Proof of Strength for Engineering Components’, 2nd revised edition, 2004, VDMA Verlag GmbH, ISBN 3-8163-0496-6.

[R3] Sierakoswki & Newaz, ‘Damage tolerance in advanced composites’, 1995, Technomic Publishing, ISBN 1-56676-261-8

[R4] ‘Aerospace Structural Metals Handbook’, CINDAS/Purdue University

[R5] Saxena ‘Nonlinear Fracture Mechanics for Engineers’, 1998, CRC Press, ISBN 0-8493-9496-1

[R6] Chell, McClung, Kuhlman, Russell, Garr, Donnelly, ‘Guidelines for Proof Test Analysis’, 1999, NASA/CR-1999-209427

[R7] McClung, Chell, Lee, Russell, Orient, ‘Development of a Practical Methodology for Elastic-Plastic and Fully Plastic Fatigue Crack Growth’, 1999, NASA/CR-1999-209428

Bibliography

ECSS-S-ST-00	ECSS system – Description, implementation and general requirements
ECSS-Q-ST-10-09	Space product assurance Nonconformance control system
ISO 3452-2	Non-destructive testing Penetrant testing Part 2: Testing of penetrant materials
NASA-HDBK-5010	‘Fracture control implementation handbook for payloads, experiments, and similar hardware’, 2005, NASA
MIL-HDBK-17	Composite Materials Handbook
BS 7910	Guide on methods for assessing the acceptability of flaws in metallic structures