 · Home· Table of Contents · Aerospace | From 'Safe Life' to Fracture Mechanics - F111 Aircraft Cold Temperature Proof Testing at RAAF Amberley.Gerard Redmond, BAppSc, MSc (Eng), DIC, MRAeSMaterials Officer NDTSL-DGTA RAAF Base Amberley, QLD. Contact |
F111 was one of the first aircraft designed for "Safe Life" as a result of the Aircraft Structural Integrity Program in the USA (1956). However, following several early aircraft losses, it was realised that relatively small flaws escaping detection during NDI at manufacture could lead to catastrophic failure in the highly stressed, high strength steel structure following a period of fatigue growth in a very short time frame. This led to the application of fracture mechanics principle to aircraft design and was used in the F111 recovery program in the form of the cold proof test. At the test temperature of - 40°C, the fracture toughness of the steel is reduced so that at critical load, small flaws undetectable by NDI can cause catastrophic failure. If the aircraft does not fail, then fracture mechanics principles can be used to predict a period of safe operations before the "proof test" flaw size grows to critical flaw size under normal operating conditions. F111 is the only aircraft ever built to depend for safety of operation on this test. This paper will briefly describe the history and technical basis for the Cold Proof Test, shortly to be established at RAAF Amberley.
Keywords: Aircraft Design, Fatigue, Safe-Life, Fracture Mechanics, Cold Proof Test.
During pull-up from a rocket-firing pass at Nellis Airforce Base, Nevada, December 1969, an F111A experienced catastrophic failure of the left wing. The subsequent investigation determined that the failure initiated at a pre-existing manufacturing flaw in the lower plate of the wing pivot. The flaw was due to a forging fold in the high strength, D6ac steel forging which makes up the bottom plate. The flaw had passed undetected through inspections at manufacture and grew to critical size after only 100 flying hours[1].
The F111 had been based on the "safe life" design philosophy which had developed immediately after the war years in an effort to take into account cyclic stresses which lead to fatigue of airframes. The advent of the "cold war" led to efficient airframe requirements with materials "pushed" closer and closer to their limits. At first, fatigue failures on these aircraft (i.e. B47, Comet) were attributed to poor static design. As the nature of fatigue in airframe structures became more understood, it was realised that even a "correctly" designed airframe from a static load consideration would not necessarily reach its design life because of cyclic loading leading to fatigue[2].
The "safe life" approach was introduced as the result of the Aircraft Structural Integrity Program (ASIP) whose primary aim was to take into consideration the effects of cyclic loading on the airframe. Safe life involves rigorous fatigue testing of a full, representative airframe and certain components and subassemblies for 40,000 hours "ensuring" a safe life of 10,000 hours in the case of the F111. The 4x-safety factor was to take into account unknowns, assumptions and variables applicable to the fleet as a whole.
The safe life approach however, does not take into account that high strength steel of limited toughness is used in critical, highly stressed parts of the structure. Steel in this category can fracture under load in the presence of relatively small defects, introduced at manufacture or during service. While the ASIP requirement "proves" the overall airframe design for a certain safe fatigue life, it does not take into account the effect of a single "rogue" defect, introduced in a particular airframe at manufacture, and escaping non-destructive inspection (NDI). Thus the overall design in fatigue situations may be acceptable in accordance with the ASIP requirement, but unforseen, small, random flaws can undermine this and cause failures well below the "safe life", as occurred at Nellis.
The F111 aircraft were "mothballed" in response to the early failures and an advisory committee set up by the US government to look at the problem. Eventually, the committee came up with the idea of using fracture mechanics (already in use in missile technology at the time). Fracture mechanics directly addresses the problem of the effect of a small flaw and the toughness of the material to predict time to failure at a given stress level. This is exactly what the problem of the F111 high strength steel structure called for[3].
However, the F111 was already designed and built - in effect, it was too late for the new design approach which its failures had led to. Little could be done to change materials and stresses to reduce the airframe sensitivity to small, random flaws in the high strength steel components.
There was also another problem: most of the steel primary structural members of concern are located in areas of very limited accessibility. Furthermore, the "state of the art" of non destructive inspection techniques at the time were inadequate to reliably find randomly oriented, randomly located manufacturing flaws. What was needed was a "global" test or method, able to completely interrogate all the areas of the complex steel structures concerned for the presence of small flaws. There was only one viable option to fulfill these requirements and ensure the integrity of the airframe - a low temperature "cold" proof test.
The cold proof test has sometimes been considered as a "desperation measure" by General Dynamics in order to recover the F111 aircraft[3]. It is true that the test was most probably the only practical option left to ensure airframe integrity. However, it is far from a desperation measure. In fact, the cold proof test was established using the principles of fracture mechanics (thus enabling this approach to be used, if not directly in the design, then into the successful recovery of the aircraft). At once, the cold proof test enables the evaluation of the current structural integrity of the airframe in a global fashion, while enabling the prediction of a period of safe life operation before another inspection, or cold proof test is required. It therefore becomes part of a fracture control program for the aircraft through life of type.
The philosophy of cold proof testing is rooted in that theory of fracture mechanics which is the science of predicting the behaviour of materials in the presence of flaws such as manufacturing defects, fatigue cracks etc. Fracture mechanics has the capability to predict the sizes of flaws necessary to cause component failure when exposed to a given level of stress. As the stress increases, the flaw size that would cause failure (called the critical size) will decrease. The proof test philosophy, then, is to apply a high as stress as possible, without creating other problems such as yielding or secondary structural damage, which, if the structure survives, will allow quite a reliable determination of the largest sizes of flaws that could exist. When these "proof test" flaw sizes are less than the critical sizes required to cause failure during normal operational loads, then the fracture mechanics analysis procedures can predict a period of safe operations before another inspection, or proof test, will be required. Also, for steel material, the critical flaw size will decrease as the temperature decreases. The material essentially becomes more brittle: or more technically, the cold temperature reduces its fracture toughness. Therefore, F111 proof tests are accomplished at minus 45°F to provide further reduction in the proof test critical flaw sizes. An aircraft which does not produce a failure at the low temperature is guaranteed (with 100% certainty) not to have a flaw that is larger than the low temperature critical crack size (i.e. as determined using the fracture mechanics equation).
The cold proof test facility is specifically designed for the F111 aircraft - it never has and most likely never will be used for any other aircraft. It consists of a large structural steel test fixture, to hold the aircraft firmly and react the test loads which are applied to the aircraft through hydraulic rams. The hydraulic load system is computer controlled and incorporates sophisticated control and safety systems to prevent overload of the airframe during failures or system malfunctions. The system has the ability to "dump" up to 130,000 psi of force almost instantaneously as a failure is detected by a load cell feed back loop. The cold temperature is achieved by the use of liquid nitrogen that is vaporized to form gaseous nitrogen after being poured into the test chamber plenium ducts. Fans are used to circulate the cold nitrogen around the airframe. The test facility building itself is highly insulated to facilitate the environmental control requirements.
The F111 cold proof test procedure is divided into four major elements:
1. Pre-test inspection.
Conceptually, the proof test is intended to detect defects in airframe locations where inspection by other means is impractical, or to find defects in areas where defects are not expected to exist. Since these defects are found when the airframe component fails catastrophically under the test, it is extremely prudent to thoroughly inspect the airframe before the test using the best, up to date non destructive inspection techniques and methods available to prevent unnecessary failures. Pre-test inspection is focused on known critical areas and any defects or cracks found are repaired before the aircraft goes to the cold proof test.
2. Aircraft preparation.
The aircraft is tested in the fully assembled (operational) condition with load fixtures and all of the instrumentation required for the test attached to the airframe. The aircraft is pushed back into the facility and attached to the test fixture.
3. Cool down.
Liquid nitrogen is pumped into the plenium chambers from a large tank outside the facility to initiate the cool down process. 6000 gallons is used for each test. The cool down is carefully monitored and controlled from the control room until the chamber temperature is brought down to minus 65°F. Using thermocouples attached deep within the critical components of the airframe, the chamber and structure temperatures are eventually stabilised at between minus 43°F and minus 47°F. (Note: there is sometimes the misconception that the cold temperature is intended to simulate environmental conditions at high altitude. This is not the case - indeed , although the air temperature at 40,000 feet may be of the order of minus 40°F, the aircraft "skin" actually gets quite hot due to air friction with the effect that the steel deep within the airframe never really cools down).
4. Load application.
Once the temperature of the airframe has stabilised, the loads are then applied under four distinct wing pivot settings:
| Wing position | Load condition |
| 56 degrees | -2.4 g |
| 56 degrees | +7.33 g |
| 26 degrees | -3.0 g |
| 26 degrees | +7.33 g |
5. Post test inspection/Restoration.
Acoustic emission data is analysed to determine if any significant sounds were generated during the test. If any sounds are considered to be indicative of system or structural failures, the position of the sound source are identified by the computer and an inspection carried out in that area by maintenance personnel. The test fixtures and other test equipment is then removed and the aircraft returned to the maintenance facility for continued preparations and procedures required prior to return to the operating squadron.
As well as the cold proof testing carried out as part of the "recovery program" involving all of the aircraft grounded and mothballed following the Nellis crash in 1969 (including the aircraft for the RAAF), several other programs have been concluded. A further program will continue on the current RAAF F111 fleet. These programs are a follows:
a. Production proof testing.
Technically identical to the recovery test, production proof testing was carried out at Fort Worth on all aircraft produced subsequent to the 1969 grounding (in all, 556 F111 aircraft encompassing all model variants were produced in Fort Worth by General Dynamics, the last being delivered to the USAF in 1979).
b. Phase II Structural Inspection Program (II-SIP)
II-SIP was the second application of cold proof testing to the F111 fleet, starting in 1973 and finishing in 1983 and carried out at Sacremento Logistics Centre (SM-ALC), USA. II-SIP included the same two recovery test program conditions, plus a +7.3g condition with the wings moved forward to 26 degrees. This condition allowed the application of higher stresses in the wing carry through box lower plate to cover a stress corrosion failure in this region discovered during the recovery-testing program. This was one of the first of several modifications introduced over the years to incorporate the detection of in-service induced flaws to the overall cold proof test objectives. The time interval between the first tests was calculated by using fracture mechanics crack growth analysis based on usage spectrum data from F-105 Southeast Asia experience (F-111 flight recorder data did not exist at that time). The intervals were either 1500, 2000 or 2500 hours depending on model. The RAAF F111C cold proof test interval is 2000 hours.
c. Phase III Structural Inspection Program (III-SIP).
Third cycle of cold proof testing, starting in 1986 for the USAF, 1989 for the RAAF aircraft and completed in 1998 shortly before the closure of SM-ALC. III-SIP includes the II-SIP test conditions, plus a -3.0g test condition with wings swept forward at 26 degrees. This was to allow testing of those high strength steel members that are loaded in compression during positive g manoeuvres. It evolved in response to failures during II-SIP from fatigue cracks in the wing pivot fitting upper plate.
d. Phase IV Structural Inspection Program (IV-SIP).
There have been no further incidents from III-SIP to warrant any changes to the IV-SIP test conditions. IV-SIP was started at SM-ALC in 1993 for USAF F111E aircraft. IV-SIP will be carried out on RAAF aircraft at Amberley, the first test being scheduled in June, 2001.
There have been eleven major failures during F111 cold proof tests in USAF and RAAF aircraft. These failures do not include occasional failures of bolts, secondary structure and aluminium components which, though individually important, were not significant to the overall test objectives. Only the RAAF aircraft failures will be discussed briefly here.
a. 1981:
The four F-111A models converted to F111Cs to replace original aircraft loses by the RAAF were cold proof tested as part of the conversion effort. The first aircraft experienced catastrophic failure of the wing pivot fitting due to fatigue cracks in the No.2 upper surface stiffener run-out. This failure resulted in a fleetwide inspection and the instigation of a standard NDI inspection during depot maintenance.
b. 1982:
Repeat of 1981 failure on RAAF F111C due to fatigue crack in the run-out being missed during RAAF depot maintenance inspection. The NDI procedure was revised and a boron doubler reinforcement of the upper plate area was designed and applied. There have been no further failures in this area.
c. 1991:
RAAF F111C horizontal stabiliser pivot shaft failed from a fatigue crack at the base of a manufacturing tooling location hole. The crack was missed during NDI inspection of the hole, but it was shown that the configuration of the tooling hole, and machining marks in the area contributed to both the existence of the crack and its being missed during inspection. Rework procedures are now applied to the base of the hole to create a better structural configuration and improve the inspectability.
Any one of the eleven cold proof failures could have caused catastrophic, in-flight failure had they not been discovered, resulting severe impact on operational readiness and doubt about structural integrity of the F111 airframe.
The F-111 cold proof test program has proven its capability of finding very small flaws resulting from either original manufacturing processes, or from in-service usage. Over the period of eleven proof test failures, there have been no in-flight structural failures.
As the fleet ages, the cold proof test will become even more important for ensuring that critical flaws do not threaten the safety of the aircraft. The fact that the cold proof test can identify failure sites not previously recorded (and therefore not regularly inspected by NDI), particularly in an aging airframe, posses a strong augment for the continuation of the program.
On a final note, it should be emphasized that the cold proof test is only a part (albeit very important) of the overall fracture control program of the RAAF F111 aircraft fleet. As well as using fracture mechanics principles to evolve the cold proof test strategy, the same principles were applied retrospectively to the critical parts of the airframe in what became known as the Durability Assessment and Damage Tolerance Assessment (DADTA) program. This allowed for the establishment of crack growth data and NDI inspection intervals for 100 critical parts of the structure. In parallel with this, NDI techniques have been developed and improved dramatically to allow for the reliable inspection of smaller and smaller defects. The development of the magnetic rubber technique which, under some circumstances, can detect a flaw of 0.010 inches in length, is a good example of this development.
| © AINDT , created by NDT.net | |Home| |Top| |