Understanding the "Limit-of-Validity (LoV)": Airplane Life

Limit-of-Validity (LoV) is the airplane operational life during which it is demonstrated that Widespread Fatigue Damage (WFD) will not occur in airplane.

But what does this actually mean? To grasp the essence of Limit-of-Validity (LoV), let's delve into the evolution of aircraft structural design philosophies, shaped by historical accidents.

Whenever an airplane takes-off, it is subjected to cyclic loads (also known as repeated loads) along with other forms of loads. These cyclic loads on airplane are inevitable during airplane’s flight, and they are termed as “Fatigue”. The damage caused by fatigue loads is called “fatigue damage”. The probability of fatigue damage in airplane structure increases with the airplane utilization. This fatigue damage is progressive in nature as it initiates as minor cracks and grow under repeated loads.

Historically airplanes were designed, starting from the Wright Brothers era in 1903, without considering the fact that “damage” may occur to airplane during its operation”. However, fatal aircraft accidents in history prompted a paradigm shift in the aircraft structural design. For example, the fuselage of Comet airplane was exploded during its cruise in year 1954 (fatigue damage). Similarly, Boeing 707 was crashed in year 1977 as the right horizontal stabilizer and elevator were separated during its flight (fatigue damage). Furthermore, in 1988, Aloha airlines Boeing 737-297 experienced fuselage decompression, caused by loss of fuselage upper shell (fatigue damage).

Each of the aforementioned airplane accident served as a poignant lesson, propelling advancements in design philosophies. These lessons have paved the way for three categories of structural design concepts:

Safe-Life concept (Safety-by-Retirement):

(Introduced in CAR 4b Amendment-3 (Pre-FAA) after Comet airplane crash)

“The Safe-life is a point in the airplane’s operational life, expressed in hours or flight cycles, at which the structure must be taken out of service or replaced. The structure is retired or replaced at the safe-life to prevent the structure from developing fatigue cracks”. (FAA AC 23-13A)

Fail-Safe concept (Safety-by-Design):

(introduced in CAR 4b Amendment-3 (Pre-FAA) after Comet airplane crash)

“Fail-safe is the attribute of the structure that permits it to retain its required residual strength for a period of unrepaired use after the failure or partial failure of a principal structural element”. (FAA AC 23-13A). It means the failure of one element does not cause the entire structure to fail.

Damage-Tolerance concept (Safety-by-Inspection):

(introduced in FAA FAR-25 amendment-45 after Boeing 707 crash)

“Damage tolerance is the attribute of the structure that permits it to retain its required residual strength for a period of use after the structure has sustained a given level of fatigue, corrosion, accidental, or discrete source damage”. (FAA AC 23-13A)

It should be noted that the Damage Tolerance concept is not a replacement of Safe-life and Fail-safe. A combination of Safe-Life, Fail-Safe and Damage Tolerance is needed for structural maintenance. Damage-tolerance focuses on supplemental structural inspections to detect cracks before they propagate to unsafe limits, while the fail-safe allows cracks to grow to obvious and easily detected dimensions.

In order to further proceed with the structural design details, lets define another important terminology called “Design Service Goal (DSG)”.

Design service goal (DSG):

“DSG is the period of time (in flight cycles or flight hours, or both) established at design and/or certification during which the airplane structure is expected to be reasonably free from significant cracking” (EASA AMC 20-20). DSG is not intended to limit the operation of airplane.

So, when the concepts of Safe-life and Fail-safe were initially introduced, it was anticipated that cracking in airplane, which operated up to the DSG, would initiate from a single source (e.g. from manufacturing flaw) and would occur in isolation. However, it was learnt that cracks originated from single sources grew and interacted strongly. The requirements of “Supplemental Structural Inspection Program (SSIP)” were introduced to detect all kinds of fatigue damage before they become critical in size and density. In other words, the intent of SSIP was to preclude the unsafe levels of cracking. However, the SSIPs did not prove to be fully effective in finding all forms of fatigue damages as the airplane reached and exceeded their DSG. (EASA AMC 20-20).

Having stated above, it was clear that cracks do not always originate from single source and some cracks initiate while other propagate, sometimes leading to the fracture of whole structure. This led to the use of term Widespread Fatigue Damage (WFD) as defined below:

Widespread Fatigue Damage (WFD):

(introduced in FAA FAR-25 amendment-96 after Boeing 737 Aloha crash)

“WFD means the simultaneous presence of cracks at multiple locations in the structure of an airplane that are of such size and number that the structure will no longer meet the fail-safe strength or residual strength used for the certification of that structure” (EASA AMC 20-20).

Multiple-element damage (MED) is a source of widespread fatigue damage characterized by the simultaneous presence of fatigue cracks in similar adjacent structural elements. (EASA AMC 20-20)?

Multiple-site damage (MSD) is a source of widespread fatigue damage characterized by the simultaneous presence of fatigue cracks in the same structural element. (EASA AMC 20-20)

Now that we have covered the history and concept of structural design philosophies and their evolution, it is time to explain the Limit-of-Validity.

Limit-of-Validity (LoV):?

“LoV is the period of time (in flight cycles, flight hours, or both), up to which it has been demonstrated that WFD is unlikely to occur in an airplane’s structure by virtue of its inherent design characteristics and any required maintenance actions”. (FAA AC 120-104)

So, LoV is the operational life of an airplane, unless an extended LoV is approved. To support establishment of the LoV, the design approval holder must demonstrate by test evidence and analysis at a minimum and, if available, service experience or service experience and teardown inspection results of high-time airplanes, that WFD will not occur in that airplane up to the LoV. Extension in the LoV is a Major change to the airplane Type Design. (FAA AC 120-104)

For existing younger airplane models with many years of operation remaining between the time on the high-time airplane of that model and its design service goal, the LoV may be approximately equal to the design service goal with few, if any, required maintenance actions. (FAA AC 120-104) For an existing ageing airplane type, the initial WFD evaluation of the complete airframe will typically cover a significant forward estimation of the projected airplane usage beyond its DSG, also known as the ‘proposed ESG’ and is effectively a proposed LoV. Typically, an evaluation through an additional 25 % of the DSG would provide a realistic forecast, with reasonable planning time for necessary maintenance action. Upon completion of the evaluation and publication of the revised maintenance requirements, the ‘proposed ESG’ becomes the LoV. (EASA AMC 20-20)

“Extended service goal (ESG) is an adjustment to the Design Service Goal established by service experience, analysis, and/or test during which the principal structure will be reasonably free from significant cracking including WFD”. (EASA AMC 20-20)

LoV is specific to the airplane structural configuration (e.g. LoV of airplane with classic wings will be different from the airplane with winglets) and is included in the Airworthiness Limitation Section (ALS) document of airplane.

Responsibilities Of Regulatory Authority, Design Approval Holder & Operator:

The primary responsibility is with the Design Approval Holder (DAH) to perform the analyses and supporting tests. However, it is expected that if extensive maintenance actions are necessary, the practicality of their implementation will be evaluated in a cooperative effort between the operators and Type Certificate Holders (TCH) / DAHs, with participation of Regulatory Authority.

The TCH is responsible for proposing and submitting an LoV in the airplane Airworthiness Limitation Section (ALS) for approval. The operator is responsible for implementing the LoV in their Aircraft Maintenance Programme. (EASA AMC 20-20)

Rules / Regulations:

EASA: The Limit of Validity (LOV) is required by point 26.303 of Part-26 (Annex I to Regulation (EU) 2015/640).

FAA: The Limit of Validity (LOV) requirements are given in point 26.21 of 14CFR Part-26.

Conclusion:

To summarize, the evolution of airplane design philosophies transitioned from "Safety-by-Retirement" (Safe-Life) to "Safety-by-Design" (Fail-Safe), and eventually to "Safety-by-Inspection" (Damage Tolerance). Modern airplanes are designed and manufactured with the prescribed “Design service goal” (up to which significant cracking are unlikely to occur in airplane) and the Limit-of-Validity (up to which the WFD are unlikely to occur in airplane). The LoV is the operational life of airplane beyond which airplane should not operate unless an extended LoV is approved from competent authority (FAA for Boeing and EASA for Airbus).

Further Reading:

1. FAA AC 120-104.
2. FAA AC 91-56B.
3. EASA AMC 20-20.

References:

1. FAA AC 120-104.
2. FAA AC 91-56B.
3. FAA AC 23-13A.
4. EASA AMC 20-20.
5. Airbus A320 series Airworthiness Limitations Section (ALS) Part 2.
6. “Design and Certification” lecture slides by R.C. Alderliesten of TU Delft.
7. Boeing article “Understanding the new Widespread Fatigue Damage rule” in AERO QTR_04.12.