On 22 December 1969, an F-111 pulled out of a practice bombing run over the Nevada desert at four g, and its left wing came off. The culprit was a flaw about an inch long, forged into a steel fitting at the factory and missed repeatedly by inspectors during manufacture.

That accident did more than ground a fleet. It finished the argument over how aircraft structures should be designed, and it pushed the US Air Force to the philosophy that now underpins both military and civil structural rules: damage tolerance. To understand why, you have to know the two ideas that came before it.

Safe-life: retire it before it cracks

The oldest answer to fatigue is the simplest. Work out, by analysis and test, how many load cycles a part can take before a crack is likely to appear, divide that life by a generous scatter factor, and throw the part away before it gets there. That is safe-life design.

Its weakness is that it assumes the part starts perfect. A safe-life component is designed so that, with an extremely low accepted level of risk, it will never form a detectable fatigue crack during its service life, which usually means running it at stresses well below what the material could carry. The classic example is the helicopter rotor blade: it sees so many cycles that a crack could grow to critical length within a single flight, before any inspection could find it.

For transport aircraft, safe-life survives today as the fallback. Under 14 CFR 25.571(c), damage-tolerance compliance is not required for particular structure if the applicant establishes that it is impractical, and the regulation then sets a safe-life standard instead.

Fail-safe: assume something breaks

Der de Havilland Comet disasters of 1954 shook the industry. G-ALYP crashed into the Mediterranean off Elba in January, and G-ALYY went down near Naples in April. A complete Comet fuselage was then pressurised again and again in a water tank built for the purpose at Farnborough, until it split after 3,057 flight cycles, 1,221 real and 1,836 simulated.

Boeing's full-scale fatigue test of the 777X: the modern descendant of the Comet water tank, cycling a complete airframe through simulated flights.

Wikipedia's account of the inquiry notes that afterwards aircraft were designed to fail-safe or safe-life standards. Fail-safe design accepts that a part may break and asks a different question: can the rest of the structure carry the load until the damage is found? The answer is multiple load paths, so the failure of one spar cap or one skin panel does not bring the aircraft down, and crack-stopping features that keep a running crack from tearing across the whole structure.

The idea is far older than the jet age. Wikipedia's article on damage tolerance opens its history with a note Leonardo da Vinci wrote when describing his flying machine.

The B-47 and the birth of ASIP

The US Air Force learned the same lesson in its own way. The Damage Tolerant Design Handbook, the Air Force-sponsored reference on the subject, traces its Aircraft Structural Integrity Program to the Boeing B-47 Stratojet. Designed as a high-altitude bomber, it was flown from 1957 in punishing low-level training missions, including toss-bombing manoeuvres, and its real loading spectrum changed dramatically.

On 13 March 1958, two B-47Bs broke up in flight in separate incidents, with failures starting in the lower wing skin, and three more in-flight accidents followed while those investigations were still running. The Air Force ran three concurrent fatigue test programmes, at Boeing Wichita, Douglas Tulsa and the NACA laboratory at Langley, and the results became the keystone of ASIP.

Even then the lessons came hard. During the full-scale fatigue test of the F-105D at Wright Field, the main wing carry-through frame failed at less than 20 per cent of one lifetime, and a redesigned frame later failed at 116 per cent of one lifetime against a requirement for four.

The F-111 and the end of the argument

Then came the F-111. Cracks in its D6AC steel wing attachment structure had already appeared during ground fatigue testing in 1968, according to the Defense Systems Information Analysis Center. On 22 December 1969, the left wing pivot fitting of F-111 No. 94 failed during a 4.0 g pull-up at Nellis Air Force Base, and the aircraft and its crew of two were lost.

The fitting had been through production inspection. That did not matter, because the flaw was there from the start, near a vertical reinforcing rib where production inspections could not see it. A safe-life calculation that assumes a perfect part had nothing to say about a part that was never perfect.

The recovery was unlike anything before it. The Damage Tolerant Design Handbook calls the follow-up the largest single material investigation ever, focused on D6AC steel, and says the aircraft were released to fly again on the basis of a cold-proof test combined with the best non-destructive inspection then available. The F-111s were loaded on the ground at minus 40 degrees Fahrenheit to clear the D6AC wing carry-through and its attached components.

The logic of a proof test is brutal and elegant. If a part survives a load higher than anything it will see in service, any flaw it contains must be smaller than the size that would have broken it. Fracture mechanics can then estimate how long that largest possible flaw would take to grow to a dangerous size, and the inspection interval is set inside that window. The handbook notes that proof testing works best on high-strength steels and other materials that fracture in a brittle, plane-strain manner, and that this F-111 programme is the notable exception to its otherwise limited use on whole airframes.

A symposium talk on full-scale fatigue testing of T-38 wings, the kind of ASIP work that keeps ageing military fleets flying.

Damage tolerance becomes the rule

A Scientific Advisory Board convened for the F-111 investigation recommended that a damage-tolerant design methodology be used for all future weapon systems. In September 1972 those concepts went into MIL-STD-1530, Aircraft Structural Integrity Program, Airplane Requirements, which also required each aircraft type to have a force structural maintenance plan. MIL-A-83444, Airplane Damage Tolerance Requirements, followed in July 1974, and MIL-STD-1530A in 1975.

Damage tolerance turns the old assumptions inside out. It starts by assuming that flaws exist in the structure from day one and that they will grow with use. The designer must show that the largest flaw that could plausibly escape manufacture will not grow to critical size before a scheduled inspection has had a realistic chance of finding it, and the structure must keep enough residual strength in the meantime.

Civil rules took the same route. Today 14 CFR 25.571 requires inspection thresholds for single-load-path structure, and for fail-safe structure whose failure might go unnoticed, to be based on crack growth from an initial flaw of the maximum probable size that manufacturing or service could leave behind. The rule also demands a limit of validity, backed by full-scale fatigue test evidence, during which widespread fatigue damage will not occur.

Three philosophies, one airframe

No modern aircraft uses just one of these ideas. A helicopter's rotor blades may be safe-life parts on a damage-tolerant airframe. An airliner's fuselage is built with fail-safe multiple load paths, then managed under a damage-tolerance inspection programme with a published limit of validity. Military fleets run the whole package through ASIP, from the first full-scale fatigue test to the last flight.

Those full-scale tests have grown enormous. At BAE Systems' site in Brough, Yorkshire, a 350-tonne rig with more than 2,500 strain gauges and 160 loading actuators flew an F-35A airframe through 8,000 hours, one complete lifetime, of simulated flight, according to the Institution of Mechanical Engineers.

Afterburner has looked elsewhere at why aircraft are riveted rather than welded, and at the ultimate load test that proves a wing's static strength. Damage tolerance is the third leg: not how strong the structure is on the day it is built, but how safe it stays once the cracks arrive, as they always do.

Sources: eCFR (14 CFR 25.571), Damage Tolerant Design Handbook (AFGROW/LexTech), Defense Systems Information Analysis Center, Wikipedia, Institution of Mechanical Engineers, NASA, DVIDS