You have seen the video. A wing, stripped of its skin panels in places and bristling with instrumentation, is pulled upward by a forest of hydraulic jacks until the tips are somewhere near the roof. A number climbs on a screen. Then there is a bang like a shipping container being dropped, and twenty tonnes of aluminium stops being a wing.

Almost everyone who watches that clip draws the same conclusion: this is what certification looks like, and the wing has to break for the aeroplane to be approved. It is a reasonable conclusion. It is also wrong, and the regulation that governs the test says so in two short paragraphs.

What the rules actually demand is far stranger than destruction. They demand that the structure survive a load it will never see, by a margin fixed in 1970, for exactly three seconds.

Limit load is the worst day the aeroplane is ever supposed to have

Start with the number that everything else is built on. Limit load is the maximum load the designers expect the aircraft to meet in service — the gust that arrives at the wrong moment, the manoeuvre at the corner of the envelope, the landing nobody is proud of. Subpart C of 14 CFR Part 25 spends several thousand words defining the flight and ground conditions that generate it.

What the structure owes at that load is set out in 25.305(a), and it is a subtler requirement than it first appears: the structure must be able to support limit loads without detrimental permanent deformation, and at any load up to limit load, the deformation may not interfere with safe operation.

Read that second clause again. The wing is allowed to bend — enormously, as any window-seat passenger in turbulence knows. What it is not allowed to do is bend in a way that jams a control surface, binds a fuel line or leaves the aeroplane a different shape afterwards. Limit load is the boundary of the elastic world. Below it, the structure springs back.

Then you multiply by one and a half

Above limit load sits a second number, and the rule that creates it is one of the shortest in Part 25.

That is ultimate load: limit load times 1.5, a margin that has survived essentially unchanged for over half a century. It is not a prediction of anything. No airliner is expected to encounter 150 per cent of its own worst case. The factor exists to absorb everything the analysis cannot see — scatter in material properties, a batch of fasteners at the low end of tolerance, a manufacturing deviation, a load case nobody thought to run.

And what the structure owes at ultimate load is stated in a sentence that is quoted far less often than it deserves:

Three seconds. That is the entire demand. Hold the number, do not come apart, and the requirement is met. There is no clause instructing anybody to keep pulling until something lets go.

The three seconds themselves are not arbitrary. A static rig applies load slowly, over minutes, while the real event that produces limit load — a gust, a manoeuvre — is over in a fraction of a second. The hold is there to prove the structure is genuinely in equilibrium at that load rather than passing through it, which is also why the rule drops the requirement when the proof comes from dynamic testing that reproduces the real load history instead.

The companion rule, 25.307, explains why anybody builds a rig at all. Structural analysis alone may be used only if the structure conforms to one for which experience has shown the method reliable. In every other case, the regulation says, substantiating tests must be made to load levels sufficient to verify structural behaviour up to the loads specified in 25.305. On a clean-sheet wing in a new material, that is the whole wing.

What actually happened on the three big rigs

Theory is cheap. The interesting part is where each manufacturer chose to stop.

Boeing 787, 28 March 2010. Boeing announced that it had completed the ultimate-load wing up-bending test on the 787 static test unit, loading the airframe to 150 per cent of the most extreme forces the aeroplane is ever expected to experience in service. The wings flexed upward by roughly 25 feet. The programme did not declare victory on the spot; Boeing described the initial results as positive and said more extensive analysis and review were needed before the test could be deemed a success. That gap between the hold and the verdict is normal, and it is where the strain-gauge data earns its keep.

Airbus A350 XWB, December 2013. Airbus took its static test airframe to 1.5 times limit load, with the wingtips deflecting more than five metres at the peak. The company announced the result in January 2014 as a pass. It did not take the structure to destruction, and nothing in the regulation asked it to.

Two sentences and a photograph, which is roughly the proportion of public attention this milestone usually gets relative to a first flight. Inside the company it is the bigger moment of the two.

Boeing 777-9, 5 September 2019. This is the one that went wrong, and it went wrong by the narrowest margin in the business. With FAA personnel present, the static article was being loaded toward ultimate when the structure failed at 1.48 times limit load — 99 per cent of the target. The initiating failure was in the lower fuselage behind the wing, where compression buckled and ruptured the aluminium skin; the split ran up the side and a passenger plug door aft of the wing blew out, a secondary effect rather than the cause. The airframe was a write-off and was scrapped.

Boeing said at the time that what it had seen reinforced its prior assessment and that the result would not have a significant impact on the design or on preparations for first flight. One per cent short is still short, and the regulation does not round up. But as an illustration of how finely these margins are cut, nothing in modern certification beats it: the difference between a pass and a scrapped airframe was two per cent of limit load.

Boeing’s own film on how the 777X wing spars are tested is a rare look inside the process from the manufacturer’s side rather than from a phone camera at the back of the hall.

So why does the famous video end with a bang?

Because somebody chose to keep pulling.

The clip most people have seen is the Boeing 777 wing test from January 1995. Aviation Week reported it at the end of that month under the headline “777 passes full-scale wing destruct test”, noting that the tests confirmed the wing met its maximum design requirement of bearing 150 per cent of the load experienced in the most extreme flight conditions. Boeing’s own image archive dates the ultimate load test of the 777 wing to 1995 as well.

A word of caution about the number that always travels with this footage. You will see it stated everywhere that the 777 wing broke at exactly 154 per cent of limit load. That figure is repeated in forum posts, in video captions and on social media, and we could not trace it to a primary Boeing or FAA document. The contemporaneous trade reporting confirms the wing met the 150 per cent requirement; the extra four points appear to have entered circulation somewhere downstream. Treat it as folklore that may well be true rather than as a specification.

What the clip genuinely shows is a decision, not a requirement. Once a structure has held ultimate load for its three seconds, the regulatory job is finished and the test article is, in engineering terms, scrap. Continuing to load it costs nothing further and buys information that exists nowhere else: the actual margin, measured rather than calculated.

The 787 test is the cleaner demonstration of the elastic story. Watch how far the tips travel and how completely the wing returns.

Why the engineers want it to fail close to the line

Here is the counterintuitive part, and it is the reason the breaking point matters even though no rule requires one.

If a wing is taken past ultimate and fails just above 150 per cent, the structure is very nearly perfectly sized. The analysis was right, the margins were thin and honest, and almost nothing is being carried that does not need to be there. If it survives to a long way above ultimate, that is not a triumph — it is excess material, and excess material on a wing is weight. Weight is fuel, fuel is payload and range, and over a twenty-five-year service life across a fleet of several hundred aircraft, a few hundred surplus kilograms per airframe is a real number on somebody’s balance sheet.

This is also why 25.307 insists on material correction factors when static or dynamic tests are used to show compliance, unless the structure has enough redundancy that the failure of one element simply redistributes load through alternate paths. The test article is one specimen built from one set of batches. The fleet is not. The correction factor is the bridge between the thing on the rig and the thousand aircraft that will be built to the same drawings.

So the next time the clip comes around your feed, watch it for what it is. Not a trial by ordeal, and not a requirement to destroy. A structure holding a number it will never meet, for three seconds, while a room full of people read strain gauges — and then, because the airframe has no future anyway, an engineering team spending the remains on finding out exactly how good their sums were.

Sources: 14 CFR 25.301, 25.303, 25.305 and 25.307 (eCFR, current as of October 2026); Boeing media release, “Boeing Completes Ultimate-Load Wing Test on 787”, 28 March 2010; Aviation Week, “A350 XWB passes ultimate load wing test”, 13 January 2014; Airbus, 13 January 2014; Aviation Week, “777 passes full-scale wing destruct test”, 30 January 1995; The Seattle Times and AVweb reporting on the 777X static test failure, November 2019; NASA Armstrong Flight Research Center.