AMC 20-29 Composite Aircraft Structure

• ED Decision 2010/003/R found in: AMC-20 Amdt 21 - Airworthiness of Products, Parts and Appliances (Apr 2021)

AMC 20-29 Composite Aircraft Structure ED Decision 2010/003/R 1.         PURPOSE This AMC provides an acceptable means, but not the only means, for airworthiness certification of composite aircraft structures. Guidance information is also presented on the closely related design, manufacturing and maintenance aspects. This AMC primarily addresses carbon and glass fibre reinforced plastic structures, although many aspects of this document are also applicable to other forms of structure, e.g. metal bonded structure, wooden structure, etc. Note: When applying this guidance to other forms of structure, additional design considerations may be necessary and other appropriate references should also be consulted. 2.         OBJECTIVE AMC 20-29 standardises recognised good design practices common to composite aircraft structures in one document. For rotorcraft, AMC 20-29 complements existing AMC to CS-27 and CS-29 (referring to FAA AC 27-1B MG8 and AC 29-2C MG8). 3.         APPLICABILITY This AMC provides Acceptable Means of Compliance with the provisions of CS-23, CS-25, CS-27 and CS-29. Many of the concepts included in this AMC may also be applicable in part or in full to other CSs. However, when using this AMC as an Acceptable Means of Compliance for these other CSs, appropriate engineering judgement should be exercised and early agreement with the Agency sought. This AMC applies to: applicants for a type-certificate, restricted type-certificate or supplemental type-certificate; certificate/approval holders; parts manufacturers; material suppliers; and maintenance and repair organisations. Note: The technical content of this AMC is harmonised with FAA Advisory Circular AC 20-107B, dated 8 September 2009. 4.         RELATED REGULATIONS AND GUIDANCE a.         Applicable paragraphs are listed in [Appendix 1](#_DxCrossRefBm421436874). b.         Relevant guidance considered complementary to this AMC is provided in [Appendix 1](#_DxCrossRefBm421436874). 5.         GENERAL a.         The procedures outlined in this AMC provide Acceptable Means of Compliance and Guidance Material for composite structures, particularly those that are essential in maintaining the overall flight safety of the aircraft (“critical structure” as defined in [Appendix 2](#_DxCrossRefBm421436876)). This AMC is published to aid in the evaluation of certification programmes for composite applications and to reflect the current status of composite technology. It is expected that this AMC will be modified periodically to reflect the continued evolution of composite technology and the data collected from service experience and expanding applications. b.         There are factors unique to the specific composite materials and processes used for a given application. For example, the environmental sensitivity, anisotropic properties, and heterogeneous nature of composites can make the determination of structural failure loads, modes, and locations difficult. The reliability of such evaluation depends on repeatable structural details created by scaled manufacturing or repair processes. The extent of testing and/or analysis may differ for a structure depending upon the criticality to flight safety, expected service usage, the material and processes selected, the design margins, the failure criteria, the database and experience with similar structures, and on other factors affecting a particular structure. It is expected that these factors will be considered when interpreting this AMC for use on a specific application. c.         Definitions of terms used in this AMC can be found in [Appendix 2](#_DxCrossRefBm421436876). 6.         MATERIAL AND FABRICATION DEVELOPMENT All composite materials and processes used in structures are qualified through enough fabrication trials and tests to demonstrate a reproducible and reliable design. One of the important features of composite construction is the degree of care needed in the procurement and processing of composite materials. The final mechanical behaviour of a given composite material may vary greatly depending on the processing methods employed to fabricate production parts. Special care needs to be taken in controlling both the materials being procured and how the material is processed once delivered to the fabrication facility. The CSs (namely paragraphs 2x.603 and 2x.605) specify the need to procure and process materials under approved material and process specifications that control the key parameters governing performance. These paragraphs outline a need to protect structures against the degradation possible in service. They also require that the design account for any changes in performance (e.g., environmental and variability effects) permitted by material and process specifications. a.         Material and Process Control (1)       Specifications covering material, material processing, and fabrication procedures are established to ensure a basis for fabricating reproducible and reliable structure. Material specifications are required to ensure consistent material can be procured, and batch acceptance testing or statistical process controls are used to ensure material properties do not drift over time. Specifications covering processing procedures should be developed to ensure that repeatable and reliable structure can be manufactured. The means of processing qualification and acceptance tests defined in each material specification should be representative of the expected applicable manufacturing process. The process parameters for fabricating test specimens should match the process parameters to be used in manufacturing actual production parts as closely as possible. Both test and production parts must conform to material and process specifications. (2)       Once the fabrication processes have been established, changes should undergo additional qualification, including testing of differences, before being implemented, (refer to [Appendix 3](#_DxCrossRefBm421436875)). It is important to establish processing tolerances, material handling and storage limits, and key characteristics, which can be measured and tracked to judge part quality. (3)       Material requirements identified in procurement specifications should be based on the qualification test results for samples produced using the related process specifications. Qualification data must cover all properties important to the control of materials (composites and adhesives) and processes to be used for production of composite structure. Carefully selected physical, chemical, and mechanical qualification tests are used to demonstrate the formulation, stiffness, strength, durability, and reliability of materials and processes for aircraft applications. It is recommended that airframe designers and manufacturers work closely with material suppliers to properly define material requirements. (4)       To provide an adequate design database, environmental effects on critical properties of the material systems and associated processes should be established. In addition to testing in an ambient environment, variables should include extreme service temperature and moisture content conditions and effects of long-term durability. Qualification tests for environmental effects and long-term durability are particularly important when evaluating the materials, processes, and interface issues associated with structural bonding (refer to paragraph 6.c for related guidance). (5)       Key characteristics and processing parameters should be specified and monitored for in-process quality control. The overall quality control plan required by the certifying agency should involve all relevant disciplines, i.e., engineering, manufacturing, and quality control. A reliable quality control system should be in place to address special engineering requirements that arise in individual parts or areas as a result of potential failure modes, damage tolerance and flaw growth requirements, loadings, inspectability, and local sensitivities to manufacture and assembly. (6)       Tolerances permitted by the material and process specifications should be substantiated by analysis supported by test evidence, or tests at the coupon, element or sub-component level. For new production methods, repeatable processes should be demonstrated at sufficient structural scale in a way shown to be consistent with the material and process qualification tests and development of the associated specifications. This will require integration of the technical issues associated with product design and manufacturing details prior to a large investment in structural tests and analysis correlation. It will also ensure the relevance of quality control procedures defined to control materials and processes as related to the product structural details. (7)       Note that the Agency does not certify materials and processes. However, materials and processes specifications are part of the type-design subject to type-certification. Appropriate certification credit may be given to products and organisations using the same materials and processes in similar applications subject to substantiation and applicability. In some cases, material and processing information may become part of accepted shared databases used throughout the industry. New users of shared qualification databases must control the associated materials and processes through proper use of the related specifications and demonstrate their understanding by performing equivalency sampling tests for key properties. Note that materials and processes used in European Technical Standard Order (ETSO) articles or authorisations must also be qualified and controlled. b.         Design Considerations for Manufacturing Implementation (1)       Process specifications and manufacturing documentation are needed to control composite fabrication and assembly. The environment and cleanliness of facilities are controlled to a level validated by qualification and proof of structure testing. Raw and ancillary materials are controlled to specification requirements that are consistent with material and process qualifications. Parts fabricated should meet design drawing tolerances obtained from the production tolerances validated in qualification, design data development, and proof of structure tests. Some key fabrication process considerations requiring such control include: (i) material handling and storage, (ii) laminate layup and bagging (or other alternate process steps for non-laminated material forms and advanced processes), (iii) mating part dimensional tolerance control, (iv) part cure (thermal management), (v) machining and assembly, (vi) cured part inspection and handling procedures, and (vii) technician training for specific material, processes, tooling and equipment. (2)       Substantiating data is needed for design to justify all known defects, damage and anomalies allowed to remain in service without rework or repair. Adequate manufacturing records support the identification and substantiation of known defects, damage and anomalies. (3)       Additional substantiating design data is needed from new suppliers of parts previously certificated. This may be supported by manufacturing trials and quality assessments to ensure equivalent production and repeatability. Some destructive inspection of critical structural details is needed for manufacturing flaws that are not end item inspectable and require process controls to ensure reliable fabrication. c.         Structural Bonding Bonded structures include multiple interfaces (e.g., composite-to-composite, composite-to-metal, or metal-to-metal), where at least one of the interfaces requires additional surface preparation prior to bonding. The general nature of technical parameters that govern different types of bonded structures are similar. A qualified bonding process is documented after demonstrating repeatable and reliable processing steps such as surface preparation. It entails understanding the sensitivity of structural performance based upon expected variation permitted per the process. Characterisation outside the process limits is recommended to ensure process robustness. In the case of bonding composite interfaces, a qualified surface preparation of all previously cured substrates is needed to activate their surface for chemical adhesion. For all bonding interfaces, regardless if on metallic or previously cured composite substrates, a qualified surface preparation is needed to activate their surface for chemical adhesion. Many technical issues for bonding require cross-functional teams for successful applications. Applications require stringent process control and a thorough substantiation of structural integrity. (1)       Many bond failures and problems in service have been traced to invalid qualifications or insufficient quality control of production processes. Physical and chemical tests may be used to control surface preparation, adhesive mixing, viscosity, and cure properties (e.g., density, degree of cure, glass transition temperature). Lap shear stiffness and strength are common mechanical tests for adhesive and bond process qualification. Shear tests do not provide a reliable measure of long-term durability and environmental degradation associated with poor bonding processes (i.e., lack of adhesion). Some type of peel test has proven more reliable for evaluating proper adhesion. Without chemical bonding, the so-called condition of a “weak bond” exists when the bonded joint is either loaded by peel forces or exposed to the environment over a long period of time, or both. Adhesion failures, which indicate the lack of chemical bonding between substrate and adhesive materials, are considered an unacceptable failure mode in all test types. Material or bond process problems that lead to adhesion failures are solved before proceeding with qualification tests. (2)       Process specifications are needed to control adhesive bonding in manufacturing and repair. A “process control mentality”, which includes a combination of in-process inspections and tests, has proven to be the most reliable means of ensuring the quality of adhesive bonds. The environment and cleanliness of facilities used for bonding processes are controlled to a level validated by qualification and proof of structure testing. Adhesives and substrate materials are controlled to specification requirements that are consistent with material and bond process qualifications. The bonding processes used for production and repair meet tolerances validated in qualification, design data development, and proof of structure tests. Some key bond fabrication process considerations requiring such control include: (i) material handling and storage, (ii) bond surface preparation, (iii) mating part dimensional tolerance control, (iv) adhesive application and clamp-up pressure, (v) bond line thickness control, (vi) bonded part cure (thermal management), (vii) cured part inspection and handling procedures, and (vii) bond technician training for specific material, processes, tooling and equipment. Bond surface preparation and subsequent handling controls leading up to the bond assembly and cure must be closely controlled in time and exposure to environment and contamination. (3)       CS 23.573(a) sets the certification specification for primary composite airframe structures, including considerations for damage tolerance, fatigue, and bonded joints. Although this is a small aeroplane rule, the same performance standards are normally expected for large aeroplanes and rotorcraft (via special conditions and CRIs). (a)       For bonded joints, CS 23.573(a)(5) states: "For any bonded joint, the failure of which would result in catastrophic loss of the aeroplane, the limit load capacity must be substantiated by one of the following methods: (i)        The maximum disbonds of each bonded joint consistent with the capability to withstand the loads in paragraph (a)(3) of this section must be determined by analysis, tests, or both. Disbonds of each bonded joint greater than this must be prevented by design features; or (ii)       Proof testing must be conducted on each production article that will apply the critical limit design load to each critical bonded joint; or (iii)      Repeatable and reliable non-destructive inspection techniques must be established that ensure the strength of each joint." (b)       These options do not supersede the need for a qualified bonding process and rigorous quality controls for bonded structures. For example, fail safety implied by the first option is not intended to provide adequate safety for the systematic problem of a bad bonding process applied to a fleet of aircraft structures. Instead, it gives fail safety against bonding problems that may occasionally occur over local areas (e.g., insufficient local bond contact pressure or contamination). Performing static proof tests to limit load, which is the second option, may not detect weak bonds requiring environmental exposure and time to degrade bonded joint strength. This issue should be covered by adequately demonstrating that qualified bonding materials and processes have long-term environmental durability. Finally, the third option is open for future advancement and validation of non-destructive inspection (NDI) technology to detect weak bonds, which degrade over time and lead to adhesion failures. Such technology has not been reliably demonstrated at a production scale to date. (4)       Adhesion failures are an unacceptable failure mode for bonded structure that require immediate action by the responsible engineers to identify the specific cause and isolate all affected parts and assemblies for directed inspection and repair. Depending on the suspected severity of the bonding problem, an airworthiness directive may be required to restore the affected aircraft to an airworthy condition. Any design, manufacturing or repair details linked to the bonding problem should also be permanently corrected. d.         Environmental Considerations Environmental design criteria should be developed that identify the critical environmental exposures, including humidity and temperature, to which the material in the application under evaluation may be exposed. Service data (e.g., moisture content as a function of time in service) can be used to ensure such criteria are realistic. In addition, the peak temperatures for composite structure installed in close proximity to aircraft systems that generate thermal energy need to be identified for worst-case normal operation and system failure cases. Environmental design criteria are not required where existing data demonstrate that no significant environmental effects, including the effects of temperature and moisture, exist for the material system and construction details, within the bounds of environmental exposure being considered. (1)       Experimental evidence should be provided to demonstrate that the material design values or allowables are attained with a high degree of confidence in the appropriate critical environmental exposures to be expected in service. It should be realised that the worst case environment may not be the same for all structural details (e.g., hot wet conditions can be critical for some failure modes, while cold dry conditions may be worse for others). The effect of the service environment on static strength, fatigue and stiffness properties and design values should be determined for the material system through tests, e.g., accelerated environmental tests, or from applicable service data. The maximum moisture content considered is related to that possible during the service life, which may be a function of a given part thickness, moisture diffusion properties and realistic environmental exposures. The effects of environmental cycling (i.e., moisture and temperature) should be evaluated when the application involves fluctuations or unique design details not covered in the past. Existing test data may be used where it can be shown to be directly applicable to the material system, design details, and environmental cycling conditions characteristic of the application. All accelerated test methods should be representative of real-time environmental and load exposure. Any factors used for acceleration that chemically alter the material (e.g., high temperatures that cause post-cure) should be avoided to ensure behaviour representative of real environmental exposures. (2)       Depending on the design configuration, local structural details, and selected processes, the effects of residual stresses that depend on environment should be addressed (e.g., differential thermal expansion of attached parts). e.         Protection of Structure Weathering, abrasion, erosion, ultraviolet radiation, and chemical environment (glycol, hydraulic fluid, fuel, cleaning agents, etc.) may cause deterioration in a composite structure. Suitable protection against and/or consideration of degradation in material properties should be provided for conditions expected in service and demonstrated by test and/or appropriate validated experience. Where necessary, provide provisions for ventilation and drainage. Isolation layers are needed at the interfaces between some composite and metal materials to avoid corrosion (e.g., glass plies are used to isolate carbon composite layers from aluminium). In addition, qualification of the special fasteners and installation procedures used for parts made from composite materials need to address the galvanic corrosion issues, as well as the potential for damaging the composite (delamination and fibre breakage) in forming the fastener. f.          Design Values Data used to derive design values must be obtained from stable and repeatable material that conforms to mature material and representative production process specifications. This will ensure that the permitted variability of the production materials is captured in the statistical analysis used to derive the design values. Design values derived too early in the material’s development stage, before raw material and composite part production processes have matured, may not satisfy the intent of the associated rules. Laminated material system design values should be established on the laminate level by either test of the laminate or by test of the lamina in conjunction with a test validated analytical method. Similarly, design values for non-laminated material forms and advanced composite processes must be established at the scale that best represents the material as it appears in the part or by tests of material substructure in conjunction with a test validated analytical method. g.         Structural Details For a specific structural configuration of an individual component (point design), design values may be established which include the effects of appropriate design features (holes, joints, etc.). Specific metrics that quantify the severity of composite structural damage states caused by foreign impact damage threats are needed to perform analysis (i.e., the equivalent of a metallic crack length). As a result, testing will often be needed to characterise residual strength, including the structural effects of critical damage location and combined loads. Different levels of impact damage are generally accommodated by limiting the design strain levels for ultimate and limit combined load design criteria. In this manner, rational analyses supported by tests can be established to characterise residual strength for point design details. 7.         PROOF OF STRUCTURE – STATIC The structural static strength substantiation of a composite design should consider all critical load cases and associated failure modes. It should also include effects of environment (including residual stresses induced during the fabrication process), material and process variability, non-detectable defects or any defects that are allowed by the quality control, manufacturing acceptance criteria, and service damage allowed in maintenance documents of the end product. The static strength of the composite design should be demonstrated through a programme of component ultimate load tests in the appropriate environment, unless experience with similar designs, material systems, and loadings is available to demonstrate the adequacy of the analysis supported by sub-component, element and coupon tests, or component tests to accepted lower load levels. The necessary experience to validate an analysis should include previous component ultimate load tests with similar designs, material systems, and load cases. a.         The effects of repeated loading and environmental exposure which may result in material property degradation should be addressed in the static strength evaluation. This can be shown by analysis supported by test evidence, by tests at the coupon, element or sub-component level, as appropriate, or alternatively by relevant existing data. Earlier discussions in this AMC address the effects of environment on material properties (paragraph 6.d) and protection of structure (paragraph 6.e). For critical loading conditions, three approaches exist to account for prior repeated loading and/or environmental exposure in the full-scale static test. (1)       In the first approach, the full-scale static test should be conducted on structure with prior repeated loading and conditioned to simulate the critical environmental exposure and then tested in that environment. (2)       The second approach relies upon coupon, element, and sub-component test data to determine the effect of repeated loading and environmental exposure on static strength. The degradation characterised by these tests should then be accounted for in the full-scale static strength demonstration test (e.g., overload factors), or in analysis of these results (e.g., showing a positive margin of safety with design values that include the degrading effects of environment and repeated load). (3)       In practice, aspects of the first two approaches may be combined to obtain the desired result (e.g., a full scale static test may be performed at critical operating temperature with a load factor to account for moisture absorbed over the aircraft structure’s life). Alternate means to account for environment using validated tests and analyses (e.g., an equivalent temperature enhancement to account for the effect of moisture without chemically altering the material), may be proposed by the applicant. b.         The strength of the composite structure should be reliably established, incrementally, through a programme of analysis and a series of tests conducted using specimens of varying levels of complexity. Often referred to in industry as the “building block” approach, these tests and analyses at the coupon, element, details, and sub-component levels can be used to address the issues of variability, environment, structural discontinuity (e.g., joints, cut-outs or other stress risers), damage, manufacturing defects, and design or process-specific details. Typically, testing progresses from simple specimens to more complex elements and details over time. This approach allows the data collected for sufficient analysis correlation and the necessary replicates to quantify variations occurring at the larger structural scales to be economically obtained. The lessons learned from initial tests also help avoid early failures in more complex full-scale tests, which are more costly to conduct and often occur later in a certification programme schedule. (1)       Figures 1 and 2 provide a conceptual schematic of tests typically included in the building block approach for a fixed wing and tail rotor blade structures, respectively. The large quantity of tests needed to provide a statistical basis comes from the lowest levels (coupons and elements) and the performance of structural details are validated in a lesser number of sub-component and component tests. Detail and subcomponent tests may be used to validate the ability of analysis methods to predict local strains and failure modes. Additional statistical considerations (e.g., repetitive point design testing and/or component overload factors to cover material and process variability) will be needed when analysis validation is not achieved. The static strength substantiation programme should also consider all critical loading conditions for all Critical Structure. This includes an assessment of residual strength and stiffness requirements after a predetermined length of service, which takes into account damage and other degradation due to the service period.  Figure 1 - Schematic diagram of building block tests for a fixed wing.  Figure 2 - Schematic diagram of building block tests for a tail rotor blade. (2)       Successful static strength substantiation of composite structures has traditionally depended on proper consideration of stress concentrations (e.g., notch sensitivity of details and impact damage), competing failure modes and out-of-plane loads. A complete building block approach to composite structural substantiation addresses most critical structural issues in test articles with increasing levels of complexity so that many areas of reliable performance can be demonstrated prior to the component tests. The details and sub-component testing should establish failure criteria and account for impact damage in assembled composite structures. Component tests are needed to provide the final validation accounting for combined loads and complex load paths, which include some out-of-plane effects. When using the building block approach, the critical load cases and associated failure modes would be identified for component tests using the analytical methods, which are supported by test validation. c.         The component static test may be performed in an ambient atmosphere if the effects of the environment are reliably predicted by building block tests and are accounted for in the static test or in the analysis of the results of the static test. d.         The static test articles should be fabricated and assembled in accordance with production specifications and processes so that the test articles are representative of production structure including defects consistent with the limits established by manufacturing acceptance criteria. e.         The material and processing variability of the composite structure should be considered in the static strength substantiation. This is primarily achieved by establishing sufficient process and quality controls to manufacture structure and reliably substantiate the required strength by test and analysis. The scatter in strength properties due to variability in materials and processes are characterised by proper allowables or design values, which are derived in compliance with CS 2x.613. When the detail, sub-component and component tests show that local strains are adequately predicted and positive margins of safety exist using a validated analysis everywhere on the structure, then proof of static strength is said to be substantiated using analysis supported by test evidence. Alternatively, in the absence of sufficient building block test data and analysis validation, overloads are needed in the component test to gain proof of static strength for the structure using an approach referred to as substantiated by tests. The overload factors applied in this case need to be substantiated either through tests or past experience and must account for the expected material and process variation. f.          It should be shown that impact damage that can be expected from manufacturing and service, but not more than the established threshold of detectability for the selected inspection procedure, will not reduce the structural strength below ultimate load capability. This can be shown by analysis supported by test evidence, or by a combination of tests at the coupon, element, sub-component and component levels. The realistic test assessment of impact damage requires proper consideration of the structural details and boundary conditions. When using a visual inspection procedure, the likely impact damage at the threshold of reliable detection has been called barely visible impact damage (BVID). Selection of impact sites for static strength substantiation should consider the criticality of the local structural detail, and the ability to inspect a location. The size and shape of impactors used for static strength substantiation should be consistent with likely impact damage scenarios that may go undetected for the life of an aircraft. Note that it is possible for some designs to have detectable impact damage and still meet static strength loads and other requirements without repair (refer to allowable damage discussions in paragraph 10.c(1)). g.         Major material and process changes on existing certified structure require additional static strength substantiation (e.g., refer to [Appendix 3](#_DxCrossRefBm421436875)). 8.         PROOF OF STRUCTURE – FATIGUE AND DAMAGE TOLERANCE The evaluation of composite structure should be based on the applicable certification specifications identified in the type-certification basis. Such evaluation must show that catastrophic failure due to fatigue, environmental effects, manufacturing defects, or accidental damage will be avoided throughout the operational life of the aircraft. The nature and extent of analysis or tests on complete structures and/or portions of the primary structure will depend upon applicable previous fatigue/damage tolerant designs, construction, tests, and service experience on similar structures. In the absence of experience with similar designs, Agency-approved structural development tests of components, sub-components, and elements should be performed (following the same principles discussed in paragraph 7.b and [Appendix 3](#_DxCrossRefBm421436875)). The following considerations are unique to the use of composite material systems and provide guidance for the method of substantiation selected by the applicant. When establishing details for the damage tolerance and fatigue evaluation, attention should be given to a thorough damage threat assessment, geometry, inspectability, good design practice, and the types of damage/degradation of the structure under consideration. — Composite damage tolerance and fatigue performance is strongly dependent on structural design details (e.g., skin laminate stacking sequence, stringer or frame spacing, stiffening element attachment details, damage arrestment features, and structural redundancy). — Composite damage tolerance and fatigue evaluations require substantiation in component tests unless experience with similar designs, material systems, and loadings is available to demonstrate the adequacy of the analysis supported by coupons, elements, and sub-component tests. — Final static strength, fatigue, and damage tolerance substantiation may be gained in testing a single component test article if sufficient building block test evidence exists to ensure that the selected sequence of repeated and static loading yield results representative of that possible in service or provide a conservative evaluation. — Peak repeated loads are needed to practically demonstrate the fatigue and damage tolerance of composite aircraft structure in a limited number of component tests. As a result, metal structures present in the test article generally require additional consideration and testing. The information contained in AMC 25.571 provides fatigue and damage tolerance guidance for metallic structures. a.         Damage Tolerance Evaluation (1)       Damage tolerance evaluation starts with identification of structure whose failure would reduce the structural integrity of the aircraft. A damage threat assessment must be performed for the structure to determine possible locations, types, and sizes of damage considering fatigue, environmental effects, intrinsic flaws, and foreign object impact or other accidental damage (including discrete source) that may occur during manufacture, operation or maintenance. (a)       Currently, there are very few industry standards that outline the critical damage threats for particular composite structural applications with enough detail to establish the necessary design criteria or test and analysis protocol for complete damage tolerance evaluation. In the absence of standards, it is the responsibility of individual applicants to perform the necessary development tasks to establish such data in support of product substantiation. Some factors to consider in development of a damage threat assessment for a particular composite structure include part function, location on the aircraft, past service data, accidental damage threats, environmental exposure, impact damage resistance, durability of assembled structural details (e.g., long-term durability of bolted and bonded joints), adjacent system interface (e.g., potential overheating or other threats associated with system failure), and anomalous service or maintenance handling events that can overload or damage the part. As related to the damage threat assessment and maintenance procedures for a given structure, the damage tolerance capability and ability to inspect for known damage threats should be developed. (b)       Foreign object impact is a concern for most composite structures, requiring attention in the damage threat assessment. This is needed to identify impact damage severity and detectability for design and maintenance. It should include any available damage data collected from service plus an impact survey. An impact survey consists of impact tests performed with representative structure, which is subjected to boundary conditions characteristic of the real structure. Many different impact scenarios and locations should be considered in the survey, which has a goal of identifying the most critical impacts possible (i.e., those causing the most serious damage but are least detectable). When simulating accidental impact damage at representative energy levels, blunt or sharp impactors of different sizes and shapes should be selected to cause the most critical and least detectable damage, according to the load conditions (e.g., tension, compression or shear). Until sufficient service experience exists to make good engineering judgments on energy and impactor variables, impact surveys should consider a wide range of conceivable impacts, including runway or ground debris, hail, tool drops, and vehicle collisions. This consideration is important to the assumptions needed for use of probabilistic damage threat assessments in defining design criteria, inspection methods, and repeat inspection intervals for maintenance. Service data collected over time can better define impact surveys and design criteria for subsequent products, as well as establish more rational inspection intervals and maintenance practice. In review of such information, it should be realised that the most severe and critical impact damages, which are still possible, may not be part of the service database. (c)       Once a damage threat assessment is completed, various damage types can be classified into five categories of damage as described below (refer to figure 3). These categories of damage are used for communication purposes in this AMC. Other categories of damage, which help outline a specific path to fatigue and damage tolerance substantiation, may be used by applicants in agreement with the regulatory authorities.  Figure 3 - Schematic diagram showing design load levels versus categories of damage severity. Category 1: Allowable damage that may go undetected by scheduled or directed field inspection and allowable manufacturing defects. Structural substantiation for Category 1 damage includes demonstration of a reliable service life, while retaining ultimate load capability. By definition, such damage is subjected to the requirements and guidance associated with paragraph 7 of this AMC. Some examples of Category 1 damage include BVID and allowable defects caused in manufacturing or service (e.g., small delamination, porosity, small scratches, gouges, and minor environmental damage) that have substantiation data showing ultimate load is retained for the life of an aircraft structure. Category 2: Damage that can be reliably detected by scheduled or directed field inspections performed at specified intervals. Structural substantiation for Category 2 damage includes demonstration of a reliable inspection method and interval while retaining loads above limit load capability. The residual strength for a given Category 2 damage may depend on the chosen inspection interval and method of inspection. Some examples of Category 2 damage include visible impact damage (VID), VID (ranging in size from small to large), deep gouges or scratches, manufacturing mistakes not evident in the factory, detectable delamination or debonding, and major local heat or environmental degradation that will sustain sufficient residual strength until found. This type of damage should not grow or, if slow or arrested growth occurs, the level of residual strength retained for the inspection interval is sufficiently above limit load capability. Category 3: Damage that can be reliably detected within a few flights of occurrence by operations or ramp maintenance personnel without special skills in composite inspection. Such damage must be in a location such that it is obvious by clearly visible evidence or cause other indications of potential damage that becomes obvious in a short time interval because of loss of the part form, fit or function. Both indications of significant damage warrant an expanded inspection to identify the full extent of damage to the part and surrounding structural areas. In practice, structural design features may be needed to provide sufficient large damage capability to ensure limit or near limit load is maintained with easily detectable, Category 3 damage. Structural substantiation for Category 3 damage includes demonstration of a reliable and quick detection, while retaining limit or near limit load capability. The primary difference between Category 2 and 3 damages are the demonstration of large damage capability at limit or near limit load for the latter after a regular interval of time, which is much shorter than the former. The residual strength demonstration for Category 3 damage may be dependent on the reliable short time detection interval. Some examples of Category 3 damage include large VID or other obvious damage that will be caught during walk-around inspection or during the normal course of operations (e.g., fuel leaks, system malfunctions or cabin noise). Category 4: Discrete source damage from a known incident such as flight manoeuvres is limited. Structural substantiation for Category 4 damage includes a demonstration of residual strength for loads specified in the regulations. It should be noted that pressurised structure will generally have Category 4 residual strength requirements at a level higher than shown in figure 3. Some examples of Category 4 damage include rotor burst, bird strikes (as specified in the regulations), tyre bursts, and severe in-flight hail. Category 5: Severe damage created by anomalous ground or flight events, which is not covered by design criteria or structural substantiation procedures. This damage is in the current guidance to ensure the engineers responsible for composite aircraft structure design and the Agency work with maintenance organisations in making operations personnel aware of possible damage from Category 5 events and the essential need for immediate reporting to responsible maintenance personnel. It is also the responsibility of structural engineers to design-in sufficient damage resistance such that Category 5 events are self-evident to the operations personnel involved. An interface is needed with engineering to properly define a suitable conditional inspection based on available information from the anomalous event. Such action will facilitate the damage characterisation needed prior to repair. Some examples of Category 5 damage include severe service vehicle collisions with aircraft, anomalous flight overload conditions, abnormally hard landings, maintenance jacking errors, and loss of aircraft parts in flight, including possible subsequent high-energy, wide-area (blunt) impact with adjacent structure. Some Category 5 damage scenarios will not have clearly visual indications of damage, particularly in composite structures. However, there should be knowledge of other evidence from the related events that ensure safety is protected, starting with a complete report of possible damage by operations. (d)       The five categories of damage will be used as examples in subsequent discussion in this paragraph and in paragraphs 9 and 10. Note that Category 2, 3, 4 and 5 damages all have associated repair scenarios. (2)       Structure details, elements, and sub-components of Critical Structure should be tested under repeated loads to define the sensitivity of the structure to damage growth. This testing can form the basis for validating a no-growth approach to the damage tolerance requirements. The testing should assess the effect of the environment on the flaw and damage growth characteristics and the no-growth validation. The environment used should be appropriate to the expected service usage. Residual stresses will develop at the interfaces between composite and metal structural elements in a design due to differences in thermal expansion. This component of stress will depend on the service temperature during repeated load cycling and is considered in the damage tolerance evaluation. Inspection intervals should be established, considering both the likelihood of a particular damage and the residual strength capability associated with this damage. The intent of this is to assure that structure is not exposed to an excessive period of time with residual strength less than ultimate, providing a lower safety level than in the typical slow growth situation, as illustrated in Figure 4. Conservative assumptions for capability with large damage sizes that would be detected within a few flights may be needed when probabilistic data on the likelihood of given damage sizes does not exist. Once the damage is detected, the component is either repaired to restore ultimate load capability or replaced.  Figure 4 - Schematic diagram of residual strength illustrating that significant accidental damage with “no-growth” should not be left in the structure without repair for a long time. (a)       The traditional slow growth approach may be appropriate for certain damage types found in composites if the growth rate can be shown to be slow, stable and predictable. Slow growth characterisation should yield conservative and reliable results. As part of the slow growth approach, an inspection programme should be developed consisting of the frequency, extent, and methods of inspection for inclusion in the maintenance plan. Inspection intervals should be established such that the damage will have a very high probability of detection between the time it becomes initially detectable and the time at which the extent of the damage reduces the residual static strength to limit load (considered as ultimate), including the effects of environment. For any detected damage size that reduces the load capability below ultimate, the component is either repaired to restore ultimate load capability or replaced. Should functional impairment (such as unacceptable loss of stiffness) occur before the damage becomes otherwise critical, part repair or replacement will also be necessary. (b)       Another approach involving growth may be appropriate for certain damage types and design features adopted for composites if the growth can be reliably shown to be predictable and arrested before it becomes critical. Figure 5 shows schematic diagrams for all three damage growth approaches applied to composite structure. The arrested growth method is applicable when the damage growth is mechanically arrested or terminated before becoming critical (residual static strength reduced to limit load), as illustrated in Figure 5. Arrested growth may occur due to design features such as a geometry change, reinforcement, thickness change, or a structural joint. This approach is appropriate for damage growth that is detectable and found to be reliably arrested, including all appropriate dynamic effects. Structural details, elements, and sub-components of Critical Structure, components or full-scale structures, should be tested under repeated loads for validating an Arrested Growth Approach. As was the case for a “no-growth” approach to damage tolerance, inspection intervals should be established, considering the residual strength capability associated with the arrested growth damage size (refer to the dashed lines added to Figure 5 to conceptually show inspection intervals consistent with the slow growth basis). Again, this is intended to ensure that the structure does not remain in a damaged condition with residual strength capability close to limit load for long periods of time before repair. For any damage size that reduces load capability below ultimate, the component is either repaired to restore ultimate load capability or replaced. (c)       The repeated loading should be representative of anticipated service usage. The repeated load testing should include damage levels (including impact damage) typical of those that may occur during fabrication, assembly, and in-service, consistent with the inspection techniques employed. The damage tolerance test articles should be fabricated and assembled in accordance with production specifications and processes so that the test articles are representative of production structure. (3)       The extent of initially detectable damage should be established and be consistent with the inspection techniques employed during manufacture and in service. This information will naturally establish the transition between Category 1 and 2 damage types (i.e., inspection methods used by trained inspectors in scheduled maintenance). For damage that is clearly detectable to an extent that it will likely be found before scheduled maintenance (i.e., allowing classification as Category 3 damage), detection over shorter intervals and by untrained personnel may be permitted. Flaw/damage growth data should be obtained by repeated load cycling of intrinsic flaws or mechanically introduced damage. The number of cycles applied to validate both growth and no-growth concepts should be statistically significant, and may be determined by load and/or life considerations and a function of damage size. The growth or no growth evaluation should be performed by analysis supported by test evidence or by tests at the coupon, element, or sub-component level.  Figure 5 - Illustrations of residual strength and damage size relationships for three different approaches to composite structural damage tolerance substantiation (4)       The extent of damage for residual strength assessments should be established, including considerations for the probability of detection using selected field inspection procedures. The first four categories of damage should be considered based on the damage threat assessment. In addition, Category 3 damage should be detected in a walk-around inspection or through the normal course of operations. Residual strength evaluation by component or sub-component testing or by analysis supported by test evidence should be performed considering that damage. The evaluation should demonstrate that the residual strength of the structure will reliably be equal to or greater than the strength required for the specified design loads (considered as ultimate), including environmental effects. The statistical significance of reliable sub-component and detail residual strength assessments may include conservative methods and engineering judgment. It should be shown that stiffness properties have not changed beyond acceptable levels. (a)       For the no-growth, slow growth, arrested growth approaches, residual strength testing should be performed after repeated load cycling. All probabilistic analyses applied for residual strength assessments should properly account for the complex nature of damage defined from a thorough damage threat assessment. Conservative damage metrics are permitted in such analyses assuming sufficient test data on repeated load and environmental exposure exists. (b)       Composite designs should afford the same level of fail-safe, multiple load path structure assurance as conventional metals design. Such is also the expectation in justifying the use of static strength allowables with a statistical basis of 90 percent probability with 95 percent confidence. (c)       Some special residual strength considerations for bonded structure are given in paragraph 6.c.(3). (5)       The repeated load spectrum developed for fatigue testing and analysis purposes should be representative of the anticipated service usage. Low amplitude load levels that can be shown not to contribute to damage growth may be omitted. Reducing maximum load levels is generally not accepted. Variability in repeated load behaviour should be covered by appropriate load enhancement or life scatter factors and these factors should take into account the number of specimens tested. The use of such factors to demonstrate reliability in component tests should be consistent with the fatigue and damage tolerance behaviour characterised for the materials, processes and other design details of the structure in building block tests. (6)       An inspection programme should be developed consisting of frequency, extent, and methods of inspection for inclusion in the maintenance plan. Inspection intervals should be established such that the damage will be reliably detected between the time it initially becomes detectable and the time at which the extent of damage reaches the limits for required residual strength capability. The potential for missed inspections should be considered. (a)       For the case of no-growth design concept, inspection intervals should be established as part of the maintenance programme. In selecting such intervals, the residual strength level associated with the assumed damages should be considered. This point was illustrated in Figures 4 and 5. Note that an acceptable inspection interval for the larger damages shown for the “no-growth” and “arrested growth” options in Figures 4 and 5 was conceptually shown as related to an acceptable slow growth basis in terms of the residual strength and time below ultimate load before damage was detected and repaired. Data on the probability of occurrence for different damage sizes also helps define an inspection interval. (b)       A thorough composite damage threat assessment and the separation of different damage sizes into categories, each with associated detection methods, supports programmes using a rigorous damage tolerance assessment to avoid conservative design criteria with very large damage assumptions. In such cases, Category 2 damage types will require the structural substantiation of well specified and reliable inspection methods applied by trained inspectors at scheduled maintenance intervals (by default, Category 1 damage is at the threshold of this evaluation). Those damages classified as Category 3 may take advantage of shorter service time intervals provided sufficient structural substantiation exists with demonstrated proof that there will be early detection by untrained ramp maintenance or operations personnel. By definition, Category 4 damage will require residual strength substantiation to levels that complete a flight with limited manoeuvres based on the associated regulatory loads. Due to the nature of service events leading to Category 4 damage, suitable inspections will need to be defined to evaluate the full extent of damage, prior to subsequent aircraft repair and return to service. By definition, Category 5 damages do not have associated damage tolerance design criteria or related structural substantiation tasks. Category 5 damage will require suitable inspections based on engineering assessment of the anomalous service event, and appropriate structural repair and/or part replacement, prior to the aircraft re-entering service. (7)       The structure should be able to withstand static loads (considered as ultimate loads) which are reasonably expected during a completion of the flight on which damage resulting from obvious discrete sources occur (i.e., uncontained engine failures, etc.). The extent of damage should be based on a rational assessment of service mission and potential damage relating to each discrete source. Structural substantiation will be needed for the most critical Category 4 damage as related to the associated load cases. Some Category 4 damage may have high margins but will likely still require suitable inspections since their detectability may not be consistent with the substantiations validated for Category 2 damage types. (8)       The effects of temperature, humidity, and other environmental or time-related aging factors, which may result in material property degradation, should be addressed in the damage tolerance evaluation. Unless tested in the environment, appropriate environmental factors should be derived and applied in the evaluation. b.         Fatigue Evaluation Fatigue substantiation should be accomplished by component fatigue tests or by analysis supported by test evidence, accounting for the effects of the appropriate environment. The test articles should be fabricated and assembled in accordance with production specifications and processes so that the test articles are representative of production structures. Sufficient component, sub-component, element or coupon tests should be performed to establish the fatigue scatter and the environmental effects. Component, sub-component, and/or element tests may be used to evaluate the fatigue response of structure with impact damage levels typical of those that may occur during fabrication, assembly, and in service, consistent with the inspection procedures employed. Other allowed manufacturing and service defects, which would exist for the life of the structure, should also be included in fatigue testing. It should be demonstrated during the fatigue tests that the stiffness properties have not changed beyond acceptable levels. Replacement lives should be established based on the test results. By definition, Category 1 damage is subjected to fatigue evaluation and expected to retain ultimate load capability for the life of the aircraft structure. c.         Combined Damage Tolerance and Fatigue Evaluation Generally, it is appropriate for a given structure to establish both an inspection programme and demonstrate a service life to cover all detectable and non-detectable damage, respectively, which is anticipated for the intended aircraft usage. Extensions in service life should include evidence from component repeated load testing, fleet leader programmes (including NDI and destructive tear-down inspections), and appropriate statistical assessments of accidental damage and environmental service data considerations. 9.         PROOF OF STRUCTURE – FLUTTER AND OTHER AEROELASTIC INSTABILITIES The aeroelastic evaluations including flutter, control reversal, divergence, and any undue loss of stability and control as a result of structural loading and resulting deformation, are required. Flutter and other aeroelastic instabilities must be avoided through design, quality control, maintenance, and systems interaction. a.         The evaluation of composite structure needs to account for the effects of repeated loading, environmental exposure, and service damage scenarios (e.g., large Category 2, 3 or 4 damage) on critical properties such as stiffness, mass and damping. Some control surfaces exposed to large damage retain adequate residual strength margins, but the potential loss of stiffness or mass increase (e.g., sandwich panel disbond and/or water ingression) may adversely affect flutter and other aeroelastic characteristics. This is particularly important for control surfaces that are prone to accidental damage and environmental degradation. Other factors such as the weight or stiffness changes due to repair, manufacturing flaws, and multiple layers of paint need to be evaluated. There may also be issues associated with the proximity of high temperature heat sources near structural components (e.g., empennage structure in the path of jet engine exhaust streams or engine bleed air pneumatics system ducting). These effects may be determined by analysis supported by test evidence, or by tests at the coupon, element or sub-component level. 10.       CONTINUED AIRWORTHINESS The maintenance and repair of composite aircraft structure should meet all general, design and fabrication, static strength, fatigue/damage tolerance, flutter, and other considerations covered by this AMC as appropriate for the particular type of structure and its application. a.         Design for Maintenance Composite aircraft structure should be designed for inspection and repair access in a field maintenance environment. The inspection and repair methods applied for structural details should recognise the special documentation and training needed for critical damage types that are difficult to detect, characterise and repair. The inspection intervals and life limits for any structural details and levels of damage that preclude repair must be clearly documented in the appropriate continued airworthiness documents. b.         Maintenance Practices Maintenance manuals, developed by the appropriate organisations, should include appropriate inspection, maintenance, and repair procedures for composite structures, including jacking, disassembly, handling, part drying methods, and repainting instructions (including restrictions for paint colours that increase structural temperatures). Special equipment, repair materials, ancillary materials, tooling, processing procedures, and other information needed for inspection or repair of a given part should be identified since standard field practices, which have been substantiated for different aircraft types and models, are not common. (1)       Damage Detection (a)       Procedures used for damage detection must be shown to be reliable and capable of detecting degradation in structural integrity below ultimate load capability. These procedures must be documented in the appropriate sections of the instructions for continued airworthiness. This should be substantiated in static strength, environmental resistance, fatigue, and damage tolerance efforts as outlined in paragraphs 6, 7 and 8. Substantiated detection procedures will be needed for all damage types identified by the threat assessment, including a wide range of foreign object impact threats, manufacturing defects, and degradation caused by overheating. Degradation in surface layers (e.g., paints and coatings) that provide structural protection against ultraviolet exposure must be detected. Any degradation to the lightning strike protection system that affects structural integrity, fuel tank safety, and electrical systems must also be detected. (b)       Visual inspection is the predominant damage detection method used in the field and should be performed under prescribed lighting conditions. Visual inspection procedures should account for access, time relaxation in impact damage dent depth, and the colour, finish and cleanliness of part surfaces. (2)       Inspection. Visual indications of damage, which are often used for composite damage detection, provide limited details on the hidden parts of damage that require further investigation. As a result, additional inspection procedures used for complete composite damage characterisation will generally be different from those used for initial damage detection and need to be well documented. Non-destructive inspection performed prior to repair and destructive processing steps performed during repair must be shown to locate and determine the full extent of the damage. In-process controls of repair quality and post-repair inspection methods must be shown to be reliable and capable of providing engineers with the data to determine degradation in structural integrity below ultimate load capability caused by the process itself. Certain processing defects cannot be reliably detected at completion of the repair (e.g., weak bonds). In such cases, the damage threat assessment, repair design features and limits should ensure sufficient damage tolerance. (3)       Repair. All bolted and bonded repair design and processing procedures applied for a given structure shall be substantiated to meet the appropriate requirements. Of particular safety concern are the issues associated with bond material compatibilities, bond surface preparation (including drying, cleaning, and chemical activation), cure thermal management, composite machining, special composite fasteners, and installation techniques, and the associated in‑process control procedures. The surface layers (e.g., paints and coatings) that provide structural protection against ultraviolet exposure, structural temperatures, and the lightning strike protection system must also be properly repaired. (4)       Documentation and Reporting. Documentation on all repairs must be added to the maintenance records for the specific part number. This information supports future maintenance damage disposition and repair activities performed on the same part. It is recommended that service difficulties, damage, and degradation occurring to composite parts in service should be reported back to the design approval holder to aid in continuous updates of damage threat assessments to support future design detail and process improvements. Such information will also support future design criteria, analysis, and test database development. c.         Substantiation of Repair (1)       When repair procedures are provided in Agency approved documents or the maintenance manual, it should be demonstrated by analysis and/or test that the method and techniques of repair will restore the structure to an airworthy condition. Repairable damage limits (RDL), which outline the details for damage to structural components that may be repaired based on existing data, must be clearly defined and documented. Allowable damage limits (ADL), which do not require repair, must also be clearly defined and documented. Both RDL and ADL must be based on sufficient analysis and test data to meet the appropriate structural substantiation requirements and other considerations outlined in this AMC. Additional substantiation data will generally be needed for damage types and sizes not previously considered in design development. Some damage types may require special instructions for field repair and the associated quality control. Bonded repair is subjected to the same structural bonding considerations as the base design (refer to paragraph 6.c). (2)       Operators and maintenance repair organisations (MRO) wishing to complete major repairs or alterations outside the scope of approved repair documentation should be aware of the extensive analysis, design, process, and test substantiation required to ensure the airworthiness of a certificated structure. Documented records and the certification approval of this substantiation should be retained in accordance with regulations to support any subsequent maintenance activities. d.         Damage Detection, Inspection and Repair Competency (1)       All technicians, inspectors and engineers involved in damage disposition and repair should have the necessary skills to perform their supporting maintenance tasks on a specific composite structural part. The continuous demonstration of acquired skills goes beyond initial training (e.g., similar to a welder qualification). The repair design, inspection methods, and repair procedures used will require approved structural substantiation data for the particular composite part. Society of Automotive Engineers International (SAE) Aerospace Information Report (AIR) 5719 outlines training for an awareness of the safety issues for composite maintenance and repair. Additional training for specific skill building will be needed to execute particular engineering, inspection and repair tasks. (2)       Pilots, ramp maintenance, and other operations personnel that service aircraft should be trained to immediately report anomalous ramp incidents and flight events that may potentially cause serious damage to composite aircraft structures. In particular, immediate reporting is needed for those service events that are outside the scope of the damage tolerance substantiation and standard maintenance practices for a given structure. The immediate detection of Category 4 and 5 damages are dependent on the proper reaction of personnel that operate and service the aircraft. 11.       ADDITIONAL CONSIDERATIONS a.         Crashworthiness (1)       The crashworthiness of the aircraft is dominated by the impact response characteristics of the fuselage. Regulations, in general, evolve based on either experience gained through incidents and accidents of existing aircraft or in anticipation of safety issues raised by new designs. In the case of crashworthiness, regulations have evolved as experience has been gained during actual aircraft operations. For example, emergency load factors and passenger seat loads have been established to reflect dynamic conditions observed from fleet experience and from controlled FAA and industry research. Fleet experience has not demonstrated a need to have an aircraft level crashworthiness standard. As a result, the regulations reflect the capabilities of traditional aluminium aircraft structure under survivable crash conditions. This approach was satisfactory as aircraft have continued to be designed using traditional construction methods. With the advent of composite fuselage structure and/or the use of novel design, this historical approach may no longer be sufficient to substantiate the same level of protection for the passengers as provided by similar metallic designs. (2)       Airframe design should assure that occupants have every reasonable chance of escaping serious injury under realistic and survivable crash impact conditions. A composite design should account for unique behaviour and structural characteristics, including major repairs or alterations, as compared with conventional metal airframe designs. Structural evaluation may be done by test or analysis supported by test evidence. Service experience may also support substantiation. (3)       The crash dynamics of an aircraft and the associated energy absorption are difficult to model and fully define representative tests with respect to structural requirements. Each aircraft product type (i.e., large aeroplane, small aeroplane, and rotorcraft) has unique regulations governing the crashworthiness of particular aircraft structures. The regulations and guidance associated with each product type should be used accordingly. The regulations for large aeroplane and rotorcraft address some issues that go beyond those required of small aeroplanes. (4)       Special conditions are anticipated for large aeroplanes with composite fuselage structure to address crashworthiness survivability. The impact response of a composite fuselage structure must be evaluated to ensure the survivability is not significantly different from that of a similar-sized aircraft fabricated from metallic materials. Impact loads and resultant structural deformation of the supporting airframe and floor structures must be evaluated. Four main criteria areas should be considered in making such an evaluation. (a)       Occupants must be protected during the impact event from release of items of mass (e.g., overhead bins). (b)       At least the minimum number of emergency egress paths must remain following a survivable crash. (c)       The acceleration and loads experienced by occupants during a survivable crash must not exceed critical thresholds. (d)       A survivable volume of occupant space must be retained following the impact event. (5)       The criticality of each of these four criteria will depend on the particular crash conditions. For example, the loads and accelerations experienced by passengers may be higher at lower impact velocities where structural failures have not started to occur. As a result, validated analyses may be needed to practically cover all the crashworthiness criteria for a fuselage. (6)       Existing large aeroplane requirements also require that fuel tank structural integrity be addressed during a survivable crash impact event as related to fire safety (also refer to paragraph 11.b). As related to crashworthiness, composite fuel tank structure must not fail or deform to the extent that fire becomes a greater hazard than with metal structure. (7)       Physics and mechanics of the crashworthiness for composite structures involve several issues. The local strength, energy absorbing characteristics, and multiple competing failure modes need to be addressed for composite structure subjected to a survivable crash. This is not simply achieved for airframe structures made from anisotropic, quasi-brittle, composite materials. As a result, the accelerations and load histories experienced by passengers and equipment on a composite aircraft may differ significantly from that seen on a similar metallic aircraft unless specific considerations are designed into the composite structure. In addition, care should be taken when altering composite structure to achieve specific mechanical behaviours. (For example, where the change in behaviour of a metallic structure with a change in material thickness may be easily predicted, an addition or deletion of plies to a composite laminate may also require data for the effects of laminate stacking sequence on the failure mode and energy absorption characteristics of a composite element). (8)       Representative structure must be included to gain valid test and analysis results. Depending on aircraft loading (requiring investigation of various aircraft passenger and cargo configurations), structural dynamic considerations, and progressive failures, local strain rates and loading conditions may differ throughout the structure. Sensitivity of the structural behaviour to reasonable impact orientation should also be considered for large aeroplane and rotorcraft applications. This can be addressed by analysis supported by test evidence. (9)       Considering a need for comparative assessments with metal structure and a range of crash conditions, analysis with sufficient structural test evidence is often needed for large aeroplane and rotorcraft applications. Analysis requires extensive investigation of model sensitivity to modelling parameters (e.g., mesh optimisation, representation of joints, element material input stress-strain data). Test also requires investigation of test equipment sensitivity appropriate to composites (e.g., filter frequencies with respect to expected pulse characteristics in the structure). Model validation may be achieved using a building block approach, culminating in an adequately complex test (e.g., a drop test with sufficient structural details to properly evaluate the crashworthiness criteria). b.         Fire Protection, Flammability and Thermal Issues (1)       Fire and exposure to temperatures that exceed maximum operating conditions require special considerations for composite airframe structure. (Refer to note below). Requirements for flammability and fire protection of aircraft structure attempt to minimise the hazard to occupants in the event that flammable materials, fluids, or vapours ignite. The regulations associated with each aircraft product type (i.e., transport, small airplane, rotorcraft) should be used accordingly. Compliance may be shown by tests or analysis supported by test evidence. A composite design, including repair and alterations, should not decrease the existing level of safety relative to metallic structure. In addition, maintenance procedures should be available to evaluate the structural integrity of any composite aircraft structures exposed to fire and temperatures above the maximum operating conditions substantiated during design. Note: Aircraft cabin interiors and baggage compartments have been areas of flammability concerns in protecting passenger safety. This revision of the AMC does not address composite materials used in aircraft interiors and baggage compartments. Please consult other Guidance Material for Acceptable Means of Compliance with flammability rules for interiors. (2)       Fire protection and flammability has traditionally been considered for engine mount structure, firewalls, and other powerplant structures that include composite elements. Additional issues critical to passenger safety have come with the expanded use of composites in wing and fuselage structures for large aeroplanes. Existing regulations do not address the potential for the airframe structure itself to be flammable. Wing and fuselage applications should consider the effects of composite design and construction on the resulting passenger safety in the event of in-flight fires or emergency landing conditions, which combine with subsequent egress when a fuel-fed fire is possible. (3)       The results of fire protection and flammability testing with structural composite parts indicate dependence upon overall design and process details, as well as the origin of the fire and its extent. For example, the overall effects of composite fuselage structures exposed to fire may be significantly different when the fire originates within the cabin, where it can be controlled by limiting the structure’s contribution to spreading the fire, than when the fire occurs exterior to the fuselage after a crash landing, where fuel is likely to be the primary source for maintaining and spreading the fire. The threat in each case is different, and the approach to mitigation may also be different. In-flight fire safety addresses a fire originating within the aircraft due to some fault, whereas post-crash fire safety addresses a fuel fed pool fire external to the aircraft. Special conditions are anticipated for large aeroplanes with fuselage structure subjected to both in-flight and post-crash fire conditions. Large aeroplane wing structure will need to have special conditions for post-crash fire conditions. (4)       For an in-flight fire in large aeroplanes, it is critical that the fire not propagate or generate hazardous quantities of toxic by-products. In-flight fires have been catastrophic when they can grow in inaccessible areas. Composite fuselage structure could play a role different from traditional metal structure if the issue is not addressed. (5)       Metallic large aeroplane fuselage and wing structures have established a benchmark in fire protection that can be used to evaluate specific composite wing and fuselage structural details. Exterior fire protection issues associated with composite structure must include the effects of an exterior pool fire following a survivable crash landing. Fuselage structure should provide sufficient time for passenger egress, without fire penetration or the release of gasses and/or materials that are either toxic to escaping passengers or reduce visibility (smoke density) or could increase the fire severity. Furthermore, these considerations must be extended to wing and fuel tank structure, which must also be prevented from collapse and release of fuel (including consideration of the influence of fuel load upon the structural behaviour. For large aeroplanes, the standards of CS 25.856(b) provide the benchmark to establish the required level of safety. (6)       The exposure of composite structures to high temperatures needs to extend beyond the direct flammability and fire protection issues to other thermal issues. Many composite materials have glass transition temperatures, which mark the onset of reductions in strength and stiffness that are somewhat lower than the temperatures that can have a similar effect on equivalent metallic structure. The glass transition temperature of most composite materials is further reduced by moisture absorption. The reduced strength or stiffness of composites from high temperature exposures must be understood per the requirements of particular applications (e.g., engine or other system failures). After a system failure and/or known fire, it may be difficult to detect the full extent of irreversible heat damage to an exposed composite structure. As a result, composite structures exposed to high temperatures may require special inspections, tests, and analysis for proper disposition of heat damage. All appropriate damage threats and degradation mechanisms need to be identified and integrated into the damage tolerance and maintenance evaluation accordingly. Reliable inspections and test measurements of the extent of damage that exists in a part exposed to unknown levels of high temperatures should be documented. Particular attention should be given to defining the maximum damages that likely could remain undetected by the selected inspection procedures. c.         Lightning Protection Lightning protection design features are needed for composite aircraft structures. Current Carbon fibre composites are approximately 1,000 times less electrically conductive than standard aluminium materials, and composite resins and adhesives are traditionally non-conductive. Glass and aramid fibre composites are non-conductive. A lightning strike to composite structures can result in structural failure or large area damage, and it can induce high lightning current and voltage on metal hydraulic tubes, fuel system tubes, and electrical wiring if proper conductive lightning protection is not provided. Aircraft lightning protection design guidance can be found in the FAA Technical Report “Aircraft Lightning Protection Handbook” (See [Appendix 1](#_DxCrossRefBm421436874) 2.a). The lightning protection effectiveness for composite structures should be demonstrated by tests or analysis supported by tests. Such tests are typically performed on panels, coupons, subassemblies, or coupons representative of the aircraft structure, or tests on full aircraft. The lightning test waveforms and lightning attachment zones are defined in EUROCAE ED-84 and ED-91. Any structural damage observed in standard lightning tests should be limited to Category 1, 2 or 3, depending on the level of detection. This damage is characterised and integrated into damage tolerance analyses and tests as appropriate. Small simple aeroplanes certified under CS-23 for VFR use only may be certified based on engineering assessment, according to AC 23-15A. The effects of composite structural repairs and maintenance on the lightning protection system should be evaluated. Repairs should be designed to maintain lightning protection. (1)       Lightning Protection for Structural Integrity (a)       The composite structural design should incorporate the lightning protection when appropriate for the anticipated lightning attachment. The extent of lightning protection features depends on the lightning attachment zone designated for that area of the aircraft. Lightning protection features may include, but are not limited to, metal wires or mesh added to the outside surface of the composite structure where direct lightning attachment is expected. (b)       When lightning strikes an aircraft, very high currents flow through the airframe. Proper electrical bonding must be incorporated between structural parts. This is difficult to achieve for moveable parts (e.g., ailerons, rudders and elevators). The electrical bonding features must be sized to conduct the lightning currents or they can vaporise, sending the high currents through unintended paths such as control cables, control rods, or hydraulic tubes. Guidance for certification of lightning protection of aircraft structures can be found in EUROCAE ED-113. (2)       Lightning Protection for Fuel Systems (a)       Special consideration must be given to the fuel system lightning protection for an aircraft with integral fuel tanks in a composite structure. Composite structure with integral fuel systems must incorporate specific lightning protection features on the external composite surfaces, on joints, on fasteners, and for structural supports for fuel system plumbing and components to eliminate structural penetration, arcing, sparks or other ignition sources. AC 20-53B provides certification guidance for aircraft fuel system lightning protection. (b)       Large aeroplane regulations for fuel system ignition prevention in CS 25.981 require lightning protection that is failure tolerant. As a result, redundant and robust lightning protection for composite structure joints and fasteners in fuel tank structure is needed to ensure proper protection in preventing ignition sources. (3)       Lightning Protection for Electrical and Electronic Systems (a)       Lightning strike protection of composite structures is needed to avoid inducing high lightning voltages and currents on the wiring for electrical and electronic systems whose upset or damage could affect safe aircraft operation. The consequences from a lightning strike of unprotected composite structures can be catastrophic for electrical and electronic systems that perform highly critical functions, such as fly-by-wire flight controls or engine controls. (b)       Electrical shields over system wiring and robust circuit design of electrical and electronic equipment both provide some protection against system upset or damage due to lightning. Since most composite materials provide poor shielding, at best, metal foil or mesh is typically added to the composite structure to provide additional shielding for wiring and equipment. Electrical bonding between composite structure parts and panels should be provided for the shielding to be effective. EUROCAE ED‑81 and ED-107 provide certification guidance for aircraft electrical and electronic system lightning protection. [Amdt 20/6] AMC 20-29 Composite Aircraft Structure ED Decision 2010/003/R 1.         PURPOSE This AMC provides an acceptable means, but not the only means, for airworthiness certification of composite aircraft structures. Guidance information is also presented on the closely related design, manufacturing and maintenance aspects. This AMC primarily addresses carbon and glass fibre reinforced plastic structures, although many aspects of this document are also applicable to other forms of structure, e.g. metal bonded structure, wooden structure, etc. Note: When applying this guidance to other forms of structure, additional design considerations may be necessary and other appropriate references should also be consulted. 2.         OBJECTIVE AMC 20-29 standardises recognised good design practices common to composite aircraft structures in one document. For rotorcraft, AMC 20-29 complements existing AMC to CS-27 and CS-29 (referring to FAA AC 27-1B MG8 and AC 29-2C MG8). 3.         APPLICABILITY This AMC provides Acceptable Means of Compliance with the provisions of CS-23, CS-25, CS-27 and CS-29. Many of the concepts included in this AMC may also be applicable in part or in full to other CSs. However, when using this AMC as an Acceptable Means of Compliance for these other CSs, appropriate engineering judgement should be exercised and early agreement with the Agency sought. This AMC applies to: applicants for a type-certificate, restricted type-certificate or supplemental type-certificate; certificate/approval holders; parts manufacturers; material suppliers; and maintenance and repair organisations. Note: The technical content of this AMC is harmonised with FAA Advisory Circular AC 20-107B, dated 8 September 2009. 4.         RELATED REGULATIONS AND GUIDANCE a.         Applicable paragraphs are listed in [Appendix 1](#_DxCrossRefBm1926189312). b.         Relevant guidance considered complementary to this AMC is provided in [Appendix 1](#_DxCrossRefBm1926189312). 5.         GENERAL a.         The procedures outlined in this AMC provide Acceptable Means of Compliance and Guidance Material for composite structures, particularly those that are essential in maintaining the overall flight safety of the aircraft (“critical structure” as defined in [Appendix 2](#_DxCrossRefBm1926189314)). This AMC is published to aid in the evaluation of certification programmes for composite applications and to reflect the current status of composite technology. It is expected that this AMC will be modified periodically to reflect the continued evolution of composite technology and the data collected from service experience and expanding applications. b.         There are factors unique to the specific composite materials and processes used for a given application. For example, the environmental sensitivity, anisotropic properties, and heterogeneous nature of composites can make the determination of structural failure loads, modes, and locations difficult. The reliability of such evaluation depends on repeatable structural details created by scaled manufacturing or repair processes. The extent of testing and/or analysis may differ for a structure depending upon the criticality to flight safety, expected service usage, the material and processes selected, the design margins, the failure criteria, the database and experience with similar structures, and on other factors affecting a particular structure. It is expected that these factors will be considered when interpreting this AMC for use on a specific application. c.         Definitions of terms used in this AMC can be found in [Appendix 2](#_DxCrossRefBm1926189314). 6.         MATERIAL AND FABRICATION DEVELOPMENT All composite materials and processes used in structures are qualified through enough fabrication trials and tests to demonstrate a reproducible and reliable design. One of the important features of composite construction is the degree of care needed in the procurement and processing of composite materials. The final mechanical behaviour of a given composite material may vary greatly depending on the processing methods employed to fabricate production parts. Special care needs to be taken in controlling both the materials being procured and how the material is processed once delivered to the fabrication facility. The CSs (namely paragraphs 2x.603 and 2x.605) specify the need to procure and process materials under approved material and process specifications that control the key parameters governing performance. These paragraphs outline a need to protect structures against the degradation possible in service. They also require that the design account for any changes in performance (e.g., environmental and variability effects) permitted by material and process specifications. a.         Material and Process Control (1)       Specifications covering material, material processing, and fabrication procedures are established to ensure a basis for fabricating reproducible and reliable structure. Material specifications are required to ensure consistent material can be procured, and batch acceptance testing or statistical process controls are used to ensure material properties do not drift over time. Specifications covering processing procedures should be developed to ensure that repeatable and reliable structure can be manufactured. The means of processing qualification and acceptance tests defined in each material specification should be representative of the expected applicable manufacturing process. The process parameters for fabricating test specimens should match the process parameters to be used in manufacturing actual production parts as closely as possible. Both test and production parts must conform to material and process specifications. (2)       Once the fabrication processes have been established, changes should undergo additional qualification, including testing of differences, before being implemented, (refer to [Appendix 3](#_DxCrossRefBm1926189313)). It is important to establish processing tolerances, material handling and storage limits, and key characteristics, which can be measured and tracked to judge part quality. (3)       Material requirements identified in procurement specifications should be based on the qualification test results for samples produced using the related process specifications. Qualification data must cover all properties important to the control of materials (composites and adhesives) and processes to be used for production of composite structure. Carefully selected physical, chemical, and mechanical qualification tests are used to demonstrate the formulation, stiffness, strength, durability, and reliability of materials and processes for aircraft applications. It is recommended that airframe designers and manufacturers work closely with material suppliers to properly define material requirements. (4)       To provide an adequate design database, environmental effects on critical properties of the material systems and associated processes should be established. In addition to testing in an ambient environment, variables should include extreme service temperature and moisture content conditions and effects of long-term durability. Qualification tests for environmental effects and long-term durability are particularly important when evaluating the materials, processes, and interface issues associated with structural bonding (refer to paragraph 6.c for related guidance). (5)       Key characteristics and processing parameters should be specified and monitored for in-process quality control. The overall quality control plan required by the certifying agency should involve all relevant disciplines, i.e., engineering, manufacturing, and quality control. A reliable quality control system should be in place to address special engineering requirements that arise in individual parts or areas as a result of potential failure modes, damage tolerance and flaw growth requirements, loadings, inspectability, and local sensitivities to manufacture and assembly. (6)       Tolerances permitted by the material and process specifications should be substantiated by analysis supported by test evidence, or tests at the coupon, element or sub-component level. For new production methods, repeatable processes should be demonstrated at sufficient structural scale in a way shown to be consistent with the material and process qualification tests and development of the associated specifications. This will require integration of the technical issues associated with product design and manufacturing details prior to a large investment in structural tests and analysis correlation. It will also ensure the relevance of quality control procedures defined to control materials and processes as related to the product structural details. (7)       Note that the Agency does not certify materials and processes. However, materials and processes specifications are part of the type-design subject to type-certification. Appropriate certification credit may be given to products and organisations using the same materials and processes in similar applications subject to substantiation and applicability. In some cases, material and processing information may become part of accepted shared databases used throughout the industry. New users of shared qualification databases must control the associated materials and processes through proper use of the related specifications and demonstrate their understanding by performing equivalency sampling tests for key properties. Note that materials and processes used in European Technical Standard Order (ETSO) articles or authorisations must also be qualified and controlled. b.         Design Considerations for Manufacturing Implementation (1)       Process specifications and manufacturing documentation are needed to control composite fabrication and assembly. The environment and cleanliness of facilities are controlled to a level validated by qualification and proof of structure testing. Raw and ancillary materials are controlled to specification requirements that are consistent with material and process qualifications. Parts fabricated should meet design drawing tolerances obtained from the production tolerances validated in qualification, design data development, and proof of structure tests. Some key fabrication process considerations requiring such control include: (i) material handling and storage, (ii) laminate layup and bagging (or other alternate process steps for non-laminated material forms and advanced processes), (iii) mating part dimensional tolerance control, (iv) part cure (thermal management), (v) machining and assembly, (vi) cured part inspection and handling procedures, and (vii) technician training for specific material, processes, tooling and equipment. (2)       Substantiating data is needed for design to justify all known defects, damage and anomalies allowed to remain in service without rework or repair. Adequate manufacturing records support the identification and substantiation of known defects, damage and anomalies. (3)       Additional substantiating design data is needed from new suppliers of parts previously certificated. This may be supported by manufacturing trials and quality assessments to ensure equivalent production and repeatability. Some destructive inspection of critical structural details is needed for manufacturing flaws that are not end item inspectable and require process controls to ensure reliable fabrication. c.         Structural Bonding Bonded structures include multiple interfaces (e.g., composite-to-composite, composite-to-metal, or metal-to-metal), where at least one of the interfaces requires additional surface preparation prior to bonding. The general nature of technical parameters that govern different types of bonded structures are similar. A qualified bonding process is documented after demonstrating repeatable and reliable processing steps such as surface preparation. It entails understanding the sensitivity of structural performance based upon expected variation permitted per the process. Characterisation outside the process limits is recommended to ensure process robustness. In the case of bonding composite interfaces, a qualified surface preparation of all previously cured substrates is needed to activate their surface for chemical adhesion. For all bonding interfaces, regardless if on metallic or previously cured composite substrates, a qualified surface preparation is needed to activate their surface for chemical adhesion. Many technical issues for bonding require cross-functional teams for successful applications. Applications require stringent process control and a thorough substantiation of structural integrity. (1)       Many bond failures and problems in service have been traced to invalid qualifications or insufficient quality control of production processes. Physical and chemical tests may be used to control surface preparation, adhesive mixing, viscosity, and cure properties (e.g., density, degree of cure, glass transition temperature). Lap shear stiffness and strength are common mechanical tests for adhesive and bond process qualification. Shear tests do not provide a reliable measure of long-term durability and environmental degradation associated with poor bonding processes (i.e., lack of adhesion). Some type of peel test has proven more reliable for evaluating proper adhesion. Without chemical bonding, the so-called condition of a “weak bond” exists when the bonded joint is either loaded by peel forces or exposed to the environment over a long period of time, or both. Adhesion failures, which indicate the lack of chemical bonding between substrate and adhesive materials, are considered an unacceptable failure mode in all test types. Material or bond process problems that lead to adhesion failures are solved before proceeding with qualification tests. (2)       Process specifications are needed to control adhesive bonding in manufacturing and repair. A “process control mentality”, which includes a combination of in-process inspections and tests, has proven to be the most reliable means of ensuring the quality of adhesive bonds. The environment and cleanliness of facilities used for bonding processes are controlled to a level validated by qualification and proof of structure testing. Adhesives and substrate materials are controlled to specification requirements that are consistent with material and bond process qualifications. The bonding processes used for production and repair meet tolerances validated in qualification, design data development, and proof of structure tests. Some key bond fabrication process considerations requiring such control include: (i) material handling and storage, (ii) bond surface preparation, (iii) mating part dimensional tolerance control, (iv) adhesive application and clamp-up pressure, (v) bond line thickness control, (vi) bonded part cure (thermal management), (vii) cured part inspection and handling procedures, and (vii) bond technician training for specific material, processes, tooling and equipment. Bond surface preparation and subsequent handling controls leading up to the bond assembly and cure must be closely controlled in time and exposure to environment and contamination. (3)       CS 23.573(a) sets the certification specification for primary composite airframe structures, including considerations for damage tolerance, fatigue, and bonded joints. Although this is a small aeroplane rule, the same performance standards are normally expected for large aeroplanes and rotorcraft (via special conditions and CRIs). (a)       For bonded joints, CS 23.573(a)(5) states: "For any bonded joint, the failure of which would result in catastrophic loss of the aeroplane, the limit load capacity must be substantiated by one of the following methods: (i)        The maximum disbonds of each bonded joint consistent with the capability to withstand the loads in paragraph (a)(3) of this section must be determined by analysis, tests, or both. Disbonds of each bonded joint greater than this must be prevented by design features; or (ii)       Proof testing must be conducted on each production article that will apply the critical limit design load to each critical bonded joint; or (iii)      Repeatable and reliable non-destructive inspection techniques must be established that ensure the strength of each joint." (b)       These options do not supersede the need for a qualified bonding process and rigorous quality controls for bonded structures. For example, fail safety implied by the first option is not intended to provide adequate safety for the systematic problem of a bad bonding process applied to a fleet of aircraft structures. Instead, it gives fail safety against bonding problems that may occasionally occur over local areas (e.g., insufficient local bond contact pressure or contamination). Performing static proof tests to limit load, which is the second option, may not detect weak bonds requiring environmental exposure and time to degrade bonded joint strength. This issue should be covered by adequately demonstrating that qualified bonding materials and processes have long-term environmental durability. Finally, the third option is open for future advancement and validation of non-destructive inspection (NDI) technology to detect weak bonds, which degrade over time and lead to adhesion failures. Such technology has not been reliably demonstrated at a production scale to date. (4)       Adhesion failures are an unacceptable failure mode for bonded structure that require immediate action by the responsible engineers to identify the specific cause and isolate all affected parts and assemblies for directed inspection and repair. Depending on the suspected severity of the bonding problem, an airworthiness directive may be required to restore the affected aircraft to an airworthy condition. Any design, manufacturing or repair details linked to the bonding problem should also be permanently corrected. d.         Environmental Considerations Environmental design criteria should be developed that identify the critical environmental exposures, including humidity and temperature, to which the material in the application under evaluation may be exposed. Service data (e.g., moisture content as a function of time in service) can be used to ensure such criteria are realistic. In addition, the peak temperatures for composite structure installed in close proximity to aircraft systems that generate thermal energy need to be identified for worst-case normal operation and system failure cases. Environmental design criteria are not required where existing data demonstrate that no significant environmental effects, including the effects of temperature and moisture, exist for the material system and construction details, within the bounds of environmental exposure being considered. (1)       Experimental evidence should be provided to demonstrate that the material design values or allowables are attained with a high degree of confidence in the appropriate critical environmental exposures to be expected in service. It should be realised that the worst case environment may not be the same for all structural details (e.g., hot wet conditions can be critical for some failure modes, while cold dry conditions may be worse for others). The effect of the service environment on static strength, fatigue and stiffness properties and design values should be determined for the material system through tests, e.g., accelerated environmental tests, or from applicable service data. The maximum moisture content considered is related to that possible during the service life, which may be a function of a given part thickness, moisture diffusion properties and realistic environmental exposures. The effects of environmental cycling (i.e., moisture and temperature) should be evaluated when the application involves fluctuations or unique design details not covered in the past. Existing test data may be used where it can be shown to be directly applicable to the material system, design details, and environmental cycling conditions characteristic of the application. All accelerated test methods should be representative of real-time environmental and load exposure. Any factors used for acceleration that chemically alter the material (e.g., high temperatures that cause post-cure) should be avoided to ensure behaviour representative of real environmental exposures. (2)       Depending on the design configuration, local structural details, and selected processes, the effects of residual stresses that depend on environment should be addressed (e.g., differential thermal expansion of attached parts). e.         Protection of Structure Weathering, abrasion, erosion, ultraviolet radiation, and chemical environment (glycol, hydraulic fluid, fuel, cleaning agents, etc.) may cause deterioration in a composite structure. Suitable protection against and/or consideration of degradation in material properties should be provided for conditions expected in service and demonstrated by test and/or appropriate validated experience. Where necessary, provide provisions for ventilation and drainage. Isolation layers are needed at the interfaces between some composite and metal materials to avoid corrosion (e.g., glass plies are used to isolate carbon composite layers from aluminium). In addition, qualification of the special fasteners and installation procedures used for parts made from composite materials need to address the galvanic corrosion issues, as well as the potential for damaging the composite (delamination and fibre breakage) in forming the fastener. f.          Design Values Data used to derive design values must be obtained from stable and repeatable material that conforms to mature material and representative production process specifications. This will ensure that the permitted variability of the production materials is captured in the statistical analysis used to derive the design values. Design values derived too early in the material’s development stage, before raw material and composite part production processes have matured, may not satisfy the intent of the associated rules. Laminated material system design values should be established on the laminate level by either test of the laminate or by test of the lamina in conjunction with a test validated analytical method. Similarly, design values for non-laminated material forms and advanced composite processes must be established at the scale that best represents the material as it appears in the part or by tests of material substructure in conjunction with a test validated analytical method. g.         Structural Details For a specific structural configuration of an individual component (point design), design values may be established which include the effects of appropriate design features (holes, joints, etc.). Specific metrics that quantify the severity of composite structural damage states caused by foreign impact damage threats are needed to perform analysis (i.e., the equivalent of a metallic crack length). As a result, testing will often be needed to characterise residual strength, including the structural effects of critical damage location and combined loads. Different levels of impact damage are generally accommodated by limiting the design strain levels for ultimate and limit combined load design criteria. In this manner, rational analyses supported by tests can be established to characterise residual strength for point design details. 7.         PROOF OF STRUCTURE – STATIC The structural static strength substantiation of a composite design should consider all critical load cases and associated failure modes. It should also include effects of environment (including residual stresses induced during the fabrication process), material and process variability, non-detectable defects or any defects that are allowed by the quality control, manufacturing acceptance criteria, and service damage allowed in maintenance documents of the end product. The static strength of the composite design should be demonstrated through a programme of component ultimate load tests in the appropriate environment, unless experience with similar designs, material systems, and loadings is available to demonstrate the adequacy of the analysis supported by sub-component, element and coupon tests, or component tests to accepted lower load levels. The necessary experience to validate an analysis should include previous component ultimate load tests with similar designs, material systems, and load cases. a.         The effects of repeated loading and environmental exposure which may result in material property degradation should be addressed in the static strength evaluation. This can be shown by analysis supported by test evidence, by tests at the coupon, element or sub-component level, as appropriate, or alternatively by relevant existing data. Earlier discussions in this AMC address the effects of environment on material properties (paragraph 6.d) and protection of structure (paragraph 6.e). For critical loading conditions, three approaches exist to account for prior repeated loading and/or environmental exposure in the full-scale static test. (1)       In the first approach, the full-scale static test should be conducted on structure with prior repeated loading and conditioned to simulate the critical environmental exposure and then tested in that environment. (2)       The second approach relies upon coupon, element, and sub-component test data to determine the effect of repeated loading and environmental exposure on static strength. The degradation characterised by these tests should then be accounted for in the full-scale static strength demonstration test (e.g., overload factors), or in analysis of these results (e.g., showing a positive margin of safety with design values that include the degrading effects of environment and repeated load). (3)       In practice, aspects of the first two approaches may be combined to obtain the desired result (e.g., a full scale static test may be performed at critical operating temperature with a load factor to account for moisture absorbed over the aircraft structure’s life). Alternate means to account for environment using validated tests and analyses (e.g., an equivalent temperature enhancement to account for the effect of moisture without chemically altering the material), may be proposed by the applicant. b.         The strength of the composite structure should be reliably established, incrementally, through a programme of analysis and a series of tests conducted using specimens of varying levels of complexity. Often referred to in industry as the “building block” approach, these tests and analyses at the coupon, element, details, and sub-component levels can be used to address the issues of variability, environment, structural discontinuity (e.g., joints, cut-outs or other stress risers), damage, manufacturing defects, and design or process-specific details. Typically, testing progresses from simple specimens to more complex elements and details over time. This approach allows the data collected for sufficient analysis correlation and the necessary replicates to quantify variations occurring at the larger structural scales to be economically obtained. The lessons learned from initial tests also help avoid early failures in more complex full-scale tests, which are more costly to conduct and often occur later in a certification programme schedule. (1)       Figures 1 and 2 provide a conceptual schematic of tests typically included in the building block approach for a fixed wing and tail rotor blade structures, respectively. The large quantity of tests needed to provide a statistical basis comes from the lowest levels (coupons and elements) and the performance of structural details are validated in a lesser number of sub-component and component tests. Detail and subcomponent tests may be used to validate the ability of analysis methods to predict local strains and failure modes. Additional statistical considerations (e.g., repetitive point design testing and/or component overload factors to cover material and process variability) will be needed when analysis validation is not achieved. The static strength substantiation programme should also consider all critical loading conditions for all Critical Structure. This includes an assessment of residual strength and stiffness requirements after a predetermined length of service, which takes into account damage and other degradation due to the service period.  Figure 1 - Schematic diagram of building block tests for a fixed wing.  Figure 2 - Schematic diagram of building block tests for a tail rotor blade. (2)       Successful static strength substantiation of composite structures has traditionally depended on proper consideration of stress concentrations (e.g., notch sensitivity of details and impact damage), competing failure modes and out-of-plane loads. A complete building block approach to composite structural substantiation addresses most critical structural issues in test articles with increasing levels of complexity so that many areas of reliable performance can be demonstrated prior to the component tests. The details and sub-component testing should establish failure criteria and account for impact damage in assembled composite structures. Component tests are needed to provide the final validation accounting for combined loads and complex load paths, which include some out-of-plane effects. When using the building block approach, the critical load cases and associated failure modes would be identified for component tests using the analytical methods, which are supported by test validation. c.         The component static test may be performed in an ambient atmosphere if the effects of the environment are reliably predicted by building block tests and are accounted for in the static test or in the analysis of the results of the static test. d.         The static test articles should be fabricated and assembled in accordance with production specifications and processes so that the test articles are representative of production structure including defects consistent with the limits established by manufacturing acceptance criteria. e.         The material and processing variability of the composite structure should be considered in the static strength substantiation. This is primarily achieved by establishing sufficient process and quality controls to manufacture structure and reliably substantiate the required strength by test and analysis. The scatter in strength properties due to variability in materials and processes are characterised by proper allowables or design values, which are derived in compliance with CS 2x.613. When the detail, sub-component and component tests show that local strains are adequately predicted and positive margins of safety exist using a validated analysis everywhere on the structure, then proof of static strength is said to be substantiated using analysis supported by test evidence. Alternatively, in the absence of sufficient building block test data and analysis validation, overloads are needed in the component test to gain proof of static strength for the structure using an approach referred to as substantiated by tests. The overload factors applied in this case need to be substantiated either through tests or past experience and must account for the expected material and process variation. f.          It should be shown that impact damage that can be expected from manufacturing and service, but not more than the established threshold of detectability for the selected inspection procedure, will not reduce the structural strength below ultimate load capability. This can be shown by analysis supported by test evidence, or by a combination of tests at the coupon, element, sub-component and component levels. The realistic test assessment of impact damage requires proper consideration of the structural details and boundary conditions. When using a visual inspection procedure, the likely impact damage at the threshold of reliable detection has been called barely visible impact damage (BVID). Selection of impact sites for static strength substantiation should consider the criticality of the local structural detail, and the ability to inspect a location. The size and shape of impactors used for static strength substantiation should be consistent with likely impact damage scenarios that may go undetected for the life of an aircraft. Note that it is possible for some designs to have detectable impact damage and still meet static strength loads and other requirements without repair (refer to allowable damage discussions in paragraph 10.c(1)). g.         Major material and process changes on existing certified structure require additional static strength substantiation (e.g., refer to [Appendix 3](#_DxCrossRefBm1926189313)). 8.         PROOF OF STRUCTURE – FATIGUE AND DAMAGE TOLERANCE The evaluation of composite structure should be based on the applicable certification specifications identified in the type-certification basis. Such evaluation must show that catastrophic failure due to fatigue, environmental effects, manufacturing defects, or accidental damage will be avoided throughout the operational life of the aircraft. The nature and extent of analysis or tests on complete structures and/or portions of the primary structure will depend upon applicable previous fatigue/damage tolerant designs, construction, tests, and service experience on similar structures. In the absence of experience with similar designs, Agency-approved structural development tests of components, sub-components, and elements should be performed (following the same principles discussed in paragraph 7.b and [Appendix 3](#_DxCrossRefBm1926189313)). The following considerations are unique to the use of composite material systems and provide guidance for the method of substantiation selected by the applicant. When establishing details for the damage tolerance and fatigue evaluation, attention should be given to a thorough damage threat assessment, geometry, inspectability, good design practice, and the types of damage/degradation of the structure under consideration. — Composite damage tolerance and fatigue performance is strongly dependent on structural design details (e.g., skin laminate stacking sequence, stringer or frame spacing, stiffening element attachment details, damage arrestment features, and structural redundancy). — Composite damage tolerance and fatigue evaluations require substantiation in component tests unless experience with similar designs, material systems, and loadings is available to demonstrate the adequacy of the analysis supported by coupons, elements, and sub-component tests. — Final static strength, fatigue, and damage tolerance substantiation may be gained in testing a single component test article if sufficient building block test evidence exists to ensure that the selected sequence of repeated and static loading yield results representative of that possible in service or provide a conservative evaluation. — Peak repeated loads are needed to practically demonstrate the fatigue and damage tolerance of composite aircraft structure in a limited number of component tests. As a result, metal structures present in the test article generally require additional consideration and testing. The information contained in AMC 25.571 provides fatigue and damage tolerance guidance for metallic structures. a.         Damage Tolerance Evaluation (1)       Damage tolerance evaluation starts with identification of structure whose failure would reduce the structural integrity of the aircraft. A damage threat assessment must be performed for the structure to determine possible locations, types, and sizes of damage considering fatigue, environmental effects, intrinsic flaws, and foreign object impact or other accidental damage (including discrete source) that may occur during manufacture, operation or maintenance. (a)       Currently, there are very few industry standards that outline the critical damage threats for particular composite structural applications with enough detail to establish the necessary design criteria or test and analysis protocol for complete damage tolerance evaluation. In the absence of standards, it is the responsibility of individual applicants to perform the necessary development tasks to establish such data in support of product substantiation. Some factors to consider in development of a damage threat assessment for a particular composite structure include part function, location on the aircraft, past service data, accidental damage threats, environmental exposure, impact damage resistance, durability of assembled structural details (e.g., long-term durability of bolted and bonded joints), adjacent system interface (e.g., potential overheating or other threats associated with system failure), and anomalous service or maintenance handling events that can overload or damage the part. As related to the damage threat assessment and maintenance procedures for a given structure, the damage tolerance capability and ability to inspect for known damage threats should be developed. (b)       Foreign object impact is a concern for most composite structures, requiring attention in the damage threat assessment. This is needed to identify impact damage severity and detectability for design and maintenance. It should include any available damage data collected from service plus an impact survey. An impact survey consists of impact tests performed with representative structure, which is subjected to boundary conditions characteristic of the real structure. Many different impact scenarios and locations should be considered in the survey, which has a goal of identifying the most critical impacts possible (i.e., those causing the most serious damage but are least detectable). When simulating accidental impact damage at representative energy levels, blunt or sharp impactors of different sizes and shapes should be selected to cause the most critical and least detectable damage, according to the load conditions (e.g., tension, compression or shear). Until sufficient service experience exists to make good engineering judgments on energy and impactor variables, impact surveys should consider a wide range of conceivable impacts, including runway or ground debris, hail, tool drops, and vehicle collisions. This consideration is important to the assumptions needed for use of probabilistic damage threat assessments in defining design criteria, inspection methods, and repeat inspection intervals for maintenance. Service data collected over time can better define impact surveys and design criteria for subsequent products, as well as establish more rational inspection intervals and maintenance practice. In review of such information, it should be realised that the most severe and critical impact damages, which are still possible, may not be part of the service database. (c)       Once a damage threat assessment is completed, various damage types can be classified into five categories of damage as described below (refer to figure 3). These categories of damage are used for communication purposes in this AMC. Other categories of damage, which help outline a specific path to fatigue and damage tolerance substantiation, may be used by applicants in agreement with the regulatory authorities.  Figure 3 - Schematic diagram showing design load levels versus categories of damage severity. Category 1: Allowable damage that may go undetected by scheduled or directed field inspection and allowable manufacturing defects. Structural substantiation for Category 1 damage includes demonstration of a reliable service life, while retaining ultimate load capability. By definition, such damage is subjected to the requirements and guidance associated with paragraph 7 of this AMC. Some examples of Category 1 damage include BVID and allowable defects caused in manufacturing or service (e.g., small delamination, porosity, small scratches, gouges, and minor environmental damage) that have substantiation data showing ultimate load is retained for the life of an aircraft structure. Category 2: Damage that can be reliably detected by scheduled or directed field inspections performed at specified intervals. Structural substantiation for Category 2 damage includes demonstration of a reliable inspection method and interval while retaining loads above limit load capability. The residual strength for a given Category 2 damage may depend on the chosen inspection interval and method of inspection. Some examples of Category 2 damage include visible impact damage (VID), VID (ranging in size from small to large), deep gouges or scratches, manufacturing mistakes not evident in the factory, detectable delamination or debonding, and major local heat or environmental degradation that will sustain sufficient residual strength until found. This type of damage should not grow or, if slow or arrested growth occurs, the level of residual strength retained for the inspection interval is sufficiently above limit load capability. Category 3: Damage that can be reliably detected within a few flights of occurrence by operations or ramp maintenance personnel without special skills in composite inspection. Such damage must be in a location such that it is obvious by clearly visible evidence or cause other indications of potential damage that becomes obvious in a short time interval because of loss of the part form, fit or function. Both indications of significant damage warrant an expanded inspection to identify the full extent of damage to the part and surrounding structural areas. In practice, structural design features may be needed to provide sufficient large damage capability to ensure limit or near limit load is maintained with easily detectable, Category 3 damage. Structural substantiation for Category 3 damage includes demonstration of a reliable and quick detection, while retaining limit or near limit load capability. The primary difference between Category 2 and 3 damages are the demonstration of large damage capability at limit or near limit load for the latter after a regular interval of time, which is much shorter than the former. The residual strength demonstration for Category 3 damage may be dependent on the reliable short time detection interval. Some examples of Category 3 damage include large VID or other obvious damage that will be caught during walk-around inspection or during the normal course of operations (e.g., fuel leaks, system malfunctions or cabin noise). Category 4: Discrete source damage from a known incident such as flight manoeuvres is limited. Structural substantiation for Category 4 damage includes a demonstration of residual strength for loads specified in the regulations. It should be noted that pressurised structure will generally have Category 4 residual strength requirements at a level higher than shown in figure 3. Some examples of Category 4 damage include rotor burst, bird strikes (as specified in the regulations), tyre bursts, and severe in-flight hail. Category 5: Severe damage created by anomalous ground or flight events, which is not covered by design criteria or structural substantiation procedures. This damage is in the current guidance to ensure the engineers responsible for composite aircraft structure design and the Agency work with maintenance organisations in making operations personnel aware of possible damage from Category 5 events and the essential need for immediate reporting to responsible maintenance personnel. It is also the responsibility of structural engineers to design-in sufficient damage resistance such that Category 5 events are self-evident to the operations personnel involved. An interface is needed with engineering to properly define a suitable conditional inspection based on available information from the anomalous event. Such action will facilitate the damage characterisation needed prior to repair. Some examples of Category 5 damage include severe service vehicle collisions with aircraft, anomalous flight overload conditions, abnormally hard landings, maintenance jacking errors, and loss of aircraft parts in flight, including possible subsequent high-energy, wide-area (blunt) impact with adjacent structure. Some Category 5 damage scenarios will not have clearly visual indications of damage, particularly in composite structures. However, there should be knowledge of other evidence from the related events that ensure safety is protected, starting with a complete report of possible damage by operations. (d)       The five categories of damage will be used as examples in subsequent discussion in this paragraph and in paragraphs 9 and 10. Note that Category 2, 3, 4 and 5 damages all have associated repair scenarios. (2)       Structure details, elements, and sub-components of Critical Structure should be tested under repeated loads to define the sensitivity of the structure to damage growth. This testing can form the basis for validating a no-growth approach to the damage tolerance requirements. The testing should assess the effect of the environment on the flaw and damage growth characteristics and the no-growth validation. The environment used should be appropriate to the expected service usage. Residual stresses will develop at the interfaces between composite and metal structural elements in a design due to differences in thermal expansion. This component of stress will depend on the service temperature during repeated load cycling and is considered in the damage tolerance evaluation. Inspection intervals should be established, considering both the likelihood of a particular damage and the residual strength capability associated with this damage. The intent of this is to assure that structure is not exposed to an excessive period of time with residual strength less than ultimate, providing a lower safety level than in the typical slow growth situation, as illustrated in Figure 4. Conservative assumptions for capability with large damage sizes that would be detected within a few flights may be needed when probabilistic data on the likelihood of given damage sizes does not exist. Once the damage is detected, the component is either repaired to restore ultimate load capability or replaced.  Figure 4 - Schematic diagram of residual strength illustrating that significant accidental damage with “no-growth” should not be left in the structure without repair for a long time. (a)       The traditional slow growth approach may be appropriate for certain damage types found in composites if the growth rate can be shown to be slow, stable and predictable. Slow growth characterisation should yield conservative and reliable results. As part of the slow growth approach, an inspection programme should be developed consisting of the frequency, extent, and methods of inspection for inclusion in the maintenance plan. Inspection intervals should be established such that the damage will have a very high probability of detection between the time it becomes initially detectable and the time at which the extent of the damage reduces the residual static strength to limit load (considered as ultimate), including the effects of environment. For any detected damage size that reduces the load capability below ultimate, the component is either repaired to restore ultimate load capability or replaced. Should functional impairment (such as unacceptable loss of stiffness) occur before the damage becomes otherwise critical, part repair or replacement will also be necessary. (b)       Another approach involving growth may be appropriate for certain damage types and design features adopted for composites if the growth can be reliably shown to be predictable and arrested before it becomes critical. Figure 5 shows schematic diagrams for all three damage growth approaches applied to composite structure. The arrested growth method is applicable when the damage growth is mechanically arrested or terminated before becoming critical (residual static strength reduced to limit load), as illustrated in Figure 5. Arrested growth may occur due to design features such as a geometry change, reinforcement, thickness change, or a structural joint. This approach is appropriate for damage growth that is detectable and found to be reliably arrested, including all appropriate dynamic effects. Structural details, elements, and sub-components of Critical Structure, components or full-scale structures, should be tested under repeated loads for validating an Arrested Growth Approach. As was the case for a “no-growth” approach to damage tolerance, inspection intervals should be established, considering the residual strength capability associated with the arrested growth damage size (refer to the dashed lines added to Figure 5 to conceptually show inspection intervals consistent with the slow growth basis). Again, this is intended to ensure that the structure does not remain in a damaged condition with residual strength capability close to limit load for long periods of time before repair. For any damage size that reduces load capability below ultimate, the component is either repaired to restore ultimate load capability or replaced. (c)       The repeated loading should be representative of anticipated service usage. The repeated load testing should include damage levels (including impact damage) typical of those that may occur during fabrication, assembly, and in-service, consistent with the inspection techniques employed. The damage tolerance test articles should be fabricated and assembled in accordance with production specifications and processes so that the test articles are representative of production structure. (3)       The extent of initially detectable damage should be established and be consistent with the inspection techniques employed during manufacture and in service. This information will naturally establish the transition between Category 1 and 2 damage types (i.e., inspection methods used by trained inspectors in scheduled maintenance). For damage that is clearly detectable to an extent that it will likely be found before scheduled maintenance (i.e., allowing classification as Category 3 damage), detection over shorter intervals and by untrained personnel may be permitted. Flaw/damage growth data should be obtained by repeated load cycling of intrinsic flaws or mechanically introduced damage. The number of cycles applied to validate both growth and no-growth concepts should be statistically significant, and may be determined by load and/or life considerations and a function of damage size. The growth or no growth evaluation should be performed by analysis supported by test evidence or by tests at the coupon, element, or sub-component level.  Figure 5 - Illustrations of residual strength and damage size relationships for three different approaches to composite structural damage tolerance substantiation (4)       The extent of damage for residual strength assessments should be established, including considerations for the probability of detection using selected field inspection procedures. The first four categories of damage should be considered based on the damage threat assessment. In addition, Category 3 damage should be detected in a walk-around inspection or through the normal course of operations. Residual strength evaluation by component or sub-component testing or by analysis supported by test evidence should be performed considering that damage. The evaluation should demonstrate that the residual strength of the structure will reliably be equal to or greater than the strength required for the specified design loads (considered as ultimate), including environmental effects. The statistical significance of reliable sub-component and detail residual strength assessments may include conservative methods and engineering judgment. It should be shown that stiffness properties have not changed beyond acceptable levels. (a)       For the no-growth, slow growth, arrested growth approaches, residual strength testing should be performed after repeated load cycling. All probabilistic analyses applied for residual strength assessments should properly account for the complex nature of damage defined from a thorough damage threat assessment. Conservative damage metrics are permitted in such analyses assuming sufficient test data on repeated load and environmental exposure exists. (b)       Composite designs should afford the same level of fail-safe, multiple load path structure assurance as conventional metals design. Such is also the expectation in justifying the use of static strength allowables with a statistical basis of 90 percent probability with 95 percent confidence. (c)       Some special residual strength considerations for bonded structure are given in paragraph 6.c.(3). (5)       The repeated load spectrum developed for fatigue testing and analysis purposes should be representative of the anticipated service usage. Low amplitude load levels that can be shown not to contribute to damage growth may be omitted. Reducing maximum load levels is generally not accepted. Variability in repeated load behaviour should be covered by appropriate load enhancement or life scatter factors and these factors should take into account the number of specimens tested. The use of such factors to demonstrate reliability in component tests should be consistent with the fatigue and damage tolerance behaviour characterised for the materials, processes and other design details of the structure in building block tests. (6)       An inspection programme should be developed consisting of frequency, extent, and methods of inspection for inclusion in the maintenance plan. Inspection intervals should be established such that the damage will be reliably detected between the time it initially becomes detectable and the time at which the extent of damage reaches the limits for required residual strength capability. The potential for missed inspections should be considered. (a)       For the case of no-growth design concept, inspection intervals should be established as part of the maintenance programme. In selecting such intervals, the residual strength level associated with the assumed damages should be considered. This point was illustrated in Figures 4 and 5. Note that an acceptable inspection interval for the larger damages shown for the “no-growth” and “arrested growth” options in Figures 4 and 5 was conceptually shown as related to an acceptable slow growth basis in terms of the residual strength and time below ultimate load before damage was detected and repaired. Data on the probability of occurrence for different damage sizes also helps define an inspection interval. (b)       A thorough composite damage threat assessment and the separation of different damage sizes into categories, each with associated detection methods, supports programmes using a rigorous damage tolerance assessment to avoid conservative design criteria with very large damage assumptions. In such cases, Category 2 damage types will require the structural substantiation of well specified and reliable inspection methods applied by trained inspectors at scheduled maintenance intervals (by default, Category 1 damage is at the threshold of this evaluation). Those damages classified as Category 3 may take advantage of shorter service time intervals provided sufficient structural substantiation exists with demonstrated proof that there will be early detection by untrained ramp maintenance or operations personnel. By definition, Category 4 damage will require residual strength substantiation to levels that complete a flight with limited manoeuvres based on the associated regulatory loads. Due to the nature of service events leading to Category 4 damage, suitable inspections will need to be defined to evaluate the full extent of damage, prior to subsequent aircraft repair and return to service. By definition, Category 5 damages do not have associated damage tolerance design criteria or related structural substantiation tasks. Category 5 damage will require suitable inspections based on engineering assessment of the anomalous service event, and appropriate structural repair and/or part replacement, prior to the aircraft re-entering service. (7)       The structure should be able to withstand static loads (considered as ultimate loads) which are reasonably expected during a completion of the flight on which damage resulting from obvious discrete sources occur (i.e., uncontained engine failures, etc.). The extent of damage should be based on a rational assessment of service mission and potential damage relating to each discrete source. Structural substantiation will be needed for the most critical Category 4 damage as related to the associated load cases. Some Category 4 damage may have high margins but will likely still require suitable inspections since their detectability may not be consistent with the substantiations validated for Category 2 damage types. (8)       The effects of temperature, humidity, and other environmental or time-related aging factors, which may result in material property degradation, should be addressed in the damage tolerance evaluation. Unless tested in the environment, appropriate environmental factors should be derived and applied in the evaluation. b.         Fatigue Evaluation Fatigue substantiation should be accomplished by component fatigue tests or by analysis supported by test evidence, accounting for the effects of the appropriate environment. The test articles should be fabricated and assembled in accordance with production specifications and processes so that the test articles are representative of production structures. Sufficient component, sub-component, element or coupon tests should be performed to establish the fatigue scatter and the environmental effects. Component, sub-component, and/or element tests may be used to evaluate the fatigue response of structure with impact damage levels typical of those that may occur during fabrication, assembly, and in service, consistent with the inspection procedures employed. Other allowed manufacturing and service defects, which would exist for the life of the structure, should also be included in fatigue testing. It should be demonstrated during the fatigue tests that the stiffness properties have not changed beyond acceptable levels. Replacement lives should be established based on the test results. By definition, Category 1 damage is subjected to fatigue evaluation and expected to retain ultimate load capability for the life of the aircraft structure. c.         Combined Damage Tolerance and Fatigue Evaluation Generally, it is appropriate for a given structure to establish both an inspection programme and demonstrate a service life to cover all detectable and non-detectable damage, respectively, which is anticipated for the intended aircraft usage. Extensions in service life should include evidence from component repeated load testing, fleet leader programmes (including NDI and destructive tear-down inspections), and appropriate statistical assessments of accidental damage and environmental service data considerations. 9.         PROOF OF STRUCTURE – FLUTTER AND OTHER AEROELASTIC INSTABILITIES The aeroelastic evaluations including flutter, control reversal, divergence, and any undue loss of stability and control as a result of structural loading and resulting deformation, are required. Flutter and other aeroelastic instabilities must be avoided through design, quality control, maintenance, and systems interaction. a.         The evaluation of composite structure needs to account for the effects of repeated loading, environmental exposure, and service damage scenarios (e.g., large Category 2, 3 or 4 damage) on critical properties such as stiffness, mass and damping. Some control surfaces exposed to large damage retain adequate residual strength margins, but the potential loss of stiffness or mass increase (e.g., sandwich panel disbond and/or water ingression) may adversely affect flutter and other aeroelastic characteristics. This is particularly important for control surfaces that are prone to accidental damage and environmental degradation. Other factors such as the weight or stiffness changes due to repair, manufacturing flaws, and multiple layers of paint need to be evaluated. There may also be issues associated with the proximity of high temperature heat sources near structural components (e.g., empennage structure in the path of jet engine exhaust streams or engine bleed air pneumatics system ducting). These effects may be determined by analysis supported by test evidence, or by tests at the coupon, element or sub-component level. 10.       CONTINUED AIRWORTHINESS The maintenance and repair of composite aircraft structure should meet all general, design and fabrication, static strength, fatigue/damage tolerance, flutter, and other considerations covered by this AMC as appropriate for the particular type of structure and its application. a.         Design for Maintenance Composite aircraft structure should be designed for inspection and repair access in a field maintenance environment. The inspection and repair methods applied for structural details should recognise the special documentation and training needed for critical damage types that are difficult to detect, characterise and repair. The inspection intervals and life limits for any structural details and levels of damage that preclude repair must be clearly documented in the appropriate continued airworthiness documents. b.         Maintenance Practices Maintenance manuals, developed by the appropriate organisations, should include appropriate inspection, maintenance, and repair procedures for composite structures, including jacking, disassembly, handling, part drying methods, and repainting instructions (including restrictions for paint colours that increase structural temperatures). Special equipment, repair materials, ancillary materials, tooling, processing procedures, and other information needed for inspection or repair of a given part should be identified since standard field practices, which have been substantiated for different aircraft types and models, are not common. (1)       Damage Detection (a)       Procedures used for damage detection must be shown to be reliable and capable of detecting degradation in structural integrity below ultimate load capability. These procedures must be documented in the appropriate sections of the instructions for continued airworthiness. This should be substantiated in static strength, environmental resistance, fatigue, and damage tolerance efforts as outlined in paragraphs 6, 7 and 8. Substantiated detection procedures will be needed for all damage types identified by the threat assessment, including a wide range of foreign object impact threats, manufacturing defects, and degradation caused by overheating. Degradation in surface layers (e.g., paints and coatings) that provide structural protection against ultraviolet exposure must be detected. Any degradation to the lightning strike protection system that affects structural integrity, fuel tank safety, and electrical systems must also be detected. (b)       Visual inspection is the predominant damage detection method used in the field and should be performed under prescribed lighting conditions. Visual inspection procedures should account for access, time relaxation in impact damage dent depth, and the colour, finish and cleanliness of part surfaces. (2)       Inspection. Visual indications of damage, which are often used for composite damage detection, provide limited details on the hidden parts of damage that require further investigation. As a result, additional inspection procedures used for complete composite damage characterisation will generally be different from those used for initial damage detection and need to be well documented. Non-destructive inspection performed prior to repair and destructive processing steps performed during repair must be shown to locate and determine the full extent of the damage. In-process controls of repair quality and post-repair inspection methods must be shown to be reliable and capable of providing engineers with the data to determine degradation in structural integrity below ultimate load capability caused by the process itself. Certain processing defects cannot be reliably detected at completion of the repair (e.g., weak bonds). In such cases, the damage threat assessment, repair design features and limits should ensure sufficient damage tolerance. (3)       Repair. All bolted and bonded repair design and processing procedures applied for a given structure shall be substantiated to meet the appropriate requirements. Of particular safety concern are the issues associated with bond material compatibilities, bond surface preparation (including drying, cleaning, and chemical activation), cure thermal management, composite machining, special composite fasteners, and installation techniques, and the associated in‑process control procedures. The surface layers (e.g., paints and coatings) that provide structural protection against ultraviolet exposure, structural temperatures, and the lightning strike protection system must also be properly repaired. (4)       Documentation and Reporting. Documentation on all repairs must be added to the maintenance records for the specific part number. This information supports future maintenance damage disposition and repair activities performed on the same part. It is recommended that service difficulties, damage, and degradation occurring to composite parts in service should be reported back to the design approval holder to aid in continuous updates of damage threat assessments to support future design detail and process improvements. Such information will also support future design criteria, analysis, and test database development. c.         Substantiation of Repair (1)       When repair procedures are provided in Agency approved documents or the maintenance manual, it should be demonstrated by analysis and/or test that the method and techniques of repair will restore the structure to an airworthy condition. Repairable damage limits (RDL), which outline the details for damage to structural components that may be repaired based on existing data, must be clearly defined and documented. Allowable damage limits (ADL), which do not require repair, must also be clearly defined and documented. Both RDL and ADL must be based on sufficient analysis and test data to meet the appropriate structural substantiation requirements and other considerations outlined in this AMC. Additional substantiation data will generally be needed for damage types and sizes not previously considered in design development. Some damage types may require special instructions for field repair and the associated quality control. Bonded repair is subjected to the same structural bonding considerations as the base design (refer to paragraph 6.c). (2)       Operators and maintenance repair organisations (MRO) wishing to complete major repairs or alterations outside the scope of approved repair documentation should be aware of the extensive analysis, design, process, and test substantiation required to ensure the airworthiness of a certificated structure. Documented records and the certification approval of this substantiation should be retained in accordance with regulations to support any subsequent maintenance activities. d.         Damage Detection, Inspection and Repair Competency (1)       All technicians, inspectors and engineers involved in damage disposition and repair should have the necessary skills to perform their supporting maintenance tasks on a specific composite structural part. The continuous demonstration of acquired skills goes beyond initial training (e.g., similar to a welder qualification). The repair design, inspection methods, and repair procedures used will require approved structural substantiation data for the particular composite part. Society of Automotive Engineers International (SAE) Aerospace Information Report (AIR) 5719 outlines training for an awareness of the safety issues for composite maintenance and repair. Additional training for specific skill building will be needed to execute particular engineering, inspection and repair tasks. (2)       Pilots, ramp maintenance, and other operations personnel that service aircraft should be trained to immediately report anomalous ramp incidents and flight events that may potentially cause serious damage to composite aircraft structures. In particular, immediate reporting is needed for those service events that are outside the scope of the damage tolerance substantiation and standard maintenance practices for a given structure. The immediate detection of Category 4 and 5 damages are dependent on the proper reaction of personnel that operate and service the aircraft. 11.       ADDITIONAL CONSIDERATIONS a.         Crashworthiness (1)       The crashworthiness of the aircraft is dominated by the impact response characteristics of the fuselage. Regulations, in general, evolve based on either experience gained through incidents and accidents of existing aircraft or in anticipation of safety issues raised by new designs. In the case of crashworthiness, regulations have evolved as experience has been gained during actual aircraft operations. For example, emergency load factors and passenger seat loads have been established to reflect dynamic conditions observed from fleet experience and from controlled FAA and industry research. Fleet experience has not demonstrated a need to have an aircraft level crashworthiness standard. As a result, the regulations reflect the capabilities of traditional aluminium aircraft structure under survivable crash conditions. This approach was satisfactory as aircraft have continued to be designed using traditional construction methods. With the advent of composite fuselage structure and/or the use of novel design, this historical approach may no longer be sufficient to substantiate the same level of protection for the passengers as provided by similar metallic designs. (2)       Airframe design should assure that occupants have every reasonable chance of escaping serious injury under realistic and survivable crash impact conditions. A composite design should account for unique behaviour and structural characteristics, including major repairs or alterations, as compared with conventional metal airframe designs. Structural evaluation may be done by test or analysis supported by test evidence. Service experience may also support substantiation. (3)       The crash dynamics of an aircraft and the associated energy absorption are difficult to model and fully define representative tests with respect to structural requirements. Each aircraft product type (i.e., large aeroplane, small aeroplane, and rotorcraft) has unique regulations governing the crashworthiness of particular aircraft structures. The regulations and guidance associated with each product type should be used accordingly. The regulations for large aeroplane and rotorcraft address some issues that go beyond those required of small aeroplanes. (4)       Special conditions are anticipated for large aeroplanes with composite fuselage structure to address crashworthiness survivability. The impact response of a composite fuselage structure must be evaluated to ensure the survivability is not significantly different from that of a similar-sized aircraft fabricated from metallic materials. Impact loads and resultant structural deformation of the supporting airframe and floor structures must be evaluated. Four main criteria areas should be considered in making such an evaluation. (a)       Occupants must be protected during the impact event from release of items of mass (e.g., overhead bins). (b)       At least the minimum number of emergency egress paths must remain following a survivable crash. (c)       The acceleration and loads experienced by occupants during a survivable crash must not exceed critical thresholds. (d)       A survivable volume of occupant space must be retained following the impact event. (5)       The criticality of each of these four criteria will depend on the particular crash conditions. For example, the loads and accelerations experienced by passengers may be higher at lower impact velocities where structural failures have not started to occur. As a result, validated analyses may be needed to practically cover all the crashworthiness criteria for a fuselage. (6)       Existing large aeroplane requirements also require that fuel tank structural integrity be addressed during a survivable crash impact event as related to fire safety (also refer to paragraph 11.b). As related to crashworthiness, composite fuel tank structure must not fail or deform to the extent that fire becomes a greater hazard than with metal structure. (7)       Physics and mechanics of the crashworthiness for composite structures involve several issues. The local strength, energy absorbing characteristics, and multiple competing failure modes need to be addressed for composite structure subjected to a survivable crash. This is not simply achieved for airframe structures made from anisotropic, quasi-brittle, composite materials. As a result, the accelerations and load histories experienced by passengers and equipment on a composite aircraft may differ significantly from that seen on a similar metallic aircraft unless specific considerations are designed into the composite structure. In addition, care should be taken when altering composite structure to achieve specific mechanical behaviours. (For example, where the change in behaviour of a metallic structure with a change in material thickness may be easily predicted, an addition or deletion of plies to a composite laminate may also require data for the effects of laminate stacking sequence on the failure mode and energy absorption characteristics of a composite element). (8)       Representative structure must be included to gain valid test and analysis results. Depending on aircraft loading (requiring investigation of various aircraft passenger and cargo configurations), structural dynamic considerations, and progressive failures, local strain rates and loading conditions may differ throughout the structure. Sensitivity of the structural behaviour to reasonable impact orientation should also be considered for large aeroplane and rotorcraft applications. This can be addressed by analysis supported by test evidence. (9)       Considering a need for comparative assessments with metal structure and a range of crash conditions, analysis with sufficient structural test evidence is often needed for large aeroplane and rotorcraft applications. Analysis requires extensive investigation of model sensitivity to modelling parameters (e.g., mesh optimisation, representation of joints, element material input stress-strain data). Test also requires investigation of test equipment sensitivity appropriate to composites (e.g., filter frequencies with respect to expected pulse characteristics in the structure). Model validation may be achieved using a building block approach, culminating in an adequately complex test (e.g., a drop test with sufficient structural details to properly evaluate the crashworthiness criteria). b.         Fire Protection, Flammability and Thermal Issues (1)       Fire and exposure to temperatures that exceed maximum operating conditions require special considerations for composite airframe structure. (Refer to note below). Requirements for flammability and fire protection of aircraft structure attempt to minimise the hazard to occupants in the event that flammable materials, fluids, or vapours ignite. The regulations associated with each aircraft product type (i.e., transport, small airplane, rotorcraft) should be used accordingly. Compliance may be shown by tests or analysis supported by test evidence. A composite design, including repair and alterations, should not decrease the existing level of safety relative to metallic structure. In addition, maintenance procedures should be available to evaluate the structural integrity of any composite aircraft structures exposed to fire and temperatures above the maximum operating conditions substantiated during design. Note: Aircraft cabin interiors and baggage compartments have been areas of flammability concerns in protecting passenger safety. This revision of the AMC does not address composite materials used in aircraft interiors and baggage compartments. Please consult other Guidance Material for Acceptable Means of Compliance with flammability rules for interiors. (2)       Fire protection and flammability has traditionally been considered for engine mount structure, firewalls, and other powerplant structures that include composite elements. Additional issues critical to passenger safety have come with the expanded use of composites in wing and fuselage structures for large aeroplanes. Existing regulations do not address the potential for the airframe structure itself to be flammable. Wing and fuselage applications should consider the effects of composite design and construction on the resulting passenger safety in the event of in-flight fires or emergency landing conditions, which combine with subsequent egress when a fuel-fed fire is possible. (3)       The results of fire protection and flammability testing with structural composite parts indicate dependence upon overall design and process details, as well as the origin of the fire and its extent. For example, the overall effects of composite fuselage structures exposed to fire may be significantly different when the fire originates within the cabin, where it can be controlled by limiting the structure’s contribution to spreading the fire, than when the fire occurs exterior to the fuselage after a crash landing, where fuel is likely to be the primary source for maintaining and spreading the fire. The threat in each case is different, and the approach to mitigation may also be different. In-flight fire safety addresses a fire originating within the aircraft due to some fault, whereas post-crash fire safety addresses a fuel fed pool fire external to the aircraft. Special conditions are anticipated for large aeroplanes with fuselage structure subjected to both in-flight and post-crash fire conditions. Large aeroplane wing structure will need to have special conditions for post-crash fire conditions. (4)       For an in-flight fire in large aeroplanes, it is critical that the fire not propagate or generate hazardous quantities of toxic by-products. In-flight fires have been catastrophic when they can grow in inaccessible areas. Composite fuselage structure could play a role different from traditional metal structure if the issue is not addressed. (5)       Metallic large aeroplane fuselage and wing structures have established a benchmark in fire protection that can be used to evaluate specific composite wing and fuselage structural details. Exterior fire protection issues associated with composite structure must include the effects of an exterior pool fire following a survivable crash landing. Fuselage structure should provide sufficient time for passenger egress, without fire penetration or the release of gasses and/or materials that are either toxic to escaping passengers or reduce visibility (smoke density) or could increase the fire severity. Furthermore, these considerations must be extended to wing and fuel tank structure, which must also be prevented from collapse and release of fuel (including consideration of the influence of fuel load upon the structural behaviour. For large aeroplanes, the standards of CS 25.856(b) provide the benchmark to establish the required level of safety. (6)       The exposure of composite structures to high temperatures needs to extend beyond the direct flammability and fire protection issues to other thermal issues. Many composite materials have glass transition temperatures, which mark the onset of reductions in strength and stiffness that are somewhat lower than the temperatures that can have a similar effect on equivalent metallic structure. The glass transition temperature of most composite materials is further reduced by moisture absorption. The reduced strength or stiffness of composites from high temperature exposures must be understood per the requirements of particular applications (e.g., engine or other system failures). After a system failure and/or known fire, it may be difficult to detect the full extent of irreversible heat damage to an exposed composite structure. As a result, composite structures exposed to high temperatures may require special inspections, tests, and analysis for proper disposition of heat damage. All appropriate damage threats and degradation mechanisms need to be identified and integrated into the damage tolerance and maintenance evaluation accordingly. Reliable inspections and test measurements of the extent of damage that exists in a part exposed to unknown levels of high temperatures should be documented. Particular attention should be given to defining the maximum damages that likely could remain undetected by the selected inspection procedures. c.         Lightning Protection Lightning protection design features are needed for composite aircraft structures. Current Carbon fibre composites are approximately 1,000 times less electrically conductive than standard aluminium materials, and composite resins and adhesives are traditionally non-conductive. Glass and aramid fibre composites are non-conductive. A lightning strike to composite structures can result in structural failure or large area damage, and it can induce high lightning current and voltage on metal hydraulic tubes, fuel system tubes, and electrical wiring if proper conductive lightning protection is not provided. Aircraft lightning protection design guidance can be found in the FAA Technical Report “Aircraft Lightning Protection Handbook” (See [Appendix 1](#_DxCrossRefBm1926189312) 2.a). The lightning protection effectiveness for composite structures should be demonstrated by tests or analysis supported by tests. Such tests are typically performed on panels, coupons, subassemblies, or coupons representative of the aircraft structure, or tests on full aircraft. The lightning test waveforms and lightning attachment zones are defined in EUROCAE ED-84 and ED-91. Any structural damage observed in standard lightning tests should be limited to Category 1, 2 or 3, depending on the level of detection. This damage is characterised and integrated into damage tolerance analyses and tests as appropriate. Small simple aeroplanes certified under CS-23 for VFR use only may be certified based on engineering assessment, according to AC 23-15A. The effects of composite structural repairs and maintenance on the lightning protection system should be evaluated. Repairs should be designed to maintain lightning protection. (1)       Lightning Protection for Structural Integrity (a)       The composite structural design should incorporate the lightning protection when appropriate for the anticipated lightning attachment. The extent of lightning protection features depends on the lightning attachment zone designated for that area of the aircraft. Lightning protection features may include, but are not limited to, metal wires or mesh added to the outside surface of the composite structure where direct lightning attachment is expected. (b)       When lightning strikes an aircraft, very high currents flow through the airframe. Proper electrical bonding must be incorporated between structural parts. This is difficult to achieve for moveable parts (e.g., ailerons, rudders and elevators). The electrical bonding features must be sized to conduct the lightning currents or they can vaporise, sending the high currents through unintended paths such as control cables, control rods, or hydraulic tubes. Guidance for certification of lightning protection of aircraft structures can be found in EUROCAE ED-113. (2)       Lightning Protection for Fuel Systems (a)       Special consideration must be given to the fuel system lightning protection for an aircraft with integral fuel tanks in a composite structure. Composite structure with integral fuel systems must incorporate specific lightning protection features on the external composite surfaces, on joints, on fasteners, and for structural supports for fuel system plumbing and components to eliminate structural penetration, arcing, sparks or other ignition sources. AC 20-53B provides certification guidance for aircraft fuel system lightning protection. (b)       Large aeroplane regulations for fuel system ignition prevention in CS 25.981 require lightning protection that is failure tolerant. As a result, redundant and robust lightning protection for composite structure joints and fasteners in fuel tank structure is needed to ensure proper protection in preventing ignition sources. (3)       Lightning Protection for Electrical and Electronic Systems (a)       Lightning strike protection of composite structures is needed to avoid inducing high lightning voltages and currents on the wiring for electrical and electronic systems whose upset or damage could affect safe aircraft operation. The consequences from a lightning strike of unprotected composite structures can be catastrophic for electrical and electronic systems that perform highly critical functions, such as fly-by-wire flight controls or engine controls. (b)       Electrical shields over system wiring and robust circuit design of electrical and electronic equipment both provide some protection against system upset or damage due to lightning. Since most composite materials provide poor shielding, at best, metal foil or mesh is typically added to the composite structure to provide additional shielding for wiring and equipment. Electrical bonding between composite structure parts and panels should be provided for the shielding to be effective. EUROCAE ED‑81 and ED-107 provide certification guidance for aircraft electrical and electronic system lightning protection. [Amdt 20/6] AMC 20-29 Composite Aircraft Structure ED Decision 2010/003/R 1. PURPOSE This AMC provides an acceptable means, but not the only means, for airworthiness certification of composite aircraft structures. Guidance information is also presented on the closely related design, manufacturing and maintenance aspects. This AMC primarily addresses carbon and glass fibre reinforced plastic structures, although many aspects of this document are also applicable to other forms of structure, e.g. metal bonded structure, wooden structure, etc. Note: When applying this guidance to other forms of structure, additional design considerations may be necessary and other appropriate references should also be consulted. 2. OBJECTIVE AMC 20-29 standardises recognised good design practices common to composite aircraft structures in one document. For rotorcraft, AMC 20-29 complements existing AMC to CS-27 and CS-29 (referring to FAA AC 27-1B MG8 and AC 29-2C MG8). 3. APPLICABILITY This AMC provides Acceptable Means of Compliance with the provisions of CS-23, CS-25, CS-27 and CS-29. Many of the concepts included in this AMC may also be applicable in part or in full to other CSs. However, when using this AMC as an Acceptable Means of Compliance for these other CSs, appropriate engineering judgement should be exercised and early agreement with the Agency sought. This AMC applies to: applicants for a type-certificate, restricted type-certificate or supplemental type-certificate; certificate/approval holders; parts manufacturers; material suppliers; and maintenance and repair organisations. Note: The technical content of this AMC is harmonised with FAA Advisory Circular AC 20-107B, dated 8 September 2009. 4. RELATED REGULATIONS AND GUIDANCE a. Applicable paragraphs are listed in [Appendix 1](#_DxCrossRefBm1701658068). b. Relevant guidance considered complementary to this AMC is provided in [Appendix 1](#_DxCrossRefBm1701658068). 5. GENERAL a. The procedures outlined in this AMC provide Acceptable Means of Compliance and Guidance Material for composite structures, particularly those that are essential in maintaining the overall flight safety of the aircraft (“critical structure” as defined in [Appendix 2](#_DxCrossRefBm1701658070)). This AMC is published to aid in the evaluation of certification programmes for composite applications and to reflect the current status of composite technology. It is expected that this AMC will be modified periodically to reflect the continued evolution of composite technology and the data collected from service experience and expanding applications. b. There are factors unique to the specific composite materials and processes used for a given application. For example, the environmental sensitivity, anisotropic properties, and heterogeneous nature of composites can make the determination of structural failure loads, modes, and locations difficult. The reliability of such evaluation depends on repeatable structural details created by scaled manufacturing or repair processes. The extent of testing and/or analysis may differ for a structure depending upon the criticality to flight safety, expected service usage, the material and processes selected, the design margins, the failure criteria, the database and experience with similar structures, and on other factors affecting a particular structure. It is expected that these factors will be considered when interpreting this AMC for use on a specific application. c. Definitions of terms used in this AMC can be found in [Appendix 2](#_DxCrossRefBm1701658070). 6. MATERIAL AND FABRICATION DEVELOPMENT All composite materials and processes used in structures are qualified through enough fabrication trials and tests to demonstrate a reproducible and reliable design. One of the important features of composite construction is the degree of care needed in the procurement and processing of composite materials. The final mechanical behaviour of a given composite material may vary greatly depending on the processing methods employed to fabricate production parts. Special care needs to be taken in controlling both the materials being procured and how the material is processed once delivered to the fabrication facility. The CSs (namely paragraphs 2x.603 and 2x.605) specify the need to procure and process materials under approved material and process specifications that control the key parameters governing performance. These paragraphs outline a need to protect structures against the degradation possible in service. They also require that the design account for any changes in performance (e.g., environmental and variability effects) permitted by material and process specifications. a. Material and Process Control (1) Specifications covering material, material processing, and fabrication procedures are established to ensure a basis for fabricating reproducible and reliable structure. Material specifications are required to ensure consistent material can be procured, and batch acceptance testing or statistical process controls are used to ensure material properties do not drift over time. Specifications covering processing procedures should be developed to ensure that repeatable and reliable structure can be manufactured. The means of processing qualification and acceptance tests defined in each material specification should be representative of the expected applicable manufacturing process. The process parameters for fabricating test specimens should match the process parameters to be used in manufacturing actual production parts as closely as possible. Both test and production parts must conform to material and process specifications. (2) Once the fabrication processes have been established, changes should undergo additional qualification, including testing of differences, before being implemented, (refer to [Appendix 3](#_DxCrossRefBm1701658069)). It is important to establish processing tolerances, material handling and storage limits, and key characteristics, which can be measured and tracked to judge part quality. (3) Material requirements identified in procurement specifications should be based on the qualification test results for samples produced using the related process specifications. Qualification data must cover all properties important to the control of materials (composites and adhesives) and processes to be used for production of composite structure. Carefully selected physical, chemical, and mechanical qualification tests are used to demonstrate the formulation, stiffness, strength, durability, and reliability of materials and processes for aircraft applications. It is recommended that airframe designers and manufacturers work closely with material suppliers to properly define material requirements. (4) To provide an adequate design database, environmental effects on critical properties of the material systems and associated processes should be established. In addition to testing in an ambient environment, variables should include extreme service temperature and moisture content conditions and effects of long-term durability. Qualification tests for environmental effects and long-term durability are particularly important when evaluating the materials, processes, and interface issues associated with structural bonding (refer to paragraph 6.c for related guidance). (5) Key characteristics and processing parameters should be specified and monitored for in-process quality control. The overall quality control plan required by the certifying agency should involve all relevant disciplines, i.e., engineering, manufacturing, and quality control. A reliable quality control system should be in place to address special engineering requirements that arise in individual parts or areas as a result of potential failure modes, damage tolerance and flaw growth requirements, loadings, inspectability, and local sensitivities to manufacture and assembly. (6) Tolerances permitted by the material and process specifications should be substantiated by analysis supported by test evidence, or tests at the coupon, element or sub-component level. For new production methods, repeatable processes should be demonstrated at sufficient structural scale in a way shown to be consistent with the material and process qualification tests and development of the associated specifications. This will require integration of the technical issues associated with product design and manufacturing details prior to a large investment in structural tests and analysis correlation. It will also ensure the relevance of quality control procedures defined to control materials and processes as related to the product structural details. (7) Note that the Agency does not certify materials and processes. However, materials and processes specifications are part of the type-design subject to type-certification. Appropriate certification credit may be given to products and organisations using the same materials and processes in similar applications subject to substantiation and applicability. In some cases, material and processing information may become part of accepted shared databases used throughout the industry. New users of shared qualification databases must control the associated materials and processes through proper use of the related specifications and demonstrate their understanding by performing equivalency sampling tests for key properties. Note that materials and processes used in European Technical Standard Order (ETSO) articles or authorisations must also be qualified and controlled. b. Design Considerations for Manufacturing Implementation (1) Process specifications and manufacturing documentation are needed to control composite fabrication and assembly. The environment and cleanliness of facilities are controlled to a level validated by qualification and proof of structure testing. Raw and ancillary materials are controlled to specification requirements that are consistent with material and process qualifications. Parts fabricated should meet design drawing tolerances obtained from the production tolerances validated in qualification, design data development, and proof of structure tests. Some key fabrication process considerations requiring such control include: (i) material handling and storage, (ii) laminate layup and bagging (or other alternate process steps for non-laminated material forms and advanced processes), (iii) mating part dimensional tolerance control, (iv) part cure (thermal management), (v) machining and assembly, (vi) cured part inspection and handling procedures, and (vii) technician training for specific material, processes, tooling and equipment. (2) Substantiating data is needed for design to justify all known defects, damage and anomalies allowed to remain in service without rework or repair. Adequate manufacturing records support the identification and substantiation of known defects, damage and anomalies. (3) Additional substantiating design data is needed from new suppliers of parts previously certificated. This may be supported by manufacturing trials and quality assessments to ensure equivalent production and repeatability. Some destructive inspection of critical structural details is needed for manufacturing flaws that are not end item inspectable and require process controls to ensure reliable fabrication. c. Structural Bonding Bonded structures include multiple interfaces (e.g., composite-to-composite, composite-to-metal, or metal-to-metal), where at least one of the interfaces requires additional surface preparation prior to bonding. The general nature of technical parameters that govern different types of bonded structures are similar. A qualified bonding process is documented after demonstrating repeatable and reliable processing steps such as surface preparation. It entails understanding the sensitivity of structural performance based upon expected variation permitted per the process. Characterisation outside the process limits is recommended to ensure process robustness. In the case of bonding composite interfaces, a qualified surface preparation of all previously cured substrates is needed to activate their surface for chemical adhesion. For all bonding interfaces, regardless if on metallic or previously cured composite substrates, a qualified surface preparation is needed to activate their surface for chemical adhesion. Many technical issues for bonding require cross-functional teams for successful applications. Applications require stringent process control and a thorough substantiation of structural integrity. (1) Many bond failures and problems in service have been traced to invalid qualifications or insufficient quality control of production processes. Physical and chemical tests may be used to control surface preparation, adhesive mixing, viscosity, and cure properties (e.g., density, degree of cure, glass transition temperature). Lap shear stiffness and strength are common mechanical tests for adhesive and bond process qualification. Shear tests do not provide a reliable measure of long-term durability and environmental degradation associated with poor bonding processes (i.e., lack of adhesion). Some type of peel test has proven more reliable for evaluating proper adhesion. Without chemical bonding, the so-called condition of a “weak bond” exists when the bonded joint is either loaded by peel forces or exposed to the environment over a long period of time, or both. Adhesion failures, which indicate the lack of chemical bonding between substrate and adhesive materials, are considered an unacceptable failure mode in all test types. Material or bond process problems that lead to adhesion failures are solved before proceeding with qualification tests. (2) Process specifications are needed to control adhesive bonding in manufacturing and repair. A “process control mentality”, which includes a combination of in-process inspections and tests, has proven to be the most reliable means of ensuring the quality of adhesive bonds. The environment and cleanliness of facilities used for bonding processes are controlled to a level validated by qualification and proof of structure testing. Adhesives and substrate materials are controlled to specification requirements that are consistent with material and bond process qualifications. The bonding processes used for production and repair meet tolerances validated in qualification, design data development, and proof of structure tests. Some key bond fabrication process considerations requiring such control include: (i) material handling and storage, (ii) bond surface preparation, (iii) mating part dimensional tolerance control, (iv) adhesive application and clamp-up pressure, (v) bond line thickness control, (vi) bonded part cure (thermal management), (vii) cured part inspection and handling procedures, and (vii) bond technician training for specific material, processes, tooling and equipment. Bond surface preparation and subsequent handling controls leading up to the bond assembly and cure must be closely controlled in time and exposure to environment and contamination. (3) CS 23.573(a) sets the certification specification for primary composite airframe structures, including considerations for damage tolerance, fatigue, and bonded joints. Although this is a small aeroplane rule, the same performance standards are normally expected for large aeroplanes and rotorcraft (via special conditions and CRIs). (a) For bonded joints, CS 23.573(a)(5) states: "For any bonded joint, the failure of which would result in catastrophic loss of the aeroplane, the limit load capacity must be substantiated by one of the following methods: (i) The maximum disbonds of each bonded joint consistent with the capability to withstand the loads in paragraph (a)(3) of this section must be determined by analysis, tests, or both. Disbonds of each bonded joint greater than this must be prevented by design features; or (ii) Proof testing must be conducted on each production article that will apply the critical limit design load to each critical bonded joint; or (iii) Repeatable and reliable non-destructive inspection techniques must be established that ensure the strength of each joint." (b) These options do not supersede the need for a qualified bonding process and rigorous quality controls for bonded structures. For example, fail safety implied by the first option is not intended to provide adequate safety for the systematic problem of a bad bonding process applied to a fleet of aircraft structures. Instead, it gives fail safety against bonding problems that may occasionally occur over local areas (e.g., insufficient local bond contact pressure or contamination). Performing static proof tests to limit load, which is the second option, may not detect weak bonds requiring environmental exposure and time to degrade bonded joint strength. This issue should be covered by adequately demonstrating that qualified bonding materials and processes have long-term environmental durability. Finally, the third option is open for future advancement and validation of non-destructive inspection (NDI) technology to detect weak bonds, which degrade over time and lead to adhesion failures. Such technology has not been reliably demonstrated at a production scale to date. (4) Adhesion failures are an unacceptable failure mode for bonded structure that require immediate action by the responsible engineers to identify the specific cause and isolate all affected parts and assemblies for directed inspection and repair. Depending on the suspected severity of the bonding problem, an airworthiness directive may be required to restore the affected aircraft to an airworthy condition. Any design, manufacturing or repair details linked to the bonding problem should also be permanently corrected. d. Environmental Considerations Environmental design criteria should be developed that identify the critical environmental exposures, including humidity and temperature, to which the material in the application under evaluation may be exposed. Service data (e.g., moisture content as a function of time in service) can be used to ensure such criteria are realistic. In addition, the peak temperatures for composite structure installed in close proximity to aircraft systems that generate thermal energy need to be identified for worst-case normal operation and system failure cases. Environmental design criteria are not required where existing data demonstrate that no significant environmental effects, including the effects of temperature and moisture, exist for the material system and construction details, within the bounds of environmental exposure being considered. (1) Experimental evidence should be provided to demonstrate that the material design values or allowables are attained with a high degree of confidence in the appropriate critical environmental exposures to be expected in service. It should be realised that the worst case environment may not be the same for all structural details (e.g., hot wet conditions can be critical for some failure modes, while cold dry conditions may be worse for others). The effect of the service environment on static strength, fatigue and stiffness properties and design values should be determined for the material system through tests, e.g., accelerated environmental tests, or from applicable service data. The maximum moisture content considered is related to that possible during the service life, which may be a function of a given part thickness, moisture diffusion properties and realistic environmental exposures. The effects of environmental cycling (i.e., moisture and temperature) should be evaluated when the application involves fluctuations or unique design details not covered in the past. Existing test data may be used where it can be shown to be directly applicable to the material system, design details, and environmental cycling conditions characteristic of the application. All accelerated test methods should be representative of real-time environmental and load exposure. Any factors used for acceleration that chemically alter the material (e.g., high temperatures that cause post-cure) should be avoided to ensure behaviour representative of real environmental exposures. (2) Depending on the design configuration, local structural details, and selected processes, the effects of residual stresses that depend on environment should be addressed (e.g., differential thermal expansion of attached parts). e. Protection of Structure Weathering, abrasion, erosion, ultraviolet radiation, and chemical environment (glycol, hydraulic fluid, fuel, cleaning agents, etc.) may cause deterioration in a composite structure. Suitable protection against and/or consideration of degradation in material properties should be provided for conditions expected in service and demonstrated by test and/or appropriate validated experience. Where necessary, provide provisions for ventilation and drainage. Isolation layers are needed at the interfaces between some composite and metal materials to avoid corrosion (e.g., glass plies are used to isolate carbon composite layers from aluminium). In addition, qualification of the special fasteners and installation procedures used for parts made from composite materials need to address the galvanic corrosion issues, as well as the potential for damaging the composite (delamination and fibre breakage) in forming the fastener. f. Design Values Data used to derive design values must be obtained from stable and repeatable material that conforms to mature material and representative production process specifications. This will ensure that the permitted variability of the production materials is captured in the statistical analysis used to derive the design values. Design values derived too early in the material’s development stage, before raw material and composite part production processes have matured, may not satisfy the intent of the associated rules. Laminated material system design values should be established on the laminate level by either test of the laminate or by test of the lamina in conjunction with a test validated analytical method. Similarly, design values for non-laminated material forms and advanced composite processes must be established at the scale that best represents the material as it appears in the part or by tests of material substructure in conjunction with a test validated analytical method. g. Structural Details For a specific structural configuration of an individual component (point design), design values may be established which include the effects of appropriate design features (holes, joints, etc.). Specific metrics that quantify the severity of composite structural damage states caused by foreign impact damage threats are needed to perform analysis (i.e., the equivalent of a metallic crack length). As a result, testing will often be needed to characterise residual strength, including the structural effects of critical damage location and combined loads. Different levels of impact damage are generally accommodated by limiting the design strain levels for ultimate and limit combined load design criteria. In this manner, rational analyses supported by tests can be established to characterise residual strength for point design details. 7. PROOF OF STRUCTURE – STATIC The structural static strength substantiation of a composite design should consider all critical load cases and associated failure modes. It should also include effects of environment (including residual stresses induced during the fabrication process), material and process variability, non-detectable defects or any defects that are allowed by the quality control, manufacturing acceptance criteria, and service damage allowed in maintenance documents of the end product. The static strength of the composite design should be demonstrated through a programme of component ultimate load tests in the appropriate environment, unless experience with similar designs, material systems, and loadings is available to demonstrate the adequacy of the analysis supported by sub-component, element and coupon tests, or component tests to accepted lower load levels. The necessary experience to validate an analysis should include previous component ultimate load tests with similar designs, material systems, and load cases. a. The effects of repeated loading and environmental exposure which may result in material property degradation should be addressed in the static strength evaluation. This can be shown by analysis supported by test evidence, by tests at the coupon, element or sub-component level, as appropriate, or alternatively by relevant existing data. Earlier discussions in this AMC address the effects of environment on material properties (paragraph 6.d) and protection of structure (paragraph 6.e). For critical loading conditions, three approaches exist to account for prior repeated loading and/or environmental exposure in the full-scale static test. (1) In the first approach, the full-scale static test should be conducted on structure with prior repeated loading and conditioned to simulate the critical environmental exposure and then tested in that environment. (2) The second approach relies upon coupon, element, and sub-component test data to determine the effect of repeated loading and environmental exposure on static strength. The degradation characterised by these tests should then be accounted for in the full-scale static strength demonstration test (e.g., overload factors), or in analysis of these results (e.g., showing a positive margin of safety with design values that include the degrading effects of environment and repeated load). (3) In practice, aspects of the first two approaches may be combined to obtain the desired result (e.g., a full scale static test may be performed at critical operating temperature with a load factor to account for moisture absorbed over the aircraft structure’s life). Alternate means to account for environment using validated tests and analyses (e.g., an equivalent temperature enhancement to account for the effect of moisture without chemically altering the material), may be proposed by the applicant. b. The strength of the composite structure should be reliably established, incrementally, through a programme of analysis and a series of tests conducted using specimens of varying levels of complexity. Often referred to in industry as the “building block” approach, these tests and analyses at the coupon, element, details, and sub-component levels can be used to address the issues of variability, environment, structural discontinuity (e.g., joints, cut-outs or other stress risers), damage, manufacturing defects, and design or process-specific details. Typically, testing progresses from simple specimens to more complex elements and details over time. This approach allows the data collected for sufficient analysis correlation and the necessary replicates to quantify variations occurring at the larger structural scales to be economically obtained. The lessons learned from initial tests also help avoid early failures in more complex full-scale tests, which are more costly to conduct and often occur later in a certification programme schedule. (1) Figures 1 and 2 provide a conceptual schematic of tests typically included in the building block approach for a fixed wing and tail rotor blade structures, respectively. The large quantity of tests needed to provide a statistical basis comes from the lowest levels (coupons and elements) and the performance of structural details are validated in a lesser number of sub-component and component tests. Detail and subcomponent tests may be used to validate the ability of analysis methods to predict local strains and failure modes. Additional statistical considerations (e.g., repetitive point design testing and/or component overload factors to cover material and process variability) will be needed when analysis validation is not achieved. The static strength substantiation programme should also consider all critical loading conditions for all Critical Structure. This includes an assessment of residual strength and stiffness requirements after a predetermined length of service, which takes into account damage and other degradation due to the service period.  Figure 1 - Schematic diagram of building block tests for a fixed wing.  Figure 2 - Schematic diagram of building block tests for a tail rotor blade. (2) Successful static strength substantiation of composite structures has traditionally depended on proper consideration of stress concentrations (e.g., notch sensitivity of details and impact damage), competing failure modes and out-of-plane loads. A complete building block approach to composite structural substantiation addresses most critical structural issues in test articles with increasing levels of complexity so that many areas of reliable performance can be demonstrated prior to the component tests. The details and sub-component testing should establish failure criteria and account for impact damage in assembled composite structures. Component tests are needed to provide the final validation accounting for combined loads and complex load paths, which include some out-of-plane effects. When using the building block approach, the critical load cases and associated failure modes would be identified for component tests using the analytical methods, which are supported by test validation. c. The component static test may be performed in an ambient atmosphere if the effects of the environment are reliably predicted by building block tests and are accounted for in the static test or in the analysis of the results of the static test. d. The static test articles should be fabricated and assembled in accordance with production specifications and processes so that the test articles are representative of production structure including defects consistent with the limits established by manufacturing acceptance criteria. e. The material and processing variability of the composite structure should be considered in the static strength substantiation. This is primarily achieved by establishing sufficient process and quality controls to manufacture structure and reliably substantiate the required strength by test and analysis. The scatter in strength properties due to variability in materials and processes are characterised by proper allowables or design values, which are derived in compliance with CS 2x.613. When the detail, sub-component and component tests show that local strains are adequately predicted and positive margins of safety exist using a validated analysis everywhere on the structure, then proof of static strength is said to be substantiated using analysis supported by test evidence. Alternatively, in the absence of sufficient building block test data and analysis validation, overloads are needed in the component test to gain proof of static strength for the structure using an approach referred to as substantiated by tests. The overload factors applied in this case need to be substantiated either through tests or past experience and must account for the expected material and process variation. f. It should be shown that impact damage that can be expected from manufacturing and service, but not more than the established threshold of detectability for the selected inspection procedure, will not reduce the structural strength below ultimate load capability. This can be shown by analysis supported by test evidence, or by a combination of tests at the coupon, element, sub-component and component levels. The realistic test assessment of impact damage requires proper consideration of the structural details and boundary conditions. When using a visual inspection procedure, the likely impact damage at the threshold of reliable detection has been called barely visible impact damage (BVID). Selection of impact sites for static strength substantiation should consider the criticality of the local structural detail, and the ability to inspect a location. The size and shape of impactors used for static strength substantiation should be consistent with likely impact damage scenarios that may go undetected for the life of an aircraft. Note that it is possible for some designs to have detectable impact damage and still meet static strength loads and other requirements without repair (refer to allowable damage discussions in paragraph 10.c(1)). g. Major material and process changes on existing certified structure require additional static strength substantiation (e.g., refer to [Appendix 3](#_DxCrossRefBm1701658069)). 8. PROOF OF STRUCTURE – FATIGUE AND DAMAGE TOLERANCE The evaluation of composite structure should be based on the applicable certification specifications identified in the type-certification basis. Such evaluation must show that catastrophic failure due to fatigue, environmental effects, manufacturing defects, or accidental damage will be avoided throughout the operational life of the aircraft. The nature and extent of analysis or tests on complete structures and/or portions of the primary structure will depend upon applicable previous fatigue/damage tolerant designs, construction, tests, and service experience on similar structures. In the absence of experience with similar designs, Agency-approved structural development tests of components, sub-components, and elements should be performed (following the same principles discussed in paragraph 7.b and [Appendix 3](#_DxCrossRefBm1701658069)). The following considerations are unique to the use of composite material systems and provide guidance for the method of substantiation selected by the applicant. When establishing details for the damage tolerance and fatigue evaluation, attention should be given to a thorough damage threat assessment, geometry, inspectability, good design practice, and the types of damage/degradation of the structure under consideration. — Composite damage tolerance and fatigue performance is strongly dependent on structural design details (e.g., skin laminate stacking sequence, stringer or frame spacing, stiffening element attachment details, damage arrestment features, and structural redundancy). — Composite damage tolerance and fatigue evaluations require substantiation in component tests unless experience with similar designs, material systems, and loadings is available to demonstrate the adequacy of the analysis supported by coupons, elements, and sub-component tests. — Final static strength, fatigue, and damage tolerance substantiation may be gained in testing a single component test article if sufficient building block test evidence exists to ensure that the selected sequence of repeated and static loading yield results representative of that possible in service or provide a conservative evaluation. — Peak repeated loads are needed to practically demonstrate the fatigue and damage tolerance of composite aircraft structure in a limited number of component tests. As a result, metal structures present in the test article generally require additional consideration and testing. The information contained in AMC 25.571 provides fatigue and damage tolerance guidance for metallic structures. a. Damage Tolerance Evaluation (1) Damage tolerance evaluation starts with identification of structure whose failure would reduce the structural integrity of the aircraft. A damage threat assessment must be performed for the structure to determine possible locations, types, and sizes of damage considering fatigue, environmental effects, intrinsic flaws, and foreign object impact or other accidental damage (including discrete source) that may occur during manufacture, operation or maintenance. (a) Currently, there are very few industry standards that outline the critical damage threats for particular composite structural applications with enough detail to establish the necessary design criteria or test and analysis protocol for complete damage tolerance evaluation. In the absence of standards, it is the responsibility of individual applicants to perform the necessary development tasks to establish such data in support of product substantiation. Some factors to consider in development of a damage threat assessment for a particular composite structure include part function, location on the aircraft, past service data, accidental damage threats, environmental exposure, impact damage resistance, durability of assembled structural details (e.g., long-term durability of bolted and bonded joints), adjacent system interface (e.g., potential overheating or other threats associated with system failure), and anomalous service or maintenance handling events that can overload or damage the part. As related to the damage threat assessment and maintenance procedures for a given structure, the damage tolerance capability and ability to inspect for known damage threats should be developed. (b) Foreign object impact is a concern for most composite structures, requiring attention in the damage threat assessment. This is needed to identify impact damage severity and detectability for design and maintenance. It should include any available damage data collected from service plus an impact survey. An impact survey consists of impact tests performed with representative structure, which is subjected to boundary conditions characteristic of the real structure. Many different impact scenarios and locations should be considered in the survey, which has a goal of identifying the most critical impacts possible (i.e., those causing the most serious damage but are least detectable). When simulating accidental impact damage at representative energy levels, blunt or sharp impactors of different sizes and shapes should be selected to cause the most critical and least detectable damage, according to the load conditions (e.g., tension, compression or shear). Until sufficient service experience exists to make good engineering judgments on energy and impactor variables, impact surveys should consider a wide range of conceivable impacts, including runway or ground debris, hail, tool drops, and vehicle collisions. This consideration is important to the assumptions needed for use of probabilistic damage threat assessments in defining design criteria, inspection methods, and repeat inspection intervals for maintenance. Service data collected over time can better define impact surveys and design criteria for subsequent products, as well as establish more rational inspection intervals and maintenance practice. In review of such information, it should be realised that the most severe and critical impact damages, which are still possible, may not be part of the service database. (c) Once a damage threat assessment is completed, various damage types can be classified into five categories of damage as described below (refer to figure 3). These categories of damage are used for communication purposes in this AMC. Other categories of damage, which help outline a specific path to fatigue and damage tolerance substantiation, may be used by applicants in agreement with the regulatory authorities.  Figure 3 - Schematic diagram showing design load levels versus categories of damage severity. Category 1: Allowable damage that may go undetected by scheduled or directed field inspection and allowable manufacturing defects. Structural substantiation for Category 1 damage includes demonstration of a reliable service life, while retaining ultimate load capability. By definition, such damage is subjected to the requirements and guidance associated with paragraph 7 of this AMC. Some examples of Category 1 damage include BVID and allowable defects caused in manufacturing or service (e.g., small delamination, porosity, small scratches, gouges, and minor environmental damage) that have substantiation data showing ultimate load is retained for the life of an aircraft structure. Category 2: Damage that can be reliably detected by scheduled or directed field inspections performed at specified intervals. Structural substantiation for Category 2 damage includes demonstration of a reliable inspection method and interval while retaining loads above limit load capability. The residual strength for a given Category 2 damage may depend on the chosen inspection interval and method of inspection. Some examples of Category 2 damage include visible impact damage (VID), VID (ranging in size from small to large), deep gouges or scratches, manufacturing mistakes not evident in the factory, detectable delamination or debonding, and major local heat or environmental degradation that will sustain sufficient residual strength until found. This type of damage should not grow or, if slow or arrested growth occurs, the level of residual strength retained for the inspection interval is sufficiently above limit load capability. Category 3: Damage that can be reliably detected within a few flights of occurrence by operations or ramp maintenance personnel without special skills in composite inspection. Such damage must be in a location such that it is obvious by clearly visible evidence or cause other indications of potential damage that becomes obvious in a short time interval because of loss of the part form, fit or function. Both indications of significant damage warrant an expanded inspection to identify the full extent of damage to the part and surrounding structural areas. In practice, structural design features may be needed to provide sufficient large damage capability to ensure limit or near limit load is maintained with easily detectable, Category 3 damage. Structural substantiation for Category 3 damage includes demonstration of a reliable and quick detection, while retaining limit or near limit load capability. The primary difference between Category 2 and 3 damages are the demonstration of large damage capability at limit or near limit load for the latter after a regular interval of time, which is much shorter than the former. The residual strength demonstration for Category 3 damage may be dependent on the reliable short time detection interval. Some examples of Category 3 damage include large VID or other obvious damage that will be caught during walk-around inspection or during the normal course of operations (e.g., fuel leaks, system malfunctions or cabin noise). Category 4: Discrete source damage from a known incident such as flight manoeuvres is limited. Structural substantiation for Category 4 damage includes a demonstration of residual strength for loads specified in the regulations. It should be noted that pressurised structure will generally have Category 4 residual strength requirements at a level higher than shown in figure 3. Some examples of Category 4 damage include rotor burst, bird strikes (as specified in the regulations), tyre bursts, and severe in-flight hail. Category 5: Severe damage created by anomalous ground or flight events, which is not covered by design criteria or structural substantiation procedures. This damage is in the current guidance to ensure the engineers responsible for composite aircraft structure design and the Agency work with maintenance organisations in making operations personnel aware of possible damage from Category 5 events and the essential need for immediate reporting to responsible maintenance personnel. It is also the responsibility of structural engineers to design-in sufficient damage resistance such that Category 5 events are self-evident to the operations personnel involved. An interface is needed with engineering to properly define a suitable conditional inspection based on available information from the anomalous event. Such action will facilitate the damage characterisation needed prior to repair. Some examples of Category 5 damage include severe service vehicle collisions with aircraft, anomalous flight overload conditions, abnormally hard landings, maintenance jacking errors, and loss of aircraft parts in flight, including possible subsequent high-energy, wide-area (blunt) impact with adjacent structure. Some Category 5 damage scenarios will not have clearly visual indications of damage, particularly in composite structures. However, there should be knowledge of other evidence from the related events that ensure safety is protected, starting with a complete report of possible damage by operations. (d) The five categories of damage will be used as examples in subsequent discussion in this paragraph and in paragraphs 9 and 10. Note that Category 2, 3, 4 and 5 damages all have associated repair scenarios. (2) Structure details, elements, and sub-components of Critical Structure should be tested under repeated loads to define the sensitivity of the structure to damage growth. This testing can form the basis for validating a no-growth approach to the damage tolerance requirements. The testing should assess the effect of the environment on the flaw and damage growth characteristics and the no-growth validation. The environment used should be appropriate to the expected service usage. Residual stresses will develop at the interfaces between composite and metal structural elements in a design due to differences in thermal expansion. This component of stress will depend on the service temperature during repeated load cycling and is considered in the damage tolerance evaluation. Inspection intervals should be established, considering both the likelihood of a particular damage and the residual strength capability associated with this damage. The intent of this is to assure that structure is not exposed to an excessive period of time with residual strength less than ultimate, providing a lower safety level than in the typical slow growth situation, as illustrated in Figure 4. Conservative assumptions for capability with large damage sizes that would be detected within a few flights may be needed when probabilistic data on the likelihood of given damage sizes does not exist. Once the damage is detected, the component is either repaired to restore ultimate load capability or replaced.  Figure 4 - Schematic diagram of residual strength illustrating that significant accidental damage with “no-growth” should not be left in the structure without repair for a long time. (a) The traditional slow growth approach may be appropriate for certain damage types found in composites if the growth rate can be shown to be slow, stable and predictable. Slow growth characterisation should yield conservative and reliable results. As part of the slow growth approach, an inspection programme should be developed consisting of the frequency, extent, and methods of inspection for inclusion in the maintenance plan. Inspection intervals should be established such that the damage will have a very high probability of detection between the time it becomes initially detectable and the time at which the extent of the damage reduces the residual static strength to limit load (considered as ultimate), including the effects of environment. For any detected damage size that reduces the load capability below ultimate, the component is either repaired to restore ultimate load capability or replaced. Should functional impairment (such as unacceptable loss of stiffness) occur before the damage becomes otherwise critical, part repair or replacement will also be necessary. (b) Another approach involving growth may be appropriate for certain damage types and design features adopted for composites if the growth can be reliably shown to be predictable and arrested before it becomes critical. Figure 5 shows schematic diagrams for all three damage growth approaches applied to composite structure. The arrested growth method is applicable when the damage growth is mechanically arrested or terminated before becoming critical (residual static strength reduced to limit load), as illustrated in Figure 5. Arrested growth may occur due to design features such as a geometry change, reinforcement, thickness change, or a structural joint. This approach is appropriate for damage growth that is detectable and found to be reliably arrested, including all appropriate dynamic effects. Structural details, elements, and sub-components of Critical Structure, components or full-scale structures, should be tested under repeated loads for validating an Arrested Growth Approach. As was the case for a “no-growth” approach to damage tolerance, inspection intervals should be established, considering the residual strength capability associated with the arrested growth damage size (refer to the dashed lines added to Figure 5 to conceptually show inspection intervals consistent with the slow growth basis). Again, this is intended to ensure that the structure does not remain in a damaged condition with residual strength capability close to limit load for long periods of time before repair. For any damage size that reduces load capability below ultimate, the component is either repaired to restore ultimate load capability or replaced. (c) The repeated loading should be representative of anticipated service usage. The repeated load testing should include damage levels (including impact damage) typical of those that may occur during fabrication, assembly, and in-service, consistent with the inspection techniques employed. The damage tolerance test articles should be fabricated and assembled in accordance with production specifications and processes so that the test articles are representative of production structure. (3) The extent of initially detectable damage should be established and be consistent with the inspection techniques employed during manufacture and in service. This information will naturally establish the transition between Category 1 and 2 damage types (i.e., inspection methods used by trained inspectors in scheduled maintenance). For damage that is clearly detectable to an extent that it will likely be found before scheduled maintenance (i.e., allowing classification as Category 3 damage), detection over shorter intervals and by untrained personnel may be permitted. Flaw/damage growth data should be obtained by repeated load cycling of intrinsic flaws or mechanically introduced damage. The number of cycles applied to validate both growth and no-growth concepts should be statistically significant, and may be determined by load and/or life considerations and a function of damage size. The growth or no growth evaluation should be performed by analysis supported by test evidence or by tests at the coupon, element, or sub-component level.  Figure 5 - Illustrations of residual strength and damage size relationships for three different approaches to composite structural damage tolerance substantiation (4) The extent of damage for residual strength assessments should be established, including considerations for the probability of detection using selected field inspection procedures. The first four categories of damage should be considered based on the damage threat assessment. In addition, Category 3 damage should be detected in a walk-around inspection or through the normal course of operations. Residual strength evaluation by component or sub-component testing or by analysis supported by test evidence should be performed considering that damage. The evaluation should demonstrate that the residual strength of the structure will reliably be equal to or greater than the strength required for the specified design loads (considered as ultimate), including environmental effects. The statistical significance of reliable sub-component and detail residual strength assessments may include conservative methods and engineering judgment. It should be shown that stiffness properties have not changed beyond acceptable levels. (a) For the no-growth, slow growth, arrested growth approaches, residual strength testing should be performed after repeated load cycling. All probabilistic analyses applied for residual strength assessments should properly account for the complex nature of damage defined from a thorough damage threat assessment. Conservative damage metrics are permitted in such analyses assuming sufficient test data on repeated load and environmental exposure exists. (b) Composite designs should afford the same level of fail-safe, multiple load path structure assurance as conventional metals design. Such is also the expectation in justifying the use of static strength allowables with a statistical basis of 90 percent probability with 95 percent confidence. (c) Some special residual strength considerations for bonded structure are given in paragraph 6.c.(3). (5) The repeated load spectrum developed for fatigue testing and analysis purposes should be representative of the anticipated service usage. Low amplitude load levels that can be shown not to contribute to damage growth may be omitted. Reducing maximum load levels is generally not accepted. Variability in repeated load behaviour should be covered by appropriate load enhancement or life scatter factors and these factors should take into account the number of specimens tested. The use of such factors to demonstrate reliability in component tests should be consistent with the fatigue and damage tolerance behaviour characterised for the materials, processes and other design details of the structure in building block tests. (6) An inspection programme should be developed consisting of frequency, extent, and methods of inspection for inclusion in the maintenance plan. Inspection intervals should be established such that the damage will be reliably detected between the time it initially becomes detectable and the time at which the extent of damage reaches the limits for required residual strength capability. The potential for missed inspections should be considered. (a) For the case of no-growth design concept, inspection intervals should be established as part of the maintenance programme. In selecting such intervals, the residual strength level associated with the assumed damages should be considered. This point was illustrated in Figures 4 and 5. Note that an acceptable inspection interval for the larger damages shown for the “no-growth” and “arrested growth” options in Figures 4 and 5 was conceptually shown as related to an acceptable slow growth basis in terms of the residual strength and time below ultimate load before damage was detected and repaired. Data on the probability of occurrence for different damage sizes also helps define an inspection interval. (b) A thorough composite damage threat assessment and the separation of different damage sizes into categories, each with associated detection methods, supports programmes using a rigorous damage tolerance assessment to avoid conservative design criteria with very large damage assumptions. In such cases, Category 2 damage types will require the structural substantiation of well specified and reliable inspection methods applied by trained inspectors at scheduled maintenance intervals (by default, Category 1 damage is at the threshold of this evaluation). Those damages classified as Category 3 may take advantage of shorter service time intervals provided sufficient structural substantiation exists with demonstrated proof that there will be early detection by untrained ramp maintenance or operations personnel. By definition, Category 4 damage will require residual strength substantiation to levels that complete a flight with limited manoeuvres based on the associated regulatory loads. Due to the nature of service events leading to Category 4 damage, suitable inspections will need to be defined to evaluate the full extent of damage, prior to subsequent aircraft repair and return to service. By definition, Category 5 damages do not have associated damage tolerance design criteria or related structural substantiation tasks. Category 5 damage will require suitable inspections based on engineering assessment of the anomalous service event, and appropriate structural repair and/or part replacement, prior to the aircraft re-entering service. (7) The structure should be able to withstand static loads (considered as ultimate loads) which are reasonably expected during a completion of the flight on which damage resulting from obvious discrete sources occur (i.e., uncontained engine failures, etc.). The extent of damage should be based on a rational assessment of service mission and potential damage relating to each discrete source. Structural substantiation will be needed for the most critical Category 4 damage as related to the associated load cases. Some Category 4 damage may have high margins but will likely still require suitable inspections since their detectability may not be consistent with the substantiations validated for Category 2 damage types. (8) The effects of temperature, humidity, and other environmental or time-related aging factors, which may result in material property degradation, should be addressed in the damage tolerance evaluation. Unless tested in the environment, appropriate environmental factors should be derived and applied in the evaluation. b. Fatigue Evaluation Fatigue substantiation should be accomplished by component fatigue tests or by analysis supported by test evidence, accounting for the effects of the appropriate environment. The test articles should be fabricated and assembled in accordance with production specifications and processes so that the test articles are representative of production structures. Sufficient component, sub-component, element or coupon tests should be performed to establish the fatigue scatter and the environmental effects. Component, sub-component, and/or element tests may be used to evaluate the fatigue response of structure with impact damage levels typical of those that may occur during fabrication, assembly, and in service, consistent with the inspection procedures employed. Other allowed manufacturing and service defects, which would exist for the life of the structure, should also be included in fatigue testing. It should be demonstrated during the fatigue tests that the stiffness properties have not changed beyond acceptable levels. Replacement lives should be established based on the test results. By definition, Category 1 damage is subjected to fatigue evaluation and expected to retain ultimate load capability for the life of the aircraft structure. c. Combined Damage Tolerance and Fatigue Evaluation Generally, it is appropriate for a given structure to establish both an inspection programme and demonstrate a service life to cover all detectable and non-detectable damage, respectively, which is anticipated for the intended aircraft usage. Extensions in service life should include evidence from component repeated load testing, fleet leader programmes (including NDI and destructive tear-down inspections), and appropriate statistical assessments of accidental damage and environmental service data considerations. 9. PROOF OF STRUCTURE – FLUTTER AND OTHER AEROELASTIC INSTABILITIES The aeroelastic evaluations including flutter, control reversal, divergence, and any undue loss of stability and control as a result of structural loading and resulting deformation, are required. Flutter and other aeroelastic instabilities must be avoided through design, quality control, maintenance, and systems interaction. a. The evaluation of composite structure needs to account for the effects of repeated loading, environmental exposure, and service damage scenarios (e.g., large Category 2, 3 or 4 damage) on critical properties such as stiffness, mass and damping. Some control surfaces exposed to large damage retain adequate residual strength margins, but the potential loss of stiffness or mass increase (e.g., sandwich panel disbond and/or water ingression) may adversely affect flutter and other aeroelastic characteristics. This is particularly important for control surfaces that are prone to accidental damage and environmental degradation. Other factors such as the weight or stiffness changes due to repair, manufacturing flaws, and multiple layers of paint need to be evaluated. There may also be issues associated with the proximity of high temperature heat sources near structural components (e.g., empennage structure in the path of jet engine exhaust streams or engine bleed air pneumatics system ducting). These effects may be determined by analysis supported by test evidence, or by tests at the coupon, element or sub-component level. 10. CONTINUED AIRWORTHINESS The maintenance and repair of composite aircraft structure should meet all general, design and fabrication, static strength, fatigue/damage tolerance, flutter, and other considerations covered by this AMC as appropriate for the particular type of structure and its application. a. Design for Maintenance Composite aircraft structure should be designed for inspection and repair access in a field maintenance environment. The inspection and repair methods applied for structural details should recognise the special documentation and training needed for critical damage types that are difficult to detect, characterise and repair. The inspection intervals and life limits for any structural details and levels of damage that preclude repair must be clearly documented in the appropriate continued airworthiness documents. b. Maintenance Practices Maintenance manuals, developed by the appropriate organisations, should include appropriate inspection, maintenance, and repair procedures for composite structures, including jacking, disassembly, handling, part drying methods, and repainting instructions (including restrictions for paint colours that increase structural temperatures). Special equipment, repair materials, ancillary materials, tooling, processing procedures, and other information needed for inspection or repair of a given part should be identified since standard field practices, which have been substantiated for different aircraft types and models, are not common. (1) Damage Detection (a) Procedures used for damage detection must be shown to be reliable and capable of detecting degradation in structural integrity below ultimate load capability. These procedures must be documented in the appropriate sections of the instructions for continued airworthiness. This should be substantiated in static strength, environmental resistance, fatigue, and damage tolerance efforts as outlined in paragraphs 6, 7 and 8. Substantiated detection procedures will be needed for all damage types identified by the threat assessment, including a wide range of foreign object impact threats, manufacturing defects, and degradation caused by overheating. Degradation in surface layers (e.g., paints and coatings) that provide structural protection against ultraviolet exposure must be detected. Any degradation to the lightning strike protection system that affects structural integrity, fuel tank safety, and electrical systems must also be detected. (b) Visual inspection is the predominant damage detection method used in the field and should be performed under prescribed lighting conditions. Visual inspection procedures should account for access, time relaxation in impact damage dent depth, and the colour, finish and cleanliness of part surfaces. (2) Inspection. Visual indications of damage, which are often used for composite damage detection, provide limited details on the hidden parts of damage that require further investigation. As a result, additional inspection procedures used for complete composite damage characterisation will generally be different from those used for initial damage detection and need to be well documented. Non-destructive inspection performed prior to repair and destructive processing steps performed during repair must be shown to locate and determine the full extent of the damage. In-process controls of repair quality and post-repair inspection methods must be shown to be reliable and capable of providing engineers with the data to determine degradation in structural integrity below ultimate load capability caused by the process itself. Certain processing defects cannot be reliably detected at completion of the repair (e.g., weak bonds). In such cases, the damage threat assessment, repair design features and limits should ensure sufficient damage tolerance. (3) Repair. All bolted and bonded repair design and processing procedures applied for a given structure shall be substantiated to meet the appropriate requirements. Of particular safety concern are the issues associated with bond material compatibilities, bond surface preparation (including drying, cleaning, and chemical activation), cure thermal management, composite machining, special composite fasteners, and installation techniques, and the associated in‑process control procedures. The surface layers (e.g., paints and coatings) that provide structural protection against ultraviolet exposure, structural temperatures, and the lightning strike protection system must also be properly repaired. (4) Documentation and Reporting. Documentation on all repairs must be added to the maintenance records for the specific part number. This information supports future maintenance damage disposition and repair activities performed on the same part. It is recommended that service difficulties, damage, and degradation occurring to composite parts in service should be reported back to the design approval holder to aid in continuous updates of damage threat assessments to support future design detail and process improvements. Such information will also support future design criteria, analysis, and test database development. c. Substantiation of Repair (1) When repair procedures are provided in Agency approved documents or the maintenance manual, it should be demonstrated by analysis and/or test that the method and techniques of repair will restore the structure to an airworthy condition. Repairable damage limits (RDL), which outline the details for damage to structural components that may be repaired based on existing data, must be clearly defined and documented. Allowable damage limits (ADL), which do not require repair, must also be clearly defined and documented. Both RDL and ADL must be based on sufficient analysis and test data to meet the appropriate structural substantiation requirements and other considerations outlined in this AMC. Additional substantiation data will generally be needed for damage types and sizes not previously considered in design development. Some damage types may require special instructions for field repair and the associated quality control. Bonded repair is subjected to the same structural bonding considerations as the base design (refer to paragraph 6.c). (2) Operators and maintenance repair organisations (MRO) wishing to complete major repairs or alterations outside the scope of approved repair documentation should be aware of the extensive analysis, design, process, and test substantiation required to ensure the airworthiness of a certificated structure. Documented records and the certification approval of this substantiation should be retained in accordance with regulations to support any subsequent maintenance activities. d. Damage Detection, Inspection and Repair Competency (1) All technicians, inspectors and engineers involved in damage disposition and repair should have the necessary skills to perform their supporting maintenance tasks on a specific composite structural part. The continuous demonstration of acquired skills goes beyond initial training (e.g., similar to a welder qualification). The repair design, inspection methods, and repair procedures used will require approved structural substantiation data for the particular composite part. Society of Automotive Engineers International (SAE) Aerospace Information Report (AIR) 5719 outlines training for an awareness of the safety issues for composite maintenance and repair. Additional training for specific skill building will be needed to execute particular engineering, inspection and repair tasks. (2) Pilots, ramp maintenance, and other operations personnel that service aircraft should be trained to immediately report anomalous ramp incidents and flight events that may potentially cause serious damage to composite aircraft structures. In particular, immediate reporting is needed for those service events that are outside the scope of the damage tolerance substantiation and standard maintenance practices for a given structure. The immediate detection of Category 4 and 5 damages are dependent on the proper reaction of personnel that operate and service the aircraft. 11. ADDITIONAL CONSIDERATIONS a. Crashworthiness (1) The crashworthiness of the aircraft is dominated by the impact response characteristics of the fuselage. Regulations, in general, evolve based on either experience gained through incidents and accidents of existing aircraft or in anticipation of safety issues raised by new designs. In the case of crashworthiness, regulations have evolved as experience has been gained during actual aircraft operations. For example, emergency load factors and passenger seat loads have been established to reflect dynamic conditions observed from fleet experience and from controlled FAA and industry research. Fleet experience has not demonstrated a need to have an aircraft level crashworthiness standard. As a result, the regulations reflect the capabilities of traditional aluminium aircraft structure under survivable crash conditions. This approach was satisfactory as aircraft have continued to be designed using traditional construction methods. With the advent of composite fuselage structure and/or the use of novel design, this historical approach may no longer be sufficient to substantiate the same level of protection for the passengers as provided by similar metallic designs. (2) Airframe design should assure that occupants have every reasonable chance of escaping serious injury under realistic and survivable crash impact conditions. A composite design should account for unique behaviour and structural characteristics, including major repairs or alterations, as compared with conventional metal airframe designs. Structural evaluation may be done by test or analysis supported by test evidence. Service experience may also support substantiation. (3) The crash dynamics of an aircraft and the associated energy absorption are difficult to model and fully define representative tests with respect to structural requirements. Each aircraft product type (i.e., large aeroplane, small aeroplane, and rotorcraft) has unique regulations governing the crashworthiness of particular aircraft structures. The regulations and guidance associated with each product type should be used accordingly. The regulations for large aeroplane and rotorcraft address some issues that go beyond those required of small aeroplanes. (4) Special conditions are anticipated for large aeroplanes with composite fuselage structure to address crashworthiness survivability. The impact response of a composite fuselage structure must be evaluated to ensure the survivability is not significantly different from that of a similar-sized aircraft fabricated from metallic materials. Impact loads and resultant structural deformation of the supporting airframe and floor structures must be evaluated. Four main criteria areas should be considered in making such an evaluation. (a) Occupants must be protected during the impact event from release of items of mass (e.g., overhead bins). (b) At least the minimum number of emergency egress paths must remain following a survivable crash. (c) The acceleration and loads experienced by occupants during a survivable crash must not exceed critical thresholds. (d) A survivable volume of occupant space must be retained following the impact event. (5) The criticality of each of these four criteria will depend on the particular crash conditions. For example, the loads and accelerations experienced by passengers may be higher at lower impact velocities where structural failures have not started to occur. As a result, validated analyses may be needed to practically cover all the crashworthiness criteria for a fuselage. (6) Existing large aeroplane requirements also require that fuel tank structural integrity be addressed during a survivable crash impact event as related to fire safety (also refer to paragraph 11.b). As related to crashworthiness, composite fuel tank structure must not fail or deform to the extent that fire becomes a greater hazard than with metal structure. (7) Physics and mechanics of the crashworthiness for composite structures involve several issues. The local strength, energy absorbing characteristics, and multiple competing failure modes need to be addressed for composite structure subjected to a survivable crash. This is not simply achieved for airframe structures made from anisotropic, quasi-brittle, composite materials. As a result, the accelerations and load histories experienced by passengers and equipment on a composite aircraft may differ significantly from that seen on a similar metallic aircraft unless specific considerations are designed into the composite structure. In addition, care should be taken when altering composite structure to achieve specific mechanical behaviours. (For example, where the change in behaviour of a metallic structure with a change in material thickness may be easily predicted, an addition or deletion of plies to a composite laminate may also require data for the effects of laminate stacking sequence on the failure mode and energy absorption characteristics of a composite element). (8) Representative structure must be included to gain valid test and analysis results. Depending on aircraft loading (requiring investigation of various aircraft passenger and cargo configurations), structural dynamic considerations, and progressive failures, local strain rates and loading conditions may differ throughout the structure. Sensitivity of the structural behaviour to reasonable impact orientation should also be considered for large aeroplane and rotorcraft applications. This can be addressed by analysis supported by test evidence. (9) Considering a need for comparative assessments with metal structure and a range of crash conditions, analysis with sufficient structural test evidence is often needed for large aeroplane and rotorcraft applications. Analysis requires extensive investigation of model sensitivity to modelling parameters (e.g., mesh optimisation, representation of joints, element material input stress-strain data). Test also requires investigation of test equipment sensitivity appropriate to composites (e.g., filter frequencies with respect to expected pulse characteristics in the structure). Model validation may be achieved using a building block approach, culminating in an adequately complex test (e.g., a drop test with sufficient structural details to properly evaluate the crashworthiness criteria). b. Fire Protection, Flammability and Thermal Issues (1) Fire and exposure to temperatures that exceed maximum operating conditions require special considerations for composite airframe structure. (Refer to note below). Requirements for flammability and fire protection of aircraft structure attempt to minimise the hazard to occupants in the event that flammable materials, fluids, or vapours ignite. The regulations associated with each aircraft product type (i.e., transport, small airplane, rotorcraft) should be used accordingly. Compliance may be shown by tests or analysis supported by test evidence. A composite design, including repair and alterations, should not decrease the existing level of safety relative to metallic structure. In addition, maintenance procedures should be available to evaluate the structural integrity of any composite aircraft structures exposed to fire and temperatures above the maximum operating conditions substantiated during design. Note: Aircraft cabin interiors and baggage compartments have been areas of flammability concerns in protecting passenger safety. This revision of the AMC does not address composite materials used in aircraft interiors and baggage compartments. Please consult other Guidance Material for Acceptable Means of Compliance with flammability rules for interiors. (2) Fire protection and flammability has traditionally been considered for engine mount structure, firewalls, and other powerplant structures that include composite elements. Additional issues critical to passenger safety have come with the expanded use of composites in wing and fuselage structures for large aeroplanes. Existing regulations do not address the potential for the airframe structure itself to be flammable. Wing and fuselage applications should consider the effects of composite design and construction on the resulting passenger safety in the event of in-flight fires or emergency landing conditions, which combine with subsequent egress when a fuel-fed fire is possible. (3) The results of fire protection and flammability testing with structural composite parts indicate dependence upon overall design and process details, as well as the origin of the fire and its extent. For example, the overall effects of composite fuselage structures exposed to fire may be significantly different when the fire originates within the cabin, where it can be controlled by limiting the structure’s contribution to spreading the fire, than when the fire occurs exterior to the fuselage after a crash landing, where fuel is likely to be the primary source for maintaining and spreading the fire. The threat in each case is different, and the approach to mitigation may also be different. In-flight fire safety addresses a fire originating within the aircraft due to some fault, whereas post-crash fire safety addresses a fuel fed pool fire external to the aircraft. Special conditions are anticipated for large aeroplanes with fuselage structure subjected to both in-flight and post-crash fire conditions. Large aeroplane wing structure will need to have special conditions for post-crash fire conditions. (4) For an in-flight fire in large aeroplanes, it is critical that the fire not propagate or generate hazardous quantities of toxic by-products. In-flight fires have been catastrophic when they can grow in inaccessible areas. Composite fuselage structure could play a role different from traditional metal structure if the issue is not addressed. (5) Metallic large aeroplane fuselage and wing structures have established a benchmark in fire protection that can be used to evaluate specific composite wing and fuselage structural details. Exterior fire protection issues associated with composite structure must include the effects of an exterior pool fire following a survivable crash landing. Fuselage structure should provide sufficient time for passenger egress, without fire penetration or the release of gasses and/or materials that are either toxic to escaping passengers or reduce visibility (smoke density) or could increase the fire severity. Furthermore, these considerations must be extended to wing and fuel tank structure, which must also be prevented from collapse and release of fuel (including consideration of the influence of fuel load upon the structural behaviour. For large aeroplanes, the standards of CS 25.856(b) provide the benchmark to establish the required level of safety. (6) The exposure of composite structures to high temperatures needs to extend beyond the direct flammability and fire protection issues to other thermal issues. Many composite materials have glass transition temperatures, which mark the onset of reductions in strength and stiffness that are somewhat lower than the temperatures that can have a similar effect on equivalent metallic structure. The glass transition temperature of most composite materials is further reduced by moisture absorption. The reduced strength or stiffness of composites from high temperature exposures must be understood per the requirements of particular applications (e.g., engine or other system failures). After a system failure and/or known fire, it may be difficult to detect the full extent of irreversible heat damage to an exposed composite structure. As a result, composite structures exposed to high temperatures may require special inspections, tests, and analysis for proper disposition of heat damage. All appropriate damage threats and degradation mechanisms need to be identified and integrated into the damage tolerance and maintenance evaluation accordingly. Reliable inspections and test measurements of the extent of damage that exists in a part exposed to unknown levels of high temperatures should be documented. Particular attention should be given to defining the maximum damages that likely could remain undetected by the selected inspection procedures. c. Lightning Protection Lightning protection design features are needed for composite aircraft structures. Current Carbon fibre composites are approximately 1,000 times less electrically conductive than standard aluminium materials, and composite resins and adhesives are traditionally non-conductive. Glass and aramid fibre composites are non-conductive. A lightning strike to composite structures can result in structural failure or large area damage, and it can induce high lightning current and voltage on metal hydraulic tubes, fuel system tubes, and electrical wiring if proper conductive lightning protection is not provided. Aircraft lightning protection design guidance can be found in the FAA Technical Report “Aircraft Lightning Protection Handbook” (See [Appendix 1](#_DxCrossRefBm1701658068) 2.a). The lightning protection effectiveness for composite structures should be demonstrated by tests or analysis supported by tests. Such tests are typically performed on panels, coupons, subassemblies, or coupons representative of the aircraft structure, or tests on full aircraft. The lightning test waveforms and lightning attachment zones are defined in EUROCAE ED-84 and ED-91. Any structural damage observed in standard lightning tests should be limited to Category 1, 2 or 3, depending on the level of detection. This damage is characterised and integrated into damage tolerance analyses and tests as appropriate. Small simple aeroplanes certified under CS-23 for VFR use only may be certified based on engineering assessment, according to AC 23-15A. The effects of composite structural repairs and maintenance on the lightning protection system should be evaluated. Repairs should be designed to maintain lightning protection. (1) Lightning Protection for Structural Integrity (a) The composite structural design should incorporate the lightning protection when appropriate for the anticipated lightning attachment. The extent of lightning protection features depends on the lightning attachment zone designated for that area of the aircraft. Lightning protection features may include, but are not limited to, metal wires or mesh added to the outside surface of the composite structure where direct lightning attachment is expected. (b) When lightning strikes an aircraft, very high currents flow through the airframe. Proper electrical bonding must be incorporated between structural parts. This is difficult to achieve for moveable parts (e.g., ailerons, rudders and elevators). The electrical bonding features must be sized to conduct the lightning currents or they can vaporise, sending the high currents through unintended paths such as control cables, control rods, or hydraulic tubes. Guidance for certification of lightning protection of aircraft structures can be found in EUROCAE ED-113. (2) Lightning Protection for Fuel Systems (a) Special consideration must be given to the fuel system lightning protection for an aircraft with integral fuel tanks in a composite structure. Composite structure with integral fuel systems must incorporate specific lightning protection features on the external composite surfaces, on joints, on fasteners, and for structural supports for fuel system plumbing and components to eliminate structural penetration, arcing, sparks or other ignition sources. AC 20-53B provides certification guidance for aircraft fuel system lightning protection. (b) Large aeroplane regulations for fuel system ignition prevention in CS 25.981 require lightning protection that is failure tolerant. As a result, redundant and robust lightning protection for composite structure joints and fasteners in fuel tank structure is needed to ensure proper protection in preventing ignition sources. (3) Lightning Protection for Electrical and Electronic Systems (a) Lightning strike protection of composite structures is needed to avoid inducing high lightning voltages and currents on the wiring for electrical and electronic systems whose upset or damage could affect safe aircraft operation. The consequences from a lightning strike of unprotected composite structures can be catastrophic for electrical and electronic systems that perform highly critical functions, such as fly-by-wire flight controls or engine controls. (b) Electrical shields over system wiring and robust circuit design of electrical and electronic equipment both provide some protection against system upset or damage due to lightning. Since most composite materials provide poor shielding, at best, metal foil or mesh is typically added to the composite structure to provide additional shielding for wiring and equipment. Electrical bonding between composite structure parts and panels should be provided for the shielding to be effective. EUROCAE ED‑81 and ED-107 provide certification guidance for aircraft electrical and electronic system lightning protection. [Amdt 20/6]