Damage tolerance assumes the structure already has a flaw and asks whether the aircraft stays safe anyway. Regulation (FAR/CS 25.571, and the military equivalents in MIL-STD-1530 / the old MIL-A-83444 thinking) gives you a small set of routes to that answer. The two that matter for most metallic primary structure are slow crack growth and fail-safe. They are not interchangeable. They are different promises about how the part behaves once a crack exists, and they drive different analyses, different tests, and different inspection programmes.

Two promises

Slow crack growth. A crack grows in a single, non-redundant load path — slowly, stably, and predictably — and we inspect it out before it reaches critical size. The whole substantiation rests on three things: a believable initial flaw, a crack-growth curve you trust, and an inspection interval that genuinely fits the operator. There is no second load path catching you. If the curve is wrong or the inspection is missed, the structure is gone.

Fail-safe. The structure is arranged so that after a single member fails — or after a crack arrests at a designed boundary — load redistributes and the remaining structure carries a defined residual-strength load to the next inspection. Safety comes from redundancy and arrest features (crack stoppers, tear straps, multiple spars or planks), not from watching a single crack creep. You pay for it in mass and in part count.

Why the choice has to come first

The trap is to mesh before you have decided which promise you are making. The two philosophies do not converge on the same model:

  • Different critical locations. Slow-crack-growth thinking points you at the worst single detail. Fail-safe thinking points you at the load path that has to pick up the slack after something breaks.
  • Different load cases. Fail-safe demands the broken-element (continuing-damage) case, with the appropriate dynamic factor on the redistributed load. Slow crack growth never needs it.
  • Different residual-strength requirement. Fail-safe has to demonstrate residual strength at limit (or a regulated fraction) with the member gone. Slow crack growth has to demonstrate it at the critical crack size.
  • Different inspection programme. One route sells the airframe on a tight, recurring NDI interval; the other sells it on redundancy and a walk-around-class inspection. The operator lives with whichever you chose.

Pick the philosophy late and you re-run everything. Pick it early and the analysis nearly writes itself.

How the inspection interval actually falls out

For slow crack growth the logic is mechanical, and worth keeping in your head:

  1. Set the initial flaw — typically a rogue/manufacturing flaw per the certification basis (a quarter-circular corner crack at a fastener hole is the classic starting assumption).
  2. Find the critical crack length a_c from the residual-strength requirement: the size at which K reaches K_c (or net-section fails) under the residual-strength load.
  3. Integrate the growth curve from initial to critical to get a life in flights, then divide by a factor (commonly 2) so two inspections bracket the detectable-to-critical window. That factor is the whole safety argument — it is why a single missed inspection does not lose the aircraft.

The growth is da/dN = C·(ΔK)^m in the Paris regime, with da/dN the growth per cycle, ΔK the stress-intensity range, and C, m the material constants. Real spectra spend most of their life in near-threshold and most of their length in the last few percent, where growth accelerates toward K_c — so the integral is dominated by the small-crack end for time and the large-crack end for the critical size. Get either end wrong and the interval is wrong.

Where I land in practice

On monolithic primary structure — a machined bulkhead, a one-piece spar cap — I lean toward slow crack growth, because designing in true redundancy costs mass you usually do not have on a fighter. The price is that your inspection and your NDI capability (the smallest crack you can reliably find, the 90/95 probability-of-detection size) become load-bearing parts of the certification, not afterthoughts.

On built-up structure with natural load paths — multi-spar wings, multi-rib stabilisers, skin-stringer fuselage — fail-safe is often already present in the architecture. There the job is to prove the redundancy is real: that load genuinely redistributes after a member fails, that the arrest feature arrests, and that the residual-strength case closes. On a CS-23 trainer that built-up redundancy is frequently what makes the certification tractable in the first place.

Either way, the first deliverable of a damage-tolerance task is not a number. It is a sentence: “this region is substantiated by [slow crack growth / fail-safe], because…”. Write that sentence first, get it agreed with the chief engineer and the certification authority, and everything downstream — load cases, critical locations, test plan, inspection programme — is just consequence.