Management of Airframe In-Service Pitting Corrosion by Decoupling Fatigue and Environment

: Corrosion-induced maintenance is a signiﬁcant cost driver and availability degrader for aircraft structures. Although well-established analyses enable assessing the corrosion impact on structural integrity, this is not the case for fatigue nucleation and crack growth. This forces ﬂeet managers to directly address detected corrosion to maintain ﬂight safety. Corrosion damage occurs despite protection systems, which inevitably degrade. In particular, pitting corrosion is a common potential source of fatigue. Corrosion pits are discontinuities whose metrics can be used to predict the impact on the fatigue lives of structural components. However, a damage tolerance (DT) approach would be more useful and ﬂexible. A potential hindrance to DT has been the assumption that corrosion-induced fatigue nucleation transitions to corrosion fatigue, about which little is known for service environments. Fortunately, several sources indicate that corrosion fatigue is rare for aircraft, and corrosion is largely conﬁned to ground situations because aircraft generally ﬂy at altitudes with low temperature and humidity Thus, it is reasonable to propose the decoupling of corrosion from the in-ﬂight dynamic (fatigue) loading. This paper presents information to support this proposition, and provides an example of how a DT approach can allow deferring corrosion maintenance to a more opportune time.


Introduction
Airframe corrosion maintenance and control are major sustainment cost drivers and availability degraders. This is despite good design; corrosion prevention and control plans; and the use of various protection systems, including anodising layers on aluminium, cadmium and chromium plating of steels, special coatings such as ion vapour deposition (IVD) aluminium, corrosion-inhibiting paint primers and topcoats. The protection systems degrade in service, and corrosion commences. This has the potential to impact aircraft structural integrity if not adequately addressed.
Management of aircraft fatigue and environmental degradation is generally well understood when these aspects are viewed as distinct and separate tasks, e.g., in typical Aircraft Structural Integrity Management Plans (ASIMP) [1]. For example, this is the case for fatigue nucleating from unintentional manufacturing discontinuities, often surface connected, that occur in typical production-quality metallic airframes; and also for assessing the effect of corrosion (material loss) on static strength and stiffness and hence the structural integrity [2].
On the other hand, when there are corrosion-related fatigue problems, notably the nucleation and growth of fatigue cracks from corrosion damage, the only currently available remedy is 'find and fix', i.e., when corrosion is found, it has to be removed and the affected area restored to full structural integrity. This situation exists mainly because: (i) The onset of degradation or damage of the metal's protective surface treatment is not predictable; (ii) Concerns that fatigue cracking (should it exist) will be influenced by the presence of a corrosive environment, e.g., [3][4][5][6], as it is well known that cracking in corrosive environments occurs at significantly higher rates than in laboratory air (i.e., the source of most fatigue crack growth rate data); (iii) The transition of corrosion (usually pitting corrosion; see Section 2 for fatigue crack nucleation) is not well understood [6]; and (iv) Approved analytical tools are not available to determine the significance of corrosion, when detected, for the fatigue of aircraft structures.
This paper provides examples of fatigue cracking and growth from service-induced corrosion pits, followed by a discussion of managing corrosion pitting in a framework that differs from the 'find and fix' method. The purpose of this discussion is to continue support, based on fracture mechanics (note: the USAF damage-tolerant surrogate flaw values and approach may be used if the effective crack-like size of a pit can be shown to be less than these values), e.g., [6][7][8][9], such that detected corrosion is left in service for a short well-defined period, for example until the next maintenance. This approach avoids unplanned maintenance, which is very expensive owing to logistical problems, e.g., personnel availability and aircraft operational requirements. If the removal of corrosion pitting until the next planned maintenance is possible, then this by itself should save much unnecessary expense while allowing for the continuance of operational capabilities.

Corrosion and Fatigue of Airframe Alloys: Practical Considerations
Much corrosion in metallic aircraft is due to localised pitting: an example is shown in Figure 1 [10]. The pits may be shallow in their early stages, resembling general corrosion when viewed macroscopically. Additionally, pitting may be present under white or grey powdery deposits of corrosion products on aluminium alloy surfaces, and only become visible after removing the deposits. Since pitting corrosion is common, and there is plenty of evidence from both service aircraft and laboratory tests that it can result in fatigue, this issue is explicitly discussed in the present paper. However, it must be stated that only some corrosion pits lead to cracks [3]. In recent years, independent evidence has been obtained that there appears to be little or no corrosion activity in flight for aircraft structures since the conditions for corrosion are not present at altitude. (This is not necessarily applicable to aircraft that often fly for long periods at low altitudes in tropical and subtropical marine environments and coastal areas, or to internal spaces, e.g., cargo holds, that may be exposed to corrosive materials; additionally, it must be noted that some categories (e.g., combat aircraft) spend most of their service life on the ground) [7,8,[12][13][14][15][16][17][18][19][20][21][22][23][24] or else there is either a fatigue problem or a The literature abounds with studies of aircraft alloys subjected to a corrosive environment and cycled under fatigue loading. These studies state that in a corrosive environment, the fatigue life can be reduced by 50 to 400% (e.g., [4,11]). Although these studies dramatically illustrate the potential detrimental influence of corrosion on fatigue lives, they are largely irrelevant to the fleet manager. This is because: The in-service time of the effect is not considered, i.e., there is no attempt to correlate or indicate the reduction in the fatigue life with respect to aircraft service lives. This is an intractable problem owing to enormously different time scales; b.
Most results were obtained by fatigue cycling in a continuous corrosive environment (usually 3.5% NaCl salt spray) which is not representative for aircraft (see below); c.
The influences of a protection scheme or its degradation are not generally considered. There are exceptions, e.g., [6], but these still have timescale-related problems; and d.
Such tests are not reflected by service experience, given that proper maintenance programmes are in place.
In recent years, independent evidence has been obtained that there appears to be little or no corrosion activity in flight for aircraft structures since the conditions for corrosion are not present at altitude. (This is not necessarily applicable to aircraft that often fly for long periods at low altitudes in tropical and subtropical marine environments and coastal areas, or to internal spaces, e.g., cargo holds, that may be exposed to corrosive materials; additionally, it must be noted that some categories (e.g., combat aircraft) spend most of their service life on the ground) [7,8,[12][13][14][15][16][17][18][19][20][21][22][23][24] or else there is either a fatigue problem or a corrosion problem. The former evidence is well demonstrated in investigations by Trathen [12], who presented the corrosion rates measured in internal bays in a range of Royal Australian Air Force (RAAF) aircraft: see the example in Figure 2, where there appeared to be little corrosion activity during flight. Instead, corrosion occurred while the aircraft was on the ground. Typical output from a P-3C corrosion monitor, showing corrosion current, μA, periods of flight, and airfield relative humidity (RH), reprinted with permission from [12].
A different way and indirect way to show there would be little corrosion activity (specifically corrosion-assisted fatigue crack growth) during flight were specimen tests in 'wet' and 'dry' air at a cycle frequency roughly comparable to pressurisation cycling for a transport aircraft pressure cabin [25]. An example is given in Figure 3. The fractograph in Figure 3 was taken in the early part of the continuum-mode fatigue crack growth regime for AA2024-T3, a standard pressure cabin skin material. In this regime, cycling at normal frequencies, e.g., 1-20 Hz, in dry or wet air, or even distilled water, results in well-defined so-called 'ductile' fatigue striations. However, cycling at 0.003 Hz (one cycle taking approximately 5½ min) resulted in a change from ductile striations in dry air to a cleavage- Figure 2. Typical output from a P-3C corrosion monitor, showing corrosion current, µA, periods of flight, and airfield relative humidity (RH), reprinted with permission from [12].
Tropical, coastal and industrial regions are unfavourable environments. Aircraft operating in these environments and spending most of their time at low altitude and on the ground are likely to experience more corrosion, owing to consistently high humidities and moderate-to-high temperatures. Contaminants are also important. Salt is a frequent and widespread contaminant, and so are industrial pollutants such as sulphur dioxide, ammonia and smoke particles, all of which can accelerate corrosion [22].
A different way and indirect way to show there would be little corrosion activity (specifically corrosion-assisted fatigue crack growth) during flight were specimen tests in 'wet' and 'dry' air at a cycle frequency roughly comparable to pressurisation cycling for a transport aircraft pressure cabin [25]. An example is given in Figure 3. The fractograph in Figure 3 was taken in the early part of the continuum-mode fatigue crack growth regime for AA2024-T3, a standard pressure cabin skin material. In this regime, cycling at normal frequencies, e.g., 1-20 Hz, in dry or wet air, or even distilled water, results in well-defined so-called 'ductile' fatigue striations. However, cycling at 0.003 Hz (one cycle taking approximately 5 1 2 min) resulted in a change from ductile striations in dry air to a cleavage-like fracture surface in wet air. This change was not observed for pressure cabin cracks in service aircraft [21,25]. Hence, it is concluded that the low frequency of pressure cabin cycling would not have resulted in a significant additional environmental effect on fatigue crack growth in the service environment.
Corros. Mater. Degrad. 2021, 2, FOR PEER REVIEW 5 Figure 3. Continuum-mode (fatigue striations) fracture surface change when cycling from 'dry' to 'wet' air at 0.003 Hz reprinted with permission from [25] for AA2024-T3 aluminium alloy. The arrows indicate a crack in a superficial corrosion layer that formed on the 'dry' striation growth region during cycling in 'wet' air.
These separate observations indicate that the environmental effect on fatigue crack growth in aircraft can generally be decoupled. This greatly eases the problem of assessing fatigue crack growth in aircraft, since it is generally not corrosion assisted (see [26,27] for standard corrosion terminologies). Most importantly, the decoupling of corrosion and fatigue means that laboratory fatigue data in ambient air can be used to assess fatigue crack growth. Some authors even argue that this might be conservative because corrosion can blunt a crack tip, resulting in retarded fatigue growth, e.g., [28].
In production airframes (and in the absence of fatigue enhancement processes), fatigue cracks nucleate from near-surface material manufacturing and airframe production discontinuities, and in-service damage [24,29]. Given a properly designed and maintained aircraft, corrosion will occur only when the corrosion protection system breaks down. Therefore, corrosion is considered a time-dependent nucleation source. All else being the . Continuum-mode (fatigue striations) fracture surface change when cycling from 'dry' to 'wet' air at 0.003 Hz reprinted with permission from [25] for AA2024-T3 aluminium alloy. The arrows indicate a crack in a superficial corrosion layer that formed on the 'dry' striation growth region during cycling in 'wet' air.
These separate observations indicate that the environmental effect on fatigue crack growth in aircraft can generally be decoupled. This greatly eases the problem of assessing fatigue crack growth in aircraft, since it is generally not corrosion assisted (see [26,27] for standard corrosion terminologies). Most importantly, the decoupling of corrosion and fatigue means that laboratory fatigue data in ambient air can be used to assess fatigue crack growth. Some authors even argue that this might be conservative because corrosion can blunt a crack tip, resulting in retarded fatigue growth, e.g., [28].
In production airframes (and in the absence of fatigue enhancement processes), fatigue cracks nucleate from near-surface material manufacturing and airframe production discontinuities, and in-service damage [24,29]. Given a properly designed and maintained aircraft, corrosion will occur only when the corrosion protection system breaks down. Therefore, corrosion is considered a time-dependent nucleation source. All else being the same (spectrum, material, stress), the equivalent crack-like sizes of discontinuities are the major source of variability in the fatigue life of a component [30,31].
For pitting-induced fatigue cracks, it has been observed that the effective cracklike pit depth (EPS = equivalent pre-crack size) is a defining fatigue crack growth metric [6,[13][14][15][29][30][31][32][33][34][35][36][37][38][39]. Coupling this result with a well-proven crack growth model, such as that used in the lead crack framework [40], could enable predicting the impact with time of service-detected corrosion pitting on airframe or individual component structural integrities. The development of such an analytical tool constitutes a significant advance in managing the structural integrity of aircraft. Using this analytical tool could allow corrosion repair to be postponed until the next planned maintenance, thereby saving considerable resources while allowing for the continuance of operational capabilities, as stated in Section 1 of this paper.

Comparison of Service and Test Crack Growth
The Defence Science and Technology (DST) Group's FINAL (Flaw IdeNtification through Application of Loads) programme [41] concerned fatigue tests of seventeen centre barrel fuselage sections from retired F/A-18 Hornet aircraft. A special test set-up was constructed to enable realistic fatigue load distributions under a modified mini-FALSTAFF flight block loading history [42]. Testing was continued until the bulkheads of the centre barrels failed.
A failure that occurred in the flange below the RHS air inlet duct of the Y470 wing attachment bulkhead was investigated in detail [14,43]; see Figure 4. The cracked region eventually linked up with others, resulting in total failure of the bulkhead. Quantitative fractography (QF) enabled showing that the main crack, C1, was only approximately 0.8 mm in depth when the bulkhead was removed from service, i.e., before testing.
Corros. Mater. Degrad. 2021, 2, FOR PEER REVIEW 6 while allowing for the continuance of operational capabilities, as stated in Section 1 of this paper.

Comparison of Service and Test Crack Growth
The Defence Science and Technology (DST) Group's FINAL (Flaw IdeNtification through Application of Loads) programme [41] concerned fatigue tests of seventeen centre barrel fuselage sections from retired F/A-18 Hornet aircraft. A special test set-up was constructed to enable realistic fatigue load distributions under a modified mini-FAL-STAFF flight block loading history [42]. Testing was continued until the bulkheads of the centre barrels failed.
A failure that occurred in the flange below the RHS air inlet duct of the Y470 wing attachment bulkhead was investigated in detail [14,42]; see Figure 4. The cracked region eventually linked up with others, resulting in total failure of the bulkhead. Quantitative fractography (QF) enabled showing that the main crack, C1, was only approximately 0.8 mm in depth when the bulkhead was removed from service, i.e., before testing. The main crack is shown in Figure 5, which also shows fracture surface discoloration representing the crack growth during service. The discoloration occurred partly because the centre barrel was stored in the open air for a long time after its removal from service; and also intermittently in service [42, most probably during static (on-ground) conditions. The overall result was limited corrosion within the crack, as has been demonstrated by laboratory tests [16,32]. The main crack is shown in Figure 5, which also shows fracture surface discoloration representing the crack growth during service. The discoloration occurred partly because the centre barrel was stored in the open air for a long time after its removal from service; and also intermittently in service [43], most probably during static (on-ground) conditions. The overall result was limited corrosion within the crack, as has been demonstrated by laboratory tests [16,32].
Corros. Mater. Degrad. 2021, 2, FOR PEER REVIEW 7 Figure 5. Optical colour fractograph of the C1 crack after cleaning to remove mild fracture surface oxidation. The yellowish discoloration represents the crack growth in service (see [14,42] for more details). The test spectrum consisted of flight blocks, and the yellow arrows point to some progression marks from the block loading.
The three cracks, C1, C2 and C3 joined up to form the semi-elliptical crack shape shown in Figure 4. Each of these cracks nucleated from pits due to chemical etching during production. The chemical etching was the precursor to IVD coating with aluminium for corrosion prevention. The pit depths for C1, C2 and C3 were, respectively 12, 6.2, and 8.4 m. Figure 6 is a detailed view of the C1 fatigue fracture surface. This detail shows a local area of the transition from service to test crack growth. The fracture topographies before and after the transition have similarly-spaced progression markings. The reason could well be that because the actual aircraft was a trainer, the centre barrel experienced repetitive load sequences analogous to the test load history. On this assumption, the positions of the repeated progression markings were (i) measured and correlated with the service flight hours before transition (the service load history was not available; however, progression markings for the service life were measured, and they were assumed to have a regular distribution during the centre barrel's service period-this assumption is reasonable because the aircraft was a trainer) and (ii) correlated with the test load history after transition. This approach allowed constructing reasonably consistent crack growth plots for the three cracks C1, C2 and C3; see Figure 7. Optical colour fractograph of the C1 crack after cleaning to remove mild fracture surface oxidation. The yellowish discoloration represents the crack growth in service (see [14,43] for more details). The test spectrum consisted of flight blocks, and the yellow arrows point to some progression marks from the block loading.
The three cracks, C1, C2 and C3 joined up to form the semi-elliptical crack shape shown in Figure 4. Each of these cracks nucleated from pits due to chemical etching during production. The chemical etching was the precursor to IVD coating with aluminium for corrosion prevention. The pit depths for C1, C2 and C3 were, respectively 12, 6.2, and 8.4 µm. Figure 6 is a detailed view of the C1 fatigue fracture surface. This detail shows a local area of the transition from service to test crack growth. The fracture topographies before and after the transition have similarly-spaced progression markings. The reason could well be that because the actual aircraft was a trainer, the centre barrel experienced repetitive load sequences analogous to the test load history. On this assumption, the positions of the repeated progression markings were (i) measured and correlated with the service flight hours before transition (the service load history was not available; however, progression markings for the service life were measured, and they were assumed to have a regular distribution during the centre barrel's service period-this assumption is reasonable because the aircraft was a trainer) and (ii) correlated with the test load history after transition. This approach allowed constructing reasonably consistent crack growth plots for the three cracks C1, C2 and C3; see Figure 7.
Because the results in Figure 7 cover the service and test periods, they suggest that compared with the laboratory test conditions, there was no significant enhancement of fatigue crack growth by the service environment.
An additional noteworthy feature in Figure 7 is that the three exponential regression equations are good fits to the service and test data. Back-extrapolation of these equations to time zero yields EPS values of 10.4, 6.3 and 3.9 µm for the cracks C1, C2 and C3. (EPS is used to distinguish this method from the more commonly used EIFS (equivalent initial flaw size; see [35,36]. EPS values are based on QF measurements encompassing very small crack sizes (approximately 10-100 µm). This means that back-extrapolation from the EPS values to time zero is very limited. In contrast, the EIFS method needs considerable back-extrapolation from relatively large cracks to time zero. This makes the EIFS method more dependent on modelling sensitivities) These EPS values compare fairly well with QF measurements of etch pit depths, namely 12, 6.2 and 8.4 µm. There are more fatigue crack growth analyses based on etch pit nucleation sites in 14-16. Corros. Mater. Degrad. 2021, 2, FOR PEER REVIEW 8 Figure 6. Optical fractograph for part of the C1 crack transition from service to test loading, from [14].
Because the results in Figure 7 cover the service and test periods, they suggest that compared with the laboratory test conditions, there was no significant enhancement of fatigue crack growth by the service environment.
An additional noteworthy feature in Figure 7 is that the three exponential regression equations are good fits to the service and test data. Back-extrapolation of these equations to time zero yields EPS values of 10.4, 6.3 and 3.9 m for the cracks C1, C2 and C3. (EPS is used to distinguish this method from the more commonly used EIFS (equivalent initial flaw size; see [35,36). EPS values are based on QF measurements encompassing very small crack sizes (approximately 10-100 μm). This means that back-extrapolation from the EPS values to time zero is very limited. In contrast, the EIFS method needs considerable backextrapolation from relatively large cracks to time zero. This makes the EIFS method more dependent on modelling sensitivities) These EPS values compare fairly well with QF measurements of etch pit depths, namely 12, 6.2 and 8.4 m. There are more fatigue crack growth analyses based on etch pit nucleation sites in 14-16.

Differences between Crack Growth from Etch Pits and Corrosion Pits
In Section 3, the example concerned etch pits only. The reason is that major airframe components (AA7050-T7451 alloy) in F/A-18 Hornet aircraft had undergone chemical etching as a precursor to IVD coating, and much service fatigue cracking nucleated from

Differences between Crack Growth from Etch Pits and Corrosion Pits
In Section 3, the example concerned etch pits only. The reason is that major airframe components (AA7050-T7451 alloy) in F/A-18 Hornet aircraft had undergone chemical etching as a precursor to IVD coating, and much service fatigue cracking nucleated from etch pits [35,36] (note: anodising also produces similar etch pits; see [37]). Fatigue crack growth from etch pits conformed to the lead crack framework, which posits exponential growth virtually immediately when an aircraft enters service [40]. In turn, the main reasons why etch pits result in lead crack behaviour are their crack-like contours, with depths usually less than 20 µm. These characteristics promote early crack nucleation, stable crack fronts and early growth. Examples are given in Figure 8. (i) Corrosion pits can have convoluted 3D shapes and geometries-they may be shallow depressions or cavities, deeper but spread out, as in Figure 9, or long and narrow, with sharp tips growing in various directions, particularly down grain boundaries. All these morphology variations can significantly affect the crack nucleation and propagation behaviour.
(ii) In more detail, corrosion pit irregularities can cause fatigue crack nucleation at many positions above or below the eventual crack plane, and also at multiple positions along the pit boundary, as in Figure 9. The result is complex interference (crack 'shadowing') between small cracks, an ill-defined overall crack front and greater fracture surface roughness, and consequently less efficient early crack growth into the material. This situation may persist for several tenths of millimetres and result in significant deviations from lead crack behaviour. In turn, such deviations will considerably influence the fatigue crack growth life, since much of the life is spent in growing small cracks [40]. (iii) Fatigue-nucleating pits need not be optimally located with respect to grain orientations (important for small cracks) and the local stresses in a component. This means that crack growth will be slower than for lead cracks.
The above remarks serve to show that while it might be thought that pit-nucleated fatigue cracking would exhibit lead crack growth behaviour, this is not necessarily so.  In contrast, corrosion pits are usually (much) less crack-like and significantly larger, e.g., Figure 9, which shows an exceptionally large 30 µm deep but sharp-pointed (V-shaped) etch pit filled with etching product; and an irregularly shaped corrosion pit. This latter characteristic is a general one, and hence it is argued (and in [32,36]) that the physical dimensions of corrosion pits may be poor indicators of their EPS. The reasons for this may be a combination of several factors: (i) Corrosion pits can have convoluted 3D shapes and geometries-they may be shallow depressions or cavities, deeper but spread out, as in Figure 9, or long and narrow, with sharp tips growing in various directions, particularly down grain boundaries. All these morphology variations can significantly affect the crack nucleation and propagation behaviour. (ii) In more detail, corrosion pit irregularities can cause fatigue crack nucleation at many positions above or below the eventual crack plane, and also at multiple positions along the pit boundary, as in Figure 9. The result is complex interference (crack 'shadowing') between small cracks, an ill-defined overall crack front and greater fracture surface roughness, and consequently less efficient early crack growth into the material. This situation may persist for several tenths of millimetres and result in significant deviations from lead crack behaviour. In turn, such deviations will considerably influence the fatigue crack growth life, since much of the life is spent in growing small cracks [40].
(iii) Fatigue-nucleating pits need not be optimally located with respect to grain orientations (important for small cracks) and the local stresses in a component. This means that crack growth will be slower than for lead cracks.

AA7050-T7451 Y488 Wing Attachment Bulkhead
Another failure example from the FINAL programme resulted in a 'new' centre barrel. This happened at the forward mould-line flange of the Y488 wing attachment bulkhead, and just below the lower wing attachment lug [14]. However, failure nucleated at a large corrosion pit in the forward-inboard edge of the forward flange (a similar analysis for an AA2014 aircraft main landing gear was reported in [44]), most probably because the IVD coating was locally absent. The corrosion pit was in an area where the surface had been shot-peened to improve its fatigue resistance. Unfortunately, the peening had removed the IVD coating, and subsequent protection by the paint system had failed. The main causative factor for protection system failure and corrosion was long-term outdoor storage before testing. Figure 10 shows the corrosion pit, which at 440 µ m depth had extended well beyond the estimated compressive layer depth (approximately 250 µ m [45]) induced by shotpeening. Detailed fractography detected a repeating pattern of block loading from the FI-NAL test, and QF enabled deriving the original fatigue crack growth curve (■) shown in Figure 11. The empirically adjusted curve (♦) was derived on the assumption of exponential lead crack growth behaviour, based on many QF fatigue crack growth analyses of service and test cracks in RAAF aircraft. The adjusted curve back-extrapolated to a zerotime EPS of only 7.7 µ m. This suggests the large pit was not very effective as a fatigue crack nucleation site. Similar findings were reported in [32].

AA7050-T7451 Y488 Wing Attachment Bulkhead
Another failure example from the FINAL programme resulted in a 'new' centre barrel. This happened at the forward mould-line flange of the Y488 wing attachment bulkhead, and just below the lower wing attachment lug [14]. However, failure nucleated at a large corrosion pit in the forward-inboard edge of the forward flange (a similar analysis for an AA2014 aircraft main landing gear was reported in [44]), most probably because the IVD coating was locally absent. The corrosion pit was in an area where the surface had been shot-peened to improve its fatigue resistance. Unfortunately, the peening had removed the IVD coating, and subsequent protection by the paint system had failed. The main causative factor for protection system failure and corrosion was long-term outdoor storage before testing. Figure 10 shows the corrosion pit, which at 440 µm depth had extended well beyond the estimated compressive layer depth (approximately 250 µm [45]) induced by shotpeening. Detailed fractography detected a repeating pattern of block loading from the FINAL test, and QF enabled deriving the original fatigue crack growth curve ( ) shown in Figure 11. The empirically adjusted curve ( ) was derived on the assumption of exponential lead crack growth behaviour, based on many QF fatigue crack growth analyses of service and test cracks in RAAF aircraft. The adjusted curve back-extrapolated to a zero-time EPS of only 7.7 µm. This suggests the large pit was not very effective as a fatigue crack nucleation site. Similar findings were reported in [32].

F/A-18 Trailing Edge Flap Hinge Lugs
Examination of trailing edge flap (TEF) hinge lugs from two RAAF F/A-18 aircraft revealed corrosion pits at the interface between the lug and monoball, e.g., Figure 12, after approximately 1400-1500 service flight hours [46]. Several fatigue cracks nucleated from

F/A-18 Trailing Edge Flap Hinge Lugs
Examination of trailing edge flap (TEF) hinge lugs from two RAAF F/A-18 aircraft revealed corrosion pits at the interface between the lug and monoball, e.g., Figure 12, after approximately 1400-1500 service flight hours [46]. Several fatigue cracks nucleated from

F/A-18 Trailing Edge Flap Hinge Lugs
Examination of trailing edge flap (TEF) hinge lugs from two RAAF F/A-18 aircraft revealed corrosion pits at the interface between the lug and monoball, e.g., Figure 12, after approximately 1400-1500 service flight hours [46]. Several fatigue cracks nucleated from some of these pits: Figure 13 shows two examples. QF determined that these pits reached an average depth of 200 µm before fatigue took over. The largest corrosion pit switched to fatigue when approximately 290 µm deep. some of these pits: Figure 13 shows two examples. QF determined that these pits reached an average depth of 200 m before fatigue took over. The largest corrosion pit switched to fatigue when approximately 290 m deep.  QF and service history data enabled crack growth measurements in the hinge lugs except near the fatigue nucleation sites, where corrosion and rubbing obscured and destroyed the fracture surface details. QF relied on (i) measuring progression markings where they were assumed to be the results of a particular load or series of loads; (ii) assuming that these loads were spread evenly during the lug lives. These assumptions then resulted in a constant time base: see Figure 14, which indicates that most of the crack growth was approximately exponential. Furthermore, corrosion did not significantly enhance crack growth (if corrosion-assisted crack growth had occurred, periods of growth at higher levels than the mean should have been evident). These are the main conclusions from this investigation: EPS estimations for the corrosion pits were not possible because Corros. Mater. Degrad. 2021, 2, FOR PEER REVIEW 13 some of these pits: Figure 13 shows two examples. QF determined that these pits reached an average depth of 200 m before fatigue took over. The largest corrosion pit switched to fatigue when approximately 290 m deep.  Optical fractographs of fatigue cracks nucleating from corrosion pits in AA7050-T73652 TEF hinge lugs. These were from two different aircraft having tail numbers A21-015 and A21-021, respectively. Reprinted with permission from [46]. Copyright 1994 DST.
QF and service history data enabled crack growth measurements in the hinge lugs except near the fatigue nucleation sites, where corrosion and rubbing obscured and destroyed the fracture surface details. QF relied on (i) measuring progression markings where they were assumed to be the results of a particular load or series of loads; (ii) assuming that these loads were spread evenly during the lug lives. These assumptions then resulted in a constant time base: see Figure 14, which indicates that most of the crack growth was approximately exponential. Furthermore, corrosion did not significantly enhance crack growth (if corrosion-assisted crack growth had occurred, periods of growth at higher levels than the mean should have been evident). These are the main conclusions from this investigation: EPS estimations for the corrosion pits were not possible because Figure 13. Optical fractographs of fatigue cracks nucleating from corrosion pits in AA7050-T73652 TEF hinge lugs. These were from two different aircraft having tail numbers A21-015 and A21-021, respectively. Reprinted with permission from [46]. Copyright 1994 DST. QF and service history data enabled crack growth measurements in the hinge lugs except near the fatigue nucleation sites, where corrosion and rubbing obscured and destroyed the fracture surface details. QF relied on (i) measuring progression markings where they were assumed to be the results of a particular load or series of loads; (ii) assuming that these loads were spread evenly during the lug lives. These assumptions then resulted in a constant time base: see Figure 14, which indicates that most of the crack growth was approximately exponential. Furthermore, corrosion did not significantly enhance crack growth (if corrosion-assisted crack growth had occurred, periods of growth at higher levels than the mean should have been evident). These are the main conclusions from this investigation: EPS estimations for the corrosion pits were not possible because there was no information about when corrosion pitting started. The crack growth curve differences between the A21-015 and A21-021 samples may be the results of several factors, including different aircraft usages, aerodynamic buffet, localised assembly stresses, and corrosion pit locations on the lug perimeters.
there was no information about when corrosion pitting started. The crack growth curve differences between the A21-015 and A21-021 samples may be the results of several factors, including different aircraft usages, aerodynamic buffet, localised assembly stresses, and corrosion pit locations on the lug perimeters.

F-111 Stiffener in the Upper Wing
Prior to Cold Proof Load Testing (CPLT), two instances of corrosion pit-related fatigue cracks were found in RAAF F-111 wings. These discoveries were due to pre-test inspection programmes intended to find and amend problems before conducting subsequent CPLTs. The inspections revealed numerous cracks and also new problem locations. Notable examples were cracks in the stiffener No.2 runouts in the upper wing pivot fittings of two RAAF F-111Cs, aircraft A8-148 and A8-109 [47,48]. The cracks were removed by electro-discharge machining (EDM) from the radius of stiffener runout No.2, and in both cases fatigue cracks nucleated from intergranular corrosion pits. Figure 15 is an example of the corrosion pitting and an overview of the excised fatigue fracture surface, which showed closely-spaced progression markings.

F-111 Stiffener in the Upper Wing
Prior to Cold Proof Load Testing (CPLT), two instances of corrosion pit-related fatigue cracks were found in RAAF F-111 wings. These discoveries were due to pre-test inspection programmes intended to find and amend problems before conducting subsequent CPLTs. The inspections revealed numerous cracks and also new problem locations. Notable examples were cracks in the stiffener No.2 runouts in the upper wing pivot fittings of two RAAF F-111Cs, aircraft A8-148 and A8-109 [47,48]. The cracks were removed by electro-discharge machining (EDM) from the radius of stiffener runout No.2, and in both cases fatigue cracks nucleated from intergranular corrosion pits. Figure 15 is an example of the corrosion pitting and an overview of the excised fatigue fracture surface, which showed closely-spaced progression markings.
Although there were multiple fatigue nucleation sites in both cases, and also in others [48], there was no indication that the cracks interacted, thereby influencing the overall crack growth. QF for the progression markings and data from the aircraft Nzmeters enabled crack growth to be correlated with service usage back to the previous CPLT. The crack growth curves from this datum (Flight hours 0) are shown in Figure 16.
The crack growth histories in Figure 16 appear to be approximately exponential. This suggests that corrosion did not significantly enhance fatigue crack growth. However, it is evident that the crack growth rates, represented by the gradients of the exponential plots, were significantly different. This variation could have several causes, including service usage differences, differences in residual stresses, and local geometry variations for the runouts.
Measurement of the fatigue-nucleating corrosion pit depths was problematic. They would be impossible to estimate from the back-extrapolation included in Figure 16. How-ever, they were considered to have been 10-25 µm deep during the previous CPLTs for both aircraft [48]. This rough estimate was possible because the previous CPLTs had left well-defined progression markings on the fatigue fracture surfaces, and the intervals between CPLTs were approximately 2000 flight hours. Nevertheless, EPS values could not be derived, owing mainly to the unknown times taken for formation of the corrosion pits. Although there were multiple fatigue nucleation sites in both cases, and also in others [48], there was no indication that the cracks interacted, thereby influencing the overall crack growth. QF for the progression markings and data from the aircraft Nz-meters enabled crack growth to be correlated with service usage back to the previous CPLT. The crack growth curves from this datum (Flight hours 0) are shown in Figure 16. Figure 16. QF-derived and back-extrapolated crack growth curves for the aircraft A8-109 and A8-148 stiffener runouts, adapted from [48].
The crack growth histories in Figure 16 appear to be approximately exponential. This suggests that corrosion did not significantly enhance fatigue crack growth. However, it is evident that the crack growth rates, represented by the gradients of the exponential plots,  Although there were multiple fatigue nucleation sites in both cases, and also in others [48], there was no indication that the cracks interacted, thereby influencing the overall crack growth. QF for the progression markings and data from the aircraft Nz-meters enabled crack growth to be correlated with service usage back to the previous CPLT. The crack growth curves from this datum (Flight hours 0) are shown in Figure 16. The crack growth histories in Figure 16 appear to be approximately exponential. This suggests that corrosion did not significantly enhance fatigue crack growth. However, it is evident that the crack growth rates, represented by the gradients of the exponential plots, were significantly different. This variation could have several causes, including service

Additional Remarks about EPS Estimates and Corrosion Pitting
Previous sections in this paper have mentioned and discussed the use of EPS values as the starting points for fatigue crack growth analyses. Extensive characterisation of crack growth from various fatigue-nucleating discontinuities, except corrosion pits, has shown the suitability, indeed preferability, of EPS compared to other metrics, for example the Murakami and Endo √ area-parameter (the square root of the projection area of a small flaw perpendicular to the loading direction) [49], and the Equivalent Initial Flaw Size (EIFS) approach [34,36]. However, as discussed at the beginning of the present section, and illustrated by the case histories in Sections 4.2 and 4.3, the determination of EPS values for corrosion pits is difficult. Currently, few EPS data exist other than limited amounts for AA7050. and further analyses are needed for other materials.
Given the foregoing situation, the authors recommend further analyses to establish reliable EPS values for corrosion pitting, in both high-strength airframe alloys such as AA7050, and other airframe materials, notably high-strength low-alloy steels and nominally corrosion-resistant 'stainless' steels.

Structural Assessment Methodology
The structural certification basis for an airframe must be fully appreciated before considering the corrosion pitting effect on structural integrity. A concise interpretation of the UK Defence Standard 970 [50] is given here as reference for the discussions in this section. (The USAF damage tolerance approach 1 might also have been considered here. However, although the method presented in the present paper is similar, there are very significant differences (see [40]). These include the use of (i) a QF-determined initial discontinuity size or EPS, instead of the assumption of a surrogate flaw size of 1.27 mm depth (for example); and (ii) a residual strength criterion. See [51], which compares several aircraft design standards.) The important aspects for this purpose are:

1.
Corrosion is not considered from a durability perspective; 2.
The Standard requires that the cumulative probability of failure (CPOF) for the total airframe, owing to structural fatigue, be limited to 1/1000 in the life of type. This is mainly achieved by using the guidelines during design, followed by a representative full-scale fatigue test (FSFT). The demonstrated FSFT simulated flight hours until reaching a residual strength criterion are then divided by a scatter factor (SF) to achieve the required CPOF. The FSFT is assumed to represent the mean quality and build standard of the fleet; and the applied load history is assumed to represent the mean for aircraft usage; 3.
For primary structure, any crack in the FSFT must not reach the critical size (for 1.2 Design Limit Load (DLL)) and within a (lifetime X SF) of the spectrum loading; and 4.
Service fatigue loads are monitored and periodically reviewed.
The lead crack framework can illustrate the certification requirements; see Figure 17. For an optimally designed airframe, the lead crack will be just below its critical crack size (a crit ), typically 10 mm depth for combat aircraft (high performance) aluminium alloy airframes [35,36]. Note that an a crit of 10 mm is much larger than a typical non-destructive threshold crack size. Additionally, since the test article is assumed representative for the mean quality of an airframe, it may be assumed that the lead crack nucleated from a typical discontinuity depth of 10 µm [36]. Furthermore, it is assumed that the required life is 6000 flight hours for a typical scatter factor SF = 3.0. Thus, the maximum crack growth rate (maximum certification basis) shown in Figure 17 is the upper limit for an airframe that has achieved certification. Figure 17 Fatigue cracks from production-quality initial discontinuities begin to grow almost immediately after an aircraft enters service [31,35,36,40,[51][52][53][54][55]. Corrosion is likely to occur once the corrosion protection systems fail during service. Then, given sufficiently high local stress states and corrosion pit sizes (depths), one or possibly more fatigue cracks will nucleate and grow from pits. Since the time when corrosion pitting begins cannot (currently) be predicted for aircraft operational environments, the assessment in this subsection considers only corrosion pitting detected during routine inspections. It is important to note two basic conditions for the assessment:

An Assessment Methodology for Fatigue Cracking from Corrosion Pits, Exemplified by
(1) Undetected or unrepaired corrosion in a certified airframe will affect structural integrity only if a corrosion-nucleated fatigue crack reaches a critical crack size (a crit ) before any other discontinuity-nucleated crack does so. (2) Significant corrosion probably occurs only when the aircraft is parked at the air base.
Hence, fatigue crack growth (largely or entirely under in-flight loading) is considered to be unaffected by possibly aggressive ground environments. In other words, fatigue crack growth data obtained from laboratory tests in ambient air are appropriate for the assessment (discounting potentially detrimental shelter environments; additionally, note that this approach is considered conservative by Burns et al. [18]).
Corros. Mater. Degrad. 2021, 2, FOR PEER REVIEW 17 mean quality of an airframe, it may be assumed that the lead crack nucleated from a typical discontinuity depth of 10 m [36]. Furthermore, it is assumed that the required life is 6000 flight hours for a typical scatter factor SF = 3.0. Thus, the maximum crack growth rate (maximum certification basis) shown in Figure 17 is the upper limit for an airframe that has achieved certification. Figure 17. Schematic plots of the growth of (i) the most critical crack (--) in an optimised mean quality FSFT, assuming a fatigue-nucleating corrosion pit depth of 0.01 mm depth; and (ii) similar plots, i.e., with the same maximum growth rate, for a fatigue-nucleating corrosion pit depth of 0.2 mm. Figure 17 Fatigue cracks from production-quality initial discontinuities begin to grow almost immediately after an aircraft enters service [31,35,36,40,[51][52][53][54][55]. Corrosion is likely to occur once the corrosion protection systems fail during service. Then, given sufficiently high local stress states and corrosion pit sizes (depths), one or possibly more fatigue cracks will nucleate and grow from pits. Since the time when corrosion pitting begins cannot (currently) be predicted for aircraft operational environments, the assessment in this subsection considers only corrosion pitting detected during routine inspections. It is important to note two basic conditions for the assessment:

An Assessment Methodology for Fatigue Cracking from Corrosion Pits, Exemplified by
(1) Undetected or unrepaired corrosion in a certified airframe will affect structural integrity only if a corrosion-nucleated fatigue crack reaches a critical crack size (acrit) before any other discontinuity-nucleated crack does so. (2) Significant corrosion probably occurs only when the aircraft is parked at the air base.
Hence, fatigue crack growth (largely or entirely under in-flight loading) is considered to be unaffected by possibly aggressive ground environments. In other words, fatigue crack growth data obtained from laboratory tests in ambient air are appropriate for the assessment (discounting potentially detrimental shelter environments; additionally, note that this approach is considered conservative by Burns et al. [18]).
It is assumed that when a corrosion pit attains a particular depth, it will result in It is assumed that when a corrosion pit attains a particular depth, it will result in fatigue crack nucleation and growth. With respect to Figure 17, this depth is taken to be 200 µm (0.2 mm) for typical airframe aluminium alloys, whereby we note that its effective crack-like size would be much less (see [35,36,38,39]). (Note that the EPS mean value for corrosion pits in [35,36] is not considered statistically significant.) As the worst-case scenario, the pit is assumed to be at the most highly stressed location in the airframe and therefore fatigue cracking occurs at the maximum growth rate; see Figure 17.
From Figure 17, it can be seen that if corrosion occurs early in the service life, it is likely to 'win the race' to a crit . However, even a typical corrosion pit has a relatively long life before it reaches a crit (10,200 h according to Figure 17). The same crack nucleating at 4000 h is also shown, and this does not reach a crit until well over 14,000 h. However, logistical considerations require specifying a limiting crack depth for repairability. For the purpose of illustrating the usefulness in diagrams such as Figure 17, this limiting crack depth is taken to be 2 mm, and provides an allowable crack growth period of 6000 h.
In addition, an appropriate SF must be applied in order to determine the safe life of the corrosion-nucleated fatigue crack (CNFC). For example: SF (CNFC) = 3.0 on mean life [50] × 2 for analysis only [50] × 2 for uncertainty = 12 (The 'mean life' for example could be the average of the failure lives from identical locations on both the right and left side of a bulkhead. If the location is not fatigue monitored an additional unmonitored factor of 1.5 will be required [50]. The residual strength factor of 1.2 on DLL provides another additional conservatism).
The last factor of 2 is added for extra conservatism, since the proposed methodology is new. This factor may be removed when experience with the methodology matures. From the illustration values the above SF equates to a safe life period of (10,200/12) = 850 flight hours; or a limit of repairability of (6000/12) = 500 flight hours, which is a significant period. Using all the above factors complies with the intent of current design standards and therefore implies that there would be a very low probability of corrosion-induced fatigue cracking becoming safety-critical.

The Proposed Framework, Based on the Lead Crack Approach
The essence of the assessment methodology and the following proposal is that maintenance to remove/repair corrosion pitting can be delayed until a more opportune time. This could be the next scheduled service after pitting has been detected in the interval between servicing, thereby enabling repair in a logistically appropriate manner. The proposed framework, which applies only to corrosion pitting, is as follows:

1.
Walk-around or other scheduled inspections are typically those when corrosion damage is found, and these would continue.

2.
If corrosion is found, its type and severity would be determined (see [56] for definitions of light, moderate and severe corrosion) (i.e., extent or coverage (minor severity here relates to static modes of potential failure related to the spread of the corrosion and depth of material to be removed in the subsequent repair)). There would also be inspection for any associated fatigue cracks (as was done for lugs such as those in Figure 12). Any detected fatigue cracks would be managed by established methods (note that the probability of multi-site cracking effects is considered very remote at the short intervals derived by the methodology). The particular inspection technique and thus the NDI detectability threshold should depend on the local configuration (e.g., eddy current for the fastener hole example in Figure 1). The presence of pitting should not affect the sensitivity of any suitable inspection type.

3.
If corrosion is due to pitting, and no cracking is detected, then the damage would be treated periodically (this will be determined according to the CIC type and the airbase environment) with corrosion inhibiting compounds (CICs) and left in place until the next maintenance period. The application of CICs is intended to prevent/reduce further corrosion, thereby limiting the difficulty of any repairs.

4.
During the remainder of the non-repair interval the corrosion should ideally be re-inspected to check for any increase and/or for detectable cracking.

5.
Any detected corrosion should ideally be mapped by location. This would help to identify fleet trends, and minimise the clean-up effort at the next scheduled maintenance. 6.
At the next scheduled maintenance, the corrosion would be cleaned up (normally by blending); and if material removal leaves the component(s) above allowable thickness limits, then the corrosion protection system would be restored and the aircraft returned to service.
As a logistical note, the established fact that corrosion occurs mainly on the ground signifies that in-flight corrosion sensor monitoring is not warranted, since a single groundbased system at each base would suffice for predictive maintenance.

Concluding Remarks
Pitting corrosion is a major maintenance problem for aircraft aluminium alloys, and is also a problem for other materials. This paper has considered some service examples of corrosion-induced pitting or cracks exposed to service environments. These examples support the contention that fatigue crack growth, which is mainly due to in-flight dynamic loads, is not significantly influenced by the environment, unlike the largely static exposure on the ground. This means that fatigue crack growth data obtained in a laboratory air environment can be used for fatigue lifing purposes. The examples also show that for the materials involved, the effective crack-like sizes of corrosion pits were, or are, smaller than their actual depths. However, this need not apply to other materials.
A method (framework) has been presented to rationalise from a safety perspective the postponement, for an appropriate interval, of repair measures for corrosion pitting detected in service. The method relies on (i) the pitting metrics for fatigue nucleation, namely the pit effective pre-crack sizes (EPS), despite their current uncertainties; and (ii) using the lead crack concept to describe fatigue crack growth from the pits. Further work is recommended to define EPS values for corrosion pits in typical airframe materials.
It is suggested that delaying corrosion pitting repair until the next scheduled maintenance, rather than the current 'find and fix' approach, will save considerable expense and use of resources and improve the availability of aircraft.
Following on from the foregoing remarks, the development of analytical tools that can accurately assess pitting corrosion effects on aircraft structural durability would represent a step-change improvement in Aircraft Structural Integrity Management and Sustainment.