3.6.2 · D5Spacecraft Structures & Systems Engineering

Question bank — Structural design process — load cases, FOS (factor of safety)

1,827 words8 min readBack to topic

First, the symbols this page uses

Before any trap, let us pin down every abbreviation and letter — so no prompt below uses a symbol you have not met.

Figure — Structural design process — load cases, FOS (factor of safety)
Figure — Structural design process — load cases, FOS (factor of safety)
Figure — Structural design process — load cases, FOS (factor of safety)

Now the traps — every symbol above is fair game.


True or false — justify

A factor of safety greater than 1 means the structure will definitely never fail.
False — covers known ignorance (material scatter, analysis error, load uncertainty); an unmodelled load case or a manufacturing flaw can still cause failure below the factored load.
Applying a higher always makes a spacecraft safer overall.
False — a higher adds mass, and mass stolen from payload or propellant can compromise the mission; safety is a balance, not "more is always better".
If the worst-case stress is below the material's allowable strength , the part passes.
False — you must first multiply the limit stress by ; a stress comfortably under allowable can still give once the factor is applied (see Figure 1's shifted danger line).
A part that passes the ultimate check automatically passes the yield check.
False — yield and ultimate are separate checks with different and different allowables; a part could survive rupture yet permanently deform, which is its own failure.
Quasi-static loads can be treated as a constant because the structure is rigid.
False — it is because the load changes slowly compared to the structure's response time, so the structure reaches near-equilibrium; rigidity is not the reason.
Random and sine vibration can simply be added to the quasi-static load as one big number.
False — they act at different frequencies and times; you either envelope them or combine them by root-sum-square where they genuinely coincide, not by naïve addition.
means the part has failed.
False — means exactly equals the factored design load , i.e. zero spare margin but still acceptable; failure is .
Two perpendicular simultaneous loads should be summed to get the total demand.
False — perpendicular loads combine as vectors (the diagonal in Figure 3, Pythagoras / RSS); scalar summing overstates the load and wastes mass, as covered in Quasi-static Loads and Launch Environment.

Spot the error

", so I'll multiply the yield strength by 1.4 to get my allowable."
The error is inflating the supply; multiplies the demand () or equivalently divides the allowable — we never boost the material's real strength.
"My margin is ."
The is missing from the denominator; the correct form is , so the unfactored version dangerously overstates the margin.
"To be safe I'll design the strut for the sum of every load case at once."
Load cases occur at different times/frequencies, so summing them all is over-conservative; you design to the worst-case envelope and RSS only truly simultaneous orthogonal loads.
"The stress came out negative, so the margin is negative — it fails."
A negative stress just means compression (our sign convention, Figure 2); it is the margin that signals failure when negative, and margin is computed from magnitudes against the relevant allowable.
"I passed at limit load, so I don't need to test at ultimate."
Qualification testing is typically done at or above ultimate to prove the factored design load is survivable — see Qualification vs Acceptance Testing; passing only at limit proves nothing about the margin.
"The FEM stress is 150 MPa and yield is 300 MPa, so I have 100% margin."
You forgot the ; with the design stress is MPa and the real margin is , not .

Why questions

Why do we inflate the load rather than reduce the allowable when applying ?
They are algebraically equivalent, but inflating the demand keeps a single, clearly-defined "design load" the structure is checked against (the shifted line in Figure 1), avoiding double-counting when several uncertainties stack.
Why use a lower for yield than for ultimate?
Permanent deformation (yield) is a recoverable-in-design, less catastrophic outcome than rupture (ultimate), so we tolerate a smaller cushion against yield and a larger one against fracture — the two danger zones in Figure 1.
Why do untested, composite, or pressurized parts use higher factors of safety?
Their strength has more scatter and less validation — composites vary batch to batch, pressure vessels fail catastrophically — so a larger cushion absorbs that greater uncertainty.
Why treat quasi-static loads as static instead of solving the full dynamics?
Because low-frequency loads change slowly relative to the structure's response, the dynamic amplification is negligible and a constant- static analysis captures the peak stress far more cheaply.
Why can't we just test the flight spacecraft in the real launch environment before deciding the design?
You launch it only once and cannot recover it to redesign; the whole process is forecasting the loads and proving on paper and in ground tests, per Quasi-static Loads and Launch Environment.
Why is the "" in the margin-of-safety formula essential?
It converts the capacity/demand ratio into fractional spare capacity, so reads directly as "how much extra strength beyond the factored load", with the pass line landing cleanly at zero.
Why does over-designing (huge everywhere) actually hurt a spacecraft?
Extra structural mass reduces available payload and propellant, raising launch cost or shrinking the mission — in space, mass is the enemy, so margins are trimmed to just-enough.

Edge cases

If the limit load is exactly zero for some case, what is the design load for that case?
Zero — , so that case imposes no demand; the part is sized by whichever other load case dominates the envelope.
A part has (0.1% margin). Should the engineer relax?
No — such a razor-thin margin leaves no room for the analysis uncertainty is supposed to smooth over locally, so most engineers add material or re-examine assumptions rather than ship it.
What does an that is huge (say ) tell you about the design?
The part is massively over-strength for that load — a signal to lighten it (thinner walls, lighter material) to save mass, provided no other load case governs, per Mass Budget and Structural Efficiency.
If yield and ultimate allowables are very close (a brittle material), which check governs?
The ultimate check, because a brittle material fractures with little prior yielding, so its higher against rupture drives the sizing and the yield margin becomes almost irrelevant.
Two load cases give identical stress magnitudes but one is tension () and one compression () — same margin?
Not necessarily — the compressive case can trigger buckling at a stress far below the yield allowable, so it may use a lower buckling allowable and yield a smaller margin, even though the magnitudes match.
A thermal load produces stress but no external force. Does it still enter the load cases?
Yes — thermal induces internal stress through constrained expansion, which counts as a static load case that must be enveloped with the mechanical ones, and can be checked in Finite Element Analysis of Spacecraft Structures.
The limit load is uncertain by a wide margin. Should or the limit estimate change?
Raise the limit load estimate to a conservative value first (that is a modelling choice); covers residual scatter, not gross uncertainty in the load definition itself.
A part passes analysis at ultimate but fails a random-vibration test. What went wrong?
The static ultimate check missed a resonance that amplified stress dynamically; the fix is a proper dynamic analysis and requalification, tying into Random & Sine Vibration Testing.