Proof testing

In one lineA proof test doesn’t show a vessel is perfect — it guarantees that every survivor’s flaws are smaller than a size you can calculate.

Before thisCase sizing (MEOP, proof and burst; leak-before-break)

Why this matters

Every solid motor case is normally proof tested before it is insulated and loaded with propellant. It is the last check between manufacture and a vessel that will hold an energetic load for years. A proof test catches:

• Workmanship and material errors — a wrong heat treatment, a weak weld, a wall machined too thin, a bad batch of material.
• Cracks nobody found. This is the subtle one, and the reason proof is part of the fracture-control argument rather than just a quality check.
• Leaks at welds, bosses and seals.

What a proof test proves — and what it doesn’t

Think of it like…

A sieve

Pour a bag of gravel through a sieve. You never look at a single stone, but you know for certain that every stone that passed through is smaller than the mesh. A proof test is a sieve for cracks: any case carrying a crack big enough to fail at proof pressure fails on the test stand, safely. Every case that survives has only cracks smaller than the “mesh size” — even cracks no inspection could ever have found.

A proof test sorts by flaw size — worked-example numbers

The proof test guarantees a maximum flaw size whether or not anyone could find it. Here the guaranteed size (0.86 mm) is smaller than what NDT can reliably see (1.27 mm), so proof is the argument that carries the fracture case.

It does not prove:

• That the case has margin to burst. Proof is below burst on purpose. Burst capability is shown by analysis and by testing qualification articles to failure.
• That flaws stay small. Cracks grow with every pressurisation and, in some environments, under sustained load. The proof screen is the starting size for a life argument, not the end of it.
• That the case survives loads other than pressure — thrust, bending, handling, external pressure.
• That the test did no harm. Proof is the highest stress the part will see before flight. It can grow sub-critical cracks and, in a susceptible material and environment, leave the case worse than it found it.

Choosing the proof factor

The proof pressure is MEOP times a proof factor (see the pressure ladder). The factor is squeezed from both sides:

Pushes the factor up	Pushes the factor down
Smaller screened flaw, so more crack-growth life	Proof stress must stay below yield, with margin for local peaks
Must cover strength lost at the service temperature	The test can grow cracks and cause sustained-load damage
Must cover toughness lost at the service temperature	Composites: fibre damage, stress-rupture and damage accumulation
Must screen to a size NDT cannot reliably see	Good hardware lost in the test, schedule and cost

The governing standard sets the factor for the vessel class — typically somewhere between about 1.05 and 1.5 — and the fracture-control plan checks it buys enough life. Two corrections are routinely applied on top:

• Temperature. If the case is weaker at its service temperature than at the test temperature, raise the proof pressure by the ratio of strengths, so the proof stress-to-strength ratio covers the service condition.
• Toughness. The screen only works if the material is at least as tough in the test as in service. Toughness of high-strength steels usually falls with temperature, so a warm proof can screen nothing for a cold-day firing. The calculator below shows how quickly that happens.

The flaw-screening argument

For a crack of depth $a$ in a wall at stress $\sigma$, linear-elastic fracture mechanics gives the stress intensity $K = Y\sigma\sqrt{\pi a}$, where $Y$ is a geometry factor (about 1.12 for a long, shallow surface crack). The crack runs unstably when $K$ reaches the fracture toughness $K_{IC}$. So:

$$a_\text{screen} = \frac{1}{\pi}\left(\frac{K_{IC,\text{proof}}}{Y\,\sigma_\text{proof}}\right)^2 \qquad a_\text{crit} = \frac{1}{\pi}\left(\frac{K_{IC,\text{service}}}{Y\,\sigma_\text{MEOP}}\right)^2$$

Their ratio is the heart of proof-test logic (Tiffany and Masters, 1965):

$$\frac{a_\text{crit}}{a_\text{screen}} = R^2 \left(\frac{K_{IC,\text{service}}}{K_{IC,\text{proof}}}\right)^2$$

where $R$ is the proof factor. A 1.10 proof leaves room for the surviving cracks to grow by 21% before they become critical at MEOP. Raising $R$ helps as $R^2$; losing toughness in service hurts as the square of the toughness ratio.

The crack-growth life between the two comes from the Paris law, $da/dN = C\,(\Delta K)^m$. With a constant $Y$ it integrates in closed form:

$$N = \frac{a_\text{crit}^{\,1-m/2} - a_\text{screen}^{\,1-m/2}}{C\,\left(Y\,\Delta\sigma\sqrt{\pi}\right)^m\,(1 - m/2)}$$

Fracture-control standards for flight pressure vessels typically require the analysed life to be at least four times the service life.

Calculator — what does the proof buy?

Proof-test flaw screenLEFM · constant geometry factor · Paris growth

Material

K_IC at proof tempK_IC at coldest serviceYield (MPa)

Vessel & test

Stress at MEOP (MPa)Wall (mm)Proof factorGeometry factor Y

Defaults are the D6AC case from the case-sizing page. Y = 1.12 is a long, shallow surface crack.

Service

Pressurisations after proofLife factorRange per cycle (× MEOP stress)NDT reliable depth (mm)

Cycles to failure from initial flaw

—

Life ÷ required

—

Flaw sizes

Proof screens flaws above

—

Critical at MEOP

—

Critical ÷ screened

—

Initial flaw set by

—

Test severity

Proof stress

—

Proof stress ÷ yield

—

Critical depth ÷ wall

—

K = Yσ√(πa) at proof and at MEOP. Where each line meets the toughness gives the screened and critical sizes.

Life bought by the proof screen versus proof factor. Shaded: proof stress above yield.

Screening only: constant Y, linear-elastic fracture mechanics, no crack growth during the proof cycle itself, no sustained-load (environment-assisted) growth. A released proof-test argument uses measured toughness and growth data at the service condition, realistic flaw shapes, and the governing standard's factors.

Worked example — the D6AC case

The case from the case-sizing example: hoop stress 1094 MPa at 10 MPa MEOP, 1.377 mm wall, $K_{IC} \approx 70$ MPa√m, proof factor 1.10, long surface crack ($Y = 1.12$).

1. Proof stress. $1.10 \times 1094 = 1204$ MPa — 83% of the 1450 MPa yield.
2. Screened flaw. $\frac{1}{\pi}\left(\frac{70}{1.12 \times 1204}\right)^2 = 0.86$ mm. No case that passes proof has a crack deeper than this.
3. Critical flaw at MEOP. $\frac{1}{\pi}\left(\frac{70}{1.12 \times 1094}\right)^2 = 1.04$ mm. The ratio is $1.10^2 = 1.21$.
4. Life. Martensitic steel, Barsom’s upper bound $da/dN = 1.35 \times 10^{-10}\,\Delta K^{2.25}$, full 0–MEOP cycles: about 105 pressurisations to grow from 0.86 to 1.04 mm. For a single firing plus one leak check, with a life factor of 4, the requirement is 8 — a margin of about 13.
5. NDT. If inspection can only promise to find cracks deeper than about 1.3 mm, it cannot support this argument on its own: the critical size is smaller than what NDT sees. Proof carries the fracture case.

Two warnings come out of the same numbers:

• Cold service. If toughness at −40 °C is 20% lower (56 MPa√m), the ratio becomes $1.21 \times 0.8^2 = 0.77$. Survivors of a room-temperature proof may then carry cracks that fail on a cold day. The proof screen is worthless unless the test is done cold or the toughness drop is ruled out.
• Deep cracks. The critical crack is 75% of the wall. A constant $Y$ underestimates $K$ that deep, so the real sizes are smaller. This is also the break-before-leak case the case-sizing page flagged. A released analysis uses a proper surface-crack solution.

Test media and safety

Why we proof with liquid

Think of it like…

A full suitcase versus a compressed spring

Sitting on a suitcase packed with books barely squashes it, and nothing much springs back when you stand up. That is a liquid: it hardly compresses, so it stores very little energy. A gas is a coiled spring — every bit of work done to squeeze it is waiting to come back out the instant the vessel opens.

The energy released if the vessel fails is:

$$E_\text{liquid} = \frac{p^2 V}{2K} \qquad E_\text{gas} = \frac{p V}{\gamma - 1}\left[1 - \left(\frac{p_\text{atm}}{p}\right)^{\frac{\gamma-1}{\gamma}}\right] \qquad E_\text{wall} = \tfrac{1}{2}\,p\,\Delta V$$

For the 85-litre example case at 11 MPa: water stores about 2.3 kJ, and the steel wall’s own elastic strain energy adds 5.2 kJ — 7.5 kJ in total, about 2 g of TNT. The same test with nitrogen stores about 1.7 MJ, roughly 0.4 kg of TNT: over 200 times more. That is why proof tests are hydrostatic unless there is a compelling reason otherwise, and why pneumatic proof needs special approval, remote operation and much larger exclusion zones.

Trapped air is gas energy hidden inside a hydrostatic test. It matters most in large, low-pressure tests, where the liquid stores little energy of its own. Vessels are filled from the bottom and bled from the highest point until only liquid comes out.

The medium must not attack the vessel

• Stress-corrosion cracking. High-strength steels can crack under sustained stress in plain water. Proof water is inhibited and its chemistry controlled, hold times are kept short, and the case is drained and dried promptly.
• Chemistry matters for every alloy. Titanium pressure tanks failed during Apollo-era testing with methanol, and chlorides attack stainless steels. Check the test medium against the material as carefully as the propellant.
• Temperature. Steel cases are tested well above any ductile–brittle transition, and at a temperature that keeps the toughness argument above valid.

The rig and the schedule

Hydrostatic proof rig — schematic

Every feature answers a failure mode: the relief valve caps an over-pressure, two gauges catch a lying gauge, the high-point vent removes trapped air, the barrier and remote control keep people away from stored energy, and strain gauges show the vessel tracking its predicted stiffness.

A typical hydrostatic proof schedule — illustrative, not a procedure

Small steps with holds let you stop before proof if something leaks, creaks or does not track the expected strain. The actual pressures, rates and hold times come from the governing test specification.

• Remote operation. No one is near a pressurised vessel, and the cell is cleared and barricaded before pressure rises above a low leak-check level.
• Relief valve set above proof pressure and below anything that would damage the vessel; rupture discs as backup.
• Two independent, calibrated pressure measurements. A single gauge that reads low can over-pressurise a case.
• Stepped pressurisation with holds, and a slow final ramp, so a leak or an abnormal strain reading stops the test early.
• Records. Gauge calibrations, liquid temperature, pressure and strain histories, and the serial number of the part form the acceptance record.

Acceptance criteria

A case passes proof when the test specification’s criteria are all met. Typically:

1. No burst and no leak. Leaks are judged visually and by the pressure hold — after correcting for temperature.
2. No significant permanent deformation. Measured by volumetric expansion (water jacket), strain gauges or dimensional checks before and after. A widely used convention for gas cylinders limits permanent expansion to 10% of the total expansion at test pressure. Motor cases use programme-specific limits.
3. Strain tracks prediction. Strain gauges should follow the predicted elastic response linearly. A knee in the strain–pressure curve means local yielding.
4. Post-proof NDT to look for cracks the test may have grown.
5. Composite cases add acoustic-emission criteria, because fibre and matrix damage makes noise long before it shows.

Why hold pressure drifts

A liquid-full vessel is very stiff, so tiny volume changes move the pressure a lot. A change in liquid temperature changes its volume:

$$\frac{dp}{dT} = \frac{\beta_\text{liquid} - 3\alpha_\text{vessel}}{1/K + C}$$

where $\beta$ is the liquid’s volumetric expansion coefficient, $\alpha$ the vessel’s linear expansion coefficient, and $C = \frac{1}{V}\frac{dV}{dp}$ the vessel’s volumetric compliance. For the example case it is about 0.12 MPa per kelvin — over 1% of proof pressure for a single degree. Most hold-pressure “leaks” are the liquid cooling.

Calculator — test rig and acceptance

Test rig — energy, expansion, hold driftthin cylinder with hemispherical ends

Vessel

Internal diameter (mm)Cylinder length (mm)Wall (mm)

Test

Proof pressure (MPa)Trapped air (% of volume)

Measured (for acceptance)

Pressure change in hold (MPa)Liquid temp change in hold (K)Total expansion at proof (mL)Permanent expansion (mL)Permanent-set limit (% of total)Allowed unexplained drop (MPa)

Stored energy, this medium

—

TNT equivalent

—

Internal volume

—

Expansion and hold

Elastic expansion at proof

—

Liquid to pump in

—

Hold drift per kelvin

—

Unexplained pressure change

—

Permanent ÷ total expansion

—

Stored energy: liquid compression p²V/2K, isentropic gas expansion to atmosphere, and elastic strain energy in the wall (½p·ΔV). Membrane compliance of the cylinder only — domes, bosses and fittings add a little. Exclusion distances come from your site safety rules, not from this number.

The defaults show a typical hold reading: a 0.15 MPa drop during a 1 K fall in liquid temperature. Temperature explains 0.12 MPa of it, leaving 0.03 MPa unexplained — inside the illustrative 0.05 MPa allowance.

Where this stops

Screening, not a fracture-control plan

These tools use linear-elastic fracture mechanics with a constant geometry factor and class-typical growth data. A released proof-test argument uses measured toughness and crack-growth data at the right temperature and environment, surface- and embedded-crack solutions, crack growth during the proof cycle itself, sustained-load (environment-assisted) cracking, and the governing standard’s factors.

• Thin, tough walls may tear in a ductile way before linear-elastic fracture mechanics applies. Elastic-plastic methods are then needed.
• Composite cases are not screened this way. Their proof logic is about damage, stress rupture and acoustic emission, not a single crack.

Differences from REF·DB v1

Crack-growth constants corrected

v1 labelled the ferrite–pearlite constants ($6.9\times10^{-12}$, $m = 3.0$) as “low-alloy / maraging steel”. D6AC, maraging and other martensitic case steels use Barsom’s martensitic upper bound ($1.35\times10^{-10}$, $m = 2.25$), which predicts faster growth at the stress intensities that matter here. v1’s austenitic coefficient also did not match the metric form of Barsom’s line; it is now $5.6\times10^{-12}$, $m = 3.25$.

References and further reading

• C. F. Tiffany & J. N. Masters, “Applied Fracture Mechanics”, in Fracture Toughness Testing and its Applications, ASTM STP 381 (1965) — the origin of proof-test logic for pressure vessels.
• J. M. Barsom & S. T. Rolfe, Fracture and Fatigue Control in Structures, 3rd ed., ASTM (1999) — crack-growth relationships for steels.
• T. L. Anderson, Fracture Mechanics: Fundamentals and Applications, 4th ed., CRC Press (2017).
• NASA-STD-5019, Fracture Control Requirements for Spaceflight Hardware; NASA-STD-5009, Nondestructive Evaluation Requirements for Fracture-Critical Metallic Components.
• AIAA S-080 and S-081 — metallic and composite-overwrapped pressure vessels.
• 49 CFR 180.205 — US requirements for requalifying gas cylinders by hydrostatic test, including the permanent-expansion limit.

Note

Educational and screening material. Proof test procedures, pressures and acceptance criteria come from your programme’s test specifications and are approved by the responsible test, stress and safety authorities.