AIAA SciTech Forum 10.2514/6.

2021-1618
11–15 & 19–21 January 2021, VIRTUAL EVENT
AIAA Scitech 2021 Forum

Key Requirements and Challenges for

Space Vehicle Bellows Designs
Vinay K. Goyal1, Christopher N. Sagrillo2, Yenyih Ni3
The Aerospace Corporation, El Segundo, CA, 90245, USA

The purpose of this paper is to highlight the unique challenges associated with bellows, disseminate past space
vehicle anomalies, provide lessons learned in the qualification and acceptance of bellows, and provide guidance
for qualification and acceptance test programs. Development of a robust qualification program for bellows is
challenging, largely due to the following: bellows are sensitive to manufacturing variances, are prone to process
drift and are challenging to analyze. Bellows may also operate in complex loading environments and can exhibit
Downloaded by Peking University on April 1, 2024 | http://arc.aiaa.org | DOI: 10.2514/6.2021-1618

unique failure modes. Given the number of anomalies that have occurred with bellows, existing standards may
be insufficient to protect against future failures. Guidelines for qualification and acceptance programs are
provided based on lessons learned. These guidelines can serve as the basis for enhancing industry standards.

I. Introduction
Bellows are metallic components that are used extensively in launch vehicles. Generally, they are found in rocket
engines and pressurized lines to accommodate deflections caused by severe thermo-mechanical and vibratory launch
environments. Bellows need to provide flexibility, but also be capable of enduring complex internal and external loads.
While many bellows designs exist, typical bellows designs for launch vehicle applications include single and multi-
ply ‘U-shaped’ convolute bellows.

Fig. 1 U-Shaped Convolute Bellows with and without Flanged Connections.

National Security Space (NSS) programs require high reliability launch vehicles for missions of national
significance. These missions can be complex and costly. Therefore, an additional investment is made to assure that
these missions are successful [1]. To achieve this goal, it is necessary to ensure robustness of structural/propulsion
designs. Given that bellows are associated with several reported failures [2,3], they have been studied extensively.
Bellows are challenging to design, manufacture, and analyze because of their complex geometry and complicated
failure mechanisms. Further, the manufacturing process, which generally includes forming of the bellows convolutes,
inherently introduces build-to-build variability. This makes most bellows highly workmanship sensitive. Welded
connections, braided overwraps and hinged joints further complicates matters.

1
Principal Engineer, Launch Systems, AIAA Associate Fellow.
2
Project Engineer, Stage Propulsion, Launch Operations Division.
3
Sr. Project Engineer, Structural Systems, Launch System Operations.

$copyRight
 To qualify bellows for spaceflight applications, existing aerospace standards such as the AIAA-S-080A, Space
Systems – Metallic Pressure Vessels, Pressurized Structures, and Pressure Components [4] and its predecessor AIAA-
S-080-1998 [5], are commonly used. ISO Standard 10785, Space Systems - Bellows - Design and Operation [6] also
provides requirements for bellows in space systems; however, it’s requirements are specific to bellows.
To disseminate lessons learned by the National Aeronautics and Space Administration (NASA), SP-8123 Liquid
Rocketlines, Bellows, Flexible Hoses, and Filters [7], was published in 1977. SP-8123 provides a detailed review of
bellows designs and includes a checklist of recommended requirements. Procedures for satisfying each design
guideline is also provided. The Expansion Joint Manufacturers Association (EJMA), widely known as the authority
on the selection and application of metallic bellows, also provides comprehensive information relative to bellows
design. The latest edition of Standards of the Expansion Joint Manufacturers Association, Inc was released in 2016
[8]. For spaceflight applications, EJMA’s standard is routinely used for preliminary design. In 1988, ASME B31.3
added Appendix X, which incorporates requirements for Metallic Bellows Expansion Joints into the Chemical Plant
and Petroleum Refinery Piping Code. These requirements address design analysis, fatigue curves, correlation to
testing, and pressure testing [9]. Both the ASME and EJMA standards do not provide requirements for spaceflight
Downloaded by Peking University on April 1, 2024 | http://arc.aiaa.org | DOI: 10.2514/6.2021-1618

qualification, however, are useful in the design and testing of bellows.

Given the persistence of bellows anomalies in the aerospace industry, the intent of this paper is to emphasize the
unique challenges they present, disseminate past space vehicle anomalies, provide lessons learned in the qualification
and acceptance of bellows, and offer a set of guidelines for verifying bellows design and manufacturing.

II. Unique Challenges

Bellows include unique challenges not present in other structural components. These include significant
manufacturing variability, complex loading environments, unique failure modes, inspection limitations, and low
confidence analytical predictions. Subsequently, this section highlights the key issues associated with each topic.

A. Bellows Manufacturing
Manufacturing of bellows in many cases introduces significant build-to-build variability. This is especially true when
the bellows convolutes are formed. To accomplish this, a variety of techniques are used including: mechanical bulging,
hydro-forming, roller forming, etc. However, before initiating a forming process, the sheet stock used to produce the
bellows varies within tolerance. Small differences in sheet stock thickness can result in significant differences in
bellows stiffness. The stiffness variation as a function of percent deviation from nominal sheet thickness is shown in
Figure 2. Due to a 10 percent deviation in sheet stock tolerance alone, the stiffness varies by 27 - 33 percent. Once
formed, differences in other dimensional parameters (e.g., convolute height, pitch, etc) further increase variability.

Fig. 2 Variation in bellows stiffness due to ply thickness tolerance for several bellows designs.
 The hydraulic pressure applied in the hydroforming process can also be a key factor in the final properties of
bellows. For example, the contact between plies for multi-ply bellows and the spacing between convolutions may not
be uniform. As a result, the stiffness of one bellows unit is likely to be different than another. Hardware installation
can also influence bending stiffness. Testing of multi-ply bellows at various azimuth angulations under various
pressure levels showed that bending stiffness within the same sample can vary significantly up to 60% at low pressures
and decreases to 20% at higher pressures. These large variations suggest that contact, thickness of the plies, and even
pre-stress effects are strong contributors to the variability observed. Accurate characterization of bellows stiffness is
important, as it can play a significant role in the fluid-structure interaction calculations, coupled loads analysis
predictions, and prediction of fatigue failures.
Bellows forming can also locally change bellows ply thickness and material properties. This is because significant
cold working occurs during forming. Consequently, non-uniform thickness and strain hardening is observed
throughout the convolute, and is shown in Figure 3. In general, the bellows roots and/or crowns experience the most
thinning, the most plastic deformation, and retain the most manufacturing residual stresses. Subsequently, initiation
of fatigue failures tends to occur in these regions.
Downloaded by Peking University on April 1, 2024 | http://arc.aiaa.org | DOI: 10.2514/6.2021-1618

Fig. 3 Micro-Hardness Measurements as a Function of Convolute Location.

In many bellows designs, welds are also present. These can either be longitudinal or circumferential. When
longitudinal, the welds exist within the convolutions and are susceptible to cracking. This is because the weld and its
heat affected zone, will be less ductile than the parent material. As a result, when circumferential, or ‘seam welds’,
are present in a bellows design, careful inspections of these areas must be conducted. Post-processing (e.g., tempering,
annealing) can also be used to address welds and other non-uniformities within a bellows design; however, one must
carefully consider the trade-offs between overall strength and ductility for the given application.

B. Bellows Design Load Environments

Bellows must tolerate both deflections and external loads. The types of deflections accommodated by bellows include
thermal expansion/contraction, installation misalignment, as well as other mechanically-induced displacements (e.g.,
engine gimballing, actuation of structures, etc). The external loads that bellows must withstand include internal
pressure loads, mechanical loads (e.g., bending, axial, and shear loads), and vibrational environments.
Vibrational environments include both mechanically-induced and flow-induced vibrations (FIV) and warrant
special attention. FIV is very difficult to protect against and has been attributed with several aerospace anomalies. FIV
occurs when fluid instabilities and the natural frequency of the fluid-structural system coincide. For straight bellows,
NASA published MSFC-DWG-20M02540 [10], which determines the resonant frequency of the fluid-structural
system, as well as the alternating stresses due to FIV. However, these guidelines do not include guidance for FIV
predictions in angulated bellows, which create a much different flow field than straight bellows.
Pressure transients, such as water hammer, are also very dangerous for bellows. This is because bellows are
intentionally made more flexible than surrounding propulsion hardware, and as a result, will have a reduced overall
 cross section when compared with adjacent plumbing lines. Water hammer can rapidly increase the internal pressure
in a propulsion line, and in some cases, impact the hardware several times before it is dampened out by viscous forces.
When the amplitude of water hammer pressure spikes becomes prohibitively large, special provisions can be included
in bellows to protect against over-pressurization. Examples include braided overwraps, as well as other externally
reinforced bellows designs.
Proper design for a given loading environment can be very difficult. For example, to address external loads one
may increase ply thickness or ply count. However, in doing so, the design loses flexibility and consequently may fail
to relieve displacements as intended. This can result in premature failure of the bellows, or failure of adjacent
structures. As a result, a good understanding of the design environment is extremely important for bellows design.

C. Bellows Failure Modes

Bellows exhibit unique failure modes. However, the most common failure mode in spaceflight applications is fatigue.
In other industries, bellows carry substantial strength and life safety factors. In spaceflight applications, the use of
large safety factors is either challenging due to extreme loading environments, or undesirable due to the associated
Downloaded by Peking University on April 1, 2024 | http://arc.aiaa.org | DOI: 10.2514/6.2021-1618

weight penalty. Therefore, spaceflight bellows can include small margins of safety, and as a result, anomalies occur.
Several other factors play a role in fatigue failure of bellows. For example, handling damage during processing,
shipping, and installation can be initiators for fatigue crack growth. Bellows convolutes are very thin, and as a result,
can be damaged easily well before flight. Unrestrained bellows can also be inadvertently deflected beyond their yield
strength. While potential for mitigation exists using protective covers and deflection constraints, pre-flight damage
can still occur during launch processing. Subsequently, bellows must always be handled with care.
Fatigue failure typically begins with circumferential fatigue cracks at or near the convolute roots and crowns.
These regions are prone to residual manufacturing stresses, which are another contributor to premature failure. Surface
effects such as oxidation and rough surfaces, can also drastically decrease fatigue performance of bellows plies. Given
the nature of the fluids stored within bellows, stress corrosion cracking and hydrogen embrittlement have also been
factors in fatigue life reduction. Finally, unexpected loading conditions such as pressure transients can cause fatigue
failure. In this case, overloading results in low cycle fatigue damage.
Inter-ply rupture has also been noted in several bellows applications during manufacturing, as well as in service.
This phenomenon occurs when fluids or contaminants are trapped between bellows plies. When heated, the trapped
constituents can rapidly expand, leading to rupture of the inner-most ply. For example, if lubricants become trapped
between plies during manufacture, downstream heat treatments can cause these fluids to vaporize. Similarly, in
cryogenic applications, trapped cryogens can be heated easily at ambient conditions – thereby causing in-service inter-
ply rupture.
Finally, buckling instability can also occur with bellows. Buckling can be caused by both internal pressure (e.g.,
squirming) and external pressure. In the case of external pressure, buckling manifests as crushed convolutions.
Conversely, for internal pressure, buckling causes column instability. Both types of instabilities should be evaluated
when designing bellows. The EJMA standard provides guidelines to determine the onset of buckling instability.
Modeling of the phenomenon has also been demonstrated as shown in Figure 4.

Fig. 4 Bellows squirm in a single ply bellows design (left) and its model prediction (right).
 D. Analysis and Inspection of Bellows
High confidence analysis of bellows is challenging to achieve for a variety of reasons, but particularly because of the
way they are manufactured. Given the dimensional tolerances associated with bellows, build-to-build variability alone
is difficult to bound in a model. Furthermore, quantification of the effects of forming (e.g. localized residual stresses,
strain hardening, and ply thinning) can be very challenging. Omission of any one of these can significantly impact
stress predictions. If operating in the plastic regime, non-linear material modeling also needs to be considered. For
multi-ply bellows designs, inter-ply contact modeling is required. Lastly, when welds are present, convolution stress
states are complicated. For these reasons analytical stress predictions for bellows are generally low confidence.
Despite these challenges, analytical models are still valuable. For example, analysis can be used to size and
determine the most appropriate bellows design for a given application. The EJMA standard, which includes equations
to quantify both stresses and stiffness, is useful for this purpose. Sensitivity studies with finite element models are also
routinely used to determine critical locations, as well as design test campaigns. In select cases, where modelling is
correlated to test, finite element models have been capable of predicting stresses and strains. However, this becomes
increasingly difficult when operating in the plastic regime. Further, model correlation is generally difficult, due to
Downloaded by Peking University on April 1, 2024 | http://arc.aiaa.org | DOI: 10.2514/6.2021-1618

large strain gradients in the bellows roots and crowns.

Predicting fatigue of bellows is even more challenging than predicting strength exceedances. This is due to
uncertainty in the local stress field, complexity in loading conditions, and geometric variabilities. Appropriate fatigue
data is also hard to find. A general bellows fatigue curve for austenitic steels is present in the EJMA standard; however,
the lack of material specificity limits its value for spaceflight applications. Ultimately, analytical fatigue predictions
can be informative, but it is highly recommended to rely on test for qualification. For most spaceflight applications,
demonstration of damage tolerance is also required. For bellows, satisfying damage tolerance by analysis is extremely
difficult. First, the thinness of bellows plies and plastic stresses may prohibit the use of linear elastic fracture
mechanics. Second, determination of an acceptable flaw size is required.
The acceptable flaw size for damage tolerance needs be found through reliable inspections, which are challenging
to implement after bellows manufacturing. For example, dye penetrant inspections may be possible on external
bellows surfaces, but the inner surfaces are much less practical. While visual inspections with high magnification and
light can reveal handling damage (e.g., nicks and dents) and corrosion, it may not be perceptive to surface flaws. For
multi-ply bellows there is no effective technique to detect flaws for internal plies. Computer tomography and X-ray
have been successfully used to detect flaws in welds.

III. Historical Anomalies

Reported failures of bellows have been attributed to a variety of causes. These include low-cycle fatigue cracks,
high-cycle fatigue cracks, manufacturing imperfections, and flow-induced vibrations. Subsequently, this section
provides synthesized narratives for each issue through historical anomalies.

A. Low Cycle Fatigue

During functional testing of a bellows design, hydraulic fluid leakage was observed. During the test program, many
bellows leaked, but there was significant variability in when the leaks occurred. While low cycle fatigue was the direct
cause, the root cause of these unexpected failures was attributed to fabrication weld cracks and high plastic-range
stress concentrations. Consequently, it is important to inspect all bellows welds post forming. It is also important to
understand the state of stress in bellows for all operations – including qualification and acceptance testing.
Low cycle fatigue failures have also occurred in bellows, as a result of excessive pressure spikes. For example, in
service pressure transients plastically deformed a bellows design and accelerated fatigue failure. After subsequent
pressure cycles, failure initiated at the root of the bellows convolutes. The pressure spikes were attributed to the water
hammer phenomenon. The proof test, burst test and pressure cycle test did not account for pressure transients.
Therefore, the design was not properly vetted for in-service pressure transients.
 B. High Cycle Fatigue
During static testing of a Space Shuttle Main Engine (SSME), bellows failed due to high cycle fatigue. The design,
which included an internal tripod to allow the bellows to gimbal without extension due to internal pressure, failed –
resulting in liberation of the tripod [2]. Ultimately, impact with a downstream elbow caused hydrogen leakage in the
low-pressure duct. Several causes where considered, including FIV and underpredicted gimbal angles; however, the
root cause in the end was found to be discrepant hardware dimensions. These resulted in higher stress concentrations,
that when coupled with the severe vibrational environment, led to high-cycle fatigue failure.
There are other instances, where a qualification campaign was successfully conducted, yet fatigue cracks
developed. For example, random vibration testing of a flex-line was required as part of an acceptance test program.
Qualification of the baseline bellows design was completed with no issues, yet acceptance testing resulted in
unexpected fatigue failure of a bellows flight article. The fatigue failure occurred at the crown of the first convolute.
Random vibration levels were deemed realistic for the application and not conservative. In this case, vendor process
drift led to issues after qualification; highlighting the importance of a robust acceptance test program and periodic
verification of a given bellows manufacturing process.
Downloaded by Peking University on April 1, 2024 | http://arc.aiaa.org | DOI: 10.2514/6.2021-1618

C. Manufacturing Imperfections
The manufacture of bellows can also lead to issues. For example, fatigue failure of a bellows assembly occurred due
to pit defects introduced during manufacturing. These regions acted as initiation points and caused stress
concentrations which locally decreased fatigue strength. The defects and fatigue cracks occurred at the root of the
convolutions. In this case, manufacturing process controls were inadequate and led to issues in service.
In another example, a bellows diaphragm found within a valve assembly failed due to fatigue. The root cause of
the failures was attributed to residual stresses and large grain sizes throughout the bellows plies. Residual stresses are
difficult to account for, and in many cases, drive otherwise elastic strains to the plastic limit. Additionally, large grains
in thin structures significantly increase uncertainty in fatigue scatter. The combination of the two led to the failure.
Imperfections in welds have also caused several issues with bellows. The reduced ductility of longitudinal welds
relative to the parent material, makes them susceptible to cracking during bellows forming. Undetected cracks in
circumferential welds in multi-ply designs has also resulted in fluid entrapment between plies. In cryogenic
applications, the trapped fluid has rapidly expanded, causing catastrophic rupture in the inner ply. Therefore,
inspection of multi-ply designs that operate in extreme thermal environments is very important.

D. Flow Induced Vibrations

An unexpected FIV bellows failure was identified after detecting leakage. Extensive inspections of the inner bellows
determined the presence of several cracks through the entire bellows wall. High cycle fatigue cracking was found to
have initiated from the inner walls of the bellows convolution crowns and was clustered near the seam weld. In this
instance, the large aspect ratio of the convolutes pushed the design beyond the shapes assumed for FIV calculations
and also created excess wall thinning during manufacture. In addition, almost no margin existed between operating
conditions and calculated flow-induced resonance. This combination resulted in operation at resonant frequencies and
premature failure of the bellows.

IV. Lessons Learned

Despite the existence of bellows requirements for spaceflight including: AIAA-S-080A-2018, ISO Standard 10785,
NASA-STD-5012, and SMC-S-016 [12] (and predecessor documents such as MIL-1522 and MIL-1540), anomalies
continue to occur. These failures suggest that requirements need to be revisited. Through participation in several
anomaly investigations, a variety of lessons learned have been established on characterization of bellows design
environments, characterization of as-built hardware, and enforcement of robust qualification test programs. Select
details for each topic are provided below:
 A. Characterization of Design Environment
Given the unique and often complex design environments for bellows, an assessment should fully account for enforced
deflections, misalignments, temperatures, pressure cycling, low-frequency vibrations, and equivalent high frequency
vibrations. Failure to do so can grossly underpredict loads and lead to inadvertent failures. Furthermore, due to the
fatigue sensitivity of bellows, a robust cycle count methodology for both mechanical and pressure cycles is important.
Response time histories rather than response power spectral densities should be used, as the response time history
provides a sequence of loading events, some of which could introduce plasticity. Additionally, pressure transients
such as water hammer, should be fully characterized to ensure that the service life definition encompasses all nominal
and off-nominal operational environments.
In applications subject to flow induced vibrations, additional scrutiny is warranted. This is because even small
alternating stresses from FIV can contribute to fatigue failure when combined with mean stresses. FIV environments
should be fully characterized by identifying operating regions where fluid excitation frequencies match the fluid-
structural resonance frequencies. To mitigate FIV, installation of an internal liner can prevent the bellows
convolutions from being exposed to flow. Angulated bellows, however, are difficult to protect with a liner and require
Downloaded by Peking University on April 1, 2024 | http://arc.aiaa.org | DOI: 10.2514/6.2021-1618

alternative approaches - such as optimization of the bellows stiffness to avoid resonant frequencies. Bellows can also
be partially lined, allowing for larger deflection, but this approach leaves some convolutes exposed to flow excitation.

B. Characterization of As-Built Hardware

Given that bellows require a balance between strength and flexibility, the appropriate material selection for a given
design should be considered carefully. For example, a very high strength, high modulus of elasticity, and low apparent
fracture toughness can be problematic in bellows design. This is because ductility is preferred over brittle behavior in
most bellows applications. However, low strength relative to loading environments can also result in premature
failures. Further, the bellows forming process can significantly reduce ductility in the bellows roots and crowns. One
such method to mitigate this concern is to stress relieve the formed bellows assembly. Other heat treatments can then
be applied to the hardware and result in uniform mechanical properties
Due to the inherent variability in bellows manufacturing, detailed inspection of the as-built hardware is also very
important. Advances in contactless measurement techniques can allow for comparisons between the as-built hardware
and the idealized design. Borescope inspections with high intensity light can also be employed to detect surface
asperities that point to manufacturing issues such as pitting and corrosion. Root-to-root measurements between
bellows ply convolutions can also be taken to ensure that plastic deformation is not taking place during acceptance
testing. Finally, the use of computed tomography scans can assist in determining out of tolerance conditions.

Fig. 5 Computed tomography scan of a bellows assembly.

It is also important to characterize the overall bellows quality at the start of a qualification program. To do this, a
first article inspection should be conducted to preclude potential grain size issues, weld issues, verify ply thicknesses,
and take hardness measurements. This ensures that the manufacturing was completed as expected, but also provides
 insight into critical design and analysis inputs. The stiffness, which is strongly influenced by the thickness of the
bellows plies, should also be measured for each flight article. This serves to monitor build-to-build variability, but
also verifies stiffness requirements for the bellows design.

C. Robust Qualification Test Programs

To bound the design environment and build-to-build variability for a bellows design, a robust qualification and
acceptance test program is needed. One of the most common issues noted in qualification is the use of inadequate
factors of safety in combined loads tests. For example, many test programs implement a 1.0 factor of safety on
extension or angulation, while a test factor is applied to the internal pressure. By applying a factor of safety of 1.0 to
displacements, it does not account for variability in displacements stresses, which can be large compared to the internal
pressure stresses. To account for all loads equally, it is recommended that the appropriate factor of safety be applied
to the total stress state. The combined loads in test can then be adjusted to achieve the appropriate stress level.
It is also well documented that bellows used in aerospace applications operate plastically. For predictable
performance, it is recommended that the high stressed regions of bellows designs (e.g. roots and/or crowns) not be
Downloaded by Peking University on April 1, 2024 | http://arc.aiaa.org | DOI: 10.2514/6.2021-1618

allowed to go beyond the material yield point during operation. Ideally, yielding should not occur during proof testing
either – as plastic deformation can reduce the overall fatigue life of the design.
With regards to fatigue, a scatter factor of 4.0 is typically applied to the number of cycles contained within a
complete service life. However, this may be insufficient to protect against all bellows failures. Therefore, a higher
scatter factor may be more appropriate, as this both addresses high cycle fatigue and provides additional margin against
built-to-build variability. Alternatively, testing multiple units after proof testing to fatigue failure in qualification
testing is a viable option. This approach provides data on manufacturing variability and identifies post-proof life
capability. If such tests are conducted over the life of the program, they ensure that process drift has not occurred.
When developing the load spectra for qualification tests, one must also be careful with augmentation of the service
life using cumulative damage. This is because damage can be very sensitive to total cycle count and to the statistical
distribution of cycles as a function of displacements.
In acceptance testing, measures should be taken to ensure identical clocking for flight and test installation of the
bellows during stiffness verification. This is because performance can vary from one azimuth to another within the
same bellows unit. For example, longitudinal welds, external stiffeners, gimbal joints, as well as differences in inter-
ply contact all affect stiffness in the same unit. Finally, when accounting for pressure transients in proof testing, it
may be more appropriate to apply a dynamic pressure with an input frequency matching the operational frequency.
Large sustained pressures can lead to squirm that would otherwise not occur with a pressure transient. However, this
requires that the frequency of the pressure transient be well defined and sufficiently bounded by the test.

V. Guidelines and Recommendations

To safeguard against bellows failures in space vehicle applications, several standards exist. The most common include:
ISO Standard 10785: Space Systems - Bellows - Design and Operation, AIAA S-080A-2018: Space Systems – Metallic
Pressure Vessels, Pressurized Structures, and Pressure Components, and its predecessor AIAA S-080-1998. Guidance
can also be found in NASA’s SP-8123 Liquid Rocketlines, Bellows, Flexible Hoses, and Filters, as well as EJMA’s
Standards of the Expansion Joint Manufacturers Association, Inc. Several lessons learned and key requirements for
bellows are included in these documents.
The guidelines and recommendations in this section build upon existing standards and guidelines, but also include
lessons learned from historical failures. While no set of guidelines can eliminate failures entirely, particularly when
build-to-build variability in manufacturing occurs, the incorporation of best practices can decrease the likelihood of
failures. Ideally, qualification test articles bound manufacturing process driven features, bound flight loading
conditions, and link inspection techniques to robust acceptance criteria proven by the qualification test articles. To
this end, a set of recommendations is provided for qualification and acceptance testing of ‘U-shaped’ convolute
bellows for space system and launch vehicle applications.
 A. Qualification Program
A qualification program is used to prove out the design and the processes used to manufacture the hardware. Therefore,
it is imperative the qualification campaign for a bellows be bounding relative to the maximum loads expected in
service and be bounding of the expected manufacturing build-to-build variability. If rework of a bellows is allowed
during manufacturing (e.g., re-forming or re-rolling of bellows convolutes, multi-pass weld repairs, etc.) qualification
articles should account for the effects of the rework. It is also strongly recommended that qualification be repeated
after any change in supplier or manufacturing process.

1. Acceptance Tests: Every flight production unit requires acceptance testing. The qualification unit should undergo
the same acceptance program as the production hardware to verify that the design will be able to survive the
qualification program after the acceptance tests. The acceptance tests that are recommended to be included as part of
the acceptance program are discussed in Section B.

2. First Article Inspections: After successfully completing the acceptance tests, it is recommended to dissect a
minimum of one bellows sample to verify a lack of damaging microstructural features such as: pits, surface
Downloaded by Peking University on April 1, 2024 | http://arc.aiaa.org | DOI: 10.2514/6.2021-1618

irregularities, microcracks, large grain sizes, and weld defects. The dissected sample should also be used to obtain
hardness and convolution thickness measurements for both seam welds and parent material. The hardness
measurements can be used to determine the yield strength of the material throughout the convolutes, and the thickness
measurements validate assumptions used in analytical predictions (e.g., stiffness). Prior to destructive testing, stiffness
characterization can also be performed to establish relationships to in-service degrees of freedom (e.g., extension,
compression, angulation, etc.) and collect data that can be used for process control. Although it is recommended to
conduct the first article inspection (FAI) after the acceptance tests, it may be justifiable to conduct the FAI before
acceptance testing.

3. Vibration and Life Cycle Tests: The vibration test and life cycle test induce high-frequency and low-frequency
cyclic fatigue damage to the bellows. Therefore, these tests should be performed on the same qualification test article.
If conducting both tests on the same unit is deemed impractical, it may be possible and more ideal, to envelope total
cumulative damage from the vibration and life cycle tests in a single test. When developing the load spectra for such
tests, one must be careful as damage can be sensitive to the statistical nature of the environments (e.g., deterministic
vs. random) and to the total cycle count. Combined cyclic loads should be based on credible, but worst-case
combinations of environments. Any reduction in the number of test cycles using equivalent cumulative damage
calculations, should be substantiated by test measurements – noting that strain measurements can be difficult to obtain.
The vibration test verifies that the design will survive high-frequency vibration environments. The requirements
for the amplitude and duration of the vibration test vary depending on program requirements (e.g., SMC-S-016, NASA
STD-7001B). Internal pressure should be included in the vibration test. Flow induced vibration (FIV) environments
should also be evaluated. This is accomplished by assessing potential operating regions where fluid excitation
frequencies approach fluid-structural resonance frequencies. The FIV assessment should also account for the entire
bellows stiffness range – which is strongly influenced by convolute thickness and height. If FIV is deemed credible,
an FIV test should be performed in accordance with MSFC-SPEC-626 [11].
For life cycle testing, the service life must include all pressure cycles and external load (deformation) cycles –
including those conducted as part of the acceptance program. To account for inherent scatter in fatigue capability, a
minimum life factor of 4 is applied to the complete service life. To address process variability in bellows
manufacturing, it is recommended that a minimum of 3 bellows samples be tested – where bellows samples ideally
come from individual lots. Alternatively, fatigue capability can be verified by testing several bellows to failure, so
long as the minimum life factor demonstrated is 4 times the service life. In test, the clocking angle, which is the angular
position associated with the installation, should match the flight configuration, or the worst-case clocking angle
relative to the direction of flexure should be used. The applied loads must be adjusted to account for differences in
material strength and fatigue properties between test temperatures and flight temperatures. If fatigue damage induced
by thermal cycles is non-negligible, thermal cycles need to be included as part of the life cycle test. Lastly, pressure
transients should be accounted for in the pressure spectra.
 Success Criteria: No detrimental deformation, leakage above a predefined leak rate, or rupture permitted.

4. Stability Test: In stability testing, a minimum ultimate factor of 1.25 is applied to loads that reduce structural
stability structural margins. For loads that stabilize the test article, the lowest expected magnitude is chosen and a
factor of 1.0 is applied. Worst-case pressures and displacements should be accounted for simultaneously. Note that
the maximum pressure may occur with bellows in the most elongated position, and can result in column instability or
bellows squirm.

Success Criteria: No detrimental deformation, leakage above a predefined leak rate, or rupture permitted.

5. Ultimate Test / Burst Test: The ultimate test verifies that the design has sufficient strength to withstand limit load,
which is a statistically defined maximum load or combination of thermal, mechanical, and/or pressure loads that the
hardware may experience at the same time during its service life. Given the build-to-build variability in bellows
manufacturing, ultimate testing of two or more bellows samples is encouraged. The ultimate factor applied to limit
load is typically between 1.25 and 1.4. To improve tolerance to defects, an ultimate factor of 2.5 drives low operational
Downloaded by Peking University on April 1, 2024 | http://arc.aiaa.org | DOI: 10.2514/6.2021-1618

stresses in the part and a proof factor of 1.5 screens for gross workmanship defects and/or critical flaws. In test, the
clocking angle of the test configuration should match the flight configuration, or the worst-case clocking angle relative
to the direction of flexure should be used. The applied loads must also be adjusted to account for differences in material
strength between the test and flight temperatures. If there is a significant stress induced by temperature gradients or
thermal mismatch, the applied loads should be increased to envelop thermal stress.
The burst test can be omitted if the ultimate test includes the maximum expected operating pressure (MEOP) as
part of the limit load definition and an ultimate factor of 2.5 is selected. Otherwise, a burst factor of 2.5 is applied to
the design MEOP and internal pressure is held for a minimum of 5 minutes without loss of pressure. If internal pressure
is a significant portion of the bellows design environment, increasing pressurization until hardware failure (i.e. rupture)
can be informative. The test is conducted at the worst-case operating temperature, or the applied pressure is adjusted
according to the material strength difference at test temperature and flight temperature. If there is a significant stress
induced by temperature gradients or thermal mismatch, pressure should be increased to envelop thermal stress.

Success Criteria: No leakage above a predefined leak rate, or rupture permitted.

6. Damage Tolerance Verification: The purpose of damage tolerance verification is to demonstrate that the hardware
will not fail in the presence of defects. Due to a lack of confidence in analytical predictions, damage tolerance
verification by analysis is not recommended for bellows. Further, verification by test is challenging. This is because
it is difficult to develop crack-like flaws in bellows that are tied to non-destructive inspections with a P90/C95
probability of detection. Typical flaws include: disbonded seam welds, weld scratches/gouges/dents/inclusions, and
convolution crown or root scratches/gouges/dents. Given the challenges associated with damage tolerance testing, a
detailed FAI and fatigue testing of multiple bellow samples are recommended. This does not eliminate the need for
damage tolerance verification entirely, but it does provide some confidence in repeatable bellows performance.
One viable option to address damage tolerance is to design bellows to be redundant by using a multi-ply bellows
configuration with 3 or more plies. In multi-ply bellows designs, failure of one ply may not result in failure of the
bellows assembly. To demonstrate multi-ply redundancy, a severed ply can be intentionally introduced in a bellows
test article prior to life testing – at a critical location where predicted tensile stresses are significant. If the damaged
test article can withstand life testing with no detrimental deformation or rupture, damage tolerance is satisfied.
However, through-cracks in bellows plies can also result in intrusion/entrapment of gasses or liquids in between plies,
and lead to additional failure modes that should be evaluated. As part of a redundancy assessment, it is also
recommended that an evaluation be conducted to ensure that 1) failure of one or more plies does not generate debris
that would affect or compromise system-level performance or prevent mission objectives from being met, and 2) the
remaining bellows assembly is capable of sustaining all redistributed loads and environments.
If damage tolerance cannot be demonstrated via redundancy and/or damage tolerance testing, then the bellows
design should be subject to an ultimate test of 2.5 times limit load and a proof test of 1.5 times limit load. The increased
 safety factors are intended to lead to low operational stresses in service, and subsequently improve tolerance to defects.
Detrimental deformation is not allowed, and a positive yield strength margin should be maintained in proof testing.

Success Criteria: No detrimental deformation, leakage above a predefined leak rate, or rupture permitted.

B. Acceptance Program
While the qualification program is intended to prove out the design and manufacturing processes, the goal of the
acceptance program is to verify workmanship of process-sensitive hardware, screen out early failures, and verify
flightworthiness. Prior to installation, bellows should be protected from damage and inadvertent deflections. This can
be accomplished using protective covers and pre-installation constraints. In addition to the recommendations provided
below, periodic verification of bellows microstructure, fatigue capability, etc, can serve to monitor build-to-build
variability in production hardware and should be considered for programs with extended life spans.

1. Pre-Test Inspections: All dimensions are to be measured to verify that they meet drawing specifications. In addition,
a visual inspection should be conducted to verify that there are no visually detectable defects. Magnification glass,
Downloaded by Peking University on April 1, 2024 | http://arc.aiaa.org | DOI: 10.2514/6.2021-1618

borescope, lighting and other methods should be used to enhance visual inspections. To disposition defects, a criterion
validated by damage tolerance testing should be established. Further, if the unformed bellows tube includes a seam
weld, dye penetrant inspection of the weld prior to forming is recommended. Crack-like indications should not be
permitted.

2. Proof Test: The required proof factor should be applied to the limit load, which includes the maximum expected
operating pressure. This is because loads other than internal pressure can lead to considerable stresses throughout the
bellows assembly, and subsequently render a proof pressure test to be ineffective at enveloping flight conditions.
Although a proof factor as low as 1.1 is acceptable, a proof factor of 1.5 and an ultimate factor of 2.5 (as indicated in
Section A5) can result in low operational stresses in service, and subsequently improve tolerance to defects. During
proof testing, a positive yield strength margin should be maintained. Internal pressure should also be held for a
minimum of 5 minutes without loss of pressure. The clocking angle of the test configuration should match the flight
configuration, or the worst-case clocking angle relative to the direction of flexure should be used. Additionally, the
applied loads must be adjusted to account for differences in material strength between the test and flight temperature.
If there is a significant stress induced by temperature gradients or thermal mismatch, the applied loads should be
increased to envelop the thermal stress. Further, if elevated proof and ultimate factors are used in lieu of damage
tolerance, differences in fracture toughness between the test and flight temperature must also be considered when
adjusting the applied load.

Success Criteria: No detrimental deformation, leakage above a predefined leak rate, or rupture permitted.

3. Stiffness Verification Test: Stiffness variation in flight bellows is usually an indicator of manufacturing variability
and/or process drift. As a result, the use of stiffness measurements for process control is highly recommended.
Verification of bellows stiffness also assists in validation of loads on adjacent components. Margins of safety for
adjacent components should be verified at the minimum and maximum range of acceptable stiffnesses for the bellows.
In the stiffness verification test, the production unit stiffness should be measured to verify that the flexibility meets
the design intent in the desired degrees of freedom. The clocking angle of the test configuration should match the
flight configuration. Additionally, flexibility of a bellows design often varies as a function of internal pressure and is
typically proportional to the material modulus at the operating temperatures. As a result, it is recommended that
measurement of bellows stiffness be performed under test conditions that are relevant to flight conditions. For this
reason, it may be prudent to combine stiffness verification testing with the proof test.

Success Criteria: Stiffness measurements fall within program established requirements. No detrimental deformation,
leakage above a predefined leak rate, or rupture permitted.

4. Thermal Cycle and Thermal Vacuum Test: The thermal tests are functional tests, not structural tests. The need for
these tests should be evaluated based on flight thermal conditions. Since temperature extremes will typically occur
 during operations, a proof test with compensation added for temperature effects in many cases is acceptable. An
exception may be when the temperature effects cause a thermal mismatch that cannot be easily simulated by an
increased load. When required, the thermal tests are conducted in compliance with SMC-S-016.

Success Criteria: No detrimental deformation, leakage above a predefined leak rate or rupture permitted.

5. Leak Check: The leak check is a performance test, not a structural test. The allowed leak rate is defined by a system-
level analysis and the test media. These tests are conducted according to SMC-S-005 [13] and SMC-S-016. The
production unit must pass the leak check.

Success Criteria: Leak rate within program established requirements.

6. Post-Test Inspections: All dimensions are measured to verify that they meet the drawing specifications. In addition,
a visual inspection should be conducted.

Success Criteria: Detrimental deformation and visible damage are not allowed.
Downloaded by Peking University on April 1, 2024 | http://arc.aiaa.org | DOI: 10.2514/6.2021-1618

VI. Conclusion
It is not a surprise that bellows have been a challenging structural component to design and operate safely. The
complexity in the manufacturing process, the loading conditions, the inability to analyze them with high confidence
and the inability to fully inspect them to the level of rigor as other flight hardware are ongoing challenges. Further, in
aerospace applications, stresses usually exceed the materials’ yield strength. Understanding the structural performance
characteristics and capabilities of various metal alloys in this “plastic” regime, while accounting for manufacturing
process sensitive features of the design, is of paramount importance.

VIII. References
[1] Gujral, A., Emanuelsen, W. A., Goyal, V. K., Kendall, R. L., Lauderdale, W. J., and Strizzi, J. D., “Launch
System Reuse,” IAC-18-D2-1-6-x43039, presented at the 69th International Astronautical Congress, October
2018, Bremen, Germany
[2] “A History of Aerospace Problems, Their Solutions, Their Lessons Learned,” NASA Technical Paper 3653,
September 1996.
[3] “Proper Manufacturing, Handling, Use, Storage and Care Of Metal Bellows Flex Hoses,” NASA Lessons
Database, September, 2010, https://llis.nasa.gov/lesson/5479
[4] “Space Systems – Metallic Pressure Vessels, Pressurized Structures, and Pressure Components,” ANSI/AIAA
S-080A-2018, March 2018.
[5] “Space Systems – Metallic Pressure Vessels, Pressurized Structures, and Pressure Components,” ANSI/AIAA
S-080-1998, September 1999.
[6] “Space Systems - Bellows - Design and Operation,” ISO 10785, October 2011.
[7] “Liquid Rocketlines, Bellows, Flexible Hoses, and Filters,” NASA SP-8123, April 1977.
[8] “Standards of the Expansion Joint Manufacturers Association, Inc,” 10th Edition, Expansion Joint Manufacturers
Association, Inc, December 2016
[9] Becht. C, “B31.3 Appendix X Rules for Expansion Joints,” Journal of Pressure Vessel Technology, August
1995, Vol. 117.
[10] “Assessment of Flexible Lines for Flow Induced Vibration,” NASA MSFC-DWG-20M02540 Revision E,
December 19, 1991
[11] “Test Control Document for Assessment of Flexible Lines for Flow Induced Vibration,” NASA MSFC-SPEC-
626, May 11, 1990.
[12] “Test Requirements for Launch, Upper-Stage and Space Vehicles,” SMC-S-016 (2014), 5 September 2014.
[13] “Space Flight Pressurized Systems,” SMC-S-005 (2015), 28 February 2015.