Neither Money Nor Manpower: The story of the de Havilland Comet and the crash of BOAC flight 781
Note: this accident was previously featured in episode 43 of the plane crash series on June 30th, 2018, prior to the series’ arrival on Medium. This article is written without reference to and supersedes the original.
In the spring of 1952, British aviation took a great leap forward when the de Havilland Comet I became the first jet airliner to carry paying passengers, soaring away from London Heathrow Airport at twice the speed and to twice the height of its contemporary competitors. Much fanfare accompanied the coming of this new era, as the press and public alike hailed the Comet as evidence of Britain’s return to the forefront of aeronautical engineering after the devastation of WWII. But this pride would soon be dented, not once or twice, but over and over again, as Comets crashed in Rome, Karachi, and Calcutta. But it was not until the 10th of January 1954, when BOAC flight 781 abruptly disintegrated at 29,000 feet after takeoff from Rome that the industry truly began to wonder whether something was wrong. The Comet was grounded, then ungrounded almost as quickly, only for disaster to strike again just days later, sealing the unfortunate fate of the world’s first passenger jet.
What was causing the Comet to fall apart at the seams? The answer would seem shocking today, but was groundbreaking at the time: as it turned out, the fuselage itself was simply not strong enough, and would fail in fatigue after as few as 1,000 flights. The danger of metal fatigue was far from unrecognized at the time, but in an effort to bring aerospace engineering into the terra incognita of high altitude pressurized flight, assumptions were made which would prove disastrously unfounded. The subsequent unraveling of those assumptions would transform the process of designing and testing commercial airplanes, proving that the construction of a modern jet takes more precision — and more math — than almost anyone had anticipated.
◊◊◊
In 1946, as Britain clawed its way out of the ashes of the Second World War, major figures in the public and private sectors began to turn their attention toward the daunting task of reviving the United Kingdom’s once thriving commercial aircraft manufacturing industry. Design and production of new models had ceased for several years, and with the looming prospect of American dominance in the field, the consensus was that they needed something radically new. And at that time, with the first fighter jets having already entered production, there was one obvious path forward: in the future, everyone agreed, airliners would be turbine-powered.
Up until that point, every commercial airplane had been powered by piston engines which were not fundamentally different from the internal combustion engines in traditional automobiles. These engines were loud, inefficient, and suffered frequent breakdowns due to the large number of moving parts. In contrast, some of the latest military aircraft designed during the last stages of WWII had been equipped with newly developed turbojet engines, which sucked in air through an intake, accelerated it through a series of turbine-driven compressors, and ejected it as exhaust to produce thrust. These engines were not the same as modern jet engines, which are turbofans rather than turbojets; the difference lies in the presence of a “fan,” which accelerates bypass air around the outside of the engine core to increase thrust. Turbofans had not yet been invented in the 1940s, and the turbojet engines then in use were quite primitive in comparison, with a narrow air intake leading directly to the compressor stages without the characteristic fans that are now closely associated with the very concept of a jet engine.
The idea of powering a commercial airplane using turbojets was novel, but popular, and Britain was not the only country to propose such a design at around the same time. With competition looming, Britain’s Ministry of Supply chose to invest heavily in an early proposal by a well-established manufacturer, the de Havilland Aircraft Company, which had gained experience with jet engines while developing the Vampire fighter jet. De Havilland was confident that they could apply what they had learned to the development of a new passenger airliner.
Although jet engines promised to cut air travel times in half, they presented a number of then-unexplored engineering challenges. One of the most significant issues was that jet engines are most efficient at very high altitudes above 30,000 feet, and efficiency drops precipitously closer to the ground, where the air is more dense and temperatures are higher. Therefore, for a jet airliner to be economical, it would need to be able to cruise between 35,000 and 40,000 feet, where the oxygen quantity is much too low to sustain human life. The answer, of course, was to pressurize the fuselage to improve the oxygen concentration available to the occupants, which was not a new idea. Several piston-engine airliners with pressurized cabins were already entering service in the 1940s, including the Lockheed Constellation, which had been carrying passengers for TWA since 1945. However, these airplanes cruised at altitudes no higher than 25,000 feet, and no one had ever built a fuselage which could withstand the relatively poorly understood conditions at 40,000.
Between 1946 and 1949, de Havilland engineers worked feverishly to design their new airliner, christened the Comet I. By modern jet standards, the plane was rather diminutive, with room for only 36 to 44 passengers, although travelers today would find its seating unimaginably spacious, with sufficient room for every seat to lean back almost into a comfortable sleeping position. Its jet age comforts were complemented by its sleek and futuristic look, featuring four de Havilland Ghost engines built directly into the wing roots, giving the plane the appearance — to propeller-accustomed observers — of having no engines at all.
Supported by a firm order from the state-owned British Overseas Airways Corporation, or BOAC, the company was able to overcome numerous technical challenges, and the first prototype took to the air in July 1949, less than three years after development began in September 1946. Although this development appears lightning-fast today, it was actually considered rather lengthy at the time. Still, some pressure was evident, and in fact just 13 days after the Comet’s first flight, Avro Canada conducted a successful test flight of its own jet airliner, nicknamed the “Jetliner.” Although this aircraft helped popularize the term “jetliner” to refer to all jet-powered airliners, it would never enter production. The Comet project, by contrast, was moving full steam ahead.
One of the engineering challenges faced, and thought to be overcome, during the development of the Comet was the question of how to design a fuselage that could withstand the repeated application of pressurization loads at 40,000 feet. At that altitude, the difference in pressure inside and outside the cabin would result in a continuous load of about 8.25 pounds per square inch (or 569 hectopascals) to the fuselage skin. Simultaneously, however, this fuselage skin needed to be thinner than on previous aircraft, for reasons of weight economy. The Comet’s thirsty turbojet engines and low fuel capacity already limited its maximum service range, and any increase in weight would restrict this range even further, making the aircraft uneconomical to operate.
A thin skin combined with high pressurization loads meant that de Havilland needed to pay special attention to two safety margins: the ability of the fuselage to withstand an overpressure event, and its ability to withstand repeated applications of normal pressurization loads over thousands of flights. Today, these questions would be fairly straightforward to answer, but at the time, they required extensive testing of the proposed materials, namely aluminum, in order to clear up some unknowns about its behavior under such loads.
At the time, there were few regulations governing the design of pressurized fuselages, but one of the provisions which did exist called for a fuselage to be able to withstand a pressure load about 1.33 times the maximum load expected in flight. De Havilland went one further, pressurizing a ground-based test fuselage to twice the expected load, or 2P, about 30 times, followed by pressurization to about 1.33P a further 2,000 times. Even after this brutal testing regime, no defects in the skin were observed.
The question of the skin’s behavior under repeated loads was much less certain. The main concern was metal fatigue, or the slow breakdown of a metal component as a load is repeatedly added and removed. This weakening of the metal leads to cracks which grow progressively longer with every cycle until the normal operating load exceeds the ultimate strength of the material, resulting in its failure.
In terms of dealing with metal fatigue of the fuselage, designers of early pressurized airliners generally took one of two approaches: the “failsafe” approach, or the “safe life” approach. The failsafe approach to fuselage design held that the life span of the fuselage was indeterminate, so long as it was possible to detect and repair fatigue cracks in a timely manner, and as long as a fatigue failure of the fuselage would not result in the loss of the airplane. All airliners today are designed under this principle, and it has been the standard since the Boeing 707 entered service in 1958. But this technique adds weight and complexity due to the need for internal stops that divert crack growth. (For more information on this topic, see my article on Aloha Airlines flight 243.) Because the designers of the Comet had such poor weight and performance margins to work with, this method was rejected in favor of the “safe life” approach. Under a safe life approach, there were no redundancies in the event of a fatigue failure of the fuselage, but the plane itself would come with a fixed service life limit (expressed in terms of number of flights) which was comfortably beneath the minimum probable time to fatigue failure. In the case of the Comet, de Havilland built the aircraft with an expected operating life of 10 years and 10,000 flights, which was considered plenty at the time, although it would be pitifully little today — by contrast, the expected service life of the Boeing 737–200, which entered service in 1968, was 20 years and 75,000 flights, with additional use possible given diligent maintenance, thanks to the failsafe design principle.
In 1949, there was no requirement that a manufacturer actually test a representative pressurized fuselage to determine its fatigue life, and the normal approach was to simply over-engineer the skin so as to preclude any likelihood of failure within the proposed service life. This had worked adequately on non-pressurized airliners, because their fuselages were subject to much less cyclical loading. But for a pressurized fuselage where premature breakdown was a serious concern, there seemed to be no easy solution. Research at the time had already shown that the minimum and maximum times to fatigue failure in nominally identical aluminum components could be separated by as much an order of magnitude, meaning that it was hard to find the lower bound by empirically testing any reasonable number of fuselages. The only solution was to use math to prove that the skin was so strong as to permit no possibility of fatigue cracking within its planned service life. In practice, this meant determining the location of highest stress within the fuselage, and ensuring that the maximum in-service stress at that location was sufficiently far below the ultimate strength of the material. This method took advantage of an inherent engineering property of metal; namely, the fact that there is a correlation between the rate of fatigue of the metal and the ratio of its operating stress to its ultimate strength.
The ultimate strength of a material is the maximum load that it can withstand before failing. Through the progressive introduction of cracks, metal fatigue slowly reduces this ultimate strength until it drops below the normal operating load, resulting in a catastrophic failure. If the ultimate strength is much higher than the operating load, then fatigue will develop slowly; and conversely, an operating load close to the ultimate strength will result in rapid fatigue. Therefore, this ratio can be used as a convenient stand-in for estimating the fatigue life, and a particular target ratio (its exact value depends on the material) can be used as a benchmark to ensure that the fatigue life is long enough.
For the type and thickness of the metal used in the Comet’s fuselage skin, de Havilland arrived at an ultimate strength of 65,000 pounds per square inch (psi). The next question, then, concerned the location on the fuselage which would be subjected to the most stress during normal operation. Unless a pressure vessel is a perfect unbroken sphere, the distribution of stress will not be uniform, because stress tends to build up in places where a load must travel around a discontinuity, such as a corner, a hole, or a defect. This phenomenon is called “stress concentration,” and the sharper the angle around which the stress must travel, the greater that concentration will be. You probably observe this phenomenon yourself every time you open a plastic package: ripping into the package can be quite difficult, unless you use scissors to make a small cut first, in which case the material will tear easily. This is because the sharp end of the cut more effectively concentrates the load that you’re applying to the material.
On the Comet fuselage, the locations subject to the highest stress concentration were the corners of the windows and doors. The engineers were well aware that stress would build up at these corners, but after conducting a series of complex calculations, they arrived at a maximum operating stress in these areas of 28,000 psi, which was considered adequate. Indeed, an operating stress to ultimate strength ratio of 28:65 should have produced a fatigue life well in excess of 10,000 cycles.
◊◊◊
After years of development and extensive test flying, the Comet was finally deemed ready for service in early 1952. Britain’s Air Registration Board proudly granted the aircraft its airworthiness type certificate, and on May 2nd, 1952, the first scheduled passenger flight on a jet airliner took off from London Heathrow, operated by the Comet G-ALYP. The passengers, including numerous journalists, marveled at the view from 40,000 feet, which few people had ever seen; they also commented favorably on the quietness of the engines, which was said to be such an improvement over piston engines that new Comet pilots sometimes forgot they were at high power and neglected to roll back the throttles for cruise. The editors of Popular Science even proclaimed that on board the Comet, there would be “no noise” whatsoever. Nevertheless, their wonder should be put in perspective — if the Comet were still operating today, it would be the noisiest airliner in the sky.
The first flights were a success, and before long Comets were carrying passengers back and forth between Britain and the Far East for BOAC, cutting the airline’s travel time between London and Tokyo from 86 to 36 hours. What’s more, the simpler engines saved on maintenance costs, and the passengers enjoyed a more comfortable ride, as the Comet could fly above most bad weather. Orders soon began to pour in, especially for proposed future versions of the Comet, which promised to be larger and faster. Among them was America’s de facto flag carrier Pan Am, whose orders for the upcoming Comet II were seen as a triumph of British engineering in the American market.
The Comet’s first year and a half of service was not without mishap, however. On October 26, 1952, a BOAC Comet slid off the end of the runway during a failed takeoff from Rome; thankfully no one was killed, but the plane was written off. Then on March 3rd, 1953, disaster struck again: as a brand new Comet, bound for Canadian Pacific Airlines, departed Karachi, Pakistan during its initial delivery flight, the plane failed to become airborne and crashed in flames off the end of the runway, killing all 11 crew and support staff on board, including several de Havilland engineers. Disturbed by the crash, Canadian Pacific immediately cancelled its remaining orders.
The causes of both crashes were similar: the pilots had rotated for liftoff too early, causing more of the airplane to face into the airstream; this resulted in extra drag which made it impossible to achieve the takeoff speed. These misjudged takeoffs likely had to do with their pilots’ lack of familiarity with the high-performance Comet, leading to a tendency toward overcontrol of the aircraft. This problem was also exacerbated during night takeoffs by the design of the attitude indicator, which was not marked in degrees, even though the plane would fail to become airborne if the pilot pitched up beyond a rather specific pitch angle.
Neither of these accidents killed paying passengers, but it wouldn’t be long before a more serious disaster befell the Comet. On the 2nd of May 1953, exactly one year after the type entered service, a BOAC Comet with six crew and 37 passengers aboard departed Calcutta, India, bound for Delhi, the next stop on a marathon Singapore-to-London service. The initial climb was normal, but the plane soon vanished into a severe thunderstorm. Two minutes after takeoff, the pilots reported that they were climbing to 32,000 feet, but no further transmissions were received. Four minutes later, when the plane would have been at about 7,500 feet, witnesses on the ground 40 kilometers west of Calcutta heard a massive explosion and saw fire falling from the sky. The wreckage was soon found spread over a considerable area, with no signs of survivors; all 43 people on board were dead.
An investigation by Indian authorities found that the horizontal stabilizer had separated in flight, resulting in a catastrophic mid-air breakup. The reason for the failure of the stabilizer was uncertain, but it was probably either due to an extreme gust inside the thunderstorm, or due to excessive G-forces during recovery from a pilot-induced dive triggered by a severe turbulence encounter (similar to the events described in my article on the 1963 crash of Northwest Orient flight 705). Either way, the structural integrity of the Comet did not appear to be in question.
◊◊◊
As these events were occurring, increased knowledge of metal fatigue in service led Britain’s Air Registration Board to introduce a new rule requiring that manufacturers of pressurized aircraft fatigue test a representative fuselage to at least 15,000 cycles, in order to demonstrate that it would, in fact, last this long without failing. This rule was applied retroactively to the Comet, so de Havilland resurrected its test fuselage, then pressurized and depressurized it 16,000 times over the course of July 1953. At that point, having completed 18,000 cycles during its lifetime, the fuselage failed due to fatigue cracking near the corner of a technical window. Since this was considerably more than the plane’s 10,000-cycle service life, De Havilland was quite pleased with the results, which seemed to prove their earlier assumptions correct. The stress ratio had accurately predicted the fatigue life of the fuselage, exactly as advertised.
◊◊◊
Five months later, on the 10th of January 1954, BOAC Comet G-ALYP, the same aircraft which performed the first ever scheduled passenger jet flight, prepared to depart from Ciampino Airport in Rome on flight 781, bound for London on the eighth and final leg of its journey from Singapore. On board were 29 passengers and six crew, including a four-member flight crew consisting of 31-year-old Captain Alan Gibson, 33-year-old First Officer William Bury, and two supporting crew, Flight Engineer Francis Macdonald and Radio Officer Luke McMahon.
At 10:31 local time that morning, flight 781 took off from Rome and turned to the northwest, paralleling the Italian coast as it climbed toward its cruising altitude of 36,000 feet. The pilots provided routine position reports as they climbed, informing the Ciampino controller that they were climbing through 26,000 feet and had reached the Orbetello waypoint at 10:50. The weather was fine with only a few thin, scattered clouds.
Nearby, the pilot of a piston-engine BOAC Argonaut heard Captain Gibson issue his report and asked him about the cloud conditions. Gibson had mentioned these conditions a few minutes earlier, a fact to which he thought to draw the Argonaut’s attention. Using pre-NATO phonetic shorthand for the aircraft callsigns, he said, “George How Jig from George Yoke Peter, did you get my — ”
At that precise moment, as it was climbing through about 27,000 feet, the Comet’s roof dramatically ripped open, causing an immediate explosive decompression. The force of the blast ripped passenger seats out of the floor and dashed their unbelted occupants against the airframe and each other, instantly killing numerous people. In the blink of an eye, the fatally compromised aircraft structure disintegrated utterly, the rear section folding away at the aft wing spar, followed by the forward section a split second later. The intact center wing section pitched violently downward, turning completely inverted in less than a second, resulting in the catastrophic failure of all four engines due to sheer gyroscopic inertia. Both wingtips immediately failed in overload, splitting open the fuel tanks and liberating large quantities of fuel, which ignited into a fireball, streaking like a literal comet through the skies off the coast of Italy.
Far below, fishermen near the island of Elba heard a loud sound and looked up to see a fire in the sky descending. Struck with horror, they watched as great chunks of the airplane spiraled to their doom, turning around and around as they fell, until at last they struck the water, and the blazing remnants of the aircraft vanished into a blue-grey sea.
◊◊◊
About two hours later, reports of the Comet’s sudden demise finally reached authorities on the island of Elba, who swiftly launched a search and rescue operation in the strait between Elba and the neighboring island of Montecristo. As all available vessels hurried to the scene, they found the surface strewn with the sad flotsam of a flight gone suddenly awry, including cabin furnishings, baggage, and the bodies of 15 victims. No survivors were found, and all 35 people on board were soon presumed dead, the remainder having sunk with the aircraft to the bottom of the sea.
In both London and Rome, aviation authorities quickly maneuvered to respond to the crash, launching a major investigation. At the same time, BOAC, fearing a possible mechanical fault, grounded its Comets until more was known, although the company was quick to argue (rather facetiously) that since the move was voluntary, it was not technically a “grounding.” Several other Comet operators followed suit, although at least one, the Royal Canadian Air Force, kept its planes in the air. Others, meanwhile, speculated quite openly that the crash was no accident, but the result of a bomb — after all, why else would such an esteemed aircraft simply explode without warning?
As the inquiry got underway, Italian authorities, who had jurisdiction under international law, elected to hand the reins over to Britain, which possessed more expansive expertise, facilities, and access to witnesses. The Royal Navy was ordered to collect as much debris as possible, with the response to the crash placed in the hands of Admiral Louis Mountbatten, 1st Earl Mountbatten of Burma and great uncle of King Charles III. On the civilian side, the technical investigation was led by Arnold Hall of the Royal Aircraft Establishment (RAE), a state-run aerospace research organization controlled by the War Office (now the Ministry of Defense). He would later be joined by the Honorable Lord Cohen, a judge who would be tasked with overseeing the public inquiry and making a ruling as to the cause.
Meanwhile, an emergency meeting was held between representatives of BOAC, de Havilland, and the Air Registration Board (ARB) in order to list possible causes of the crash and find actions which could be taken to preclude their recurrence. With the airplane having fallen into the sea, at a time when underwater recovery was in its infancy, there was doubt that the cause would ever be found, and BOAC couldn’t keep its Comets on the ground forever because of a single mysterious crash. At the same time, however, it would be imprudent to release them once more for service without modification. The ARB agreed, and a list of potential problems was drawn up, including such disparate causes as control surface flutter, control system failure, structural overload due to turbulence, fatigue of the structure, explosive decompression by overpressure, and engine fire. Several dozen modifications were then proposed in order to address any vulnerability in these areas which de Havilland’s engineers could envision, hoping that this “spatter” technique might incidentally address the defect which caused the crash, even if the wreckage was not recovered.
Although fatigue of the structure was among the possibilities considered, de Havilland had in mind fatigue of the wings, since testing on a fuselage specimen had recently revealed the presence of cracks in the wheel well area after 6,700 flight cycles. The ill-fated Comet, G-ALYP, had crashed on only its 1,290th flight, but with only one sample of the phenomenon, the length of time to fatigue was still essentially unknown, and the issue could not be ruled out as a potential cause. As for fatigue of the fuselage skin, the possibility was not seriously considered — after all, de Havilland’s calculations, backed up by experimental evidence, had shown that the fuselage should be resistant to fatigue until much later in its life cycle. Instead, de Havilland and BOAC agreed that in their view, the most likely cause was not a structural problem at all, but the explosion of an engine, leading to wing failure.
Back at Elba, meanwhile, the Royal Navy had dispatched three specialized ships to search for the wreckage of the Comet. With the debris believed to lie at a depth of between 130 and 180 meters, well below the reach of divers, the ambitious project was the deepest recovery of a crashed aircraft yet attempted, and it would also be the first to involve the use of an underwater television camera to broadcast images of the sea floor back to the surface. This approach quickly paid off, as within the first few weeks of the search, the cameras detected several large pieces of debris, including the tail section and parts of the center wing area, which were hauled to the surface by floating cranes.
After transporting the recovered debris to Farnborough Airport, headquarters of the RAE, investigators attached each piece to a frame in order to reconstruct the aircraft from the ground up. As each piece was added, they examined it in detail for clues about the sequence and cause of the aircraft’s breakup. Much of this analysis would require months of study, but a few things stood out right away. Most notably, the tail section showed evidence of having been struck by objects from inside the cabin, leaving behind smears of blue paint from the passenger seats, and a piece of carpet was found embedded in the tail. These discoveries suggested that the pressure cabin had failed, resulting in the ejection of its contents, but they did not reveal whether this was the cause of the accident, or its result. That could only be determined by recovering more debris, particularly from the center section. The tail, on the other hand, was ruled out, since evidence indicated that it had struck the sea more or less intact, having fallen whole from 27,000 feet. Similarly, none of the wreckage showed signs of having been exposed to an explosive device, and the possibility of sabotage was officially discarded.
Over the course of January, February, and March, BOAC and de Havilland worked to implement all of the modifications which had been proposed at the emergency meeting, and by March 23rd the work was nearing its conclusion. On that day, BOAC announced its intention to resume Comet services, provided that the Air Registration Board and the Air Safety Board, an advisor body, agreed. Both agencies swiftly granted their blessing to the plan, with the ARB noting that everything in the companies’ power had been done to make the Comets safe, and that it had never been, and was not now, the Board’s policy to enforce the indefinite grounding of an aircraft type in the absence of specific evidence that it was faulty. Shortly afterward, the Comet took the air once more, having been grounded for two and a half months.
◊◊◊
Just over two weeks later, on the 8th of April 1954, another Comet, G-ALYY, arrived in Rome after a flight from London. Owned by BOAC, the Comet was on loan to South African Airways, which had dispatched its own crew to fly the plane on its London-to-Johannesburg service. With 14 passengers and a crew of seven — SAA’s roster added a navigator — the aircraft departed Rome, bound for Cairo, at 19:32, turned southeast, and began climbing to 35,000 feet. At 19:57, the pilot reported that they were abeam Naples and still climbing; eight minutes later, at 20:05, the crew informed Cairo that they had departed Rome and provided their expected arrival time. But after that, no more was heard.
At that moment, as the plane approached 35,000 feet, it exploded without warning, broke into several sections, and plunged from the sky. Over several minutes, the flaming wreckage spiraled down from the heavens, until it finally slammed into the Tyrrhenian Sea southeast of Naples and sank beneath the waves, never to be seen again.
It took time for news to spread and a search to be mounted, and the first Royal Navy vessels did not arrive until the following day. Upon reaching the scene, they found a few items of light floating debris, the bodies of six victims, and a few personal effects, including a letter whose author had apparently been interrupted mid-composition. However, the rest of the wreckage and human remains had sunk to a depth between 950 and 1,060 meters, which was too deep to recover with the technology available in 1954.
It was nevertheless apparent that whatever brought down South African Airways flight 201 was probably similar or even the same as the culprit behind BOAC flight 781. Both flights had disintegrated at high altitude without a distress call while still climbing, and both sets of victims showed evidence of having been exposed to an explosive decompression, followed by blunt impacts resulting in death. In light of these similarities, it was decided that the investigation into the crash of G-ALYY should be subsumed into the existing investigation into the loss of G-ALYP, and that a common cause would be presumed.
The occurrence of a second Comet disaster just 15 days after the type returned to service came as a shock to everyone involved, and resulted in immediate public uproar. The ARB swiftly moved to revoke the Comet’s type certificate, forcing all operators around the world to ground the aircraft until further notice. For the foreseeable future, no jet airliners would ply the world’s airways — a massive step backward for British aviation. Under pressure to salvage Britain’s reputation as a first rate maker of passenger aircraft, Prime Minister Winston Churchill declared, “The cost of solving the Comet mystery must be reckoned neither in money nor in manpower.”
The fact that none of de Havilland’s design modifications prevented the crash of flight 201 provided a clue in and of itself. Both airplanes had clearly disintegrated in flight without evidence of sabotage, de Havilland had already fixed the known issues with the wings, and the tail had already been absolved of any role. That left one obvious suspect: the fuselage itself, which was not modified during the grounding, and whose failure would be consistent with the clues discovered thus far. De Havilland remained skeptical; after all, G-ALYY had completed only 900 flights at the time of the crash, even less than G-ALYP. But investigators had begun to suspect that de Havilland’s calculations were not all they were cracked up to be, and within days, Arnold Hall and the RAE resolved to put their theory to the test.
At an RAE testing facility, investigators placed the fuselage of an existing Comet, G-ALYU, inside a tank which would simulate pressurization loads using water rather than air. Because water is not compressible, this would reduce the severity of the fuselage’s eventual failure, causing it to simply split open as opposed to violently exploding, as the two ill-fated Comets had done. Furthermore, to prevent the weight of the water inside the fuselage from affecting the results, the entire fuselage itself was also immersed in water, while pumps were used to force more water into the interior until the pressure differential reached a value of 8.25 psi, equal to the normal pressurization load in flight. Special rigs would then flex the wings to simulate turbulence, among other considerations, and then the water would be pumped back out again, completing the cycle. Using this method, investigators could subject the fuselage to the equivalent of one flight cycle every ten minutes. The plan was to run the simulation 24/7 until the fuselage failed.
In early June 1954, the test began. All day, every day, for several weeks it continued, slowly racking up cycles. The plane had already completed 1,230 flights before the testing started, and the simulation increased this total to 3,059, until finally, on cycle number 3,060, the fuselage burst with a muffled “pop.”
Upon inspection, the investigators found that fatigue cracks had developed at the corner of an emergency escape hatch, then spread out through the fuselage skin until it failed. Such a failure after 3,000 cycles was entirely consistent with the time to failure of both lost Comets, which failed at 1,290 and 900 cycles respectively, given the known distribution of possible lifespans in nominally identical components. Furthermore, it was quite logical that the first in-service failures would occur at a lower number of cycles than the experimental average. And in any case, the result was more consistent with the data from the crashed Comets than it was with de Havilland’s now-discredited prediction of 18,000 cycles. But that left engineers and investigators with two burning questions: first, why was the fuselage’s lifespan so short; and second, why had the original stress calculations and fatigue tests failed to reveal the problem?
One potential vulnerability in the stress calculations was their level of precision. De Havilland had calculated a maximum operating stress of 28,000 psi at the corners of the windows and doors, but investigators noted that this value was an average over an area of 2–3 square inches (13–19 square centimeters), meaning that in theory, highly localized stresses could be considerably greater. This “peak stress” could have been measured through the liberal application of strain gauges, but de Havilland had apparently elected not to attempt this, believing that any more precise measurements would be unreliable. Nevertheless, investigators measured it anyway, and from these data they calculated a localized peak stress at the window corners of up to 45,000 psi under normal pressurization conditions. Not only was this much greater than de Havilland’s predicted value, its relative proximity to the ultimate strength of the material (estimated to be 65,000 psi) produced an unfavorable stress ratio correlating to an expected fatigue life considerably below 10,000 cycles.
De Havilland’s mistake was in believing that they needed to calculate anything less than the absolute peak stress over the smallest possible area. As it turns out, metal fatigue doesn’t care how small the area of peak stress is — cracks will develop regardless.
As for why de Havilland’s test fuselage survived to 18,000 cycles, investigators came up with a plausible theory, which has only been further substantiated by the passage of time. Specifically, the problem was that the fatigue test was accomplished using the same sample fuselage which had previously been used to prove the design’s resistance to high pressurization loads. The 30 tests to a pressure of 2P, followed by 2,000 more tests to a value somewhat above P (P being 8.25 psi), inadvertently subjected this airframe to a metalworking technique designed to improve the lifespan of a product. By stressing the material to close to its ultimate strength prior to its entry into service — a technique known as “cold working” — the tests caused plastic deformations of the fuselage skin in the areas subjected to peak stress. This deformation actually relieved the stress in these areas to the point that the fatigue life of the fuselage was substantially increased, allowing it to reach 18,000 cycles before failing. In contrast, the fuselages of actual, production Comets were not “cold worked” before starting passenger flights, so the corners of their windows and doors remained dangerously brittle.
The cause of the Comet disasters was by now slowly revealing itself, piece by piece, but investigators still lacked one key element: hard, physical proof that fatigue of the fuselage at the corner of a window or door brought down BOAC flight 781. By August 1954, some 70% of the aircraft had been recovered, and the sequence of its breakup was starting to become clear, with all signs pointing toward an initiating failure near the top of the center fuselage. However, this part of the skin had yet to be found.
In an effort to locate it, investigators ordered the systematic trawling of the seabed across an ever-expanding area around the main point of impact, recovering anything that could be swept up in the trawler nets. It didn’t take long before they found exactly what they were looking for: a large chunk of the upper fuselage from the area above the forward spar, near the leading edge of the wings. This section contained two small windows for the automatic direction finder (ADF) antennas, which also happened to be the windows which precipitated the eventual fatigue failure of de Havilland’s test fuselage back in 1953. And there, originating from a rivet hole near the starboard corner of the rear ADF window, then stretching aft along the spine of the fuselage, was a fatigue crack.
◊◊◊
The discovery that de Havilland had drastically overestimated the lifespan of the Comet’s fuselage led to major changes in the way engineers design pressurized airplanes. Given that the fuselage is such a complex piece of equipment with many areas of elevated stress and variable load paths, the “safe life” approach was all but abandoned in favor of the “failsafe” approach, which reduced the danger of getting things wrong. The findings also led to awareness that separate sample fuselages had to be used for overpressure and fatigue testing. But most of all, the twin disasters drove home the fact that when building such a high-performance machine, rules of thumb and rough calculations simply aren’t good enough. A manufacturer must calculate the distribution of stress with a great degree of precision, and all load paths through the skin must be carefully predicted, mapped, and analyzed. It remains true that physical testing of a large enough sample of fuselages to determine a design’s minimum fatigue life is impracticable, but sufficient indirect assurance against premature failure can only be achieved through the development of a complete understanding of how the material behaves on both macro and micro levels. This was what was missing from de Havilland’s design — the aircraft got ahead of its engineers, who, in following the practices of the time, succumbed to the danger of “unknown unknowns.” There was a lot they didn’t know about their own aircraft, but even more critically, they didn’t know that they actually needed to know everything.
◊◊◊
Ultimately, the crash dashed any hope of the Comet becoming a commercial success. All outstanding orders were cancelled, and the type remained grounded for four years as de Havilland completely overhauled the design of its fuselage. All existing Comet airframes were permanently removed from service, as there was no way to render them safe. In the meantime, de Havilland produced two more successive prototypes, the Comet 2 and Comet 3, which eventually led to the Comet 4, a much improved version with more passenger seats, greater fuel capacity, a thicker fuselage skin, and a closer overall resemblance to jet airliners as we know them today, both in terms of appearance and safety systems. The Comet 4 entered service in September 1958, but by then, it was no longer a novelty. The Soviet Union had beaten it to the punch, as the Tupolev Tu-104, launched in 1956, became the only operational passenger jet in the world for a period of two years. And more was to come: just weeks after the Comet’s return to service, Boeing launched its 707, and Douglas followed with the DC-8 in 1959. Both aircraft proved far superior in service, and in the end, only 76 Comet 4s were ordered. Furthermore, most of these airlines quickly moved them off of their primary routes, and by the 1970s, second-tier British airline Dan-Air was the only carrier still operating the type, with 49 in its fleet. The last Comet passenger flight was operated by Dan-Air in 1981, but a military derivative, the Hawker-Siddeley Nimrod, flew until 2011.
◊◊◊
Many readers familiar with the Comet disasters might be wondering why, with this article drawing to its close, I have yet to utter the phrase “square windows.” But the truth is that “square windows” never had anything to do with the Comet crashes. The windows were not and never were square — in fact, you can see for yourself in the above image, which shows a Comet 1 window next to a modern Boeing 737 window. Can you tell which is which? You probably can, but not because one is any more “square” than the other.
The cause of the Comet’s difficulties was not the shape of its windows, but de Havilland’s failure to predict the complex load pathways and stress concentrations in the material. And in terms of fundamental design deficiencies, the most significant fact was that the fuselage skin was simply too thin, leaving it unable to withstand the local stresses generated around its perfectly normal-shaped windows. The lessons of the twin disasters were therefore much more profound than the oft-repeated concluding line, “and no one ever built a jet with square windows again.” In reality, no one was ever that stupid! But the Comet crashes did fundamentally alter the process of designing airliners, bringing about a more thorough and regimented approach to the problem of metal fatigue. And the inquiry was a milestone of its own, establishing many of the techniques which form the basis of modern investigative practice, from mathematical modeling to underwater recovery. The story of the Comet, then, is a tale of firsts, both the positive kind, and the dangerous kind — the perils of pushing into the unknown. The solution to the Comet mystery was not reckoned in money or manpower, but neither was its creation. The only thing that would have saved the Comet was knowledge, but in the history of human innovation, seldom have we learned what we must do without first learning what we must not.
_______________________________________________________________
Join the discussion of this article on Reddit
Support me on Patreon (Note: I do not earn money from views on Medium!)
Visit r/admiralcloudberg to read and discuss over 240 similar articles
