Sean Brady recounts the tale of the Comet jet airliner crashes of the 1950s and explains how the trailblazing accident investigation revealed a failure of imagination that holds lessons for all engineers. 

It is the morning of January 10, 1954, and a British Overseas Airways Corporation (BOAC) aircraft takes off from Rome. Its destination is London(1). The weather is mild and there are 29 passengers and six crew on board. At 10.50am the plane radios that it’s climbing to a cruising altitude of 10,973m.

Then in another transmission it’s cut off, literally mid-sentence, as if the plane has ceased to exist(2). Off the coast of the island of Elba, a number of fishermen are repairing nets when they hear a sound like thunder. Then they see a shocking sight.

Flaming wreckage is hurtling out of the clouds towards the sea. The fishermen investigate and find debris and bodies floating in the water. But this isn’t just a plane crash. It’s a plane crash that sets in motion a series of events that changes the world of aviation. And it contains lessons for all engineers, regardless of profession. 

The Comet

The British de Havilland Comet (Figure 1) went into service in 1952, and was the world’s first commercial jet aircraft(2). It could travel at twice the speed of existing propeller planes, and flew twice as high, up in the rarefied atmosphere.

There were some very good benefits from travelling so high: one was cold air, which made the jet engines more efficient; the other was that it flew above bad weather, which made it possible to stick to flight schedules regardless of the meteorological conditions. So, these Comets were a great leap forward for international travel.

One of the challenges of flying so high, however, was the need to keep the air inside the aircraft at a similar pressure to that at ground level, making the flight more comfortable for the crew and passengers. But this meant that, at cruising height, the air pressure inside the aircraft was higher than that on the outside – the plane was an inflated balloon with a 0.71mm thick aluminium skin.

Every single Comet put into service was tested to ensure it could withstand this pressure by a comfortable margin. But there had been some issues. There were a number of incidents during take-off. One was non-fatal, the other killed everybody on board, and both were blamed on pilot error. Then, on the first anniversary of the Comet going into service – May 2, 1953 – one of the planes suddenly disintegrated after take-off from Calcutta, India.

All 43 people on board were killed. But because it occurred in a violent thunderstorm, the storm got the blame for the crash: the plane was either subjected to high stresses or the pilot was trying to overcompensate when controlling the aircraft(3). Nothing was found to suggest there was anything systemically wrong with the Comet.

Elba crash

Now we return to where our story began: it is January 10, 1954, only eight months after the Calcutta disaster, and a Comet crashes at Elba and kills 35 people. On this day, there is no bad weather to take the blame and the plane was in no distress, which we know because the pilot was cut off mid-sentence. And to make matters worse, the plane had crashed into 150m of water, so retrieving evidence was going to be very difficult.

The mystery fuelled the usual sort of speculation: sabotage, or even a bomb – what else could have brought down such a sophisticated machine?(2) But the autopsies performed on the bodies found no evidence of a bomb blast, although they did find strange injuries that had occurred before the victims died: fractured skulls and ruptured lungs. 

It was with this background that Winston Churchill – British prime minister at the time – decided that something had to be done, and he dispatched the Royal Navy to recover the plane from the waters around Elba. It would prove a mammoth task.

First they had to find the plane, then retrieve it. But slowly they began taking it up piece by piece and bringing it back to the UK, where they’d built a wooden skeleton of the Comet to which they attached each of the retrieved fragments.

While this is a familiar sight nowadays to fans of air crash investigations, it was here that the practice started on such a large scale. And then they found the plane’s tail, and it provided insight into the failure sequence: forward parts of the plane were torn open before the rear failed; this was evident because air rushing into the open fuselage had slammed passengers’ possessions back up into the tail of the craft, where they still remained. A coin had been thrown into the tail so violently that it had left a visible imprint on the wall.

Fatal decision

Meanwhile, the Comet fleet was grounded, and this was having a huge impact on BOAC. Commercial and political pressure was mounting to put the planes back into service. By this stage, they had been examined for weakness and some structural modifications had been made.

So, within 10 weeks of the crash at Elba, with the cause of that crash still not having been identified, the Comets were put back into service. But this decision would turn out to be a horrible mistake. On April 8, 1954, just three months after the Elba crash and only 16 days after the resumption of flying, another Comet took off from Rome.

Again the weather was good. Again a Comet exploded in mid-air. Again everybody on board was killed – all 21 people. And again their autopsies showed the same horrific head injuries and ruptured lungs. This wreckage fell into the sea near Naples, where the water was 1,000m deep. It couldn’t be recovered, so now it was more important than ever to retrieve the Elba wreckage – it was the only evidence they were likely to find.

And finding any available wreckage was now paramount because the Naples crash brought with it a very disturbing realisation: might this crash and the Elba crash – both mid-air disintegrations – have the same cause?

Even more disturbing, did both these disintegrations have the same cause as the mid-air disintegration that happened in India during the storm? Did the storm actually mask the true cause of that failure? Because it was now looking like there was a fatal flaw in the Comet’s design.

Churchill took serious steps. He put Sir Arnold Hall, chief of the Royal Aircraft Establishment based at Farnborough, in charge of investigating the cause of the crashes. Churchill told him to spare nothing in the quest to discover what went wrong. They had to get to the bottom of it – the reputation of British aviation was on the line.

Investigation

The navy continued to retrieve the debris from around Elba, the investigators continued attaching it to their wooden skeleton, and all the evidence pointed to the plane violently tearing itself apart. So the team decided to investigate what happens when a pressurised aircraft ruptures.

They built a one-tenth scale model of a fuselage, including models of passengers and seats, pressurised it, then ruptured it. As the pressurised air screamed out of the model, the seats were torn up and slammed into the fuselage roof – which explained the victims’ head injuries.

And the sudden depressurisation also explained the lung damage – the air pressure inside the passengers’ lungs would have suddenly become higher than the surrounding air and they’d have ruptured. But how could a fuselage rupture because of internal pressure?

The aircraft had been designed to withstand a pressure of 138kPa, which was two-and-a-half times greater than the in-service pressure expected during a normal flight (57kPa). And each and every plane was tested with twice this pressure (114kPa) before it went into service. But Hall and the team had a theory.

Metal fatigue

As I’m sure most of us know, fatigue failures occur when we apply a critical magnitude of stress combined with a critical number of stress cycles. And Hall suspected fatigue could have been the culprit for these crashes.

Every time a Comet flew, its fuselage was pressurised, then depressurised – it experienced one cycle of stress per flight. While the designers had considered fatigue due to this pressurisation cycle, they were of the view that one cycle per flight wasn’t an issue, or at least it was an issue that was being managed by ensuring that the fuselage could resist two-and-a-half times the service pressure(3).

But was this assumption correct? Was it possible that one stress cycle per flight was enough to destroy these aircraft in a relatively short period of time? The team at Farnborough decided they wanted to find out, so they set up an experiment.

They spent six weeks building a 34m long × 7m wide × 5m deep water tank. They retired an actual Comet, stripped it out until they were left with a bare fuselage and wings, then put the fuselage in the tank with its wings sticking out the sides (Figure 2).

They filled the plane and tank with water and began the stress cycles. Additional water was pumped into the fuselage until it reached the in-service pressure. They held this pressure, then relieved it, and repeated. On the outside of the tank, hydraulic jacks flexed the wings up and down.

In a matter of minutes they were able to replicate the pressure cycle from one whole flight(2). This would go on 24 hours a day, every day. They expected it could take as long as five months to fail the plane in fatigue, equal to the Comet designers’ estimated fatigue life of 10,000 cycles or 10 years of service.

They didn’t have to wait that long. Less than one month into the test, the tank controllers noticed a sudden drop in the pressure inside the aircraft. It had sprung a leak. It had failed at 3,000 cycles, or equivalent to 3,000 pressurised flights(3). (The two planes that crashed in service had failed at an even fewer number of cycles: the Elba aircraft had failed after 1,290 pressurised flights and the Naples aircraft after 900. But the key was that all three planes had failed a lot earlier than the projected 10,000 flights(3).)

The team began draining the tank and found a massive tear beside the plane’s forward escape hatch – a crack had sprung from the corner of hatch, grew rapidly due to the stress cycles, then shot catastrophically to rip a 2.4m long gash in the fuselage (Figure 3).

There were the tell-tale signs of fatigue where the crack had originated. And this had been a controlled experiment – once the gash appeared, the water pressure had been released, which was the point of conducting the experiment with water rather than air. In service, where pressurised air would obviously be involved, the damage would have been much more extensive.

And that’s exactly what they found with the Elba debris. As more and more wreckage was retrieved, the investigators began tracking the cracks on the wreaked fuselage and were able to trace them back to a corner of a window on the plane’s roof (Figure 4).

The failure sequence then becomes apparent. Now, just imagine for a moment you’re a passenger on this flight. A crack suddenly rips across the fuselage roof. A piece of the roof then tears off, leaving a gaping hole. There’s a rapid depressurisation and your seat is flung upwards and you fracture your skull on the roof. At the same time your lungs rupture. Then the rear of the fuselage and the tail gets pulled off, then a portion of the wings, and then the nose rips off.

From this point forward the engines catch fire and what remains of the plane hurtles towards the sea. But why did this crack start? Were the designers correct in their assumption that if the fuselage could withstand two-and-a-half times the service pressure, then it wouldn’t be susceptible to fatigue? Well, no they weren’t, and Hall and his team had just demonstrated it in the water tank.

There were a number of reasons why the cracks developed and grew. One issue was that the fuselage plates were riveted together, and when these rivets were punched into the metal, they created minor defects. These defects were the birthplace for fatigue cracks. Another issue was the Comets’ square-shaped windows, which only had small rounded corners. This shape generated stress concentrations at the windows’ corners.

In other words, the square-shaped windows resulted in high stresses and these stresses, in combination with the existing rivet defects, generated the perfect situation for a fatigue failure. So, fatigue had destroyed the Comets, and it was a systemic issue. The entire fleet had a fundamental flaw.

In time, de Havilland would design a new safe Comet, the Comet 4, and it would make the first transatlantic commercial jet flight in 1958, but by this time Boeing in the USA would have taken the lead in the development of commercial jet travel.

Failure of imagination

There are two broad ways of thinking about the Comet crashes. The first is as a series of tragic engineering failures, which indeed they were. But there is also another view, a view that goes to the very heart of engineering. These Comets were a great leap forward in aviation, but so too were the lessons learnt from their failure.

These lessons provided a deeper understanding of how to design and build a new generation of aircraft. It’s been said that Boeing took the lead in jet development precisely because of the lessons learnt the hard way by de Havilland.

But these lessons only existed because the failures were diligently investigated. Performing a full-scale test to destruction on a real aircraft was a pretty serious commitment to finding out what went wrong. And what went wrong gives us a fascinating insight into the limitations of engineering.

And these limitations were really the limitation of our imagination as engineers. While we may have all the analysis techniques in the world, we can still only analyse and design for the situations we can actually imagine. And the designers of the Comet couldn’t imagine that one fatigue cycle per flight could destroy their plane – these failures broadened their horizons.

There is a wonderful line by author DD Dempster, who wrote about the Comet back in 1959. He said: "No aircraft has contributed more to safety in the jet age than the Comet. The lessons it taught the world of aeronautics live in every jet airliner flying today"(5).

So, the next time you’re on a plane, take a break from the book or magazine you’re reading, or the film you’re watching, or the podcast you’re listening to, and take a look at the window nearest you. It’s oval or round(2). One of the more visible reminders of the legacy of the Comet crashes.

Author: Dr Sean Brady is the managing director of Brady Heywood. The firm provides forensic and investigative structural engineering services and specialises in determining the cause of engineering failure and non-performance. Web: www.bradyheywood.com.au Twitter: @BradyHeywood Podcast: available on iTunes or at www.bradyheywood.libsyn.com 

References 

1) Serling RJ ‘Case History: BOAC Comet Crashes, Mediterranean Islands of Elba and Stromboli (1954)’, In: Dennies DP (2005) How to Organize and Run a Failure Investigation, Materials Park, OH: ASM International

2) Delatte NJ (2009) Beyond failure: Forensic case studies for civil engineers, Reston, VA: ASCE Press

3) Petroski H (1992) To engineer is human: The role of failure in successful design, New York, NY: Vintage Books

4) Ministry of Transport and Civil Aviation (1955) Civil Aircraft Accident Report of the Court of Inquiry into the Accidents to Comet G-ALYP on January 10, 1954 and Comet G-ALYY on April 8, 1954, London: HMSO

5) Dempster DD (1959) The tale of the Comet, London: Allan Wingate