History of Flights

Calcutta

On May 2, 1953, one year to the day after the maiden flight of the British-made de Havilland Comet, aircraft G-ALYV departed Calcutta Airport for Delhi as BOAC Flight 783. A few miles out of the airport, the flight encountered a severe thunderstorm. While the pilot and air traffic control were both aware of it, the storm did not appear severe enough to restrict flight through it. Furthermore, the captain was well-qualified, had considerable experience on this route, and had experience in similar weather conditions. Just six minutes after take off, while climbing to 7,500 feet, radio communication was lost. About this same time, witnesses at various ground locations saw "an aircraft coming down in a blaze of fire through severe thunderstorm and rain" and then crash into the ground. All 37 passengers and six crew members were killed.

The inquiry into the accident, directed by the Central Government of India, concluded that the crash near Calcutta was due to "structural failure of the airframe during flight through a thundersquall." They determined that one of two possibilities caused an overstressing of the plane enough to crash it: either severe gusts from the storm, or over-controlling by the pilot because of the storm. They recommended that the wreckage be more thoroughly analyzed to determine the primary failure, and that "consideration should be given" to modifying the flying characteristics of the Comet to give it more "feel" when loads are applied to the control surfaces.

Elba 

On January 10, 1954, Comet G-ALYP departed Ciampino Airport, Rome for London as BOAC Flight 781. About 20 minutes into the flight, as it was approaching 27,000 feet, transmission from the crew ceased mid-sentence, indicating a failure of the aircraft with "catastrophic suddenness." Witnesses on the island of Elba, Italy, saw the aircraft fall into the sea in flames. All 29 passengers and six crew members were killed.

While a crash investigation is normally conducted by the government or aviation authority in the country of the crash, it was determined that the British authorities would head the Elba investigation. The Comet fleet was grounded while investigation began and while de Havilland made modifications "to cover every possibility that imagination has suggested as a likely cause of the disaster." These modifications were made to address any possible cause of failure including flutter of control surfaces, primary structural failure due to gusts, flying controls, explosive decompression, engine fire, failure of a turbine blade, and fatigue of the wing. Fatigue of the fuselage was not considered as a cause at this time, nor was a modification made to compensate for it.

As these modifications were made, and while wreckage was still being recovered, the British Minister of Transport and Civil Aviation noted "the nature and extent of the modifications planned... and whilst the Calcutta disaster is completely accounted for... we cannot eliminate that the accident might have been due to some other cause which was possibly common to both disasters." Believing the unknown cause of possibly two accidents had been fixed during the massive modification project, Comet flight was resumed March 23, 1954.

Naples 

Just over two weeks later, on April 8, 1954, Comet G-ALYY departed Ciampino Airport, Rome for Cairo, as South African Airlines Flight 201, chartered through BOAC. About 40 minutes into the flight, while climbing through 35,000 feet, the aircraft experienced a catastrophic in-flight break-up and crashed into the sea near Naples. All 14 passengers and seven crew members were killed.

Immediately following this crash, BOAC suspended all Comet flights. The Airworthiness Certificate was removed from all Comet aircraft and the fleet was subsequently grounded indefinitely. It would take four years for the Comet to conduct commercial airline flights again - this time as the Comet 4.

Very minimal wreckage of the Naples aircraft was able to be recovered due to the great depth to which it had sunk - about 3,300 feet. From what was able to be recovered, it was concluded that there were no inconsistencies with "the view that the accident to Yoke Yoke [Naples] was attributable to the same cause as the accident to Yoke Peter [Elba]."

Now, with the cause of three accidents in the span of one year all possibly hinging on the findings of the Elba wreckage, efforts to recover the remaining pieces were renewed. Underwater television cameras were used for the first time. By the end of August 1954, 70% of the Elba crash had been recovered.

Fuselage Testing

With still no definitive cause, investigators decided to do full-scale tests on existing fuselages: unpressurized flight tests on G-ANAV and pressure tests on G-ALYU. To conduct the pressure tests in a safer manner, a water tank was constructed to encase the fuselage. The fuselage was submerged and filled with water, and then additional water was pumped into the cabin until the pressure inside the fuselage reached 1P, the equivalent of flight. This was then cycled to simulate many flights over the life of an aircraft. By using water instead of air, water being a much less compressible fluid, the test would be much safer and the fuselage would be able to be repaired and re-tested as necessary. Had air been used, the results would have resembled the catastrophic in-flight break-ups at Elba and Naples.

G-ALYU had undergone 1,230 pressurized flights before testing and 1,830 tank "flights" before the fuselage failed at the corner of a squarish forward escape hatch window. This failure was the pivotal evidence needed to turn the direction of the investigation towards fatigue. A scale model was next created to test the theory of fatigue failure of the fuselage at a window corner. The results were then mapped to the crash site near Elba, and a new search area created. At this new location, the aircraft's Automatic Direction Finder (ADF) windows, also squarish, were recovered within hours. The ADF windows are on the very top of the

fuselage, just forward of the wings. This piece of Elba wreckage, containing the two ADF windows and adjacent material bore the "unmistakable fingerprint of fatigue," and was determined to be the first fracture of the Elba crash.

G-ALYU withstood about 3,060 pressurized "flights," whether in the air or in the water tank. The Elba aircraft had experienced 1,290 pressurized flights. The Naples aircraft made 900 pressurized flights. All these seemed to indicate a much lower fatigue life than the 16,000 successful cycles de Havilland tested.

Even in the design stage, de Havilland knew that the Comet would be a great technological advancement. They were competing to be the first company to offer pressurized jet service to the public. Since there was little experience in the design and production of pressurized commercial airliners at the time of the Comet development, deHavilland placed special emphasis on structural testing. One area of special emphasis involved pressure testing of the fuselage at higher than normal pressures.

Both the International Civil Aviation Organization (ICAO) and the British Civil Aircraft Requirements (BCARs), the applicable regulations for any British-made civil aircraft of the day, required a design pressure of 2P and a proof test of the fuselage up to 1.33P, where "P" is the working pressure difference, or the pressure expected in normal flight. For the Comet, P was approximately 8.25 pounds per square inch (lbs/in² or psi). Neither ICAO nor the British authorities were fully aware of all the implications and effects of pressurized flight yet, so many regulations remained the same for pressurized and unpressurized aircraft, including the fatigue requirements.

De Havilland significantly exceeded the requirements in their effort to ensure the safety of their aircraft. They decided to design the fuselage to withstand up to 2.5P, and to proof test it to 2P, instead of just 1.33P. A prototype fuselage was pressurized between 1P and 2P approximately 30 times, and then pressurized to "rather over P" another 2,000 times. These two tests were to prove the fuselage as an adequate pressure vessel as well as to prove its structural integrity. Much later, in the summer of 1953 after Comets were already flying, regulations started to be published that required further fatigue testing for pressurized fuselages. Consequently, de Havilland went back and tested the same prototype fuselage with another 16,000 pressurization cycles between zero and 1P to verify its fatigue life. The fuselage finally failed at 16,000 cycles due to fatigue cracks at the corner of a squarish cabin window. The Comet's expected life was only 10,000 cycles, so cracks at 16,000 were not a concern.

Stress Concentrations at Window Corners 

De Havilland ran many tests in pre-production to prove the safety of the Comet: from pressure tests, to flight tests, to stress tests. The extensive proof testing of the fuselage was believed to be hard evidence that the Comet was safe. This experiential knowledge gained from actual testing bolstered de Havilland's confidence in their analyses. Calculations had been made for an average stress "in the neighborhood of the corners" which found the stress to be less than half the ultimate strength of the material. De Havilland did not consider further stress calculations to be any more accurate than the one already done, and preferred to rely on testing as the main evidence for the adequacy of the Comet. Following the failure of G-ALYU in the water tank however, more testing revealed stress at the window to be significantly higher than that originally determined. The testing found high stress concentrations at the window corners.

A stress concentration is a very localized area of much higher stress than the surrounding area. The stress concentrations were high specifically because of the squarish shape of the windows and window frames which is very different from the round/oval shapes of modern airplane windows. With modern windows, the stress flows freely around the curved edges with minimal build up. But with the Comets' squarish windows, stress cannot smoothly flow around the abrupt corners. This creates stress concentrations.

The following animation describes the stress concentrations associated with the squarish windows.

Although any aircraft will have varying levels of stress concentrations, the Comet's unique squarish window corners resulted in especially high stress levels. De Havilland tested their prototype to 2P, twice the expected operating pressure. The pressure overload combined with the very high stress levels at the window corners, created stress levels at the concentrations great enough to change the material characteristics at these locations. Each time de Havilland increased the pressure load, the material characteristics progressively changed. Upon achieving the highest load of 2P, these locations had fundamentally different material characteristics than a production Comet. The process by which the material characteristics changed is called cold-working.

Material Cold-Work Properties

Cold-working is not, in itself, a safety issue. The testing to 2P proved the Comet could withstand excessive pressure loads. The significant misstep was the decision to perform the fatigue test on the same prototype fuselage that had undergone the pressure test and had been cold-worked. The prototype fuselage withstood 16,000 cycles before failure, due in large part to the fundamentally different material characteristics of the cold-worked material at the window corners. This characteristic change actually improved the fatigue properties at these locations, which would mask the true fatigue vulnerability of the production Comet. The following animation describes how the material characteristics can be changed through cold-working.

The Comets that crashed at Calcutta, Elba, and Naples, and G-ALYU in the water tank, had not undergone proving tests to 2P, nor had any other production Comet. These airframes did not have the "benefit" of the application of high loads to improve their fatigue characteristics. As a result, the window corners' natural cycles of stress would quickly wear out, or fatigue, the material. The fatigue had such a great effect on the never-overloaded production fuselages that instead of 16,000 cycles of fatigue life, the Comets were only reaching about 1,000 cycles. At the end of their fatigue lives, the worn-out material would rupture catastrophically, resulting in inflight breakup.

Back to Top

Calcutta

The inquiry into the Calcutta accident found the cause of the crash to be:

"structural failure of the airframe during flight through a thunder squall. In the opinion of the court the structural failure was due to overstressing which resulted from either:

(i) Severe gusts encountered in the thunder squall, or
(ii) Over-controlling or loss of control by the pilot when flying through the thunderstorm."

The report on Elba refers to the crash at Calcutta twice. First, after a summary of the Calcutta crash, "Fatigue failure of the cabin was not then suspected as a cause and in my opinion the evidence adduced in the course of the present inquiry affords no sufficient reason for doubting the conclusion of the Indian Court." Later, Calcutta is compared to Elba saying that "whilst the Calcutta disaster is completely accounted for... we cannot eliminate that the accident might have been due to some other cause which was possibly common to both disasters."

The official cause of the Calcutta crash has never been anything other than the storm.

Elba and Naples

The Royal Aircraft Establishment report states the following about the crashes at Elba and Naples:

"We have formed the opinion that the accident at Elba was caused by structural failure of the pressure cabin, brought about by fatigue. ... Owing to the absence of wreckage, we are unable to form a definite opinion on the cause of the accident near Naples, but we draw attention to the fact that the explanation offered above for the accident at Elba appears to be applicable to that at Naples."

The Ministry Of Transport And Civil Aviation report concurs in the finding by saying, "I unhesitatingly come to the conclusion that R.A.E. were right in their conclusion that the accident at Elba was caused by structural failure of the pressure cabin in the region of the A.D.F. window, brought about by fatigue."

To read the complete accident reports, select the following:
G-ALYV at Calcutta
G-ALYP at Elba and G-ALYY at Naples
G-ALYR report on additional fatigue testing, 1960

Back to Top

Calcutta

The report on the crash at Calcutta determined the cause to be the thunderstorm and resulting overstress of the airplane from either turbulence, or overcontrol by the flight crew. The recommendations after the accident were, first, to call for a more in-depth investigation of the wreckage to find the "primary failure" to determine if there needed to be any changes to the aircraft, and second, for de Havilland to give the Comet more "feel" so the pilot would be able to gauge the air loads on the control surfaces.

Elba and Naples

The Ministry of Civil Aviation's report on the crash near Elba included many recommendations. First, further research was recommended. They recognized that more knowledge was still necessary to prevent this from happening again. The recommended research was in the areas of the ductility of aluminum alloys, stress distribution in the skin of the fuselage, and the effects of the pressure forcing stress beyond the yield stress of the material. The final recommendation was for more widespread use of strain gauges in testing.

No additional recommendations were given in the report on Naples.

Back to Top

BCAR D3-1 General Structures, Revised, 1st January 1948

BCAR D3-7 Pressure Cabin Loads, Revised, 1st July 1956

De Havilland exceeded BCAR D3-7, regulation 4.2, by testing beyond 1.33P. However, the eventual accidents of the Comets could be attributed to non-compliance with BCAR D3-1, regulation 4.5, due to their "probability of disastrous fatigue failure of the primary structure under repeated loads" being more than "extremely remote."

In BCAR D3-7, regulation 4.3.2, a statement directly relating to the Comet accidents was added a year after the Elba and Naples reports were published, saying that fatigue testing must "involve a repeated loading test on a complete pressure cabin which has not been used previously for strength test work..." Much of the 1st July 1956 revision to D3-7 pertains to lessons learned from the Comet.

Back to Top

The de Havilland DH-106 Comet 1 became the world's first pressurized civilian jet transport with its inaugural flight on May 2, 1952, flown by the Elba aircraft. Many companies were competing for this title, including the Avro Jetliner which flew its first test flight just two weeks after the Comet's first test flight in 1949. The Jetliner never reached production; however, the name has become the colloquial term for any jet airliner.

The Comet was the most technologically advanced airplane of its era. It flew faster, higher, and smoother, than anything the public had seen before. The BOAC first class cabin arrangement was luxurious and roomy. Cabin noise levels and passenger comfort were also dramatically improved over previous unpressurized airplanes.

Back to Top

The squarish windows and window frames created high stress concentrations which were not detected during testing.

The production aircraft fleet had essentially no fatigue testing to reveal that the life of the aircraft was only around 1,000 flight cycles.

Back to Top

• Fatigue testing on a fuselage which has been pressurized beyond standard operational pressure is acceptable.

The test to validate the fuselage as a pressure vessel (the testing to 2P) surpassed standard operational pressure and inadvertently cold-worked the material at the window corners. As a result, the test specimen should not then have been used for future fatigue tests. However, in the case of the Comet, the same test article was used for both tests. The same airframe underwent fatigue testing and yielded satisfactory results. Due to the previous cold-working, the test setup, and consequently the results did not reflect the fatigue characteristics of a production airplane.

Back to Top

The de Havilland DH-106 Comet 1 was the first pressurized civilian jet transport. As such, the Comet was in many ways, new technology, so there were

no precursor events. Much was still unknown about fatigue in pressurized flight. The Elba report even stated, "Enough is now known about the fundamental physics of fatigue for engineers to be aware that there is still much to be learnt." The Comet became the aircraft from which the whole aviation industry learned the fatigue behavior of pressurized fuselages. The Comet accidents themselves became precursor events for fuselage fatigue accidents that occurred years later.

Back to Top

Not long after the maiden flight of the Comet, other jets made their debuts, including the Sud Aviation Caravelle, Boeing 707, and Tupolev Tu-104. When the Airworthiness Certificate was revoked for the Comet in 1954, the door was opened other manufacturers to vie for the high performance pressurized jet aircraft market. The Comet design employed a general structural design philosophy referred to as "safe-life." Critical parts are assigned a safe amount of time, cycles, or flight-hours in which they will function properly. This "life" is determined from extensive designing, testing, and evaluating. The Comets' safe-life was targeted at 10,000 cycles. After this, significant repairs or replacements would be required in order that the aircraft could be safe for another calculated number of cycles.

Boeing, and other manufacturers of that era, on the other hand, designed their pressurized aircraft, such as the Boeing 707, under the structural design philosophy of "fail-safe." In fail-safe design, a critical part has redundancies, alternate load paths, and provisions for cracks to be stopped and turned, should they occur. Often, this may result in more complex, or heavier designs. Today, both the fail-safe and safe-life philosophies have evolved into "damage tolerant" standards, which integrates attributes of each approach into one objective standard. Damage tolerance involves a structural capability that provides safe operation with specific failure or damage conditions which may exist between prescribed inspection periods. Further information on damage tolerance can be found in AC 25.571 and in 14 CFR 25.571.

Back to Top

After the crash at Elba, de Havilland took action to "cover every possibility that imagination has suggested as a likely cause of the disaster." These possibilities included flutter of the control surfaces, primary structural failure, flying controls, explosive decompression of the pressure cabin, engine fire, failure of a turbine blade, and fatigue of the wing.

Only a very limited number of Comet 1's were delivered before the model changed enough to get a new designation. The Comet 1A had increased fuselage strength, among other updates. It wasn't until the next model, the Comet 1XB, that the window shape was changed from squarish to the now-conventional oval shape.

Note: At the time of the assembly and construction of the material for the Comet accident in this library, due to the age of this accident it was not able to be determined what method was used to change the design of Comet airplanes in service; i.e. an AD or similar process. No ADs, or documents serving the same purposes as ADs could be found, or linked to these accidents.

Back to Top

Airplane Life Cycle

• Design / Manufacturing

Accident Threat Categories

• Structural Failure    

Groupings

• N/A

Accident Common Themes

• Flawed Assumptions
• Unintended Effects

Back to Top

Flawed Assumptions

Fuselage fatigue testing for the Comet aircraft had only been conducted after the pressure test to 2P. It was assumed that the pressure test would have no effect on the results of the fatigue test. It was further assumed that fatigue testing required for unpressurized flight would be the same as fatigue testing necessary for pressurized flight, so the full-scale fuselage fatigue tests were neither required nor conducted until a year after the Comet had been introduced into the market.

Unintended Effects

By pressurizing the fuselage during testing up to twice the expected pressure, de Havilland was unintentionally enhancing the fatigue life of the fuselage material.

Back to Top

Dan-Air Boeing 707, May 14, 1977

The right-hand horizontal stabilizer and elevator separated from the aircraft during landing due to metal fatigue.

See accident module

Aloha Airlines Flight 243, Boeing 737, April 28, 1988

An 18-foot-long section of the forward fuselage departed the airplane due to undetected disbonding and fatigue damage of the fuselage skin.

See accident module

El Al Flight 1862, Boeing 747, October 4, 1992

Metal fatigue of the fuse pins in the engine mounting led to separation of an in-board engine, which struck, and caused failure of the outboard engine mount, resulting in loss of control and the crash of the airplane.

See accident module

Back to Top

Technical Related Lessons:

Maintenance and other in-service programs should be predicated on a thorough understanding of the fatigue properties of complex structural elements. (Threat Category: Structural Failure)

• Not knowing enough about the fatigue properties of complex structures can have catastrophic results. Detailed attention must be paid to aspects such as material choice, thickness, geometry, stress levels, maintenance, and usage. Even large static strength margins do not negate the effects of fatigue. In this accident, the fatigue properties of the production airplanes were not well understood, and test results were misleading regarding the airplane's actual fatigue life.

Common Theme Related Lessons:

The performance of test specimens must be representative of the production airplane, and produce results that are conservative relative to the expected usage and environment. (Common Theme: Unintended Effects)

• De Havilland's fatigue test setup did not reflect the production fleet. The test specimen had been previously cold worked due to overloaded proof pressure testing. This overload inadvertently enhanced the fatigue life of the specimen, and thus produced results which did not reflect the production configuration. Following the three accidents, it was learned that the original test fuselage had been subjected to both the overpressure tests and subsequently, to the fatigue cycle testing. These two tests conducted on the same test article inadvertently changed the material properties in high stress areas of the fuselage (i.e., window corners). Production airplanes, which had not been subjected to repeated overpressure cycling, were found to form fatigue cracks near the corners of the windows at approximately 1000 airplane flight cycles, while the original test specimen was subjected to 16,000 cycles before the first crack was observed.

Back to Top