Common Comet Misconceptions and Collaborative Contribution to Safety
Recently the 68th anniversary of the first flight of the prototype G-ALVG of pioneering jet airliner the de Havilland DH-106 Comet occured. As noted by Richard Gale of ADS:
On Saturday 27th July 1949, the de Havilland Comet took off from Hatfield Aerodrome for its inaugural flight; reaching 10,000ft and circling the skies for approximately 31 mins.
In the three years it took from the original drawing board to the first flight, the Comet instantly doubled the speed and altitude of air transport. It also brought in a whole range of new and innovative technology such as integral wing fuel tanks, engine-bled air for pressurisation and de-icing, and airbrakes. After a production line was set up, the first pure jet powered commercial flight took place in May 1952 to Johannesburg.
In-Flight Break-Ups
Tragically the Comet is also remembered for a series of in-flight break-ups in its first 2 years in service:
- 2 May 1953 British Overseas Airways Corporation (BOAC) Flight 783, Comet 1 G-ALYV, near Calcutta, India (43 fatalities)
- 10 January 1954 BOAC Flight 781, Comet 1 G-ALYP, Mediterranean, near Elba, Italy (35 fatalities)
- 8 April 1954 South African Airways (SAA) Flight 201, Comet 1 G-ALYY, near Naples, Italy (21 fatalities)
The G-ALYV Calcutta accident occurred in a severe thunderstorms and the Court of Inquiry concluded the cause was:
Structural failure of the airframe during flight through a thunder squall. In the opinion of the Court, the structural failure was due to overstressing which resulted from either: (1) Severe gusts encountered in the thunder squall, or (2) Overcontrolling or loss of control by the pilot when flying through the thunderstorm.
As the FAA Lessons Learnt database notes, the cause this accident was reconsidered after subsequent accidents, and:
The official cause of the Calcutta crash has never been anything other than the storm.
The G-ALYP Elba accident occurred about 20 minutes into the flight as the aircraft climbed through 27,000 feet…
…transmission from the crew ceased mid-sentence, indicating a failure of the aircraft with “catastrophic suddenness.” Witnesses on the island of Elba, Italy, saw the aircraft fall into the sea in flames.
The search and salvage off Elba included the use of novel technologies, such as an underwater TV camera and continued during the summer of 1954:
Fuselage Wreckage Filmed with Admiralty Research Laboratory Pye TV System from RFA Sea Salvor off Elba (Credit: IWM (A 32858))
As described in the FAA Lessons Learnt database:
The Comet fleet was grounded while investigation began and while de Havilland made modifications “to cover every possibility that imagination has suggested as a likely cause of the disaster.” These modifications were made to address any possible cause of failure including flutter of control surfaces, primary structural failure due to gusts, flying controls, explosive decompression, engine fire, failure of a turbine blade, and fatigue of the wing. Fatigue of the fuselage was not considered as a cause at this time, nor was a modification made to compensate for it.
As these modifications were made, and while wreckage was still being recovered, the British Minister of Transport and Civil Aviation noted “the nature and extent of the modifications planned… and whilst the Calcutta disaster is completely accounted for… we cannot eliminate that the accident might have been due to some other cause which was possibly common to both disasters.”
Believing the unknown cause of possibly two accidents had been fixed during the massive modification project, Comet flight was resumed March 23, 1954.
Just over 2 weeks later G-ALYY, a BOAC aircraft chartered by SAA, experienced a catastrophic in-flight break-up while climbing through 35,000 feet and crashed into the sea near Naples. Comet operations were again immediately suspended all Comet flights.
Very minimal wreckage of the Naples aircraft was able to be recovered due to the great depth to which it had sunk – about 3,300 feet. From what was able to be recovered, it was concluded that there were no inconsistencies with “the view that the accident to Yoke Yoke [Naples] was attributable to the same cause as the accident to Yoke Peter [Elba].”
The investigation on the two Mediterranean accidents then progressed together. As the FAA Lessons Learnt database describes:
…investigators decided to do full-scale tests on existing fuselages: unpressurized flight tests on G-ANAV and pressure tests on G-ALYU.
To conduct the pressure tests in a safer manner, a water tank was constructed to encase the fuselage. The fuselage was submerged and filled with water, and then additional water was pumped into the cabin until the pressure inside the fuselage reached 1P, the equivalent of flight. This was then cycled to simulate many flights over the life of an aircraft. By using water instead of air, water being a much less compressible fluid, the test would be much safer and the fuselage would be able to be repaired and re-tested as necessary. Had air been used, the results would have resembled the catastrophic in-flight break-ups at Elba and Naples.
Comet G-ALYU in the 200,000 gallon Water Tank for Pressure Tests at RAE Farnborough (Credit: via FAA)
The Comet design employed a general structural design philosophy referred to as “safe-life.” Critical parts are assigned a safe amount of time, cycles, or flight-hours in which they will function properly. This “life” is determined from extensive designing, testing, and evaluating. The Comets’ safe-life was targeted at 10,000 cycles.
By 24 June 1954:
G-ALYU had undergone 1,230 pressurized flights before testing and 1,830 tank “flights” [i.e. 3,060 pressure cycles, when] the fuselage failed at the corner of a squarish forward escape hatch window. This failure was the pivotal evidence needed to turn the direction of the investigation towards fatigue.
After further searching off Elba, debris (discussed further below) was found that:
…bore the “unmistakable fingerprint of fatigue,” and was determined to be the first fracture of the Elba crash.
By the end of August 1954, 70% of the Elba aircraft had been recovered.
Elba Comet 1 G-ALYP Wreckage reconstruction (Credit: via FAA)
This silent film illustrates the break-up sequence:
The two accidents were examined by a Court of Inquiry (under Lord Cohen, with assessors, Sir William Farren, Professor W J Duncan and Air Commodore A H Wheeler) that published its investigation report (CAP 127) on 1 February 1955 (discussed in a contemporary issue of Flight: page 1, 2 and 3).
The inquiry made a number of recommendations:
First, further research was recommended. They recognized that more knowledge was still necessary to prevent this from happening again. The recommended research was in the areas of the ductility of aluminum alloys, stress distribution in the skin of the fuselage, and the effects of the pressure forcing stress beyond the yield stress of the material. The final recommendation was for more widespread use of strain gauges in testing.
In BCAR D3-7, regulation 4.3.2, a statement directly relating to the Comet accidents was added a year after the Elba and Naples reports were published, saying that fatigue testing must “involve a repeated loading test on a complete pressure cabin which has not been used previously for strength test work…” Much of the 1st July 1956 revision to D3-7 pertains to lessons learned from the Comet.
Of the decision to resume operations after the Elba accident the Court of Inquiry stated:
Comet Misconceptions: 1) Fatigue
One common misconception is that fatigue was an unknown phenomena at the time the Comet was designed. In fact as early as 1837 Wilhelm Albert had published the first article on fatigue and during the 1840s fatigue related railway failures were identified in France and the UK.
However, what were not well understood were suitable ways to analyse and test designs for their resistance to fatigue. The Court of Inquiry report stating:
Enough is now known about the fundamental physics of fatigue for engineers to be aware that there is still much to be learnt.
The applicable certification requirements, the…
British Civil Aircraft Requirements (BCARs)…required a design pressure of 2P and a proof test of the fuselage up to 1.33P, where “P” is the working pressure difference, or the pressure expected in normal flight. For the Comet, P was approximately 8.25 pounds per square inch (lbs/in2 or psi).
However the regulators were not:
…fully aware of all the implications and effects of pressurized flight yet, so many regulations remained the same for pressurized and unpressurized aircraft, including the fatigue requirements.
Consequently:
De Havilland significantly exceeded the requirements in their effort to ensure the safety of their aircraft. They decided to design the fuselage to withstand up to 2.5P, and to proof test it to 2P, instead of just 1.33P. A prototype fuselage was pressurized between 1P and 2P approximately 30 times, and then pressurized to “rather over P” another 2,000 times.
BOAC de Havilland Comet 1 (Credit: Unknown)
Subsequently the military Joint Airworthiness Committee (JAC) had accepted a paper in October 1952 on fatigue testing of pressurised fuselages and as a result in June 1953 the UK’s Air Registration Board (ARB) issued a proposed change to BCARs that would require:
…further fatigue testing for pressurized fuselages. Consequently, de Havilland went back and tested the same…fuselage with another 16,000 pressurization cycles between zero and 1P to verify its fatigue life. The fuselage finally failed at 16,000 cycles due to fatigue cracks at the corner of a squarish cabin window. The Comet’s expected life was only 10,000 cycles, so cracks at 16,000 were not a concern.
However, the post accident water tank tested…
…G-ALYU withstood about 3,060 pressurized “flights,” whether in the air or in the water tank. The Elba aircraft had experienced 1,290 pressurized flights. The Naples aircraft made 900 pressurized flights. All these seemed to indicate a much lower fatigue life than the 16,000 successful cycles de Havilland tested.
However, an unintended consequence of the original 2P proof testing was the test cold worked areas of structure with stress concentrations. As explained in the FAA Lessons Learnt database, de Havilland’s…
…significant misstep was the decision to perform the [1953] fatigue test on the same prototype fuselage that had undergone the pressure test and had been cold-worked. The prototype fuselage withstood 16,000 cycles before failure, due in large part to the fundamentally different material characteristics of the cold-worked material at the window corners. This characteristic change actually improved the fatigue properties at these locations, which would mask the true fatigue vulnerability of the production Comet.
The FAA note that the Mediterranean accidents:
…could be attributed to [unknowing] non-compliance with BCAR D3-1, regulation 4.5, due to their “probability of disastrous fatigue failure of the primary structure under repeated loads” being more than “extremely remote.”
Comet Misconceptions: 2) Windows
Another common misconception, possibly encouraged by the switch to oval windows on later Comet models, is that the fatigue failures occurred from a square cabin window. While they are examples of one of the stress concentrators in the Comet fuselage design the failures were as follows:
- 1953 G-ALYP Elba accident: the origin was in the aperture for a glass fibre Automatic Direction Finding (ADF) antenna on the upper fuselage (the wreckage is on display at the Science Museum in London)
Elba Accident Comet G-ALYP Water Tank Test Failure at the ADF ‘window’ (Credit: Krelink)
- 1954 G-ALYY Naples accident: the origin was never discovered
- 1954 G-ALYU water tank test: the origin was at the forward escape hatch
Comet G-ALYU Water Tank Test Failure at the Forward Escape Hatch (Credit: via FAA)
Safety Collaboration
The design knowledge gained during the investigation was were published openly in the de Havilland Gazette, and de Havilland had discussions with British and overseas organisations, benefitting the entire industry, and in particular the next generation of aircraft.
Subsequent designs used:
…the structural design philosophy of “fail-safe.” In fail-safe design, a critical part has redundancies, alternate load paths, and provisions for cracks to be stopped and turned, should they occur. Often, this may result in more complex, or heavier designs.
Boeing promoted their 707 design with a confidential technical marketing film:
Today, both the fail-safe and safe-life philosophies have evolved into “damage tolerant” standards, which integrates attributes of each approach into one objective standard.
Damage tolerance involves a structural capability that provides safe operation with specific failure or damage conditions which may exist between prescribed inspection periods. Further information on damage tolerance can be found in AC 25.571 and in 14 CFR 25.571.
The Comet Subsequently
The Comet 2, which had been in development at the time of the Comet 1 accidents, only saw military service. The last Comet 2 was retired from service on 10 January 1975. Only one of the stretched Comet 3s was built, in development in parrallel with the Comet 2. It was used for development flying.
The Comet 4, based on the larger Comet 3 addressed the lessons learnt.
The Comet 4 (including 4B/4C) was the most successful [variant with] 77 built, twice as many as all the other series put together, and they flew a total of 1.7 million hours. It was in commercial service from October 1958…
The last civil scheduled flight of a Comet 4 was with Dan Air in November 1980.
While the Comet 4 operated the first trans-Atlantic jet service on 4 October 1958, de Havilland’s advantage had been lost as the Boeing 707 entered service only nine days after the Comet 4 and made its first tran-Atlantic scheduled flight on 26 October 1958.
The last flying Comet, the military Comet 4C flying test bed XS235 Canopus was finally withdrawn from the Defence Evaluation and Research Agency (DERA) in 1997, after 34 years.
Comet 4C XS235 Canopus in 1990 (Credit RuthAS)
The Comet 4 was also the basis for the HS.801 Nimrod, which operated for the Royal Air Force (RAF) until 2011.
,_UK_-_Air_Force_AN1554801.jpg)
Nimrod R1 XW665 Operated by 51 Squadron, RAF (Credit: Mike Freer)
The Comet is a reminder of innovation and ingenuity, as well as risk and sacrifice. Its introduction was the start of a revolution in air transport that we can sometimes take for granted, and its mistakes the start of a safety-first culture in aviation that we could not function without.
As de Havilland Chief Test Pilot, who commanded the first Comet flight said:
I don’t think it is too much to say that the world changed from the moment the Comet’s wheels left the ground.
Video tour of an ex-Mexicana Comet (originally ordered by its parent PanAm) preserved in the US:
Aerossurance is pleased to be supporting the annual Chartered Institute of Ergonomics & Human Factors’ (CIEHF) Human Factors in Aviation Safety Conference for the third year running. We will be presenting for the second year running too. This year the conference takes place 13 to 14 November 2017 at the Hilton London Gatwick Airport, UK with the theme: How do we improve human performance in today’s aviation business?
Recent Comments