On the afternoon of Tuesday 2 November 1954, in Church House, Westminster, Sir Hartley Shawcross put a question to the Director of the Royal Aircraft Establishment. Shawcross appeared for the de Havilland Aircraft Company, which had built the Comet, the first jet airliner in the world to carry fare-paying passengers. Two Comets lay on the bed of the Mediterranean. The witness was Sir Arnold Hall, whose staff at Farnborough had spent the summer finding out why. In 1953, Shawcross said, the makers had put a length of the Comet’s cabin through 18,000 pressurisations in a tank at Hatfield, which corresponded to 54,000 hours of flying. Would the witness agree that, “that test having been made in 1953, it was not unreasonable for de Havillands to think that the fuselage would have, I do not say a 54,000 hours’ life, but a fatigue life considerably in excess of anything that had actually been flown?”

“I cannot entirely agree with that,” Hall said. “This result was, in my opinion, achieved because the specimen had been pre-loaded in a static test to 13½ lb on several occasions, and to 16 lb on some occasions, and that if a specimen is so exposed, you get a release of stress concentration due to plastic flow, and the specimen may (and I emphasize the word ‘may’) have a very much longer life than it otherwise would.” He would not put a figure on the word. “I would certainly not like to say that it is necessarily not worse than 10 to 1. Therefore if one got 54,000 hours on a pre-loaded specimen, I do not know of any basis on which one could then predict that the fatigue life of an unpre-loaded specimen would be X at all.”

The Comet that had broken up off Elba in January had made 1,290 pressurised flights. The one that had broken up off Naples in April had made 900. The number that everyone concerned had read, and had gone on reading between the two accidents, was eighteen thousand.

Who ran it

The Comet was de Havilland’s. Ronald Bishop was its chief designer, with C. T. Wilkins as his chief assistant; R. H. T. Harper was chief structural engineer and Harry Povey the director in charge of production. The company had built only military aircraft through the war, had some years of jet fighters behind it and an engine company of its own, and began the design by the end of September 1946. British Overseas Airways Corporation, the state airline, and the Minister of Supply signed a contract for Comets on 21 January 1947, two and a half years before a prototype flew.

The airline was BOAC. Its chairman was Sir Miles Thomas; its deputy operations director for engineering, Charles Abell, chaired the committee that examined the fleet after the first loss.

Between the maker and the airline stood two boards. The Air Registration Board, incorporated in 1937, held by delegation from the Minister the power to write airworthiness requirements and to recommend certificates. Its chairman was Lord Brabazon of Tara, who told the Court he had had fifty years connected with aviation, and its chief technical officer was Walter Tye. The Air Safety Board was advisory only, appointed in November 1946 to “keep under continuous review the needs of safety in British civil aviation”. Its chairman was Air Chief Marshal Sir Frederick Bowhill; its members included Brabazon, Sir Leonard Bairstow, who a generation earlier had chaired the airworthiness panel for the airship R101, and Arnold Hall.

Hall was Director of the Royal Aircraft Establishment at Farnborough, the Ministry of Supply’s research station, Professor Hall in January 1954 and Sir Arnold by the autumn. Under him Dr P. B. Walker headed the Structures Department and E. L. Ripley the Accidents Investigation Section. The Minister of Transport and Civil Aviation was Alan Lennox-Boyd until the summer of 1954, with John Profumo as his Parliamentary Secretary; the report of the inquiry went to his successor, John Boyd-Carpenter.

The inquiry was ordered by Lennox-Boyd and sat under Lord Cohen, a Lord of Appeal, appointed Commissioner by the Lord Chancellor on 8 September 1954, with three assessors: Sir William Farren, technical director of A. V. Roe and president of the Royal Aeronautical Society; Professor W. J. Duncan; and Air Commodore A. H. Wheeler. Sir Lionel Heald, a former Attorney-General, led for the Crown. Shawcross led for de Havilland.

What they were trying to find out

There were two experiments in this story, and the second was designed to test the first.

The first was de Havilland’s. To make a jet airliner pay, the report of the inquiry explained, “it was essential that the cruising height should be upwards of 35,000 ft—double that of the then current air-liners—and that the weight of the structure and equipment should be as low as possible.” At 40,000 feet the cabin was to be held at the pressure of 8,000 feet, a difference of 8¼ pounds on every square inch of skin, “about 50 per cent greater than that in general use”. The cabin would be pumped up to that pressure on every climb and let down on every descent, for the life of the aircraft.

The makers’ hypothesis about that cabin was written into the strength they gave it. The British requirements asked for a “proof” pressure of one and a third times the working pressure, under which the cabin must show no permanent deformation, and a “design” pressure of twice the working pressure, at which the metal might reach its ultimate strength. De Havilland designed to two and a half times and tested to twice. They did so, the report found, for two reasons, and the first was this: “They believed, and this belief was shared by A.R.B. and other expert opinion, that a cabin which would survive undamaged a test to double its working pressure, 2 P, would not fail in service under the action of fatigue due to the pressurisation to working pressure, P, on each flight”. On that basis, the assessors recorded, “they felt that the cabin was good for the life of the aircraft (say 10,000 pressurised flights, or 10 years).”

The second experiment was Farnborough’s, and it was set up after the second loss. Its hypothesis was that the cabin’s life under repeated pressure was short enough for both aircraft to have burst from fatigue at about a thousand flights, and that a whole Comet, pumped up and let down in a tank until it failed, would say so. If the hypothesis was right, the tank would split the cabin at the corner of a window after a count of cycles comparable with the aircraft’s lives, and the wreckage from Elba would show a fracture of the same kind at the same sort of place.

What nobody set out to find, and what the second experiment found anyway, was why the first had given the wrong answer.

What they built

The first prototype Comet flew from Hatfield on Wednesday 27 July 1949 at 6.17 in the evening, with John Cunningham at the controls, for thirty-one minutes. The full certificate of airworthiness for the type was handed to the company at Hatfield by the Minister of Civil Aviation on Tuesday 22 January 1952. At three o’clock in the afternoon of Friday 2 May 1952 the chocks were pulled from G-ALYP, Yoke Peter in the phonetic alphabet of the day, at London Airport, with thirty-six passengers aboard and Captain A. M. Majendie in command, and twelve minutes later she was climbing away for Rome on the first jet airline service in the world. She reached Johannesburg twenty-three hours and thirty-eight minutes later, two minutes ahead of schedule. “It went without a hitch,” Sir Miles Thomas said; the flight had “put British civil aviation—jet-propelled—on the map of the world.”

She was propelled by four de Havilland Ghost turbojets buried in the wings and flown by hydraulic power controls. Her cabin was regulated to a maximum difference of 8.25 pounds a square inch, with a safety valve set at 8.5. Along the sides were square-cornered windows; in the roof over the wing were two more, for the aerials of the automatic direction finder; forward on each side was an escape hatch. All of these were cut-outs in a skin of aluminium alloy, and the skin was held to its stringers by an adhesive called Redux in place of rivets.

The cabin was tested before any of it flew. De Havilland built two lengths of it: a front section twenty-six feet long, from the nose nearly to the front spar, which “included typical windows, hatches and door”, and a centre section of twenty-four feet across the wing. Both were filled with water and pumped up. The front section was taken to 16½ pounds a square inch, twice the working pressure, in 1948 and 1949, and it held. The front section was also put through 2,000 cycles to rather over the working pressure. These, the report said, “were not intended as a test of the fatigue resisting properties of the structure, but rather as providing an assurance that the cabin would be satisfactory as a pressure vessel. But they undoubtedly contributed to de Havillands’ confidence in the soundness of the cabin.”

“Until about the middle of 1952,” the report found, “the likelihood that the fatigue resistance properties of a pressure cabin demanded further precautions, either in design or by test, than were provided by the current static strength requirements had not been realised.” Fatigue was a wing problem. Wings were bent up and down by every gust; cabins were pressurised once a flight, and once a flight seemed too seldom to matter. In October 1952 the Ministry of Supply’s joint airworthiness committee for military transports drafted a requirement for cabins that added, to the static and proof tests, a repeated loading of one and a quarter times working pressure applied 10,000 times. In June 1953 the Air Registration Board circulated the same for civil aircraft, with the count raised to 15,000.

That July de Havilland went back to the front test section. No Comet had then flown more than 2,500 hours, about 800 pressurised flights. The section, which had already been to twice working pressure twice and to pressures between once and twice “some 30” times, and had been repaired after its first 2,000 cycles, was pumped up to the working pressure and let down again about 16,000 times. By September 1953 it had stood 18,000 applications in all. Then the skin failed in fatigue at the corner of a window, “originating at a small defect in the skin”. Harper’s arithmetic made the 2,000 cycles worth about 6,000 hours and the 18,000 worth about 54,000. “But the number of pressurisations sustained was so large that, in conjunction with the numerous other tests,” the report said, “it was regarded as establishing the safety of the Comet’s cabin with an ample margin.” Harper was aware that the earlier static loads might have lengthened the life of the specimen; the margin seemed to cover it.

Meanwhile a Comet had been lost. On 2 May 1953, a year to the day after the first service, G-ALYV broke up in a thunderstorm six minutes out of Calcutta, with forty-three people aboard. The Indian court that inquired into it reported on 26 May that the structure had failed through overstressing in a thundersquall, by severe gusts or by the pilot’s handling of the aircraft in them. The Establishment reconstructed the wreckage at Farnborough and found “no fatigue cracks”. Nobody then suspected the cabin.

By the time the next one fell, the Comets of BOAC had flown about 24,000 hours.

Three thousand and sixty

Yoke Peter left Ciampino airport, Rome, for London at 9.31 on the morning of Sunday 10 January 1954, with twenty-nine passengers and a crew of six under Captain Alan Gibson, who was thirty-one. At 9.50 she reported, “Over Orbetello Beacon now.” A BOAC Argonaut, slower and lower on the same route, had asked her captain for the height of the cloud tops. At about 9.51 the Argonaut’s captain heard: “George How Jig from George Yoke Peter. Did you get my—” and nothing more. A sailor at Capoliveri on Elba “heard a heavy roaring noise like thunder” and “saw a globe of fire rotating as it came down into the sea”; a farmer at Portoferraio saw “two pieces of an aircraft, the smaller in flames, falling in almost parallel lines into the sea”. Fifteen bodies were recovered, and the pathologist at Pisa who examined them found injuries from impact and from explosive decompression, and no sign of a bomb. All thirty-five aboard had died.

Yoke Peter had flown 3,681 hours. BOAC suspended its Comet services from midnight the next day “as a measure of prudence”, a commercial decision and “not an official grounding”. A committee under Abell, with de Havilland and the Board represented, met at London Airport from 11 January to decide what might have caused the loss and what could be done about it. It listed six possibilities, from flutter of the controls to fire from the engines. Of fatigue, Abell told the inquiry, they “had in mind more particularly fatigue of the wing”, because cracks had just appeared near the wheel wells of the prototype on the rams at Farnborough. A large number of modifications followed, most of them against fire. “At the conclusion of their work the Committee still regarded fire as the most likely cause.” And, the report recorded, “neither Mr. Bishop nor Mr. Harper of de Havillands suspected that the failure of the cabin structure by fatigue or otherwise was a primary cause of the accident. They still regarded the 18,000 repeated loadings as removing any doubt about the fatigue life of the cabin.”

Under the sea off Elba the Royal Navy was looking for the aircraft, with salvage vessels, grabs and an underwater television camera, the first ever used for the purpose, in seventy to a hundred fathoms. The camera found a piece of the Comet on 12 February. “It is rather like searching for a handful of peas in a one-acre field from a helicopter on a misty day,” Admiral Earl Mountbatten reported in March.

The Minister had not withdrawn the certificate of airworthiness, and he asked his Air Safety Board whether the Comets should fly again. The Board met on 2 March and minuted him on the 5th. “It realises that no cause has yet been found that would satisfactorily account for the Elba disaster,” the minute said, and that the Calcutta accident, though “completely accounted for” by a great gust, might share “some other cause which was possibly common to both disasters. Nevertheless, the Board realises that everything humanly possible has been done to ensure that the desired standard of safety shall be maintained.” It recommended a return to service when the modifications were in and flight-tested. Brabazon wrote for the Registration Board that “modifications are being embodied to cover every possibility that imagination has suggested as a likely cause of the disaster”. The first Comet with passengers took off on 23 March. By then the search had found only the floating wreckage, the pressure dome, parts of the rear fuselage, the engines and the centre section. The front of the cabin came up on 3 April.

On Wednesday 7 April G-ALYY, Yoke Yoke, chartered from BOAC by South African Airways, landed at Rome on her way to Johannesburg and was held a day for a faulty fuel gauge. She left for Cairo at 6.32 the next evening, Thursday 8 April, with fourteen passengers and seven crew under Captain W. K. Mostert, reported abeam Naples at 6.57 climbing to 35,000 feet, signalled Cairo at 7.05, and was not heard again. The aircraft carrier Eagle and the destroyer Daring found bodies and seats the next day north-east of Stromboli, in 520 fathoms of water. There was no possibility of salvage. Yoke Yoke had flown 2,704 hours and had been back in service sixteen days.

BOAC stopped the Comets that night. On Monday 12 April Profumo told the House that the Minister had withdrawn the certificate of airworthiness from every Comet, that a public inquiry would be held into both accidents, and that “exhaustive investigations and tests will be carried out as a major national research project by the Ministry of Supply.” The Registration Board’s letter said why: “The Board cannot disregard the real possibility that there is some factor influencing the airworthiness of Comet aircraft which the most diligent investigations have failed to discover.”

The Minister of Supply put the whole problem to Hall. His staff reviewed the Abell committee’s list, and were struck, the report said, “chiefly by the apparent similarity of the circumstances of the two accidents”, each at about the same height and the same time after take-off, “and by the fact that the modifications carried out after Elba seemed to rule out many of the other possible causes.” On 18 April he decided that a whole cabin should be put through repeated loading, as “one of a number of lines of inquiry which had to be pursued”.

The instrument was a tank. A cabin could not be tested to failure with air in it, because the burst would be “equivalent in the case of the Comet’s cabin to the explosion of a 500 lb. bomb”, destroying the evidence; it could not simply be filled with water, because the weight of the water would load it as no flight did. So a tank was built at Farnborough large enough to hold a Comet with its wings projecting through the sides, the tank and the cabin were filled together, and the cabin was pressurised by pumping water into it from the space outside. Each cycle stood for a flight: one pressurisation of the cabin, and bending loads on the wings from hydraulic rams to stand for the gusts. Every thousand “flights” or so the pressure was raised to one and a third times working pressure, 11 pounds, as a proving test. Vibration, the buffeting of the jets, the loads of take-off and landing were not represented, and every one of them would shorten a real cabin’s life, so that “the life of a fuselage deduced from the test is longer than would be expected in service.”

The aircraft was G-ALYU, Yoke Uncle, which had flown 3,521 hours and made 1,230 pressurised flights for BOAC. On 24 June, after the equivalent of a further 1,830 flights, during a proving test, the cabin split. The failure began at the bottom rear corner of the forward escape hatch on the port side, in the skin near its edge, and ran fore and aft; the figures in the report give the pressure at 10.4 pounds and the total as 3,057 flights, which the text rounds to 3,060. Algae in the water had stained the faces of the crack, “which made it clear that the crack had endured several pressurisations before it spread catastrophically.” It was fatigue. In hours, the figure the inquiry used was 9,000.

“We thought we were covered by these tests that we had done,” Bishop said at Church House, “and it was a very great surprise to me personally when the fuselage blew up in the tank at 9,000 hr. We thought we had a very much longer life than that.” Hall put the three aircraft on one scale: “If we take YU as unity, YP was 2.4 times younger and YY was 3.4 times younger . . . At the time of the Elba and Naples accidents, both aircraft had flown longer than the safe fatigue life we could give in the light of the evidence obtained from YU.”

What it looked like from inside

The failure in the tank was a prediction about the sea bed, and the Establishment went back to the sea bed to check it.

Ripley’s section had been reassembling Yoke Peter on a wooden frame as the pieces arrived, a jig-saw of thousands of fragments. Water damage and fire damage did not run across the same breaks, which showed that the structure had come apart in the air and the fire had come after; bending, tension and fatigue each leave a different edge; marks made by one piece passing over another gave the order. The rear fuselage had hit the sea open end first; the centre section, with all four engines, had gone in upside down, on fire, and the burnt metal said the fire had burned about three minutes, which is how long such a piece takes to fall from 30,000 feet. The engines were stripped and given, in Heald’s phrase, “a completely clean bill of health”. Everything said that the cabin had burst while the aircraft was flying normally, somewhere over the wing, and the escape hatch that had failed in the tank was examined on the wreckage for a matching failure. There was none, on either side.

So in July the search was turned round. If the cabin had burst, pieces would have been blown clear and would lie back along the track towards Rome, where the water deepened too fast for the grab and the only method was trawling. On 12 August an Italian fishing boat brought up a piece of cabin roof from over the front spar, with the two windows of the direction-finding aerials in it; “at the time it was not recognized as such.” On examination every fracture in the roof ran away from one point and none ran into it: the starboard aft corner of the rear aerial window, “at the edge of the countersunk hole through which a bolt passed”. There the experts found what they believed to be fatigue. Professor A. J. Murphy of Birmingham, called by de Havilland, saw “the shading, smoothness and fine grain which were typical of fatigue fractures.” At the opposite corner the fracture ran through a crack about a fifth of an inch long in the reinforcing plate, made accidentally during manufacture and dealt with in the usual way, by drilling a small hole at each end to stop it spreading. Three such cracks in the plates round these windows had been recorded on a concession note in the words “splits have been located with a 1/16th dia. drill hole”; a fourth, in the skin, had been drilled at both ends and never recorded at all, and had spread past one of its holes in service. The first fracture, the Court accepted, “occurred near the rear A.D.F. window and spread fore and aft from it.”

The thing could be made to happen again on a small scale. A Perspex model of the cabin, one-tenth size, with seats and dummy passengers, was put in a chamber pumped down to 40,000 feet and burst where Yoke Peter had burst; after a tenth of a second, full-scale, “complete chaos had developed”, and “within one-third of a second of the accident taking place,” Heald told the Court, “the cabin was apparently empty.”

Then the tank told them something the design calculations had not. After de Havilland had repaired Yoke Uncle’s hatch, strain gauges were fixed as close as could be managed to the edge of the skin at the corners of typical windows, which had not been done before. The reading, extrapolated to the edge, was 43,000 pounds a square inch at the working pressure, with another 2,700 from other loads: 45,700 against an ultimate strength of about 65,000, or 70 per cent. De Havilland’s own figure for the region had been 28,000, an average over two or three inches. The makers thought the measurement unreliable, because it implied that in their own test to twice the working pressure the corner had seen 86,000 pounds, 30 per cent above what the metal could bear. The answer to that paradox was the answer to everything. “Within the yield point of the material twice two is four,” Hall said; “above the yield point it is not.”

What happened

The inquiry opened at Church House on Tuesday 19 October 1954 and sat for twenty-two days, the last six of them across Parliament Square at the Institution of Civil Engineers, finishing on 24 November. Sixty-eight witnesses gave evidence; the transcript ran to 1,600 pages and some 800,000 words. The companion pieces “The Crown’s case” and “The makers’ case” follow the hearings day by day; what matters here is what each party said about the number.

Heald opened for the Crown with the whole case, and said that the fatigue explanation was the one that “everything in Sir Arnold Hall’s investigation supports” and “nothing contradicts”. Hall gave evidence over several days. The fatigue could not have been seen: “I know of no physical test one can apply to a piece of material which will tell one how much it is fatigued.” What had been new was “that a specimen which passed a static test of twice its normal loading could nevertheless have in it stress concentrations of 70 per cent of the ultimate.” Asked whether, had he known in March of the drilled cracks round the aerial windows, his advice on the Air Safety Board would have been the same, he said, “No, it would not.”

The Board’s chairman had already been cross-examined on the minute of 5 March. “When you passed this Minute, what did the Board consider was the probable cause of the Elba disaster?—We did not know.” Would it not have been humanly possible to wait for more wreckage? “Yes, it would have been humanly possible,” Bowhill said. Hall gave the Board’s reason: the wreckage of the Calcutta Comet, breaking up at 7,000 feet, had been spread over five miles, so that Yoke Peter’s, from 30,000, should have lain along twenty, back towards Rome into deep water and an unswept minefield. That the pieces lay close together was itself a sign of what had happened, and nobody knew it yet.

Brabazon gave the Court a speech. “The Elba accident was a completely unexplained accident to us at that time,” he said; “if you grounded the type of every aeroplane that had an unexplained accident you would scarcely have a machine in the air today.” “It is metallurgy, not aeronautics, that is in the dock.” Tye, the Board’s chief technical officer, was the one expert who would not go all the way: he accepted that the cabin had burst, but doubted whether “high-level fatigue” could be read from “that extremely small piece of metal”, and could offer no alternative. He told the Court how the Board had reasoned after Elba: “it still seemed inconceivable that failure at one-third of the estimated safe life could occur”, and the 18,000 cycles “might have indicated a life of 54,000 hr. Pre-loading might have influenced this figure, but could not completely rule it out as an indication.”

De Havilland’s witnesses did not dispute the cause. Bishop said that the pressure cabin had been “one of the biggest problems that we had to face”, and: “We obviously missed the main point.” Harper explained why the company had trusted tests over calculation: a riveted joint should, on paper, break at its rivet holes, and did not, because the peaks of stress “either disappear or become altered under load”. The same yielding that saved the joint in his example was what had flattered the test section in 1953. Walker, for the Establishment, refused to count the eighteen windows of Yoke Uncle as eighteen specimens: “as far as I am concerned, the aircraft is the specimen.”

On 12 November Heald announced what the Registration Board would now require: “complete cabins of pressurised aircraft shall be submitted to tank tests similar to those used at Farnborough, at any rate until knowledge of the fatigue problem has become much more exact”, and “at least two airframes of each prototype will have to be made available, one for static testing and the other for fatigue testing.” On 23 November Shawcross put in the company’s statement: thicker skin, windows and cut-outs redesigned to lower the stress, and no repair of any crack that did not leave the part as strong as if there had been no crack. In his closing speech he said the thing plainly. “We believed the static-loading test would cover fatigue. We know now that that was wrong, but not only did we believe that, the Royal Aircraft Establishment believed it, the Air Registration Board believed it, the International Civil Aviation Organisation believed it and the Civil Aeronautics Authority of America believed it.”

Cohen signed his report on 1 February 1955 and it was published on 12 February, price eight shillings. The cause of the Elba accident “was the structural failure of the pressure cabin brought about by fatigue”. Of Naples, “owing to the impossibility of salvaging any appreciable part of the wreckage”, no positive answer could be given, but the same explanation was “at least possible”. Neither accident was due to the wrongful act or negligence of anyone. The fundamental cause was “that there existed around the corners of the windows and other cut-outs a level of stress higher than is consistent with a long life of the cabin”. On the drilled cracks: the method “would have been appropriate had the stresses been as low as de Havillands believed them to be, but was, in fact, inappropriate as the region concerned was one in which there were high stresses.” On the resumption: “no blame can be attached to any one for permitting the resumption of the services.” On the test of 1953: “In the then state of knowledge I think this conclusion was reasonable.”

The report’s own account of what the test had done is in its paragraphs on research. As the pressure in a cabin rises towards twice the working pressure, “the stress in the more highly stressed regions will reach that at which the material is no longer elastic. Its extension will then be of a plastic nature, that is to say, one which does not disappear when the stress which caused it is removed.” Over most of the skin nothing changes. “But in areas where the stress was high, there will remain a permanent stretch. The pre-loaded cabin is therefore physically different from a new one, if the pre-load has exceeded a certain level.” The stretch is too small to see, yet “it may have a profound effect on the distribution of stress in the material when the working pressure is applied a second time”, reducing it “markedly” where it was greatest. There could be “no direct proof”, but this was “at any rate a partial explanation of the apparent anomaly presented by the failure of the pressure cabin of Yoke Uncle at R.A.E. after 3,000 cycles, in spite of the survival of the test specimen of the forepart of the cabin to over 16,000 cycles when tested by de Havillands. The maximum pressure difference which had ever been applied to Yoke Uncle was 1⅓ P, whereas the test specimen had been subjected to two applications of 2 P in addition to nearly twenty of between P and 2 P.” The subject “should undoubtedly receive more study, if only to ensure that tests during design are not rendered unreliable by failure to appreciate its significance.”

After

On 16 February 1955 Boyd-Carpenter told the Commons that the Government accepted every recommendation. Comet 1s “cannot be made suitable for further airline use without extensive and costly modifications”; some would go to the Ministry of Supply for the research the Court had asked for. Comet 2s in a modified form would be built for the Royal Air Force, with “special pressure tank tests” and a full passenger certificate before they flew. BOAC announced the same day that its Comet 1s “will not be used again on public passenger service”, that it would order new Comets built with thicker skin, and that the new design would be tested with repeated pressure tests “such as were used by the Royal Aircraft Establishment”. Asked in the House whether every pressurised aircraft would now have to go into a tank like Farnborough’s before it was certified, the Minister answered, “generally speaking the answer is ‘Yes.’”

The tank had already spread. Within a fortnight of Hall’s evidence, Flight reported that the Britannia and the Dutch Fokker Friendship would be tank-tested and that Vickers would do the same to the Viscount at Weybridge, “voluntarily at the expense of the companies involved”. Flight reported that the new Comet 2’s pressure fuselage would be completely rebuilt, “incorporating a heavier skin and round, instead of square, windows.” In New York in January 1955 an engineer from the Boeing company, which was building the 707, told the Institute of the Aeronautical Sciences the lesson in his company’s words: “There are instances in the past when full-scale fatigue tests were run and complete reliance on airplane-life predictions placed on the results, yet the airplanes so tested suffered most unfortunate accidents from fatigue. There is no reason to believe that complete reliance on airplane-life predictions based on analysis and testing can be made in the future any more than in the past.”

What it taught

The Comet’s cabin was tested before it flew, and tested more than any cabin before it: to twice its working pressure, through 2,000 cycles, and then, when the question of fatigue arose, through 16,000 more. The inquiry found that the makers had been “proceeding in accordance with what was then regarded as good engineering practice”, and blamed nobody. That is what makes the story worth keeping. The failure came out of the design of the test.

The test measured the specimen it was given, and the specimen was not the aircraft. The front section had been to twice the working pressure twice and to pressures between once and twice nearly twenty times before anyone counted its cycles. At the corners of its windows the metal had yielded and stayed stretched, and from then on the working pressure met a different piece of structure, with its worst stresses eased, from the one that left the factory. Nothing of this could be seen. The section went on to stand 18,000 pressurisations; a cabin that had never been above one and a third times the working pressure stood 3,060. Harper knew of the possibility and judged the margin ample; Tye knew of it and judged the 18,000 still “an indication”; the Court judged both reasonable. The lesson is not that they should have known. It is that a test is a measurement of the thing in the tank, and when the thing in the tank has a history the thing in service lacks, the number that comes out belongs to the history.

A proxy that everyone agrees on is still a proxy. The hypothesis under the whole programme was that static strength covered fatigue: survive twice the working pressure and you would survive the working pressure ten thousand times. Shawcross’s list of those who believed it ran from Hatfield through Farnborough and the Board to the civil authorities of the world, and he was right that this was the belief of the age. What the tank showed, in Hall’s words, was “that a specimen which passed a static test of twice its normal loading could nevertheless have in it stress concentrations of 70 per cent of the ultimate.” The static test answered the question it asked. The question that mattered had been assigned to it by consensus, and consensus is not a result.

“Everything humanly possible” was decided while the instrument lay on the sea bed. In March 1954 the Air Safety Board recommended the return to service of an aircraft whose last loss, by its own minute, no cause had been found to “satisfactorily account for”, on the ground that every possibility imagination suggested had been modified against. It did so believing, for good technical reasons, that the wreckage would never be recovered, when the fact that the wreckage lay in a small area was itself evidence of a burst cabin. The Court found that no one was to blame, and it was right that no practice then required a type to be grounded after one unexplained loss. But the reading that explained Elba was lying in seventy fathoms the whole time, and the second aircraft went to Naples with it still down there. Where a cause is unknown, the modifications that cover “every possibility that imagination has suggested” cover only those.

A repair is only as good as the stress it assumes. The cracks round the aerial windows were “located” with a sixteenth-inch drill, in accordance with the drawings and the concession procedure, and “would have been appropriate had the stresses been as low as de Havillands believed them to be”. The company’s own figure for the region was 28,000 pounds a square inch, the tank’s 45,700. Every judgement made about that corner, the drilled holes, the countersunk bolt, the unrecorded fourth crack, was made against the wrong number, and all of them were correct against it. An instrument that reads too low does not merely miss a danger; it certifies the measures taken against it.

The specimen is the aircraft. Walker would not let eighteen windows count as eighteen tests, and the Board’s first new rule was two airframes of every new type, one to break under static load and one to break under cycles, in a tank, “at any rate until knowledge of the fatigue problem has become much more exact”. Within months Boeing was saying that a complete fuselage might have to be pressure-cycled. The rule cost an aircraft for every design, which is what Tye regretted and the engineers’ counsel warned would deter new designs, and it is the reason the lesson held.

The complication is in the numbers. Fatigue lives of nominally identical structures scatter, the assessors said, over a range of at least nine to one, and from a single test “it is impossible to say where, in the total range to be expected from general experience, a particular specimen lies.” Tye’s doubt was a doubt about probability, and the Court answered it by the method he himself proposed, eliminating everything else. The pre-loading explanation is “partial”, and the Court said there could be “no direct proof” of it. What is not in doubt is the order of the readings. The number eighteen thousand was read in September 1953, and again in January 1954, and again in March, and each time it was read as the life of the cabin. The number three thousand and sixty was read on 24 June 1954, from an aircraft, and it was the first reading in the programme that had been taken from the thing that flew. The airship R101 had left Cardington before her trials were finished; the Comet’s trials were finished, and the test had passed, and the thing it had tested was not the thing in the air.

Sources

• Ministry of Transport and Civil Aviation, Civil Aircraft Accident: Report of the Court of Inquiry into the Accidents to Comet G-ALYP on 10th January, 1954 and Comet G-ALYY on 8th April, 1954, C.A.P. 127 (HMSO, 1955), Lord Cohen with Sir William Farren, Professor W. J. Duncan and Air Commodore A. H. Wheeler. The history of the project; the design pressures, the test sections and the tests of 1948 to 1953; the requirements of 1952 and 1953; the Calcutta finding; the Elba flight and the last message; the naval search and the dates of recovery; the Abell committee and the 18,000 loadings; the Air Safety Board’s minute, Brabazon’s letter and the resumption; the Naples flight; the tank, Yoke Uncle’s 1,230 and 1,830 flights, the algae and the strain gauges; the fatigue at the bolt hole and the drilled cracks; the findings, the paragraphs on pre-loading, and the questions and answers; Appendix IV, the assessors’ note on fatigue; Appendix VI, Part 1 of the RAE’s Accident Note No. 270; Appendices VII and VIII, the statements of 12 and 23 November 1954. Scanned copy, Federal Aviation Administration. faa.gov
• Flight, 29 October 1954 (“Knowledge of the Comet”, the editorial; “The Comet Inquiry: the first week’s evidence”, with the Ciampino messages, the Argonaut captain’s evidence, the Elba affidavits and Hall’s first days; “The Comet Accidents: History of Events”, Heald’s opening); 5 November 1954 (“Tank-testing Pressurized Transport”; the second week, with Bowhill’s cross-examination, Abell’s evidence, Hall on the escape hatch and the 2.4 and 3.4 ratios, and Walker); 12 November 1954 (the third week: Hall on the resources, the wreckage trail and the future of testing; Hall on pre-loading under Shawcross’s cross-examination; Brabazon’s evidence and Cohen’s reply; Walker on “the aircraft is the specimen”; Tye’s first day); 19 November 1954 (the fourth week: Tye’s evidence and doubts, the Board’s letter after Naples, Murphy, Harper on the test programme and the riveted joint, Bishop, Heald’s statement of the new requirements, Povey); 26 November 1954 (the editorial “The Inquiry—and After”; the fifth week, the agreed statement, Hall on “twice two is four”, the questions, and the speeches of counsel); 3 December 1954 (Shawcross’s closing, the de Havilland statement, Rimmer, Scarman, Heald’s closing, the 68 witnesses and 800,000 words, and Kenneth Owen’s technical summary). Quotations from the witnesses and counsel are taken from these reports; the transcript itself is at the National Archives. 29 Oct, 5 Nov, 12 Nov, 19 Nov, 26 Nov, 3 Dec
• Flight, 15 January 1954 (“B.O.A.C. Comet Lost: Services Suspended”); 22 January 1954 (“Elba Accident Developments”); 29 January 1954 (“Farnborough Comet Investigations”, the press visit of 20 January and the prototype on the rams; “The Elba Search”); 12 March 1954 (“Comet Services from March 23rd”; “Elba Salvage Operations”, Mountbatten’s account); 16 April 1954 (“The Loss of G-ALYY”, with the withdrawal of the certificate and Yoke Uncle’s flight to Hatfield). 15 Jan, 22 Jan, 29 Jan, 12 Mar, 16 Apr
• Flight, 11 February 1955 (“High-altitude Transport Problems”, the Boeing papers to the Institute of the Aeronautical Sciences; “The New Comet 2”, the heavier skin and round windows); 18 February 1955 (“Report of the Comet Inquiry”, the summary of the report on its publication on 12 February); 25 February 1955 (“Comets: the Next Step”, the Commons statement of 16 February and the BOAC statement). 11 Feb, 18 Feb, 25 Feb
• Flight, 4 August 1949 (“Comet in the Sky”, the first flight of 27 July); 25 January 1952 (“Full C. of A. for Comet”); 9 May 1952 (“Comet on Schedule”, the first service of 2 May and Sir Miles Thomas’s words); 8 May 1953 (“Loss of a Comet”, Calcutta). 4 Aug 1949, 25 Jan 1952, 9 May 1952, 8 May 1953
• Hansard. Commons, 8 March 1954, Civil Aviation, Lennox-Boyd’s announcement of the resumption; 9 April 1954, “Missing Comet Aircraft”, Lennox-Boyd’s statement; 12 April 1954, “Comet Aircraft (Loss)”, Profumo on the withdrawal of the certificate, the inquiry and the Ministry of Supply’s investigation; 16 February 1955, “Comet Aircraft Accidents (Report of Inquiry)”, Boyd-Carpenter’s statement and the exchange on tank tests; written answer of 14 February 1955 on the date of publication. 8 Mar 1954, 9 Apr 1954, 12 Apr 1954, 16 Feb 1955, 14 Feb 1955