← back to the index
FR-002 pressurization fatigue

de Havilland Comet — Square Windows That Fatigue-Cracked the First Jetliner Out of the Sky

cyclic-fatiguepressurization-fatiguestress-concentration-at-cutoutjet-airlinerpressurized-fuselage1950s
Death toll
56 dead (35 on G-ALYP; 21 on G-ALYY)
Structure
de Havilland DH.106 Comet 1 pressurized fuselage, climbing toward ~35,000 ft
Failed
10 Jan 1954 (G-ALYP) and 8 Apr 1954 (G-ALYY)
Status
Broke up

Summary

On 10 January 1954, twenty minutes out of Rome and climbing through roughly 27,000 feet, BOAC Comet G-ALYP — the world's first jet airliner in scheduled service — broke apart over the Tyrrhenian Sea near Elba; all 35 aboard died. Eighty-nine days later, on 8 April 1954, after the type had been cleared back to service, South African Airways' Comet 1 G-ALYY disintegrated in almost identical circumstances while climbing through about 35,000 feet near Naples, killing all 21. Fifty-six people died in the two events. The cause was neither weather, sabotage, nor the engines the press first blamed: it was high-cycle fatigue — a crack that grew, pressurization cycle after pressurization cycle, from the corner of a cutout in the cabin skin until the fuselage unzipped at altitude.

The mechanism was proven by experiment. The Royal Aircraft Establishment (RAE) at Farnborough sealed a sister airframe, G-ALYU, inside a purpose-built water tank and repeatedly cycled the cabin from flight pressure and back. On 24 June 1954, after 3,057 simulated flights, the fuselage burst, the fatigue crack starting at the corner of a window cutout exactly as the recovered Elba wreckage would confirm.

The popular memory fixed on the square passenger windows, and that shorthand is half right and half myth. The cabin windows were indeed unforgiving rectangles whose corners concentrated stress, but the fatal crack on the tested airframe and on G-ALYP began at the rivet-pierced corner of a different opening — the aperture for the Automatic Direction Finder (ADF) antenna on the upper fuselage. The skin was thin, the corners sharp, and the holes around them punch-riveted rather than drilled, leaving microscopic cracks before the aircraft ever flew. The result was a stress concentration far higher than de Havilland's calculations admitted, in a structure cycled to full pressure on every flight, with no full-scale fatigue test to expose it first. The Court of Inquiry under Lord Cohen and the RAE's analysis turned the Comet from a national triumph into the founding case study of aircraft fatigue: Britain's airworthiness code was rewritten to demand full-pressure-cabin fatigue testing, the Comet was redesigned with oval windows and thicker skin, and the discipline of damage tolerance grew from the wreckage off Elba.

Timeline

1949-07-27
Comet 1 first flies
The de Havilland DH.106 Comet takes to the air, a pressurized, swept-wing, four-jet airliner that will cruise above the weather at ~35,000–40,000 ft, far higher and faster than any piston rival.
1952-05-02
Comet enters commercial service
BOAC begins scheduled Comet 1 operations London to Johannesburg; the jet age opens and the Comet becomes a symbol of postwar British prestige.
1953-05-02
G-ALYV breaks up after Calcutta
Six minutes after take-off, climbing through a tropical storm, BOAC Comet G-ALYV disintegrates near Calcutta, killing 43. The inquiry attributes it to airframe overstress from a gust or pilot over-control — not fatigue. The structural warning is misread.
1954-01-10
G-ALYP breaks up off Elba
BOAC Flight 781, climbing through ~27,000 ft about twenty minutes out of Rome's Ciampino, suffers an explosive in-flight break-up over the sea near Elba; all 35 aboard are killed. The fleet is voluntarily grounded.
1954-01–03
Engines suspected; modifications made
With no recovered wreckage at first, attention falls on engine fire, turbine failure, and control problems; de Havilland makes some 50 modifications addressing these hypotheses. Fatigue is not among the suspected causes.
1954-03-23
Comet returned to service
On the strength of the modifications and the absence of a proven cause, the Comet 1's certificate is restored and BOAC resumes flying — a clearance made without the failure being understood.
1954-04-08
G-ALYY breaks up near Naples
South African Airways Flight 201, leased Comet G-ALYY, disintegrates while climbing through ~35,000 ft near Naples on the Rome–Cairo leg; all 21 aboard die. The type is grounded again, permanently for the Comet 1.
1954-spring
Elba wreckage salvaged
The Royal Navy recovers large sections of G-ALYP from ~150 m of water off Elba — one of the first deep-sea accident salvages — giving investigators the physical evidence the first inquiry lacked.
1954-06-24
RAE water-tank test bursts G-ALYU
At Farnborough the RAE pressure-cycles sister airframe G-ALYU in a water tank; after 3,057 simulated flights (1,221 prior service flights plus 1,836 in the tank) the cabin ruptures, the crack originating at the corner of a window cutout.
1954-08–10
Wreckage matches the test
Reassembly of G-ALYP shows fatigue cracking initiating at a rivet hole at the corner of the rear ADF antenna window and propagating to fast fracture — the same mechanism the tank reproduced.
1954-10–11
Cohen Court of Inquiry reports
The public inquiry under Lord Justice Cohen concludes the accidents were caused by structural failure of the pressure cabin due to fatigue originating at a window cutout; design stress concentrations and the absence of full-scale fatigue testing are central findings.
1955–1958
Comet redesigned and re-certified
The Comet 4 emerges with thicker fuselage skin, oval windows, redesigned cutouts, and reinforcement; British airworthiness rules are amended to mandate full pressure-cabin fatigue testing before certification.

The Build — A Pressure Vessel Cycled to the Edge Without a Fatigue Test

The Comet was built to fly higher than anything before it, and that ambition wrote the failure into the airframe. Cruising at 35,000–40,000 feet meant a cabin held at a pressure difference of roughly 8 psi above the thin outside air — a load applied and removed in full on every flight, so the fuselage was in effect a thin-walled aluminium-alloy balloon inflated and deflated once per sortie. De Havilland tested the cabin to high static pressures, far beyond operating pressure, to prove it would not burst on a given flight, but that proof could not reveal what repeated cycling would do over thousands of flights. Static strength and fatigue strength are different properties: the Comet was qualified for the first and exposed to the second.

The skin gauge was thin — chosen to save weight and reach the record ceiling — and into it were cut the openings every airliner needs: passenger windows, escape hatches, and antenna apertures. The near-rectangular passenger windows had relatively sharp corners, and a sharp internal corner in a loaded sheet is a stress raiser, running local stress several times the surrounding average. The more dangerous detail was on the upper fuselage, where a roughly square cutout carried the ADF radio-navigation antenna window. The intended assembly used Redux bonding with drilled holes; in practice the holes around these cutouts were punch-riveted, a faster method that left tiny pre-existing cracks at the hole edges before first flight. The stage was set: a thin skin, a sharp corner multiplying stress, a manufacturing flaw seeding a crack at that corner, and a full pressure cycle on every flight to drive it — with no full-scale fatigue test in the certification, because no rule yet required one.

The Failure Sequence — One Cycle Too Many

Each time a Comet climbed the cabin inflated and the skin around the ADF cutout stretched; each time it descended it relaxed. At the stress-concentrated corner the metal saw a far larger alternating stress than the calculations of the day predicted, and from the punch-riveted hole there a fatigue crack advanced microscopically with every cycle — a process invisible inside and out, leaving no leak, no noise, no warning the crew could detect. The estimated initial defect was on the order of 100 micrometres, smaller than a human hair, and it grew flight by flight toward critical length.

On G-ALYP that length was reached at roughly 27,000 feet near Elba, after about 1,290 flights. When the crack passed criticality the skin could no longer hold the pressure: it tore open at the speed of sound in aluminium, the crack outrunning the structure's ability to redistribute the load. The cabin decompressed explosively, the fuselage failed catastrophically, and the aircraft broke into pieces in seconds — too fast for any crew action, too high for survival. No fire started the sequence; the post-break-up evidence of burning was a consequence, not a cause. Eighty-nine days later G-ALYY repeated the script almost exactly, breaking up while climbing through about 35,000 feet near Naples — two aircraft, two near-identical fractures, one mechanism, the second loss occurring only because the first cause had not been found before the Comet was cleared to fly again.

The Reckoning — A Tank, a Crack, and a Rewritten Code

The breakthrough came from refusing to argue from the wreckage alone. The RAE submerged sister airframe G-ALYU in a water tank large enough to take the whole fuselage and cyclically pressurized the water-filled cabin to flight load; water, being nearly incompressible, meant that when the structure failed it would deflate harmlessly rather than detonate, preserving the fracture for study. After 3,057 simulated flights the cabin burst, the origin unambiguous: a fatigue crack at the corner of a window cutout. When the Royal Navy's salvaged sections of G-ALYP were reassembled at Farnborough, the recovered structure told the same story, the initiation traced to the riveted corner of the rear ADF window. Experiment and wreckage agreed, conclusively in a way neither alone could be.

The Court of Inquiry under Lord Cohen delivered the verdict in the autumn of 1954: structural failure of the pressure cabin brought about by fatigue, with stress concentrations at the cutout corners and the absence of full-scale fatigue testing as the governing engineering failures. The deeper fault was a certification process that proved static strength and never tested fatigue life at all. De Havilland and Britain paid for that lesson with the commercial lead in jet airliners, which passed to Boeing while the Comet was grounded and redesigned.

Contributing Factors

01
Static strength proof mistaken for fatigue qualification
De Havilland pressure-tested the cabin far above working pressure to show it would not burst, and treated that as proof of structural adequacy. But surviving one large load says nothing about surviving thousands of working loads; fatigue is a distinct failure mode with its own physics. A cyclically loaded pressure cabin must be qualified by full-scale, full-life fatigue testing, not extrapolated from a single proof load.
02
Sharp cutout corners that multiplied stress
Every opening in a loaded skin — passenger window, hatch, antenna aperture — is a stress raiser, and a near-square corner can multiply local stress several-fold above the field. The Comet's rectangular windows and squarish ADF cutout placed the highest stresses exactly where the geometry was least forgiving. The corner radius is a primary fatigue-life parameter and must be designed by stress analysis, not by what is easy to cut.
03
A manufacturing method that seeded the crack
The fastener holes around the critical cutouts were punch-riveted rather than drilled and bonded as intended, leaving microscopic cracks at the hole edges before first flight. A stress concentration with a pre-existing crack is lethal because it skips the long initiation phase and goes straight to propagation. The as-built fatigue life is set by the worst hole, so shop methods must be controlled as tightly as the drawing.
04
A missed structural warning re-attributed to the weather
When G-ALYV broke up in 1953, the loss was charged to a storm gust or pilot over-control rather than investigated as a possible airframe defect, and the fleet flew on. The first unexplained structural break-up of a novel airframe must be treated as a structural suspect until disproven; a convenient meteorological or human-error explanation should never close a structural question.
05
Re-certification without a proven cause
After Elba, de Havilland made dozens of modifications addressing engine and control hypotheses and the Comet was returned to service three months later, with the actual mechanism still unknown. The fix addressed the suspects, not the culprit, and G-ALYY died for it. Return to service requires the failure to be positively identified and demonstrably eliminated, not merely some causes ruled out.

Aftermath

Fifty-six people died across the two break-ups, and the Comet 1 never flew commercially again. The water tank itself became the template for full-scale fatigue testing of pressurized airframes worldwide, and the principle that a complete pressure cabin must be cycled to failure on the ground before passengers cycle it in the air entered British airworthiness law: the British Civil Airworthiness Requirements were amended, BCAR D3-7 adding a clause — traceable to the Elba and Naples reports — that required a repeated-loading test on a complete pressure cabin not previously used for static strength work. The redesigned Comet 4 returned in 1958 with thicker skin, oval windows, and reinforced cutouts, and flew safely for decades, including as the Nimrod maritime patrol airframe. But the commercial prize was lost: while the Comet sat grounded, Boeing's 707 and Douglas's DC-8 took the market the Comet had opened.

The deeper legacy was conceptual. The Comet investigation is the origin point of modern aircraft fatigue and damage-tolerance design — the doctrine that structures will contain cracks, that those cracks must grow slowly and be found before critical length, and that "safe-life" and "fail-safe" philosophies must be proven by test, not assumed by calculation. The Comet became the canonical case, and "the Comet windows" the byword for a stress concentration nobody analysed until it killed.

Lessons

  1. Qualify cyclically loaded structures by fatigue test, never by static proof: a cabin that survives one over-pressure can still crack and burst under thousands of normal pressurizations, so run a complete structure to failure on the ground before it carries passengers.
  2. Design cutout corners by stress analysis, not by convenience: treat the radius of every window, hatch, and antenna opening as a primary fatigue parameter, and put reinforcement where the stress concentrates rather than where it is easy to build.
  3. Control the shop process at high-stress details as tightly as the drawing: a faster fastening method that leaves pre-cracked hole edges silently spends the structure's entire fatigue life before first flight.
  4. Treat the first unexplained structural break-up as a structural fault until proven otherwise: do not let a storm, a gust, or a pilot absorb a signal that the airframe itself may be failing and let the real defect fly on.
  5. Return to service only on a proven cause, never on ruled-out suspects: modifying everything you suspect is not the same as fixing what failed, and clearing an aircraft before the mechanism is identified buys the next identical accident.

References