Historical facts The DeHavilland Comet was the first production commercial jet airliner that went into

service in 1952. The earliest production aircraft designated G-ALYP was loaned to the British Overseas Airways Company and inaugurated the first scheduled overseas flight from London to Johannesburg with fare-paying customers on-board. Much of the design is similar to the commercial airliners seen around the world today. The Comet had four turbojet engines (turbofan are now the norm for reduced noise and better fuel economy), which made the aircraft muchmore efficient at higher altitudes of flight than its propeller-driven contemporaries. Furthermore, it featured an internally pressurised fuselage/cabin and also pioneered design elements which were unusual at the time such as backward-swept wings, integral wing fuel tanks and a four-wheel bogie undercarriage (1). Unfortunately, the DeHavilland Comet also influenced modern aircraft design by two catastrophic failures. Result of investigation Within two years of entering service two of the Comet fleet fell apart during ascent to cruise altitude with a total loss of the aircrafts and the death of 56 passengers. The first production aircraft G-ALYP, scheduled on BOAC Flight 781 from Rome Ciampino to London Heathrow, was lost on January 10, 1954 by the fuselage breaking up in mid-air 20 minutes after taking off. BOAC voluntarily grounded its fleet and engineers suggested 60 immediate modifications to the design to rectify some of the design flaws that were believed to have caused the accident (2). Comet flights resumed on March 23, 1954 but only two weeks later on April 8, 1954 Comet G-ALYY, on the chartered South African Airways Flight 201 from Rome Ciampino to Cairo, again crashed into the Mediterranean sea within 30 minutes of take-off. The entire Comet 1 fleet was then grounded, its Certificate of Airworthiness revoked and the line production at DeHavilland in Hatfield suspended. A number of investigations followed led by Sir Arnold Hall at the Royal Aeronautical Establishment in Farnborough, UK. Most critically this included a full-scale cyclic internal pressurisation test of the fuselage in a water tank of the aircraft G-ALYU removed from service for this purpose. G-ALYU had accumulated 1221 internal pressurisation cycles in service and after a further 1836 cycles in the water tank the cabin ripped open after a proof-test loading 33% higher than the nominal pressurisation cycle loading (2). Evidence of fatigue cracking was found that originated from the aft

lower corner of the forward escape hatch and also from the right-hand aft corner of the windows illustrated in Figures 1 and 2 below.

Underlying theory Both of these locations feature sharp right hand corners which cause local areas of high stress-concentration that are provide very benign conditions for crack initiation and propagation under fatigue loading. Furthermore, circular cylindrical structures, such as the aircraft fuselage, develop internal membrane stresses (constant through the thickness) to resist the internal pressure loads. As a result of the curved shape of the fuselage these forces induce secondary out-of-plane bending moments acting to straighten-out the curvature. In addition, the stress concentration around the the escape hatch and window cutouts was exacerbated by countersunk bolt holes creating a knife-edge in both the primary skin and doubler reinforcement (Figure 3) (2). Swift (1987) has argued that the shell structure would have had enough residual strength to sustain large and easily detectable cracks if they had grown midway between two window cutouts. However, cracks that grew across a bay from one cutout to the next would not be tolerable and result ultimate failure of the structure.

Preventive measurement The most notable lesson learned from the Comet disaster is that viewing windows are no longer designed square but with rounded edges to reduce any stress concentrations. Another immediate lessons is that crack-stoppers are now placed between framecutouts that take the shape of circumferential stiffeners that break-up the fuselage into multiple sections and thus prevent the crack from propagating from one window to the next. Most importantly however, before and during the Comet era the aircraft design philosophy was predominantly SAFE-LIFE, which means that the structure was designed to sustain the required fatigue life with no initial damage and no accumulation of damage during service e.g. cracking (1). The Comet accidents showed that around stress concentration cracks would initiate and propagate much earlier than expected, such that safety could not be universally guaranteed in the SAFE-LIFE approach without uneconomically short aircraft service lives. For this reason the FAIL-SAFE design philosophy was developed in the late 1950s. All materials are assumed to contain a finite initial defect size before entering service that

may grow due to fatigue loading in-service. The aircraft structure is thus designed to sustain structural damage without compromising safety up to a critical damage size that can be easily detected by visual inspection between flights. All inspections are coupled with crack propagation calculations that guarantee that an observed crack is not susceptible to grow to the critical size between two inspection cycles, in which case adequate repair is performed. Furthermore, the structure is designed to be damage tolerant with multiple load paths and built-in redundancies that impart residual strength to the aircraft in case the primary structure is compromised in-service.