Case file
- What happened: In 1954, two de Havilland Comet 1 airliners broke apart in mid-flight over the Mediterranean, shedding fuselage sections at cruising altitude. Both losses traced to the same structural failure mode under repeated cabin pressurisation.
- Scale: 56 dead across two confirmed fatigue-related in-flight break-ups. The entire Comet fleet grounded. Britain lost its lead in commercial jet aviation to Boeing and Douglas.
- Root cause: Square cabin window and hatch corners created severe stress concentrations under repeated pressurisation cycles. Cracks initiated at the corners, propagated through the fuselage skin, and produced catastrophic hull rupture.
- The bill: Beyond the lives lost, the Comet programme was reset. Redesigned variants with oval windows and reinforced fuselage structure did not re-enter service until 1958 — by which point the market had moved on.
~56Lives lost in two confirmed fatigue hull losses
1954Year entire Comet fleet was grounded
1958Year redesigned Comet 4 re-entered service
The situation
The de Havilland Comet was a marvel. First commercial jet airliner, entered service in 1952, years ahead of anything Boeing or Douglas had on the drawing board. It halved travel times. It was pressurised to a higher cabin altitude differential than anything before it — which meant the fuselage was a pressure vessel cycling through a full inflation–deflation sequence on every flight. That last detail is what killed people. The Comet was designed in an era where static strength calculations were the gold standard. You calculated the maximum expected load, applied a factor of safety, verified the structure could hold, and certified the aircraft. What nobody had fully accounted for was what happens to that same structure when the load isn't applied once but applied, removed, and re-applied thousands of times. Metal doesn't care about your safety factor. Metal cares about cycles.How it unfolded
The first warning came in May 1953. A Comet broke up near Calcutta in severe weather — 43 dead. Investigators attributed the loss to extreme turbulence overload, not fatigue. It should have been a louder signal than it was. On 10 January 1954, BOAC Flight 781 disintegrated over the Mediterranean near Elba. All 35 on board killed. The fleet was inspected, some modifications made, flights resumed. Three months later, South African Airways Flight 201 suffered an identical in-flight break-up near Naples — 21 dead. No turbulence. No fire. No bomb. The aircraft came apart at cruising altitude. The fleet was grounded permanently. The Royal Aircraft Establishment ran one of the most exhaustive failure investigations in history — recovering wreckage from the seabed, reconstructing fuselage sections, and running full-scale cyclic pressurisation tests on an intact Comet airframe submerged in a water tank. That test airframe eventually tore itself open at a forward escape hatch cutout. The crack pattern matched the recovered wreckage.Root-cause anatomy
The technical failure is well understood. Every cutout in a pressurised structure concentrates stress at its edges. A circular hole distributes that stress evenly around its perimeter. A square corner does the opposite — it funnels stress into a sharp geometric transition, multiplying the local stress to roughly three to four times the nominal load in the surrounding skin. Under static load, the material holds. Under cyclic load, those concentrated stress peaks become crack initiation sites. Crack propagates. Skin tears. Fuselage bursts. But the organisational failure is where I focus. De Havilland had brilliant aerodynamicists and stress engineers. What they lacked was a fatigue discipline. No one owned the question of what happens to this joint, this cutout, this rivet pattern after two thousand cabin pressurisations. The design was validated for strength. It was never validated for endurance.A drawing that passes stress review but has never met a fatigue cycle is a hypothesis, not a design.
Where the quality system failed
In modern AS9100 terms, the Comet's design validation failed at the PFMEA level. A design-phase FMEA should have identified square cutout corners in a pressurised skin as a high-severity failure mode. Severity: catastrophic. Occurrence: high, because pressurisation cycles are the primary operational load, every flight. Detection: low, because fatigue cracks are invisible to the naked eye until final fracture. That is a red risk priority number by any scoring method you choose. The audit trail would have asked simple questions. Was cyclic fatigue testing performed on representative fuselage structure? No. Was the window cutout geometry analysed for stress concentration under cyclic load? No. Was the ADF antenna cutout and escape hatch — both square-cornered — subjected to accelerated life-cycle testing? No. Each of those is a design validation gate that either didn't exist as a concept or wasn't applied to this programme. Change control played its part. When the 1953 Calcutta loss occurred, the modifications made afterwards were minor reinforcement work, not a fundamental review of cutout geometry. A proper CAPA gate at that point — one that asked whether the structural failure shared root causes with other vulnerabilities in the same fuselage — could have forced the fatigue question before SAA 201 fell out of the sky three months later.What would have caught it
Three things, all now standard aerospace practice, all existing because of cases like this. First: cyclic fatigue testing on full-scale fuselage sections. Pressurise the hull, depressurise it, repeat until it fails. Note where it fails. Redesign that location. This is mandatory under AS9100 design validation for pressurised structures. Second: PFMEA-driven cutout geometry review. Any opening in a stressed skin — window, door, hatch, antenna mount — gets analysed for stress concentration factor and rated for fatigue life before the drawing is released. Square corners flagged. No debate. Third, and this is the part that still amazes me: the fix wasn't engineering genius. It was geometry. Increase the corner radius, distribute the stress, eliminate the initiation site. The Comet 4's oval windows weren't an aesthetic choice. They were a PFMEA corrective action.My take
At Airbus, every design change that touches pressurised structure goes through a fatigue review so thorough it would seem excessive to anyone outside aerospace. We don't just calculate whether the part holds. We calculate how long it holds, how it fails when it finally does, and whether that failure is detectable before it becomes critical. That discipline exists because the Comet taught the industry that static strength is a necessary but insufficient condition for airworthiness. I've seen this same pattern in automotive, compressed into a less fatal scale. At SNOP, I inherited a stamped bracket that passed every static load test on the bench. It failed in the field after roughly 40,000 door-slam cycles because the stamping radius created a stress concentration nobody had modelled. Same physics. Same organisational gap. A PFMEA review with cyclic load as the driving failure mode would have caught it before a single part shipped. We fixed the radius, added a cyclic test to the validation protocol, and the field failures went to zero. Cost of the fix: a tooling modification and a test fixture. Cost of the original failure: months of warranty claims and a customer escalation that consumed my engineering team for a full quarter. The Comet is the reason my APQP checklists require fatigue data before a design review closes. Not because someone wrote a procedure. Because fifty-six people proved what happens when you skip it.What this means on your floor
- If your design validation has static load cases but no cyclic fatigue cases, you are flying a Comet. Fix it before your customer finds the failure mode for you.
- Any geometric discontinuity — hole, corner, notch, weld — in a load-bearing structure needs a stress concentration analysis and a fatigue life estimate. No exceptions.
- A CAPA gate triggered by an early field failure must ask whether the root cause is systemic, not just local. The Calcutta crash should have triggered a full structural fatigue review. It triggered a minor modification.
- Your PFMEA is only as good as the failure modes your team can imagine. If nobody on the team has cyclic fatigue experience, bring someone in who does.
