On the morning of January 10, 1954, the de Havilland Comet G-ALYP left Rome on the final leg of a flight from Singapore to London, climbing through 27,000 feet in clear weather. About half an hour after takeoff it broke apart over the Mediterranean and fell into the sea near the island of Elba, killing all 35 people aboard, ten of them children. Three months later, on April 8, a second Comet, G-ALYY, broke up the same way over the sea near Naples, killing 21; too little wreckage was ever recovered to prove the cause, but investigators judged it the same failure.
Before the Comet entered service, de Havilland had already tested its pressure cabin for exactly this kind of fatigue. A section of cabin skin was proof-tested to 16.5 pounds per square inch (twice the pressure the real cabin would ever fly at), then cycled until a crack opened near a window corner, after 18,000 simulated flights. What nobody grasped was that proof-testing the section to double pressure before the fatigue counting began had toughened the very metal under study, and that a section propped up on substitute bulkheads did not carry stress the way a whole fuselage does. The test had answered a real question honestly. It was the wrong question.
After the second crash, the Royal Aircraft Establishment at Farnborough, under Sir Arnold Hall, was given the investigation, and ran a test nobody had attempted before: submerge an entire retired Comet, G-ALYU, in a specially built water tank — water, because a ruptured cabin full of compressed air would have gone off like a 500-pound bomb — and pressurize it again and again to reproduce the stress of a full flight in about five minutes. Yoke Uncle had already flown 1,221 real pressurized flights for BOAC; that June, 1,836 simulated cycles later, the skin split at a rivet hole beside the forward escape hatch. The real G-ALYP had broken up after only 1,286 pressurized flights; G-ALYY, after 903. The Royal Navy recovered about seventy percent of Yoke Peter's wreckage from the seabed, and inside it investigators traced the fatal crack to a bolt hole beside a roof window used for radio direction-finding, a different corner from the one that failed in the tank and evidence that the danger was general rather than one flaw in one place.
Every fact in that sequence had been true all along: the strength of the alloy, the shape of the windows, the metal's real fatigue life under pressure. Nobody at de Havilland had lied, and nothing about the failure was put down to carelessness; the engineers had built at the edge of what aeronautical science then knew. A test that measures a stiffer stand-in, or proofs a part before straining it, does not quite lie. It answers a question nobody meant to ask.
In the House of Commons in February 1955, a member of Parliament asked the transport minister to confirm that Farnborough's water tank had been a lesson to the world in thoroughness. He agreed. Full-scale fatigue testing of a whole airframe, to several times its design life, became standard practice for certifying every jet airliner after the Comet, because a water tank had found the crack a smaller, kinder test missed.