Failure Knowledge Database / 100 Selected Cases

Crash of B-747 of El Al Israel Airlines
by Fatigue Failure of Engine Fuse Pin
Oct. 4th, 1992, near Schiphol Airport, Amsterdam, The Netherlands
KOBAYASHI, Hideo (Yokohama National University) andTERADA, Hiroyuki (Japan Aerospace Technology Foundation)(Summary)
Soon after the take-off of a Boeing 747 cargo air transport of El-Al Israel Airlines, the two engines on
the ri ght w ing dro pped off, and t he a ir tr ansport w ent o ut of co ntrol, finally c olliding i nto the a partmentbuilding. Th irty-nine a partment h abitants were killed i n this accident. T he c ause of e ngine s eparation
during take-off phase was fatigue failure of the pylon fuse pin.
1. Component
Pylon fuse pin (Pylon is the structural component connecting the jet engine to the main wing. The roleof the fuse pin is to allow the engine to separate from the wing under the strong impact load that occurs in
the event of a crash or hard landing in order to protect the fuselage from engine fire.)
2. EventThe freight aircraft of El-Al Israel Airlines took-off from Schiphol Airport, Amsterdam, at 18:22 local
time, bound for Tel Aviv. Six minutes after the take-off, an engine fire broke out at the No.3 and then at theNo.4 e ngines. The aircr aft went o ut of contr ol a nd c ollided i nto t he apartm ent bu ilding ne ar th e airp ort.
Four persons on-b oard an d 39 apartm ent hab itants were killed. F urthermore, the aircraft was carrying alarge amount of plated uranium and chemical materials for making sarin (highly poisonous lethal gas). As aresult of t his accident, m any people , not only the inhabitants of the apartm ent buil ding but a lso t hose
involved in the re scue and in vestigation op erations, suf fered afte r ef fects from the e xposure to t hese
substances.
The investigation found that the two engines were torn-off from the main wing before the collision.
3. Course
The aircraft had been in ser vice for more than 13 years and had ex perienced 10,107 flights and 45,746
flight hours. However, during this entire time, the fuse pins had not been inspected. Even though severalcases that called into question the integrity of the engine fuse pin had been reported on this type of aircraftfrom all over the w orld before the accident, Boeing did not ta ke any action to issue a Servi ce Bulletin forinspection and maintenance of this structural component.
4. Cause(1) A fuse pin of the No.3 engine fractured as a result of corrosion fatigue. (The engine is sustained by1

Failure Knowledge Database / 100 Selected Cases

four fuse pins.) As a result, the engine became unstable and began to vibrate. The vibration caused fuelto leak. The leaking fuel caught fire, and then the other fuse pins were torn off by overload and heating,and the engines finally dropped off.
(2) When the two engines dropped off during the critical phase of the initial climb, the cockpit crew could
not put the fail-safe mechanism into operation, and they lost control of the aircraft.
5. Immediate Action
Four days af ter B oeing issued t he Ser vice Bulletin (SB) for th e fus e pin, t he Federa l Aviation
Administration (FAA) issued the Airworthiness Directive (AD), which overrode the previous SB by Boeing,
requesting all operators to inspect the fuse pins of their aircraft. The AD requested that eight items related
to the integrity of the fuse pins should be inspected within 30 days, while the time limitation was 90 dayson the SB. O n June 18th, 1993, Boeing announced that reinforcement of the joint of the pylon would becarried out to prevent the separation of the engines for all B-747 aircraft (948 air craft) in operation aroundthe world.
6. Countermeasure
The fuse pin is manufactured with a n otch deliberately included so t hat it will break under the impact
load in t he event of em ergency. Howe ver, a cylindrical p in wit h a notch is l ikely to be su bjected toexcessive c orrosion a nd fat igue dam age. Therefore, t he fuse pin w as repl aced by a new type w ithout anotch.
However, the fail-safe concept for the case of two-engines-out at the climbing phase is still unresolved.
7. Knowledge
The fail-safe mechanism that had been designed for the aircraft did not function effectively in this case.
For a four engine aircraft such as the B-747, the aircraft should remain controllable even if any two engines
fail. However, in fact the aircraft was unable to hold its attitude and crashed. The situation for the fuse pin
was similar. The engine was attached to the wing by four fuse pins. However, the engine dropped off fromthe pylon when only one of the four fuse pins was fractured by corrosion fatigue. The fail-safe mechanism
plotted by designers must be verified by conducting experiments under the critical conditions.
8. Background
The rel uctance of B oeing to resp ond after the sam e kin d of ac cident of C hina Airlines h as b eenquestioned. O ne of th e reas ons m ay be the l arge share that t he J umbo jet oc cupies in the m arket of a irtransport. In the case of the DC-10 crash in M ay 19 79 at Chicago O' hare A irport, where 27 3 peo ple onboard were killed, the FAA suspected that structural defects might have been responsible and ordered theimmediate cancellation of all D C-10 f lights. T he r eal c ause w as foun d t o b e th e p oor q uality o fmaintenance, and the order was withdrawn one month later. Regarding this matter, some people said that
the FAA could order the cancellation of all flights of the aircraft, because it was DC-10. However, if it had
been a Boeing 747, the cancellation of all flight might paralyze air transportation.
2

Failure Knowledge Database / 100 Selected Cases

In fact, the n umber of D C-10's in opera tion w as ap proximately 20 0 at that t ime, w hile th e c urrent
number of B- 747's in operation is about 900. If the flights of all Jumbo jets were cancelled, the influence
could be tremendous, as a g eneral inspection and maintenance of all B-747's may cause great difficulty tothe operators all over the world. This thought might make FAA hesitate the quick response.
9. SequelAt 13:38 on March 1st, 1994 (JST), Northwest Airlines Ft. 018, a B-747 bound for New York via Narita
from Hong Kong, arrived at Narita Airport. As it touched down, the No. 1 engine partially came off fromthe left win g. The ai rcraft continued i ts landing ru n dragging th e en gine fro m t he wi ng. Although a fi rebroke out, it was extinguished in 10 minutes. All 248 persons onboard were uninjured.
The i nvestigation i nto t he i ncident fo und tha t o ne of t he fo ur fuse- pins, lo cated at fron t sid e of th econnection bet ween th e engi ne an d p ylon, was broken. As a resul t, the engine became partially detachedfrom the wing.
Prior to t his incident, i n 1 992, t he FAA and t he Ministry of T ransportation had i ssued AirworthinessDirectives (AD) to every aircraft operator to conduct general inspections of the fuse pins, including visualand ultra sonic inspections every 500 flights for the old type of fuse pin and every 1,000 flights for the new
type of fuse pin, and to replace the fuse pins wi th new ones if c orrosion or crack-like damage is detected.
However, the broken pin in this incident was not i ncluded in the scope for ins pection because of it w as alow load- bearing component with few damage cases reported.
The necessity of including this fuse-pin in the general inspection was pointed out, because damage tothis fuse-pin could result in a serious accident if the fracture were to happen in flight.
10. On the Side
Fail-safe design is based on the idea of r edundancy in the system in order to avoid catastrophic failureof the w hole syste m in opera tion e ven if a critical el ement of the systembecam e da maged ornon-functional.
The fail-safe design of a structural system aims at maintaining the structural function of the system forthe designated period even if a component is lost or fractured. For example, in the event of crack initiationin an element, fail-safe design aims to contain the damage in a limited area and allow other elements to takeover the rol e tha t t he damaged el ement bore. Mu ltiple l oad pa th struc ture, l oad alleviation struc ture,
combined structure, and double structure are the examples of fail-safe structure system designs.
The fuse pin of the pylon should be designed as a f ail-safe component. The relation between the stressamplitude on the fuse pin and the fatigue life is shown in Fig. 2. The fatigue lifetimes of fuse pins without
notches vary considerably so that each of the f our fuse pins holding the engine to the wing will generally
have different lifetimes. Therefore, if the engine is att ached to the wing by four fuse pins without notches,normally it w ill n ot dro p o ff eve n if one of these f use pi ns r eaches the end of its fati gue lifetime andbecomes broken, and the integrity of the structural system would be maintained. In the case of the notchedfuse pin, the variation of the fa tigue l ifetime is m uch sm aller. Th e n otch pro vides a location for cra ck
initiation and accelerates the crack growth. Consequently, the failure of one notched fuse pin tri ggers the3Failure Knowledge Database / 100 Selected Cases

failure of the rest in a short period. This almost instantaneous fracture of all four fuse pins is what occurredin the accidents of China Airlines and El-Al Israel Airlines.
The role of the fuse pin is to allow the engine to break off under the impact load in the event of a crashlanding or other hard landing in order to protect the fuselage from engine fire, because a dragged engine
can often become the so urce of an intensive external fire that leads to the loss of m any lives. In order for
the fuse pins to function properly, they should always be kept free from corrosion damage and fatigue loadin order to avoid unexpected failure during normal operation.
11. Social Impact
Many migrant workers from Turkey were living in the apartment building into which the cargo transportof EL-AL Airlines crashed. Thirty-nine habitants living in the apartment died in the crash.
The cargo also caused a large impact to s ociety. The transport was carrying depleted uranium and a lso
chemical raw materials for producing sarin, highly poisonous lethal gas. Thousands of people, not only theinhabitants of the a partment building but also those who participated in t he rescue or who were otherwise
involved in the accident, suffered long after from the after effects from exposure to these materials.
12. Information Source(1) CAA Accident Summary, 1996.
(2) Predicted Tragedy? Crash of Jumbo Jet in Amsterdam' Asahi Newspaper, Oct. 27th, 1992.
(2) 'Reinforcement of Engine Joint, All Jumbo Jet of Boeing', Asahi Newspaper, June 19th, 1993.
(3) 'Unexpected Break of Fuse Pin, Northwest Engine Dropped When Landing' Asahi Newspaper, March
2nd, 1994.
13. Primary Scenario
01. Ignorance
02. Insufficient Knowledge
03. Misapprehension
04. Insufficient Analysis or Research
05. Insufficient Prior Research
0 6. Lack of Surveillance/Review
07. Usage
08. Operation/Use
09. Aircraft Operation
10. Usage
11. Maintenance/Repair
12. Inspection
13. Parts Exchange
14. Failure

4Failure Knowledge Database / 100 Selected Cases

15. Fracture/Damage
16. Fracture of Fuse Pin
17. Drop of Engine
18. Failure
19. Large-Scale Damage
20. Crash of Aircraft
21. Secondary Damage
22. External Damage
23. Fracture of Apartment
24. Bodily Harm
25. Death
26. Fatally Injured by Crash
27. Damage to Society
28. Change in Perception
29. Distrust to Aviation safety

5Failure Knowledge Database / 100 Selected Cases

Main Engines dropped off
Main Wing

Fuse Pin

Fig. 1Engine

Schematic Structure of Pylon.

6Failure Knowledge Database / 100 Selected Cases

500

Stress Amplitude σa ( MPa )

400

300
Un-notched Material200Notched Material

1000103104105106107Fatigue Life Nf ( cycles )Fig. 2

Relation Between Stress Amplitude and Fatigue Life of Fuse Pin.

7108