| Case Name |
Crash of B-747 of El Al Israel Airlines by Fatigue Failure of Engine Fuse Pin |
| Pictograph |
|
| Date |
October 4, 1992 |
| Place |
Crash of B-747 of El Al Israel Airlines by Fatigue Failure of Engine Fuse Pin |
| Location |
Schiphol Airport |
| Machinery |
Pylon fuse pin (Pylon is the structural component connecting the jet engine to the main wing. The role of the fuse pin is to allow the engine to separate from the wing under the strong impact load that occurs in the event of a crash or hard landing in order to protect the fuselage from engine fire.) |
| Overview |
Soon after the take-off of a Boeing 747 cargo air transport of El-Al Israel Airlines, the two engines on the right wing dropped off, and the air transport went out of control, finally colliding into the apartment building. Thirty-nine apartment habitants were killed in this accident. The cause of engine separation during take-off phase was fatigue failure of the pylon fuse pin. |
| Incident |
The freight aircraft of El Al Israel Airlines took-off from Schiphol Airport, Amsterdam, at 18:22 local time, bound for Tel Aviv. Six minutes after the take-off, an engine fire broke out at the No.3 and then at the No.4 engines. The aircraft went out of control and collided into the apartment building near the airport. Four persons on-board and 39 apartment habitants were killed. Furthermore, the aircraft was carrying a large amount of plated uranium and chemical materials for making sarin(highly poisonous lethal gas). As a result of this accident, many people, not only the inhabitants of the apartment building but also those involved in the rescue and investigation operations, suffered after effects from the exposure to these substances.
The investigation found that the two engines were torn-off from the main wing before the collision. |
| Sequence |
The aircraft had been in service for more than 13 years and had experienced 10,107 flights and 45,746 flight hours. However, during this entire time, the fuse pins had not been inspected. Even though several cases that called into question the integrity of the engine fuse pin had been reported on this type of aircraft from all over the world before the accident, Boeing did not take any action to issue a Service Bulletin for inspection and maintenance of this structural component. |
| Cause |
(1) A fuse pin of the No.3 engine fractured as a result of corrosion fatigue. (The engine is sustained by four fuse pins.) As a result, the engine became unstable and began to vibrate. The vibration caused fuel to leak. The leaking fuel caught fire, and then the other fuse pins were torn off by overload and heating, and the engines finally dropped off.
(2) When the two engines dropped off during the critical phase of the initial climb, the cockpit crew could not put the fail-safe mechanism into operation, and they lost control of the aircraft.
Failure Knowledge Database / 100 Selected Cases
http://shippai.jst.go.jp/en/Serach |
| Response |
Four days after Boeing issued the Service Bulletin (SB) for the fuse pin, the Federal Aviation Administration (FAA) issued the Airworthiness Directive (AD), which overrode the previous SB by Boeing, requesting all operators to inspect the fuse pins of their aircraft. The AD requested that eight items related to the integrity of the fuse pins should be inspected within 30 days, while the time limitation was 90 days on the SB. On June 18th, 1993, Boeing announced that reinforcement of the joint of the pylon would be carried out to prevent the separation of the engines for all B-747 aircraft (948 aircraft) in operation around the world. |
| Countermeasures |
The fuse pin is manufactured with a notch deliberately included so that it will break under the impact load in the event of emergency. However, a cylindrical pin with a notch is likely to be subjected to excessive corrosion and fatigue damage. Therefore, the fuse pin was replaced by a new type without a notch.
However, the fail-safe concept for the case of two-engines-out at the climbing phase is still unresolved. |
| Knowledge Comment |
The fail-safe mechanism that had been designed for the aircraft did not function effectively in this case. For a four engine aircraft such as the B-747, the aircraft should remain controllable even if any two engines fail. However, in fact the aircraft was unable to hold its attitude and crashed. The situation for the fuse pin was similar. The engine was attached to the wing by four fuse pins. However, the engine dropped off from the pylon when only one of the four fuse pins was fractured by corrosion fatigue. The fail-safe mechanism plotted by designers must be verified by conducting experiments under the critical conditions. |
| Background |
The reluctance of Boeing to respond after the same kind of accident of China Airlines has been questioned. One of the reasons may be the large share that the Jumbo jet occupies in the market of air transport. In the case of the DC-10 crash in May 1979 at Chicago O'hare Airport, where 273 people on board were killed, the FAA suspected that structural defects might have been responsible and ordered the immediate cancellation of all DC-10 flights. The real cause was found to be the poor quality of maintenance, and the order was withdrawn one month later. Regarding this matter, some people said that the FAA could order the cancellation of all flights of the aircraft, because it was DC-10. However, if it had been a Boeing 747, the cancellation of all flight might paralyze air transportation.
In fact, the number of DC-10's in operation was approximately 200 at that time, while the current number of B-747's in operation is about 900. If the flights of all Jumbo jets were cancelled, the influence could be tremendous, as a general inspection and maintenance of all B-747's may cause great difficulty to the operators all over the world. This thought might make FAA hesitate the quick response. |
| Sequel |
At 13:38 on March 1st, 1994 (JST), Northwest Airlines Ft. 018, a B-747 bound for New York via Narita from Hong Kong, arrived at Narita Airport. As it touched down, the No. 1 engine partially came off from the left wing. The aircraft continued its landing run dragging the engine from the wing. Although a fire broke out, it was extinguished in 10 minutes. All 248 persons onboard were uninjured.
The investigation into the incident found that one of the four fuse-pins, located at front side of the connection between the engine and pylon, was broken. As a result, the engine became partially detached from the wing.
Failure Knowledge Database / 100 Selected Cases
http://shippai.jst.go.jp/en/Serach
Prior to this incident, in 1992, the FAA and the Ministry of Transportation had issued Airworthiness Directives (AD) to every aircraft operator to conduct general inspections of the fuse pins, including visual and ultra sonic inspections every 500 flights for the old type of fuse pin and every 1,000 flights for the new type of fuse pin, and to replace the fuse pins with new ones if corrosion or crack-like damage is detected. However, the broken pin in this incident was not included in the scope for inspection because of it was a low load- bearing component with few damage cases reported.
The necessity of including this fuse-pin in the general inspection was pointed out, because damage to this fuse-pin could result in a serious accident if the fracture were to happen in flight. |
| Incidental Discussion |
Fail-safe design is based on the idea of redundancy in the system in order to avoid catastrophic failure of the whole system in operation even if a critical element of the system became damaged or non-functional.
The fail-safe design of a structural system aims at maintaining the structural function of the system for the designated period even if a component is lost or fractured. For example, in the event of crack initiation in an element, fail-safe design aims to contain the damage in a limited area and allow other elements to take over the role that the damaged element bore. Multiple load path structure, load alleviation structure, combined structure, and double structure are the examples of fail-safe structure system designs.
The fuse pin of the pylon should be designed as a fail-safe component. The relation between the stress amplitude on the fuse pin and the fatigue life is shown in Fig. 2. The fatigue lifetimes of fuse pins without notches vary considerably so that each of the four fuse pins holding the engine to the wing will generally have different lifetimes. Therefore, if the engine is attached to the wing by four fuse pins without notches, normally it will not drop off even if one of these fuse pins reaches the end of its fatigue lifetime and becomes broken, and the integrity of the structural system would be maintained. In the case of the notched fuse pin, the variation of the fatigue lifetime is much smaller. The notch provides a location for crack initiation and accelerates the crack growth. Consequently, the failure of one notched fuse pin triggers the failure of the rest in a short period. This almost instantaneous fracture of all four fuse pins is what occurred in the accidents of China Airlines and El Al Israel Airlines.
The role of the fuse pin is to allow the engine to break off under the impact load in the event of a crash landing or other hard landing in order to protect the fuselage from engine fire, because a dragged engine can often become the source of an intensive external fire that leads to the loss of many lives. In order for the fuse pins to function properly, they should always be kept free from corrosion damage and fatigue load in order to avoid unexpected failure during normal operation. |
| Scenario |
| Primary Scenario
|
Ignorance, Insufficient Knowledge, Misapprehensions, Insufficient Analysis or Research, Insufficient Prior Research, Lack of Surveillance/Review, Usage, Operation/Use, Aircraft Operation, Usage, Maintenance/Repair, Inspections, Parts Exchange, Failure, Fracture/Damage, Fracture of Fuse Pin, Drop of Engine, Failure, Large-Scale Damage, Crash of Aircraft, Secondary Damage, External Damage, Fracture of Apartment, Bodily Harm, Death, Fatally Injured by Crash, Damage to Society, Change in Perception, Distrust to Aviation safety
|
|
| Sources |
(1) CAA Accident Summary, 1996.
(2) Predicted Tragedy? Crash of Jumbo Jet in Amsterdam' Asahi Newspaper, Oct. 27th, 1992.
(3) 'Reinforcement of Engine Joint, All Jumbo Jet of Boeing', Asahi Newspaper, June 19th, 1993.
(4) 'Unexpected Break of Fuse Pin, Northwest Engine Dropped When Landing' Asahi Newspaper, March
2nd, 1994.
|
| Number of Deaths |
204 |
| Consequences |
Many migrant workers from Turkey were living in the apartment building into which the cargo transport of EL AL Airlines crashed. Thirty-nine habitants living in the apartment died in the crash.
The cargo also caused a large impact to society. The transport was carrying depleted uranium and also chemical raw materials for producing sarin, highly poisonous lethal gas. Thousands of people, not only the inhabitants of the apartment building but also those who participated in the rescue or who were otherwise involved in the accident, suffered long after from the after effects from exposure to these materials. |
| Multimedia Files |
Fig_2.Schematic Structure of Pylon
|
|
Fig_3.Relation Between Stress Amplitude and Fatigue Life of Fuse Pin
|
| Field |
Material Science
|
| Author |
TERADA, Hiroyuki (Japan Aerospace Technology Foundation)
KOBAYASHI, Hideo (Yokohama National University)
|
|
