El Al Cargo Flight 1862 lost the Number 3 and Number 4 engines simultaneously when the inboard midspar fuse pin of the Number 3 pylon fractured due to fatigue cracking at a corrosion pit. As the Number 3 engine and its nacelle separated, it struck the Number 4 nacelle, separating both. The combined separation tore through hydraulic lines in the wing area, causing severe control degradation. The aircraft struck a 13-storey apartment complex in Amsterdam’s Bijlmermeer district.
The accident killed 43 people — four crew members and 39 residents of the Groeneveen and Klein-Kruitberg apartment blocks. The investigation revealed a fuse pin design that had a corrosion-initiated fatigue failure mode that the inspection programme, at its mandated intervals, had been unable to detect before fracture.
El Al 1862 lost two engines because the fuse pin holding one of them failed. The fuse pin is designed to fail — but on purpose, in the right conditions. Fatigue failure at a corrosion pit is not the right condition. The inspection programme that should have caught it missed the failure mode.
Date | 4 October 1992 |
Flight | LY 1862 |
Aircraft | Boeing 747-258F |
Operator | El Al |
Fatalities | 43 — 4 crew and 39 on the ground |
Category | Engine Separation / Pylon Fuse Pin / Hydraulic Loss / Urban Impact |
Location | Amsterdam, Netherlands |
The Event
- October 1992: El Al cargo 747 departs Amsterdam Schiphol Airport for Tel Aviv with a full cargo load
- Shortly after departure, climbing through approximately 6,500 feet, the Number 3 engine pylon midspar fuse pin fractures
- The Number 3 engine nacelle separates and strikes the Number 4 nacelle in its path
- Both the Number 3 and Number 4 engines separate from the right wing together
- Hydraulic lines serving the right wing controls are severed; control is severely degraded
- The aircraft is asymmetric, with two engines lost from the right wing
- The crew declare an emergency and attempt to return to Schiphol
- They cannot maintain control; the aircraft enters a right bank and impacts the Bijlmermeer district
- The aircraft strikes the Groeneveen apartment block at high speed and burns
- 43 die — 4 crew, 39 on the ground; property destruction is extensive
The Bijlmermeer disaster had significant additional consequences. Residents of the area subsequently reported health effects they attributed to the cargo. Initial cargo manifests were disputed; investigation into cargo contents continued for years. The accident also destroyed part of a densely populated urban neighbourhood.
Systems Engineering Perspective
From a systems engineering perspective, El Al 1862 reveals the corrosion-initiated fatigue failure mode in the 747 pylon midspar fuse pin — a failure mode where a corrosion pit acts as a stress raiser, initiating a fatigue crack that grows under the repetitive loads of normal flight operations to a critical size before the inspection programme detects it.
A fuse pin designed to provide controlled separation under overload conditions must itself be designed and inspected to prevent premature failure under normal operational loads. El Al 1862 demonstrates what happens when fatigue cracking at a corrosion site produces unscheduled, catastrophic premature failure.
Fuse Pin Function — Designed to Fail, Not to Fracture Prematurely
The 747 pylon midspar fuse pin is a deliberately frangible element — it is designed to fail cleanly in an overload condition, allowing the engine and pylon to separate from the wing without tearing apart the wing structure. This controlled separation capability is a safety feature: an uncontrolled engine separation in an extreme overload event would cause more damage than a controlled separation via the fuse pin.
The fuse pin’s designed failure mode requires it to remain structurally sound under all normal operating loads, failing only when an overload exceeds its specified threshold. Fatigue cracking at a corrosion pit initiates a failure process that does not respect the designed threshold — the pin fails at a load significantly below the designed overload, in conditions for which there is no emergency procedure or structural protection.
A safety-critical frangible element must be protected against failure modes that produce premature fracture below the design load threshold. Corrosion-initiated fatigue is exactly such a mode.
Corrosion Pit as Fatigue Initiator
Corrosion pits act as stress concentration sites. At a corrosion pit, the local stress in a structural member under cyclic loading is significantly higher than the nominal stress. Under fatigue loading — the repeated application of flight loads over thousands of flight cycles — a crack can initiate at a corrosion pit at a nominal stress level that would not have initiated a crack at an uncorroded site.
The fuse pin inspection programme used visual inspection and dimensional checks at mandated intervals. The corrosion pit from which the fatigue crack initiated was below the visual detection threshold. The crack, growing beneath the surface from the pit, was also below visual detection threshold until it had reached a size where fracture was imminent.
Visual inspection cannot detect sub-surface fatigue cracks growing from corrosion pits. Inspection methods for critical frangible elements must be capable of detecting the actual failure mechanism, not just the visible surface condition.
Human Factors Perspective
The human factors analysis of El Al 1862 is a maintenance and inspection programme design case study. The crew performed professionally in the emergency and could not have changed the outcome given the aircraft’s condition after losing two engines from one side.
Inspection Programme vs Actual Failure Mode
The fuse pin inspection programme at the time used inspection methods that were appropriate for detecting visible surface damage and dimensional wear. They were not capable of detecting sub-surface fatigue cracks growing from corrosion pits at the relevant stage of crack development. The inspection programme was designed for the failure modes anticipated in the original design analysis — not for the corrosion-initiated fatigue failure mode that actually killed the aircraft.
An inspection programme is only as safe as its ability to detect the actual failure modes of the components it covers. Inspection methods must match failure modes.
Cascade Failure — One Separation Causing Two
The Number 3 engine’s separation path carried it into the Number 4 nacelle. The geometry of both nacelle positions made this cascade almost certain in a Number 3 separation event. The aircraft’s design had not specifically considered the consequence of a Number 3 fuse pin failure in terms of the damage trajectory of the separating nacelle.
System Interaction Breakdown
1. Corrosion-Initiated Fatigue Not Detectable by Existing Inspection
The failure mechanism was sub-surface and grew below the inspection threshold until fracture.
2. Cascade Separation — Two Engines Lost From One Failure
The Number 3 separation geometry caused the Number 4 separation. The design had not protected against this cascade.
3. Hydraulic Loss From Combined Separation
The combined separation severed hydraulic lines sufficient to make the aircraft uncontrollable.
Significance in Aviation Risk
1. Emergency AD for Fluorescent Penetrant Inspection
An Emergency Airworthiness Directive was issued mandating fluorescent penetrant inspection of 747 pylon midspar fuse pins across the global fleet — a method capable of detecting surface-breaking fatigue cracks that visual inspection would miss.
2. Corrosion Prevention and Control Programme
The accident drove enhanced corrosion prevention and control programme requirements for pylon and wing attachment structures.
3. Inspection Interval Reduction
The inspection intervals for fuse pins were significantly reduced, reducing the window in which an undetected crack could grow to critical size.
Related Aviation Risk Lab Content
Pillar Pages
Maintenance and Airworthiness: Maintenance And Airworthiness
Systems Engineering: Systems Engineering
Design and Certification: Design And Certification
Related Case Studies
Case Study 6: United 232 — Hydraulics, Teamwork: United 232
Case Study 9: Japan Airlines 123 — The Bulkhead: Jal 123
Case Study 30: Lauda Air 004 — The Thrust Reverser: Lauda Air 004
Closing Perspective
El Al 1862 killed 43 people because a corrosion pit initiated a fatigue crack in a fuse pin, and the inspection programme could not detect that crack before it reached critical size. The fuse pin was designed to provide controlled separation. The crack subverted that design, producing uncontrolled, unscheduled, catastrophic failure.
The fluorescent penetrant inspection mandate that followed is the direct engineering response — replacing visual inspection with a method capable of detecting the actual failure mechanism. The corrosion prevention programme requirements address the initiation condition.
Together, they close the gap that El Al 1862 exposed: a safety-critical frangible element subject to a failure mode that the inspection programme was blind to.
El Al 1862 is the case that mandated fluorescent penetrant inspection for 747 fuse pins. The visual inspection that missed the crack was not wrong — it was incapable of seeing what it needed to see.
Related Posts
