Boeing 747-200F

Photo copyright Martin Oertle - used with permission
El Al Flight 1862, 4X-AXG
Amsterdam, Netherlands
October 4, 1992
A Boeing Model 747-200 freighter, powered by four Pratt & Whitney JT9D-7J engines and operated by El Al Israel Airlines, experienced the separation of both engines from the right wing (engines 3 and 4) during climb out from Schiphol Airport, Amsterdam, Netherlands. The separation of both engines resulted in loss of control of the aircraft and subsequent crash, killing all four people on board as well as 43 others on the ground.
It was later determined that the inboard engine and strut (engine 3) had separated from the wing and impacted the outboard engine (engine 4), causing it to also depart the aircraft. This accident was one of several engine separation events leading to an industry-wide change in strut design philosophy.

Photo copyright Torsten Maiwald - used with permission
On October 4, 1992, at 17:20 UTC, El Al Israel Airlines (ELY) Flight 1862, a Boeing 747-200 freighter series airplane with three crewmembers and one non-revenue passenger customer on board, took off from Schiphol Airport in Amsterdam, The Netherlands. The aircraft was on a flight from John F. Kennedy International Airport, New York, to Ben Gurion International Airport, Tel Aviv, with an intermediate stop at Schiphol Airport for a crew change and cargo processing.
The weather was clear and dry at the time of the late afternoon (dusk) departure. The maintenance transit check had been performed prior to departure with no significant defects recorded.
History of flight
Less than 10 minutes after takeoff, at 17:27.30 and at an altitude of 6,500 feet, the flight data recorder indicated the number 3 and 4 engines and their struts departed the aircraft. The copilot transmitted an emergency call: "El Al 1862, mayday, mayday, we have an emergency."
Communication with Schipohl Air Traffic Control (ATC) established the crew's intent for immediate return to the airport. However, the airplane was only seven miles from the airport and was still flying at an altitude of 5,000 feet - too high to accomplish a straight-in approach. Under direction from ATC, the flight crew was to be vectored through an approximately 360-degree pattern of descending turns to intercept the final approach course.

At 17:32 the flight crew informed ATC that "engines number 3 and 4 are out, and we have problems with the flaps." The aircraft turned through a heading of 100 degrees and was maintaining a heading of 120 degrees. The aircraft was in gradual descent for approximately two minutes.
El Al 1862 was cleared for the final approach at 15:33, and directed to turn right to heading 270 to intercept the final approach course. The airplane was then at an altitude of about 4,000 feet, with a groundspeed of approximately 260 knots and on a heading of 120 degrees. According to radar plot, it took about 30 seconds for the aircraft to actually change heading.
When it became apparent the aircraft was going to overshoot the localizer, the controller informed the crew accordingly and directed the aircraft to turn further to a heading of 290 degrees. Twenty seconds later a new heading instruction to 310 degrees was given along with descent clearance to 1,500 feet.
The flight crew acknowledged the instruction at 17:35, but added "we have a controlling problem." Approximately 25 seconds later the copilot indicated a loss of control, and the transmission included audible warnings from the stick shaker and ground proximity warning systems. The airplane crashed into an eleven story apartment building in the Bijlmwemeer, a suburb of Amsterdam, approximately 13 kilometers east of Schipohl Airport. The aircraft was destroyed by the impact and resulting fire.
Wreckage Recovery and Investigation

resulting from the engine separation
View Larger
The number 3 and 4 engines and struts were recovered from the water at the entrance to Naarden Harbour, east of Amsterdam. The engines were still attached to the struts and were located approximately 200 meters apart.
In addition to the water recovery of the engines, numerous engine cowling and reverser parts, some portions of the right wing leading edge structure, leading edge flap number 18, pneumatic ducting, and both strut diagonal braces were recovered on land in close proximity to the engines.
Analysis of the recovered engine and strut components allowed investigators to determine the sequence of the engine separations. Witness marks on both engines indicated that the inboard (number 3) engine had failed first, traveled in an outboard direction, impacted the outboard (number 4) engine, and caused the breakaway of that engine and strut from the airplane.
Design of the 747 Strut

The engine struts (also known as pylons) of the Boeing 747 airplanes are essentially a two-cell torque box connecting the engine to the wing. The strut carries the engine vertical, side, torsional and thrust loads to the wing.
The upper aft end of the original 747 engine struts connects to the wing at five points:
- An upper link connects the strut front spar to the underwing front spar fitting. (Identified as R1 in Figure below)
- A diagonal brace connects the strut lower spar fitting to the underwing lower spar fitting (R2)
- Two midspar fittings connect the strut midspar to the underwing midspar fittings (R3 and R4)
- A single side link connects one of the strut midspar fittings to the underwing side brace fitting (R5)

View Larger
The forward end of the strut supports the engine via the forward and aft engine mounts.
The design of the strut includes provisions to prevent fuel tank rupture in the event of an engine breakaway caused by extreme overloads from engine failure, abnormal flight, or landing. Each of the five strut-to-wing attachments includes a structural fuse pin, which is a hollow pin having less strength than the adjacent structure. Specifically, the wing structure and strut attachment fittings are designed to be stronger than the fuse pins, thus assuring that when a structural overload occurs, the fuse pin fails first and the wing structure (fuel tank) remains intact.
Breakaway Philosophy of the 747 Strut
The original Boeing 747 airplanes were designed to meet the requirements of 14 CFR, Part 25.571, Amendment 0, which requires that the failure of a single principle structural element would not result in catastrophic failure or affect the flight characteristics of the airplane. With the five strut-to-wing attachments identified in the figure above, the strut was designed to be failsafe for vertical loads. This means that if any single component of the strut were to fail, the vertical load could be redistributed to the remaining intact structure and be safely reacted.
At the time of certification of the model 747, The Boeing Company utilized an additional, but less analytical, method of complying with fail-safe requirements. With the addition of the structural fuses at all the strut-to-wing attachment points, it was believed that, in the event of an overload to the strut-to-wing attachment, the fused joints would fail and the strut would safely depart the aircraft. It was assumed the strut would fall away from the aircraft or rotate over the wing. In either scenario, it was assumed the strut would not impose significant collateral damage to the aircraft.
The philosophy of "safe separation" was supported by previous events of engines and struts departing 707 aircraft. As the Boeing 747 is the company's second four-engine transcontinental commercial transport category airplane model, and its design was greatly influenced by the Boeing 707/720 (also powered by four engines), the reliance on 707 in-service experience was accepted by both the manufacturer and the regulatory authorities. Before the 747 was certified, there were numerous incidents of in-flight or ground separation of the engine and strut assembly in the 707/720 fleets, and no serious wing or fuel tank damage was caused during these events.
Fuse Pins

- tested to failure in shear
A structural fuse pin is essentially a pin with a hollowed-out center intended to provide a point of failure at a specific load. Design and manufacturing of a fuse pin typically requires machining out of the center of the pin to limit the strength to a pre-determined level.
Different methods are used during manufacturing to ensure the fuse pin strength is kept at the specified level. For instance, during manufacturing of the fuse pins, each material lot can be tested to determine the strength level of that batch. (It is not uncommon for individual material lot properties to vary somewhat.) The final diameter of the machining of the fuse pins made from each material lot can be varied to correlate to the demonstrated strength properties of the material.
Another check that may be performed by the manufacturer is to test a significant number of sample pins produced from each material lot. Testing is performed to assure that the finished pin performs to the strength level specified. The photo on the right shows the results of one such test. The fuse pin was loaded to its ultimate load and failure occurred at the level specified. In this case failure is evidenced by the excessive deformation of the pin.
El Al 747 Strut Failure Sequence
Once the sequence of the number 3 and 4 engine separations was determined, the focus of this accident investigation became finding the initial cause of the engine number 3 engine separation. Not all parts of the number 3 strut were recovered, and most notably missing was the inboard midspar fuse pin. Investigators analyzed all possible failure sequences of the strut components and followed a process of elimination to reach a final conclusion of the most likely scenario. The failure scenario was determined to be as follows:

- The initial failure occurred at the inboard midspar fuse pin. As this pin was never recovered, this is an assumption which supports the failure sequence. The initial failure of the pin (location "one" in figure above) would result in the ductile fracture of the inboard midspar fitting outboard lug (location "two"). The location two failure was confirmed by metallurgical analysis to have been the result of eccentric loading.
- Failure of the inboard fuse pin eccentrically loaded the outboard midspar fuse pin. Portions of this pin were recovered during the accident investigation. Investigators found this pin had existing fatigue cracking at the outboard shear surface which failed next (location "three"), causing the inboard shear surface to fail in overload (location "four").
- The subsequent failure occurred in the upper link, then the diagonal brace. This last segment of the failure sequence was analyzed by the investigating team and shown to result in a liberated engine and strut trajectory closely resembling that of the El Al flight.
View an animation of the strut-to-wing load path failure sequence below:
View the complete report prepared by Netherlands Aviation Safety Board.
Design Evolution of 747 Fuse Pins
The initial 747 midspar fuse pins were known as "bottle bore" pins. The inner bore of the fuse pin had a complex cross section, similar to the shape of a bottle. The variable cross section of the pin allowed the designers to vary the strength of the pin across the length of the shaft. In this way, the pins would preferentially fail at the interface between the wing lugs and the midspar fitting. However, these machined surfaces also introduced surface shape features that contributed to the initiation of fatigue cracking.

Reports of cracking in bottle bore fuse pins on aircraft in service resulted in the release of the manufacturer's recommendation and an FAA Airworthiness Directive to require the inspection of midspar fuse pins on all 747 aircraft. The AD was released in 1979 and required repetitive inspections of the fuse pins every 2,500 flight hours (approximately 450 flight cycles). Two years later, the manufacturer released updated service information which recommended replacement of the bottle bore fuse pins with an improved design fuse pin having a "bulkhead" configuration. The FAA followed this recommendation with an amendment to the AD, which gave operators the choice of terminating inspections by doing the fuse pin replacement or to continue inspecting indefinitely.
During this time, the aircraft involved was one of a small number on which the bottle bore fuse pins had not been replaced. The last inspection that was conducted in accordance with the AD had occurred 258 flight cycles prior to the accident.
In 1988, seven years after the new style bulkhead fuse pins were put into service, reports of cracking in these pins were received by Boeing. Inspection instructions were released by the manufacturer and mandated by the FAA in 1991 for all aircraft equipped with bulkhead-style fuse pins.
In 1992, with the evidence from the El Al accident investigation focusing on fatigue cracking of bottle bore fuse pins, the FAA mandated replacement of the old style fuse pins within 30 days.
By 1993 a third generation fuse pin design was developed. By this time, finite element analyses had been developed on the bottle bore and bulkhead style fuse pins, which showed that these designs were subjected to higher stresses than had been predicted using the original analysis utilizing classical methods. The improved third-generation design of this fuse pin features a straight inner bore, with slightly thicker walls. These design changes eliminated the machining shape changes prone to fatigue crack initiation, as well as lowering the fuse pin stresses. Manufacturing is simplified, as is the accomplishment of in-service inspections of these pins.

Design Changes to the 747 Strut

View Large
In response to the El Al accident, as well as the other related accidents including 747 airplanes operated by China Air, Evergreen, and Air India, the manufacturer developed a redesigned strut for 747 aircraft.
The FAA mandated the retrofit of the improved struts on all 747 aircraft in 1995. This effort, known as the 747 Strut Modification Program, required the installation of newly designed struts on all in-service 747 aircraft. The new strut design is failsafe for all engine attachment points and damage tolerant for any single strut-to-wing attachment failure. Although structural fuse pins are still included in the design, the intent is that these fuses will protect the wing tank from damage during ground impact. The new design is intended to prevent separation of the strut from the wing during flight.
With a complete failure of a single strut-to-wing attachment, so that no load transfer is possible through the joint, the loads are then redistributed to the remaining intact structure. A crack growth analysis is then calculated for the most critical remaining structure. The inspection interval is based on providing opportunities to visually detect the broken member before the crack growth to its critical length in the remaining most critical member. For example, a fuse pin could be missing from either the inboard or outboard strut midspar fitting and the remaining wing-to-strut attachment structure is still capable of carrying the strut loads until the critical crack length in the other midspar fitting or fuse pin is reached.

(View Larger)
Among the improvements in the redesigned struts are these features that increase load carrying capability and fail-safety:
- More robust design for increased strength
- Added dual-side links
- Aluminum midspar fitting replaced with titanium fittings
- Added backup structure inside the wing box
- Improved fuse pins throughout the strut
- Structure has been shown compliant to the damage tolerance requirements of 14 CFR 25.571. A mandatory inspection program has been developed based on the damage tolerance principles, as well as to address inspections for struts subject to hard landings, high drag, and turbulence exceedences.
- Improved corrosion-resistance practices incorporated
Related Incident
China Airlines
On December 29, 1991, less than 10 months prior to the El Al accident described previously, a China Airlines' 747-200F series freighter departed Taiwan International Airport. Ten minutes after takeoff, at an altitude of 5,000 feet, the pilot reported engine problems and that he had lost lateral control of the airplane.
The airplane lost control and crashed into terrain. Flight data recorder outputs indicated that two engines lost power simultaneously during climb. Wreckage was concentrated on the land, except the numbers 3 and 4 engines and struts, which had fallen into the ocean some distance away. The JT9D-7R4G2 powered airplane had accumulated 45,869 flight hours and 9,095 flight cycles.
At the time of the El Al 747 accident, the investigation of the China Airlines accident was still ongoing. The two engines of the China Airlines aircraft had been recovered only a few months earlier, and the midspar assembly of the number 3 strut was not found with the engine wreckage. In late October 1992, a few weeks after the El Al accident, the China Airlines number 3 midspar assembly was located and became the key piece to that investigation.

Ultimately, China Airlines investigators concluded that fracture of the number 3 (inboard) engine strut midspar fitting lugs had contributed to the in-flight separation of the engine and strut, which subsequently struck and separated the number 4 (outboard) engine/strut from the right wing. During investigation, a fatigue crack approximately 0.03" long was revealed in the lugs of one of the midspar fittings of the number 3 engine strut. The midspar fitting lugs on the struts had been inspected on this airplane in accordance with the manufacturer's recommendations. In addition, all the fuse pins were inspected per Boeing service bulletins less than 800 flights before the accident. None of these inspections discovered any existing damage or discrepancies.
The RLD Dutch Civil Aviation Authority issued 21 findings relative to this accident and cited the probable cause as:
"The design and certification of the B747 pylon was found to be inadequate to provide the required level of safety. Furthermore, the system to ensure structural integrity by inspection failed. This ultimately caused - probably initiated by fatigue in the inboard midspar fuse-pin - the number 3 pylon and engine to separate from the wing in such a way that the number 4 pylon and engine were torn off, part of the leading edge of the wing was damaged and the use of several systems was lost or limited.
This subsequently left the flight crew with very limited control of the airplane. Because of the marginal controllability a safe landing became highly improbable, if not virtually impossible."
The complete text of the findings can be accessed at the following link: RLD Findings.
The RLD Dutch Civil Aviation Authority issued the following key recommendations:
- Redesign the engine strut of the Boeing Model 747 airplanes including the strut-to-wing attachments. A full-scale fatigue and failsafe test should be performed to validate the new design.
- Review existing methods of maintaining structural integrity such as maintenance requirements and AD mandated actions.
- When a structural design is based on that of another design, consideration should be taken in the in-service performance and failure history of the other design.
- Evaluate and improve the training of flight crews on flying in asymmetrical conditions such as with one or more engines inoperative.
View the complete text of the recommendations.
14 CFR 25.571 defines the requirement for the structure whose failure could result in catastrophic failure of the airplane to be evaluated for either fatigue or failsafe strength.
View the text of 14 CFR 25.571 Amendment 0.
At the time of the El Al accident, the manufacturer utilized the philosophy of safe separation of an engine during flight. It was believed that as long as the strut was fused to the wing, thus minimizing the chance of fuel tank rupture, separation of an engine and strut would be a non-catastrophic, safe event for the airplane. It was further believed that a separated engine/strut would follow a trajectory over the top of the wing, safely avoiding contact with other areas of the airplane. This belief was accepted because it had occurred on 707 aircraft during flight, prior to development of the 747.
- The initial fuse pin design was prone to fatigue cracking, initiating at the machined details of the inner bore.
- Reliance on an inspection program to locate cracked fuse pins was ineffective.
- The separation of the number 3 engine caused critical damage to the airplane.
- It was assumed that an engine and strut departing the 747 aircraft would rotate over the wing and follow a trajectory away from the aircraft. Occurrences of engine/strut breakaway on the 707 had followed this scenario, but the 747 engine and strut did not behave similarly. Thus, the loss of a single engine was considered to be a non-critical event.
- The manufacturer and the FAA accepted a program of periodic inspections of the fuse pins to maintain safety of the 747 airplane, even after it was known that the fuse pins were prone to fatigue cracking.
- The failsafe design philosophy (ability of an aircraft to withstand the failure of a single principle element) was assumed to provide a safe design for the aircraft strut.
Before the El Al 747 accident, cracks had been found in bottle bore design fuse pins on other 747 aircraft. The manufacturer had redesigned the fuse pins and made available this alternate design. However, continued inspection of the existing design fuse pins was allowed as an option to fuse pin replacement.

Photo copyright Mick Bajcar - used with permission
Resulting Safety Initiatives
No specific regulatory changes were made as a result of the El Al accident.
The significant regulatory requirement governing structural design and analysis, 14 CFR 25.571, had been updated to require that new designs incorporate the damage tolerance philosophy, rather than applying failsafe principles. This change came about as Amendment 45, issued in 1978.
The redesigned 747 strut, which was mandated for retrofit on the 747 fleet, was designed using the latest damage tolerance principles and technology.
View a list of the certification basis of the upgraded engine strut.
Since 1970 over 30 ADs have been issued against the 747 to inspect and/or modify certain structural details of the 747 strut and strut-to-wing attachment structure. Some of the more significant ADs are listed below.
- AD 79-17-04: This AD mandates inspections of bottle bore fuse pins to detect cracking. This AD was later amended in 1982 to allow the replacement of the bottle bore pins with new design pins to terminate the inspections.
- AD 86-22-01: This AD mandates improved inspection procedures for bottle bore pins.
- Telegraphic AD 92-24-51: This AD mandates replacement of all bottle bore fuse pins with new bulkhead style design fuse pins within 30 days. This AD was issued one month after the occurrence of the El Al accident.
- AD 95-10-16: Strut-mod for airplanes equipped with Pratt & Whitney Model JT9D series engines, excluding Model JT9D-70 engines
- AD 95-13-06: Strut-mod for airplanes equipped with General Electric Model CF6-80C2 series engines or Pratt & Whitney Model PW4000 series engines
- AD 95-13-07: Strut-mod for airplanes equipped with General Electric Model CF6-45 or -50 series engines, or Pratt & Whitney Model JT9D-70 series engines
- AD 2007-01-15: Upper spar fitting inspections
- AD 2005-03-01: Post strut-mod inspections
- AD 2006-09-01: Thrust link inspections
- AD 2005-19-09: Dual side brace inspections
Airplane Life Cycle:
- Design / Manufacturing
Accident Threat Categories:
- Structural Failure
Groupings:
- Loss of Control
Accident Common Themes:
- Flawed Assumptions
Flawed Assumptions
While inflight separation of an engine was not a desired event, the use of the "safe separation" philosophy in strut design was widely accepted throughout the aviation industry. In events where an overload of the engine attachment structure could possibly result in other structural failures (fuel tank breaches, damage to wing structure, etc.), it was considered that safe engine separation from the airplane was an acceptable strategy to maintain the safety of the airplane. Multiple engine separations had occurred on in-service aircraft, with no resulting significant loss in aircraft controllability. These incidents occurred on both the four-engine model 707 and three-engine model 727 as well as the two-engine model 737 aircraft. It was accepted that any engine separations potentially occurring on the model 747 in-service fleet would behave similarly to the previous models.
Air India
On May 7, 1990, an Air India 747-200B series passenger airplane, Flight 132, landed at New Delhi. Upon thrust reversal, the number 1 (outboard) engine/strut partially detached from the left wing. No fatalities or injuries occurred. The aircraft had accumulated 57,617 flight hours and 17,211 flight cycles.
The fuse pin at the diagonal brace underwing fitting had been improperly installed with the primary retention devices omitted during maintenance, allowing it to migrate out of position under vibration. Migration of the fuse pin resulted in an overload and failure of the upper link fuse pin. This secondary failure allowed rotation of the engine/strut down to the runway.
In 1985 Boeing released Service Bulletin 747-54-2083 providing instructions to install secondary retention devices at all the fuse pin locations. However, Air India did not accomplish the modification as it was not mandated by an AD. Consequently, the FAA has mandated the actions in the service bulletin in 1995 as part of the 747 strut-mod program.

Evergreen Airlines
On March 31, 1993, the number 2 engine/strut of a 747-100 series freighter airplane separated from the left wing of the airplane shortly after takeoff from Anchorage, Alaska. The airplane had been leased from Evergreen Airlines and was being operated by Japan Airlines. Severe turbulence was reported during takeoff. In fact, the airport was closed for passenger operations due to severe turbulence.
Shortly after takeoff, at an altitude of 2,000 ft., the airplane experienced an uncommanded left bank of about 50 degrees. The crew reported a "huge" yaw. The number 2 engine throttle slammed to its aft stop, its reverser indication showed thrust reverser deployment, and its associated electrical bus failed.
The airplane experienced several severe pitch and roll oscillations before the number 2 engine/strut separated from the airplane in flight. The captain declared an emergency and initiated a large radius left turn and landed successfully.
The National Transportation Safety Board (NTSB) determined that the probable cause of this lateral engine/strut separation was severe turbulence that resulted in dynamic multi-axis lateral loading exceeding the lateral load carrying capability of the strut, which was already weakened by the presence of fatigue cracks near the forward end of the strut's forward firewall web. Two fatigue cracks were found on the web.

View Larger
Northwest Airlines

On March 1, 1994, Flight 18, a Northwest Airlines' 747-200B passenger airplane landed at the Tokyo International Airport with the forward portion of the number 1 engine/strut separated from the left wing. A fire broke out in the aft portion of the engine. All crew members and passengers evacuated with no injury reported.
No turbulence was reported during the flight. Investigators found that the forward fuse pin of the upper link of the number 1 engine strut was fractured. The diagonal brace of the strut was disconnected at its aft connection and was found lying inside the trailing edge fairing door. There were traces of fire on and around the upper portion of the strut. It was determined that during the most recent maintenance activity one of the fuse pins had been installed without any retention devices. Migration of the fuse pin at the aft connection of the diagonal brace may have contributed to the partial separation of the engine/strut.

(View Larger)
Chronologic Order of 747 Strut Related Accidents
- Air India - Delhi, India - May 7, 1990
- China Airlines - Taiwan, People's Republic of China - December 29, 1991
- El Al Airlines - Amsterdam, The Netherlands - October 4, 1992
- Evergreen Airlines - Anchorage, Alaska - March 31, 1993
- Northwest Airlines - Tokyo, Japan - March 1, 1994
Other Related Accidents
- United States Air Force (USAF) Boeing KC-135-BN Stratotanker - On January 4, 1965, the airplane crashed after the number 3 and 4 engines/struts separated in-flight. All four on board were killed.
- EgyptAir Boeing 707-336C - On December 5, 1972, the airplane crashed after the number 4 engine/strut separated in-flight. All six crew members on board were killed.
- Trans-Air Service Boeing 707-321C - On March 31, 1992, the airplane performed an emergency landing after the number 3 and 4 engines/struts separated in-flight and fire broke out. There were no fatalities, but the airplane was written off after it overshot the runway and sustained more damage.
- Tampa Colombia Boeing 707-324C - On April 25, 1992, the airplane performed an emergency landing after the number 3 engine/strut separated in-flight. No fatalities occurred, but the airplane sustained substantial damage.
- International Air Tour 707-355C - On November 1998, the airplane performed an emergency landing after the number 3 engine/strut separated in-flight, resulting in associated hydraulic failures. No fatalities occurred, but the airplane was written off after it overshot the runway and sustained more damage when it landed on its belly.
Technical Related Lesson:
Structural maintenance and other in-service programs should be predicated on a thorough understanding of the fatigue properties of complex structural elements. (Threat category: Structural Failure)
- Not knowing enough about the fatigue properties and load environment of complex structures can have catastrophic results. Detailed attention must be paid to aspects such as material properties, loads, and durability and maintainability of structural designs. The original 747 strut-to-wing attachments employed the fail-safe design philosophy which relied on a redundant load path to prevent catastrophic failures due to the failure of a single structural element. After this accident, the strut-to-wing attachments were redesigned to employ the damage tolerance design philosophy. The design of fuse pins, which featured complex machined surfaces to preferentially fail at a specific location, led to premature fatigue cracking at those locations. In addition, the struts were redesigned to account for certain load conditions that were not considered in the original design.
Engine separation can result in catastrophic damage. (Threat Category: Structural Failure)
- In this accident, the number 3 engine separated due to a structural failure in the strut. The number 3 engine struck, and caused the separation of, the number 4 engine. Separation of the number 3 engine also caused damage to the wing leading edge, contributing to control difficulties. Design assumptions related to the engine trajectory following separation, and resultant airplane damage was shown to have been incorrect.
Common Theme Related Lesson:
Past assumptions must be confirmed as relevant to present designs. It is necessary to understand the origins of original assumptions before they can continue to be considered valid. (Common Theme Category: Flawed Assumptions)
- Throughout the 1960's and 1970's, it was widely believed that safe separation of an engine and strut represented an acceptable methodology of strut design. Multiple events of strut breakaway on the model 707, 727, and 737 provided an experience base which allowed manufacturers and regulatory authorities to assume future engine/strut designs would behave similarly. It was assumed that the 747 would reflect past history and that should an engine separation occur in flight, the engine trajectory would be the same as on past designs, and in past events. After the 747 entered service, the trajectory of the engine/strut during an in-flight breakaway was found to be catastrophic.