Aircraft Accidents and Lessons Unlearned LXVIII: El Al Flight 1862

On October 4, 1992, El Al flight 1862 (EA1862), a Boeing 747-258F freighter, registration 4X-AXG, crashed 16 minutes into flight, at 5:36 PM (17:36) Coordinated Universal Time (UTC). The aircraft had taken off on its second leg, Schiphol airport in Amsterdam to Ben Gurion airport in Tel Aviv, Israel; the first leg originated in John F. Kennedy airport in New York.

During climb, the number (#) 3 engine and its pylon separated from the wing, going outboard. The departing engine then collided with the #4 engine, causing the #4 engine and its pylon to also separate from the wing. Both catastrophic separations severely damaged the right wing’s leading edge secondary flight control devices – slat system – which negatively affected the ability to maintain control during the emergency landing procedure that followed. After reporting the emergency and requesting a return to Schiphol airport, the flight crew reported a # 3 engine fire and a loss of thrust in both #3 and #4 engines. The accident was investigated by the Nederlands Aviation Safety Board (NASB) and reported in accident report 92-11.

The NASB determined the Probable Cause to be, “The design and certification of the B747 pylon was found to be inadequate to provide the required level of safety. Furthermore, the system to ensure structural integrity by inspection failed. This ultimately caused – probably initiated by fatigue in the inboard midspar fuse-pin – the number 3 pylon and engine to separate from the wing in such a way that the number 4 pylon and engine were torn off, part of the leading edge of the wing was damaged and the use of several systems was lost or limited. This subsequently left the flight crew with very limited control of the airplane. Because of the marginal controllability a safe landing became highly improbable, if not virtually impossible.”

To clarify, the #3 engine and its pylon catastrophically separated from the right wing. During its separation, the engine cartwheeled outboard before it collided with the #4 engine, which also separated with its pylon. These two distinct, yet connected, events caused severe damage to the slats on the right wing, disabling them. The flight crew could not see the damage from the first officer’s cockpit window, and they couldn’t access the fuselage’s side windows because of cabin cargo load devices. It is possible the slat damage’s extent wouldn’t have been obvious from a cabin window that only accesses the wing’s upper surface. Therefore, they were unaware that the engines had departed. They were also ignorant of the slat damage and tried to extend them during the approach in Schiphol airport, causing an asymmetry problem of unbalanced lift between the right and left wings.

Damage to the leading edge (LE) flight controls was limited to the right wing’s outboard slats, which led to the problem. The departure of the engines and their pylons resulted in the impairment of the LEs devices between the #3 and #4 engines and were directly responsible for the final loss of control. This damage was secondary. Despite the slat damage leading directly to the resulting accident, the LEs impairment did not contribute to the accident’s root cause. In addition, damage to electrical, pneumatic, hydraulic, and fuel systems contributed to the pilots confusion and were associated damage from the engines’ separations.

If the NASB followed the textbook investigation, the emphasis would have been on the LE slats since they contributed mostly to loss of control at the end. EA1862 first alerted air traffic control at 17:27:56 (military time) of its emergency. EA1862 had control until at they communicated flap problems at 17:32:20, 4 minutes, 24 seconds later, when they tried to move flaps and slats for landing, presumably at 2000 feet and 12 miles out. At this early flap setting not all slats would’ve been extended but was likely the first indication of LE slat problems.

At 17:35:25, 7 minutes and 29 seconds after the emergency began, EA1862 still had controlled flight. However, at this moment, the pilots announced the loss of stability, and they were “… going down.” This most likely occurred when all slats would have been extending and airspeed was decreased. If the slats were prevented from full extension on the right side, that would have resulted in an asymmetrical problem that, in association with yaw issues due to the loss of #3 and #4 engines, would have made the aircraft extremely difficult to handle at the lower airspeed. In addition, per the recorder transcript, the pilots were still unaware the engines had separated, and the right-wing slats were damaged. In reality, the pilots were compensating for the engines, thinking they were still on-wing with a fully functional slat system. If they had known, it was unlikely they would have extended the slats.

The NASB did an exceptional job in dividing attention between the fundamental cause of the accident and the cause of the fundamental cause of the accident; they steered clear of accident investigation agencies’ interpretation of probable cause. NASB investigators understood how maintenance and inspection played a significant role in the accident, meaning the NASB took the compliance of service bulletins and the proper inspection of critical items very seriously.

Per the Federal Aviation Administration (FAA) website, a service bulletin (SB) is issued by the manufacturer, “to inform owners and operators about critical and useful information on aircraft safety, maintenance, or product improvement.” These are manufacturer bulletins, not FAA requirements. While an operator’s compliance with service bulletins may or may not be mandatory, SBs shouldn’t be ignored when it comes to safety because the manufacturer directs it.

An Airworthiness Directive (AD) is, “a document issued or adopted by the [oversight] agency which mandates actions be performed on an aircraft to restore an acceptable level of safety, when evidence shows that the safety level of the aircraft may otherwise be compromised.”  To properly understand the discoveries made by the NASB in the interpreted text in the report format it was written in, the CONCLUSIONS on page 45 were cross-referenced with the FACTUAL INFORMATION starting on page 19, subchapter 1.6.4: Service Bulletins and Airworthiness Directives through page 21, 1.6.4.4: subchapter Service Bulletins Applicable to the Nacelle Strut rear Engine Mount Bulkhead.

Report 92-11 focused on the pylon fuse bolts and the SBs associated with inspection of pylon integrity with regards to non-destructive testing (NDT) of fatigue cracking and the presence of a required corrosion preventative compound. The fuse pin acts as a ‘fuse’ or a ‘weak link’ that prevents system or structural failure. Per report 92-11, “The design of the engine nacelle and pylon incorporates provisions that preclude a wing cell rupture in case of engine separation, by means of structural fuses. A clean breakaway of the nacelle and/or pylon from the wing is ensured when the shearloading of the fuse pins exceeds the design load conditions.”

Report 92-11 showed a series of SBs and ADs issued against the B747 pylon and its mounting hardware, dating from August 1979 to September 1992. These SBs and ADs required NDT inspections. In addition, Report 92-11 showed an eight-event history of pylon problems with the B747 and B707 between December 1979 and March 1993. On the accident aircraft, the #3 pylon’s outboard midspar fuse pin showed material integrity problems and significant fatigue cracking. Was this finding an example of poor engineering by Boeing, or did it demonstrate a failure on El Al to conduct proper NDT inspections on their B747 engine pylons per the SBs and ADs in the timeframes dictated by Boeing?

To have brought this report to its appropriate conclusion, the FAA’s Aircraft Certification Office (ACO) should have conducted its own thorough investigation into both Boeing and Pratt & Whitney’s engine-to-pylon-to-wing designs, especially when the ACO has approval of their engineering. The ACO should’ve been concerned with pylon SBs and ADs in the years between 1979 and 1992. Among other things, this was a cargo accident. In the 1990s, cargo airliners both domestic and international, were not as recognized as they are today, even though the B747 was flown by most air operators worldwide.

In addition, the International Civil Aviation Organization – ICAO – should’ve launched an investigation into El Al’s heavy maintenance overhaul facilities to determine if EA1862 was a one-off accident or if it was indicative of NDT inspections inadequately performed.

There is another aspect of this accident that stood out. A picture from the EA1862 accident showed a damaged depleted uranium counterweight. (DUCW). DUCWs are used as counterweights for primary flight controls, such as the elevators, ailerons, rudders, and some secondary flight controls. When I began working accidents for the National Transportation Safety Board in 2001, I spoke with my immediate supervisor about the caution needed when handling the DUCW at accident sites or even the identification of DUCW in the surrounding the accident site. I had removed damaged DUCWs from rudders and saw how depleted uranium could be exposed despite its lead container; how investigators were unaware of its presence on flight controls.

Damaged depleted uranium counterweight and undamaged counterweight

Though DUCWs aren’t at the dangerous isotope levels of quality uranium, the DUCW’s lead container can become compromised during an accident’s explosive conclusion. The depleted uranium is then exposed to emergency personnel and accident investigators.

The NASB was tenacious about this investigation, not dismissing important information where other accident investigation agencies would’ve focused on the loss of life and other emotional aspects that had nothing to do with the investigation. It was hoped that the FAA ACO and ICAO followed through with proper investigations.