The sun was setting last Oct. 4 as El Al flight 1862 lifted off from Amsterdam's Schiphol Airport. As the Boeing 747 cargo plane climbed, the crew felt a powerful shudder. "We have a control problem," radioed Captain Isaac Fuchs, who couldn't see that the two right engines had snapped off. "Going down, 1862 going down, going down," were his last words to the tower. The plane slammed into two apartment buildings, killing the four-member crew and 39 people on the ground.
Back at Boeing Co. headquarters in Seattle, the circumstances were horrifyingly familiar. Just 10 months earlier, a China Airlines Ltd. 747 had crashed off Taiwan under similar circumstances, killing five. Both were cargo planes, which carry heavier loads than passenger jets. Boeing engineers had just figured out what happened in Taiwan--but hadn't fixed the problem in time to prevent the Holland crash. "Oh, my God, not again," one Boeing official who has since retired recalls thinking at the time.
On June 18, Boeing announced that exhaustive engineering work plus trillions of supercomputer calculations had finally produced a foolproof way to keep the 747's engines from falling off. Evidence points to the failure of a hollow steel "fuse pin," slightly smaller than a beer can, that attaches an engine to a wing. It's supposed to sever in a crash, but instead broke while planes were aloft. Boeing tried to fix the problem by introducing a new generation of fuse pins in 1980, but they, too, proved susceptible to failure. Now, the company is moving to a third generation of pins--plus an extra steel brace should they fail.
CLEAN BREAK. In Boeing's design, even the untimely breakage of a fuse pin never should have caused a 747 to crash. That's because the company assumed that even if the pins did break in flight, an engine would fall away cleanly and the plane would fly on the remaining three. Boeing engineers now realize that if one inboard engine breaks away, it can knock off the same wing's outboard engine--as happened in both Taiwan and the Netherlands. The design flaw is costing not just pride, but money. Boeing will spend roughly $200 million for parts alone, estimates Wolfgang Demisch of UBS Phillips & Drew brokerage in New York.
Boeing says that today, all 948 of its 747s in service are safe and that all fuse pins are either new or are being frequently inspected by airlines. Still, the question arises: Why did Boeing take so long to fix the problem--especially when it had reports of corroded and cracked fuse pins dating back to 1979? "They waited to act until they were forced into a bad situation," says Leo Janssens, president of the Aviation Safety Foundation, an advocacy group based in Worthington, Ohio. El Al
Israel Airlines Ltd. claimed in January that Boeing's response was "slow, weak, and bordering on negligence."
Boeing says it acted as quickly as possible while still being thorough. Indeed, company officials say they had no idea what really was wrong until July, 1992, when the China Airlines inboard engine was found at the bottom of the sea, intact.
Its main defense, however, is the intricate nature of aircraft design, which makes crafting a solution especially tricky. "In retrospect, we could have [done it faster], but it would have taken a vision instead of a logical engineering approach," says M. Richard Johnson, Boeing's director of engineering for the 747 and 767. "Engineers are methodical."
From the day the 747 was conceived, the idea of a plane going down with up to 400 passengers has haunted Boeing. Former Chairman William Allen, when asked what he would do if a 747 crashed, used to say: "I'd rather talk about something pleasant--like a nuclear war." But the 747 has turned out to be one of the safest aircraft ever built. Based on their experience with other new planes, insurance underwriters expected that there would be at least three 747 crashes in its first 18 months. Instead, there were five fatal accidents in its first decade--three blamed on pilot error. Boeing's safety philosophy extended to its engine mounts, which were designed for "safe separation." The fuse pins are supposed to break under unusual stress. If an engine hits a building, a vehicle, or the runway, it is supposed to separate without rupturing fuel tanks inside the wing, and thus avoid fires. From the 707 on, all Boeing jets had breakaway engines.
Boeing's chief rival, Europe's Airbus Industrie, never bought into breakaway engines. If an Airbus crash-lands, the plane can even skid on its engines without their falling off. "Our philosophy is: Whatever happens, the engines stay strongly attached," says an Airbus official in Paris. In recent years, Boeing at least began to acknowledge a potential problem. For its 757, 767, and upcoming 777, Boeing added a brace to hold the engine on in case of a fuse-pin failure in flight. And it also used the brace in its newer 737-400. But Boeing decided that the 747 was safe without extra bracing.
A GLITCH. Still, the warnings were there. In 1979, airlines began reporting cracks and corrosion in the fuse pins. Boeing engineers blamed that on poor machining of the hard-to-fabricate parts. By the mid-1980s, cracks turned up in the new pins the company had switched to. Boeing blamed that on an anticorrosion compound that scraped off during production. It still considered all this a glitch. Although the Federal Aviation Administration ordered inspections, there was no reason to suspect that the cracks and corrosion could lead to a crash, says Anthony J. Broderick, associate FAA administrator for regulations and certification.
So convinced was Boeing that the engine mount was safe that when the China Airlines flight went down, its engineers thought the fault was with the engines, not the mount. On that theory, engine maker Pratt & Whitney split the cost of the investigation. When the right inboard engine was recovered intact, it appeared instead that it had broken away and slammed into the outboard one, tearing it off the wing. Boeing knew it had to do something, so last Sept. 21 it invited representatives of all 82 airlines flying 747s to discuss the problem. The company recommended inspecting fuse pins for corrosion and announced it would be designing a simpler, corrosion-resistant pin. Unan- nounced, Boeing engineers were also working on a new backup brace to keep engines from falling off in flight.
Then disaster struck in Amsterdam. This time, Boeing quickly realized what the trouble was. Soon after, it and the FAA ordered all 747 operators to inspect engine mountings within 30 days and every 500 landings thereafter. Those inspections showed only a few cracked pins but corrosion on about 20% of all pins, far more than Boeing expected.
Bad pins may have been at fault again last March, when an Evergreen International Airlines Inc. 747 cargo flight headed for Chicago lost an engine after takeoff from Anchorage. Although the plane landed safely, a National Transportation Safety Board preliminary report released in May said turbulence may have put excessive loads on the engine mounts, which gave way.
The solution that Boeing has announced involves reinforcing the engine mount with a sturdy steel bracket shaped like an upside-down V, using stronger braces, and redesigning the fuse pins. The new pins are made of corrosion-resistant stainless steel instead of regular steel. Their walls are also thicker and stronger. The new fuse pins are already in production; the other parts should be ready early next year.
Airlines will have to share the cost of labor for the modifications, which could take up to three weeks per plane. Still, most are relieved to have a solution. Ever since the El Al crash, they've had to disrupt flight schedules to test fuse pins every four to six months. This doesn't coincide with regularly scheduled maintenance, and it requires costly, time-consuming ultrasound tests.
CLOSER LOOK. Boeing engineers say they've fixed the problem, thanks to techniques unknown even 10 years ago. The designers of the original 747 used a mathematical approach called finite-element analysis to model the stresses by dividing the complex wing into 10,000 parts. In their new investigation, using powerful supercomputers and software, engineers divided the fuse pin alone into 34,000 parts. Each simulation took 11 hours to complete. It showed that at several critical points within the pins, stresses during takeoff were far greater than expected.
In Johnson's Boeing office is a photo of a crash site, overlaid with a quote he found somewhere once: "Aviation in itself is not inherently dangerous, but to an even greater degree than the sea, it is terribly unforgiving of any carelessness, incapacity, or neglect." That the failure of a 4-inch-long part can bring down a 200-ton airplane may be the ultimate in flight's unforgiving nature. Boeing can only be grateful that it apparently solved the mystery before a 747 full of passengers fell from the sky.
SEEKING A SOLUTION 1970 Boeing 747 goes into service and becomes a best-seller. 1979 Boeing receives reports of cracks in the fuse pins that attach engines to wings. 1980 Boeing creates a stronger pin, but some airlines opt to inspect old ones instead. DEC. 29, 1991 China Airlines 747 freighter using the new pins crashes off Taiwan, killing five. OCT. 4, 1992 El Al Israel Airlines cargo plane loses two engines and crashes into low-income housing near Amsterdam, killing 43 people. JUNE 18, 1993 Boeing says it will ask airlines to install stronger engine mountings and install redesigned, stainless-steel fuse pins. DATA: BUSINESS WEEK