El Al 1862
This cargo Boeing 747 took off performance limited (they were as heavy as they could have been under the conditions) and had the number three engine take out the number four engine. That cost them some of their flight controls and they definitely had their hands full. And yet they were able to fly for eight minutes, maintaining altitude and heading when they wanted. They began fuel dumping almost immediately. But as they slowed the increasing angle of attack overwhelmed the thrust available and they ended up behind the power curve and outside their roll capability. The Netherlands accident report says, "Because of the marginal controllability a safe landing became highly improbable, if not virtually impossible."
That might be true. But there are a few things we can take away from this:
- If the airplane is flying but continued flight is questionable, try to reduce grossweight before reducing airspeed or increasing drag.
- If faced with a loss of thrust on one side, attempt to make turns into the good engine(s) to improve roll out capability.
- When declaring an emergency, give ATC a quick burst of (a) what the problem is, (b) what you intend to do, and (c) the need for ATC to keep quiet and "keep an eye" on the situation. More about this: Declaring an Emergency.
- If you don't have to land immediately and controllability is in question, look for a remote area where you can do a controllability check. (Attempt to slow the aircraft to approach speed and configure for landing at altitude; doing so with enough altitude to recover if things go wrong.) This gives you a better idea of how fully you can configure and how slowly you can fly. See: Controllability Check.
Drawing: El Al 1862 estimated damage to RH wing leading edge, from Nederlands AAR 92-11, figure 4.
- Date: 4 October 1992
- Time: 17:20 UTC
- Type: Boeing 747-258F
- Operator: El Al Israel Airlines
- Registration: 4X-AXG
- Fatalities: 3 of 3 crew, 1 of 1 passenger, 39 ground casualties
- Aircraft Fate: Destroyed
- Phase: En route
- Airports: (Departure) Amsterdam-Schiphol International Airport (AMS/EHAM), Netherlands
- Airports: (Destination) Tel Aviv-Ben Gurion International Airport (TLV/LLBG), Israel
The time from takeoff to the initial engine separation was only six minutes, the aircraft flew for the next seven minutes before departing controlled flight. It all happened very quickly.
Photo: El Al 1862 flight track, Nederlands AAR 92-11, appendix 3.1
Click photo for a larger image
[Nederlands AAR 92-11, ¶1.1]
- No anomalies were evident during the initial climb until 17:27.30, as the aircraft was passing through an altitude of about 6,500 feet. The flight data recorder revealed that the no. 3 and 4 engines and their pylons departed the right wing at this time. The copilot then transmitted the emergency call, "El Al 1862, Mayday, Mayday, we have an emergency". The aircraft turned to the right, and according to witnesses on the ground, started dumping fuel immediately. The Amsterdam Radar controller confirmed the emergency call and immediately cleared the area of other traffic. At 17:28.06 the controller, not knowing the reason for the emergency call, asked the crew if they wanted to return to Schiphol Airport.
- After the acknowledgement by the crew of their intention to return to the airport they were instructed to turn to heading 260 and were informed about their position relative to Schiphol Airport. At 17:28.17 the crew reported a fire on engine no. 3 and subsequently they indicated loss of thrust on engines no. 3 and no. 4.
- At 17:28.57, El Al 1862 was informed that runway 06 was in use and the wind was 040° at 21 knots. The flight crew however requested runway 27 for landing. ATC then asked the crew if they could switch radio frequency to Schiphol Approach Control on 121.2 megahertz.
- The crew immediately switched frequency to Approach Control. Subsequently the flightcrew was instructed to switch to Schiphol Arrival on 118 4 megahertz.
- Because the aircraft was only 7 miles from the airport and still flying at an altitude of 5,000 feet, a straight in approach was not feasible and the crew was instructed to turn right to heading 360 and descend to 2,000 feet. The crew was again informed about the wind (by then 050° at 22 knots).
- About one minute later at 17:31.17 the controller asked what distance they required to touchdown. Shortly thereafter, the controller asked for the number of track miles the flight crew required for an approach. The crew stated that they needed "12 miles final for landing".
- Together with this reply to ATC, the call "Flaps 1" could be heard as background conversation in the cockpit. ATC instructed El Al 1862 to turn right to heading 100. During the turn the controller asked for the status of the aircraft and was informed: "No. 3 and 4 are out and we have problems with the flaps".
- The airplane had turned through heading 100 and was maintaining heading 120. No corrective action was taken by the controller. The aircraft maintained an airspeed of 260 knots and was in a gradual descent.
- El Al 1862 was cleared for the approach and directed to turn right to heading 270 to intercept the final approach course. The airplane was then at an altitude of about 4,000 feet, with a groundspeed of approximately 260 knots and on heading 120.
- The position was 3 nautical miles north of the centreline of runway 27 at a distance of about 11 miles projected on the extended centreline of runway 27. According to the radar plot, it took about thirty seconds before the aircraft actually changed heading.
- When it became apparent that the airplane was going to overshoot the localizer, the controller informed the crew accordingly and directed the aircraft to turn further to heading 290 in an attempt to intercept the final approach again but now from the south. Twenty seconds later a new heading instruction to 310 was given, along with descent clearance to 1,500 feet.
- The flightcrew acknowledged this instruction at 17:35.03 and added, "and we have a controlling problem". Approximately 25 seconds later the copilot called, "Going down 1862, going down". In the first part of this transmission commands from the captain to raise all the flaps and to lower the landing gear could be heard. During the middle part of this transmission a sound was heard, and in the final part of the transmission another sound was audible. These sounds were later analyzed and determined to be the stick shaker and the ground proximity warning system respectively.
- The airplane crashed at 17:35.42 into an eleven-floor apartment building in the Bijlmermeer, a suburb of Amsterdam, approximately 13 km east of Schiphol Airport. The impact was centred at the apex of two connected and angled blocks of apartments and fragments of the aircraft and the buildings were scattered over an area approximately 400 meters wide and 600 meters long.
The runways are about the same length. Because they took off on Runway 01L the crew appeared to reason that a return to Runway 27 would have been quicker.
The cockpit workload, dealing with two engines failed on the same side in a Boeing 747 which had departed at the maximum grossweight for the conditions must have been incredibly high. Having multiple frequency changes was an unnecessary distraction.
The controller is perhaps a bit anxious here, trying to be helpful but inadvertently adding to the crew's workload.
The aircraft appears to be controllable at this point, maintaining altitude and heading.
The "controlling problem" appeared to start as they slowed to configure.
Drawing: El Al 1862 probable separation sequence, from Nederlands AAR 92-11, figure 6.
[Nederlands AAR 92-11, ¶2.2]
- External and internal examination of the engines showed that all damage was either a result of gyroscopic effects during pylon separation or the impact of engine no. 3 with engine no. 4 and/or the impact of the engines with the water. No physical evidence was found inside the engines indicating that a surge could have occurred. Also examination of the El Al maintenance records and DFDR data from before the accident flight revealed no signs of surges.
- The possibility of sabotage was examined by several police and security agencies familiar with sabotage techniques and terrorist activity. No evidence of sabotage was found.
- The Board therefore concluded that the separation of the engine pylon was caused by a failure of connecting components that attach the pylon to the wing of the airplane.
- Therefore the scenario which is most likely, is (1) a fracture initiated by a fatigue crack of the shear face of the inboard midspar fuse pin. This was followed by (2) a sequential failure of the outboard lug of the inboard midspar fitting. Then (3) the outboard shear face. Finally (4) the inboard shear face of the outboard midspar fuse pin. The subsequent pylon engine separation occurred during the flight out of Schiphol Airport at 6500 feet and at an IAS of 267 knots.
[Nederlands AAR 92-11, ¶2.3]
- Based on the similar fuse pin design of the Boeing 707, Boeing concluded that the fused pylon concept effectively protected wing structure and fuel tanks against consequences of pylon overloads. A detailed fail-safe analysis of this nacelle and pylon concept was made by Boeing. This analysis addressed all critical load conditions resulting from abnormal flight or landing conditions.
- It should be noted that the report does not address the specific fail-safe load analysis assuming a fatigue failure or obvious partial failure of a single principle structural element.
- It is important to note that during type certification a then state-of-the-art fatigue analysis of the pylon structure was performed by Boeing in order to establish the maintenance requirements for the Boeing 747. In real life this did not turn out to be sufficiently reliable. At that time full scale testing was not part of the USA airplane certification process.
- Boeing did not conduct any structural testing of the pylon to positively determine its static strength, fatigue and fail-safe characteristics. The FAA accepted Boeing's contention that since the Boeing 707 pylon had proved reliable, the nearly identical design of the Boeing 747 pylon would also be reliable. Therefore on the date of type certification the nacelle and pylon design met all applicable airworthiness requirements.
[Nederlands AAR 92-11, ¶2.4]
- Loss of part of the leading edge flaps and damage of the right wing results in a change in lift generating capability of that wing. At small angles of attack the lift on both wings is essentially equal, at higher angles of attack the increase of lift on the damaged wing is less than the increase in lift on the undamaged wing. An increase in angle of attack will therefore generate a roll moment. In the case of El Al 1862 this increase caused bank steepening during the right turns in the direction of the damaged wing. This effect was confirmed by DFDR data.
- In general modern airplanes have adequate control capability to turn in either direction in a two engine inoperative situation. However turning into the direction of the functioning engines will create a flight condition with more margin. It is recommended to emphasize this basic knowledge during training.
- An energy analysis was performed based upon altitude and airspeed data from the DFDR. It should be realised that this method does not allow extrapolation of performance capabilities in other conditions then those encountered during this flight. Based on this analysis the following conclusions can be made:
- Marginal level flight capability was available at 270 knots and go-around power with a limited manoeuvring capability;
- At MCT thrust and 270 knots IAS there was no level flight capability;
- Performance degraded below about 260 knots at increased angles of attack. Deceleration to 256 knots resulted in a considerable sink rate.
- It is therefore believed that the performance deterioration at increased angles of attack is the most likely explanation for the advancement of the throttles during the final stage of the flight.
- After separation of the engines and pylons the crew flew the aircraft in the following condition:
Perhaps a page from the military community would be helpful here. When aircraft controllability was suspect, we would often brief going to a safe area (in terms of altitude, terrain, and population) to run the airplane through a flight controllability check. The answer could reveal the minimum possible speed to fly or the need to land the airplane on isolated, level terrain.
This analysis fails to address the impact of decreased grossweight due to the ongoing fuel dumping.
- RH wing leading edge severely damaged.
- RH wing leading edge flaps partly lost.
- RH outboard aileron floating at 5 degrees trailing edge up.
- limited roll control due to:
- no outboard aileron available;
- spoiler system partly available.
A retired Boeing test engineering wrote to bring up another factor:
If some or all of the LE slats had been damaged or torn off when the engines separated, that would have increased the right wing's stall speed [less max lift capability], one reason for the airplane becoming uncontrollable. As the crew tried to return to the airport, if they had slowed too much then the right wing would have stalled but not the left. Once that happened, the airplane would have rolled uncontrollably.
Lesson: turn into the good engines to improve your roll out capability.
- asymmetric lift generation at increased angle of attack
- high thrust asymmetry
- loss of aerodynamic efficiency of the RH inboard aileron at increased angle of attack
- possible asymmetric lift due to leading edge flaps operation.
It is important to realize that there is a point along the airspeed versus thrust curve where it takes increasing thrust to maintain decreasing airspeed, the so-called "region of reversed command." Once a swept wing jet decelerates below L/DMAX, the only way to recover is to decrease the angle of attack.
More about this: Low Speed Flight / Region of Reversed Command.
[Nederlands AAR 92-11, ¶2.5]
- Within one minute after engine separation the crew decided to return immediately and to land on runway 27, in spite of the unfavourable wind conditions for this runway. The crew may have been urged to this decision for the following reasons:
- the possibility of having been hit by a missile causing a quickly deteriorating situation;
- the believe that they were experiencing one or two uncontrollable engine fires with the possibility that these fire(s) would burn into the wing;
- the assumption that the airplane was too heavy to maintain straight and level flight;
- the crew was familiar with Schiphol Airport, knew the layout of the runways and knew that runway 27 was the longest and the nearest available runway.
- The decision to land as soon as possible committed the crew to perform under extreme time constrains. The complexity of the emergency on the other hand called for time consuming and partly conflicting checklist procedures. Warnings and indications in the cockpit were most likely compelling and confusing. Furthermore the pilots were confronted with a controllability and performance situation which was completely unknown to them and they were not in a position to make a correct assessment. The Board is of the opinion that given the situation of the crew as described above and the marginal controllability the possibility for a safe landing was highly improbable, if not virtually impossible.
We cannot get into the pilots' heads to understand why they felt the need to rush their return; but it is important to look at this retrospectively to take away lessons for the future. The possibilty of an external threat or an unknown fire are tangible, but not certain. Knowing that the aircraft was barely controllable should telegraph the message that further decreases in speed will leave to a loss of control is a certainty. They would have been better served by keeping their speed, continuing their fuel dump, and considering further options.
The crew was in an extremely difficult situation and in these situations there is a subconscious pressure to get the airplane on the ground. The report says control of the airplane may have been "virtually impossible." That might be true. But please keep in mind that if you find yourself running out of aileron to keep the airplane wings level, it may be time to pick up the speed to see if you can keep the airplane in coordinated, level flight. See: Controllability Check, for techniques about how to determine the limits of your controllability.
[Nederlands AAR 92-11, ¶3.2]
- The design and certification of the B747 pylon was found to be inadequate to provide the required level of safety. Furthermore the system to ensure structural integrity by inspection failed. This ultimately caused - probably initiated by fatigue in the inboard midspar fuse-pin - the no. 3 pylon and engine to separate from the wing in such a way that the no. 4 pylon and engine were torn off, part of the leading edge of the wing was damaged and the use of several systems was lost or limited.
- This subsequently left the flight crew with very limited control of the airplane. Because of the marginal controllability a safe landing became highly improbable, if not virtually impossible.
Nederlands Aviation Safety Board Aircraft Accident Report 92-11, El Al Flight 1862, Boeing 747-258F 4X-AXG, Bijlmermeer, Amsterdam, October 4, 1992.