Drawing: El Al 1862 estimated damage to RH wing leading edge, from Nederlands AAR 92-11, figure 4.

Eddie Sez:

This cargo Boeing 747 took off performance limited (they were as heavy as they could have been under the conditions) and had the number three engine take out the number four engine. That cost them some of their flight controls and they definitely had their hands full. And yet they were able to fly for eight minutes, maintaining altitude and heading when they wanted. They began fuel dumping almost immediately. But as they slowed the increasing angle of attack overwhelmed the thrust available and they ended up behind the power curve and outside their roll capability. The Netherlands accident report says, "Because of the marginal controllability a safe landing became highly improbable, if not virtually impossible."

That might be true. But there are a few things we can take away from this:

  1. If the airplane is flying but continued flight is questionable, try to reduce grossweight before reducing airspeed or increasing drag.

  2. If faced with a loss of thrust on one side, attempt to make turns into the good engine(s) to improve roll out capability.

  3. When declaring an emergency, give ATC a quick burst of (a) what the problem is, (b) what you intend to do, and (c) the need for ATC to keep quiet and "keep an eye" on the situation. More about this: Abnormal Procedures & Techniques / Declaring an Emergency.

  4. If you don't have to land immediately and controllability is in question, look for a remote area where you can do a controllability check. (Attempt to slow the aircraft to approach speed and configure for landing at altitude; doing so with enough altitude to recover if things go wrong.) This gives you a better idea of how fully you can configure and how slowly you can fly.

What follows are quotes from the relevant regulatory documents, listed below, as well as my comments in blue.

Accident Report


[Nederlands AAR 92-11, ¶1.1]


Drawing: El Al 1862 probable separation sequence, from Nederlands AAR 92-11, figure 6.

[Nederlands AAR 92-11, ¶2.2]

  • External and internal examination of the engines showed that all damage was either a result of gyroscopic effects during pylon separation or the impact of engine no. 3 with engine no. 4 and/or the impact of the engines with the water. No physical evidence was found inside the engines indicating that a surge could have occurred. Also examination of the El Al maintenance records and DFDR data from before the accident flight revealed no signs of surges.

  • The possibility of sabotage was examined by several police and security agencies familiar with sabotage techniques and terrorist activity. No evidence of sabotage was found.

  • The Board therefore concluded that the separation of the engine pylon was caused by a failure of connecting components that attach the pylon to the wing of the airplane.

  • Therefore the scenario which is most likely, is (1) a fracture initiated by a fatigue crack of the shear face of the inboard midspar fuse pin. This was followed by (2) a sequential failure of the outboard lug of the inboard midspar fitting. Then (3) the outboard shear face. Finally (4) the inboard shear face of the outboard midspar fuse pin. The subsequent pylon engine separation occurred during the flight out of Schiphol Airport at 6500 feet and at an IAS of 267 knots.

[Nederlands AAR 92-11, ¶2.3]

  • Based on the similar fuse pin design of the Boeing 707, Boeing concluded that the fused pylon concept effectively protected wing structure and fuel tanks against consequences of pylon overloads. A detailed fail-safe analysis of this nacelle and pylon concept was made by Boeing. This analysis addressed all critical load conditions resulting from abnormal flight or landing conditions.

  • It should be noted that the report does not address the specific fail-safe load analysis assuming a fatigue failure or obvious partial failure of a single principle structural element.

  • It is important to note that during type certification a then state-of-the-art fatigue analysis of the pylon structure was performed by Boeing in order to establish the maintenance requirements for the Boeing 747. In real life this did not turn out to be sufficiently reliable. At that time full scale testing was not part of the USA airplane certification process.

  • Boeing did not conduct any structural testing of the pylon to positively determine its static strength, fatigue and fail-safe characteristics. The FAA accepted Boeing's contention that since the Boeing 707 pylon had proved reliable, the nearly identical design of the Boeing 747 pylon would also be reliable. Therefore on the date of type certification the nacelle and pylon design met all applicable airworthiness requirements.

[Nederlands AAR 92-11, ¶2.4]

It is important to realize that there is a point along the airspeed versus thrust curve where it takes increasing thrust to maintain decreasing airspeed, the so-called "region of reversed command." Once a swept wing jet decelerates below L/DMAX, the only way to recover is to decrease the angle of attack. More about this: Basic Aerodyanmics / Low Speed Flight / Region of Reversed Command.

[Nederlands AAR 92-11, ¶2.5]

[Nederlands AAR 92-11,]

Probable Cause

[Nederlands AAR 92-11, ¶3.2]

See Also

Abnormal Procedures & Techniques / Declaring an Emergency

Basic Aerodynamics / Asymmetrical Thrust

Basic Aerodynamics / Low Speed Flight


Nederlands Aviation Safety Board Aircraft Accident Report 92-11, El Al Flight 1862, Boeing 747-258F 4X-AXG, Bijlmermeer, Amsterdam, October 4, 1992.