Engine Enigma -- Boeing Seeks Answers To Corroded Fuse Pins And Loose Engines

-- PART ONE OF A TWO-PART SERIES.

For more than 15 years, The Boeing Co. quietly cast its long-running problems with fuse pins as a routine design glitch the company's renowned engineers were trying diligently to fix.

That changed abruptly last October when an El Al Israel Airlines 747-200 freighter, missing both right engines, slammed into a crowded Amsterdam apartment building.

Now fuse pins - the breakaway safety bolts that secure engines to jetliner wings - have sparked a heated debate in which serious questions are being raised about the safety of existing and future Boeing products.

Aviation safety experts contend Boeing and the Federal Aviation Administration, encumbered by the desire to balance economic concerns with public-safety responsibilities, once again are moving too slowly to eliminate a safety threat that is more pervasive and grievous than authorities are willing to admit.

"I think they are playing with fire here," said jet engine consultant Mark Bobbi, of Hartford, Conn-based Forecast International.

Engines speared

Exacerbating safety experts' concern is the fact that the El Al disaster, which killed all six crew members and at least 50 people on the ground, marked the fourth time in 11 months an inboard right engine broke off a Boeing jet and - instead of dropping safely away as designed - veered into the outboard right engine.

This lends credence to an alarming phenomenon that continues to go unaccounted for in safety rules and aircraft design principles.

Physicists and aeronautical experts consulted by The Times say powerful gyroscopic forces could cause a rapidly spinning jet engine to shoot forward and to the right should it come loose in flight. Like an out-of-control rocket, the engine might then act as a major destructive force to other parts of the aircraft.

Aviation safety experts say this heretofore unacknowledged tendency raises serious questions about the current philosophy, formulated in the 1950s, used in mounting increasingly massive jet engines to the wings of modern jetliners, including Boeing's newest model, the 777 twinjet.

"It bothers me a great deal that the No. 3 engine comes off and spears No. 4," said aviation consultant Dick Sears, a retired Boeing pilot who test-flew the 747. "To the best of my knowledge, the airplane design does not include that possibility."

Though spokesmen for Boeing and the FAA made several brief public statements in the weeks after the El Al crash, senior Boeing and FAA officials declined to be interviewed for this story. Authorities declined several requests from The Times to meet with a reporter to review an extensive list of questions focused on the development history of jetliner engine mounts and long-standing industry analysis about the behavior of loose engines.

Boeing and the FAA emphasize that ongoing, periodic inspection of 747 fuse pins, ordered in the wake of the El Al crash, keep the jumbo-jet fleet safe.

However, Boeing's long history of futilely trying to solve design flaws that have turned up on engine mounts of several airplane models suggests authorities are grappling with a high-stakes quandary that so far has escaped easy resolution. The ante: corporate solvency and human lives.

Single failure rule

When Boeing engineers devised breakaway fuse pins to fasten engines to the wings of 747 jumbo jets, they were applying a fundamental tenet of air-safety logic.

The rule holds that no isolated failure of a single aircraft system should cause a jetliner to crash. Fuse pins, which Boeing used successfully on its pioneering commercial jetliner, the 707, ingeniously addressed that standard.

The hollow steel pins, four inches long and 2.25 inches in diameter, are sturdy enough to lift a jumbo jet into flight and hold fast as the powerful engines pull the 400-ton aluminum bird to nearly the speed of sound.

During flight, the pins endure enormous stress from multiple directions as the airplane climbs, banks, bounces, descends and lands. And yet the pins are designed to be precisely weak enough to break in case of certain emergencies.

If one of the 747's four engines began coming apart in flight, for instance, the pins are designed to snap; the engine should sheer cleanly away, leaving the wing intact and the jetliner flyable.

That's how it works on paper. In practice, there has been a smattering of cases of engines falling off jetliners over the past four decades that collectively has produced sparse hard information about loose engine trajectory - until the four cases of engines colliding this past year. Meanwhile, the threat of engines separating under normal flying conditions, because of weakened engine mount parts, is something Boeing has been trying futilely to eradicate since the late-1960s.

Dozens of upgrades

Documents obtained by The Times show the FAA, guided by Boeing, required airlines to inspect and upgrade engine mounts on 707s in 1977, 1988 and again last September. The 707 and the 747, the only four-engine jetliners made by Boeing, use comparable engine mount systems.

The FAA's orders stemmed from four separate instances of engines falling off 707s (now out of production and used primarily outside the United States), including two cases last spring in which a right inboard engine sheered off and struck the right outboard engine.

Since 1969, Boeing and the FAA have asked airlines dozens of times to inspect and upgrade engine mounts because of a variety of problems with the systems on 727s, 737s, 757s and 767s.

Boeing's long-running problems with 1,100 older model 737-100s and 737-200s highlight the difficulty of perfecting an engine mount system that is phenomenally strong, and yet just weak enough to break in narrow circumstances.

A few years ago, Boeing thought it solved a problem with breakaway bolts and a safety cable failing prematurely on 737-100s and 737-200s. At Boeing's request, the FAA in 1988 required airlines to install upgraded hardware on those models, including a secondary support structure replacing the safety cable.

But last January as a Delta Air Lines 737-200 twinjet took off from Dallas-Fort Worth airport, the right engine sheered cleanly off, despite recent installation of the upgraded parts. The airplane made a safe emergency landing.

Boeing spokesman Steve Smith refused to say if Boeing knows whether the engine dropped away, or if gyroscopic forces sent it rocketing out to the right, in this case harmlessly because there is only one engine hanging from each wing. For the second time in four years, Boeing is once again redesigning the mounts for 1,100 early model 737s-100s and 737-200s.

747 difficulties

The difficulties of mounting engines to aircraft is magnified on Boeing's flagship, the 747, the world's largest commercial jetliner. Like its sister ship the 707, the 747 is powered by four engines. Since 1969, Boeing has produced more than 935 747s. All but a handful are still in commercial service.

The engine mounts installed on 747s built before 1980 featured an "old-style" fuse pin honed to the proper weakness by a machinist boring an intricate hourglass shape inside the pin. That proved to be a bad design.

"We discovered in the radius of the hourglass design that the machining created tiny knicks where corrosion could develop," Boeing spokesman Chris Villiers said last October. "The corrosion could grow into cracks."

In 1979, the FAA ordered airlines to periodically inspect the old-style fuse pins for corrosion or cracks on an ongoing basis.

Boeing considered the flaw serious enough to begin work on a "new-style" pin, featuring a simplified hourglass core supported by inserts wedged permanently into both open ends of the pin. Factory installation of new-style pins began in 1980.

Two years later, in 1982, the FAA advised airlines flying 747s built before 1980 that they would no longer have to regularly inspect fuse pins as long as they replaced the old-style pins with new-style pins acquired from Boeing. The work required an aircraft to be grounded for about two days, but it freed airlines from ever having to check the fuse pins again.

New pins flawed, too

However, reports soon reached Boeing that the new-style pins were corroding and cracking as well. In 1985 or 1986, an alert ground inspector averted a possible tragedy when he spotted an engine drooping on a 747 passenger jet just minutes before take off. The flight was aborted. The National Transportation Safety Board later indicated the droop was caused by a cracked new-style fuse pin.

In May 1991, Boeing and the FAA ordered airlines using new-style pins to perform a one-time check of the pins to see if an anti-corrosive primer was in place inside the core of the pins. If corrosion or cracks were discovered, the airlines were instructed to replace the pins.

Once the inspection was completed, there was no requirement to check the fuse pins ever again, nor even to report back to the FAA what was found, said FAA spokesman Dave Duff. Thus authorities never formally tallied or assessed as a group the cases of corroded or cracked pins uncovered by the call for inspection.

Some airlines balked at the order, which meant squeezing an unplanned for, time-consuming task into a rigorously tight maintenance routine. Airline executives who had spent the time and money to replace old-style pins with the newer version felt especially cheated because Boeing had pitched the new pins as a foolproof upgrade, said a mechanic for a major U.S. airline who was involved in the work.

Mechanics gripe

Mechanics weren't happy either. Boeing's inspection procedure called for the tightly wedged inserts to be yanked loose to check for corrosion and cracks inside the pin. As it turned out, the inserts were the reason why the new-style pins proved readily susceptible to corrosion.

"The concern was the pins were coated with anti-corrosive primer," Boeing's Villiers said. "There was a concern that in putting on the inserts, the primer may have been scratched. We asked operators to do a one-time inspection to check that the primer was in place underneath the inserts."

Boeing designed a special tool to remove the inserts, but it still took up to 50 man-hours to inspect the four pins on each engine mount and an additional 160 man-hours to replace a set of four pins, which entailed removing, then reattaching the engine.

The pristine logic of Boeing engineers, working in offices insulated from the real-life, day-to-day experience of a competitive flight line, became the butt of jokes among airline mechanics.

"It stands to reason that if something (insert) is going to be set that tight, you're going to scrape it (anti-corrosive primer) away," the mechanic said. "I guess they figured in theory there shouldn't be any room for corrosion to get in there. But obviously there was."

Disaster in Taiwan

On Dec. 29, 1991, eight months after Boeing and the FAA decided a one-time inspection of new-style fuse pins would keep the 747 fleet safe, a 12-year-old China Airlines 747-200 freighter, packed nearly to its maximum flying weight, took off from Taipei, Taiwan, bound for Anchorage, Ala.

Securing the engines were new-style pins, installed at some point in the previous few years as replacements for the aircraft's original old-style pins. Moreover, according to the FAA's 1991 inspection order, the pins should have been recently checked, or were due for an inspection in the near future. (Boeing and the FAA refused to reveal details of the jetliner's maintenance history.)

A few minutes after takeoff, as the aircraft approached 29,000 feet with its engines roaring at climb thrust, the right inboard engine and the strut holding it to the wing ripped loose and veered into the right outboard engine, knocking it loose, too.

Both right-side engines fell into the sea. As he struggled to guide the crippled jet back to Taipei, the captain radioed that the aircraft was stuck in a right-hand turn. Less than three minutes later, the jet smashed into a sea cliff killing all five crew members.

Slow reaction

Although investigators from the FAA, Boeing and the NTSB spent several weeks assisting Taiwan aviation officials at the scene of the accident, a news blackout was draped over the Taiwan disaster. U.S. authorities referred questions to their Taiwanese counterparts, who said very little publicly. It took about six weeks to recover both right engines from the ocean floor.

Months passed; U.S. and Taiwanese authorities thoroughly analyzed evidence from the wreckage. Word spread in aviation circles that Boeing, the FAA and the airlines were arguing over the scope and timing of a second call for inspection of new-style fuse pins. Such an inspection would further disrupt airline operations in the midst of an unprecedented industry depression, in which losses over a three-year span were fast approaching $9 billion.

Even so, the carefully measured reaction of U.S. authorities was nothing new. Aviation history is replete with cases of manufacturers, airlines and the FAA methodically narrowing the focus of investigations into emerging safety concerns - until a major disaster triggers more aggressive action.

For instance, documents show Boeing knew since the early 1970s about a flaw in the electrical system of 747 cargo doors that could cause a door to open by itself in flight. But it took a cargo door ripping off a United Airlines 747 in 1989 - and the deaths of nine passengers - for Boeing to fix the flaw.

More recently, Boeing has been quietly moving to upgrade suspect wiring and a flawed valve on thrust reversers of 747s, 757s and 737s - two years after a flawed reverser (an engine braking device) inadvertently deployed, flipping a Lauda Air 767 into a supersonic crash dive into a Thai jungle. All 223 on board were killed.

Cracked pin spurs alert

Nine months after the China Airlines 747 crash, the air-safety system appeared to be in gridlock. There was no word from Boeing or the FAA whether other airlines found weakened new-style pins as a result of the May 1991 call for inspection. No official precautionary measures were imminent.

Then on Sept. 11, 1992, an alert inspector checking an Argentina Aerolineas 747-200 passenger jetliner prior to take off spotted the aircraft's right inboard engine drooping. Mechanics discovered the droop was caused by a cracked new-style fuse pin.

The following week, on Sept. 16, Boeing convened a meeting in Seattle of several major 747 operators to discuss fuse-pin problems. Final touches were put on a "service bulletin" advising airlines to again perform a one-time inspection of the new-style fuse pins. Old-style pins, by now used on fewer than 200 older model 747s, were not covered. Following several rounds of meetings, Boeing officials picked a date to issue the bulletin: Oct. 8, 1992.

They never got the chance.

Kid gloves come off

At 6 p.m. Sunday, Oct. 4, 1992, the El Al jet crashed in almost the same way as the China Airlines jet. Both lost two right engines in an alarmingly similar way.

About 14 minutes after takeoff, the inboard engine and strut sheered free of the El Al jet's right wing and veered into the right outboard engine, knocking it loose. Both engines fell into a lake.

The airplane made two wide, right-hand circles over Amsterdam before careening into a 10-story apartment complex where residents were just settling down to supper.

The El Al jet happened to be one of the comparatively few jetliners still using the original old-style pins covered by the periodic inspection rule. In fact, the pins passed an ultrasonic inspection about four months before it crashed, and were not due for their next check for another two or three months.

If U.S. authorities treated the Taiwan crash with kid gloves, they scrambled in a comparative full-blown red alert to the Amsterdam accident. Boeing pushed up the release date of its call for inspection to Oct. 5, the day after the crash.

Two weeks after the loss of the El Al jet, FAA Deputy Director Thomas McSweeney, in an unusually candid letter to Dutch aviation officials, spelled out the link between the disasters in Taipei and Amsterdam. As the letter made its way to Amsterdam, its contents were divulged to reporters at The Wall Street Journal and USA Today.

"The probable cause of these two accidents appears to be related to structural failure of the No. 3 (inboard right) engine pylon-to-wing connection," McSweeney wrote. "To date, based upon extensive service history with the Boeing 747, the only probable cause we have identified is cracking and eventual failure of the midspar fuse pins."

Crisis brewing

McSweeney's explicitness was startling. The FAA, mandated by Congress to both ensure air safety and promote the aviation industry, typically takes great pains to avoid any hint that it holds any opinion about the probable cause of an air disaster, especially a controversial one.

That's the bailiwick of the NTSB, which is equally reluctant to declare, early on, what it thinks may have caused an accident. The safety board typically takes a year or longer to issue an official ruling. FAA spokesman Duff could not explain the unprecedented breach of protocol by McSweeney, who declined interview requests.

It may be that U.S. authorities finally perceived flawed 747 fuse pins as a complicated crisis reaching full boil. "They were taking their sweet old time after China Airlines," said air-safety consultant John Galipault, president of Aviation Safety Institute. "Nobody in management put any urgency to this until after the second accident."

The highly visible Amsterdam crash did something the obscure accident near Taipei did not: It made precautionary grounding of the 747 fleet an uncomfortable possibility.

The last time the FAA grounded a jetliner model - the McDonnell Douglas DC-10 trijet - as unsafe, top FAA officials came under withering fire from industry insiders and high-powered politicians. Moreover, European authorities at first went along with the grounding, but then put the DC-10 back in the air weeks before the U.S. did, undermining the FAA's credibility.

Ironically, that case involved weakened engine mounts causing the worst aviation accident ever on U.S. soil. On May 25, 1979, an American Airlines DC-10 lost an engine after takeoff from Chicago's O'Hare airport and slammed into the ground killing all 271 on board and two people on the ground.

Chasing a compromise

Nobody wanted to see the 747 similarly grounded, especially with the airline industry drowning in red ink. "If the FAA were to ground our whales (747s) in this environment, this airline would go bankrupt," said an insider at a major U.S. carrier.

Yet, should another fuse pin failure occur, the FAA might not have any choice. FAA officials responded by launching a worldwide inspection of most of the 747 fleet, requiring installation of new-style pins on jumbo jets still using old-style pins and ordering airlines to, this time, formally report their findings.

Within 30 days after the El Al crash, inspections of 300 747s turned up 499 corroded pins and 14 cracked pins, a shocking 20 percent problem rate.

"When you go out and find 20 percent of the fuse pins in the fleet corroded, that's very serious," said engine expert Bobbi. "They're constantly chasing their tail on this, worrying about forging a compromise the manufacturer and the airlines can live with, while hoping it doesn't lead to another accident."

Indeed, Boeing and the FAA have reverted to behind-closed-doors operating procedure, refusing to divulge even routine background information about aircraft design.

Meanwhile, the discovery and refurbishing of corroded and cracked 747 fuse pins has continued.

Boeing has also mounted sophisticated measuring instruments to fuse pins on several live commercial flights to gather fresh data on the stresses the pins must withstand during all phases of flight.

But Boeing and the FAA now decline to say if the same one-in-five rate of problem pins is being found on the rest of the jumbo-jet fleet.

They are equally mum about what can be done, beyond inspections, about tens of thousands of pins, cleaned up or not, that will continue to be readily susceptible to corrosion. And they decline to publicly discuss whether the much more intensive use of modern jetliners might, perhaps, render 50s-era engine mount design principles obsolete.