Fuse Pins: The Structural Fuse That Holds the Engine On
Jet engine pylons contain deliberately weakened pins designed to shed the engine under extreme overload — and two Boeing 747 freighter accidents showed what happens when the fuse itself fails from fatigue.
An electrical fuse protects a circuit by being the first element to fail. Large jet transports apply the same philosophy structurally: the engine pylon that carries a multi-ton turbofan under the wing includes fuse pins — hollow steel pins with machined necked-down sections, deliberately sized to be the weakest links in the engine-to-wing load path.
The design intent is often misunderstood. The fuse pins are not a vibration switch, and they are not meant to react to high vibration levels in normal service. They are static overload fuses. If the engine strikes the ground in a wheels-up landing, if the rotor seizes and delivers an enormous torque spike, or if a fan blade-off event produces loads beyond the pylon’s design envelope, the fuse pins shear and the engine departs cleanly — sacrificing the engine to preserve the wing box and, critically, the fuel tanks inside it. A wing that keeps its fuel where it belongs is the difference between an emergency landing and a fireball.
Fuse pins are common on older aircraft, such as the Boeing 747. However, manufacturers like Airbus do not use fuse pins. Airbus mounts the engine permanently to the wing, designing the entire structure to stay attached in almost all situations.
The Loads the Fuse Must Survive
The engineering challenge is that the fuse pins must be weak enough to shear under crash and seizure loads, yet strong enough to carry every load the pylon sees in service — including the most violent dynamic event an engine can produce short of destruction: a fan blade-off. When a fan blade releases, the rotor is left with a large residual unbalance. The rotating unbalance force is
$$ F = m \, e \, \omega^2 $$
where \( m \) is the unbalance mass, \( e \) its eccentricity, and \( \omega \) the rotor speed. The loss of a single wide-chord fan blade — several kilograms at roughly a one-meter radius, at thousands of RPM — generates a rotating force measured in the hundreds of kN, cycling at the fan’s rotational frequency. After shutdown, the engine continues windmilling in the airstream for the remainder of the flight, subjecting the pylon to sustained unbalance excitation, possibly near an airframe or pylon mode. Certification requires the mounts and fuse pins to carry blade-off and windmilling imbalance loads without releasing the engine. The fuse fires on gross overload; it must hold through severe vibration.
El Al Flight 1862 — Amsterdam, 1992
On October 4, 1992, an El Al Boeing 747-200 freighter departed Amsterdam Schiphol for Tel Aviv. Minutes into the climb, the number 3 engine (inboard, right wing) separated from the wing. It moved outboard and struck the number 4 engine, tearing it off as well. The departing engines and pylons damaged the right wing leading edge, hydraulics, and high-lift devices. The crew attempted to return to Schiphol, but with severely degraded lift and control on the right wing, the aircraft rolled and crashed into an apartment complex in the Bijlmermeer district. Forty-three people died — the crew, one passenger, and residents on the ground.
The investigation traced the initiating failure to fuse pins in the number 3 pylon. Fatigue cracking had progressed through a fuse pin until it failed in normal cruise-climb flight loads — far below the overload level the fuse was designed to react to. Once one pin failed, the load redistributed to the remaining attachments, overloading them in sequence. The structural fuse, intended to fire only in extremis, had instead failed silently from fatigue while doing its everyday job.
China Airlines Flight 358 — Taipei, 1991
The El Al accident was not the first. On December 29, 1991, a China Airlines 747-200 freighter departing Taipei lost its number 3 engine, which likewise moved outboard and took the number 4 engine with it. The aircraft crashed shortly after; the wreckage pattern — both right-wing engines found separated from the crash site — matched what Amsterdam investigators would see ten months later. Fuse pin and pylon attachment failure was again implicated. Two accidents, same aircraft type, same failure sequence, within a year: a textbook fleet-wide fatigue problem announcing itself.
Why the Fuses Failed
The investigations and subsequent airworthiness reviews identified a cluster of contributing factors familiar to any fatigue engineer. The necked fuse sections concentrate stress by design — that is what makes them fuses — which also makes them efficient fatigue crack initiators under the pylon’s everyday alternating loads: gusts, maneuvers, thrust cycles, and engine vibratory loads transmitted through the mounts. Corrosion pitting on pin surfaces provided initiation sites and accelerated growth. The pins were difficult to inspect in place, so cracks could grow undetected between overhauls. And the older 747 pylon design had limited fail-safety: the loss of one pin could cascade rather than being safely absorbed by redundant load paths.
The regulatory response was substantial: repetitive inspection programs, fuse pin replacement with redesigned pins, and ultimately Boeing’s redesigned 747 pylon structure with improved damage tolerance, so that a single failed element no longer threatens engine retention.
KEY POINT: A structural fuse must satisfy two requirements simultaneously: fail reliably above the overload threshold, and survive indefinitely below it. The second requirement is a fatigue problem. The El Al and China Airlines accidents were not cases of a safety device firing incorrectly — they were cases of the device fatiguing and failing under ordinary service loads it was supposed to carry for the life of the airframe.
Lessons for the Structural Dynamicist
The fuse pin story generalizes well beyond aviation. Shear pins, breakaway bolts, frangible connections in launch vehicle staging, and breakaway light poles beside highways all embody the same trade. Several lessons carry over. First, any intentional stress concentration is a fatigue hot spot, and its alternating stress spectrum — including vibratory loads — must be characterized as carefully as its ultimate overload behavior. Second, a fuse that cannot be inspected is a fuse whose condition is unknown; damage tolerance analysis must assume cracks exist. Third, fail-safety matters: the load path should tolerate the loss of one element without cascading. And finally, corrosion and fatigue conspire — a pit becomes an initiation site, and a protective coating breach can halve a component’s life. The fuse pin is one of the cleverest ideas in airframe design, and its failures are among the most instructive.
References
Netherlands Aviation Safety Board, Aircraft Accident Report 92-11: El Al Flight 1862, Boeing 747-258F, Amsterdam, October 4, 1992.
FAA Airworthiness Directives on Boeing 747 pylon fuse pin inspection and replacement (1990s).
14 CFR § 33.94, Blade containment and rotor unbalance tests; § 25.361/25.362, engine failure loads.
T. Irvine, Vibrationdata publications & free ebooks: https://blog.vibrationdata.com/2025/11/27/toms-ebooks/