United Airlines Flight 232

Date

19 July 1989

Phase of flight

Landing

Location

Sioux Gateway Airport, Sioux City, Iowa, United States

Aircraft

McDonnell Douglas DC-10-10

Registration

N1819U

Operator

United Airlines

Flight

United Airlines 232

Occupants

296

Fatalities

111110 passengers and 1 flight attendant; a passenger who died 31 days later is counted among the seriously injured, as 49 CFR 830.2 requires

Investigating body

National Transportation Safety Board (United States)

Final report

NTSB/AAR-90/06

Report date

1 November 1990

Report title

United Airlines Flight 232, McDonnell Douglas DC-10-10, Sioux Gateway Airport, Sioux City, Iowa, July 19, 1989

On 19 July 1989 United Airlines Flight 232, a McDonnell Douglas DC-10-10 registered N1819U, was cruising at 37,000 ft over Iowa when the fan of its tail-mounted No. 2 engine broke apart. Fragments cut the lines of the aircraft's three hydraulic systems, and every flight control surface stopped moving. For about 44 minutes the crew steered the aircraft with the thrust of the two remaining engines, and at 16:00 central daylight time (local time) it touched down on a closed runway at Sioux Gateway Airport, Sioux City, broke up and caught fire.

Of the 296 people on board, 111 were killed, and one more passenger died of his injuries 31 days later. The National Transportation Safety Board (NTSB) traced the failure to a fatigue crack that had grown from a defect in the titanium of the stage 1 fan disk, a crack that United Airlines' inspection had not detected. It found that the damaged aircraft could not realistically have been landed safely, and described the crew's performance as "highly commendable".

Flight 232 is a reference case for crew resource management, for flight with thrust alone, for the inspection of engine rotating parts and for protecting flight control systems from a single event.

The flight

Flight 232 was a scheduled passenger flight under 14 CFR Part 121 from Denver, Colorado, to Philadelphia, Pennsylvania, with a stop at Chicago. It departed Denver at 14:09 with 285 passengers and 11 crew members: a captain, a first officer, a second officer (flight engineer) and 8 flight attendants. The first officer was flying, with the autopilot engaged.

The captain had 29,967 hours logged with United, 7,190 of them on the DC-10. The first officer estimated his total at about 20,000 hours, including 665 hours as a DC-10 first officer. The second officer estimated about 15,000 hours, with 33 hours on the DC-10. The crew was qualified, and the NTSB found that weather, air traffic control and navigation facilities were not factors. The aircraft, delivered to United in 1971, had flown 43,401 hours and took off at 369,268 lb.

Three hydraulic systems and no manual reversion

The DC-10's primary flight controls, ailerons, elevators and rudder, are all powered hydraulically, and each surface is driven by two of three independent systems. Each system is powered by its own engine, with backup from reversible motor pumps and, for the No. 3 system, auxiliary pumps that an air-driven generator can power. There is no manual reversion: at least one system must keep its fluid and its pressure for the aircraft to be controlled. The lines were separated to reduce the chance that one event could damage all three, but all three pass through the tail, where the No. 2 engine is mounted.

The accident

At 15:16:10, about 1 hour 7 minutes after take-off, the crew heard a loud bang and felt vibration. The No. 2 engine had failed, and while running the shutdown checklist the second officer saw the hydraulic pressure and quantity gauges of all three systems at zero. The aircraft entered a descending right turn. The captain took control, found that it did not respond to the controls, and reduced thrust on the No. 1 engine, after which the wings rolled level. The crew deployed the air-driven generator and selected the auxiliary pump, but with no fluid left, pressure did not return.

The crew asked Minneapolis Center for vectors to the nearest airport and accepted Sioux City. The company's maintenance centre, contacted by radio, could offer no procedure that the crew did not already have: none existed, because the manufacturer, the FAA and the airline had considered the total loss of hydraulic flight controls too remote to need one.

An off-duty United DC-10 training check airman travelling in first class offered to help. He first looked at the wings through the cabin windows, reporting the inboard ailerons slightly up and the spoilers down, and was then asked to take the thrust levers, freeing the two pilots to work the control columns. Because the No. 1 and No. 3 thrust levers could not be used symmetrically, he used a hand on each. The aircraft kept turning right and oscillated slowly in pitch. Left turns were difficult, and the controller asked how steep a right turn the flight could make. The crew jettisoned fuel down to the automatic cutoff, leaving 33,500 lb, and extended the landing gear by the alternate method. Looking aft, the second officer saw damage to both horizontal stabilisers.

Controllers had planned an approach to runway 31, 8,999 ft long, but the aircraft lined up on runway 22, which had been closed in 1988. The controller had cleared the flight to land on any runway, and given its position and the difficulty of left turns, the captain continued. The flaps and slats, which need hydraulic power, stayed retracted. In the last 20 seconds the airspeed averaged 215 kt and the sink rate 1,620 ft per minute. The captain recalled that about 100 ft above the ground the nose pitched down and the right wing dropped. The right wingtip and right main gear touched first, on the threshold slightly left of the centreline; the aircraft skidded to the right, cartwheeled, broke apart and burned. The centre fuselage came to rest inverted in a corn field.

The investigation

A crack in the fan disk

The tail cone and parts of the No. 2 engine fell on farmland near Alta, Iowa, and were recovered the day after the accident. Metallurgists showed that the stage 1 fan disk, made of titanium alloy (Ti-6Al-4V), had broken from a fatigue crack at the inside surface of its bore. The crack began at a hard alpha inclusion, a small nitrogen-rich defect formed when the titanium ingot was melted, which had escaped the ultrasonic and macroetch inspections during the disk's manufacture by General Electric Aircraft Engines (GEAE) in 1971. A cavity at the defect, probably opened during final machining or shot peening, acted as a stress raiser. The number of striations on the fracture was close to the disk's 15,503 cycles, so the crack had started very early in its life.

Missed at the last inspection

The disk had passed six fluorescent penetrant inspections (FPI) in its life, the last at United's San Francisco overhaul shop in 1988, 760 cycles before the accident. A discoloured area on the fracture, about 0.476 in long at the bore surface, marked the crack's size at that inspection, and traces of FPI chemicals inside it showed that the penetrant had entered the crack. The NTSB concluded that the crack, almost 1/2 in long, was detectable and should have been found. It considered several explanations: poor preparation of the part, an area of the bore hidden by the suspension cable, developer powder obscuring the indication, and an inspector who, knowing that the bore rarely produced indications, gave it only cursory attention. Inspectors worked largely alone, with little redundancy against human error.

How one engine took out three systems

Titanium traces on the severed No. 1 and No. 3 hydraulic lines in the right horizontal stabiliser showed that engine fragments had cut them. The No. 2 system, whose pumps are driven by the No. 2 engine, lost its hydraulic components and hoses with the engine's fan section. The design met the certification standard of the time, but the NTSB found that the potential for random engine debris to damage the hydraulic systems should have been given more consideration in the DC-10's design and certification.

Flying on thrust alone

With the elevators and stabiliser fixed, the aircraft's trim speed was set by its configuration and damage and could not be reduced for landing. Any disturbance or thrust change started a phugoid, a slow exchange of speed and height about the trim speed, with a period of about 1 minute. More thrust made the aircraft climb and less made it descend; well-timed small thrust changes could damp the oscillation. For direction the crew used differential thrust: the resulting yaw and sideslip produce a roll through wing sweep and dihedral, and the roll produces the turn. A manoeuvre could take as much as 20 to 40 seconds to follow a thrust change.

In simulator trials, experienced DC-10 pilots found that they could control speed, touchdown point, direction, attitude or sink rate separately, but not all of them at once, and a landing at a planned point and speed was "a highly random event". The NTSB concluded that the damaged aircraft, although flyable, could not have been landed successfully on a runway, and that training for this scenario would not have helped.

Crew and cabin

The NTSB found that the captain's decision to bring the check airman to the flight deck was "positive and appropriate" and saw the crew's work as evidence of the value of the cockpit resource management training United had given for a decade. It judged the crew's performance "highly commendable" and said it "greatly exceeded reasonable expectations".

In the cabin, the senior flight attendant did not ask how much time remained before landing, and the flight attendants were still collecting meal trays when the second officer warned that the passenger briefing would be short. All flight attendants and passengers were in the brace position at touchdown. Four children travelled on adults' laps and were placed on the floor; one of them died. Of the fatal injuries, 35 passengers died from smoke inhalation. The airport emergency response was timely, but corn about 7 ft tall and the failure of a water supply vehicle hampered the firefighting.

Probable cause and contributing factors

The NTSB determined that the probable cause was "the inadequate consideration given to human factors limitations in the inspection and quality control procedures used by United Airlines' engine overhaul facility which resulted in the failure to detect a fatigue crack originating from a previously undetected metallurgical defect located in a critical area of the stage 1 fan disk that was manufactured by General Electric Aircraft Engines. The subsequent catastrophic disintegration of the disk resulted in the liberation of debris in a pattern of distribution and with energy levels that exceeded the level of protection provided by design features of the hydraulic systems that operate the DC-10's flight controls."

Member Jim Burnett dissented. In his view the probable cause was the manufacture by GEAE of a defective disk and the failure to detect it, United's failure to detect the crack, and Douglas's failure to design the airframe for a random release of engine fragments, with the FAA's certification process as a contributing factor.

Safety recommendations and what changed

Douglas developed a hydraulic system enhancement for the DC-10: an electrically operated shutoff valve in the No. 3 system, forward of the horizontal stabiliser, which closes automatically when the No. 3 reservoir level falls, with a cockpit light. After damage like Flight 232's, it preserves stabiliser trim at half rate, some aileron control, the slats and other services. AD 90-13-07, effective 20 July 1990, required it on all DC-10s by 20 July 1991, and Douglas built the MD-11 with it.

During the investigation the NTSB recommended urgent inspections of CF6-6 fan disks and shafts, a new inspection method for the fan disk bore, damage tolerance evaluations of critical engine parts, and a macroetch inspection of titanium rotating parts in their final shape (A-89-95 to -97, A-90-88 to -91). It also recommended that all occupants, including infants and small children, be restrained in an approved seat or child restraint (A-90-78, -79), and made recommendations on firefighting equipment and crops on airports (A-90-147 to -155). The final report added, among others:

• research into simpler, automated and more reliable inspection, with a redundant "second set of eyes" for critical parts such as engine rotating components (A-90-167, and A-90-176, -177 to industry);
• research into backup flight control systems with an alternative source of power for new wide-body aircraft (A-90-168);
• system safety reviews of certificated aircraft for the redundancy and protection of power sources for flight and engine controls (A-90-169);
• analysis of the fragments' dispersion, size and energy for a revision of Advisory Circular 20-128 on uncontained engine failures (A-90-170);
• a reminder to training departments of the importance of time management in preparing the cabin for an emergency landing (A-90-173).

Lessons for pilots

Use every resource. The captain accepted help from an experienced pilot in the cabin, divided the work so that one person handled thrust while two worked the controls, sent crew members to assess the damage, and kept air traffic control and the cabin informed. The NTSB saw this as evidence of the value of crew resource management training.

Know the aircraft beyond the checklist. No procedure existed for the loss of all hydraulic flight controls. The crew worked out that thrust changes could control pitch and roll, but with long delays. Flight with thrust alone depends on anticipation: each change has to be made 20 to 40 seconds before it is needed.

Redundancy needs separation. Three independent systems protected the DC-10 against one or two failures, but all three passed close to one engine in the tail. When studying hydraulic systems, look at how the lines are routed and what protects them from a single event such as a rotor burst, not just at the number of systems.

Read the indications after an engine failure. An engine failure can be more than a loss of thrust. On Flight 232 the second officer noticed the hydraulic gauges at zero while running the shutdown checklist, and the air-driven generator could not help because the fluid was gone.

Inspection is a human task. A crack almost 1/2 in long was missed by one inspector working alone, possibly in an area that rarely showed defects. Any inspection, including a pilot's walk-round, is only as good as the attention given to the areas that matter most.

Crash Investigations pages summarise official investigation reports for study and exam preparation. The investigating body's report is the authoritative account and prevails wherever it differs from this page. Under ICAO Annex 13, an investigation exists to prevent accidents, not to apportion blame or liability.