← back to the reports
MY-005 McDonnell Douglas DC-10 · United Airlines 1989

United Airlines Flight 232 — A Hidden Flaw Severed Every Hydraulic Line, and a Crew Flew on Engines Alone

engine-failurewidebody-jet1980s
Killed
112
Aircraft
McDonnell Douglas DC-10-10
Operator
United Airlines
Status
Mechanical

Summary

On 19 July 1989, United Airlines Flight 232, a McDonnell Douglas DC-10-10 registered N1819U, crash-landed at Sioux Gateway Airport in Sioux City, Iowa, after the catastrophic failure of its tail-mounted number two engine destroyed all three of the aircraft's hydraulic systems. Of the 296 people aboard, 112 were killed and 184 survived. Unlike most entries in this file, the outcome is remembered less for the deaths than for the survivals: an aircraft left with no conventional flight controls was kept airborne for some 44 minutes and brought to a runway by a crew improvising with engine thrust alone, a feat the investigators and the wider profession regarded as extraordinary.

The aircraft had departed Denver's Stapleton International for Chicago O'Hare, with onward service to Philadelphia. About an hour into cruise at 37,000 feet, the stage-one fan disk of the rear General Electric CF6-6 engine fractured and burst apart. The engine failed in an uncontained manner: high-energy fragments were thrown clear of the engine casing and through the tail. Those fragments cut the lines of all three independent hydraulic systems where they passed close together near the tail. Hydraulic fluid drained away, and with it went the aircraft's ability to move its elevators, ailerons, rudder, flaps, and slats. The DC-10 was, in the conventional sense, uncontrollable.

What followed was a controlled descent flown on differential thrust. Captain Alfred Haynes and his crew, joined by an off-duty United DC-10 training check airman, Captain Dennis Fitch, who was travelling as a passenger and came forward to help, manipulated the two remaining wing engines — adding and reducing power on each side to turn, and using power changes to coax the nose up and down — to fly the crippled aircraft toward Sioux City. On final approach the aircraft was descending too fast and drifting right; the right wingtip struck the runway, the aircraft cartwheeled, broke apart, and caught fire. That so many lived through it was attributed to the crew's airmanship, the cabin crew's preparation, and a well-drilled local emergency response that happened to be on a shift change with extra personnel available.

The National Transportation Safety Board, in report AAR-90/06, traced the disaster to a metallurgical defect that had been present in the fan disk since its manufacture and had grown into a fatigue crack that inspections failed to catch. The board's probable cause did not stop at the metal; it faulted the inspection and quality-control regime that should have found the crack and did not.

Timeline

1971–1972
A flaw born in the foundry
During manufacture, the titanium of the number-two engine's stage-one fan disk forms with a hard, brittle inclusion (a nitrogen-rich "hard alpha" defect) near a bolt-hole bore — a latent flaw the disk carries from new.
1972–1989
A crack that hid in plain sight
A fatigue crack grows slowly from the defect over thousands of flight cycles; the disk passes six on-wing fluorescent-penetrant inspections, the last in 1988, without the crack being detected.
19 July 1989, ~14:09
Departure
Flight 232 leaves Denver Stapleton for Chicago O'Hare with 296 aboard, climbing to a cruise altitude of 37,000 feet.
~15:16
The engine bursts
About an hour out, the tail-mounted CF6 fan disk fractures and fails uncontained; the crew hears a loud bang and the number two engine winds down.
Within seconds
All hydraulics lost
Engine fragments sever all three hydraulic systems where their lines run together near the tail; fluid drains away and conventional flight control is lost.
~15:20
An extra pilot steps forward
Off-duty United check airman Dennis Fitch offers help and is brought to the cockpit; the crew begins flying the aircraft on differential thrust of the two wing engines.
~15:20–16:00
A descent on thrust alone
Over roughly 40 minutes the crew uses asymmetric power to turn and to manage pitch, working the aircraft down toward Sioux Gateway Airport, aiming for runway 22 and then a closed runway.
19 July 1989, 16:00
Impact
On short final the right wing drops and strikes the runway; the DC-10 cartwheels, breaks into sections, and burns. 112 die; 184 survive.
1989–1990
The disk is found and tested
Investigators recover the fractured fan disk from an Iowa cornfield; metallurgical examination identifies the hard-alpha inclusion and the fatigue crack that grew from it.
1 November 1990
The board reports
The NTSB publishes report AAR-90/06, attributing the accident to inadequate inspection and quality control that failed to detect a fatigue crack from a manufacturing defect in the GE fan disk.
1990s
Reforms follow
GE and the FAA revise titanium-rotor inspection and "fracture control" practices; the industry expands research into surviving total hydraulic loss and refines crew-resource-management training.

The Aircraft and the Engine in the Tail

The DC-10-10 was a wide-body trijet: two engines under the wings and a third, the number two, mounted in the base of the vertical stabiliser, fed by an S-duct inlet at the top of the rear fuselage. N1819U was nearly eighteen years old in 1989 but well within its service life. Its three engines were General Electric CF6-6 high-bypass turbofans, and the largest single rotating part at the front of each was the stage-one fan disk — a thick titanium hub spinning at high speed, carrying the fan blades. A fan disk holds enormous rotational energy; if it bursts, the fragments cannot be contained by the engine casing, which is why a fan-disk failure is among the most feared events in jet operation.

The DC-10's flight controls were entirely hydraulic, powered by three independent systems for redundancy. Redundancy assumes that the systems fail independently — that whatever takes out one will not take out the others. The vulnerability that Flight 232 exposed was geometric rather than mechanical: although the three systems drew power from different sources, their lines ran in close proximity through the tail, near the number two engine, with no fuse, check valve, or shutoff that could isolate a section and preserve the rest. A single energetic event in that region could puncture all three at once. On paper the aircraft had triple redundancy. In that one location it had none.

The number two engine's fan disk had been forged from a titanium ingot that contained a hard-alpha inclusion — a brittle, nitrogen-contaminated region introduced during melting. The flaw was present when the disk entered service. Under the cyclic stress of repeated takeoffs and landings, a fatigue crack initiated at the inclusion near a bolt bore and grew, cycle by cycle, for seventeen years.

Forty-Four Minutes on Thrust Alone

About an hour into the cruise, the fan disk let go. The crew heard a sharp bang and felt the airframe shudder; the number two engine instruments showed it had failed. Within seconds the flight engineer and captain saw the hydraulic quantity and pressure for all three systems falling toward zero. The aircraft began a slow right turn and a phugoid oscillation — porpoising up and down — that the crew could not arrest with the control column, because the controls no longer answered.

Captain Haynes, First Officer William Records, and Flight Engineer Dudley Dvorak worked the problem with no procedure to guide them; total loss of all hydraulics was a contingency the manuals did not cover because it was considered effectively impossible. Dennis Fitch, a DC-10 instructor riding as a passenger, came forward and was put to work on the throttles. By advancing and retarding the two wing engines independently, the crew found they could turn the aircraft and, by exploiting the relationship between thrust and the phugoid, partially manage its climb and descent. It was crude, laggy, and exhausting, and it kept the aircraft flying. Air traffic controllers and United's maintenance base were brought in; the crew chose Sioux Gateway as the nearest adequate field.

The approach was the hardest part. With no flaps, no slats, no precise control of pitch or roll, and a descent rate far above normal, the aircraft arrived over the threshold fast and sinking. Moments before touchdown the right wing dropped; the wingtip and the number-three engine contacted the runway first. The DC-10 cartwheeled, broke into several large pieces, and the fuselage came to rest inverted in a cornfield beside the runway, with a fuel-fed fire. The cockpit voice recorder and the survivors' accounts established that the crew had done everything achievable; the investigators later judged that a safe landing was essentially beyond the reach of any crew given the aircraft's state, which made the 184 survivals all the more remarkable.

What the Board Found

The NTSB's report, AAR-90/06, stated the probable cause in terms that named both the metal and the people who should have caught it. The board found: "the probable cause of this accident was the inadequate consideration given to human factors limitations in the inspection and quality control procedures used by United Airlines' engine overhaul facility which resulted in the failure to detect a fatigue crack originating from a previously undetected metallurgical defect located in a critical area of the stage 1 fan disk that was manufactured by General Electric Aircraft Engines. The subsequent catastrophic disintegration of the disk resulted in the liberation of debris in a pattern of distribution and with energy levels that exceeded the level of protection provided by design features of the hydraulic systems that operate the DC-10's flight controls."

Two threads run through that finding. The first is mechanical and metallurgical: a hard-alpha inclusion, formed in the titanium during manufacture, seeded a fatigue crack that grew undetected across seventeen years and six fluorescent-penetrant inspections. The board concluded the crack should have been detectable at the last inspection and was missed, and that the inspection regime had not adequately accounted for the human limitations of operators looking for small indications on a large part. The second thread is one of design margin: the DC-10's flight-control hydraulics, though triply redundant, were grouped in the tail with no protection against simultaneous severance by engine debris. The board treated the engine failure as the initiating event and the total hydraulic loss as the reason it became unsurvivable for most aboard. It assigned the cause to the mechanical failure of the fan disk and the inspection system that failed to catch it, while documenting the design vulnerability that turned a contained problem into a catastrophic one.

The Five Factors

01
A defect that the part carried from birth
The fan disk left the foundry with a hard-alpha inclusion that no amount of careful operation could remove. When a flaw is built into a critical rotating part, the only defences are catching it at manufacture or detecting the crack it spawns; once both fail, the failure is only a matter of cycles. Material quality control at the point of forging is the first and cheapest line of defence.
02
A crack that defeated repeated inspection
The disk passed six inspections over seventeen years while a fatigue crack grew within it, because the inspections did not reliably reveal small indications and did not account for the limits of the humans performing them. An inspection regime is only as good as its real-world detection rate; designing it without regard to human factors guarantees that some cracks pass through.
03
Redundancy that was not independent
Three hydraulic systems gave the appearance of triple redundancy, but their lines ran together through the tail where a single uncontained failure could sever them all. Redundancy protects only against independent failures; routing every backup through one vulnerable region reintroduces the single point of failure the redundancy was meant to remove.
04
No protection against the energy the engine could throw
The hydraulic system's design assumed engine debris of a certain magnitude; the fan disk threw fragments beyond that level. Containment and shielding assumptions must be matched to the worst credible failure of the rotating parts nearby, because an uncontained disk burst is not a remote abstraction but a known, periodic event.
05
Improvisation as the last layer
With no procedure for total hydraulic loss, the crew kept the aircraft flying on differential thrust and an off-duty pilot's help, saving most aboard. Trained crew judgement, crew-resource-management discipline, and the willingness to improvise are the final defence when every engineered safeguard has failed; they cannot be relied upon to substitute for the safeguards, but they are why 184 people lived.

Aftermath

Flight 232 produced two enduring legacies. The first was in metallurgy and inspection: the accident drove a wholesale tightening of how titanium rotor parts are made and examined, including improved melting practices to reduce hard-alpha inclusions and a formal "fracture control" and lifing discipline for critical rotors, alongside enhanced and more frequently audited inspection procedures across the engine industry. The second was in the philosophy of hydraulic redundancy: the industry studied how to survive a total loss of flight-control hydraulics, work that informed later flight-control architectures, propulsion-controlled-flight research, and the routing and protection of hydraulic lines on subsequent designs.

The human story made the accident a permanent fixture of training. Captain Haynes spent years afterward speaking to aviation audiences about luck, communication, preparation, and crew resource management; the crew's coordinated, ego-free use of every resource — including a passenger who happened to be a check airman — became one of the most cited examples of CRM in practice. There was no criminal prosecution; the cause was an undetected manufacturing flaw, not negligence of the kind courts punish. For the families of the 112 who died and the survivors who carried the day with them, the Sioux City crash remains a study in how much skill can salvage from a situation that engineering had declared impossible.

Lessons

  1. Control material quality at the source: a hard-alpha inclusion forged into a critical rotor cannot be operated away, so the foundry and its inspections are the decisive line of defence.
  2. Build inspection regimes around the human doing the inspecting; an examination that ignores realistic detection limits will let small, growing cracks pass through, no matter how many times it is repeated.
  3. Make redundant systems physically independent; backups that share a single vulnerable route are not redundancy, and an uncontained engine burst is a foreseeable event, not a freak one.
  4. Match containment and protection assumptions to the worst credible failure of nearby rotating parts, and protect critical control runs accordingly.
  5. Invest in crew resource management and improvisation training; when every engineered safeguard fails, disciplined teamwork in the cockpit is the only layer left.

References