- United DC-10 at Sioux City
- Accident Overview
- Accident Board Findings
- Accident Board Recommendations
- Relevant Regulations / Policy / Background
- Prevailing Cultural / Organizational Factors
- Key Safety Issue(s)
- Safety Assumptions
- Resulting Safety Initiatives
- Airworthiness Directives (ADs) Issued
- Common Themes
- Related Accidents / Incidents
- Lessons Learned
- United DC-10 at Sioux City
Illustration of DC-10 General Configuration
United Airlines (UAL) Flight 232, a McDonnell Douglas DC-10-10, was a scheduled passenger flight from Stapleton International Airport in Denver, Colorado to Philadelphia, Pennsylvania, with an en route stop in Chicago, Illinois. On July 19, 1989, at 14:09 CDT, Flight 232 departed Denver with 285 passengers and 11 crewmembers on board.
History of Flight
The takeoff and en route climb to a planned cruising altitude of 37,000 feet were uneventful. About 1 hour and 7 minutes after takeoff (at approximately 15:16 CDT) the flight crew heard a loud bang followed by vibration and shuddering of the airframe. The flight crew noted from the engine instruments that the No. 2 engine (tail-mounted) had failed, and they initiated the engine shutdown checklist. While performing the shutdown checklist, the flight crew noted that the aircraft's normal system hydraulic pressure and quantity gauges indicated zero.
The first officer was flying the aircraft at the time of engine failure and advised the captain that he could not control the aircraft, which began a right descending turn. The captain took control of the aircraft and confirmed that it did not respond to control inputs. He then reduced thrust on the No. 1 engine, which resulted in the aircraft rolling to a wings-level attitude. The flight crew deployed the air-driven generator that powers the No. 1 auxiliary hydraulic pump; however, this action did not restore hydraulic power to the aircraft.
At 15:20 CDT, the flight crew radioed Minneapolis Air Route Traffic Control Center (ARTCC) and requested emergency assistance and vectors to the nearest airport. The ARTCC gave the flight crew vectors for the Sioux Gateway Airport in Sioux City, Iowa.
The passengers were informed of the engine failure, and the flight attendants were told to prepare the aircraft for an emergency landing. An off-duty UAL DC-10 training check airman, who was seated in the passenger cabin, came forward to the flight deck to assist the flight crew at approximately 15:29 CDT.
Photo of UAL 232 in Flight - Areas of Damage Highlighted
The flight crew made visual contact with the airport at about 9 miles from touchdown. Air traffic control had instructed the aircraft to attempt a landing on runway 31, which was 8,999 feet long. However, the aircraft was on approach to runway 22, which was 6,600 feet long and closed. Given the aircraft's position and difficulty in making left turns, the captain elected to continue the approach to runway 22 rather than attempt to maneuver to runway 31.
During the approach, the flight crew observed a high sink rate alarm prior to touchdown. Smooth oscillations in pitch and roll continued until just before touchdown when the right wing dropped rapidly. The check airman used the first officer's airspeed indicator and visual cues to determine the flight path and need for power change. He continued to manipulate the No. 1 and No. 3 engine throttles until the aircraft made contact with the ground.
Photos of UAL 232 Initial Touchdown Area
At 16:00 CDT the aircraft touched down on the threshold to runway 22 slightly left of the centerline. The first ground contact was made by the right wing tip, followed by the right main landing gear. The aircraft skidded to the right of the runway and rolled to an inverted position. Witnesses observed the aircraft catch fire and cartwheel, coming to rest after crossing runway 17/35. Firefighting and rescue operations began immediately, however the aircraft was destroyed by impact and fire. A video of the crash and the crash scene is available at the following link: UAL 232 Crash Video.
Photos of Initial Touchdown, Fuselage Section, and Tail Section
There were 111 fatalities, 47 serious injuries and 125 minor injuries.
Illustration of CF-6 Engine Cutaway
View Larger Image
Illustration of CF-6 Fan Assembly
Showing Fan Disk
View Larger Image
Illustration of CF-6 Fan Disk Cross-section
View Larger Image
The engines installed on the aircraft were General Electric Aircraft Engines (GEAE) CF6-6D model turbofan engines. The fan disk failure was caused by a fatigue crack that initiated from a metallurgical defect located on the surface of the disk bore. The metallurgical defect formed during the initial manufacture of the titanium alloy material and was not detected by inspections performed during the manufacturing process (manufactured in December 1971 timeframe). The disk was installed in the CF6-6D engine, and the defect caused the initiation of a fatigue crack that eventually grew to a critical size and produced a catastrophic separation of the disk. Total service time and cycles accumulated on the fan disk at the time of the accident were 41,009 hours and 15,503 cycles.
Engine design and certification standards involve a combination of containment and reliability for the blade and rotor failures, respectively. The engine case is required to contain debris associated with the failure of any single blade from any of the compressor or turbine stages. Conversely, other rotating elements of the engine, such as fan disks and turbine rotors, are required to be sufficiently robust so as to never expect a failure in the life of that engine fleet. This concept, identified as "rotor integrity", is necessary since containment of disk debris is impractical due to the extremely high energies involved for most turbofan engine rotor failures.
Photos of Reconstructed #2 Fan Disk
In spite of the engine's blade containment and rotor integrity capabilities, service experience has shown that it is necessary to provide airplane protection for certain types of uncontained engine failures. This airplane level protection involves a combination of separation, shielding, or strategic location of vital systems throughout the airplane. High energy rotors (e.g., fan disks) can cause a hazard to the aircraft when they fail due to their ballistic nature and have historically represented one of the highest accident risks caused by turbine engine propulsion systems. Aircraft safety for this type of threat is provided by a combined effort of precluding rotor failures and by mitigating the effects in the event of a failure. Overall, safety is compromised if either of these two strategies is overlooked or not effective.
During the time the fan disk was in revenue service, the engine underwent overhauls that exposed the fan disk to piece part-level inspections six times. At each exposure, the disk was inspected in accordance with the CF6 engine manual instructions, which included a fluorescent penetrant inspection. The accident investigation determined that the fatigue crack was of sufficient size that the previous fluorescent penetrant inspections, if properly performed, should have detected it. The most recent fluorescent penetrant inspection on the fan disk occurred 760 cycles prior to the accident flight, at which time the surface crack is estimated to have been approximately 0.5" long.
The titanium alloy fan disk was manufactured in 1971 using a double vacuum arc remelt (VAR) process, which was the process used by the majority of engine manufacturers during this timeframe. At the time of its failure, it had been in service for 17 years. VAR is one type of process used in the manufacturing of titanium alloy fan disks. This method converts an electrode composed of the titanium source materials into an ingot form by melting the electrode. The electrode is melted in a water-cooled copper crucible under vacuum using electrical power to form an arc between the electrode and the molten pool. Consumption of the electrode occurs over a period of hours.
One method of improving the quality of titanium material is to go through successive operations such as double or triple VAR. The industry began to recognize, in the 1970's, that the rate of material defects in double VAR titanium used for high-energy rotating engine parts was significantly high and required corrective actions.
The FAA worked with industry to improve the titanium manufacturing processes that industry began to implement in the early 1980's. At that time, it was believed that it would be acceptable for rotors manufactured from the older (double VAR) processes to remain in service until part retirement, based on confidence that the manufacturing and piece part engine overhaul inspections were reliable and adequate for detecting defects/cracks prior to part failure.
Illustration of DC-10 Hydraulic System Schematic
View Larger Image
Illustration of DC-10 Hydraulic System Arrangement
in Horizontal Stabilizer
View Larger Image
The McDonnell Douglas DC-10 is a large, wide-body transport airplane, originally type certified in 1971. The flight control system is, for the time of design, conventional in that the flight controls are hydraulically powered and consist of ailerons and flight spoilers located on the wings, elevators on the horizontal stabilizer, and rudder on the vertical stabilizer.
Each axis in the flight control system is powered by at least two of the three airplane hydraulic systems. The airplane is equipped with three separate hydraulic systems, each independent of the other two, such that loss of any one system retains sufficient capability in each of the flight control axes, although in some cases, capability may be degraded. The airplane does not have a manual control capability (sometimes referred to as "manual reversion"), due to the high forces that would be necessary to move the control surfaces if they were unassisted by a hydraulic system.
There is limited space in the aft areas of the airplane for hydraulic system distribution, especially where the hydraulic lines are routed to the tail surfaces. The three hydraulic systems, while remaining functionally isolated, were located physically close to one another in certain areas. One result, which contributed to this accident, was that all three systems were vulnerable to damage from the engine debris, should the No. 2 engine experience a catastrophic failure.
Following failure of the center engine fan disk, debris struck and damaged the aircraft's three hydraulic systems. The loss of all three systems resulted in complete loss of control of the aircraft through normal flight control inputs. The only means available to maintain directional control of the aircraft was manipulation of the thrust from wing-mounted engines. The aircraft had a continuous tendency to turn right; and the flight crew could not maintain a stabilized flight condition.
Photo of Right Horizontal Stabilizer Showing Damage
Following the crash of an Eastern Airlines Lockheed L-1011, near Miami, in 1972, the industry conducted a review of ways to mitigate poor crew performance, especially in emergencies. Subsequently, as a result of this review, United Airlines became the first commercial carrier to adopt a formal Crew Resource Management (CRM) program. CRM, rather than allowing an autocratic environment on the flight deck, encourages crew teamwork and, when/if necessary, assertion of authority by crewmembers that are, in the flight deck hierarchy, subordinate to the captain. CRM, when well practiced, results in high levels of crew communication, delegation of duties in order to manage all required tasks efficiently, and an overall attitude of cooperation and teamwork.
The flight crew collectively was very experienced, the captain in particular having over 7000 hours in the DC-10. Additionally, an off-duty DC-10 check captain was onboard as a passenger, and was invited to the flight deck by the captain. The check airman assumed control of the throttles for the left and right engines, as throttle manipulation (use of asymmetric thrust) was the only means to attempt airplane control.
Following the accident, the NTSB conducted a number of simulator studies to assess the possibility of crew training to control the airplane in a UAL 232 situation. The studies revealed that the crew would not have benefited from such training, if it had existed, as the airplane was virtually impossible to control. The NTSB concluded that the airplane, while flyable, could not have been successfully landed on a runway with the loss of all hydraulic flight controls.
The NTSB stated, "The Safety Board believes that under the circumstances the UAL flight crew performance was highly commendable and greatly exceeded reasonable expectations."
Relative to CRM practices, and crew interaction during the emergency, the NTSB further commented on the flight crew's performance by stating, "The Safety Board views the interaction of the pilots, including the check airman, during the emergency as indicative of the value of cockpit resource management training, which has been in existence at UAL for a decade."
Following the accident, the captain made a presentation to an audience at a safety meeting hosted by the National Aeronautics and Space Administration (NASA), discussing the events of the flight and flight crew performance. The NASA transcript of that presentation is available at the following link: UAL 232 Captain presentation