United Airlines Flight 232


United Airlines Flight 232 was a regularly scheduled United Airlines flight from Denver to Chicago, continuing to Philadelphia. On July 19, 1989, the DC-10 serving the flight crash-landed at Sioux City, Iowa, after suffering a catastrophic failure of its tail-mounted engine, which led to the loss of many flight controls. At the time, the aircraft was en route from Stapleton International Airport to O'Hare International Airport. Of the 296 passengers and crew on board, 112 died during the accident, while 184 people survived. The crash was the fifth-deadliest one involving the DC-10, behind Turkish Airlines Flight 981, American Airlines Flight 191, Air New Zealand Flight 901, and UTA Flight 772. Despite the deaths, the accident is considered a prime example of successful crew resource management because of the large number of survivors and the manner in which the flight crew handled the emergency and landed the airplane without conventional control.

Aircraft

The airplane, a McDonnell Douglas DC-10-10, was delivered in 1971 and owned by United Airlines since then. Before departure on the flight from Denver on July 19, 1989, the airplane had been operated for a total of 43,401 hours and 16,997 cycles. The airplane was powered by CF6-6D high-bypass-ratio turbofan engines produced by General Electric Aircraft Engines. The aircraft's No. 2 engine had accumulated 42,436 hours and 16,899 cycles of operating time immediately prior to the accident flight.
The DC-10 used three independent hydraulic systems, each powered by one of the aircraft's three engines, to power movement of the aircraft's flight controls. In the event of loss of engine power or primary pump failure, an air-driven generator could be deployed that would provide electrical power for electrically powered auxiliary pumps. These systems were designed to be redundant, such that if two hydraulic systems were inoperable, the one remaining hydraulic system would still permit the full operation and control of the airplane. However, at least one hydraulic system must have fluid present and the ability to hold fluid pressure in order to control the aircraft. Like other widebody transport aircraft of the era, the DC-10 was not designed to revert to unassisted manual control in the event of total hydraulic failure. The DC-10's hydraulic system was designed and demonstrated to the Federal Aviation Administration as compliant with regulations that "no single failure or malfunction or probable combination of failures will jeopardize the safe operation of the airplane..."

Crew

Flight 232's captain, Alfred Clair Haynes, 57, was hired by United Airlines in 1956. He had 29,967 hours of total flight time with United Airlines, of which 7,190 were in the DC-10.
Haynes' co-pilot was first officer William Roy Records, 48, first hired by National Airlines in 1969. He subsequently worked for Pan American World Airways. He estimated that he had approximately 20,000 hours of total flight time. He was hired by United Airlines in 1985, and had accrued 665 hours as a DC-10 first officer while at United.
Flight 232's flight engineer, Dudley Joseph Dvorak, 51, was hired by United Airlines in 1986. He estimated that he had approximately 15,000 hours of total flying time. While working for United, he had accumulated 1,903 hours as a flight engineer in the Boeing 727 and 33 hours as a flight engineer in the DC-10.
Dennis Edward Fitch, 46, a training check airman aboard Flight 232 as a passenger, was hired by United Airlines in 1968. He estimated that, prior to working for United, he had accrued at least 1,400 hours of flight time with the Air National Guard, with a total flight time of approximately 23,000 hours. His total DC-10 time with United was 2,987 hours, including 1,943 hours accrued as a flight engineer, 965 hours as a first officer, and 79 hours as a captain. Fitch had learned of the 1985 crash of Japan Airlines Flight 123, caused by a catastrophic loss of hydraulic control, and had wondered if it was possible to control an aircraft using throttles only. He had practiced under similar conditions on a simulator.
Eight flight attendants were also aboard the flight.

Events

Takeoff and engine failure

Flight 232 took off at 14:09 Central Daylight Time from Stapleton International Airport, Denver, Colorado, bound for O'Hare International Airport in Chicago with continuing service to Philadelphia International Airport.
At 15:16, while the plane was in a shallow right turn at its cruising altitude of, the fan disk of its tail-mounted General Electric CF6-6 engine explosively disintegrated. The uncontained failure resulted in the engine's fan disk departing the aircraft, tearing out components including parts of the No. 2 hydraulic system and supply hoses in the process; these were later found near Alta, Iowa. Engine debris penetrated the aircraft's tail section in numerous places, including the horizontal stabilizer, severing the No. 1 and No. 3 hydraulic system lines where they passed through the horizontal stabilizer.
The pilots felt a jolt, and the autopilot disengaged. As Records took hold of his control column, Haynes focused on the tail engine, whose instruments indicated it was malfunctioning; he found its throttle and fuel supply controls jammed. At Dvorak's suggestion, a valve cutting fuel to the tail engine was shut off. This part of the emergency took 14 seconds.

Attempts to control plane

Meanwhile, Records found that the plane did not respond to his control column. Even with the control column turned all the way to the left, commanding maximum left aileron, and pulled all the way back, commanding maximum up elevatorinputs that would never be used together in normal flightthe aircraft was banking to the right with the nose dropping. Haynes attempted to level the aircraft with his own control column, then both Haynes and Records tried using their control columns together, but the aircraft still did not respond. Afraid the aircraft would roll into a completely inverted position, the crew reduced the left wing-mounted engine to idle and applied maximum power to the right engine. This caused the airplane to slowly level out.
While Haynes and Records performed the engine shutdown checklist for the failed engine, Dvorak observed that the gauges for fluid pressure and quantity in all three hydraulic systems were indicating zero. The loss of all hydraulic fluid meant that control surfaces were inoperative. The flight crew deployed the DC-10's air-driven generator in an attempt to restore hydraulic power by powering the auxiliary hydraulic pumps, but this was unsuccessful. The crew contacted United maintenance personnel via radio, but were told that, as a total loss of hydraulics on the DC-10 was considered "virtually impossible", there were no established procedures for such an event.
The plane was tending to pull right, and slowly oscillated vertically in a phugoid cyclecharacteristic of planes in which control surface command is lost. With each iteration of the cycle, the aircraft lost approximately of altitude. Fitch, an experienced United Airlines captain and DC-10 flight instructor, was among the passengers and volunteered to assist. The message was relayed by a flight attendant to the flight crew, who invited Fitch up to the cockpit; he arrived and began assisting at about 15:29.
Haynes asked Fitch to observe the ailerons through the passenger cabin windows to see if control inputs were having any effect. Fitch reported back that the ailerons were not moving at all. Nonetheless, the crew continued to manipulate their control columns for the remainder of the flight, hoping for at least some effect. Haynes then asked Fitch to take over control of the throttles so that Haynes could concentrate on his control column. With one throttle in each hand, Fitch was able to mitigate the phugoid cycle and make rough steering adjustments.
ATC was contacted and an emergency landing at nearby Sioux Gateway Airport was organized. Haynes kept his sense of humor during the emergency, as recorded on the plane's CVR:
and later:
A more serious remark often quoted from Haynes was made when ATC asked the crew to make a left turn to keep them clear of the city:
Haynes later noted that "We were too busy . You must maintain your composure in the airplane, or you will die. You learn that from your first day flying."

Crash landing

As the crew began to prepare for arrival at Sioux City, they questioned whether they should deploy the landing gear or belly-land the aircraft with the gear retracted. They decided that having the landing gear down would provide some shock absorption on impact. The complete hydraulic failure left the landing gear lowering mechanism inoperative. Two options were available to the flight crew. The DC-10 is designed so that if hydraulic pressure to the landing gear is lost, the gear will fall down slightly and rest on the landing gear doors. Placing the regular landing gear handle in the down position will unlock the doors mechanically, and the doors and landing gear will then fall down into place and lock due to gravity. An alternative system is also available using a lever in the cockpit floor to cause the landing gear to fall into position. This lever has the added benefit of unlocking the outboard ailerons, which are not used in high-speed flight and are locked in a neutral position. The crew hoped that there might be some trapped hydraulic fluid in the outboard ailerons and that they might regain some use of flight controls by unlocking them. They elected to extend the gear with the alternative system. Although the gear deployed successfully, there was no change in the controllability of the aircraft.
Landing was originally planned on the Runway 31. Difficulties in controlling the aircraft made lining up almost impossible. While dumping some of the excess fuel, the plane executed a series of mostly right-hand turns with the intention of lining up with Runway 31. When they came out they were instead lined up with the closed Runway 22, and had little capacity to maneuver. Fire trucks had been placed on Runway 22, anticipating a landing on nearby Runway 31, so all the vehicles were quickly moved out of the way before the plane touched down. Runway 22 had been permanently closed a year earlier.
ATC also advised that there was a four-lane Interstate that ran north and south just east of the airport which they could land on if they did not think they could make the runway. The pilot opted to try for the runway instead.
.
Fitch continued to control the aircraft's descent by adjusting engine thrust. With the loss of all hydraulics, the flaps could not be extended and since flaps control both the minimum required forward speed and sink rate, the crew were unable to control both airspeed and sink rate. On final approach, the aircraft's forward speed was and it had a sink rate of, while a safe landing would require and. Fitch needed a seat for landing; Dvorak offered up his own, as it could be moved to a position behind the throttles. Dvorak sat in the cockpit's jump seat for landing. Fitch noticed the high sink rate and that the plane started to yaw right again, and pushed the throttles to full power in an attempt to mitigate the high sink rate and level the plane. It was now 16:00. The CVR recorded the following final moments:
There was not enough time for the flight crew to react. The tip of the right wing hit the runway first, spilling fuel, which ignited immediately. The tail section broke off from the force of the impact, and the rest of the aircraft bounced several times, shedding the landing gear and engine nacelles and breaking the fuselage into several main pieces. On the final impact, the right wing was shorn off and the main part of the aircraft skidded sideways, rolled over onto its back, and slid to a stop upside-down in a corn field to the right of Runway 22. Witnesses reported that the aircraft "cartwheeled" end-over-end, but the investigation did not confirm this. The reports were due to misinterpretation of the video of the crash that showed the flaming right wing tumbling end-over-end and the intact left wing, still attached to the fuselage, rolling up and over as the fuselage flipped over.

Injuries and deaths

Of the 296 people on board, 112 died. Most were killed by injuries sustained in the multiple impacts, but 35 people in the middle fuselage section directly above the fuel tanks died from smoke inhalation in the post-crash fire. Of those, 24 had no traumatic blunt-force injuries. The majority of the 184 survivors were seated behind first class and ahead of the wings. Many passengers were able to walk out through the ruptures to the structure.
Of all of the passengers:
The passengers who died for reasons other than smoke inhalation were seated in rows 1–4, 24–25 and 28–38. Passengers who died because of smoke inhalation were seated in rows 14, 16 and 22–30. The person assigned to 20H moved to an unknown seat and died of smoke inhalation.
One crash survivor died 31 days after the accident; he was classified according to NTSB regulations as a survivor with serious injuries.
Fifty-two children, including four "lap children" without their own seats, were on board the flight because of the United Airlines "Children's Day" promotion. Eleven children, including one lap child, died. Many of the children were traveling alone.
It was not until 35 minutes after the crash that rescuers identified the debris that was the remains of the cockpit, with the four pilots alive inside. All four recovered from their injuries and eventually returned to flight duty.

Investigation

The rear engine's fan disk and blade assemblyapproximately acrosscould not be located at the accident scene despite an extensive search. The engine's manufacturer, General Electric, offered rewards of $50,000 for the disk and $1,000 for each fan blade. Three months after the crash, a farmer discovered most of the fan disk, with several blades still attached, in her cornfield - thereby qualifying her for a reward a General Electric lawyer confirmed. The rest of the fan disk and most of the additional blades were later found nearby.
The NTSB determined that the probable cause of this accident was the inadequate consideration given to human factors, and limitations in the inspection and quality control procedures used by United Airlines' engine overhaul facility. These resulted in the failure to detect a fatigue crack originating from a previously undetected metallurgical defect located in a critical area of the titanium-alloy stage-1 fan disk that was manufactured by General Electric Aircraft Engines. The uncontained manner in which the engine failed resulted in high-speed metal fragments being hurled from the engine; these fragments penetrated the hydraulic lines of all three independent hydraulic systems on board the aircraft, which rapidly lost their hydraulic fluid. The subsequent catastrophic disintegration of the disk resulted in the liberation of debris in a pattern of distribution and with energy levels that exceeded the level of protection provided by design features of the hydraulic systems that operate the DC-10's flight controls; the flight crew lost its ability to operate nearly all of them.
Despite these losses, the crew was able to attain and then maintain limited control by using the throttles to adjust thrust from the remaining wing-mounted engines. By using each engine independently, the crew made rough steering adjustments, and by using the engines together they were able to roughly adjust altitude. The crew guided the crippled jet to Sioux Gateway Airport and lined it up for landing on one of the runways. Without the use of flaps and slats, they were unable to slow down for landing, and were forced to attempt landing at a very high ground speed. The aircraft also landed at an extremely high rate of descent because of the inability to flare. As a result, upon touchdown the aircraft broke apart, rolled over and caught fire. The largest section came to rest in a cornfield next to the runway. Despite the ferocity of the accident, 184 passengers and crew survived owing to a variety of factors including the relatively controlled manner of the crash and the early notification of emergency services.

Failed component

The investigation, while praising the actions of the flight crew for saving lives, would later identify the cause of the accident as a failure by United Airlines maintenance processes and personnel to detect an existing fatigue crack. The Probable Cause in the report by the NTSB read as follows:
Post-crash analysis of the crack surfaces showed the presence of a penetrating fluorescent dye used to detect cracks during maintenance. The presence of the dye indicated that the crack was present and should have been detected at a prior inspection. The detection failure arose from poor attention to human factors in United Airlines' specification of maintenance processes.
Investigators discovered an impurity and fatigue crack in the disk. Titanium reacts with air when melted, which creates impurities which can initiate fatigue cracks like that found in the crash disk. To prevent this, the ingot that would become the fan disk was formed using a "double vacuum" process: the raw materials were melted together in a vacuum, allowed to cool and solidify, then melted in a vacuum once more. After the double vacuum process, the ingot was shaped into a billet, a sausage-like form about 16 inches in diameter, and tested using ultrasound to look for defects. Defects were located and the ingot was further processed to remove them, but some contamination remained. GE later added a third vacuum-forming stage because of their investigation into failing rotating titanium engine parts.
The contamination caused what is known as a hard alpha inclusion, where a contaminant particle in a metal alloy causes the metal around it to become brittle. The brittle titanium around the impurity then cracked during forging and fell out during final machining, leaving a cavity with microscopic cracks at the edges. For the next 18 years, the crack grew slightly each time the engine was powered up and brought to operating temperature. Eventually the crack broke open, causing the disk to fail.
The origins of the crash disk are uncertain because of significant irregularities and gaps, noted in the NTSB report, in the manufacturing records of GE Aircraft Engines and its suppliers. Records found after the accident indicated that two rough-machined forgings having the serial number of the crash disk had been routed through GEAE manufacturing. Records indicated that Alcoa supplied GE with TIMET titanium forgings for one disk with the serial number of the crash disk. Some records show that this disk “was rejected for an unsatisfactory ultrasonic indication”, that an outside lab performed an ultrasound inspection of this disk, that this disk was subsequently returned to GE, and that this disk should have been scrapped. The FAA report stated “There is no record of warranty claim by GEAE for defective material and no record of any credit for GEAE processed by Alcoa or TIMET”.

GE records of the second disk having the serial number of the crash disk indicate that it was made with an RMI titanium billet supplied by Alcoa. Research of GE records showed no other titanium parts were manufactured at GE from this RMI titanium billet during the period of 1969 to 1990. GE records indicate that final finishing and inspection of the crash disk were completed on December 11, 1971. Alcoa records indicate that this RMI titanium billet was first cut in 1972 and that all forgings made from this material were for airframe parts. If the Alcoa records were accurate, the RMI titanium could not have been used to manufacture the crash disk, indicating that the initially rejected TIMET disk with “an unsatisfactory ultrasonic indication” was the crash disk.

CF6 engines like that containing the crash disk were used to power many civilian and military aircraft at the time of the crash. Due to concerns that the accident could recur, a large number of disks that were in service were examined by ultrasound for indications of defects. The fan disks on at least two other engines were found to have defects like that of the crash disk. Prioritization and efficiency of inspections of the many engines under suspicion would have been aided by determination of the titanium source of the crash disk. Chemical analyses of the crash disk intended to determine its source were inconclusive. The NTSB report stated that if examined disks were not from the same source, “the records on a large number of GEAE disks are suspect. It also means that any AD action that is based on the serial number of a disk could fail to have its intended effect because suspect disks could remain in service.” The FAA report did not explicitly address the impact of these uncertainties on operations of military aircraft that might have contained a suspect disk.

Influence on the industry

The National Transportation Safety Board investigation, after reconstructions of the accident in flight simulators, deemed that training for such an event involved too many factors to be practical. While some level of control was possible, no precision could be achieved, and a landing under these conditions was stated to be "a highly random event". Expert pilots were unable to reproduce a survivable landing; according to a United pilot who flew with Fitch, "Most of the simulations never even made it close to the ground". The NTSB stated that "under the circumstances the UAL flight crew performance was highly commendable and greatly exceeded reasonable expectations."
Because this type of aircraft control is difficult for humans to achieve, some researchers have attempted to integrate this control ability into the computers of fly-by-wire aircraft. Early attempts to add the ability to real airplanes were not very successful; the software was based on experiments conducted in flight simulators where jet engines are usually modeled as "perfect" devices with exactly the same thrust on each engine, a linear relationship between throttle setting and thrust, and instantaneous response to input. Later, computer models were updated to account for these factors, and planes have been successfully flown with this software installed.

Titanium processing

The manufacturing process for titanium was changed in order to eliminate the type of gaseous anomaly that served as the starting point for the crack. Newer batches of titanium use much higher melting temperatures and a "triple vacuum" process in an attempt to eliminate such impurities.

Aircraft designs

Newer aircraft designs such as the McDonnell Douglas MD-11 have incorporated hydraulic fuses to isolate a punctured section and prevent a total loss of hydraulic fluid. Following the United 232 accident, such fuses were installed in the number 3 hydraulic system in the area below the number 2 engine on all DC-10 aircraft to ensure sufficient control capability remained if all three hydraulic system lines should be damaged in the tail area. Although elevator and rudder control would be lost, the aircrew would still be able to control the aircraft's pitch with stabilizer trim, and would be able to control roll with some of the aircraft's ailerons and spoilers. Although not an ideal situation, the system provides a greater measure of control than was available to the crew of United 232.
It is still possible to lose all three hydraulic systems if serious damage occurs elsewhere, as nearly happened to a cargo airliner in 2002 during takeoff when a main-gear tire exploded in the wheel well. The damage in the left wing area caused total loss of pressure from the #1 and the #2 hydraulic systems. The #3 system was dented but not penetrated.

Restraints for children

Of the four children deemed too young to require seats of their own, one died from smoke inhalation. The NTSB added a safety recommendation to the FAA on its "List of Most Wanted Safety Improvements" in May 1999 suggesting a requirement for children under two years old to be safely restrained, which was removed in November 2006. The accident sparked a campaign led by United Flight 232's senior flight attendant, Jan Brown Lohr, for all children to have seats on aircraft. Though it is no longer on the "most wanted" list, aircraft restraints for children under two is still recommended practice by the NTSB and FAA, though it is not required by the FAA as of May 2016. The NTSB asked the International Civil Aviation Organization to make this a requirement in September 2013.

Crew resource management

The accident has since become a prime example of successful crew resource management. For much of aviation's history, the captain was considered the final authority, and crews were to respect the captain's expertise without question. This began to change in the 1970s, especially after the 1978 United Airlines Flight 173 crash in Portland, Oregon, and the Tenerife airport disaster. Crew Resource Management, while still considering the captain as final authority, instructs crew members to speak up when they detect a problem, and instructs captains to listen to crew concerns. United Airlines instituted a Crew Resource Management class in the early 1980s. The NTSB would later credit this training as valuable toward the success of United 232's crew in handling their emergency. The FAA made Crew Resource Training mandatory in the aftermath of the accident.

Factors contributing to survival rate

Of the 296 people aboard, 112 were killed and 184 survived. Haynes later identified three factors relating to the time of day that increased the survival rate:
  1. The accident occurred during daylight hours in good weather;
  2. The accident occurred as a shift change was occurring at both a regional trauma center and a regional burn center in Sioux City, allowing for more medical personnel to treat the injured;
  3. The accident occurred when the Iowa Air National Guard was on duty at Sioux Gateway Airport, allowing for 285 trained personnel to assist with triage and evacuation of the injured.
"Had any of those things not been there," Haynes said, "I'm sure the fatality rate would have been a lot higher."
Haynes also credited Crew Resource Management as being one of the factors that saved his own life, and many others.
When Haynes died in August 2019, United Airlines issued a statement thanking him for "his exceptional efforts aboard Flight UA232".
As with the Eastern Air Lines Flight 401 crash of a similarly-sized Lockheed L-1011 in 1972, the relatively shallow angle of descent likely played a large part in the relatively high survival rate. The National Transportation Safety Board concluded that under the circumstances, "a safe landing was virtually impossible."

Notable victims

The Flight 232 Memorial was built along the Missouri river in Sioux City, Iowa to commemorate the heroism of the flight crew and the rescue efforts the Sioux City community undertook after the crash. It is a statue of Iowa National Guard Lt. Col. Dennis Nielson from a news photo that was taken that day while he was carrying a three year old to safety.

Similar accidents

The odds against all three hydraulic systems failing simultaneously had previously been calculated as low as a billion to one. Yet such calculations assume that multiple failures must have independent causes, an unrealistic assumption, and similar flight control failures have indeed occurred:
The disintegration of a turbine disc, leading to loss of control, was a direct cause of two major aircraft disasters in Poland:
In contrast to deploying landing gear: