United Airlines 232

The performance of the crew of United Airlines Flight 232 has become a textbook example of how Crew Resource Management should work and rightfully so. United had thrown itself "all in" with CRM programs for a decade prior to this mishap and it shows.

The NTSB accident report gets the cause wrong, however, by singling out United maintenance practices for failing to detect the impending engine failure. Yes, those maintenance practices led to the engine failure, but that engine failure should not have led to the loss of all three hydraulic systems. The initiating cause of this mishap is the FAA's aircraft certification philosophy. The report notes this on page 91, but does not list it as causal:

14 CFR 25.901 paragraph (c) states: "for each powerplant and auxiliary power unit installation, it must be established that no single failure or malfunction or probable combination of failures will jeopardize the safe operation of the airplane, except that the failure of structural elements need not be considered, if the probability of each failure is extremely remote".

I was flying the Boeing 747 at the time and our fleet had a similar mishap when a failed bulkhead took out all four of that airplane's hydraulic systems. We were all required to train for the no-flight control landing and came to the conclusion it could be done, but getting the airplane onto a runway was next to impossible. We concluded the best course of action was to attempt to put the airplane down on a large flat surface and hope for the best. Of course we had an advantage the DC-10 did not. With four engines mounted on swept wings, we could control pitch using inboard versus outboard engines, as well as roll using left versus right. More about this: Japan Airlines 123.

The fix on the 747 was to install fuse plugs on the hydraulic systems so that they would not bleed themselves dry in the event of a line break. The NTSB report for this mishap mentions that as an interim fix for the DC-10.

Everything here is from the references shown below, with a few comments in an alternate color.

Figure: DC-10-10 N1819U, from Aviation=safety.net.

• Date: 19 July 1989
• Time: 15:16
• Type: McDonnell Douglass DC-10-10
• Operator: United Airlines
• Registration: N1819U
• Fatalities: 1 of 11 crew, 110 of 285 passengers
• Aircraft Fate: Destroyed
• Phase: Approach
• Airports: (Departure) Stapleton International Airport, CO (DEN, KDEN), United States of America; (Destination) Chicago-O'Hare International Airport, IL (ORD/KORD), United States of America

[NTSB AAR-90/06, ¶1.1.]

• About 1 hour and 7 minutes after takeoff, at 1516:10, the flightcrew heard a loud bang or an explosion, followed by vibration and a shuddering of the airframe. After checking the engine instruments, the flightcrew determined that the No. 2 aft (tail-mounted) engine had failed. The captain called for the engine shutdown checklist. While performing the engine shutdown checklist, the second officer (flight engineer) observed that the airplane's normal systems hydraulic pressure and quantity gauges indicated zero.
• The first officer advised that he could not control the airplane as it entered a right descending turn. The captain took control of the airplane and confirmed that it did not respond to flight control inputs. The captain reduced thrust on the No. 1 engine, and the airplane began to roll to a wings-level attitude.
• The flightcrew deployed the air driven generator (ADG), which powers the No. 1 auxiliary hydraulic pump, and the hydraulic pump was selected "on." This action did not restore hydraulic power.
• At 1520, the flightcrew radioed the Minneapolis Air Route Traffic Control Center ( ARTCC) and requested emergency assistance and vectors to the nearest airport.
• A flight attendant advised the captain that a UAL DC-10 training check airman, who was off duty and seated in a first class passenger seat, had volunteered his assistance. The captain immediately invited the airman to the cockpit, and he arrived about 1529.
• At the request of the captain, the check airman entered the passenger cabin and performed a visual inspection of the airplane's wings. Upon his return, he reported that the inboard ailerons were slightly up, not damaged, and that the spoilers were locked down. There was no movement of the primary flight control surfaces. The captain then directed the check airman to take control of the throttles to free the captain and first officer to manipulate the flight controls.
• The check airman attempted to use engine power to control pitch and roll. He said that the airplane had a continuous tendency to turn right, making it difficult to maintain a stable pitch attitude. He also advised that the No. 1 and No. 3 engine thrust levers could not be used symmetrically, so he used two hands to manipulate the two throttles.
• About 1542, the second officer was sent to the passenger cabin to inspect the empennage visually. Upon his return, he reported that he observed damage to the right and left horizontal stabilizers.
• Fuel was jettisoned to the level of the automatic system cutoff, leaving 33,500 pounds. About 11 minutes before landing, the landing gear was extended by means of the alternate gear extension procedure.
• The flight crew said that they made visual contact with the airport about 9 miles out. ATC had intended for flight 232 to attempt to land on runway 31, which was 8,999 feet long. However, ATC advised that the airplane was on approach to runway 22, which was closed, and that the length of this runway was 6,600 feet. Given the airplane's position and the difficulty in making left turns, the captain elected to continue the approach to runway 22 rather than to attempt maneuvering to runway 31. The check airman said that he believed the airplane was lined up and on a normal glidepath to the field. The flaps and slats remained retracted.
• During the final approach, the captain recalled getting a high sink rate alarm from the ground proximity warning system (GPWS). In the last 20 seconds before touchdown, the airspeed averaged 215 KIAS, and the sink rate was 1,620 feet per minute. Smooth oscillations in pitch and roll continued until just before touchdown when the right wing dropped rapidly. The captain stated that about 100 feet above the ground the nose of the airplane began to pitch downward. He also felt the right wing drop down about the same time. Both the captain and the first officer called for reduced power on short final approach.
• The check airman said that based on experience with no flap/no slat approaches he knew that power would have to be used to control the airplane's descent. He used the first officer's airspeed indicator and visual cues to determine the flight path and the need for power changes. He thought that the airplane was fairly well aligned with the runway during the latter stages of the approach and that they would reach the runway. Soon thereafter, he observed that the airplane was positioned to the left of the desired landing area and descending at a high rate. He also observed that the right wing began to drop. He continued to manipulate the No. 1 and No. 3 engine throttles until the airplane contacted the ground. He said that no steady application of power was used on the approach and that the power was constantly changing. He believed that he added power just before contacting the ground.
• The airplane touched down on the threshold slightly to the left of the centerline on runway 22 at 1600. First ground contact was made by the right wing tip followed by the right main landing gear. The airplane skidded to the right of the runway and rolled to an inverted position. Witnesses observed the airplane ignite and cartwheel, coming to rest after crossing runway 17/35. Fire fighting and rescue operations began immediately, but the airplane was destroyed by impact and fire.

[NTSB AAR-90/06, ¶2.2]

1. Titanium alloy was found on the fracture surfaces of severed lines of hydraulic systems No. 1 and No. 3 located in the right horizontal stabilizer. Several of the major components of the engine, including the stage 1 fan blades and fan disk, were made from titanium alloy and no other components of the surrounding airframe were made from such material. These factors led the Safety Board to conclude that the systems' No. 1 and No. 3 hydraulic lines were severed by fragments released during the failure sequence of the No. 2 engine.
2. The engine-driven No. 2 hydraulic pumps were attached to and received power from the No. 2 engine accessory section. This unit was mounted to the engine directly below the fan section of the engine. Portions of the No. 2 engine accessory section and associated No. 2 hydraulic system components, including hydraulic supply hoses, were found in the Alta, Iowa, area. Therefore, portions of the No. 2 hydraulic system and supply hoses mounted on, or adjacent to, the No. 2 engine accessory section were damaged and separated by the forces and disruption of the engine fan section during the engine failure.
3. The separation, fragmentation, and forceful discharge of uncontained stage 1 fan rotor assembly parts from the No. 2 engine led to the loss of the three hydraulic systems that powered the airplane's flight controls.

[NTSB AAR-90/06, ¶2.3]

1. Because of the loss of the three hydraulic systems, the flight crew was confronted with a unique situation that left them with very limited control of the airplane. The only means available to fly the airplane was through manipulation of thrust available from the No. 1 and No. 3 engines. The primary task confronting the flight crew was controlling the airplane on its flight path during the long period (about 60 seconds) of the "phugoid" or pitch oscillation. This task was extremely difficult to accomplish because of the additional need to use the No. 1 and No. 3 power levers asymmetrically to maintain lateral (roll) control coupled with the need to use increases and decreases in thrust to maintain pitch control. The flight crew found that despite their best efforts, the airplane would not maintain a stabilized flight condition.
2. Douglas Aircraft Company, the FAA, and UAL considered the total loss of hydraulic-powered flight controls so remote as to negate any requirement for an appropriate procedure to counter such a situation. The most comparable maneuver that the flight crew was required to accomplish satisfactorily in a DC-10 simulator was the procedure for managing the failure of two of the three hydraulic systems; however, during this training, the remaining system was available for movement of the flight controls.
3. The Safety Board views the interaction of the pilots, including the check airman, during the emergency as indicative of the value of cockpit resource management training, which has been in existence at UAL for a decade.
4. After carefully observing the performance of a control group of DC-l0-qualified pilots in the simulator, it became apparent that training for an attempted landing, comparable to that experienced by UA 232, would not help the crew in successfully handling this problem. Therefore, the Safety Board concludes that the damaged DC-10 airplane, although flyable, could not have been successfully landed on a runway with the loss of all hydraulic flight controls. The Safety Board believes that under the circumstances the UAL flight crew performance was highly commendable and greatly exceeded reasonable expectations.

Our conclusion in the 747 community was similar. Though we had more control because of the four engines mounted on swept wings, the difficulty of getting the airplane onto a runway cannot be overstated. We believed that the best solution was to put the airplane in a controlled descent over the flatest available surface.

[NTSB AAR-90/06, ¶3.2] The National Transportation Safety Board determines that the probable cause of this accident was the inadequate consideration given to human factors limitations in the inspection and quality control procedures used by United Airlines' engine overhaul facility which resulted in the failure to detect a fatigue crack originating from a previously undetected metallurgical defect located in a critical area of the stage 1 fan disk that was manufactured by General Electric Aircraft Engines. The subsequent catastrophic disintegration of the disk resulted in the liberation of debris in a pattern of distribution and with energy levels that exceeded the level of protection provided by design features of the hydraulic systems that operate the DC-l0's flight controls.

Crew Resource Management

NTSB Aircraft Accident Report, AAR-90/06, United Airlines Flight 232, McDonnell Douglas DC-10-10, Sioux Gateway Airport, Sioux City, Iowa, July 19, 1989