The performance of the crew of United Airlines Flight 232 has become a textbook example of how Crew Resource Management should work and rightfully so. United had thrown itself "all in" with CRM programs for a decade prior to this mishap and it shows.
The NTSB accident report gets the cause wrong, however, by singling out United maintenance practices for failing to detect the impending engine failure. Yes, those maintenance practices led to the engine failure, but that engine failure should not have led to the loss of all three hydraulic systems. The initiating cause of this mishap is the FAA's aircraft certification philosophy. The report notes this on page 91, but does not list it as causal:
14 CFR 25.901 paragraph (c) states: "for each powerplant and auxiliary power unit installation, it must be established that no single failure or malfunction or probable combination of failures will jeopardize the safe operation of the airplane, except that the failure of structural elements need not be considered, if the probability of each failure is extremely remote".
I was flying the Boeing 747 at the time and our fleet had a similar mishap when a failed bulkhead took out all four of that airplane's hydraulic systems. We were all required to train for the no-flight control landing and came to the conclusion it could be done, but getting the airplane onto a runway was next to impossible. We concluded the best course of action was to attempt to put the airplane down on a large flat surface and hope for the best. Of course we had an advantage the DC-10 did not. With four engines mounted on swept wings, we could control pitch using inboard versus outboard engines, as well as roll using left versus right. More about this: Japan Airlines 123.
The fix on the 747 was to install fuse plugs on the hydraulic systems so that they would not bleed themselves dry in the event of a line break. The NTSB report for this mishap mentions that as an interim fix for the DC-10.
Everything here is from the references shown below, with a few comments in an alternate color.
Figure: DC-10-10 N1819U, from Aviation=safety.net.
[NTSB AAR-90/06, ¶1.1.]
[NTSB AAR-90/06, ¶2.2]
[NTSB AAR-90/06, ¶2.3]
Our conclusion in the 747 community was similar. Though we had more control because of the four engines mounted on swept wings, the difficulty of getting the airplane onto a runway cannot be overstated. We believed that the best solution was to put the airplane in a controlled descent over the flatest available surface.
[NTSB AAR-90/06, ¶3.2] The National Transportation Safety Board determines that the probable cause of this accident was the inadequate consideration given to human factors limitations in the inspection and quality control procedures used by United Airlines' engine overhaul facility which resulted in the failure to detect a fatigue crack originating from a previously undetected metallurgical defect located in a critical area of the stage 1 fan disk that was manufactured by General Electric Aircraft Engines. The subsequent catastrophic disintegration of the disk resulted in the liberation of debris in a pattern of distribution and with energy levels that exceeded the level of protection provided by design features of the hydraulic systems that operate the DC-l0's flight controls.
NTSB Aircraft Accident Report, AAR-90/06, United Airlines Flight 232, McDonnell Douglas DC-10-10, Sioux Gateway Airport, Sioux City, Iowa, July 19, 1989
Copyright 2019. Code 7700 LLC. All Rights Reserved.