Description

On 19 July 1989, a Douglas DC-10-10 (N1819U) being operated by United Airlines on a scheduled domestic passenger flight from Denver to Chicago O’Hare was in the cruise at FL370 in day VMC when about an hour after takeoff, a loud explosion was heard and it was apparent that the number 2 (tail-mounted) engine had failed. It was soon clear that there had been a complete failure of hydraulic power, which resulted in the inability to operate any of the primary flight control surfaces. An emergency was declared and radar vectors to Sioux City offered by ATC and accepted. With the assistance of an off duty DC-10 Training Captain who managed to control the flight path by manipulating the thrust on engines 1 and 3, the aircraft was able to approach a runway at Sioux City on which an emergency landing was attempted. Soon after the right main gear and wingtip contacted the only practicable (but officially closed) runway, the aircraft rolled inverted and was progressively destroyed by the impact and fire. 111 of the 296 occupants were killed, 47 sustained serious injuries, 125 sustained minor injuries and 13 were uninjured.

Investigation

An Investigation into the accident was carried out by the NTSB. Both flight recorders were recovered from the wreckage. The CVR data covered the final 33½ minutes of the flight beginning about 10 minutes after the number 2 engine failed. The FDR was undamaged with no evidence of excessive damage and it was found to contain a full 25 hours of recorded data. However, although the quality of the data recording was generally good, there were some anomalies in the data. Available parameters included altitude, indicated airspeed, heading, pitch attitude, roll attitude, stabiliser position, fan rotor speed (N1) for each engine, position of control surfaces and longitudinal, lateral and vertical acceleration.

Photographs taken as the aircraft was approaching Sioux City showed that the fan cowling and the fuselage tail cone of the failed number 2 engine were missing but that the rest of the engine appeared to be intact. An initial examination of the wreckage found that the fan rotor components of the failed engine forward of the fan shaft and part of the shaft itself had separated from the engine in flight. The progressive breakup of the aircraft after its first runway contact began immediately as the right wing broke and the final disposition of the various separated parts of the aircraft ended up as shown in the illustration below. Debris which was ejected from the engine at the time of the failure and fell to the ground but did not cause any personal injury or significant damage, and damage to airport facilities at Sioux City was negligible.

Flight Crew Experience

The 57 year-old Captain had a total of 29,967 flying hours which included 7,190 hours on type with all his experience being gained whilst employed by United Airlines which he joined in 1956. After experience as a First Officer on the Boeing 727, he qualified as a DC10 First Officer and then returned to the 727 as a Captain in 1985 before transferring back to the DC10 as a Captain in 1987. The 48 year-old First Officer had a total of approximately 20,000 flying hours which included 665 hours on type. He had been employed by United Airlines since 1985, having previously been employed by National Airlines and then Pan American World Airways. The 51 year-old Second Officer had a total of approximately 15,000 flying hours which included 33 hours on type. He had been employed by United Airlines since 1986 and prior to a recent move to the DC10 had been a Second Officer on the Boeing 727. The 46 year-old off-duty Training Captain who assisted the duty flight crew in tackling the emergency and in particular manipulated the thrust levers of the two remaining engines to successfully achieve rudimentary flight path control had joined United Airlines in 1968 after service in the Air National Guard where he had accumulated between 1,400 and 1,500 total flying hours. His total experience on the DC10 since qualifying on type in 1978 was 2,987 hours comprised of 1,943 hours as a Second Officer, 965 hours as a First Officer and 79 hours as a Captain since upgrade less than 3 months prior to the accident.

What Happened

It was established that at the time of engine failure, the First Officer had been acting as PF and had immediately announced that he could no longer control the aircraft, which began a right descending turn. The Captain took control and confirmed the lack of control but by reducing the thrust set on the number 1 engine, he was able to roll the aircraft to a wings-level attitude. Starting the Air Driven Generator (ADG), which is designed to power the number one auxiliary hydraulic pump, did not restore any hydraulic power to the aircraft and it was subsequently confirmed that debris from the failed engine had struck and comprehensively disabled all three hydraulic systems - the only means of moving the primary flight control surfaces. The off-duty Training Captain who had joined the flight crew to assist in responding to the emergency took over the manipulation of the number 1 and 3 engine thrust levers and with visual reference and sight of the First Officer's ASI, he was able to achieve course control of the aircraft flight path. He continued to do this until the aircraft made contact with the runway during the eventual emergency landing - the accomplished ground track is shown below.

The Investigation was able to establish that catastrophic failure of the fan disc of the General Electric CF6-6D engine had been caused by a fatigue crack that had originated in a metallurgical defect on the surface of the disk bore. It was concluded that this defect had its origin in the manufacture of the titanium alloy material from which the failed disc was formed. This flaw in the material was not detected by inspections performed during the manufacturing process or after installation of the disc in the engine and it caused the initiation of the fatigue crack which eventually caused the explosive failure. At the time of the failure, the disc had accumulated 41,009 flight hours and 15,503 flight cycles. It was noted that during successive routine off-wing engine overhauls in accordance with the prevailing maintenance procedures, routine inspection using fluorescent penetrant dye had failed to detect the crack. It was also determined that during the most recent of these overhauls, after which the engine had been installed on the accident aircraft for 760 flight cycles, the crack would have been of a size such that a properly performed inspection should have detected it.

Whilst the failure of a single engine should not have created a loss of flight path control, it was evident that the aircraft type certification process had not taken sufficient account of the need for containment of engine failure debris if the assumption that the integrity of the fan rotor would, by design and through routine engine overhaul requirements, never fail was unduly optimistic. The Investigation considered the way the flight crew and the assisting pilot had been able to achieve sufficient flight path control to be able to eventually reach and attempt to land on a paved runway surface at an airport with full RFFS capability and concluded that the aircraft, whilst flyable, “could not have been successfully landed on a runway with the loss of all hydraulic flight controls”. It was also concluded that the crew performance in the circumstances had been “highly commendable and greatly exceeded reasonable expectations” and that the exemplary interaction of the pilots during the emergency had been “indicative of the value of Cockpit Resource Management” which was an established part of the pilot training regime at United Airlines.

Safety Issues relating to occupant crash survival

The Investigation examined all aspects of the post crash scenario in particular matters of cabin safety (including infant passenger restraint) and the response of the emergency services.

A total of 21 Investigation Findings were formally documented as follows:

1. The flight crew was certificated and qualified for the flight and the airplane was dispatched in accordance with company procedures and Federal regulations.
2. Weather was not a factor in this accident.
3. Air Traffic Control services were supportive of the flight crew and were not a factor in the accident.
4. The aircraft experienced an uncontained failure of the No. 2 engine stage 1 fan rotor disc assembly.
5. The No. 2 engine fragments severed the No. 1 and No. 3 hydraulic system lines, and the forces of the engine failure fractured the No. 2 hydraulic system, rendering the airplane's three hydraulic-powered flight control systems inoperative.
6. The airplane was marginally flyable using asymmetrical thrust from engines No. 1 and 3 after the loss of all conventional flight control systems; however, a safe landing was virtually impossible.
7. The airport emergency response was timely and initially effective; however, cornstalks on the airfield and the failure of the Kovatch P-18 water supply vehicle adversely affected fire fighting operations.
8. The FAA has not adequately addressed the issue of infant occupant protection. The FAA has permitted small children and infants to be held or restrained by use of seatbelts during turbulence, landing, and takeoff, posing a danger to themselves and others.
9. Separation of the titanium alloy stage 1 fan rotor disc was the result of a fatigue crack that initiated from a type 1 hard alpha metallurgical defect on the surface of the disc bore.
10. The hard alpha metallurgical defect was formed in the titanium alloy material during manufacture of the ingot from which the disc was forged.
11. The hard alpha metallurgical defect was not detected by ultrasonic and macroetch inspections performed by General Electric Aircraft Engines during the manufacturing process of the disc.
12. The metallurgical flaw that formed during initial manufacture of the titanium alloy would have been apparent if the part had been macroetch inspected in its final part shape.
13. The cavity associated with the hard alpha metallurgical defect was created during the final machining and/or shot peening at the time of General Electric Aircraft Engines’ manufacture of the disc after General Electric Aircraft Engines’ ultrasonic and macroetch manufacturing inspections.
14. The hard alpha defect area cracked with the application of stress during the disc's initial exposures to full thrust engine power conditions and the crack grew until it entered material unaffected by the hard alpha defect.
15. General Electric Aircraft Engines’ material and production records relevant to CF6-6 stage 1 fan disk S/N MPO 00385, which was the failed disc, were incomplete.
16. Regarding the existence at General Electric Aircraft Engines of two S/N MPO 00385 disks, an outside laboratory had possession of the disc, which was rejected for an ultrasonic indication at the time that the disc that eventually separated was receiving its final processing on the production line. Therefore, the two S/N MPO 00385 disks were not switched at the manufacturing facility.
17. General Electric Aircraft Engines’ disc manufacturing records and associated vendor-supplied documents, together with the system for maintaining and auditing them, did not assure accurate traceability of turbine engine rotating components.
18. United Airlines fan disc maintenance records indicated that maintenance, inspection, and repair of the CF6-6 fan disc was in accordance with the Federal Aviation Administration approved United Airlines' maintenance program and the General Electric Aircraft Engines' shop manual.
19. A detectable fatigue crack about 0.5 inch long at the surface of the stage 1 fan disk bore of the No. 2 engine existed at the time of the most recent United Airlines inspection in April 1988 but was not detected before the accident.
20. The discoloration noted on the surface of the fatigue crack was created during the FPI (fluorescent penetrant inspection) process performed by UAL 760 cycles prior to the accident, and the discoloured area marks the size of the crack at the time of this inspection.
21. The inspection parameters established in the United Airlines maintenance program, the United Airlines Engineering Inspection Document, and the General Electric Aircraft Engines shop manual inspection procedures, if properly followed at the maintenance facility, are adequate to identify unserviceable rotating parts prior to an in-service failure.

The Probable Cause of the accident was determined as follows:

“The inadequate consideration given to human factors limitations in the inspection and quality control procedures used by United Airlines' engine overhaul facility which resulted in the failure to detect a fatigue crack originating from a previously undetected metallurgical defect located in a critical area of the stage 1 fan disc that was manufactured by General Electric Aircraft Engines. The subsequent catastrophic disintegration of the disc resulted in the liberation of debris in a pattern of distribution and with energy levels that exceeded the level of protection provided by design features of the hydraulic systems that operate the DC-l0's flight controls.”

A total of 28 Safety Recommendations were made as a result of the Investigation as follows:

On 17 August 1989:

• that the FAA conduct a directed safety investigation (DSI) of the General Electric CF6-6 turbine engine to establish a cyclic threshold at which the fan shaft and the fan disks should be separated and inspected for defects in the components. The DSI should include a review and analysis of:
  • the certification, testing and stress analysis data that were used to establish the life limits of the fan disks and fan shaft components and the recommended inspection frequencies for these components;
  • the manufacturing processes associated with the production of the fan assembly and fan forward shaft;
  • metallurgical analysis of the front flange of the fan forward shaft in which cracks were recently discovered;
  • the maintenance practices involved in the assembly and disassembly of the fan disks and the fan forward shaft for the potential to damage the components during these processes;
  • non-destructive inspection of spare fan disks and fan forward shafts beginning with those components with the highest number of cycles in service; and
  • non-destructive inspections of fan disks on installed engines that may be performed by an approved inspection procedure. [A-89-95]
• that the FAA, following completion of the directed safety investigation of the General Electric CF6-6 turbine engine discussed in A-89-95, issue an airworthiness directive to require appropriate inspections of the fan disks and the fan forward shaft at appropriate cyclic intervals. [A-89-96]
• that the FAA evaluate, because of similarities in design, manufacture, and maintenance, the need for a directed safety investigation of all General Electric CF6-series turbine engines with the objectives of verifying the established life limits for rotating parts of the fan modules and establishing appropriate cyclic inspection requirements for these parts. [A-89-97]

NB: These recommendations were classified as "Closed-Superseded" by other recommendations issued on 18 June 1990.

On 30 May 1990:

• that the FAA revise 14 CFR 91, 121 and 135 to require that all occupants be restrained during takeoff, landing, and turbulent conditions, and that all infants and small children below the weight of 40 pounds and under the height of 40 inches to be restrained in an approved child restraint system appropriate to their height and weight. [A-90-78]
• that the FAA conduct research to determine the adequacy of aircraft seatbelts to restrain children too large to use child safety seats and to develop some suitable means of providing adequate restraint for such children. [A-90-79]

On 18 June 1990:

• that the FAA develop, with the assistance of General Electric Aircraft Engines, an alternate method of inspecting the bore area of the CF6-6 engine fan Stage I rotor disks for the presence of surface cracks; issue an Airworthiness Directive to require that these disks be inspected with this method on an expedited basis, that disks found to have cracks be removed from service, and that the inspection be repeated at a cyclic interval based upon the crack size detectable by the inspection method, the stress level in the applicable area of the disk, and the crack propagation characteristics of the disk material. [A-90-88]
• that the FAA evaluate currently certificated turbine engines to identify those engine components that, if they fracture and separate, could pose a significant threat to the structure or systems of the airplanes on which the engines are installed; and perform a damage tolerance evaluation of these engine components. Based on this evaluation, issue an Airworthiness Directive to require inspections of the critical components at intervals based upon the crack size detectable by the approved inspection method used, the stress level at various locations in the component, and the crack propagation characteristic of the component material. [A-90-89]
• that the FAA amend 14 CFR part 33 to require that turbine engines certificated under this rule are evaluated to identify those engine components that, if they should fracture and separate, could pose a significant threat to the structure or systems of an airplane; and require that a damage tolerance evaluation of these components be performed. Based on this evaluation, require that the maintenance programs for these engines include inspection of the critical components at intervals based upon the crack size detectable by the inspection method used, the stress level at various locations in the component, and the crack propagation characteristics of the component material. [A-90-90]
• that the FAA require turbine engine manufacturers to perform a surface macroetch inspection of the final part shape of critical titanium alloy rotating components during the manufacturing process. [A-90-91]

On 19 October 1990:

• that the FAA direct Airport Certification Inspectors to require 14 CFR 139 certificate holders to inspect the suction hoses on Kovatch A/S32P-18 water supply vehicles to verify that they incorporate the modifications described in Kovatch Technical Service Bulletin 86-KFTS-P-18-5 and to immediately remove from service A/S32P-18 vehicles that have not been so modified. [A-90-151]
• that the FAA amend 14 CFR 139 to require airport operators to perform maximum capacity discharge tests of all emergency response fire fighting and water supply vehicles before the vehicles are accepted for service and on a regularly scheduled basis thereafter. [A-90-152]
• that the FAA make available to all 14 CFR 139 certificated airports an account of the circumstances of the accident described in Safety Recommendation letter A-90-147-155 as they relate to the deficiencies identified with the Kovatch A/S32P-18 water supply vehicle. [A-90-153]
• that the FAA develop guidance for airport operators for acceptable responses by aircraft rescue and fire fighting equipment to accidents in crop environments on airport property. [A-90-154]
• that the FAA require annual airport certification inspections to include examinations of airfield terrain to ensure, where practicable, that surface obstructions, including agricultural crops, do not interfere with rescue and fire fighting activities. [A-90-155]
• that the US Department of the Air Force require that Kovatch A/S32P-18 vehicles comply with Kovatch Technical Service Bulletin 86-KFTS-P-18-5 and expedite the distribution of modification kits that will permit compliance with the service bulletin. [A-90-147]
• that the US Department of the Air Force immediately remove from service all Kovatch A/S32P-18 vehicles until they have been so modified. [A-90-148]
• that the US Department of the Air Force require maximum capacity discharge tests of all emergency response fire service vehicles before the vehicles are accepted for service and on an established regular schedule thereafter. [A-90-149]
• that the US Department of the Air Force make available to all operators of Department of the Air Force air bases an account for the circumstances of the accident described in Safety Recommendation letter A-90-147-150 as they relate to the deficiencies in the Kovatch A/S32P-18 water supply vehicle. [A-90-150]

On issue of the Final Report:

• that the FAA intensify research in the non-destructive inspection field to identify emerging technologies that can serve to simplify, automate, or otherwise improve the reliability of the inspection process. Such research should encourage the development and implementation of redundant ("second set of eyes") inspection oversight for critical part inspections, such as for engine rotating components. [A-90-167]
• that the FAA encourage research and development of backup flight control systems for newly certificated wide-body airplanes that utilise an alternative source of motive power separate from that source used for the conventional control system. [A-90-168]
• that the FAA conduct system safety reviews of currently certificated aircraft as a result of the lessons learned from the July 19, 1989, Sioux City, Iowa, DC-10 accident to give all possible consideration to the redundancy of, and protection for, power sources for flight and engine controls. [A-90-169]
• that the FAA analyse the dispersion pattern, fragment size and energy level of released engine rotating parts from the July 19, 1989, Sioux City, Iowa, DC-10 accident and include the results of this analysis, and any other peripheral data available, in a revision of AC 20-128 for future aircraft certification. [A-90-170]
• that the FAA conduct a comprehensive evaluation of aircraft and engine manufacturers' recordkeeping and internal audit procedures to evaluate the need to keep long-term records and to ensure that quality assurance verification and traceability of critical airplane parts can be accomplished when necessary at all manufacturing facilities. [A-90-171]
• that the FAA create the mechanism to support a historical data base of worldwide engine rotary part failures to facilitate design assessments and comparative safety analysis during certification reviews and other FAA research. [A-90-172]
• that the FAA issue an Air Carrier Operations Bulletin for all air carrier flight crew training departments to review this accident scenario and reiterate the importance of time management in the preparation of the cabin for an impending emergency landing. [A-90-173]
• that the FAA issue an Airworthiness Directive to mandate service life limits or recurrent inspection requirements on General Electric Aircraft Engines CF6-6 engine stage 1 fan disks inspected in accordance with AD-89-20-01. [A-90-174]
• that the FAA issue an Airworthiness Directive based on the General Electric Aircraft Engines CF6-6 Engine Service Bulletin 72-962, pertaining to 119 stage 3 fan disks made from ALCOA forgings, to mandate compliance with the intent of the service bulletin by all operators. [A-90-175]
• that the Air Transport Association encourage member operators to incorporate specific maintenance inspection techniques in their maintenance manuals and maintenance contracts that simplify, automate, and provide redundant ("second set of eyes") inspection oversight for critical part inspection, such as for rotating engine parts. [A-90-176]
• that the Aerospace Industries Association of America encourage members to incorporate specific maintenance inspection techniques and inspection equipment in their service manuals that simplify, automate, and provide redundant ("second set of eyes") inspection oversight for critical part inspection, such as for rotating engine parts. [A-90-177]

The Final Report of the Investigation was published on 1 November 1990.

Related Articles

• Uncontained Engine Failure
• Loss of Control
• Ageing Aircraft - Structural Failure
• Certification of Aircraft, Design and Production
• Non Destructive Testing of Composite Materials in Aviation
• Crew Resource Management (CRM)
• Jet Engine
• Flight Controls
• Hydraulic Systems