The Airport Emergency Plan is the framework that supports the ARFF operations; that would be “The Plan,” if you will. The major mishap exercise is the practical means to see if the plan works. In this assignment, the airport manager of the Francey Executive Airport (KFEA) (note: this is not a real airport) has asked you, the ARFF Commander, for your input to build a major mishap exercise profile to help evaluate the Airport Emergency Plan.  
Reviewing the existing profile from the United Flight 232 crash (aviation-safety) use the link (https://aviation-safety.net/database/record.php?id=19890719-1) and the NTSB Report (PDF). Which is provided in the attachment section. Provide your inputs for the major mishap exercise profile using the Rapid Response Checklist (text pages 593-594) for the Francey Executive Airport (KFEA).  These pages can be found in the attachment section. 
 
Your response should contain at least 500 words of substantial thought. A minimum of two references is required. Your submission must be clear and concise, and succinct APA formatting applies.

, ,·

PB90-9 I 0406
I · NTSB/AAR-90/06

NATIONAL
· . TRANSPORTATION

SAFETY
.BOARD I _____ – _,_ — —

AIRCRAFf ACCIDENT REPORT

UNITED AIRLINES Fl.IGHT 232 ··~ .. ·
McDONNELL DOUGLAS DC-I0-10
SIOUX GATEWAY AIRPORT
SIOUX CITY, IOWA
JULY 19, 1989

-·~:~~

-··-~ . .. . .. ,’!II· .–~~
.. -··– . ,,,;,_,,

TECHNICAL REPORT DOCUMENTATION PAGE
1. Report No. 2. Government Accession No. 3. Recipient’s Catalog No.

NTSB/AAR-90/06 PB90-910406

4. Title and Subtitle Aircraft Accident Report·- 5. Report Date
United Airlines Flight232, McDonnell Douglas DC-10-10, November 1, 1990
Sioux Gateway Airport, Sioux City, Iowa, July 19, 1989

6. Performing Organization
Code

7. Author(s) 8. Performing Organization
Report No.

9. Performing Organization Name and Address 10. Work Unit No.
51580

National Transportation Safety Board
11. Contract or Grant No. Office of Aviation Safety

Washington, D.C. 20594
13. Type of Report and

Period Covered
Aircraft Accident Report

12. Sponsoring Agency Name and Address July 19, 1989

NATIONAL TRANSPORTATION SAFETY BOARD
14. Sponsoring Agency Code Washington, D.C. 20594

15. Supplementary Notes

16. Abstract
This report explains the crash of a United Airlines McDonnell Douglas DC-10-10 in Sioux City, Iowa,
on July 19, 1989. The safety issues discussed in the report are engine fan rotor assembly design,
certification, manufacturing, and inspection; maintenance and inspection of engine fan rotor
assemblies; hydraulic flight control system design, certification, and protection from uncontained
engine debris; cabin safety, including infant restraint systems; and aircraft rescue and firefighting
facilities. Safety recommendations addressing these issues were made to the Federal Aviation
Administration and the U.S. Air Force.

17. Key Words 18. Distribution Statement
This document is available to the
public through the Nationai
Technical Information Service,
Springfield, Virginia 22161

19. Security Classification 20. Security Classification 21. No. of Pages 22. Price
(of this report) (of this page)

UNCLASSIFIED UNCLASSIFIED 126

NTSB Form 1765.2 (Rev: 5/88}

,, .,
i .
I
I
I
I

~, : __ •
I

1.
1.1
1.2

. 1.3
1.4
1.5
1.6
1.6.1
1.6.2
1.6.3
1.7
1.8
1.9
1.9.1
1.10
1.11
1.11.1
1.11.2
1.12
1.12.1
1.12.2·
1.12.3

1.12. 4
1.13
1.14
1.14 .1
Ll4.2
1.14. 3
1.15
1.15 .1
1.15. 2
1.16
1.16.1
1.16.2
1.16.3
1.16. 4
1.16. 5
1.16. 6

1.17
1.17.1
1.17.2
1.17.3

1.17.4
1.17.5
1.17.6

CONTENTS

EXECUTIVE SUMMARY • e • e e ••• e e e e t •• e a a a I a a a ‘a I I I a a a I a I I e a I I I I I I I

FACTUAL INFORMATION
Hi story of Flight ……………………………………. .
Injuries to Persons ..•………………………………..
Damage to Airplane ………. –. ………………….. · ….. · .. ·.
Other Damage ……………………………………….. -.
Personnel Information ……………………………….. .
Airplane Information …..•…•……•……………………
No. 2 Engine Historical Data ………..•………………..
Stage 1 Fan Disk Historical Data ………… i •••••••••••••••
Airplane Flight Controls and Hydraulits–Oescription ……. .
Meteorological Information …………………………… .
Aids to Navigation ………………………………….. .
Communications …….•…….•………..•………………
United Airlines Company Flight Following ………….•……
Airport Information …………………………………. .
Flight Recorders ………………… · ….. · ……………… .
Cockpit Voice Recorder ………………………………. .
Fl i g ht Data Recorder •……•…………………………..
Wreckage and Impact Information ………………………. .
-Impact Marks and Ground Damage ……………………….. .
Reconstruction of Empennage ..•…………………………
Damage to Inlet Duct and Vertical Stabilizer Spars
(Banjo Frames) …….. , …………………………….. .

Hydraulic System Damage ………………………………. .
Medical and Pathological Information ……….•………….
Fi re ………………………………………………. .
Airport Response ……………………………………. .
Off-Airport Response ………………………………… .
The Kovatch P-18 Water Supply Vehicle …………………. .
Survival Aspects ……………………………………. .
Cabin Preparation …………………………………… .
Infants ……………………… · ……………………. .
Tests and Research ………………………………….. .
Design of CF6-6 Engine Stage 1 Fan Disk ……………….. .
Examination of No. 2 Engine Stage 1 Fan Disk ……..•..•….
Examination of Containment Ring ..•……..•……………..
Other No. 2 Engine Hardware ………………………….. .
s;ster Fan Disks …………………………………… .
No. 2 Engine Fan Disk Fracture Surface Chemical Residue
Examination …….•………………………………….

Additional Information ………………………………. .
Fan Disk Manufacturing Processes and Hard Alpha ………… .
ALCOA Forging and Records …………………………….. ·
GEAE Fan Disk S/N MPO 00385 Machining and Finishing
· Records …………………………………………… .
Inspections During Disk Manufacture •……………………
Responsibility for Continuing Airworthiness ……………. .
Certification Requirements ………•……………………

i ii

v

I
5
6
6
6

11
12
15
15
19
19
19
19
20
21
21
23
24
25
30

32
32
35
35
35
38
38
39
39
40
41
41
41
47
47
48

49
49
49
51

53
57
59
62

1.17.6.l
1.17.6.2
1.17.7
1.17.8
1.17.9
1.17.10

Certification Requirements – Aircraft …..•……………..
Certification Requirements – Engine …………………… .
Field Inspection Programs …. ~ …..•……………………
Hydraulic System Enhancement ….•…..•…………………
Hi stori cal Review .. • ………………………………… .
Airplane Flight Characteristics with Immovable Control
Surf aces ………………………………………….. .

1.17.10.1 General Characteristics ……………………………… .
1.17.10.2 Flight Simulator Studies ..•….•…………..• : ……….. .
1.18 Useful Investigative Techniques •…………••…•……….
1.18.1 Special Investigative Techniques – Photograph Image

2.
2.1
2.2
2.3
2.4
2.4.1
2.4.2
2.4.3
2.4.4
2.5
2.5.1
2.6
2.7
2.7.1

2.7.2
2.8
2.9
2.10
2.10.l
a.10.2
2.10.3
2.10.4

Analysis ………………………………………….. .

ANALYSIS
General ….. ···-···· …….. ~ ………………………….. .
Ace i dent Sequence …•……………………..•…………
Performance of UAL 232 Fl ightcrew …………………….. .
Analysis of Fan Diak Fracture …………………… ~ ….. .
Separation of Fan Disk …………•.•…•……………….
Initiation·and Propagation of fatigue Crack …………….. .
Source of Hard Alpha Defect ………………………….. .
Formation of Cavity ………….•…….•……………….
Origin of Accident Fan Disk MPO 00385 …………………. .
Quality Assurance During Manufacturing Process …………. .
Operator Inspection Program and Methods ……………….. .
Philosophy of Engine/Airframe Design ………………….. .
Hydraulic Systems/Flight Control Design Concept and
Cert i fi cation ……………………………………… .

Future Certification Concepts ………………………… .
Survival Aspects …………………………………….. .
Emergency Management ……………•………………….. ·.
Adequacy of Actions Taken Since the Accident …………… .
CF6-6 Fan Disk Inspection Programs ……………………. .
Hydraul i.c System Enhancement …………………………. .
Industry Task Group Efforts ………………………….. .
Damage Tolerance for Commercial Transport Engines ………. .

3. CONCLUSIONS

62
63
64
66
67

70
70
72
73

73

73
74
75
77
77
77
78
79
80
83
85
89

89
90
92
93
95
95
97
98
99

3 .1 Findings • . • . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
3.2 Probable Cause . . . . . . . . . . . . . . . . • . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

4. RECOMMENDATIONS • .. . • . • • • • • • • • • .. • • • • • • • • .. . .. .. . • . • . • .. . . . . . 102

5. APPENDIXES
Appendix A–Investigation and Hearing ………………….. 111
Appendix B–Personnel Information • . . . . . .. .. . . .. .. . .. . . .. . .. . 112
Appendix C–Horizontal Stabilizer Damage Diagram………… 115
Appendix D–Douglas Aircraft Company Letter: Controllability
with all Hydraulic Failure .. …. . .. . . . .. .. . . .. .. . .. .. .. .. . . 116

iv

•••••

. j

:~

. ,.
·l
I;

···”

!;A
}~

EXECUTIVE SUMMARY

On July 19, 1989, at 1516, a DC-10-10, Nl819U, operated by United
Airlines as flight 232, experienced a catastrophic failure of the No. 2
tail-mounted engine during cruise flight. The separation, fragmentation and
forceful discharge of stage 1 fan rotor assembly parts from the No. 2 engine
led to the loss of the three hydraulic systems that powered the airplane’s
flight controls. The flightcrew experienced severe difficulties controlling
the airplane, which subsequently crashed during an attempted landing at Sioux
Gateway Airport, Iowa. There were 285 passengers and 11 crewrnembers onboard.
One flight attendant and 110 passengers were fatally injured.

. The National Transportation Safety Board determines that the
probable cause of this accident was the inadequate consideration given to
human factors limitations 1n the inspection and quality control procedures
used by United Airlines’ engine overhaul facility which resulted in the
failure to detect a fatigue crack originating from a previously undetected
metallurgical defect located in a critical area of the stage 1 fan disk that
was manufactured by General Electric Aircraft Engines. The subsequent
catastrophic disintegration of the disk resulted in the liberation of debris
in a pattern of distribution and with ·energy levels that exceeded the level
of protection provided ·by design features of the hydraulic systems that
operate the DC-lO’s flight controls.

The safety issues raised in this report include:

1. General Electric Aircraft Engines’ {GEAE} CF6-6 fan rotor
assembly design, certification, manufacturing, and
inspection .

2. United Airlines’ maintenance and inspection of CF6-6
engine fan.rotor assemblies.

3. DC-10 hydraulic flight control system design,
certification and protection from uncontained ~gine
debris.

4. · Cabin safety, including infant restraint systems, and
airport rescue and firefighting facilities.

Reconunendations concerning these issues were addressed to the
Federal Aviation Administration, the Secretary of the Air Force, the Air
Transport Association and the Aerospace Industries Association.

v

I
I
I

-a

~ ! •
I

I

I
I
I

I
I

‘ ‘I
I
i
i

-_;~
::”!II

NATIONAL TRANSPORTATION SAFffi BOARD
WASHINGTON, D. C. 20594

AIRCRAFT ACCIDENT REPORT

UNITED AIRLINES.FLIGHT 232, McDONNELL DOUGLAS DC-10-10
SIOUX GATEWAY AIRPORT

SIOUX CITY, IOWA
JULY 19, 1989

1. FACTUAL INFORMATION

1.1 History of Flight

United Airlines (UAL) flight 232 (UA 232), a McDonnell Oougl as
DC-10-10, registration No. Nl819U, was a scheduled passenger flight from
Stapleton International Airport, Denver, Colorado, to Philadelphia,
Pennsylvania, with an en route stop at Chicago, Illinois. The flight was
conducted under Title 14 Code of Federal Regulations (CFR) Part 121.
Flight 232 departed Denver at 1409 central daylight time. There were 285
passengers and 11 crewmembers on board.

The takeoff and the en route climb to the planned cruising altitude
of 37 ,000 feet were uneventful. The first officer (copilot) was the flying
pilot. The autopilot was engaged, and the autothrottles were selected in the
speed mode for 270 KIAS. The flight plan called for a cruise speed of

. Mach 0.83.

About 1 hour and 7 minutes after takeoff, at 1516:10, the
flightcrew heard a loud bang or an explosion, followed by vibration and a
shuddering of the airframe. After checking the engine instruments, the
fl ightcrew determined that the No. 2 aft (tail-mounted) engine had failed.
(See figure 1). The captain called for the engine shutdown checklist. While
performing the engine shutdown checklist, the second officer (flight
engineer) observed that the airplane’s normal systems hydraulic pressure and
quantity gauges indicated zero.

The first officer advised that he could not control the airplane as
it entered a right descending turn. The captain took control of the
afrplane and confirmed that it did not respond to flight control inputs. The
captain reduced thrust on the No. 1 engine, and the airplane began to roll to
a wings-level attitude.

The flightcrew deployed the air driven generator (ADG), which
powers the No. 1 auxiliary hydraulic pump, and the hydraulic pump was
selected non.” This action did not restore hydraulic power. ·

At 1520, the flightcrew radioed the Minneapolis Air Route Traffic
Control Center (ARTCC) and requested emergency assistance an.d vectors to the
nearest airport. Initially, Des Moines International Airport was suggested
by ARTCC. At 1522, the air traffic controller informed the flightcrew

2

Wing Mounted Engines

Aft Tail
Mounted Engine

Figure l.–DC-10 airplane view illustrated with engine arrangement .

‘~t·'” •’. .·,

• ‘ ‘ . ))

3

that they were proceeding in the direction of Sioux City; the controller
asked the flightcrew if they would prefer to go to Sioux City. The
fl ightcrew responded, aaffirmative. 11 They were then given vectors to the
Sioux Gateway Airport (SUX) at Sioux City, Iowa. (See figure 2). Details of
relevant air traffic control (ATC) communications, cockpit conversations,
airplane maneuvers, and airplane and engine system parameters are contained
in Sections 1.9 and 1.11 of this report.

Crew interviews indicate that shortly after the. engine. failure, the
passengers were informed of the failure of the No. 2 engine, and the senior
flight attendant was called to the cockpit. She was told to prepare .the
cabin for an emergency landing. She returned to the cabin and separately
informed the other flight attendants to prepare for an emergency landing. A
flight attendant advised the captain that a UAL DC-10 training check airman,,
who was off duty and seated in a first class passenger seat, had volunteered
his assistance. The captain immediately invited the airman to the cockpit,
and he arrived about 1529.

At the request of the captain, the check airman entered the
passenger cabin and performed a visual inspection of the airplane’s wings.
Upon his return, he reported that the inboard ailerons were slightly up, not
damaged, and that the spoilers were locked down. There was no movement of
the primary” flight control surfaces. The captain then directed the check
airman to take control of the throttles to free the captain and first officer
to manipulate the flight controls.

The check airman attempted to use engine power to control pitch and
roll. He said that the airplane had a continuous tendency to turn right,
making it diffi<;ult to maintain a stable pitch attitude. He also advised that the No. 1 and No. 3 engine thrust levers -could not be used symmetrically, so he used two hands to manipulate the two throttles. About 1542, the second officer was sent to the passenger cabin to inspect the empennage visually. Upon his return, he reported that he observed damage to the right and left horizontal stabilizers. Fuel was jettisoned to the level of the automatic system cutoff, leaving 33,500 pounds. About 11 minutes before landing, the landing gear was extended by means of the alternate gear extension procedure. The flightcrew said that they made visual contact with the airport about 9 miles out. ATC had intended for flight 232 to attempt to land on runway 31, which was 8,999 feet long. However, ATC advised that the airplane was on approach to runway 22, which was closed, and that the length of this runway was 6,600 feet. Given the airplane's position and the difficulty in making left turns, the captain elected to continue the approach to runway 22 rather than to attempt maneuvering to runway 31. The check airman said that he believed the airplane was lined up and on a normal glidepath to the field. The flaps and slats remained retracted . •• o Kingsley 'f:-... 360. right hand tum-not recorded on radar ·· · ~ Sioux Gateway Airport o Pierson 0 Cotrectiomillle ;: ;fi' (; . (:: ~ 0 .~ 0 - OMaplllton 0 Battle Creek Intended rot/out 095 MHDG _._ ....... ___ ~-.--_-;). • Alta 1 Storm~ lake l-.J 0.00 6.00 12.00 18.00 24.00 30.00 36.00 42.00 48.00 54.00 60.00 Scale (NM) Figure 2.--Ground track from radar plot. • • .,. t l ' : I . ;~· 5 During the final approach, the captain recalled getting a high sink rate alarm from the ground proximity warning system (GPWS). In the last 20 seconds before touchdown, the airspeed averaged 215 KIAS, and the sink rate was 1,620· feet per minute. Smooth oscillations in pitch and roll continued until just before touchdo~n when the right wing dropped rapidly. The capta1 n stated that about 100 feet above the ground the nose of the airplane began to pitch downward. He also felt the right wing drop down about the same time. Both the captain and the first officer called for reduced power on short final approach. The check airman said that based on experience with no flap/no slat approaches he knew that power would have to be used to control the airplane's descent .. He used the first officer's airspeed indicator and visual cues to determine the flightpath and the need for power changes. He thought that the airplane was fairly well aligned with the runway during the latter stages ·of · the approach and that they would reach the runway. Soon thereafter, he observed that the airplane was positioned to the left of the desired landing area and descending at a high rate. He also observed that the right wing began to drop. He continued to manipulate the No. 1 and No. 3 engine throttles until the airplane contacted the ground. He said that no steady application of power was used on the approach and that the power was constantly changing. He believed that he added power just before contacting the ground. The airplane touched down on the threshold slightly to the left of the centerline on runway 22 at 1600. First ground contact was made by the right wing tip followed by the right main landing gear. The airplane skidded to the right of the runway and rolled to an inverted position. Witnesses observed the airplane ignite and cartwheel, coming to rest after crossing runway 17/35. Firefighting and rescue operations began immediately, but the airplane was destroyed by impact and fire. The accident occurred during daylight conditions at 42° 25' north latitude and 950 23' west longitude. 1.2 Injuries to Persons In1uries Crew passengers Others Total Fatal 1 110 0 111 Serious 6 41* 0 47 Minor 4 121 0 125 None _Q 13 Q _n Total 11 285 0 296 *One passenger died 31 days after the accident as a result of injuries he had received in the accident. In accordance with 49 CFR 830.2, his injuries were classified "serious." 1.3 6 Damage to Airplane The airplane was destroyed by impact and postcrash fire. Photographs of the airplane were taken by observers on the ground during its final approach to Sioux Gateway Airport. They showed that the No. 2 engine fan cowling and the fuselage tail cone were missing. The remainder of the No. 2 engine appeared intact. Postcrash examination of the wreckage revealed that the No. 2 engine fan rotor components forward of the fan forward· shaft, as well as part of the shaft, had separated from the engine in flight. (See figures 3 through 5). · The airplane's right wing began to break up immediately following touchdown. The remainder of the airplane broke up as it tumbled down the runway. The fuse 1 age center section, with most of the 1 eft wing st il 1 ·attached, came to rest in a corn field after crossing runway 17/35. The cockpit separated early in the sequence and came to rest at the edge of runway 17/35. . The largely intact tail section continued down runway 22 and came to rest on taxiway "L." The engines separated during the breakup. The No. 1 and No. 3 engines came to rest near taxiway "L" and the intersection of runway 17/35, between 3,000 and 3,500 feet from the point of first impact. (See figure 6). The No. 2 engine came to rest on taxiway "J" to the 1 eft ·of runway 22, about 1,850 feet from the point of first impact. The majority of the No. 2 engine fan module was not found at the airport. The value of the airplane was estimated at $21,000,000. 1.4 Other Damage Airplane parts, which separated and fell to the ground on cultivated land, caused no significant damage. There was some minor damage to airport facilities and adjacent crops as a result of the crash landing. 1.5 Personnel Information The flightcrew consisted of . a captain, first officer, second officer and eight flight attendants. (See appendix B). The captain was employed· by UAL on February 23, 1956. He had 29,967 hours of flight time logged with UAL, 7,190 hours of which was in the DC-10. He held an airline transport pilot certificate with type ratings in the DC-10 and B-727. He possessed a current first class airman medical certificate. His most rec.ent proficiency check in the OC-10 was completed on April 26, 1989. • ~ . ~ . ·-····'·-- ·----···~-· ·-··-··-· .. ~ Figure 3.--Photo (C. Zellmer) taken while flight 232 was approaching Sioux Gateway Airport. Arrows indicate damage to the right horizontal stabilizer. It is also evident that the No. 2 engine fan cowl door and the tail cone are missing. ~ ...... Fan Figure 4.--CF6-6 engine. ,. .• , Direction of rotation ~ CX>

.”-..; ~ .,

Spinner cone

Spinner cover

Forward

,_,
:’.: •• …::-:J’

w

Stage 1 fan rotor disk

Figure 5.–CF6-6 fan rotor assembly.

.. ~

‘°

850 Ft. Overrun

EIBY
1,093 Fl

t
N

Airport Diagram

rTL
,74.J

Ft. LI_._…_ ….. -”L.-L’….L-‘.._.1_.. …………. ~·
0 2,000 4,000 6,000

10

Closed Runway

1,000 Ft. Stopway

Flap Hinge

No. 3 Engine

Touchdown Area

Right Wing Tip

Right Main
Landing Gear
(2 Places}

Right Wing Tip

Figure 6.–Sioux Gateway Airport and wreckage path of UA flight 232.

11

The first officer began airline employment on August 25, 1969. He
estimated ·that he had logged 20,000 hours of flight time. He had accrued
665 hours as a first officer in the DC-10. He held an airline transport
pilot certificate with type ratings in the DC-10 and L-1011. He possessed a
current first class airman medical certificate. His most recent proficiency
check in the DC-10 was completed on A~gust 8, 1988.

The second officer was employed by UAL on May 19, 1986. He
estimated that he had 15,000 hours of flight time. UAL records indicated
that he had accumulated 1, 903 hours as a second officer in the B-727 and
33 hours in the DC-10. He held a flight engineer certificate for turbojet
airplanes. He possessed a current second cl ass airman medical certificate.
His most recent proficiency check ·in the DC-10 was completed on June 8, 1989.

A review of flightcrew duty time indicated that the crew had
complied with all relevant duty time limitations. The accident occurred on
the third day of a 4-day scheduled trip sequence. The crew had a 22-hour
layover in Denver prior to the departure of flight 232. The cockpit crew had
flown together six times in the previous 90 days.

The off-duty check airman was employed by UAL on January 2, 1968.
He held an airline transport pilot certificate with type rating in the DC-10
and a first class medical certificate. He had completed captain-transition
training in the DC-10 on April 25, 1989, and was assigned as a DC-10 training
check airman at UAL’s Flight Training Center in Denver, Colorado. He had
about 23, 000 hours tot a 1 flight ti me with 2, 987 hours 1 ogged in the DC-1 O.
He had 79 hours as captain in the OC-10.

1.6 Airplane Information

UAL operated a total of 55 OC-10 airplanes; 47 airplanes were model
OC-10-10, and 8 airplanes were model DC-10-30. The accident airplane,
Nl819U, fuselage No. 118, factory S/N 44618, was delivered in 1971 and was
owned by UAL since that time. Prior to departure on the accident flight from·
Denver on July 19, 1989, the airplane had been operated a total of
43,401 hours and 16,997 cycles.

The maximum certificated takeoff weight for Nl819U was
430,000 pounds. The center of gravity {CG) computed· for departure was
21.9 percent mean aerodynamic chord (MAC). The calculated CG limits for this
gross weight were 13.4 percent and 30.8 percent MAC, respectively. The
takeoff gross weight was 369,268 pounds.

The accident airplane was powered by General Electric Aircraft
Engines {GEAE) CF6-60 high bypass ratio turbofan engines. The CF6-6 engine
was certified by the FAA on September 16, 1970.

Table l provides identification and historical information for the
engines in Nl819U at the time of the accident.

12

Table 1

Engines Historical Data

Data

Engine Serial Number (ESN)
Total Time
Total Cycles
Time Since Last Maintenance
Cycles Since Last Maintenance
Time Since Last Shop Visit
Cycles Since Last Shop Visit
Date of Installation

Number 1

451-170
44,078
16,523

1,047
358

3,635
1,318

5-9-88

Number 2 ·

451-243
42,436
16,899

2,170
760

2, 170
760

10-25-88

Number 3·

451-393
39,338
11, 757

338
116
338
116

6-11-89

Figure 7 contains a c·utaway sectional drawing of the flow path and
construction of the CF6-6 engine. The figure also shows the fan and
accessory drive sections. Figure 8 displays the CF6-6 rotating assemblies.
The portion of the No. 2 engine that departed the airplane is outlined by
the dashed lines.

1.6.1 No. 2 Engine Historical Data

Engine S/N 451-243 was first installed on June 23, 1972, in the
No. 3 position of a UAL DC-10-10, registration airplane N1814U. Fan module
S/N 51406, which contained stage 1 fan disk P/N 9137M52P36, S/N MPO 00385,
was installed on engine S/N 451-243 during a shop visit in July 1988, at ,_-_
UAL. At that time, the engine had accumulated 40,266 hours and 16,139 cycles
since new.

Engine S/N 451-243 was installed in the No. I position on UAL
airplane registration Nl807U on September 15, 1988. It was removed “for
convenience” 8 days later after one flight and was installed in ·the No. 2
position on N1819U on October 25, 1988. The engine had accumulated
42,436 hours and 16,899 cycles at the time of the accident.

Examination of service records, crew writeups, action items, trend
monitoring data, and flight recorder data indicated no abnormal engine
operation prior to the in-flight incident, with the exception of certain
autothrottle anomalies. The autothrottle system’s inability to hold steady
Nl was noted in the reported difficulties, and corrective action entries in
U L’s Aircraft Maintenance Information System (AMIS) were dated on July 14,
17, and 19, 1989. On July 19, corrective action for the discrepancy was
indicated accomplished at Phil adel phi a with the replacement of the
autothrottle speed control and was signed off as “system ops check nor~al.”

~.-· .. -:._

~

Engine
Gompo~ents

lost in
flight

{
I

_L _, Fan sectlon –
I
I
I
I
I
I
I

Forward

‘- I ______ /

‘·-‘

w

Figure 7.–CF6-6 engine cutaway.

. WWW:,I ,_

…..
w

14

hAf _a:
8

.
en
Cl) ….. -..Q e
QJ
en
en
CG

CJ)
c: …..
~
CG
~
0
s..

I

~
u

I
I

tJ

f)l

r.'”.. ‘ft.’ } ‘.> ./ :..

-~ /)”, 1 I .
..1 ‘~ …

;,.J”‘ .•

15

1.6.2 Stage 1 Fan Disk Historical Data

The stage 1 fan disk, part number (P/N) 9137M52P36,1 S/N MPO 00385, ·
was processed in the manufacturing cycle at the GEAE-Evendale, Ohio, factory
from September 3 to December 11, 1971. It was installed as a new part in
engine S/N 451-251 in the GEAE production assembly facility in Evendale. The
engine was shipped to Douglas Aircraft Company on January 22, 1972, where it
was installed o~ a new DC-10-10.

·During the next 17 years, the engines in which this stage 1 fan
disk were installed were routinely overhauled and the fan module was
disassembled. The disk was removed on the following dates for inspection:
September 1972, November 1973, January 1976, June 1978, February 1982 and
February 1988. This disk was accepted after each of six fluorescent
penetrant inspections (FPI). 2 (See figure 9). Five of the six inspections
were performed at the UAL CF6 Overhaul Shop in San Francisca, California.
One of them was performed at the GEAE Airline Service Department in Ontario,
California, in 1973. At the time of the accident, the stage 1 fan disk had
accumulated 41,009 hours and 15,503 cycles since new. The last shop visit in
February 1988, was 760 flight cycles before the accident, and FPI was
performed at that time. The engine had been removed because of corrosion in
the high pressure turbine (HPT) stage 1 nozzle guide vanes. At that time,
the stage 1 fan disk had accumulated 38,839 hours and 14,743 cycles since
new. Following this inspection, the disk was installed in engine
S/N 451-243, the No. 2 engine on the accident airplane.

1.6.3 Airplane Flight Controls and Hydraulics–Description

Primary flight controls on the OC-10-10 consist of inboard and
outboard ailerons, two-section elevators, and a two-section rudder.
Secondary flight controls consist of leading edge slats, spoilers, inboard
and outboard flaps, and a dual-rate movable horizontal stabilizer. Flight
control surfaces are segmented to achieve redundancy. Each primary and

1orlglnal P/N 9010M27P10 was superseded when the disk was modified
during a GEAE shop visit in 1973. The fan blade dovetail slots were
rebroached at that time.

2Fluorescent penetrant Inspection (FPI) Is the accepted Industry
Inspection technique for interrogating nonferrous (nonmagnetic) component
surfaces for discontinuities or cracks. The technique relies on the ability
of a penetrant (a low-viscosity penetrating oil containing fluorescent· dyes)
to penetrate by capillary action into surface discontinuities of the
component being inspected. The penetrant fluid is applied to the surface and
allowed to penetrate Into any surface discontinuities. Exce~s penetrant is
then removed from the component surface. A developer is then applied to the
component surface to act as a blotter and draw the penetrant back out of the
surface discontinuity, producing an Indication which fluoresces under
ultraviolet lighting.

16

15

14

13

0 12
0
0
~ 11
)(

z 10
fl’)

~ 9
3:
Q) 8 r::
Q)
u 7 r::

“iii

“‘ 6 Q)
TI
>. 5 ()

4

3

2

1

0

,-.

I I l I I I ~~en~ (1~3 CSN)
UAL Shop visit, FP1 (14743 CSN)

~’

~
:…,,. ….

~/

1.-~

1 …….

v
I~ …. ~UAL Shop visit, FP1 (9236 CSN)

-”
v

l……ol ~

/ ~:uAL Shop visit, FP1 (831 SCSN)
I~ I/ I I I

/’ l I I I
,V ..,.. UAL Shop visit, FP1 (3764 CSN) I I I I I 1 I I I

.[.I
~ ~ GEAE Shop visit, FP1 (1645 CSN) (Part number change)

‘ I

Ji.,,,- ~ UAL Shop visit, FP1 (824 CSN)

72 73 74 75 76 77 78 79 80 81 82 83 84 85 86

Calendar Vear

Figure 9.–Inspection history of accident fan disk.
(Data source GEAE)

,e,

87 88

~ ~

89

…..
O’I

.-) c• ~~ ._,

17

secondary control surface is powered by two of three independent hydraulic
systems.

The No; 1 hydraulic system provides power to the right inboard
aileron and the left outboard aileron, the right inboard and outboard
elevators, the left outboard elevator, the upper rudder, the horizontal
stabilizer trim, and the captain’s brake system. The No. 2 hydraulic system
provides power to the right outboard aileron and the left inboard aileron,
the inboard and outboard elevators on the left side, the outboard elevator on
the right side, and the lower rudder. It also provides power to the isolated
cl osed-1 oop system that operates the upper rudder. The No. 3 hydraulic
system provides power to the right inboard and outboard aileron and the left
inboard aileron, the inboard elevators on the right and left side, horizontal,
stabilizer trim, and the first officer’s brake system. It also drives an
isolated c 1 osed-1 oop system that powers the 1 ower rudder actuator. These
closed-loop arrangements allow for operation of the remaining parts of
hydraulic systems No. 2 and No. 3 in the event of damage to the rudder
hydraulic system. (See figure 10).

The three independent, continuously operating hydraulic systems are
intended to provide power for full operation and control of the airplane in
the event that one or two of the hydraulic systems are rendered inoperative.
System integrity of at least one hydraulic system is required–fluid present
and the ability to hold pressure–for continued flight and landing; there are
no provisions for reverting to manual flight control inputs .

Each hydraulic system derives its power from a separate engine,
with a primary and a reserve engine-driven pump providing hydraulic
pressure. ·Either of these pumps can supply full power to its system. Backup
power is provided by two reversible motor pumps, which transmit power from
one system to another without fluid interconnection. This backup power
system activates automatically without requiring flightcrew control, if fluid
is still available in the unpowered system.

Electrical power can be used to drive either of two auxiliary pumps
provided for the No. 3 hydraulic system. In an emergency situation where the
engine-driven pumps are inoperative, an air-driven generator can be deployed
into the airstream to supply electrical power to one of these auxiliary
pumps.

The hydraulic components and piping are physically separated to
minimize the vulnerability of the airplane to multiple hydraulic system
failures in the event of structural damage. The No. 1 hydraulic system lines
run ~long the left side of the fuselage to the rear of the airplane and along
the front spar of the horizontal stabilizer and the vertical stabilizer. The
No. 2 hydraulic system lines are routed from the center engine along the rear
spar of the horizontal and vertical stabilizers. The No. 3 hydraulic system
lines run along the right side of the fuselage to the tail area and along the
rear spar of the horizontal stabilizer. The No. 2 hydraulic system lines are
not routed forward of the rear wing spar, in order to isolate them from wing
engine fragmentation, and No. 3 hydraulic system lines in the tail section

,.

I I ®-:1j =….
_…,.
ua”Mng

DC-10 Hydraulic System Schematic

9..,.,_
01¥1-
® _,,,_
~~v-

OD
~

~~ ,_V_
E ………
()p.oaa.dVllNe

•·• -· —
‘I ‘lol I I 0…..–···1—-1’1’1111 I IC:.::,’:: LlflVMQ

Spollrl 111

…..

r .. c.no

Figure 10.–DC-10 hydraulic system schematic.

,.,

……. -.
-CcNMlll … _
._~

…..


,__

….. _, … ,
00

…… I –ITllC:-
-;,Si» I -T1im ……..,,_ –
.-..;;;–
~

a–.
ifinijd
E…,.,..

.~ ~

19

are not routed aft of the ;nboard elevator actuators in order to mrn1m1ze
exposure to poss;ble eng;ne fragmentation damage from. the tail-mounted
engine.

The OC-10-10 hydraulic system was designed by the manufacturer and
demonstrated to the FAA to comply with 14 CFR 25.901, which in part specified
that, “no single [powerplant] failure or malfunction or probable combination
of failures will jeopardize the safe operation of the airplane …. ”

1.7 Meteorological Information

The surface weather observation taken at Sioux Gateway Airport at
1559 estimated a ceiling of 4,000 feet with broken clouds and 15 miles
visibility. The temperature was 80° F, and winds were 360° at 14 knots.
There were towering cumulus clouds in all quadrants. The last wind reported
to the crew by the tower at 1558 was from 010° at 11 knots.

1.8 Aids to Navigation

Instrument landing System (ILS) approaches for runways 31 and 13
were available. When runway 22/04 was closed in 1988, published instrument
approaches to that runway were cancelled. Electronic aids to navigation were
not used by the crew of UA 232.

1.9 Conununications

1.9.l United Airlines Company Flight Following

At. 1521, UA 232 sent an Aircraft Communications and Reporting
System (ACARS} message to UAL’s central dispatch facility3 in Chicago,
Illinois, requesting a call on frequency 129.45. Dispatch was initially
unsuccessful in establishing voice contact. At 1523, dispatch initiated an
ACARS call to UA 232 that resulted in positive contact.

The communication between UA 232, UAL’s dispatch facility and
UAL’s San Francisco maintenance facility (SAM} was recorded by Aeronautical
Radio Incorporated (ARINC). The. recording revealed that, at 1525, UA 232
requested that dispatch put the flight in contact with “SAM immediately,
it’s a MAYDAY.” UA 232’s initial conversation with SAM occurred at 1527.
The crew advised SAM of the loss of all hydraulic systems and quantities and
requested whatever assistance SAM could provide. SAM was unable to provide
instructions to the flightcrew that they did not already have.

At 1533, SAM informed UA 232 that it was making contact with UAL
Flight Operations. At 1540, SAM advised the flightcrew that representatives
of UAL’ s “Operational Engineering” department had been contacted ·to 1 end.
assistance. At 1545, SAM informed the flightcrew that, “Engineering is

3Dlspatch facility – the air carrier section operating in .accordance
with Part 121, Subpart U – Dispatching and Flight Release Rules for flight
planning, release, and monitoring of air carrier operations.

20

assembling right now and they’re listening to us.” UA 232 then advised SAM
that the flight was at 9,000 feet and that they were planning to try to land ~-·
at Sioux City. At 1549, the flightcrew informed SAM that they had just •
completed the alternate gear extension procedure. This communication was the
last one ARINC recorded from UA 232.

The dispatcher working UA 232 stated that UAL Flight Operations
asked her to inquire of the flightcrew about the pos~ibility of landing in
Lincoln, Nebraska, Jn$tead of Sioux City. Flight Operations was concerned
about crosswinds and the need for a longer runway. The dispatcher forwarded
this inquiry to the flightcrew at 1554 but did not receive a reply.

The dispatch office also received a call from UAL personnel in
Sioux City stating that a oc-10· was east of the field experiencing
difficulty. Dispatch contacted the Sioux Gateway Airport ATC tower directly
and requested the dispatching of all emergency crash, fire, and rescue
equipment. ·

1.10 Airport Information

Sioux Gateway Airport serves Sioux City, Iowa, and is 6 nmi south
of the city on a flat plain adjacent to the east bank of the Missouri River.
Its elevation is 1,098 feet. The airport is owned and operated by the city
as a public-use airport.

The airport is·currently served by two runways. Runway 17/35, of
asphalt construction, is 150 feet wide by 6,599 feet long. Both ends have ,_-._
overruns; 850 feet on the north end and 794 feet on the south end.
Runway 13/31 is 150 feet wide by 8,999 feet long with 1,000 feet of overrun
on the southeast end.

Runway 4/22 has a concrete surf ace, 150 feet wide by 6, 888 feet
long. It has paved shoulders 75 feet wide on each side, from the threshold
area of runway 22 to the intersection with runway 13/31. Runway 22 has a
turf overrun 550 feet long on its approach end, with a short asphalt base
section just in front of the threshold. The terrain past the rollout end is
cropland. Elevation at the threshold of runway 22 is 1,095 feet. The runway
is marked with a yellow “X” painted over the numbers at each end to indicate
that the runway is closed.

Sioux Gateway Airport is an “Index· B” airport under 14 CFR 139.
The airport “Index” is based on the size of scheduled air carrier aircraft
that normally use that facility and the average daily departures of
airplanes–in this case–DC-9, B-737, and B-727-100 series airplanes. A
ful 1-scal e emergency exercise is required under 14 CFR 139 every 3 years,
and a “table-top” review of the Airport Emergency Plan is required annually.
A mass casualty exercise was conducted at the airport on October 10, 1987,
that included the evacuation of about 90 casualties. The most recent drill
was conducted on June 16, 1989. During the postaccident discussions,
emergency personnel indicated that their preparedness training was a
tremendous asset in. this response.

21

DC-10 airplanes are not normally scheduled to land at Sioux Gateway
Airport and require the use of an “Index D” airport, which recommends more
than twice the quantity of firefighting extinguishing agents required of an
“Index B” airport.

Aircraft rescue and firefighting (ARFF) services at the Sioux
Gateway Airport are provided by the Iowa Air National Guard (ANG) through a
joint-use agreement with the National Guard Bureau, the State of Iowa, and
the City of Sioux City. Additionally, the local community reaction plan is
coordinated with airport emergency services by the FAA control tower during
its hours of operation through the Woodbury County Disaster and Emergency
Services Conununications Center in Sioux City.

1.11

1.11.1

Flight Recorders

Cockpit Voice Recorder

The airplane was equipped with a Sundstrand Model AVSS7B, serial
no. 7510, cockpit voice recorder (CVR) that provided a good record of air
traffic control and intracockpit communications for the last 33 minutes and
34 seconds of the .flight. The recording began at 1526:42, during a
transmission made by the captain to Sioux City Approach Control about
10 min~tes after the No. 2 engine had failed.

At 1529:15, the CVR revealed a flight attendant relaying a message
to the captain. The captain responded, “okay let’em come up” to the
flightdeck. At 1529:35, the check airman arrived on the flightdeck. At
1529:41, the captain explained, “we don’t have any controls.”
Fourteen seconds later, the captain directed the check airman to return to
the cabin to determine if he could see any external damage to the airplane
through the windows.

At 1530:32, the first officer asked, “What’s the hydraulic
quantity.” The second officer reported that it was zero, followed by the
first officer asking, “on all of them,” and the second officer confirming the
status. The captain followed by saying, “quantity is gone?” Three seconds
later, he asked the second officer, “you got a hold of SAM?” The second
officer reported, “he’s not telling me anything.” The captain responded,
“we’re not gonna make the runway fellas.” At this point, it is believed
that the check airman returned to the flightdeck, and the captain reported,
“we have no hydraulic fluid, that’s part of our main problem.” The check
airmman stated, “okay both your inboard ailerons are sticking up that’s as
far as I can tell.· I don’t know.” He then asked the captain for
instructions, and the captain told him which throttle to manipulate. At
1532:02, the check airman reported that the flight attendants were slowly
securing the cabin and the captain reported that “they better hurry we’re
gonna have to ditch I think.”

At 1532:16, the captainr reported to the approach controller that
the flight had no hydraulic fluid and therefore no elevator control and that
the flight might have to· make a forced landing. Two seconds after the
captain began his transmission, the check airman stated, “get this thing

22

down we’re in trouble.” At 1534:27, the captain decided to attempt a landing
at Sioux City and asked the second officer for information to make a ~.·
no-flap, no-slat landing. He also asked the controller for the ILS ~
frequency heading to the runway and the length of the runway. fhe
cont ro] l er provided the frequency and reported runway 31 to be 9, 000 feet
long. At this point, the airplane was about 35 miles northeast of the
airport.

At 1535:36, the captain instructed the second officer to start
dumping fuel by using the quick dump. At 1537:55, the captain asked the
check airman if he could manipulate the throttles to maintain a 10° to iso
turn, and the check airman replied that he “would try.~ At 1538:55, one of
the pilots said that 200 knots would be the “clean maneuvering airspeed,” and
the first officer responded with, “two hundred and one eighty five on your
bugs Al.”

At 1540:39, the captain asked the senior flight attendant if
everyone in the cabin was ready. The captain explained to the flight
attendant that they had very little control of the airplane because of the
loss of hydraulic flight controls and that they were going to attempt to land
at Sioux City, Iowa. He stated that it would be a difficult landing and that
he had doubts about the outcome and the crew’s ability to carry out a
successful evacuation. He said that there would be the signal “brace, brace,
brace” made over the public address system to alert the cabin occupants to
prepare for the landing. At 1541:09, the approach controller again informed
the flight that emergency equipment would be standing by.

‘At 1541 :52, the second officer reported that a flight attendant t
said she observed damage on one wing. He asked if he should go aft and look.
The captain authorized his absence from the flightdeck to investigate. The
second officer returned about 2-1/2 minutes later to report that there was
damage to the tail of the airplane, and the captain stated, ” … that’s what I
thought.” At 1548: 43, the landing gear was extended. At 1549: 11, the
captain directed the flightcrew to lock their shoulder harnesses and to put
everything away.

At 1551: 04, ATC reported that the airplane was 21 mil es north of
the airport. The controller requested the flight to widen its turn slightly
to the left in order to make a turn onto its final approach and to keep the
airplane away from the city. The captain responded, “whatever you do, keep
us away from the city.” Several seconds later, the controller gave the
flight a heading of 180°. At 1552:19, the controller alerted the crewmembers
to a 3,400-foot tower obstruction located 5 miles to their right. The first
officer acknowledged. At 1552:34, the controller asked how steep a right
turn the flight could make. The captain responded that they were trying to
make a 300 bank. A cockpit crewmember commented, “I can’t handle that steep
of bank … can’t handle that steep of bank.”

At 1553:35, the first officer stated, ” … we’re gonna have to try
it straight ahead Al ..• ” followed 2 seconds later by the controller advising
the crew that if they could hold altitude, their right turn to 180° would put
the flight about 10 miles east of the airport. The captain stated, “that’s

l ··. ~ .. ,; ‘ . ;r :

23

what we’re tryin’ to do.” The first officer then recommended that they try
to establish a shallow descent. Twenty seconds later, the captain stated
that he wanted to get as close to the airport as possible. Seconds later, he
stated, “get pn the air and te 11 them we got about 4 minutes to go.” The
first officer so advised the controller,~ but the captain corrected him,
saying, “tell the passengers,” at which time a crewmember made a PA
announcement. At 1555:44, the captain reported a heading of IBoo. The
controller reported that if the altitude could be maintained, the heading,
“will work fine for about oh 7 miles.”

At 1557:07, the controller reported to the flight that the airport
was ” … twelve o’clock and one three miles.” At 1558:11, the captain
reported the runway in sight and thanked the controller for his help. The
captain instructed the second officer to make a PA announcement, which was
believed to be a 2-minute warning. The controller reported the winds as
360° at 11 knots ·and cl eared the flight to land on any runway. At this
point, the flightcrew attempted to turn the airplane to the left slightly.
At 1558:59, the captain reported, “we’re pretty well lined up on this one
here .•. think we will be ..• ” The controller stated that the runway the flight
had lined up on was runway 22, which was closed, but he added “that’ll work
sir, we’re gettin’ the equipment off the runway, they’ll line up for that
one.” The captain asked its length, and the controller reported it as
6,600 feet long. Twelve seconds later, the controller stated that there was
an open field at the end of the runway and that the winds would not be a
problem. During the interim seconds, the crew’s attention was directed to
manipulating the throttles. At 1559:29, one of the crewmembers made the PA
announcement to brace for the landing.

At 1559:44, the first of several ground proximity warning system
alerts (GPWS) began and ended 8 seconds later. At 1559:58 the captain stated
“close the throttles.” At 1600:01, the check airman stated “nah I can’t
pull’em off or we’ll lose it that’s what’s turnin’ ya.” Four seconds later,
the first officer stated, “left Al” followed by “left throttle” left
[repeated several times]. A second series of GPWS alerts begin at 1600:09,
followed by the first officer stating several times, “we’re turning” or
“we’re tryin.” The sound of the impact occurred at 1600:16.

1.11.2 Flight Data Recorder

The flight data recorder (FDR) was a Sundstrand Model 573
(S/N 2159). It was found undamaged, and there was no evidence of excessive
wear. The quality of the data recording was generally good, although some
anomalies in the data did occur. The recorded data included altitude,
indicated airspeed, heading, pitch attitude, roll attitude, stabilizer
position,. fan rotor speed (NI) for each engine, vertical acceleration,
position of control surfaces, longitudinal acceleration, and lateral
acceleration.

The FDR contained a full 25 hours of recorded data. The data for.
the July 19 Denver-Chicago flight and the previous flights on the tape were
transcribed and examined for anything unusual in the Ni record for the No. 2
engine. All prior recorded engine parameters were normal.

24

The data revealed no evidence of RPM that exceeded the maximum
allowable limit of 111 percent Ni for flights prior to the accident flight. •
However, the data did reveal cyclic excursions in Ni within allowable values
on all three engines.

The FDR operated normally until ground impact, except for three
periods in which the data stream was interrupted and data were lost. The
first 1 ass occurred shortly after takeoff during a track switch within the
recorder. The second loss of 44 seconds of data occurred approximately
9 minutes before the No. 2 engine fa i1 ed. The third 1 ass occurred at the
time of the No. 2 engine failure, resulting in the loss of approximately
0.7 seconds of data. The FDR data showed thaf the No. 2 engine failed at
1516:10.

The FDR data for the conditions that existed just prior to the
No. 2 engine failure–the last data point before the failure–were:

Pressure Altitude
Indicated Airspeed
Total Air Temperature
Magnetic Heading
Pitch Angle
Bank Angle
Fan Speed, No. 1 engine
Fan Speed, No. 2 engine
Fan Speed, No. 3 engine
Vertical Load Factor
Longitudinal Load, Factor
Lateral Load Factor

1.12 Wreckage and Impact Information

36,991 feet
271. 25 knots
-17 degrees C.
82.27 degrees
2.812 degrees
20.04 degrees
102.86 percent4
102.69 percent
103.59 percent
1.0556 g’s
(+).0708 g’s
(-).0030 g’s

Farm residents in a rural area near Alta, Iowa, notified
authorities shortly after the accident to report that aircraft parts had
fallen in their area. The aft fuselage tailcone and No. 2 engine parts,
including one-half of the fan forward stator casing or containment ring and
numerous smaller pieces, were recovered in a relatively localized region the
day after the accident.

Also found near Alta soon after the accident were parts of the
tail engine adapter assembly, consisting of adapter ring and bellmouth
assemblies, an anti-ice pneumatic tube, a starter a; r tube, three cowl
hold-open rods, two hydraulic system accumulators from the No. 2
engine-driven hydraulic pumps, fan blade fragments, two pieces of insulated
metal braid-covered hydraulic hose clamped together, and a segment of
aluminum material broken out of the large structural “banjo” forging from the
airplane inlet duct structure. ·

4 speed is indicated as a percent of a rotor design reference speed. It
doe~ not indicate. a percent of a rated speed or rated thrust.

25

Infl ight photographs taken by observers on the ground near the
airport showed that, to the extent visible from the viewing location, the
No; 2 engine installation was still intact, except for the right fan cowl
door. The engine mounting beam, reversers, and the core cowl appeared
structurally intact prior to ground contact at the airport.

About 3 months after the accident, parts of the No. 2 engine fan
disk were found in . farm fie 1 ds near A 1 ta. There were two sect i ans that
constituted nearly the entire disk, each with fan blade segments attached.
These parts were initially taken to the GEAE facility in Evandale, Ohio, for
examination under the directiori of the Safety Board. The small segment was
later transported to the NTSB Materials Laboratory in Washington for further
evaluation. (See section 1.16, Tests and Research).

The recovery location of two pieces of the No. 2 engine stage 1 fan
disk assembly relative to the radar track suggested that the small segment of
the stage 1 fan disk assembly departed the aircraft to the left, and the
remainder of the fan disk assembly departed to the right. Trajectory
calculations for the separated fan disk assemblies predicted that, with the
northerly winds aloft, both pieces of the fan disk assembly would move to the
south of the aircraft ground track, where they were actually recovered. (See
figure 11). ·

About 9 months after the accident, farmers in the same area located
the front flange of the No. 2 engine rotor shaft and a large section of the
fan booster disk. These parts were later examined at the NTSB Materials
Laboratory and at other laboratories. (See section 1.16, Tests and
Research).

1.12 .1 Impact Marks and Ground Damage

The airplane’s right wing tip, right main landing gear, and the
nacelle for the No. 3 engine contacted the runway during the initial
touchdown sequence. The airplane tumbled as it continued down the runway and
broke into multiple sections. The airplane skidded off the right side of
runway 22 between taxiway “H” and runway 17/35 and through a soybean field.
Part of the fuselage and wing section wreckage came to rest in a corn field
adjacent to the west side of runway 17/35.

The empennage of the airplane came to rest on its right side
against the remaining stub of the right horizontal stabilizer on taxiway “L”
near the intersection of runway 4/22 and runway 17/35. Most of the inlet for
the No. 2 engine, some of the aft fuselage, a stub of the right inboard
horizontal stabilizer, and a part of the vertical stabilizer, just above the
engine inlet section, were intact. The separated vertical fin and rudder
were located on taxiway “L” just west of the empennage.

The wing center section was found in an inverted pas it ion in the
corn field and was partially. consumed by the postcrash fire. A major
portion of the left wing was still attached to the center fuselage. Most of
the outboard section of the right wing had separated during the breakup on
runway 22. The remainder of the inboard section of the right wing still

26

Alta Debris Field-Buena Vista County. f;
A Separation Point
e Debris Fleld I

– ~ Direction of Flight I
A E9 Stage 1 Fan Disk 8 A A N E S

Large Piece – ~ c1s 1-_+—-+–+—1–t§L-
e E9 Fan Disk Segment M36

•………………….. ~ . ….. …… ………… .. Expanded
—+–+—4—+—1—-1—–‘+-=.- Search Area-

31 32 33 !/
Rembrandt F

. a C25
—~~- 1–~– — — : — —

,,…— 1 ~ I B 5 .,-_:– __ _

_./:V A 1:1::1 –
Prime Search Area : 12 • 1 E9 • 9

I : ..

E L K l 13’136 111 ;::. 17 =·:~···· ..
!••·~ ,-

~–+–+—-:f.~ … ~–~—~—~-~—~–~—~—~-~ .. +.–l—~c29>-1-~–1–
M31 •

• 3

M31

• –

Alta flt’~
Scale: Sections are 1 mile square

8
I

SCOTT
I

TOWNSHIP

I I f
B

Truesdale r I

I
WASHINGTON

Figure 11.–Trajectory information/Alta debris field.

.. t.
I .,,

attached to the center fuselage was heavily damaged by ground impact. The
center fuselage section was extensively damaged.

The forward fuselage section, aft of the crew compartment, had
separated and was 1 ocated near the wing center fuse 1 age section. The crew
compartment wreckage was located east of runway 17 /35 along the main debris
path.

The left horizontal stabilizer separated into three main sections.
The pieces were found on the northwest side of runway 22. Two of the
sections were located approximately halfway between taxiway “H” and
runway 17 /35.

The right horizontal stabilizer had broken into a number of pieces,
which came to rest on both sides of runway 22. The largest piece recovered
was a 16-foot outboard section on the left side of runway 22. Most of the
leading edge was missing near the tip. Another large section containing the
right stabilizer midsection and portions of the inboard and outboard
elevators were recovered on the right side of runway 22 along the debris
path.

Portions of the No. 2 engine stage 1 fan blades·and stage 2 booster
blades were found embedded in aircraft sheet metal of the empennage, and two
No. 2 engine fan-to-shaft flange nuts were found lodged in the No. 2 intake
acoustic panels.

Four punctures on the vertical stabilizer were noted as probable
fragment damage prior to ground impact. Documentation of hole/puncture
damage to the horizontal stabilizers is contained in Appendix C. There were
79 punctures recorded from fragment damage and one large hole, about the same
size as the large piece of recovered fan disk. The flight control surfaces
were recovered in the aircraft wreckage and had varying degrees of damage
that could have occurred befor~ or after impact.

Examination of the interior of the empennage revealed that~ except
for the breached hydraulic fluid systems, there was no evidence of precrash
damage to the components comprising the flight contro 1 systems, hydraulic
systems, or the auxiliary power unit.

Due to extensive ground damage to the airplane structure,
continuity of the flight control systems after the accident could not be
established for all systems. All control system cables and system component
separations that were examined were typical of overload failures associated
with ground impact and aircraft breakup.

The extension of the horizontal stabilizer actuators were measured
and recorded. Their positions were equivalent to a position of 1° airplane
noseup. Measurements of other hydraulically powered flight control
actuators were not recorded. These actuators do not have mechanical locking
devices and are free to rest or float along with the position of their
attached control surfaces, when hydraulic pressure is absent.

28

·The No. 1 engine came to rest on the north side of runway 22 just
before the intersection of runway 17/35 and runway 4/22. The engine was •. _.,
located about 3,050 feet beyond the initial impact point of the airplane.
The fan cowling for the No. 1 engine had separated shortly after touchdown
and was in the soybean field to the left of runway 22 and beyond taxiway “I.”
The engine had impacted the ground at the 12:00 position 5 of the fan module,
crushing the forward fan stator case in an aft and radially inward direction
into the fan rotor blades. The fan blade airfoils were bent opposite to the
direction of rotor rotation.

The No. 3 engine came to rest on the west side of runway 17/35 near
the intersection of runway 17/35 and taxiway “L.” The engine was located
approximately 3,500 feet beyond the initial impact point of the airplane. It
had sustained severe ground impact damage. There was no evidence of
preimpact damage.

The No. 2 engine came to rest on taxiway “J” to the left of
runway 22. The engine was located approximately 1,850 feet beyond the
initial impact point of the airplane. It was extensively damaged during the
ground impact and from tumbling after it was severed from the empennage.

The upper portion of the aft fan case, upper struts, and the fan
frame were still attached to the gas generator core. The aircraft mount beam
was still attached to the forward and aft engine mounts. The upper halves of
the left and right fan reversers were partially attached at the aircraft
mount beam. The exhaust nozzle and centerbody, including the center vent
tube, were severely crushed forward into the turbine rear frame. The aft end -~-
of the turbine rear frame was also crushed forward over most of its
circumference. .,..

The high-pressure compressor cases, the compressor rear frame and
the turbine midframe were not visibly damaged. The left quadrant of the
upper and lower low-pressure turbine cases were bulging outward in the plane
of the stage 5 rotor blades. The stage 5 low-pressure turbine rotor blades
were only visible in small regions. In these areas, no contact was observed
between the stage 5 blades and the aft side of the stage 5 vanes. The eighth
stage bleed air manifolds that were attached to the lower case of the
high-compressor stator case were dented.

The aft end of the fan forward shaft, in addition to approximately
20 percent of the shaft cone wall section, remained attached to the engine.
Six fragments of the conical section were recovered at the accident site;
they represented about 75 percent of the fan forward shaft.

The entire aft fan case with attached fan frame outer struts was
recovered at the accident site. Approximately 95 percent of the aft fan
stator case was recovered, as wel 1 as about 90 percent of the stage 2 fan

5 All clock positions referred to in this report are viewed from aft
looking forward CALF). Viewed in this manner, fan rotation is clockwise.

29

(booster) inner outlet guide vanes. All of the booster support remained
attached to the engine, but the booster stator support was heavily damaged.

Seven sectors of the eight-sector booster midring shroud were
recovered at the accident site and contained approximately 60 percent of the
midring shroud assembly. All of the sectors were severely deformed and did
not show any corresponding evidence of a high-speed rub from the stage 2
booster blades. The shroud sectors displayed irregular rub marks and an
irregular rub track. One of the larger shroud sectors contained indentations
consistent with booster blade tip impressions radiating outward and forward
into the shroud. ·

Two full and one partial segment of the total of eight stage 1
outlet vane sectors were recovered at the accident site. The partial vane
sector contained only the inner band and was found within the left horizontal
stabilizer.

The No. 1 ball bearing on the CF6-6 engine is the largest bearing
in the engine and is the primary fan support bearing that carries the fan
rotor thrust. Fragments from the outer race of the failed engine No. 1
bearing and one bearing ball, in addition to fragments from the No. 2 roller
bearing and several intact rollers, were recovered at the accident site. The
ball and roller bearings, the raceways and their outer race fragments were
not visibly deteriorated and did not e.xhibit any visual evidence of
preaccident spalling or oil starvation.

. The fore and aft components of the No. 1 ball bearing housing
assembly were recovered at the accident site in front of the No. 2 engine on
taxiway “J.” Both housings (the forward housing was still attached to the
largest fragment of the aft housing) had been separated and deformed into a
“horseshoe” shape due to radial outward impact at the 1:00 position.

Two large pieces of one sector of the stage 2 disk assembly
(booster spool) were recovered at the accident site. One piece of the
assembly consisted of approximately 67 percent of the stage 2 disk’s
circumference. The other piece consisted.of about 32 percent of the forward
spacer arm.

El even fragments of stage 1 fan blades were recovered at the
airport either in the left horizontal stabilizer or on the ground. One fan
blade fragment containing the dovetail, platform, and inner airfoil section
(S/N AMO 11691) was recovered on the left side of runway 22 between the
initial touchdown point and the No. 2 engine position on taxiway “J.” It was
determined that it was from blade position No. 10.

Sections of 2 of the 20 fan disk/fan forward shaft retaining bolts ~
were recovered during a search of the accident site. The two recovered bolt
sections consisted of the shank and head ends only. The thread ends were ·
missing, and the fracture surfaces appeared to be typical of a combination of
shear/bending overload.

30

Three of the 20 fastener nuts for the fan disk/fan forward shaft
retaining bolts were recovered at the accident site. Two of these fan nuts ~.’q., ..

1
.

were embedded in the No. 2 engine inlet acoustic panels; the third was 9
recovered in the interior area of the right horizontal stabilizer in hole
No. 5.

The right and left core cowls had separated from the pylon at their
hinge points. The cowls were found 30 feet from the No. 2 engine and were
severely damaged by ground impact. The cowl halves were joined by the lower
latches; however, the aft hinge had broken.

The lower right half of the forward fan stator case {containment
ring) was recovered on the right side of runway 22, approximately 500 feet
beyond taxiway “J,” and in line wlth the direction that the empennage had
skidded after separating from the fuselage.

1.12.2 Reconstruction of Empennage

The aft fuselage and all identified pieces. of the empennage were
transported to a hangar at Sioux Gateway Airport for reconstruction {mockup).
(See figure 12). The aft fuselage was mourited vertically on a wooden
trestle with cables anchoring it to the floor and walls. Lines were strung
from the lower surface of the two horizontal stabilizers to the hangar walls

·to establish the dihedral angles for the horizontal stabilizer
reconstruction. The rudder and vertical stabi 1 i zer were not used in the
reconstruction of the tail. A wooden scaffolding was constructed to support
the larger piece of horizontal stabili

1
z
1
er structure, and a wire gridhwas usked •.. -…. -.·.

to support the smaller pieces. A ga ery was constructed around t e moc up
to aid examination.

Left Horizontal Stabilizer Damage.–All the holes attributed to
engine debris damage were examined, and no – evidence of severed lines or
significant leakage of hydraulic fluid was found.

Right Horizontal Stabilizer Damage.–The outboard elevator had been
broken and separated from the outer section of the horizontal stabilizer
between the actuator .and the inboard damper hinges. Forward of that, the
section was broken and had separated on a 1 i ne para 11 el to the aircraft
centerline from just outboard of the actuator. This section was about
16 feet long. The stabi 1 i zer had a 1 so separated along a. line from between
the mid- and inner hingei of the inboard elevator parallel with the aircraft
centerline to the leading edge of the stabilizer .

. There were three large holes found in the right stabilizer. One
hole, located at the outboard leading edge and oriented generally spanwise,
extended- aft to the front spar; this hole was one of the damaged areas
visible in the in-flight photograph taken during the airplane’s approach to
the airport. Considerable effort was expended to identify the source of this
damage; the damage has dimensions similar to the size of the large piece of
the fan disk and blades. However, no positive match could be made. A
second hole seen in the in-flight photograph was forward of the inboard
elevator. Flight control hydraulic components are in this area. The exact

31

.
:;)

°’ -00 -z:
~
0

c
0 ….
~
u
cu
en

-…. …
~

cu

l1
.c
~

~
0

c
0 ….
~
u
:::s
s..
~
en
c
0
u
~

N -cu
s..
:::s
en

32

size and shape of the hole could not be determined because of damage from the
ground impact and the breakaway of the stabilizer section outboard of the
inboard elevator actuator. A third hole was in the inboard elevator; there
are no critical components within this structure.

The remaining smaller holes were examined to determine if they had
been caused by engine hardware and. to verify elements of the aircraft
control systems that had been damaged. The diagram shown in appendix C was
prepared.

l.12.3 Damage to Inlet Duct and Vertical Stabilizer Spars (Banjo Frames)

Examination of the tail of the airplane revealed crash damage to
the front of the No. 2 engine inlet on the right side and top, and the left
side was· separated at 9:00. The No. 4 (aftmost) section of the banjo frame
was cracked through at 3:30; and the aft edge had separated and had a piece
missing from 2:30 to 4:00·. A portion of the missing piece was recovered from
a farm field in the region of Alta, Iowa, and matched the banjo frame from
approximately 3:30 to 4:00. The recovered piece was examined and found to
contain titanium alloy smears. The only titanium components liberated in
flight were from the fan section of the No. 2 engine.

•·’ .. , ) ..·

The longitudinal distance between the engine forward fan stator
case and the aircraft No. 4 banjo frame {about 17 inches) is bridged by an
engine inlet adapter assembly consisting of two cylindrical panels–the inlet
bell mouth, bolted to the front flange of the fan forward casing, and the
adapter ring. The assembly is designed to provide clearance to accommodate
displacement between engine and airframe. •.

Two pieces of the bellmouth assembly were recovered near Alta,
including the area of 7:00 to 12:00. A large portion of this bellmouth panel
was torn away at the bracket stations at 9:00 and 11:30. About 25 percent of
the inlet adapter ring was eventually recovered.

1.12.4 Hydraulic System Damage

During reconstruction of the empennage, it was noted that a portion
of the right hori zonta 1 stab i l i zer was not recovered at the Si aux City
Airport. A photograph taken from the ground prior to impact shows that this
section was missing before impact. The missing area contained the No. 1
hydraulic system tubing that supplies hydraulic fluid to the right inboard
and outboard elevator actuators. {See figure 13 and 14}.

A fragment of hydraulic tubing assembly with a nT-fitting” attached
was recovered from the runway and was i dent i fi ed as part of the · No. 1
hydraulic system. The tubing was bent, punctured, and showed evidence of
impact damage. Titanium alloy traces were identified on the tubing.
Adjacent tubing sections that mated with this “tee” segment were not found.

Examination of the empennage wreckage revealed that the No. 3
hydraulic system pressure line was severed in the inboard area of the right
horizontal stabilizer. Holes penetrating the stabilizer skins were found in

33

.
S-
eu
N –…. .c ,., ….,
en

-,., ….,
c
0
N ….
s-
o
~

….,
~
en ….
s-

‘+–
0

cu
u ,.,

‘+–s-
::s
en

Q.
0 ….,

‘to-
o

~ ….
> ..

::::>
0 -co -z:

I
I .

C”> –

t
FWD

Hydraulics 1

Elevator Actuator
(4 per airplane)

Not to Scale

Hydraulics 2

~

Engine
Nacelle

Hydraulics 2

Actuator Position

RH lnbd Elev
LH lnbd Elev
RH Outbd Elev
LH Outbd Elev

Area Missing
From Airplane

Rear Spar

. Closure
Spar

Hydraulic
System
1 & 3
2 & 3
1 & 2
1 & 2

Figure 14.–Nl819U, planform of horizontal stabilizer hydraulic system damage.

~
~ …. _ . t·· ,I –

w
~

1 .. ) i).
;,/. .

35

the upper and lower surfaces in the area of the severed line. The pressure
line was severed with a gap of approximately 2.5 inches. The return line
had penetrated the horizontal stabilizer and had separated from the adjacent
fitting. Material adhering to severed areas of the damaged hydraulic lines
of the No. 3 hydraulic system was identified by X-ray energy dispersion
examination as titanium alloy. The entry hole where the object passed
through the top skin and doubler was 5.5 inches by 2.25 inches and roughly
rectangular. The hole size did not match the dimensions of any piece of the
stage 1 fan disk; however, the hole s1ze and shape were comparable to the
dimensions of a fan blade base platform.

Portions of two insulated-braided hydraulic hoses were recovered
near Alta, Iowa, during the on-scene investigation. The hoses were joined by
an insulated clamp and were identified as a hydraulic supply and return hose
from an engine-driven pump. The hoses recovered near Alta were attached to a
No. 2 engine-driven hydraulic pump. Positive identification of the hoses by
part number could not be established. However, all supply hoses for the
No. 1 and No. 3 engines were accounted for in the wreckage at the airport .

. All three hydraulic system reservoirs were examined and found
empty. The system 1 and system 2 reservoirs and associated plumbing were
found intact and undamaged mounted in their normal positions. The system 3
reservoir and its associated plumbing were found intact with minor blackening
from fire damage in their normal positions in the right wheel well.

1.13 Medical and Pathological lnformation

Of the 296 persons aboard the airplane, 110 passengers and 1 flight
attendant were fatally injured. Autopsies revealed that 35 passengers died
of asphyxia due to smoke inhalation, including 24 without traumatic blunt
force injuries. The other fatally injured occupants died of multiple
injuries from blunt force impact. Of the remaining 185 persons onboard, 47
sustained serious injuries, 125 sustained minor injuries, and 13 were not
injured. (See figure 15).

l.14 Fire

There was no evidence of in-flight fire. A postcrash fire erupted
during the crash breakup of the airplane. A deep-seated fuel-fed fire took
place in the cabin wreckage.

1.14.1 Airport Response

The FM control tower advised the airport fire department of a
DC-10 in-flight emergency about 1525. A total of five ARFF vehicles were
dispatched. These units were assisted by four Sioux City Fire Department
vehicles, which were dispatched to the airport before the crash as part of
the community emergency response plan.

During the response, information relayed from the control tower to
these units indicated that the airplane might not reach the airport and that
it could crash approximately 5 miles south of the airport.

·.-11•.·~·–·ttM”‘C ·=== _M_.,DE*[email protected] ‘ ff a…-·-·•,..–
—··. ·- – ,.. • • ·- •”;-” ·-· .·:–:·~~- ·….:. …….. .:£ • .:..–“‘··· -~ •• : •• ·-··

….

.. -~ . – -.:-:-··· -.·

Ex.c … Ed Ed

w
Injury Legend 1 L.,___) Ol

f.ll Fatal 0 Minor
Ell Fatal (smoke inhalation) IB None
• Serious D Unoccupied seat

~ Approximate breaks in fuselage

*’In-lap occupants’

D11F D 14J

0 128 Ell 22E

Note:
Passenger who was
assigned seat 20H
moved to an unknown
seat.Bl

Figure 15.–Seating and injury information.

… l •

‘: (‘( ~
/ .. ~

37.

At 1547, the fire chief was advised by the control tower that the
airplane was going to reach the airport and that it would land on Runway 31.
Firefighting units immediately too.k positions along runway 31 and awaited the
arrival of the airplane.

At 1559, the control tower advised ARFF personnel that the OC-10
would land on runway 22 instead of runway 31. Further, the tower informed
the fire chief that some of his vehicles were aligned with the approach path
of the DC-10 and that they should be moved immediately.

. Before all units were repositioned, the airplane touched down,
began to break up, and a fire ignited .. The center section, which contained
the majority of passengers, was inverted and came to rest in a corn field
about 3,700 feet from the initial impact area.

After the crash, all ARFF vehicles proceeded to the intersection of
runways 22 and 17, and the fire chief radioed the 185th Tactical Fighter
Group Command Post directing all available personnel and equipment to respond
to the accident scene.

About 1601, after briefly inspecting the tail section of the
airplane, the fire chief directed all units to proceed to the center section
of the airplane. While responding to this location, some passengers were
found in their seats· and others were walking along runway 17.

A significant fire was burning, mostly on the exterior of the
wreckage. The fire chief learned from exiting passengers that other
passengers could be located among the cornstalks, which were approximately
7 feet high. The emerging passengers later stated that they were disoriented
by these tall cornstalks. ·

The first ARFF vehicle to arrive at the scene sprayed a massive
application of foam to blanket the surface of the inverted center section.
The fire chief reported that the foam application could eas i 1 y reach the
right wing. Some passengers reported that they were sprayed with foam while
exiting the airplane.

The fire chief reported that the fire was located primarily
underneath the right wing box area and along the front portion of the
fuselage. He said that the 10- to 12-knot wind from the north helped to keep
the fire away from the fuselage.

About 1604, the first vehicle to arrive on the scene had exhausted
its onboard water supply. By this time, a second vehicle had arrived and
commenced a mass application of foam. A 1-inch hand 1 ine from the· second
vehicle was used to attack the right wing box area that could not be reached
by the foam. ARFF personnel reported that the hand line attack helped
protect passengers exiting from the front portion of the airplane wreckage.
About 1610, the second vehicle also exhausted its water supply.

At 1610, while these firefighting operations were in progress, a
third unit, a Kovatch P-18 water supply vehicle was brought into position to

: ‘

. :1
d

‘q

‘ ‘.


!

. i ~
‘I

~.. !
.~ !

,.•
!’

38

resupply the other two units. ·water supply lines were connected but, because
of a mechanical problem, the P-18 was unable to pump any water to the other
vehicles. Consequently, the P-18 was disconnected and, at 1618, Sioux City
Fire Department pumpers were positioned to replenish the two primary
vehicles. By ·that time, the fire in the area of the right wing had

.intensified, spreading to the interior of the airplane. Jhe fire intensified
until approximately 1700 and was not brought under control until
approximately 2 hours after the crash. Spot fires persisted throughout the
night. The fire was suppressed after the application of a total of
15,000 gallons of water and 500 gallons of extinguishing agent.

1.14.2 ·Off-Airport Response

Following notification by the FAA control tower at ·1525, the
Woodbury County Communications Center in Sioux City began notifying community
emergency response organizations. Community agencies included the Sioux City
Fire Department (SCFD) and the Police Department, the Woodbury County
Disaster and Emergency Services, and county/state law enforcement personnel.
Responding units included two engine companies and a command vehicle from the
fire department and an ambulance from Siouxland Health Services.

At 1534, when the control tower relayed to these units that the
airplane would land about 5 miles south of the airport, the vehicles
responded by traveling south of the airport on Interstate 1-29. At 1538,
when the fire chief learned that an attempt was being made by the DC-10 to
land on runway 31, the responding SCFO units proceeded to the airport and
took a position on a nearby bridge at the 1-29 Sergeant Bluff exit to the
airport. Abo’ut 1547, the SCFD emergency responders were advised that the
airplane would land on runway 31. The SCFD on-scene commander directed all
units to proceed to the airport command post security staging area .

Following the crash, the SCFD assisted fire and rescue efforts. At
1625, the SCFD Fire Chief became the Site Commander. After the magnitude of
the accident became apparent, the call for all available ambulances was made
at 1604. Thirty four ambulances responded from more than 28 agencies, some
as far away as 60 miles. Additionally, a total of nine helicopters were
provided by Marian Air Care and military units from Lincoln, Nebraska, and
Boone, Iowa. By 1730, all victims had been transported from the airport to
the two local hospitals.

1.14.3 The Kovatch P-18 Water Supply Vehicle

When a restriction developed in the P-18’s tank-to-pump hose, all
water flow stopped to the two ARFF vehicles. Thus, the airport’s primary
firefighting vehicles could not be replenished to continue attacking the

. fire. The P-18’s tank-to-pump suction hose assembly was removed for further
examination.

The examination disclosed that the 2-inch long internal
polyvinylchl oride (PVC} stiffener instal 1 ed in the hose had rotated
laterally goo. Kovatch representatives stated that the internal stiffener in
the soft hose ass~mbly is required to prevent the hose from collapsing. They

. l~.
‘I’ ~

I
-~

~;; ‘)·.·. ‘·”) ,….-

~.

J

39

also stated that the stiffener was installed by a press fit in the center of
the hose.

In examining the susceptibility of the internal stiffener to
displace and rotate, the Safety Board found that the stiffener’s length was
about one-half the internal diameter of the soft suction hose. Because of
the small size of the stiffener and because it was not clamped, it was free
to rotate #and block the flow of water or even to slide toward the pump
intake, making the soft suction hose susceptible to collapse.

1.15 Survival Aspects

The largest intact section of the airplane was the center portion
of the fuselage that contained seat rows 9-30 and the flight attendant
jumpseats at doors 2L, 2R, 3L, and 3R. This section came to rest inverted in
a corn field and was eventually destroyed by the postcrash fire. The
ceiling structure collapsed throughout the fuselage, and the greatest amount
of collapse was in the area of the left wing. Thirty-three of the 35
occupants who died from asphyxia secondary to smoke inhalation were in the
section of the fuselage containing rows 22-30. Two other occupants in seats
14A and 160 died of asphyxia due to smoke inhalation.

The tail and a portion of the rear cabin containing 10 passenger
seats and 2 flight attendant jumpseats separated early in the impact
sequence. With the exception of the tail section, the cabin aft of about
row 31 was destroyed by impact.

The cockpit area separated from the fuselage just aft of doors IL
and IR and was substantially damaged, but the shoulder harnesses and 1 ap
belts remained intact and restrained the four occupants who were extricated
by ARFF personnel. Most of the first class cabin section was destroyed.

1.15.1 Cabin Preparation

The flight attendants were serving a meal when the No. 2 engine
failed. The senior flight attendant was called to the cockpit and was
instructed by the captain to secure the cabin and prepare for an emergency
evacuation. She did not ask the captain for the amount of time available
until the airplane would land. In a later interview, she said that she did
not request this information of the captain because she thought the
fl ightcrew was too busy. The senior flight attendant returned to the cabin
and separately instructed six of the seven flight attendants to stow food
service items and to secure the cabin in preparation for an emergency
landing. · She related that she did not notify the passengers because she
wanted to keep things “normal” as long as possible and did not want to alarm
them.

The senior flight attendant related that she was told by the second.
officer, after he had gone to the rear of the cabin and observed damage on
the tail, that the passenger briefing was going to be a “quick .and dirty.”
[This comment refers to the abbreviated passenger briefing in lieu of a

. longer and more detailed briefing.] The flight attendant stated that when

. ‘ 1:
; i
: I

‘.I
I

:!

40

she received this information, the flight attendants in the aft cabin were
still retrieving meal trays. . Survivors related that the captain’s
announcement to the passengers at 1545 stated that the flight attendants had
briefed the passengers about the brace position. However, the passengers had
not’ yet _been .briefed about the emergency cabin preparations. The senior
flight att~ndant began reading the “Short Notice Cabin Preparation” briefing
after the ~aptain concluded his announcement.

The Short Notice Emergency Landing Preparation directed flight
attendants to be. seated in their jumpseats. However, the flight attendants
were standing at their demonstration positions when the briefing was read;
they subsequently assisted passengers in their briefing zones. Flight
attendants gave brace-for-impact instructions to parents of i~fants and small
children. They assisted small children in passenger seats by providing
pillows as padd.ing to tighten adult lap belts. For example, a 32-month-old
boy seated in 17G was given pillows to tighten his seat belt. He remained
restrained during the impact sequence and was not injured. _

All of the flight attendants and passengers were in a brace-
for-impact position when the airplane landed.

1.15.2 Infants

There were four -in-lap occupants onboard flight 232. 6 Three of
them were under 24 months, and one was 26 months old. During the
preparations for the emergency landing, parents were instructed to place
their “infants” ‘on the floor and to hold them there when the parent assumed
the protective brace position. The four in-lap occupants were held on the
floor by adults who occupied seats llF, 128, 14J and 22E.

The woman in 14J stated that her son “flew up in the air” upon
impact but that she was able to grab him and hold onto him. Details of what
happened to the 26-month-old child at 128 during the impact sequence are not
known, but he sustained minor injuries. The mother of the 11-month-old girl
at llF said that she had problems placing and keeping her daughter on the
floor because she was screaming and trying to stand up. The mother of the
23-month-old at 22E was worried about her son’s position. She kept asking
the flight attendants for more specific instructions about the brace position
and her “special situation with a child on the floor.” The mothers of the
infants in seats llF and 22E were unable to hold onto their infants and were
unable to find them after the airplane impacted the ground. The infant
originally located at llF was rescued from the fuselage by a passenger who_
heard her cries and reentered the fuselage. The infant held on the floor in
front of seat-22E died of asphyxia secondary to smoke inhalation. The Safety
Board addressed the infant restraint issue in Safety Recommendations A-90-78
and A-90-79 issued May 30, 1990.

614 CFR 121.311 allows- occupants who have not reached their second

birt~day to ~j h~ld in the laps of an adult.

-«–;, ·-·
‘ _,


~—-

l.

” -}.··.·.·. ‘ ;:~ I .
.,;/

l’ .J· ., .. ~r

41

1.16 Tests and Research

1.16.1 Design of CF6-6 Engine Stage 1 Fan Disk

Figure 16 shows a drawing of a CF6-6 engine fan rotor assembly,
most of which departed the No. 2 engi n.e of the accident airplane i nfl ight.
The assembly consists of the large stage 1 disk and attached fan blades and
retainers, the smaller stage 2 disk and attached blades, the spinner cone
and cover, and various mounting and balancing hardware. A cutaway view of
the engine in the area of the stage 1 disk is shown in figure 17.

. The stage 1 fan disk weighs 370 pounds and is a machined titanium
alloy forging about 32 inches in diameter. GEAE convention refers to various
portions of the disk as the rim, the bore, the web, and the disk arm, as
labeled in figure 17. The rim is .about 5 inches thick and is the outboard
portion of the disk. The rim contains the axial “dovetail” slots, which
retain the fan blades. Also, the stage 2 fan disk is bolted t~ the aft face
of the rim. The bore is about 3 inches thick and is the enlarged portion of
the disk adjacent to the 11-inch-diameter center hole. Extending between
the rim and. bore is the .disk web, which ·is about 0.75 inch thick. The
conical disk arm extends aft from the web at a diameter of about 16 inches.
The conical arm diameter decreases in the aft direction to about 10 inches at
the disk arm flange where the disk bolts to the fan forward shaft (also
labeled in figure 17).

The primary loads imposed on the stage 1 fan disk are radially
outboard loads in the dovetail slots. These loads arise from the disk
holding the fan blades against centrifugal forces during rotation of the
assembly. The loads imposed by the fan blades result in radial stresses in
the disk rim. The radial stress generally decreases toward the bore and are
supplanted by circumferential {hoop) stresses. Radial stresses are zero at
the bore because there is no material inboard of this location to resist the
stress. However, the hoop stresses are greatest along the inside diameter of
the bore. Because the disk arm acts to strengthen the aft face of the disk,
the area on the disk that experiences the maximum hoop stress is the forward
corner of the bore.

l.16. 2 Examination of No. 2 Engine Stage l Fan Disk

In mid October 1989, about 3 months after the accident, two pieces
of the No. 2 engine stage I fan disk, with attached blade pieces, were found
in corn· fields near Alta, Iowa. The two pieces comprised the entire
separated disk, with the exception of one dovetail post, which was not
recovered. Figure 18 shows the reconstructed pieces of the disk after the
larger disk piece had been cut during the metallurgical evaluations. The gap
between the smaller and larger piece does not represent missing material but
is a result of mechnical deformation that occurred during the disk
separation. The disk contained two principal fracture areas, resulting in
about one-third of the rim separating from the remainder of the disk. One of
the fracture areas progressed largely circumferentially through the web ·and

·rim. The other was on a near-radial plane, progressing through the bore,
web, disk arm, and rim. Features on the circumferential fracture were

; ~
:.1

·:i
; l

; :

~ ~
; i
. !

. ~ :
! ‘ •I
; i ..
; ‘

Spinner cover

42

~E’– Stage 1 blade

Disk arm

……-~;=+J~-~r– Bore

NOTE:Stage 1 fan disk
highlighted

Figure 16.–Fan rotor assembly.

f l; ·’, .i _,,

t

. ~r-;}· .. ,_
~ ·. .

.j ~· ~~ … )
i .·’.

10.2″

43

….,….._ __ Fan Blade —“I~

Forward

5.56”
Shaft C/L

t
Figure 17.–CF6-6 engine stage 1 fan disk cutaway view – disk highlighted .

44

CV

ii’
~
en
CV
c: ….
C’>
c:
Cl)

N .
0
:z

I
I .

co –
CV
s..
~
C’> ….

Lt..

))
.·.

,.. ~/

I

I I

45

typical of an overstress separation stemming from multiple origin areas in
the radius between the disk arm and the web. The near-radial fracture
surface also contained overstress features over most of its surface.
However, on this break the overstress features stemmed from a preexisting
radial/axial fatigue crack region in the bore of the disk. Figure 19A shows

·the fatigue region on the bore. ·

Metallurgical evaluation revealed that the fatigue crack initiated
near a small cavity on the surface of the disk bore, about 0.86 inch aft of
the forward face of the bore. Figure 198 is a close view of the cavity. A
portion of the fatigue crack around the origin area was slightly discolored ..
The topography of the fracture surface in the fatigue zone was the same
outside the discolored area as it was inside the discolored area. The
following table lists overall sizes of the fatigue crack, the discolored
area, and the cavity. ·

fatigue zone
discolored area
cavity

Axial length

1.24 inch
0.476 inch
0.055 inch

Radial Depth

0.56 inch
0.180 inch
0.015 inch

The width of the cavity (measured across both mating fracture.
surfaces) also was 0.055 inch.

Fractographic, metallographic, and chemical analysis examinations
of the fatigue region revealed the presence of a nitrogen-stabilized hard
alpha inclusion around the cavity. The microstructure of the core of the
inclusion consisted of stabilized-alpha structure (structure with an elevated
hardness, excessive nitrogen, and devoid of transformed beta structure) that
extended slightly outboard of the cavity (to a maximum radial depth of
0.018 inch from the inside diameter of the bore} and over an axial length of
at least 0.044 inch. Altered microstructure associated with the inclusion·
extended significantly beyond the area containing only stabilized alpha
structure, gradually blending into the normal microstructure, a mixture of
approximately equal amounts of alpha structure and transformed beta
structure.7 The altered microstructure region was elongated in the axial
direction (along the local grain flow direction), but primarily aft of the
stabilized-alpha region.

The stabilized-alpha inclusion contained microcracks that were
generally oriented parallel to the cavity surface. Also, microporosity was
found in the altered microstructure around the core of the inclusion.

The mating fatigue regions on the pieces of the separated stage 1
fan disk were subjected to scanning electron microscope examinations. Some
areas of fatigue striations were found just outboard of the stabilized-alpha

7 Alpha and beta are n~mes given to two differing microstructural phases
in titanium alloys. In Ti·6A1-4V, these two phases are present in
approximately equal amounts.

46

c

Figure I9A.–Fatigue crack fracture ar’ea cut from the bore of the smaller
piece of the separated stage 1 fan disk. The fatigue crack extends from the
cavity Jar.row “C”) to -the dashed line position. The discolored portion of
the fatigue crack is between the cavity and the dotted line. Magnification:
2.26X.

•’ .·

c

Figure -198.–Closer view of the discolored area on the fatigue crack. The
dotted line in this figure corresponds to the dotted 1 ine in figure 19A.
Arrowheads on the fracture surface indicate cracking directions away from the
cavity. Magnificatio.p: 8.6X.

‘ ‘

) . .

47

portion of the inclusion at the fatigue origin. However, between the cavity
bottom and a radial distance of 0.025 inch outboard of the bore surface,
areas with brittle fracture features and a lack of fatigue striations were
found intermixed among more ductile-appearing bands with fatigue striations.
The zone with a mixture of brittle features and fatigue striation areas
correlated with the enriched alpha microstructure surrounding the
stabilized-alpha core of the inclusion.

·The fatigue striation spacing generally increased as distance from
the origin area increased. However, starting at a distance of about
0.145 inch outboard of the bore surface, areas with much more closely spaced
striations were also found. The more closely spaced striations were referred
to as minor striations, and the striations with wider spacings were referred
to as major striations.

The total number of major striations along a radially outward
direction from the origin area .was estimated by graphically integrating ·a
plot of the striation density versus distance. · The e.stimate correlated
reasonably well with the total number of takeoff/landing cycles on the disk.
The striations indicate fatigue crack growth since early in the life of the
disk.

1.16.3 Examination of Containment Ring

The fan forward stator case (containment ring) is 86 inches in
diameter and has an axial length of 16 inches. It is a stainless steel hoop
that surrounds the stage 1 fan disk blades. The ring is designed to absorb
energy on the order of that associated with rel ease of one fan blade and
adjacent damage.

The containment ring from the No. 2 engine was separated at the
1: 45 and 7: 30 positions. The upper-1 eft piece of the ring departed the
airplane in flight and was recovered near Alta. The lower right half of the
ring remained with the airplane and was recovered at the wreckage site at
Sioux City.

Examination of the 7:30 separation area on the ring pieces revealed
deformation and fan blade retainer witness marks that indicated that the
smaller piece of the stage 1 fan disk burst through the ring at this
location.

Examination of the containment ring separation at the 1:45 position
revealed features typical of a tensile overstress separation.

1.16.4 Other No. 2 Engine Hardware

Metallurgical examination of the pieces of the fan forward shaft,
the booster disk, the No. 1 ball bearing and bearing support, and other
components of the engine revealed fractures and deformation consistent with
initial separation of the stage 1 fan disk. The damage patterns on these
components and the containment ring indicated that the smaller piece of the

,:
I

i
.l
I

.1

.1

·,1

~ ·.

;

;•

i’.:
‘ .·,

·•· :i;

,,

i.
r,
j:
! ~ .

!

‘!
•l

48

disk departed the airplane to the left and the larger piece departed to the
right.

1.16.5 Sister Fan Disks

GEAE and ALCOA records indicate that eight fan disks were produced
from the same titanium ingot as the separated fan disk. Six of these fan
disks {S/N MPO 00382, 00383, 00384, 00386, 00387 and 00388) were in service
at the time of the accident and they were recalled to GEAE for testing. The
tests consisted of immersion-ultrasonic and surface macroetch. The results
of these studies indicate that fan disks No. MPO 00388 and MPO 00382 had
rejectable anomalies, as follows: ·

Fan Disk Serial Number MPO 00388 – Fan disk S/N 388 contained
a reject able ul trason 1c indication found by means of
immersion-ultrasonic in the web area of the disk. Macroetch
indications were noted in the web area coincident with the
ultrasonic indication. In addition, macroetch indications
were identified in the bore and spacer arm flange area.
Metallurgical evaluation of the ultrasonic indication revealed
the presence of a nitrogen-stabilized hard alpha inclusion
similar to the inclusion found at the origin of the fatigue
crack on the separated disk, S/N MPO 00385. The area
containing this hard alpha inclusion displayed multiple
microcracks oriented in various directions. There was,
however, no evidence of fatigue crack propagation from this
area. The coincident macroetch indications were determined to
be areas of chemical segregation within the disk and displayed
local chemistries not in conformance with the GEAE material
specifications.

Fan Disk Serial Number MPO 00382 – Immersion-ultrasonic
inspection of fan disk S/N 382 was completed without any
rejectable indications being detected. The separate
ultrasonic inspection of the dovetail posts revealed no
rejectable indications. However, the blue etch anodize
macroetch inspection detected indications typical of
chemically segregated areas. A light etching indication
approximately 0.65 by 0.060 inch extended between two bolt
holes on the forward face of the disk arm flange. A second
indication area composed of two small, thin, dark etching
indications (0.38 inch and 0.25 inch) was observed on the aft
face of the disk arm flange.

Fan Disk Serial Numbers MPO 00387 and MPO 00383 – Fan disks
S/N 387 and S/N 383 completed the immersion-ultrasonic
inspection and macroetch inspect ion procedures without any
defect indications noted.

Fan Disk Serial Number MPO 00386 – Immersion-ultrasonic
inspection of this fan disk showed several indications below
the rejection limit. The indications were situated near the

t

•:· … j
I:·.~ .. . ··i /7., …

1.16.6

49

forward face of the disk bore. However, a macroetch
inspection of disk S/N 386 and a metallographic evaluation of
the indication area revealed no· evidence of material flaws.
The ultrasonic indications fa this disk are consistent with
prior cases where no material fl aw was found on subsequent
destructive evaluation.

Fan Disk Serial Number MPO 00384 – This disk completed the
dovetail post ultrason 1c inspection and part ia 11 y comp 1 eted
the immersion-ultrasonic inspection prior to being sectioned
to evaluate the disk forging grain flow and microstructure.
No indications were detected with either ultrasonic procedure.
Blue etch anodize (BEA) macroetch inspection of the disk,
accomplished after sectioning, did not reveal any indications
typical of chemical segregation, but areas on the pressure
face of three adjacent disk posts were characterized as
typical of microstructure overheated during forging.

No. 2 Engine Fan Disk Fracture Surface Chemical Residue Examination

Analytical procedures were developed to examine the smaller piece
of the disk to determine if chemical residues from the UAL inspection with
FPI were present on the fatigue fracture surface. The fracture surface was
gently washed initially with deionized water and later with an ultrasonic
washer using deionized water. Secondary Ion Mass Spectroscopy (SIMS)
measurements on the fatigue fracture surface after the initial washing showed
an ion fragmentation pattern that was consistent with chemical compounds used
in the FPI fluid, ZL-30A. These compounds were identified as 2-ethylhexyl
diphenyl phosphate, decyl diphenyl phosphate, and triphenyl phosphate.

Gas chromatograph (GC)/mass spectroscopy (MS) measurements of the
hexane extract of the water used in the ultrasonic washing indicated the
presence of triphenyl phosphate and 2-ethyl hexyl di phenyl phosphate in the
wash water. The presence of these two compounds was confirmed by GC
retention time and by electron impact and chemical ion impact mass
spectroscopy. Triphenyl phosphate, 2-ethylhexyl diphenyl phosphate, and
decyl diphenyl phosphate are present in Santicizer 2024 which is used in the
FPI fluid, Z-30A {used to inspect the disk). Engine oil, which contains
tritolyl phosphate, was eliminated as a source of the chemical residues on
the fracture surface. This phosphate, used as an oil additive, produced a
mass spectrum that was different from that of the Santicizer 2024.

1.17

1.17.1

Additional Information

Fan Disk Manufacturing Processes and Hard Alpha

There are three primary steps in the manufacturing of titanium
alloy fan disks–material processing, forging, and final machining. In the
first step, raw materials are combined in a heat (quantities of alloy source
materials melted at the same time; heats are numbered for recordkeeping
purposes} and processed into a titanium alloy ingot (after the final melting
operation, the heat of metal is referred to as an ingot}. The ingot

.i;

,;, .

. ;
i

:: i
‘I

. ‘ ~
:! ‘ ~
‘i

~ j 1

· .. :;
… ‘·

,.
f:

50

is formed during furnace melting operations. The,ingot is then reformed into
a billet (an 1ngot after it is mechanically elongated and reduc~d. in
diameter) for further processing~ The second step involves cutting the
billet into smaller pieces (forging blanks) that are then forged into
geoqietrical shapes. The last step involves machining the forged shape into
the final part shape.

Titanium alloys can exhibit three major types of melt-related
anomalies: 1) Type I hard al.pha inclusions, 2) high-density inclusions, and
3) segregation (Type II alpha segregates or beta flecks).

Most of the Type I hard alpha inclusions observed in production
materials result from localized excess amounts of nitrogen and/or oxygen that
have been introduced through atmospheric reactions with titanium in the
molten state. A typical hard alpha inclusion contains an enriched alpha8
zone in the alpha plus beta matrix; voids or cracks are commonly associated
with the hard, brittle alpha phase inclusion. Hard alpha inclusions have a
melting point significantly greater than the normal structure.

To promote melting or dissolution of hard alpha inclusions, it is
desirable either to increase the temperature of the molten pool in the
furnace or to increase the time during which the material is in a liquid
state. Successive melting operations, such as double or triple vacuum
melting, provide additional opportunities for dissolution of hard alpha
inclusions but do not guarantee their complete dissolution.

Over the years, research has shown many potential sources for hard
alpha inclusions in traditionally processed titanium materials. The major
sources of these inclusions are considered to be: 1) contaminated input
materials (sponge material exposed to a fire, or torch-cut. revert material
that has been insufficiently cleaned to remove the torch-cut surfaces),
2) contaminated weldjng operations, such as welding of electrodes or
electrode holders/stubs, 3) improper conditions during the vacuum melting
cycle, including possible drop in of contaminated material or furnace
leakage, and 4) inadequate cleaning of the surface of the solidified ingot,
particularly after the first melt.

In 1970 and 1971, as a result of separations of titanium alloy
rotating engine parts with hard alpha inclusions, GEAE teams visited domestic
and foreign titanium melting sources, titanium sponge producers, master alloy
producers, and forging sources to determine possible improvements to process
parameters and controls. Typical items reviewed by the teams included
electrode welding, sponge processing and inspection, revert material control,
master alloy production, and melting controls. According to GEAE,
qualification of all titanium melters to meet new specifications for premium
quality triple-vacuum-melted titanium forgings was accomplished in 1971.

8 Areas with a significant amount of alpha phase are referred to as
alpha-rich areas or as an alpha inclusion. If the element causing the
excessive alpha phase is nitrogen, hardness is increased and the resulting
brittle area Is referred to as a nitrogen-stabilized hard alpha Inclusion.

~~ ••

(

~·l. /)’·
‘ :: • f I ~~
-:.

~·.

51

Also in 1971, the CF6-6 stage 1 fan rotor disk engineering drawing
was changed to specify premium quality triple-vacuum-melted Ti-6Al-4V. All
the fan disks manufactured after January 1972 were made in accordance with
the new triple-melt material requirements.

The current revision of the GEAE specification for fan disk ·
material contains an additional class of material that allows material to be

….. melted ·by hearth melting, plus vacuum-arc remelting (VAR) processes. This
newly introduced hearth melting process is intended to significantly increase
the probability of the dissolution of any hard alpha inclusions that are
present in the raw material.

Billet diameter for use in forging fan disks was reduced from the
Hi-inch diameter used. by ALCOA to produce fan disks in 1970 and from the
13-inch and 14-inch-billet diameter subsequently used by Wyman Gordon to
produce th.ese components. Current bi 11 et diameter specified for CF6 model
engine fan disks is 10 inches. This smaller diameter allows a more sensitive
immersion-ultrasonic inspection of the billet. Also, according to GEAE
personnel, the small er bill et diameter may increase the propensity during
forging for ·cracks or voids to form around hard alpha inclusions, thereby
increasing the likelihood that defects can be detected during subsequent
ultrasonic inspections.

1.17 .2 ALCOA Forging and Records

At the time the accident fan disk was produced, titanium alloy
ingots/billets were manufactured by several companies, including Titanium
Metals Corporation (TIMET) and Reactive Metals Incorporated (RMI).

Records indicate that the separated fan disk involved in the
accident was forged by Aluminum Company of America (ALCOA). ALCOA had
subcontracted with Titanium Metals Corporation of America (TIMET) to supply
raw material in billet form. GEAE specifications at that time required
double-vacuum melting of the ingot. ALCOA was also processing titanium alloy
billets from RMI and other suppliers.

ALCOA records show that the heat from which fan disk serial number
MPO 00385 originated was TIMET heat number K8283,· melted on February 23,
1971. Shortly after heat K8283 was produced, GEAE changed its material
specification to require triple-vacuum melting. This change went into effect
at s·uch time that disks manufactured from heat K8283 were the last CF6-6
stage 1 fan disks produced from material made using the double-melt process.

TIMET records indicate that heat K8283 was made primarily from
titanium sponge. Also included in the heat was recycled Ti-6Al-4V alloy,
ends of other heats, and other alloy elements. TIMET used Lake Mead water,
which contains a significant sulfur content, to process titanium at its
Henderson, Nevada, facility. The use of this water reportedly results in
titanium material with sulfur levels higher than the levels in titanium made
by other producers. TIMET also used a phosphoric acid cleaning procedure
that reportedly introduced phosphorous into its titanium in amounts
significantly greater than the amounts of other producers.

” ·;1
·i!!
·:!.

·’.;j’
-.!,,

ti
• ‘ ~ 1

•:!I

·::I

“i

!:

;.;.·

52

Melting of the heat K8283 ingot was accomplished using the
double-vacuum-melting process. In this process eJectrodes, consisting of
welded titanium briquettes of the required final composition, are melted in a
vacuum chamber by striking an arc to the electrode. After the initial
melting, the ingot is allowed to cool, then is removed from the melt chamber,
inverted and remelted using the same method. After the second melting, heat
K8283 ingot was 28 inches in diameter and weighed approximately 7,000 pounds.
The ingot was then shipped to the Toronto, Ohio, TIMET facility for
conversion to a 16-inch-diameter billet form.

A 11 the bi 11 et surfaces were ground, and the ingot was contact
ultrasonic inspected per written TIMET procedure. Based on the results of
TIMET’S ultrasonic inspection, the top 6.5 inches of material from the billet
was removed and discarded, and the remainder of the bi 11 et was accepted as
having passed ultrasonic inspection.

The entire billet product, net weight.6,208 pounds, including top
and bottom test slices, was shipped to ALCOA, Cleveland, Ohio, along with
certificates of tests, certifying the acceptability of the materials to the
requirements of the GEAE specifications. The TIMET sales order to.ALCOA was
dated March 26, 1971.

ALCOA records show that this heat of material was assigned a lot
number, and eight forging blanks, each weighing approximately 700 pounds,
were cut from the billet. The blanks were identified from the top to the
bottom of the billet as serial numbers 599-1 through 599-8, corresponding to
forging serial numbers AJV 00381 through AJV 00388.

It has been many years since ALCOA was involved in processing fan
disks for GEAE. Records retained at ALCOA did not provide information on
how the material’s traceability was maintained through the preforming steps,
blocker forging, finish forging,. heat treatment, and machining. Visits to
the facility indicated that information on the shop traveler records was
correlated to marker crayon indications on the parts as a method to separate
lots during processing.

ALCOA forging processes required that a test ring be removed at the
bore location of each forging and tested to certify that the room temperature
tensile strength and notched stress rupture life met · requirements. ALCOA
typically certified microstructure, alpha phase, and hydrogen content on one
forging from each process lot. Test values for the forgings certifying
acceptable tests to the requirements of GEAE specifications were required to
be provided by ALCOA to GEAE. These records could not be located during the
Safety Board’s records exam.ination, nor were they required to be ret~ined for
this length of time. ALCOA records indicate initial shipment to GEAE of
forgings from heat K8283 in May 1971.

During the accident investigation, ALCOA provided a listing of all
CF6-6 fan disks manufactured, showing the heat numbers and serial numbers.
This list was used, in conjunction with the listing provided by TIMET, to
identify heats of Ti-6Al-4V that contained raw materials from the same
feedstocks as heat K8283.

~ •.. -,

(

‘J:-, •’·) ~~~ ‘ ff’. . ‘
~} ~ ( ‘
.l~ . .

… ,.
‘ ‘ ;1 ;I , ..

53

1.17 .3 GEAE Fan Disk S/N ~PO 00385 Machining and Finishing Records

During the records search for the manufacturing routing package of
stage 1 fan disk S/N MPO 00385, it was learned that two rough machined
forgings9 (referred to as disk “A”. and “B”) having this same serial number
had been routed through GEAE manufacturing. Actual receiving documentation
at GEAE could not be located. Figure 20 depicts the three shapes of the disk
during the manufacturing process.

Production records indicate that GEAE performed an
immersion-ultrasonic inspection of a disk S/N MPO 00385 (disk “A”) on June 7,
1971. The record of inspection is dated June 23, 1971. The. part was
rejected for an unsatisfactory ultrasonic indication. Under procedures in
effect at the time, it should have been put aside in a specified storage area
pending disposition. No other manufacturing records were found that
documented a disk Serial No. MPO 00385 in the manufacturing process between
June and September 1971. Correspondence and shipping records indicate that
disk “A” was shipped on January 7, 1972 to an outside ultrasonic test
laboratory,- CONAM Inspection, Inc., Columbus, Ohio. GEAE sought an
independent verification of the ultrasonic indication. The existence,
location, and amplitude of the ultrasonic indication were verified by CONAM.
Records from the two inspection sources are provided in the following table.

Comparison of Ultrasonic Inspection Results,
. S/N MPO 00385

Inspection Site

Date on Insp. Record

UIS Indication

Dist. From Aft Flg.
Clock Pas. from S/N
Depth
Circumf. Length
Signal strength

(at 12 dB)
Angle, radial shear

GE

6/23/71

4 inches
11:30 o’clock
2-3/4 inches
3/8 inch
50% of max.

20°

CONAM

1/31/72

4. inches
11:30 o’clock
3-1/4 to 3-7/16 inches
3/16 inch
603 of max.

CONAM shipping records showed that disk “A” was returned to GEAE-
Evendale on January 31, 1972. It remained at GEAE and was reportedly
scrapped and cut up for examination on November 1, 1972. Records of
sectioning and microscopic examination of the ultrasonic indication disclosed
only macrostructural features in the area of the indication. No evideMce of
a hard alpha inclusion, or other defect was found. There is no record of any

9 ro facilitate discussion within this Safety Board report, the first
disk SIN MPO 00385 to appear in the records is described as disk “A.” The
jecond disk S/N MPO 00385 to appear in the records is described as disk 11 8.”

.. ,
I

I

I
i
!
I
I

I
I
I

·,
;

i.
r

f .,

f

I
I
l

i
‘ !

Forging envelope

Rectiliner machined
forging (AMF)

shape for ultrasonic
· inspections

54

Scale approximately one-half actual size

Figure 20.–CF6-6 stage 1 fan disk envelopes
at various stages of manufacture.

55

warranty claim by GEAE for defective material and no record of any credit for
GEAE processed by ALCOA or TIMET.

Before disk “A” was shipped to CONAM, a manufacturing pr-0cess
record, called a Dispatch Order (DO), indicated that a disk S/N MPO 00385.
(disk “B”) was machined into a rectilinear machined forging shape on
September 13, 1971, and that this disk passed immersion ultrasonic and
macroetch inspections on September 29, and 31, 1971.

As indicated on the 00, the remaining operations to complete
processing of disk “B” for shipment to the engine assembly line included shot
peening, grit blasting of the dovetail slots, meta 1 spray of the dovetail
slots, and final inspection of these. operations. This work was completed on
December 11, 1971. From that point, records show that disk “B” was sent to
GEAE Production Assembly, where it was installed in CF6-6 engine S/N 451-251.
This engine was shipped to Douglas Aircraft Company on January 22, 1972, for
installation on a new DC-10-10 airplane. To reiterate, according to GEAE
records, disk “A” was at CONAM .from January 7 to January 31, 1972, during
which time disk “B” was installed in a new engine and shipped to a customer.

The calendar history of the GEAE manufacturing activity for the
eight forgings reported by ALCOA as comprising heat K8283 is shown in tabular
summary. (See figure 21). Although ALCOA records indicate that a forging
S/N AJV 00381 was produced from TIMET heat K8283, no record of this forging
or disk could be found at GEAE.

As previously discussed, GEAE records showed twci entries on a
“critical rotating parts list” for a S/N MPO 00385 stage 1 fan disk. One of
the entries agreed with ALCOA records, listing the disk as being from heat
K8283. The other S/N MPO 00385 entry listed the disk as being from heat
704233. Heat 704233 is a valid heat number determined to have been used by
Reactive Metals Inc. (RMI) for a heat of Ti-6Al-4V. Further research of
GEAE records showed no other entry of a heat number 704233 for other titanium
parts manufactured at GEAE, spanning the entire period from 1969 to 1990.

ALCOA records indicated that material from RMI heat number 704233
was in inventory at ALCOA at the same time that fan disk forgings from TIMET
heat K8283 were being processed. ALCOA’s Stock Inventory Record (Titanium)
indicated that heat 704233 was received at ALCOA on November 20, 1970, and
that this Ti-6AL-4V RMI material was fo the form of a 16-inch diameter
billet, certified to GEAE material specification for fan di.sk material.
However, ALCOA’s records also indicate that RMI heat 702233 was first cut in
1972, several years after forging the disk blanks from TIMET heat K8283. The
records indicate that three of the pieces cut from 704233 weighed about
700 pounds, a weight consistent with that needed to produce a CF6-6 engine
stage 1 fan disk. The records further indicate that all forgings made from
heat 704233 were accounted for and were forgings for airframe parts.

Records for RMI heat 704233 indicate that this heat was produced
from a double melting procedure that used argon gas instead of a vacuum
inside the melting chamber during the second melt.

·—-·—– ··——·—–.. —.—-:-_….;.. .. ~:;: :~ ·-·-··::::·.-·:.. ····—·–·. ___ , ,._.-. _ .. __________ ,, ________ _ —~~

HISTORY OF HEAT# TIMET – K8283

……. ~——-1971 )Ila Ill( 1972 GE Disk
Serial# May June


July Aug Sept Oct Nov Dec Jan Feb

7 I I rr I 1
Ultrasonlc Disk Is In Sonic Shape Sent to CONAM for Verlflcat11 n

385

385
—–·-··

383

384
..

382
..

388

386

387

~ •,

!Reject In Production Not Final Machined * Indication Verified

23~—·- – .i. —-·i-i———- —-·
,. ____


311

Indication Sent Back
Confirmed at GE to GE

13–·—– -~– •11 22 I
Start In Lina Shipped to Engine

·—·
LAN 14M15 Ass em bl~ Shl~ped

13·;.. ~ .L..- – – – —–~–22 Start In Line Shipped to
LRN 14(015 — . -···· ..:;;;:19 As~er1?1v __ —–s——— —-· ·—-Start In Line Shipped to’

LRN 140013 AsS&fl!bly
-·-·—··-···- ·—–· .. —-·—– —

13— —~· ~—- —26
Start In Line ShlppeCf to

— — —- LRN 140013 Aa~e~-~Y-

___ -_J_ __ = 1s——– —-1 ai——-14 Start In Line Shipped to LRN 140013 Assembly
— – — -· —- ~-~.;;;: .. 291 -.. -10—·—-I
Start In Line Shipped to
LRN 140010 _ A!ir..!l~l:Jly
11-;…..1…;:;;;;~-~ ‘—j–1i—– —- —24
Start In Line Shipped to
LRN_140010 _____ -·——- – — —–·– ______ A_ssernbly_

LAN – Lab Release Number GE Has No
Timet Serial# in Heat – 381, 382, 383, 384, 385, 386, 387, 388 Record of 381

Figure.21.–Calendar history of manufacturing activity
of heat K8283 prepared by GEAE.

t-)

_cutu p

Verl
11/1

ed
n2

.~
.-_.-:_/

U1

°’

fi.~
‘fl! ~~ .. .. ~

.. }.·

57

In 1970, separation of a fan disk produced by another manufacturer
occurred during takeoff on a OC-8 aircraft in Rome, Italy. This fan disk was
manufactured from RMI argon remelted material, the same procedure used for
heat 704233. The cause of the separation was traced to a Type II segregate
present in the fan disk material. The separated fan disk had been
manufactured from the top position of the billet. The investigation findings
at the time indicated that the argon remelting process had created a tendency
for Type II segregation anomalies to occur in the top portion of the billet.

Based on these findings, the FAA and the US Air Force mandated
that for future critical rotating parts, the use of double-vacuum-melted
material would be the minimum standard. Stocks of material initially melted
under vacuum and remelted under argon could be utilized, provided that the·
top 7 percent of the top billet of such material was discarded or used for
nonrotor applications.

GEAE complied with the November and December 1970 FAA instructions,
1mmedi ately required double-vacuum-melted material as the minimum standard,
and notified suppliers· of this requirement. The fan disk from the UAL
accident airplane was produced after the requirement became effective. ·

During the investigation, the Safety Board was advised by TIMET
that the material contained in the accident disk may not have been produced
at the TIMET facility. TIMET contended that certain trace elements, which
should have been present in any material of TIM ET manufacture, were not
detected in sufficient quantity to ident Hy TIMET as the producer. As a
result, under the direction of the Safety Board, four independent chemical
·analyses were undertaken by TIM ET, GEAE, ALCOA and RMI. All four companies
forwarded submissions on this subject to the Safety Board. TIMET’s
submission stated that some of the disks {including the separated disk
S/N MPO 00385) have sulfur and phosphorous 1 evel s below the range expected
for titanium material produced by TIMET during the 1969-1971 timeframe.
TIMET’S and GEAE’S submissions stated that disks S/N’s MPO 00382, MPO 00385,
MPO 00386, . and MPO 00388 were not produced by TIMET. However, RMI’s
submission stated that all seven disks could be from the same heat and that
the variations in chemical elements could be the result of normal variability
of chemical element concentrations _within a heat. Further, RMI stated that
heat 704233 was made from only 100 percent RMI titanium sponge and master
alloys with no scrap added and therefore that this heat could not have been
used to produce the separated disk or other disks that contained
phosphosulfide microinclusions. ALCOA~s analysis stated that the disks
appear to separate into two groups based on the variations in the trace
chemical elements; however, ALCOA added that there is insufficient data to
determine the causes of the differences.

1.17.4 Inspections During Disk Manufacture

Curing the manufacturing process for the separated fan disk, the
disk material or disk part underwent four nondestructive inspections. The
purpose of these inspections was to detect the presence of anomalies, both
internally and on the surface.

!
. i

. ·t
!

I
·’ .I
!

-:I

58

. The first inspection was performed by TIMET in 1970. This
inspection was a contact-ultrasonic inspection of the 16-inch diameter billet
from heat K8283. The purpose of this inspection was to detect subsurface
(internal) flaws. Currently manufactured titanium alloy billets for disk
usage are subjected to an immersion-ultrasonic inspection that has a greater
sensitivity to detect internal flaws .

ALCOA was not required to inspect the forgings for internal
defects; however, it did perform material specification tests to verify the
integrity of the forging .

GEAE performed the second inspection, an immersion-ultrasonic
inspection of the disk forging after it had been machined to the rectilinear
machine forged shape (RMF). In 1971, when the accident disk was processed
through GEAE,- the testing equipment was calibrated to a standard, with the
output from the calibration maximized to 80-percent full-scale height (FSH)
on the readout equipment. An additional +12 deCibels (dB) of gain was then
added to the output signal during the inspection, increasing the sensitivity
by a factor of 4 above the standard calibration. Reject level was set at
60-percent FSH, and all signals above 30 percent were evaluated.

The immersion-ultrasonic inspection specified for currently
produced disks requires a +6 dB gain for the output signal, rather than the
+12 dB gain used in 1971. For most of the ultrasonic scan modes (angle of
the probe) in the current inspection (taking into account their specified
evaluation and rejection criteria), this change results in an average drop in
sensitivity of about 50 percent. The average drop in sensitivity cannot be
stated more accurately because of changes in the evaluation and rejection
limits, the addition of automatic depth compensating features, and more scan
modes. Further, the current inspection utilizes strip chart recorders, which
do not require continuous monitoring. Thus, an indication above the
evaluation or rejection limit is more likely to be perceived by the human
operator during the current inspection. Since 1971, GEAE has also made
improvements in the transducers that impart the sonic waves into the
material, in the inspection systems that control movement of the transducers,
and in the instrumentation that receives, amplifies, and displays the
reflected signal.

GEAE also performed a macroetch inspection on the rectilinear
machine forged shape. This inspection highlights microstructural changes or
anomalies on the surface. In the early 1970’s, only a nitric hydrofluoric
acid mixture was used by GEAE in the macroetch procedure. The current GEAE
macroetch requirement is for a two-step etching process. The first step
uses a nitric hydrofluoric acid mixture identical to that used in 1971. The
second step of the current two-step process involves immersion in an ammonium
bifluoride solution. The second step enhances the contrast developed by the
nitric hydrofluoric acid step and provides somewhat better definition of any
material anomaly present on the surface.

The final nondestructive inspection performed on the accident disk
before it entered service was a fluorescent penetrant inspection (FPI),
accomplished by GEAE on December 9, 1971, with no anomalies found. Currently

f
. .
.

f.

59

manufactured disks also receive an FPI inspection that incorporates
improvements in the inspection products and techniques that have evolved
since 1971.

1.17.5 Responsibility for Continuing Airworthiness

The investigation revealed that the GEAE design and service life of
the CF6-6 stage 1 fan disk were based on the assumption that the titanium
alloy material that passed GEAE’s in-house quality assurance tests and
inspections during manufacture was free of defects. GEAE did not depend on
the supplier for in-depth inspections but relied on its own immersion-
ultrasonic inspection, macroetch and· FPI inspection to provide quality
assurance during disk manufacture.

During certification, GEAE presented low-cycle fatigue analyses and
calculations to the FAA indicating that a defect-free part would not initiate
a fatigue crack for a predicted service life of at least 54,000 cycles. The
FAA applied a 1/3 safety factor multiplier to the prediction to arrive at a
safe life limit of 18,000 cycles. A number of CF6-6 disks have nearly
attained the 18,000 cycles and have been retired as uneconomical to
reassemble in an engine. Many of them were stored by the operators in
anticipation of an FAA-approved service life extension. In fact, GEAE had
submitted an application for life extension to 20,000 cycles shortly b~fore
the UA 232 accident. Historically, there had not been a reported cracking
problem with a CF6-6 stage 1 fan disk.

The GEAE CF6-6 shop manual has always called for FPI of the fan
disk each time it is separated from the fan module (at piece part exposure),
and this requirement was incorporated in the UAL inspection program approved
by the FAA. Additional field inspections of the CF6-6 stage 1 fan disks were
based on service history of the fleet and were incorporated into the· shop
manual and GEAE service letters.

Commercial air carriers operate in the US per the Code of Federal
Regulations ‘defined in Title 14 – Aeronautics and Space, Chapter I,
Subchapter G, Part 121. The basic maintenance regulations are contained in
Part 121, Subpart L – Maintenance, Prevention Maintenance and Alterations.
Key ingredients are trained personnel, proper instructions, and the required
tooling and facilities. ·

FAR 121.363{a){2) states “Each certificate holder is primarily
responsible for the performance of the maintenance, preventive maintenance
and alteration of its aircraft, including airframes, aircraft engines,
propellers, appliances, emergency equipment, and parts thereof, in accordance
with its manual and the regulations of this chapter.”

FAR 121.365 defines the organization required, FAR 121.367 defines
the programs required, · FAR 121.369 defines the manual requirements,
FAR 121.271 defines the inspection personnel, and FAR 121.373 defines a
continuing analysis and surveillance program.

‘:

.;. :

.
. I

‘ I
. ‘

60

The requirements specify that each certificate holder shall have an
inspection program manned by trained, certified “personnel located in an
organization separate from the other maintenance, preventive maintenance or
alteration functions.” The airline maintenance manual defines “the method of
performing required inspections and a designation by occupational title of
personnel authorized to perform eac~ required inspection.” The manual must
include “procedures, standards and limits necessary for required inspections
and acceptance or rejection of the Hems required to be inspected and for
periodic ·inspect ion and calibration of precision tools, measuring devices,
and test equipment.”

UAL’s Maintenance Program Logical, Information Based on Reliability
Analysis (LIBRA), under which the CF6-6 engines installed on the accident
aircraft were maintained has features common to the primary maintenance
processes, (Hard Time, On Condition, Function Verification and Condition
Monitoring). The LIBRA concept is based on the theory that “an efficient
maintenance program is one that schedules only those tasks necessary to meet
the stated objectives,” including safety of flight, as well as those tasks
that “should be accomplished concurrently in the interests of economy.”

Each aircraft part or system is analyzed by UAL’s Maintenance
Department in accordance with a dee is ion tree. The key quest i ans on the
decision tree are:

1)

2)

is there a reduction in failure resistance detectability
by either fl ightcrew monitoring or by in situ
maintenance and unit testing.

does the fa i 1 ure mode have a direct adverse effect on
operating safety,

3) is the function visible to the flightcrew,

a 4) is there an adverse relationship between part or system
age and reliability.

Each part or system is then assigned one or more types of primary
maintenance processes.

UAL’s CF6-6 engine maintenance program specified
condition-monitoring maintenance modified by hard-time limits, and
on-condition tasks modified by soft-time limits. The stage 1 fan disk had an
on-condition soft-time (nonmandatory) inspection 1 imit per the GEAE shop
manual and an inspection threshold of 14,000 hours as a UAL limit. Thus, the
engine theoretically could have been installed in a UAL airplane and, if
there were no conditions that required the engine’s removal and module
disassembly, the stage 1 fan disk would not have been inspected until it
reached the inspection threshold limit. Thereafter, theoretically if there
were no on-condition removals, the engine could remain in operation until the
fan disk reached the life limit. In practice, GEAE statistical data indicate
that the fan module is disassembled, as a fleet average, about every
2,500 cycles .

~~.’. . .11··· . l J,
,. ··’ . ·

)

61

The six inspections of the accident fan disk, including the
inspection 760 cycles before the accident, were performed in accordance with
UAL document 72-21-03. UAL NDT10 inspection requirements included FPI of the
disk and ultrasonic inspection of the dovetails. FPI requirements were
found in document UAL GN-3-0-0-18, Process 58.

A review and comparison of GEAE’s Standard Practices Manual (SPM)
and UAL FPI Procedures Operation sheets were performed. Both documents
specify that the CF6-6 fan disk receive a steam cleaning per UAL GN-4-0-30-20
Process 2H and an alkaline cleaning for titanium per GN-4-0-3-20 Process 28.
After cleaning, the remaining molydag (molybdenum disulphide) coating may be
removed as required, using glass bead blast per GN-4-0-0-6 Process E-25.

UAL used Magnafl ux products for FPI Process 58. These products
consisted of:

Penetrant ZL30A
Remover ZRlOA at nominal 20 percent concentration
Dry developer ZP4A
Nonaqueous wet developer (NAWD) ZP9

These products were all approved per the Standard Practice Manual
70-32-02 for Class G FPI. The UAL procedure GN-3-0-0-18 Process 58 allowed
ZL37 penetrant as an alternate. ZL37 was one of the newer approved Magnaflux
penetrants that replaced ZL30A; . the latter is no 1 onger manufactured by
Magnaflux. Airlines were permitted to use existing supplies of ZL30A
penetrant. The application of the penetrant remover and developer per UAL
procedure involved typical industry practice. The UAL procedure allowed for
the use of the self-filtered 125-watt ultraviolet lamps for inspection.

The UAL procedure warned inspectors that titanium parts resist the
capillary action of the penetrant and that “complete penetrant coverage is
required for these materials.” Also, the procedure cautioned not to overwash
the parts or the penetrant might be flushed out of true indications. The
disk bore is mentioned as a critical area for inspection, along with other
areas.

At UAL’s maintenance facility, a disk was hung from a steel wire
covered with a sheath. This hanging device was routed through the bore. The
suspension device obscures both the application of penetrant and developer
which is applied with a hand-held wand. Inspection personnel had to pause
during application to lift up sharply (jerk) on the disk to rotate it. With
disk rotation, ··the previously masked area was exposed and the FPI material
was applied to the area with the wand.

10NOT, Nondestructive testing refers to inspection. methods, such as
fluorescent penetrant, magnetic particle, radiographic, ultrasonic, and eddy
current inspections that do not damage or significantly alter the component
during the inspections.

•.

. :t
:.:1
:,,

. ~ .

62

The Safety Board staff visited another operator’s disk inspection
facility and found a different suspension system in use. The disk was
mounted through the bore on a tefl on spindle with a sma 11 retaining 1 i p.
The spindle also precluded full coverage of part of the disk by the penetrant
and developer. This operator used automated application, but rotation by
hand was still required to get coverage of the masked area of the bore.

1.17.6 Certification Requirements

1.17.6.1 Certification Requirements – Aircraft

Certification requirements for the DC-10-10 were specified in the
14 CFR; Part 25 Airworthiness Standards: Transport Category Airplanes dated
February 1, 1965, with Amendments 1 through 22 and Special Condition
25-18-WE-7, dated January 7, 1970. Part 25, paragraph 25.903(d) governed
turbine powerplant installations. This paragraph stated that:

“Unless the engine type certification specifies that the
engine rotor cases can contain damage resulting from rotor
blade. failure, turbine engine powerplant installations must
have a protection means so that rotor blade failure in any
engine will not affect the operation of remaining engines or
jeopardize continued safety. In addition, design precautions
must be taken to minimize the probability of jeopardizing
safety if an engine turbine rotor fails unless:

(1) The engine type certificate specifies that the
turbine rotor can withstand damage-inducing factors
(such as those that might result from abnormal rotor
speed, temperature or vibration); and (2) The
powerplant systems associated with engine devices,
systems and instrumentation give reasonable
assurance that those engine operating limitations
that adversely affect turbine rotor structural

· integrity will not be exceeded.”

Special Condition 25-18-WE-7 stated that, “In lieu of the
requirement of (paragraph) 25.903(d)(l), the airplane must incorporate design
features to minimize hazardous. damage to the airplane in the event of an
engine rotor fai 1 ure or of a fire which burns through the engine case as a
result of an internal engine failure.”

Special Condition 25-18-WE-7 was imposed by the FAA as part of
certification of the DC-10-10 because FAR 25.903{d) was in the process of
being revised and the applicable airworthiness requirement did not contain
adequate or appropriate safety standards for the DC-10. In response to the
special condition requirements, on July 1, 1970, Douglas responded by
supplying information to the FAA that indicated the powerplants and
associated systems were isolated and arranged so that the probability of the
failure of any one engine or system adversely affecting the operations of the
other engines or systems was “extremely remote.” The response also noted
that hydraulic system design considerations demonstrated compliance with the • ‘

63

special conditions. The FAA responded on July 17, 1970, that the review of
Douglas’ compliance was complete and that the requirements of the applicable
regulations and special conditions were satisfied. Amendment 23 was adopted
after DC-10 certification and included the revised FAR 25.903(d).
FAR 25.903(d)(l) mandated “incorporation of design features to minimize the
hazards to the airplane in the event of a rotor (disk) failure.~

FAA Order No. 8110.11 dated November 19, 1975 entitled “Design
Considerations for Minimizing Damage Caused by Uncontained Aircraft Turbine
Engine Rotor Failures” was distributed internally to various FAA offices.

Specific FAA-prepared advisory methods for compliance with
25.903(d) were not published until March 3, 1988, following a Safety Board
recommend at ion on uncontai ned rotor separation events. Advisory Circular
(AC) 20-128 entitled “Design Considerations for Minimizing Hazards Caused by
Uncontained Turbine Engine and Auxiliary Power Unit Rotor and Fan Blade
Failure” set forth suggested methods for compliance with the FAR. In this.
AC, the FAA defines potential fragment spread angles that should be
considered in the design of the aircraft to minimize the hazards associated
with uncontained rotor failures. Predicted piece-size and energy levels are
discussed. Further, this AC proposed that critical components, such as
critical control systems and hydraulic system~, be located outside the area
of debris impact, as determined by the spread angle and fragment energy
levels. If this is not possible, shields or deflectors should be considered
to minimize the hazard of the uncontained debris.

FAA Order 8110.11 contained much of the same information as
contained in AC 20-128, including fragment spread angles and the suggested
use of shields or deflectors. Neither FAA Order 8110.11 nor AC 20-128 were
effective at the time of certification of the DC-10-10.

1.17.6.2 Certification Requirements – Engine

The containment requirements for compressor and turbine rotor
blades and turbine rotors ~ere specified in the US Code of Federal
Regulations, Title 14 Part 33-Airworthiness Standards; Aircraft Engines,
dated February 1, 1965. No special conditions were imposed with respect to
containment for the CF6-6 engine.

Rotor blade failure was addressed in paragraph 33.19, nourability,”
and stated: “Engine design and construction must minimize the development of
an unsafe condition of the engine between overhaul periods. The design of
the compressor and turbine rotor cases must provide for the containment of
damage from rotor blade failure.

To supplement this requirement, FAA Advisory Circular 33-lA,
paragraph 10 and 11, provided guidelines and acceptable means for testing to
demonstrate substantiation of the requirement, and such testing was
accomplished.

.·,
. ;1
-:;1
,. ,.

. ‘
‘,!l

. !

.. ,

. ·’


r :1
·, l
: !
,:.i

” i J
ii , r
i·i
: l
: I
• r

I
. I
. !
.1

;

: 1·

. !
: I

I

I

64

Turbine rotor failure was addressed in paragraph 33.27 of FAR
Title 14, Part 33, as follows: “To minimize the probability of failure of
turbine rotors, (a) Turbine rotors must be demonstrated to be of enough
strength to withstand damage-inducing factors, such as those that might
result from abnormal rotor speeds, temperatures or vibration; and {b) The
design and functioning of control devices, systems and instrumentation must
give reasonable assurance that those engine operating limitations that affect
turbine rotor structural integrity will not be exceeded in service.”

FAA Advisory Circular 33-3 addressed guidance and acceptable means
for complying with the turbine and compressor rotor requirements of FAR
Part 33. Paragraph 5, Scope, stated that, for the rotors, “their design and
construction must provide structural integrity of sufficient strength to
withstand specified overspeeds and overtemperatures without failure un 1 ess
rotor bursts are demonstrated to be contained within their respective
housings .

. Neither the FAR nor the AC required containment of a fractured fan
disk. At the time of CF6-6 engine certification, the certification approval
required containment of one released fan blade and any resultant damage.

The design and testing program for the fan rotor disk was selected
to comply with the requirements of FAR 33 paragraphs 33.19, 33.27, 33.63 and
33.65. The Summary of Analysis and Testing Methods proposed to demonstrate
compliance of the CF6-6 with these and all applicable requirements of FAR 33
and was submitted to the FM for approval at the Preliminary Type Board
meeting on January 22, 1969. Approval of this report was received in
January 1970. During the design of the fan rotor, structural integrity
analyses for durability and fatigue life were performed and component tests
were conducted.

The durability of the fan disk was demonstrated by these analyses
and by a fan rotor overspeed durability test per the approved program and the
guidelines of FAA Advisory Circular 33-3.

1.17.7 Field Inspection Programs

The GE CF6-6 Shop Manual specified a fluorescent penetrant
;nspection of the fan disk each time the disk is separated from the fan
module for any reason. Further field inspections of the CF6-6 stage 1 fan
disk were defined by the Shop Manual and by Commercial Engine Service
Memorandum (CESM) Numbers 95 and 96.

CESM 95, issued in November 1987, described a hand-held ultrasonic
inspection of the fan disk dovetail posts to be performed at every engine
shop vis it. It was a 1 so incorporated into the GE CF6-6 Shop Manual in
November 1987. This inspection was introduced to the CF6-6 fleet after a
crack was discovered in a CF6-50 fan disk dovetail post during a normal shop
inspection. CESM 96 was issued in June 1988 to define a population of CF6-6
stage 1 fan disks for accelerated inspection to assist in the investigation
of fan disk. dovetail post cracking. The population was selected for
investigative purposes only and was not a suspect population. As of

IE:
•f

(.

65

June 1990, no cracks had been discovered on the CF6-6 fan disks inspected by
this method.

CF6-6 CESM No. 98 was issued as a result of this accident on
August 25, 1989. It introduced an immersion-ultrasonic procedure for the
complete CF6-6 fan disk. Shortly after CESM 98 was issued, a
contact-ultrasonic inspection method was developed for stage I fan disks
installed in engines or fan modules and was approved by GEAE for field use.
Working with the FAA and CF6-6 airline operators, an inspection program,
including time compliance requirements, was established for prioritized
categories of CF6-6 fan disks. CF6-6 Service Bulletin 72-947 introduced the
program to the operators.

GEAE CF6-6 Service Bulletin 72-947 was issued on September 15,
1989. The Service Bulletin recommended hand-held contact-ultrasonic
inspection by a specified date, of all CF6-6 stage I fan disks affected by
the Service Bulletin, depending on the category. It also recommended that
all· affected CF6-6 fan disks be immersion-ultrasonic inspected by a
specified date for each category. The ultrasonic inspections recommended by
SB 72-947 were in addition to the inspection requirements defined by the
CF6-6 Shop Manual and CESM’s No. 95 and No. 96.

Cf6-6 SB 72-947 defines inspect ions for three prioritized
categories of fan disks as follows:

Category 1.–(six sister disks) fan disks removed from
service and submitted to GEAE for evaluation by September 15,
1989. ALCOA records state that these fan disks were produced
from the same billet of material as fan disk S/N MPO 00385 in
the accident aircraft 451-243.

Category 11.–(total 52) Fan disks were inspected by either
contact or immersion-ultrasonic insoection methods by
November 21, 1989. These fan disks were limited to one
contact-ultrasonic inspection and then immersion-ultrasonic
inspection, or were to be removed from service by April 1,
1990. Category II disks include all disks believed to have
been manufactured from the same raw materials feedstock as
those used to manufacture the bi 11 et used for disk
S/N MPO 00385 and the Category I disks.

Category 111.–(total 213) Fan disks were inspected by either
contact or immersion-ultrasonic inspect ion methods by
February 4, 1990. Contact-ultrasonic inspection on installed
engines is required at intervals not to exceed 500 flight
cycles or until the fan disk is immersion-ultrasonic
inspected. These fan disks are to be immersion-ultrasonic
inspected or removed from service by December 31, 1990.
Category III disks include all disks believed to have been
manufactured by the same process as S/N MPO 00385
(double-vacuum melt process).

. ‘/
l
1

I ._,
I

i
i:
!
i

:1

·!
J
l
‘ i
!

66

The FAA issued Airworthiness Directive (AO) No. 89-20-01 as a final
rule on September 21, 1989. The compliance requirements for the AD are the
same as CF6-6 Service Bulletin 72-947 .

. All 37 Category II disks still in service were either contact or
immersion-ultrasonic inspected by November 21, 1989. All Category II stage 1
fan disks inspected passed the inspection requirements.

All Category III disks were inspected by February 4, 1990, using
one of the two inspection methods. Four Category III disks were returned to
GE-Evendale for further inspection and evaluation; verifiable anomalies were
discovered in two of the disks.

GEAE has undertaken a replacement program for all fan disks
identified by CF6-6 SB 72-947 and AD 89-20-01 as Category I, II, and III.
The program is administered by the GEAE Manager of Customer Service.
Replacement disks were immediately made available for the Category I disks
that were recalled. Category II and III disks were more numerous and were
more difficult to replace. As newly manufactured spares become available in
the GEAE inventory, the spares are being exchanged for disks that were
removed from engines that were disassembled for either AD compliance
inspecti.ons or other maintenance activity. GEAE has stated that it intends
to remove from service all Category II and III disks prior to accumulation of
1,500 cycles after the immersion-ultrasonic inspection .

The Safety Board was informed that the replacement program was
undertaken for commercial reasons but also because of a limitation in the·
immersion-ultrasonic inspection process. GEAE determined that the detectable
defect size in the most critical area (bore forward corner) is a 0.1-inch
radius crack. This results in a predicted residual life by GEAE calculations
of 1,500 cycles. That is, a crack less than the detectable size of 0.1-inch
~ould not propagate to failure in 1,500 cycles.

GEAE also released SB 72-962, dated July 2, 1990, which directed
contact and immersion inspections of all disks forged by ALCOA~ The

·inspections are to be conducted in a manner similar to those mandated by
CF6-6 Service Bulletin 72-947 for Category I, II, and III disks–contact
ultrasonic interval, not to exceed 500 cycles until a once-through-the-fleet
immersion-ultrasonic inspected can be accomplished. GEAE informally stated
that this inspection was initiated to verify the quality of any ALCOA disks
that may have been affected by recordkeeping anomalies during manufacture.

1.17 .8 Hydraulic System Enhancement

On September 15, .1989, Oougl as Aircraft Company announced
development of design enhancements to the DC-lO’s hydraulic system that would
preserve adequate flight control if a catastrophic in-flight event in the
empennage of the airplane damage~ all three hydraulic systems. The
enhancements consist of three separate installations: (1) an electrically ‘
operated shutoff valve in the supply line and a check valve in the return
line of the No. 3 hydraulic system, (2) a sensor switch in the No. 3

t.

67

hydraulic reservoir, and (3) an annunciator light in the cockpit to alert the
crew.to the activation of the shutoff valve.

The shutoff valve is located in the empennage forward of the
horizontal stabilizer. Normally open, the valve will close automatically if
the sensor switch detects hydraulic fluid dropping below a preset level in
the No. 3 reservoir. The switch will also illuminate the alert light in the
cockpit. If severe damage results in a breach of the No. 3 hydraulic system
anywhere in the aircraft, the shutoff valve will stop fluid flow through the
No. 3 hydraulic system routed through the tail. The hydraulic system
enhancement is intended to provide the crew with longitudinal control by
stabilizer trim input at one-half rate and lateral control through right
inboard, right outboard, and left inboard aileron deflection, and with slats
(but no flaps) in the event that an aircraft sustains damage similar to the
damage sustained by flight 232. In addition, fluid for operation of the
spoiler panels, brakes, nose wheel steering, landing gear, and lower rudder
is preserved. The enhancement was mandated by FAA AD 90-13-07 effective
July 20, 1990. The AD requires incorporation of the hydraulic system
enhancement in all DC-10 airplanes on or before July 20, 1991.

In addition to the previously discussed shutoff valve system,
Douglas also offered a system that incorporated flow-limiting fuses in the
No. 3 hydraulic system. Service bulletins were issued by Douglas to cover
the installation of either system. AD-90-13-07 required that CF6-6-equipped
DC-10 airplanes (DC-10-10 and DC-10-lOF) have either the shutoff valve or
flow-limiting fuses installed within 6 months of the AD issue date. All
other models of the OC-10 were required to be modified with the shutoff valve
within 12 months. The AD also required that if flow-limiting fuses were
installed, the airplane must also have the shutoff valve installed within
12 months. The operators had the opt ion of 1 ea vi ng the fuses in the system
if they had been installed.

Douglas has incorporated the enhanced hydraulic system in the·
MD-11. All MD-ll airplanes will be manufactured with the shutoff valve
system installed.

1.17.9 Historical Review

The investigation included a review of NTSB Aircraft Accident
Reports 73-2, 79-17, 82-3 and relevant cases of loss of hydraulic flight
controls in wide-body transport airplanes:

July 30, 1971
San Francisco, CA

A Boeing 747 departed on a
1 imited-length runway. with
incorrect takeoff reference
speeds and struck an
approach lighting
structure, disabling 3 of
the 4 hydraulic systems
for flight controls. The
airplane landed safely on
the remaining system.

‘:t
I

”I

. I

· .. !

·•·

r
·~:

‘ ‘ ,.
,j:

·’ ~
.~ ‘ .

December 8·, 1985
Mt. Ogura, Japan

September 22, 1981
Colts Neck, NJ

68

An improper aft pressure
bulkhead structural repair
on a Boeing 747 resulted in
an expl os1ve decompression
that caused damage to al 1
four hydraulic systems
available for flight
control. The flightcrew
attempted to control the
airplane with differential
power. The airplane
crashed, fatally injuring
more than 500 passengers.

Bearing failure within the
No. 2 tail-mounted engine
on an l-1011 allowed the
fan assembly to escape,
disabling three of the four
hydraulic systems
available for flight
control. The airplane
1 anded safely on the
remaining system.

The investigation also included a review of incident/accident
records for uncontained engine failures and damage as a result of released
rotating parts. NTSB Special Study, “Turbine Engine Rotor Disk Failures,
NTSB-AAS-74-4″ formed a basis for the review. Two FAA-sponsored
industry-published statistical reports were included. They are SAE Report
AIR 1537, events through 1975, and SAE Report AIR 4003, events 1976 through
1983. The review considered only commercial transport aircraft engine
operating experience. The information on non-containment events was derived
primarily from engine manufacturers and operators data since they have the
most comprehensive records and knowledge of such events. The FAA Technical
Center also produces an Annual Statistical Report of Aircraft Gas Turbine
Engine Rotor Failures in U.S. Commercial Aviation, derived from data reported
through the Service Difficulty Report (SOR) system. This data includes only
events reported by U.S. operators, and therefore does not reflect the total
engine fleet experience. Presently, there is no central repository or
reporting and collecting program for acquiring and recording such data.

For the 1976-1983 period, 203 non-containment events were
identified as relevant involving four transport aircraft engine types:
turboprop, turbojet, low bypass ratio turbofan and high bypass ratio
turbofan. Of these, five involved fan disks or disk fragments, two of which
resulted in airframe damage categorized as significant or severe. There were
52 total disk failures in the 201 events. Of these, 15, or 29 percent,
resulted in significant or severe aircraft damage. Of all noncontained
events, 12.3 percent resulted in significant or severe aircraft damage.

• •

ID:’ tr)·.·
~I..

[)” ,,, ~’) .

rn, ).
‘;;/ .

69

For the period 1962 to 1975, high bypass ratio engine hours of
operation were 5 percent of the total reported. For the period 1976-1983
they represent 23 percent of the total operating hours reported. The
non-containment rate per million operating hours in the 1976-1983 period is
about 2.5 times that of low bypass ratio engines, and if fan-blade-only
events are excluded, the rate is 1.3 times the low bypass ratio engine rate.
FAA-sponsored work will soon be undertaken by SAE on a third report, events
1984 through 1989. Selected cases are cited below.

April 19, 1970
Rome, Italy

May 2, 1972
Tucson, AZ

December 28, 1972
Atlantic City, NJ

January 10, 1973
Grand Junction,

November 3, 1973
Albuquerque, NM

May 25, 1981
Jamaica, NY

co

DC-8
JT-30

DC-10
CF-6-6, #2

L-1011
RB211, #3

L-1011
RB211, fl1

DC-10
CF-6-6

L-1011
RB211, #3

September 22, 1981 L-1011
Colts Neck, NJ RB-211, #2

March 16, 1979
Okinawa, R. I.

DC-10
Cf6-50, #3

A fan disk ruptured on takeoff
and the takeoff was refused.
The aircraft was destroyed by
fire. A hard alpha inclusion
was discovered in the titanium
engine fan disk · (argon cap
melt).

The low-pressure turbine
assembly separated from the
engine and fell to the ground.

The fan disk
335 cycles
inappropriate
selection.

The fan disk
274 cycles
inappropriate
selection.

ruptured at
due to an

titanium alloy

ruptured at
due to an

titanium alloy

Part of the fan assembly
disintegrated during an
overspeed and parts struck a
cabin window. A passenger was
ejected from the cabin during a
subsequent decompression. The
cause of the fan overspeed was
not determined.

The stage 1 fan assembly
escaped during climb because of
a thrust-bearing failure.

Event similar to that described
above.

The stage 3 disk of the high-
pressure compressor failed on
takeoff. A hard alpha inclusion
was discovered.

I
·~ ‘ ,,
‘·

i

i’
I.
, . . . ,
n
i ‘
H
.: t
·”t
. ;
. ri

70

September 22, 1981 OC-10
Miami, FL CF6-50, #3

March 17, 1982
Sanaa, N. Yemen

June 25, 1983
Manila, R. P.

July 5, 1983
Chicago, IL

January 19, 1985
Brazaville, Congo

April 6, 1985
Dakar, Senegal

A300B
CF6-50, #2

8747
CF6-50, #4

DC-8,
CFM56, #1

8747
CF6-50, #4

OC-10
CF6-50, #2

The low-pressure turbine disk
ruptured because of an object
that was left in the engine
during assembly after
maintenance.

The high-pressure turbine stage
11 disk ruptured from low-cycle
fatigue around an embossment.
The airplane was destroyed by
fire fo 11 owing an aborted
takeoff.

The high-pressure compressor
stage 9 disk ruptured during
climb. Low-cycle fatigue from a
hard alpha inclusion was the
cause. Debris punctured the
stabilizer.

Stage 1 high-pressure compressor
disk separated during takeoff.
The disk had 256 cycles si nee
new. A hard alpha inclusion was
discovered in the disk fracture
area, which was manufactured
from triple melt material.

The high-pressure turbine stage
1 disk ruptured in cruise due to
loss of cooling air. A fuel tank
was punctured.

The high-pressure compressor
stage 9 disk ruptured during
climb. Fatigue was indicated on
one recovered piece. The
evidence of the fatigue source
has not been located.

1.17.10 Airplane Flight Characteristics with Immovable Control Surfaces

1.17.10.1 General Characteristics

Steady cruise level flight is attained when the forces acting on
the airplane are in a state of equilibrium; that is, thrust equals drag and
the airplane’s weight is balanced. by the lift forces produced by the
airplane’s wing and horizontal stabilizer. Since the lift forces produced
by the wing and stabilizer and the airplane’s drag vary with airspeed, the
equilibrium condition is unique for a particular combination of weight,
thrust, arid airspeed. The airspeed at which the lift and weight forces are

W)
,.l 1, ;’
·;, ., ..

.:->

71

balanced is in turn dependent on the angle between the r~lative wind and the
chord line of the wing and stabilizer aerodynamic surfaces (angle of attack}.

The DC-10 airplane is trimmed for the desired steady flight
condition by moving the horizontal stabilizer (relative to the wing} to the
position at which the normal forces are balanced without the need for the
pilot or autopilot to hold constant forces on the airplanes’ flight controls.
Transient changes from the steady cruise condition are achieved by
manipulating the controls to move the airplane’s elevator, ailerons/spoilers,
and rudder. The deflection of the elevator momentarily changes the lift
produced by the horizontal stabilizer to cause a change in the airplane’s
attitude, angle of attack, and airspeed. When the deflection is removed from
the elevator, the airplane will return to its original trim airspeed so that
the lift and weight forces will again be balanced.

In routine flight, the pilot will change both thrust and elevator
or horizontal stabilizer trim position to attain a new steady flight path;
that is, to change airspeed and/or rate of climb or descent. An inability to
reposition the horizontal stabilizer or move the elevator severely restricts
the pilot’s control over such flightpath changes by eliminating the essential
means of changing the normal force balance. Under such conditions, the
airplane will continuously seek the airspeed and flightpath at which the
forces balance for the existing stabilizer trim position and the existing
thrust level. This motion is called the phugoid.

A small change in power would typically result in a slight change
in speed foll owed by the appropriate climb or descent and a return to
approximately the same trim speed. For UAL 232, the trim speed was set by
the airplane configuration and the damage resulting from engine failure and
could not be reduced for .landing as is normally the case.

Stimuli, such as gusts or power changes, may initiate the airplane
phugoid. The phugoid produces a long period of pitch oscillation and may
produce speed variations about the trim speed .. If the speed varies from the
trim speed, the airplane will change pitch and either climb or descend to
recover to the trim speed. For example, if the speed falls below the trim
speed while the airplane is in level flight, the lift produced by the wing is
not sufficient to maintain altitude. The airplane will start to descend and
pick up speed. Normally, the airspeed will increase beyond the trim speed
and the airplane lift will become greater than required, resulting in an
increase in vertical velocity and subsequent climb. During the climb, the
airspeed will fall . toward the trim speed. The time to complete one
oscillation is called the period of the phugoid and may be as long as several
minutes on some airplanes. The period of the phugoid for typical large jet
transports is about 1 minute. When elevator control is present, the phugoid
is easily damped and is not noticeabl~ to the pilot.

In a situation· such as UAL 232, the elevator and trim positions
were constant; therefore the trim speed was set and direct control over the

. phugoid was not available. Variations in net power produced climbs or
descents as expected. The resulting phugoid led to variations about the trim
speed, as well as long-term oscillations in pitch attitude and vertical

72

velocity. The phugoid could be damped with properly timed small changes in
thrust. ·

Lateral airplane control is normally achieved by using the
ailerons to produce a roll angle that will result in a turn or change in the
direction of flight. Since the ailerons were inoperative during the descent
of UAL 232, lateral control was maintained by using differential thrust on
the airplane. Differential thrust produces a yawing moment and a yaw angle
where the airplane is pointed-in a direction slightly left or right of the
flight path. Because of the wing sweep and dihedral, a yaw angle produces a
rolling moment and a roll angle. The roll angle produces the turn to a new
heading.

For a landing, the elevator and ailerons may produce the required
maneuvers in several seconds which allows for a precise approach to
touchdown. For UAL 232, pilot-induced thrust variations were required to
control the phugoid and the asymmetric rolling moments attributed to
airframe damage, in addition to the maneuvers required for landing. The
required maneuvers could be implemented, via thrust variations, with a delay
of as much as 20 to 40 seconds. Thus, any thrust changes required for
landing would have to be anticipated at least 20 to 40 seconds prior to
touchdown, and any required changes within 20 to 40 seconds of landing could
not be fully implemented.·

1.17.10.2 Flight Simulator Studies

As a result of the accident, the Safety Board directed a simulator
reenactment of the events leading to the crash. The purpose of this effort
was to replicate the accident airplane dynamics to determine if DC-10
flightcrews could be taught to control the airplane and land safely with no
hydraulic power available to actuate the flight controls. The simulator
exercise was based only on the situation that existed in the Sioux City
accident–the failure of the No. 2 (center) engine and the loss of fluid for
all three hydraulic systems.

The DC-10 simulator used in the study was programmed with the
aerodynamic characteristics of the accident airplane that were validated by
comparison with the actual flight recorder data. DC-10 rated pilots,
consisting of line captains, training clerk airmen, and production test
pilots were then asked to fly the accident airplane profile. Their
comments, observations, and performance were recorded and analyzed. The only
means of control for the flightcrew was from the operating wing engines. The
application of asymmetric power to the wing engines changed the roll
attitude, hence the heading. Increasing and decreasing power had a limited
effect on the pitch attitude. The airplane tended_ to oscillate about the
center of gravity {CG) in the pitch axis. It was not possible to control the
pitch oscillations with any measure of precision. Moreover, because airspeed
is primarily determined by pitch trim configuration, there was no direct
control of airspeed. Consequently, landing at a predetermined point and
airspeed on a runway was a highly random event.

~
•~:

Ii: •

73

Overal 1, the results of this study showed that such a maneuver
involved many unknown variables and was not trainable, and the degree of
controllability during the approach and landing rendered a simulator training
exercise virtually impossible. However, the results of these simulator
studies did provide some advice that may be helpful to fl ightcrews in the
extremely unlikely event they are faced with a similar situation. This
information has been presented to the industry by the Douglas Aircraft
Company in the form of an “All OC-10 Operators Letter.” In addition to
discussing flight control with total hydraulic failure, the letter describes
a hydraulic system enhancement mandated by an FAA Airworthiness Directive,
(See appendix 0).

1.18

1.18 .1

Useful Investigative Techniques

Special Investigative Techniques – Photograph Image Analysis

Color photographs of the accident aircraft were taken by a resident
who lived on the approach path to Sioux Gateway Airport. The photographs,
taken after the engine failure, depicted the damage to the right side and
empennage of the aircraft. The photograph with the sharpest image was
selected for further analysis. The boundaries and locations of the holes
were calculated so that the locations of the holes could be incorporated into
a three-dimensional scale drawing of the horizontal stabilizer. Three areas
on the photograph contained four holes, which were selected for analysis:
the hole on the leading edge of the right horizontal stabilizer; two holes
slightly inboard and in the middle of the right horizontal stabilizer; and a
hole on the right inboard elevator. The holes were defined as those areas
where light could be observed penetrating areas of the stabilizer. They were
transformed to the stabilizer coordinate system and input into the
computer-aided design (CAD) system to generate a drawing of the horizontal
stabilizer depicting the in-flight damage.

2. ANALYSIS

2.1 General

The flightcrew of UA 232 were trained and qualified in accordance
with applicable Federal regulations and UAL company standards and
requirements. The airplane was certificated, equipped, and operated-
according to applicable regulations. Meteorological conditions and
navigation and communication facilities did not contribute to the accident.
ATC services and controller performance were reasonable, proper, and
supportive of the flightcrew and were not factors in the accident.

The Safety Board determined that the accident sequence was
initiated by a catastrophic separation of the stage 1 fan disk from the No. 2
engine during cruise flight. The separation, fragmentation, and forceful
discharge of uncontained stage 1 fan rotor assembly parts from the No. 2
engine 1 ed to the lass of the three hydraulic systems that powered the
airplane’s flight controls. The flightcrew experienced severe difficulties
controlling the airplane and used differential power from the remaining two
engines for partial control. The airplane subsequently crashed during an

74

attempted emergency landing at Sioux Gateway Airport. Upon ground contact,
the airplane broke apart and portions of it were consumed by fire.

of:
The Safety Board’s analysis of this accident included an evaluation

o the structural and metallurgical evidence to determine
the initial failure origin withi~ the engine;

o the manner in which uncontained parts separated from the
engine;

o the failure of the hydraulic systems that power the
flight control systems;

o the capability of the flightcrew to control the airplane
on its flightpath;

o the effectiveness of the GEAE CF6-6 engine manufacturing,
recordkeeping, and quality assurance programs;

o the effectiveness of UAL’s CF6-6 engine fan section
maintenance and inspection practices;

o the effectiveness of the FAA’s oversight of the design,
certification, manufacture, ·recordkeeping, and
continuing airworthiness of the CF6-6 engine;

o the effectiveness of nondestructive inspection (NDI)
programs for the inspection of rotating engine parts;

o the human factors aspects of airline maintenance NDI
programs;

o the design and certification of wide-bodied aircraft and
jet engines to minimize damage from uncontained, rotating
engine parts;

o the effectiveness of the manufacturing process for
rotating engine parts made of titanium;

o cabin survivability issues, including child (infant) seat
restraints; and,

o rescue and firefighting services.

2.2 Accident Sequence

Photographs of the airplane taken during the approach to Sioux
City by witnesses on the ground indicated inflight damage in the area of the
No. 2 engine and tail section of the airplane. The location of parts of the
No. 2 engine and empennage structure near Alta, Iowa, together with the

75

documentation and analysis of the No. 2 engine components and surrounding
structure, led the Safety Board to conclude that the No. 2 engine stage 1 fan
disk fracture and separation was the initial event that led to the liberation
of engine rotating parts with sufficient energy to penetrate the airplane’s
structure. · ·

Shortly after the engine failure, the crew noted that the hydraulic
fluid pressure and quantity had fallen to zero in the three systems.
Approximately l minute after the engine failure, the FDR recorded no further
powered movement of the flight control surfaces. Consequently, the No. 2
engine failure precipitated severe damage that breached the three hydraulic
systems, leaving the flight control systems inoperative.

Titanium alloy was found on the fracture surfaces of severed lines
of hydraulic systems No. 1 and No. 3 located in the right horizontal
stabilizer. Several of the major components of the engine, including the
stage I fan blades and fan disk, were made from titanium alloy and no other
components of the surrounding airframe were made from such material. These
factors led the Safety Board to conclude that the systems’ No. 1 and No. 3
hydraulic lines were severed by fragments released during the failure
sequence of the No. 2 engine.

The loss of hydraulic system No. 2 required further analysis. The
engine-driven No. 2 hydraulic pumps were attached to and received power from
the No. 2 engine accessory section. This unit was mounted to the engine
directly below the fan section of the engine. Portions of the No. 2 engine
accessory section and associated No. 2 hydraulic system components, including
hydraulic supply hoses, were found in the Alta, Iowa, area. Therefore,
portions of the No. 2 hydraulic system and supply hoses mounted on, or
adjacent to, the No. 2 engine accessory section were damaged and separated by
the forces and disruption of the engine fan section during the engine
failure. The investigation disclosed no evidence of other system anomalies
that would have contributed to the hydraulic system or flight control
difficulties experienced in the accident.

2.3 Performance of UAL 232 Flightcrew

Because of the loss of the three hydraulic systems, the flightcrew
was confronted with a unique situation that 1 eft them with very limited
control of the airplane. The only means available to fly the airplane was
through manipulation of thrust available from the No. 1 and No. 3 engines.
The primary task confronting the flightcrew was controlling the airplane on
its flightpath during the long period (about 60 seconds) of the “phugoid” or
pitch oscillation. This task was extremely difficult to accomplish because
of the additional need to use the No. I and No. 3 power levers asymmetrically
to maintain lateral (roll) control coupled with the need to use increases and
decreases in thrust to maintain pitch control. The fl ightcrew found that
despite their best efforts, the airplane would not maintain a stabilized
flight condition.

.·.
I

,;;

·:: ..

/
·,.

76

Douglas Aircraft Company, the FAA, and UAL considered the total
loss of. hydraulic-powered flight controls_ so remote as to negate any
requirement for an appropriate procedure to counter such a situation. The
most comparable maneuver that the fl ightcrew was required to accomplish
satisfactorily in a DC-10 simulator was the procedure for managing the
failure of two of the three hydraulic systems; however, during this training,
the remaining system.was available for movement of the flight controls.

The CVR recorded the flightcrew’s discussion of procedures,
possible solutions, and courses of action in dealing with the loss of
hydraulic system flight controls, as well as the methods of attempting an
emergency landing. The captain’s acceptance of the check airman to assist
in the cockpit was positive and appropriate. The Safety Board views the
interaction of the pilots, including the check airman, during the emergency
as indicative of the value of cockpit resource management training, which has
been in existence at UAL for a decade.

The loss of the normal manner of flight control, combined with an
airframe vi brat ion and the visual assessment of the damage by crewmembers,
led the flightcrew to conclude that the structural integrity of the airplane
was in jeopardy and that it was necessary to expedite an emergency landing.
Interaction between the fl i ghtcrew and the UAL system aircraft maintenance
network (SAM) did not lead to beneficial guidance. UAL flight operations
attempted to ask the flightcrew to consider diverting to Lincoln, Nebraska.
However, the information was sent through flight dispatch and did not reach
the flightcrew in time to have altered their decision to land at the Sioux
Gateway Airport. ·

The simulator reenactment of the events leading to the crash
landing revealed that 1 ine fl ightcrews could not be taught to control the
airplane and land safely without hydraulic power available to operate the
flight controls. The results of the simulator experiments showed that a
landing attempt under these conditions involves many variables that affect
the extent of controllability during the approach and landing. In general,
the simulator reenactments indicated that landing parameters, such as speed,
touchdown point, direction, attitude, or vertical velocity could be
controlled separately, but it was virtually impossible to control all
parameters simultaneously.

After carefully observing the performance of a control group of
DC-IO-qualified pilots in the simulator, it became apparent that training for
an attempted landing, comparable to that experienced by UA 232, would not
help the crew in successfully handling this problem. Therefore, the Safety
Board concludes that the damaged DC-10 airplane, although flyable, could not
have been successfully landed on a runway with the loss of all hydraulic
flight controls. The Safety Board believes that under the circumstances the
UAL flightcrew performance was highly commendable and greatly exceeded
reasonable expectations.

• . ‘

.-;
~

~
.·-~·
! !

‘ ,I; .
… :·

2.4

2.4.1

77

Analysis of Fan Disk Fracture

Separation of Fan Disk

Examination of the fracture surfaces of the fan disk disclosed that
the near-radial, bore-to-rim fracture was the primary fracture. The
fracture initiated from a fatigue region on the inside diameter of the bore.
The remaining portions of the disk fractures were typical of overstress
separations resulting from the fatigue failure. ·

Because of the geometry of the fan disk and the load paths within
the disk, the near-radial fracture created a bending moment in the disk arm
and web that overstressed the disk, leading to rupture and release of a
segment. As soon as the segment of the disk was released, the remainder of
the disk was immediately out of balance. Sufficient evidence in the form of
witness marks,, on the containment ring indicates that the segment of the
disk with its blade roots still attached exited the engine around the 7:30
position. Additional evidence from the bearing housings and compressor
section indicates that the remainder of the disk with attached blade roots
immediately exited the engine from about the 1:00 position. Blade fragments,
separately and in groups, were primarily liberated toward the right
horizontal stabilizer and the aft lower fuselage area. The investigation
disclosed that the liberated pieces of the engine banjo frame contained
transferred titanium. However, the Safety Board could not determine which of
the titanium engine parts struck the frame.

2.4.2 Initiat’ion and Propagation of Fatigue Crack

. Metallurgical examination showed that the fatigue crack initiated
in a nitrogen-stabilized type I hard alpha defect at the inside surface of
the bore. The hard alpha defect was formed during manufacture of the
material and remained undetected through ultrasonic, macroetch, and FPI
inspections performed during manufacture of the part.

Fracture mechanics evaluations performed by GEAE showed that at the
time of the disk separation, the fatigue crack was of a magnitude that would
cause fracture and resulting separation of the disk fan under normal loads.
The number of major striations on the fatigue region was nearly equal to the
total number of takeoff/landing cycles on the disk (15,503), indicating that
the fatigue crack initiated very early in the life of the disk.

The results of the GEAE fracture mechanics analysis were also
consistent with fatigue tnitiation on the first application of stress from a
defect slightly larger than the size of the cavity found at the fatigue
origin. The Safety Board concludes that the hard alpha defect area cracked
with the application of stress during the disk’s initial exposures to full
thrust engine power conditions and that the crack grew until it entered

11wltness •arks are areas of mechanical damage or transferred material
whose shape, orientation, and composition can indicate what component created

the damage.

. ‘

.j
l
I

1
i

78

thrust engine power conditions and that the crack grew unfil it entered
material ·unaffected by the hard alpha defect. From that point, the· crack
followed established fracture mechanics predictions for Ti-6Al-4V alloy.

The Safety Board also attempted to determine the size of the
fatigue crack at the time of UAL’s FPI inspection of the disk 760 cycles
prior to the accident. One possibility was that the discolored portion of
the fatigue crack was created during the alkaline cleaning of the disk in
preparation for the inspection. The fractographic examination of the fatigue
region disclosed no topographic reason for the discoloration. In addition,
the. Safety Board is aware of no operational environment or conditions that
would cause such discoloration. For these reasons, the Safety Board
concludes that the discoloration on the surface of the fatigue crack was
created during some step in the FPI process performed by UAL 760 cycles prior
to the accident, and that the discolored area marks the size of the crack at
the time of this inspection. The actual surface length of the discolored
area is 0.476 inch.

The GEAE fracture mechanics analysis also was used to estimate the
size of the fatigue crack at the time of the inspection. The analysis
estimated that the surface length of the crack was 0.498 inch long at the
last inspection.

An independent fracture mechanics analysis performed by UAL
estimated a smaller crack size at 760 cycles prior to failure. However, this
analysis used material properties, surface correction factors, and a load
spectrum that the Safety Board believes are unrealistic.

2.4.3 Source of Hard Alpha Defect

The hard alpha defect was caused by excessive amounts of nitrogen
locally situated in the material. Titanium will absorb such amounts of
nitrogen only when it is in its molten state.

The vacuum-melt process has not been adequate to produce a
defect-free product. Increasing the number of vacuum melts from two to three
has been shown to be effective in reducing. the number of defects, the source
of which can be the raw material, the sponge reactor, or welded material on
the electrode. However, there is always the possibility that a defect can be
introduced into each melt by foreign material remaining in a furnace. Since
1971, there have been improvements in furnace cleaning requirements that are
intended to reduce this problem. Tighter controls have also been placed on
the raw materials for premium-grade stock (that would be made into rotating
parts for aerospace uses) in an effort to ensure a higher quality product .

The current technology for quality control of titanium
manufacturing has progressed to the point where critical defects are rare.
Additional reductions in the number and size of defects are unlikely to occur
without changing to a new production process, such as hearth melting. Major
efforts associated with such a changeover are currently being evaluated to
determine if hearth melting can be introduced into industrial production .

• •:~

I
..
‘ .

., · 1 ,,
–~ I f ‘. ‘l ~ ” .’: t . . .

‘• (} ;,· • • : j
‘/

,J• •’
l

79

Quality assurance measures to ensure that the interior of titanium
parts are defect-free are based 1 argely on ultrasonic inspections. Such
inspections have been . shown to be less than 100 percent effective in
detecting anomalies becau-se detectable anomalies must be associated with
cracks and voids. This accident demonstrates the difficulty of inspection.
Therefore, to some extent, the engine manufacturers rely upon the billet
fabrication procedures for their overall quality assurance of disk material.
Although the billet producers have been constantly striving to upgrade the
quality of their product~ defects do occur in both double- and triple-melted
material. The rupture in 1983 of a GEAE CFM-56 triple-melted stage 1
high-pressure compressor rotor disk having only 256 cycles, caused by an
undetected hard alpha defect, illustrates this problem.

2.4.4 Formation of Cavity

The Safety Board believes that at the time of manufacture of the
disk, the cavity at the fatigue origin point was originally filled, or nearly
filled, with hard alpha material, making the defect more difficult to detect
through ultrasonic means at the time of GEAE’s ultrasonic inspection of the
rectilinear machine forging (RMF) shape during the manufacturing process.
The Safety Board also believes that the cavity was most likely created during
the final machining and/or shot peening processes and that the shot peening
probably created the microcracking parallel to and just below the cavity
surface. Moreover, the shot peening quite likely created the mechanical
deformation on portions of the cavity bottom. This mechanical deformation
was inconsistent with damage that could occur during the accident sequence.

the
The Safety Board examined and rejected other theories concerning

formation of the cavity, including the following:

a. The cavity was originally filled with hard alpha material
that fell out during or shortly after the disk separation
as a result of “ringing” (severe vibrations) or damage
that occurred as the disk exited the airplane. The lack
of a fresh fracture appearance in portions of the cavity
and the location and orientation of the microcracks
·beneath the cavity surface do not support this
possibility.

b. The hard alpha material in the cavity was dislodged
during the life of the disk, as repeated cycles of
stress caused increasingly extensive cracking in the
material that originally filled the cavity. However, the
orientation of the microcracks beneath the surface of the
cavity is more consistent with their formation by shot
peening, rather than by operating stresses.

c. The cavity was never filled with hard alpha material but
was part of a large void associated with the hard alpha
defect. In this case, the microcracks and mechanical
damage would still be produced by the shot peening,
without significant enlargement of the size of the

. !

80

cavity. However, the hard alpha defect found in fan disk
S/N MPO 00388 was approximately the same size as the
defect area in the separated disk, and the two defects
may have arisen from similar sources. Since the defect
in S/N 388 contained no large voids, it is reasonable to
conclude that the defect in the accident disk did not
contain a void. Also, a void the size of the cavity
should have been detected by the ultrasonic inspection
of the RMF shape.

Therefore, the Safety Board concludes that the cavity was created
during the final machining and/or sh~t peening at the time of GEAE’s
manufacture of the disk, after GEAE’s ultrasonic and macroetch manufacturing
inspections. The cavity and surrounding hard alpha material provided a
stress raiser from which the fatigue crack initiated.

2.5 Origin of Accident Fan Disk MPO 00385

GEAE maintains a computerized listing of all critical rotating
engine parts by part number and serial number, together with the titanium
supplier’s heat number, for traceability purposes. When the data for disk
part number 9010M27Pl0 was recalled, serial number MPO 00385 was listed
twice, once with heat number K8283 and once with heat number 704233. The
first listing is the TIMET heat as shown on ALCOA records, and the second is
a Reactive Metals Incorporated (RMI) heat number, which appeared in GEAE
records only in the critical rotating parts list. ALCOA records show that
RMI heat 704233 was received at ALCOA in October 1970~ and remained in
inventory until first cut in March 1972, 2 months after disk MPO 00385 was

· shipped from GEAE in an engine. The ALCOA records indicate that none of the
forgings made from heat 704233 were delivered to GEAE.

Because of the discovery of contradictory records, chemical
analyses were performed on the separated disk material in an attempt to
verify its technical specifications and to relate the manufactured part to
its basic source material. Multiple samples were removed from the bore and
from the rim of each of the seven disks that records indicate were from TIMET

· heat K8283. In order to ensure unbiased analyses, the samples were coded
before being distributed to GEAE, ALCOA, TIMET, and RMI for analysis.
Results of the chemical analyses were gathered, the sample identifications
were decoded, and the results distributed among the parties. In general, the
chemical analyses showed that the material complied with the composition
limits set forth in the applicable GEAE materials specification.

Statistical analysis of the trace element data from the chemical
analyses performed by the four companies shows significant variations in some
of the trace elements between the seven disks. At least two groups of disks
are suggested by these analyses, and comparisons of the mean values for
several elements tend to group disks MPO 00383, MPO 00384 and MPO 00387 in
one cluster and disks MPO 00382, MPO 00385, MPO 00386 and MPO 00388 in
another. These statistical analyses do not identify the origin of either
cluster of disks, and the Safety Board cannot determine if the seven disks
came from the same heat or from different heats.

J

I . .

Iii
~

··:
~

l·~.’1· l’· I}-/ . .. , ·’
~. ·.

81

However, if these disks were not produced from the same heat, the
records on a large number of GEAE disks are suspect. It also means that any
AD action that is based on the serial number of a disk may fail to have its
intended effect because suspect disks could remain in service. For example,
the AO 89-20-01 target population includes the Category I, II, and III disks,
based on serial number. Because of doubts about the records, the FAA would
be unable to determine whether all disks made from the billet that produced
the accident disk (Category I disks) have been removed from service. Also,
the priority of inspections of Category II and III disks may be inappropriate
in some cases if the records do not accurately reflect the heat information,
and .there may be double-vacuum melted disks identified as triple-vacuum
melted disks.

During the investigation, Safety· Board investigators visited the
ALCOA facility, inspected all available records, and viewed the forging
processes in the production area. They compared stock undergoing successive
forging operations and heat treatments and the records accompanying the
items. They also observed heating and blocking (striking) and final forging
operations in which parts were unmarked and arranged in groups on pallets.
At times, they could only be identified by the accompanying “shop traveller”
paperwork, which, by necessity,·was separated from the parts and pallet.
Because of the nature of the industrial operations conducted, identification
data could be exchanged between parts in process. However, no evidence other
than the chemical variances was found to indicate that any such
misidentification occurred in the case of disk MPO 00385.

ALCOA keeps bulk materials in ir.ventory at its forging facilities
in order to fill customer orders more efficiently. Inventory records
indicate that during the time of the manufacture of disk MPO 00385, ALCOA had
argon remelted titanium billet material in stock. Its production records
indicate that this material was never manufactured into GEAE parts, nor was
it shipped to the GEAE facilities. Nevertheless, a stock number from some of
this material (RMI heat 704233) appears in GEAE records as a source for one
of the disks identified with S/N MPO 00385. No other records exist. to
corroborate or resolve this anomaly. In fact, all other GEAE and ALCOA
records show that MPO 00385 was fabricated from TIMET heat K8283.

On July 2, 1990, GEAE issued SB 72-962, which directed a fleet
campaign to verify the quality of 119 additional CF6-6 fan disks forged by
ALCOA. The Safety Board has been informed that the FAA intends to issue an
AD to mandate compliance with the intent of GEAE Service Bulletin 72-962.
Until such time as an AD is issued, the Safety Board remains on record as
recommending that the FAA mandate compliance with the Service Bulletin.

Not all records associated with the manufacture of fan rotor disks
relevant to this accident were available from GEAE. The TIMET and ALCOA
records indicate that the billet and forgings were manufactured and certified
in accordance with the then-current GEAE specification for titanium used in
rotating parts. However, several anomalies appear in the GEAE records,
which call into question the reliability or accuracy of all the disk records
from the same period. For instance, there were no records found indicating
receipt of the fan disk forgings by the GEAE plant.

.. ,·
··~.

~: I

i.

‘ ..

82

Chronologically, the first appearance of a GEAE part number
9010M27P.10 for fan disk S/N MPO 00385 was on an ultrasonic inspection log
sheet dated June 7, 1971, which indicates that a disk with S/N MPO 00385 was
rejected and marked, “hold for investigation.” There was no dispatch order
card found dated in June 1971 for this serial number. Although a stock
inventory card indicated that in August 1971 a CF~-6 stage 1 fan disk in the
RMF shape was located in the materials lab for ultrasonic investigation, this
card did not indicate a serial number. Nevertheless, a dispatch order card
from GEAE records indicates that a disk with S/N MPO 00385 entered the
manufacturing process on September 3, 1971, as a forging, and it passed
ultrasonic inspection on September 29, 1971. This disk had a traceable
record history leading to engine S/N 451-243, the No. 2 engine in the
accident airplane. ·

A billet map prepared by ALCOA indicates that eight disk forgings,
S/N MPO 00381 through MPO 00388, were made from a TIMET-supplied billet, heat
number K8283. However, there were no GEAE records of any kind for a
S/N MPO 00381 disk. Instead, there were two disks having S/N MPO 00385.
Serialization of the disks was initiated by the forger, in this case ALCOA,
from blocks of serial numbers provided by GEAE. There was no evidence ·at
Alcoa to indicate that the company shipped two disks having S/N MPO 00385.

Additionally, GEAE and vendor correspondence records indicate that
a S/N MPO 00385 disk was tested by an outside laboratory in January 1972 and
that an indication of an anomoly was confirmed ultrasonically. The
indication was not in the area of the bore where the defect existed on the
accident disk. The disk with the ultrasonic indication was reportedly cut
up by GEAE in an attempt to identify the source of the indication; no
metallurgical anomalies were found. The Safety Board concludes that the
outside laboratory had possession of the disk with the ultrasonic indication
{as confirmed by the outside laboratory) at the time that the disk that
eventually separated was receiving its final processing through GEAE.
Therefore, the Safety Board believes that the two S/N MPO 00385 disks were
not switched at GEAE.

The results of the chemical analyses show that disks S/N MPO 00382
through S/N MPO 00388 could have been forged from two or more bi 11 ets.
However, no further records were found either at GEAE or Alcoa that could
confirm the origin of the material. Only 1 imited, uncorroborated evidence
suggests that the failed disk was produced from titanium not intended for use
in rotating engine parts. However, if such a situation had existed, it could
have contributed to the accident.

A primary purpose for lengthy retention of manufacturing and
maintenance records, in addition to the certification of materials and
procedures, is traceability in the event of in-service difficulties or
failures. However, the records are only as useful as the thoroughness and
accuracy of the persons initiating them and the system used for auditing,
handling, and storing them. It appears that in the early 1970’s, much of the
data entry and transferral was accomplished by hand and that GEAE did not
adequately audit critical parts records for accuracy. Consequently, the
Safety Board concludes that the recordkeeping portion of GEAE’s quality

li!i
~

.

~ :(;._, I
~’··~
;; ‘I I .’·

83

assur~nce progr~m on the manufacture of CF6-6 fan disks in the early 1970’s
was deficient.

The Safety Board is concerned that adequate manufacturers’
recordkeeping provisions may not currently be in effect. Consequently, the
Safety Board recommends that the FAA conduct a comprehensive evaluation of
manufacturing recordkeeping and audit procedures to ensure that adequate
quality assurance and traceability of critical airplane parts can be
accomplished at all manufacturing facilities.

2.5.1 Quality Assurance During Manufacturing Process

Ultrasonic and macroetch inspections were performed during the
manufacturing process in 1971. The Safety Board tried to determine whether
some GEAE inspection process could have or should have detected the hard
alpha defect that served as the initiation point for the fatigue crack.

In the area of the bore surface of the disk, only about 0.15 inch
is removed from the rectilinear machine forging shape during machining to the
final shape. Since it is known that the altered microstructure surrounding
the core of the hard alpha defect in the disk bore extended at least
0.273 inch aft of the center of the cavity, and for a smaller distance
forward, the altered microstructure may have extended through most or all of
the material removed during final machining. However, there are two reasons
why the altered microstructure may not have been detectable on the
rectilinear machine forged shape. ·

First, the material grain flow is largely parallel to the bore
surface at this location. Therefore, the material segregation area would
have a distinct tendency to be elongated in the direction of the grain flow,
that is, in the axial direction. Because of this tendency, the radial width
of the segregation area may have been much smaller than its axial length and
therefore may not have extended to the surface of the rect i 1 i near machine
forged shape.

Second, some form of altered microstructure may have been detected
during the inspection of the rectilinear shape, and the microstructure may
have been evaluated and found acceptable, but no record of such an inspection
evaluation has been found. This possibility is plausible since most of the
area outside the core of the hard a 1 pha defect contained a mi eras tructure
that, while obviously different from the matrix microstructure, was
acceptable per the material specifications.

The ultrasonic inspection that was conducted on the rectilinear
shape of the separated disk by GEAE in 1971 could have detected the hard
alpha area only if there had been cracking or voids associated with the
defect. The defect was far enough below the rectilinear shape surface that
the nnoise” associated with entry of the ultrasonic beam into the part would
not have affected the response from the hard alpha area. Therefore, it is
possible that either the hard alpha area did not have voids or cracks
associated with it at that time or the inspection was performed incorrectly
or inadequately.

.J

84

Information available from the titanium industry indicates that
virtually all the hard alpha defects that have been detected ultrasonically
are associated with relatively large voids. This information is reasonable,
since the presence of large voids makes detection of the hard alpha much
easier by ultrasonic inspection. However, certain hard alpha defects may not
be associated with large voids. This condition was demonstrated by the hard
alpha defect areas found within the web of one of the sister disks,
S/N MPO 00388. Detection of defects of this type would be difficult using
ultrasonic inspection methods, since the change in ultrasonic attenuation at
the boundary between the parent metal and the hard alpha is neither abrupt
nor large. .

During the metallographic evaluation of the ultrasonically located
defect in disk S/N MPO 00388, significant amounts of microcracks were found
associated with areas of hard alpha. It is these cracks that 1 ed to the
detection of the defect areas through ultrasonic inspections conducted after
the accident. Disk S/N MPO 00388 was al so ultrasonically inspected during
1971, while it was in the rectilinear shape, and no indications above the
rejectable limits were reported. This fact suggests that if a proper
manufacturing inspection was performed, the microcracking associated with the
defects in MPO 00388 was introduced into the disk after the 1971 ultrasonic
inspection of the rectilinear shape. However, the ultrasonic indications
generated from the recent postaccident inspection were only at the
rejectable limit, and differences in the 1971 rectilinear shape inspection
and the recent inspection on the final part shape make the two inspections
not identical because of both procedural inspection changes over time and the
alterations by final machining.

During 1971, GEAE manufacturing specifications required the disks
to be macroetched in order to inspect for material segregation and other
material-related defects. The etchant used by GEAE was a mixture of
hydrofluoric and nitric acids in water. The disks were etched while in the
rectilinear shape. Representatives of GEAE stated that the final shape of
the disk was not macroetch inspected for a variety of reasons, including

. concern that the etching procedure would remove too much of the surface
material. GEAE’s current etching practice for disks is nearly identical to
the practice in 1971, with the exception that a second, contrast-enhancing
step has been added to the etching procedure.

Although GEAE vendors used final shape etching on fan blades, the
process was not intended to detect microstructural anomalies. The Safety
Board was informed during the investigation that the final shape etching
process was intended to enhance the subsequent in-process inspections.

By contrast, other major turbine engine manufacturers have used a
final shape etching procedure for many years. It is called blue etch
anodizing {BEA), and it is used to macroetch titanium parts, including fan
blades and disks. During the investigation, the Safety Board employed the
BEA procedure on the pieces of the separated disk, as well as on the sister
disks (the disks reportedly from the same heat as the separated disk). A
comparison between the BEA procedure and the GEAE macroetchi ng procedure
showed that they were approximately equal in their capability to detect

..
~

[YU”(( I
~ .·)·· ..
, .•. I . •
:.;…·

85

material segregation, such as was found on disk S/N MPO 00388. However,
neither BEA nor an acid etch would detect a subsurface defect.

The UA 232 accident occurred because an undetected hard a 1 pha
inclusion on the surface of the disk caused initiation of a fatigue crack
that eventually grew to a critical size, producing catastrophic separation of
the disk. The initial hard alpha inclusion may not have been detectable
using the 1971 or current ultrasontc inspection. methods. In addition, the
macroetching procedure that GEAE performed during the manufacturing process
may not have been capable of detecting the flaw because the macroetch was
performed on the rectilinear machine forged shape instead of on the final
part shape. Based on the Safety Board’s conclusion that the cavity was most
likely created during the final machining and/or shot peening process, the
Safety Board further concluded that the flaw would have been apparent if the
part had been macroetched in its final part shape. The Safety Board
addressed this issue in its safety recommendation A-90-91 issued
June 18, 1990. (See section 4).

2.6 Operator Inspection Program and Methods

Maintenance records indicated that the stage 1 fan disk, the fan
booster disk, the fan shaft, and the No. 1 bearing had been inspected in
accordance with the UAL maintenance program and the GEAE CF6-6 shop manual.
The records search also showed that none of the engines in which the fan disk·
had been installed had experienced an overspeed or bird strike. There were
no items in the prior 3 months’ flight records relating to the fan
components.

The stage 1 fan disk records indicated that the disk had been
through six detailed part inspections in its lifetime, each of which included
FPI of the entire disk. All of them had been stamped and accepted by the
inspectors with no crack indications observed. The last inspection was about
1 year prior to the accident. All the records examined, as well as the life
history and tracking methods, appeared to be in accordance with the
FAA-approved UAL maintenance program.

Based on the evaluations and contributions from GEAE; UAL, and FAA,
the Safety Board believes that the GEAE predictions of crack size more
closely represent actual conditions. That is, GEAE fracture mechanics
predictions indicate that, at the time of the last inspection, the length of
the crack was almost 1/2 inch along the bore surface.

The portion of the fatigue crack around the origin that was
discolored was slightly less than 1/2-inch long along the bore surface. This
size corresponds reasonably well to the size of the crack predicted ·by the
GEAE fracture mechanics evaluation. Therefore, the Safety Board concludes
that the discolored area marks the size of the crack at the time of the last
inspection and that processing steps during the inspection created the
discoloration.

i:
. ~ :

86

. During FPI inspection, a crack the size of the discolored region
should have a high probability of detection, presuming that a proper
inspection was conducted. At the time of the inspections prior to the most
recent inspection in April 1988, the crack in the disk would have been much
smaller. However, the GEAE fracture mechanics evaluation indicated that the
surface length of the crack during several of the inspections prior to
April 1988 was such that the crack would normally have been detectable by
FPI. The Safety Board recognizes, however, that the unique metallurgical
properties of the origin area may have altered the detectability of the crack
during these inspections.

One factor that might “close” a crack and make detection more
difficult is the presence of residual bulk compressive stresses. These
stresses can be generated when a part is loaded so heavily that the yield
stress is exceeded in local areas, resulting in permanent elongation of the
metal fo the stressed area. When the stress is removed, the unyielded
material tries to force the yielded material to return to its original
condition, resulting in a residual compressive stress on the yielded area and
a residual tensile stress on the adjacent unyielded material.

Measurements on one of the sister disks revealed virtually no bulk
residual stresses. Also, there is no reason to expect that the disk normally
would have operated under conditions allowin~ stresses as high as the yield
stress to be generated on the disk. Therefore, the Safety Board discounted
the residual stress theory as a reason for UAL’s not detecting the crack at
its inspection. ·

UAL has asserted that it is possible for the compressiv~ layer
associated with shot peening to “close” a crack in shot peened titanium
alloy, thereby preventing entry of the FPI fluid into the crack. The Safety
Board is aware that shot peening or other types of mechanical work performed
on the surface, if done immediately prior to inspection, may .reduce or even
eliminate the FPI indication. However, discussions with the FAA National
Resource Specialists (for Fracture Mechanics and Metallurgy and for
Nondestructive Evaluation) and other industry experts have indicated that
shot peening, performed prior to cracking, has only a minimal effect on the
probability of detection of a given sized flaw. In support of this
contention, UAL attempted to obtain shot peened titanium engine components
with large cracks that could not be detected using FPI. However, UAL
personnel stated that the only components available up to the date of this
report contained small cracks that, while they could be detected using eddy
current inspection, were below the detectable limits of the FPI process.
Further, the Safety Board possesses data indicating that FPI has long been a
proven inspection method for detecting cracks on other shot peened parts.
Therefore, the Safety Board concludes that the presence of shot peening on
the fan disk should not have prevented the detection of the nearly 1/2-inch
long crack in the disk bore at the last inspection .

Analytical procedures performed on the fracture face of the segment
of the rotor disk and water washings from this surface showed the presence of
di and triphenyl phosphates, compounds present in FPI fluid similar to that
used to inspect the disk prior to the failure. This unique combination of

87

chemicals shows that the crack existed at the time of this inspection and
that the crack was sufficiently open so that the FPI fluid entered the crack.
Based on this finding and the conclusion from metallurgical analysis that the
crack was approximately 0.5 inch long on the surface of the bore of the
rotor disk at the time of last inspection, the Safety Board concludes that
the crack was detectable at the time of last inspection with FPI fluid.
However, the crack was not detected and consequently the rotor disk was
considered to be free of flaws and was accepted as a serviceable part.

A r·eview of the inspection process suggests several explanations
for the inspector’s failure to detect the crack. It is possible that the
inspector did not adequately prepare the part for inspection or that he did
not rotate the disk, as it was suspended by a cable, to enable both proper
preparation and subsequent viewing of all portions of the disk bore,
particularly the area hidden by the suspension cable/hose. It is also
possible that loose developer powder, which could have dropped from the
suspension cable, obscured the crack sufficiently to prevent its recognition
as a flaw. Finally, inspection experience indicates that certain areas of
CF-6 disks, because of their geometry, frequently show large FPI indications
and that other areas rarely do so. One such area of frequent indications is
around the perimeter of the disk near the dovetail posts. By contrast, the
central bore area apparently has rarely produced FPI indications. Thus, it
is possible that the inspector did not consider the bore area a critical area
for inspection, as stated in UAL’s inspection directives, and that he gave
the bore area only cursory attention, thereby reducing the likelihood that a
crack would be detected. Any of these possibilities, or some combination of
them, could have contributed to nondetection of the crack in this case.

The UAL maintenance program is comprehensive and based on industry
standards. The company’s inspection requirements for the CF6-6 stage 1 fan
disk are generally consistent with other airline practices and comply with
Federal regulations. Further, UAL’s procedures for selecting, training, and
qualifying NDI personnel are also consistent with industry practices.
However, it is clear that the adequacy of the inspections is dependent upon
the performance of the inspector. That is, there are human factors
associated with NOi processes that can significantly degrade inspector
performance. Specifically, NDI inspectors generally work independently and
receive very little supervision.· Moreover, there is minimum redundancy built
into the aviation industry’s FPI process to prevent human error or other task
or workplace factors that can adversely affect inspector performance.
Because of these and other s imi 1 ar factors, the Safety Board is concerned
that NDI inspections in general, and FPI in particular, may not be given the
detailed attention that such a critical process warrants.

The Safety Board addressed the issue of human factors i.n NOi
inspector reliability following the Aloha Airlines B-737 accident near Maui,
Hawaii, in April 1988. As a result of its investigation of the Aloha
accident, the Safety Board issued two recommendations to the FAA that are
relevant to the maintenance and inspection issues identified in this case.

=~
io

88

A-89-56

Require formal certification and recurrent training of
aviation maintenance inspectors performing nondestructive
inspection functions. Formal training should include
apprenticeship and periodic skill demonstration.

A-89-57

Require operators to provide specific training programs for
maintenance and inspection personnel about the conditions
under which visual inspections must be conducted. Require
operators to periodically test personnel on their ability to
detect the defined defects.

In its response to these recommendations, the FAA acknowledged that
its Aging Fleet Evaluation Program has highlighted some of the same
deficiencies outlined by the Safety Board and that it is addressing these
issues as part of regulatory reviews of 14 CFR Parts 65 and 147. The FAA
also indicated that the ultil ization of inspector personnel, and the human
factors aspects of such utilization, are also being examined. Based on the
FAA’s response, these recommendations hav.e been classified as “Open–
Acceptable Action.”

The Safety Board also believes that the manual inspection systems
used to inspect the vast majority of aircraft structural and engine
components are inherently susceptible to human factors problems that can
significantly reduce the probability of detecting a given defect. Automation
of NOi is already available with current technology. Automated eddy current,
ultrasonic, and FPI equipment can be employed by airline maintenance centers.
The Safety Board believes that the FAA should follow through with a research
program to identify emerging technologies for NDI that simplify or automate
the inspection processes, provide funding to initiate demonstration programs,
and encourage operators and others that perform inspections to adopt superior
techniques and equipment. The FAA should also encourage the development and
implementation of redundant (“second set of eyes”) inspection oversight for
critical part inspections, such as for rotating engine parts.

Subsequent to the Aloha Airlines accident and several other mishaps
in which structural problems in high-time air carrier airplanes were
identified, it became increasingly evident that the qua1 ity of maintenance
ultimately depends directly on the performance of line maintenance and
inspection personnel. Accordingly, the FAA has initiated a continuing series
of government/industry meetings to address “Human Factors Issues in Aircraft
Maintenance and Inspection.”

The first of these 2-day meetings was held in October 1988, and
the second was held in December 1988. The first meeting identified
communication, in all its forms, as being of considerable importance in
aviation maintenance and as a matter in need of attention. The second
meeting focused further on issues of “information exchange and
communications.” A number of recommendations to the FAA resulted from these

89

meetings in the areas of communications, training, management regulatory
review, and research and development. A third meeting was held in June 1990
that focused on training issues, and additional meetings are planned by the
FAA to address other aspects. of the maintenance and inspection problem. FAA
representatives have indicated that the results of these meetings will serve
as prospective contributions to its Human Factors Research and Development
program and to its regulatory review activities.

The Safety Board is encouraged by these developments and urges the
FAA to continue these worthwhile efforts on an expedited basis with a view
toward establishing a constructive dialogue with the key elements of the
aviation maintenance community. ·

2.7 Philosophy of Engine/Airframe Design

2.7.1 Hydraulic Systems/Flight Control Design Concept and Certification

The three hydraulic systems installed on the DC-10 are physically
separated in a manner that is intended to protect the integrity of the
systems in a single-event-failure. Hydraulic fluid is isolated between the
three independent systems and alternate motive systems and auxiliary systems
are provided.

During the investigation of this accident, the Safety Board
reviewed alternative flight control system design concepts for wide-body
airplanes. The concept of three independent hydraulic systems, as installed
on the OC-10, is not unique. Boeing and Airbus have three such systems on
some of their most recently certified models. Lockheed and Boeing have also
provided four independent systems on some of their wide-body airplanes. The
Safety Board can find no inherent safety advantage to the installation of
additional independent hydraulic systems for f1 ight controls beyond those
currently operating in today’s fleet. However, the Safety Board believes
that backup systems to the primary hydraulic systems should be developed and
included in the initial design for certification. Such backup systems are
particularly important for the coming generation of wide~body airplanes.
Manual reversion flight control systems are quite likely impractical because
of the power requirements to deflect large control surfaces that are heavily
loaded. Therefore, the Safety Board recommends that the FAA encourage
continued research and development into backup flight control systems that
employ an alternative source of motive power.

Additional design precautions could have been taken by Douglas if
the potential effect of the distribution pattern and fragment energy levels
had been predicted. Engine manufacturers should provide such data to the
airframe manufactures who can then incorporate measures to count~r the
effects into the airframe design. The problem is complicated by many
factors, including the interaction of the nacelle design, engine pylon
design, and supporting airframe structure.

During the _UA 232 accident sequence, once the fan disk failed and
the pieces began to escape the confines of the containment ring, the
dispersion of rotor disk and fan blade fragments was altered by contact with

90

both engine components and the airplane structure. The Safety Board did not
attempt to determine the specific origin or trajectory of each fragment that
damaged the airplane in flight. For accident prevention purposes and in the
course of making safety recommendations, it was sufficient to recognize that
catastrophic damage from the failure of rotating parts can originate from
any fragment source with sufficient energy to penetrate the airplane’s
structure.

The s·afety Board considers in retrospect that the potential for
hydraulic system damage as a result of the effect of random engine debris
should have been given more consideration in the original design and
certification requirements of the OC-10 and that Douglas should have better
protected the critical hydraulic system(s) from such potential effects. As
a result of lessons learned from this accident, the hydraulic system
enhancement mandated by AD-90-13-07 should serve to preclude loss of flight
control as a result of a No. 2 engine failure. Nonetheless, the Safety Board
is concerned that other aircraft may have been given similar insufficient
consideration in the design for redundancy of the motive power source for
flight control systems or for protecting the electronic flight and engine
controls of new generation aircraft. Therefore, the Safety Board recommends
that the FAA conduct system safety reviews of currently certificated aircraft
in light of the lessons learned in this accident to give an· possible
consideration to the redundancy and protection of power sources for flight
and engine controls.

2.7.2 Future Certification Concepts

On March 9, 1988, the FAA issued AC 20-128, in part as the result
of a Safety Board recommendation made in 1982. The AC provides for a method
of compliance with FARs that require design precautions to be taken to
minimize the hazards to an airplane in the event of an uncontained engine or
auxiliary power unit failure. The AC defines dispersion angles for fragments
that may be released during a fan blade or rotor failure. These angles
define impact areas relative to the engine installation based on recorded
observations of the results of failures both in service and in tests. The AC
also provides a listing of design considerations to minimize damage to
critical structural elements and systems in the airplane, and defines the
fragment energy levels that can be expected from the failure of a fan blade
or predicted pieces of a rotor.

The Safety Board notes that the AC provides the engine/airframe
designer with information that had previously been left to the interpretation
of the designer. The Safety Board also notes that the initial operational
capability of the high-bypass-ratio turbofan engines began in the early
1970’s. For almost 20 years, and obviously during the development period of
the majority of the wide-body fleet, a recognized . interpretation· of the
regulations concerning hazards related to uncontained engine failures was not
published by the FAA. The Safety Board believes that improved industry and
FAA research and development programs in the area of uncontained engine
failures and their effects will significantly improve the safety of the
aviation fleet.

91

The Safety Board believes that the engine manufacturer should
provide accurate data for future designs that would allow for a total safety
assessment of the airplane as a whole. It is possible that in the interest
of marketing a new engine to an airframe manufacturer, the engine
manufacturer may underestimate the potential for failure and resultant
damage. Similarly, the airframe manufacturer may not possess the data
necessary to estimate the total interactive effect of the powerplant
installation on the airframe. ·

14 CFR 25.901 paragraph (c) states: “for each powerplant and
auxiljary power unit installation, it must be established that no single
failure or malfunction or probable combination of failures will jeopardize
the safe operation of the airplane, except that the failure of structural
elements need not be considered, if the probability of each failure is
extremely remote”. 14 CFR 25. 903 paragraph (d) (1) states: “for turbine
engine installation design precautions must be taken to minimize the hazards
to the airplane in the event of an engine rotor failure or of a fire
originating within the engine which burns through the engine case.”

14 CFR 25.901 and 25.903 are intended to bridge the gap between
Part 25 and Part 33 regulations. An engine manufacturer can meet the
requirements of Part 33 for an engine without regard to the airframe
requirements of Part 25. The expense involved in designing, certifying, and
manufacturing turbine engines requires that engine manufacturers produce
engines that may be installed on several different model airplanes.
Consequently, the same basic engine is usually installed on airplanes
manufactured by several different companies. Each installation has its own
inherent safety considerations. The differences between wing-mounted,
fuselage-mounted, and tail-mounted installations, and the number ·of engines
present, require specific system safety assessments that are not currently
explicitly required.

Although AC 20-128 provides the airframe manufacturer with a method
for compliance with 14 CFR 25.903, it implies that the manufacturer should
consider fragment energy levels that only the engine manufacturer can
provide, and that compressor and turbine disk segment noncontainment should
be considered. However, the AC does not specifically address large fan disk
segments. Further, the AC is predicated on a three-piece disk rupture with
only 1/3 of the disk penetrating the airplane. The Safety Board believes
that in future aircraft certifications, the FAA, when assessing compliance by
the airframe manufacturer with 14 CFR 25.903, should require that the engine
manufacturer provide, and the airframe manufacturer consider, fragment sizes
,and energies such as those encountered in this accident.

In addition, in the case of large fragments, such as the fan disc
segments, the spread angle or dispersion area as defined in AC 20-128 may be
inadequate. This accident demonstrated inconsistancies between the
predictions of AC 20-128 and the realities of the actual damage to the
airframe in this accident. Also, the fact that there was titanium alloy
transferred to the No. 4 banjo frame may mean that the banjo piece moved into
the dispersion path. However, it may also mean that the frame was struck by
the uncontained fragment of the rotor disk assembly when the fragment was.

•I
I

:’.i.

. :.

1′
! ,,

92

oriented out of its plane of rotation by unbalanced forces during the
separation sequence. If the uncontained fragment is displaced out of plane,
the spread angle is then a function of the disk fragment dimensions and
should be considered when showing compliance with 25.903. Therefore, the
Safety Board recommends that the FAA analyze the dispersion pattern, fragment
size, and energy level of released engine rotating parts in this accident and
include the results of this analysis, and any other peripheral data
available, in a revision of AC 20-128 for future aircraft certification.

Following this accident, the Safety Board attempted to obtain
historical. data and recent operating experience regarding engine rotating
part failures and noncontainment events. The most recent information readily
available were the two SAE reports that provided data only through 1983. The
Safety Board is concerned that there may not be a central repository for a
current and complete data base for engine rotating part noncontainment
events. The Safety Board believes that the FAA should review the current
reporting requirements for manufacturers and operators to establish a
centrally available data base of these events based on operator and engine
manufacturer knowledge and inservice experience.

The Safety Board recommends that the FAA establish a system to
monitor the engine rotary parts failure history of turbine engines and to
support a data base sufficient for design assessment, comparative safety
analysis among manufacturers, and more importantly, to establish a
verifiable background for the FAA to research during certification review.
This system should collect worldwide data by means of the reporting
requirements for manufacturers contained in 14 CFR Part 21.3.

2.8 Survival Aspects

Prelanding preparation improved the prospects of survivability for
those occupants seated in areas where the fuselage remained intact.
Passengers were in protective brace positions, seatbelts were tightly
fastened, and the cabin was properly secured~

With the exception of two elderly passengers who died of asphyxia
from smoke inhalation, all of the occupants in rows 9-21 were able to
evacuate in spite of smoke from the postcrash fire. Although most passengers
were able to escape without assistance, several passengers stated that they
were assisted by other passengers.

The ceiling structure collapsed throughout the fuselage; however,
the greatest amount of collapse was found in the area near the left wingbox.
Consequently, passengers in that section of the fuselage had less space
available in which to extricate themselves from their seats and· escape.
Thirty three passengers in this section died of smoke inhalation: twelve of
those 33 passengers had blunt trauma injuries that may have incapacitated
them or slowed their escape; the other 21 persons did not sustain blunt trama
injuries. Escape for those passengers seated on the left side of cabin in
rows 22-30 was hampered by the hazardous combination of fuselage crush and
immediate exposure to the smoke entering the fuselage. Most passengers on

I

93

the right side of the cabin in rows 22-30 were able to escape because there
was less crushing in that area.

The other fatalities resulted from blunt force impact injuries.
These passengers were-located in areas where the structural integrity of the
airplane was destroyed during the impact sequence.

Current FAA regulations allow occupants who have not reached their
second birthday to be held in the lap of an adult. The Safety Board believes
that this regulation does not adequately protect occupants under age 2 and
urged the FM to require that infants and small children be restrained in
child safety seats appropriate to their height and weight. The Safety Board
believes that time consuming flight attendant duties, such as providing
special brace-for-impact instructions for unrestrained infants, answering
questions about those instructions, and distributing pillows in an effort to
enhance the effectiveness of adult lap belts on small children, could be
reduced if child restraint was mandatory. Thus, flight attendants could
devote more time to other important duties while they prepare the cabin for
an emergency landing. The Safety Board issued Recommendations A-90-78 and
A-90-79 to address the child restraint issue on May 30, 1990. {See
section 4).

When the engine failure occurred, the flight attendants were
conducting a meal service. The captain contacted the senior flight attendant
and instructed her to prepare the cabin for an emergency landing.

There were two types of cabin preparation contained in UAL’s Land
Evacuation Checklist: Full Cabin Preparation (over 10 minutes) and Short
Notice Emergency Landing Preparation (under 10 minutes). Both types of
preparation required the senior flight attendant to determine how much time
was available prior to landing. The senior flight attendant determined to
keep things “normal” in the cabin and delayed the emegency cabin
preparations. Although the delay did not affect the eventual safety of
passengers, the Safety Board believes that the senior flight attendant’s
primary goals should have been to ensure that there was adequate time to
complete a full cabin preparation in the face of an obviously severe
emergency. The Safety Board recommends that time management of emergency
cabin preparations be reiterated in flight attendant emergency training.

2.9 Emergency Management

Overall, the established airport/county emergency plan, the recent
full-scale disaster drill in 1987, and the nearly 1/2-hour of warning time
facilitated the management of the emergency response. The emergency
responders arrived at the scene expeditiously, established control, conducted
fire suppression, and transported the injured.

The amount of agent used was appreciably more than the FAA
index “B” requirements. A DC-10 routinely requires an index “D” airport
under Part 139, which requires more than twice the quantity of firefighting
extinguishing agents and vehicles required of an index “B” airport. Because
of the large fire, the extinguishing agent was expended and the firefighters

94

were ‘Unable to control the fire surrounding the center section of the
fuselage. The Safety Board believes that the initial mass application of •.. ·
foam to the cabin section of the inverted fuselage facilitated evacuation of
the ambulatory survivors. The Safety Board was unable to determine whether
attempts by firefighters to rescue potential survivors would have been
successful after the crash because of the rapidly deteri orating survival
conditions.

There were several problems with the ability of the ARFF service to
control the postcrash fire at the airplane’s right wing root because the
cornstalks and the wind direction limited the access of ARFF vehicles only to
the east side of the inverted cabin. The height and density of the
cornstalks also interfered with the firefighters’ ability to see debris and
passengers. Some of the passengers were on the ground and others were
walking between the cornstalks trying to find a path leading away from the
bu~ning ~abin. ·

Furthermore, The FAA has no guidance for ARFF operations in unique
terrain, where crops can limit visibility and mobility. Considering the
visibility constraints on emergency responders and terrain limitations, the
FAA should reassess 1ts policy that allows crops to be cultivated on
certificated airports. The Safety Board believes that the FAA should ensure
that surface obstructions, including certain agricultural crops should not be
present where they might interfere with rescue and firefighting activities.
A Safety Board recommendation to that effect has been addressed to the FAA.
(See section 4}.

When the P-18 vehicle’s water pump failed during the resupply •… ·:
attempts, no extinguishing agent was applied to the fuselage for about
10 minutes. Duri.ng this period, the fire at the airplane’s right wing root
intensified. Soon thereafter, the fire penetrated the cabin and resulted in
deep-seated fires within the cabin that could not be reached by an exterior
firefighting attack. Despite attempts to advance hand lines to the interior
of the airplane, the magnitude of the fire intensified inside tha cabin and
burned out of control for approximately 2 1/2 hours.

The results of the examination of the P-18 pump revealed a problem
with the design of the suction hose assembly. The defect caused the suction
hose to collapse, blocking the flow of the water.

Tyndall Air For~e Base personnel had detected the same problem in
February, .1989. However, the U.S. Air Force did not take immediate action to
correct this problem until after the UA 232 accident, 5 months later. There
is further concern that all in-service Kovatch P-18 vehicles may not have
been properly modified. Even though the Air Force is attempting to
distribute modification kits for the P-18 internal hoses, there is no
assurance, without an inspection and test of all units, that all the P-18’s
have been properly modified with the replacement hose assembly.

Of further concern is the absence of requirements for 14 CFR 139
operators to test routinely all fire-service equipment at their full-rated
discharge capacity. In the absence of full-capacity testing, deficiencies in

•r1?>. Et’ ·t.V

j
l

~lu
I
I

95

the operation of key fire/service equipment may go undetected until
emergency conditions occur. –

As vividly demonstrated by the UA 232 accident, all fire-service
equipment should be tested at full-rated capacity prior to acceptance by the
ARFF service and tested periodically thereafter. This practice would allow
routine training opportunities for ARFF personnel and the opportunity to
identify equipment deficiencies. Safety Board recommendations’· regarding
emergency equipment management have been addressed to both the FAA and the
Department of the Air Force. (See section 4).

2.10

2.10.1

Adequacy of Actions Taken Since the Accident

CF6-6 Fan Disk Inspection Programs

As a result of the accident, GEAE developed an ultrasonic
inspection program to reverify the airworthiness of the CF6-6 engine fan
disks. This inspection program was initially issued in SB 72-947 on
September 15, 1989. Two revisions of SB 72-947 were issued, one in
October 1989, and one in November 1989. The changes in the revisions were to
expand the subject population and add disk serial numbers to the list of
disks to be inspected.

SB 72-947.defined three categories of disks. Category I disks were
from the heat that produced the separated disk; Category II disks were disks
from heats with raw material in common with the heat that produced the
separated disk {including some heats made with the triple vacuum-melting
process); Category III disks were all remaining disks from heats made with
the double vacuum-melting process.·

Even .before the pieces of separated disk were discovered in
October 1989, it was believed probable that the fan disk separated as a
result of material anomalies. Because material anomalies can be shared
throughout a particular heat, soon after the accident GEAE began working
with operators to remove from service the six remaining disks from the heat
that produced the separated disk. Therefore, by the tim~ SB 72-947 was
issued, all Category I disks had been permanently removed from service.

SB-72-947 recommended that Category II disks receive an
i nsta1l ed-engi ne contact-ultrasonic inspection by November 21, 1989,. and an
immersion-ultrasonic inspection no later than April 1, 1990. It also
recommended that Category III disks receive an installed-engine ultrasonic
inspection by February 4, 1990, and at intervals of 500 cycles or less,
thereafter, and an immersion-ultrasonic inspection no later than December 31,
1990. On September 21, 1989, 6 days after SB 72-947 was issued, the FM
issued AD 89-20-01. In effect, this AD made SB 72-947 mandatory.

The installed-engfne contact-ultrasonic inspection {per the AD and
SB) is performed on the disk with only minor disassembly of engine
components. This inspection is designed to be easily performed and to
provide a margin of safety until the more detailed immersion-ultrasonic
inspection can be performed. After a disk has been immersion-ultrasonic

~~
~,·,: ‘. i •
. ,. ‘
!if,i
•:.J!:
:l:

‘ : ..

96

inspected, which’ requires complete disassembly of the disk from the engine,
the provisions of AD 89-20-01 and SB 72-947 are met and no further ultrasonic
inspections are required for the life of the disk. To amplify, GEAE stated
that after the disks were immersion-inspected, the parts were considered to
be equivalent to nonaffected parts.

·one of the inspection modes used during the contact-ultrasonic
irispection.1s specifically designed to detect a radial/axial crack located on
the surface of the bore. This is the orientation and location of. the crack
that led ·to the separation of the. accident disk. However, neither the
contact nor the immersion-ultrasonic inspection mode can detect small cracks
in the corner between the inside diameter of the bore and the front face of
the·bore. · A combination of the following three factors makes this location
a particularly critical one on the disk:

1. Ultrasonic inspections, by their nature, are not capable
of inspecting a volume of material near the entry point
of the beam.

2. The presence of the corner radius between the inside
diameter of the bore and the front face of the bore makes
it difficult to bring an ultrasonic probe close to this
corner.

3. The are·a of highest stress on the disk is the forward
corner of the surface of the bore. Therefore, the
critical crack size is smallest at this location.

GEAE engineers have demonstrated that, using the contact-ultrasonic
inspection, an axial/radial corner slot with a 0.2-inch radius (extending
radially and axially a distance of 0.2 inch) generates an indication that is
slightly above the rejection limit. The engineers estimated that a crack
the size of. the slot would grow to failure in about 650 takeoff/landing
cycles. Upon initial inquiry, GEAE was unable to demonstrate how large a
crack in the forward corner of the bore could be detected using the various
inspection modes in the immersion-ultrasonic inspection.

. . Because the Safety Board was concerned that the ultrasonic
inspections ·alone were insufficient to ensure the long-term airworthiness of
the CF6-6 engine fan disks, the Safety Board issued Safety Recommendation
A-90-BB to the FAA on June 18, 1990. This recommendation suggested that the
FAA develop, with the assistance of GEAE, an alternate inspection method for
the bore 6f the disks and that the FAA require that this alternate
inspection be repeated. at specified intervals to ensure that developing
cr~cks ~r~ detected. (See section 4).

During meetings on Sepember 13, 1990, GEAE demonstrated that a
0.1 inch radius ‘crack in the forward corner of the bore could be detected
using one of the inspection modes in the immersion-ultrasonic inspection.
GEAE estimated that a crack of this size would grow to a critical size in
1,500 cycles. GEAE stated that all Category II and III disks will be removed
from service and replaced with new disks prior to the accumulation of

97

1,500 cycles after immersion inspection.
initiated by the Manager of Customer Service
user airlines. The Safety Board recommends
mandate further service limits or methods of
life on disks inspected per AD-89-20-01.

The replacement program was
through letter exchanges with
that the FAA issue an AD to
inspect ion to extend residual

Also related to CF6-6 fan disk inspections, on June 14, 1990, a few
days before the Safety Board issued Safety Recommendation A-90-88, GEAE
issued a revision to the CF6-6 engine shop manual, inserting provisions for
an eddy current inspection of the bore area of the fan disk. Because the
shop manual is a mandatory part of operators’ FAA-approved maintenance
programs, the eddy current inspection of the bore is required, along with an
FPI of the entire disk, every time the disk is separated from the fan module.

The Safety Board believes that the eddy current inspection can
detect a much smaller surface crack in the forward corner of the bore of the
disk than the ultrasonic inspections. Even though the eddy current
inspection is not required at specific cyclic fotervals, as suggested in
recommendation A-90-88, a typical disk would be expected to become a piece
part and to be inspected a least several times before reaching its life limit
of 18,000 cycles. Therefore, the Safety Board believes that,the inclusion of
the eddy current inspection in the CF6-6 engine shop manual satisfies the
intent of recommendation A-90-88.

2.10.2 Hydraulic System Enhancement

The Safety Board recognizes the value of the hydraulic system
enhancements for the DC-IO in the unlikely event that another OC-10
experiences similar damage to the horizontal stabilizer as a result of a
No. 2 engine failure. The isolation of hydraulic system No. 3 forward of the
empennage has been demonstrated through simulator testing and during actual
flight tests at a safe altitude to provide acceptable limited airplane
controllability. However, it must be pointed out that a leaking system No. 3
hydraulic line or component could cause the system to shut off system No. 3’s
hydraulic power to the empennage while system No. I and system No. 2 may be
functioning normally. The enhancement is designed to alert the flightcrew to
any isolation of system 3 if such a situation occurs.


The Safety Board notes that the incorporation of the flow rate

sensing fuses on some OC-10 airplanes may provide an interim measure of
safety until the installation of the electrically operated shutoff valve can
be completed. Again, the Board notes that in the unlikely event of a Na. 2
engine failure similar to the UA 232 accident, the fuses may provide for
limited additional controllability. The design of the fuse system
enhancement requires that the flow through the fuses be in excess of
15 gallons per minute. The fuses do not function at lower flow rates, and
therefore the fuses will not guarantee protection against an open or breached
hydraulic line if the flow is less than 15 gpm as might occur if a broken
line is pinched.

In summary, the hydraulic system enhancements provided by Douglas
and mandated by the FAA appear to protect the airplane in the unlikely event

98

of a similar No. 2 engine catastrophic failure. ln other failures involving
the hydraulic systems and the No. I and No. 3 engines, the enhancements do
not provide any additional margin of safety. The vulnerability of the DC-10
or other wide-bodied airplanes in the event of such failures is not known.

2.10.3 Industry Task Group Efforts

The Systems Review Task Force (SRTF) originated after the UA 232
accident. The charter of the group, as noted from an Air Transport
Association memorandum to the Transport Aircraft Safety Subcommittee and FAA
Research and Development Advisory Committee in December 8, 1989, stated ·in
part:” … The charter of the SRTF is to: determine possible design concepts
that will provide alternati.ve means of control of flight critical functions
in the event of total loss of all (normal) redundant systems which provide
that control regardless of the probability of such loss.” In addition; the
SRTF was asked to consider the need for improved engine particle
containment. “Where applicable, the concepts developed by the SRTF should
be considered for retrofit of current fleet aircraft.”

Boeing, Douglas, Airbus, Lockheed, General Electric, Pratt and
Whitney, and Rolls Royce are among the airframe/engine manufacturers
represented in the SRTF. Initial reports from the executive steering
committee indicate that progress is continuing in all the working groups and
that a final report will be available near year’s end. The Safety Board
supports this effort and is optimistic, that the FAA will take an active role
in using the committee effort to upgrade design and certification
requirements.

As part of the SRTF, an Engine Containment Working Group {ECWG) is
also functioning. Of interest is the group’s categorization of parts that
may not be contained in the event of failure. This concept states that
there are parts that cannot be contained by any known means. The group’s
approach to this problem is to identify the potential parts in this group, to
characterize their damage potential to the airplanes, and to pay special
attention to them· during design, in-service inspection, and repair. The
group is also studying the incorporation of improved containment designs and
concepts.

The ECWG is also studying inspection reliability. There are
currently proposals for a joint industry/regulatory agency program to
generate the probability of detection statistics for current inspection
techniques and a symposium of manufacturers to address advances in
containment technology.

The Safety Board has a vital interest in the work of the SRTF
industry group. As evident from the UA 232 accident, inadequate predictions
of secondary damage in the area of flight control redundancy have resulted in
both this accident and the crash of a B-747 in Japan. There are many other
wide-body-type airplanes in the world transport fleet that may benefit from a
systems safety review, such as that desired by the FAA Administrator in the
charter to the SRTF group. The Safety Board recommends to the FAA that the

I

i)( ·{I
I

99

SRTF activities receive maximum encouragement and support to attain the
stated objectives.

2.10.4 Damage Tolerance for Commercial Transport Engines

In addition to the separation of the fan disk involved in the
UA 232 accident, there have been many examples of life-limited engine
components failing before they reached their life limit. The Safety Board
believes that this fact demonstrates the need for a revision of the
certification, design, and maintenance philosophies· for turbine engines.
Currently, the certification process for rotating parts in engines assumes
that the materials used are free of defects. Thus, manufacturers are not
required to assume that undetectable defects are present in the material when
the life of the part is calculated and demonstrated. In the case of the fan
disk on the CF6-6 engine, GEAE tests conducted at the time of certification
demonstrated that a defect-free disk could withstand 54,000 takeoff/landing
cycles with no sign of crack initiation. This 54,000-cycle life was reduced
to an FAA-approved life of 18,000 cycles.

The total number of cycles that a part experiences before failure
can be divided into the number of cycles needed to initiate a crack and the
cycles needed to propagate the crack to failure. For most defect-free parts,
the majority of the parts’ total life is in the initiation of a crack, and
only a minor amount in the crack propagation phase. However, the presence of
a preexisting defect in the material can effectively eliminate the initiation
phase of the growth of a crack, leaving only the propagation phase to failure
as residual life. This type of preexisting defect was jn the fan disk
involved in the UAL 232 accident. The hard alpha inclusion became a
crack-like defect very early in the operation of the disk. As cycles
accumulated, the crack grew larger until failure occurred before the life
limit was reached. ·

Because of these concerns, the Safety Board, on June 18, 1990,
issued recommendations A-90-89 and A-90-90 to the FAA. They recommended that
the FAA require operators to incorporate a damage tolerance philosophy into
the maintenance of engine components that, if the components fracture and
separate, could pose a significant threat to the structure or systems of
airplanes on which they are or could be installed. (See section 4).

Under a damage tolerance philosophy, it is assumed that the
component material in critically stressed areas contains flaws of a size just
below the flaw size detectable during manufacturing inspections. Inspection
methods and intervals are thus determined by the detectable crack size per a
given inspection method, the stress level at various positions within the
component, and the crack propagation characteristics of the component
material.

A damage tolerance philosophy has been used during the design phase
for the structure of airplanes certificated after 1978. Also, older airplane
models have an equivalent analysis incorporated into the maintenance of the
structure through the Supplemental Structural Inspection Program, compliance
with which has been made mandatory through AO’s. The Safety Board believes

‘ .

l· i
I ‘.
i
‘;

J,;


ui.,

! .

I
;
·~

i

;

. ;

‘ , ..

:.l’.:
•·’ . ·.

“‘ ‘!

100

that the .FAA should begin an effort to incorporate a damage tolerance
philosophy into the maintenance of certain critical components in turbine
engines for commercial jet transports by investigating and defining the
technological areas that need to be advanced. At the very least, the.
technological advances in damage tolerance assessment, nondestructive
inspection, and probability calculations associated with such programs should
be emphasized for ~se in commercial aircraft maintenance programs.

The Safety Board therefore emphasizes the need for action by the
FAA and industry on recommendations A-90-89 and A-90-90.

3. CONCLUSIONS

3.1 Findings

I. The fl ightcrew was certificated and qualified for the flight
and the airplane was dispatched in accordance with company
procedures and Federal regulations.

2. Weather was not a factor in this accident.

3. Air Traffic Control services were supportive of the fl1ghtcrew
and were not a factor in the accident.

4. The a i rp 1 ane experienced an unconta i ned failure of the No. 2
engine stage I fan rotor disk assembly.

5. No. 2 engine fragments severed the No. I and No. 3 hydraul i c ~
system lines, and the forces of the engine failure fractured ~
the No. 2 hydraulic system, rendering the airplane’s three
hydraulic-powered flight control systems inoperative.
Typical of all wide-body design transport airplanes, there are
no alternative power sources for the flight control systems.

6. The airplane was marginally flyable using asymmetrical thrust
from engines No. 1 and 3 after the loss of all conventional
flight control systems; however, a safe landing was virtually
impossible .

7. The airport emergency response was timely and initially
effective; however, cornstalks on the airfield and the failure
of the Kovatch P-18 water supply vehicle adversely affected
firefighting operations. ·

8. The FAA has not adequately addressed the issue of infant
occupant protection. The FAA has permitted small children and
infants to be held or restrained by use of seatbelts during
turbulence, landing, and takeoff, posing a danger to
themselves and others .

l

i
~
j

I) ~I 😮
!
1

l
;
I

1.-

1
l
l
l

I
j
l
I

.i

j

~1 0
}

l

I

J
I

l
1
l
j

1

l
i
I

~’I 9 1 l .
l

101

0 9. · ··Separation of the titanium alloy stage 1 fan rotor disk was
· ·.··.the result of a fatigue crack that initiated from a type 1

hard alpha metallurgical defect on the. surface ·of the disk
bore.

10. The ·hard alpha metallurgical defect was formed in .·.the
titanium alloy material during manufacture of the ingot from
which the disk was forged.

11. The hard alpha metallurgical defect was not detected by
ultrasonic and macroetch inspections performed by General
Electric Aircraft Engines during the manufacturing process of
the disk.

12. The metallurgical flaw that formed during initial manufacture
··of the titanium alloy would have been apparent if the part had
·been macroetch inspected in its final part shape.

13. The cavity associated with the hard alpha metallurgical defect
was created during the final machining and/or shot peening at
the time of GEAE’s manufacture of the disk, after GEAE’s
ultrasonic and macroetch manufacturing inspections.

14. The hard alpha defect area cracked with the application of
stress during the disk’s 1nitia1 exposures to full thrust
engine power conditions and the crack grew until it entered
material unaffected by the hard alpha defect.

15. General Electric Aircraft Engines material and production
records relevant to CF6-6 stage 1 fan disk S/N MPO 00385,
which was the failed disk, were incomplete.

16. Regarding the existence at General Electric Aircraft Engines
of two S/N HPO 00385 disks, an outside laboratory had
possession of the disk, which was rejected for an ultrasonic
indication at the time that the disk that eventually separated
was receiving it’s final processing on the production 1 ine.
Therefore, the two S/N MPO 00385 disks were not switched at
the manufacturing facility.

17. General Electric Aircraft Engines disk manufacturing records
and associated vendor-supplied documents, together with the
system for maintaining and auditing them, did not assure
accurate traceability of turbine engine rotating components.

– 18. United Airlines fan disk maintenance records indicated that
maintenance, inspection, and repair of the CF6-6 fan disk was
in accordance with the Federal Aviation Administration-
approved United Airlines’ maint~nance program and the General
Electric Aircraft Engines’ shop manual.

102

19. A detectable fatigue crack about 0.5 inch long at the surface
of the stage I fan disk bore of the No. 2 engine existed at
the time of the most recent United Airlines inspection in
April 1988 but was not detected before the accident.

20. The discoloration noted on the surface of the fatigue crack
was created during the FPI process performed by UAL 760 cycles
prior to the accident, and the discolored area marks the size
of the crack at the time of this inspection.

21. The inspection parameters established in the United Airlines
maintenance program, the United Airlines Engineering
Inspection Document, .and the General Electric Aircraft Engines
shop manual inspection procedures, if properly followed at the
maintenance facility, are adequate to identify unserviceable
rotating parts prior to an in-service failure.

3.2 Probable Cause

The National Transportation Safety Board determines that the
probable cause of this accident was the inadequate consideration given to
human factors limitations in the inspection and quality control procedures
used by United Airlines’ engine overhaul facility which resulted in the
failure to detect a fatigue crack ori-ginating from a previously undetected
metallurgical defect located in a critical area of the stage 1 fan disk that
was manufactured by General Electric Aircraft Engines. The subsequent
catastrophic disintegration of the disk resulted in the liberation of debris
in a pattern of distribution and with energy levels that exceeded the level
of protection provided by design features of the hydraulic systems that
operate the DC-lO’s flight controls.

4. RECOMMENDATIONS

As a result of its investigation of this accident, the National
Transportation Safety Board makes the following additional recommendations:

–to the Federal Aviation Administration:

Intensify research in the nondestructive inspection fie 1 d to
identify emerging technologies that can serve to simplify
automate, or otherwise improve the . reliability of the
inspection process. Such research “should encourage the
development and implementation of redundant (“second set of
eyes”) inspection oversight for critical part inspections,
such as for engine rotating components. (Class II, Priority
Action) (A-90-167}

Encourage research and development of backup flight control
systems ·for newly certificated wide-body airplanes that
utilize an alternative source of motive power separate from
that source used for the conventional control system.
(Class II, Priority Action) (A-90-168)

l
;

I
j
j

: l -,.

~ l (t

I
I
l.
1

l
i

I
j

I

l
1

!~

103

Conduct system safety reviews of currently certificated
aircraft as a result of the lessons learned from the July 19,
1989, Sioux City, Iowa, DC-10 accident to give all possible
consideration to the redundancy of, and protection for, power
sources for flight and engine controls. (Class II, Priority
Action) (A-90-169)

Analyze the dispersion pattern, fragment size and energy level
of released engine rotating parts from .the July 19, 1989,
Sioux City, Iowa, DC’.”10 accident and include the results of
this. analysis, and any other .peripheral data available, in· a
revision of AC 20-128 for future aircraft certification.
(Class II, Priority Action) (A-90-170)

Conduct a comprehensive eva 1 uat ion of aircraft and engine
manufacturers’ recordkeeping and internal audit procedures to
evaluate the need to keep long-term records and to ensure that
quality assurance verification and traceability of critical
airplane parts can be accomplished when necessary at all
manufacturing facilities. (Class II, Priority Action)
(A-90-171)

Create the mechanism to support a historical data base of
worldwide engine rotary part failures to facilitate design
assessments and comparative safety analysis during
certification reviews and other FAA research. (Class II,
Priority Action) (A-90-172)

Issue an Air Carrier Operations Bulletin for all air carrier
flightcrew training departments to review this accident
scenario and reiterate the importance of time management in
the preparation of the cabin . for an impending emergency
landing. (Class II, Priority Action) (A-90-173)

Issue an Airworthiness Directive to mandate service life
limits or recurrent inspection requirements on GEAE CF6-6
engine stage I fan disks inspected in accordance with
AD-89-20-01. (Class II, Priority Action) (A-90-174)

Issue an Airworthiness Directive based on the GEAE CF6-6
Engine Service Bulletin 72-962, pertaining to 119 stage 1 fan
disks made from ALCOA forgings, to mandate compliance with the
intent of the s.ervice bulletin by all operators. (Class II,
Priority Action) (A-90-175)

ti
.. !

104

–to the Air Transport Association:

Encourage member operators to incorporate specific maintenance
inspection techi nques 1 n their maintenance manuals and
maintenance contracts that simplify, automate, and provide
redundant {“second set of eyes”) inspection oversight for
critical part inspection, such as for rotating engine parts .

• .
. l (Class II, Priority Action) (A-90-176)

–to the Aerospace Industries Association of America, Inc.

Encourage members to incorporate specific maintenance
inspection techniques and inspection equipment in their
service manuals that simplify, automate, and provide redundant
(

1 second set of eyes”) ·inspection oversight for critical part
inspection, such as for rotating engine parts. (Class II,
Priority Action) (A-90-177)

Also, during .the course 9f this investigation, the National
Transportation Safety Board issued the following safety recommendations to
the Federal Aviation Administration:

On August 17. 1989

Conduct a directed safety investigation (OSI) of the General
Electric CF6-6 turbine engine to establish a cyclic threshold
at which the fan shaft and the fan disks should be separated .;
and inspected for defects in the components. The OSI should
include a review and analysis of:

(a)

(b)

(c)

(d)

the certification, testing and stress analysis
data that were used to establish the life
1 imits of the fan disks and fan shaft
components and the recommended inspect ion
frequencies for these components;


the manufacturing processes associated with the
production of the fan assembly and fan forward
shaft;

meta 11 urg i ca 1 ana 1 ys is of the front flange of
the fan forward ‘shaft in which cracks were
recently discovered;

the maintenance practices
assembly and disassembly of
the fan forward shaft for
damage the components during

involved in th~
the fan disks and
the potential to
these processes;

i
;

I

‘ I
!
I

i
j
i
l
I
l
I

·~ !
t~ I (_:t
,.. I

I

1
j
I

~I ~
I
!

(e)

105

nondestructive inspection of spare fan disks
and fan forward. shafts beginning with those
components with the highest number of cycles in
service; and

(f) nondestructive inspections of fan disks on
installed engines that may be performed by an
approved inspection procedure. · (Class I,
Urgent Action) (A-89-95)

Following completion of the directed safety .investigation of
the General Electric CF6-6 turbine engine ~iscussed in
A-89-95, issue an airworthiness directive to require
appropriate inspections of the fan disks and the fan forward
shaft at appropriate cyclic intervals. (Class I, Urgent
Action) {A-89-96)

Evaluate, because of similarities in design, manufacture, and
maintenance, the need for a directed safety investigation of
all General Electric CF6-series turbine engines with the
objectives of verifying the established life limits for
rotating parts of the fan modules and establishing appropriate
cyclic inspect ion requirements for these parts. (Cl ass II,
Priority Action) (A-89-97)

These recommendations were classified as “Closed-Superseded” by
other recommendations issued on June 18, 1990.

On May 30, 1990

Revise 14 CFR 91, 121 and 135 to require that all occupants be
restrained during takeoff, landing, and turbulent conditions,
and that all infants and small children below the weight of
40 pounds and under the height of 40 inches to be restrained
in an approved child restraint system appropriate to their
height and weight. {Class II, Priority Action) (A-90-78)

Conduct research to determine the adequacy of aircraft
seatbelts to restrain children t6o large to use child safety
seats and to develop some suitable means of providing adequate
restraint for such children. {Class II, Priority Action)
A-90-79)

The FAA Administrator responded to Safety Recommend at ions A-90-78
and -79 on August 6, 1990. Regarding A-90-78, the FAA issued a Notice of
Proposed Rulemaking (NPRM) on February 22, 1990, for child restraint system
provisions. The Safety Board is evaluating the response.

106

On June 18. 1990

1)

2)

3)

4)

Develop, with the assistance of General Electric Aircraft
Engines, an alternate method of inspecting the bore area
of the· CF6-6 engine fan Stage I rotor disks for the
presence of surface cracks; issue an Airworthiness
Directive to require that these disks be inspected with
this method on an expedited basis, that disks found to
have cracks be removed from service, and that the
inspection be repeated at a cyclic interval based upon
the crack size detectable by the inspection method, the
stress level in the applicable area of the disk, and the
crack propagation characteristics of the disk material.
(Class I, Urgent Action) {A-90-88)

Evaluate currently certificated turbine engines to
identify those engine components that, if they fracture
an separate, could pose a significant threat to the
structure or systems of the airplanes on which the
engines are installed; and perform a damage tolerance
evaluation of these engine components. Based on this
evaluation, issue an Airworthiness Directive to require
inspections of the critical components at intervals
based upon by the crack size detectable by the approved
inspection method used, the stress level at various
1 ocat ions in the component, and the crack propagation
characteristic of the component materi a 1 . (Cl ass II I,
Longer Term Action) (A-90~89)

Amend 14 CFR part 33 to require that turbine engines
·certificated under this rule are evaluated to identify
those engine components that, if they should fracture and
separate, could pose a significant threat to the
structure or systems of an airplane; and require that a
damage tolerance evaluation of these components be
performed. Based on this evaluation, require that the
maintenance programs for these engines include inspection
of the critical components at intervals based upon the
crack size detectable by the inspection method used, the
stress level at various locations in the component, and

·the crack propagation characteristics of the. component
material. (Class III Longer Term Action) (A-90-90)

Require turbine engine manufacturers to perform a surface
macroetch inspection of the final part shape of critital
titanium alloy rotating components during the
manufacturing process. (Class II, Priority) (A-90-91)

The FAA Administrator responded to these recommendations in a
letter dated July 31, 1990. The Safety Board is in the process of evaluating
the response.

I

t!rro
l
1
I
;

,, ;.- i (t
~ : .>’

l
I
I

l
i

‘ i

107

On October 19. 1990

Direct Airport Certification Inspectors·to require 14.CFR 139
certificate· holders to inspect the suction hoses on Kovatch
A/S32P-18 water supply vehicles to verify that they
·incorporate the modifications described in Kovatch Technical
Service Bulletin 86-KFTS-P-18-5 and to immediately remove from
service A/S32P-18 vehicles that have not been so modified.
(Class II, Priority Action) (A-90-151}

Amend 14 CFR 139 to require airport operators to perform
maximum capacity discharge tests of a 11 emergency response
fire fighting and water supply vehicles before the vehicles
are accepted for service and on a regularly scheduled basis
thereafter. (Class II, Priority action} (A-90-152)

Make available to all 14 CFR 139 certificated airports an
account of the circumstances of the accident described in
Safety Recommendation letter A-90-147 through -155 as they
relate to the deficiencies identified with the Kovatch
A/S32P-18 water supply vehicle. (Class II, Priority Action)
(A-90-153)

Develop guidance for airport operators for. acceptable
responses by aircraft rescue and fire fighting equipment to
ace i dents in crop environments on airport property.
(Class II, Priority Action} (A-90-154)

Require annual airport certification inspections to include
examinations of airfield terrain to ensure, where practicable,
that surface obstructions, including agricultural crops, do
not interfere with rescue and fire fighting activities.
(Class II, Priority Action) {A-90-155)

The National Transportation Safety Board issued the following
recommendations to the U.S. Department of the Air Force:

On October 19, 1990

Require that Kovatch A/S32P-16 vehicles comply with Kovatch
Technical Service Bulletin 86-KFTS-P-18-5 and expedite the
distribution of .modification kits that will permit compliance
with the service bulletin. (Class II, Priority Action}
(A-90-147)

‘ ‘

Immediately remove from service all Kovatch A/S32P-18 vehicles
until they have been so modified. (Class II, Priority Action)
(A-90-148)

108

Require maximum capacity discharge tests of all emergency
response ·fire service vehicles before the vehicles are
accepted for s·ervice and on an established regular schedule
thereafter. (Class II, Priority Action} (A-90-149}

Make available to all operators of Department of the Air Force
air bases an account for the circumstances of the accident
described in Safety Recommendation letter A-90-147 through
-150 as they relate to the deficiencies in the Kovatch
A/S32P-18 water supply vehicle. (Class II, Priority Action)

· ‘ (A-90-150)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

/s/ James L. Kolstad
Chairman

/s/ Susan Coughlin
Vice Chairman

/s/ Jim Burnett
Member

/s/ John K. Lauber
Member

/s/ Christopher A. Hart
Member

Jim Burnett, Member, filed the following dissenting statement on
the probable cause:

I believe that the probable cause of the accident was:

(1) the manufacture by General Electric Aircraft Engines
(GEAE} of a metallurgically defective titanium alloy first
stage fan disk mounted on the aircraft’s No. 2 engine and the
failure to detect or correct the condition;

(2} ·the failure of United Airlines to detect a fatigue crack
which developed from the defect and ultimately led to a
rupture of the disk and fragmentation damage that disabled the
airplane’s hydraulically powered fight control systems; and

(3) the failure of the Douglas Aircraft Company’s (Douglas)
design of the airframe to account for the possibility of a
random release and dispersion of engine fragments following a
catastrophic failure of the No. 2 engine.

I

·- …

l..t . ~

109

Contributing to the cause of the accident was the failure of
the Federal Aviation Administration’s (FAA) certification
process to require the DC-10 design to account. for the
possibility of a random release and dispersion .of. engine
fragments following an uncontained failure of the No. 2
engine.

GEAE did not use premium grade triple-melt titanium in the
manufacture of the accident disk. GEAE was at that time in the process of
switching to premium grade triple-melt titanium for quality control reasons.
Nevertheless, GEAE missed an opportunity to detect the hard-alpha inclusion
in the accident disk when it conducted a macroetch test on metal that was to
be machined away rather than on the finished fan disk.

The DC-10 was certificated in 1971. In January 1970, the FAA
imposed the following Propulsion Special Condition for the DC-10:

In lieu of the requirements of Section 25.903(d)(l), the
airplane must incorporate design features to minimize
hazardous damage to the airplane in the event of an engine
rotor failure … ”

For compliance, on July 1, 1970, Douglas Aircraft answered, in
part, as follows: ·

The power plants and associated systems are isolated and
arranged in such a manner that the probability of the failure
of one engine or system adversely affecting the operation of
the other engine or systems is extremely remote .

The FAA responded that the information which Douglas provided
concerning protective design features for the DC-10 satisfied .the Propulsion·
Special Condition.

I think that the event which resulted in this accident was
foreseeable, even though remote, and that neither Douglas nor the FAA was
entitled to dismiss a possible rotor failure as remote when reasonable and
feasible steps could have been taken to “minimize” damage in the event of
engine rotor failure. That additional steps could have been taken is
evidenced by the corrections readily made, even as retrofits,· subsequent to
the occurrence of the “remote” event.

November 1, 1990

//0

: ..• ,
“.

1. Investigation

Ill

5. APPENDIXES

APPENDIX A

INVESTIGATION AND HEARING

The Washington Headquarters of the National Transportation Safety
Board was notified of the United Airline’s flight 232 inflight emergency
within minutes of its occurrence. An investigation team was standing by when
notification of the crash was received. The full team departed
Washington, D.C. at 2100 hours and arrived in Sioux City at 0100 hours
central daylight time the following morning. The team was composed of the
following investigative groups: Operations, Human Performance, Systems,
Structures,. Powerpl ants, Maintenance Records, Air Traffic Control, Survival
Factors, and Aircraft Performanc~.

In addition, speci a 1 i st reports were prepared to summarize
findings relevant to the CVR, FDR, Metallurgical Subgroup, and chemical
residue search.

Parties to the field investigation were the FAA, United Airlines,
Douglas Aircraft Company, General Electric Aircraft Engines, the Airline
Pilots Association, the International Association of Machinists, and the
Association of Flight Attendants.

2. Public Hearing

A 4-day public hearing was held in Sioux City, Iowa, beginning on
October 31, 1989. Parties represented at the hearing were the FAA, United
Airlines, Douglas Aircraft Company, General Electrk Aircraft Engines, the
Airline Pilots Association, the International Association of Machinists, the
Association of Flight Attendants, Titanium Metals, Inc., and Aluminum
Corporation of America.

t
i

~
li

Captain .Alfred.C. Haynes

112

APPENDIX B

PERSONNEL INFORMATION

Captain Haynes, 57, was hired by United Airlines on
February 23, 1956. He has 29,967 hours of total flight time with United
Airlines, of which 7,190 is in the DC-10. He holds Airline Transport Pilot
Certificate No. 1337052, latest issue September 21, 1985, with type ratings
in the DC-10 and 8727. His most recent first class medical certificate,
dated Maren· 8, 1989, contained the limitation, “Shall possess glasses fOr
near vision while exercising the privileges of his airman certificate.”

His initial training in the DC-10 was as a first officer and was
completed on February 26, 1976. He was type rated in the DC-10 on
May 11, 1983. On April 6, 1987, he was requalified as a DC-10 captain after
having served as a 8-727 captain since September I985. His most recent
proficiency check in the DC-10 was completed on April 26, 1989.

Captain Haynes’ flight and duty time the previous 24 hour period
was 2 hours OI minute and 2 hours 30 minutes, respectively; for the previous
72 hours it was 10 hours 39 minutes and I4 hours 9 minutes, respectively.
Flight times covering the previous 30, 60, and 90 day periods are: Last 30:
73:45, Last 60: 147:39, Last 90: 212:50.

First Officer William R. Records

First Officer Records, 48, was hired by National Airlines on
August 25, 1969. He subsequently worked for Pan American World Airways. His
first pilot activity at United Airlines was completion of the United Airlines
indoctrination course (PAA Pilots to UAL} on December 26, I985. He estimated
that he had accumulated approximately 20, 000 hours of total flight time.
United’s records indicate that he has accrued 665 hours of flight time as a
DC-10 first officer. He holds Airline Transport Pilot Certificate
No. 1559572, latest issue July IO, I984, with type ratings in the L-lOlI and
DC-10. His most recent first class medical c~rtificate, dated June 14, 1989,
was issued with the limitation, “Holder shall possess glasses which correct
for near vision while exercising the privileges of his airman certificate.”

First Officer Records completed United’s DC-10 transition course on
August 8, I988. This was also the date of his last proficiency check.

First Officer Records’ flight and duty time the previous 24 hour
period was 2 hours 01 minute and 2 hours and 30 minutes, respective 1 y; for
the previous 72 hours it was IO hours and 39 minutes and I4 hours and
9 minutes, respectively. Flight time covering the previous 30, 60, and
90 day periods are: Last 30: 83:I3, Last 60: 146:50, Last 90: 2Il:27.

113

Second Officer Dudley J. Dvorak

Second Officer Dudley J. Dvorak, 51, was hired by United Airlines
on May 19, 1986. He estimated that he had approximately 15,000 hours of
total flying time. United’s records indicate that he has accumulated
1,903 hours as a second officer in the B-727 and 33 hours as a second officer
in the DC-10.

Second Officer Dvorak holds Flight Engineer Certificate
No. 340306866, dated August 7, 1985, for turbojet. His most recent second
cla~s medical certificate was issued on August 22, 1988, with the limitation,
“Holder shall possess correcting glasses for near vision while exercising the
privileges of his airman certificate.

Second Officer Dvorak completed DC-10 transition training on
June 8, 1989. This is also the date of his last check ride.

Second Officer Dvorak’s flight and duty time the previous 24 hour
period was 2 hours 01 minute and 2 hours 30 minutes, respectively; for the
previous 72 hours it was 10 hours 9 minutes and 14 hours 9 minutes,
respectively. His flight times covering the previous 30, 60, and 90 day
periods are: Last 30: 46:00, Last 60: 54:11, Last 90: 78:42.

Training Check Airman Captain Dennis E. Fitch

Training Check Airman Captain Dennis E. Fitch, 46, was hired by
United Airlines on January 2, 1968. He estimated that prior to his
employment with United he had accrued between 1,400 and 1,500 hours of flight
time with the Air National Guard. His total DC-10 time with United is
2,987 hours, of which 1,943 hours were accrued as a second officer, 965 hours
as a first officer, and 79 hours as a captain.

Captain Fitch holds Airline Transport Pilot Certificate
No. 1723162, last issued on April 25, 1989, with a type rating in the OC-10.
His most recent first class medical certificate, dated February 10, 1989, was
issued with the limitation, “Holder shall possess correcting glasses for
near vision while exercising the privileges of his airman certificate.”

Captain Fitch completed DC-10 second officer training on
April 2, 1978. On February 2, 1988, he completed first officer transition
training on the DC-10. He completed captain transition training on the DC-10
on April 25, 1989. He was assigned as a DC-10 training check airman (TCA) at
United’s Training Center in Denver, Colorado.

First Flight Attendant Janice T. Brown

First Flight Attendant Janice T. Brown, completed initial training
in April 1977, and the most recent recurrent emergency procedures training on
February 17, 1989.

114

Flight Attendant Barbara A. Gillaspie

Flight Attendant Barbara A. Gillaspie, completed initial training
in February 1988, and the most recent recurrent emergency procedures training
on January 26, 1989 ..

Flight Attendant Timothy B. Owens

Flight Attendant Timothy B. Owens, completed initial training in
June 1989.

Flight Attendant Georgeann Delcastillo

Flight Attendant Georgeann Delcastillo, completed initial training
in October 1987, and the most recent recurrent emergency procedures training
on October 6, 1988.

Flight Attendant Susan White

Flight Attendant Susan White, completed initial training in
May 1986, and the most recent recurrent emergency procedures training on
May 24, 1989.

Flight Attendant Donna s. McGrady
Flight Attendant Donna S. McGrady, completed initial training in

September 1979, ·and the most recent recurrent emergency procedures training
on September 13, 1989.

Flight Attendant Virginia A. Murray

Flight Attendant Virginia A. Murray, completed initial training in
May 1978, and the most recent recurrent emergency procedures training on
January 11, 1989.

Flight Attendant Rene L. Lebeau

Flight Attendant Rene L. Lebeau, completed initial training in
November 1988.

I

D /{




Why Choose Us

  • 100% non-plagiarized Papers
  • 24/7 /365 Service Available
  • Affordable Prices
  • Any Paper, Urgency, and Subject
  • Will complete your papers in 6 hours
  • On-time Delivery
  • Money-back and Privacy guarantees
  • Unlimited Amendments upon request
  • Satisfaction guarantee

How it Works

  • Click on the “Place Order” tab at the top menu or “Order Now” icon at the bottom and a new page will appear with an order form to be filled.
  • Fill in your paper’s requirements in the "PAPER DETAILS" section.
  • Fill in your paper’s academic level, deadline, and the required number of pages from the drop-down menus.
  • Click “CREATE ACCOUNT & SIGN IN” to enter your registration details and get an account with us for record-keeping and then, click on “PROCEED TO CHECKOUT” at the bottom of the page.
  • From there, the payment sections will show, follow the guided payment process and your order will be available for our writing team to work on it.