United Airlines Flight 232: The Sioux City Crash That Rewrote Crew Training

United Airlines Flight 232 departed Denver Stapleton International Airport at 2:09 PM on July 19, 1989, bound for Philadelphia with a scheduled stop in Chicago. There were 285 passengers and 11 crew on board. Captain Al Haynes, 57, had been flying for United for 33 years. First Officer William Records and Second Officer Dudley Dvorak completed the flight deck crew. It was a routine afternoon departure on a clear summer day, and for the first hour and seven minutes it was completely uneventful.

At 3:16 PM, at 37,000 feet over Iowa, the No. 2 engine — the tail-mounted GE CF6-6 — exploded. Not failed: exploded. The first-stage titanium fan disk, spinning at thousands of revolutions per minute, burst apart. The fragments tore through the tail section of the DC-10 with enough energy to sever all three of the aircraft’s independent hydraulic lines. Hydraulic fluid, which powered every flight control surface on the aircraft — the ailerons, elevators, rudder, spoilers, and leading-edge slats — drained out of the system in seconds. Haynes, Records, and Dvorak had no ailerons, no elevator, no rudder. The aircraft’s flight manual had no checklist for this situation. There was no checklist because the scenario was considered so improbable it did not need one: three independent hydraulic systems, the engineers had reasoned, could not all fail at once.

Dennis Fitch was sitting in first class. Fitch was a United DC-10 instructor and check airman, travelling as a passenger. A flight attendant relayed a message from the cockpit: could he come forward? He could. For the next 44 minutes, Fitch knelt between the two pilots and worked the throttles of the two remaining wing-mounted engines by hand, using differential thrust — more power on one side, less on the other — as the only available substitute for the flight controls that no longer worked. The crew made an emergency approach to Sioux Gateway Airport near Sioux City. On touchdown, the right wing struck the runway. The aircraft cartwheeled, broke apart, and burned. Of the 296 people on board, 112 died. One hundred and eighty-four survived an accident that should not have had any survivors at all.

Go to aircraft: McDonnell Douglas DC-10-10

(/) tap to zoom

(/)

Reset

What the investigation found

The NTSB’s probable cause, published in AAR-90/06, identified the failure as originating in the No. 2 engine fan disk: “the inadequate consideration given to human factors limitations in the inspection and quality control procedures used by United Airlines’ engine overhaul facility which resulted in the failure to detect a fatigue crack originating from a previously undetected metallurgical defect located in a critical area of the stage 1 fan disk that was manufactured by General Electric Aircraft Engines.” At the center of that cause was a single flaw smaller than a fingernail.

The disk had a nitrogen inclusion — a pocket of nitrogen gas that had been trapped in the titanium during the manufacturing process. Inclusions of this type create what engineers call a stress riser: a point where the material is locally weaker and stress concentrates when the disk spins under load. Over approximately 17,000 flight cycles, a fatigue crack had initiated at that inclusion and grown outward through the disk, unseen and undetected, until the disk could no longer contain the centrifugal forces generated at operating speed and burst. The crack was not at the rim of the disk, where standard inspections looked. It was in the bore, the central hub area, which the fluorescent penetrant inspection procedure used at United’s overhaul facility did not cover. The inspection had passed the disk on its last check because the inspection was not designed to find a crack in that location.

The hydraulic system design was also examined. The DC-10’s three hydraulic systems ran through different structural paths, and the FAA had accepted this arrangement as providing adequate redundancy at the time of certification. But the analysis had not fully accounted for an uncontained engine failure — a disk or blade fragment released at high energy from a tail-mounted engine — as a credible common-cause failure event. The fragments from the No. 2 engine were energetic enough to sever all three systems simultaneously. The investigation found that the hydraulic routing through the tail section had not been evaluated against this specific failure mode with adequate rigor.

The NTSB was explicit that the crew’s performance was extraordinary. The board noted in its report that the successful approach to Sioux City — imprecise, too fast, ultimately unsurvivable on landing but survivable enough to save 184 lives — was achieved without any procedure, any training, or any design intent that accounted for this scenario. Haynes, Records, Dvorak, and Fitch improvised a solution in real time. The NTSB’s safety recommendations came in two streams: the technical causes of the disk failure, and the human factors lessons from how the crew had managed the impossible.

What changed

The most immediate regulatory response addressed the failure origin. The FAA required updated fluorescent penetrant inspection procedures for titanium fan disks that specifically covered the bore — the area where the United 232 crack had grown undetected. GE Aircraft Engines revised its inspection procedures for the CF6 family, and the FAA issued Airworthiness Directives requiring operators of affected engines to comply with the new inspection standards. The concept of inspection coverage was extended: it was no longer sufficient to inspect the locations where cracks were expected to form. Manufacturers were required to demonstrate that their inspection procedures covered the failure modes identified in service, including failure origins in previously uninspected locations.

The investigation’s findings about the titanium manufacturing defect drove longer-term changes to how rotating engine components are made and tracked. The FAA and engine manufacturers developed new requirements for the certification of titanium forgings used in critical rotating parts, including enhanced material traceability — the ability to trace a specific component back to the specific melt of titanium from which it was made, so that if a defect is found in one part, related parts from the same batch can be identified and inspected. These requirements were formalized in FAA Advisory Circular and regulatory guidance issued in the years following the accident.

The crew resource management changes were the most far-reaching consequence of United 232, and they unfolded in stages. Later in 1989, the FAA issued Advisory Circular AC 120-51, providing official guidance that recommended CRM training for air carrier crews — a framework the investigation’s findings gave enormous weight to. The following year, the FAA introduced the Advanced Qualification Program (AQP), a formalized alternative training curriculum that made CRM and line-oriented flight training mandatory for carriers that adopted it.

By 1995, the FAA had amended Part 121 to require CRM training across all air carrier operations, making what began as a recommendation binding throughout the industry. The Flight 232 scenario — specifically the crew’s management of Fitch’s involvement, Haynes’ explicit delegation, and the coordinated use of differential thrust — became the central case study for this training worldwide.

ICAO later incorporated CRM requirements into Annex 1 and Annex 6, extending the obligation to international operators. The NTSB identified the Flight 232 crew as a model: a captain who solicited input, accepted help from an unexpected source, clearly divided responsibilities, and maintained situational awareness in a situation that had no procedure. The way pilots are trained to work with each other in an emergency was changed, permanently, by what Haynes said on that cockpit voice recorder.

The hydraulic system design implications extended to aircraft that had not yet been built. Boeing’s engineering work on the 777, which entered service in 1995, specifically addressed the uncontained engine failure scenario. The 777’s three hydraulic systems are routed so that no single uncontained engine failure can sever more than one system, preserving at least partial flight control in a scenario that would have destroyed all controllability on a DC-10. This design principle — that the hydraulic system architecture must be evaluated against the uncontained engine failure threat, not just against random single-system failures — came directly from the lessons of United 232. It is reflected in the certification standards that subsequent widebody aircraft were required to meet.

There is a secondary lesson in United 232 that the industry took time to fully absorb. The accident exposed a gap between what a certification standard assumed and what actually happened in service. The DC-10’s hydraulic redundancy was certified as adequate because three independent systems seemed sufficient. The uncontained engine failure scenario was not adequately modeled at certification. This is the same pattern that appears in Aloha Airlines 243 — where an inspection program was certified as adequate but did not account for the actual failure mode that developed in service — and it appears again, decades later, in the 737 MAX, where MCAS was certified under safety assumptions that did not reflect what the system would actually do in operation. The pattern is consistent: the certification framework assumes one thing, the operational reality produces another, and people are killed before the gap is closed.

United 232 is one of the most studied accidents in aviation history precisely because the crew’s performance gave investigators something rare: a case where humans did nearly everything right in a catastrophic situation, and 184 people lived because of it. The rules that followed — inspect the bore, track the material, train the crew to ask for help — are the direct inheritance of what Haynes, Records, Dvorak, and Fitch did in 44 minutes over Iowa. Every article in The Flights That Changed Aviation ends with a rule that exists today. This one ends with a phrase that is still taught in cockpits around the world: “I need help.”