This is the aircraft involved in Flight 232. The view shows the DC-10's three-engine arrangement, including the engine in the tail. It does not show the internal fan disc or hydraulic lines examined during the investigation.
Resized and JPEG recompressed; no content changes.
Geographic context
Denver Stapleton, departure
Sioux Gateway, diversion
Chicago, planned stop
Philadelphia, intended
Schematic geography only. Airport and location markers are approximate; markers do not show a recorded flight track. Basemap: Natural Earth, public domain.Read supporting evidence
During cruise, the tail-mounted engine suffered an uncontained fan-disk failure. Debris damaged all three hydraulic systems and removed conventional flight-control authority. The crew used differential thrust from the two remaining engines, assisted by an off-duty DC-10 training check airman, to reach Sioux City. The aircraft struck the ground during a fast, steep approach to Runway 22, broke apart and burned. Of 296 occupants, 184 ultimately survived.
Read the full incident Follow what happened, from the flight to the investigation findings.
What investigators concluded
The NTSB probable cause focused on inadequate allowance for human limitations in the overhaul inspection and quality-control process, which failed to detect a fatigue crack growing from a metallurgical defect in the fan disk. The resulting debris exceeded the hydraulic systems' design protection. The report's injury table records 111 fatal injuries and treats a passenger who died 31 days later as seriously injured under the regulatory definition. Including that later death gives 112 deaths overall.
The flight to Sioux City with no normal flight controls
1,743 words / about 8 minutes to read. Based on the investigation records cited below.
An ordinary flight at cruising altitude
United Airlines flight 232 departed Denver's Stapleton Airport on July 19, 1989, for Chicago, with Philadelphia as its eventual destination. The McDonnell Douglas DC-10-10, registered N1819U, carried 285 passengers and 11 crewmembers. It left Denver at 14:09 Central Daylight Time and climbed to 37,000 feet. The first officer was flying, with the autopilot engaged and the autothrottles maintaining the selected speed. Takeoff and climb were uneventful.
The DC-10 had three engines, two beneath the wings and one mounted in the tail. It also had three hydraulic systems powering its flight controls. That separation was intended to provide protection against individual failures. The emergency that developed would reach beyond the loss of one engine: damage from the tail engine would disable the hydraulic capability needed to move the primary control surfaces. Losing one source of thrust on a three-engine aircraft and losing normal control of the aircraft were therefore very different problems.
About an hour and seven minutes after departure, at 15:16:10, the crew heard a loud bang followed by vibration and shuddering. Their instruments showed that the tail-mounted number 2 engine had failed. The captain called for its shutdown procedure. While the flight engineer worked through that response, he saw hydraulic pressure and quantity indications at zero. The first officer then reported that the aircraft was entering a descending right turn and would not respond to his controls. What had initially appeared to be an engine emergency had become a flight-control emergency.
The captain took control and confirmed that the usual inputs were ineffective. Reducing thrust on the left wing engine helped the aircraft roll toward a more level attitude. This gave the crew a way to influence its movement, although it did not restore normal control. The two surviving engines became the available means of making coarse changes in pitch and direction. The response involved delays and continuing oscillations, rather than the immediate, predictable movement normally obtained from elevators, ailerons and rudder.
The crew deployed the air-driven generator and selected the auxiliary hydraulic pump it powered. Hydraulic pressure did not return. This was important because an alternative pump could not recover control when the damaged system had lost the fluid it needed. The emergency procedures and equipment were available, but they did not provide an effective remedy for the combination of damage aboard flight 232. The crew had to continue managing the aircraft with its flight controls largely immovable.
At about 15:20, they requested emergency assistance and directions to the nearest airport. Air traffic control first suggested Des Moines, then recognized that the aircraft was proceeding toward Sioux City and offered that airport. The crew accepted. Controllers supplied vectors to Sioux Gateway while the pilots tried to keep the aircraft within a usable flight path. A diversion decision ordinarily leads into a planned approach with a controllable aircraft. Here, reaching the vicinity of an airport was itself uncertain, and every change of heading had to be achieved with the limited influence available from engine thrust.
The cabin crew began preparing passengers for an emergency landing. An off-duty United DC-10 training check airman was travelling in first class and offered assistance. The captain invited him into the cockpit, where he arrived at about 15:29. His presence gave the operating crew another qualified person who could take on a task while the others continued flying, communicating and searching for a way to recover control.
At the captain's request, the check airman first went back into the cabin to inspect the wings. He returned with observations that the inboard ailerons were slightly raised and the spoilers remained down. There was no movement of the primary flight-control surfaces. The captain then assigned him the two surviving engine thrust levers. This allowed the captain and first officer to continue working the flight controls while the additional pilot concentrated on using power to influence pitch and roll.
The check airman found that the aircraft tended continuously to turn right. He used separate movements of the left and right engine throttles rather than treating them as a single matched pair. Keeping the wings closer to level and limiting the descent demanded repeated adjustments. Later, the flight engineer inspected the tail from the cabin and reported damage to both horizontal stabilizers. These observations helped the crew understand the scale of the emergency, but they could not repair the hydraulic damage. The added pilot increased the cockpit's working capacity; he did not bring a procedure capable of restoring conventional control.
As the flight continued toward Sioux City, the crew jettisoned fuel to the automatic system's cutoff, leaving about 33,500 pounds. Approximately 11 minutes before landing, they lowered the landing gear using the alternate extension procedure. The flaps and slats remained retracted. The crew was therefore approaching in a configuration that required a relatively high speed, while lacking the normal ability to make precise changes in the aircraft's attitude and flight path.
The pilots saw the airport at about nine miles. Air traffic control had intended to send them to runway 31, almost 9,000 feet long. The aircraft's developing path instead brought it toward runway 22, a closed runway about 6,600 feet long. Changing to the preferred runway would require further maneuvering, particularly difficult left turns. The captain chose to continue toward runway 22. The available alignment took precedence over obtaining an ideal runway because the aircraft could not be maneuvered as a normal DC-10.
At one stage the check airman believed they were aligned and on a normal-looking glide path. That visual impression did not remove the underlying instability. During the last 20 seconds, the recorded speed averaged about 215 knots and the descent rate about 1,620 feet per minute. Pitch and roll oscillations continued. The surviving engines still provided thrust, but their effect was insufficiently precise to produce a conventional stabilized approach. The cockpit had brought the aircraft to an airport; it still had to contend with its rapidly changing attitude and descent as the ground approached.
Close to the ground, the nose began dropping and the right wing rolled downward. Both operating pilots called for reduced power. The check airman continued changing the two surviving engines' thrust as he tried to manage the descent and attitude. He later said that power was being adjusted continuously rather than held at a steady setting. The right wingtip made the first ground contact at the runway 22 threshold at about 16:00, followed by the right main landing gear.
The aircraft skidded to the right, rolled inverted and broke apart as it crossed the airport. Witnesses saw fire and a cartwheeling motion. The cockpit separated early, the central fuselage and much of the left wing came to rest beyond another runway, and the tail section stopped farther along the original landing direction. The engines also separated. The breakup left occupants in different wreckage areas, with very different exposure to impact forces, fire and escape routes.
Rescue and firefighting began immediately. The final report records 111 fatalities in its injury table, together with 47 serious injuries, 125 minor injuries and 13 uninjured occupants. A footnote explains that one passenger counted among the seriously injured died from those injuries 31 days later. Under the reporting definition then applied, that death fell outside the fatal-injury period. It is therefore appropriate to distinguish the table's 111 fatalities from the overall total of 112 deaths. The distinction reflects the reporting convention, not a disagreement about the later passenger's death or its connection to the accident.
Investigators traced the initiating failure to the stage 1 fan disk in the tail engine. A fatigue crack had developed from a metallurgical defect in a critical area of the disk. Eventually the rotating disk broke apart, releasing fragments beyond the engine. Their distribution and energy overwhelmed the protection afforded to the aircraft's hydraulic systems. The loss of three hydraulic systems was therefore a common consequence of one destructive event, despite the systems being separately arranged.
The investigation found that a detectable crack was present at the disk's most recent United inspection in April 1988. The report described a crack about half an inch long at the bore surface at that time. Evidence on the crack surface indicated that the fluorescent penetrant inspection process had reached it, yet the part had not been rejected. The issue was not simply that no inspection method existed. The board examined how a critical inspection could fail to identify a defect that the process should have revealed.
The adopted probable cause emphasized insufficient consideration of human limitations in United's engine overhaul inspection and quality-control procedures. That led to the failure to detect the fatigue crack originating in the earlier material defect. The report then connected the disk's breakup to the hydraulic damage and lost flight controls. This causal account extends backward beyond the bang heard in the cockpit. The crew encountered the final consequences of a defect, crack growth and an unsuccessful opportunity for detection that had developed before the aircraft departed Denver.
The flight crew did not create the underlying failure. The NTSB's adopted explanation concerned the undetected disk crack and the destructive effect of its fragments on the flight-control hydraulics. Member Jim Burnett filed a dissent on probable cause that gave explicit emphasis to manufacture of the defective disk, failure to detect the crack and the airframe design's treatment of fragment release. His statement belongs to the investigation record, but it should not be substituted for the board's adopted probable cause.
The recorded flight also shows the distinction between getting an aircraft to an airport and retaining enough control for a safe touchdown. Four pilots shared the cockpit work after the additional check airman arrived, and the aircraft reached Sioux Gateway. Yet the available engine control could not eliminate the final high descent rate and roll. Their actions must be assessed against the loss of conventional controls, rather than against the precision expected from an intact aircraft on an ordinary approach.
The report recommended better nondestructive inspection methods and additional inspection oversight for critical rotating parts. It also recommended research into backup flight controls powered independently of the conventional system. Those proposals addressed different links in the sequence: preventing an undetected disk failure and preserving control if a severe failure nevertheless occurred. The report's descriptions of subsequent actions and recommendations are records from the investigation period. They do not establish the present configuration of every aircraft. Flight 232's outcome includes both the people who survived the airport impact and the 112 people who ultimately died.
The crew heard a bang, vibration and airframe shuddering. Hydraulic pressure and quantity indications fell to zero, and control inputs did not produce the expected response.
The crew requested help and vectors to the nearest airport. Sioux City was selected after the controller noted the aircraft was already heading in that direction.
An off-duty training check airman joined the cockpit. After inspecting the wings, he operated the throttles while the captain and first officer worked the flight controls.
The aircraft was aligned with the closed, shorter Runway 22. Given the difficulty of turning left, the captain continued rather than manoeuvring to Runway 31. Flaps and slats stayed retracted.
The right wingtip contacted first, followed by the right main landing gear. The aircraft overturned and broke apart. Firefighting and rescue began immediately.
The aircraft was already aligned with it and was difficult to turn left. The captain continued toward Runway 22 rather than attempt the manoeuvre to Runway 31.
The adopted probable cause focuses on inspection and quality-control human factors. A Board member filed a broader dissent that also emphasised manufacture and airframe design. That dissent is not the adopted Board finding.
The injury table counts 111 fatal injuries. A passenger died 31 days later and remained classified as seriously injured under the regulatory definition, giving 112 deaths overall.
Actions and recommendations are described at the dates of the cited records. A recommendation is not proof of implementation.
Protection of redundant controls: recommended
The NTSB recommended system-safety reviews of existing aircraft to reconsider redundancy and protection of flight- and engine-control power sources. This is A-90-169 as published, not a current completion claim.
The Board recommended inspection methods and oversight that account for human limitations, including a second set of eyes for critical rotating parts. These recommendations do not establish implementation by every operator.
Matching dossiers for High-energy landing: JSX Flight 284
Read alongside
These comparisons connect specific research topics. Shared circumstances do not establish identical causes. Evidence from both investigations is provided below.
Both involved uncontained engine failures and damage to other systems. United 232 lost all three hydraulic control systems; Qantas 32 retained sufficient capability for a managed return and landing.
Explore the records below for additional context. They open on the publisher's site and are not all included in our report search. Source reuse terms apply.
Official search guidance for investigation records and recommendation responses. Search United 232, Sioux City, or the A-90 recommendation identifiers cited above.
Sources and transparency
Checked against the NTSB final report through source and page comparison. No independent expert review.
Source limitations
The official PDF is an older scanned report with imperfect text recognition. Page references link to the scan; search may miss words misread by recognition. The displayed death toll includes the passenger who died 31 days later, while retaining the report's regulatory injury classification. A board member's dissent follows the adopted findings; this dossier attributes the adopted probable cause to the Board.
United Airlines Flight 232, McDonnell Douglas DC-10-10, Sioux Gateway Airport, Sioux City, Iowa, July 19, 1989
National Transportation Safety Board NTSB/AAR-90/06, report date 1 November 1990
Brief attributed excerpts for source-based commentary. Full report, photographs and third-party material are not republished. Source terms / provenance.
Kevin Murphy writes the incident accounts on AirlineIncidents.com, out of a long interest in aviation safety and the lessons each investigation leaves behind.
Prepared by
AirlineIncidents editorial desk
Report citation check
Independent expert review
Not completed
Citation checks compare supporting text with the indexed report pages. They do not constitute independent expert review. How these pages are prepared.
Revision history
: Checked report citations and source hashes. Added credited photographs, geographic context, sequence diagrams, reader answers, evidence limits, report-era safety follow-up, further records, sourced incident comparisons and this editorial record.
: Added a full chronological account with section-level report references and links from the short summary.
