Designed for Disaster: The DC-10 Airliner, Part 4

A Tragedy and a Miracle - United Airlines Flight 232.

The DC-10 had been flying for nearly 2 decades in the summer of 1989 and during that period the most egregious design short comings had been discovered and addressed. Unfortunately, hundreds of people had lost their lives in the process.Still, it had been just over 10 years since American Flight 191 had met its fate. Potential passengers had forgotten Turkish Air Flight 981 and were beginning to forget the photograph of the crashing American Airlines DC-10, in an extreme left bank, with one engine missing.

Passengers were becoming at ease with the airplane again.

July 19^th, 1989

United Airlines Flight 232 had departed Denver with 285 passengers and a crew of 11 on board and was one hour and seven minutes into the cruise segment of its flight to Chicago. The aircraft was level at 37,000 feet and cruising at 270 knots indicated airspeed with the autopilot engaged and the engines under control of the auto-throttle system.

Responding to a command from Air Traffic Control to execute a right turn, First Officer William Records moved the autopilot’s heading bug to 095 degrees and the DC-10 rolled into a right bank in response. Midway in the turn, a loud bang was heard and the entire airframe shuddered.

The DC-10’s luck had once again run out. And in an echo of the Chicago crash, an engine problem had caused a hydraulic problem that caused a control problem.

Twenty Years Earlier

Airworthiness Standards imposed on manufacturers of transport category aircraft are contained in Federal Air Regulation (FAR) part 25. To allow the FAA to determine if the manufacturer is meeting the requirements, designers are required to submit detailed documentation regarding the likelihood of various failure modes as part of their pre-certification due diligence.   When the DC-10 was being certified, one of the compliance items, paragraph 25.903(d), (1) of FAR 25, said in part:

“Unless the engine type certification specifies that the engine rotor cases can contain damage resulting from rotor blade failure, turbine engine power plant installations must have a protection means so that rotor blade failure in any engine will not affect the operation of remaining engines or jeopardize continued safety. In addition, design precautions must be taken to minimize the probability of jeopardizing safety if an engine turbine rotor fails…..”

In addition, the FAA imposed a special condition, 25-18-WE-7, on the certification of the DC-10 stating that “In lieu of the requirement of paragraph 25.903(d)(1), the airplane must incorporate design features to minimize hazardous damage to the airplane in the event of a engine rotor failure or a fire which burns through the engine case as a result of an internal engine failure.”

In essence, the FAA was saying “Build your airplane but make certain that if an engine disintegrates, it doesn’t take anything else with it”.

Douglas Commercial Aircraft Company* provided information describing the hydraulic systems used to control the DC-10 and calculated the possibility of a failure of all three systems to be so high as to be virtually impossible.  Al Haynes, the captain of Flight 232, would later recall that he had been told during his DC-10 training class that the odds against failure of all three hydraulic systems were “one billion to one”.

If Haynes recollection is correct, the designers, in spite of the fact that all three hydraulic system lines were routed in close proximity to the tail mounted engine, thought there was virtually no chance that the disintegration of a 6 foot rotor disk, spinning at thousands of RPM, would destroy all three systems.

Whatever they may have thought, they assured the FAA in writing that, per 25-18-WE-7, the likelihood of hazardous damage to the airplane during such an event was, to use their words, “extremely remote”.

Since the possibility of such an event was deemed extremely remote, no attempt was made to prevent a total loss of hydraulic fluid from the systems should a breach occur. There was no cut off device to isolate at least one hydraulic system nor were there any hydraulic fuses included in the design.

Nineteen Years Earlier

In 1970, the Titanium ingot that would eventually become the stage one fan disk in the number 2 engine on Flight 232 was created by ALCOA. When it was manufactured, a defect, called a Hard Alpha event, occurred which went undetected. Ultrasonic testing of the ingot failed to disclose the problem which became a microscopic crack when the ingot was machined into a billet that eventually became the stage one fan used in the accident airplane.

Fig 1. Cutaway of the Stage One Fan Section of United Flight 232’s Number 2 Engine 

The National Transportation Safety Board (NTSB) later determined that the crack had been in the rotor of the fan stage for 17 years and had been growing with each temperature cycle. Neither General Electric, the manufacturer of the engine, nor United Airlines’ maintenance personnel, had detected it during multiple ultrasonic and dye checks between 1971 and the date of the accident.

On July 19^th, 1989, the crack in the stage one fan disk in engine number 2 of Flight 232 finally encompassed the entire span of the rotor, from the bore to the rim, and the 300 pound disk shattered, spewing fragments over the horizontal stabilizer.

The fragments destroyed a portion of the stabilizer and breached the hydraulic lines for hydraulic systems 1 and 3.  As the disk shattered, it also caused the accessory drive to depart engine number 2, which breached hydraulic system number two.

Fig 2. Disintegrating Stage One Disc destroyed all Three Hydraulic Systems

Flight 232 had no hydraulic systems to control the rudder, ailerons, slats, flaps, spoilers or the horizontal stabilizer. The loss of control was complete in that they could make no gross movements of the primary controls nor could they make adjustments to flight control trim settings.

The only working controls they had left were the thrust controls for the two wing mounted engines.

Aircraft Stability and Phugoid Oscillations

When an airplane is in level flight, the lift generated by the wings cancels the effects of gravity and the thrust generated by the engines cancels the effects of drag caused by the movement of the aircraft through the air.  Within the performance limits of the airplane, this equilibrium can be maintained at virtually any airspeed.

If an airplane is trimmed for level flight and something happens to cause the equilibrium to be disturbed, the airplane will try to return to the trimmed airspeed and to level flight. As it does so, the craft will execute a series of deviations above and below the horizon.

For example, the nose of the airplane might dip below the horizon for a time which increases the airspeed. The nose would then start to rise and go above the horizon a small amount which causes airspeed to decay a bit. After a few more trips above and below the horizon, it will settle back into level flight at the original airspeed. This tendency is called Positive Stability meaning that the airplane wants to return to its last trimmed airspeed.

Fig 3. Phugoid Oscillations occur as the aircraft attempts to return to the airspeed for which it has been trimmed.

The name for the oscillation component itself is Phugoid Oscillation and the period for the excursions can be from several seconds in a small airplane up to a couple of minutes for large aircraft. The effect of phugoid oscillations would figure heavily in the attempt to control the stricken DC-10 used for United Airlines Flight 232 that July day in 1989.

Flight Level 370

Flight Engineer Dudley Dvorak watched in amazement as all three hydraulic systems lost pressure and their fluid quantity indicators spun down to zero. Such a thing wasn’t possible but it had happened.

Following the loud noise, warning lights came on and the autopilot disconnected. Throttle adjustments were no longer possible for engine number 2 and the instruments associated with that engine disclosed it was no longer operating.

Since the airplane had been in the middle of a right turn when the event had occurred, First Officer Records attempted to roll the aircraft back to level flight but discovered that the controls had no effect.

Dvorak informed Records and Captain Haynes that they had no hydraulic pressure in any of the three systems which prompted Haynes to deploy the Ram Air Turbine (RAT) hydraulic pump in the hope that it would restore hydraulic pressure and some semblance of control authority. Nothing happened because there was no hydraulic fluid available.

Haynes assumed control of the airplane and increased the thrust on the right engine which stopped the continuing right turn. The airplane was now in a continuous side slip due to the rudder remaining in a slight right deflection where it had frozen when all hydraulic fluid was lost during the right turn.

At this point, the airplane began a series of phugoid oscillations that resulted in a loss of altitude of about 1500 feet each time the cycle was completed. The phugoid had a corkscrew component and it repeated at random times.

Haynes declared an emergency and the crew agreed that it was imperative to get the airplane on the ground as rapidly as possible. Sioux City, Iowa was 50 miles to the west-southwest and the crew decided it had the closest suitable airport.

Denny Fitch

Back in the passenger compartment, a deadheading DC-10 instructor pilot, Denny Fitch, had heard the noise and observed the phugoid oscillation. He asked a flight attendant to inform the captain that he was available to assist if the captain desired his help.

Haynes asked Fitch to come to the cockpit and upon entering, Fitch quickly observed how bad the situation was for the crew and passengers.

Fitch recommended that he take a position behind the center console where he could operate the throttles because they would have to be moved independent of one another to control the airplane and that could not be easily done by either Haynes or Records from their pilot seats.

Since the airplane wanted to turn right, it was decided that it would be better to make all turns in that direction rather then make the cross-control situation worse.

For nearly a half hour, as they maneuvered to Sioux City, the airplane was allowed to make a series of turns and circles to the right as altitude was lost in preparation for a landing attempt.

Fig 4. United Flight 232 executed a series of right turns as it descended into Sioux City for its emergency landing attempt.

With no way to re-trim the airplane for a reasonable approach speed, the landing would have to be attempted at nearly 100 knots over the normal speed. Haynes ordered Dvorak to dump fuel in preparation for the certain crash landing.

Believing there may be some hydraulic fluid trapped in the actuators used to extend the landing gear, Fitch suggested that the gear be lowered in the hope a re-trim could be accomplished to a slower speed which might also have a positive effect on the phugoid oscillation.

His hunch was wrong however so a warning was given to the cabin crew to prepare the passengers for a very hard landing.

Impact

Fitch was able to somewhat control the phugoid oscillations as long as he had some altitude to play with but the crew knew that once they got close to the ground, their only hope for a successful outcome rested on the airplane not deciding to execute a phugoid once they were on final approach.

Instead, on short final, and at the worse possible time, the airplane began a phugoid and lowered the right wing as a result of the corkscrew motion that was superimposed on the phugoid.

The airplane began to veer to the right as it approached the airport with a sink rate of over 1800 feet per minute whereas a normal sink rate would have been 300 feet per minute.

First Officer Records can be heard on the cockpit voice recorder repeating “Left, Left, Left” as he tried to will a counteraction of the aircraft’s lateral movement.

The right wing of the DC-10 hit the runway first and the resulting sparks started a fire which was enabled by residual fuel leaking from that wing’s tanks.

The impact ripped the tail section off the airplane as well as the landing gear. The fuselage broke into several pieces and the right wing broke off. The main portion of the fuselage ended up in a corn field, upside down. The cockpit section also ended up inverted in the corn with Haynes, Records, Dvorak and Fitch all trapped inside.

When it was all over, 110 passengers and one flight attendant would be dead but amazingly, 185 passengers and rest of the crew would survive.

It truly was both a tragedy and a miracle.

Aftermath

In the weeks that followed the crash of Flight 232, Al Haynes received accolades because his leadership was the embodiment of a form of airborne decision making known as Crew Resource Management (CRM). United Airlines had been at the forefront of the CRM process which involves the entire flight crew in the decision making process instead of relying only on the captain’s experience.

Haynes had consulted with Bill Records and Dudley Dvorak throughout the event and his decision to utilize the expertise of Denny Fitch was deemed particularly instrumental in the saving of as many lives as possible in a particularly bad situation.

Haynes gave all the credit to his crew and his modesty was genuine.

For his part, Denny Fitch simply said that those thirty minutes in the cockpit of Flight 232 was the most “alive” he had ever felt. He also said he was just a person who happened to be in the right place at the right time.

In an attempt to determine if the accident could have been avoided, several experienced pilots attempted to duplicate the actions of Flight 232’s crew in a simulator. None were able to do nearly as well as Haynes and his fellow aviators and most never made it to the runway.

After the crash, the FAA imposed an Airworthiness Directive (AD) on the DC-10 requiring the installation of automatic controls to isolate hydraulic system number 1 in case a similar event was to occur. Operators could also install hydraulic fuses in the lines if they chose but the inclusion of the automatic protection of one hydraulic system was mandatory. The system developed for the DC-10 was also used later in the MD-11 version of the three engine wide body.

Additionally, inspection techniques for the rotating components used in jet engines were revisited and additional testing and documentation requirements were the result.

By the 1990’s though, the days of the DC-10 in passenger service were pretty much over. It would soldier on for a time but economics and the public’s perception of the DC-10 relegated it to hauling freight instead of passengers. The wee small hours of the morning is where you’ll find most of the remaining airborne DC-10s.

Legacy

The DC-10 was designed at a time when the slide rule was still in common use and aeronautical engineers practiced a science that resembled black magic to the general population.

But it wasn’t black magic that caused the DC-10’s problems. Rather it was engineering shortcuts and poor design decisions. And for the most part, the engineers in the trenches were powerless to stop what many of them knew to be wrong headed approaches.

In the final analysis though, it wasn’t the airlines or the engineers or the management of Douglas Commercial Aircraft Company that had to live with the poor decisions.  Rather, it was the families and friends of the 728 people who died as a result of those poor decisions.

John Loughmiller is an Electrical Engineer, Commercial Pilot, Flight Instructor and a Lead Safety Team Representative for the FAA.

* Douglas Commercial Aircraft Company merged with McDonnell Aircraft which in turn was purchased by Boeing Company. At the time when the principle DC-10 design process was underway, the company was known as Douglas Commercial Aircraft Company, Additional design was accomplished during the McDonnell-Douglas years, however by the time Boeing acquired the combined companies, the DC-10 was a mature product.

(All imagery in this article was obtained either from US Government accident reports or from Wikimedia Commons media library and is public domain.)