← back to the index
FR-007 high-cycle fatigue

United 232 — A Fatigue Crack in a Titanium Fan Disk Took Out All Hydraulics

cyclic-fatiguehard-alpha-inclusionuncontained-disk-burstengine-rotating-diskjet-airliner1980s
Death toll
112 dead; 184 survived (296 aboard)
Structure
McDonnell Douglas DC-10-10 N1819U, No. 2 (tail) CF6-6D engine, stage-1 fan disk
Failed
19 July 1989, 15:16 CDT, ~37,000 ft
Status
Broke up

Summary

At 15:16 on 19 July 1989, cruising near 37,000 feet over north-central Iowa, the tail-mounted No. 2 engine of United Airlines Flight 232 — a McDonnell Douglas DC-10-10 carrying 296 people from Denver to Chicago — disintegrated without warning; 44 minutes later the crippled airliner broke up on landing at Sioux Gateway Airport, killing 112 and leaving 184 alive. The cause was not bird strike, pilot error, or fire. It was a single high-cycle fatigue crack that had grown for years from a metallurgical defect buried in the bore of one titanium fan disk, until the disk burst and threw high-energy fragments through every hydraulic line on the aircraft at once.

The disk was the stage-1 fan rotor of a General Electric CF6-6D turbofan, a forged Ti-6Al-4V component roughly a metre across spinning at takeoff and climb power. Embedded in its bore, dating to the original titanium melt, was a "hard-alpha" inclusion — a brittle, low-ductility region where the casting had absorbed roughly 2.07 percent nitrogen by weight against a specified maximum near 0.02 percent. Sitting in the most highly stressed part of the disk, around a tiny cavity within it a fatigue crack initiated and crept outward, one spin-up and spin-down at a time, through some 17,000 flight cycles of revenue service.

Because the DC-10's three independent hydraulic systems all routed lines through the tail in the arc swept by a bursting tail engine, the uncontained debris severed all three at once and drained every drop of fluid. The crew — captain Alfred Haynes, first officer William Records, second officer Dudley Dvorak, and off-duty check airman Dennis Fitch, who worked the wing throttles by hand — flew an aircraft with no working flight controls to a runway on differential thrust alone. The forensic verdict in NTSB report AAR-90/06 was unambiguous: a fatigue fracture from a hard-alpha inclusion, missed by six successive fluorescent-penetrant inspections, compounded by hydraulic architecture with no protection against a total loss. The survival of 184 of 296 was attributed almost entirely to the airmanship of a crew flying a configuration the manufacturer had never deemed survivable.

Timeline

1971
The titanium ingot is melted with a buried flaw
The Ti-6Al-4V ingot for the stage-1 fan disk is produced by GE using the era's double-vacuum melt practice; a hard-alpha inclusion of about 2.07 w/o nitrogen against a ~0.02 w/o limit is left inside the metal undetected.
1972
Disk forged, machined, and accepted
The disk is finished into the stage-1 fan rotor of a CF6-6 engine; macroetch and fluorescent-penetrant manufacturing inspections do not detect the subsurface inclusion in the bore.
1972–1989
Crack initiates and grows in service
A high-cycle fatigue crack initiates at a cavity within the inclusion and propagates outward through the bore over roughly 17,000 flight cycles.
1972–1989
Six fluorescent-penetrant inspections miss the crack
The disk passes six successive fluorescent-penetrant overhaul inspections; the crack, by then large enough to detect, is missed at each.
1989-07-19 14:09
Flight 232 departs Denver
N1819U leaves Denver Stapleton for Chicago O'Hare with 285 passengers and 11 crew, climbing to about 37,000 feet.
1989-07-19 15:16
The tail engine bursts
The stage-1 fan disk of the No. 2 (tail) engine separates; uncontained fragments are flung outward as the crew hears a bang and feels the airframe shudder.
1989-07-19 15:16
All three hydraulic systems severed
Debris penetrates the tail where lines for all three systems run, and the fluid drains within seconds, leaving no ailerons, elevators, rudder, flaps, slats, or spoilers.
1989-07-19 ~15:20
Differential-thrust control improvised
With no flight controls, the crew steers on asymmetric thrust from the two wing engines; off-duty check airman Dennis Fitch is brought forward and works the throttles by hand.
1989-07-19 16:00
Breakup on landing at Sioux City
Aiming for the closed runway 22 at Sioux Gateway, the aircraft sinks fast with a high roll; the right wing strikes first and tears off, and the fuselage cartwheels, breaks apart, and burns. 184 of 296 survive.
1990-11
NTSB issues report AAR-90/06
The Board attributes the accident to a fatigue crack from an undetected hard-alpha inclusion in the titanium fan disk, citing the human-factors limits of the overhaul inspection process as the probable cause.
1990s
Titanium melt and disk inspection overhauled
The FAA, GE, and the titanium industry move to triple-melt (triple-VAR) rotor titanium, expand subsurface and ultrasonic inspection of fan disks, and adopt damage-tolerance lifing over pure safe-life.

The Disk — A Flaw Forged Into a Rotating Part

The fan disk is the spinning hub carrying the first-stage fan blades; it sees enormous centrifugal stress every spin-up, concentrated at its bore. Ti-6Al-4V was chosen for strength-to-weight, and the disk was lifed as a "safe-life" part — assumed crack-free for a fixed number of cycles, then retired, on the premise that a sound disk would not crack within its life. That premise rested on the titanium being clean.

This disk was not. When the ingot was vacuum-melted around 1971, a region of metal absorbed far too much nitrogen — about 2.07 percent by weight where roughly 0.02 percent was the limit — forming a hard-alpha inclusion: a brittle pocket unlike the tough alloy around it. Hard alpha does not deform with the surrounding metal; under cyclic load it cracks. It sat in the worst possible place, the highly stressed bore, where a fatigue crack found its origin around a small cavity.

The original sin was metallurgical, committed before the disk was ever a disk. The double-vacuum melt of the period could leave such inclusions, and surface-aimed macroetch and fluorescent-penetrant inspection could not reliably find a subsurface pocket in the bore. The lifing philosophy compounded it: a safe-life part is not routinely re-inspected for propagating cracks, so the overhaul inspections were neither frequent nor sensitive enough to track a flaw the doctrine said could not exist.

The Failure Sequence — One Burst Disk, Three Dead Systems

By July 1989 the fatigue crack had grown through roughly 17,000 cycles to critical length. At 15:16, with the engines at cruise power and the aircraft near 37,000 feet, the tail engine's stage-1 fan disk reached that length and burst — an uncontained failure: the disk flew apart rather than staying inside the case, hurling fragments outward at the speed of a spinning rotor.

What turned an engine failure into a near-total loss was where those fragments went. The DC-10 carried three independent hydraulic systems, the standard defence against losing flight controls — but the lines for all three converged in the tail, in the arc a bursting No. 2 engine would sweep. The debris cut all three at essentially the same instant and the fluid bled out within seconds. The redundancy was nominal: independent pumps, but a single common volume through which one event severed them together. With every system dry, the crew had no ailerons, elevators, rudder, flaps, slats, or spoilers.

The only control left was thrust. Advancing one wing engine and retarding the other induced a slow, sluggish turn; adding power raised the nose, reducing it dropped it. Dennis Fitch worked the throttles by hand for 44 minutes while the crew fought a slow phugoid oscillation thrust could only partly damp, coaxed the aircraft toward Sioux City, and lined up on the closed runway 22. On short final the descent rate was far too high and the right wing low; the wingtip struck first, the wing tore away spilling fuel, and the aircraft cartwheeled, broke apart, and burned. That 184 of 296 lived owed to daylight, a prepared airport, and a crew flying a machine the manuals had no procedure for.

The Reckoning — A Flaw No Inspection Caught

The National Transportation Safety Board reconstructed the disk from fragments recovered across the Iowa landscape. The finding, published as AAR-90/06, was precise: the disk failed by high-cycle fatigue, the crack initiated at the hard-alpha inclusion in the bore — a nitrogen-stabilized defect inherited from the original casting — and had grown for thousands of cycles, passing its manufacturing inspections and six successive fluorescent-penetrant overhaul inspections.

The probable cause indicted not only the metal but the people reading the inspections: the inadequate consideration given to the human-factors limitations of the inspection and quality-control procedures at United's engine overhaul facility, which failed to detect the crack growing from the defect manufactured by General Electric. The flaw was inspectable and the inspection existed, but the process — lighting, technique, time pressure, the expectation that a "good" disk shows nothing — let a detectable crack pass as clean six times over. A second finding ran alongside: the DC-10's hydraulic architecture had no provision to survive loss of all three systems to one uncontained event, and no fuses to preserve fluid for the rest.

Contributing Factors

01
A subsurface metallurgical flaw forged into a safe-life rotating part
The hard-alpha inclusion — roughly 2.07 percent nitrogen against a 0.02 percent limit — was a brittle, crack-prone pocket in the most highly stressed region of a spinning disk, created at the melt and unremovable once forged in. A rotating part lifed as crack-free is only as safe as the cleanliness of its metal.
02
Inspection methods unmatched to the defect they had to find
Macroetch and fluorescent-penetrant inspection target surface indications; the inclusion was subsurface, in the bore, so the disk was certified clean because the method could not see the flaw type that mattered. An inspection must be qualified against the specific mechanism it is meant to catch.
03
Safe-life lifing that assumed the crack could not exist
Because the disk was a safe-life part, doctrine held it crack-free and it was never subjected to frequent, sensitive re-inspection for propagating cracks — the assumption itself was why the crack was never hunted. Lifing by assumed integrity, rather than damage tolerance that presumes a flaw may be present, removes the vigilance that would catch a real one.
04
Redundant hydraulics defeated by a single common location
Three independent systems gave paper redundancy, but their lines all passed through the tail in the arc of a bursting No. 2 engine, so one event severed all three. Independent pumps mean nothing if the lines share a single vulnerable volume; true redundancy requires physical separation against the credible single-point hazard.
05
Six inspections that each repeated the same miss
The crack passed six successive fluorescent-penetrant inspections, each under the human-factors limits the NTSB named — expectation, fatigue, technique, the belief that a healthy disk shows nothing. Identical inspections share identical blind spots, giving false confidence rather than coverage.

Aftermath

The toll — 112 dead and 184 survivors of 296 aboard — made Flight 232 one of the defining aviation accidents of its era, remembered as much for the crew's improvised differential-thrust flying as for the failure that caused it. The titanium industry moved to triple-melt (triple-vacuum-arc-remelt) practice for premium rotor titanium, sharply cutting the chance of hard-alpha inclusions surviving into a forged disk, and the FAA and engine makers expanded subsurface and ultrasonic inspection of fan and compressor disks. The deeper shift was philosophical: from pure safe-life assumptions toward damage-tolerance lifing, inspecting on the premise that a flaw may already be present. On the airframe side it drove hydraulic survivability work — fuses and physical separation of redundant lines so one uncontained event cannot drain all systems. In engineering memory, "Sioux City" and "United 232" became the byword for the uncontained disk burst: a flaw forged into the metal, grown by fatigue, missed by inspection after inspection, and able to cut through every redundancy an aircraft carried.

Lessons

  1. Qualify the metal before you trust the lifing: a part lifed as crack-free is only as sound as the cleanliness of its forging, so verify melt quality against the real defect population, not the assumption that the metal is clean.
  2. Match the inspection method to the defect mechanism: prove an inspection can detect the specific flaw type, size, and location that governs failure — a method blind to a subsurface bore inclusion is no safeguard against one.
  3. Inspect on the assumption a crack exists, not that it cannot: apply damage-tolerance thinking to critical rotating parts, setting re-inspection interval and sensitivity to catch a propagating flaw before critical length.
  4. Separate redundant systems in space, not just on paper: route independent hydraulic, electrical, or control paths so no single event — especially an uncontained rotor burst — severs them together, and add fuses to preserve what survives.
  5. Never multiply a flawed inspection and call it coverage: an identical check shares its blind spots, so vary the method and the inspector, because six copies of the same miss is one miss, not six catches.

References