Sioux City Plane Crash: A tale of mystery and misery

On 19 July 1989, United Airlines (UA) Flight 232, a McDonnell Douglas DC-10-10 operating the Denver–Chicago–Philadelphia corridor, suffered a catastrophic uncontained failure of its tail-mounted No. 2 engine at 37,000 feet above northern Iowa, severing all three of its independent hydraulic systems simultaneously. Of the 296 people on board — 285 passengers and 11 crew — 184 survived when Captain Alfred C. Haynes and three other pilots brought the crippled, uncontrollable aircraft to a partially controlled crash-landing at Sioux Gateway Airport (SUX), Sioux City, Iowa.

The remaining 112 perished — 110 passengers and one flight attendant in the immediate crash, and one additional survivor who died from injuries a month later. The wreckage scattered across more than a mile of runway and an adjoining cornfield in a fireball visible from across the Iowa flatlands.

The accident became the deadliest single-aircraft accident in United Airlines’ history and remains one of the most analytically significant events in the annals of aviation safety. The crew’s improvised use of differential engine thrust to control a widebody jetliner with zero hydraulic authority — a technique that no flight manual had anticipated and for which no training procedure existed — drew immediate and unreserved praise from the National Transportation Safety Board (NTSB), which concluded that their performance greatly exceeded reasonable expectations.

United Airlines (UA) Flight 232

Category	Details
Date	Wednesday, 19 July 1989
Time	16:00
Aircraft Type	McDonnell Douglas DC-10-10
Operator	United Airlines
Registration	N1819U
MSN	46618/118
Year of Manufacture	1973
Total Airframe Hours	43,401 hours
Flight Cycles	16,997 flights
Engine Model	General Electric CF6-6D
Fatalities	111 fatalities / 296 occupants
Other Fatalities	0
Aircraft Damage	Destroyed, written off
Accident Category	Accident
Location	Sioux Gateway Airport (SUX)
Flight Phase	Landing
Flight Nature	Passenger – Scheduled
Departure Airport	Stapleton International Airport (DEN/KDEN)
Destination Airport	O’Hare International Airport (ORD/KORD)

Data: Aviation Safety Network

The Aircraft, The Route, And the Crew Behind Flight 232

The McDonnell Douglas DC-10-10 operating Flight 232, registered N1819U, was powered by three General Electric CF6-6D high-bypass turbofan engines — one under each wing and one mounted in the vertical stabiliser at the tail, a distinctive trijet configuration that distinguished the DC-10 from the twin-engined widebody aircraft that would later dominate long-haul aviation.

Its three hydraulic systems were each powered by one of the three engines, and the aircraft was certified to fly on any single surviving hydraulic system in the event of two failures. Total hydraulic failure was considered so remote by regulators and the manufacturer that no procedure had been developed to address it.

The flight crew on 19 July 1989 comprised Captain Alfred C. ‘Al’ Haynes, a United Airlines veteran with 33 years of service and 7,000 hours of DC-10 experience; First Officer William R. ‘Bill’ Records; and Flight Engineer Dudley J. Dvorak. Eight flight attendants rounded out the crew complement.

Flight 232 had departed Stapleton International Airport (DEN), Denver, at 14:09 Central Daylight Time, bound for its first stop at O’Hare International Airport (ORD), Chicago, and then continuing to Philadelphia International Airport (PHL) as its final destination. The aircraft was carrying 285 passengers — a near-full load for the 287-seat two-class configuration — and the early stages of the flight were, by every account, unremarkable.

The Fan Disk Failure At 37,000 Feet

Sixty-seven minutes after takeoff, at 15:16 CDT, the DC-10 was cruising at 37,000 feet over northern Iowa when the crew heard a loud bang followed immediately by violent shuddering of the airframe. The stage-1 fan disk of the No. 2 tail-mounted engine had disintegrated explosively, ejecting high-velocity metal fragments outward with an energy and distribution pattern that the aircraft’s hydraulic system architecture was never designed to withstand. Within seconds, hydraulic fluid pressure in all three independent systems dropped to zero.

First Officer Records immediately disengaged the autopilot and attempted to correct a developing right bank using standard control column inputs. The aircraft did not respond. Captain Haynes took the controls and found them equally dead — the yoke and rudder pedals moved freely but controlled nothing. The aircraft was entering a right-descending turn that, if unchecked, would develop into a fatal spiral.

Out of options within seconds, Haynes reduced thrust on the left-wing engine to idle and advanced the right wing engine to maximum power — the resulting differential thrust arrested the bank and slowly levelled the wings. It was an instinctive adaptation with no procedural precedent, and it saved the aircraft from immediate loss of control.

Flight Engineer Dvorak activated the air-driven generator and attempted to engage the auxiliary hydraulic pumps, but with no fluid left in any of the three systems, the pumps drove nothing. The crew radioed United’s San Francisco Maintenance Facility (known internally as SAM) and were told, in plain terms, that the DC-10 had no backup flight controls for a scenario of total hydraulic loss — the manufacturer had not established any procedure for circumstances considered all but impossible. The crew was on its own.

Dennis Fitch And Differential Thrust

The crew’s situation changed at 15:29 CDT when a flight attendant informed the cockpit that a qualified DC-10 instructor was travelling aboard as a passenger. Dennis Edward ‘Denny’ Fitch, an off-duty United Airlines check airman and DC-10 training captain, had been seated in first class. He walked to the cockpit, assessed the situation in moments, and volunteered to manage the throttles while Haynes concentrated on the control column — even though controlling the column was, by this point, essentially futile. Fitch crouched between the captain and first officer at the throttle console and took over the task of differential thrust management.

By increasing power on the right-wing engine and reducing it on the left, Fitch could induce a slow right turn. Reversing the asymmetry produced a left turn. Adding power to both engines caused a climb; reducing both caused a descent. The technique was imprecise and the aircraft oscillated in what engineers describe as a phugoid cycle — a slow, rhythmic wave of altitude gain and loss that repeated approximately every 1,500 feet, impossible to arrest without hydraulic control of the elevator.

The crew could steer but they could not hold altitude or maintain a stable descent rate. Air Traffic Control directed them toward Sioux Gateway Airport, vectoring them in from the Minneapolis Air Route Traffic Control Center (ARTCC), which had been contacted by the crew at 15:20.

The approach that emerged was a series of predominantly right-hand turns — the only direction Fitch’s differential thrust could reliably produce, since the aircraft could be induced to bank left by advancing the right engine but could not sustain a left turn without the correct hydraulic inputs. This limited turning radius caused the aircraft to align not with Runway 31, where all emergency services had staged, but with the shorter, permanently closed Runway 22. Fire trucks and medical vehicles scrambled to clear the closed strip in the minutes before touchdown.

The Crash-Landing of UA 232

Flight 232 was travelling at 247 mph and descending at 1,850 feet per minute when it struck the runway — a speed and sink rate almost double the normal DC-10 landing parameters of approximately 160 mph and 250 feet per minute. The crew had been unable to deploy the high-lift flaps because the flap system required hydraulic power, and without them, the minimum controllable airspeed was dangerously high.

The right wingtip dipped and struck the ground first, shearing the wing off and igniting the spilled fuel in an immediate fireball. The tail section separated cleanly and came to rest on the runway. The fuselage cartwheeled three times and broke into several sections, with the main wreckage veering right off the runway and coming to rest inverted in the cornfield at the airport’s edge. The cockpit section broke free and skidded separately into the field.

Of the 296 people on board, 112 ultimately died — 110 passengers and 1 flight attendant in the immediate crash, with 1 further passenger succumbing to injuries one month later. Thirty-five passengers seated in the middle fuselage section directly above the fuel tanks died from smoke inhalation. Seventy-six passengers died from injuries sustained during the multiple impacts. The luckiest 13 passengers emerged from the wreckage without injury.

All four members of the flight crew — Haynes, Records, Dvorak, and Fitch — survived, though all sustained serious injuries. First Officer Records later recalled being pinned in the detached cockpit section, his face in the dirt, conscious through the entire ordeal: his pelvis, both hips, and eight ribs had been fractured, and rescue workers initially passed the broken cockpit structure without recognising it as anything but debris.

How Sioux City Was Ready Was Ready for the Emergency Response

The survival of 184 people from a crash of this violence was not solely the result of the crew’s airmanship. The ground response at Sioux City was one of the most remarkably prepared disaster operations in aviation history — and its preparation had an extraordinary precedent.

Two years before Flight 232, local authorities in Sioux City had conducted a disaster drill whose scenario was precisely a commercial airliner crashing at the airport with mass casualties. The drill was filmed and a coordinated response protocol was developed with the local Air National Guard.

Within 90 minutes of the crash, more than 80 emergency vehicles from 40 communities across Iowa, Nebraska, and South Dakota had evaluated, treated, and transported nearly 200 injured people to hospital. The NTSB subsequently told Gary Brown, the airport’s crash and fire rescue director, that 41 of those survivors would have died had it not been for the speed, skill, and overwhelming scale of the rescue response.

Sioux City’s two hospitals received so many medical supplies from neighbouring Sioux Falls and Iowa City that one facility reported receiving five months’ inventory in three hours. Residents formed a donation line a block and a half long around the hospital to give blood — the city ultimately had triple the supply it needed.

The Iowa Air National Guard’s 185th Air Refueling Wing, headquartered in Sioux City, was on the ground assisting with evacuations, and off-duty hospital staff returned to work voluntarily. At times, two doctors were attending to every injured passenger.

NTSB Revealed What Caused the Fan Disk to Fail?

The engine fan disk that initiated the catastrophe was not found at the crash site. The fragmenting disk had been ejected from the aircraft while it was cruising at 37,000 feet somewhere over the vast agricultural expanse of northern Iowa, and it had landed silently in an unmarked cornfield.

The NTSB offered a reward for the disk’s discovery, but months passed without it being found — until the autumn harvest, when a farmer discovered the two main disk fragments lying in her cornfield, uncovered by her combine harvester. The pieces were found near the town of Alta, Iowa, approximately 66 miles from Sioux City.

Metallurgical analysis of the recovered disk fragments established the core finding of the investigation. The stage-1 fan disk of the General Electric CF6-6D engine had been manufactured with a “hard alpha” inclusion — a nitrogen contamination in the titanium alloy that caused the surrounding metal to become brittle.

During the forging process, the contaminated material cracked and fell away during final machining, leaving a cavity with microscopic crack edges that went undetected. For the next 18 years, the crack grew imperceptibly larger with each engine cycle — each time the engine was powered up and down — until it reached approximately half an inch in length. At that point, the metallurgical math was complete: the disk fractured explosively at operating speed.

The NTSB’s final report, published on 1 November 1990, attributed the probable cause to “inadequate consideration given to human factors limitations in the inspection and quality control procedures used by United Airlines’ engine overhaul facility”:

“which resulted in the failure to detect a fatigue crack originating from a previously undetected metallurgical defect located in a critical area of the stage 1 fan disk that was manufactured by General Electric Aircraft Engines. The subsequent catastrophic disintegration of the disk resulted in the liberation of debris in a pattern of distribution and with energy levels that exceeded the level of protection provided by the design features of the hydraulic systems that operate the DC-10’s flight controls.”

Six fluorescent penetrant inspections (FPIs) had been carried out on the disk over its 17-year service life, but none had detected the fatigue crack — because, as subsequent research established, the crack had been growing sub-surface, below the region accessible to fluorescent penetrant inspection, driven by shot-peening-induced surface compressive stresses. The inspection method in use was structurally incapable of detecting what it was designed to find.

Compounding the finding was a disturbing revelation about manufacturing records. The NTSB discovered significant irregularities and gaps in GE Aircraft Engines’ own records of the crash disk, including indications that two rough-machined forgings had been assigned the same serial number, that one disk had been flagged as defective and should have been scrapped, and that no warranty claim or credit had been filed by GE with the titanium supplier Alcoa or TIMET. The precise origin of the crash disk remains formally unresolved.

How Flight 232 Changed Pilot Training Forever

Captain Al Haynes never accepted the word “hero.” He consistently credited the outcome to what he called the four components of the crew’s success: luck, training, communications — and Crew Resource Management (CRM). CRM is the practice of using all available resources, including every person in the cockpit, to achieve safe flight outcomes, with the captain retaining final authority but actively soliciting input from all crew. United Airlines had instituted a CRM programme in the early 1980s, and the NTSB credited this training as directly contributing to the crew’s ability to manage the Flight 232 emergency.

Following the accident, the FAA made Crew Resource Management training mandatory across the US commercial aviation industry — a regulatory change that has since saved countless lives by transforming the culture of cockpit authority from a rigid hierarchy into a collaborative, communicative system. Haynes spent the rest of his life as a lecturer on CRM and human factors in aviation, speaking at safety conferences worldwide and refusing to frame his crew’s actions as anything other than teamwork.

He died on 25 August 2019, a week short of his 88th birthday. Dennis Fitch, the off-duty instructor whose throttle management made the controlled descent possible, died in 2012. The NTSB’s Safety Compass blog published a tribute to Haynes upon his death, noting that his name had become synonymous with calm, competent airmanship under unimaginable duress.

The concept of propulsion-controlled aircraft (PCA) — the formal engineering discipline of flying on engine thrust alone when flight controls are disabled — grew directly from Flight 232. NASA’s Dryden Flight Research Center subsequently developed a formal PCA system for the F-15 and later evaluated it for transport aircraft, demonstrating that what Fitch had improvised by intuition could be translated into a systematic emergency capability.

Post-accident simulation testing by the NTSB confirmed what the crew already knew: even with the technique in hand, the odds of getting the aircraft onto the runway were deeply unfavourable. The fact that they did so with 184 survivors remains, in the view of virtually every aviation safety expert who has studied the case, one of the most extraordinary outcomes in the history of civil aviation.

What Flight 232 Changed in Aviation Certification and Engineering

The NTSB’s final report on Flight 232 issued a series of safety recommendations that reshaped commercial aviation engineering and certification practice globally. Their scope extended far beyond the United Airlines fleet or the DC-10 type — they applied, as the FAA’s own lessons-learned documentation states, to “large transport aircraft and engines throughout the commercial aviation industry.”

On the titanium manufacturing side, GE Aircraft Engines and the broader industry shifted to triple vacuum arc remelting (VAR) combined with hearth melting for all critical rotating components — a process that subjects the titanium to three sequential cycles under vacuum conditions, dissolving hard alpha inclusions more effectively than the single or double VAR processes previously standard.

The FAA issued Airworthiness Directive AD 89-20-01 within two months of the accident, requiring ultrasonic inspections of all CF6-6 stage-1 fan disks for metallurgical defects. Subsequent directives added eddy-current inspections, which could detect sub-surface cracks invisible to fluorescent penetrant techniques. During the inspection campaign triggered by these directives, at least two CF6 fan disks in active service were found to contain defects similar to the crash disk and were removed before they could fail.

On the hydraulic architecture side, the FAA issued Airworthiness Directive AD 90-13-07 requiring modifications to DC-10 hydraulic systems to prevent total hydraulic loss, including the addition of hydraulic fuses in critical routing areas.

The certification philosophy underpinning subsequent aircraft designs — including the Boeing 777, 787, and Airbus A380 — incorporated the lessons of Flight 232: that hydraulic system routing should be physically separated to eliminate the possibility of a single debris event defeating all systems simultaneously, and that uncontained engine failure scenarios must be considered in the certification of adjacent systems.

For children aboard aircraft, the accident also catalysed an important safety campaign. Senior flight attendant Jan Brown Lohr became a prominent advocate for requiring all infants and children to occupy their own restrained seats following the crash, during which four “lap children” — infants counted as too young to require separate seats — had been separated from their parents on impact. One of the four died from smoke inhalation.

What The Captain Al Haynes Said Afterwards

Captain Haynes became one of aviation’s most sought-after public speakers in the three decades that followed the accident, and his lectures at safety conferences and universities constituted a remarkable ongoing testimony about human factors, systemic failure, and collective decision-making.

Speaking at a NASA safety meeting, Haynes attributed the survival of 184 people to four things: luck, communication, preparation, and crew resource management. He was specific about what he meant by luck: the accident happened over Iowa rather than a mountain range; the weather over Sioux City was good; an experienced DC-10 instructor happened to be on the plane; and the local authorities happened to have drilled for exactly this scenario two years earlier.

On crew resource management, he was characteristically direct about what would have happened without it: “If I hadn’t used CRM,” Haynes is widely quoted as saying, “if we had been the kind of crew that didn’t communicate with each other, we would have been dead.”

The candour was deliberate. Haynes understood that the real lesson of Flight 232 was not the extraordinary nature of what the crew did — it was the way they did it. They delegated, communicated, and included Fitch without ego or territorial instinct. Four pilots, none of whom had ever trained for this scenario, made decisions together that no one of them could have made alone.