The Repository Root Cause

United 232: Three Hydraulic Systems, One Tail

October 19, 2026 · Runtime 11:34 · Watch on YouTube

The DC-10 had three hydraulic systems, so it could lose two and still fly. On July 19, 1989, one titanium disk from the tail engine took out all three within about a minute. The pumps, the fluid and the pipes were separate; the place they all ended was not.

Chapters

  1. 0:00 Three systems, one minute
  2. 0:33 Flight 232, 37,000 feet
  3. 1:09 The story everyone knows, and the question it skips
  4. 1:47 What the design promised
  5. 2:27 Every backup needs the same fluid
  6. 3:02 Where all three pipes had to go
  7. 3:37 What the debris reached
  8. 4:17 Extremely remote: the 1970 approval
  9. 4:58 It had happened in pieces before
  10. 5:40 The disk in the corn field
  11. 6:15 A flaw from the melt
  12. 6:49 Where the factory looked
  13. 7:26 A life limit for a perfect disk
  14. 8:07 Six inspections, all accepted
  15. 8:51 The wire through the bore
  16. 9:28 The probable cause
  17. 10:09 The fix was a valve
  18. 10:49 Independence is a place

Transcript

Three systems, one minute 0:00

The DC-10 had three hydraulic systems to move its flight controls. Three sets of pumps, three separate supplies of fluid, three sets of pipes, run down different sides of the airplane. Every control surface was powered by two of them, so the airplane could lose two of the three and still fly. On July 19th, 1989, at thirty-seven thousand feet over Iowa, all three went to zero within about a minute. One part did it: a titanium disk, thirty-two inches across, from the engine in the tail.

Flight 232, 37,000 feet 0:33

United Airlines Flight 232 left Denver at 2:09 in the afternoon, bound for Philadelphia by way of Chicago, with two hundred and ninety-six people on board. At 3:16, in cruise, the crew heard a loud bang, and the airframe shook. The engine instruments said the number two engine, the one mounted in the tail, had failed. While the crew ran the shutdown checklist, the flight engineer saw the gauges for hydraulic pressure and quantity, on all three systems, reading zero. The airplane was turning right and descending, and the control column did nothing.

The story everyone knows, and the question it skips 1:09

The version most people know is the one about the crew. It is true, and the Safety Board says it plainly: their performance greatly exceeded reasonable expectations. For forty-four minutes they steered a wide-body jet with nothing but the throttles of the two wing engines, and they reached a runway at Sioux City. On the landing the right wing touched first, and the airplane broke apart. A hundred and eleven of the two hundred and ninety-six on board died. But this channel asks a different question. Losing one engine is a case every airliner is designed for. So why did losing one engine leave nothing to fly with?

What the design promised 1:47

Here is what the design promised. Each of the three systems took its power from a different engine, with two pumps on each, and either pump could carry the whole system. Between the systems sat two reversible motor pumps, which could pass power from one system to another without ever mixing their fluid. And if every engine pump was lost, a small propeller could drop into the airstream and turn a generator, to run an electric pump on system three. What the design did not have was a way back to cables. The surfaces were too heavy for muscle. At least one system had to keep its fluid and hold pressure, or nothing moved.

Every backup needs the same fluid 2:27

Look at that list of backups again, and ask what each one actually backs up. The second pump replaces the first pump. The motor pumps move power from one system to another. The generator in the airstream drives a pump. Every one of them replaces a source of power. Not one of them replaces the fluid. The report says it about the transfer pumps directly: they work if fluid is still available in the system they are feeding. The crew deployed the generator and switched on the pump, and nothing came back. There was nothing left in the pipes for it to push.

Where all three pipes had to go 3:02

So where could all three lose their fluid at once? The pipes were kept apart on purpose. System one ran down the left side of the fuselage, system three down the right, and system two came out of the center engine. The designers had even thought about flying debris. System two was kept behind the wing's rear spar, away from the wing engines, and system three was kept out of part of the tail, away from the engine back there. But all three had to end in the same place, because that is where the elevators and the rudder are. The tail, right beside the number two engine.

What the debris reached 3:37

Here is what the debris did. A section of the right horizontal stabilizer was already missing before the airplane reached the ground. A photograph taken from below, on the approach, shows the gap. That section carried system one's tubing, and a piece of it recovered from the runway had titanium smeared on it. System three's pressure line was cut in the same stabilizer, further inboard. System two's pumps were bolted to the failed engine itself, and parts of them came down in farm fields near Alta, Iowa. About a minute after the bang, the flight data recorder shows no more powered movement of any control surface.

Extremely remote: the 1970 approval 4:17

Was any of this foreseen? When the DC-10 was certified, the FAA required design features to limit the damage if an engine rotor burst. In July of 1970, Douglas answered that the engines and systems were arranged so that one failure harming the others was extremely remote, and that the hydraulic design complied. Sixteen days later, the FAA agreed. What neither side had was a published method for how far fragments fly, or how much energy they carry. The FAA's guidance on that came out in March of 1988. Eighteen years after the airplane was certified, and sixteen months before this flight.

It had happened in pieces before 4:58

And even that guidance pictured a disk breaking into three pieces, with one of the three reaching the airplane. The Board noted that it did not specifically address a large piece of a fan disk, which is what this was. Nor was the danger new. In 1981, a Lockheed TriStar over New Jersey lost the fan from its tail engine, and three of its four hydraulic systems with it. It landed on the fourth. In 1985, in Japan, a Boeing 747 lost all four after a faulty repair to its rear bulkhead, and more than five hundred people died. The Board wrote that poor predictions of secondary damage had led to both this accident and the one in Japan.

The disk in the corn field 5:40

Now the part itself. The stage one fan disk weighed three hundred and seventy pounds: a machined titanium forging, thirty-two inches across, that held the fan blades at its rim. It fell somewhere over Iowa, and for three months nobody found it. In mid-October it turned up in two pieces, in corn fields near Alta, complete except for one blade post. The fracture had started at the bore, the thick inner ring around the center hole. That is where the spinning disk is stressed hardest, because there is no metal further in to share the load.

A flaw from the melt 6:15

At the origin, investigators found a tiny cavity, and around it a spot of titanium loaded with nitrogen, called hard alpha. Titanium only takes in that much nitrogen while it is molten. So the flaw had been in the metal since the ingot was poured. It was harder than the alloy around it, and it cracked almost as soon as the disk first ran at full power. The growth marks on the crack face nearly matched the disk's total of fifteen thousand five hundred and three flights. The crack had been growing, a little every flight, for seventeen years.

Where the factory looked 6:49

Why didn't the factory see it? General Electric inspected the disk in 1971, with ultrasound and with an acid etch. But ultrasound finds hard alpha only when a crack or a void sits beside it. And the etch was done on the rough forged shape, before the final machining. The Board concluded that the cavity was opened by that final machining and shot peening, after both inspections. And it found that the flaw would have been apparent if the finished part had been etched, which other engine makers had done for years. The defect was in the metal. The gap was in where the inspection stood.

A life limit for a perfect disk 7:26

The disk also had a life limit, and it never reached it. At certification, General Electric showed that a disk without defects would last fifty-four thousand flights before a crack even began. The FAA took a third of that, eighteen thousand, as the safe life. This disk failed at fifteen thousand five hundred and three. A third is a wide margin, but it was a margin on a number that assumed the metal was perfect. With a flaw already inside, the long phase before a crack starts simply does not exist, and only the growing phase is left. Shortly before the accident, General Electric had applied to extend that life to twenty thousand.

Six inspections, all accepted 8:07

In seventeen years, the disk came out of its engine six times and was checked with fluorescent penetrant. That is a dye that soaks into any crack and glows under ultraviolet light, once the surface is wiped and dusted with developer. Five of those checks were done at United's overhaul shop in San Francisco, and all six were stamped as accepted. The last was in early 1988, seven hundred and sixty flights before the accident. By then the crack was nearly half an inch long on the bore. And the Board could show the dye had gone into it. Chemicals from the penetrant were found on the fracture face, and the process had left a stain marking the crack's size that day: zero point four seven six inches.

The wire through the bore 8:51

So why wasn't it seen? The Board did not settle on one reason, and it listed several. At United's shop, the disk hung from a sheathed steel wire threaded through the bore, the very surface where the crack was. The wire masked the bore from the spray wand, and the inspector had to jerk the disk upward to turn it and reach the hidden strip. Developer powder could have dropped off the cable onto the crack. And in that kind of inspection, indications showed up near the blade slots on the rim, and almost never in the bore. An area that never shows anything is an easy area to look at quickly.

The probable cause 9:28

Read the probable cause carefully, because it does not say that an inspector missed a crack. It says that inadequate consideration was given to human factors limitations in the inspection and quality control procedures at United's engine overhaul facility. The Board found the procedures themselves adequate, if properly followed. What it found missing was redundancy. Inspectors worked alone, with little supervision, in a process with almost no second check built in. Its recommendation asks for a second set of eyes on critical parts like engine disks. The airplane had three of everything. Its most critical inspection had one.

The fix was a valve 10:09

What changed on the airplane afterwards is the most telling part. The Board looked at airliners with four independent hydraulic systems, and found no inherent safety advantage in adding more. The fix the FAA made mandatory, in July of 1990, was a valve. An electric shutoff valve on system three, just ahead of the horizontal stabilizer, closes by itself when the fluid in system three's reservoir starts to drop. If the tail is torn open, the tail is cut off, and the fluid in front of it stays where it is. That keeps stabilizer trim, some of the ailerons, the slats, the brakes and the landing gear.

Independence is a place 10:49

Independence was counted in pumps, in fluid and in pipes. It was never counted in places. Three systems that all pass through one place are, in that place, one system, and the tail was that place. The same arithmetic ran through the disk: six inspections, one method, one person at a time, one wire through the bore. Backups only multiply when their failures are separate. Next case is another engine coming apart, twenty-one years later. Qantas Flight 32, November 2010: an Airbus A380 lost a turbine disk over Indonesia, and the cause was an oil pipe machined too thin. The factory's own measuring machine had most likely flagged it.

Description and sources

United Airlines Flight 232, Denver to Philadelphia via Chicago, 19 July 1989, 296 on board. In cruise at 37,000 feet the stage 1 fan disk of the tail-mounted No. 2 engine separated. Fragments severed the No. 1 and No. 3 hydraulic lines in the right horizontal stabilizer, and the No. 2 system's pumps were lost with the engine. With no powered flight controls, the crew steered with the two wing-engine throttles for about 44 minutes and reached Sioux Gateway Airport, where the airplane broke apart on landing. 111 people died.

Every backup in the DC-10's hydraulic design replaced a source of power -- a second pump, reversible motor pumps, an air-driven generator -- and none replaced the fluid. The three systems were routed apart, and even kept away from the engines, but all three had to end in the tail. At certification in 1970 the arrangement was accepted as making such a loss extremely remote; the FAA's published method for fragment spread and energy came in 1988.

The disk carried a hard alpha flaw from the titanium melt. GE's 1971 ultrasonic and etch inspections were made on the rough forged shape, before final machining opened the cavity. The disk passed six fluorescent penetrant inspections; at the last one, 760 flights before the accident, a crack about half an inch long was present, and penetrant residue was later found inside it. The NTSB's probable cause names inadequate consideration of human factors limitations in United's inspection and quality control procedures. The fix for the airplane was not a fourth system but a shutoff valve that seals the tail off from system 3.

PRINT-READY, FROM THIS CHANNEL

The Failure Atlas, Vol. 01 — Tacoma Narrows · Citicorp Center · Millennium Bridge · Apollo 13 · the 2003 blackout · Hyatt Regency

https://therepository.gumroad.com/l/failure-atlas

PRIMARY SOURCES

ARCHIVE PHOTOGRAPHS — the real structure, with title, author, date, archive and licence. All public-domain.

  • Fig. 14 — NTSB — 1990 | NTSB/AAR-90/06 | Public domain
  • Fig. 1 — NTSB — 1990 | NTSB/AAR-90/06 | Public domain
  • Fig. 10 — NTSB — 1990 | NTSB/AAR-90/06 | Public domain
  • Fig. 18 — NTSB — 1990 | NTSB/AAR-90/06 | Public domain
  • Fig. 11 — NTSB — 1990 | NTSB/AAR-90/06 | Public domain
  • Fig. 19B — NTSB — 1990 | NTSB/AAR-90/06 | Public domain
  • Fig. 20 — NTSB — 1990 | NTSB/AAR-90/06 | Public domain
  • Fig. 17 — NTSB — 1990 | NTSB/AAR-90/06 | Public domain
  • Fig. 9 — NTSB — 1990 | NTSB/AAR-90/06 | Public domain

The 7 technical plates in this video are illustrations generated for the channel by a diffusion image model, styled to match its cyanotype identity. They are diagrams of the system — the photographs above are the archive, the drawings are ours, not photographs of the hardware, and no person is depicted in any of them.

Root Cause investigates why engineered systems fail, using official investigation findings and primary technical literature. Sources for this episode are linked above.

#aviation #engineering #rootcause