On 19 July 1989, the tail-mounted engine of United Airlines flight 232 disintegrated over Iowa. Debris severed all three of the DC-10's independent hydraulic systems. The crew flew the aircraft to Sioux City using engine thrust alone and crash-landed on the runway. 111 of the 296 people aboard died. 185 survived — an outcome that simulator studies afterwards suggested was close to unrepeatable.
The failure nobody designed for
The fan disc in the number two engine failed because of a metallurgical flaw present since the titanium was cast, which had grown into a fatigue crack over years and had been missed in inspections. When it let go, fragments cut through the tail section.
The DC-10 had three hydraulic systems specifically so that no single event could disable all of them. But all three ran through the tail, and the geometry of the failure severed all three within seconds. Hydraulic fluid drained away and every flight control stopped responding.
Flying with throttles
Captain Al Haynes, First Officer William Records and Flight Engineer Dudley Dvorak discovered they could produce a crude turn by advancing one wing engine and retarding the other, and could influence climb and descent by changing both together. The aircraft naturally oscillated up and down in a phugoid cycle, and it drifted persistently right.
A fourth pilot, Dennis Fitch, a DC-10 training check airman, was travelling as a passenger. He came forward and ended up kneeling on the flight deck floor working the throttles by hand while the others managed everything else. Haynes later described the flight deck as functioning as four people doing one job — a textbook illustration of the Crew Resource Management practices that had been introduced after Tenerife.
The landing
They reached Sioux Gateway Airport with no ability to flare, little directional control and a descent rate far above normal. The right wing dropped just before touchdown, the aircraft struck the runway, broke up and burned.
That 185 people walked away from it is due to several things at once: the crew getting the aircraft to a runway at all, an emergency response that happened to be exercising a mass-casualty drill that month and was on scene immediately, and the structure of the fuselage sections that separated.
What changed
Inspection procedures for titanium engine components were tightened, addressing the manufacturing flaw at source. More importantly, the accident forced manufacturers to reconsider redundancy as a matter of physical routing rather than system count: three systems that all pass through the same volume of the aircraft are less independent than the number suggests. Later aircraft designs added hydraulic fuses and separated routing so that a single uncontained failure cannot drain everything.
UA232 is also the case most often cited when arguing that CRM saves lives. The NTSB was explicit that the outcome exceeded what could reasonably have been expected, and attributed it substantially to how the four pilots worked together.