The DC-10 Lost Every Flight Control at 37,000 Feet.
The Crash That Shouldn't Have Been Survivable.
🕒 9 min read · Black Box Series · Episode 03 · Pilot Nick
You’re in seat 9F.
It’s a routine afternoon — Denver to Chicago, drinks served, descent still an hour away. The sun is hitting the wing through the window. You’re maybe halfway through your magazine.
Then a bang you feel in your ribs.
Not a clunk. A bang. The whole airplane lurches sideways. Your tray slides. Somewhere behind you, a glass breaks. The engines — you can’t quite put your finger on what’s different, but something is off.
The seatbelt sign comes on. The captain’s voice comes over the PA, calmer than it has any right to be.
“Ladies and gentlemen, we’ve had a problem with our number two engine. We are diverting to Sioux City.”
That’s the polite version.
Up at FL370, the cockpit just lost the airplane.
Welcome to Black Box · Episode 03
If you’re new here Black Box is the series where I take a real aviation incident and break it down the way a pilot actually thinks about it.
Not the news version. Not the dramatized version.
The version from the left seat.
What the crew saw. What they decided. Why. And most importantly for the nervous flyers reading this what changed afterwards, so that you never have to.
Here’s what almost nobody — passenger or pilot — fully understood about wide-body airliners on July 19, 1989.
A DC-10 has three hydraulic systems. Three. Each one independent, each one rated to fly the airplane on its own. You can lose one. You can lose two. The third one will still move the rudder, the elevators, the ailerons, the flaps, and the landing gear.
The design philosophy was simple: no single failure should be able to take all three. The probability of losing all three hydraulic systems on a DC-10 was calculated at roughly one in a billion flight hours.
Then a fan disk in engine number two — the one mounted in the tail — failed.
Not a crack the airline missed. A microscopic metallurgical defect, present in the titanium since the disk was forged 18 years earlier, that finally let go after 41,000 cycles of heating and cooling and spinning at 8,000 rpm.
The disk burst.
Shrapnel sprayed through the tail at hundreds of miles per hour and severed the lines of all three hydraulic systems — every one of which, for design reasons that made sense in 1968, happened to pass within a few feet of each other right behind that engine.
In about two seconds, the crew of United 232 had a DC-10 with no working flight controls.
No rudder. No elevators. No ailerons. No flaps. No spoilers. No nose-wheel steering. Nothing.
And the good news — yes, there is some — is what they did next.
Captain Al Haynes had been flying for 33 years. 30,000 hours. He’d never seen anything like this. Nobody had.
His first instinct, the one drilled into every airline pilot, was to grab the checklist. Loss of all hydraulics. He looked. There was no procedure.
There was no procedure because the situation wasn’t supposed to be possible.
The airplane was now in a slow right roll, pitching gently up and down in a long, lazy oscillation pilots call a phugoid — the natural rhythm an airplane settles into when nobody is flying it. Nose up, slow down. Nose down, speed up. Sixty seconds per cycle. Beautiful, almost, except they were 37,000 feet over Iowa with 296 people behind them.
First Officer William Record was on the controls and feeling nothing. The yoke moved freely. None of it did anything.
In the cabin behind them was a man named Dennis Fitch an off-duty United Check Airman who happened to be deadheading home. A DC-10 instructor. He’d actually trained for a hydraulic-loss scenario in a simulator, just out of curiosity, and discovered something interesting: you could sort of steer an airplane with the throttles.
Push the left engine forward, the airplane yaws and rolls right. Push the right engine, it rolls left. Add thrust to both, the nose comes up. Pull both back, the nose drops.
Fitch walked into the cockpit, introduced himself, and offered to help.
Haynes pointed at the center pedestal.
“Take the throttles.”
For the next 44 minutes, Fitch knelt on the floor between the captain and first officer, his hands on two thrust levers, flying the airplane the way nobody had ever flown an airplane before. Haynes ran the radios and the cabin. Record held the useless yoke. Second Officer Dudley Dvorak worked the system pages, looking for anything that could be saved.
Four pilots. Two engines. Zero flight controls. One runway in Iowa.
This is the part nobody trains for. So here’s what they did instead.
The 5 things the crew did right — without a checklist
These weren’t steps in a procedure. They’re what airline pilots now study as the textbook for “no procedure exists.”
1. They flew the airplane first.
Before anything else — before the radios, before the cabin, before the diversion — they flew.
Aviate, Navigate, Communicate.
In that order, always. The temptation when something catastrophic happens is to start talking, start asking, start fixing. The crew of 232 did none of that for the first 90 seconds. They figured out what the airplane was doing, then what it would do next, then what it might let them do.
2. They accepted the airplane they had.
Haynes never tried to get back the airplane they’d taken off in. He worked with the one he had. No working controls? Fine. What does work? Two throttles. Okay. We fly with two throttles.
3. They put the right person on the right job — immediately.
Fitch was a passenger. Fitch was also the only person on board who’d ever thought about flying a DC-10 with throttles alone. Haynes didn’t care about rank, schedule, or who was supposed to be where. He looked at the problem and put the most-qualified hand on it within two minutes of Fitch walking through the cockpit door.
4. They told the truth, fast.
Haynes got on the radio with Sioux City approach and told them, plainly: “We have almost no controllability.” Not “we have a problem.” Not “we’re declaring an emergency.” A specific, factual description that let the ground know exactly what was about to land on them and gave them 40 minutes to position every fire truck, ambulance, and Air National Guard medic in the county.
5. They kept their sense of humor.
This is the one that gets quoted most. When the approach controller cleared them to any runway, Haynes laughed and said, “You want to be particular and make it a runway, huh?” That isn’t gallows humor. That’s a crew whose stress was so far past the red line that the only way to keep working was to acknowledge it. Pilots call this winding the clock — doing something small and human to keep your nervous system below the threshold where it stops thinking.
This is the part the public never sees. The crew of 232 didn’t survive because they were braver. They survived because they had a system — and when the system ran out of procedures, they had each other.
The framework above is the whole story above the line. But the part most pilots study isn’t what the crew did. It’s what the industry did after.
Below the paywall, I’ll walk you through the three things in your next flight that exist directly because of Sioux City — the cockpit conversation you’ll never hear, the hydraulic line routed three feet to the left of where it would have been in 1989, and the inspection that catches the next fan disk before it ever leaves the maintenance hangar. Plus the Sioux City Lesson Card lesson learned for us pilots.
This is the part of the story that should reassure you the most. And it almost never gets told.
