- ValuJet DC-9 in Florida
- Accident Overview
- Accident Board Findings
- Accident Board Recommendations
- Relevant Regulations
- Prevailing Cultural / Organizational Factors
- Key Safety Issue(s)
- Safety Assumptions
- Resulting Safety Initiatives
- Airworthiness Directives (ADs) Issued
- Common Themes
- Related Accidents / Incidents
- Lessons Learned
- ValuJet DC-9 in Florida
Photo of ValuJet Model DC-9
Photo copyright Mark Bess - used with permission
NTSB photo of recovered oxygen generator
On May 11, 1996, at 1413 EDT, a McDonnell Douglas Model DC-9-32 airplane operated by ValuJet Airlines, Inc. as Flight 592 crashed into the Florida Everglades approximately ten minutes after takeoff from Miami International Airport, Miami, Florida. The crash occurred as Flight 592 was attempting to return to Miami and was the result of an uncontrolled fire in the airplane's forward Class D cargo compartment. The fire was attributed to improper carriage of unexpended chemical oxygen generators in the cargo compartment as company-owned material (COMAT). The inadvertent activation of one or more of these generators provided an ignition source and contributed to the oxygen-fed fire which spread rapidly and ultimately rendered the airplane uncontrollable. All 105 passengers, two pilots and three cabin crew died in the accident.
A chemical oxygen generator is a component of the passenger supplemental oxygen system installed on some transport category airplanes. In the event of a decompression, this system protects passengers from the harmful effects of hypoxia by providing them with oxygen via a drop down mask until the airplane can descend to a more breathable altitude. One chemical oxygen generator is usually installed in each passenger service unit located above each seat row and provides oxygen to the passengers in that seat row (see oxygen generator diagram and photos). Once the masks drop down, the chemical oxygen generator for the seat row is activated when one of the passengers in the row pulls the mask down to don it. The action of pulling the mask down pulls on a lanyard that is attached to a pin in the firing mechanism of the generator. When the pin is pulled out of the firing mechanism, a spring-loaded initiation mechanism strikes a percussion cap containing a small explosive charge mounted in the end of the oxygen generator. The percussion cap, when struck, provides the energy necessary to start a chemical reaction in the generator oxidizer core, which liberates oxygen gas. When activated following a decompression, generators produce oxygen for a fixed period of time, typically 12 to 22 minutes. The chemical reaction that generates the oxygen also causes the generator shell to heat up to temperatures in the 450-500 deg F range, so care is taken during airplane design to ensure that when installed on the airplane, generators are not located adjacent to systems or materials that could ignite or be damaged by heat.
Oxygen generators have a fixed life, usually between ten and fifteen years, after which they are removed from the airplane and replaced with new generators. New generators are fitted with safety caps or safety pins, depending on the generator's design, to keep them from inadvertently activating during shipment, storage, and installation. After removal from the airplane, expired generators are still capable of being activated, producing oxygen and heat, and should be activated to expend them prior to disposal. Once the activated generator has completed its chemical reaction and has cooled, it is safe for handling. However, the expended generators are still considered hazardous waste due to the residual byproducts of the chemical reaction and, as such, must be disposed of accordingly. (See Oxygen Generators Animation)
Photo of recovered forward cargo compartment components
indicated presence of an intense fire
NTSB photo of post accident investigation
On the day of the accident, five boxes of expired, but NOT expended, generators that had been removed from ValuJet airplanes that were being readied for service were placed in the forward cargo compartment of Flight 592 for shipment to the Atlanta ValuJet facility, along with some airplane tires, all of which were being shipped by ValuJet as company-owned material (COMAT). The oxygen generators did not have safety caps installed. According to the shipping ticket, the COMAT consisted of two main tires and wheels and five boxes that were described as "Oxy Canisters - Empty." (Shipping Ticket)
At some point, possibly before takeoff, one or more of the generators inadvertently activated, producing oxygen and heat that ignited adjacent cargo and caused adjacent generators to produce oxygen. Since the forward cargo compartment of the ValuJet airplane was not equipped with a fire detection system to annunciate the presence of the fire to the flightcrew, the first indication of a problem occurred approximately six and a half minutes after takeoff. At this time, the flightcrew heard, and the cockpit voice recorder (CVR) recorded, an unidentified sound. The flight data recorder (FDR) recorded anomalous altitude and airspeed parameters, and the flightcrew immediately noted electrical anomalies. Based on post-crash fire tests, the noise heard and anomalies noted were most likely caused by the rupture of an inflated tire in the forward cargo compartment which had burst after being subjected to the heat and flames of the as yet undetected fire. Within 30 seconds, the captain reported an electrical problem to air traffic control (ATC), and voices shouting "fire, fire, fire" in the passenger cabin were recorded on the CVR. Flight 592 had dispatched with an inoperative cockpit/cabin interphone, so flight attendants had to open the cockpit door to apprise the flightcrew of the situation in the cabin. Just over three minutes later, Flight 592 crashed into the Everglades approximately 16 nautical miles from Miami International Airport at a large right roll angle and steep nose down attitude. (See ValuJet Flight 592 Flight Path Animation)
NTSB photo of recovered FDR
Although the National Transportation Safety Board (NTSB) was unable to determine with certainty the reason for the apparent loss of control, examination of the wreckage showed that before the impact the left side floor beams above the cargo compartment had melted and collapsed, which would likely have affected the control cables on the captain's side and may have also affected the first officer's controls. Ultimately the NTSB concluded that the loss of control was most likely the result of flight control system damage from the extreme heat and structural collapse. However, the NTSB was not able to rule out the possibility that the flightcrew was incapacitated by smoke or heat in the cockpit during the last seven seconds of the flight.
The NTSB made many recommendations following the loss of Flight 592 intended to address areas that had been determined causal in the accident associated with cargo compartment design standards, handling of hazardous materials, and oversight of airline operations. (NTSB Recommendations)
Class D Cargo Compartment
Both the forward and aft lower lobe cargo compartments on the ValuJet Model DC-9-30 airplane were certified as Class D cargo compartments in 1966 under part 4b, "Airplane Airworthiness Transportation Catagories," of the Civil Aviation Regulations (CARs) (CAR part 4b), which preceded the current Code of Federal Regulations. At the time of the accident, the FAA's most current cargo compartment classification regulation was section 25.855, "Cargo or baggage compartments," (14 CFR 25.855), which also allowed for approval of Class D cargo compartments. (Class C - D Regulations)
The primary method of controlling a fire in a Class D cargo compartment is to starve the fire of oxygen. This is accomplished by restricting the size and ventilation of the compartment with the intent that any fire occurring therein would quickly use up the available oxygen and self-extinguish, or at least remain at a non-threatening level for the duration of the flight. Class D cargo compartments were required to have fire resistant liners to protect adjacent structure and systems, which also served as a means to limit ventilation of the compartment and to prevent smoke from entering occupied areas of the airplane like the passenger cabin. Class D cargo compartments were not required to have fire detection systems, such as smoke detectors, to inform the flightcrew of the presence of a fire.
Historical evidence associated with Class D cargo compartment effectiveness in controlling fires showed mixed success. Because Class D compartments did not have fire detection systems, the presence of an in-flight fire was generally not discovered until the airplane landed and the cargo compartment door was opened. Typical causes of Class D compartment fires included baggage contacting airplane electrical components, such as lights, and items being carried in passenger baggage or mail bags. In many cases, the passive fire suppression system of the Class D compartment was successful. However, in some cases, the effectiveness of the Class D approach to control cargo fires could be questioned, particularly when carriage of hazardous materials was involved. In one case, leakage of chemicals being incorrectly carried in an American Airlines Model DC-9-83 airplane Class D cargo compartment caused a fire. Because no fire detection system was present, the flightcrew was unaware of the growing uncontrolled fire. Fortunately, in this incident, smoke in the passenger cabin was reported to the flightcrew and the airplane was already close to landing, so the flightcrew was able to successfully land the airplane and evacuate the occupants. The fire was uncontrolled, and had it gone undetected for longer, loss of the airplane would likely have resulted.
After the Flight 592 accident, the FAA conducted tests to further learn about the overall nature of a fire initiated by oxygen generators and fed with oxygen released from additional oxygen generators. Although the exact configuration of the Flight 592 forward cargo compartment loading could not be duplicated, the results showed that activation of one or more chemical oxygen generators loaded in a similar manner to the ValuJet loading could create enough heat to ignite adjacent materials. The testing also showed that adjacent oxygen generators could become involved and could generate additional oxygen, contributing to the size and intensity of the fire and thus defeating the Class D compartment fire protection methodology of suppressing fires through oxygen starvation. See Class D Cargo Compartment Testing Conducted by the FAA Technical Center, Atlantic City, NJ.
After the accident, the FAA initiated rulemaking to improve cargo fire protection for future airplane designs and to require retrofit incorporation of these improvements on existing airplanes. The FAA revised 14 CFR 25.855 to remove the Class D cargo compartment classification entirely. The FAA also revised section 121.314, "Cargo and baggage compartments," (14 CFR 121.314) to require all U.S. operators of passenger airplanes equipped with Class D cargo compartments to upgrade their cargo compartments to meet the 14 CFR 25.855 Class C cargo compartment standard and to meet the section 25.858, "Cargo [or baggage compartment smoke or fire detection systems]," (14 CFR 25.858 requirement to detect a cargo fire and annunciate it to the flight deck within one minute. Retrofit of airplanes to meet these requirements was a significant effort and included design and installation of a) new one-minute fire detection systems and b) new fire suppression systems (systems that control the fire by flooding the cargo compartment with a fire suppressant such as Halon). (Related Regulations)
The sequence of events that led to this accident started with the removal of about 144 expired oxygen generators from two Model DC-9-82 airplanes, N802VV and N803VV, which had recently been acquired by ValuJet. The task of removal and replacement of these generators had been sub-contracted to SabreTech, a Miami-based repair station that was contracted to perform heavy maintenance for ValuJet. SabreTech was using ValuJet work cards and was working to a tight schedule under a contract that stated that SabreTech agreed "to credit ValuJet the amount of $2,500 per calendar day as liquidated damages for each day the airplane is delayed beyond the redelivery date...." All work at SabreTech for the airplanes was to have been completed by April 24, 1996 for N802VV and by April 30, 1996 for N803VV. The passenger oxygen system maintenance tasks were ultimately completed and signed off as completed on May 5, 1996 for N802VV and on April 30, 1996 for N803VV.
Step 1B of the ValuJet Work Card 0069 used to accomplish the generator removals called for installation of shipping (safety) caps on unexpended generators prior to removal from the airplane. This step was not accomplished by maintenance personnel despite multiple conversations at SabreTech regarding the issue. Post accident interviews with responsible SabreTech maintenance personnel uncovered that these safety caps were not available at the SabreTech facility and were never procured. Under a great deal of pressure to complete work on the Model DC-9-82 airplanes on time, the work card item regarding shipping (safety) caps was signed off as complete by the SabreTech mechanics. One SabreTech inspector who signed off the "Final Inspection" block of the non-routine work card for one of the airplanes, said, in post-accident interviews, that at the time he signed off he was aware that the generators still needed (shipping) safety caps. He further stated that he brought this to the attention of the lead mechanic on the floor at the time, and was told that both the SabreTech supervisor and the ValuJet representative were aware of the problem and that it would be taken care of "in stores." According to him, after being given this reassurance, he signed the card as complete, as his focus was now entirely on the airworthiness of the other airplane being readied for service. SabreTech signed off ValuJet Work Card 0069 for N802VV and N803VV on May 5, 1996 and April 30, 1996, respectively.
NTSB photo of external soot trail behind opening
(See Large Photo)
Neither the ValuJet work card nor the referenced McDonnell Douglas Model DC-9-82 Airplane Maintenance Manual (MM), Chapter 35-22-03 (the only McDonnell Douglas AMM reference on the work card) gave instructions on how to store unexpended generators or dispose of expended generators. Disposition instructions did exist in another chapter of the McDonnell Douglas AMM but were not referenced on the work card. Without specific disposition instructions for the removed generators, SabreTech personnel used various methods of disposition. Generators ended up with their lanyards either cut off or wrapped around or taped to the generator canister in an attempt to preclude inadvertent actuation. Only six of the approximately 144 generators were reported to have been expended in the course of completing the work card. The majority of generators was incorrectly tagged with "repairable" tags and ultimately placed in five cardboard boxes that happened to be available on the shop floor. Expired and/or expended generators are not repairable and should have been tagged with red "condemned" tags.
The boxes of unexpended generators were eventually taken to the ValuJet section of SabreTech's shipping and receiving hold area and placed next to other boxes in front of shelves that held other parts from ValuJet airplanes. No markings, descriptions, disposition instructions, or other communications were attached to the boxes. No written or verbal communications were accomplished between the mechanics and the shipping/receiving personnel regarding these boxes. No hazardous materials warning labels were affixed to these boxes despite the fact that some individuals had noticed that the boxes in which the new generators were shipped did have such warnings. ValuJet was not authorized to carry hazardous materials on their airplanes.
On May 7 or 8, 1996, SabreTech's director of logistics went to the shipping and receiving area and directed the employees to clean up the area and to remove all of the items from the floor. This action was being taken because a potential customer was coming to the facility to conduct an audit/inspection, and in a previous audit by another customer, the "housekeeping" in the shipping and receiving area had been written up by the customer as unacceptable. The director of logistics said that he did not know the contents of any of the boxes in the area and that he did not give any specific instructions as to their disposition.
NTSB photo of Flight 592 impact crater
The stock clerk identified the unexpended generators as "empty canisters" on the shipping ticket. He did not know what the items were, and he made an incorrect assumption that the presence of "green" repairable tags on the generators meant that they were empty. He indicated in post-accident interviews that he had not read the "Reason for Removal" block on these tags. It is important to note that oxygen generators are hazardous material whether they have been expended or not, but the boxes were never labeled as such, and as previously stated, ValuJet was not authorized to carry hazardous material on their airplanes.
The five boxes of oxygen generators, along with the other COMAT, were transported to Flight 592 where a ValuJet ramp agent and the flight's first officer accepted the shipment, although neither paid particular attention to the contents. ValuJet ramp agents then loaded the boxes along with three tires in the forward cargo compartment. The ramp agent inside the cargo compartment when the boxes were loaded testified after the accident that he remembered hearing a "clink" sound when he loaded one of the boxes and that he could feel objects moving inside the box. The ramp agent said that the cargo was not secured and that the cargo compartment had no means for securing the cargo, which is consistent with many lower lobe cargo compartments that are designed to be bulk loaded.
At this point, the hazardous cargo of unexpended oxygen generators without safety caps installed - loosely packed in cardboard boxes with bubble wrap and improperly labeled without requisite hazardous material warnings - was loaded in the forward Class D cargo compartment. It is impossible to know exactly when the first oxygen generator actuated, but it is assumed that it activated at some time between when the generators were loaded on the airplane and takeoff, a period of approximately 30-35 minutes. It is widely believed that if a fire detection system had been installed on the airplane, the accident could have been averted because, depending on when the fire was annunciated, the flightcrew could have precluded takeoff or, if already in flight, returned to the airport more quickly. If the airplane had also been equipped with a fire suppression system, the system may not have been able to control a fire in the presence of oxidizers such as oxygen generators, so whether it would have been effective in preventing the accident is unclear.
NTSB photos of ValuJet Flight 592 Recovery Scene
(view large photos)