McDonnell Douglas DC-9-32

Accident Overview

On May 11, 1996, at 1413 EDT, a McDonnell Douglas Model DC-9-32 airplane operated by ValuJet Airlines, Inc. as Flight 592 crashed into the Florida Everglades approximately ten minutes after takeoff from Miami International Airport, Miami, Florida. The crash occurred as Flight 592 was attempting to return to Miami and was the result of an uncontrolled fire in the airplane's forward Class D cargo compartment. The fire was attributed to improper carriage of unexpended chemical oxygen generators in the cargo compartment as company-owned material (COMAT). The inadvertent activation of one or more of these generators provided an ignition source and contributed to the oxygen-fed fire which spread rapidly and ultimately rendered the airplane uncontrollable. All 105 passengers, two pilots and three cabin crew died in the accident.

Oxygen Generators

A chemical oxygen generator is a component of the passenger supplemental oxygen system installed on some transport category airplanes. In the event of a decompression, this system protects passengers from the harmful effects of hypoxia by providing them with oxygen via a drop down mask until the airplane can descend to a more breathable altitude. One chemical oxygen generator is usually installed in each passenger service unit located above each seat row and provides oxygen to the passengers in that seat row (see oxygen generator diagram and photos). Once the masks drop down, the chemical oxygen generator for the seat row is activated when one of the passengers in the row pulls the mask down to don it. The action of pulling the mask down pulls on a lanyard that is attached to a pin in the firing mechanism of the generator. When the pin is pulled out of the firing mechanism, a spring-loaded initiation mechanism strikes a percussion cap containing a small explosive charge mounted in the end of the oxygen generator. The percussion cap, when struck, provides the energy necessary to start a chemical reaction in the generator oxidizer core, which liberates oxygen gas. When activated following a decompression, generators produce oxygen for a fixed period of time, typically 12 to 22 minutes. The chemical reaction that generates the oxygen also causes the generator shell to heat up to temperatures in the 450-500 deg F range, so care is taken during airplane design to ensure that when installed on the airplane, generators are not located adjacent to systems or materials that could ignite or be damaged by heat.

Oxygen generators have a fixed life, usually between ten and fifteen years, after which they are removed from the airplane and replaced with new generators. New generators are fitted with safety caps or safety pins, depending on the generator's design, to keep them from inadvertently activating during shipment, storage, and installation. After removal from the airplane, expired generators are still capable of being activated, producing oxygen and heat, and should be activated to expend them prior to disposal. Once the activated generator has completed its chemical reaction and has cooled, it is safe for handling. However, the expended generators are still considered hazardous waste due to the residual byproducts of the chemical reaction and, as such, must be disposed of accordingly. (See Oxygen Generators Animation below.)

Flight 592

On the day of the accident, five boxes of expired, but NOT expended, generators that had been removed from ValuJet airplanes that were being readied for service were placed in the forward cargo compartment of Flight 592 for shipment to the Atlanta ValuJet facility, along with some airplane tires, all of which were being shipped by ValuJet as company-owned material (COMAT). The oxygen generators did not have safety caps installed. According to the shipping ticket, the COMAT consisted of two main tires and wheels and five boxes that were described as "Oxy Canisters - Empty." (Shipping Ticket)

At some point, possibly before takeoff, one or more of the generators inadvertently activated, producing oxygen and heat that ignited adjacent cargo and caused adjacent generators to produce oxygen. Since the forward cargo compartment of the ValuJet airplane was not equipped with a fire detection system to annunciate the presence of the fire to the flight crew, the first indication of a problem occurred approximately six and a half minutes after takeoff. At this time, the flight crew heard, and the cockpit voice recorder (CVR) recorded, an unidentified sound. The flight data recorder (FDR) recorded anomalous altitude and airspeed parameters, and the flight crew immediately noted electrical anomalies. Based on post-crash fire tests, the noise heard and anomalies noted were most likely caused by the rupture of an inflated tire in the forward cargo compartment which had burst after being subjected to the heat and flames of the as yet undetected fire. Within 30 seconds, the captain reported an electrical problem to air traffic control (ATC), and voices shouting "fire, fire, fire" in the passenger cabin were recorded on the CVR. Flight 592 had dispatched with an inoperative cockpit/cabin interphone, so flight attendants had to open the cockpit door to apprise the flight crew of the situation in the cabin. Just over three minutes later, Flight 592 crashed into the Everglades approximately 16 nautical miles from Miami International Airport at a large right roll angle and steep nose down attitude. (See ValuJet Flight 592 Flight Path Animation below.)

Although the National Transportation Safety Board (NTSB) was unable to determine with certainty the reason for the apparent loss of control, examination of the wreckage showed that before the impact the left side floor beams above the cargo compartment had melted and collapsed, which would likely have affected the control cables on the captain's side and may have also affected the first officer's controls. Ultimately the NTSB concluded that the loss of control was most likely the result of flight control system damage from the extreme heat and structural collapse. However, the NTSB was not able to rule out the possibility that the flight crew was incapacitated by smoke or heat in the cockpit during the last seven seconds of the flight.

The NTSB made many recommendations following the loss of Flight 592 intended to address areas that had been determined causal in the accident associated with cargo compartment design standards, handling of hazardous materials, and oversight of airline operations. (NTSB Recommendations)

Class D Cargo Compartment

Both the forward and aft lower lobe cargo compartments on the ValuJet Model DC-9-30 airplane were certified as Class D cargo compartments in 1966 under part 4b, "Airplane Airworthiness Transportation Catagories," of the Civil Aviation Regulations (CARs) (CAR part 4b), which preceded the current Code of Federal Regulations. At the time of the accident, the FAA's most current cargo compartment classification regulation was section 25.855, "Cargo or baggage compartments," (14 CFR 25.855), which also allowed for approval of Class D cargo compartments. (Class C - D Regulations)

The primary method of controlling a fire in a Class D cargo compartment is to starve the fire of oxygen. This is accomplished by restricting the size and ventilation of the compartment with the intent that any fire occurring therein would quickly use up the available oxygen and self-extinguish, or at least remain at a non-threatening level for the duration of the flight. Class D cargo compartments were required to have fire resistant liners to protect adjacent structure and systems, which also served as a means to limit ventilation of the compartment and to prevent smoke from entering occupied areas of the airplane like the passenger cabin. Class D cargo compartments were not required to have fire detection systems, such as smoke detectors, to inform the flight crew of the presence of a fire.

Historical evidence associated with Class D cargo compartment effectiveness in controlling fires showed mixed success. Because Class D compartments did not have fire detection systems, the presence of an in-flight fire was generally not discovered until the airplane landed and the cargo compartment door was opened. Typical causes of Class D compartment fires included baggage contacting airplane electrical components, such as lights, and items being carried in passenger baggage or mail bags. In many cases, the passive fire suppression system of the Class D compartment was successful. However, in some cases, the effectiveness of the Class D approach to control cargo fires could be questioned, particularly when carriage of hazardous materials was involved. In one case, leakage of chemicals being incorrectly carried in an American Airlines Model DC-9-83 airplane Class D cargo compartment caused a fire. Because no fire detection system was present, the flight crew was unaware of the growing uncontrolled fire. Fortunately, in this incident, smoke in the passenger cabin was reported to the flight crew and the airplane was already close to landing, so the flight crew was able to successfully land the airplane and evacuate the occupants. The fire was uncontrolled, and had it gone undetected for longer, loss of the airplane would likely have resulted.

After the Flight 592 accident, the FAA conducted tests to further learn about the overall nature of a fire initiated by oxygen generators and fed with oxygen released from additional oxygen generators. Although the exact configuration of the Flight 592 forward cargo compartment loading could not be duplicated, the results showed that activation of one or more chemical oxygen generators loaded in a similar manner to the ValuJet loading could create enough heat to ignite adjacent materials. The testing also showed that adjacent oxygen generators could become involved and could generate additional oxygen, contributing to the size and intensity of the fire and thus defeating the Class D compartment fire protection methodology of suppressing fires through oxygen starvation. See Class D Cargo Compartment Testing Conducted by the FAA Technical Center, Atlantic City, NJ. 

After the accident, the FAA initiated rulemaking to improve cargo fire protection for future airplane designs and to require retrofit incorporation of these improvements on existing airplanes. The FAA revised 14 CFR 25.855 to remove the Class D cargo compartment classification entirely. The FAA also revised section 121.314, "Cargo and baggage compartments," (14 CFR 121.314) to require all U.S. operators of passenger airplanes equipped with Class D cargo compartments to upgrade their cargo compartments to meet the 14 CFR 25.855 Class C cargo compartment standard and to meet the section 25.858, "Cargo [or baggage compartment smoke or fire detection systems]," (14 CFR 25.858 requirement to detect a cargo fire and annunciate it to the flight deck within one minute. Retrofit of airplanes to meet these requirements was a significant effort and included design and installation of a) new one-minute fire detection systems and b) new fire suppression systems (systems that control the fire by flooding the cargo compartment with a fire suppressant such as Halon). (Related Regulations)

Organizational Events

The sequence of events that led to this accident started with the removal of about 144 expired oxygen generators from two Model DC-9-82 airplanes, N802VV and N803VV, which had recently been acquired by ValuJet. The task of removal and replacement of these generators had been sub-contracted to SabreTech, a Miami-based repair station that was contracted to perform heavy maintenance for ValuJet. SabreTech was using ValuJet work cards and was working to a tight schedule under a contract that stated that SabreTech agreed "to credit ValuJet the amount of $2,500 per calendar day as liquidated damages for each day the airplane is delayed beyond the redelivery date...." All work at SabreTech for the airplanes was to have been completed by April 24, 1996 for N802VV and by April 30, 1996 for N803VV. The passenger oxygen system maintenance tasks were ultimately completed and signed off as completed on May 5, 1996 for N802VV and on April 30, 1996 for N803VV.

Step 1B of the ValuJet Work Card 0069 used to accomplish the generator removals called for installation of shipping (safety) caps on unexpended generators prior to removal from the airplane. This step was not accomplished by maintenance personnel despite multiple conversations at SabreTech regarding the issue. Post accident interviews with responsible SabreTech maintenance personnel uncovered that these safety caps were not available at the SabreTech facility and were never procured. Under a great deal of pressure to complete work on the Model DC-9-82 airplanes on time, the work card item regarding shipping (safety) caps was signed off as complete by the SabreTech mechanics. One SabreTech inspector who signed off the "Final Inspection" block of the non-routine work card for one of the airplanes, said, in post-accident interviews, that at the time he signed off he was aware that the generators still needed (shipping) safety caps. He further stated that he brought this to the attention of the lead mechanic on the floor at the time, and was told that both the SabreTech supervisor and the ValuJet representative were aware of the problem and that it would be taken care of "in stores." According to him, after being given this reassurance, he signed the card as complete, as his focus was now entirely on the airworthiness of the other airplane being readied for service. SabreTech signed off ValuJet Work Card 0069 for N802VV and N803VV on May 5, 1996 and April 30, 1996, respectively.

Neither the ValuJet work card nor the referenced McDonnell Douglas Model DC-9-82 Airplane Maintenance Manual (MM), Chapter 35-22-03 (the only McDonnell Douglas AMM reference on the work card) gave instructions on how to store unexpended generators or dispose of expended generators. Disposition instructions did exist in another chapter of the McDonnell Douglas AMM but were not referenced on the work card. Without specific disposition instructions for the removed generators, SabreTech personnel used various methods of disposition. Generators ended up with their lanyards either cut off or wrapped around or taped to the generator canister in an attempt to preclude inadvertent actuation. Only six of the approximately 144 generators were reported to have been expended in the course of completing the work card. The majority of generators was incorrectly tagged with "repairable" tags and ultimately placed in five cardboard boxes that happened to be available on the shop floor. Expired and/or expended generators are not repairable and should have been tagged with red "condemned" tags.

The boxes of unexpended generators were eventually taken to the ValuJet section of SabreTech's shipping and receiving hold area and placed next to other boxes in front of shelves that held other parts from ValuJet airplanes. No markings, descriptions, disposition instructions, or other communications were attached to the boxes. No written or verbal communications were accomplished between the mechanics and the shipping/receiving personnel regarding these boxes. No hazardous materials warning labels were affixed to these boxes despite the fact that some individuals had noticed that the boxes in which the new generators were shipped did have such warnings. ValuJet was not authorized to carry hazardous materials on their airplanes.

On May 7 or 8, 1996, SabreTech's director of logistics went to the shipping and receiving area and directed the employees to clean up the area and to remove all of the items from the floor. This action was being taken because a potential customer was coming to the facility to conduct an audit/inspection, and in a previous audit by another customer, the "housekeeping" in the shipping and receiving area had been written up by the customer as unacceptable. The director of logistics said that he did not know the contents of any of the boxes in the area and that he did not give any specific instructions as to their disposition.

A stock clerk suggested, and received permission, to pack up the boxes and send them back to ValuJet's Atlanta facility. He then reorganized the contents of the five boxes by redistributing the number of generators in each box, placing them on their sides, end-to-end along the length of the box, and placing about two to three inches of bubble wrap in the top of each box. He then closed the boxes and to each applied a blank SabreTech address label and a ValuJet COMAT label with the notation "aircraft parts." According to the clerk, the boxes remained next to the shipping table from May 8, 1996, until the morning of May 11, 1996, the day of the accident.
The stock clerk identified the unexpended generators as "empty canisters" on the shipping ticket. He did not know what the items were, and he made an incorrect assumption that the presence of "green" repairable tags on the generators meant that they were empty. He indicated in post-accident interviews that he had not read the "Reason for Removal" block on these tags. It is important to note that oxygen generators are hazardous material whether they have been expended or not, but the boxes were never labeled as such, and as previously stated, ValuJet was not authorized to carry hazardous material on their airplanes.

The five boxes of oxygen generators, along with the other COMAT, were transported to Flight 592 where a ValuJet ramp agent and the flight's first officer accepted the shipment, although neither paid particular attention to the contents. ValuJet ramp agents then loaded the boxes along with three tires in the forward cargo compartment. The ramp agent inside the cargo compartment when the boxes were loaded testified after the accident that he remembered hearing a "clink" sound when he loaded one of the boxes and that he could feel objects moving inside the box. The ramp agent said that the cargo was not secured, and that the cargo compartment had no means for securing the cargo, which is consistent with many lower lobe cargo compartments that are designed to be bulk loaded.

At this point, the hazardous cargo of unexpended oxygen generators without safety caps installed - loosely packed in cardboard boxes with bubble wrap and improperly labeled without requisite hazardous material warnings - was loaded in the forward Class D cargo compartment. It is impossible to know exactly when the first oxygen generator actuated, but it is assumed that it activated at some time between when the generators were loaded on the airplane and takeoff, a period of approximately 30-35 minutes. It is widely believed that if a fire detection system had been installed on the airplane, the accident could have been averted because, depending on when the fire was annunciated, the flight crew could have precluded takeoff or, if already in flight, returned to the airport more quickly. If the airplane had also been equipped with a fire suppression system, the system may not have been able to control a fire in the presence of oxidizers such as oxygen generators, so whether it would have been effective in preventing the accident is unclear.

Back to top 

The National Transportation Safety Board (NTSB) determined that the probable causes of the accident, which resulted from a fire in the airplane's Class D cargo compartment that was initiated by the activation of one or more oxygen generators being improperly carried as cargo, were (1) the failure of SabreTech to properly prepare, package, and identify unexpended chemical oxygen generators before presenting them to ValuJet for carriage; (2) the failure of ValuJet to properly oversee its contract maintenance program to ensure compliance with maintenance, maintenance training, and hazardous materials requirements and practices; and (3) the failure of the FAA to require smoke detection and fire suppression systems in Class D cargo compartments.

The complete NTSB report on this accident is provided at the following link: ValuJet 592 Accident Report

Also listed as contributing factors were the failure of the FAA to adequately monitor ValuJet's heavy maintenance programs and responsibilities, including ValuJet's oversight of its contractors and SabreTech's repair station certificate; the failure of the FAA to adequately respond to prior chemical oxygen generator fires with programs to address the potential hazards; and ValuJet's failure to ensure that both ValuJet and contract maintenance facility employees were aware of the carrier's "no-carry" hazardous materials policy and had received appropriate hazardous materials training.

The NTSB issued 47 findings relative to this accident: (NTSB Findings)

Back to top

The NTSB issued numerous safety recommendations to the FAA, the Research and Special Programs Administration (RSPA), the United States Postal Service (USPS), and the Air Traffic Association (ATA) in the wake of this accident.

The recommendations to the FAA centered on requiring smoke detection and fire suppression systems for all Class D cargo compartments and requiring the cockpit-cabin interphone to be operable for dispatch. The NTSB also recommended that airline pilots should have training and means to rapidly don oxygen masks and smoke goggles at the first indication of a possible in-flight smoke/fire emergency. Additionally, they recommended that further research should be conducted to evaluate methods and procedures to protect crewmembers and passengers from smoke and fumes. Numerous other maintenance and operational issues were addressed including, among other things, efforts to improve organizational performance in the adherence to published procedures, the safety of transport of hazardous materials, and a specific recommendation to ensure that oxygen generators that have reached the end of their service life should be expended prior to transport.

The recommendations to the RSPA, USPS, and ATA all centered on efforts to improve the safety of transport of hazardous materials. A link to the complete list of NTSB recommendations is included here. (NTSB Recommendations)

Back to top

The DC-9-32 was originally certified in the mid-1960s under Civil Aviation Regulations (CAR) 4b with amendments 4b-1 thru 4b-16. These regulations directly preceded, and as stated in the airplanes Type Certificate Data Sheet (TCDS), are considered equivalent to Title 14 of the Code of Federal Regulations (14 CFR) Part 25 (new) which became effective February 1st, 1965.

The then new 14 CFR 25.855, "Cargo and Baggage Compartments," described general cargo compartment fire protection requirements.

The then new 14 CFR 25.857, "Cargo compartment classification," described specific cargo compartment classifications, such as Class C and Class D, and specific requirements associated with each classification. The Class D classification required a cargo fire to be totally contained so as not to endanger the safety of occupants. This class of cargo compartment attempted to control the growth of a fire primarily by starving the fire of oxygen. Due to the oxygen starvation assumption, Class D compartments were not required to have a smoke and fire detection system, nor were they required to have an active fire suppression system.

14 CFR 25.1439, "Protective breathing equipment," is linked here for completeness due only to the fact that the NTSB stated in their accident findings that although the final loss of control of ValuJet 592 was likely the result of flight control failure due to the extreme heat and structural collapse caused by the fire "...the Safety Board cannot rule out the possibility that the flight crew was incapacitated by smoke or heat in the cockpit during the last 7 seconds of the flight." This regulation describes the protective breathing equipment requirements for crewmembers that were in place at the time the DC-9-32 was certified.

Back to top

Prior to the Flight 592 accident, "oxygen starvation" was the primary means to control fires in Class D cargo compartments, accomplished by restricting the size of the compartment and limiting the amount of ventilation. This design scheme was considered to be an adequate means to control an in-flight fire that originated in a cargo compartment. The Class D approach was not oriented toward managing the improper carriage of oxidizers in quantities that could defeat the "oxygen starvation" approach for controlling fires.

ValuJet was, at the time of the accident, a rapidly growing, non-traditional air carrier, and had elicited some airworthiness concerns from both FAA headquarters in Washington DC and the FAA's Atlanta Flight Standards District Office (FSDO). At the time of the accident, the FAA Atlanta FSDO was in the midst of a 120-day intensive, focused surveillance of ValuJet, initiated due to concerns over the carrier's accident/incident rate, rapid growth, and the difficulty in performing surveillance (oversight) activities of ValuJet maintenance and operations due to ValuJet's non-traditional use of vendors.

Back to top

Unexpended oxygen generators were not identified as hazardous material and as such were incorrectly placed in Flight 592's cargo compartment for shipment, violating ValuJet's own procedures specifically banning carriage of hazardous materials. Review of past reports from other U.S. operators indicates that improper carriage of oxygen generators on airplanes had occurred multiple times prior to the accident, due in part to failure to recognize or mark generators as hazardous materials.

Work instructions to install safety caps, which could provide some protection from inadvertent activation, were not followed by SabreJet personnel who removed oxygen generators from ValuJet Model DC-9-82 airplanes, increasing the chance of inadvertent activation of the generators when they were incorrectly placed in Flight 592's cargo compartment.

Flight 592's Class D cargo compartment was not equipped with a means to detect the fire in the cargo compartment and annunciate it to the flight crew in time for them to take action that could have averted the accident.

The presence of oxidizers (chemical oxygen generators) in Flight 592's Class D cargo compartment could defeat the Class D method of controlling fires through oxygen starvation, allowing the fire to become uncontrolled.

Flight 592's Class D cargo compartment was not equipped with a fire suppression system, which may or may not be effective in the presence of oxidizers. However, such a system could potentially have slowed the growth of the fire to afford the flight crew additional time to land and evacuate the airplane.

The Flight 592 flight crew apparently did not don oxygen masks and smoke goggles at the first indication of an in-flight smoke/fire event, which could, in the presence of significant smoke quantities, result in flight crew incapacitation due to smoke inhalation.

Flight 592 was dispatched with an inoperative cabin-cockpit interphone, which could delay communication between the flight attendants and flight crew and could introduce smoke from the passenger cabin into the cockpit when flight attendants open the cockpit door to communicate with the flight crew.

Back to top

Fires in Class D cargo compartments could be effectively controlled through "oxygen starvation."

Fires in Class D cargo compartments would remain sufficiently small such that they would not endanger the airplane or occupants for the normal duration of the flight so that no means was required to detect the fire and annunciate it to the flight crew.

Hazardous materials regulations, training, and oversight by government agencies and industry would preclude loading of hazardous materials, such as oxygen generators, on airplanes, particularly those carrying passengers.

The flight crew would immediately don oxygen masks/smoke goggles when confronted with a potential in-flight smoke/fire event.

Maintenance personnel will adhere to all published procedures.

Back to top

Several events involving Class D cargo compartments and improper carriage of oxygen generators occurred prior to the Flight 592 accident. Some are identified below, and additional events were identified in the NTSB report on the Flight 592 accident.

August 19, 1980 - Saudi Arabian Airlines Cargo Fire: The Lockheed Model L-1011 series airplane was forced to return shortly after departure from Riyadh, Saudi Arabia, when an in-flight fire was detected in the airplane's Class D cargo compartment. Although the airplane successfully landed, the fire continued to spread throughout the cabin, killing all 301 occupants. Following the accident, the NTSB recommended that the FAA reevaluate the "Class D" certification of the Model L-1011 cargo compartment with a view toward either changing the classification to "C," requiring fire detection and extinguishing equipment, or changing the liner material to ensure containment of fires of the types likely to occur in the compartment.

See accident module

August 10, 1986 - American Trans Air Flight 131: The Model DC-10 series airplane was unloaded following a charter flight. Company maintenance personnel had placed damaged passenger seatbacks in the forward cargo hold which incorporated seatback-mounted chemical oxygen generators (although most generators are installed overhead, usually in passenger service units, some are installed in passenger seatbacks). A company mechanic examining the seatbacks encountered a loose oxygen generator, which he handled improperly by its oxygen hose. The generator activated, generating high temperatures and a high localized oxygen concentration, resulting in ignition of seat covers and eventually resulting in a fire that burned through the cabin floor.

February 3, 1988 - American Airlines Flight 132: A chemical reaction resulting from a hydrogen peroxide solution, in concentration prohibited for air transportation, which leaked and combined with the sodium orthosilicate-based mixture from an undeclared and improperly prepared container, resulted in an uncontrolled fire in the airplane's Class D cargo compartment which could have resulted in loss of the airplane. The flight crew was made aware of the presence of the fire when occupants in the passenger cabin smelled smoke. Fortunately, the airplane was close to landing, so the flight crew was able to quickly land and successfully evacuate the airplane. The NTSB recommended that the FAA to require fire/smoke detection systems and fire extinguishing systems for all Class D cargo compartments as the result of this event.

September 24, 1993 - Federal Express: A fire was discovered in a cargo container that was unloaded from a Federal Express Model 727 series airplane. Smoke was seen emitting from a corner of the cargo container and was attributed to a chemical oxygen generator in a passenger service unit that was being shipped. The packaging for the unit did not identify that it included hazardous material.

October 20, 1994 - Emery: Fire was observed in a box as a truck unloaded. The contents of the truck were destined for an Emery flight. The box contained 37 oxygen generators individually wrapped in bubble plastic. The fire started when one generator inadvertently activated, providing an ignition source. No safety caps were installed.

Back to top

As a direct result of the Flight 592 accident and its precursors, the Class D cargo compartment design methodology was abandoned, and the Class D classification was removed from multiple Part 25 regulations. Legislation was enacted to increase protection from possible inflight fires. All existing Class D cargo compartments were required to be upgraded to Class C or Class E compartments in accordance with 14 CFR 121.314. In addition, all existing cargo smoke or fire detection systems were required to be updated to meet the more stringent requirements of 14 CFR 25.858 which required detection to occur within one minute. A list of the pertinent regulatory changes is listed below:

Amendment 25-93, dated March 19, 1998, to14 CFR 25.855

• Paragraph (c) of 14 CFR 25.855 was modified to remove Class D cargo compartment classification

 Amendment 25-93, dated March 19, 1998, to14 CFR 25.857

• Paragraph (c)(2) of 14 CFR 25.857 was revised by minor wording changes
• Paragraph (d) of 14 CFR 25.857 was revised to remove the Class D cargo compartment requirements and added the wording (Reserved)

Amendment 25-93, dated March 19, 1998, to 14 CFR 25.858

• Revised to add "...baggage compartment..." to cargo compartment requirements
• Revised to add the words "smoke or fire detector provisions..."

Amendment 121-269, dated March 19, 1998, to 14 CFR 121.314

• Paragraph (a) of 14 CFR 121.314 was revised to add "(see Appendix L of this part)" that provided references to the FAR part 25 requirements for this paragraph
• Paragraph (c) of 14 CFR 121.314 was revised to require, after March 19, 2001, each Class D cargo compartment to meet Class C requirements, with other provisions for cargo-only airplanes with Class E cargo compartments
• Paragraph (d) of CFR 121.314 was revised to add a reporting requirement on the conversion status

Also as a direct result of ValuJet 592 and after years of research, development and testing, the Department of Transportation Pipeline and Hazardous Materials Safety Administration revised its Hazardous Materials Regulations (HMR) to require cylinders of compressed oxygen and other oxidizing gases and packages of chemical oxygen generators to be placed in an outer packaging that meets certain flame penetration and thermal resistance requirements when transported aboard an aircraft; revising the pressure relief device (PRD) setting limit on cylinders of compressed oxygen and other oxidizing gases transported aboard aircraft; limiting the types of cylinders authorized for transporting compressed oxygen aboard aircraft; and converting most of the provisions of an oxygen generator approval into requirements in the HMRs Docket No. RSPA-04-17664 (HM-224B), effective October 1, 2007, 72 FR 4442, January 31, 2007.

Back to top

No airworthiness directives were written as the result of the accident.  The requirement to modify existing U. S. airplanes was addressed under 14 CFR part 121 changes which mandated operators to upgrade existing Class D cargo compartments to Class C standards.

Back to top

Airplane Life Cycle:

• Operational
• Design / Manufacturing

Accident Threat Categories:

• Uncontrolled Fire / Smoke
• Cabin Safety / Hazardous Cargo

Groupings:

• N/A

Accident Common Themes:

• Organizational Lapses
• Human Error
• Flawed Assumptions

Back to top

Organizational Lapses

As discussed earlier, the lack of communications and lack of adherence to procedures created the opportunity for the unexpended oxygen generators to find themselves aboard Flight 592 without safety caps and despite the fact that ValuJet was not authorized for carriage of hazardous materials. The ValuJet work card utilized by the SabreTech mechanics did include a step to install safety caps on the removed, unexpended oxygen generators, but this never happened despite the work card item having been signed off as accomplished. The removed, improperly tagged generators were then placed in ValuJet's storage area with no communications regarding the hazardous nature of the material or the absence of safety caps. SabreTech had no formal procedure in place that required an individual leaving items in the shipping and receiving area to inform anyone in that area of what the items were, or that they were hazardous. Based at least partially on the improper handling and tagging of the oxygen generators by SabreTech mechanics, the SabreTech stock clerk did not prepare or package the generators properly, nor were hazardous materials labels attached that likely would have alerted ValuJet's ramp personnel to the hazardous contents of the shipment.

Human Error

Errors were evident across organizational boundaries; a large number of these errors were organizational in nature and can be loosely grouped as a lack of oversight. Two errors, however, if avoided, would likely have stopped the chain of events that led to the accident. SabreTech maintenance personnel neglected to install safety caps on the removed oxygen generators which allowed the inadvertent actuation of the generators and the resultant fire. Although this can be viewed as a human error, the investigators noted that the safety caps were not available at SabreTech, forcing the responsible personnel to improvise. Workers developed different "workarounds", attempting to comply with the intent of a maintenance step that they could not literally accomplish. Finally, shipping personnel, not realizing that the generators were, in fact, not expended, improperly packaged and presented for carriage the oxygen generators without hazardous material markings, which defeated ValuJet's "no fly" policy on hazardous material.

Flawed Assumptions

There were a number of flawed assumptions that were contributors to this accident. From a design/certification standpoint, it was assumed that a fire occurring in a Class D cargo compartment would remain sufficiently small due to oxygen starvation such that it would not endanger the airplane or occupants for the normal duration of the flight, and that as such, a means to detect and annunciate the fire to the flight crew was not needed. Despite a number of precursors indicating that this design could be defeated by certain cargo compositions, it took this accident to drive home the need for cargo compartment fire detection and suppression systems on passenger airplanes.

In concert with the Class D cargo compartment design was the assumption that current prohibitions and regulations against transporting oxygen generators and other hazardous material aboard passenger airplane would preclude an accident of this nature. Evidence showed that oxygen generators were not always being identified as hazardous materials and were making their way into passenger airplane cargo compartments.

Maintenance personnel made the assumption that cutting or taping the oxygen generator lanyards would provide adequate protection against inadvertent oxygen generator activation and would prevent generator activation.

Shipping/Receiving assumed that the oxygen generators were empty and packaged them as if they were not hazardous material. Actually, even an expended generator would be considered hazardous material because of the residual chemical byproducts produced by the generator in the course of generating oxygen.

Back to top

Saudi Arabian Airlines Model L-1011, Riyadh, Saudi Arabia - August 19, 1980

American Trans Air Flight 131, McDonnell Douglas Model DC-10, Chicago - August 10, 1986

American Airlines Flight 132, McDonnell Douglas Model DC-9-83, February 3, 1988

See accident module

Back to top

Technical Related Lessons:

Cargo compartments not readily accessible to the flight crew require adequate fire detection and suppression. (Threat Category: Uncontrolled Fire)

• At the time of the ValuJet accident, the primary means of controlling a fire in a Class D cargo compartment was to contain the fire, and to starve the fire of oxygen, making it unnecessary to equip the compartment with fire detection and suppression capability. This safety strategy proved to be inadequate in light of the ValuJet experience, and Class D compartments were mandated to be elevated to Class C in order to provide a detection/suppression capability. 
• Class E cargo compartments do rely on oxygen starvation as the method of fire suppression, similar to Class D cargo compartments, but with several important differences. Class E cargo compartments require a smoke or fire detection system, means to shut off the ventilating airflow to, or within the compartment, and a means to exclude hazardous quantities of smoke, flames, or noxious gases from the flight crew compartment. In addition, regulatory guidance denotes that some cargo airplanes have a recommended smoke procedure in the Airplane Flight Manual to raise the cabin pressure to 25,000 feet or more to limit the available oxygen supply until the airplane can descend to land. 

There are types of cargo that are sufficiently hazardous to preclude their shipment on an airplane unless properly packaged and identified. (Threat Category: Cabin Safety/Hazardous Cargo)

• Neither SabreTech, nor ValuJet exercised proper processes or oversight to prevent shipment of improperly packaged oxygen canisters on ValuJet aircraft. Shipment of oxygen canisters can pose a threat to the airplane that, if inadvertently activated, they have the capacity to overcome suppression capabilities at any level. This type of cargo poses such a high-level threat that it should not be carried on an airplane without special actions or protective packaging. 

Common Theme Related Lessons:

Airline maintenance/service, and the associated safety oversight, should be performed to the same acceptable level of safety, regardless of the service provider, or the organization providing the oversight. (Common Theme: Organizational Lapses)

• Neither ValuJet, nor their contractor, were providing adequate oversight of the safety processes and protections that should have prevented the loading and shipment of improperly dispositioned oxygen canisters on an airplane. ValuJet was not authorized to carry hazardous cargo, yet a breakdown in organizational safeguards resulted in unidentified hazardous cargo being placed on the accident airplane. The investigation concluded that neither ValuJet, or the service contractor, provided an adequate level of performance oversight, and unsafe practices were regularly performed.

Two discussions of the "normal", "organizational", or "system" accident are linked here:

Langewiesche "The lessons of Flight 592." Published in Atlantic Monthly

Stimpson "Operating Highly Complex and Hazardous Technological Systems Without Mistakes: The Wrong Lessons from Flight 592"

Some maintenance tasks, due to their importance to safety, should be performed by specially trained individuals, and be properly identified as such through clear work instructions (e.g., "Required Inspection Personnel"). (Common Theme: Organizational Lapses)

• The ValuJet workcard associated with the installation/removal of oxygen generators from the airplane required the installation of "shipping caps" on un-expended generators prior to removal from the airplane. The only shipping caps available at SabreTech were those shipped with the replacement generators. Those caps were required to stay on the new generators until the final mask drop check was completed, making them unavailable for placement on removed generators. As a result, maintenance personnel developed other means that they felt would render the removed generators "safe" in lieu of the work instructions. Further, inspectors assumed that installation of caps would be accomplished at a later time and signed the work instructions as complete. The lack of a part that was required as a link in the safety chain, and the acceptance of the "workaround" as equivalent to the work instruction requirements, indicates another organizational lapse that contributed to the accident.
• While the need for specifically trained personnel isn't definitive for this particular workcard, it points out the criticality that maintenance instructions can inherently carry, and stresses the need to verify, validate, and properly monitor the performance of maintenance tasks. If the expectation is that no deviation from a maintenance procedure is allowed, it should so state, and should require a higher level of scrutiny, precluding acceptance as complete until the adherence to instructions is verified.

Certain maintenance or servicing tasks may require specific materials, tools, or parts to be used. If the expectation is that these will be used without deviation, then it is important that the facility or station where this maintenance or servicing is being accomplished provide these items, and that they be readily available. (Common Theme: Organizational Lapses)

• While it is questionable whether the shipment of oxygen generators on an airplane was appropriate, one of the requirements for shipment via any method was the installation of specific shipping caps on the generators. While the work cards specified installation of these caps upon removal of unexpended oxygen generators from the airplane, the caps were not available at Sabre Tech. This resulted in attempts at securing the generators via other means that were less positive and may have contributed to the activation of one or more of the packed generators, and the initiation of the fire.

Safety strategies involving passive features (e.g., controlling oxygen in a Class D cargo compartment) are dependent on the performance of the feature when subjected to the specific threat, and threat environment the safety strategy is protecting against. (Common Theme: Flawed Assumptions)

• In the case of this accident, the fire was the source of oxygen, and therefore presented a situation that the passive features of the cargo compartment could not control. Even though in this case, the type, and intensity of the fire may have overwhelmed even a robust suppression system, this accident underscores the importance of properly assessing the threats and safety assumptions upon which safety is predicated.

Back to top