What warning label where? ValuJet Flight 592

Unless you spend a great deal of time in a chemistry lab or dabble in rocket propulsion, the concept of oxygen as a dangerous substance may not be immediately self-evident. Nor does the word “oxidizer” carry the same weight as, say, “explosive.”

Pressurized pure oxygen was responsible for the vicious rapidity of the flame propagation in the Apollo 1 launchpad fire. More recently, oxygen and the chemical reaction responsible for producing it killed a hundred and ten people and dug a crater in the bedrock of the Florida Everglades.

I was sixteen when ValuJet Flight 592 slammed into the swamp at over five hundred miles an hour. I remember hearing about it, and watching the pictures of the recovery effort on the news. They didn’t find many big pieces of anything, including people; a small amount of human tissue was strongly suspected of belonging to the first officer, but it wasn’t in any condition to provide proof. Eventually 68 of the 110 people aboard were identified. They’re still there, the victims of Flight 592. They’re in the mud, in the cracks in the bedrock, in the murky water.

ValuJet was one of the first low-cost airlines offering cheap fares with no frills, and its fleet was made up of aging McDonnell-Douglas DC-9 and MD-80 jets. It had a contract with several maintenance and repair facilities around the country to perform service and overhauls on its planes, three of which were qualified to provide heavy maintenance. One of these, located in Miami, was SabreTech.

The accident itself

On the afternoon of May 11, 1996, a Douglas DC-9-32, N904VJ, owned and operated by ValuJet Airlines, Inc. as flight 592, took off from Miami International Airport on a flight to William B. Hartsfield Atlanta International. Six minutes later, the crew requested an immediate return to Miami due to smoke in the cockpit and cabin. The interphone connecting the cabin and cockpit wasn’t working (one of many equipment failures plaguing ValuJet planes); contrary to regulations, the flight attendants had to open the door to communicate with the pilots, introducing smoke to the cockpit. Shouts in the background of “fire, fire, fire, fire” can be heard on the recording, coming from the cabin. Just before 2:14 PM, ten minutes after takeoff, the plane vanished from Miami radar.

When emergency personnel arrived at the scene they faced considerable challenges: the wreck site was a quarter-mile from the nearest road, located in a seven-foot-deep swamp in which visibility was approximately nil, and the plane had hit the ground with such force as to render it into lots of tiny little bits, surrounded by mud, sawgrass, and alligators. Nevertheless, through a very great deal of hard work on the part of a large number of searchers and the cooperation of various law enforcement agencies, enough fragments of wreckage were found, identified, and reassembled into a model of the accident aircraft to begin to offer some answers into the cause of the wreck.

Investigators knew that a fire had played some part in the disaster, although where it was located or what had caused it was still unknown. As they pieced together the shreds of the DC-9 fire damage began to appear, located in what had been the forward cargo bay of the plane. Wiring controlling the aircraft’s flight surfaces and engine thrust was burnt through, indicating that the crew had most likely lost control of the plane as the systems died. When the CVR and FDR were finally recovered, the data indicated that progressive control system failure following an initial anomaly had occurred, and this was corroborated by the discovery that the left-side floorboards had melted and collapsed, affecting the captain’s control cables.

Checking with SabreTech and ValuJet records, they found that the forward cargo bay on the accident flight had contained five boxes of "company materials" (COMAT) and a couple of landing-gear wheels, none of which theoretically should have started a fire; however, further investigation revealed that the contents of the COMAT boxes were listed as "Oxy Cannisters [sic] 'Empty'," at which point they began to realize that in all likelihood this had been a completely preventable tragedy.

Emergency oxygen on board commercial passenger airliners is provided not by pressurized oxygen tanks but by chemical oxygen generators. These are cylinders about the size of a tennis-ball can, containing a mixture of sodium chlorate, barium peroxide, and potassium perchlorate. If the cabin loses pressure the compartments holding these things will open, dropping those dinky plastic oxygen masks over the passengers’ heads; pulling on the masks tugs on a lanyard attached to the oxygen generator’s firing pin, setting off a little percussion cap. This produces enough energy to trigger the chemical reaction within the generator core whereby the sodium chlorate is reduced to sodium chloride and oxygen is given off in gas form; it’s a nice, elegant little reaction which does away with the need to carry dangerous pressurized tanks over passengers’ heads and allows the oxygen system to take up very little space.

However, this reaction is exothermic. Powerfully so. An activated oxygen generator is capable of reaching temperatures of five hundred degrees while it’s working; for this reason it is vitally important that when you are carrying these things around or storing them you put a safety cap over the firing pin, preventing them from being triggered by mistake. This would seem to be common sense.

The investigation into ValuJet’s and SabreTech’s shipping and labeling policies and history revealed that not only were the oxygen generators being carried in the accident aircraft’s forward cargo bay not empty or secured for transportation, they were also not appropriately marked, had not been identified as hazardous materials, and were in fact not recognized by maintenance personnel as dangerous. They had been stacked in the cardboard boxes without safety caps, covered with a layer of bubble wrap, and shoved into the cargo bay along with the spare wheels. Apparently these generators had been removed from ValuJet planes when they passed their expiration dates, then left sitting around minus safety caps for several weeks until personnel were told to clean up the storage rooms for an upcoming site visit/audit, whereupon they were packed into boxes–still sans safety caps, as apparently these were unavailable–and sat around some more until someone finally asked if he should send them to Atlanta and was told “okay, that sounds good to me.”

According to the stock clerk, he identified the generators as “empty canisters” because none of the mechanics had talked with him about what they were or what state they were in, and that he had just found the boxes sitting on the floor of the hold area one morning. He said he did not know what the items were. Nobody had bothered to read the ‘reason for removal’ tags on the generators.

Tests on similar oxygen generators in a mockup of the DC-9’s forward cargo bay demonstrated that not only was an activated generator in a cardboard box capable of starting a fire, within ten minutes of ignition the temperature on the ceiling of the cargo bay was reaching temperatures over 3,000 degrees F. Aluminum’s melting point is around 1,220 F, higher or lower depending on the alloy. There was no way the floor of the passenger compartment could withstand this kind of fire.

The forward cargo bay was supposedly fire-resistant due to its lack of ventilation, which would cause a standard fire to use up the available oxygen and burn out fairly quickly. However, not only did the oxygen generators reach ignition temperature, they also, well, generated oxygen, which fed the fire. Regulations didn’t require smoke/fire detection systems in cargo compartments of this type, nor any kind of fire suppression systems.

Going back to the battered black boxes, investigators found that at 2:10 pm, six minutes after takeoff and right before all the electrical systems went to hell, an unidentified sound was recorded on the CVR. According to the FDR, just before the sound, the airplane was climbing through 10,634 feet at 260 knots indicated airspeed. Simultaneous with the noise on the CVR, the FDR recorded a 33-knot decrease in indicated airspeed and a pressure altitude drop of 817 feet. The FDR airspeed and altitude data returned to normal values within 4 seconds. Altitude and speed data recorded on the FDR are based on readings from the static port on the left-hand side of the DC-9 (a small port open to the atmosphere, which registers the pressure of the outside air on the plane as it moves).

An increase of 69 pounds per square foot (psf) sensed by a static pressure sensor on the airplane would result in an 817-foot decrease in altitude (as recorded by the FDR). Further, an increase of 69 psf in static pressure would result in a decrease in airspeed of about 40 knots, which is consistent with a curve fit of the airspeed decrease recorded on the FDR. The brief anomaly in the readings is, therefore, consistent with a momentary jump in the static system pressure. What would cause this sudden pressure increase?

How about a bursting landing-gear tire in the forward cargo bay?

Tests showed that in fact one of the tires recovered from the crash site which was torn open could have produced this level of pressure increase as it blew during the fire. By calculating the length of time it took for the fire to heat up the tire to bursting point in a recreation of the cargo bay, investigators could work out roughly when the fire began–possibly as late as during the airplane’s takeoff roll. Almost immediately after the tire blew, the wiring bundles running under the cabin floor burned through and the crew began to lose control of the plane, as the fire ate its way into the passenger compartment.

Imagine it. You’re in a plane that was built the year Neil Armstrong walked on the moon, bound for Atlanta on a sunny afternoon in May. You’ve been delayed in departure for over an hour and you are probably overjoyed when the damn thing takes off; as usual, you’re looking out the window at the runway flashing by and wondering if the plane is going to make it into the air at all–and, as usual, it does, and the vast hand of inertia presses your butt into your seat as the captain climbs through two thousand feet and begins to bank left. If you’re on the left side of the cabin you can look down and see Miami lazily baking in the afternoon sun.

Then you smell something funny. Something burning. It’s coming from the front of the cabin, and it’s getting worse. People are starting to sound panicky up there, and now there’s flames, visible flames dancing on the floor, and you are in an airplane that is on fire. Perhaps the floor’s gone soft and is beginning to sag, too hot to touch; the carpet’s melting. Flames lick at the seats, and people have begun to scream; and now there’s smoke, black smoke rolling along the ceiling. You can’t get out: there’s nowhere to go. The flight attendants try to alert the cockpit, but the interphone isn’t working. They bang on the door and finally open it–which you absolutely must not do in a case of smoke in the cabin. The oxygen masks have not dropped. By now the crew are losing control and have radioed for an emergency return to Miami, and people are burning alive as the fire spreads and the temperature in the cabin soars. Without control over the engines, flaps, slats, ailerons, or rudder, Flight 592 is helplessly plummeting toward the ground.

Probably the passengers and crew were unconscious by the time of impact, overcome by heat and toxic fumes. Probably none of them were able to see the ground rushing up at them, or feel themselves blown apart by the force of the crash. Had any number of people done their jobs right, it wouldn’t have happened at all; had the SabreTech mechanics properly labeled the generators when they removed them from the aircraft, had they activated them and safely expended the cores as the manufacturer’s and other airlines’ procedures required before shipping them as hazardous materials, this would not have happened. ValuJet and SabreTech had received several warnings as a result of negligent or insufficient safety oversight, and despite the obvious necessity had not made changes to their operating procedures that would have prevented the accident from occurring.

ValuJet never recovered from the crash. In 1997 it merged with low-cost carrier AirTran Airways, and discarded the ValuJet name entirely. Today AirTran’s fleet is among the youngest in the field, with an average age of less than 4 years; in July 09 it will be serving 62 locations in the States. Since ValuJet bought AirTran and took on the AirTran name, the airline has not experienced any fatal accidents and is generally considered among the safest commercial airlines in the country. Lessons learned from the crash wrote new rules regarding oxygen generator disposal, COMAT and hazardous material transportation, compliance inspections, fire detection and suppression systems, and cargo bay design. Flight 592 could have been prevented; the changes made in the industry as a result of the tragedy will hopefully prevent anything like it from happening again.

Information in this post is taken from the official NTSB report.