Summary
Following the grounding of large numbers of piston-engine aircraft across eastern
Australia in early January 2000 as a consequence of using contaminated aviation
gasoline (Avgas), the Australian Transport Safety Bureau initiated a major safety
deficiency investigation into the circumstances of the contamination. Guidance
for the investigation was subsequently provided in the form of Terms of Reference,
which stated that the investigation was being widened to examine the following:
- the existing standards for aviation gasoline;
- the details of risk analyses undertaken prior to and during the production
of aviation gasoline at Mobils Altona refinery;
- the adequacy of the production control, distribution control, and recording
processes used by Mobil and other refiners;
- the current arrangements for the oversight of aviation gasoline quality,
including the procedures followed by Mobil and other refiners to disclose
information with potential aviation safety implications; and
- any other matter of material relevance to the above.
The ATSB investigation team identified a number of factors related to the manufacture,
standards and oversight of Avgas that contributed to the contamination, which
are outlined below. The relevance of these factors was also considered in relation
to the manufacture of other aviation fuels.
The fitness for purpose of aviation fuels is safety critical, however the systems
of manufacture, distribution, supply and use in aircraft were not supported
by all the defences that are normally incorporated into other safety critical
aviation systems. Despite the safety risk, there were no significant redundant
systems to enhance the defences for aviation fuel quality.
The deficiencies that have been identified in relation to the supply of Avgas
that was not fit for purpose also have the potential to affect the fitness for
purpose of other aviation fuels, like Jet A-1. Aircraft that use Avgas are normally
small compared with civilian airliners which normally use aviation turbine fuel
such as Jet A-1. If a similar contamination of Jet A-1 had led to similar deficiencies
in engine reliability, then the potential for a major accident with large loss
of life would have been significant.
A temporary variation in the production process in Mobils Altona refinery
in late 1999 led to an increased dosage of an anti-corrosion chemical being
injected into the Avgas process stream, which led to a contamination of Avgas.
The anti-corrosion chemical, Neutramine D, contained an active ingredient called
ethylene diamine. Ethylene diamine was not completely extracted during Avgas
manufacture. Excess ethylene diamine from the injected Neutramine D was expected
to be extracted from the process stream in water taken from the deisobutaniser
tower during manufacture, however the extraction mechanism was not fully effective.
The concentration of ethylene diamine in the final product was small and none
of the many quality assurance and specification tests used during manufacture
and distribution identified the presence of the ethylene diamine in the final
product.
The refiners knowledge of the process within the alkylation unit was not complete.
The manufacturing process for Avgas is very complex, and there are many variables
and factors that can affect the process. A lot of information was available
to the operating team at the refinery, however not all the activities were fully
recorded and available for future reference.
Mobil did not define or clearly document procedures for managing process deviations
outside some of the limits for normal operations within the alkylation unit.
The refiner aimed to operate the plant within predefined parameters, to effectively
control the process and maximise its efficiency. The parameter deviations at
which the alkylation unit would be considered to be outside normal operations
were not clearly defined in all cases, nor were the initial considerations or
actions to be taken in such circumstances clearly laid out.
The processes for monitoring the reliability of plant equipment did not provide
the best possible indication of reliability. A number of systems were used for
predicting and managing the reliability of various components in the alkylation
unit. Some of these systems could have been used more effectively to predict
reliability. Systems to assess the adequacy of the reliability prediction systems
were also not completely effective.
Management of change at the refinery did not consider the effectiveness of
the extraction mechanism for ethylene diamine from the Avgas process stream.
Changes within the refinery that might have indicated a variation in the properties
of the process stream, and therefore might have influenced the efficiency of
the extraction mechanism for ethylene diamine included:
- a decrease in the efficiency of the caustic wash system due to problems
with caustic circulation pumps and a system leak; and
- concentrations of sulfates and pH in water from the deisobutaniser tower
overheads that were outside their normal ranges, indicating increased acid
and alkyl sulfate carryover from the alkylation reactor.
These changes were not considered in the context of their potential to affect
the ability of the system to ensure that any ethylene diamine that was injected
into the process stream would be effectively extracted.
Mobil did not have an effective process in place to identify the adverse consequences
of the cumulative effects of multiple planned and unplanned process changes
on the degree of control in the alkylation unit. A number of planned and unplanned
changes were taking place in the alkylation unit at the time of the contamination
event. Any one of the changes could be effectively managed, however the effect
of one change on another change would decrease the ability to manage the potential
cumulative effect of all the changes, so that the degree of knowledge, and ability
to control the unit to the same level of accuracy would be degraded.
The refiners procedures were not effective in ensuring that decisions were
fully implemented, or that progress with recommendations was regularly reported
and reviewed. Following a previous contamination event, a number of recommendations
and improvement actions were identified. They were not all acted on and followed
through to completion.
The refiners risk management process considered an overly narrow predefined
set of undesirable outcomes. The process did not allow Mobil to identify all
the undesirable outcomes (such as hazards to aviation safety) that could prevent
them from producing products that were fit for purpose and from achieving their
broader organisational objectives.
The refiner had not satisfied itself that all compounds that could be in the
process stream during manufacture, (with particular attention to process chemicals
that were introduced during the manufacturing process), would not adversely
affect the systems in which the final product was intended to be used. The manufacturing
process was designed to ensure that all chemicals that were in the process stream
that were not desired in the end product would be extracted from the process
stream during manufacture. Despite this, process deviations may have reduced
the effectiveness of these extraction mechanisms. The refiner did not have procedures
in place to rigorously consider the likely consequences of product contamination
by any of the chemicals that were introduced into the process stream during
manufacture, nor of any of the likely products of reaction of those chemicals.
The refiner did not conduct any specific practical validation of its assumption
that ethylene diamine would be extracted during manufacture following the introduction
of Neutramine D injection in 1991. Neutramine D was first used in the alkylation
unit before the introduction of a formal Management of Change process
at the refinery. At the time of the introduction, a number of concerns were
addressed, however no practical validation was undertaken to assess the effectiveness
of the extraction mechanism to ensure that ethylene diamine was removed from
the process stream.
The use of Neutramine D to help manage corrosion in the deisobutaniser tower
had been contracted out. The process of contracting out the corrosion control
at the Altona refinery alkylation unit was not managed to ensure that the fulfillment
of the contractors objectives would not adversely affect Mobils broader objectives.
The corrosion control contractor was required to control the rate of Neutramine
D injection as a result of pH indications taken from water samples from the
deisobutaniser distillation tower overheads. This requirement did not address
the potential for the objectives of the corrosion control contractor (to meet
these requirements) to affect the refiners broader product quality objective
of ensuring that the product was fit for purpose.
The refiners manufacturing process was accredited to ISO 9002, and has been
subsequently reaccredited. The refiners use of its accredited quality assurance
system was not effective in ensuring that Avgas was supplied that was fit for
purpose.
Following up a recommendation arising from a previous contamination event could
have allowed Mobil the opportunity to identify ethylene diamine contamination.
The refinery had experienced a previous contamination event from microbiological
contamination. Dead bacteria had been transferred along the delivery path and
clogged filters. It was thought that the bacteria had been killed by the unusually
alkaline water in the bottom of the Avgas storage tank. While the reason for
the alkalinity of that water was never ascertained, ethylene diamine dissolved
in water will markedly increase its alkalinity.
A clear understanding did not exist among the manufacturers, regulators and
users of aviation fuel that compliance with a fuel standard, by itself, would
not provide assurance that fuel would be fit for purpose. When the quality of
the supplied Avgas was first suspected, it was immediately re-tested to ensure
that it met its specification. Avgas is normally sold on the condition that
it meets its specification. The fuel that contaminated the aircraft met its
specification as defined by the tests that were used to ensure that the Avgas
does meet its specification. Fuel is normally fully tested only once during
manufacture and distribution to ensure that it meets its specification. A number
of other issues have to be addressed beyond the specification to ensure that
Avgas is, and remains, fit for purpose.
Despite aviation fuels being a global commodity, no single global standard
existed or was used for each main grade of aviation fuel. Manufacturers of Avgas
normally use their own specification for their product that meets or slightly
exceeds the major international standards. Each manufacturers specification
is normally slightly different, so the actual standard for this global commodity
is not consistent.
It was impossible to comply with the literal interpretation of the major international
standards for aviation gasoline because they did not specify maximum permissible
concentrations of undesired compounds, either singly or collectively. The major
international standards for Avgas implied a zero permissible concentration of
undesired compounds in the product. It is not possible to measure zero concentrations,
only to measure to the lowest measurable limit (and this is normally impractical
and expensive in a production environment). It was therefore not possible to
comply exactly with the specifications. If the specifications allowed a permissible
small concentration of classes of undesired compounds, then this would have
allowed the specification to be met exactly. However, this would have required
an understanding of the potential impact of such compounds both by themselves
and in combination with other compounds that are, or could be, in the fuel.
Accepted definitions did not exist for all the physical and chemical properties
of aviation fuels that were required to ensure that aviation fuels were fit
for purpose. A number of properties of Avgas are essential for fitness for purpose
which are not defined in the international standards. These properties are known
by people and organisations who are responsible for ensuring that they exist,
however there are no defined levels for these properties for Avgas. This meant
that Avgas could have been supplied that met the international standards and
yet the undefined essential physical and chemical properties may have been addressed
to a varying extent, or not at all.
Despite the criticality to safety of aviation fuel quality, no regulatory requirements
for fuel quality testing existed beyond the requirement to visually assess a
sample of fuel drained from an aircraft before the first flight of a day, or
after refuelling. Australian law that applied to the operation of civil aircraft
did not require any testing of fuel quality, beyond the need for a sample to
be drained from the bottom of aircraft fuel tanks before the first flight of
a day, and after refuelling. The sample was to be examined to confirm the correct
clarity, colour and odour, and tested for water, either with water detecting
equipment, or visually. These tests would not have identified the presence of
ethylene diamine in a sample of the contaminated fuel.
There was a diffusion of responsibility among the various regulatory bodies
that had the potential to oversee aviation fuel manufacture, quality assurance,
supply and use. Aviation fuel was manufactured at a workplace which was regulated
by relevant occupational health and safety organisations. It was sold in commercial
transactions that were covered by the obligations of state and federal trade
practices legislation. It was used in aircraft that were regulated by the civil
aviation regulator. It was possible for each of these responsibilities to have
an influence on aviation fuel during its life from manufacture to consumption,
but there was no clear delineation of the roles and responsibilities of the
respective regulatory organisations in relation to the quality of aviation fuel.
There was no indication to show that the then Civil Aviation Authority considered
the effect on safety when it made a safety related decision to discontinue any
oversight of aviation fuel quality. When the Civil Aviation Authority discontinued
its oversight of aviation fuel manufacture and distribution in 1991, its reasoning
was primarily that the expertise in these areas rested with the manufacturing
organisations, and they were therefore considered to be the best people to ensure
that the quality of fuel was maintained. A lack of expertise within the Authority
was not a relevant justification for a change to regulatory oversight which
could affect a safety critical aspect of aviation.
No mechanism existed to ensure that the Civil Aviation Safety Authority was
made aware in a timely manner of information relating to the management of situations
related to fuel quality that could affect the safety of flight. Following the
discontinuation of any form of regulatory oversight by the then Civil Aviation
Authority, no formal lines of communication existed between the Authority and
manufacturers or distributors of aviation fuel, and hence the initial notification
of a fuel quality problem was likely to occur through informal channels, and
the timeliness of formal notification was at the behest of the manufacturer
or distributor.
The Australian Transport Safety Bureau identified a number of deficiencies
in the development of manufacturing processes and the management of those processes
within the refinery, the relevance of standards that were used in the manufacture
of Avgas, and the oversight of aviation fuels.
These safety deficiencies formed the basis for the development of safety recommendations
issued by the Bureau. The recommendations are designed to reinforce the defences
that are, or could be, put in place to reduce the probability that the safety
of civil aviation could be compromised in the future.
The recommendations fall into three main groupings:
- The first group relate primarily to the management of the processes for
the manufacture of Avgas. They are addressed to the refiner, and may be considered
as relevant to other manufacturers of aviation fuels, as well as managers
of complex, safety critical systems.
- The second group relate to the development and use of international standards
for Avgas, including their use in ensuring the fitness for purpose of Avgas
used in aircraft.
- The third group relate to the use of regulatory oversight as an effective
defence in ensuring that fuel quality as a safety critical aviation system
is, and remains, consistently fit for purpose, and the need to eliminate any
diffusion of responsibility among regulators who have the potential to regulate
aviation fuel quality.
The full text of the recommendations can be found in section 5 of the complete
report.
Download Complete Document: sir200103_001 [ PDF: 654Kb]
Type: Research and Analysis Report
Publication Date: 14/03/01
ISBN: 0 642 27470 3
|
