Summary

Following the grounding of large numbers of piston-engine aircraft across eastern Australia in early January 2000 as a consequence of using contaminated aviation gasoline (Avgas), the Australian Transport Safety Bureau initiated a major safety deficiency investigation into the circumstances of the contamination. Guidance for the investigation was subsequently provided in the form of Terms of Reference, which stated that the investigation was being widened to examine the following:

1. the existing standards for aviation gasoline;
2. the details of risk analyses undertaken prior to and during the production of aviation gasoline at Mobil's Altona refinery;
3. the adequacy of the production control, distribution control, and recording processes used by Mobil and other refiners;
4. the current arrangements for the oversight of aviation gasoline quality, including the procedures followed by Mobil and other refiners to disclose information with potential aviation safety implications; and
5. any other matter of material relevance to the above.

The ATSB investigation team identified a number of factors related to the manufacture, standards and oversight of Avgas that contributed to the contamination, which are outlined below. The relevance of these factors was also considered in relation to the manufacture of other aviation fuels.

The fitness for purpose of aviation fuels is safety critical, however the systems of manufacture, distribution, supply and use in aircraft were not supported by all the defences that are normally incorporated into other safety critical aviation systems. Despite the safety risk, there were no significant redundant systems to enhance the defences for aviation fuel quality.

The deficiencies that have been identified in relation to the supply of Avgas that was not fit for purpose also have the potential to affect the fitness for purpose of other aviation fuels, like Jet A-1. Aircraft that use Avgas are normally small compared with civilian airliners which normally use aviation turbine fuel such as Jet A-1. If a similar contamination of Jet A-1 had led to similar deficiencies in engine reliability, then the potential for a major accident with large loss of life would have been significant.

A temporary variation in the production process in Mobil's Altona refinery in late 1999 led to an increased dosage of an anti-corrosion chemical being injected into the Avgas process stream, which led to a contamination of Avgas. The anti-corrosion chemical, Neutramine D, contained an active ingredient called ethylene diamine. Ethylene diamine was not completely extracted during Avgas manufacture. Excess ethylene diamine from the injected Neutramine D was expected to be extracted from the process stream in water taken from the deisobutaniser tower during manufacture, however the extraction mechanism was not fully effective. The concentration of ethylene diamine in the final product was small and none of the many quality assurance and specification tests used during manufacture and distribution identified the presence of the ethylene diamine in the final product.

The refiner's knowledge of the process within the alkylation unit was not complete. The manufacturing process for Avgas is very complex, and there are many variables and factors that can affect the process. A lot of information was available to the operating team at the refinery, however not all the activities were fully recorded and available for future reference.

Mobil did not define or clearly document procedures for managing process deviations outside some of the limits for normal operations within the alkylation unit. The refiner aimed to operate the plant within predefined parameters, to effectively control the process and maximise its efficiency. The parameter deviations at which the alkylation unit would be considered to be outside normal operations were not clearly defined in all cases, nor were the initial considerations or actions to be taken in such circumstances clearly laid out.

The processes for monitoring the reliability of plant equipment did not provide the best possible indication of reliability. A number of systems were used for predicting and managing the reliability of various components in the alkylation unit. Some of these systems could have been used more effectively to predict reliability. Systems to assess the adequacy of the reliability prediction systems were also not completely effective.

Management of change at the refinery did not consider the effectiveness of the extraction mechanism for ethylene diamine from the Avgas process stream. Changes within the refinery that might have indicated a variation in the properties of the process stream, and therefore might have influenced the efficiency of the extraction mechanism for ethylene diamine included:

• a decrease in the efficiency of the caustic wash system due to problems with caustic circulation pumps and a system leak; and
• concentrations of sulfates and pH in water from the deisobutaniser tower overheads that were outside their normal ranges, indicating increased acid and alkyl sulfate carryover from the alkylation reactor.

These changes were not considered in the context of their potential to affect the ability of the system to ensure that any ethylene diamine that was injected into the process stream would be effectively extracted.

Mobil did not have an effective process in place to identify the adverse consequences of the cumulative effects of multiple planned and unplanned process changes on the degree of control in the alkylation unit. A number of planned and unplanned changes were taking place in the alkylation unit at the time of the contamination event. Any one of the changes could be effectively managed, however the effect of one change on another change would decrease the ability to manage the potential cumulative effect of all the changes, so that the degree of knowledge, and ability to control the unit to the same level of accuracy would be degraded.

The refiner's procedures were not effective in ensuring that decisions were fully implemented, or that progress with recommendations was regularly reported and reviewed. Following a previous contamination event, a number of recommendations and improvement actions were identified. They were not all acted on and followed through to completion.

The refiner's risk management process considered an overly narrow predefined set of undesirable outcomes. The process did not allow Mobil to identify all the undesirable outcomes (such as hazards to aviation safety) that could prevent them from producing products that were fit for purpose and from achieving their broader organisational objectives.

The refiner had not satisfied itself that all compounds that could be in the process stream during manufacture, (with particular attention to process chemicals that were introduced during the manufacturing process), would not adversely affect the systems in which the final product was intended to be used. The manufacturing process was designed to ensure that all chemicals that were in the process stream that were not desired in the end product would be extracted from the process stream during manufacture. Despite this, process deviations may have reduced the effectiveness of these extraction mechanisms. The refiner did not have procedures in place to rigorously consider the likely consequences of product contamination by any of the chemicals that were introduced into the process stream during manufacture, nor of any of the likely products of reaction of those chemicals.

The refiner did not conduct any specific practical validation of its assumption that ethylene diamine would be extracted during manufacture following the introduction of Neutramine D injection in 1991. Neutramine D was first used in the alkylation unit before the introduction of a formal Management of Change process at the refinery. At the time of the introduction, a number of concerns were addressed, however no practical validation was undertaken to assess the effectiveness of the extraction mechanism to ensure that ethylene diamine was removed from the process stream.

The use of Neutramine D to help manage corrosion in the deisobutaniser tower had been contracted out. The process of contracting out the corrosion control at the Altona refinery alkylation unit was not managed to ensure that the fulfillment of the contractor's objectives would not adversely affect Mobil's broader objectives. The corrosion control contractor was required to control the rate of Neutramine D injection as a result of pH indications taken from water samples from the deisobutaniser distillation tower overheads. This requirement did not address the potential for the objectives of the corrosion control contractor (to meet these requirements) to affect the refiner's broader product quality objective of ensuring that the product was fit for purpose.

The refiner's manufacturing process was accredited to ISO 9002, and has been subsequently reaccredited. The refiner's use of its accredited quality assurance system was not effective in ensuring that Avgas was supplied that was fit for purpose.

Following up a recommendation arising from a previous contamination event could have allowed Mobil the opportunity to identify ethylene diamine contamination. The refinery had experienced a previous contamination event from microbiological contamination. Dead bacteria had been transferred along the delivery path and clogged filters. It was thought that the bacteria had been killed by the unusually alkaline water in the bottom of the Avgas storage tank. While the reason for the alkalinity of that water was never ascertained, ethylene diamine dissolved in water will markedly increase its alkalinity.

A clear understanding did not exist among the manufacturers, regulators and users of aviation fuel that compliance with a fuel standard, by itself, would not provide assurance that fuel would be fit for purpose. When the quality of the supplied Avgas was first suspected, it was immediately re-tested to ensure that it met its specification. Avgas is normally sold on the condition that it meets its specification. The fuel that contaminated the aircraft met its specification as defined by the tests that were used to ensure that the Avgas does meet its specification. Fuel is normally fully tested only once during manufacture and distribution to ensure that it meets its specification. A number of other issues have to be addressed beyond the specification to ensure that Avgas is, and remains, fit for purpose.

Despite aviation fuels being a global commodity, no single global standard existed or was used for each main grade of aviation fuel. Manufacturers of Avgas normally use their own specification for their product that meets or slightly exceeds the major international standards. Each manufacturer's specification is normally slightly different, so the actual standard for this global commodity is not consistent.

It was impossible to comply with the literal interpretation of the major international standards for aviation gasoline because they did not specify maximum permissible concentrations of undesired compounds, either singly or collectively. The major international standards for Avgas implied a zero permissible concentration of undesired compounds in the product. It is not possible to measure zero concentrations, only to measure to the lowest measurable limit (and this is normally impractical and expensive in a production environment). It was therefore not possible to comply exactly with the specifications. If the specifications allowed a permissible small concentration of classes of undesired compounds, then this would have allowed the specification to be met exactly. However, this would have required an understanding of the potential impact of such compounds both by themselves and in combination with other compounds that are, or could be, in the fuel.

Accepted definitions did not exist for all the physical and chemical properties of aviation fuels that were required to ensure that aviation fuels were fit for purpose. A number of properties of Avgas are essential for fitness for purpose which are not defined in the international standards. These properties are known by people and organisations who are responsible for ensuring that they exist, however there are no defined levels for these properties for Avgas. This meant that Avgas could have been supplied that met the international standards and yet the undefined essential physical and chemical properties may have been addressed to a varying extent, or not at all.

Despite the criticality to safety of aviation fuel quality, no regulatory requirements for fuel quality testing existed beyond the requirement to visually assess a sample of fuel drained from an aircraft before the first flight of a day, or after refuelling. Australian law that applied to the operation of civil aircraft did not require any testing of fuel quality, beyond the need for a sample to be drained from the bottom of aircraft fuel tanks before the first flight of a day, and after refuelling. The sample was to be examined to confirm the correct clarity, colour and odour, and tested for water, either with water detecting equipment, or visually. These tests would not have identified the presence of ethylene diamine in a sample of the contaminated fuel.

There was a diffusion of responsibility among the various regulatory bodies that had the potential to oversee aviation fuel manufacture, quality assurance, supply and use. Aviation fuel was manufactured at a workplace which was regulated by relevant occupational health and safety organisations. It was sold in commercial transactions that were covered by the obligations of state and federal trade practices legislation. It was used in aircraft that were regulated by the civil aviation regulator. It was possible for each of these responsibilities to have an influence on aviation fuel during its life from manufacture to consumption, but there was no clear delineation of the roles and responsibilities of the respective regulatory organisations in relation to the quality of aviation fuel.

There was no indication to show that the then Civil Aviation Authority considered the effect on safety when it made a safety related decision to discontinue any oversight of aviation fuel quality. When the Civil Aviation Authority discontinued its oversight of aviation fuel manufacture and distribution in 1991, its reasoning was primarily that the expertise in these areas rested with the manufacturing organisations, and they were therefore considered to be the best people to ensure that the quality of fuel was maintained. A lack of expertise within the Authority was not a relevant justification for a change to regulatory oversight which could affect a safety critical aspect of aviation.

No mechanism existed to ensure that the Civil Aviation Safety Authority was made aware in a timely manner of information relating to the management of situations related to fuel quality that could affect the safety of flight. Following the discontinuation of any form of regulatory oversight by the then Civil Aviation Authority, no formal lines of communication existed between the Authority and manufacturers or distributors of aviation fuel, and hence the initial notification of a fuel quality problem was likely to occur through informal channels, and the timeliness of formal notification was at the behest of the manufacturer or distributor.

The Australian Transport Safety Bureau identified a number of deficiencies in the development of manufacturing processes and the management of those processes within the refinery, the relevance of standards that were used in the manufacture of Avgas, and the oversight of aviation fuels.

These safety deficiencies formed the basis for the development of safety recommendations issued by the Bureau. The recommendations are designed to reinforce the defences that are, or could be, put in place to reduce the probability that the safety of civil aviation could be compromised in the future.

The recommendations fall into three main groupings:

• The first group relate primarily to the management of the processes for the manufacture of Avgas. They are addressed to the refiner, and may be considered as relevant to other manufacturers of aviation fuels, as well as managers of complex, safety critical systems.
• The second group relate to the development and use of international standards for Avgas, including their use in ensuring the fitness for purpose of Avgas used in aircraft.
• The third group relate to the use of regulatory oversight as an effective defence in ensuring that fuel quality as a safety critical aviation system is, and remains, consistently fit for purpose, and the need to eliminate any diffusion of responsibility among regulators who have the potential to regulate aviation fuel quality.

The full text of the recommendations can be found in section 5 of the complete report.