On 30 October 2001, the University of Queensland Department of Mechanical Engineering (UQ), launched an experimental supersonic-combustion ram jet (scramjet) payload via a two-stage solid-fuel rocket that was provided by Astrotech Space Operations Inc (Astrotech). The rocket was launched from the Woomera Prohibited Area in northern South Australia, that was operated by the Department of Defence (DoD). The planned flight was to validate data obtained in the hypersonic wind tunnel at the UQ facilities.

The launch occurred at 1301 Australian Central Summer Time and according to observers and video evidence, the first stage booster appeared to operate successfully, although UQ personnel noted an anomaly in the received telemetry data. After the initial coast stage, during which time the first stage separated, the second stage ignited and observers reported seeing the rocket and the resultant exhaust trails appearing to curl in a 'cork screw' fashion. That continued with the stability of the rocket appearing to deteriorate until it was out of sight.

The first stage (Terrier) was recovered from the intended impact area shortly after the flight, while remnants of the first stage fixed fins were recovered north east of the flight path and between the first stage impact area and the launch pad approximately 12 weeks after the launch. The separate location of the fins indicated that the fins separated from the vehicle during the first stage flight.

The second stage (Orion) with fixed fins and payload was recovered about 16 weeks after the launch from an area about 28 km east of the Stuart Highway and about 100 km north west from the launch site rather than the 373 km nominal aiming point. The highway had not been closed to traffic, nor was it required to be.

After the flight, the UQ team reported that while examining their telemetry data they noted an anomaly in the accelerometer and magnetometer data at approximately 2.8 seconds after first stage ignition. UQ also noted that the vehicle had not achieved the spin rate (4-6Hz) that was intended. However, the UQ team suggested that the low spin rate was more likely the result of some other event, perhaps the loss of one or more fins, rather than contributing to the accident. Additionally, a number of personnel who viewed the post-flight video reported seeing what appeared to be objects falling from the vehicle during the first stage burn. However, the Optical Coordinator from the launch team and Australian Transport Safety Bureau (ATSB) investigators considered that the video images lacked sufficient resolution to determine what occurred at those times.

ATSB specialist examination of the first stage indicated that the fixed fin support structure had broken up during the flight. Examination of the fracture surfaces indicated overload through the fixed fin spindle (journal) sockets. Larger Nike fins had been fitted by Astrotech rather than the smaller standard Terrier fins. This was to achieve the required stability and ensure a stable platform during the scramjet experiment. No pre-existing defects were found within the physical structure of the fin support. Some of the fin journal sockets showed evidence of excessive angular bending forces, suggesting possible movement or rotation of the fins during flight. A considerable proportion of the first stage fixed fin skin and internal honeycomb material had not been recovered at the time the investigation was carried out. Of the material that was recovered, most of the damage and deformation suggested both aerodynamic and ground impact forces.

The Nike fixed fin angle of incidence was adjusted using trailing edge adjustment lugs. Marks and damage around the fixed fin adjustment lug mounting points indicated in-flight movement and possible insecurity of the fin adjustment lugs. Crushing damage of the fin rib sections beneath the lug mounting set-screws was possibly pre-flight damage which may have contributed to in-flight movement. It was also noted that the Nike fins were not designed for securing in the location used and contained no reinforcement or other strengthening features in this area. The Nike fins were designed to be secured on the leading side of the fin base, whereas the original Terrier fins were designed to be secured on the trailing side of the fin base.

ATSB specialist examination of the payload found no evidence to suggest that the payload or associated components had contributed to the flight anomaly, however the level of impact damage limited the examination.

During launch preparation, sandbags were placed around the base of the launcher. The Astrotech "Operation and Inspection Log for the Assembly of the Terrier-Orion Suborbital Launch vehicle system" called for grout to be placed at the base of the launcher. However, grout was not available, thus sandbags were used to protect the base of the launcher. UQ suggested that it was possible that a sandbag or a rock in a sandbag could have damaged a fin during the initial launch phase. That would have required a sandbag or rock to have been deflected off the infrastructure and impact a fin. Video footage and still images viewed by the ATSB Specialists and Astrotech, indicated that a number of the sandbags were ejected and/or disrupted during the ignition and launch. However, it was not possible to determine if a rock had impacted a fin during the launch sequence.

The examination could not conclusively determine what caused or allowed the first stage Nike fixed fins to move during the flight. However, based on the available evidence, it is likely that the first stage Nike fins either sustained damage from aerodynamic overload due to their movement during the flight or the fin support structure was unable to support the increased aerodynamic load of the larger Nike fins. It is also possible that the sandbags or rocks ejected during the launch damaged the first stage fixed fins. As a result, at separation, the second stage would have been in an unstable flight attitude and possibly not able to recover stabilised flight.

Because the Space Activities Act and Space Activities Regulations did not provide for a launch licensing instrument with a fee structure appropriate to the resources of educational/scientific organisations, UQ was granted an exemption certificate by the then Minister following a recommendation from the Australian regulator, the Space Licensing and Safety Office (SLASO). As part of UQ's application for an exemption certificate, it was required to furnish a risk hazard analysis of the project based on statutory methodology and informal guidance provided by SLASO.

The investigation determined that although the risk analysis conducted by UQ allowed for failure of the first stage and non ignition of the second stage, insufficient allowance was made for the rocket vehicle malfunctioning and going off course. During the investigation, UQ indicated that as part of its hazard identification during the risk hazard analysis process, it had not specifically considered the possibility of the rocket impacting near the Stuart Highway. The second stage and payload impacted about 28 kilometres east of the highway.

Although SLASO had expressed reservations in an internal document, prior to the launch, regarding the risk hazard analysis submitted by UQ, it assessed the analysis as part of the application and recommended that UQ be granted the exemption certificate. SLASO was satisfied that a risk hazard analysis has been performed and that the launch would comply with the Launch Safety Standards of the Flight Safety Code, provided there were adequate exclusion arrangements for the WIR and the area around the nominal aiming point. As part of that assessment, SLASO also relied, in part, on the granting of a licence to Astrotech by the United States regulator, the Federal Aviation Administration (FAA), the submission of a risk hazard analysis to the FAA by Astrotech as part of their launch licence application and an analysis conducted by the FAA. Although SLASO requested a copy of that analysis from the US regulator, it was not provided. After the Launch, SLASO commented that there was no evidence that the launch violated the risk acceptance criterion spelled out in the launch safety standards of the Flight Safety Code.

SLASO is seeking to acquire specialist risk analysis software, with appropriate user training, to assist with assessing risk hazard analysis models submitted by applicants. SLASO also indicated that it plans to provide additional guidance for applicants wishing to apply for a licence, permit or exemption certificate. Additionally, Government approval has been granted to amend the Space Activities Act to provide for educational/research activities with an appropriate fee structure. That will allow the requirements to be clearly spelt out in regulations made in respect of that certificate.

UQ has indicated that it intends to reassess its risk hazard analysis.

Astrotech indicated that it plans to review its pre-launch assembly procedures of the rocket vehicle.

DoD has indicated that it plans to review its internal procedures for the approval of Woomera Prohibited Area activities and that the MoU with SLASO may also be reviewed.

In addition to these safety actions, the Investigator issues the following recommendations.

1) That Astrotech review the:

a) suitability of the Nike fins for use on the Terrier vehicle;
b) suitability of the fin support attachment structure when other than Terrier fins are used;
c) suitability and effectiveness of the opposing set-screw arrangement for securing and setting the Nike fin incidence angle to the Terrier fin support structure; and
d) suitability of the use of sandbags at the base of the launcher pedestal, in lieu of the specified grouting.

2) That SLASO require all Australian launch operators to submit a comprehensive risk hazard analysis for independent verification prior to the issuing of a licence, permit or exemption certificate.

3) That SLASO consider requiring launch operators to submit their risk hazard analysis to stakeholders and participants, for review and discussion.

4) That launch infrastructure providers make available sufficient resources to enable the provision of appropriate recording equipment with suitably trained personnel to provide additional recorded evidence to aid any occurrence investigation that may be necessary.

5) That overseas organisations involved in an Australian launch provide any risk hazard analysis and/or assessment to SLASO to better enable SLASO to properly assess a launch application.

The ATSB Annual Review 2002 documents ATSB's achievements and safety activities from 1 July 2001 to 30 June 2002 and outlines its business planning for 2002-2003.

Executive Directors message

The Australian Transport Safety Bureau has made significant progress since it began on 1 July 1999 as an operationally independent body within the Commonwealth Department of Transport and Regional Services (DOTARS).

During 2001-02, the ATSB assisted the Minister for Transport and Regional Services to develop new legislation that would enable the Bureau to investigate rail accidents on the increasingly important interstate system. The legislation also updates and harmonises the Bureaus aviation and marine investigative powers. Introduced into parliament on 20 June 2002, the Transport Safety Investigation Bill 2002 (TSI Bill) passed the House of Representatives with bipartisan support on 24 September and is currently before the Senate. The Bureau is also involved with the drafting of associated Regulations and proposed memoranda of understanding with key stakeholders.

The Bureau revised its investigator work-level standards and developed an internal competency-based Diploma in Transport Safety Investigation, for which national tertiary accreditation has been granted for five years. The Diploma will help validate that ATSB investigators have reached a minimum competency standard before assuming more senior responsibilities.

The federal industry minister asked the ATSB to investigate, under the Space Activities Act, an accident involving the first HyShot rocket launch at Woomera. The launch was to test a University of Queensland scramjet, a world-leading project in the race for faster passenger transport. The Bureaus investigation of the October 2001 launch and its final report and recommendations led to important changes before a reportedly highly successful second launch.

The ATSB has continued to monitor and report on road safety progress under the National Road Safety Strategy framework approved by ministers of the Australian Transport Council (ATC). It has worked closely with state and territory transport agencies, and other major stakeholders, through the National Road Safety Strategy Panel. Toward the end of the financial year, the Bureau, aided by a panel of distinguished road safety experts, formed a task force to develop an Action Plan for 2003 and 2004. The national road fatality rate, which stood at nine deaths per 100 000 population in calendar year 2001, has plateaued since about 1997 and the new Action Plan will seek to substantially cut the road toll. ATC approved the Plan on 8 November 2002.

The Parliamentary Secretary, Senator the Hon. Ron Boswell, released several ATSB research reports and a number of other road safety publications throughout the year. Two important studies concerned speed risks. ATSB research findings on the links between travel speed and road trauma have been widely cited in policy papers produced by other agencies (both in Australia and overseas) and have supported a number of major public education campaigns on speed. The Bureau also released reports on motorcycle fatalities and on driveway deaths. ATSB researchers have a special interest in fatigue issues and are working to improve national injury data as well as data on heavy-vehicle safety.

The ATSB continued to participate in rail-safety investigations at the invitation of state governments. Since 1999, the Bureau has undertaken or taken part in nine investigations. Most of these were in Victoria, but others have involved WA, NSW, Queensland and SA. Investigations have brought about important safety changes, including to operational practices and to legislation. In cooperation with state rail regulators, the Bureau has also created a national rail occurrence database with a concise set of key statistical rail safety indicators for the calendar year 2001. Ongoing discussions with state rail regulators are directed to extending the databases coverage of safety occurrences, harmonising definitions and incorporating pre-2001 data.

In 2001-02, marine reports released included investigations of groundings and collisions between ships and fishing vessels. Recognising the international nature of the shipping industry, the ATSB has continued to actively support the work of the International Maritime Organization, where it has addressed topics such as lifeboat safety and vessel fires, and to provide marine investigation and safety training. Captain Kit Filor continued as chair of the Marine Accidents International Investigators Forum (MAIIF).

The ATSB released 118 final air safety investigation reports in the past financial year thereby reducing its investigation report backlog from 125 to 90. Major reports included:

• the Whyalla Airlines VH-MZK Piper Chieftain accident with eight fatalities
• the Beech Super King Air 200 VH-SKC ghost flight fatal accident which followed the incapacitation of the pilot and seven passengers
• a serious incident involving loss of control during one engine inoperative training in a Beech 1900D airliner.

The Bureau continued to investigate maintenance problems involving Ansett's 767 fleet and Class A aircraft, as well as a fatal accident involving the WA Police Airwing at Newman. It also helped the Aviation Safety Council of Taiwan investigate a major Singapore Airlines SQ006 747 fatal accident. The President of Taiwan acknowledged the Bureaus contribution when he opened the International Society of Air Safety Investigators (ISASI) forum in October 2002. Aviation outputs also included CAIR reports, recommendations and safety notices, as well as articles in magazines such as Flight Safety Australia. The Bureau further developed its website www.atsb.gov.au and now receives more than four million hits each year.

When the Secretary reorganised the Department in January 2002, the Bureaus previous federal Black Spot and vehicle recall functions transferred to more appropriate divisions within DOTARS. I thank the staff involved for their contributions to the ATSB. I particularly wish to acknowledge Adrian Beresford-Wylie, who left the Bureau for a senior DOTARS position in September 2002. As a branch head, Adrian made a great contribution to the Bureau and to Australian road safety. I am pleased to welcome Joe Motha who has taken on Adrians former role.

I am grateful to the Deputy Prime Minister and Minister for Transport and Regional Services, the Hon. John Anderson, to our Parliamentary Secretary, Senator the Hon. Ron Boswell, and to the Department Secretary Mr Ken Matthews, for their support throughout the year. The ATSB is passionate about its role in contributing to safe transport and on behalf of the ATSBs hardworking staff, I affirm that the Bureau looks forward to meeting the challenges of 2002-03 and beyond in all four transport modes.

Kym Bills

Boeing 767-238, VH-EAQ

EXECUTIVE SUMMARY

The left engine of a Boeing 767-238 aircraft (VH-EAQ) failed during the climb phase of a regular passenger transport flight from Melbourne to Sydney. After the failure, which was characterised by a single loud 'bang' and severe vibration, the engine was shut down and the aircraft returned to Melbourne.

Engineering inspections of the JT9D-7R4 engine found that one of the fan blades had failed part-way along its length and impacted the fan case at the 11 o'clock position, causing the failure of several nose-cowl bolts and substantial damage to components adjacent to the impact point. After the initial impact, the failed blade struck the inside of the nose cowl, forward of the fan. This impact was of sufficient energy to puncture the nose cowl and allow the escape of the blade segment. No damage was caused externally to the airframe or control surfaces.

ATSB laboratory examination of the blade section remaining within the fan rotor disk found that the blade had fractured as a result of fatigue crack growth from a pre-existing defect at the blade trailing edge. The defect was identified as a shallow crack that had formed during or before the last blade refurbishment operation, carried out in 1991. Non-destructive examination procedures carried out on the blade following the refurbishment had failed to detect the defect.

In 1998, the manufacturer purchased the engine for use as a lease unit. The defective blade was installed into the engine shortly thereafter. At the time of failure, the blade had operated for 7,187 hours and through 2,083 cycles following its 1991 refurbishment. Operating times and cycles before the blade refurbishment were not available.

Sikorsky S76 Helicopter, VH-EXX

1. FACTUAL INFORMATION

1.1 Introduction

A Sikorsky S76C helicopter (VH-EXX) sustained a failure of the number-two engine during cruise flight. The failed engine was a Turbomeca Arriel 1S1 turboshaft engine, serial number 15038 and had accumulated 7,935 hours and 6,784 cycles since new.

Reports from the flight crew indicated that the engine failure was associated with a loss of gas-generator turbine speed and an escalation of turbine outlet temperatures. Fire warnings for the engine were also received, prompting the pilot commanded shutdown of the engine and discharging of the fire suppression system.

1.2 Engine examination

Disassembly of the engine (figure 1) was carried out at the Bankstown (NSW) facility of Turbomeca Pty Ltd, in the presence of representatives from the engine manufacturer, the helicopter operator and the Australian Transport Safety Bureau. The examination revealed the following significant damage to the operating components of the engine:

• Outer wall of the centrifugal diffuser cracked and separated into seven pieces over half the circumference (figure 2).
• First-stage gas-generator turbine blades oxidised and burnt over the outermost third of their length (figure 3).
• Second-stage nozzle guide vanes extensively overheated and partially melted on the convex (trailing) face and on the trailing edges (figure 4).
• Second-stage gas-generator turbine blade number 16 fractured beneath the platform. Remaining blades burnt and mechanically damaged on tip edges (figure 5).
• Second-stage NGV housing indented and punctured, circumferential cracking extending from this area (figure 6).
• Power turbine NGV missing two vanes; the remainder showing mechanical damage (figure 7).
• Number-three (rear) bearing collapsed, showing extensive overheating and out-of-balance damage to races and adjacent seals (figure 8).
• Rear bearing air vent and oil return lines fractured from outside of housing (figure 9).
• Two of the three T5 thermocouples burnt away completely (figure 10).

Figure 1. Arrial 1S1 engine, serial number 15038, as removed from the aircraft.	Figure 2. Diffuser assembly, showing break-up of the outer housing.
Figure 3. First-stage gas-generator turbine blades oxidised and burnt over their outer length.	Figure 4. Second-stage nozzle guide vanes extensively melted and disrupted in a localised area.
Figure 5. Second-stage gas-generator turbine blades damaged and oxidised, with one blade missing. Item in upper left corner is a guide vane from the power turbine NGV.	Figure 4. Second-stage NGV housing with a large puncture and cracking from the released turbine blade.
Figure 7. Power turbine NGV assembly, missing a vane (see Figure 5).	Figure 8. Rear bearing race and rotating air seals, showing extensive out-of-balance damage.
Figure 9. Rear bearing air vent line, fractured at point of connection with the bearing housing. The oil return line had failed in a similar way.	Figure 10. Thermocouple assembly - thermocouples at arrows burned/damaged.

From these observations, the axial compressor diffuser assembly and the second stage turbine rotor were selected for further examination.

In June 2006, the ATSB released an aviation research investigation report titled Wire-strike Accidents in General Aviation: Data Analysis 1994 to 2004. Since the publication of this report the ATSB has received additional information from key industry stakeholders. As a result, the ATSB has made some revisions to the report to incorporate this advice.

Furthermore, a discrepancy was also identified in one of the tables, which has since been updated. Accordingly, the information contained in the report may differ slightly from that contained in the initial report.

Wire strikes are a significant safety concern for the aviation industry, in particular, the general aviation sector. Wire strikes may result in fatalities and/or the destruction of an aircraft. This report analyses the characteristics of wire-strike occurrences in the general aviation sector using accident and incident data collected by the Australian Transport Safety Bureau. The analysis found that 119 wire-strike accidents and 98 wire-strike incidents were reported between 1994 and 2004. The rate of wire-strike accidents reported per 100,000 hours flown ranged from around 0.9 in 1997 and 1998 to 0.1 in 2003. The figures suggested a downward trend beginning in 1998, with a return to previous accident rates in 2004. Reported wire-strike accidents were primarily in three of the statistical groups used by the Australian Transport Safety Bureau for investigative purposes - aerial agriculture, other aerial work, and private/business. The majority of wire-strike accidents were associated with aerial agriculture operations (62 per cent) followed by other aerial work (20 per cent), and private/business operations (15 per cent). The findings reinforce the clear danger to pilots flying at low level in the vicinity of powerlines and the need to be proactive in reducing the risks associated with such, including the implementation of risk management plans, thorough pre-flight planning and preparation, ongoing training, the use of powerline markers, and due diligence and care.

EXECUTIVE SUMMARY

This report follows a previous report published by the Australian Transport Safety Bureau (ATSB) in 2003 on airspace-related occurrences titled Airspace-Related Occurrences Involving Regular Public Transport and Charter Aircraft within Mandatory Broadcast Zones. The 2003 report provided a detailed examination of the ATSB's accident and incident data for airspace-related occurrences in Mandatory Broadcast Zones (MBZs), between 1994 and 2001. In recognition of changes in traffic levels, occurrence reporting rates and the classification of incidents following the enactment of the Transport Safety Investigation Act in 2003 (ATSB, 2003b), an update of the analyses was considered necessary.

The purpose of the current report was to examine occurrences associated with MBZs in Australia. Specifically, the objectives of the report were to:

• examine the number of occurrences involving General Aviation (GA) aircraft in addition to occurrences involving Regular Public Transport (RPT) aircraft that occurred in MBZ airspace from 2001 to 2004; and
• examine the number of occurrences involving GA aircraft and RPT aircraft that were associated with intentional and unintentional non-compliance with MBZ procedures from 2001 to 2004.

MBZ occurrences were identified using the ATSB aviation occurrence database and subsequently validated by two ATSB Senior Transport Safety Investigators. The occurrences were then examined according to three different criteria. The first criterion encompassed all airspace-related occurrences within MBZs. The second criterion related to only those occurrences where the pilot intentionally mis-complied with MBZ procedures. In contrast, the third criterion related to only those occurrences where the pilot unintentionally mis-complied with MBZ procedures.

In total, 257 airspace-related occurrences in MBZ airspace involving GA aircraft and RPT aircraft for 2001 - 2004 were identified. The highest number of occurrences took place in 2001 and were classified as a Category 5. The number of airspace-related occurrences declined from 3.9 in 2001 to 3.1 per 100,000 hours flown by GA and RPT aircraft in 2002 and remained at 3.1 for 2003 and 2004. These findings suggest that the number of MBZ airspace-related occurrences declined slightly over the four-year period. The findings contrast with those presented in the 2003 report (Figure 1, page 9), which showed an increase in airspace-related occurrences between 1994 and 2001 (ATSB, 2003a).

Of the airspace-related occurrences identified, 145 involved intentional non-compliance with MBZ procedures and 25 involved unintentional non-compliance with MBZ procedures. Most of the non-compliance occurrences were in 2001 and were classified as a Category 5. The number of intentional non-compliance occurrences decreased from 2.6 per 100,000 hours flown by GA and RPT aircraft in 2001 to 1.4 in 2004. This finding suggests that the number of occurrences involving non-compliance generally declined over the 2001 - 2004 period. In contrast, the rate for unintentional occurrences remained below 1 per 100,000 hours flown and did not appear to vary across the four-year period.

Overall, the findings suggest that the number of MBZ airspace-related occurrences in Australia between 2001 and 2004, including those specifically relating to non-compliance with MBZ procedures, was relatively low. Furthermore, the findings suggest that the rate of MBZ-related occurrences did not rise during this period. It may therefore be deduced that the risk due to MBZ-related occurrences did not increase. Importantly though, due to recent changes and potential inconsistencies in the reporting and recording of occurrences, the findings on which these conclusions are based need to be interpreted with caution.

Boeing 747-438, VH-OJJ

EXECUTIVE SUMMARY

On 24 April 2001, a Boeing 747-400, VH-OJJ, experienced the loss of both left and right combustion fairing panels from the number three engine during take-off on a flight from Sydney to Los Angeles.

The fairing panels were ejected forcefully from the bypass duct of the engine, causing minor localised damage to the duct internal surfaces and the trailing edge of the centre wing flap section.

Examination by the Technical Analysis unit showed the damage to be consistent with fairing mis-installation, whereby the hooks on the right panel were not engaged with the respective socket pins of the upper fairing. This then permitted the free movement of the fairing sections to a point where they were caught by the bypass airflow and forcefully ejected.

The examination did not identify any defects in manufacture or maintenance of the fairing mounts or latches that could have contributed to the release.

Neville R. Blyth
Senior Transport Safety Investigator
Technical Analysis

The research paper examined fatal accidents and fatalities involving civil aviation aircraft in Australian airspace between 1990 and 2005. The purpose of the paper was to provide accurate data to industry and the public by identifying key trends and characteristics. Specifically, the objectives of the paper were to:

1. identify trends for fatal accidents and fatalities from 1990 to 2005,
2. examine the number of fatal accidents from 1990 to 2005 by pilot licence type, type of operation, level of proficiency, and aircraft weight, and
3. examine the number of fatalities from 1990 to 2005 by pilot licence type, type of operation, level of proficiency and aircraft weight.

The ATSB aviation database was searched to identify all fatal accidents involving civil aviation aircraft operating in Australian airspace from 1 January 1990 to 31 December 2005. It was found that the number of reported fatal accidents and fatalities declined significantly between 1990 and 2005, with the highest number of fatal accidents and fatalities in 1990. The number of fatal accidents and fatalities reported in 2005 was below the annual average calculated for the 16-year period. Fatal accidents associated with both professional and non-professional pilots declined significantly between 1990 and 2005. In relation to type of operation, the findings show that both commercial and non-commercial operations experienced a significant decrease in the number of fatal accidents between 1990 and 2005. For commercial operations, 2004 was the lowest for the 16-year period for both fatal accidents and fatalities. An elevated fatality rate for 2005 was primarily because of a fatal accident at Lockhart River in Queensland, which involved 15 fatalities. The fatal accident and fatality rates for commercial and non-commercial operations in Australian airspace have been very low.

Auditory icons caricatures of everyday sounds have the potential to convey information by non-verbal means quickly and accurately. Two experiments investigated the application of auditory icons as warning signals to the civil aviation cockpit environment. Warning signals that are iconic and that stand in a direct relation to the event being signalled, such as the sound of coughing to signal the presence of carbon monoxide, should convey information about the nature of the critical event as well as alerting the operator that there is a problem. By contrast, signals that are arbitrarily associated with an event, such as a beep to signal the presence of carbon monoxide, provide little information about the nature of the event. Speed and accuracy of recognition in response to these different types of warnings may also be influenced by modality (visual, auditory, auditory + visual) and by task demand (low, high). Experiment 1 investigated effects of signal iconicity (iconic, abstract), modality, and task demand on warning recognition speed and accuracy. One-hundred and seventy-eight participants completed a computer-based training session and test task that involved responding to warnings associated with nine critical events while completing low- and high-demand concurrent tasks. As hypothesized, fewer training trials were required to learn iconic warnings compared with abstract warnings. During the test phase, the effect of iconicity, as hypothesized, was influenced by modality and task demand. Bimodal (auditory + visual) warnings were recognized with the greatest consistency and accuracy. Auditory abstract warnings elicited slow reaction times and poor accuracy. Auditory iconic warnings, under conditions of high demand, evoked levels of accuracy comparable with bimodal warnings. Experiment 2 investigated recognition speed and accuracy in response to four auditory iconic and four abstract warnings in an Advanced Aviation Training Device. As hypothesized, accuracy was greater in response to auditory iconic than abstract warnings and recognition accuracy and reaction time were unaffected by level of flying experience. Reaction times in the Advanced Aviation Training Device were approximately 1 second. These initial experiments suggest that there is potential for the use of auditory iconic warnings and bimodal warnings as the means, not only to alert, but also inform pilots about the nature of a critical incident.

Following the grounding of large numbers of piston-engine aircraft across eastern Australia in early January 2000 as a consequence of using contaminated aviation gasoline (Avgas), the Australian Transport Safety Bureau initiated a major safety deficiency investigation into the circumstances of the contamination. Guidance for the investigation was subsequently provided in the form of Terms of Reference, which stated that the investigation was being widened to examine the following:

1. the existing standards for aviation gasoline;
2. the details of risk analyses undertaken prior to and during the production of aviation gasoline at Mobil's Altona refinery;
3. the adequacy of the production control, distribution control, and recording processes used by Mobil and other refiners;
4. the current arrangements for the oversight of aviation gasoline quality, including the procedures followed by Mobil and other refiners to disclose information with potential aviation safety implications; and
5. any other matter of material relevance to the above.

The ATSB investigation team identified a number of factors related to the manufacture, standards and oversight of Avgas that contributed to the contamination, which are outlined below. The relevance of these factors was also considered in relation to the manufacture of other aviation fuels.

The fitness for purpose of aviation fuels is safety critical, however the systems of manufacture, distribution, supply and use in aircraft were not supported by all the defences that are normally incorporated into other safety critical aviation systems. Despite the safety risk, there were no significant redundant systems to enhance the defences for aviation fuel quality.

The deficiencies that have been identified in relation to the supply of Avgas that was not fit for purpose also have the potential to affect the fitness for purpose of other aviation fuels, like Jet A-1. Aircraft that use Avgas are normally small compared with civilian airliners which normally use aviation turbine fuel such as Jet A-1. If a similar contamination of Jet A-1 had led to similar deficiencies in engine reliability, then the potential for a major accident with large loss of life would have been significant.

A temporary variation in the production process in Mobil's Altona refinery in late 1999 led to an increased dosage of an anti-corrosion chemical being injected into the Avgas process stream, which led to a contamination of Avgas. The anti-corrosion chemical, Neutramine D, contained an active ingredient called ethylene diamine. Ethylene diamine was not completely extracted during Avgas manufacture. Excess ethylene diamine from the injected Neutramine D was expected to be extracted from the process stream in water taken from the deisobutaniser tower during manufacture, however the extraction mechanism was not fully effective. The concentration of ethylene diamine in the final product was small and none of the many quality assurance and specification tests used during manufacture and distribution identified the presence of the ethylene diamine in the final product.

The refiner's knowledge of the process within the alkylation unit was not complete. The manufacturing process for Avgas is very complex, and there are many variables and factors that can affect the process. A lot of information was available to the operating team at the refinery, however not all the activities were fully recorded and available for future reference.

Mobil did not define or clearly document procedures for managing process deviations outside some of the limits for normal operations within the alkylation unit. The refiner aimed to operate the plant within predefined parameters, to effectively control the process and maximise its efficiency. The parameter deviations at which the alkylation unit would be considered to be outside normal operations were not clearly defined in all cases, nor were the initial considerations or actions to be taken in such circumstances clearly laid out.

The processes for monitoring the reliability of plant equipment did not provide the best possible indication of reliability. A number of systems were used for predicting and managing the reliability of various components in the alkylation unit. Some of these systems could have been used more effectively to predict reliability. Systems to assess the adequacy of the reliability prediction systems were also not completely effective.

Management of change at the refinery did not consider the effectiveness of the extraction mechanism for ethylene diamine from the Avgas process stream. Changes within the refinery that might have indicated a variation in the properties of the process stream, and therefore might have influenced the efficiency of the extraction mechanism for ethylene diamine included:

• a decrease in the efficiency of the caustic wash system due to problems with caustic circulation pumps and a system leak; and
• concentrations of sulfates and pH in water from the deisobutaniser tower overheads that were outside their normal ranges, indicating increased acid and alkyl sulfate carryover from the alkylation reactor.

These changes were not considered in the context of their potential to affect the ability of the system to ensure that any ethylene diamine that was injected into the process stream would be effectively extracted.

Mobil did not have an effective process in place to identify the adverse consequences of the cumulative effects of multiple planned and unplanned process changes on the degree of control in the alkylation unit. A number of planned and unplanned changes were taking place in the alkylation unit at the time of the contamination event. Any one of the changes could be effectively managed, however the effect of one change on another change would decrease the ability to manage the potential cumulative effect of all the changes, so that the degree of knowledge, and ability to control the unit to the same level of accuracy would be degraded.

The refiner's procedures were not effective in ensuring that decisions were fully implemented, or that progress with recommendations was regularly reported and reviewed. Following a previous contamination event, a number of recommendations and improvement actions were identified. They were not all acted on and followed through to completion.

The refiner's risk management process considered an overly narrow predefined set of undesirable outcomes. The process did not allow Mobil to identify all the undesirable outcomes (such as hazards to aviation safety) that could prevent them from producing products that were fit for purpose and from achieving their broader organisational objectives.

The refiner had not satisfied itself that all compounds that could be in the process stream during manufacture, (with particular attention to process chemicals that were introduced during the manufacturing process), would not adversely affect the systems in which the final product was intended to be used. The manufacturing process was designed to ensure that all chemicals that were in the process stream that were not desired in the end product would be extracted from the process stream during manufacture. Despite this, process deviations may have reduced the effectiveness of these extraction mechanisms. The refiner did not have procedures in place to rigorously consider the likely consequences of product contamination by any of the chemicals that were introduced into the process stream during manufacture, nor of any of the likely products of reaction of those chemicals.

The refiner did not conduct any specific practical validation of its assumption that ethylene diamine would be extracted during manufacture following the introduction of Neutramine D injection in 1991. Neutramine D was first used in the alkylation unit before the introduction of a formal Management of Change process at the refinery. At the time of the introduction, a number of concerns were addressed, however no practical validation was undertaken to assess the effectiveness of the extraction mechanism to ensure that ethylene diamine was removed from the process stream.

The use of Neutramine D to help manage corrosion in the deisobutaniser tower had been contracted out. The process of contracting out the corrosion control at the Altona refinery alkylation unit was not managed to ensure that the fulfilment of the contractor's objectives would not adversely affect Mobil's broader objectives. The corrosion control contractor was required to control the rate of Neutramine D injection as a result of pH indications taken from water samples from the deisobutaniser distillation tower overheads. This requirement did not address the potential for the objectives of the corrosion control contractor (to meet these requirements) to affect the refiner's broader product quality objective of ensuring that the product was fit for purpose.

The refiner's manufacturing process was accredited to ISO 9002, and has been subsequently reaccredited. The refiner's use of its accredited quality assurance system was not effective in ensuring that Avgas was supplied that was fit for purpose.

Following up a recommendation arising from a previous contamination event could have allowed Mobil the opportunity to identify ethylene diamine contamination. The refinery had experienced a previous contamination event from microbiological contamination. Dead bacteria had been transferred along the delivery path and clogged filters. It was thought that the bacteria had been killed by the unusually alkaline water in the bottom of the Avgas storage tank. While the reason for the alkalinity of that water was never ascertained, ethylene diamine dissolved in water will markedly increase its alkalinity.

A clear understanding did not exist among the manufacturers, regulators and users of aviation fuel that compliance with a fuel standard, by itself, would not provide assurance that fuel would be fit for purpose. When the quality of the supplied Avgas was first suspected, it was immediately re-tested to ensure that it met its specification. Avgas is normally sold on the condition that it meets its specification. The fuel that contaminated the aircraft met its specification as defined by the tests that were used to ensure that the Avgas does meet its specification. Fuel is normally fully tested only once during manufacture and distribution to ensure that it meets its specification. A number of other issues have to be addressed beyond the specification to ensure that Avgas is, and remains, fit for purpose.

Despite aviation fuels being a global commodity, no single global standard existed or was used for each main grade of aviation fuel. Manufacturers of Avgas normally use their own specification for their product that meets or slightly exceeds the major international standards. Each manufacturer's specification is normally slightly different, so the actual standard for this global commodity is not consistent.

It was impossible to comply with the literal interpretation of the major international standards for aviation gasoline because they did not specify maximum permissible concentrations of undesired compounds, either singly or collectively. The major international standards for Avgas implied a zero permissible concentration of undesired compounds in the product. It is not possible to measure zero concentrations, only to measure to the lowest measurable limit (and this is normally impractical and expensive in a production environment). It was therefore not possible to comply exactly with the specifications. If the specifications allowed a permissible small concentration of classes of undesired compounds, then this would have allowed the specification to be met exactly. However, this would have required an understanding of the potential impact of such compounds both by themselves and in combination with other compounds that are, or could be, in the fuel.

Accepted definitions did not exist for all the physical and chemical properties of aviation fuels that were required to ensure that aviation fuels were fit for purpose. A number of properties of Avgas are essential for fitness for purpose which are not defined in the international standards. These properties are known by people and organisations who are responsible for ensuring that they exist, however there are no defined levels for these properties for Avgas. This meant that Avgas could have been supplied that met the international standards and yet the undefined essential physical and chemical properties may have been addressed to a varying extent, or not at all.

Despite the criticality to safety of aviation fuel quality, no regulatory requirements for fuel quality testing existed beyond the requirement to visually assess a sample of fuel drained from an aircraft before the first flight of a day, or after refuelling. Australian law that applied to the operation of civil aircraft did not require any testing of fuel quality, beyond the need for a sample to be drained from the bottom of aircraft fuel tanks before the first flight of a day, and after refuelling. The sample was to be examined to confirm the correct clarity, colour and odour, and tested for water, either with water detecting equipment, or visually. These tests would not have identified the presence of ethylene diamine in a sample of the contaminated fuel.

There was a diffusion of responsibility among the various regulatory bodies that had the potential to oversee aviation fuel manufacture, quality assurance, supply and use. Aviation fuel was manufactured at a workplace which was regulated by relevant occupational health and safety organisations. It was sold in commercial transactions that were covered by the obligations of state and federal trade practices legislation. It was used in aircraft that were regulated by the civil aviation regulator. It was possible for each of these responsibilities to have an influence on aviation fuel during its life from manufacture to consumption, but there was no clear delineation of the roles and responsibilities of the respective regulatory organisations in relation to the quality of aviation fuel.

There was no indication to show that the then Civil Aviation Authority considered the effect on safety when it made a safety related decision to discontinue any oversight of aviation fuel quality. When the Civil Aviation Authority discontinued its oversight of aviation fuel manufacture and distribution in 1991, its reasoning was primarily that the expertise in these areas rested with the manufacturing organisations, and they were therefore considered to be the best people to ensure that the quality of fuel was maintained. A lack of expertise within the Authority was not a relevant justification for a change to regulatory oversight which could affect a safety critical aspect of aviation.

No mechanism existed to ensure that the Civil Aviation Safety Authority was made aware in a timely manner of information relating to the management of situations related to fuel quality that could affect the safety of flight. Following the discontinuation of any form of regulatory oversight by the then Civil Aviation Authority, no formal lines of communication existed between the Authority and manufacturers or distributors of aviation fuel, and hence the initial notification of a fuel quality problem was likely to occur through informal channels, and the timeliness of formal notification was at the behest of the manufacturer or distributor.

The Australian Transport Safety Bureau identified a number of deficiencies in the development of manufacturing processes and the management of those processes within the refinery, the relevance of standards that were used in the manufacture of Avgas, and the oversight of aviation fuels.

These safety deficiencies formed the basis for the development of safety recommendations issued by the Bureau. The recommendations are designed to reinforce the defences that are, or could be, put in place to reduce the probability that the safety of civil aviation could be compromised in the future.

The recommendations fall into three main groupings:

• The first group relate primarily to the management of the processes for the manufacture of Avgas. They are addressed to the refiner, and may be considered as relevant to other manufacturers of aviation fuels, as well as managers of complex, safety critical systems.
• The second group relate to the development and use of international standards for Avgas, including their use in ensuring the fitness for purpose of Avgas used in aircraft.
• The third group relate to the use of regulatory oversight as an effective defence in ensuring that fuel quality as a safety critical aviation system is, and remains, consistently fit for purpose, and the need to eliminate any diffusion of responsibility among regulators who have the potential to regulate aviation fuel quality.

The full text of the recommendations can be found in section 5 of the complete report.