F111 Deseal/Reseal Board of Inquiry Homepage

The BOI Report


Volume 1                   Entrenching Safety in the RAAF - A review of systemic issues, and
the Recommendations with a view to preventing recurrence.
Title Page
Table of Contents
          Chapter 1 Introduction
Chapter 2 The Failure of the Air Force Medical Service
Chapter 3 The Limitations of the Chain of Command
Chapter 4 The Impact of Production Pressures
Chapter 5 Incident and Hazard Reporting
Chapter 6 The Problem of Responsibility for Health and Safety
Chapter 7 Taking the Hierarchy of Controls Seriously
Chapter 8 Audit/Review
Chapter 9 The Command and Discipline System
Chapter 10 Organisational Learning
Chapter 11 Summary of Main Findings
Appendix 1 Appointment and Conduct of the Inquiry
Appendix 2 Appointment Instrument and Terms of Reference
Appendix 3 List of Board Recommendations
Appendix 4 Comment on Matters that might Warrant Further Inquiry
Appendix 5 Health Effects
Appendix 6 'The Ambulance Down in the Valley'


The President and Members of the Board of Inquiry into the F-111 (fuel tank) Deseal/Reseal and Spray Seal Programs (1977-1999) confirm that we unanimously support the findings and recommendations presented in this report.

J.W. Clarkson

Group Captain

Dr A. Hopkins
Department of Sociology, ANU

K.V. Taylor

Commodore, RANR

29 June 2001



During the course of this Inquiry into the chemical exposure of Air Force maintenance workers some 1.5 million documents, covering a period of 27 years, have been researched. Some 40, 000 documents totalling 151, 000 pages have been entered into the Board's database, Casebook. Statements were taken from over 650 people.

Whilst the aim of this report is to address the extensive Terms of Reference, it has also been designed to facilitate the work of the Chief of Air Force's follow-on team for accepted recommendations.

For clarity, and utility as a management tool, this report is presented in three volumes. The purpose of Volume 1 is to present a line of argument which answers three main questions:

  1. what happened;
  2. why; and
  3. what can be done to prevent recurrence.

Volume 1 also sets out the Board's recommendations. The Board's approach to its overall task is explained in detail in Appendix 1 to Volume 1. Volume 1 also contains a copy of the Terms of Reference and identifies the issues and points of interest during the Inquiry.

Volume 2 of the report provides a more comprehensive answer to the detail of the individual Terms of Reference. It will be of most use to individuals seeking to work through the detail of the evidence. For example, the sequence of events and information such as lists of chemicals and individuals working in the programs at specific times. This part has also been edited by text hyper link to enable ease of electronic access.

Volume 3 is extensive reference material which in hard copy presently fills a room in Victoria Barracks, Brisbane. The whole of the material before the Board has also been recorded on CD ROM.

29 June 2001



Report of the Board of Inquiry
F-111 (Fuel Tank) Deseal/Reseal and Spray Seal Programs

Volume 1

Entrenching Safety in the RAAF

A Review of Systemic Issues, and the Recommendations with a view to preventing recurrence.

Royal Australian Air Force

Air Force Headquarters, R1-1-D003, Russell Offices, Canberra, ACT, Australia 2600

29 June 2001

Copyright © apart from fair dealing


Chapter 1

'I have skin cancers or solar skin damage on my scalp, forehead, face and arms. I also have claw toes and my left foot bows out. I have lodged a claim for these impairments with the Department of Veterans Affairs and receive a sixty percent disability pension. … I continue to suffer blood pressure problems which date back to my days at Amberley. I have also suffered haemorrhoids with intermittent bleeding from the bowel. I have a lump on the palm of my left hand and a lump in the throat, which makes it intermittently hard to swallow. Back in my time at Amberley I was referred to an Ear, Nose and Throat Specialist in Brisbane. I still have a sore throat and am always coughing. I have bad breath and my wife is always telling me that I have an awful smell from my body which is not regular body odour. I also get a red rash on my face and suffer from headaches and dizziness, especially when my wife is using any cleaning product around the house. I am at times very depressed and this has put a strain on my relationship with my wife … and with my family. For some years I have not been interested in sex. I get very cranky and yell and snap at my wife for apparently no reason at all. My wife tells me there is something wrong with me and says that I should see a Doctor. She tells me that I am not the same man she knew before our posting to Amberley. I suffer from broken sleep patterns and was always a good eater but now find my appetite is gone. I generally only pick at food. I believe I have lost concentration and my short-term memory is lacking. I seem to be only able to absorb about three to five minutes of information at a time. My wife has noted my short-term memory loss problems, as have some of my friends. I remember when I was first covered in SR51 I felt sick in the stomach that night and had a splitting headache.... I still get headaches frequently'.

These are the words of one of the workers exposed to toxic chemicals at Amberley. We estimate that in excess of 400 people have suffered long-term damage to their health as a result of such exposure1.

For more than 20 years RAAF maintenance personnel have been working inside the fuel tanks of F111 aircraft, resealing leaking seams, in an ongoing series of repair programs. They worked in cramped and very unpleasant conditions, sometimes in unbearable heat and sometimes in near freezing temperatures, and they suffered chronic and occasionally acute exposure to the hazardous substances with which they worked. The resulting symptoms include skin rash, gastro-intestinal problems, headaches and loss of memory.

The matter came to a head in early 2000 and the fuel tank repair program was suspended. Since that time the problem of fuel tank leaks has not been adequately addressed and the availability of F111 aircraft has been affected. In short, as well as causing substantial human suffering, the failure of the fuel tank reseal program has impacted on defence capability.

Some of those whose health has been damaged believe that certain individuals should be held accountable for allowing things to go on as long as they did2. We understand this concern. But the scale and duration of the problem indicates that we are dealing with a deep-seated failure for which no single individual or group of individuals can reasonably be held accountable. As we noted at the outset of the hearing, 'the material made available to the Board… points to ongoing failings at a managerial level to implement a safe system of work and co-ordinate processes within a complex organisation'3. If anybody is to be held accountable, therefore, it is the Air Force itself. Our aim, however, is not to assign blame; it is to understand how the exposure occurred and to make recommendations designed to reduce the chance of recurrence.

A number of major themes permeate this report. We identify them here so that the reader will recognise them when they appear in later Chapters.

Organisational causes

Investigators are sometimes content to identify the actions or inactions of individuals as the cause of an accident. Human error, carelessness or procedural violations by front line operators are readily apparent in the early stages of most accident investigations, and too often, investigations seem to terminate at this point. The recommendations which follow are for tighter supervision, more training, or perhaps, disciplinary action. But identifying the way in which the actions or inactions of individuals contribute to an accident is only the beginning. Any event has a potentially infinite network of causes or contributing factors, and pushing the investigation some distance back along these causal pathways provides far greater insight into why an event occurred. In particular, when an unwelcome event of any sort occurs in a large organisation, it is important to identify the organisational causes of the event, some of which may be remote in time and place from the event in question4. The value of such an analysis is that it may uncover a variety of ways in which accidents can be avoided.

Our analysis adopts this approach and seeks to identify the organisational and cultural factors which led to the failure of the Air Force to protect the health of its F111 fuel tank repair workers. The Board's investigation rapidly revealed numerous incidents of non-compliance by maintenance workers with requirements that they wear personal protective equipment - goggles, respirators and the like - as well as a variety of failures by supervisors, but we treat these as symptomatic of the organisational problems we seek to identify, not in themselves the causes on which it is most useful to focus. Thus while we support better training and tighter supervision of maintenance workers, our principal recommendations concern the way the Air Force does business and they highlight the need for significant cultural and organisational changes.

We should stress that many of the organisational failures which we shall identify are by no means unique to the Air Force. The RAAF is a large organisation with many of the strengths and weaknesses of other large organisations, particularly large industrial organisations. We shall draw these parallels at various points. There are however some features of the Air Force stemming from its military nature, which generate particular weaknesses as well as particular opportunities to provide a safe work place.

Our thinking about the organisational causes of the exposure of Air Force workers to toxic chemicals is summarised in the diagram at the end of this report. It appears at the end because it is not self-explanatory and will be comprehensible only in the light of the discussion in this and subsequent Chapters.

The principles which we have identified above already guide the ADF Directorate of Flying Safety which investigates all military aircraft accidents. For this agency, and indeed for civilian air accident investigation agencies generally, where pilot error is involved it is only the starting point for an investigation into organisational causes. The agency has a trained team of investigators who stand ready at all times to carry out investigations of this type. At the moment they deal only with air crashes, but there is no reason why this capacity should not be used to investigate ground incidents as well. After all, in the civilian arena, the Bureau of Air Safety Investigation has been transformed into the Australian Transport Safety Bureau and applies an organisational style of analysis to rail crashes and other ground problems as well as to aircraft accidents. At the time of writing, it is carrying out an investigation of the apparent organisational failures of the Civil Aviation Safety Authority.

Flying Safety

We do not have to look very far for a model of how best to manage occupational health and safety. A second theme in this report is that the Air Force management of flying safety exemplifies many of the principles of best practice identified in the research literature. The way flying safety is managed is a model which many other organisations dealing with major hazards could follow with profit. We have already noted that the Air Force investigation of aircraft accidents represents best practice. Other features of the flying safety model which we shall stress are: centralised control of airworthiness, the system of authorisations which identifies responsibilities and accountabilities, and an incident reporting system which allows the Air Force to learn from incidents before they become accidents.

The quality of the Air Force's management of flying safety has evolved over time, to some extent influenced by changes occurring in the wider society. In addition, according to the Director of Flying Safety, 'there was a cultural shift. …in the early 1990s due to a number of accidents which caused management to look at how business was being done'5. In a two-year period to July 1992, there were fourteen military aircraft crashes resulting in a loss of twenty-three lives. Perhaps the most shocking was the loss of a B707 and its five crew members when it crashed off the Victorian coast. A "4-Corners" television documentary at the time6 both symbolised and stimulated public concern about this situation and this concern no doubt contributed to the cultural shift to which the Director of Flying Safety referred.

It is important to understand this background since it cautions against any assumption that the way in which air safety is managed can be transferred easily to the management of ground safety. Air safety has a very high priority, in part because of the public visibility of aircraft crashes. Ground safety failures are less visible and therefore less likely to be able to command the attention and resources which air safety enjoys. This report will identify a number of ways in which the lower attention paid to ground safety in the Air Force contributed to problems experienced by fuel tank repair workers at Amberley.

The priority of operations over logistics

The distinction between operations and logistics is one of the fundamental cleavage lines of the Air Force. Operations refers to all flying activities of the aircraft squadrons, including training. Logistics supports operations and includes aircraft maintenance work. Some maintenance work is done by personnel attached to the flying squadrons but the more extensive maintenance, including much of the fuel tank repair work, has been done by maintenance organisations with no operational role. The distinction between operations and logistics is therefore not only a conceptual one; it is mirrored in the way the Air Force is organised.

In almost every way, operations take precedence over logistics. It is the needs of the operational squadrons which drive the activities of the logistics squadrons. Operations is what the Air Force is about, and the raison d'etre of logistics is to serve operations. The motto on the letterhead of the maintenance wing at Amberley is 'excellent logistics for operations'.

The aim of a maintenance squadron or wing is to produce serviceable aircraft for use by operational squadrons. In this respect, a maintenance organisation within the Air Force is driven by production imperatives in the same way as any private sector producer. It must meet the needs of its client operating squadrons in the same way that private sector producers must supply the needs of their customers. The suspension of the maintenance program at Amberley meant a failure in the supply of serviceable aircraft to the client, just as the disruption of electricity or gas production results in a failure of supply to customers. This analysis will be important at various stages in this report, in understanding, for example, the production pressures under which the fuel tank repairers worked, the deficiencies exhibited by the Air Force medical service, and the fact that flying safety has received greater attention than ground safety.

The priority of operations over logistics is deep-seated in the culture of the Air Force. The fact that several of the organisational failures which we shall identify stem from this priority means that they will not be easily rectified.

The priority of platforms over people

The recent address by the Secretary to the Department of Defence, Dr Allan Hawke, entitled 'People Power' raised the issue of people versus platforms (weapons platforms, i.e. aircraft, ship etc). 'Defence, ' he said, was sometimes criticised as being too 'platform-centric' and he argued that there is a need to put people first. He took issue with those who say that equipment must remain the primary focus, and argued that without a 'people first' culture, recruitment and retention rates will decline and with them the ability to sustain operational capability. 'People matter - its people who make the difference', he said7. In so saying the Secretary to Defence was seeking to reverse the traditional priorities.

The traditional priority of platforms over people was in evidence at Amberley and we shall show later in this report how it contributed at various times to the failure of the Air Force to protect its maintenance workers. At this point we shall simply illustrate this priority by reference to the case of a worker who was employed to dispose of a chemical used in the first repair program. SR51 was a toxic chemical used to strip away the old and disintegrating sealants inside the tanks, prior to resealing. After use it was disposed of by means of incineration, in a remote corner of the base. This was a lonely and unsupervised activity and the worker whose job this was throughout 1979/80 spent much of his time covered in this chemical. Throughout this period he suffered various ill effects including memory loss, mood swings and vertigo. He complained from time to time about these symptoms but nothing was done about his conditions of work. On one matter, however, the Air Force was particular. He was not to operate the incinerator at any time an F111 was taking off, so as to avoid any possibility that the combustion products from the incinerator might damage the aircraft8. We are not suggesting in this case that a deliberate decision was made to give greater importance to an aircraft than to an individual; it is simply that the well-being of the aircraft was attended to while the well-being of the individual was not.

Organisational learning

Safety depends on the capacity to learn from accidents and incidents9. It is not enough to investigate their causes; recommendations arising from investigatory reports must be implemented. Otherwise hard won lessons will be to no avail. We shall identify recommendations from previous reports which, if implemented, would have reduced the exposure of F111 fuel tank workers. In particular, a problem remarkably similar to the F111 problem was identified in 1981 among Air Force surface finishers (roughly, spray painters), some of whom were suffering the ill effects of exposure to toxic substances10. An inquiry produced recommendations, many of which had direct implications for the work of the F111 fuel tank repair section. These recommendations were not implemented for F111 workers. The need to learn the lessons of previous inquiries is a theme we develop later.

The Chain of Command

Responsibility for safety lies ultimately with the chain of command. Our analysis suggests that there were critical failures in the chain of command and many of our recommendations are aimed at rectifying these weaknesses by augmenting the flow of information and ensuring better supervision. The report canvases a number of strategies for achieving this: incident reporting systems, safety committees, audits, etc. We stress that none of these is a substitute for the chain of command. They are simply means of strengthening its capacity to fulfil its function.

The problem of exposure to hazardous substances

It is estimated that in Australia four times as many people die from diseases caused by exposure to hazardous substances in the workplace as die from traumatic injury on the job11. The volume of occupationally caused ill health is of course much greater. The problem is insidious because the full effects of exposure often do not manifest themselves at the time, with the result that management and workers alike fail to have proper regard to the dangers.

It is not surprising, then, that exposure to toxic chemicals appears to be part of a broader problem for the ADO, going well beyond the case of the F111 fuel tank workers. The experience of the surface finishers has already been mentioned. Moreover, while the Board was sitting, allegations were made that Army SAS men who had been exposed to chemicals during their counter-terrorist training are now suffering illnesses as a consequence12.

The ADO must attend to these matters not only because of its responsibility to its members, but also because it makes financial sense. Expenditure on compensation for injury and illness incurred by ADF personnel was about $167 million in the financial year to June 200013. If we add in the training costs for those who replace the three hundred odd who are discharged or reclassified as medically unfit, the cost becomes a noticeable percentage of defence outlays. Exposure to hazardous substances would contribute a significant fraction of this cost.

Focus on the most recent program

The Australian Defence Organisation has steadily improved its management of occupational health and safety since the first reseal program began in 1978. It is therefore especially troubling from a management point of view that personnel were still working in dangerous conditions in the late 1990s. Despite undoubted improvements the Air Force still had a problem. For this reason our report will tend to focus on the last of the programs, the spray seal program, which began in 1996 and was suspended in February 2000.

1. This estimate is justified in Appendix 5 - Health Effects.
2. For example, T524, (Apr 09, 2001)
3. T 14, Transcript of Proceedings 28FEB01.
4. James Reason, Managing the Risks of Organisational Accidents, (Aldershot: Ashgate, 1997).
5. T 596. Transcript of Proceedings 09APR01.
6. ABC television, 13 July 1992.
7. 'People Power', pages 2, 4, 13. November 17, 2000 - www.defence.gov.au/secretary/.
8. WIT.0300.001 (at 015) par 39.
9. A. Hale, B Wilpert & M. Freitag, After the Event: From Accident to Organisational Learning, (Oxford: Pergamon, 1997).
10. AMB.0063.099 (at 121).
11. T. Driscoll & C. Mayhew, 'The extent and cost of occupational injury and illness', Chapter 3 in C. Mayhew and C Peterson (eds), (Sydney: Allen and Unwin, 1999).
12. The Australian, April 27, 2001 at page 5.
13. Tye, MAN.0030.001, par 8.


Chapter 2

The spray seal program

In late 1998, fuel tank repair workers who had been experiencing memory loss, fatigue, and other neurological problems began talking to each other and realised that the problems from which they were suffering were quite wide spread in the group. Various stories circulated: one, for example, was about a man who had experienced difficulty getting the soap to lather in the shower, and eventually realised that he had not turned the water on1. While the workers recognised the funny side of these stories they were also alarmed at what was happening to them. But a visit by two affected workers to the Amberley Medical Section failed to produce any response2.

The officer in charge of the aircraft maintenance section then wrote on 8 February 1999 to the senior medical officer at the Medical Section expressing his concern about the symptoms which his workers were experiencing. He went on:

'while none of the symptoms have been directly attributed to exposure to hazardous substances it has become evident that personnel employed in FTRS (fuel tank repair section) are experiencing abnormal health symptoms compared to other personnel employed in ARRS (Aircraft Rectification and Repair Section)'.

The officer then 'proposed' that the medical section carry out testing 'as deemed appropriate by medical staff' on the affected personnel. He concluded by asking medical section for a response 'as to the viability of this proposal'.

This was a clear request for help and an invitation to the medical section to take the initiative in resolving the problem.

The response to this request was organised by paramedical staff who were attached to the Amberley health centre, an Environmental Health Surveyor and an Environmental Health Officer. It was determined that the affected workers would be seen by a nurse and that full blood tests, liver function tests and a urine analysis would be carried out.

The results proved negative and a Minute dated 26 March 1999 was sent to the fuel tank repair section stating that 'on the basis of these results, it can be concluded that current protective measures used at FTRS are adequate for the prevention of overexposure to chemical hazards'3. The end result was that Amberley Medical Section discounted the reported symptoms, and assured the officer in charge of FTRS that all was well.

In September 1999 a new Sergeant took charge of the fuel tank repair section. He was concerned by the continuing symptoms and the failure of the medical authorities 'to take an interest in our complaints', and in December he encouraged all affected workers to make appointments individually to see a doctor at the centre4. At about this time staff at the Medical Section began to take an interest in the protective clothing being worn by workers and they discovered that suits offered inadequate protection, being permeable to Toluene, one of the toxic substances in use in the spray seal program. At this point the matter was raised at the highest level at Amberley and the spray seal program was suspended at the end of January, 2000.

It is apparent from this chronology that the Medical Section failed for more than a year to identify the cause or potential cause of the symptoms of chemical exposure which were being reported by fuel tank personnel.

Earlier programs

The failure of the Amberley medical section to recognise and respond appropriately to work related illness was not confined to the most recent reseal program - it was a feature of earlier programs, particularly the first. The incinerator operator described in Chapter 1 visited the medical section on various occasions complaining of headaches, sore throat and other symptoms of chemical poisoning. He recounts how on one occasion after collapsing at the incinerator and being taken to the medical section, he was given a Pandadol and told to go back to work5. He notes, too, that erectile problems which he associated with his chemical exposure were diagnosed simply as marital problems6.

Another worker on the first program recounts how he was overcome with fumes and hospitalised at the base hospital for a couple of days, after which he was given a tablet and sent back to work7. On two other occasions during the first reseal program workers were dragged unconscious from the fuel tanks and taken to the medical section8. Yet none of this prompted base medical to raise the alarm about work procedures involved in the program.

The lack of an occupational medicinal program

A major reason for the failure of the medical section to make any connection between symptoms reported and the workplace practices is that it had no organised occupational medicinal program. Despite the fact that the centre was located in an industrial environment, where workers were using a large variety of potentially harmful chemicals, it functioned for these workers in much the same way as any private medical practice, offering individualised health care, for sporting injuries, viral infections and the like. Some of its medical staff had, at their own initiative, acquired qualifications in occupational medicine, but there was no requirement that doctors at the centre have such qualifications.

This problem had bedevilled the reseal program from the outset. In 1980 the Commanding Officer of the Amberley Aircraft Maintenance Depot wrote a Minute concerning the 'need for medical officer specialisation in industrial hygiene'. He said, in part,

'With the advent of many new technical processes in support of maintenance activities the risk to personal health has increased… When the ENGO gets to hear about a potential health problem, usually from the shop floor, he enlists the aid of the hygiene NCO who is backed up by the Senior Medical Officer. But there is no on-going watchdog in such matters and advice available, when it is sought, is rather limited'9.

A former Director General of Air Force Health Services gave useful evidence on this point. He noted that from the mid 1970s the RAAF began to develop an expertise in occupational medicine, but from the early 1990s medical services were being cut back and restructured. 'By the end of 1993 the RAAF-specific occupational medicine sub-specialisation virtually disappeared'10. Part of the reason for this disappearance was the requirement that the defence forces increase their focus on operational activities.

The priority of operations over logistics, described in Chapter 1, has been an integral feature of Air Force medical services. The same witness, who had been the Senior Medical Officer at Amberley between 1982 and 1983, provided the following evidence:

'The operational demands of RAAF Amberley were extremely high….There were enormous pressures to focus output on the operational squadrons… The main priority of the Base Medical Flight was personnel with aircrew status. This meant the re-validation of aircrew medicals. Aircrew consisted of pilots, navigators and flight engineers, air traffic controllers and air defence operators. Aircrew …were given priority for medical treatment if ill or injured'.

'The second highest priority was the treatment of injuries and disease... The focus of this activity was to minimise illness and to rehabilitate members after injury to maximise their fitness for duty'.

'The third level of priority were medical assessments and monitoring of non-aircrews'11.

The commanding officer of Amberley Aircraft Maintenance Depot made a similar observation in his 1980 Minute:

'Whilst not denying the importance of aviation medicine to a base on which flying is conducted, there seems to be a pre-occupation with this aspect'.

Given these priorities it is no wonder that the health needs of maintenance workers received little attention at Amberley and that occupational medicine has had such a poor history within the Air Force.

It is symptomatic of the problem that while there is a recognised specialisation in aviation medicine in the RAAF, there is no recognised specialisation in general occupational medicine12.

A further illustration of the failure of occupational medicine within the Air Force is the way the policy of Occupational Health Assessments (OHAs) has been interpreted13. A major focus of the policy is the requirement that Senior Medical Officers or their representatives evaluate working areas to determine the nature of hazards and extent to which people are exposed to them. A second strand of the OHA is to carry out a medical assessment of individuals 'when indicated'. The phrase 'when indicated' suggests that this second function is indeed secondary. Yet OHAs have come to be understood as primarily medical assessments, with little or no attention given to workplace evaluation. In fact OHAs have become little more than a series of routine pathology tests.

Furthermore, the policy specifies clearly that the responsibility for determining when and where to conduct OHAs lies with the Base Senior Medical Officer. Commanders are instructed to permit access of health services personnel for this purpose. In practice however there seems to be confusion about just who is responsible and it often appears to depend on Commanders taking the initiative and requesting assessments. Clearly, in view of the operational priorities of the health services, effective OHAs, as envisaged in the policy, must await the establishment of a high profile occupational medicine program.

Diagnosis of occupational disease depends on carefully documenting work histories, chemical exposures and symptoms, often over extended periods of time. This in turn requires careful and sophisticated systems of record keeping. Where such data bases exist, clusterings of cases and trends over time can be more readily detected14. The record keeping at the Amberley medical section was not of the requisite quality, presumably because of the absence of any systematic Air Force focus on occupational health.

It should be noted, however, that the ability to detect the problems being experienced by the fuel tank workers at Amberley did not depend on a sophisticated data base. A Medical Section with an occupational focus could reasonably have been expected to carry out a work place investigation where a worker presented with symptoms which he believed were work induced15. Such an investigation would quickly have revealed the extent of the problem and the likelihood that workers were indeed being exposed to toxic chemicals.

Medical testing

Another aspect of the lack of focus on occupational medicine was the nature of the tests which doctors at the base were authorising. A distinction can be made between biological monitoring and biological effects monitoring16. The former seeks to detect directly the presence of toxic chemicals or their metabolites in the body (in the blood or the urine for example). The latter tests for bodily changes, for example, changes in blood count, liver function or sperm count, which might result from the exposure to toxic chemicals. According to one witness, the standard health monitoring tests for persons suspected of having been exposed to toxic chemicals consisted of the following: blood counts, liver function tests, lung capacity tests and spermalogical tests17. None of these procedures tests directly for the presence in the body of toxic chemicals or their metabolites; they test for bodily changes which may stem from the activity of toxic chemicals but which may also be caused in quite different ways, for example, by infectious diseases present in the broader community. They are very general tests and as such are of little assistance in diagnosing diseases caused by chemical exposure18.

If medical testing is to perform any function in the diagnosis of occupational disease it must be very specific. If particular chemicals are suspected they must be tested for directly and careful account must be taken of how long they or their metabolites remain in the body after exposure19. Moreover, if solvent exposure is suspected, according to some of the medical evidence received by the board, neuropsychological tests should be part of the repertoire of biological effects monitoring20. On the whole, medical monitoring programs authorised or conducted by Amberley Medical Section for the spray seal workers were of the non-specific kind. In particular, they did not involve any neuropsychological tests. This was because of the view taken by medical staff that the results of any such testing would not assist in the absence of baseline testing at an earlier stage. Their failure to provide any indication that fuel tank workers were suffering from the effects of chemical exposure is not surprising.

One chemical-specific test which was carried out by the Medical Section following the request by the officer in charge of aircraft maintenance was geared to the potential exposure of the fuel tank workers to Toluene. This was a urine test for the hippuric acid levels. Hippuric acid is a metabolite of Toluene, and its presence in the body can demonstrate exposure to Toluene21. Such testing was carried out within a short time of the workers ceasing spraying operations. The result of this test was negative and this was, not unreasonably, taken as evidence that fuel tank workers had not been exposed to Toluene.

We conclude that the testing carried out was largely ineffective, apart from the hippuric acid test, and that this was due in part to the lack of an explicit occupational focus at Amberley Medical Section.

Signs over symptoms

One feature of the inadequate response of the Amberley Medical Section is not related to the lack of an occupational medicine focus but stems from the practice of medicine more generally. A distinction is made in the medical profession between symptoms and signs. Symptoms are those matters of which patients complain; signs are the indications of pathology which are visible or detectable to the medical practitioner. Thus a headache is a symptom but not a sign; an abnormal blood test result may be a sign but not a symptom. An indicator such as a skin rash is both a symptom and a sign.

There is a general tendency in the medical community to give preference to signs when seeking to diagnose problems22. From the point of view of the medical observer, signs are objective23; reports of symptoms which are not detectable to the medical observer tend to be viewed as less reliable. From the point of view of the patient, the situation is almost the reverse. The symptoms are the objective reality and signs such as blood test results are indirect and abstract.

Medicine faces a dilemma when patients complain of symptoms but there are no signs available to medical observers. There is a risk in these circumstances that medical observers will downplay the significance of the symptoms. Thus, patients with back pain or overuse injuries undetectable to medical observers are often treated with scepticism, particularly when compensation issues are involved24.

The medical preference for signs over symptoms appears to have been manifested in early 1999 at Amberley in the following way. When the tests came back negative, the symptoms of which the workers were complaining were dismissed and they were sent back to work with assurances that nothing was amiss25. This was a particularly unfortunate outcome, given, as we now know, that the tests were incapable of serving as valid signs.

Contract doctors

Another factor giving rise to difficulty at the Amberley Medical Section is the change in conditions of employment of RAAF doctors in recent years. Decades ago, doctors were salaried. That meant that even though there might be no formal occupational health program at a base, doctors could take time to visit workshops and familiarize themselves with the processes in which workers were involved. Such a familiarity is vital if doctors are to be sensitive to the possible occupational causes of the symptoms which are reported to them.

The drive to limit costs has led the Air Force to outsource services of many sorts, including medical services, and at Amberley today, most patient care is provided by contract doctors26. The difficulty of retaining doctors as full time members of the Air Force has also contributed to this shift. Contract doctors are paid to provide office consultations. They are not paid to get out of the office and investigate the workplace. As a result, one doctor who was seeing the men from the fuel tank repair section had never been to visit their workplace27. His understanding of the problem he confronted was correspondingly limited. It should be noted, too, that contract doctors are not paid to do the sometimes time-consuming research which may be necessary to identify the nature of the problem.

Some contract doctors may be less likely to feel a sense of belonging to the Air Force community than full time serving medicos. They are not 'members', but simply contractors, and it is not reasonable to expect of them the same commitment to the organisation and willingness to go beyond the call of duty when the need arises that is normally assumed of a member.

It should also be noted that the doctor who diagnosed the problem in early 2000 was unaware that workers had presented at the Medical Section a year earlier complaining of the same symptoms. He explained that this, too, was a consequence of the narrow focus of his contract, as well as the absence of an appropriate data base at the centre and the fact that there was no attempt to assign doctors to patients on the basis of the patient's workplace.

Environmental Health Section

The Air Force currently recognises an environmental health specialisation, and major RAAF bases have Environmental Health Sections. These sections are attached to base medical sections and function as an arm of the medical service. Environmental health includes occupational health and safety, but this has not been its primary focus. According to Ross,

'RAAF environmental health has, as its prime focus, preparing for a public health mission in the operational environment. The main tasks are food and water quality, and vector (insect) control. Occupational health or occupational hygiene has been regarded as an additional task not central to this role'.28

This is no accident; it is, or has been RAAF policy. A policy statement issue in 1990 observed that the resources available to Environmental Health Sections were not sufficient to carry out all their responsibilities and that they must act in accordance with the following priorities29:

  1. Operational health support (including exercises)
  2. Disaster health support
  3. Training
  4. Public health issues, including water supply, food hygiene, disease and insect control
  5. Hearing conservation program
  6. Annual workplace assessments for the identification and evaluation of workplace hazards
  7. Occupational Health Assessment
  8. Other duties

This policy document remained in force until December 2000, when it was cancelled, along with a large number of others, for technical reasons. No alternative ranking has been provided and environmental health at Amberley continues to follow these priorities by default30.

This listing gives top priority to operational health support and a very low priority to occupational health and safety matters. In so doing it reflects the earlier mentioned priority of operations over logistics. Numerous witnesses complained at the Inquiry about an apparent lack of interest shown by the Environmental Health Section in the conditions of the fuel tank repair workers and, given the under-resourcing of the section and the priorities which had been set for it, this apparent lack of interest was virtually inevitable.


The inadequate resourcing of the medical service has been implicit in the forgoing but needs to be emphasised. In 1995 the Officer Commanding the maintenance wing at Amberley participated in a review of the base medical service. He observed that the service was 'an organisation under financial and resource stress'. He notes further that the senior medical officer was a 'young doctor (who) had limited management experience and was distraught with the inability of the under-resourced health services flight to meet customer demand'31. Representations at the time to improve resourcing were to no avail32. We realise that the recommendations which we have made in this Chapter will require additional resources. It is therefore imperative that Air Force recognise these funding requirements.

Continuing review of affected personnel33

In early 2001, a year after the spray seal program had been suspended, the Commanding Officer of the aircraft maintenance squadron wrote to the Amberley Medical Section asking what follow-up testing had been done on affected personnel. The reply he received from the Acting Senior Medical Officer made the following points:

The Medical Section subsequently noted: 'It should be remembered that other conditions such as head injury, stress and anxiety or depression could also present a similar picture', that is to say, the symptoms should not be assumed to be caused by chemical exposure.

The response provided to the CO led him to express doubt about whether the medical service was in a position to ensure 'that personnel who may have suffered an injury are properly and compassionately managed.'

Another response has been the commissioning by the Department of Veteran's Affairs of a significant scientific study concerning the health of former ground crew who had been at risk of exposure to toxic chemicals. The study is ongoing and is expected to be completed in 200335.

1. T338, Transcript of Proceedings 29MAR01.
2. T338, Transcript of Proceedings 29MAR01.
3. AMB.0049.095.
4. T515, Transcript of Proceedings 05APR01; By mid-Feb over 80 % of personnel in FTRS had done so - Ross, EXP.0001.001(at 006).
5. WIT.0300.001 (at 015), par 36.
6. ibid, (at 016) par 42.
7. T140. (26 March, 2001)
8. T183, Transcript of Proceedings 26MAR01
9. LAV.0030.284.
10. MAN.0016.001(at 009), par 30.
11. ibid, pars 25-7.
12. EXP.0001.001 (at 053).
13. DI(AF) PERS 53-4.
14. MAN.0013.001(at 009), par 29.
15. T474. (04 April, 2001).
16. EXP.0004.001 (at 003 & 004).
17. EXP.0002.001 (at 003) par 10.
18. At T70 Transcript of Proceedings 21MAR01, Dr Lewis stated that 'biological effects monitoring is a crude screening test and if you really want to know it was this chemical you have to find some way of measuring'. See also Dr Lewis at T68 (21 March, 2001).
19. EXP.0004.001 (at 003).
20. ibid. Also, at T45 Transcript of Proceedings 21MAR01, Dr Shumack stated 'Doing full blood counts, liver functions, that sort of testing, there is not a highly specific test for chemical exposure, let alone solvent exposure. The gold standard for solvent exposure is neuro-psychological testing. People can be exposed to low levels of solvents for years and years and years and never have one test that will be off, …its not the preferred standard of monitoring'.
21. EXP.0001.001 (at 005).
22. G. Engel, 'The need for a new medical model: a challenge for biomedicine', Chapter 5.7 in A. Caplan, et all (eds) Concepts of Health and Disease: Interdisciplinary Perspectives. (Reading: Addison-Wesley, 1981). Engel notes that 'the biomedical model … encourages bypassing the patient's verbal account by placing greater reliance on technical procedures and laboratory measurements' (p596).
23. T54, Transcript of Proceedings 21MAR01.
24. P. Boyle and M. Quinlan, Managing Occupational Health and Safety: A Multidisciplinary Approach, 2nd Ed (Melbourne: Macmillan, 2000), Chapter 4.
25. As we noted earlier, the minute emanating from the Medical Section, dated 26 March 1999, stated that 'on the basis of these results, it can be concluded that current protective measures used at FTRS are adequate for the prevention of overexposure to chemical hazards': AMB.0049.095.
26. T36, Transcript of Proceedings 21MAR01.
27. T37, Transcript of Proceedings 21MAR01.
28. EXP.0001.001 (at 048).
29. HSC EH 1-5 Environmental Health - Tasking Priorities (June 90), attached to MAN.0010.001(at 003).
30. T454, Transcript of Proceedings 03APR01.
31. MAN.0106.001 (at 011), par 23.
32. MAN.0106.001 (at 089), par 2.
33. The material in this section is drawn from HRG.0005.001; HRG.0020.010, par 4 and HRG.0020.003.
34. The Board notes the evidence from currently serving medical staff that although no firm diagnosis had been made, a 'working diagnosis' of solvent exposure had been made.
35. Full details of the study are set out in Annex D to Chapter 13 of Volume 2 of this report.


Chapter 3

Research shows that bad news does not move easily up organisational hierarchies1. The Air Force is no exception to this rule: there was a great deal of bad news about the reseal program which never made its way to senior commanders. Most striking perhaps was the failure of senior commanders to become aware that workers were suffering symptoms of exposure to toxic chemicals. But there was also a great deal of bad news about the goggles, breathing apparatus and suits which were supposed to protect the workers from exposure. Workers complained frequently about problems with this equipment and chose not to wear it in certain situations, for reasons to be discussed later. But none of this reached the attention of senior commanders.

A related research finding is that, left to themselves, workers develop unapproved ways of doing things in response to difficulties they encounter2. Again there is plenty of evidence of this occurring in the reseal programs. For instance, the last program was particularly hazardous because it involved spraying sealant in a confined space, and the design for this program called for the fuel tanks to be ventilated by two supply hoses and two exhaust vents while workers were inside the tanks. However, workers found this impractical and carried out the task without this ventilation. The full significance of this failure to comply with the requirements of the spray seal process will be discussed later. The point here is that although this unapproved practice was followed for more than a year prior to the suspension of the program, senior commanders at no stage became aware of it.

These findings present a considerable challenge to the Air Force. Like any military organisation, the Air Force is highly centralised and it relies heavily on its chain of command to achieve its corporate objectives. It presumes that the chain of command will convey relevant information up the hierarchy to facilitate informed decisions. It also presumes that instructions passed down through the chain of command will be complied with and that the supervisory processes are such as to ensure that instructions are complied with.

Senior Air Force commanders place a great deal of faith in this system. Here is a statement provided to the Board by a former officer commanding (OC) of the maintenance wing at Amberley

'I expected that, having provided a command and management framework, appropriate direction, priorities and resources to my subordinate commanders and supervisors, they are then responsible and accountable for discharging their duties. Such accountability also requires that should difficulties be experienced in carrying out tasks, either personally assigned by me as the OC or injected laterally into the organisation from outside agencies, such difficulties are to be brought to my attention'3

'I feel confident that should a serious safety concern be identified, it would have been raised through the management chain rapidly'.4

According to another former OC of the maintenance wing at Amberley,

'I believe that the ingrained requirement to follow procedures and to supervise subordinates to ensure that this is done is such as to make instances of non-compliance the exception'5.

'I have no reason to believe that the procedures developed for the Deseal/Reseal were not generally followed. I consider that the supervisory chain and the Air Force emphasis on supervision was sufficient to ensure compliance with procedures'...6.

And according to a third commander,

'At no time was there anything preventing AMSQN members from passing up this information through the Chain of Command (or around the chain of command if they felt it necessary to do so)'7.

But despite such convictions it is clear that the chain of command did not function to alert senior commanders to the problems in the fuel tank repair section and conversely that the supervisory processes failed to secure compliance. In this Chapter we explore some of the reasons for this failure and make some recommendations about how the operation of the chain of command might be improved.

The weak link in the chain

Military chains of command are long. There are six ranks between the Leading Aircraftman on the hangar floor and the Group Captain, the highest ranking officer in the maintenance wing at Amerberly. The chain metaphor invites the observation that a chain is only as strong as its weakest link, and the evidence presented to the Board suggests that one link in the chain of command is significantly weaker than the others.

There is a major divide in the Air Force between the commissioned and non-commissioned officers. Non-commissioned officers - Corporals, Sergeants and Warrant Officers - work their way up through the ranks and promotion to Warrant Officer typically comes at a relatively late career point. A few are promoted to the ranks of the commissioned officers. Typically, however, commissioned engineering officers, are tertiary trained and their entry point into the Air Force is above the Warrant Officer rank. The result is that a young engineer may be placed in charge of a sizeable maintenance group with several highly experienced non-commissioned officers reporting to him/her. There is an inherent weakness in the chain of command at this point since the young engineer is often not in a position to effectively supervise subordinates or to understand their problems.

For example, at Amberley, in July 1999, six months before the spray seal program was suspended, a young engineer took over as officer in charge of the aircraft maintenance section8. He was three years out of engineering school and had not previously worked in a maintenance section. His rank at this time was Flight Lieutenant. Although he had not had any significant management experience he now had 170 personnel from seven different sections under his authority. The fuel tank repair section was one of these sections. It was headed by a Flight Sergeant, one of seven Flight Sergeants reporting to the young Flight Lieutenant. This was clearly a situation in which the Flight Lieutenant could give only very limited attention to the fuel tank repair section.

Soon after commencing his new job the Flight Lieutenant 'took the opportunity to be a spectator for part of one spray seal'. However, he was not in a position to make a judgement about what he saw because he had no real understanding of what he termed 'the complex and involved processes' being carried out. He simply assumed that the section was being managed competently and that approved procedures were being followed. He noted that:

'Due to the large number of personnel under my command, the various team leaders were encouraged to exercise authority and initiative in solving problems. The system was such that only those problems which could not be rectified at that level should be brought to my attention'.

We stress that these comments are not intended as criticism of this young engineer; he had been placed in an untenable position. The result was, however, that the fuel tank repair section was left largely to manage itself, with relatively little supervision from more senior officers.

It is not surprising, therefore, that the Flight Lieutenant did not know that unauthorised work practices had developed in the section, nor did he know of the difficulties workers had had with personal protective equipment. Moreover, he had no knowledge of the symptoms of exposure to toxic chemicals from which the workers under his command suffered throughout this period.

We have focussed here on the six months prior to the cancellation of the spray seal program, but there is evidence that the reseal programs operated for much of their history with relatively little supervision from within the commissioned officer ranks9.

This problem is not unique to the Air Force. The Royal Commission into the gas plant explosion at Longford found that the withdrawal of engineers from site as a cost-cutting measure had led to inadequate supervision of trade staff which contributed to the accident10. Engineers are a resource which must be available in technically complex environments to provide a back up to those who are more directly involved in the production process. Engineering expertise must be on hand when workers encounter difficulties; otherwise they inevitably resort to unapproved procedures.

The level of staffing necessary to ensure that engineers are on hand when needed involves a degree of redundancy. Where organisations are faced with cost cutting imperatives, engineering staff may be the first to go, but this in the long run is false economy.

This cost-cutting process appears to have been at work in the Air Force. According to one commander,

'The Aircraft Maintenance Squadron (AMS) has been through a number of commercialisation-type reviews over a number of years. There are very few officers in the Squadron in comparison to, for example, operational units and there is a substantial reliance on the Flight Sergeants as the team leaders to control the work and the people'11.

He went on:

…'(AMS) is a difficult organisation to manage because of the lack of people like Flight Lieutenants; … (we need the) experienced junior officer who is able to get out and about amongst the troops, and provide essentially an external oversight of the organisation; or for that matter even be sent to go find out about this, go look into that… So I guess my main comment would be: don't cut out that level of management'12.

The differential impact of cost cutting on officers in maintenance squadrons, to which this witness refers, is another manifestation of the priority which the Air Force has given to operations over logistics, to the ultimate detriment of the fuel tank repair section.

We note, finally, that the problem will not be resolved by the current policy of outsourcing maintenance work to private contractors. Other government bodies have previously followed the path of outsourcing engineering work and then cutting their own engineering staff. One result has been that they have been left with insufficient engineering expertise to manage the contracts they have let. This is one of the factors which contributed to the failure of the Canberra hospital implosion, which killed one spectator but could have killed many more13. Because the Air Force will retain considerable control of the activities of its contractors, it will, under OHS legislation, remain responsible to a considerable degree for the health and safety of the contractor work force and will, for this reason among others, need to maintain its engineering capacity.

The issue of micro-management

The weak link identified above is not the only place in the chain of command where the movement of information upwards can be blocked. We have noted already that in late 1998, information about the symptoms being suffered by personnel of the fuel tank repair section moved up the chain of command as far as the Squadron Leader. He was concerned enough to write to the Medical Section asking them to investigate, and when he drew a blank response from the Medical Section staff he apparently let the matter drop. At no stage did he communicate this information to the Wing Commander to whom he reported, even though the two had daily meetings. This was a critical blockage in the flow of information. A year later, when the same Wing Commander became aware of the symptoms being experienced by the troops in the fuel tank repair section, it was he who took action to suspend the program14. There is a possibility that had he become aware of the problem on the earlier occasion, the program might have been halted then.

Why did the movement of information stop at this point? An influential strand of management theory holds that senior managers should not 'micro-manage' those below them. Subordinates have a job to do and should be left alone as far as possible to get on with it. To do otherwise is to undermine them. Thus for example, when a US submarine surfaced under a Japanese fishing vessel, killing nine people, due in part to a failure of a crew member to carry out his usual function, the Commander defended himself by saying,

'I depended on my subordinates' to ensure that watches were properly staffed and that provisions were made for working around broken equipment. 'I didn't micro-manage my crew. I empowered them to do their job'15.

A similar presumption against micro-management operated at Amberley. After making reference to this concept, the Wing Commander explained that,

'I would try and look at a higher level of dealing with things than the Squadron Leaders. And it is not my job to do the Squadron Leader's job'16.

The other side of this particular coin is that officers are not expected to take matters to their superiors unless they feel unable handle them. As the junior officer quoted above noted,

'The system was such that only those problems which could not be rectified at that level (below me) should be brought to my attention'.

The fact that the Squadron Leader took action about the symptoms of which he had been notified, but did not in turn notify his own superior, is consistent with this style of management. The Wing Commander gave evidence at the Board that although in retrospect he would prefer to have been notified, he believed that the Squadron Leader had handled the matters correctly17.

There is of course a competing view about the most effective way to manage. Senior managers need to know what is going on at lower levels in their organisations and, as the Secretary of Defence himself has recently observed:

'It is notoriously difficult for the heads of large organisations to get direct, unsanitised feedback from people who do not report directly to them'18.

Managers need to find ways to assure themselves that information about things which are going wrong or procedures which are not being followed is indeed able to find its way up the management chain. We deal with this more systematically in later Chapters but there is one simple strategy which management theorists all agree is critical, and that is that senior managers should take the time regularly to walk around workplaces and talk to people in informal ways which give them the opportunity to voice concerns or grievances. This was certainly an aspect of management strategy at Amberley, in theory19, but in practice it seemed to have had a relatively low priority, for according to the evidence of workers on the shop floor, they very rarely saw a senior officer and even more rarely had any opportunity to talk with one. Moreover visits by senior officers tended not to be walk-arounds for the purpose of observation and casual interaction, but occasions for addressing the troops and providing them with information20. This is a subtle but important difference.

It seems that the balance struck by management at Amberley between the need to avoid micro-managing and the need to make direct contact with lower ranks was not optimal.


A further factor which served to weaken the chain of command in the case of the most recent of the reseal programs was the decision by the Air Force to move towards the outsourcing of maintenance and other logistic functions. The process of outsourcing, known as 'market testing' in the military, has generated extreme organisational turbulence and placed enormous burdens on senior managers. Officers at the top of the management chain found themselves doing two jobs - their normal supervisory job and market testing, which required them to be away from the base for substantial periods of time. According to the Officer Commanding,

'The oppressive workloads which have been borne by Commanders with their increasing diversion to market-testing activities has forced the devolution of excessive responsibilities upon subordinate supervisors including junior officers and senior non-commissioned officers' 21.

Contributing to this was the can-do attitude of the senior commanders which led them to accept this burden. The can-do philosophy is often seen in Air Force circles as a characteristic of lower service ranks. It is not, however, confined to lower ranks, nor even to the services. It is a feature of all large organisations where willing and well meaning employees attempt to do the best they can with the resources at their disposal to achieve the organisation's goals. Those at the helm of large organisations need to be sensitive to this phenomenon and find ways to encourage people to put up their hand and say that a job simply cannot be done with the resources available. This is a considerable challenge since, understandably, employees at all levels would fear that such assertive behaviour would be career limiting.

The Navy used to operate a policy of 'ship stoppers'. The policy was that if certain critical crew were missing (eg radio operators), the ship could not sail. The captain was not be expected to make do with the available crew resources; he was required to defer sailing until the necessary resources were available. Similar ways need to be found to prevent Air Force commanders from trying to do too much with too little.

The posting system

Personnel in the Air Force are posted to new positions every two or three years. The reasoning, in part, is that people need to acquire a range of skills so that in an operational environment, where support may be unavailable or limited, they will have the personal competencies necessary to do the job. In particular, an officer needs to be a 'jack of all trades', to be able to cope in extreme circumstances.

One drawback of this philosophy is that a jack of all trades is master of none. Supervisors who are posted into a complex and unfamiliar technical environment, where there are established processes in operation, cannot expect to understand the technicalities or to take responsibility for the processes under their control. They must assume that the processes are being carried out as intended and that it is appropriate to carry on with business as usual, until there is some reason to think otherwise.

Thus, when a Sergeant is posted into the fuel tank repair section to supervise the on-going spray seal program, he is unlikely to realise that the absence of any ventilation inside the tanks is in violation of the approved process. The point is that once a defective procedure becomes entrenched, people rotating through supervisory positions are not likely to question it until something goes wrong.

A new officer commanding makes a similar assumption. One former OC of the maintenance wing at Amberley expressed it this way:

'Mature programs running successfully neither demanded nor received more than routine involvement at senior management level. The wing deseal/reseal program fell into this category. It had been going for some years before my arrival, and was not experiencing any major difficulties' 22.

One possible solution to this problem is that when officers are posted to take direct charge of certain technically complex operations which are deemed to be critical for any reason, including the possible danger to the health of workers, special induction procedures should apply. Rather than being expected to learn from others on the job, which inevitably means picking up entrenched bad habits, they should be given a period of time before commencing duty to study the processes from first principles and to examine the documentation which is supposed to govern procedures. They will then be in better position to identify non-compliance which has become established.

Even if all the recommendations made in this Chapter are implemented, the chain of command will remain only as good as its weakest link. There is clearly a need for strategies to augment the normal supervisory chain. This matter will be taken up in later Chapters.

1. C Stone, (1975) Where the Law Ends: The Social Control of Corporate Behaviour, NY: Harper & Row.
2. B Wynne (1988), 'Unruly technology: practical rules, impractical discourses and public understanding'. Social Studies of Science Vol 18, pp 147-167.
3. MAN.0009.001 (at 003) par 9.
4. MAN.0009.001 (at 005) par 14.
5. MAN.0004.001(at 003), par 12.
6. ibid,(at 006, 007) par 33.
7. HRG.0005.001 (at 014), par 105.
8. The following information is taken from MAN.0018.001 (at 002,5), pars 1,2,3,4,16.
9. T212; MAN.0005.001 (at 004), par 15; MAN.0035.001 (at 005), par 23; WIT.0189.001 (at 009), par 32; MAN.0049.001 (at 010), par 52 & 53.
10. D. Dawson & B Brooks, Report of the Longford Royal Commission: The Esso Longford Gas Plant Accident. Melbourne: Government Printer, 15.7.
11. T 90, Transcript of Proceedings 22MAR01.
12. T 99, Transcript of Proceedings 22MAR01.
13. A Yates, Government as an Informed Buyer: Recognising Technical Expertise as a Crucial Factor in the Success of Engineering Contracts (Canberra: The Institution of Engineers, Australia, 2000).
14. T 7, (19 March 2001).
15. The Canberra Times, 22/3/01.
16. T 109, Transcript of Proceedings 22MAR01.
17. T 109, Transcript of Proceedings 22MAR01.
18. Allan Hawke, speech entitled 'People Power', 17/11/2000, Annex G, op cit.
19. T 99, Transcript of Proceedings 22MAR01.
20. HRG.0005.001 (at 026), par 33.
21. HRG.0001.001 (at 003), par 10.
22. MAN.0004.001 (at 006), par29.


Chapter 4

Investigations of major accidents or industrial health disasters almost invariably reveal that production or operational pressures contributed significantly to the problem1. The Air Force is again no exception to the pattern. It delivers defence capability and this requires, among other things, a large scale maintenance program to ensure the supply of serviceable aircraft, for use both in regular training exercises and in times of conflict. Thus Air Force maintenance organisations are under production pressures very like those which operate in private industry.

Several commanders referred to this pressure in their evidence. According to one, when he took over as OC of the maintenance wing,

'the rate of output of the R5 servicing (major overhaul servicing) on the F111 was approximately half that required to sustain the rate of effort for the fleet, and significant effort was being applied to reduce the time taken for this servicing'2.

The pressure stemmed quite explicitly from the priority accorded to operations, as another commander noted:

'The time constraints were dictated by the operational requirements of the aircraft. The flying squadrons had … very little concept of what F111 servicing involved. Their expectation was that sixteen F111 aircraft would be on line and ready to fly as required…'

'I recall at the time that there was an urgency with the F111 maintenance program. The fuel leaks had meant that the operational flying squadrons had inadequate hours available for training. The problems with the aircraft fuel leaks were well established, resulting in a large number of aircraft being unserviceable'3.

Here is how another officer described it.

'It was an operational imperative that the F111 move to schedule through the various stages of the R5 servicing. The more aircraft that were on the hangar floor the less aircraft that were available to the flying squadrons'4.

Officers were adamant, however, that these production pressures did not compromise safety. According to one

'I at no time placed any pressure on personnel to forgo safety so as to complete the job on time. In fact, had I been informed that any such thing was happening, I would have taken immediate steps to ensure that the situation was never repeated'5.

One OC described two safety matters which had come to his attention during his period of command, one of which had led to the suspension of production until the problem was rectified. From these incidents he drew the conclusion that 'safety came first, the operational and production targets came second'. He went on: 'from the above two examples and other anecdotal evidence offered to me, I believe that this culture of safety-first existed through the management chain.'

He was wrong on this point, as we shall shortly demonstrate, and the workforce had a very different perception of just what the priorities were.

The fact that perceptions about the priority accorded to safety depend on one's position in the organisation is a feature of many large industrial organisations. A recent survey of the mining industry in Australia showed that 81 percent of senior managers thought that their company had a positive attitude towards safety, while only 55 per cent of plant operators agreed6. It seems that senior managers are generally less aware than the work force of the impact of production pressures on safety.

Pressures on the hangar floor

Members of the fuel tank repair section perceived themselves to be under considerable pressure to get the job done. At times, because of equipment breakdowns, people would have to stay on the job for 12 hours at a stretch to finish what had been scheduled for the day7. On one occasion they were asked to do 13 hours overtime in one weekend to complete what they were doing8.

Workers on the spray seal program had a five day window of time to carry out the resealing of one aircraft, after which the hangar in which they worked would be needed for other purposes. It was inconceivable that they take longer9. On one occasion delays in getting the sealant delivered meant that they had only three days in which to do the job. They managed, but the job was so rushed that the aircraft needed to be resprayed10.

The consequences of pressure

In a high pressure environment, problems with the personal protective equipment the workers were supposed to wear tended to get brushed aside, particularly in the earlier programs. Gloves disintegrated within five minutes of contact with the chemicals, but rather than continually interrupting the job to get new ones, people worked with bare hands. Moreover, according to one worker,

'there were times when the respirator restricted vision in confined areas. In those situations I would simply remove the respirator to get the job done'… Getting the job done was the priority and we just did what we were told'11.

The immediate supervisors were caught up in this compromise. A non-commissioned officer in charge of the first program commented as follows:

'I am aware of occasions when troop members removed the respirators from their face because they could not wear them in confined areas in some of the fuselage tanks. Working conditions inside the tanks were always difficult but the job had to be done…'12.

Here are the words of a supervisor at a different period: 'The troops knew the gloves did not work, but the troops had to keep going to get the job done…'13.

Production pressures sometimes affected safety in quite complex ways. In the spray seal program, workers inside the tanks were suited out in cumbersome and uncomfortable equipment. As one witness described it: 'imagine yourself dressed up in a couple of overcoats in the middle of summer crawling around in your kitchen cupboards. Its not a real pleasant sort of environment to be in'14. Moreover, there was no limit on the time people were required to remain suited up and working inside tanks. They stayed there till the job was done. Four or five hours was standard15 and in one case a worker spent eight hours in his protective equipment, unable to consume any fluid or go to the toilet16. This was highly stressful work and workers outside the tanks assisted those inside in whatever way they could. Spray guns had to be passed out, cleaned and tested from time to time. Workers who carried out this function were supposed to put on protective gear, but they sometimes didn't because of the pressure of the situation:

'The guy inside the fuel tank is under enough stress, so you would be in a hurry to get that gun clean and back to him so that he can keep going doing his job and get out of there with the least amount of stress, because you know how bad it is for him. So sometimes you would forget the mask'17.

This was one of the less obvious forms of exposure for workers in the spray seal program, but it may well have been one of the most significant.

This is not the first time this recommendation has been made. We return to this point in Chapter 10.

An aside on masculinity

This is an appropriate point to introduce what is essentially an aside on the 'culture of masculinity', a concept which is sometimes advanced to explain the apparent willingness of workers to ignore safety requirements and expose themselves to hazards. The thinking is exemplified by a 1982 government report on hazardous chemicals:

'(There was a) reluctance of some workers to use protective clothing or respirators provided. Evidence was given that where the effects of a chemical might not become evident for many years or where heat exertion made their use uncomfortable, this 'macho' attitude was more of a problem18'.

One witness made reference to this issue of masculinity in his statement to the Board.

'I believe the culture was don't whinge, just get the job done quickly and keep going… There was also a sort of masculine denial that fuel or chemicals would affect us and we should not show any weakness. … An attitude of indifference to the dangers posed by the chemicals was common … there was a certain amount of macho posturing…a culture of indifferent acceptance'.

But this witness is not invoking masculinity as an independent explanation for non-compliance. He is describing an attitude brought into play by the circumstances in which workers found themselves, as a way of coping with those circumstances. It involved a stoic and fatalistic acceptance of the compromises that were forced upon them, rather than an attitude of bravado or defiance. Even in the comment from the government report quoted above there is a suggestion that the macho attitude is brought into play by the uncomfortable nature of the protective equipment rather than providing an independent explanation for non-compliance. It is probably also the case that where some members of a group are displaying macho responses to danger, others may be induced by peer pressure to behave in the same way, but the Board has no direct evidence of this occurring among fuel tank repair workers. The culture of masculinity is therefore a concept which contributes only marginally to our understanding of why the exposure to chemicals occurred.

The problem of denial

It needs to be understood that the ways in which production takes precedence over safety are often subtle. It is not that a deliberate choice is made to put people at risk in order to achieve a production target. It is simply that production is a constant imperative and safety is not. Failure to meet production targets has immediate consequences; failure to comply with safety requirements usually has no consequence, either immediate or long term. Safety requirements are precautionary and the failure to take precautions does not lead automatically to negative outcomes. Where the potentially negative outcomes are as uncertain as the effects of chemical exposure, it is particularly easy for managers to lose focus on safety.

Moreover, organisations sometimes develop a culture of denial, that is, a set of beliefs which enable information about problems to be discounted and production to continue19. One such belief which was evident from time to time at Amberley was that people who complain are simply trouble makers who are looking for ways of avoiding work which everyone acknowledged was very unpleasant but which nevertheless had to be done. A Flight Sergeant described the problem of troublemakers as follows:

'Well, usually it was the undercurrent of things amongst the troops, the comments that used to go on amongst them…They would run the place down amongst them. These fellows had to be watched to keep them on the go. But you strike that in every group20'.

The earlier mentioned incinerator attendant found himself disbelieved because he was perceived in this way. He complained at an early stage to his superior officer about the disgusting nature of his work. (The chemical SR51 with which he was working had such an unpleasant smell that workers using it were ostracized by other workers on the base and prevented from using common facilities.) When this man later reported symptoms of poisoning, his understanding was that he was seen as a 'bludger' who was trying to avoid work21.

A Corporal in the spray seal program who complained numerous times assumed that he had been typed as a troublemaker and ignored for this reason. Workers on the hangar floor were expected to show initiative in overcoming difficulties22 and it is easy to see how people who complained regularly would have been construed as trouble makers. The Corporal believed that the attitude of his superiors to him was -'You're just a Corporal, don't tell me my job'. He went on:

'If you bring these issues up they say you're just being problematic,… you're causing trouble, so just shut up and do your job23'.

He gave the following illustration of how his complaints had been dismissed in this way by a senior officer who once visited the spray seal section. He told the Board that he had explained to the officer:

'why we needed more time, more money, more equipment and most of all, more understanding on his behalf so that we can achieve a safe outcome. After an hour of talking straight about all the problems we had, his response to me was 'so can you spray the whole fleet of jets back to back from next week'? (ie without any break between sprayings)'.

The Board did not have the opportunity to hear the officer's account of this conversation, but it is evident that the Corporal's perception was that his complaints had been dismissed.

It is clear that the idea that complainers were trouble makers at times served as a belief which enabled those who had more pressing things on their minds to discount complaints that protective equipment was inadequate or reports that workers were suffering from headaches or other non-specific ailments.

There is nothing surprising about this belief. Whistleblowers make enemies not just because of the unwelcome nature of their message, but also because of style in which they convey it. People who are sufficiently assertive to complain are often by their nature more abrasive than others and more likely to alienate those to whom they complain. But they need to be listened to.

The 'can do' problem

The phenomenon of making do with available resources and if necessary deviating from required safety procedures in order to get the job done, so very much in evidence in the fuel tank repair section, is sometimes described as the 'can do' philosophy.

The issue has been extensively discussed in the context of airworthiness and the following observations by the Director Airworthiness Coordination and Policy Agency, made in 2000, are worth quoting.

'For some time, there has been general agreement across the RAAF that it is under-resourced (in funding and personnel) and over-tasked. Over the past few years changes have lead to outsourcing, restructuring and reduction in Manpower Required in Uniform (MRU) while retaining capability and levels of tasking. The result has been the strong inculcation of a 'can do' mentality within management (at all levels) which largely requires people to do the best they can and to advise management when they cannot meet the task'.

'Recent surveys indicate that the "can do" mentality is so strong (now perhaps "must do"), that even at the levels where maintenance work is actually being conducted people are extraordinarily reluctant to admit that tasks cannot be achieved. Evidence suggests that short cuts may be being used to achieve tasks in the belief that this is accord with the overall aim of the unit/RAAF (to achieve output - aircraft on line - in the minimum time)….'

'There is a serious and challenging dichotomy between the views of the practitioners of aircraft maintenance and RAAF management. In effect the troops feel they are doing the right thing, whilst management do not condone at all the range of expedient practices being employed24'.

The Director was perhaps referring to a survey carried out by the Flying Safety agency, which made the following observation

'The culture that exists within 75SQN Maintenance Flight is very much a can-do culture, and in some respects, bordering on 'must-do'. A strong operational focus and subsequent commitment to meeting the flying programme means that despite management support for (and continual communication of) the ACAUST 'extended working hours' directive, maintenance personnel are unwilling to advise what they can't do…. It also appears that in some cases, the responsibility for 'passing on the bad news to Ops' or 'making the hard decisions' is being placed at too low a level25'.

We have already noted that investigations of major accidents routinely reveal that cost-cutting pressures played a prominent role and constituted in some respects the root cause26. But pushing the causal analysis back this far is something of a dead end in the case of organisations operating in a competitive market environment, because there is nothing much that can be done about it. Organisations that can do more with less succeed, those that cannot, go out of business.

Fortunately, the Air Force is not in this position. It can respond to resource cuts by choosing to do less, and still remain in business. This is the key to solving the problem of production pressure and the sometimes dangerous 'can do' mentality it generates.

The Director Airworthiness Coordination and Policy Agency expresses the solution as follows.

'We are not in a position to seek additional resources at this time; it is our problem to fix within our existing budgets. We must therefore adjust our workloads accordingly, reducing operational tempo if necessary and slowing down the introduction of new capabilities /mods/upgrades…It is time that management at all levels (SNCO and above) make the hard yards in deciding what tasks are to be shed rather than depending on subordinates determining what they should not do'.

Production pressures were a major source of the problems of the fuel tank repair section and the analysis provided by the Director Airworthiness Coordination and Policy Agency is entirely apposite. Moreover, his recommendation about shedding tasks is in line with our thinking. The aim must be to get senior NCOs to abandon their must-do attitude and to ask the question: can this job be done without any compromise to safety? If the answer is no, because of problems with the protective equipment or for any other reason, they must be encouraged to stop the job until the matter is sorted out. The current presumption among senior officers that NCOs should only bring problems to them which they cannot resolve themselves works against this, so the required behaviour will only occur if NCOs are rewarded for stopping work until problems are resolved. The Board is aware of one instance where work stopped because the right respirator canisters were not available, resulting in a speedy resolution of the problem27. Such behaviour is to be encouraged.

Production or operational pressures are of course inevitable (and desirable to a degree). But it is not inevitable that they take precedence over safety. Senior managers are undoubtedly sincere in their commitment to safety. But they are somewhat removed from the daily imperative to get the job done which tends to compromise safety at lower levels in the Air Force. The challenge is to find ways of conveying critical information to their attention in such a way that their commitment to safety can come in to play. Encouraging NCOs to raise safety issues up the chain of command is one strategy. The hazard and incident reporting systems to be discussed in the next Chapter provide another way.

1. A recent example is the inquiry into the Glenbrook rail crash in NSW in 1999. See the Interim Report of the Special Commission of Inquiry into the Glenbrook Rail Accident, p 71.
2.MAN.0004.001 (at 006), par 28.
3. MAN.0008.001 (at 004,7), par 12, 22.
4. MAN.0005.001 (at 003,4), par 13.
5. MAN.0018.001 (at 007,8) par 24.
6. Minerals Council of Australia, Safety Culture Survey Report, July 1999.
7. MAN.0006.001 (at 022) par 121.
8. MAN.0015.001 (at 019) par 86.
9. T335, Transcript of Proceedings 29MAR01.
10. T339, Transcript of Proceedings 29MAR01.
11. WIT.0360.001 (at 010,11) pars 22 & 28.
12. MAN.0001.001 (at 017,016), par 33.
13. MAN.0002.001 (at 014) par 30.
14. T519,..\Transcripts\Apr05.doc - hopkinschap4fn14.
15. T526,..\Transcripts\Apr05.doc - hopkinschap4fn15.
16. T343,..\Transcripts\Mar29.doc - hopkinschap4fn16.
17. T343,..\Transcripts\Mar29.doc - hopkinschap4fn17.
18. Report of the House of Representatives Standing Committee on Environment and Conservation, Hazardous Chemicals, (December 1982).
19. A. Hopkins (1999) Managing Major Hazards: The Moura Mine Disaster, Sydney: Allen and Unwin, ch 4.
20. T196, Transcript of Proceedings 27MAR01.
21. WIT.0300.001 (at 007) par 24.
22. MAN.0018.001 (at 005,6) par 16.
23. T340, Transcript of Proceedings 29MAR01.
24. Maintenance Feedback, 2/00, p 2.
25. MAN.0029.001 (at 008), par 16.
26. For example, the Longford accident, see Dawson & Brooks, op cit.
27. WIT.0064.001(at 008) par 35.


Chapter 5

Safety in any large organisation depends on identifying information that things are about to go wrong, or are in the process of going wrong, and acting on it. The supervisory chain is the main mechanism by which this should occur, but for a variety of reasons discussed in previous Chapters it cannot be relied on. In this Chapter we consider how reporting systems can augment the chain of command.

Incident reporting

Many organisations maintain so-called incident reporting systems, which are used almost exclusively to report accidents, that is, incidents which have resulted in injury. This is how the incident reporting system was used at Amberley. Moreover, Amberley had very few strictly workplace accidents. Most of the incidents reported into the system were sporting injuries and vehicle accidents 1.

The kinds of symptoms experienced by fuel tank repair workers, such as memory loss, irritability or vertigo, were not commonly viewed as incidents and so were not reported as such2. The focus on traumatic injury is well captured in the following comment made by one supervisor in answer to a question about incident reporting,

'I don't think we had any incidents of our equipment suddenly becoming dangerous or anything like that. Health-wise I believe we only had the one incident of a chap that was affected by fumes from the air conditioning hose being partially disconnected, but actual incidents - we had no accidents and I think I should point that out right now3'.

The supervisor could not recall whether an incident form had been filled out in the case of the man overcome by fumes but he did say such a report would not have come from the fuel tank repair section; if anyone had made a report it would have been the medical section to which the man had been sent4. Other supervisors gave evidence that to their knowledge there had never been an occasion to fill out an incident report in the fuel tank repair section5.

Incident reporting systems are not in principle restricted to incidents which cause harm; they are usually intended to include incidents which have the potential to cause harm - dangerous occurrences or near misses. Research demonstrates that good safety management depends on the collection of such information, since it provides a warning and enables an organisation to take action before an injury or a fatality occurs. Collecting such information, in other words, is vital for effective safety management.

In practice, however, incident report systems are seldom used in this way. Incidents concerning the use of personal protective equipment are particularly unlikely to enter incident reporting systems. For instance, the fact that gloves disintegrated within five minutes of contact with chemicals was never made the subject of an incident report at Amberley. Nor was it ever reported that workers were at times unable to wear respirators or goggles because they got in the way and interfered with the job.

The incident reporting system currently in use in the Australian Defence Organisation is designed to focus on incidents which result in injury. The system is called 'Incident to Compensation'6, which logically presumes an injury. For the most part the form, AC563, assumes an injured person and seeks details about the injury; it is quite unsuited to the reporting of dangerous occurrences such as violations of safety requirements or the failure of personal protective equipment. As a result, the form discourages incident reporting as an early warning strategy. Since it is intended to operate as the sole accident/incident report form throughout the entire ADO7, this leaves a considerable gap in the ADO's safety management strategy. We shall suggest ways of dealing with this gap later in this Chapter. But at this point we make the following recommendation:

This recommendation is open to the objection that Comcare requires the reporting of certain dangerous occurrences and that the AC563 form is intended to fulfill this purpose. We suggest that such occurrences should be reported through one of the schemes discussed below.

Hazard reporting

An incident or occurrence is not the only type of information to which senior management needs to be alerted. Hazardous conditions may exist for long periods without giving rise to any untoward event. Machinery in a dangerous condition needs to be reported and dealt with before a dangerous incident, or worse, an injury occurs. Similarly, routine exposure to toxic chemicals is hazardous even though no there is no discrete exposure event. Reporting systems that presume discrete incidents cannot capture this information.

Hazard reporting is, therefore, a vital element of any safety management system. The methodology of safety management is to identify the hazards, assess the risks and then to control the risks. Identifying the hazards is the hardest part of this8 and large organisations need to employ systematic hazard identification procedures to fulfill this obligation. In process industries, for instance, the HAZOP (Hazard and Operability Study) is the preferred method. The Secker report9 recommended that the Energy Trace Checklist modified by Human Factors Analysis be adopted for use in the Air Force. These are all systematic procedures to be adopted when new plant or processes are designed and introduced. But they need to be augmented by an on-going hazard reporting process.

A hazard reporting system existed at Amberley which might have served as an alternative conduit of information about the problems experienced in the fuel tank repair section. Workers in the section were chronically exposed to hazardous chemicals because of the problems which they experienced with protective equipment. If these matters were not easily construed as incidents, could they perhaps be construed as hazards? If, for instance, workers were splashed with toxic chemicals because of gaps in their protective clothing, as happened routinely in certain situations, could this be reported as a hazard? According to a base health and safety officer the answer, theoretically, was yes10.

In fact, however, it occurred to no one to use the hazard reporting system in this way. The majority of the hazards reports at Amberley:

'covered not so much process aspects but other aspects of operations of the base, like if the vegetation gets too high in the median strip of the roadway or there's a missing sign or pot holes in the back road; those types of issues' 11.

These were the things which workers tended spontaneously to report.

Following the discovery of the spray seal problem in early 2000, the maintenance wing organised a series of focus groups12 to identify maintenance-related hazards, and this increased dramatically the number of hazards reported for the year13. With encouragement, it seems, the workforce was able to identify a large range of hazards previously unrecognised by management. But prior to this time the hazard reporting system had not lived up to its potential.

The Defence Safety Management Agency has recently introduced a new hazard reporting form on its web site but the Amberley experience suggests that it will not be effective unless very active steps are taken to encourage its use.

ADF Aviation Safety Reporting

The failure of the general ground safety reporting systems for pro-active safety management purposes contrasts dramatically with the success of the aviation safety reporting system. The system solicits reports of any incident with potential consequences for safety and reports are described as aviation safety occurrence reports (ASORs). ASORs are made through the chain of command and are acted on by flying supervisors before being passed on to the Directorate of Flying Safety for further comment and action if necessary.

The Air Force has made great efforts to ensure that this system works and pilots are schooled in the importance of making safety occurrence reports throughout their training. Reports are on a no-blame basis, and the effectiveness of the system can be gauged by the fact that reports are received of errors which pilots have made which were not witnessed by other people and which might therefore have been very easily covered up by the reporter14.

It is instructive to compare some of these reported aviation occurrences with occurrences in the fuel tank repair section. On one occasion a Hornet pilot experienced five seconds of starred vision in level flight and some time later feelings of nausea and mild stomach ache. The symptoms gradually worsened and he returned to base and was removed by ambulance to the medical section. The plane then underwent a maintenance examination which failed to reveal any anomalies. However the oxygen converter was replaced as a precaution. Subsequent investigation linked the incident to viral gastroenteritis rather than a cockpit environment cause15.

As for the fuel tank repair section, there were various occasions described to the Board when workers felt dizzy or close to passing out while inside tanks. Passing out inside a fuel tank in a toxic atmosphere is potentially fatal; indeed the current emphasis on confined space entry training, both inside and outside the Defence Forces, has come about precisely because of a number of such fatalities. Clearly, feeling dizzy in a fuel tank is no less dangerous to the person than feeling dizzy in a cockpit, yet these occurrences went unreported and failed to generate any investigation or remedial action.

A second comparison concerns problems which Blackhawk helicopter loadmasters experienced with hearing protection. The Directorate of Flying Safety (DFS) received 23 such reports. Loadmasters wearing double hearing protection were unable to hear radio instructions from other crew members and several of these incidents resulted in the cancellation of the sortie. A number of different solutions were tried and the problem was finally fixed with a new helmet and a special communications ear piece16.

In these loadmaster cases, personal protective equipment interfered with the job, in much the way that respirators and goggles sometimes interfered with the ability of fuel tank workers to carry out their activities in very confined spaces. But rather than expecting loadmasters to remove the equipment so as to get on with the job, as NCOs implicitly expected fuel tank workers to do17, commanders cancelled the jobs and filled out ASORs. Eventually a proper solution was found.

It is clear that a safety occurrence reporting system can easily be used to report problems being experienced with PPE as well as health symptoms of the type suffered by fuel tank repair workers. Had such a system been in place, and had it been working effectively, the problems in the fuel tank repair section would have come to light much earlier than they did.

It is also clear that what makes the ASOR system work is the enormous emphasis which the Air Force (and military aviation generally) places on the safety of flying operations. A safety occurrence reporting system could only be expected to work for ground safety if the Air Force is willing to re-evaluate its priorities and put the same effort into ground safety as it does into air safety.

Flying safety is not only affected by incidents which occur during operations. The violation of maintenance procedures as well as other types of maintenance failures also impact on airworthiness and therefore on flying safety. DFS has become increasingly concerned about this problem and has recently introduced a system of Maintenance Aviation Safety Occurrence Reports (MASORs) on a trial basis to collect information about such occurrences18.

DFS recognises that violations of maintenance procedures are being driven by production pressures and a perceived need to get the job done at whatever cost. Nevertheless, it believes that one of the reasons these matters have gone unreported is the lack of any easy reporting mechanism19. It argues, therefore, that the MASOR system has the potential to bring some of these issues to light and it promotes the system vigorously through the pages of Maintenance Feedback.

Ground Safety Reporting

As already indicated, there is no system of ground safety occurrence reporting in the Air Force comparable to the ASOR or MASOR systems. This is probably another manifestation of the Air Force's selective emphasis on flying safety. Preventing the recurrence of problems such as occurred in the fuel tank repair section depends in part on developing such a system. Four possibilities suggest themselves.

  1. Refocus the ADO incident and fatality reporting system to include all safety related occurrences.

As previously discussed, this system is already so focussed on injury reporting that it is not realistic to try to convert it into an effective safety occurrence reporting system.

  1. Energise the DSMA hazard reporting system

This would be a sensible approach since occurrences which have the potential to affect safety could easily be reported through a hazard reporting system. Previous hazard reporting systems seem not to have been well used. The DSMA offers a web-based hazard reporting system, but very substantial resources would have to go into energising this system if it were to fulfill this function.

The system also has a significant limitation in that hazards are not reported beyond the base. Of course, the response to hazards must normally be at the local level. But unless these reports are also forwarded to DSMA, or some central agency, the Air Force has no record of what is being reported or how adequately it is being responded to.

  1. Develop a new system of ground safety occurrence reports ('GSORs'), analogous to the ASORs.

The Navy has adopted this approach with it OHSIRs (Occupational Health and Safety Incident Reports) 20, but it faces the problem alluded to above that incident tends to be interpreted as injury, with the result that incidents which do not result in injury are often overlooked. Navy is therefore debating a name change to make the purpose clearer21. The Navy's system is intended to be used not just for dangerous occurrences but also for hazards22. There is therefore some potential overlap with other hazard reporting systems but in practice this is not a problem23.

There is substantial overlap between the GSOR option and the MASOR option to be discussed below. One or other of these systems should be implemented, not both. For reasons to be developed below, we prefer the MASOR.

  1. Expand the system of maintenance aviation safety occurrence reports (MASORs) to include occurrences which affect the safety of maintenance workers, as well as the safety of aircraft. The system should cover all maintenance workers, not just aircraft maintenance workers. MASOR would be understood as standing for Maintenance Safety Occurrence Report, not Maintenance Aviation Safety Occurrence Report.

This option has a number of advantages. First, it does not require the establishment of a new system but simply expands in a very natural way the matters which maintenance workers are encouraged to report. Secondly, it amounts to piggybacking ground safety on air safety. This means that the energy and resources put into air safety will have flow-on benefits for ground safety.

We anticipate that this proposal will be objected to on the grounds that it might blur the focus on air safety and threaten the effectiveness of the system of air safety which has been so painstakingly developed. This is an understandable objection. However, it presumes the priority of air safety over ground safety. If the Air Force is to give ground safety equal priority then it will need to apply whatever additional resources are necessary to ensure that the expansion of the MASOR system in the way envisaged is not at the expense of air safety.

DSMA is currently considering a new overarching electronic reporting system, ALERT, for reporting everything which needs to be reported in the defence forces24. If this happens it will be vital that the different reporting systems retain their individual identities since each serves a different purpose and must be promoted and managed differently. From the viewpoint of reporters, ALERT should amount to no more than a common data entry point for making any one of several different types of report. The Board's proposal for the expansion of the MASOR system is therefore in no way inconsistent with the development of a single report entry system.

Making Reporting Systems Work

Having decided on an appropriate reporting system, the challenge is to make it work. One vital principle is that there be feedback to reporters. This both requires those to whom reports are made to respond conscientiously and it encourages reporters. Without a commitment to feedback, reports can get lost or ignored and reporters become discouraged and likely to draw the conclusion that reporting is not worthwhile. The Board heard evidence from one worker who had made a hazard report which he felt had 'just disappeared into thin air'25. The 'feedback' publications of the Directorate of Flying Safety are a model of best practice in this respect. Not only do they provide feedback to the reporter, but they ensure that others get the benefit of whatever lessons are to be learnt, thus contributing to a culture of safety.

More generally, the challenge is to create a culture of reporting. This is no easy task and requires constant effort. The effort made by DFS to make the ASOR system work exemplifies what is needed. Navy has been promoting its OHSIR system in a similar way. Staff from the Navy Certification, Safety and Acceptance Agency constantly urge proactive reporting (not just reactive reporting) and they do so in person, in training courses, and in the magazine Seaworthy26. The result has been a dramatic rise in occurrence reporting in the last year.

The Air Force already has experience of changing the culture among maintenance workers, in relation to the D6AC steel used in the F111 airframe. This steel is ultra high strength, but as a result, it is extremely sensitive to scratching. Failure to treat it carefully can result in catastrophic failure in flight. Several USAF F111s crashed in the 1960s and 1970s for this reason. According to the Director General of Technical Airworthiness:

'All this demanded high standards of attention to detail and personal care by technicians working with it, including constant coverage with protective barriers. Before working with D6AC steel, all staff were trained in special maintenance requirements. During maintenance, there was constant reinforcement and swift supervisory action in the event of any variation to, or abrogation of authorised procedures. Hence, I recall at the time an extremely high degree of overall awareness of special requirements which, as long as the basis for the requirement was clearly explained and understood by staff, led to high standards of compliance. In turn, staff showed a great deal of pride in feeling well informed and working with this new technology'27 .

Culture change requires this kind of effort and if a culture of reporting is to be achieved a comparable effort will be required.

There are some particular ways in which reporting can be encouraged. One is to provide awards for helpful reports. This would have the advantage that the judging process would focus attention of the kinds of things which reporters should be on the look out for.

It is not only reporters who need to be encouraged; management needs to be encouraged to ensure that reports are being made. One effective way of doing this is to identify areas which are under-reporting relative to others. DSMA recently identified a naval vessel with very few incident reports relative to a comparable vessel. The issue was raised with the Commanding Officer of the under-reporting ship and within a few months its incident reporting rate had risen28. The point is that unfavorable comparisons provide a strong incentive to poor performing areas to improve performance. Ironically, it is the low number of incident reports which constitutes poor performance in this context.

A final strategy is to target areas from which reports might be expected but which are not in fact generating reports. For example, it is reasonable to expect that any area where safety depends on the use of personal protective equipment will generate reports from time to time about defective equipment. If no such reports are forthcoming, the area should be investigated.

1. T374, Transcript of Proceedings 02APR01.
2. T374, Transcript of Proceedings 02APR01.
3. T198, Transcript of Proceedings 27MAR01.
4. T200, Transcript of Proceedings 27MAR01.
5. T240.
6. MAN.0019.001 (at 023) par 76.
7. See ADO, Accident or Incident Report: Information Booklet for Form AC563.
8. Secker, T635; Dawson, op cit 13.49.
9. Recommendation 12.
10. T378, Transcript of Proceedings 02APR01.
11. T378, Transcript of Proceedings 02APR01.
12. T373 (2 April).
13. MAN.0007.001 (at 011) par 40.
14. T592.
15. Flying Feedback, August, 2000, p 2.
16. DFS data base, MAN.0029.001(at 180-087).
17. MAN.0001.001 (at 015), par 33.
18. see Maintenance Feedback, 1/00, p8.
19. Ibid
20. T674, Transcript of Proceedings 09MAY01
21. T710, Transcript of Proceedings 09MAY01
22. T709, Transcript of Proceedings 09MAY01
23. T711, Transcript of Proceedings 09MAY01
24. T570, Transcript of Proceedings 09APR01
25. T161, Transcript of Proceedings 26MAR01
26. T704, Transcript of Proceedings 09MAY01
27. MAN.0009.001 (at 002), par 5
28. T572, Transcript of Proceedings 09APR01.


Chapter 6

In theory, commanders are responsible for the health and safety of their workforces. In practice, however, the issues may be quite technical and commanders must rely on others to provide the necessary advice and expertise. It is therefore critical that those who provide the advice and make the technical decisions are properly qualified to do so and that their roles and responsibilities are clearly spelt out. If this is not done, decisions may be taken without due consideration of the safety issues, and safety advice may be given by people who do not have the necessary expertise.

This has been an enduring problem in the fuel tank reseal programs. The primary aims of this Chapter are to demonstrate the problem, then to propose a solution.

The Role of the Materials Research Laboratory in the First Reseal Program

When the problem of fuel leaks in F111 fuel tanks first became apparent in the mid 1970s, the Air Force asked a Defence organisation, the Materials Research Laboratory (MRL), for help in selecting appropriate chemicals and an application method which would resolve the leakage problem 1. MRL accepted this brief and prepared a report based on a visit to the US to examine the USAF solution to the problem. This task was very much within the competence of the MRL.

But as matters unfolded it became clear that there were safety issues to be considered, in particular concerning the toxicity of SR51, a chemical specially developed in the US for the process. The Air Force therefore found itself looking to MRL for advice on the toxicity of chemicals.

At the time, this lay outside MRL's area of expertise. The principal MRL scientist involved in the project had considerable expertise in the chemistry of aircraft sealants. But he was not a toxicologist, as he himself stressed hazards'2. In short the Air Force was looking to the wrong source.

Nevertheless, MRL allowed itself to be used as a source of toxicological advice and in March 1979 it was pressed to provide a definitive statement about the toxicity of SR51. Its advice was that SR51 could cause short term effects such as nausea, but that no long term effects had become evident although some US companies had a history of over 20 years use of the material. It noted, without any elaboration, that thiophenol (the active ingredient of SR51) had a threshold limit value (TLV) of.5 parts per million (ppm). It went on: 'the most sensible approach is to adopt full safety precautions in order to avoid any as yet unrecognised hazards'3.

It should be noted that.5 ppm is a low TLV hazards'4, indicating that SR51 could be expected to have toxic effects in very low concentrations. This information, coupled with the likelihood of exposure, led a toxicologist consulted by the Board to give SR51 the highest possible risk ranking, not exceeded by any other chemical used in any of the fuel tank repair programs hazards'5.

The information about US firms was provided by the manufacturer of SR51 which told MRL three years earlier that it knew of four companies which had been using thiophenol for up to 20 years, with no known instances of long term or chronic effects hazards'6. Given that the manufacturer may have had an interest in not knowing, and given that long term effects are in any case difficult to research, in part because of the itinerant nature of many work forces, this information is quite inconclusive hazards'7.

MRL in effect acknowledged the inexpert nature of its advice by suggesting that the RAAF toxicologist should countersign the statement or provide his own assessment hazards'8. (Shortly afterwards the Director of Air Force Medicine did provide an assessment which said in part that, 'on a hazard basis, thiophenol, should be rated moderately severe to very severe' hazards'9.)

The Air Force did not explicitly ask MRL for advice on PPE and the view of the MRL scientist was that this was a matter for others. 'I assume that the RAAF medical health service had an involvement in the program however if it did not then it ought to have' hazards'10. Indeed, 'it was way out of our area of competence to advise on particular types of PPE at that time'11. Moreover, MRL had no role in the management of the reseal program and therefore no responsibility for whether or not workers were wearing appropriate PPE12.

Nevertheless, following a visit to Amberley, although MRL did not witness the resealing process, 13 it allowed itself a view on these matters.

'The deseal-reseal operation itself is being handled efficiently by 3AD and the maintenance staff observe due precautions in handling all cleaners and desealing mixtures. There is now sufficient experience in 3AD for many operators to adopt the position that although SR51 is foul smelling it is unlikely to cause concern if safety measures are adhered to. Unfortunately this recognition is not widespread over the base and ignorance and rumor has led to emotive situations'14.

Later in this same report MRL noted that concern about the incineration of the waste SR51 'had been exaggerated to an extraordinary degree'15.

In short, despite protestations to the contrary, MRL did allow itself to comment on management and to convey a perception that all was well. Moreover there is evidence that these statements in fact had the effect of allaying concerns which management at Amberley had about the use of the chemical16.

It is ironic that a month after MRL had provided these statements to Amberley, claims were being made that deseal/reseal workers in the US were experiencing serious health problems as a result of exposure to SR51 and other chemicals17.

The provision of advice by MRL outside its sphere of competence is a good example of the problems which can arise when roles and responsibilities are not clearly articulated. The RAAF approached MRL because of its expertise on the sealant properties of certain chemicals and then sought advice from them on the toxic effects of these chemicals, a matter which was beyond their expertise. MRL contributed to the role confusion by agreeing to provide this advice.

It is worth observing in passing that these events demonstrate the priority of platforms over people on the fuel tank repair program. The purpose of the Air Force was to reseal its fuel tanks and to this end it quite appropriately turned to an expert in sealant chemistry. However it then expected him to double as a toxicologist. It is inconceivable that it would have turned to a toxicologist for safety advice and then asked him to double as a sealant chemist.

Furthermore, MRL was asked to visit and give advice when sealants did not cure properly or when there were other quality control issues18, but no similar visits from external authorities were sought in relation to problems being experienced with PPE. The quality control in relation to the sealant application was extensive, and effective. According to MRL,

'The remarkably low incidence of leaks to date contrasts most favourably with the USAF experience and is a tribute to the care and attention to quality control that has been adopted at Amberley'19.

But there was no equivalent quality control in relation to the use of protective equipment. Until the Air Force puts the same effort into securing expert safety advice as it does into securing expert advice on materials, until it applies the same level of quality control to ensuring the safety of maintenance workers as it applies to ensuring the adequacy of maintenance processes, it will remain vulnerable to the criticism that it puts platforms ahead of people.

Responsibility for selecting PPE

The problem of inadequate specification of roles and responsibilities is nowhere better illustrated than in the selection of PPE appropriate to the task. Three examples will be given.


Throughout most of the period under discussion, no decisions were made at planning stages about the types of gloves which should be worn. It was implicitly assumed that almost any gloves would do. The fact is the gloves which were initially provided disintegrated within minutes of contact with some chemicals and provided little or no protection for wearers. It was then left to the non-commissioned officers in the fuel tank repair team to experiment with ways of reducing exposure. One team leader gave evidence that he had trialed 15 different types of glove, without finding any which were satisfactory20.

Moreover, this experimentation occurred under production conditions and any proposed solutions had to be such as not to interfere with production imperatives. Thus, at one point, the idea of wearing two pairs of gloves was trialed but found to interfere with dexterity and had therefore to be abandoned. Indeed, workers at times cut the finger tips off the gloves so as to get a better feel for what they were doing21.

The problem is that no-one in the planning stages was accountable for the selection of appropriate gloves. The result was that after the production process had been approved, a great deal of trialing remained to be done. Carrying out these trials under production conditions meant that, regardless of trial outcomes, workers were expected to make the best of what they had since there was now a job to be done.


For some parts of the work, personnel were required to wear respirators, that is breathing masks that pass the air through a purifying cartridge which needs to be replaced at frequent intervals. Not all cartridges are the same: some filter out chemical vapours, others only dust. Clearly, if the aim is to protect against fumes, then it is critical that the right cartridges be selected.

The initial authorisations did not specify the appropriate PPE and this distinction was not understood. Moreover, there was continuing confusion about who was responsible for deciding on the appropriate cartridges. In theory, providing advice on the selection of appropriate PPE was one of the many responsibilities of environmental health officers22, but they did not carry out this function effectively, in part for reasons discussed in Chapter 2. In practice it was often personnel in the RAAF supply system who determined what was supplied. According to one witness,

'At one stage I recall that we got a shipment of dust cartridges and not chemical vapour cartridges. After a period of about three days with people getting headaches we were advised that the Equipos had said that the dust cartridges were an Air Force authorised alternative and that they were all we would get'23.

On this occasion a confrontation occurred with the 'equipos', and the workers refused to go into the tanks until vapour cartridges were supplied. But on other occasions the decisions of the equipment supply people went unchallenged and workers used the wrong respirators for long periods24.

There was also disagreement about how frequently cartridges needed to be replaced and whose decision this was. Personnel in the supply system requested a reduction in the frequency of replacement on the grounds that workers were going through too many, even though they were simply replacing cartridges at the frequency suggested by the manufacturer25.

In short, the absence of clear accountability meant that responsibility for cartridge selection was diffused and inappropriately exercised.


The spray seal process used in the last reseal program was potentially the most hazardous. The authorisation process will be discussed in more detail below but the specific point to be made here is that it failed entirely in relation to the selection of protective suits. On the advice of personnel who had been carrying out spray sealing operations in the US, Saranex suits were selected. However even before the spray seal process was approved at Amberley, it had been realised in the US that these suits were semi-permeable to two of the chemicals in use and therefore provided inadequate protection26. The spray seal program therefore got underway with inappropriate protective suits, a fact which was only discovered after the build up of health problems became impossible to ignore. Again, therefore, the failure to specify someone specifically responsible for the selection of appropriate protective equipment meant that the Air Force failed adequately to discharge this responsibility.

The authorisation of the spray seal program

The authorisation of the spray seal program is a case study in the failure to take OHS effectively into account. Investigations of the spray seal option began in 1991. Headquarters Logistic Command developed a proposal for a trial and put this proposal to the Director of Air Force Medicine for approval. The Director approved the trial in 1992, subject to a number of conditions, one of them being that,

'An occupational hygienist be contracted to assess the process set-up, particularly the efficiency of ventilation, the adequacy of PPE, the chemical concentrations in the work area and potential fire safety and pollution hazards'27.

So far, so good. But the trial was delayed by nearly four years and when it finally occurred in March 1996, many of the requirements were not complied with28. In particular, there was no assessment of the PPE by an occupational hygienist. This was a crucial omission for, as already noted, the protective suits were quite inadequate.

It is not clear who supervised the trial, but a report was prepared by a Corporal in the fuel tank repair section and signed off by his Squadron Leader. There appears to have been no involvement by the engineers from the logistics management squadron who ultimately would approve the process. The report described the trial as 'a complete success'. It is not clear, however, precisely what was being trialed; it does not appear to have been an OHS trial, but rather, a demonstration and training session by visiting US spray seal personnel.

The outcome of the trial was not communicated back to the Director of Air Force Medicine, or if it was, there was no response, and from this point on OHS dropped out of the approval process. The procedures were approved from an engineering point of view by the Chief Engineer at Amberley in January 1997. He was not required to make reference to the safety issues and did not do so.

The result was that a new procedure was introduced into the Air Force without adequate consideration of the associated hazards. This was not just a question of the adequacy of PPE. There were psychological hazards associated with working in a very confined space using full body PPE, there were noise hazards associated with the proposed ventilation; there were fire hazards, heat stress hazards and so on. Moreover, the interaction of these various hazards exacerbated the risk of exposure to toxic chemicals. For example, workers eventually responded to the noise problem by abandoning tank ventilation. None of these issues were considered in the approval process.

The technical airworthiness model

The inadequate way in which responsibility for OHS was handled in the case of the fuel tank repair programs contrasts dramatically with the careful way in which responsibility for the engineering aspects of maintenance is managed in the Air Force. We shall not describe the system in detail here29, but various features are worth emphasising. First, there is a clear distinction between the design of maintenance processes and their execution. Design is recognised as a specialist activity and is not done by those who carry out the maintenance. By contrast the design of appropriate OHS solutions in the reseal programs was left to a considerable extent in the hands of the fuel tank repair section.

Second, the engineering design process is carefully managed and involves some or all of the following stages: initial design, design review, design approval, design acceptance, design implementation. These steps are carried out by different people and perhaps even different organisations. Approval is a critical step and the level at which approval takes place depends on the significance of the design.

Third, in order to ensure that the people or organisations carrying out these various steps are competent, they themselves must be approved or certified competent for their tasks. The technical airworthiness regulatory system specifies a certification process.

This is a tried and true system which, according to witnesses30, delivers high quality engineering outcomes and very high levels of aircraft safety. The challenge, therefore, is to find ways in which ground safety can benefit from the technical airworthiness system.

After the spray seal program was suspended at Amberley it was decided to develop new procedures for working inside fuel tanks, not in order to recommence the hazardous spray seal activities, but to carry out more limited repair activities. The development process followed the airworthiness model for engineering change management, as far as possible.

The first step was the design of a process which was acceptable from a health and safety point of view. Design in this context means to carry out the following activities: first, identify the hazards of the process, such as exposure to toxic chemicals, heat stress, the possibility of explosion, and psychological stress; second, assess the risks, that is, the likelihood and the severity of adverse effects; third, select control measures to mitigate these risks. These are the standard elements of the risk management paradigm31. This stage was carried out at Amberley with admirable thoroughness and is a model for anyone wishing to see the risk management approach in action32.

The design was then reviewed by various Amberley personnel, but some difficulty was experienced in finding an agency to approve the design. Eventually, the Defence Safety Management Agency decided that one of its staff members was indeed competent to carry out this task and he duly approved the design.

The final stage of the design process was implementation, and the project report emphasised the importance of this step33. Effective implementation of a design depends on resourcing and the design team experienced considerable delays before they were able to acquire the appropriate PPE and ventilation equipment. Until the resourcing issue had been resolved the design could not be finally handed over to the fuel tank repair team for execution. This is a critical point. It means that problems acquiring appropriate equipment have to be resolved before production gets under way. This ensures that workers are not put under pressure to make do with what is at hand in order to get on with the job, as they have been in the reseal programs to date.

Effective implementation of a design also depends on appropriate training for workers who are to carry out the tasks, prior to handover, and the design team carried out this training34. This is particularly important if workers have been posted into a section without prior experience of the type of work involved, as was the case with the reseal programs.

The development of a health and safety solution to the fuel tank entry problem at Amberley, though inspired by the engineering design process, was necessarily a separate process. Secker recommends, however, that consideration of health and safety be built into the engineering design change management process itself35. Not only is this more efficient, it is likely to be more effective. If organisations which introduce a change are required to identify any associated risks and devise controls, they may well be able to design out the risks or at least minimise the need for cumbersome PPE. For instance, if engineers designing a reseal program were required to consider the toxicity of solvents and to develop control measures, they might well discover that it was simpler to use non-toxic substances which, though not as good as the toxic alternatives, were nevertheless satisfactory. There is evidence, for instance, that in some circumstances washing with detergent and hot water is just as effective in cleaning out fuel tanks as washing with the solvent MEK36.

This discussion leads us to the following recommendations:

It is important for people working with toxic chemicals to know how toxic they are and the kinds of symptoms which they can induce. Spray seal workers were slow to connect the symptoms of memory loss which they were experiencing with exposure to chemicals. Had they known that this was a recognised symptom they would probably have been more persistent in their complaints37. Training prior to handover of a new design should cover such matters.

Training sometimes takes the form of briefings at which trainees are simply given information. This is not the most effective form of learning; people learn best by doing, and in particular, by researching questions they have been set. Hazardous chemical training should include a requirement that the trainee access relevant DSMA data bases to find out such things as the effects of the chemicals they will be using and the suitability of PPE. Training in how to access information in this way would leave them less vulnerable to inappropriate assurances that all is well.

This is not the first time the idea of integrating OHS into engineering design has been placed on the agenda. In September 1981 the Air Force Support Command issued the following instruction38,

'On selection of new engineering processes, equipment and chemicals, a review is to be made on:
a.      whether the possible dangers surrounding the new process or use of chemicals could be controlled by making the work place safe rather than using protective clothing,
b.      the adequacy of protective clothing provided and whether it is approved by a competent authority, ...
d.      whether chemicals and materials used are hazardous or toxic…'

'After this review, action is to be taken to minimise the hazards to occupational safety identified'.

It seems probable that this instruction was an outcome of the 1981 Air Force inquiry into the health of surface finishers39. But it does not embed OHS into the engineering design approval process in the way that the Board is recommending. It is the integration into the approval process which maximises the chance that OHS will be properly considered.

We note that Directorate of Aircraft Maintenance announced in August 2000 that it was examining the interface between OHS and engineering and hoped to develop guidelines by the end of 200040. At the time of writing, draft guidelines are available on the DGTA-ADF web site41. These are not yet complete and in particular the OHS sections are still undeveloped. The Board commends this initiative.

To conclude this Chapter, while it is clearly not possible for an officer commanding to discharge his or her responsibility for OHS by reviewing every decision taken by subordinates, it is possible to ensure that OHS is effectively taken into account in decision making by those subordinates. Ensuring that OHS is built into the engineering design change approval process is one such way. It is also a way of counteracting the tendency of the Air Force to give priority to platforms over people.

1. T384, Transcript of Proceedings 02APR01.
2. T387; MRL.0004.265, par 1.
3. AMB.0071.044.
4. T263, Transcript of Proceedings 28MAR01.
5. T263, Transcript of Proceedings 28MAR01.
6. Report on Visit to USA Jan/Feb 1976, EXP.0007.001 (at 039).
7. With hindsight, the information is even more suspect. In 1981 RAAF staff in the US wrote a minute stating that 'the company … is under investigation for fraud and the standard of chemical materials is under some scrutiny' LAV.0012.190, par 1.
8. MRL.0004.265, par 1.
9. AMB.0071.043.
10. EXP.0007.001(at 010), par 25.
11. T393, (2 April).
12. EXP.0007.001(at 010), par 24.
13. AMB.0054.076 (at 077).
14. AMB.0054.076 (at 077).
15. AMB.0071.045 (at 047).
16. T448; WIT.0064.001, par 27; WIT.0135.001(at 007) at par 13; WIT.0202.001, par 30; see also minutes of an Air Officer Commanding's Conference which report that the work 'had been assessed as having no medical problems, but may be producing psychological problems' - LAV.0030.254 (at 257).
17. IOI.0061.046.
18. EXP.0007.001(at 010,011), par 25 & 26.
19. AMB.0071.045. (at 045).
20. MAN.0002.001 (at 012) par 25
21. WIT.0112.001 (at 006), par 28; MAN.0034.001 (at 010), par 32.
22. MAN.0003.001 (at 004,5) par 11.
23. WIT.0064.001 (at 007) par 34.
24. WIT.0128.001 (at 005) par 13.
25. WIT.0064.001 (at 007) par 34.
26. US Hygiene Survey, IOI.0032.214 (at 218).
27. AMB.0014.010 (at 010).
28. Compare the DAFMED approval, AMB.0014.010 (at 011) and the Armstrong Report, AMB.0020.082 with the spray seal report, AMB.0018.025. See also the discussion by GPCAPT Sargeant, HRG.0001.001.
29. Useful descriptions are contained in S.Secker, The Development of the F111 Fuel Tank Maintenance Safety Procedures - Final Report, December, 2000, see especially Chapter 5; and GPCAPT Sargeant's second statement to the Board.
30. For example, MAN.0009.001(at 005), par 15.
31. AS 4360.
32. Secker, op cit, Chapter 10.
33. Secker, pp 10-4,5
34. Secker, p 10-2.
35. Secker, p 5-5.
36. US Hygiene Survey, IOI.0032.214 (at 217).
37. T344, Transcript of Proceedings 29MAR01.
38. LAV.0031.127 (at 127,8).
39. LAV.0031.127.
40. AMB.0147.108.
41. HAZSUB Management Guidance 27 April 01, http://scaweb.defence.gov.au/dgta/DAIRMAINT_Pages/TSWF/AMPTS/AMPTS1.htm.


Chapter 7

The principal strategy for the control of hazards to workers in the reseal programs was the use of personal protective equipment (PPE). PPE should, however, be the last resort, not as appears to have been the case here, the only strategy seriously considered. This is a basic principle of occupational health and safety management and it has often been expressed in Air Force publications. The 1981 report of the working party on the chemical exposure of surface finishers wrote as follows,

'Management placed too much emphasis and reliance on PPE as a means of combating the chemical hazards, rather than correcting the processes. … Significantly, the over-dependence on the use of PPE can also be seen as a transfer of responsibility for the well-being of workers from management (in whom such responsibility should be vested) to the individual. The working party recommends that PPE should be regarded as a last resort and that every effort should be made to eliminate the hazard' 1.

The Air Force Headquarters Support Command expressed the same view in 1981.

'Controlling dangers and hazards at their source is preferable to reliance on personal protective equipment. The work place should be modified rather than the worker. Often personal protection is used rather than correct the problem by changing the hazardous process, replacing the dangerous chemical or implementing engineering control of hazardous work situations. By this 'fragile' expedient of providing personal protection the responsibility for the occupational safety is shifted from the Service to the individual member without consideration of the ongoing cost of dependence on this protection'2.

The Board endorses these views. But if our endorsement is to have more impact than these previously expressed views, we need to spell out in some detail just why PPE is such an unsatisfactory strategy and provide some suggestions about what it would mean to take this advice seriously. That is the purpose of this Chapter.

The Hierarchy of Controls

OHS authorities recognise a hierarchy of controls for dealing with occupational hazards.
The Air Force version of this hierarchy is as follows: 3

At the top of the hierarchy, the ideal way to deal with a hazard is to eliminate it totally or to substitute a less hazardous substance, process or piece of machinery. An example would be to use clips, clamps or bolts as joining devices instead of a toxic adhesive.

If it is not reasonably practicable to eliminate the hazard, then it may be possible to isolate people totally from it, or to adopt engineering controls. Dangerous machinery can have guards installed, fume cupboards and ventilation systems can be constructed to deal with dangerous gases, and noisy machinery can be enclosed.

If this is not reasonably practicable then administrative controls can be applied. Examples would be reducing the exposure periods, reducing the numbers of employees exposed, regular cleaning of contamination from walls and other surfaces, and permit-to-work systems, involving agreed procedures and precautions for identified hazardous operations.

Resort to PPE should be had only if no other options are available. The experience of the Air Force demonstrates why, as we show in the next section.

Reasons why PPE is such a poor solution

  1. PPE can hinder the work and lead workers to discard it in order to get the job done. Fuel tank workers at times had to remove goggles and masks because they impeded visibility in very confined spaces: 4. At times they removed gloves because they reduced dexterity which was necessary for some of the fine work: 5. At other times workers cut the fingers out of gloves to increase dexterity: 6.
  2. Because PPE must be renewed continually, there are often supply problems. Fuel tank repair workers on occasion found that the required PPE was unavailable or that they were expected to make it last longer and to continue using it after it had become ineffective: 7.
  3. The unavailability of approved PPE may lead team leaders to procure unapproved equipment from other sources. There is evidence of this occurring in the spray seal program: 8.
  4. The PPE supplied may be ineffective. Examples of this were provided in Chapter 6.
  5. The effectiveness of PPE depends on it being properly maintained. Again, according to the surface finishers working party,

    'the condition of PPE seen on most RAAF units visited was appalling. This equipment was commonly found to be neglected, unserviceable, incomplete, incorrectly stored and infrequently cleaned': 9.

  6. PPE may need to be individually fitted and the appropriate sizes may not be available. One fuel tank worker gave evidence that his size in wet weather gear was not available so he had to carry out high-pressure water cleaning without protection from the toxic residues which were splashed everywhere: 10.
  7. PPE may be defective in unknown ways. For example, during the investigation prior to the recommencement of fuel tank entries at Amberley it was discovered that the hoses used for the air supplied respirators, which spray seal workers had worn when they were inside tanks, were permeable to the solvent MEK. This meant that if these hoses had come into contact with MEK they might well have supplied contaminated air11.

Hazards created by PPE

Paradoxically, PPE can sometimes increase exposure to the very hazard it is designed to control. The surface finishers working party,

'measured toxicity levels of MEK under the face masks much in excess of the levels measured in the general atmosphere due to MEK fumes being trapped under the face mask'12.

The use of PPE can also create other hazards. At Amberley, workers wearing protective suits were exposed to heat stress. In the early programs no attempt was made to deal with this problem and workers often found protective suits impossible to wear for this reason13. In the last program workers were given cool suits, supplied with cool water, to be worn under their protective suits. However, these did not always work properly and at least one worker found he had to cease work inside a tank because he was at risk of fainting14.

Moreover, working in a very confined space was psychologically damaging for some people15 and being encased in the full body protection provided in the last program exacerbated this stress16.

Finally, air supplied respirators provided for the last program were heavy and uncomfortable and sometimes left the wearer with a headache at the end of the day17.

The uncomfortable and stressful nature of the PPE contributed to failure of workers to wear PPE in some circumstances, particularly outside the tanks where, though they were still working with toxic chemicals, they believed themselves to be less at risk18.

Some of these additional problems associated with PPE can be addressed by supplementary administrative controls. The working party on surface finishing suggested that,

'Where personnel are found to be suffering undue discomfort when using the agreed standard of PPE, then realistic maximum operating and minimum rest periods should be agreed upon. …(These) should then be rigidly enforced'19.

Ross was quite specific in his recommendations: no more than two hours at a time wearing PPE inside a tank and no more than three hours in total in one day20. The Board concurs with these views. If none of the recommendations made later in this Chapter are accepted and workers are reduced to wearing full body PPE:

Administrative controls like this are low on the hierarchy of controls for good reason: among other things they are difficult to enforce. Where the pressure is on and overtime is being worked, there is a considerable risk that supervisors will expect workers to spend longer times suited up.

The hazard of the aft fuel tank

Where PPE fails, for whatever reason, and exposure to toxic substances occurs, a variety of ill effects is possible. In extreme cases it is possible for the worker to black out and more than one incident was reported to the Board in which a worker had become unconscious in a fuel tank due to acute exposure21. Such incidents can be life threatening and provision needs to be made for rescue. In the spray seal program an additional person, a minder, was required to sit outside the tank, suited up, and ready to enter at any time. This is in the nature of an administrative control. There is evidence that this precaution was at times ineffective: minders were seen not suited up and sitting at some distance from the aircraft22. In these circumstances it might not be discovered for some time that a worker had blacked out inside a tank and rescue would be further delayed by the need to provide protection for the rescuer.

The aft-most fuel tank in the F111, at the rear end of the fuselage, is so small that a person in full protective gear inside has little room to move, and it was realised that should such a person become unconscious the minder would not be able to extricate the body. A further administrative procedure was then put in place to deal with such an emergency. A plan was developed for cutting a hole into the fuel tank, but only the senior engineer could authorise such a cut and he was usually not present. Eventually a requirement was introduced that someone with authority to cut be present at all times23.

Using toxic chemicals in the aft-most fuel tank must be regarded as particularly hazardous because of the consequences if something goes wrong, and it is clearly a matter of debate as to whether the risk controls currently in place are sufficient. We suspect that were someone to pass out in this tank, the judgement would be made that the risk had not been adequately controlled. Some other solution to the problem of leaks from the aft-most fuel tank would then have to be found. If that is likely to be the outcome after such an event, why not take action now? We touch on this again below.

The explosion hazard

A report written at the time of the introduction of the spray seal process into the USAF made the following statement.

'The first point that must be noted is that the F111 fuel tank sealant process cannot be performed safely without the use of local supply and exhaust ventilation (that is into and out of the tanks)….(The chemicals) present an extreme explosive hazard when sprayed in the confined space of the fuel tanks'24.

In line with this warning, RAAF instructions required that there should be two supply hoses and two exhaust hoses for each tank being sprayed, and it specified further the required flow rates25. This is clearly an engineering control.

But it was supplemented with an administrative control. A substance only becomes potentially explosive when its concentration in the atmosphere reaches a certain level known as the lower explosive limit (LEL). The policy was that if the concentration of primer in the tank atmosphere went above 10 per cent of the LEL, spraying should stop until the concentration had fallen below this value26. This required that measurements of atmospheric concentrations be taken continuously, inside the tank, while spraying was occurring.

Neither the engineering, nor the administrative control was effective in the spray seal program at Amberley. The exhaust ventilation was disconnected soon after the program began because it was extremely noisy, 27 and the supply ventilation was not used because it kept 'the fumes completely stirred up and the operators were blinded by fog'28 and in any case the air hoses took up too much space in the entry port. These were problems that the spray seal trial, mentioned in Chapter 5, had failed to identify. Moreover the atmospheric monitoring system was not used because it was found that the monitors quickly clogged up with the materials being sprayed29. The result was that a major hazard remained quite uncontrolled.

A US test provides reason to believe that the atmosphere inside the tanks at Amberley must frequently have been explosive. The test revealed that ten minutes after a worker had entered a tank and begun doing a wipedown with MEK, the atmospheric concentration had reached 78 per cent of the LEL, way above the safe limit. The reading had not stabilised when the gas probe was withdrawn so it can be assumed that the final reading would have been higher. Further experimentation showed that it was not possible to remain below 20 per cent while work was in progress30. It would seem that the procedures in use at the time made it impossible to work in a fire-safe manner.

To return to Amberley, these findings suggest that had an ignition source been present, for example, had a static electric discharge occurred, an explosion might well have ensued.

Hangar ventilation

Hangar ventilation represents another failure of engineering controls. The safety of people inside the hangar depended in part on ventilation provided by inlet fans at one end of the hangar and outlet fans at the other. However, the ventilation was automatically turned off at 4pm and did not operate at weekends31. In view of the fact that spray sealing operations often continued after 4pm and sometimes occurred at weekends this was a serious failure. Witnesses report that when spray sealing was underway inside an aircraft, the atmosphere at times in the hangar was filled with green mist32.

The hangar ventilation system was defective in another respect. The prevailing winds were such that at times, exhaust fumes would be blown back to the air intakes and be carried back into the hangar33. Spray sealing was conducted in the surface finishing hangar, and twenty years ago the working party on surface finishers had made the very same observation about this hangar and recommended that the matter be rectified34. The problem remained uncorrected twenty years later.

It might also be mentioned here that the intake for the air-supplied respirators was positioned near the hangar exhaust outlet, thus jeopardising the quality of the air breathed by workers in the tanks35. While strictly this was a PPE problem it had engineering overtones.

The complexity of the engineering controls with respect to ventilation can now be appreciated. There were three distinct air supply systems: air-supplied respirators, tank ventilation and hangar ventilation. This complexity enhanced the potential for failure.

Eliminating hazards

The preceding discussion emphasises the precarious nature of all controls in the hierarchy, short of elimination. The policy must therefore be, wherever possible, to eliminate hazards, not simply to control them.

The best opportunity for eliminating hazards is at their point of introduction into an organisation. As Secker puts it,

'When Defence acquires a new aircraft or equipment, it also acquires the manufacturer's maintenance processes with all the inherent risks to the health and safety of personnel. Defence's OHS standards need to be specified up front during the acquisition process so that maintenance processes are developed or evaluated with the safety requirements in mind'36.

In the case of the F111, the Air Force wanted an aircraft so advanced that it would have the edge over potential antagonists. This meant buying an aircraft off the drawing board, with untested technology. One element of the untested technology was the fuel tank system with its specially developed sealant. As it turned out the sealant was defective, forcing both the USAF and the RAAF into extensive fuel tank maintenance programs which were both expensive and hazardous to workers.

But it is not inevitable that untested technology will introduce unforeseen hazards. The Board heard evidence that the fuel tank problem was quite foreseeable: 'any chemist would have known that the sealant would be unsatisfactory just by knowing its chemical composition'37. In so far as this is the case, the Board's recommendation is applicable to both tried and untried technology.

The Navy has accepted this principle and 'maintainability was a key issue in the submarine design review process'38. In particular the issue of accessing and working in confined spaces loomed large and, according to a Navy witness who gave evidence,

'there were quite a number of changes to the configuration in order to make it possible for people to get appropriate access in a safe fashion. So all sorts of access arrangements changed. We have modifications to covers of devices, to positions of valves and to the design of spaces'.

Eliminating existing hazards

The F111 is with us, with all its strengths and weakness. The challenge at this stage is to find ways of eliminating existing hazards.

Finding non-toxic alternatives for the toxic substances currently in use would eliminate many of the problems. This is not the first time this proposal has been made to the Air Force. In 1981 the working party on Surface Finishers recommended,

'that a suitable alternative to MEK as a washing agent be investigated in view of its very low flash point and potential health hazard. Gibson Chemicals product 1369 Safety Solvent as used by Qantas is recommended'39.

An Air Force document dated February, 1981 indicated that some progress had been made on this recommendation,

'SENGO-SC has 2AD and 3AD operationally testing Turco T9040, Gibson Chemical X-1369 and Dept of Supply Explosive Factory ME767. QPL testing at MRL is required. Action per DI(AF)SUP 17-4 required to have DAFMED check for toxicological properties before approval'40.

What happened after this is not known to the Board. The recommendation appears to have come to nothing as far as the fuel tank repair section was concerned because it continues to use MEK to this day. Nevertheless the policy of substitution must be pursued.

Toxic chemicals are only hazardous and only require the use of PPE if they are present in significant concentrations. In particular, they pose a minimal respiratory hazard if the concentration can be kept below the exposure standard.

In view of the unreliability of ventilation controls, demonstrated earlier, we are not confident about the effectiveness of this recommendation; it is very much a compromise solution. In principle, however, it should minimise many of the dangers of working with toxic chemicals in open spaces such as hangars, and reduce the need for PPE.

The recommendation has an important corollary:

'Work must not be carried out with toxic chemicals in a confined space if it is impossible to keep vapours below the exposure standard'.

We reiterate the following, already well-accepted principle:

'Work must not be carried out in a confined space if it is impossible to keep vapours well below their lower explosive limit'.

Complying with these two requirements would, in all probability, make spray seal operations in fuel tanks impossible, that is, until suitable non-toxic, non-explosive chemicals are found. Even direct, manual application may be problematic.

So, in the absence of non-toxic, non-explosive chemicals, how is the Air Force to solve its problem of fuel tank leaks? Here are a few ideas.

        If personnel continue to be sent into tanks with toxic atmospheres, relying on PPE:

Some of these proposals would involve a reduction in the quantity of fuel which could be carried and therefore a reduction in capability. But perhaps this is an outcome the Air Force could live with. After all, it has learnt to live with the degraded capability which has resulted from the failure of the PPE solution.

All of the above proposals are likely to be viewed as impractical, for a variety of good reasons. But suppose the Air Force were to start instead from the proposition that PPE is impractical, for the many reasons outlined earlier. Might this not encourage the search for ways of eliminating the hazards?

Taking such a step would go a long way towards reversing the current priority of platforms before people.

1. AMB.0063.099 (at 108).
2. LAV.0031.127.
3. DI(AF) PERS 60-3, par 6.
4. WIT.0360.001 (at 010,11) par 22.
5. WIT.0360.001 (at 005) par viii.
6. WIT.0112.001 (at 006), par 28.
7. WIT.0120.001 (at 003) par 7; WIT.0064.001 (at 007) par 34.
8. WIT.0189.001 (at 011) par 38.
9. AMB.0063.099 (at 109) par 30.
10. WIT.0360.001 (at 004) par v.
11. HRG.0001.001 (at 037), par 17.
12. AMB.0063.099 (at 109) par 29.
13. WIT.0202.001 (at 011), par 32, and (at 012,3), par 39 (ii).
14. WIT.0120.001 (at 003) par 7.
15. CBR.0007.134 (at 135).
16. T343, Transcripts of Proceedings 29MAR01.
17. T234, Transcripts of Proceedings 29MAR01.
18. T340,..\Transcripts\Mar29.doc - a1.
19. MB.0063.099, (at 0126) par 75.
20. EXP.0001.001 (at 059).
21. WIT.0064.001 (at 009), par 45; WIT.0128.001 (at 006), par 19.
22. EXP.0001.001 (at 019).
23. F111 Confined Space Entry Course 2203, p7-5.
24. The Armstrong report, AMB.0020.082 (at 085).
25. AAP 7214.003-292-5, AMB.0041.001.
26. AAP 7214.003-292-5, AMB.0041.001 (at 010).
27. T301, T509, Transcripts of Proceedings 05APR01.
28. MAN.0015.001 (at 012), par 52.
29. WIT.0380.001 (at 007), par 28.
30. AMB.0174.306, p 8 (Secker).
31. WIT.0259.001 (at 007), par 20.
32. For example, IOI.0001.331 (at 364).
33. MAN.0015.001 (at 013), par 53.
34. AMB.0063.099 (at 119), par 65, and (at 125), par 2(i).
35. MAN.0015.001 (at 012) par 49.
36. AMB.0174.306, p5-5.
37. EXP.0007.001 (at 003), par 7.
38. T705,..\Transcripts\May9.doc - a2.
39. AMB.0063.099 (at 122), par 74c.
40. AMB.0068.113.
41. Ross, EXP.0001.001 (at 045).
42. suggested by one witness, T446, Transcripts of Proceedings 29MAR01.


Chapter 8

Audit/review is a means of improving the flow of information up the management chain - a means of augmenting the chain of command. If bad news is to reach those who are in a position to do something about it, the mechanisms of audit/review must be working effectively. Clearly, they were not working effectively at Amberley. The purpose of this Chapter is to discover why not. We seek also to examine a range of information collection strategies which were described to the Board. Our aim is not to provide an exhaustive account of the types of audit/review used over the years but to identify features of audit/reviews which are likely to make them effective.

The terms audit and review have been deliberately run together in the preceding paragraph because, although various authorities give precise meanings to audit, review, evaluation and survey, the fact is their meanings in use vary with the context. This Chapter is concerned with all of these information gathering strategies.

OHS audits at Amberley

The maintenance wing at Amberley operated a quality assurance system, which involved systematic quality auditing. OHS was part of the quality system and so, theoretically, there was a rolling program of OHS audits, aimed at identifying problems. Auditing in the flight of which the fuel tank section was a part was carried out by a single Sergeant. Audit recommendations were directed to the area which had been audited 1 ; they were not addressed to a higher authority such as the Officer Commanding. The same Sergeant was responsible for briefing his superior officer on the progress of implementation. Audit reports therefore had relatively low visibility. But in any case, because of the pressure of work, the Sergeant failed to carry out any audits in 1999 and this failure escaped the notice of the officer to whom he reported2, again because of the pressure of work generated by market testing. As for the fuel tank repair section itself, it appears that no audits were carried out during the three year life of the spray seal program3. Clearly, the OHS audits specified in the quality system had a relatively low priority.

The Officer Commanding the maintenance wing at Amberley argued, however, that even had the audit program been carried out as intended, it is unlikely it would have picked up the problems in the fuel tank repair section4. The audit program was based on a check list consisting of 264 items, and particular audits covered only selected items. There were 24 items on the list concerning hazardous substances and six concerning PPE. These six were as follows5 :

Are areas/tasks designated for use of PPE clearly marked/signed?
Is appropriate PPE available?
Is PPE worn in designated areas/ tasks?
Is PPE in good repair?
Is regular maintenance carried out on PPE?
Is training provided on the correct use and maintenance of PPE?

The check list approach suffers a number of limitations. It is designed to guide an auditor who is not an expert in the subject matter and does not encourage the auditor to explore issues in depth. Indeed the OC did not reject the suggestion from Counsel Assisting that such an audit might be 'simply a tick and flick sort of exercise'6. Be that as it may, the audit program would not have detected non-compliance with procedures, for example the fact that the tank ventilation procedures were not being complied with. Moreover, it would not have picked up the fact that protective equipment was inadequate. According to the OC, only a more detailed 'survey' or 'evaluation' might have achieved this7.

Environmental health surveys

An 'environmental health survey' was another possible OHS information collection activity at Amberley. According to Ross,

'Environmental health is supposed to conduct a survey of each facility annually, with a comprehensive review of OHS issues, including identification of hazards, hazard registers, MSDSs, education, emergency procedures, chemical storage and more. This task has been seen to be a relatively low priority and has been allowed to lapse in many areas, in response to pressures for other tasks to be completed'8.

The Board has evidence of various environmental surveys conducted in the fuel tank repair section in the 1980's and early 1990's. Two occurred in 1985, apparently in response to a request from the Warrant Officer in charge of the section9. They were carried out by a Flight Sergeant with qualifications in environmental health. These surveys were more probing than the OHS audits and identified a number of problem areas, including 'inadequate and incorrect personal protective equipment'10. One noted, in particular, that the common household gloves in use provided poor protection but that no suitable alternatives were available. It also made a long series of recommendations, but they were not addressed to anyone in particular. It appears to have been left to the Warrant Officer to implement them, as best he could; it was he who trialed fifteen different types of gloves, without success11. The survey reports were addressed to three different officers, which meant that none had a clear responsibility to respond. In fact the reports do not seem to have had much visibility beyond the section where they were carried out.

The USAF industrial hygiene survey

The Officer Commanding the Amberley maintenance wing cited a 1995 USAF Industrial Hygiene Survey of spray seal operations in F111 aircraft in the US as an example of the kind of survey which would have identified the problems at Amberley. The survey was conducted by two industrial hygienists and was carried out over several days,

'The purpose of this survey was to assess the quality of the industrial work environment, identify processes and exposures which may affect employee health as well as community well-being, and to make recommendations for their elimination or control'12.

The survey examined ventilation practices and ensured that they were in accordance with design. Moreover it considered the adequacy of the protective equipment, noted the short breakthrough times of Saranex suits to toluene, and made detailed recommendations about appropriate gloves. There is no doubt, therefore, that a similar survey would have identified most of the problems which occurred in the Amberley spray seal program.

Moreover, the report could not be ignored. It requested a written reply within 30 days on actions planned as a result of the survey. And it was given additional weight by the fact that it was signed not by the person doing the survey, but by the Chief, Industrial Hygiene, Bioenvironmental Engineering. It further noted that,

'Data collected will be compared to our January 1993 baseline survey for verification purposes. All data, recommendations and subsequent corrective actions have been incorporated into a case file, which is maintained by our office'.

The US industrial hygiene survey was clearly far more thorough and had far greater authority than the Amberley environmental health surveys.

Technical airworthiness auditing

The Director General of Technical Airworthiness (DGTA) described to the Board the auditing process by which he assures himself that aircraft maintenance organisations are operating in accordance with the standards which his office has laid down13. His auditors visit such organisations and identify any ways in which the organisation is failing to meet the requirements. Deficiencies are formulated as Corrective Action Requests (CARs). The audit of the site might result in 20 such CARs of which perhaps four might be judged significant. The Director General himself will sign the audit report. The organisation may be given, say, two months to implement the significant requests and six months to implement the others. If the organisation fails to meet these deadlines, DGTA will organise an 'implementation facilitation visit' by his staff to help the organisation achieve compliance. Ultimate compliance is vital if the organisation is to remain an authorised engineering organisation. Auditing by DGTA therefore carries great authority, cannot be ignored and achieves high visibility in the whole of the audited organisation.

The wing-wide hazard review

Following the cessation of the spray seal program the Amberley maintenance wing employed an outside consultant to run focus groups among workers to identify hazards. Workers were required to use specific hazard identification techniques. This produced a large number of previously unidentified or unreported hazards, some of them dating back to the 1970s14. This was a high profile activity and has generated a careful tracking and rectification process15. It has the further advantage that it trains the workforce in techniques of hazard identification and increases the prospect that hazard reporting systems will be used effectively.

The maintenance safety health review

In 1999 the Directorate of Flying Safety carried out a so-called Maintenance Safety Health Review of one Air Force maintenance squadron, at the request of the squadron's commanding officer. The review team, consisting of two Squadron Leaders and two Warrant Officers, spent three days on site. This was a high powered and well resourced exercise. The Director of Flying Safety described it as a 'cultural survey' 16 and its focal point was a questionnaire asking, among other things, about compliance with maintenance procedures and reasons for non compliance. Adopting DFS methodology the review sought to identify the organisational causes of the non-compliance, in a way which did not blame individuals. As the OC of the wing noted,

'This comprehensive review found clear examples of violations to approved maintenance procedures and deteriorating maintenance standards, 'consistent with the classic organisational accident model'. In short, the review suggests that only good fortune has spared the wing from accident and injury'17.

Here was an information collection process that well and truly captured the attention not only of the commanding officer of the maintenance organisation, but also his superiors. Indeed the report received wide circulation within the Air Force and successfully highlighted problems that went way beyond the squadron reviewed.

Some conclusions

A major distinction is sometimes drawn between audits, on the one hand, and surveys or reviews, on the other. According to the Director of Flying Safety, a review is white hat, an audit is black hat, meaning that a review tries to assist, while an audit has something of a policing function18. Another view expressed to us is that audits evaluate against set criteria, while reviews evaluate the criteria as well19. It should be noted that many professional auditors subscribe to this latter view20.

These distinctions do not seem to capture the important differences in the information gathering activities described above. The OHS audits and environmental health surveys stand in dramatic contrast to the other audit/reviews.

The former were internal (to the base); they were poorly resourced, being conducted by a single, relatively low ranking individual; they had low visibility and low priority; and they were intended to be routine procedures (although in practice they did not occur routinely).

The latter were external, conducted by a consultant or by some central Air Force agency remote from the organisation under scrutiny. They were well resourced, conducted by teams, whose members were highly trained and/or high ranking, and they were conducted over several days. Their output was highly visible to the head of the organisation and beyond. They provided something of a jolt to the organisation and could not easily be ignored. They were not a part of the normal routine and therefore not occurrences about which it was possible to become blasť.

We believe that audit/reviews with the latter characteristics are likely to be relatively effective in highlighting problems and ensuring that something is done about them. We understand that the hazardous substances audit/review to be undertaken by DSMA21 should be of this nature.

The Maintenance Safety Health Review carried out by the Directorate of Flying Safety was a departure from the normal DFS accident investigation role. According to the Director it was made possible by the fact that DFS had an engineering officer in the organisation22. We are particularly attracted to the methodology of the maintenance safety health review, and it seems to us that if an industrial hygienist were contracted to DFS for a period, it would be in a position to use its methodology to carry out a review of selected Air Force sites which are dealing with hazardous chemicals. We would think that surface finishing work shops should be high on the list of priorities.

Notwithstanding earlier comments, there is one kind of internal audit we would like to see occurring on an annual basis.

1. 501WG SI(ADMIN)2-13-6, p 6.
2. hrg.0005.001 (at 024) par 27.
3. MAN.0006.001 (at 030) par 163 v.
4. T65,..\Transcripts\Feb28.doc - f.
5. 501WG SI(ADMIN)2-13-6, Annex A.
6. T68, Transcript of Proceedings 28FEB01.
7. T23-24.
8. EXP.0001.001 (at 049).
9. MAN.0002.001 (at 010) par 20.
10. AMB.0026.016.
11. MAN.0002.001 (at 010) par 23.
12. 101.0032.214.
13. T424, Transcript of Proceedings 03APR.
14. HRG.0005.001 (at 025) par 29.
15. T68, Transcipt of Proceedings 28FEB01.
16. T592, Transcript of Proceedings 09APR01.
17. MAN.0029.001, AMB.0174.304, par 3.
18. T588,.Transcript of Proceedings 09APR01.
19. T71.
20. For example, SafetyMAP: Auditing Health and Safety Management Systems, Victorian Workcover Authority, 1997.
21. T571, Transcript of Proceedings 09APR01.
22. T593, Transcript of Proceddings 9APR01.


Chapter 9

Many of the organisational features so far identified as contributing to the exposure of troops to hazardous chemicals are present in other large organisations. However there is one feature of military organisations which has no counterpart in civilian organisations - the command and discipline system. The implications of this system for health and safety will be addressed in this Chapter.

The command and discipline system exists for very good reason 1. Thus, although we shall be identifying ways in which it may have contributed to the problems at Amberley, our recommendations are directed at overcoming the problems which we identify in ways which are consistent with the system.

The threat of disciplinary action

Fuel tank workers worked under the threat of disciplinary action. As one said,

'I recall one of the fellows got his brother who worked in a lab in Melbourne to test it (SR51) and he was told to get out of the Section as quickly as possible. We accepted that opinion rather than the medical opinion, but there was little we could do about it because we were under strict orders. If we asked to be transferred we were told that we had to do our time, which was two years at that stage'2.

Another witness gave the following evidence,

'As a junior tradesman I just did what I was told by my NCO and supervisors. I was constantly assured that everything I did with the chemicals was safe and there was no cause for concern. It is my belief that the consequence of not undertaking the tasks that I was given completely would be that I would be subject to contact counseling (that is I would be taken out the back and give a clip under the ear). It was just as though it was a requirement for any new member of the unit whenever posted in to do their time in the Deseal/Reseal section. It was a culture within the unit that you could not bring up and raise any concerns and you simply did what you were told or got a kick in the arse'3.

These perceptions were not unfounded. One worker who refused to re-enter the fuel tanks was charged with an offence, convicted and sentenced to seven days detention at Amberley4.

An Air Force review of the maintenance work at Amberley in 1979 expressed some concern about this situation:

'In winter this is cold, cheerless, obnoxious and very demanding work…Several psychological problems have already emerged among airmen engaged in this extremely unpopular, but necessary work. There should be no need to reiterate the importance that the nation places on this work and neither is there any reason to doubt the motivation of those employed on it. But when considering the conditions under which they work, for peacetime, it could be argued that their loyalty is being unreasonably tested'5.

The Board has no evidence of disciplinary action being taken in more recent years to compel people to work in the fuel tank repair section, but the threat is always there if they refuse. It is the nature of the service that people are posted to the fuel tank repair section with little option of declining the job.

The risks of compulsion

Relying on compulsion to ensure that unpleasant work is done increases the risk to health and safety in various ways, and potentially undermines the command and discipline system.

One risk is that legitimate concerns which workers may have about their health and safety will be over-ridden on the grounds that they are merely objecting to the unpleasant nature of the work. This point is well illustrated by the first reseal program. The Air Force had received assurances that SR51 was safe, provided appropriate PPE was used. Further specific assurances were provided that the atrocious smell of SR51 implied nothing about its toxicity6. But consider this testimony from one worker:

'The chemical smell got into your skin and I recall I would finish work, go home and have three hot and cold showers to try and get rid of the smell. Even when you went to bed you sweated it out and it got onto the bedclothes. I was living on Base at the time and the bedclothes were only changed once a week. We were not allowed into the Mess, boozer or cinema because of the smell'7.

The fact that workers smelt after they left work is evidence that they were not being protected by their PPE, but this fact does not seem to have registered. The end result was that workers were compelled to work in circumstances which were hazardous to their health.

There are real dilemmas in this situation. Consider the case of a worker who complains that protective equipment is hot and uncomfortable. If such a worker declines to wear the equipment, is this a case of defying a command or is it a legitimate response to a heat hazard? And if it is judged to be merely a case of rebelliousness, does this judgement alter if the worker begins to complain that the heat is causing dizziness or headaches? Clearly, there are no easy answers.

A further risk is that people who are objecting to doing particularly unpleasant work because it is affecting their psychological health will be punished for their presumed rebelliousness. The worker sentenced to seven days in the cells was subsequently recommended for transfer by a senior psychologist, 'for the sake of his psychological health'8. The judgement of whether a worker is manifesting rebelliousness, deserving of punishment, or psychological ill-health, deserving of a compassionate response, is to some extent a matter of perspective, and the dilemma of how to treat such a person is probably inherent in the military command system.

Air Force workers are loyal to the organisation they serve and it was evident to the Board that they recognised that there are unpleasant jobs that have to be done. But using the discipline system to over-ride grievances has the potential to undermine this loyalty and even, in extreme circumstances, to provoke mutiny9.

The Air Force review which expressed such concern about the predicament of the fuel tank repair workers in 1979 suggested that 'substantial incentives should be approved if future morale, administrative and management problems are to be avoided'10.

We would like to elaborate this suggestion. There are various areas of work in the military which people apply for; no one is simply posted. Navy clearance diving work is an example, which we mention because it has some similarities with fuel tank repair work: workers must wear protective equipment and rely on air-supplied breathing apparatus. Recruits are slowly introduced to the experience of diving and those who feel they cannot cope are free to opt out.

If the incentives for fuel tank work were sufficient there would be no shortage of volunteers. Those who discovered they were unsuited to the work, for psychological or any other reasons would then be able to opt out, without the need for psychological testing to determine the legitimacy of their complaints.

The additional incentives would no doubt add considerably to the cost of the program. One advantage of this might be to tip the balance in favour of a solution to the fuel tank repair problem lying further up the hierarchy of controls.

Unions and the employee empowerment provisions of the OHS Act

There is a tension between the Australian military command and discipline system and some aspects of the Commonwealth's occupational health and safety system. The legitimacy of both systems comes from the Australian Parliament and both have broad community support. In this section we identify the incompatibilities (legitimate in themselves) and look at ways in which the Air Force can compensate for the unavailabilty of certain provisions of the occupational health and safety legislation without compromise to the command and discipline system.

In civilian employment workers can act in combination to assert their interests in ways which may bring them into conflict with employers. In the Australian military environment, however, such collective action is unacceptable; commanders cannot be expected to bargain with lower ranks in order to achieve compliance with their orders.

As a consequence, the Chief of the Defence Force has declared that certain sections of the Occupational Health and Safety (Commonwealth Employment) Act 1991 do not apply to members of the military11. These sections refer to worker health and safety representative (HSRs) and health and safety committees.

HSRs are elected by groups of workers and they are provided with powers under the Act, among them the power to issue provisional improvement notices. These notices can require employers to take action to deal with contraventions or hazardous situations. However, the employer may call in a government inspector to adjudicate, in the event that the notice is disputed. The aim of this provision is to empower workers to take action, against employer resistance, in relation to health and safety matters, and it is prima facie inconsistent with the military command system.

Health and safety committees are required under the Act to consist of members who represent the interests of employees and members who represent the interests of management. Again this involves an implicit empowerment of employees vis-a-vis management and is prima facie inconsistent with the military command system.

Accordingly, Defence has formally declared that these sections of the Act 'are incompatible with the military command and discipline system'12.

There is evidence that OHS representatives have beneficial effects on health and safety. A study in the US demonstrates that when worker representatives complain to the regulatory agency about an OHS problem, and the agency responds by inspecting the plant, accident rates subsequently decline13. There is evidence, too, that health and safety committees, consisting of worker and management representatives, are effective in certain circumstances14.

The effectiveness of HSRs and worker/management health and safety committees is closely related to whether or not unions are active in the workplace15. Unions empower both HSRs and worker representatives on committees to assert themselves, without fear of retaliation by the employer. Indeed, in unionised workplaces HSRs are sometimes considerably more effective than company OHS officers who are often low in company hierarchies and unable to exercise much leverage16.

There is one feature of unionised workplaces which provides them with a big advantage over non-unionised workplaces and that is that they have access to union OHS professionals. Such people have the expertise to question a company's judgments about health and safety and can force companies to face the issues fairly and squarely17.

Finally, it should be noted that unions operate as advocates on behalf of their members whose health has been affected by their work. Fuel tank repair workers whose health has been affected have had no such champion. According to one, an advocate to help with making compensation claims would be most advantageous18.

The Defence Force recognises, of course, that removing the apparatus of worker empowerment from the legislation as it applies to the military deprives employees of one of their protections. The policy position is, therefore, that

'The basic intent of those aspects of the OHS Act is achievable in the ADF in ways that are more compatible with the military command and discipline system and which reflect both the authority, and the responsibility for the health and welfare of subordinates implicit in the function of command'19.

The Air Force has sought to implement this policy by setting up a system of safety committees which parallels the system envisaged in the Act but which sees employees as advising and assisting commanders, not negotiating or bargaining with them. Whereas the Act provides that the procedure at meetings should be determined by the committee, and this may mean that the chair alternates between employer and employee representatives, in the Air Force the chair must be the commander/manager.

Moreover, Air Force policy defines each work group as a 'safety improvement team', with the NCO in charge of the group defined as a safety improvement team leader (SITL) 20. The SITL is seen in the Air Force as the rough equivalent of the Health and Safety Representative envisaged in the Act.

This structure does indeed parallel that laid out in the Act. But it differs in that it is part of the chain of command, rather than standing in some sense outside of it, as the Act envisages. In particular, the SITL is simply the NCO in charge of the section, not an employee representative empowered to take independent action.

This is an important difference. As we saw in a previous Chapter, the chain of command is far from perfect in dealing with OHS issues and we have made numerous recommendations designed to improve it. The structure of employee representation envisaged in the Act can be viewed as yet another way of augmenting the chain of command and increasing the likelihood that health and safety issues will be properly attended to. But the Air Force system means that if the chain of command is failing to attend appropriately to health and safety, so too will the system of committees and SITLs, because they are part of that fallible chain21.

This is precisely what seems to have happened at Amberley. During the period of the spray seal program, the fuel tank repair section did not meet as a safety improvement team and the Sergeant in charge of the program did not know that he was a safety improvement team leader. He was unaware of any OHS committee structure within the squadron and noted that 'this structure, from the view of those of us working at FTRS, did not function at all'22.

The fuel tank repair section was part of a larger grouping, the aircraft maintenance flight. This was supposed to have regular meetings of SITLs, but the last meeting of this group prior to the suspension of the spray seal program was held in May 1998, 20 months before the suspension23. It is notable that this meeting was not attended by the officer in charge of the flight; in fact no commissioned officer attended24.

The declaration that employee empowerment provisions of the Act do not apply to Defence places on it a special responsibility to provide some alternative system, but at Amberley that alternative system appears to have failed; certainly it failed to protect the health of fuel tank repair workers.

Part of the reason for this failure is that the SITL was a secondary appointment, that is, NCOs were given the SITL role in addition to their primary supervisory role. In practice this meant that safety improvement team leaders had little time to devote to their safety functions25.

Furthermore, because SITLs were at Sergeant level or above, they were somewhat removed from the hangar floor. This meant that they were not in a position to see things in the way that Corporals and leading aircraftmen and women might, and would not necessarily enjoy the confidence of junior ranks in the way that an elected health and safety representative might be expected to. Nor were they exposed to the hazards of the work process to the extent that the more junior ranks were. In both these respects, SITLs were not the equivalent of health and safety representatives, and this detracted from their ability to raise issues from the hangar floor.

We propose that the following steps be taken to eliminate some of the weaknesses identified above:

The OHS safety management structure at Amberley was located in the quality management system. This meant that OHS matters were reported through the Wing Quality Steering Group, chaired by the Officer Commanding the Wing. This was his only direct contact with the OHS safety management structure. However, because of the pressure of work the Quality Steering Group lapsed in 1999, 26 further undermining the safety management system. Finally, the fact that wing/squadron/unit safety meetings were not being held was not picked up in any monitoring process.

The 'no blame' approach and the maintenance of discipline

The traditional reaction of military organisations following safety failures is to hold an inquiry with the aim of seeing whether anyone is to blame. According to a Navy witness who gave evidence to the Board,

'This created a culture of punishment, where the essential theme was to identify and then to apportion blame, frequently to the last person in the chain of events. The underlying principle is that the threat of punishment influences Navy and individual behaviour to the extent that safety gains a higher priority'27.

However, a vital aspect of contemporary safety management is to encourage the reporting of near miss events and even violations of regulations which compromise safety, as was stressed in an earlier Chapter. Both Navy and Air Force (the Directorate of Flying Safety) are now giving prominence to the reporting of such incidents to facilitate organisational learning. A culture of blame suppresses reporting and makes such learning impossible. Both Navy and Air Force are therefore stressing the need for a no blame culture if reporting is to be encouraged.

This raises the question of whether a no blame culture is consistent with the military discipline system. The Directorate of Flying Safety (DFS) has wrestled with this question and concluded that within a general no blame reporting culture there is still the possibility, indeed the desirability of taking disciplinary action for certain kinds of violations. Drawing on reason28, DFS advocates a 'substitution test',

'Is it likely that someone with the same training, experience etc would have made the same mistake (or violated procedures in the same way) given similar circumstances? If the answer is yes, the issue is more organisational/systemic, and therefore personal punishment is unlikely to be effective'29.

One implication of this principle is worth drawing out. The question is not simply whether a violation was deliberate or inadvertent. A violation may have been deliberate, but if others would have been likely to violate procedures in the same way, the violation should be regarded as system-induced and therefore not warranting punishment. Thus, if a worker takes a short cut in order to get the job done, and others are doing likewise, the substitution test requires that this be seen as a systemic matter. Again, if a worker fails to wear PPE, despite being instructed to, and others do likewise, the substitution test points to a systemic problem - the uncomfortable nature of the PPE, time constraints and so on.

At this point there is a striking and important convergence in approach with the discipline system. The Discipline Act provides30 that where a charge of negligent performance of duty arises, a service tribunal, in deciding whether the member behaved negligently, has regard to the standard of care of a reasonable person, which is assessed by having regard to the standard of care that would have been exercised by a reasonable person who was a member of the Defence Force with the same training and experience in the conduct which gave rise to the charge and engaging in the same conduct.

The Defence Force in its recently promulgated Prosecution Policy31 is sensitive to these issues and enables a prosecutor to take into account in effect the substitution test. It is also appropriate for the prosecutor to take into account whether disciplinary proceedings will have an adverse effect on the morale of a unit or are not in the interests of the service.

Developments in the discipline system are occurring and consideration is being given to the establishment of a director of Military Prosecutions. Although a controversial issue, for reasons not relevant here, it would assist in achieving uniformity in the exercise of the prosecutorial discretion just described. Also under consideration is a proposal to enable Service Tribunals to find an offence proved but not to impose a conviction, in special and extenuating circumstances. This is a power which has great utility in civil jurisdictions. The diversion of cases away from the military justice system by Disciplinary Officers is also a new tool which has proved effective. It is likely also that better (electronic) systems of tracking proceedings will be introduced. This is in line with the civil courts where the status of cases and their progress has become important management information.

It should be borne in mind that the Defence Force Discipline Act is not the only avenue available. It is also possible to take administrative action in cases of professional failure32, and health and safety matters might well be construed in this way. Administrative action in the Air Force might involve formal counselling, followed if necessary by a Unit Formal Warning by the CO33. Of course in more serious cases resort may need to be had to disciplinary procedures under the DFDA. All these options may be viewed as strengthening the chain of command.

In summary, concurrent with the development of the 'no blame' approach has been a recognition by the Defence Force that there are many circumstances where transgressions occur where it is inappropriate to prosecute. Policies are still being developed in this regard. We conclude that, properly managed, these systems ought to operate harmoniously. It is essential that they do. Reconciliation can be achieved because the 'no blame' approach and the discipline system serve a common objective. For example, avoiding hazarding ships and aircraft is a primary goal of safety organisations and the object of a specific section of the Discipline Act. The differences are in method. In this context of considerable change we see the way ahead as carefully monitoring developments to ensure safety policies are working harmoniously with disciplinary policies.

1. See the Joint Standing Committee on Foreign Affairs, Defence and Trade of the Parliament of Australia, Military Justice in the Australian Defence Force.(1999)
2. WIT.0064.001 (at 009), par 41.
3. WIT.0202.001 (at 011), par 31.
4. CBR.007.124.
5. AMB.0080.064 (at 065) par 6.
6. Letter from Dr Chalk, Qld Dept of Health, 29/6/79.
7. WIT.0064.001 (at 008) par 39.
8. Reference suppressed.
9. T. Frame & K. Baker Mutiny (Sydney: Allen and Unwin, 2000).
10. Ibid.
11. Made under section 7 of the Act.
12. DI(AF) PERS 60-10, para 6.
13. J. Scholz & W Gray (1994) Direct democracy within regulatory bureaucracy: can citizen complaints improve OSHA effectiveness?' unpublished paper.
14. J Rees (1988) Reforming the Workplace: A Study of Self-Regulation in Occupational Safety. Philadelphia: University of Pennsylvania Press; S Dawson et al (1988) Safety at Work: The Limits of Self Regulation. Cambridge: CUP.
15. see Rees, op cit and Dawson, op cit.
16. A. Hopkins, Making Safety Work. (Allen and Unwin, Sydney, 1995), p132.
17. See Y. Berger, 'The Hoechst Dispute', M. Quinlan (ed) Work and Health, Melbourne: Macmillan, 1993.
18. T185.
19. DI(AF) PERS 60-10, para 6.
20. This is the terminology used at Amberley. The term SITL has now been replaced by the term safety coordinator in DI(AF) PERS 60-10.
21. The Rough Justice report made a similar point. It noted that the system of equity officers did not work because the equity officers were part of the chain of command and it recommended 'that officers in the direct chain of command and SNCOs responsible for the discipline system in units not be appointed as Equity Officers. The two roles cannot be adequately reconciled.' (p 59).
22. MAN.0006.001 (at 031) pars 163:x,xi, 166.
23. MAN.0005.001 (at 009), par 44.
24. AMB.0116.075.
25. MAN.0007.001 (at 004), par 18.
26. HRG.0005.001 (at 024) par 27.
27. MAN.0023.001at par 9.
28. J. Reason, Managing the Risks of Organisational Accidents, (Aldershot: Ashgate, 1997), p208-9.
29. Maintenance Feedback, April 2000, p9.
30. S.11(2).
31. DI(G) PERS 45-4.
32. see Military Justice in the Australian Defence Force, 1999, Chapter 5.
33. see DI(AF) PERS 4-19.


Chapter 10

Two contrasting views can be discerned in the literature about how safety is to be achieved in large organisations. The first view is that organisations must strive to perfect their safety management systems 1. Critics however argue that state-of-the-art safety management systems are not a panacea because they encourage a mechanistic belief that safety is assured once the system is set up2.

The Longford gas plant accident near Melbourne in 1998 is testimony to the fallibility of systems. Esso had in place Exxon's acclaimed Operations Integrity Management System (OIMS) which had, moreover, been audited just six months prior to the explosion and found to be functioning well. However, the Royal Commission was extremely critical of this system.

'OIMS, together with all the supporting manuals, comprised a complex management system. It was repetitive, circular, and contained unnecessary cross-referencing. Much of its language was impenetrable. These characteristics made the system difficult to comprehend by management and by operations personnel'.

'The Commission gained the distinct impression that there was a tendency for the administration of OIMS to take on a life of its own, divorced from operations in the field. Indeed it seemed that in some respects, concentration upon the development and maintenance of the system diverted attention from what was actually happening in the practical functioning of the plants at Longford

The Board finds similar characteristics in the Air Force and Defence policies and manuals.

The second view starts from the recognition that systems are never perfect, that things frequently go wrong, and that the most important requirement for safety is that organisations are mindful of the possibility of failure and learn from mistakes, incidents and near misses. The second view, then, is that safety is best achieved by striving to become a learning organisation4.

Of course, a systems approach is not incompatible with organisational learning; a safety management system should include the capacity to learn, and lessons learnt may include the need to improve the system. The distinction, therefore, is really a matter of where the emphasis is placed. Nevertheless it is a useful distinction. Research highlights the failure of organisations to learn from their own experiences and those of others as a fundamental cause of accidents5. This Chapter therefore focuses on the need to promote organisational learning as the most effective way to achieve safe and healthy workplaces.

Criticisms of the ADF Safety Management System

The view that safety depends on perfecting safety management systems was much in evidence at the Inquiry. Various witnesses identified particular deficiencies in the ADO's safety management system, and appeared to be suggesting that these contributed to the failure of management to recognise and respond to problems in the fuel tank repair section prior to 2000. According to the OC of the maintenance wing at Amberley,

'Whilst we have a number of fragmented procedures we don't have a system. Whilst we have a number of people out in the field doing very good work, they don't fit within the system'6.

The Wing OHS officer echoed this theme:

'There is a lack of corporate guidance on AS/NZS4804 development and implementation of an OHS system and DOHSMAN policies. There is no corporate guidance for integrating the OHS system with other business systems…' 7.

The Director of the Defence Safety Management Agency (DSMA) responded to these criticisms saying that DSMA was working hard to develop the system and eliminate inconsistencies8.

However the Board is not convinced that deficiencies in the safety management system were as critical as these comments imply. The presumption appears to be that if the ADO had perfected its system, the problems experienced by the F111 fuel tank workers would not have occurred, and conversely, that a defective system makes such problems almost inevitable. In our view, this presumption displays an over-reliance on OHS systems. It suggests that senior management is helpless in the face of an inadequate OHS system and is perhaps, an example of the 'learned helplessness' about which the Secretary of Defence has spoken9. Our analysis is that the fundamental failures lay in the chain of command and many of our recommendations are aimed at rectifying these weaknesses by augmenting the flow of information and ensuring better supervision.

The central health and safety agencies

Experience shows that large organisations need to maintain centralised control of safety, no matter how decentralised they are in other respects10. They must therefore have appropriate central agencies to direct the management of safety. The OC of the Amberley maintenance wing drew attention to this point when he noted that: 'there appears to be no ADF organisation with overall responsibility for the entire OHS management system'11.

During the course of the Inquiry, the Air Force announced the formation of a new Ground Safety Agency. The reorganisations of recent years had reinforced the Air Force's focus on flying safety but left it without any organisation specifically concerned with ground safety; the new agency rectifies that omission.

There are now three agencies specifically concerned with safety in the Air Force; the Ground Safety Agency, the Directorate of Flying Safety and the Directorate General of Technical Airworthiness. The Board heard evidence from a Navy witness that all safety functions in his service are combined in a single agency - the Certification, Safety and Acceptance Agency12. We have not developed a view on whether such a model might be desirable for Air Force. We note that DFS and DGTA appear very successful and competent at what they do. We are conscious, however, that we have suggested that the Directorate of Flying Safety become more involved in ground safety, specifically in relation to aircraft maintenance practices, and we would not want to see DFS forced to reject this suggestion on the grounds that it lies outside its brief.

The Defence Safety Management Agency is another organisation on the Defence safety landscape. DSMA is of very recent origin and its role is currently developing.

Finally, we note the existence of the Joint Health Support Agency, which coordinates Defence medical policy. According to its director, this organisation is not adequately resourced to deal with occupational health or preventive medicine. He argues that in the recent reorganisations of the central Defence agencies concerned with health and safety, occupational health has fallen through the cracks13. Our findings in Chapter 2 strongly support this view and we have already recommended greater resourcing for occupational medicine.

Whether it is good strategy or simply confusing to distribute health and safety across so many organisations is not something we feel able to make a judgement about. It is clearly a matter which should be kept under review.

There is one matter, however, on which we do have a view at this stage. We wish it to be understood that the following comments are about structural arrangements and are not intended as a reflection on any individuals. The new Air Force Ground Safety Agency is headed by an acting Wing Commander. The Directorate of Flying Safety is headed by a Group Captain. We are concerned that this perpetuates the priority of air over ground safety.

There is a further important aspect to this question. The present head of the flying safety agency has commanded a flying wing. This means that he can speak with authority to pilots and their commanding officers. The present head of the ground safety agency, however, is an environmental health expert with no experience as a commanding officer. He must therefore approach the commanding officers of maintenance wings, not as one of them, but to some extent as an outsider. In a sense he must seek to inject OHS from the outside while the director of flying safety can develop it from within. Since our recommendations include integrating safety into the engineering framework we believe this would be better done by a director with extensive experience in maintenance. Such a person should, of course, be able to call on the expertise of environmental health specialists within the organisation. This strategy would make it more likely that OHS would become an integral part of the engineering processes, rather than a tenuous add-on. We suspect that the Air Force would not consider appointing as Director of Flying Safety someone who was an expert in human factors but not an accomplished pilot, even though much of the work which DFS does involves human factor analysis. By the same principle, it is more important that the head of the ground safety agency be a senior engineer than an OHS expert. The excellent work done by Wing Commander Secker, an engineer, in developing tank entry procedures for the F111 demonstrates how viable this approach is.

Promoting organisational learning

The Directorate of Flying Safety is spearheading organisational learning within the Air Force. One way in which it is does this is via its accident investigation methodology which identifies the organisational defects which gave rise to the accident. Its application of this model in the maintenance safety health review provides an excellent example of organisational learning. The other mechanism of organisational learning which DFS has championed is the Aviation Safety Occurrence Reporting system, which is aimed at preventing disasters by learning from small events.

There are other areas within ADO which are also promoting this kind of learning. DSMA is encouraging injury reporting so that patterns can be identified and lessons learnt. The Navy has recently developed an OHS Incident Reporting system which has already facilitated some important learning14. Perhaps the most dramatic example of organisational learning provided to the Board was the Navy's realisation following the fire on HMAS Westralia in 1998 that it needed to overhaul the way safety was managed, leading it to set up a the Navy Certification, Safety and Accreditation Agency, modeled in part on the Air Force's Directorate General of Technical Airworthiness (DGTA) 15. DGTA itself was a response to lessons learnt by the Air Force from aircraft crashes in the late 1980s, as was the system of Airworthiness Boards.

In contrast, based on the evidence available to the Board, the Air Force has shown a striking inability to learn when it comes to ground safety. Over many years workers from the fuel tank repair section have reported to base medical with symptoms of chemical poisoning but until 2000 Air Force as a whole seemed unable to draw the conclusion that something was wrong. Moreover, workers frequently complained about problems associated with PPE but these complaints failed to register effectively. Finally surveys done from time to time in the fuel tank repair section revealed stubbornly persistent problems concerning PPE, but the recommendations from these surveys did not achieve high visibility and were not effectively implemented. This is why, in earlier Chapters, we have made recommendations about developing effective occurrence reporting systems and carrying out occasional high powered audits/reviews which include mechanisms to check on whether recommendations are implemented. Such strategies will improve the capacity of the Air Force to recognise what is going wrong and to act effectively.

The most striking instance of failure to learn which we have come across concerns the 1981 Air Force working party report on surface finishers. This report contained recommendations directly relevant to the fuel tank repair workers, which were nevertheless not implemented with respect to fuel tank workers, even though they worked in the same unit as the surface finishers. Indeed the working party itself drew attention to the applicability of its findings to F111 fuel tank repair workers. It noted that:

'F111 deseal/reseal and storage areas, involve material and working conditions which present occupational safety and health hazards… the working party recommends that most of the comments made in this report should also be addressed to all areas in the RAAF where toxic or hazardous materials are being used'16.

It is clear that this recommendation was not effectively implemented. In short the Air Force failed to learn from the experience of surface finishers and to recognise that F111 fuel tank repair workers were similarly at risk.

More than this, we have already noted other aspects of the report which were not implemented and we suspect that many of the recommendations of the working party may have been effectively ignored. One outcome of the report was an instruction from the Air Force Support Command that OHS be taken into account systematically in the selection of new engineering equipment and chemicals17, but this instruction was not effectively implemented.

It is clear to us that the non-implementation of recommendations (and even instructions) with respect to toxic chemicals is a pervasive problem in the Air Force. We believe that it would be salutary for the Air Force to confront this problem. Accordingly we make the following recommendation.

To understand why recommendations languish and to discover ways in which implementation could be made more certain would be one of the most important pieces of learning the Air Force could do.

Given the fate which appears to have befallen the recommendations of the surface finishers working party, we worry that the same fate may befall our own recommendations. It seems therefore desirable to suggest that progress in implementing this report be reviewed at some future point. Progress on the implementation of the surface finisher recommendations was reviewed one year after the report was submitted18. That proved too soon to establish the outcome of many important recommendations.

The recommendations of the Maintenance Safety Health Review provide another opportunity to develop the Air Force's capacity to learn. The recommendations of that Review were largely directed to the squadron in question. But they have clear relevance to other squadrons. Learning organisations learn not only from their own experience but also from the experience of relevant others.

One lesson that emerges from both the surface finishers working party and from the MSH Review is the need to set and enforce time limits for certain kinds of work. The same lesson emerges from this Inquiry. The Air Force has adopted this principle in relation to flying safety but it has not applied it on the ground. It must learn from its experience in this matter.

One way in which an organisation can learn is to seek information from comparable organisations. We are aware of ways in which the services learn from each other in Australia. But there seem to have been some conspicuous failures to learn from other flying organisations. The experience of the reseal programs in the USAF was not monitored on a regular basis and the results of the USAF industrial hygiene survey in 1995 appear to have been unknown to the RAAF. Moreover, we suspect the Air Force could learn more from civilian organisations like Qantas and Ansett, particularly, in relation to the use of solvents.

The Defence Safety Management Agency is developing measures by which it can assess ADO groups, against each other, in terms of progress they have made in developing safety management systems19. This is based on the very sound principle that what gets measured gets managed20.

To conclude, the Air Force has been much better at learning in matters of air safety than it has in matters of ground safety, reflecting the imbalance that has been one of the themes of this report. On matters of ground safety it has suffered from something of a learning disability. In his book on learning organisations, Senge observes that

' Learning disabilities are tragic in children, but they are fatal in organisations. Because of them, few corporations live even half as long as the person'21.

The learning disabilities under discussion are not likely to prove fatal to the Air Force. They do, however, have tragic and potentially fatal consequences for personnel such as the fuel tank repair workers.

The Air Force must find ways to capture information about what is going wrong and transmit it up the hierarchy to people who are in a position to act on it responsibly and effectively. Moreover, it must find ways to ensure that the recommendations of its surveys, reviews and inquiries are implemented. Otherwise it will be doomed to be forever relearning old lessons.

1. See Safety in Australia, Vol 23, No. 3, December 2000; N. Gunningham and R. Johnstone, Regulating Workplace Safety (Oxford: OUP, 1999).
2. Weekend Australian, 3/7/99.
3. Dawson, op cit, 13.39-40.
4. P. Senge, The Fifth Discipline: The Art and Practice of the Learning Organisation (London: Century Press, 1990).
5. For example, A. Hale, B Wilpert & M. Freitag, After the Event: From Accident to Organisational Learning, (Oxford: Pergamon, 1997); B Turner, Man-Made Disasters, Oxford: Butterworth-Heinemann, 1997).
6. T70, Transcript of Proceedings 28FEB01.
7. MAN.007.001 (at 0015) par 57.
8. T564, Transcript Of Proceedings 09APR01.
9. T432, Transcript of Proceedins 03APR01.
10. M. Barram 'Process management and the implications of organisational change'. Pp191-206 n A Hale & M Baram (eds) Safety Management: The Challenge of Change (Oxford: Pergamon, 1998); J. Prescott, A matter of safety, BHP Review Vol 72 (1994), No 1.
11. T70, Transcript of Proceedings 28FEB01.
12. T675, Transcript of Proceedings 09MAY01.
13. T576, Transcript of Proceedings 09APR01.
14. T674, Transcript of Proceedings 09MAY01, T675; MAN.0023.001.
15. MAN.0023.001.
16. AMB.0063.099 (at 121) par 70.
17. LAV.0031.127 (at 128).
18. AMB.0068.113.
19. MAN.0019.001 (at 037), annexure 5.
20. P. F. Drucker, Management : tasks, responsibilities, practices (London : Heinemann, 1974).
21. P. Senge, The Fifth Discipline: The Art and Practice of the Learning Organisation (London: Century Press, 1990).


Chapter 11

This report has identified a wide array of factors which, acting together over many years, have resulted in long term health problems for hundreds of Air Force workers. The aim of this Chapter is to lay out in a more systematic way our conclusions about how this network of causes has operated. We do so in the diagram at the end of this Chapter. Circumstances have varied over the more than 20 years of reseal programs and it is not possible to summarise these circumstances in a single causal diagram. The diagram is therefore applicable in its entirety only to the recent, spray seal program; much of it, however, is also relevant to the earlier programs.

The diagram is premised on the idea that the network of causes contributing to any event is in principle infinite and that the aim of any thoroughgoing causal analysis must be to lay out as many of the connections as possible. In some respects the analysis is a form of root cause analysis, except that most root cause analyses implicitly assume an ultimate cause or causes 1 ; no such presumption operates here. Our analysis also has a lot in common with Reason's organisational accident model2 which seeks to identify latent factors within the organisation which contributed to the accident. This analysis is broader in that it looks at the culture of the whole organisation, as well as factors which lie beyond the organisation in question3 .

The diagram is divided into a series of levels. There is a certain amount of arbitrariness in the division into six discrete levels, but the basic principle is - the more remote the cause, the higher up the diagram it is located.

At the bottom are the outcomes - damage to the health of Air Force workers leading to suspension of the spray seal program and consequent reduction in the availability of F111 aircraft. Next level up are the immediate causes. Above that are the organisational causes, to do with the way the Air Force as an organisation functions. Above that we have identified a number of Air Force values which account for many of the factors at the organisational level. Finally there are two levels, government and society, both beyond the Air Force and over which the Air Force therefore has no control.
In what follows we describe the contribution of some of the causal pathways to the outcome, proceeding from the bottom of the diagram upwards. In the process we shall be providing a summary of main findings of this report.

The Air Force medical service

Shortly after the beginning of the spray seal program, workers began to suffer symptoms of chemical exposure. As described in Chapter 2, despite reports of these symptoms, the seriousness of the problem was not recognised or responded to effectively, until the beginning of 2000. We attributed this failure to aspects of Air Force organisation, in particular the low priority given to occupational medicine in comparison with the health needs of the aircrew, which itself reflects fundamental Air Force values. Another contributing organisational factor was the employment of doctors on contracts which confined them to the Medical Section, preventing them from examining the occupational context of the patients they treated. There was also the related problem of under-resourcing. Finally, we noted the preference of the medical profession for signs visible to the external observer rather than symptoms reported by patients, leading to a tendency to ignore reports of symptoms when tests proved negative. This factor is entirely external to the Air Force and we have therefore located it at the top of the diagram.

The relative powerlessness of maintenance workers

A second factor identified in the diagram as an immediate cause is the relative powerlessness of maintenance workers. They did complain about deficiencies in the PPE and more particularly about the symptoms which they suffered, but when these complaints were effectively ignored there appeared to be nothing for it but to accept the situation and get on with the job. The diagram depicts this relative powerlessness as stemming from the absence of any union organisation and the related absence of employee empowerment provision in the OHS Act, which in turn is a consequence of the value which the military necessarily places on command and discipline. Fuel tank workers had no independent health and safety representative who might have taken the matter to the government regulator and no union to which they might have complained. Unionised workers who believe their employer is jeopardising their health can take industrial action, but the military command and discipline system makes such collective resistance illegitimate.

Reliance on PPE

At the level of immediate causes, exposure to toxic chemicals was the main focus of the Inquiry. There are several factors which contributed to this exposure and we start with the causal pathway on the left of the diagram. Exposure was only possible because the Air Force was relying totally on PPE to protect its workers from the many hazards involved in working with toxic substances in confined spaces. This reliance reflected an insufficient commitment to the hierarchy of controls. Greater commitment to the hierarchy of controls would have seen greater efforts to find engineering solutions to the problem of fuel tank leaks and/or greater efforts to find non toxic substances with which to do the job. A greater commitment to the hierarchy of controls would also have seen more attention paid to the recommendations of the working party on surface finishers and greater focus on the incorporation of OHS concerns into engineering design.

The absence of this commitment stems in part from the tendency in the military to put platforms before people, a tendency which the Secretary for Defence is seeking to reverse. It stems, too, we believe from the absence of a high status ground safety agency which would have pushed the Air Force towards a greater commitment to the hierarchy of controls and championed the inclusion of OHS in engineering design. Given the existence of a high status flying safety agency, the absence of a comparable ground safety agency is a reflection of the relatively low priority which the Air Force has given to ground safety in the past.

We have located the source of Air Force's greater concern about air safety than ground safety outside the Air Force itself in the public concern about air crashes. There has been no similar public concern about ground safety, although perhaps the build up of concern which led to this Inquiry may begin to restore the balance.

Problems with PPE

Given the reliance on PPE, problems with PPE became another factor which contributed to the exposure of fuel tank workers to toxic chemicals. A wide array of problems was canvassed earlier, some of which led to a failure of workers to wear PPE and some of which meant that workers were not adequately protected even when they did wear it. These problems stemmed in part from the absence of OHS in the design approval process. Other organisational factors which contributed to the problems with PPE were the inadequate processes of audit and review which might have been expect to pick up some of these matters, and the inadequate implementation of previous reports, both internal environmental surveys and other reports such as that by the working party on surface finishers.

One organisational failure which allowed problems with PPE to remain unresolved was the failure to use the incident and or hazard reporting systems to highlight these problems. This contrasts strikingly with the way occurrences are reported through the Aviation Safety Occurrence Reporting system, even occurrences concerning the failure of PPE, reflecting yet again the higher priority which air safety has in the Air Force value system.

The limitations of the chain of command

A final factor contributing to exposure was the failure of the chain of command to operate optimally. At the lowest level of the chain, non-commissioned officers put up with a variety of inadequacies in PPE and as well as other equipment failures and ventilation problems, without raising these matters effectively through the chain of command, or in some other way. They did so in part because of the pressure which they perceived operational requirements placing on them to get the job done as quickly as possible, which resulted in a well-intentioned but inappropriate can-do response. They also often failed to take matters higher because of the expectation that they resolve things at their level as far as possible.

There was a particular weak link in the chain of command between the senior NCOs and the junior engineering officers, and there was limited communication between these two levels. Part of the reason for this was the very broad span of responsibilities which junior engineering officers were expected to shoulder. This in turn was a consequence of reductions in their numbers as part of a general downsizing. Senior officers, too, were suffering extreme work overload as a result of being expected to carry out market testing (outsourcing) functions as well as their normal supervisory functions. The result was that senior officers had relatively little conception of what was occurring on the hangar floor. These weaknesses at the upper levels of the chain of command stem fairly directly from government policy decisions lying largely outside the control of the Air Force.

In some respects the failure of the chain of command is the most fundamental of all the failures we have discussed, and many of our recommendations are aimed at strengthening and augmenting the chain of command in various ways.


This discussion takes the causal analysis back to basic Air Force values and, beyond that, to government policy and social attitudes. It is important to do so since it shows that resolving the problems in Air Force management of OHS will not be easy. The problems are deeply rooted in Air Force culture and in the wider society. What is needed is cultural change. Only then will the Air Force be able to broaden the organisational learning skills, which it has demonstrated so conspicuously with respect to air safety, to encompass ground safety as well.

1. See for example, BHP's Incident Investigation Guide, March 1, 2000, p29.
2. Reason, op.cit.
3. Most organisational accident models are designed to explain a single accident, that is, a single event. What is to be explained here is damage to the health of a number of workers over a period of years. This involves a multitude of events. Where there is a single event to be explained, arrows in a causal diagram can represent 'but for' causes - but for one thing, another would not have happened, or probably not have happened. Such precision is not possible in the present case and the arrows should be understood as meaning 'contributed to', a deliberately vaguer concept. For further discussion of the assumptions of this model see, A. Hopkins, Lessons from Longford: The Esso Gas Plant Explosion, (Sydney: CCH) chap 10.



Board Biographies

1.1.           Commodore K. V. Taylor AM, RFD, RANR, the Board President, was appointed a Deputy Judge Advocate General in 1998. He joined the Naval Reserve, aged 19, as a recruit seaman while studying Arts/Law at Sydney University. He saw active service in HMAS Sydney during the Vietnam War. Subsequently, he commanded HMA Ships Advance and Fremantle. He has also commanded the Sydney Port Division of the Naval Reserve. Between 1992 and 1996 he was Director General of the Naval Reserve. As a Reserve Legal Officer he has extensive experience in boards of inquiry and disciplinary proceedings as counsel and a judge advocate. After practising for 20 years, as a solicitor then barrister in New South Wales, Commodore Taylor was appointed a judge of the District Court of NSW in 1991. He is also a Deputy President of the Medical Tribunal of NSW.
1.2.            Group Captain John Clarkson, CSC, Member of the Board of Inquiry appointed 19th July 2000, is a currently serving senior RAAF engineer with 33 years experience in aircraft engineering, maintenance and personnel management at a number of RAAF Units. A graduate of the Joint Services Staff College, Canberra, he was Commanding Officer of the Maintenance Squadron at RAAF East Sale from 1990 to 1992. He was Head of the RAAF Technical Trade Restructure in Canberra in 1994. Group Captain Clarkson was Director of Personnel Airmen from 1995 to 1997 responsible for airman staffing across the RAAF. From 1998 to 1999 he was the Group Engineer for the Tactical Fighter Group (F/A18 Hornets) at RAAF Williamtown, NSW.
1.3.            Dr Andrew Hopkins, Member of the Board of Inquiry from December 2000, is Associate Professor of Sociology at the Australian National University in Canberra. Dr Hopkins is the author of numerous articles on the management and regulation of occupational health and safety, as well as several books, including: Making Safety Work: Getting Management Commitment to Occupational Health and Safety, Allen and Unwin, Sydney, 1995; Managing Major Hazards: the Lessons of the Moura Mine Disaster, Allen & Unwin, Sydney, 1999; Lessons from Longford: The Esso Gas Plant Explosion, CCH, Sydney, 2000. Dr Hopkins was an expert witness at the Royal Commission into the causes of the fire at Esso's gas plant at Longford in Victoria in 1998. He speaks regularly to industry groups and conferences about the lessons from Longford. He has a BSc(Hons) and an MA from the ANU, and a PhD from the University of Connecticut.

The Terms of Reference

1.4.            Generally, the Terms of Reference required the Board to investigate a full range of activities and circumstances surrounding the Deseal/Reseal programs conducted at Amberley. Essentially, the Board was tasked to inquire into, and determine what happened during those programs, as well as why, and what can be done to prevent recurrence of the apparent incidence of reported adverse effects. The Board has taken into account, as required by those terms, the work of the Deseal/Reseal Investigating Officer, WGCDR S.W. Secker, who also chose to give oral evidence before the Board. A complete copy of the Terms of Reference is attached to this Report at Appendix 2.

Conducting a Public Hearing

1.5.            In the Appointment of the Board of Inquiry, the Chief of Air Force directed the Board to conduct all of its inquiry in public save as to matters of national security, and concerning affected persons. This enabled the Board to introduce transparency into its workings. The Inquiry was the first electronic hearing in the Defence Force. The hearings were conducted in public and as each document was tendered in evidence, including the statements of witnesses who gave evidence, displayed electronically on a large screen to the members of the public and media. Copies of these documents were made available immediately. The Board's Secretary liaised with the media and maintenance workers who required information. The Board also had the able assistance of the Director Defence Public Affairs- South East Queensland, Mr Paul Lineham. A computer linked to the evidentiary database was made available to the media during the hearing. The President gave an outline brief on procedural matters in the week before the oral hearings. The media were also instructed in the Casebook system prior to the hearing. Overall, the reporting in the media (except for one incident of misreporting in the press on the last day) was very good. Complex and emotional issues were fairly reported upon. The tension and anger reported in the days before the hearing and expressed at a public meeting diminished as the hearing proceeded. On conclusion of the hearings a number of the maintenance workers who took a very keen interest in the proceedings expressed their confidence in the Board's processes. The terms of the Appointment made such a result possible. (The Appointment document is at Appendix 2).

The Board's Task

1.6.           It was obvious from the outset that an enormous amount of written material was relevant to answering the Terms of Reference. The Board decided to examine the relevant documentation before embarking on an oral hearing. There has been research into approximately 1.5 million documents covering events over the past 27 years. Some 40,000 documents totalling 151,000 pages have been entered into the Board's data base, Casebook. Statements were taken from 646 people. Members of the public, including concerned former servicemen, were invited to come forward and let the counsel assisting know of any additional relevant evidence or matters. A number did so. The task of identifying and mastering this material, and proofing witnesses, could only be done through a process which crystallised the issues.
1.7.           To facilitate this process, 10 paradigm issues were selected. These issues gave the team identifying and assessing documents, the team interviewing witnesses, and other contributors, a common sense of direction. The resulting information was benchmarked against the current occupational health and safety regime in Air Force. The issues were: 1) Compliance with procedures; 2) Health monitoring; 3) Training; 4) Occupational Health and Safety Audit and Review; 5) Hazardous Substance Management; 6) Workplace Management; 7) Suitability of Procedures; 8) Personal Protective Equipment; 9) Facilities; and 10) Resources. A Discussion Paper was prepared which was made available, in a timely way, to the witnesses and persons potentially affected by the Board's findings. The paper and the process proved successful in generating the true issues (which were more refined than the paradigm issues) and themes such as platforms over people. There were two other benefits from the crystallisation of issues process that should be reported here.
1.8.           First, it became apparent that the recollections of witnesses, subject to the usual human frailties, were remarkably compatible. Expressed in different ways and from different perspectives they built a consistent picture. Accordingly, it was only necessary to call a representative sample of the evidence contained in the statements to give oral evidence. Such evidence was taken over fifteen days. The witnesses were selected at three levels: - ground crew, supervisors, and managers in relation to each of the First Deseal/Reseal Programs, the Wings Program and the Spray Seal Program.
1.9.           Second, crystallising the issues in this way enabled the Board in December 2000, (then comprising the President and GPCAPT Clarkson) to recommend for appointment to it, the most suitable person to contribute to the Board's deliberations as it moved to a position where it could realistically answer the questions what happened, why, and what could be done about it. By then it was clear that systemic forces were at work over a long period which were best addressed by the Board having within it a person with expertise in understanding the management of major hazards and making occupational safety work. The Board identified Dr Hopkins on this basis and he was subsequently appointed to the Board by the Chief of Air Force. This approach is in conformity with the recommendations of the Joint Standing Committee on Foreign Affairs, Defence and Trade to the Parliament in 19991 when considering the composition of board's of inquiry.
1.10.           There is one final matter for comment on the Board's tasking. It was mindful that, except perhaps in an interim way, it could not address urgent issues that affected the Air Force's capability through the continued availability of its F111's. The appointment of the Deseal/Reseal Investigating Officer and the establishment of a connection to his work, through the terms of reference, was a particularly useful way of dealing with the immediate issues. That investigation included the report of WGCDR J.A. Ross (an occupational medicine specialist), into a rudimentary health study of fuel tank maintenance workers with other Amberley personnel in early 2000. Similarly, it was inappropriate for the Board to see through to finality some of the medical issues. These will take some years to resolve through the epidemiological study being conducted by the Department of Veterans Affairs conjointly with the Department of Defence. The Board though, has done the best it can to address these important matters, within the material available to it at this time, and make solid findings.

Affected Persons

1.11.           The rules of natural justice, or procedural fairness, apply to the Inquiry. Among other matters, in this context, these rules require that a person whose interests are likely to be affected prejudicially by a decision of the Board has a right to be heard, at least by being given the opportunity to make submissions in writing, about evidence which might support an adverse finding.
1.12.           On 28 February 2001 the President ruled on an unsuccessful application by Counsel for a potentially affected person to be heard:
  1. 'The breadth of the Board's inquiries will extend over a range of issues and an extensive period of time. The material made available to the Board so far in the form of a discussion paper points to ongoing failings at a managerial level to implement a safe system of work and co-ordinate processes within a complex organisation. The incidence of reported workplace transgressions are numerous and it appears consistent …over a period of some 27 years. The Board's investigation has lead to a preliminary view that much of that which requires close scrutiny concerns systemic issues. At this point it is considered that given many transgressions …. have occurred over a period of 27 years there would be little utility in closely examining all of them particularly as many persons have now left the Service. Such detailed examination would not assist the Tribunal as it understands the issues at this point in considering remedial action, finding out what happened and meeting the other requirements of the Terms of Reference …'

1.13.           The Board concluded that 'at this stage of the proceedings and in the context … outlined … none of the applicants is an affected person'. Accordingly those persons were not given leave to be dealt with as affected persons. Later, when an application was made after the opening of the case for another person to be treated as an affected person, the application was deferred by the Board on the basis that it could be renewed at any time (and in relation to any person) by a member of the affected persons team. No such application was ever made. As a later ruling could have made it difficult for counsel for an affected person to be briefed the Board assigned funds to enable a counsel to appear each day during the hearing to look after the interests of the potentially affected persons.
1.14.           The Board took a conservative approach to the procedural fairness requirement and forwarded draft passages of its report to seven individuals, whose responses were considered by the Board.

Retention of Materials

1.15.           The Board is mindful that the material it has gathered will be of interest to the Commonwealth, in particular the Australian Government Solicitor, and individuals, as its recommendations are addressed, and the foreshadowed compensation claims are brought. Every document has been identified by bar coding and eight CDROMs prepared, storing the whole of the material before the Board. The data base remains active and the Australian Government Solicitor is now responsible for it. It could well be that future generations of defence leaders with new perspectives on occupational health will wish to revisit the circumstances surrounding this Inquiry. It is important for this reason that the Board's source material has been recorded in this way.

Assistance to The Board

1.16.           At some stages of the Inquiry, 50 or more persons were employed to evaluate the evidentiary material, prepare the discussion paper, take statements and administer the Board's activities. Implementation of the Board's policies was, of course, in the hands of the Counsel Assisting team. The Board could not have wished for more from that team and the support staff. It is always difficult to identify particular individuals in a team effort but the three counsel deserve special mention. WGCDR M J Burnett carried most of the burden for the longest period and his efforts stand out as making a major contribution to assisting the Board in its work.
1.17.            The Board was also ably assisted by its Secretary, WGCDR W. Sanders, who managed the budget, which was not exceeded.

1. Military Justice Procedures in the ADF June 1999 Canberra.






Pursuant to Regulation 23 of the Defence (Inquiry) Regulations, I, AIR MARSHAL ERROL JOHN McCORMACK AO, CHIEF OF AIR FORCE, hereby appoint a Board of Inquiry constituted by:


For the purpose of inquiring into the following matters concerning the Royal Australian Air Force, namely, the matters as particularised in the attached Terms of Reference.

AND pursuant to Regulation 25 of those Regulations I empower the Board of Inquiry to make recommendations arising out of their findings;

AND pursuant to Regulation 27 of those Regulations I appoint COMMODORE KENNETH VICTOR TAYLOR to be President of the Board of Inquiry;

AND pursuant to Regulation 28 of those Regulations I direct the Board of Inquiry to follow as closely as practicable the procedure set out in ADFP 202;

AND pursuant to Regulation 29 of those Regulations I direct the Board of Inquiry to conduct all of its inquiry in public, save where the Board of Inquiry determines on its own motion or on the motion of a party, to conduct the inquiry in camera when matters of national security or confidential and/or professional conduct, command or judgement matters relating to an affected person are involved;

AND pursuant to Regulation 29 of those Regulations I direct that all evidence to be given before the Board of Inquiry shall be on oath or affirmation;

AND pursuant to Regulation 51 of those Regulations I appoint the following legal practitioners, to assist the Board of Inquiry, namely:

Senior Counsel Assisting;

Counsel Assisting;

Counsel Assisting;

Counsel Assisting;

Counsel Assisting;

Counsel Assisting

Counsel Assisting;

Counsel Assisting;

Counsel Assisting;

Counsel Assisting;

Counsel Assisting;

Counsel Assisting

Counsel Assisting;

Counsel Assisting;

Counsel Assisting;

Counsel Assisting;

Counsel Assisting;

Counsel Assisting;

Counsel Assisting;

Counsel Assisting;

Counsel Assisting;

Counsel Assisting;


Counsel Assisting;


Counsel Assisting;

Counsel Assisting


Counsel Assisting;

Counsel Assisting;


Counsel Assisting.

Secretary to the Board of Inquiry.


Original Instrument: 19 July 2000

Instrument Varied: 27 February 2001


  1. Pursuant to the Appointment of 19 July 2000, The Board Of Inquiry Into
    The F-111 Deseal/Reseal And Spray Seal Programs (The Board) is to inquire into, make findings and recommendations concerning the following matters:
  1. the Deseal/Reseal Program conducted by the RAAF and/or contractors in the late 1970's/early 1980's, upon F111 aircraft at 501 Wing Amberley (or its predecessors) ("the 1st Deseal/Reseal");

  2. the Deseal/Reseal Program conducted by the RAAF and/or contractors in the late 1980's/early 1990's upon F111 aircraft at 501 Wing Amberley (and its predecessors) ("the 2nd Deseal/Reseal");

  3. the post 1996 Spray Seal conducted by the RAAF and/or contractors upon F111 aircraft at 501 Wing Amberley (or its predecessors) ("the Spray Seal"); and

  4. the wing tank Deseal/Reseal conducted from the late 1980's/ early 1990's by the RAAF  and/or contractors upon F111 aircraft at 501 Wing Amberley (or its predecessors) ("the wing tank DR Procedures") (each of the 1st Deseal/Reseal, 2nd Deseal/Reseal, the Spray Seal and the wing tank DR Procedures being collectively referred to as "the DR procedures").
  1. The Board is to take into evidence the reports of the Investigating Officer appointed on 31 January 2000 "to investigate and report upon the F111 fuselage fuel tank spray sealing" (the Deseal/Reseal Investigation) as amended and the report of an Investigating Officer, if appointed, upon "A Health Study of personnel involved in the maintenance of RAAF F-111 Fuel Tanks" and to consider those reports.

  2. As to the DR procedures, the Board is to identify, investigate and report on the following:
  3. General Details

    1.each of the chemicals used in the DR procedures (the chemicals), the chemical  management systems and details of manufacturers and/or the suppliers of such chemicals;

    2.  whether or not the chemicals are toxic, and if so, the toxicity of the chemicals used in the DR procedures and their general effect upon personnel exposed to the chemicals and the extent of exposure necessary to have any adverse health effect;

    3. all items of personal protective equipment ("PPE") provided and used in the DR procedures, the PPE management systems, the manufacturers and the suppliers of such PPE;

    4.the nature, extent and adequacy of work methods, instructions, and training including technical instructions provided by the manufacturers and/or suppliers relevant to the application of the chemicals used in the DR procedures together with the nature, extent and adequacy of instructions, instruments and orders provided by the RAAF, if any, concurrent with or further to the suppliers' and or manufacturers' instructions from time to time;

    5.the nature, extent and adequacy of work methods, instructions, and training including technical instructions provided by the manufacturers and /or suppliers relevant to PPE used in the DR procedures together with the nature, extent and adequacy of instructions, instruments and orders provided by the RAAF, if any, concurrent with or further to the suppliers' and or manufacturers' instructions from time to time;

    6.the work methods and practices applied by personnel (ADF or otherwise) and training undertaken from time to time in executing the DR procedures;

    7.the Occupational Health and Safety approvals, processes, management structures, procedures, training, equipment, personal protective equipment (PPE) and workplace environment in force or implemented concerning the DR procedures from time to time including any hazard identification, risk assessment and consideration of appropriate control measures;

    8.all Defence Instructions, instructions, instruments and orders with respect to the use of the chemicals and PPE in the DR procedures;

    9.the Commonwealth compensation legislation that applied during relevant periods;

    10.the extent to which personnel (ADF or otherwise) performed their duties (supervisory or otherwise) in accordance with procedures and policies in force from time to time, concerning the DR procedures including, if applicable, the extent to which such personnel failed to perform their duties (supervisory or otherwise) and the reasons (if any) for such failure;

    11.the state of domestic and international medical and scientific knowledge available from time to time concerning the hazards, health risks and best practice related to the chemicals and their use in the DR procedures;

    12.whether there were or are any systemic issues arising from any matters identified which should be addressed by the RAAF or ADF; and

    13.whether the performance or actions of any person (ADF or otherwise) whose performance or actions are directly related to the DR procedures might warrant further inquiry for administrative action.

  4. Personnel Affected

    1.the identity of personnel who may have been exposed to chemicals used in the DR procedures and the details of their duties, including duration of those duties, while so exposed.; personnel includes ADF and ADF contracted labour, personnel directly involved in DR procedures, ADF personnel working in such proximity to the chemicals used in the DR procedures as to be at risk of adverse health effects and next of kin of those ADF and ADF contracted labour personnel directly involved in DR procedures; and

    2.the nature and extent of health complaints reported as resulting from exposure to chemicals used in the DR procedures of those personnel identified above and the treatment provided; if there was any health monitoring of these personnel, detail of any preventative action taken as a result of health monitoring; and

    3.the nature and details of all claims for compensation arising from the DR procedures that have been received or notified.

  5. The Board is to make recommendations as follows:
  6. Primary Recommendations
  7. 1.what action, if any, should be taken to prevent a recurrence of the incidence of adverse  effect, if any, upon ADF and contractor personnel associated with the application of the  chemicals in the DR procedures; and

    2.whether any matters warrant further investigation.

  8. Secondary Recommendations

    1. what action, if any, should be taken to eliminate the inadequacies of any service, equipment, chemicals, procedure, training, orders, instructions and publications revealed in the course of the inquiry which are not regarded as causal factors per se but which the Board considers should be subject to action by the Appointing Authority; and

    2.whether any environmental matters arising should be referred to any appropriate authority for its examination.


October 2000





  1. There were three terms of reference that required the Board to make comment with respect to matters that might warrant further investigation or inquiry. These are discussed following.
    TOR 3a(13) Whether the performance or actions of any person (ADF or otherwise)
    whose performance or actions are directly related to the DR procedures
    might warrant further inquiry or administrative action.

  2. On this matter it is appropriate to note the comment by counsel assisting in their closing submission:

    'Although there is some contest in the evidence between ground crew and their supervisors, there seems little doubt that there was fairly widespread non-compliance with procedures and policies required to be complied with, notably in the wearing of suitable personal protective equipment. The evidence is that, in all but a very few cases, no formal action was taken under the Defence Force Discipline Act or its predecessors against those involved

    The Board made it very clear at the outset that it did not wish to identify individual failings but rather systemic failings, and in those circumstances, and also given the previously mentioned rulings of the Board on the unsuccessful applications for possibly affected persons to be joined, it is not now appropriate to make individual findings of fault against any person.'

    The Board maintains the view that it would be unnecessary and inappropriate to pursue individual cases of improper action, or inaction. This is particularly so as transgressions occurred over a 27 year period and many persons have now left the service.

    TOR 4a(2) whether any matters warrant further investigation (if any action should be
    taken to prevent recurrence of the incidence of adverse effect).

  3. The incidence of adverse effect in relation to F-111 fuel tank deseal/reseal and spray seal maintenance was due to the combination of a number of factors: working in a confined space, on a continuous (daily) basis, for extended duty periods (up to eight hours), using an accumulation of chemical products, at times with inadequate or no personal protective equipment. Of the chemical products, those that cause the Board the most concern are the SR51 desealant used on the first program, and the MMS425 primer and PR2911 spray sealant used on the spray seal program. All of these factors in combination are unique to the F-111. Apart from the lessons identified in volume 1 Chapter 10, the basic lesson from this Inquiry is that caution is necessary when using hazardous substances. Some matters have been identified in the recommendations that require further work, however, the Board did not identify any specific matter that would warrant further investigation.
    TOR 4b(2) whether any environmental matters arising should be referred to any
    appropriate authority for its examination.

  4. Counsel assisting arranged for an assessment of SR51 waste disposal by ENVIROTEST. The report by Dr Miller1 raises some uncertainties about persistence of SR51 type residues. The Board agrees with Dr Miller's recommendation that further environmental testing should be undertaken before a decision is taken to refer the matter to the appropriate authority for examination. The Board understands that further testing may already have been conducted.

1. EXP.0011.001 (at .300).



In the first paragraph of this report we said: 'we estimate that in excess of 400 personnel have suffered long term damage to their health as a result' of exposure to chemicals in the various reseal programs. This appendix provides the justification for this claim.

The Board identified 662 air force workers as being possibly exposed to chemicals during one of the reseal programs in the period 1979-1999. These workers were all interviewed and filled out a health survey in late 2000. A medical consultant selected a subgroup of 110 survey forms for analysis, based on employment records. The consultant noted that there was no bias in this selection process1.

The relevant findings were that 71 per cent said they had suffered symptoms at the time of exposure and one third (32 %) said they had consulted a health professional at that time. Two thirds of the interviewees (66%) said that they were currently suffering symptoms which they attributed to their exposure2. Extrapolating this percentage to the whole group gives us a figure in excess of 400 currently experiencing symptoms which they attribute to exposure. The symptoms include skin rash, gastro-intestinal problems, headaches, memory loss and mood and neurological disorders.

For spray seal workers, the survey was a year after working on the program, while for other workers the period since exposure was a lot longer. In other words, workers were reporting long term consequences, not simply transient effects.

But can we conclude that the symptoms being reported were indeed the result of chemical exposure?

Medical opinion available to the Board was that 'many of the symptoms are consistent with those expected following absorption of toxic chemicals'3 but that reliable conclusions about whether the chemical exposure had had any long term effects on the exposed workers would have to await the conclusions of the epidemiological study being planned by the Department of Veterans Affairs (DVA). This study will compare exposed workers with a control group of similar workers not exposed to the chemicals in the fuel tank repair program, to see if there are differences in the current levels of symptoms. This research design will facilitate scientific conclusions about whether or not symptoms in the exposed group were indeed caused by exposure. If the findings are of sufficient weight and merit they will be published in one of the leading journals4.

The Board's inquiry does not aim to contribute to scientific knowledge, in the way that an epidemiological study does. Its epistemological underpinnings are therefore different and its findings may be somewhat at variance with those of a scientific study. We develop this point in the following paragraphs.

Good science is comfortable with uncertainty. The conclusions of any reputable piece of research are nearly always tentative, that is, subject to qualifications to do with inadequacies in the data or the impossibility of ruling out alternative interpretations of the data. Good research reports often end with suggestions about further research which might reduce the level of uncertainty about the findings. The scientific enterprise is cumulative, always building towards greater understanding. Theories are never finally proved; they are always vulnerable to new evidence. As a result, good science seldom comes to unequivocal conclusions.

Good science is also conservative. It takes seriously the possibility that relationships which are apparent in survey or experimental data may have occurred by chance and may not be indicative of any real underlying relationship. Good science is only willing to reject the null hypothesis, and accept that an apparent relationship is real, if it can be shown that the likelihood of the relationship occurring by chance in the data at hand is very low. Relationships are said to be statistically significant if the probability that they might occur by chance is less than .05. By refusing to accept the existence of a relationship until it meets this or some similar test, good science assures itself of a reasonably secure knowledge base on which to build. Good science, in short, is strongly biased against concluding that a relationship exists in the data.

It should be noted too, that the fact that a relationship in the data fails to achieve statistical significance does not constitute proof that there is no relationship. The spokesperson for the DVA study who gave evidence to the Board explained that:

'In the event that our report had - broadly speaking - negative findings, it would need to be interpreted very cautiously because in many the groups we're dealing with relatively small numbers, and when you're dealing with relatively small numbers, it's always dangerous to draw too much inference from a negative conclusion'5.

There is a close parallel here with the criminal law. Like science, the criminal law is conservative when it comes to drawing conclusions: guilt must be proved 'beyond reasonable doubt' (not beyond all doubt). The law is biased in favour of defendants in this way in part because the consequences of conviction are so serious for the offender. The risk of convicting an innocent person must therefore be minimised, even if it means that some of the guilty go free.

Moreover, just as the failure to achieve statistical significance does not establish that there is no relationship, the failure of the evidence to prove guilt beyond reasonable doubt is not a finding of innocence. It is simply a finding that the evidence is not strong enough to rebut the presumption of innocence.

The criminal law requirement that matters be proved beyond reasonable doubt is, therefore, precisely analogous to the scientific requirement that a relationship will only be accepted if it is statistically significant.

The Board is not bound to adopt these conservative standards of proof in coming to conclusions. According to Counsel Assisting,

In determining whether or not a fact exists, the Board should apply the civil standard - the balance of probabilities - that is to say, whether something is more likely than not to have occurred6.

There are good reasons why this Board should not adopt a conservative standard of proof which predisposes it to find the relationship between symptoms and exposure unproven.

First, the force of our recommendations depends to a large extent on the conclusion that the health of fuel tank workers has been damaged by their work. It would of course be open to the Board to conclude merely that systemic breakdowns had exposed workers to the risk of damage to health. But if no one's health was actually damaged, our recommendations lose much of their urgency and the decision taken by the commanding officer to suspend spray sealing must be judged to be something of an over-reaction.

Secondly, the witness statements provided to the Board were made in good faith and those witnesses would be entitled to feel aggrieved if the Board adopted a methodology which effectively gave no weight to their statements unless and until they were validated by a scientific study.

Epidemiological studies are not the only way to establish causation; the circumstances of particular cases can also be persuasive. Indeed the DVA witness stated to the Board that even where epidemiological studies show no significant difference between case and control groups it may still be open to an individual to establish a causal connection for the purposes of compensation7.

In a large number of individual cases presented to the Board we find the evidence of causation to be persuasive. Especially compelling is the fact that the symptoms date from the time of exposure. There is also quite specific evidence of a causal connection in particular cases. One worker reported, for instance, that he only started to get symptoms when two or three aircraft were sprayed close together8. Another worker who had passed out in a fuel tank subsequently discovered that he had been lying on a plastic bottle of solvent, forcing its contents onto the tank floor and thence into the atmosphere where he had inhaled it9.

There is, finally, the compelling evidence from the survey conducted by Dr Ross in February 2000, following the cessation of the spray seal program. The Board is specifically requested in the terms of reference to take his report into consideration and a medical consultant for the Board described the Ross report as 'a very comprehensive and expert document'10. Ross found that 14 of the 30 workers in the fuel tank repair section had reported to Amberley Medical Section with symptoms which were consistent with chemical poisoning, eg, memory loss, headache, irritability, poor concentration. He also conducted a careful case/control survey using a control group of maintenance workers who had not been exposed to chemicals in the fuel tank repair section. The case group reported substantially more symptoms consistent with solvent exposure than did the control group and the difference was statistically significant. As befits a scientific report, Dr Ross discussed the limitations of his findings, but he concluded: 'The weight of evidence at this stage is sufficient to advise the workers and the regulatory agency (COMCARE) that workers have been adversely affected by spray sealing operations'11.

Ross's survey was carried out about two months after the last spray sealing operation. It is therefore not simply a study of transient effects. It is the best scientific evidence to date that the spray seal program had more than a transient effect on the health of those involved.

In light of the evidence the Board believes that the symptoms which workers currently experience are reasonably attributable to their earlier exposure. It is on this basis that we estimate that in excess of 400 workers have suffered long term damage to their health.

Finally, we note there is no suggestion in the evidence available to the Board of early mortality among exposed workers. Among the 110 workers studied there were six children with birth defects12. We draw no conclusions about cancer, early mortality or effects on the next generation; these are matters for the DVA study.

1. Donaldson, EXP.0003.001(at 003), or Volume 2 of this Report, Chap 2, Annex 1. A, par 1.
2. Donaldson, op cit, par 28.
3. Donaldson, op cit, par 10.
4. T86, Transcript of Proceedings 22MAR01.
5. T85, Transcript of Proceedings 22MAR01 .
6. T654, Transcript of Proceedings 28MAY01.
7. T87, Transcript of Proceedings 22MAR01 .
8. EXP.0001.001 (at 029), par 1.
9. WIT.0128.001 (at 007) par 21.
10. EXP.0004.001 (at 009) par 4.
11. EXP.0001.001 (at 003).
12. Donaldson, op cit. par 31.



`Twas a dangerous cliff, as they freely confessed;
Though to walk near its crest was so pleasant;
But over its terrible edge there had slipped
A duke and full many a peasant.
The people said something would have to be done,
But their projects did not at all tally.
Some said 'Put a fence `round the edge of the cliff',
Some, 'An ambulance down in the valley'.
The lament of the crowd was profound and was loud,
As their tears overflowed with their pity;
But the cry for the ambulance carried the day
As it spread through the neighbouring city.
A collection was made, to accumulate aid,
And the dwellers in highway and alley
Gave dollars or cents - not to furnish a fence -
But an ambulance down in the valley.
'For the cliff is all right if you're careful', they said:
'And, if folks ever slip and are dropping,
It isn't the slipping that hurts them so much
As the shock down below - when they're stopping'.
So for years (we have heard), as these mishaps occurred
Quick forth would the rescuers sally,
To pick up the victims who fell from the cliff,
With the ambulance down in the valley.
Said one to his pleas, 'It's a marvel to me
That you'd give so much greater attention,
To repairing results than to curing the cause;
You had much better aim at prevention.
For the mischief of course should be stopped at its source;
Come, neighbours and friend, let us rally.
It is far better sense to rely on a fence
Than an ambulance down in the valley'.
'He is wrong in his head', the majority said;
He would end all our earnest endeavour.
He's a man who would shirk this responsible work'
But we will support it forever
Aren't we picking up all just as fast as they fall'
And giving them care liberally?
A superfluous fence is of no consequence
If the ambulance works in the valley'.
The story looks queer as we've written it here,
But things oft occur that are stranger.
More humane, we assert, than to succour the hurt
Is the plan of removing the danger.
The best possible course is to safeguard the source
By attending to things rationally.
Yes, build up the fence and let us dispense
With the ambulance down in the valley.

Copied from a RAAF Flying Safety magazine from the-mid 1970s, apparently sourced from a DCA flight safety publication.