FACTUAL INFORMATION Two international B767 aircraft were tracking northbound on air route B220 at Flight Level (FL) 350, the second approximately 20 minutes behind. All separation in regard to these two aircraft was correctly established and maintained. The aircraft were under the control of Brisbane Sector 10 and were due to cross into the Papua New Guinea flight information region (FIR) at VIPAM, the mandatory reporting position at the FIR boundary. The controller had co-ordinated the pilot estimates for VIPAM with Port Moresby Control. Subsequently, an A310 aircraft taxied at Port Moresby for a flight to Cairns via air route B220 and the crew had been cleared to climb to FL370 by Port Moresby Control. The Sector 10 controller agreed to this flight level as initial separation responsibility was with Port Moresby Control. The A310 departed at 1316 EST and was estimating VIPAM at 1341 tracking southbound. As the first B767 was estimating VIPAM northbound at 1346, there was insufficient time to allow an unrestricted climb to FL370 for the A310. The crew were therefore instructed by Port Moresby control to maintain FL330. During the subsequent co-ordination between Port Moresby control and Sector 10, it was agreed that Sector 10 would accept responsibility for providing separation between all three aircraft and initiating a climb for the A310 when available. During this co-ordination the Port Moresby controller offered the use of Port Moresby distance measuring equipment (DME) to assist Sector 10 in this separation function. The Sector 10 controller was unsure of the process for using such equipment in Australian airspace and decided not to use the DME standard. Having accepted responsibility for separation, the Sector 10 controller correctly calculated, using mental processes only, a time of passing for the A310 and the leading B767. The estimated time of passing was 1343.30 (transmitted to the aircrews as 1343) and the aircraft sighted each other at that time. However, further climb for the A310 was still dependent on separation being provided with the second B767, which was initially estimating VIPAM at 1416. While the Sector 10 controller was waiting for confirmation that the first B767 had passed the A310, she commenced the calculation for the time of passing for the A310 with the second B767. The controller's mental calculation was based on a 27-minute time difference derived from the revised VIPAM estimates of the A310 (1341) and the second B767 (1408). The controller calculated this time of passing as 1404 (this was erroneous as the correct time was 1353.30). The required standard was for the climbing aircraft (A310) to reach FL370 by a time 10 minutes before the time of passing. Based on the controller's calculated time of 1404, this requirement would have been 1354. However, because half-minutes are not normally used in these calculations, the controller rounded out on the side of safety and issued an instruction for the crew of the A310 to climb to FL370 with a requirement to reach FL370 by 1353. At 1347, the crew of the B767 reported their position at DOTOD (a position on air route B220 south of the FIR boundary) and gave an updated estimate for VIPAM that was 2 minutes early. This new estimate had the effect of bringing the time of passing forward by 1 minute and the Sector 10 controller issued a new requirement for the crew of the A310 to reach FL370 by 1352. This requirement was correctly acknowledged. At 1348, the crew of the A310 reported maintaining FL370. The aircraft passed at 1353. The Sector 10 controller had made a 10-minute error in the time of passing calculation and the separation standard had been breached. Communication with the three aircraft in the relevant portion of air route B220 was through flight service HF channels. All transmissions and co-ordination procedures in regard to flight service requirements were adequate and in accordance with the appropriate instructions. The Australian Manual of Air Traffic Services suggests that where separation is based on mathematical calculation, a cross-check of the results should be undertaken. On this occasion, the controller had intended to make such a cross-check using a navigation computer and had prepared the flight progress strip for the northbound B767 in readiness to carry out the second calculation. However, no such check was made. She had only checked her original calculation using the same mental method. The workload on the Sector 10 controller had been high but most of the traffic separation conflictions had been completed, with co-ordination representing the bulk of the outstanding tasks at the time of the occurrence. However, the sector was still considered to be busier than normal. ANALYSIS Examination of the time of passing calculation indicated that using the 27-minute difference and the time of 1341 at VIPAM for the A310 (the point at which the controller based her separation calculation), the calculation should have resulted in a time of passing of 1354.30. This time would have then been rounded out to 1354 and then further amended to 1353 when the crew of the A310 reported at VIPAM at 1339. The difference of 1 minute in this time of passing calculation as compared to the controller's calculation (after subtracting the 10 minutes required by the separation standard and correcting the controller's 10-minute error), could not be adequately explained but was probably a safety net used by the controller when a half-minute was involved in the calculation. Having made the original 10-minute error, the controller made amendments in the single minute column and, because a cross-check was not carried out, the opportunity to remedy the mistake was lost. The Sector 10 controller knew that a cross-check was required and had intended to carry out such a check for the time of passing involving the second B767. She could not say why this was not done but she was busy and had several items on her mind at the time. One such item was the option to use Port Moresby DME to establish a definite passing. She was unsure of being able to use a foreign navigation aid in Australian airspace and was discussing this option with other controllers. Having made an error of 10 minutes in the time of passing calculation, certain factors may have reinforced the controller's perception that all was well. Firstly, the time of passing for the A310 and the first B767 had been correctly calculated and had worked as planned. Secondly, the initial estimated times at VIPAM between the A310 and the second B767, indicated that there was enough time for the change of level while maintaining separation standards provided that the crews of the A310 and the preceding B767 saw each other, and that the instruction for the climb was given as soon as those sighting reports were made. This situation would have provided 10 minutes for the crew of the A310 to complete their climb. Additionally, the controller wanted to provide a good service and give the crew of the A310 the least possible delay for their climb. However, irrespective of the times involving the A310, there was only a period of 20 minutes between the two northbound aircraft. This period was insufficient for the crew of the A310 to obtain a sighting and positive passing of the first B767, and then to climb to reach FL370 at least 10 minutes prior to passing the second B767. The position reports that were subsequently made by the three crews indicated that all aircraft reached VIPAM earlier than initial estimates. This situation reduced the time available for the A310 to safely climb when using the controller's incorrect calculations. The aircraft actually passed at 1353.30. SIGNIFICANT FACTOR The Sector 10 controller did not carry out a cross-check of the time of passing as suggested by the Australian Manual of Air Traffic Services. SAFETY ACTION As a result of the investigation, Airservices Australia issued an instruction to draw the attention of controllers to the common error of carrying the "one" in any 10-minute calculation. They also introduced an additional tool for controller reference in the form of a Time of Passing Graph.