Hazard and Risk Assessment

C2 Kurnell Buncefield Review

Appendix C�

Hazard and Risk AssessmentC1 Preliminary Hazard Analysis

Appendix �1�

Preliminary Hazard Analysis

R4Risk Pty LtdACN 134 478 050

15 Yarra Street(PO Box 5023)South Melbourne VIC 3205

P: 03 9268 9700F: 03 8678 0650E: [email protected]

Caltex Refineries (NSW) Pty Ltd

Proposed Kurnell Product TerminalPreliminary Hazard Analysis

15 May 2013R4Risk Ref.: 107-24, Release 5

CALTEX REFINERIES (NSW) PTY LTDPROPOSED KURNELL PRODUCT TERMINAL - PRELIMINARY HAZARD ANALYSIS

15 May 2013 Page 2 of 43R4Risk Ref.: 107-24, Release 5

Confidential and Sensitive DocumentExempt from disclosure under the Government Information (Public Access) Act 2009 (NSW)

The complete Preliminary Hazard Analysis Report is provided to the NSW Department of Planning &Infrastructure (“DP&I”) by Caltex Refineries (NSW) Pty Ltd (“Caltex”) in confidence for use only withinDP&I. It is submitted on the basis that there is an overriding public interest against disclosurepursuant to section 14(2) of the Government Information (Public Access) Act 2009 (NSW) (the “Act”).The Report is exempt from disclosure under the Act on the grounds that it contains informationassociated with the storage of security sensitive petroleum finished product and information that iscommercial-in-confidence.

The information which is exempt from disclosure applies specifically to the following parts of theReport:

Appendix E Lists of Hazardous Scenarios

This report must not be copied or distributed outside DP&I without the express permission of Caltex.



DOCUMENT CONTROL

Project Title Proposed Kurnell Product Terminal - Preliminary Hazard Analysis

Client Name Caltex Refineries (NSW) Pty Ltd

Project No. 107-24

Project Manager Patrick Walker

Report Author (s) Patrick Walker

Release Issue Date Reviewed by Approved by CommentsRelease 1 27 February 2013 L. Dreher L. Dreher Issued to Client

Release 2 18 April 2013 L. Dreher L. Dreher Revised with Clientcomments

Release 3 26 April 2013 L. Dreher L. Dreher Updated

Release 4 8 May 2013 L. Dreher L. Dreher Updated

Release 5 15 May 2013 L. Dreher L. Dreher Updated



Table of Contents1 EXECUTIVE SUMMARY................................................................................................................. 6

1.1 Major Risk Contributors ........................................................................................................... 6

1.2 Individual Risk - Fatality........................................................................................................... 7

1.3 Individual Risk - Injury ............................................................................................................. 7

1.4 Societal Risk - Off-site ............................................................................................................. 7

1.5 Risk of Property Damage and Accident Propagation.............................................................. 8

1.6 Biophysical Risk ...................................................................................................................... 8

1.7 Assumptions And Sensitivity ................................................................................................... 9

1.8 Related Safety Studies ............................................................................................................ 9

1.9 Findings And Recommendations............................................................................................. 9

2 ACRONYMS & GLOSSARY.......................................................................................................... 10

2.1 Acronyms............................................................................................................................... 10

2.2 Glossary................................................................................................................................. 10

3 INTRODUCTION ........................................................................................................................... 12

3.1 Background............................................................................................................................ 12

3.2 The Project ............................................................................................................................ 12

3.2.1 Scope............................................................................................................................. 12

3.2.2 Aim................................................................................................................................. 12

3.3 The Preliminary Hazard Analysis .......................................................................................... 12

3.3.1 Scope............................................................................................................................. 12

3.3.2 Aim................................................................................................................................. 13

4 SITE & PROJECT DESCRIPTION................................................................................................ 14

4.1 Project Location..................................................................................................................... 14

4.2 Project Description ................................................................................................................ 14

4.2.1 Wharf Operation ............................................................................................................ 14

4.2.2 Tank Farm Operation .................................................................................................... 14

4.2.3 Associated Pipelines and Pumps .................................................................................. 14

5 METHODOLOGY .......................................................................................................................... 17

5.1 Hazard Identification.............................................................................................................. 18

5.1.1 Data Collection .............................................................................................................. 18

5.1.2 Scenario Development .................................................................................................. 19

5.2 Frequency Assessment ......................................................................................................... 19

5.2.1 Scenario Frequency ...................................................................................................... 19

5.2.2 Event Tree Analysis....................................................................................................... 19

5.3 Consequence Assessment.................................................................................................... 19

5.3.1 Pool Fires....................................................................................................................... 20



5.3.2 Vapour Cloud Explosions .............................................................................................. 20

5.3.3 Vulnerability Models ...................................................................................................... 20

5.4 Risk Assessment ................................................................................................................... 20

5.5 Study Assumptions................................................................................................................ 20

6 RISK CRITERIA ............................................................................................................................ 21

6.1 Individual Risk - Fatality......................................................................................................... 21

6.2 Individual Risk - Injury ........................................................................................................... 21

6.3 Societal Risk Criteria ............................................................................................................. 21

6.4 Risk of Property Damage and Accident Propagation............................................................ 22

6.5 Biophysical Risk .................................................................................................................... 22

7 HAZARD IDENTIFICATION .......................................................................................................... 23

7.1 Hazardous Materials.............................................................................................................. 23

7.2 Isolatable Sections ................................................................................................................ 23

7.3 Hazardous Scenarios ............................................................................................................ 23

7.4 Consequence Events ............................................................................................................ 24

7.4.1 Pool Fires....................................................................................................................... 24

7.4.2 Vapour Cloud Explosion ................................................................................................ 25

7.5 Major Accident Hazards ........................................................................................................ 25

8 FREQUENCY ASSESSMENT ...................................................................................................... 27

8.1 Failure Frequency.................................................................................................................. 27

8.2 Event Tree Analysis............................................................................................................... 27

8.3 Tank Overfill / Explosion Frequency...................................................................................... 28

9 CONSEQUENCE ANALYSIS........................................................................................................ 30

10 RISK ASSESSMENT..................................................................................................................... 32

10.1 Individual Risk - Fatality......................................................................................................... 32

10.2 Individual Risk - Injury ........................................................................................................... 35

10.3 Societal Risk – Off-site Population ........................................................................................ 37

10.4 Risk of Property Damage and Accident Propagation............................................................ 37

10.5 Biophysical Risk .................................................................................................................... 39

10.6 Sensitivity Analysis ................................................................................................................ 40

11 COMPARISON TO RISK AT THE EXISTING FACILITY.............................................................. 41

12 REFERENCES .............................................................................................................................. 42

Appendix A Assumption Register

Appendix B Failure Rate Data

Appendix C Buncefield Recommendations

Appendix D Off-site Population Data


Appendix F Qualifications and Experience of the Hazard Analysis Team



1 EXECUTIVE SUMMARY

Caltex is seeking development approval to convert the existing Kurnell Refinery into a FinishedProduct Terminal (the ‘Project’). In accordance with the NSW Department of Planning andInfrastructure (DP&I) Director-General’s Requirements (DGRs) for the Development, a PreliminaryHazard Analysis (PHA) Report was prepared by R4Risk for inclusion in the Environment ImpactStatement (EIS) for SSD-5544.

The PHA report was prepared with reference to the State Environment Planning Policy No 33 -Hazardous and Offensive Development [1], and in accordance with the NSW DP&I’s HazardousIndustry Planning Advisory Papers No. 4 - Risk Criteria (HIPAP4) [2] and No. 6 - Hazard Analysis(HIPAP6) [3].

The Project comprises the following principal components:

Continued use of parts of the existing refinery, in a manner similar to that currently in place, forthe storage and distribution of petroleum products.

A number of existing crude oil tanks are to be cleaned and modified to allow for the storage ofrefined product (i.e. conversion to finished product tanks).

A small number of other tanks already storing one type of refined product are to be convertedto store alternative products.

New pumps, pipes and electrical infrastructure are to be installed within the Project Area(defined in Section 4.1).

A range of ancillary works is also to be undertaken to improve efficiency and to facilitate theconversion of the refinery into a terminal. These ancillary works include consolidation andupgrades to the utilities, transportation and management systems at the site.

The refinery plant would also be shut down, depressurised, de-inventoried and left in situ. Caltex shutdown, depressurise and de-inventory the refinery plant during routine maintenance activities as part ofthe existing operation and therefore this action does not form part of the Project.

The Project is expected to be undertaken over a 54 month period.

In preparing the PHA Report, R4Risk has investigated the risk of operations associated with thefollowing areas:

Tank farm operations

Wharf operations associated with fixed shore assets (i.e. excluding shipping activities); and

Associated pipelines and pumps.

The quantitative risk assessment (QRA) methodology was used to determine the risk profile for theProject. The methodology involved the following key steps:

Hazard Identification

Consequence Assessment

Frequency Assessment

Risk Assessment.

The tolerability of the calculated risk was assessed by comparison with the risk criteria specified inHIPAP4 [2]. The following sections summarise the major findings from the risk assessment. Thecorresponding risk contours are presented in Section 10.

1.1 MAJOR RISK CONTRIBUTORS

The PHA examined scenarios associated with the Major Accident Hazards (MAHs) that involved theloss of containment of flammable (gasoline, jet fuel, slops) or combustible (diesel) material. The studyconsidered the material that could be released from storage tanks, pumps and loading arms, as wellas the associated pipelines. The QRA determined the potential that released material would ignite,resulting in a pool fire. The study also evaluated the frequency and potential consequence of a



Buncefield-type vapour cloud explosion (VCE). Although assessed as extremely unlikely, theBuncefield-type VCE event was included in the QRA.

1.2 INDIVIDUAL RISK - FATALITY

Location-specific individual risk (LSIR) contours for the risk of fatality were developed. These wereused to assess the tolerability of the risk against the risk criteria described in HIPAP4. As each of therisk contours do not extend into the respective land-use areas to which the criteria are applied, the off-site fatality risk criteria are therefore satisfied. This is summarised in Table 1.

Table 1: LSIR Fatality Risk Tolerance Criteria [2]

Land UseTolerance Criteria

(risk in a million peryear)

LSIR Results

Sensitive areas, such as hospitals and schools 0.5The relevant LSIRcontours do notextend to each ofthese areas.All criteria aresatisfied.

Residential developments and continuousoccupancy, such as hotels and resorts

1.0

Commercial developments, including retailcentres, offices and entertainment centres

5

Sporting complexes and active open space 10

Industrial areas 50

1.3 INDIVIDUAL RISK - INJURY

Location-specific individual risk (LSIR) contours for the risk of injury were developed. The tolerabilityof the injury risk results was determined by comparison with the HIPAP4 injury risk criteria. Similar tothe fatality risk contours, the injury risk contours do not extend into the respective land-use areas towhich the criteria are applied. The injury risk criteria are therefore satisfied. This is summarised inTable 2.

Table 2: LSIR Injury Risk Tolerance Criteria [2]

Individual Injury Risk CriteriaTolerance Criteria


LSIR Results

Incident heat flux radiation at residential andsensitive areas exceeding 4.7 kW/m

2.

50 The relevant LSIRcontours do notextend to these areas.The criteria is met.

Incident explosion overpressure at residential andsensitive use areas should not exceed 7 kPa atfrequencies.

50

Toxic concentrations in residential and sensitiveuse areas exceed a level which would beseriously injurious to sensitive members of thecommunity following a relatively short period ofexposure.

10

Not applicable, as theQRA did not involvescenarios which couldresult in this type ofevent.

1.4 SOCIETAL RISK - OFF-SITE

The societal risk “F-N curve” was developed. This considered potential impacts on the off-sitepopulation. The tolerability of the risk was assessed using the “indicative societal risk criteria”described in HIPAP4 [2]. The societal risk assessment, compared against these criteria, is presentedin Figure 1.

The societal risk “F-N curve” for the proposed operations lies fully below the “negligible” line. In thisregion, the societal risk is not considered significant, provided other individual risk criteria are met. Asdescribed in the preceding sections, the individual risk criteria for fatality and injury are satisfied.Therefore the societal risk is also considered to be tolerable.



Figure 1: Societal Risk Results – Off-site Population

1.5 RISK OF PROPERTY DAMAGE AND ACCIDENT PROPAGATION

Location-specific risk contours were developed to represent the risk of property damage and accidentpropagation. The tolerability of the results was determined by comparison with corresponding riskcriteria outlined in HIPAP4. The risk contours do not extend to off-site areas. The risk criteria aretherefore satisfied. This is summarised in Table 3.

Table 3: Risk of Property Damage And Accident Propagation Tolerance Criteria [2]

Risk CriteriaTolerance Criteria


LSIR Results

Incident heat flux radiation at neighbouringpotentially hazardous installations or atland zoned to accommodate suchinstallations for the 23 kW/m

2heat flux.

50

The relevant LSIR contoursdo not extend to theseareas. The criteria aremet.

Incident explosion overpressure atneighbouring potentially hazardousinstallations, at land zoned toaccommodate such installations or atnearest public buildings for the 14 kPaexplosion overpressure level

50

1.6 BIOPHYSICAL RISK

The risk to the biophysical environment was assessed by examining the potential for identified releasescenarios to impact on the long-term viability of the surrounding ecosystems. For different sections ofthe facility, the assessment considered the key controls that would prevent, or mitigate, the impact of arelease. The analysis demonstrated controls would be in place that would either minimise thepotential for a release or contain product if a release did occur. Therefore, a release of product fromthe terminal would not pose a threat to the long-term viability of the ecosystem.

1.00E-09

1.00E-08

1.00E-07

1.00E-06

1.00E-05

1.00E-04

1.00E-03

1.00E-02

1.00E-01

1 10 100 1000

Freq

uenc

y of

N o

r mor

e fa

talit

ies

(F, /

year

)

Number of Fatalities (N)

Intolerable

Negligible

ALARP



1.7 ASSUMPTIONS AND SENSITIVITY

In completing the QRA, a number of technical assumptions were made. These assumptions aredescribed in Appendix A. For key assumptions, details of the applied methodology and correspondingreferences are also included.

To support the risk assessment conclusions, a review was conducted to determine the sensitivity ofthe QRA results to key parameters. The review examined the parameters such as failure frequencyand the radiant heat vulnerability model. This review showed that the risk tolerability remainedunchanged, despite the modifications made. Details of the sensitivity analysis are provided in Section10.6.

1.8 RELATED SAFETY STUDIES

In conducting the PHA, R4Risk reviewed, or were provide access to, a number of detailed studiesconducted for the Kurnell site. These included the following studies:

Process Hazard Analysis for the Terminal Conversion and the Caltex Port and Marine WorksProject

Major Hazard Facility Safety Report for the Kurnell Refinery

Kurnell Peninsula Land Use Safety Study 2007

Various historical fire safety studies examining the refinery operations and the proposedterminal

Caltex review of Buncefield Report Recommendations.

1.9 FINDINGS AND RECOMMENDATIONS

This quantitative risk assessment demonstrates that the risk levels calculated for the Project satisfythe risk criteria specified in HIPAP4. Compared with existing refinery operations, the off-site riskprofile is considerably reduced. This outcome is expected, because the Project involves adownscaling of the existing operations, i.e. a reduction in the scale and complexity of the operations atthe site.

The studies listed in Section 1.8 provided input into the development of the design for the proposedterminal. Caltex has identified risk reduction recommendations using its Riskman2 methodology.These are documented in the detailed process hazard analysis records and are tracked to completionby Caltex’s project management process.

No recommendations were made as a result of this QRA.



2 ACRONYMS & GLOSSARY

2.1 ACRONYMS

ALARP As low as reasonably practicable

BLEVE Boiling-liquid expanding-vapour explosion

Caltex Caltex Refineries (NSW) Pty Ltd

CCTV Closed-circuit television

DCS Distributed control system

DGRs Director-General’s Requirements

DP&I Department of Planning and Infrastructure

EIS Environment impact statement

ESDV Emergency shutdown valve

HES Health, environment, safety

HIPAP4New South Wales Department of Planning Hazardous Industry PlanningAdvisory Paper No. 4 [2]

HIPAP6New South Wales Department of Planning Hazardous Industry PlanningAdvisory Paper No. 6 [3]

HSE Health & Safety Executive (United Kingdom)

IR Individual risk

IRPA Individual risk per annum

Loc. Loss of containment

LPG Liquefied petroleum gas

LSIR Location-specific individual risk

MAH Major Accident Hazard

MOV Motor-operated valve

MSDS Material safety data sheet

OWS Oily Water Sewer

P&ID Piping and instrumentation diagram

PFD Probability of failure on demand

PHA Preliminary hazard analysis

PULP Premium unleaded petrol

QRA Quantitative risk assessment

SSD Significant State Development

SPULP Super-premium unleaded petrol

VCE Vapour cloud explosion

ULP Unleaded petrol

2.2 GLOSSARY

ConsequenceThe severity associated with an event in this instance the heat radiation fromthe pool fire events, i.e. the potential effects of a hazardous event.

Consequence EventThe end event associated with a failure and release, considering alldetection, isolation and ignition factors, e.g. pool fire, flash fire etc.

Eastern Tank AreaThe Eastern Tank Area contains existing finished product tanks, some ofwhich would need minor conversion works as part of the Project. It alsocontains the Oil Movements Centre (OMC).

Event Frequency The frequency assigned to a specific consequence event

FrequencyThe number of occurrences of an event expressed per unit time. It is usuallyexpressed as the likelihood of an event occurring per annum.

HazardA physical situation with the potential for human injury, damage to property,damage to the environment or some combination of these.

Hazardous ScenarioThe accidental release of a hazardous material from equipment or piping,from identified isolatable section of terminal operation.



Individual Risk (IR)The frequency at which an individual may be expected to sustain a givenlevel of harm from the realisation of specified hazards.

Individual RiskContours

As individual risk (IR) is calculated at a point, calculating the IR at manypoints allows the plotting of IR contours, these being lines that indicateconstant levels of risk. Most commonly used are the 1 chance per million-year contour and the 10 chances per million-year contour.

Individual Risk ofFatality

Individual risk, with “harm” measured in terms of fatality. It is calculated at aparticular point for a stationary, unprotected person for 24 hours per day, 365days per year. Commonly expressed in chances of fatality per million years.

Isolatable SectionA system of pipes or vessels containing the hazardous materials that arebounded by specific isolation points, which can be operated to isolate theinventory in the event of an emergency.

Probability

The expression for the likelihood of an occurrence of an event or an eventsequence or the likelihood of the success or failure of an event on test ordemand. By definition, probability must be expressed as a number between0 and 1.

Quantitative RiskAssessment

A risk assessment undertaken by combining quantitative evaluations of eventfrequency and consequence.

RiskThe combination of frequency and consequences, the chance of an eventhappening that can cause specific consequences.

RiskMan2

Caltex’s standard process for health, environment, safety (HES) and assetrelated risk management. RiskMan2 provides a standardised and systematicapproach to the identification of hazards, assessment of risk and effectiveadoption and maintenance of control measures for HES and certain assetrisks.

Western Tank Area

The Western Tank Area is primarily made up of the existing Crude Oil Tanksand the Waste Water Treatment Plant. All the Crude Oil Tanks wouldrequire conversion as part of the Project. It is proposed that the area wouldalso include the new product pumps area and the new slops pumps area.



3 INTRODUCTION

3.1 BACKGROUND

Caltex is seeking development approval to convert the existing Kurnell Refinery into a FinishedProduct Terminal (the ‘Project’). In accordance with the NSW DP&I DGRs for the Development, aPHA report was prepared by R4Risk for inclusion in the EIS for SSD-5544.

The PHA report was prepared with reference to the State Environment Planning Policy No 33 -Hazardous and Offensive Development [1], and in accordance with the NSW DP&I’s HazardousIndustry Planning Advisory Papers No. 4 - Risk Criteria [2] and No. 6 - Hazard Analysis [3]. Theexperience and qualifications of the project team are included in Appendix E.

This report details the methodology and presents the off-site risk profile for the proposed operations.The tolerability of the results has been assessed by comparison with the risk criteria specified inHIPAP4 [2].

3.2 THE PROJECT

3.2.1 ScopeThe Project comprises the following principal components:

Continued use of parts of the existing refinery, in a manner similar to that currently in place, forthe storage and distribution of petroleum products.

A number of existing crude oil tanks are to be cleaned and modified to allow for the storage ofrefined product (i.e. conversion to finished product tanks).

A small number of other tanks already storing one type of refined product are to be convertedto store alternative products.

New pumps, pipes and electrical infrastructure are to be installed within the Project Area(defined in Section 4.1).

A range of ancillary works are also to be undertaken to improve efficiency and to facilitate theconversion of the refinery into a terminal. These ancillary works include consolidation andupgrades to the utilities, transportation and management systems at the site.

The refinery plant would also be shut down, depressurised, de-inventoried and left in situ. Caltex shutdown, depressurise and de-inventory the refinery plant during routine maintenance activities as part ofthe existing operation and therefore this action does not form part of the Project.

The Project is expected to be undertaken over a 54 month period.

3.2.2 AimThe aim of the Project is to allow the site to be utilised as a terminal where finished products would bereceived by ship, stored in tanks and leave the site, predominantly by pipeline, to the CaltexBanksmeadow Terminal, Silverwater Terminal, Joint User Facility at Sydney Airport, or to the CaltexNewcastle Terminal via the Newcastle Pipeline.

The current capability for outloading via the wharf is to be retained, but would be used infrequently.Under typical operations, road transport of products from the site would cease. However, inexceptional circumstances, some road transport of product may be required.

3.3 THE PRELIMINARY HAZARD ANALYSIS

3.3.1 ScopeThis PHA has identified and assessed hazards and risks associated with the following operationalareas of the proposed development:

Tank farm operations;

Wharf operations associated with fixed shore assets (i.e. excluding shipping activities); and

Associated pipelines and pumps.



3.3.2 AimThe aim of the PHA is to:

Provide an assessment of the hazards and risks associated with the proposed works; and

Evaluate the calculated risk levels against the land-use planning criteria for off-site risk (asspecified in HIPAP4).

This aim is in accordance with the requirements of the NSW DP&I DGRs for the Project and is fullyconsistent with Caltex’s internal standards for the management of hazards and risks at its facilities.The risk associated with the Project has been assessed quantitatively using the generally-acceptedQRA methodology.

To assess the off-site risk exposure, the following outputs were generated from the QRA model:

Individual risk of fatality contours;

Individual risk of injury contours;

Societal risk “F-N curve”; and

Risk of property damage and accident propagation.

In addition to this PHA report, Caltex has also undertaken a number of detailed internal ProcessHazard Analysis studies on the proposed design. These studies represent Caltex’s collectiveknowledge of the nature and type of hazards associated with both existing and proposed operations.They are therefore considered an appropriate basis for the hazard identification step of this PHA.



4 SITE & PROJECT DESCRIPTION

4.1 PROJECT LOCATION

The Project Area is located at the site of the existing refinery, which is on the Kurnell Peninsula withinSutherland Shire Local Government Area, approximately 15 km south of Sydney’s CBD. The site andProject Area are illustrated in Figure 2.

A site plan showing the existing operations is presented in Figure 3. The figure also highlights thedifferent land-uses that surround the site. There are a number of light-industrial sites located near thewestern boundary. To the north, there is a mixture of commercial properties and residential areas.The nearest residential areas are adjacent to the north-eastern corner of the site.

4.2 PROJECT DESCRIPTION

The Kurnell Refinery is to be converted from an operating refinery to a bulk liquid fuel terminal, storingflammable and combustible liquids. The operations at Kurnell will be limited to wharf operations, tankfarm storage and associated pipelines and pumps for transfers of the fuels. The following sectionssummarise the proposed operations at the facility.

4.2.1 Wharf OperationGasoline, jet fuel and fuel oil will be received by ship at the fixed berths of Kurnell Wharf. These fuelswill be then transferred to the terminal via two loading arms and associated pipelines. Receipt ofdiesel will involve similar operations, however, it may also be received at the submarine berth. Slopproduced during terminal operations will be transferred to the wharf for loading onto ships.

A separate Development Application, EIS and Preliminary Hazard Analysis Report have beenproduced addressing the hazards and risks associated with dredging, demolition and constructionactivities, as well as those associated with operational activities due to the mooring of larger ships atKurnell Wharf (refer SSD-5353).

4.2.2 Tank Farm OperationThe flammable and combustible liquids received from the wharf are to be stored in the atmosphericstorage tanks of the tank farm. The Project will involve the continued use of parts of the existingrefinery plot, in a manner similar to that currently in place, for the storage and distribution of petroleumproducts. A number of existing crude oil tanks would be cleaned and modified to allow for the storageof refined product (i.e. conversion to finished product tanks). A small number of other tanks alreadystoring one type of refined product would be converted to store another refined product.

4.2.3 Associated Pipelines and PumpsThe flammable and combustible liquids unloaded at the wharf will be transferred via pipeline tostorage tanks within the tank farm. When required, these products will then be pumped via pipelinesfrom the storage tanks to the Banksmeadow Terminal for further distribution. These existing pipelinesrun from the tank farm, out along the wharf before travelling beneath Botany Bay to Banksmeadow.Lastly, slop will be pumped out to a fixed berth at the wharf, via a combination of new and existinglines (referred to as “Slop Lines”).



Figure 2: Location of Site and Project Area

SiteProject Area



Figure 3: Site Plan [4]



5 METHODOLOGY

The methodology for conducting a PHA is well established in Australia. This assessment was carriedout as per the guidelines provided within HIPAP4 and HIPAP6. Consistent with the potential for a highconsequence event to occur at site, and the anticipated classification of the proposed terminal as aMajor Hazard Facility, the QRA methodology was used for the purpose of off-site risk determination.The tolerability of the risk was assessed using the risk criteria specified in HIPAP4.

This section presents a summary of the QRA methodology applied to this project. The key steps in aQRA are as follows:

Hazard Identification



Risk Assessment.

The approach applied in this study follows these basic steps. A flow chart illustrating this approach isshown in Figure 4. Additional details on each of the steps are provided in the following sections.



Figure 4: Overview of QRA Methodology

5.1 HAZARD IDENTIFICATION

5.1.1 Data CollectionData on the hazards at the site and details needed to complete the risk assessment were drawn fromtechnical information on the proposed Terminal operations. This information included the following, asapplicable:

Engineering drawings (e.g. process flow diagrams, piping and instrumentation diagrams(P&IDs) etc.)

Major Accident IdentificationHazardous materials

Failure modes

Loss scenarios

P&IDs

Flow Diagrams

Emergency detection and

shutdown systems

Process Information

Hazard IdentificationWorkshops


Fire / Explosions

Flammable vapour dispersion

Toxic vapour dispersion

Impact Determination

Met data

Chemical

data

Emerg.

response

Plant and

equipment

layout


Fault Tree analysis

Event Tree analysis

End Event Frequency Determination

System data

Failure

data

Ignition

probabilities

Detection

and isolation

strategies

Risk CalculationsIndividual risk

Societal risk

Population

data

Risk Evaluation

Determine risk acceptabilityRisk

criteria

STOP

Acceptable

Not

Acceptable

Identify major riskcontributors

Propose riskreduction measures



Site layout plans

Area plans

Major inventories of combustible, flammable and toxic substances stored / handled

Release detection and isolation strategies and systems

Release containment systems

Description of surrounding land use and estimates of population densities.

5.1.2 Scenario DevelopmentThe proposed activities for the facility when in terminal operation mode were defined to identifypotential hazardous scenarios. This process involved the completion of a Process Hazard Analysisstudy by a suitably-qualified team of Caltex personnel. The study did not identify any major accidenthazards (MAHs) that were additional to those previously identified for refinery operations covering thetank farm, wharf and sub-berth operations. Conversion to terminal operations will result in a numberof the previously-defined MAHs being eliminated. Terminal operations will not include liquefied gases(e.g. propane, butane) or high-temperature / high-pressure processes, such as those present withinexisting refinery operations. The use of liquid chlorine for biocide treatment of salt water cooling waterwill also be discontinued.

The identified MAH scenarios involve the release / spill of flammable or combustible liquids resulting ina fire when ignited. This could occur at various locations including storage tanks, pumps and loadingarms. These hazardous scenarios were analysed in the QRA, based on the associated materialproperties and transfer operations. The QRA also evaluated the frequency and consequence of aBuncefield-type vapour cloud explosion.

To determine the amount of material that could potentially be involved in a release, factors such asinventory, leak detection, and leak isolation strategies were considered. Event tree models weredeveloped for each potential release scenario. As the most likely MAH scenarios involved the releaseof flammable material, the main events considered in the analysis were pool fires resulting from anignited release.

5.2 FREQUENCY ASSESSMENT

The frequency assessment involved defining the potential release sources and then determining thelikelihood (frequency) of the various releases. The assessment is a two-stage process that involvesevaluating the release frequency and then estimating the likelihood of the possible outcomes of therelease using an event tree.

5.2.1 Scenario FrequencyThe available engineering drawings for the facility were reviewed to develop a “parts count” of failureitems for each of the hazardous scenarios. Failure rates based on historical industry failure frequencydata were utilised to estimate the likelihood of the various hazardous scenarios. The failure rate datafor storage tanks, piping, valves, and other relevant equipment items was sourced from publishedreferences and other appropriate sources. The failure rate data used in the study is presented inAppendix B.

5.2.2 Event Tree AnalysisWhere appropriate, event trees were developed to estimate the frequency of the potentialconsequence events that may result from a given release scenario. This analysis incorporated theeffectiveness of proposed detection and isolation systems when assessing consequence events thatare most influenced by time.

5.3 CONSEQUENCE ASSESSMENT

Following the frequency assessment, the consequence events were identified. The potential impactsof these events were assessed using the consequence models available within PHAST-RISK [5].These models consider the nature of the release, including the release rate, discharge velocity andduration. The models used to assess the impacts of the consequence events are outlined below.



5.3.1 Pool FiresPool fire impacts for bund fires, tank top fires and fires in the vicinity of pumps & pipelines weredetermined using a solid flame model. The model represents the flame as a skewed cylinder thatradiates heat outwards. The dimensions of the skewed cylinder (flame length and flame tilt) aredefined using the empirical correlations within PHAST-RISK.

5.3.2 Vapour Cloud ExplosionsA vapour cloud explosion (VCE) occurs following the ignition of a flammable vapour cloud, coupledwith acceleration of the flame front within the cloud. Within process areas, VCEs are typicallyassociated with the confinement provided by surrounding equipment that promotes mixing and,subsequently, causes the flame front to accelerate.

The current analysis considered the potential for an explosion to result from a gasoline storage tankoverfill event. This type of event occurred at Buncefield (United Kingdom) in 2005. Investigations intothat incident concluded that the observed high levels of overpressure, and their rate of decay, aredifficult to reproduce with the standard explosion models [6] (e.g. the Multi-Energy Method [7]).Therefore, the overpressure from these events was determined using information that was specificallydeveloped to assess explosions associated with tank overfills [8].

5.3.3 Vulnerability ModelsIn order to evaluate the risk profile, the effects of the pool fire and VCE events must be estimated interms of the potential to cause fatality or injury. Vulnerability models were used to correlate the impact(e.g. heat radiation) of an event to the potential for fatality or injury. The vulnerability models used inthe study are described in Appendix A.

5.4 RISK ASSESSMENT

Both individual and societal risk results were generated to define the risk profile for terminaloperations. These results were produced by combining the frequency and consequence estimates foreach of the hazardous scenarios. The following risk measures were generated:

“Location-specific individual risk” (LSIR) contours for fatality and injury riskA graphical representation of “individual risk” that uses the risk values at each point toconstruct iso-risk contours. The contours are presented on a map showing the riskrelative to the proposed terminal and surrounding land-uses.

Societal risk “F-N curve” for off-site populationThis is a “societal risk” measure that communicates the potential for hazardousscenarios to cause multiple fatalities by plotting the frequency of “N or more fatalities”(F) against the number of fatalities (N). This is presented as a graph.

Calculation of the societal risk measures requires knowledge of the population distribution surroundingthe site. The following information is required for each location where people may be present (refer toAppendix D):

Geographical location;

Number of people present at different times of the day;

Percentage of people located indoors; and

Building type (if applicable).

From the individual risk results, a list of risk contributors at specific locations was determined. Thisallowed the major contributors to the risk to be identified, as well as the most influential hazardousscenarios. From this information, targeted risk reduction actions can be readily identified that willdeliver the most effective risk reduction outcome (i.e. the greatest reduction in risk).

5.5 STUDY ASSUMPTIONS

In conducting the QRA, a number of technical assumptions were made. The key technicalassumptions are described in Appendix A.



6 RISK CRITERIA

The tolerability of the calculated risk is assessed by comparison with an appropriate risk target orcriterion. The risk criteria used to make this assessment are specified in HIPAP4 [2]. The risk criteriaare detailed below.


The individual risk of fatality criteria described in HIPAP4 that are applicable to proposed hazardousdevelopments are as follows:

Hospitals, schools, child-care facilities and old age housing development should not beexposed to individual fatality risk levels in excess of half in one million per year (0.5 x 10

-6per

year).

Residential developments and places of continuous occupancy, such as hotels and touristresorts, should not be exposed to individual fatality risk levels in excess of one in a million peryear (1 x 10

-6per year).

Commercial developments, including offices, retail centres, warehouses with showrooms,restaurants and entertainment centres, should not be exposed to individual fatality risk levelsin excess of five in a million per year (5 x 10

-6per year).

Sporting complexes and active open space areas should not be exposed to individual fatalityrisk levels in excess of ten in a million per year (10 x 10

-6per year).

Individual fatality risk levels for industrial sites at levels of 50 in a million per year (50 x 10-6

peryear) should, as a target, be contained within the boundaries of the site where applicable.

These criteria were developed based on a principle that if the risk from a potentially hazardousinstallation is less than most risks being experienced by the community (e.g. voluntary risks,transportation risks), then that risk may be tolerated. This principle is consistent with the basis of riskcriteria adopted by most authorities internationally.

The criterion for residential areas is demonstrably very low in relation to the background risk. It isconsidered conservative, as it assumed an individual is present and exposed for 24 hours per day,365 days per year.


HIPAP4 also outlines risk criteria for effects that may cause injury to people but will not necessarilycause fatality. The injury risk criteria are separated based on the different effect types, i.e., heatradiation, explosion overpressure and toxic exposure. HIPAP4 sets the following injury risk criteria:

Heat flux radiation at residential and sensitive use areas should not exceed 4.7 kW/m2

at afrequency of more than 50 x 10

-6per year.

Explosion overpressure at residential and sensitive use areas should not exceed 7 kPa atfrequencies of more than 50 x 10

-6per year.

Toxic concentrations at residential and sensitive use areas should not exceed a level whichwould be seriously injurious to sensitive members of the community following a relatively shortperiod of exposure at a maximum frequency of 10 x 10

-6per year.

6.3 SOCIETAL RISK CRITERIA

The NSW DP&I has adopted indicative criteria to assess the off-site societal risk. The criteria take intoaccount the fact that society is particularly intolerant of accidents, which although infrequent, have thepotential to cause multiple fatalities. The criteria are presented on the “F-N” graph in Figure 5. Thecriteria define three risk regions as follows [2]:

Intolerable: above the “intolerable” line, the activity is considered undesirable, even ifindividual risk criteria are met.

ALARP (“as low as reasonable practicable”): within the ALARP region, the emphasis shouldbe on reducing risk as far as possible towards the “negligible” line (i.e. ensuring that risks havebeen reduced to as low as reasonably practicable). Provided other quantitative and qualitativecriteria of HIPAP 4 are met, the risks from the activity may be considered tolerable within the



ALARP region as long as all “reasonably practical” risk reduction measures have beenimplemented.

Negligible: below the “negligible” line the societal risk is not considered significant, providedother individual risk criteria are met.

Figure 5: Indicative Societal Risk Criteria [2]


HIPAP4 sets risk criteria that reflect the potential for property damage and accident propagation.Assessment against the criteria provides an indication of the risk that an accident at the facility maycause damage to buildings and / or propagate to involve neighbouring industrial operations, causingfurther hazardous incidents, i.e. the so-called 'domino effect'. HIPAP4 sets the following criteria forrisk of damage to property and accident propagation:

Heat flux radiation at neighbouring potentially hazardous installations, or at land zoned toaccommodate such installations, should not exceed a risk of 50 x 10

-6per year for the

23 kW/m2

heat flux level.

Explosion overpressure at neighbouring potentially hazardous installations, at land zoned toaccommodate such installations or at nearest public buildings should not exceed a risk of50 x 10

-6per year for the 14 kPa explosion overpressure level.


HIPAP4 outlines risk criteria addressing the risk from accidental releases to biophysical environment.The criteria focuses on the potential acute and chronic toxic impacts that an accidental release mayhave on whole systems and populations, rather than individual plants or animals. HIPAP4 expressesthe criteria as follows:

Industrial developments should not be sited in proximity to sensitive natural environmentalareas where the effects (consequences) of the more likely accidental emissions may threatenthe long-term viability of the ecosystem or any species within it.

Industrial developments should not be sited in proximity to sensitive natural environmentalareas where the likelihood (probability) of impacts that may threaten the long-term viability ofthe ecosystem or any species within it is not substantially lower than the background level ofthreat to the ecosystem.

1.00E-09

1.00E-08

1.00E-07

1.00E-06

1.00E-05

1.00E-04

1.00E-03

1.00E-02

1.00E-01

1 10 100 1000

Freq

uenc

y of

N o

r mor

e fa

talit

ies

(F, /

year

)


Intolerable

Negligible

ALARP



7 HAZARD IDENTIFICATION

The hazard identification phase involved a review of the planned terminal operations, engineeringdiagrams and other relevant information. This material was used to identify all sections of the facilitythat would contain hazardous material during future operations.

7.1 HAZARDOUS MATERIALS

The nature of the hazardous materials identified in the study was reviewed from information containedin the Material Safety Data Sheets (MSDSs) supplied by Caltex. The materials that are to be storedon-site are:

Gasoline (ULP / PULP / SPULP)

Jet fuel

Diesel

Fuel oil

Slop.

Slop was assumed to be a mixture of diesel and gasoline. For the purpose of this analysis, slop wasassumed to have the properties of gasoline. A list of hazardous materials identified and theirrespective properties is presented in Table 4.

Table 4: Materials Properties [9, 10, 11, 12, 13, 14, 15]

MaterialName

DangerousGoodsClass

UN No. HAZCHEMCode

FlashPoint(°C)

Auto-IgnitionTemperature

(°C)

Flammabilitylimits(in air)

Gasoline 3 1203 3YE -40 370 1.4 - 7.4%

Jet Fuel 3 1863 3Y 40 >210 0.7 - 6.0%

Diesel C1 - - >61.5 >250 1.3 - 6.0%

Fuel Oil C1 - - >61.5 - 1.0 - 5.0%

7.2 ISOLATABLE SECTIONS

Within the QRA model, the hazardous scenarios developed following a release are dependent on theconditions in the corresponding “isolatable section”. These conditions were used in the consequencemodelling for each hazardous scenario and include:

Material

Process conditions (e.g. temperature and pressure )

State (i.e. vapour or liquid)

Inventory

Flow rate

Utilisation (i.e. percentage of the time in use).

7.3 HAZARDOUS SCENARIOS

Hazardous scenarios were developed to represent the range of possible failures associated with eachisolatable section. These failure modes were represented as releases from selected hole sizes.

For the wharf operations, the following two failure cases associated with the loading / unloading armswere considered:

Full bore release – hole size equivalent to diameter of the loading arm (approximately 250mm)

Medium release – hole size equivalent to 10% of cross-sectional area of the loading arm(approximately 80 mm).



For other equipment, a maximum of five hole sizes were considered in the analysis to represent thefull range of potential failure modes. This range of hole sizes was considered for storage tanks,pumps and associated internal pipelines. The hole sizes used to define the hazardous scenarios arepresented in Table 5.

Table 5: Representative Hole SizesHole Size Category Representative Hole Size Hole Size Range

Small 5 mm dh ≤ 5 mm

Medium 20 mm 5 mm > dh ≥ 20 mm

Large 50 mm 20 mm > dh ≥ 50 mm

Very Large 100 mm 50 mm > dh ≥ 150 mm

Rupture Full bore dh > 150 mm

For some “isolatable sections”, the hole sizes presented in Table 5 were adjusted to better representthe connections and/or piping included in that section of the process. For pipelines and pumps, thepipe diameter was used as the hole size representing the “Rupture” category. For atmosphericstorage tanks and associated piping, the hole sizes representing the “Very Large” and “Rupture”categories were adjusted as necessary to reflect the larger hole sizes associated with equipmentwithin the tank farm. The hole size representing the “Very Large” case was increased to 150 mm andthe “Rupture” case was assigned the size of the largest connection to the tank.

The full list of hazardous scenarios considered in the risk assessment is provided in Appendix E.

The additional hazardous scenario of tank overfill was considered for the gasoline storage tanks. Thiswas considered to ensure the QRA examined the range of possible consequences associated with atank farm, including the explosion of a vapour cloud formed following a release (refer to Section 7.4.2).

7.4 CONSEQUENCE EVENTS

7.4.1 Pool FiresFor the identified hazardous scenarios, the potential consequence events were mainly pool fires. Apool fire is a turbulent diffusion flame, burning above a horizontal pool of vaporising flammable liquid,with little or no momentum. The flame can emit fatal levels of radiant heat to the surrounding area.Pool fires will result following the ignition of a continuous or instantaneous release of flammablehydrocarbon liquids stored at atmospheric conditions.

The size of a pool fire is determined by operating conditions, the burning rate of material and thepresence of spill containment. The location of each isolatable section was reviewed to assess thepresence of spill containment for consideration in the modelling. The main types of scenariosconsidered in the QRA are discussed below, with the associated spill containment:

Wharf Operations

A pool fire resulting from the ignition of a release from a loading arm. Spill containment isprovided that will limit the pool size [16].

Tank Farm

A pool fire resulting from the ignition of a release from a storage tank (and/or associatedequipment) into the surrounding bund. The size of a pool fire was limited to the surface areaof the bund (excluding the tank area).

A full-surface tank fire could occur following an internal explosion of a cone roof tank or thesinking of a floating roof tank. The fire size was limited to the diameter of the tank.

Pipelines

A pool fire resulting from the ignition of a release from a pipeline. Pipelines either run inside apipe trench or on the pipeway edge, with the ground underneath sloping towards the pipetrench. The diameter of the fire was limited to the trench width.



Pumps

A pool fire resulting from the ignition of a release from a pump. In most cases, the pumpswere located within a kerbed area, with an internal drain to the oily water sewer (OWS). Thepool size was limited to the kerbed area.

7.4.2 Vapour Cloud ExplosionIn December 2005 at the Buncefield Oil Storage Depot in the UK, a number of explosions and asubsequent fire occurred. These destroyed a large part of the facility, caused widespread damage tothe surrounding homes and businesses, resulted in 43 injuries and disruption to the local community[17]. The fire burned for five days and emitted a large plume of smoke into the atmosphere.

The subsequent investigation determined that the incident was due to the overfilling of a fuel storagetank containing unleaded petrol. A delivery of fuel from the pipeline feeding the tank started and thesafety systems in place to shut-off the supply of fuel to prevent overfilling failed to operate. Petrolcascaded down the side of the tank and began to collect in the bund. As overfilling continued, thevapour cloud formed by the mixture of petrol and air flowed over the bund wall and travelled off-sitetowards the nearby industrial estate. A white mist was observed in CCTV replays of the event. Theexact nature of the mist is not known with certainty: it may have been a volatile fraction of the originalfuel, such as butane, or ice particles formed from the chilled, humid air as a consequence of theevaporation of the escaping fuel.

The vapour cloud was believed to have ignited in the industrial estate car park and the main explosionwas massive. Subsequent explosions and a huge fire also occurred. The main explosion at theBuncefield depot was unusual because it generated much greater overpressures than would usuallyhave been expected from a vapour cloud explosion. The mechanism of the violent explosion was thesubject of additional research. Phase 1 of this research [18] indicated a likely sequence of events(although could not fully explain all the damage based on the theory). It was surmised that the gascloud was ignited by a source at the emergency fire water pump house and a slow flame propagatedoutwards in all directions. When it reached a line of trees and vegetation in the lane outside the site,the flame accelerated along the tree lined road. The deflagration explosion transitioned to adetonation event further along the road. The detonation travelled in all directions, leading to a highoverpressure within the flammable gas cloud and high amounts of damage over the affected area.Outside the gas cloud, the detonation became a blast wave which decayed rapidly with distance, dueto the shallow nature of the flammable gas cloud.

As a result of the incident and the subsequent analysis, this type of incident is now consideredimportant to include when assessing the risk associated with bulk fuel storage facilities. Although thistype of event is considered to have a very low likelihood of occurrence, the high explosionoverpressures that may result could cause significant far-field damage.

A scenario of this type was included in the QRA model. The scenario considered an overfill eventassociated with the 16 tanks that will store varieties of unleaded petrol. To quantify the risk, a detailedanalysis was completed to determine the frequency and consequence of an overfill event. The overfillevent frequency was determined by considering the frequency of filling operations and the controls inplace that would act to prevent the event. The consequence assessment was completed based onknowledge developed following the investigation of the Buncefield incident [8, 18].

7.5 MAJOR ACCIDENT HAZARDS

Caltex revised the list of MAHs developed for Refinery Operations to include only those relevant tofuture terminal operations. Where appropriate, each hazardous scenario identified within the QRAwas linked to an MAH. The resulting list of MAHs is presented in Table 6.



Table 6: List of Caltex MAHs for new Terminal

Relevant Area MAHNumber MAH Description Considered

in QRALoc. Wharf

WRF-001Low flash point liquid hydrocarbon loading/unloading / Large scale loss of containment

Y

WRF-003High flash point liquid hydrocarbon loading/unloading / Large scale loss of containment

Y

Loc. Sub BerthSUB-005

High flash point hydrocarbon loading/unloading / Large scale loss of containment

Y

Loc. atmospheric tanks attank farm & associatedpumps and pipelines

OMC-001Hydrocarbon vapour inside empty tank /Ignition during maintenance

N

OMC-002Low flash point hydrocarbon storage &transfer / Large scale loss of containment

Y

OMC-003High flash point hydrocarbon storage &transfer / Large scale loss of containment

Y



8 FREQUENCY ASSESSMENT

8.1 FAILURE FREQUENCY

The likelihood of a potential release of a material from an “isolatable section” was determined from thelikelihood of equipment failure within that section. Any of the identified equipment items or fittingswithin the “isolatable section” could potentially fail and result in a release. For each “isolatablesection”, the frequency assessment involves counting the number of items (e.g. flanges, valves andinstrument fittings) and summing their individual failure rates, to obtain the overall failure frequency.This “parts count” process was conducted using P&IDs, which detailed the items included within each“isolatable section”.

A full parts count was completed for equipment configurations unique to particular sections within thefacility. The results of these full parts counts were then applied to similar equipment configurations.For example, for a group of similar storage tanks, the full parts count completed for one storage tankwas then applied to the others within the group.

For each “isolatable section”, the overall failure frequency was distributed across the selected holesizes. This frequency distribution was then used to determine the likelihood of the correspondinghazardous scenarios.

The frequency assessment used available historical failure rate data from the following public sources:

UK HSE - Failure Rate used for Land Use Planning Risk Assessments [19]

International Association of Oil & Gas Producers - Storage Incident Frequencies [20]

E & P Forum - Hydrocarbon Leak and Ignition Data Base [21].

These sources provide the failure rate data for equipment items and fittings, and the correspondingfailure rate distribution for a range of hole sizes. The failure rate data used in the QRA is summarisedin Appendix B.

The failure rate data obtained from public sources was used in the QRA without modification. Nospecific characteristics, such as environmental factors, were identified that would require the failuredata to be modified. For example, no unusually harsh conditions are experienced at the Kurnell sitethat would cause failure modes, such as corrosion, to occur at significantly higher rates than thosetypical across industry. Additionally, in Terminal operations, Caltex will continue to use its establishedintegrity management processes, which are largely-based on industry standards. It is expected thatthese established processes will serve to maintain integrity management performance at a level that isat least equal to the performance reflected within the failure rate data used in the QRA model. Caltexalso has established processes for corporate audits, insurance engineering surveys and externalaudits. These provide assurance on the effectiveness of these integrity management processes.Therefore, it is considered reasonable to use the data summarised in Appendix B without modification.

8.2 EVENT TREE ANALYSIS

Event trees were used to estimate the frequency of a consequence event for a given release scenario.Event tree analysis provides a systematic means of determining which factors will influence therelease, in addition to the probability associated with each of those factors.

The following parameters are generally considered in event tree analysis:

Probabilities of release detection and isolation

Time taken to detect and isolate the release

Probability of ignition (immediate ignition and delayed ignition)

An example event tree structure incorporating release detection and isolation times is presented inFigure 6.



Figure 6: Event Tree Structure (Detection and Isolation Component)

In this analysis, a targeted approach was used to determine whether the release detection andisolation times were included in the event tree analysis for a given scenario. These factors were onlyconsidered for the hazardous scenarios with consequence events that were significantly influenced bythe failure to isolate. For other hazardous scenarios and consequence events (i.e. those whereisolation and detection did not significantly affect the contribution to the risk profile), event treeanalysis was not conducted.

8.3 TANK OVERFILL / EXPLOSION FREQUENCY

A detailed assessment was conducted to determine the frequency of an explosion following the overfillof a storage tank containing unleaded petrol. The assessment did not consider tanks containing jetfuel or diesel because these substances do not contain the light hydrocarbon components necessaryto form a large vapour cloud following an overfill event.

The frequency of an explosion following tank overfill was evaluated using a fault tree to assess theoverfill frequency and an event tree to quantify the explosion event frequency. The fault tree analysisdetermined the frequency of a significant overfill resulting from an error during tank filling operations.The analysis considered the following factors:

The number of filling operations;

The probability of operator error; and

The controls in place to prevent overfill and their effectiveness.

The investigations into the Buncefield incident developed a series of recommendations for operatorsof bulk fuel storage depots. These recommendations were targeted at reducing the risk of an incidentof this nature. In transitioning to Terminal operations, Caltex performed a gap assessment againstthese recommendations. This assessment helped to identify appropriate controls for an overfill /explosion scenario involving the gasoline storage tanks. A full list of the Buncefield recommendationsis reproduced in Appendix C.

Based on the assessment, Caltex have adopted improved controls for tankage. A number of listedcontrols are already in place with the others to be implemented during the Terminal transition.



Table 7: Tank Overfill / Explosion ControlsType of Control Controls

Prevention controls Primary level indication with high level alarm (radar gauge)

Independent level indication with high-high level alarm

Independent SIL-rated trip of tank inlet valve on high-high-high levelalarm

Tank design and maintenance program in accordance with industrygood practice

Continuous monitoring of tank inventory from a centralised controlroom

Operating procedures controlling quantity of material transferred

Classification of hazardous areas and selection of equipment andprotective systems is conducted in accordance with AustralianStandards HB13-2007 and AS2381

All tanks have installed earthing and maintenance program

Detection Flammable gas detectors and control room alarms for tankcompounds of low flash point flammable liquids

Remote CCTV monitoring for tank compounds of low flashpointflammable liquids

Tank top infra-red flame detection for low flash point flammable liquidstorage tanks

Routine operator tank farm inspections

Isolation Remote-actuated fire-rated tank inlet / outlet valves

Spill Response Bund capacity, design and construction equivalent compliance toAS1940

Primary response capability to apply foam up to, and including, fullbund surface area of largest tank compound

Tank bund drainage isolation valves operable external to bund

Event Response Tank separation distances compliant to s5.7 of AS1940.

Caltex personnel trained in advanced fire fighting techniques,specific Caltex equipment and incident management approachcommon to Fire & Rescue NSW.

Facility Emergency Plan & Pre-incident plans.

The fault tree analysis considered those controls that would directly act to prevent the tank overfill(e.g. tank level indication with high level alarm) or limit the amount of material released (e.g. gasdetector linked to an alarm). For each control, the effectiveness was determined by quantifying thereliability of individual components. Where controls relied on human intervention, the derivedeffectiveness accounted for the probability of operator error within the time required to respond.

The event tree analysis estimated the frequency of an explosion resulting from the ignition of asignificantly large vapour cloud formed following an overfill. In assessing the outcome frequency, thefollowing factors were considered:

Ignition probability;

The probability of stable weather conditions (i.e. atmospheric stability category F); and

The probability of a low wind speed that would result in the formation of a significantly largevapour cloud.

The explosion event frequency was estimated to be less than 0.01 in a million per year (<1×10-8

peryear). This event is not considered to be a significant contributor to the overall risk profile. Incomparison, the average risk of fatality from a lightning strike is 0.1 in a million per year (1×10

-7per

year) [2].



9 CONSEQUENCE ANALYSIS

For each hazardous scenario, consequence modelling was conducted for a range of hole sizes. Theconsequence modelling determined the area impacted by each consequence event. Theconsequence modelling was conducted using the software package PHAST-RISK [5]. The modelswithin PHAST-RISK were used to determine the consequence impact distances for the heat radiationfrom the pool fires.

The consequence impact distances for each effect type depends on the following conditions:

Release conditions (temperature, pressure, hole size and duration)

Release source (elevation, orientation)

Chemical properties

Atmospheric conditions (wind speed).

Independent of their likelihood, several pool fire events and the VCE events were considered to havepotential to cause an off-site fatality and / or injury. These results are summarised in Table 8, groupedby MAH. Table 9 lists a number of locations along the facility boundary where the MAHs have thepotential for off-site fatality. Of these locations, only those positions adjacent to storage tanks areimpacted by the scenarios considered in the QRA model.

Table 8: Consequence Events with Off-site Fatality or Injury Impact

MAH Related IsolatableSections

ConsequenceDescription Offsite Impact

OMC-002, OMC-003Storage tanks adjacent theNorth-Eastern, Eastern and

Western boundaries

"Very large" spill fire Injury Only

Full-surface bund fire Fatality and injury

OMC-002, OMC-003Transfer pipelines betweenwharf and terminal pipeway

Fire following a largerelease from pipeline

Fatality and injury

OMC-002Storage tanks near the

North-Eastern and Easternboundaries

VCE following a tankoverfill event

Fatality and injury

Table 9: Off-site Locations Potentially Impacted by MAH ScenariosLocation Event Type MAH No.

Intersection of Silver Beach Road and CaptainCook Drive

Not impacted

Kurnell Social Club Not impacted

Cook Street Boundary

Full-surface bundfire

OMC-002

VCE following atank overfill event

OMC-002

Reserve Road Boundary

Full-surface bundfire

OMC-002

VCE following atank overfill event

OMC-002

National Park BoundaryVCE following a

tank overfill eventOMC-002

Chisholm Rd Commercial PremisesFull-surface bund

fireOMC-003

Sir Joseph Banks Drive Boundary Not impacted

HCE BoundaryFull-surface bund

fireOMC-003

To provide guidance on the impact experienced from different fire events, the downwind impactdistance for a number of consequences are presented in Table 10. These are measured from thecentre point of the storage.



Table 10: Typical Impact Distances for Fire Scenarios

Event Distance to fatality(approx 12.5 kW/m2)

Distance to injury(approx 4.7 kW/m2)

Full surface tank fire – up to 50 mdiameter

Typically not reached atground level outside of bund


Full surface tank fire – up to 78 mdiameter



Full bund fire – up to 8000 m2

62 m 130 m

Full bund fire – up to 25,500 m2

101 m 194 m

Fire from catastrophic failure of anytransfer pipeline

26 m 60 m

Fire from catastrophic failure of anyloading arm

20 m 35 m

Due to the relative height of the storage tanks and the observer, the heat flux radiation experiencedfrom a full-surface tank fire does not exceed injury levels under average weather conditions.



10 RISK ASSESSMENT


Individual risk was determined by combining the frequency and consequence data for each hazardousscenario. Individual risk contours were developed by plotting lines that connect different locationsexperiencing the same levels of risk. The individual risk of fatality contours are presented in Figure 7.

Figure 7: Location-Specific Individual Risk of Fatality (Off-site Assessment)

The risk results were compared to the risk criteria to determine the tolerability of the risk from theproposed operations. The particular aspects of the risk criteria applicable to this study were [2]:

Hospitals, schools, child-care facilities and old age housing development should not beexposed to individual fatality risk levels in excess of 0.5 x 10

-6per year.

Reserve RoadRefinery Boundary

Chisholm RoadRefinery Boundary

Cook StreetRefinery Boundary



Residential developments and places of continuous occupancy, such as hotels and touristresorts, should not be exposed to individual fatality risk levels in excess of 1 x 10

-6per year.

Commercial developments, including offices, retail centres, warehouses with showrooms,restaurants and entertainment centres, should not be exposed to individual fatality risk levelsin excess of 5 x 10

-6per year.

Sporting complexes and active open space areas should not be exposed to individual fatalityrisk levels in excess of 10 x 10

-6per year.

Individual fatality risk levels for industrial sites at levels of 50 x 10-6

per year should, as atarget, be contained within the boundaries of the site where applicable.

The 0.5 x 10-6

per year risk contour extends off-site in some areas but does not extend to sensitiveareas such as the pre-school, which is located to the north of the Terminal boundary on Captain CookDrive. This aspect of the criteria is therefore satisfied.

The 1 x 10-6

per year risk contour extends off-site in some areas but does not extend to residentialareas. This aspect of the criteria is therefore satisfied.

The 5 x 10-6

per year risk contour extends off-site in some areas but does not extend to commercialdevelopments. This aspect of the criteria is therefore satisfied.

The 10 x 10-6

per year risk contour extends off-site in some areas but does not extend to active openspace such as the Kurnell Recreational Club, which is located to the west of the Terminal boundary onCaptain Cook Drive. This aspect of the criteria is therefore satisfied.

The analysis has found the 50 x 10-6

per year individual risk level does not exceed the site boundary.This aspect of the criteria is therefore satisfied.

The tolerability of the fatality risk results is summarised in Table 11.

Table 11: LSIR Fatality Risk Tolerance Criteria [2]

Land UseTolerance Criteria


LSIR Results

Sensitive areas, such as hospitals and schools 0.5The relevant LSIR

contours do notextend to each of

these areas.All criteria are

satisfied.

Residential developments and continuousoccupancy, such as hotels and resorts

1.0

Commercial developments, including retailcentres, offices and entertainment centres

5

Sporting complexes and active open space 10

Industrial areas 50

The model was used to determine the consequence events that contribute to the risk at differentlocations along the boundary. Risk contributors were identified at locations corresponding to theReserve Road Boundary and the Chisholm Rd boundary (refer to Figure 7). The risk contributors atthese locations are presented in Table 12.



Table 12: Risk ContributorsLocation Contributing Consequence Event MAH No. Risk Contribution

Reserve RoadRefinery Boundary

Full-surface bund fire associatedwith storage tanks near the north-eastern and eastern boundaries

OMC-002 98%

VCE following a tank overfill eventassociated with storage tanks nearthe north-eastern and easternboundaries

OMC-002 2%

Cook StreetRefinery Boundary

Full-surface bund fire associatedwith storage tanks near the north-eastern and eastern boundaries

OMC-002 98%

VCE following a tank overfill eventassociated with storage tanks nearthe north-eastern and easternboundaries

OMC-002 2%

Chisholm RoadRefinery Boundary

Full-surface bund fire associatedwith storage tanks near the westernboundary

OMC-002 100%




The injury risk results were generated by applying the impairment criteria defined in Section 6.2. Theresulting individual risk of injury contour for heat radiation is presented in Figure 8. A correspondingindividual risk of injury contour for explosion overpressure is not presented because the explosionevent frequency is below the criterion level.

Figure 8: Location-Specific Individual Risk of Injury – Heat Radiation (50 x 10-6 per year)



The tolerability of results was determined by comparison with the HIPAP4 injury risk criteria [2]. As theconsequence events analysed were pool fires and an explosion resulting from a tank overfill event (i.e.no toxic vapour dispersion), the particular aspects of the risk criteria applicable to this study were:

Heat flux radiation at residential and sensitive land-use areas should not exceed 4.7 kW/m2

ata frequency of more than 50 x 10

-6per year.

Explosion overpressure at residential and sensitive land-use areas should not exceed 7 kPa atfrequencies of more than 50 x 10

-6per year.

The 50 x 10-6

per year individual risk of injury risk contour for heat flux radiation is mostly containedon-site, only extending beyond boundary in the north-east section of the terminal. However, it doesnot reach residential areas or sensitive areas (e.g. the pre-school, which is located to the north of theterminal on Captain Cook Drive). This aspect of the criteria is therefore satisfied.

The risk of explosion calculated for a tank overfill event was below 50 x 10-6

per year. Consequently,an injury risk plot for explosion overpressure is not presented, as the risk does not exceed the criterialevel of 50 x 10

-6per year at any location. This aspect of the criteria is therefore satisfied.

The injury risk criteria for toxic exposure was not applicable, as the QRA did not involve scenarioswhich could result in this type of event. The acceptability of the injury risk criteria is summarised inTable 1.

Table 13: LSIR Injury Risk Tolerance Criteria [2]

Individual Injury Risk CriteriaTolerance Criteria


Tolerability

Incident heat flux radiation at residentialand sensitive areas exceeding 4.7 kW/m

2.

50The relevant LSIR contoursdo not extend to theseareas. The criteria is met.

Incident explosion overpressure atresidential and sensitive use areas shouldnot exceed 7 kPa at frequencies.

50

Toxic concentrations in residential andsensitive use areas exceed a level whichwould be seriously injurious to sensitivemembers of the community following arelatively short period of exposure.

10

Not applicable, as the QRAdid not involve scenarioswhich could result in thistype of event.



10.3 SOCIETAL RISK – OFF-SITE POPULATION

The societal risk exposure for the off-site population was assessed using an “F-N curve” and the“indicative societal risk criteria” described in HIPAP4 [2]. The “F-N curve” for the Project is presentedin Figure 9, which also shows the “indicative societal risk criteria”.

Figure 9: Societal Risk Results – Off-site Population

As can be seen from Figure 9, the “F-N curve” lies below the “negligible” line. In this region, thesocietal risk is not considered significant, provided other individual risk criteria are met. As describedin the preceding sections, the individual risk criteria for fatality and injury are satisfied and thereforethe societal risk is also considered tolerable.


The risk of property damage and accident propagation was assessed using the impairment criteriadefined in Section 6.4. The resulting risk contour for heat radiation is presented in Figure 10. Acorresponding risk contour for explosion overpressure is not presented because the explosion eventfrequency is below the criterion level.

1.00E-09

1.00E-08

1.00E-07

1.00E-06

1.00E-05

1.00E-04

1.00E-03

1.00E-02

1.00E-01

1 10 100 1000

Freq

uenc

y of

N o

r mor

e fa

talit

ies

(F, /

year

)


Intolerable

Negligible

ALARP



Figure 10: Location-Specific Risk of Property Damage and Accident Propagation – HeatRadiation (50 x 10-6 per year)

The tolerability of results was determined by comparison with the following risk criteria defined withinHIPAP4 [2]:

Incident heat flux radiation at neighbouring potentially hazardous installations or at land zonedto accommodate such installations should not exceed a risk of 50 x 10

-6per year for the

23 kW/m2

heat flux level.



Incident explosion overpressure at neighbouring potentially hazardous installations, at landzoned to accommodate such installations or at nearest public buildings should not exceed arisk of 50 x 10

-6per year for the 14 kPa explosion overpressure level.

The 50 x 10-6

per year risk contour for heat flux radiation is contained on-site. Therefore, it does notreach neighbouring areas, including potentially hazardous installations. This aspect of the criteria issatisfied.

In Figure 10, the 50 x 10-6

per year risk contour appears as numerous individual sections of the samecontours that are limited to the immediate area. For example, within the Tank Farm, different sectionsof the contours are contained within the corresponding bunded area. This demonstrates that thesecontours do not extend to impact surrounding infrastructure, such as storage tanks within adjoiningareas.

The risk of explosion at the facility did not exceed 50 x 10-6

per year. Consequently, a risk plot forexplosion overpressure is not presented, as the risk does not exceed the criteria level of 50 x 10

-6per

year at any location. This aspect of the criteria is therefore satisfied.

The acceptability of the risk criteria is summarised in Table 1.

Table 13: Risk of Property Damage And Accident Propagation Tolerance Criteria [2]

Risk CriteriaTolerance Criteria


Tolerability

Incident heat flux radiation at neighbouringpotentially hazardous installations or atland zoned to accommodate suchinstallations for the 23 kW/m

2heat flux.

50

The relevant LSIR contoursdo not extend to theseareas. The criteria are

met.

Incident explosion overpressure atneighbouring potentially hazardousinstallations, at land zoned toaccommodate such installations or atnearest public buildings for the 14 kPaexplosion overpressure level

50


The risk to the biophysical environment examines the potential effects on the long-term viability of theecosystem or any species within it. The risk was assessed by examining release scenariosassociated with the operations of the facility. In assessing the potential impact, the analysisconsidered the controls that would prevent, or mitigate, the impact an incident could have on thesurrounding environment.

For the wharf, the QRA identified release scenarios at the product loading arms and the pipelinesalong the wharf. A release from this equipment could affect the marine environment of Botany Bay.However, there are a number of controls in place that would minimise the potential for a release. Theequipment items are subject to testing and inspection programs, in line with Caltex’ integritymanagement programs. During unloading operations, there are personnel in attendance who, if arelease occurred, would be able to detect the leak and isolate the source. Additionally, a spill at theloading arms would be contained within the purpose-built spill containment areas. These factors willlimit the amount of material that would typically be released following a failure. A release of product atthe wharf is not considered likely to threaten the long-term viability of the ecosystem.

For the tank farm, the QRA identified release scenarios at the product storage tanks, as well as theassociated pipelines and pumps. The potential for release from this equipment is managed by Caltexthrough a maintenance program to ensure the integrity of equipment. If a release occurs, it would becontained within the bunded areas surrounding storage tanks and pumps or within the pipeways.Impacts to surrounding ecosystems would be negligible. A release would be identified by the spill



detection within the Terminal that includes routine operator surveillance, routine “dead tank”monitoring and flammable vapour detection. An appropriate response would then be activated toclean-up a spill. Additionally, the containment areas can be drained to the oily water system, whereproduct would be retained, preventing the discharge of any remaining product direct to theenvironment. Therefore, a release of product within the terminal would not threaten the long-termviability of the ecosystem.

Caltex also maintains an Environmental Aspects and Impacts Register, as part of its requirements forcompliance with ISO 14001 [22]. The register identifies potential sources of accidental release,assesses the potential consequence, identifies key risk controls and ranks the risk using Caltex’sRiskman2 process.

10.6 SENSITIVITY ANALYSIS

QRA models are developed based on a number of assumptions with some assumptions being moreinfluential than others. The assumptions used in the current study were reviewed to determine thosethat could influence the risk results. Assumptions related to the following areas were considered mostinfluential:

Frequency Data, including modification factor and utilisation

Pool Fire Modelling; and

Heat Radiation Vulnerability.

The frequency data used in the analysis was obtained from available public source. For reasonsoutlined in Section 8.1, this frequency data was applied in the QRA without modification. A sensitivityanalysis was conducted to determine the influence possible modifications would have in the results.This analysis involved doubling the frequency used in the model, i.e. a doubling of the failure rate.Although there was a change in the individual risk of fatality contours, these changes did not result inany of the risk contours exceeding the applicable criteria and therefore the conclusions maderegarding risk tolerability were unchanged.

A number of assumptions were made concerning the modelling of pool fires. The magnitude of thepool fire consequences depends on the selected representative material, operating pressure and spillcontainment size. Of these parameters, the greatest variable observed is the operating pressure (andtank level), which influences the release rate and pool fire size. While a change in pressure or levelwould result in large pool forming, the physical spill containment would limit the pool size andsubsequent fire size. Adjustment of related assumptions causes an increase in the risk contours mostinfluenced by the medium to large releases. However, these effects are limited to on-site areas andthe risk off-site is not altered significantly. The conclusions made regarding risk tolerability remainedunchanged.

The heat radiation vulnerability model and corresponding exposure time selected for use in the QRAare other assumptions that would influence the risk results. The vulnerability model is used todetermine the fatality impact based on the calculated heat flux and an assumed exposure time (referto Assumption No. 13 in Appendix A). This study used the model developed by TNO for "unprotected"personnel. An alternate choice is the Eisenberg equation, however, a higher heat flux is required toobtain the same fatality impact assuming the same exposure time. Therefore, the parameter ofgreater influence is exposure time. A longer exposure time would results in a higher fatality for thesame heat flux. The exposure time would have to be at least doubled before the risk results would beincreased to the extent that may alter the conclusions regarding risk tolerability.

In summary, the sensitivity of the QRA model to various parameters was reviewed. Significantvariations to these assumptions were investigated. The overall conclusions of the QRA modelregarding risk tolerability remained unchanged despite these modifications to the QRA model.



11 COMPARISON TO RISK AT THE EXISTING FACILITY

The conversion to terminal operations results in a significant reduction in the number of major accidentscenarios at the site due to the shut-down of the refinery process units. Following conversion toterminal operation, there will be a general reduction in the extent of the off-site risk. This reductioncan be attributed to the following factors:

Shut-down of refinery process units results in the decommissioning of the LPG storagearea (and the associated pipe network).Under refinery operations, LPG storage areas were in close proximity to the site boundaryand several release scenarios had the potential to impact off-site areas. The change toterminal operations will eliminate these scenarios.

Shut-down of refinery process units results in the ceasing of operations involving toxicmaterial, such as chlorine and hydrogen sulphide.In previous studies, large release scenarios involving these materials had the potential toextend into off-site areas. The change to terminal operations will eliminate these scenarios.

Reduced potential for events with far-reaching impacts such as boiling liquid-expanding vapour explosion (BLEVE) scenarios.Due to the removal of liquefied gas inventories, the potential for BLEVEs will be eliminated.Removal of these hazardous inventories will also significantly reduce the number of potentialVCEs.

A significant reduction in the inventory of flammable and combustible liquids.While the site will retain approximately 60% of the existing tankage, the hazardousinventories within the refinery process units will be eliminated.

Modifications to storage tank operations.The individual risk of fatality will be reduced at certain locations as a result of;

o Conversion of some tankage close to the site boundary to less hazardous duty (e.g.crude tanks converted to diesel)

o The commitment to improved risk controls at some locations as a result ofimplementing the Project (e.g. automated overfill protection on gasoline tanks).



12 REFERENCES

1 State Environment Planning Policy No 33 - Hazardous and Offensive Development,published in Gazette No 36 of 13/03/1992, p 1754.

2 New South Wales Government, Department of Planning, “Hazardous Industry PlanningAdvisory Paper No. 4, Risk Criteria for Land Use Safety Planning”, January 2011 (HIPAPNo. 4).

3 New South Wales Government, Department of Planning, “Hazardous Industry PlanningAdvisory Paper No. 6, Hazard Analysis”, January 2011 (HIPAP No. 6).

4 Caltex Refineries (NSW) Pty Ltd., "Caltex Kurnell Refinery – Neighbourhood Layout”,Drawing Number A1-127103, Revision 1.

5 Det Norske Veritas, PHAST-RISK (Safeti), Version 6.7,http://www.dnv.com/services/software/products/safeti/safeti/index.asp

6 Taveau, J., “The Buncefield explosion: were the resulting overpressures reallyunforeseeable?”, Process Safety Progress, Vol 31, No. 1, 2011.

7 Committee for the Prevention of Disasters, “Methods for calculation of physical effects – Part2 Yellow Book CPR 14E”, Third Edition, Chapter 5 Vapour Cloud Explosion, 2005.

8 DNV ENERGY, “Illustrative model of a risk based land use planning system aroundpetroleum storage sites”, Buncefield Major Incident Investigation Board, Rev 0, May 2008.

9 Caltex Refineries Pty Ltd, Material Safety Data Sheet, “Automotive Diesel Fuel”, Infosafe™No. ACRJ8, November 2011.

10 Caltex Refineries Pty Ltd, Material Safety Data Sheet, “Fuel Oil”, Infosafe™ No. AMQ17,May 2009.

11 Caltex Refineries Pty Ltd, Material Safety Data Sheet, “Jet A-1 Fuel”, Infosafe™ No. AMQ36,September 2011.

12 Caltex Refineries Pty Ltd, Material Safety Data Sheet, “Super Premium Unleaded Petrol of98 RON”, Infosafe™ No. LPTL8, May 2009.

13 Caltex Refineries Pty Ltd, Material Safety Data Sheet, “Unleaded Petrol”, Infosafe™ No.AMPHO, May 2009.

14 CHRIS Manual (Chemical Hazards Response Information System), “Oils: Diesel” data sheet,US Department of Transportation / US Coast Guard, June 1999.

15 CHRIS Manual (Chemical Hazards Response Information System), “Oils, Fuel: 4” datasheet, US Department of Transportation / US Coast Guard, June 1999.

16 Caltex Refineries (NSW) Pty. Ltd. Drawing, “Plant 10-Wharf Breasting Island Upper DeckSpill Containment Area”, Dwg No. 147999, Rev 0, 14 September 2012.

17 Buncefield Major Incident Investigation Board, “The Buncefield Incident 11 December 2005,The Final Report of the Major Incident Investigation Board”, December 2008

18 UK Health and Safety Executive, “Buncefield Explosion Mechanism Phase 1”, RR718, 2009.



19 UK HSE, Failure Rate and Event Data for use within Land Use Planning Risk Assessments,2000.

20 International Association of Oil & Gas Producers, “OGP Risk Assessment Data Directory;Storage Incident Frequencies”, Report No. 434-3, March 2010.

21 E & P Forum, “Hydrocarbon Leak and Ignition Data Base”, Report No. 11.4/180, May 1999.

22 International Standards Organisation, ISO 14001:2004, Environmental managementsystems — Requirements with guidance for use.


15 May 2013 Page A.1 of 19R4Risk Ref.: 107-24, Release 5

APPENDIX A ASSUMPTION REGISTER

This appendix documents the technical assumptions made during the QRA.



List of AssumptionsAssumption No. 1: Study Boundaries .....................................................................................................3Assumption No. 2: Isolatable Sections ...................................................................................................4Assumption No. 3: Release Rates ..........................................................................................................5Assumption No. 4: Representative Materials..........................................................................................6Assumption No. 5: Pipe Lengths.............................................................................................................7Assumption No. 6: Frequency Data ........................................................................................................8Assumption No. 7: General Utilisation ....................................................................................................9Assumption No. 8: Wharf Utilisation .....................................................................................................10Assumption No. 9: Product Transfer Utilisation ....................................................................................11Assumption No. 10: Ignition Probability ................................................................................................12Assumption No. 11: Pool Fire Modelling...............................................................................................13Assumption No. 12: Weather Data .......................................................................................................15Assumption No. 13: Heat Radiation Vulnerability .................................................................................16Assumption No. 14: Overpressure Impact ............................................................................................17Assumption No. 15: Vulnerability Summary..........................................................................................18Assumption No. 16 Off-site Population Data ........................................................................................19



Assumption No. 1: Study Boundaries

Category: Hazard Identification

The QRA considered equipment containing/handling flammable or combustible liquids at the facilitywhen operating as a Terminal. The major areas considered were:

Atmospheric storage tanks within tank farms

Wharf operations, including ship loading / unloading

Internal pipelines involved in terminal operations

Pumps involved in transfer of product.

The hazards identified for the operation were the result of fabric failures, i.e. the failure of equipmentdue to corrosion, material / construction defects and design error.



Assumption No. 2: Isolatable Sections

Category: Hazard Identification

An “isolatable section” is a system of pipes and / or equipment within the Terminal that containhazardous materials. The isolatable section is bound by specific isolation points, such as valvesthat can be operated remotely from the control room.

Where possible, emergency shutdown valves (ESDVs) were nominated as the isolation points,rather than control valves.



Assumption No. 3: Release Rates

Category: Consequence Analysis

When modelling the effects associated with the identified hazardous scenarios, constant releaserates were assumed. Release rates were calculated based on the material, hole size and operatingtemperature and pressure. Where appropriate, the calculated release rates were limited to thespecified process flow rate through the corresponding pipeline.



Assumption No. 4: Representative Materials

Category: Consequence Analysis

The material within an "isolatable section" was represented by a single representative hydrocarboncomponent for modelling purposes. In each case, the physical properties of the representativematerial were verified against the corresponding MSDSs provided by Caltex. The table below liststhe representative materials used in the QRA.

Material / Product Representative MaterialGasoline n-octane

Fuel Oil n-eicosane

ULP / PULP / SPULP n-octane

Jet Fuel n-dodecane

Diesel n-hexadecane

Slop* n-octane

Slop was assumed to be a mixture of diesel and gasoline. For the purposes of this analysis whereslop was modelled, it was assumed to have the same properties as gasoline.



Assumption No. 5: Pipe Lengths

Category: Equipment Design and Layout

The analysis considered all internal pipelines involved in operations at the Terminal. This includedpipelines connecting the wharf and storage tanks. The routes taken by the pipelines were shown ondiagrams provided by Caltex. The lengths of the pipelines were estimated from the scaled facilityplot plan.

Impact:The piping dimensions have an impact on the frequency analysis conducted in the QRA. Pipefailure frequency is related to both the pipe size and pipe length. The failure frequency generallydecreases as the pipe size increases and it increases with pipe length. The dimensions of theprocess piping also affect the inventory held within the pipe and therefore the amount of materialthat may be involved in a release.

Reference:“Site Plans” detailing the equipment layout was provided by Caltex.



Assumption No. 6: Frequency Data

Category: Frequency Analysis

The failure frequency data used in the QRA was generated by reviewing leak data associated withtransfer process. This data was considered appropriate as the study mainly examines releasesinvolving the various hydrocarbons stored at the Terminal.

The failure frequency data used in the analysis is summarised in Appendix B.



Assumption No. 7: General Utilisation


The Terminal was assumed to be in continuous operation, i.e. storage tanks always containedproduct. However, due to the nature of the operation, equipment items such as the ship loadingarms (and connecting pipelines) would not be used continuously. The utilisation for this equipmentwas adjusted based on information provided by Caltex.



Assumption No. 8: Wharf Utilisation


The failure frequency associated with the loading / unloading of material at the wharf was based onthe number of shipments per year for terminal operation. Caltex provided data detailing theexpected number of shipments for each product, as well as the number of movements involving theexport of slop.

For each material, the utilisation was determined using the following equation:

% = ( ) × %The total time to unload all shipment per year (for each material) was determined by the following:

= . ℎ × ℎ ( )( /ℎ )For all materials, shipment activities involved the use of two loading arms at the fixed berth on thewharf. Diesel will also be received at the submarine berth.

For each product, the calculated utilisation was used to determine the failure frequency of thepipelines connecting the loading arms to the corresponding storage tanks. Additional scenarioswere added representing the portion of the time that these pipelines were not in use (referred to as“static”). For the “static” scenarios, the pipeline pressure was assumed to be based on the liquidhead, i.e. the pipe elevation.



Assumption No. 9: Product Transfer Utilisation


The utilisation of the pipelines used to transfer product from the storage tanks to the Banksmeadowfuel distribution terminal was determined.

In terminal operations, a number of other pumps may be used for a range of operations within thefacility. Caltex’s expectation is that these pumps will be rarely used. These additional pumps havebeen included in the QRA with an utilisation of 1%.



Assumption No. 10: Ignition Probability

Category: Event Tree Analysis

The following probability values were used to quantify ignition of different materials. Theseprobabilities were used in the event tree analysis to determine the frequency of the resultingconsequence events. The ignition probability used for flammable liquids is summarised in the tablebelow.

Leak Category Release Rate Probability of IgnitionMinor < 1 kg/s 0.01

Major 1-50 kg/s 0.03

Massive > 50 kg/s 0.08

For combustible liquids, the ignition probabilities listed above were multiplied by 0.1 to reflect thelower chance of ignition due to the higher flash points of such materials.

Reference A.W. Cox, F.P. Lees and M.L. Ang, “Classification of Hazardous Locations”, IChemE, 1993.



Assumption No. 11: Pool Fire Modelling

Category: Consequence Modelling

For scenarios involving the release and ignition of a flammable or combustible liquid spill from tankfarm operations, wharf operations or associated pipelines, the only outcome considered in the QRAwas a pool fire. Due to ambient operating temperatures, a negligible amount of vapour flash, if any,would not occur. Therefore consequence types involving vapour dispersion (i.e. flash fires) werenot considered.

Depending on the location of the event on the site, limits were placed on the maximum pool size asfollows:

In the tank farm, the maximum pool fire diameter was limited by the bund area.

In pipeways, the maximum pool fire diameter was limited to the width of the pipe trench.

At the wharf, the maximum pool diameter was limited by the spill containment capability ofthe berth at the wharf (equivalent diameter of approximately 15 m).

For pumps, the maximum pool fire diameter was limited by the area defined by surroundingkerbing.

When modelling pool fires, the pool fire diameters were adjusted to account for the influence of thewind, which extends the fire downwind by a distance commonly referred to as the “flame drag”. Forpool fire events, the average wind speed for the site was used to calculate the “flame drag”.

Pool fires involving materials identified at the Terminal would produce “smoky” flames. These fireswere are modelled within PHAST by setting the flame type to "smoky", which makes use of thefollowing equation:

= + − Equation 1

Units:Surface emissive power of flame ( ) W/m

2

Maximum luminous emissive power ( ) W/m2

Smoke emissive power ( ) W/m2

Characteristic length for decay of ( ) m

Flame diameter (D) m

In calculating the radiant heat, the model considers the fraction of radiation emitted from a flamethat is not absorbed by the atmosphere before reaching the observer. This parameter is referred toas the atmospheric transmissivity ( ), which defined as follows:= . − . ∙ [ ( )] − . ∙[ ( )] − . ∙ [ ( )] + . ∙[ ( )] Equation 2

The adsorption coefficients for water vapour ( ( )) and carbon dioxide ( ( )) are defined asfollows: ( ) = . ∙ ∙ Equation 3

( ) = ∙ Equation 4

Units:Water vapour pressure ( ) Pa

Distance from flame surface to observer ( ) mAtmospheric temperature ( ) K



Reference: Mudan K.S. & Croce P.A., "Fire Hazard Calculations for Large Open Hydrocarbon Fires",

The SFPE Handbook of Fire Protection Engineering, 1st Edition, 1988.

Harper, M., "POLF (Pool Fire) Theory Document", DNV, London, October 2005.

Harper, M., "EXPS Theory Document", DNV, London, October 2005.



Assumption No. 12: Weather Data

Category: Consequence Modelling / Risk Analysis

The meteorological data used in the analysis was derived from 10-minute weather observationstaken by Caltex at the Kurnell Refinery.

Six atmospheric stability classes / wind speed combinations were considered used in the analysis,coupled with 16 wind directions. The probability of each atmospheric stability class / wind speedcombination occurring during the daytime was also determined for use in societal risk calculations.The probability distribution is provided below.

Stability Category A/B C DL DU E F AverageConditions

Wind Speed (m/s) 3.0 3.6 3.5 6.2 3.5 1.9 3.5

Temperature (C) 23.7 20.9 18.9 18.4 17.3 15.6 18.5

Relative Humidity(%)

56% 61% 74% 69% 73% 79% 71%

Probability 8% 17% 18% 17% 12% 27% 100%

Direction Probability of Wind DirectionN 0.063 0.042 0.027 0.001 0.021 0.092 0.045

NNE 0.040 0.036 0.052 0.006 0.127 0.136 0.072

NE 0.105 0.139 0.087 0.080 0.108 0.069 0.094

ENE 0.142 0.090 0.054 0.003 0.021 0.034 0.050

E 0.107 0.052 0.057 0.010 0.026 0.034 0.043

ESE 0.073 0.055 0.086 0.044 0.044 0.017 0.048

SE 0.038 0.026 0.054 0.070 0.029 0.013 0.037

SSE 0.039 0.041 0.130 0.111 0.083 0.014 0.067

S 0.042 0.044 0.066 0.143 0.049 0.009 0.056

SSW 0.029 0.056 0.067 0.272 0.049 0.009 0.080

SW 0.018 0.048 0.083 0.145 0.086 0.015 0.064

WSW 0.016 0.020 0.033 0.027 0.072 0.039 0.034

W 0.012 0.054 0.036 0.043 0.105 0.080 0.058

WNW 0.030 0.068 0.041 0.019 0.073 0.118 0.066

NW 0.081 0.107 0.055 0.012 0.052 0.156 0.086

NNW 0.165 0.121 0.072 0.013 0.056 0.166 0.102

Daytime Probability 1.00 1.00 0.72 0.64 0.00 0.00 0.50

Reference: CALMET files provided by Caltex for between 2003 to 2007 (2007 10 minute met.txt).



Assumption No. 13: Heat Radiation Vulnerability

Category: Risk Analysis

The following probit equation was used in the analysis to quantify the probability of fatality forindividuals exposed to heat radiation from a pool fire:= − . + . ∙ ⁄ Equation 5

Units:Thermal Radiation Intensity (I) W/m

2

Time (t) secondsProbit (Y) dimensionless

The "unprotected" probit was used to assess off-site risk, since an off-site population wouldgenerally not be expected to be wearing protective clothing.

In using the probit equations, a maximum exposure duration of 20 seconds was assumed. Thisvalue is an estimate of time taken for people to flee from harmful heat radiation. It considers thetime to react (approximately 5 seconds) and the time to move away from the area impacted by highlevels of heat radiation.

References: Committee for the Prevention of Disasters, “Methods for the determination of possible

damage”, CPR 16E “Green Book”, 1992.



Assumption No. 14: Overpressure Impact


The probability of fatality for individuals exposed to overpressure were defined for various levels ofoverpressure, as described below. The probabilities were based on guidance provided withinHIPAP4.

ExplosionOverpressure Effect Probability of Fatality

(Outdoors)

7 kPa (1 psi) Probability of injury is 10%. No fatality 0%

21 kPa (3 psi)20% chance of fatality to a person in abuilding

0%

35 kPa (5 psi)50% chance of fatality for a person in abuilding and 15 % chance of fatality for aperson in the open

15%

70 kPa (10 psi)100% chance of fatality for a person in abuilding or in the open

100%

References: New South Wales Government, Department of Planning, “Hazardous Industry Planning

Advisory Paper No. 4, Risk Criteria for Land Use Safety Planning”, January 2011 (HIPAP4).



Assumption No. 15: Vulnerability Summary


The table below details the impact that pool fire events may have on exposed personnel. Themodel used to calculate the impact depended on the location of the exposed personnel, whichvaried depending on the focus of the analysis.

Impact ConsequenceEvent Outdoor Indoor

HeatRadiation

Pool Fire<35 kW/m

2: probit

>35 kW/m2: 100% fatalities

<23 kW/m2: no fatalities

>23 kW/m2: 100% fatalities

Overpressure VCEBased on guidanceprovided within HIPAP 4

API 752*

* The probability of fatality was estimated based on the overpressure experienced and the buildingtype. The building categories used were those defined in API 752, “Management of HazardsAssociated with Location of Process Plant Permanent Buildings”, 2

ndedition, 2003.



Assumption No. 16 Off-site Population Data

Category: Societal Risk Calculations

The societal risk calculations were based on population data provided by Caltex (refer toAppendix D). For different locations, the population data detailed the expected number of peoplepresent at different times of the day. These population changes were considered in thecorresponding risk calculations.


15 May 2013 Page B.1 of 6R4Risk Ref.: 107-24, Release 5

APPENDIX B FAILURE RATE DATA

This appendix presents the failure frequency data used for each equipment item. For each equipmentitem, the failure frequency data for a range of failure modes was obtained from historical industry data.The failure modes are represented through a range of hole sizes.

The use of failure frequency from historical industry data without adjustment was consideredappropriate for this analysis. The UK HSE advises that adjustments should be made where, forexample, an assessed process design has a particularly arduous operating conditions or, alternatively,provides increased reliability. However, no particular characteristics of the Terminal operations wereidentified that justified adjusting the failure frequency data. For example, the environmental factorsexperienced at the facility are standard for its type. No excessively harsh conditions are experiencedthat would cause failure modes, such as corrosion, to occur at significantly higher rates.

Furthermore, the failure frequency data used in the QRA represent "typical" facilities with similaroperations. For example, the sources used to define the atmospheric tank failure rate were obtainedfrom a review of historical data for storage tank incidents. The reported data represents an averageperformance derived from facilities of various ages covering many management systems. Caltex willcontinue to use its established integrity management processes. These are based heavily uponindustry standards. These processes are expected to ensure that the integrity managementperformance within the facility is equal to, or better than, the performance of the "typical" facility thatthe failure frequency data represents. Caltex also has established processes for corporate audits,insurance engineering surveys and external audits to provide assurance as to the effectiveness ofthese integrity management processes. Therefore, it is considered appropriate to assess the Terminalusing historical data for a "typical" facility.



B.1 LOADING ARMS FOR LIQUID CARGO

The failure frequency for the transfer of liquid cargo at the wharf was based on loading/unloading armfailure rate from the UK HSE data [1]. Data is provided for the two failure sizes listed.

Table B-1: Loading / Unloading Arm Failure Rate

Hole Size (mm) Failure Rate [1](per transfer operation)

Equivalent to 10% of cross-sectional area of Arm

2.9 × 10-5

Arm Diameter 3.2 × 10-6

B.2 ATMOSPHERIC STORAGE TANKS

The atmospheric tank failure frequency for various release sizes was based on data from the UK HSEdata [1] and the OPG Risk Assessment Directory detailing storage incident frequencies [2]. Thefrequency distribution was derived using the OGP data.

Table B-2: Atmospheric Storage Tank Failure Rate

Hole Size (mm) Failure Rate(per tank per year)

20 2.1×10-3

50 4.2×10-4

100 2.8×10-4

Rupture 5.0×10-6

Historical data was used to determine the frequency of full surface fires associated with different typesof atmospheric storage tanks [2, 3].

Table B-3: Full-Surface Tank Fire Frequency

Tank Type Event Description Fire Frequency(per tank per year)

Floating Roof Full-Surface Tank Fire 1.2×10-4

Fixed RoofInternal Explosion and Full-

Surface Tank Fire9.0×10

-5

Fixed with Internal FloatingRoof

Internal Explosion and Full-Surface Tank Fire

9.0×10-5

B.3 PROCESS PIPING

The overall frequency has been taken from the E&P Forum [4]. The total frequency was distributed tothe representative hole sizes selected for the analysis by considering information presented in the Coxet al [5] and TNO [6].

Table B-4: Transfer Pipe (50mm < D ≤ 100mm) Failure RateHole Size (mm) Failure Rate (per metre-pipe year)

5 2.7 × 10-5

20 7.2 × 10-6

50 1.4 × 10-6

Pipe Diameter (100 mm) 3.6 × 10-7




5 2.7 × 10-5

20 7.2 × 10-6

50 1.4 × 10-6

100 1.8 × 10-7



5 2.0 × 10-5

20 5.4 × 10-6

50 1.1 × 10-6

100 1.4 × 10-7


B.4 PUMPS

The total failure frequency for pumps was taken from the OGP Risk Assessment Directory detailingprocess releases [7]. This source also provided information detailing the frequency distribution for arange of hole sizes.

Table B-7: Centrifugal Pump Failure Rate [7]Process Pipe Diameter (D) Hole Size (mm) Failure Rate (per year)

D ≤ 100 mm

5 4.0 × 10-3

20 5.6 × 10-4

50 9.9 × 10-5

Pipe diameter 5.8 × 10-5

D > 100 mm

5 4.0 × 10-3

20 5.6 × 10-4

50 9.9 × 10-5

100 2.9 × 10-5

Pipe diameter 2.9 × 10-5

B.5 FLANGES

The total failure frequency for flanges was taken from the OGP Risk Assessment Directory detailingprocess releases [7]. The data obtained from this source was distributed over the representative holesizes selected for the analysis [5].



Table B-8: Flange Failure RateProcess Pipe Diameter (D) Hole Size (mm) Failure Rate (per year)

D ≤ 50mm5 3.0 × 10

-5

20 1.2 × 10-5

50mm < D ≤ 100 mm5 3.4 × 10

-5

20 6.9 × 10-6

100 mm < D ≤ 150 mm5 4.4 × 10

-5

20 9.5 × 10-6

D >150 mm5 7.0 × 10

-5

20 1.4 × 10-5

B.6 MANUAL VALVES

The total failure frequency for manual valves was taken from the OGP Risk Assessment Directorydetailing process releases [7]. This source was also used to distribute the frequency between therepresentative hole sizes selected for the analysis. Other sources were not used, as those revieweddo not make a distinction between valve types.

Table B-9: Manual Valve Failure RateManual Valve Size (D) Hole Size (mm) Failure Rate (per year)

D ≤ 20 mm5 2.6 × 10

-5

20 8.2 × 10-6

20 mm < D ≤ 50 mm

5 2.6 × 10-5

20 5.0 × 10-6

50 3.2 × 10-6

50 mm < D ≤ 100 mm

5 3.4 × 10-5

20 6.9 × 10-6

50 1.5 × 10-6

100 2.0 × 10-6

100 mm < D ≤ 150 mm

5 4.2 × 10-5

20 8.6 × 10-6

50 1.8 × 10-6

100 6.3 × 10-7

150 1.8 × 10-6

D >150 mm

5 5.2 × 10-5

20 1.1 × 10-5

50 2.6 × 10-6

100 9.3 × 10-7

300 2.0 × 10-6



B.7 ACTUATED VALVES

The total failure frequency for actuated valves was taken from the OGP Risk Assessment Directorydetailing process releases [7]. This source was also used to distribute the frequency between therepresentative hole sizes selected for the analysis. Other sources were not used, as those revieweddo not make a distinction between valve types.

Table B-10: Actuated Valve Failure RateActuated Valve Size (D) Hole Size (mm) Failure Rate (per year)

D ≤ 20 mm5 2.8 × 10

-4

20 6.1 × 10-5

20 mm < D ≤ 50 mm

5 2.8 × 10-4

20 4.5 × 10-5

50 1.6 × 10-5

50 mm < D ≤ 100 mm

5 2.6 × 10-4

20 4.4 × 10-5

50 8.3 × 10-6

100 9.4 × 10-6

100 mm < D ≤ 150 mm

5 2.4 × 10-4

20 4.1 × 10-5

50 7.7 × 10-6

100 2.5 × 10-6

150 6.2 × 10-6

D >150 mm

5 2.4 × 10-4

20 3.8 × 10-5

50 6.2 × 10-6

100 1.8 × 10-6

300 6.6 × 10-6

B.8 INSTRUMENTATION

The total failure frequency for instrumentation was taken from the OGP Risk Assessment Directorydetailing process releases [7].

Table B-11: Instrumentation Failure RateHole Size (mm) Failure Rate (per year)

5 2.3 × 10-4

20 5.9 × 10-5

B.9 MIXERS FOR TANKS

The failure frequency data assumed for mixers connected to atmospheric tanks was based on thedata used for centrifugal pumps [7]. This data was used to represent the possible failure modesinvolving a seal failure. A limited hole size distribution has been applied to reflect the likely failuremodes associated with leaks for mixer seals.



Table B-12: Atmospheric Storage Tank Mixer Failure Rate

Hole Size (mm) Failure Rate(per tank per year)

5 4.0 × 10-3

20 7.2 ×10-4

B.10 REFERENCES

1 UK HSE, Failure Rate and Event Data for use within Risk Assessments, 2012.

2 International Association of Oil & Gas Producers, “OGP Risk Assessment Data Directory;Storage Incident Frequencies”, Report No. 434-3, March 2010.

3 LASTFIRE PROJECT, “Large Atmospheric Storage Tank Fire Project”, LASTFIRE TechnicalWorking Group, June 1997.

4 E & P Forum, “Hydrocarbon Leak and Ignition Data Base”, Report No. 11.4/180, May 1992.

5 A.W. Cox, F.P. Lees and M.L. Ang, “Classification of Hazardous Locations”, IChemE, 1993,Table 18.1, page 39.

6 TNO, “Guidelines for Quantitative Risk Assessment”, Purple Book, CPR 18E, 2005.

7 International Association of Oil & Gas Producers, “OGP Risk Assessment Data Directory;Process release frequencies”, Report No. 434-1, March 2010.


15 May 2013 Page C.1 of 6R4Risk Ref.: 107-24, Release 5

APPENDIX C BUNCEFIELD RECOMMENDATIONS

This appendix provides information on the recommendations arising from the Buncefield investigation.

A series of recommendations were by the Major Incident Investigation Board (MIIB) in relation to thedesign and operation of fuel storage sites [1]. The recommendations applicable to the facility arelisted in the following table, grouped by subject.

Design and operation of fuel storage sites

RECOMMENDATION 1 – Systematic assessment of safety integrity level requirements

The Competent Authority and operators of Buncefield-type sites should develop and agree a commonmethodology to determine safety integrity level (SIL) requirements for overfill prevention systems in line with theprinciples set out in Part 3 of BS EN 61511. This methodology should take account of:

the existence of nearby sensitive resources or populations;

the nature and intensity of depot operations;

realistic reliability expectations for tank gauging systems; and

the extent/rigour of operator monitoring.

Application of the methodology should be clearly demonstrated in the COMAH safety report submitted to theCompetent Authority for each applicable site.

Existing safety reports will need to be reviewed to ensure this methodology is adopted.

RECOMMENDATION 2 – – Protecting against loss of primary containment using high integrity systems

Operators of Buncefield-type sites should, as a priority, review and amend as necessary their managementsystems for maintenance of equipment and systems to ensure their continuing integrity in operation. This shouldinclude, but not be limited to reviews of the following:

the arrangements and procedures for periodic proof testing of storage tank overfill prevention systems tominimise the likelihood of any failure that could result in loss of containment; any revisions identifiedpursuant to this review should be put into immediate effect;

the procedures for implementing changes to equipment and systems to ensure any such changes do notimpair the effectiveness of equipment and systems in preventing loss of containment or in providingemergency response.

RECOMMENDATION 3 – Protecting against loss of primary containment using high integrity systems

Operators of Buncefield-type sites should protect against loss of containment of petrol and other highlyflammable liquids by fitting a high integrity, automatic operating overfill prevention system (or a number of suchsystems, as appropriate) that is physically and electrically separate and independent from the tank gaugingsystem.

Such systems should meet the requirements of Part 1 of BS EN 61511 for the required safety integrity level, asdetermined by the agreed methodology. Where independent automatic overfill prevention systems are alreadyprovided, their efficacy and reliability should be reappraised in line with the principles of Part 1 of BS EN 61511and for the required safety integrity level, as determined by the agreed methodology (see Recommendation 1).




The overfill prevention system (comprising means of level detection, logic/control equipment and independentmeans of flow control) should be engineered, operated and maintained to achieve and maintain an appropriatelevel of safety integrity in accordance with the requirements of the recognised industry standard for ‘safetyinstrumented systems’, Part 1 of BS EN 61511.


All elements of an overfill prevention system should be proof-tested in accordance with the validated

arrangements and procedures sufficiently frequently to ensure the specified safety integrity level is maintained in

practice in accordance with the requirements of Part 1 of BS EN 61511.


The sector should put in place arrangement to ensure the receiving site (as opposed to the transmitting location)has ultimate control over the tank filling.


The sector should undertake a review of the adequacy of existing safety arrangements, includingcommunications, employed by those responsible for pipeline transfers of fuel.


The sector, including its supply chain of equipment manufacturers and suppliers, should review and reportwithout delay on the scope to develop improved components and systems, including but not limited to thefollowing:

alternative means of ultimate high level detection systems that do not rely on components internal to thetank with the emphasis on ease of inspection, testing and maintenance;

increased dependability of tank gauging systems should be explored through improved validation ofmeasurements & trends, allowing warning of faults and using modern sensors with increased diagnosticcapability; and

systems to control and log override actions.


Operators of terminals should implement systems to ensure systematic maintenance of records pertaining toproduct movement and operation of the overfill prevention systems and any associated systems


The sector and regulators should agree on a system of lead and lag performance indicators for process safetyperformance.

RECOMMENDATION 11 – Engineering against escalation of loss of primary containment

Operators of Buncefield-type sites should review the classification of places within COMAH sites where explosiveatmospheres may occur and their selection of equipment and protective systems (as required by the DangerousSubstances and Explosive Atmospheres Regulations 2002). This review should take into account the likelihoodof undetected loss of containment and the possible extent of an explosive atmosphere following such anundetected loss of containment. Operators in the wider fuel and chemicals industries should also consider sucha review, to take account of events at Buncefield.




Following on from Recommendation 11, operators of Buncefield-type sites should evaluate the siting and/orsuitable protection of emergency response facilities such as fire fighting pumps, lagoons or manual emergencyswitches.


Operators of Buncefield-type sites should employ measures to detect hazardous conditions arising from loss ofprimary containment, including the presence of high levels of flammable vapours in secondary containment.Operators should without delay undertake an evaluation to identify suitable and appropriate measures. Thisevaluation should include, but not be limited to, consideration of the following:

installing flammable gas detection in bunds containing vessels or tanks into which large quantities of highlyflammable liquids or vapour may be released;

the relationship between the gas detection system and the overfill prevention system. Detecting high levelsof vapour in secondary containment is an early indication of loss of containment and so should initiate action,for example through the overfill prevention system, to limit the extent of any further loss;

installing CCTV equipment to assist operators with early detection of abnormal conditions. Operators cannotroutinely monitor large numbers of passive screens, but equipment is available that detects and responds tochanges in conditions and alerts operators to these changes.


Operators of new Buncefield-type sites or those making major modifications to existing sites (such as installing anew storage tank) should introduce further measures including, but not limited to, preventing the formation offlammable vapour in the event of tank overflow. Consideration should be given to modifications of tank topdesign and to the safe re-routing of overflowing liquids.


The sector should begin to develop guidance without delay to incorporate the latest knowledge on preventingloss of primary containment and on inhibiting escalation if loss occurs. This is likely to require the sector tocollaborate with the professional institutions and trade associations.


Operators of existing sites, if their risk assessments show it is not practicable to introduce measures to the sameextent as for new ones, should introduce measures as close to those recommended by Recommendation 14 asis reasonably practicable. The outcomes of the assessment should be incorporated into the safety reportsubmitted to the Competent Authority.

RECOMMENDATION 17– Engineering against loss of secondary and tertiary containment

The Competent Authority and the sector should jointly review existing standards for secondary and tertiarycontainment with a view to the Competent Authority producing revised guidance by the end of 2007.

The review should include, but not be limited to the following:

developing a minimum level of performance specification of secondary containment (typically this will bebunding);

developing suitable means for assessing risk so as to prioritise the programme of engineering work inresponse to the new specification;

formally specifying standards to be achieved so that they may be insisted upon in the event of lack ofprogress with improvements;

improving firewater management and the installed capability to transfer contaminated liquids to a placewhere they present no environmental risk in the event of loss of secondary containment and fires;



providing greater assurance of tertiary containment measures to prevent escape of liquids from site andthreatening a major accident to the environment.

RECOMMENDATION 18– Engineering against loss of secondary and tertiary containment

Revised standards should be applied in full to new build sites and to new partial installations. Onexisting sites, it may not be practicable to fully upgrade bunding and site drainage. Where this is sooperators should develop and agree with the Competent Authority risk-based plans for phasedupgrading as close to new plant standards as is reasonably practicable.

RECOMMENDATION 19 – Operating with high reliability organisations

The sector should work with the Competent Authority to prepare guidance and/or standards on how to achieve ahigh reliability industry through placing emphasis on the assurance of human and organisational factors indesign, operation, maintenance, and testing. Of particular importance are:

understanding and defining the role and responsibilities of the control room operators (including inautomated systems) in ensuring safe transfer processes;

providing suitable information and system interfaces for front line staff to enable them to reliably detect,diagnose and respond to potential incidents;

training, experience and competence assurance of staff for safety critical and environmental protectionactivities;

defining appropriate workload, staffing levels and working conditions for front line personnel;

ensuring robust communications management within and between sites and contractors and with operatorsof distribution systems and transmitting sites (such as refineries);

prequalification auditing and operational monitoring of contractors’ capabilities to supply, support andmaintain high integrity equipment;

providing effective standardised procedures for key activities in maintenance, testing, and operations;

clarifying arrangements for monitoring and supervision of control room staff; and

effectively managing changes that impact on people, processes and equipment.


Terminal operators should ensure the resulting guidance is fully implemented.


The sector should put in place arrangements to ensure that good practice in these areas, incorporatingexperience from other higher hazard sectors, is shared openly between organisations.


The regulator should ensure that MHF Safety Cases contain demonstration that good practice in human andorganisational design, operation, maintenance and testing is implemented as rigorously as for engineeringsystems.

RECOMMENDATION 23 – Delivering high performance through culture and leadership

The sector should set up arrangements to collate incident data on high potential incidents including overfilling,equipment failure, spills and alarm system defects, evaluate trends, and communicate information on risks, theirrelated solutions and control measures to the industry.


The arrangements set up to meet Recommendation 23 should include, but not be limited to, the following:

thorough investigation of root causes of failures and malfunctions of safety and environmental protectioncritical elements during testing or maintenance, or in service;

developing incident databases that can be shared across the entire sector, subject to data protection and



other legal requirements. Examples exist of effective voluntary systems that could provide suitable models;

collaboration between the workforce and its representatives, dutyholders and regulators to ensure lessonsare learned from incidents, and best practices are shared.


In particular, the sector should draw together current knowledge of major hazard events, failure histories of safetyand environmental protection critical elements, and developments in new knowledge and innovation tocontinuously improve the control of risks. This should take advantage of the experience of other high hazardsectors such as chemical processing, offshore oil and gas operations, nuclear processing and railways.

Emergency Arrangements

RECOMMENDATION 1– Assessing the potential for a major incident

Operators of Buncefield-type sites should review their emergency arrangements to ensure they provide forall reasonably foreseeable emergency scenarios arising out of credible major hazard incidents, includingvapour cloud explosions and severe multi-tank fires that, before Buncefield, were not considered realisticallycredible. The Competent Authority should ensure that this is done.

RECOMMENDATION 2– Managing a major incident on site

The Competent Authority should review the existing COMAH guidance on preparing on-site emergencyplans. This guidance needs to reflect the HSE’s Hazardous Installations Directorate (HID) ChemicalIndustries Division inspection manual used by inspectors to assess the quality of the on-site plan in meetingthe COMAH Regulations. In particular, reference should be made to the need to consult with health advisors

and emergency responders.


For Buncefield-type sites, operators should review their onsite emergency plans to reflect the revisedguidance on preparing on-site emergency plans as per Recommendation 2. The Competent Authority willneed to check that this is done.


Operators should review and where necessary revise their on-site emergency arrangements to ensure thatrelevant staff are trained and competent to execute the plan and should ensure that there are enough trainedstaff available at all times to perform all the actions required by the on-site emergency plan.

RECOMMENDATION 5 – Managing a major incident on site

For Buncefield-type sites, operators should evaluate the siting and/or suitable protection of emergencyresponse facilities such as the emergency control centre, firefighting pumps, lagoons or manual switches,updating the safety report as appropriate and taking the necessary remedial actions.

RECOMMENDATION 6 – Managing a major incident on site

Operators should identify vulnerable critical emergency response resources and put in place contingencyarrangements either on or off site in the event of failure at any time of the year and make appropriateamendments to the on-site emergency plan. This should include identifying and establishing an alternativeemergency control centre with a duplicate set of plans and technical information.

RECOMMENDATION 7 – Emergency preparedness, response & recovery

For COMAH sites, if the operator relies on an off-site Fire and Rescue Service to respond, the operator’splan should clearly demonstrate that there are adequate arrangements in place between the operator andthe service provider. The Competent Authority will need to check that this is done.



RECOMMENDATION 8– Warning and informing the public

COMAH site operators should review their arrangements to communicate with residents, local businessesand the wider community, in particular to ensure the frequency of communications meets local needs and tocover arrangements to provide for dealing with local community complaints. They should agree thefrequency and form of communications with local authorities and responders, making provision whereappropriate for joint communications with those bodies.

RECOMMENDATION 9– Warning and informing the public

The Competent Authority should review the COMAH guidance to assist operators in complying withRecommendation 8 and should work with the Cabinet Office to integrate the COMAH guidance and the CCACommunicating with the public guidance, so that communications regarding COMAH sites are developedjointly by the site operator and the local emergency responders.

RECOMMENDATION 12– Preparing for and responding to a major incident off site

Communities and Local Government should complete and, where necessary, initiate an assessment of theneed for national-level arrangements to provide, fund and maintain, emergency response equipment (suchas high volume pumps, firefighting foam and specialist pollution containment equipment). The review couldalso consider criteria for allocation and use of this equipment across the UK.

RECOMMENDATION 23 – Responding to a major incident

The operators of industrial sites where there are risks of large explosions and/or large complicated firesshould put in place, in consultation with fire and rescue services at national level, a national industry–fireservice mutual aid arrangement. The aim should be to enable industry equipment, together with operators ofit as appropriate, to be available for fighting major industrial fires. Industry should call on the relevant tradeassociations and working group 6 of the Buncefield Standards Task Group to assist it, with support fromCCS. The COMAH Competent Authority should see that this is done.

C.1 REFERENCES

1 Buncefield Major Incident Investigation Board, “The Buncefield Incident 11 December 2005,The Final Report of the Major Incident Investigation Board”, December 2008.


15 May 2013 Page D.1 of 5R4Risk Ref.: 107-24, Release 5

APPENDIX D OFF-SITE POPULATION DATA

D.1 INTRODUCTION

This appendix outlines the population data used in calculating the off-site societal risk F-N curve. Thepopulation data used in the model is presented in Table D-1. This data was developed frominformation provided by Caltex [1]. The terms referred to in the table are defined as follows:

Off-site location The off-site location of personnel in proximity to the Terminal.

Daytime Population The off-site population during the daytime (i.e. between the hours of 6 am to6 pm).

Night TimePopulation

The off-site population during the night time (i.e. between the hours of 6 pmto 6 am).

Raw Data The off-site population data provided by Caltex to R4Risk.

Modelled Population The population data used in the analysis.

Each of the listed off-site locations is identified in Figure 1. This shows the layout of theneighbourhood surrounding the facility [1].

The residential areas around the Terminal were subdivided as shown in Figure 2. The populationdensity used for the residential areas was based on the Department of Planning data. This dataindicated that the residential population density was approximately 2 people per house for an averageblock size of 750 m

2. The residential population was assumed to be fully present during night time

and non-work hours, with a 75% reduction in the overall population during work hours. It wasassumed that the residential population would be located indoors 70% of the time during the daytimeand 95% of the night-time.

The residential density was applied to the off-site locations referred to as "Residential West" and"Residential North". The total population of these areas was calculated by multiplying the density bythe area covered. For the eastern residential areas, a more detailed approach was used to estimatethe population due to the close proximity of this area to the Terminal boundary. In these areas, anoccupancy of 2 persons per block was assumed.

The Energy Australia site was also excluded from the off-site societal risk calculations because it istypically an unpopulated site.



D.2 POPULATION DATA

Table D-1: Population Data for Off-site Areas

Off-siteLocation

Daytime Population Night Time Population

Raw Data ModelledPopulation Raw Data Modelled

Population

HCE AgilityDay shift (weekdays):

8 to 10 persons5 outdoor5 indoor

Night shift andDayshift

(weekends) – 2persons

1 outdoor1 indoor

Light IndustrialArea, adjacent

to TerminalBoundary

105 car spaces for the site79 cars counted.

79 people with95% indoor (i.e.

4 outdoor,75 indoor)

No night timepopulation data

0

KurnellRecreation Club

POPE licensed for 258people

Kurnell Rec. Club - typicalpopulation is:

Number of people duringthe day = 30

Average number of peopleat night = 50 - 60

Number of people onFriday night: ~100

10 outdoor20 indoor

POPE licensedfor 258 people

Kurnell Rec. Club- typical

population for theKurnell Rec. Club

is:Number of peopleduring the day =

30Average numberof people at night

= 50-60Number of people

on Friday night~100

15 outdoor45 indoor

Pre-School 32 people with 80% indoor6 outdoor26 indoor

No night timepopulation

0

Botany BayNational Park

400,000 persons percalendar year to the park,with peak season beingJune to July for Whale

season, and Christmas andnew year periods.

Approximately110 people per

day110 outdoor

0 indoor


0

Caltex ServiceStation

31 outdoor2 indoor

31 outdoor2 indoor

Pizzas withMuscle

30 outdoor3 indoor


0

KurnellPharmacy

30 outdoor3 indoor


0

Kurnell Cellars 30 outdoor3 indoor


0

Kurnell FreshFood Supplies

30 outdoor3 indoor


0

Kurnell MedicalCentre

30 outdoor3 indoor


0

Kurnell Grocery 30 outdoor3 indoor


0



Off-siteLocation

Daytime Population Night Time Population

Raw Data ModelledPopulation Raw Data Modelled

PopulationCaptains Pies

and Cakes3

0 outdoor3 indoor


0

Kurnell ArtGallery - 6

Prince CharlesParade

30 outdoor3 indoor


0

Real Estate - 7Captain CookDrive, Kurnell

30 outdoor3 indoor


0

EndeavourCoffee & IceCream - 2

Prince CharlesParade

30 outdoor3 indoor


0

Residential East

Department of PlanningData:

Block of land size = 750 m2

~2 people per house25% of population for day

timeResidential East estimated

area = 173,500 m2

35 outdoor81 indoor

46323 outdoor440 indoor

ResidentialCentral





area = 133,486 m2

27 outdoor62 indoor


ResidentialWest





area = 285,156 m2





Figure 1: Locations of Off-Site Populations



Figure 2: Locations of Residential Areas

D.3 REFERENCES

1 Email from Marian Magbiray (Caltex) to Patrick Walker (R4Risk), “Population Data - OffsiteAnalysis”, Attachment – “Offsite Population.xls”, 9 January 2012.


15 May 2013 Page E.1 of 12R4Risk Ref.: 107-24, Release 5

APPENDIX E LISTS OF HAZARDOUS SCENARIOS

Confidential and Sensitive DocumentExempt from disclosure under the Government Information (Public Access) Act 2009 (NSW)

The complete Preliminary Hazard Analysis Report is provided to the NSW Department of Planning &Infrastructure (“DP&I”) by Caltex Refineries (NSW) Pty Ltd (“Caltex”) in confidence for use only withinDP&I. It is submitted on the basis that there is an overriding public interest against disclosurepursuant to section 14(2) of the Government Information (Public Access) Act 2009 (NSW) (the “Act”).The Report is exempt from disclosure under the Act on the grounds that it contains informationassociated with the storage of security sensitive petroleum finished product and information that iscommercial-in-confidence.

The information which is exempt from disclosure applies specifically to the following parts of theReport:


This report must not be copied or distributed outside DP&I without the express permission of Caltex.


15 May 2013 Page F.1 of 3R4Risk Ref.: 107-24, Release 5

APPENDIX F QUALIFICATIONS AND EXPERIENCE OF THEHAZARD ANALYSIS TEAM



F.1 R4RISK PROJECT TEAM

An overview of the qualifications and experience of R4Risk’s project team is provided within Table 1.

Table 1: Project Team SummaryName Project Role Qualification and Relevant Experience

Lachlan DreherProject ManagerTechnical Review

Bachelor of Engineering (Chem) Hons., University ofMelbourne

Registered Professional Engineer (NPER-3); in thecategories of Chemical (general) and Fire SafetyEngineering

Over 20 years experience in the risk management field.

Technical expert in QRA with extensive experienceleading and conducting large QRA studies

Was at the forefront in the development of in-house toolsfor the conduct of QRA (VRJ Risk Engineers /ModuSpec), including defining many of the algorithmsused in these programs.

Dr. Patrick Walker Technical Analyst

Bachelor of Engineering (Chem,) Hons., University ofNSW

Over eight years experience in a range of riskassessment techniques across a number of industries.

Extensive experience in conducting consequencemodeling and QRAs for the petrochemical, chemical andoil & gas industries.

Flora Chung Technical Analyst

Bachelor of Engineering (Chemical and Biomolecular)Hons., University of Melbourne.

Analyst with experience in consequence modelling, firesafety studies and quantitative risk assessments.



F.2 PROJECT TEAM EXPERIENCE

R4Risk’s project team has extensive experience in conducting a range of hazard and risk studies,including QRAs. These studies involved reviewing the corresponding processes to identify,understand and assess the risk associated with the significant hazards. A selection of these studiesthat involved the team members are listed in Table 2.

Table 2: R4Risk Project Team ExperienceClient Project

Legend International QRA for proposed Mount Isa Fertilizer Project (600 ktpa & 1200 ktpa)

Confidential Peer review of QRA to identify modelling flaws resulting in overstated riskresults.

Caltex Australia QRA for Kurnell Refinery

Coogee Chemicals QRA for Mt Isa Plant Expansion

Incitec Pivot Peer review of QRA for proposed facility

BHPQRA for proposed ammonium nitrate plant, including comparison of risks foralternate processing technologies and alternate site locations

BHP QRA for proposed ammonia / urea fertilizer plant.

BP Kwinana Refinery: QRA of facility

Caltex Kurnell Refinery: QRA for new crude oil storage tank

Caltex Kurnell Refinery: QRA to identify risk implications for occupied buildings at site.

Marstel Terminals Coode Island bulk liquid storage terminal: QRA, including propylene oxide andacrylonitrile storage

Mobil Mobil Altona Refinery: QRA of complete refinery

Mobil Yarraville bulk liquid storage terminal: QRA of facility

Mobil Yarraville bulk liquid storage terminal: Update QRA for changed tankageallocation

Mobil Spotswood bulk liquid storage terminal: QRA of facility

Mobil Colmslie Terminal: QRA of proposed LPG terminal

Nufarm-Coogee Kwinana Chlor-Alkali Plant: QRA of proposed plant upgrade

Nufarm-Coogee Kemerton Chlor-Alkali Plant: QRA of proposed plant upgrade

Nufarm-Coogee Kwinana Chlor-Alkali Plant: QRA of proposed plant upgrade (modified design)

Nufarm-Coogee Kemerton Chlor-Alkali Plant: QRA of proposed plant upgrade (modified design)

Nufarm-Coogee Kwinana Chlor-Alkali Plant: QRA for plant expansion (low-pressure design)

Nufarm Belvedere Agricultural Chemicals Plant (UK): QRA for chemicalsmanufacturing plant, including chlorine storage and handling

Pasminco Hobart smelter: QRAs for acid plants

Port of Brisbane Northshore Hamilton: QRA for development master plan

Process Design &Fabrication

Barnawartha Biodiesel Plant: QRA of proposed facility

Queensland NitratesPlant

Moura ammonium nitrate plant: Preliminary QRA (including ammoniamanufacture and storage)


Moura ammonium nitrate plant: QRA for final design (including ammoniamanufacture and storage)


Moura ammonium nitrate plant: QRA Update for Major Hazard Facilitycompliance (including ammonia manufacture and storage)


Moura ammonium nitrate plant: QRA for proposed plant expansion (includingammonia manufacture and storage)


Moura ammonium nitrate plant: Risk review of ammonia storage options forproposed plant expansion (refrigerated storage vs pressurised storage)


Quantitative & Qualitative Risk Analysis on the transportation of ammonia andammonium nitrate

Tiwest Kwinana Pigment Plant: QRA of facility

Appendix C2�

��Kurnell Buncefield Review

Appendix C2 Kurnell Buncefield Review

C2-1

Topic BSTG Recommendation Published 24 July 2007

Official MIIB Recommendation As published in final Report 2008

Caltex Review

Systematic Assessment of Safety Integrity levels

Safety Integrity Control of safety systems for petroleum storage tanks; and; Incorporating the findings of SIL assessments into safety case reports

Before protective systems are installed there is a need to determine the appropriate level of integrity that such systems are expected to achieve. This report uses a layer of protection study (LOPA) to provide a more consistent approach to safety integrity level (SIL) assessment. For each risk assessment/SIL determination study, operators must be able to justify each and every claim and data used in the risk assessment and ensure that appropriate management systems and procedures are implemented to support those claims. For COMAH top-tier sites this will form part of the demonstration required with the safety report. Of particular importance is the reliability and diversity of the independent layers of protection. To avoid common mode failures, extreme care should be taken when claiming high reliability and diversity, particularly for multiple human interventions. Minimum expected good practice

The overall systems for tank filling control must be of high integrity, with sufficient independence to ensure timely and safe shutdown to prevent tank overflow.

Site operators should meet the latest international standards, ie BS EN 61511:2004 Functional safety. Safety instrumented systems for the process industry sector 2.

COMAH five-year periodic reviews of safety reports should incorporate a demonstration that: the overall systems for tank filling control are of high integrity, with

sufficient independence to ensure timely and safe shutdown to prevent tank overflow; and

the overall systems for tank filling control meet BS EN 61511:2004.2

Where the SIL assessment results in a change to the safety management system that could have significant repercussions with respect to the prevention of major accidents or the limitation of their consequences, operators of top-tier sites should review their safety

R1 – Design & Operation The Competent Authority and operators of Buncefield-type sites should develop and agree a common methodology to determine safety integrity level (SIL) requirements for overfill prevention systems in line with the principles set out in Part 3 of BS EN 61511 (ref 3). This methodology should take account of:

the existence of nearby sensitive resources or populations; the nature and intensity of depot operations; realistic reliability expectations for tank gauging systems; and the extent/rigour of operator monitoring.

Application of the methodology should be clearly demonstrated in the COMAH safety report submitted to the Competent Authority for each applicable site. Existing safety reports will need to be reviewed to ensure this methodology is adopted. R4 – Design & Operation The overfill prevention system (comprising means of level detection, logic/control equipment and independent means of flow control) should be engineered, operated and maintained to achieve and maintain an appropriate level of safety integrity in accordance with the requirements of the recognised industry standard for ‘safety instrumented systems’, Part 1 of BS EN 61511.

1. Caltex believes that these recommendations are adequately addressed by the NSW Work Health and Safety Regulation 2011 Chapter 9 and as such the requirement to demonstrate that tank overfill scenarios for all hazardous materials handled are properly identified, and that the associated control measures to prevent and mitigate consequences are appropriate and demonstrated as adequate in terms of availability, reliability, functionality and survivability are already mandatory requirements.

2. The current safety case for Kurnell Refinery addresses these requirements. Nevertheless, the adequacy demonstration for tank primary containment controls is again being progressively reviewed to ensure that any changes impacting tank filling operations are fully reviewed and that the facility risk assessment is adjusted to reflect agreed control measure improvements to be adopted under the proposed facility transition. The safety assessment methodology used in the safety case incorporates both QRA and LOPA, and specific SIL assessments are undertaken where instrumented systems form part of the control measure suite (as per AS61511).

3. Special QRA studies have specifically focussed on nearby population exposures, specifically the fuel storage tanks located closest to residential areas. The results of the QRA studies undertaken by Caltex, which have been recently reviewed and revised, are consistent with the Land Use Safety Study undertaken by the NSW Department of Planning (last revised in 2007). These studies found that full refinery operations at the site did not pose a significant risk to residential areas and overall risk fell within the approval guidelines. The current proposal to transition the site from a refinery to a terminal only will substantially lower the risk even further through elimination of a broad range of fire, explosion and toxic release potential incidents and through the adoption of additional layers of protection on both gasoline and combustible liquid storage tanks. Additional controls on gasoline storage tanks will include the installation of independent high- high level alarms and vapour detection systems in

Topic Caltex Review

Underlying Principles of Buncefield Investigation Recommendations

Measures for controlling major incident risks must integrate: Integrity levels at major hazards sites in relation to containment of

dangerous goods and process safety Mitigation against the effect of a major incident on off-site

populations and buildings Preparedness for emergency response to limit the escalation of

potential major incidents Land use planning and the control of societal risk; and The regulatory system for inspection and enforcement at major

hazard industrial areas.

The Caltex Kurnell site is currently a major hazard facility site and will remain so when converted to a fuels import and storage terminal. As such the facility is required to maintain a safety case which demonstrates that the control measures are fully integrated and adequate with respect to the management of major hazards risks and which specifically must address the possibility of events such as the Buncefield VCE. A review of the Buncefield incident and its recommendations was undertaken by Caltex during the preparation of the current safety case, which resulted in a number of additional control measures being adopted, particularly on gasoline tanks in the north east corner of the site. The current conversion project will extend these improvements to all other flammables storage and in significant part, to bulk combustible storage as well. These control improvements will be reflected in revisions of the safety case. Specific details of approaches taken by Caltex relating to each of the first three control areas listed on the left are provided in the table below. In addition, Caltex actively engages in land use planning management around its refineries and terminals ensuring that decisions made by local authorities relating to land use in potentially affected zones are properly informed by Caltex. Caltex also continues to work closely and proactively with planning authorities and state Workcover and Environment Protection authorities to ensure planning decisions take into account major hazards risks. For example, in Victoria Caltex is one of the first five companies to have worked collaboratively with Worksafe Victoria to produce published land-use planning guidelines for its terminals in that state. Finally, Caltex has consulted with NSW Workcover in relation to the ongoing maintenance and continuous improvement of the Kurnell Site Safety Case. Whilst the submitted safety case has not yet been formally assessed by NSW Workcover, Caltex is committed to ensuring that it continues to comply with all requirements throughout the transition of the site to a terminal only operation, that the controls adopted continue to eliminate risk where reasonably practicable, or where not reasonably practicable to eliminate the risk, reduce risk so far as is reasonably practicable. In the adoption and/or modification of controls, consideration has been and will continue to be made of the Buncefield Investigation recommendations and of all other major investigation recommendations pertinent to the facility. Caltex has committed to meeting at least quarterly with NSW Workcover to ensure these obligations continue to be met. Workcover NSW has made specific reference to the consideration of Buncefield recommendations in its oversight and consultation agenda.


C2-2



Caltex Review

reports under the provisions of COMAH regulation 8(c).12. For the majority of sites it is not expected that a revised safety report is

required to be submitted to the Competent Authority before the next five-year review.

An appropriate demonstration of compliance should be included in safety reports submitted to the Competent Authority by the date of the next five-year periodic review of the safety report.

gasoline tank compounds as per subsequent MIIB and BSTG recommendations.

4. Caltex will continue to work with Workcover NSW to ensure the content of the safety case, the methodology for safety assessments and demonstration of the adequacy of control measures continues to be of a satisfactory standard.

Protecting against Primary LOC using high integrity systems Independent levels of protection R3 – Design & Operation

Operators of Buncefield-type sites should protect against loss of containment of petrol and other highly flammable liquids by fitting a high integrity, automatic operating overfill prevention system (or a number of such systems, as appropriate) that is physically and electrically separate and independent from the tank gauging system. Such systems should meet the requirements of Part 1 of BS EN 61511 for the required safety integrity level, as determined by the agreed methodology. Where independent automatic overfill prevention systems are already provided, their efficacy and reliability should be reappraised in line with the principles of Part 1 of BS EN 61511 and for the required safety integrity level, as determined by the agreed methodology (see Recommendation 1).

For the proposed Terminal; 1. All bulk flammables and combustible liquid storage tanks will have

independent overfill protection systems designed and installed to Australian standards.

2. These systems will incorporate automatic shut-down capability. 3. These systems will be independent of the tank gauging system and will

have the required assessed safety integrity level. 4. Design adequacy of ATG and IHLA systems has been reviewed and

verified. 5. A deviation alarm between primary and independent levels systems is

also being installed. 6. See also comments against R1 and R4 above.

Management systems for maintenance of equipment and systems to ensure their continuing integrity in operation

Inspection & maintenance systems should already be established. The MIIB’s third progress report indicated that there was a problem with the tank level monitoring system at Buncefield. An examination of the records for Tank 912 from the automatic tank gauging (ATG) system suggest an anomaly in that the ATG system indicated that the level remained static while approximately 550 m3/hr of unleaded petrol was being delivered into Tank 912. Minimum expected good practice

Overfill protection systems should be tested periodically to prove that they would operate safely when required.

Proof testing should be end to end, incorporate elements of redundancy, and include the detector at the liquid interface and the valve closure element. The test period should be determined by calculation according to the historical failure rate for each component or the system and the probability of failure on demand required to achieve the specified SIL. Records of test results, including faults found and any repairs carried out, should be retained.

Procedures for implementing changes to equipment and systems should ensure any such changes do not impair the effectiveness of equipment and systems in preventing loss of containment or in providing emergency response.

R2 – Design & Operation Operators of Buncefield-type sites should, as a priority, review and amend as necessary their management systems for maintenance of equipment and systems to ensure their continuing integrity in operation. This should include, but not be limited to reviews of the following: the arrangements and procedures for periodic proof testing of storage

tank overfill prevention systems to minimise the likelihood of any failure that could result in loss of containment; any revisions identified pursuant to this review should be put into immediate effect;

the procedures for implementing changes to equipment and systems to ensure any such changes do not impair the effectiveness of equipment and systems in preventing loss of containment or in providing emergency response.

R5 – Design & Operation All elements of an overfill prevention system should be proof tested in accordance with the validated arrangements and procedures sufficiently frequently to ensure the specified safety integrity level is maintained in practice in accordance with the requirements of Part 1 of BS EN 61511

1. Proof testing & inspection regimes for ATG and IHLA systems are adopted throughout Caltex terminals and refineries in accordance with documented procedures.

2. The tank level devices employed by Caltex are SAAB radar gauges and are not subject to the type of over-ride or failure mechanisms which occurred at Buncefield. Principles of safety in design have thus been employed.

3. All primary containment system elements are subject to a planned risk and reliability driven preventative maintenance program. Effective inspection and maintenance systems and procedures are already established. These procedures have been reviewed several times since the Buncefield incident. Any changes to inspection and maintenance regimes will be strictly managed under the Caltex Management of Change procedures and will be reflected in revisions of the safety case.

4. Critical system processes for ensuring equipment integrity are already clearly identified in the Safety Case and implemented.

5. Changes to any overfill protection element, to alarm set-points or to management system processes will continue to be rigorously assessed & managed by Caltex Management of Change processes.


C2-3



Caltex Review

Testing of overfill protection systems

Inspection and maintenance systems should already be established. Overfill protection alarms or shutdown systems using high level switches or other two-state detectors may be inactive for long periods and may develop unrevealed faults. Such faults cause the system to fail to danger when required to operate. Minimum expected good practice All elements of an overfill prevention system should be proof tested in accordance with the validated arrangements and procedures sufficiently frequently to ensure the specified safety integrity level is maintained in practice.

Refer R2 and R5 above 1. As per comments above. 2. The tank level devices employed by Caltex are SAAB radar gauges

and are not subject to the particular type of over-ride or failure mechanism which occurred at Buncefield. The type of independent level detector to be installed is an analogue device rather than a switch. As such the sensor will always be in active measurement mode and subject to alarm if bad input or variation from the primary LT occurs.

3. Verification of the level indication reading will be achieved via automated cross-reference to the primary level gauging system as well as regular physical dips of the tanks. All alarming and interlock components will be tested as part of the site preventative maintenance, testing and inspection program.

4. Caltex will continue to review opportunities in maintenance regimes to ensure acceptable practice continues to be maintained for identified critical primary containment assets/components.

Tank overfill prevention: defining tank capacity

The capacities of storage tanks should be clearly defined and appropriate safety margins put in place to prevent a release. To prevent overfill, tanks must have headspace margins to ensure that the intake will be closed off in time. High level alarms and operator or automatic actions must be adequately spaced to respond to a developing overfill situation. Minimum expected good practice

Operating practices, staffing levels and systems must provide effective safety margins to prevent an overfilling release.

Tank capacities and appropriate action levels should be set in accordance with this guidance.

Tanks should not be intentionally filled beyond the normal fill level.

1. All bulk storage tanks have defined tank capacities & safe fill levels. 2. Caltex maintains current operating procedures clearly defining tank fill

limitations and tank filling restrictions. 3. Caltex terminals have an established tank level alarm standard which

requires tank alarm settings to be established on a tank by tank basis taking into account worst case filling rates and alarm response times for that particular tank. It also takes into account all staffing level variations and operating practices in establishing the adequacy of alarm set-points. This standard ensures appropriate time is given for response to, and escalation of response to, an abnormal level condition before loss of containment can occur, and will be applied for all tanks (gasoline as well as others in converted terminal).

4. Any change to bulk storage tank fill limitations is analysed & managed by Caltex MOC processes.

Fire safe shut-off valves Each pipe connected to a tank is a potential source of a major leak. In the event of an emergency, it is important to be able to safely isolate the contents of the tank. Isolation valves should be fire safe, i.e. capable of maintaining a leak-proof seal under anticipated fire exposure. Fire-safe shut-off valves must be fitted close to the tank on both inlet and outlet pipes. Valves must either conform to an appropriate standard (BS 6755-2 or BS EN ISO 10497), equivalent international standards or be of an intrinsically fire-safe design, i.e. have metal-to-metal seats (secondary metal seats on soft-seated valves are acceptable), not be constructed of cast iron and not be wafer bolted.

1. Tanks valves will be upgraded to include fire proof coating as part of the conversion works

2. All valves being purchased for hydrocarbon service are to be fire safe and will be insulated.

NOTE; Fire Safe refers to the valve being capable of maintaining its pressure containing ability during and after a certain period of fire as required by API 6D.


C2-4



Caltex Review

Remotely operated shut-off valves (ROSOVS)

In an emergency, rapid isolation of vessels or process plant is one of the most effective means of preventing loss of containment, or limiting its size. A ROSOV is a valve designed, installed and maintained for the primary purpose of achieving rapid isolation of plant items containing hazardous substances in the event of a failure of the primary containment system (including, but not limited to, leaks from pipework, flanges, and pump seals). Valve closure can be initiated from a point remote from the valve itself. The valve should be capable of closing and maintaining tight shut off under foreseeable conditions following such a failure (which may include fire). Remotely operated shut-off valves (ROSOVs) for emergency isolation of hazardous substances: Guidance on good practice HSG244 provides guidance on how to assess the need to provide ROSOVs for emergency isolation. Minimum expected good practice

ROSOVs for the emergency isolation of hazardous substances should be fitted to the outlet pipe tanks in scope where an assessment under HSG244 indicates that such valves should be fitted. ROSOVs for the emergency isolation of hazardous substances should fail safe.

Operators of existing sites should review their risk assessments to ensure that an effective assessment has been undertaken following the key stages in HSG244.

1. All tank valves are able to be remotely isolated, have been selected to be Fire Safe and will be fire proofed as discussed above.

2. The safety case detail will be reviewed against HGS244 to verify whether any additional requirements apply.

Safe management of fuel transfer The initial report of the Buncefield Major Incident Investigation Board identified an issue with regard to safety arrangements, including communications, for fuel transfer. No existing authoritative guidance was found that adequately described this and so a set of principles for safe management of fuel transfer, which includes the adoption of principles for consignment transfer agreements has been developed. Minimum expected good practice

Companies involved in the transfer of fuel by pipeline should: - Adopt the principles for safe management of fuel transfer - Where one party controls the supply, and another controls the

receiving tanks, develop consignment transfer agreements consistent with these principles.

- Ensure that suitable ‘job factors’ are provided to facilitate safe fuel transfer

Companies involved in inter-business transfer of fuel by pipeline should have agreed on the nomenclature to be used for their product types

For ship-to-shore transfers, carry out a terminal specific review to ensure compliance with the International Shipping Guide for Oil Tankers and Terminals.

Receiving sites to develop procedures for transfer planning and review them with their senders and appropriate intermediates.

Ensure that written procedures are in place, and consistent with current good practice, for safety-critical operating activities in the transfer and storage of fuel.

R6 – Design & Operation The sector should put in place arrangement to ensure the receiving site (as opposed to the transmitting location) has ultimate control over the tank filling R7 – Design & Operation The sector should undertake a review of the adequacy of existing safety arrangements, including communications, employed by those responsible for pipeline transfers of fuel R9 – Design & Operation Operators of terminals should implement systems to ensure systematic maintenance of records pertaining to product movement and operation of the overfill prevention systems and any associated systems R10 – Design & Operation The sector and regulators should agree on a system of lead and lag performance indicators for process safety performance

1. The proposed Kurnell Import terminal differs fundamentally from the

Buncefield fuel terminal in that it will be a ship import terminal. There is no routine delivery of product to Kurnell via pipeline under the proposed new terminal arrangements although the existing D-line may be used for minor product movements between Caltex Kurnell and Caltex Banksmeadow terminal in the short term (as per current operations). In the latter case Kurnell will retain control of the filling operations as the receiving site.

2. Caltex adopts international standards for ship to shore transfer operations and these are rigorously applied. These arrangements include robust controls for communication protocols, transfer monitoring and surveillance, and for transfer cessation. All transfers are commenced only after ullage confirmation of receiving tanks.

3. Records for all product movements are systematically maintained by Caltex.

4. The control system for products movement operations will record all events associated with overfill protection controls. This includes full monitoring of dead tanks as well as tanks involved in active transfers. Operating systems incorporate confirmation of safe ullage volume and preset transfer alarms.

5. Existing safety arrangements for both ship receipt operations and internal pipeline movements have been systematically reviewed under the site safety case and include assessment of their adequacy (including communications controls). Further reviews and where necessary, revision will occur as part of ongoing management of change and routine continuous improvement activities.

6. Caltex has a defined process for operational excellence performance monitoring and governance which includes a full suite of targeted lead and lag performance indicators appropriate to monitoring the practical effectiveness of all control measures.


C2-5



Caltex Review

Overfill Protection System design R8 – Design & Operation The sector, including its supply chain of equipment manufacturers and suppliers, should review and report without delay on the scope to develop improved components and systems, including but not limited to the following:

alternative means of ultimate high level detection systems that do not rely on components internal to the tank with the emphasis on ease of inspection, testing and maintenance.

increased dependability of tank gauging systems should be explored through improved validation of measurements & trends, allowing warning of faults and using modern sensors with increased diagnostic capability.

systems to control and log override actions.

1. Caltex currently relies on its testing, inspection and maintenance

systems to demonstrate reliability of its ultimate high level alarm and tank gauging systems.

2. The Kurnell terminal bulk storage tank high levels systems will be monitored via Vias-OM. The system provides superior diagnostic capabilities to those available at the time of the Buncefield Incident including data comparison alarms between independent systems, and smart monitoring of tank inventories.

3. Caltex continues to explore emerging technologies with equipment suppliers for higher reliability and smarter system components and will progressively adopt such systems as they become available where appropriate and reasonably practicable to do so.

4. Caltex rejects the “ante-tank” design proposal described in Annex 4 of the recommendations report on the basis that it has the potential to introduce more hazards, reduce effective tank capacity, eliminate safe response time windows and thereby increase risk.

Engineering against escalation against loss of primary containment R11 – Design & Operation

Operators of Buncefield-type sites should review the classification of places within COMAH sites where explosive atmospheres may occur and their selection of equipment and protective systems (as required by the Dangerous Substances and Explosive Atmospheres Regulations 2002(ref 6)). This review should take into account the likelihood of undetected loss of containment and the possible extent of an explosive atmosphere following such an undetected loss of containment. Operators in the wider fuel and chemicals industries should also consider such a review, to take account of events at Buncefield

1. Hazardous Area classifications are regularly reviewed for all Caltex

sites to ensure they remain appropriate to the types, quantities and activities associated with the handling of hazardous materials. Classification of hazardous areas and selection of equipment and protective systems is conducted in accordance with Australian Standards HB13-2007 and AS2381.

2. The current NSW regulation relating to major hazard facilities requires a comprehensive and systematic safety assessment relating to every identified major incident scenario. Part of this safety assessment is analysis of the nature of the incident and hazards concerned, ultimately leading to adoption of control measures which reduce risk so far as is reasonable practicable. The analysis includes review of potential sources of ignition in the event of a loss of containment or other formation of flammable atmospheres and the verification of adequacy of the controls for both prevention of loss of containment event as well as for prevention of ignition. The safety assessment forms part of the current safety case. All future revisions of the safety assessment will continue to analyse and assess ignition hazards.

3. Caltex will continue with the current risk based approach and to identify and develop action plans relating to the undetected loss of containment and generation of explosive environments. The ongoing review of potential scenarios is considered part of the site’s continuous improvement process for its Safety Case.

R12 – Design & Operation Following on from Recommendation 11, operators of Buncefield-type sites should evaluate the siting and/or suitable protection of emergency response facilities such as fire fighting pumps, lagoons or manual emergency switches.

1. The current NSW regulations relating to major hazard facilities require a comprehensive and systematic safety assessment to be conducted relating to every identified major incident scenario. Part of this safety assessment is to analyse the nature of the incident and hazards concerned, and to adopt control measures which reduce risk so far as is reasonable practicable. This analysis includes review of all applicable consequence scenarios in the event of a loss of containment or fire events and the adequacy of siting for critical emergency response and shut-down controls. A key part of the study is consideration of the practicality of access to these key controls as well as survivability in the event of a major fire or explosion. The required revision of the Safety Assessment for the converted terminal will include review of these matters. This includes a Fire Safety Study for the Kurnell Terminal as per HIPAP2.


C2-6



Caltex Review

R13 – Design & Operation Operators of Buncefield-type sites should employ measures to detect hazardous conditions arising from loss of primary containment, including the presence of high levels of flammable vapours in secondary containment. Operators should without delay undertake an evaluation to identify suitable and appropriate measures. This evaluation should include, but not be limited to, consideration of the following: installing flammable gas detection in bunds containing vessels or tanks

into which large quantities of highly flammable liquids or vapour may be released;

the relationship between the gas detection system and the overfill prevention system. Detecting high levels of vapour in secondary containment is an early indication of loss of containment and so should initiate action, for example through the overfill prevention system, to limit the extent of any further loss;

installing CCTV equipment to assist operators with early detection of abnormal conditions. Operators cannot routinely monitor large numbers of passive screens, but equipment is available that detects and responds to changes in conditions and alerts operators to these changes.

1. Reviews as per recommendation R13 have already been undertaken.

Additional hydrocarbon vapour detectors have been installed in several existing tanks as per 2007 LUSS Recommendations, and will be installed in suitable locations within flammable bunds as part of the conversion upgrade works.

2. The detection of hydrocarbon vapours at or above 10% of the lower explosive limit will raise a clearly visible and audible alarm.

3. A number of CCTV units will be situated around the site (extent yet to be determined following full site security review currently being undertaken). Where cameras are being installed for increased security surveillance, the option of installing in those units additional IR detection with alarming capability is being considered.

4. The decision for leak surveillance equipment beyond the measures currently employed or detailed above will be made on a tank by tank basis taking into account all required factors when determining what is reasonably practicable. Revision to the risk assessments within the safety case will reflect these considerations. NOTE: this same approach is being applied for other locations; e.g. pumping stations.

R14 – Design & Operation Operators of new Buncefield-type sites or those making major modifications to existing sites (such as installing a new storage tank) should introduce further measures including, but not limited to, preventing the formation of flammable vapour in the event of tank overflow. Consideration should be given to modifications of tank top design and to the safe re-routing of overflowing liquids.

1. The Kurnell conversion project does not include installation of any new bulk storage tanks.

2. All tanks are designed, constructed and maintained to industry standards API 650 and API 653.

3. Caltex is closely monitoring further research into tank top design and others factors. It has most recently reviewed RR937 prepared by the UK Health and Safety Laboratory for the UK Health and Safety Executive in 2012. Any definitive learnings from emerging research will be taken into consideration in current and subsequent safety assessment reviews.

R15 – Design & Operation The sector should begin to develop guidance without delay to incorporate the latest knowledge on preventing loss of primary containment and on inhibiting escalation if loss occurs. This is likely to require the sector to collaborate with the professional institutions and trade associations.

1. Where there is opportunity to participate in industry sector collaboration on safety standards Caltex actively supports and participates in such initiatives.

2. Caltex currently sits on both NSW and Victorian MHF Advisory committees pertaining to the management and regulatory oversight of registered and/or licenced major hazard facilities.

R16 – Design & Operation Operators of existing sites, if their risk assessments show it is not practicable to introduce measures to the same extent as for new ones, should introduce measures as close to those recommended by Recommendation 14 as is reasonably practicable. The outcomes of the assessment should be incorporated into the safety report submitted to the Competent Authority.

1. Refer to comments for previously listed recommendations where a

range of additional control measures which have been and/or will be adopted to prevent and/or reduce vapour cloud formation have been discussed.


C2-7



Caltex Review

Engineering against loss of secondary and tertiary containment Bund wall and floor construction and penetration joints should be leak-

tight. Surfaces should be free from any cracks, discontinuities and joint failures that may allow relatively unhindered liquid trans-boundary migration. As a priority, existing bunds should be checked and any damage or disrepair, which may render the structure less than leak-tight, should be remedied. Bund walls should be leak-tight. As a priority, existing bund walls should be checked and any damage or disrepair, which may render the wall less than leak-tight, should be remedied. Joints in concrete or masonry bunds walls should be capable of resisting fire. Existing bunds should be modified to meet this requirement. In addition to repairing any defects in bund joints, steel plates should be fitted across the inner surface of bund joints, and/or fire-resistant sealants should be used to replace or augment non-fire-resistant materials. Bund capacity at existing installations should be a minimum of 110% of the largest contained tank. Should already be in place as good practice.

R17– Engineering against loss of secondary and tertiary containment The Competent Authority and the sector should jointly review existing

standards for secondary and tertiary containment with a view to the Competent Authority producing revised guidance by the end of 2007.

The review should include, but not be limited to the following: developing a minimum level of performance specification of

secondary containment (typically this will be bunding); developing suitable means for assessing risk so as to prioritise the

programme of engineering work in response to the new specification;

formally specifying standards to be achieved so that they may be insisted upon in the event of lack of progress with improvements;

improving firewater management and the installed capability to transfer contaminated liquids to a place where they present no environmental risk in the event of loss of secondary containment and fires;

providing greater assurance of tertiary containment measures to prevent escape of liquids from site and threatening a major accident to the environment.

R18– Engineering against loss of secondary and tertiary containment Revised standards should be applied in full to new build sites and

to new partial installations. On existing sites, it may not be practicable to fully upgrade bunding and site drainage. Where this is so operators should develop and agree with the Competent Authority risk-based plans for phased upgrading as close to new plant standards as is reasonably practicable.

1. As per R18, Caltex applies risk based plans agreed in consultation with NSW Workcover and Department of Planning for bunding and site drainage upgrades.

2. Caltex adopts AS1940 as its common standard for flammable and combustible liquid compounds. Where new tank compounds are to be constructed or existing compounds are to be substantially altered, full review of all relevant Buncefield recommendations are taken into consideration in design of those systems.

3. Bund upgrade works are included in the conversion project scope of works as detailed elsewhere in this submission but these do not entail significant alteration to current bund design. Bunds will meet key requirements as listed in the BSTG recommendations. All bund walls are sealed either with bitumen or are concrete encased

4. Caltex has reviewed current HSE UK guidance on secondary and tertiary containment and refers to the following posted note indicating that the revised guidance is not yet available: While the technical content of this guidance remains substantially correct, some of the legislation referred to has been superseded. The Highly Flammable Liquids and Liquefied Petroleum Gases Regulations 1972 have been replaced by the Dangerous Substances and Explosive Atmospheres Regulations 2002 (DSEAR). Legislation ….. and revised guidance is due to be published in 2012.

Caltex continues to monitor emerging industry guidance and practices relating to engineering design and construction standards. Pertinent improvements are adopted where reasonably practicable to do so.

5. Caltex is closely monitoring current research into bund and drainage design and others factors. It has most recently reviewed RR937 prepared by the UK Health and Safety Laboratory for the UK Health and Safety Executive in 2012.

6. Caltex revises the matters listed in R17 as a matter of course when revising its Safety Cases and their associated demonstration of adequacy of control measures.

7. Caltex secondary and tertiary containment measures are subject to preventative inspection and maintenance regimes as for any other control measure to ensure that any compromise to the leak tightness of containment is systematically identified and remedied.

Firewater management and control measures

Site-specific planning of firewater management and control measures should be undertaken with active participation of the local Fire and Rescue Service.

1. The adequacy of emergency resources and procedures is already required to be reviewed in consultation with NSW Fire and Rescue under the major hazard facilities regulations as well as via planning approval requirements.

2. A Fire Safety Study, as per HIPAP2 guidelines, has been prepared for the proposed Terminal changes and is the subject of consultation with Fire & Rescue NSW.

3. Reviews of major incident and pre-incident plans specifically address practical firewater requirements in responding to major fire events as well as firewater management issues.

4. Caltex has recently expended capital to improve the practicability of fire response. This has included improved foam delivery systems and higher capacity foam monitors for combat of tank top & bund spills/fires.


C2-8



Caltex Review

High reliability organisations

Roles responsibilities & competence

Operators should ensure that they have: clearly identified the roles and responsibilities of all those involved in

managing, performing or verifying work in the management of major hazards, including contractors; and

implemented a competence management system, linked to major accident risk assessment, to ensure that anyone whose work impacts on the control of major accident hazards is competent to do so.

R19 – Design & Operation The sector should work with the Competent Authority to prepare guidance and/or standards on how to achieve a high reliability industry through placing emphasis on the assurance of human and organisational factors in design, operation, maintenance, and testing. Of particular importance are: understanding and defining the role and responsibilities of the control

room operators (including in automated systems) in ensuring safe transfer processes;

providing suitable information and system interfaces for front line staff to enable them to reliably detect, diagnose and respond to potential incidents;

training, experience and competence assurance of staff for safety critical and environmental protection activities;

defining appropriate workload, staffing levels and working conditions for front line personnel;

ensuring robust communications management within and between sites and contractors and with operators of distribution systems and transmitting sites (such as refineries);

prequalification auditing and operational monitoring of contractors’ capabilities to supply, support and maintain high integrity equipment;

providing effective standardised procedures for key activities in maintenance, testing, and operations;

clarifying arrangements for monitoring and supervision of control room staff; and

effectively managing changes that impact on people, processes and equipment.

R20 – Design & Operation Terminal operators should ensure the resulting guidance is fully implemented. R21 – Design & Operation The sector should put in place arrangements to ensure that good

practice in these areas, incorporating experience from other higher hazard sectors, is shared openly between organisations.

R22 – Design & Operation The regulator should ensure that MHF Safety Cases contain

demonstration that good practice in human and organisational design, operation, maintenance and testing is implemented as rigorously as for engineering systems.

1. Schedule 17 Part 2 of the NSW Work Health and Legislation

addresses these recommendations and as such Caltex is required to comply as an operator of a major hazard facility. Caltex’s obligations with regard to the legislation are met through the design and implementation of its Operational Excellence Management System which has specific elements which address human factor hazards and competence management specifically.

2. Kurnell refinery has in recent years completed several detailed organisational and human factor effectiveness studies. This has included detailed studies for console operators, field operators and frontline supervisors for normal, abnormal and emergency operations. This data is being used to manage safe operations during the transition period and will be used to assist in organisational design for the new terminal arrangements.

3. Caltex is using its management of change process to ensure all the matters raised in the recommendation are taken into account where any changes to personnel, organisation or personnel /plant interfaces are proposed.

4. The OEMS also has specific elements which cover Contractor Safety Management including pre-qualification, and operational monitoring of contractors’ capabilities to supply, support and maintain high integrity equipment.

5. Caltex has long recognised the importance of establishing high reliability in its human resource. Programs such as IIF have been an example of industry leading initiatives in this area.

6. Where possible, Caltex will participate in cooperative activities initiated and coordinated by the regulator to develop standards and guidance relating to establishment and development of high reliability organisations.

7. Adoption of any resultant standards will be managed through the continuous improvement activities under the OEMS.


C2-9



Caltex Review

Staffing and shift work arrangements

Operators should: Ensure they can demonstrate that staffing arrangements are adequate

to detect, diagnose and recover any reasonably foreseeable hazardous scenario in relation to fuel transfer and storage; and

ensure that shift work is adequately managed to control risks arising from fatigue.

Staffing and shift work arrangements are critical to the prevention, control and mitigation of major accident hazards. Site operators should be able to demonstrate that staffing arrangements ensure there are sufficient alert, competent personnel to deal with both normal operation and hazardous scenarios arising from abnormal events in fuel transfer and storage. Some high hazard organisations have set staffing levels based on steadystate operations. HSE Contract Research Report Assessing the safety of staffing arrangements for process operations in the chemical and allied industries CRR 348/2001, was commissioned to provide a method to demonstrate that staffing arrangements are adequate for hazardous scenarios as well as normal operations.

Part of R19 as detailed above 1. Current requirements for a major hazard facility operator already require consideration and management of these factors.

2. Kurnell refinery has in recent years completed several detailed organisational & human factor effectiveness studies. This has included detailed studies for console operators, field operators and frontline supervisors utilising guidance contained in: a. Organisational change and major accident hazards; Chemical

Information Sheet No. CHIS7. UK Health & Safety Executive 06/2003.

b. Energy Institute, Safe Staffing Arrangements – User Guide for CRR348/2001 Methodology, Institute of Petroleum and HSE, 2004.

This data is being used to manage safe operations during the transition period and will be used to assist in organisational design for the new terminal arrangements.

3. All impacts resulting from any change to staffing /personnel arrangements will be specifically addressed by the management of change processes focussed around organisation and training and competency. Demonstration of the adequacy of the controls adopted with regard to human factor matters will be articulated in revisions of the site safety case.

Shift handover Operators should set and implement a standard for effective and safe communications at shift and crew changes handover in relation to fuel transfer and storage. For top tier COMAH sites a summary of the standard should be included in the next revision of the safety report.

1. As per comments above. Current requirements for a major hazard facility operator already require consideration and management of these factors. The Caltex Operational excellence management system and site specific operating procedures address these factors.

Organisational change and management of contractors

Site operating companies should ensure that: there is a suitable policy and procedure for managing organisational

changes, and for retention of corporate memory; the policy and procedure ensures that the company retains adequate

technical competence and ‘intelligent customer’ capability when work impacting on the control of major accident hazards is outsourced;

suitable arrangements are in place for managing and monitoring contractor activities.

1. Procedures are already established under the OEMS for Management of Change which includes organisational change, as well as for Contractor Safety Management.

2. Caltex has in recent years invested in process development & delivery of several detailed organisational & human factor effectiveness studies. These have been undertaken to assess proposed organisational changes.

3. Retention of corporate memory remains a challenge for all of industry. Caltex is no exception and relies heavily on its Safety Case and safety management system elements to record, retain and transfer knowledge in relation to major hazards risk. This remains a particular focus of the management of change process for the Kurnell conversion project.

4. As a terminal, Caltex will retain management control of all tasks undertaken on the site by contractors.


C2-10



Caltex Review

Performance evaluation and process safety performance measurement

Site operators should: Ensure they have a suitable active monitoring programme in place

for those systems and procedures that are key to the control of fuel transfer and storage; and

Develop an integrated set of leading and lagging performance indicators for effective monitoring of process safety performance

1. Active performance monitoring of all controls critical to the prevention and/or mitigation of major hazards risks is currently in place for all Caltex terminals and refineries. In transition to an import terminal the site will maintain a complete performance monitoring regime. Any changes to controls, performance indicators for those controls, or to the methods or frequency of performance monitoring will be strictly managed under the management of change process and recorded in revisions of the safety case.

2. A full suite of leading and lagging performance indicators linked to safety management systems performance is an integral part of OEMS operation. Reporting of performance against these indicators is escalated to the Caltex board as a regular element of the reporting mechanism.

3. This is already a central requirement of the MHF regime which will be specifically verified and overseen by NSW Workcover.

Delivering high performance through Culture & Leadership

R23 – Design & Operation The sector should set up arrangements to collate incident data on high potential incidents including overfilling, equipment failure, spills and alarm system defects, evaluate trends, and communicate information on risks, their related solutions and control measures to the industry. R24 – Design & Operation The arrangements set up to meet Recommendation 23 should include, but not be limited to, the following: thorough investigation of root causes of failures and malfunctions of

safety and environmental protection critical elements during testing or maintenance, or in service;

developing incident databases that can be shared across the entire sector, subject to data protection and other legal requirements. Examples exist of effective voluntary systems that could provide suitable models;

collaboration between the workforce and its representatives, dutyholders and regulators to ensure lessons are learned from incidents, and good practices are shared.

R25 – Design & Operation In particular, the sector should draw together current knowledge of major hazard events, failure histories of safety and environmental protection critical elements, and developments in new knowledge and innovation to continuously improve the control of risks. This should take advantage of the experience of other high hazard sectors such as chemical processing, offshore oil and gas operations, nuclear processing and railways.

1. These recommendations are addressed to the petroleum sector more broadly. There are however some elements which can be satisfied by Caltex specifically, in relation to the Kurnell site.

2. Caltex refining and terminals use the same corporate system for internal collation and sharing of incident data across the broader company; the Loss Prevention System. This is a well-established and implemented system which is set up to appropriately address process safety incidents as well as near-losses. The system also incorporates a program of companywide alerts and an extensive investigation, analysis and reporting program. All Caltex employees participate in the LPS activities to ensure lessons are learned from incidents and good practices are shared.

3. Thorough investigations and database records meeting the requirements of recommendation 24 are already employed through LPS.

4. Caltex is a leading participant of industry sectors forums such as Safe Load Pass which share information on sector hazards, incidents and control improvements.


C2-11



Caltex Review

Emergency Arrangements Principles for Emergency Arrangements

All sites in scope should prepare in writing a suitable on-site emergency plan as required by the COMAH Regulations. For lower-tier COMAH sites the plan should be prepared as part of the MAPP. The emergency plans should consider the response to and mitigation of a multiple tank fire following an explosion. The plan should cover the on-site consequences of such an event and the assistance available in the form of off-site mitigatory actions. The incident-specific emergency response plans should consider fire management requirements in response to, and mitigation of, a multiple tank fire. The plan should cover the on-site consequences of such an event and the assistance available in the form of off-site mitigatory actions. Any plan deemed necessary to deal with such an event must be capable of operating effectively even in the event of a preceding explosion.

R1– Emergency preparedness, response & recovery Operators of Buncefield-type sites should review their emergency

arrangements to ensure they provide for all reasonably foreseeable emergency scenarios arising out of credible major hazard incidents, including vapour cloud explosions and severe multi-tank fires that, before Buncefield, were not considered realistically credible. The Competent Authority should ensure that this is done.

1. The matter referred to in R1 is already a requirement of the NSW Work

Health and Safety Regulation and therefore required to be demonstrated in the location’s safety case. BSTG recommendations 283-292 are also covered under these provisions.

2. Ongoing revisions of the site’s Safety Case will continue to review global Major Incidents to ensure that all Major Incident potentials at the facilities continue to be comprehensively identified, assessed and controlled.

3. Pre-incident plans for all identified major incident scenarios are being reviewed and updated as part of the conversion project.

On-site emergency plan A template for an on-site emergency plan can be found at www.hse.gov.uk/comah/buncefield/final.htm. It is envisaged that sites will complete this template and that it will then act as a high-level document providing an overview of the site’s arrangements. Underpinning this document will be a series of detailed plans relating to specific incidents.

R2– Emergency preparedness, response & recovery

The Competent Authority should review the existing COMAH guidance on preparing on-site emergency plans. This guidance needs to reflect the HSE’s Hazardous Installations Directorate (HID) 7 Chemical Industries Division inspection manual used by inspectors to assess the quality of the on-site plan in meeting the COMAH Regulations. In particular, reference should be made to the need to consult with health advisors and emergency responders.


For Buncefield-type sites, operators should review their onsite emergency plans to reflect the revised guidance on preparing on-site emergency plans as per Recommendation 2. The Competent Authority will need to check that this is done.

1. Caltex will continue to work in conjunction with Workcover NSW, the

NSW Department of Planning and Infrastructure and the emergency services (in particular NSW Fire and Rescue) in review and revision of its emergency arrangements for the Kurnell site and specifically with respect to the terminal conversion plan.

2. Caltex will continue taking into account published guidelines and standards issued from time to time by the various state and federal regulators. (e.g. HIPAP2)

3. Any revision to this guidance will be reviewed and existing safety cases including emergency arrangements will be reviewed and revised as necessary in response to the revised Guidelines, as per current arrangements.


C2-12



Caltex Review

Firefighting planning and preparation

This topic comprises of two elements; firstly, the actions that should be put in place before an event occurs and secondly, actions that should be carried out once an event has occurred. These arrangements should be agreed by all parties involved, including off-site responders. Planning aids the firefighting operations immensely by determining what is needed to extinguish the fire or manage a controlled burn, and how to deliver the required resources and manage firewater to prevent environmental impact. Scenario-based incident-specific emergency response plans can identify incident control resources required for accidental release, spillages and fire and emergency response. They can also provide guidance on control and deployment of the necessary resources and importantly, can be used as a tool to exercise against, thus closing the loop from preparation to planned and exercised response. Such deliberations should form part of the environmental and safety risk assessment carried out by the operator when producing the on-site emergency plan. This should be in consultation with the environment agencies, the local authorities, the emergency services (particularly the Fire and Rescue Service) and other stakeholders.

R5 – Emergency preparedness, response & recovery For Buncefield-type sites, operators should evaluate the siting and/or

suitable protection of emergency response facilities such as the emergency control centre, firefighting pumps, lagoons or manual switches, updating the safety report as appropriate and taking the necessary remedial actions.

R6 – Emergency preparedness, response & recovery Operators should identify vulnerable critical emergency response

resources and put in place contingency arrangements either on or off site in the event of failure at any time of the year and make appropriate amendments to the on-site emergency plan. This should include identifying and establishing an alternative emergency control centre with a duplicate set of plans and technical information.

R7 – Emergency preparedness, response & recovery For COMAH sites, if the operator relies on an off-site Fire and Rescue

Service to respond, the operator’s plan should clearly demonstrate that there are adequate arrangements in place between the operator and the service provider. The Competent Authority will need to check that this is done.

1. Requirements from both recommendation sources are implicitly covered under existing NSW legislation for major hazard facilities:

The operator of a determined major hazard facility must prepare an

emergency plan for the major hazard facility that:

(a) addresses all health and safety consequences of a major incident

occurring, and

(b) includes all matters specified in Schedule 16, and

(c) provides for testing of emergency procedures, including the

frequency of testing.

In preparing an emergency plan, the operator must consult with:

(a) the following bodies:

(i) Fire and Rescue NSW, and

(ii) if the facility is within a rural fire district within the

meaning of the Rural Fires Act 1997—the NSW Rural Fire

Service, and

(b) in relation to the off-site health and safety consequences of a major incident occurring—the local authority.

The operator must ensure that the emergency plan addresses any

recommendation made by the emergency service organisations

consulted under subclause (2) in relation to:

(a) the testing of the emergency plan, including the manner in which

it will be tested, the frequency of testing and whether or not the

emergency service organisations will participate in the testing,

and

(b) what incidents or events at the major hazard facility should be

notified to the emergency service organisations.

The operator must have regard to any other recommendation or advice given by a person consulted under subclause (2).

2. Current site fire safety studies and emergency plan reviews address these recommendations. Pre-incident plans for all identified major incident scenarios are regularly reviewed and updated, and will be revised to reflect any changes made to plant, emergency controls and the emergency organisation as a result of the conversion to a terminal.

3. Sites will continue, in consultation with NSW Fire and Rescue and other nominated authorities, to identify and implement further practicable improvements.

4. As for any other control measure, the emergency planning arrangements and infrastructure are included in the Safety Case and require suitable demonstration of adequacy.

Training & Competency for Emergency Response

Trained, knowledgeable and competent personnel must be involved in the exercise of the firefighting plan and in the testing of the on-site plan. They must fulfil the tasks they will be expected to fulfil during an incident.

R4– Emergency preparedness, response & recovery Operators should review and where necessary revise their on-site emergency arrangements to ensure that relevant staff are trained and competent to execute the plan and should ensure that there are enough trained staff available at all times to perform all the actions required by the on-site emergency plan.

1. As for comments against R4-R7 above, this recommendation is

already covered by the Work Health and Safety Regulation. 2. Training and competency in the current and amended emergency plan

will be maintained throughout the site transition to an operating import terminal.


C2-13



Caltex Review

Preparedness – Mutual Aid (National Framework)


Communities and Local Government should complete and, where necessary, initiate an assessment of the need for national-level arrangements to provide, fund and maintain, emergency response equipment (such as high volume pumps, firefighting foam and specialist pollution containment equipment). The review could also consider criteria for allocation and use of this equipment across the UK.

R23 – Emergency preparedness, response & recovery

The operators of industrial sites where there are risks of large explosions and/or large complicated fires should put in place, in consultation with fire and rescue services at national level, a national industry–fire service mutual aid arrangement. The aim should be to enable industry equipment, together with operators of it as appropriate, to be available for fighting major industrial fires. Industry should call on the relevant trade associations and working group 6 of the Buncefield Standards Task Group to assist it, with support from CCS. The COMAH Competent Authority should see that this is done.

1. Whilst these two specific recommendations are really aimed at industry sectors and local, state and national government initiatives, Caltex recognises its role as a responsible member of the Kurnell community and as such actively supports mutual aid and community emergency response arrangements.

2. The revision of the Kurnell Emergency Plan to reflect operation of the site as an import terminal will specifically revise mutual aid resourcing and agreements.

Warning and informing the public R8– Emergency preparedness, response & recovery

COMAH site operators should review their arrangements to communicate with residents, local businesses and the wider community, in particular to ensure the frequency of communications meets local needs and to cover arrangements to provide for dealing with local community complaints. They should agree the frequency and form of communications with local authorities and responders, making provision where appropriate for joint communications with those bodies.

R9– Emergency preparedness, response & recovery The Competent Authority should review the COMAH guidance to assist

operators in complying with Recommendation 8 and should work with the Cabinet Office to integrate the COMAH guidance and the CCA Communicating with the public(Ref 9) guidance, so that communications regarding COMAH sites are developed jointly by the site operator and the local emergency responders.

1. Caltex Kurnell is an integral part of the community in which it

operates and as such recognises the importance of appropriate community information and communication.

2. Caltex will continue to place high priority on ensuring the intended outcome from R8 continues to be achieved.

3. Caltex has the following established communication channels in the event of an emergency:

a. Appointed members of the Caltex management team in the Emergency Operations Centre provide information updates to the media, employees and contractors.

b. Appointed members of the Caltex management team monitor & respond to community inquiries via 1800 response hotline.

c. Appointed members of the Caltex management team in the Emergency Operations Centre provide information to NSW Police who are responsible for communicating and coordinating community action (e.g. evacuation) should this be required.

d. Caltex provides subsequent feedback to community stakeholders following an Emergency. This is typically communicated via routine feedback at community meetings.

Hazard and Risk Assessment

Documents

dreher updatedrelease

societal risk

biophysical risk

individual risk fatality

individual risk injury

risk of property damage

major risk contributors

express permission of