Hazard and Risk Assessment PDF

A p p e nd ix C
Hazard and Risk Assessment

C1 Preliminary Hazard Analysis
C2 Kurnell Buncefield Review
A p p e nd ix 1
Preliminary Hazard Analysis

Caltex Refineries (NSW) Pty Ltd
Proposed Kurnell Product Terminal

Preliminary Hazard Analysis
15 May 2013
R4Risk Ref.: 107-24, Release 5
R4Risk Pty Ltd

ACN 134 478 050
15 Yarra Street
(PO Box 5023)
South Melbourne VIC 3205
P: 03 9268 9700
F: 03 8678 0650
E: solutions@r4risk.com.au
www.r4risk.com.au
CALTEX REFINERIES (NSW) PTY LTD
PROPOSED KURNELL PRODUCT TERMINAL - PRELIMINARY HAZARD ANALYSIS
Confidential and Sensitive Document

Exempt from disclosure under the Government Information (Public Access) Act 2009 (NSW)
The complete Preliminary Hazard Analysis Report is provided to the NSW Department of Planning &
Infrastructure (DP&I) by Caltex Refineries (NSW) Pty Ltd (Caltex) in confidence for use only within
DP&I. It is submitted on the basis that there is an overriding public interest against disclosure
pursuant to section 14(2) of the Government Information (Public Access) Act 2009 (NSW) (the Act).
The Report is exempt from disclosure under the Act on the grounds that it contains information
associated with the storage of security sensitive petroleum finished product and information that is
commercial-in-confidence.
The information which is exempt from disclosure applies specifically to the following parts of the
Report:
Appendix E Lists of Hazardous Scenarios
This report must not be copied or distributed outside DP&I without the express permission of Caltex.
15 May 2013 Page 2 of 43

DOCUMENT CONTROL
Project Title Proposed Kurnell Product Terminal - Preliminary Hazard Analysis

Client Name Caltex Refineries (NSW) Pty Ltd
Project No. 107-24
Project Manager Patrick Walker
Report Author (s) Patrick Walker
Release Issue Date Reviewed by Approved by Comments

Release 1 27 February 2013 L. Dreher L. Dreher Issued to Client
Release 2 18 April 2013 L. Dreher L. Dreher Revised with Client
comments
Release 3 26 April 2013 L. Dreher L. Dreher Updated
Release 4 8 May 2013 L. Dreher L. Dreher Updated
Release 5 15 May 2013 L. Dreher L. Dreher Updated
15 May 2013 Page 3 of 43

Table of Contents
1 EXECUTIVE SUMMARY................................................................................................................. 6
1.1 Major Risk Contributors ........................................................................................................... 6
1.2 Individual Risk - Fatality........................................................................................................... 7
1.3 Individual Risk - Injury ............................................................................................................. 7
1.4 Societal Risk - Off-site ............................................................................................................. 7
1.5 Risk of Property Damage and Accident Propagation .............................................................. 8
1.6 Biophysical Risk ...................................................................................................................... 8
1.7 Assumptions And Sensitivity ................................................................................................... 9
1.8 Related Safety Studies ............................................................................................................ 9
1.9 Findings And Recommendations............................................................................................. 9
2 ACRONYMS & GLOSSARY.......................................................................................................... 10
2.1 Acronyms............................................................................................................................... 10
2.2 Glossary................................................................................................................................. 10
3 INTRODUCTION ........................................................................................................................... 12
3.1 Background............................................................................................................................ 12
3.2 The Project ............................................................................................................................ 12
3.2.1 Scope............................................................................................................................. 12
3.2.2 Aim................................................................................................................................. 12
3.3 The Preliminary Hazard Analysis .......................................................................................... 12
3.3.1 Scope............................................................................................................................. 12
3.3.2 Aim................................................................................................................................. 13
4 SITE & PROJECT DESCRIPTION................................................................................................ 14
4.1 Project Location ..................................................................................................................... 14
4.2 Project Description ................................................................................................................ 14
4.2.1 Wharf Operation ............................................................................................................ 14
4.2.2 Tank Farm Operation .................................................................................................... 14
4.2.3 Associated Pipelines and Pumps .................................................................................. 14
5 METHODOLOGY .......................................................................................................................... 17
5.1 Hazard Identification.............................................................................................................. 18
5.1.1 Data Collection .............................................................................................................. 18
5.1.2 Scenario Development .................................................................................................. 19
5.2 Frequency Assessment ......................................................................................................... 19
5.2.1 Scenario Frequency ...................................................................................................... 19
5.2.2 Event Tree Analysis....................................................................................................... 19
5.3 Consequence Assessment.................................................................................................... 19
5.3.1 Pool Fires....................................................................................................................... 20
15 May 2013 Page 4 of 43

5.3.2 Vapour Cloud Explosions .............................................................................................. 20

5.3.3 Vulnerability Models ...................................................................................................... 20
5.4 Risk Assessment ................................................................................................................... 20
5.5 Study Assumptions ................................................................................................................ 20
6 RISK CRITERIA ............................................................................................................................ 21
6.1 Individual Risk - Fatality......................................................................................................... 21
6.2 Individual Risk - Injury ........................................................................................................... 21
6.3 Societal Risk Criteria ............................................................................................................. 21
6.4 Risk of Property Damage and Accident Propagation ............................................................ 22
6.5 Biophysical Risk .................................................................................................................... 22
7 HAZARD IDENTIFICATION .......................................................................................................... 23
7.1 Hazardous Materials.............................................................................................................. 23
7.2 Isolatable Sections ................................................................................................................ 23
7.3 Hazardous Scenarios ............................................................................................................ 23
7.4 Consequence Events ............................................................................................................ 24
7.4.1 Pool Fires....................................................................................................................... 24
7.4.2 Vapour Cloud Explosion ................................................................................................ 25
7.5 Major Accident Hazards ........................................................................................................ 25
8 FREQUENCY ASSESSMENT ...................................................................................................... 27
8.1 Failure Frequency.................................................................................................................. 27
8.2 Event Tree Analysis............................................................................................................... 27
8.3 Tank Overfill / Explosion Frequency...................................................................................... 28
9 CONSEQUENCE ANALYSIS........................................................................................................ 30
10 RISK ASSESSMENT..................................................................................................................... 32
10.1 Individual Risk - Fatality......................................................................................................... 32
10.2 Individual Risk - Injury ........................................................................................................... 35
10.3 Societal Risk Off-site Population ........................................................................................ 37
10.4 Risk of Property Damage and Accident Propagation ............................................................ 37
10.5 Biophysical Risk .................................................................................................................... 39
10.6 Sensitivity Analysis ................................................................................................................ 40
11 COMPARISON TO RISK AT THE EXISTING FACILITY .............................................................. 41
12 REFERENCES .............................................................................................................................. 42
Appendix A Assumption Register

Appendix B Failure Rate Data
Appendix C Buncefield Recommendations
Appendix D Off-site Population Data
Appendix F Qualifications and Experience of the Hazard Analysis Team
15 May 2013 Page 5 of 43

1 EXECUTIVE SUMMARY
Caltex is seeking development approval to convert the existing Kurnell Refinery into a Finished
Product Terminal (the Project). In accordance with the NSW Department of Planning and
Infrastructure (DP&I) Director-Generals Requirements (DGRs) for the Development, a Preliminary
Hazard Analysis (PHA) Report was prepared by R4Risk for inclusion in the Environment Impact
Statement (EIS) for SSD-5544.
The PHA report was prepared with reference to the State Environment Planning Policy No 33 -
Hazardous and Offensive Development [1], and in accordance with the NSW DP&Is Hazardous
Industry Planning Advisory Papers No. 4 - Risk Criteria (HIPAP4) [2] and No. 6 - Hazard Analysis
(HIPAP6) [3].
The Project comprises the following principal components:

Continued use of parts of the existing refinery, in a manner similar to that currently in place, for
the storage and distribution of petroleum products.
A number of existing crude oil tanks are to be cleaned and modified to allow for the storage of
refined product (i.e. conversion to finished product tanks).
A small number of other tanks already storing one type of refined product are to be converted
to store alternative products.
New pumps, pipes and electrical infrastructure are to be installed within the Project Area
(defined in Section 4.1).
A range of ancillary works is also to be undertaken to improve efficiency and to facilitate the
conversion of the refinery into a terminal. These ancillary works include consolidation and
upgrades to the utilities, transportation and management systems at the site.
The refinery plant would also be shut down, depressurised, de-inventoried and left in situ. Caltex shut
down, depressurise and de-inventory the refinery plant during routine maintenance activities as part of
the existing operation and therefore this action does not form part of the Project.
The Project is expected to be undertaken over a 54 month period.
In preparing the PHA Report, R4Risk has investigated the risk of operations associated with the
following areas:
Tank farm operations
Wharf operations associated with fixed shore assets (i.e. excluding shipping activities); and
Associated pipelines and pumps.
The quantitative risk assessment (QRA) methodology was used to determine the risk profile for the
Project. The methodology involved the following key steps:
Hazard Identification
Consequence Assessment
Frequency Assessment
Risk Assessment.
The tolerability of the calculated risk was assessed by comparison with the risk criteria specified in
HIPAP4 [2]. The following sections summarise the major findings from the risk assessment. The
corresponding risk contours are presented in Section 10.
1.1 MAJOR RISK CONTRIBUTORS

The PHA examined scenarios associated with the Major Accident Hazards (MAHs) that involved the
loss of containment of flammable (gasoline, jet fuel, slops) or combustible (diesel) material. The study
considered the material that could be released from storage tanks, pumps and loading arms, as well
as the associated pipelines. The QRA determined the potential that released material would ignite,
resulting in a pool fire. The study also evaluated the frequency and potential consequence of a
15 May 2013 Page 6 of 43

Buncefield-type vapour cloud explosion (VCE). Although assessed as extremely unlikely, the
Buncefield-type VCE event was included in the QRA.
1.2 INDIVIDUAL RISK - FATALITY

Location-specific individual risk (LSIR) contours for the risk of fatality were developed. These were
used to assess the tolerability of the risk against the risk criteria described in HIPAP4. As each of the
risk contours do not extend into the respective land-use areas to which the criteria are applied, the off-
site fatality risk criteria are therefore satisfied. This is summarised in Table 1.
Table 1: LSIR Fatality Risk Tolerance Criteria [2]
Tolerance Criteria
Land Use (risk in a million per LSIR Results
year)
Sensitive areas, such as hospitals and schools 0.5
Residential developments and continuous The relevant LSIR
1.0 contours do not
occupancy, such as hotels and resorts
Commercial developments, including retail extend to each of
5 these areas.
centres, offices and entertainment centres
All criteria are
Sporting complexes and active open space 10 satisfied.
Industrial areas 50
1.3 INDIVIDUAL RISK - INJURY

Location-specific individual risk (LSIR) contours for the risk of injury were developed. The tolerability
of the injury risk results was determined by comparison with the HIPAP4 injury risk criteria. Similar to
the fatality risk contours, the injury risk contours do not extend into the respective land-use areas to
which the criteria are applied. The injury risk criteria are therefore satisfied. This is summarised in
Table 2.
Table 2: LSIR Injury Risk Tolerance Criteria [2]

Tolerance Criteria
Individual Injury Risk Criteria (risk in a million per LSIR Results
year)
Incident heat flux radiation at residential and
2 50 The relevant LSIR
sensitive areas exceeding 4.7 kW/m .
contours do not
Incident explosion overpressure at residential and
extend to these areas.
sensitive use areas should not exceed 7 kPa at 50
The criteria is met.
frequencies.
Toxic concentrations in residential and sensitive Not applicable, as the
use areas exceed a level which would be QRA did not involve
seriously injurious to sensitive members of the 10 scenarios which could
community following a relatively short period of result in this type of
exposure. event.
1.4 SOCIETAL RISK - OFF-SITE

The societal risk F-N curve was developed. This considered potential impacts on the off-site
population. The tolerability of the risk was assessed using the indicative societal risk criteria
described in HIPAP4 [2]. The societal risk assessment, compared against these criteria, is presented
in Figure 1.
The societal risk F-N curve for the proposed operations lies fully below the negligible line. In this
region, the societal risk is not considered significant, provided other individual risk criteria are met. As
described in the preceding sections, the individual risk criteria for fatality and injury are satisfied.
Therefore the societal risk is also considered to be tolerable.
15 May 2013 Page 7 of 43

1.00E-01
Frequency of N or more fatalities (F, /year)
1.00E-02
1.00E-03
Intolerable
1.00E-04
1.00E-05
ALARP
1.00E-06
1.00E-07
1.00E-08 Negligible
1.00E-09
1 10 100 1000
Number of Fatalities (N)
Figure 1: Societal Risk Results Off-site Population
1.5 RISK OF PROPERTY DAMAGE AND ACCIDENT PROPAGATION

Location-specific risk contours were developed to represent the risk of property damage and accident
propagation. The tolerability of the results was determined by comparison with corresponding risk
criteria outlined in HIPAP4. The risk contours do not extend to off-site areas. The risk criteria are
therefore satisfied. This is summarised in Table 3.
Table 3: Risk of Property Damage And Accident Propagation Tolerance Criteria [2]
Tolerance Criteria
Risk Criteria (risk in a million per LSIR Results
year)
Incident heat flux radiation at neighbouring
potentially hazardous installations or at
50
land zoned to accommodate such
2
installations for the 23 kW/m heat flux. The relevant LSIR contours
Incident explosion overpressure at do not extend to these
neighbouring potentially hazardous areas. The criteria are
installations, at land zoned to met.
50
accommodate such installations or at
nearest public buildings for the 14 kPa
explosion overpressure level
1.6 BIOPHYSICAL RISK

The risk to the biophysical environment was assessed by examining the potential for identified release
scenarios to impact on the long-term viability of the surrounding ecosystems. For different sections of
the facility, the assessment considered the key controls that would prevent, or mitigate, the impact of a
release. The analysis demonstrated controls would be in place that would either minimise the
potential for a release or contain product if a release did occur. Therefore, a release of product from
the terminal would not pose a threat to the long-term viability of the ecosystem.
15 May 2013 Page 8 of 43

1.7 ASSUMPTIONS AND SENSITIVITY

In completing the QRA, a number of technical assumptions were made. These assumptions are
described in Appendix A. For key assumptions, details of the applied methodology and corresponding
references are also included.
To support the risk assessment conclusions, a review was conducted to determine the sensitivity of
the QRA results to key parameters. The review examined the parameters such as failure frequency
and the radiant heat vulnerability model. This review showed that the risk tolerability remained
unchanged, despite the modifications made. Details of the sensitivity analysis are provided in Section
10.6.
1.8 RELATED SAFETY STUDIES

In conducting the PHA, R4Risk reviewed, or were provide access to, a number of detailed studies
conducted for the Kurnell site. These included the following studies:
Process Hazard Analysis for the Terminal Conversion and the Caltex Port and Marine Works
Project
Major Hazard Facility Safety Report for the Kurnell Refinery
Kurnell Peninsula Land Use Safety Study 2007
Various historical fire safety studies examining the refinery operations and the proposed
terminal
Caltex review of Buncefield Report Recommendations.
1.9 FINDINGS AND RECOMMENDATIONS

This quantitative risk assessment demonstrates that the risk levels calculated for the Project satisfy
the risk criteria specified in HIPAP4. Compared with existing refinery operations, the off-site risk
profile is considerably reduced. This outcome is expected, because the Project involves a
downscaling of the existing operations, i.e. a reduction in the scale and complexity of the operations at
the site.
The studies listed in Section 1.8 provided input into the development of the design for the proposed
terminal. Caltex has identified risk reduction recommendations using its Riskman2 methodology.
These are documented in the detailed process hazard analysis records and are tracked to completion
by Caltexs project management process.
No recommendations were made as a result of this QRA.
15 May 2013 Page 9 of 43

2 ACRONYMS & GLOSSARY
2.1 ACRONYMS
ALARP As low as reasonably practicable
BLEVE Boiling-liquid expanding-vapour explosion
Caltex Caltex Refineries (NSW) Pty Ltd
CCTV Closed-circuit television
DCS Distributed control system
DGRs Director-Generals Requirements
DP&I Department of Planning and Infrastructure
EIS Environment impact statement
ESDV Emergency shutdown valve
HES Health, environment, safety
New South Wales Department of Planning Hazardous Industry Planning
HIPAP4
Advisory Paper No. 4 [2]
New South Wales Department of Planning Hazardous Industry Planning
HIPAP6
Advisory Paper No. 6 [3]
HSE Health & Safety Executive (United Kingdom)
IR Individual risk
IRPA Individual risk per annum
Loc. Loss of containment
LPG Liquefied petroleum gas
LSIR Location-specific individual risk
MAH Major Accident Hazard
MOV Motor-operated valve
MSDS Material safety data sheet
OWS Oily Water Sewer
P&ID Piping and instrumentation diagram
PFD Probability of failure on demand
PHA Preliminary hazard analysis
PULP Premium unleaded petrol
QRA Quantitative risk assessment
SSD Significant State Development
SPULP Super-premium unleaded petrol
VCE Vapour cloud explosion
ULP Unleaded petrol
2.2 GLOSSARY
The severity associated with an event in this instance the heat radiation from
Consequence
the pool fire events, i.e. the potential effects of a hazardous event.
The end event associated with a failure and release, considering all
Consequence Event
detection, isolation and ignition factors, e.g. pool fire, flash fire etc.
The Eastern Tank Area contains existing finished product tanks, some of
Eastern Tank Area which would need minor conversion works as part of the Project. It also
contains the Oil Movements Centre (OMC).
Event Frequency The frequency assigned to a specific consequence event
The number of occurrences of an event expressed per unit time. It is usually
Frequency
expressed as the likelihood of an event occurring per annum.
A physical situation with the potential for human injury, damage to property,
Hazard
damage to the environment or some combination of these.
The accidental release of a hazardous material from equipment or piping,
Hazardous Scenario
from identified isolatable section of terminal operation.
15 May 2013 Page 10 of 43

The frequency at which an individual may be expected to sustain a given

Individual Risk (IR)
level of harm from the realisation of specified hazards.
As individual risk (IR) is calculated at a point, calculating the IR at many
Individual Risk points allows the plotting of IR contours, these being lines that indicate
Contours constant levels of risk. Most commonly used are the 1 chance per million-
year contour and the 10 chances per million-year contour.
Individual risk, with harm measured in terms of fatality. It is calculated at a
Individual Risk of
particular point for a stationary, unprotected person for 24 hours per day, 365
Fatality
days per year. Commonly expressed in chances of fatality per million years.
A system of pipes or vessels containing the hazardous materials that are
Isolatable Section bounded by specific isolation points, which can be operated to isolate the
inventory in the event of an emergency.
The expression for the likelihood of an occurrence of an event or an event
sequence or the likelihood of the success or failure of an event on test or
Probability
demand. By definition, probability must be expressed as a number between
0 and 1.
Quantitative Risk A risk assessment undertaken by combining quantitative evaluations of event
Assessment frequency and consequence.
The combination of frequency and consequences, the chance of an event
Risk
happening that can cause specific consequences.
Caltexs standard process for health, environment, safety (HES) and asset
related risk management. RiskMan2 provides a standardised and systematic
RiskMan2 approach to the identification of hazards, assessment of risk and effective
adoption and maintenance of control measures for HES and certain asset
risks.
The Western Tank Area is primarily made up of the existing Crude Oil Tanks
and the Waste Water Treatment Plant. All the Crude Oil Tanks would
Western Tank Area
require conversion as part of the Project. It is proposed that the area would
also include the new product pumps area and the new slops pumps area.
15 May 2013 Page 11 of 43

3 INTRODUCTION
3.1 BACKGROUND
Caltex is seeking development approval to convert the existing Kurnell Refinery into a Finished
Product Terminal (the Project). In accordance with the NSW DP&I DGRs for the Development, a
PHA report was prepared by R4Risk for inclusion in the EIS for SSD-5544.
The PHA report was prepared with reference to the State Environment Planning Policy No 33 -
Hazardous and Offensive Development [1], and in accordance with the NSW DP&Is Hazardous
Industry Planning Advisory Papers No. 4 - Risk Criteria [2] and No. 6 - Hazard Analysis [3]. The
experience and qualifications of the project team are included in Appendix E.
This report details the methodology and presents the off-site risk profile for the proposed operations.
The tolerability of the results has been assessed by comparison with the risk criteria specified in
HIPAP4 [2].
3.2 THE PROJECT

3.2.1 Scope
The Project comprises the following principal components:
Continued use of parts of the existing refinery, in a manner similar to that currently in place, for
the storage and distribution of petroleum products.
A number of existing crude oil tanks are to be cleaned and modified to allow for the storage of
refined product (i.e. conversion to finished product tanks).
A small number of other tanks already storing one type of refined product are to be converted
to store alternative products.
New pumps, pipes and electrical infrastructure are to be installed within the Project Area
(defined in Section 4.1).
A range of ancillary works are also to be undertaken to improve efficiency and to facilitate the
conversion of the refinery into a terminal. These ancillary works include consolidation and
upgrades to the utilities, transportation and management systems at the site.
The refinery plant would also be shut down, depressurised, de-inventoried and left in situ. Caltex shut
down, depressurise and de-inventory the refinery plant during routine maintenance activities as part of
the existing operation and therefore this action does not form part of the Project.
The Project is expected to be undertaken over a 54 month period.

3.2.2 Aim
The aim of the Project is to allow the site to be utilised as a terminal where finished products would be
received by ship, stored in tanks and leave the site, predominantly by pipeline, to the Caltex
Banksmeadow Terminal, Silverwater Terminal, Joint User Facility at Sydney Airport, or to the Caltex
Newcastle Terminal via the Newcastle Pipeline.
The current capability for outloading via the wharf is to be retained, but would be used infrequently.
Under typical operations, road transport of products from the site would cease. However, in
exceptional circumstances, some road transport of product may be required.
3.3 THE PRELIMINARY HAZARD ANALYSIS

3.3.1 Scope
This PHA has identified and assessed hazards and risks associated with the following operational
areas of the proposed development:
Tank farm operations;
Wharf operations associated with fixed shore assets (i.e. excluding shipping activities); and
Associated pipelines and pumps.
15 May 2013 Page 12 of 43

3.3.2 Aim
The aim of the PHA is to:
Provide an assessment of the hazards and risks associated with the proposed works; and
Evaluate the calculated risk levels against the land-use planning criteria for off-site risk (as
specified in HIPAP4).
This aim is in accordance with the requirements of the NSW DP&I DGRs for the Project and is fully
consistent with Caltexs internal standards for the management of hazards and risks at its facilities.
The risk associated with the Project has been assessed quantitatively using the generally-accepted
QRA methodology.
To assess the off-site risk exposure, the following outputs were generated from the QRA model:
Individual risk of fatality contours;
Individual risk of injury contours;
Societal risk F-N curve; and
Risk of property damage and accident propagation.
In addition to this PHA report, Caltex has also undertaken a number of detailed internal Process
Hazard Analysis studies on the proposed design. These studies represent Caltexs collective
knowledge of the nature and type of hazards associated with both existing and proposed operations.
They are therefore considered an appropriate basis for the hazard identification step of this PHA.
15 May 2013 Page 13 of 43

4 SITE & PROJECT DESCRIPTION

4.1 PROJECT LOCATION
The Project Area is located at the site of the existing refinery, which is on the Kurnell Peninsula within
Sutherland Shire Local Government Area, approximately 15 km south of Sydneys CBD. The site and
Project Area are illustrated in Figure 2.
A site plan showing the existing operations is presented in Figure 3. The figure also highlights the
different land-uses that surround the site. There are a number of light-industrial sites located near the
western boundary. To the north, there is a mixture of commercial properties and residential areas.
The nearest residential areas are adjacent to the north-eastern corner of the site.
4.2 PROJECT DESCRIPTION

The Kurnell Refinery is to be converted from an operating refinery to a bulk liquid fuel terminal, storing
flammable and combustible liquids. The operations at Kurnell will be limited to wharf operations, tank
farm storage and associated pipelines and pumps for transfers of the fuels. The following sections
summarise the proposed operations at the facility.
4.2.1 Wharf Operation
Gasoline, jet fuel and fuel oil will be received by ship at the fixed berths of Kurnell Wharf. These fuels
will be then transferred to the terminal via two loading arms and associated pipelines. Receipt of
diesel will involve similar operations, however, it may also be received at the submarine berth. Slop
produced during terminal operations will be transferred to the wharf for loading onto ships.
A separate Development Application, EIS and Preliminary Hazard Analysis Report have been
produced addressing the hazards and risks associated with dredging, demolition and construction
activities, as well as those associated with operational activities due to the mooring of larger ships at
Kurnell Wharf (refer SSD-5353).
4.2.2 Tank Farm Operation
The flammable and combustible liquids received from the wharf are to be stored in the atmospheric
storage tanks of the tank farm. The Project will involve the continued use of parts of the existing
refinery plot, in a manner similar to that currently in place, for the storage and distribution of petroleum
products. A number of existing crude oil tanks would be cleaned and modified to allow for the storage
of refined product (i.e. conversion to finished product tanks). A small number of other tanks already
storing one type of refined product would be converted to store another refined product.
4.2.3 Associated Pipelines and Pumps
The flammable and combustible liquids unloaded at the wharf will be transferred via pipeline to
storage tanks within the tank farm. When required, these products will then be pumped via pipelines
from the storage tanks to the Banksmeadow Terminal for further distribution. These existing pipelines
run from the tank farm, out along the wharf before travelling beneath Botany Bay to Banksmeadow.
Lastly, slop will be pumped out to a fixed berth at the wharf, via a combination of new and existing
lines (referred to as Slop Lines).
15 May 2013 Page 14 of 43

Site
Project Area
Figure 2: Location of Site and Project Area
15 May 2013 Page 15 of 43

Figure 3: Site Plan [4]
15 May 2013 Page 16 of 43

5 METHODOLOGY
The methodology for conducting a PHA is well established in Australia. This assessment was carried
out as per the guidelines provided within HIPAP4 and HIPAP6. Consistent with the potential for a high
consequence event to occur at site, and the anticipated classification of the proposed terminal as a
Major Hazard Facility, the QRA methodology was used for the purpose of off-site risk determination.
The tolerability of the risk was assessed using the risk criteria specified in HIPAP4.
This section presents a summary of the QRA methodology applied to this project. The key steps in a
QRA are as follows:
Hazard Identification
Consequence Assessment
Frequency Assessment
Risk Assessment.
The approach applied in this study follows these basic steps. A flow chart illustrating this approach is
shown in Figure 4. Additional details on each of the steps are provided in the following sections.
15 May 2013 Page 17 of 43

Process Information
P&IDs
Flow Diagrams Hazard Identification
Emergency detection and Workshops
shutdown systems
Major Accident Identification

Hazardous materials
Failure modes
Loss scenarios
Met data System data
Emerg. Ignition
response probabilities
Chemical Failure
data data
Plant and Detection
equipment and isolation
layout strategies
Consequence Assessment Frequency Assessment
Fire / Explosions Fault Tree analysis

Flammable vapour dispersion Event Tree analysis
Toxic vapour dispersion
Impact Determination End Event Frequency Determination
Population
data
Risk Calculations
Individual risk
Societal risk
Identify major risk Risk Evaluation

contributors Risk
Determine risk acceptability criteria
Propose risk
reduction measures
Not
Acceptable
Acceptable
STOP
Figure 4: Overview of QRA Methodology
5.1 HAZARD IDENTIFICATION

5.1.1 Data Collection
Data on the hazards at the site and details needed to complete the risk assessment were drawn from
technical information on the proposed Terminal operations. This information included the following, as
applicable:
Engineering drawings (e.g. process flow diagrams, piping and instrumentation diagrams
(P&IDs) etc.)
15 May 2013 Page 18 of 43

Site layout plans

Area plans
Major inventories of combustible, flammable and toxic substances stored / handled
Release detection and isolation strategies and systems
Release containment systems
Description of surrounding land use and estimates of population densities.
5.1.2 Scenario Development
The proposed activities for the facility when in terminal operation mode were defined to identify
potential hazardous scenarios. This process involved the completion of a Process Hazard Analysis
study by a suitably-qualified team of Caltex personnel. The study did not identify any major accident
hazards (MAHs) that were additional to those previously identified for refinery operations covering the
tank farm, wharf and sub-berth operations. Conversion to terminal operations will result in a number
of the previously-defined MAHs being eliminated. Terminal operations will not include liquefied gases
(e.g. propane, butane) or high-temperature / high-pressure processes, such as those present within
existing refinery operations. The use of liquid chlorine for biocide treatment of salt water cooling water
will also be discontinued.
The identified MAH scenarios involve the release / spill of flammable or combustible liquids resulting in
a fire when ignited. This could occur at various locations including storage tanks, pumps and loading
arms. These hazardous scenarios were analysed in the QRA, based on the associated material
properties and transfer operations. The QRA also evaluated the frequency and consequence of a
Buncefield-type vapour cloud explosion.
To determine the amount of material that could potentially be involved in a release, factors such as
inventory, leak detection, and leak isolation strategies were considered. Event tree models were
developed for each potential release scenario. As the most likely MAH scenarios involved the release
of flammable material, the main events considered in the analysis were pool fires resulting from an
ignited release.
5.2 FREQUENCY ASSESSMENT

The frequency assessment involved defining the potential release sources and then determining the
likelihood (frequency) of the various releases. The assessment is a two-stage process that involves
evaluating the release frequency and then estimating the likelihood of the possible outcomes of the
release using an event tree.
5.2.1 Scenario Frequency
The available engineering drawings for the facility were reviewed to develop a parts count of failure
items for each of the hazardous scenarios. Failure rates based on historical industry failure frequency
data were utilised to estimate the likelihood of the various hazardous scenarios. The failure rate data
for storage tanks, piping, valves, and other relevant equipment items was sourced from published
references and other appropriate sources. The failure rate data used in the study is presented in
Appendix B.
5.2.2 Event Tree Analysis
Where appropriate, event trees were developed to estimate the frequency of the potential
consequence events that may result from a given release scenario. This analysis incorporated the
effectiveness of proposed detection and isolation systems when assessing consequence events that
are most influenced by time.
5.3 CONSEQUENCE ASSESSMENT

Following the frequency assessment, the consequence events were identified. The potential impacts
of these events were assessed using the consequence models available within PHAST-RISK [5].
These models consider the nature of the release, including the release rate, discharge velocity and
duration. The models used to assess the impacts of the consequence events are outlined below.
15 May 2013 Page 19 of 43

5.3.1 Pool Fires

Pool fire impacts for bund fires, tank top fires and fires in the vicinity of pumps & pipelines were
determined using a solid flame model. The model represents the flame as a skewed cylinder that
radiates heat outwards. The dimensions of the skewed cylinder (flame length and flame tilt) are
defined using the empirical correlations within PHAST-RISK.
5.3.2 Vapour Cloud Explosions
A vapour cloud explosion (VCE) occurs following the ignition of a flammable vapour cloud, coupled
with acceleration of the flame front within the cloud. Within process areas, VCEs are typically
associated with the confinement provided by surrounding equipment that promotes mixing and,
subsequently, causes the flame front to accelerate.
The current analysis considered the potential for an explosion to result from a gasoline storage tank
overfill event. This type of event occurred at Buncefield (United Kingdom) in 2005. Investigations into
that incident concluded that the observed high levels of overpressure, and their rate of decay, are
difficult to reproduce with the standard explosion models [6] (e.g. the Multi-Energy Method [7]).
Therefore, the overpressure from these events was determined using information that was specifically
developed to assess explosions associated with tank overfills [8].
5.3.3 Vulnerability Models
In order to evaluate the risk profile, the effects of the pool fire and VCE events must be estimated in
terms of the potential to cause fatality or injury. Vulnerability models were used to correlate the impact
(e.g. heat radiation) of an event to the potential for fatality or injury. The vulnerability models used in
the study are described in Appendix A.
5.4 RISK ASSESSMENT

Both individual and societal risk results were generated to define the risk profile for terminal
operations. These results were produced by combining the frequency and consequence estimates for
each of the hazardous scenarios. The following risk measures were generated:
Location-specific individual risk (LSIR) contours for fatality and injury risk
A graphical representation of individual risk that uses the risk values at each point to
construct iso-risk contours. The contours are presented on a map showing the risk
relative to the proposed terminal and surrounding land-uses.
Societal risk F-N curve for off-site population

This is a societal risk measure that communicates the potential for hazardous
scenarios to cause multiple fatalities by plotting the frequency of N or more fatalities
(F) against the number of fatalities (N). This is presented as a graph.
Calculation of the societal risk measures requires knowledge of the population distribution surrounding
the site. The following information is required for each location where people may be present (refer to
Appendix D):
Geographical location;
Number of people present at different times of the day;
Percentage of people located indoors; and
Building type (if applicable).
From the individual risk results, a list of risk contributors at specific locations was determined. This
allowed the major contributors to the risk to be identified, as well as the most influential hazardous
scenarios. From this information, targeted risk reduction actions can be readily identified that will
deliver the most effective risk reduction outcome (i.e. the greatest reduction in risk).
5.5 STUDY ASSUMPTIONS

In conducting the QRA, a number of technical assumptions were made. The key technical
assumptions are described in Appendix A.
15 May 2013 Page 20 of 43

6 RISK CRITERIA
The tolerability of the calculated risk is assessed by comparison with an appropriate risk target or
criterion. The risk criteria used to make this assessment are specified in HIPAP4 [2]. The risk criteria
are detailed below.

The individual risk of fatality criteria described in HIPAP4 that are applicable to proposed hazardous
developments are as follows:
Hospitals, schools, child-care facilities and old age housing development should not be
-6
exposed to individual fatality risk levels in excess of half in one million per year (0.5 x 10 per
year).
Residential developments and places of continuous occupancy, such as hotels and tourist
resorts, should not be exposed to individual fatality risk levels in excess of one in a million per
-6
year (1 x 10 per year).
Commercial developments, including offices, retail centres, warehouses with showrooms,
restaurants and entertainment centres, should not be exposed to individual fatality risk levels
-6
in excess of five in a million per year (5 x 10 per year).
Sporting complexes and active open space areas should not be exposed to individual fatality
-6
risk levels in excess of ten in a million per year (10 x 10 per year).
Individual fatality risk levels for industrial sites at levels of 50 in a million per year (50 x 10 per
-6
year) should, as a target, be contained within the boundaries of the site where applicable.
These criteria were developed based on a principle that if the risk from a potentially hazardous
installation is less than most risks being experienced by the community (e.g. voluntary risks,
transportation risks), then that risk may be tolerated. This principle is consistent with the basis of risk
criteria adopted by most authorities internationally.
The criterion for residential areas is demonstrably very low in relation to the background risk. It is
considered conservative, as it assumed an individual is present and exposed for 24 hours per day,
365 days per year.

HIPAP4 also outlines risk criteria for effects that may cause injury to people but will not necessarily
cause fatality. The injury risk criteria are separated based on the different effect types, i.e., heat
radiation, explosion overpressure and toxic exposure. HIPAP4 sets the following injury risk criteria:
Heat flux radiation at residential and sensitive use areas should not exceed 4.7 kW/m at a
2
-6
frequency of more than 50 x 10 per year.
Explosion overpressure at residential and sensitive use areas should not exceed 7 kPa at
-6
frequencies of more than 50 x 10 per year.
Toxic concentrations at residential and sensitive use areas should not exceed a level which
would be seriously injurious to sensitive members of the community following a relatively short
-6
period of exposure at a maximum frequency of 10 x 10 per year.
6.3 SOCIETAL RISK CRITERIA

The NSW DP&I has adopted indicative criteria to assess the off-site societal risk. The criteria take into
account the fact that society is particularly intolerant of accidents, which although infrequent, have the
potential to cause multiple fatalities. The criteria are presented on the F-N graph in Figure 5. The
criteria define three risk regions as follows [2]:
Intolerable: above the intolerable line, the activity is considered undesirable, even if
individual risk criteria are met.
ALARP (as low as reasonable practicable): within the ALARP region, the emphasis should
be on reducing risk as far as possible towards the negligible line (i.e. ensuring that risks have
been reduced to as low as reasonably practicable). Provided other quantitative and qualitative
criteria of HIPAP 4 are met, the risks from the activity may be considered tolerable within the
15 May 2013 Page 21 of 43

ALARP region as long as all reasonably practical risk reduction measures have been
implemented.
Negligible: below the negligible line the societal risk is not considered significant, provided
other individual risk criteria are met.
1.00E-01
1.00E-02
1.00E-03
Intolerable
1.00E-04
1.00E-05
ALARP
1.00E-06
1.00E-07
1.00E-08 Negligible
1.00E-09
1 10 100 1000
Figure 5: Indicative Societal Risk Criteria [2]

HIPAP4 sets risk criteria that reflect the potential for property damage and accident propagation.
Assessment against the criteria provides an indication of the risk that an accident at the facility may
cause damage to buildings and / or propagate to involve neighbouring industrial operations, causing
further hazardous incidents, i.e. the so-called 'domino effect'. HIPAP4 sets the following criteria for
risk of damage to property and accident propagation:
Heat flux radiation at neighbouring potentially hazardous installations, or at land zoned to
-6
accommodate such installations, should not exceed a risk of 50 x 10 per year for the
2
23 kW/m heat flux level.
Explosion overpressure at neighbouring potentially hazardous installations, at land zoned to
accommodate such installations or at nearest public buildings should not exceed a risk of
-6
50 x 10 per year for the 14 kPa explosion overpressure level.

HIPAP4 outlines risk criteria addressing the risk from accidental releases to biophysical environment.
The criteria focuses on the potential acute and chronic toxic impacts that an accidental release may
have on whole systems and populations, rather than individual plants or animals. HIPAP4 expresses
the criteria as follows:
Industrial developments should not be sited in proximity to sensitive natural environmental
areas where the effects (consequences) of the more likely accidental emissions may threaten
the long-term viability of the ecosystem or any species within it.
Industrial developments should not be sited in proximity to sensitive natural environmental
areas where the likelihood (probability) of impacts that may threaten the long-term viability of
the ecosystem or any species within it is not substantially lower than the background level of
threat to the ecosystem.
15 May 2013 Page 22 of 43

7 HAZARD IDENTIFICATION
The hazard identification phase involved a review of the planned terminal operations, engineering
diagrams and other relevant information. This material was used to identify all sections of the facility
that would contain hazardous material during future operations.
7.1 HAZARDOUS MATERIALS

The nature of the hazardous materials identified in the study was reviewed from information contained
in the Material Safety Data Sheets (MSDSs) supplied by Caltex. The materials that are to be stored
on-site are:
Gasoline (ULP / PULP / SPULP)
Jet fuel
Diesel
Fuel oil
Slop.
Slop was assumed to be a mixture of diesel and gasoline. For the purpose of this analysis, slop was
assumed to have the properties of gasoline. A list of hazardous materials identified and their
respective properties is presented in Table 4.
Table 4: Materials Properties [9, 10, 11, 12, 13, 14, 15]
Dangerous Flash Auto-Ignition Flammability
Material HAZCHEM
Goods UN No. Point Temperature limits
Name Code
Class (C) (C) (in air)
Gasoline 3 1203 3YE -40 370 1.4 - 7.4%
Jet Fuel 3 1863 3Y 40 >210 0.7 - 6.0%
Diesel C1 - - >61.5 >250 1.3 - 6.0%
Fuel Oil C1 - - >61.5 - 1.0 - 5.0%
7.2 ISOLATABLE SECTIONS

Within the QRA model, the hazardous scenarios developed following a release are dependent on the
conditions in the corresponding isolatable section. These conditions were used in the consequence
modelling for each hazardous scenario and include:
Material
Process conditions (e.g. temperature and pressure )
State (i.e. vapour or liquid)
Inventory
Flow rate
Utilisation (i.e. percentage of the time in use).
7.3 HAZARDOUS SCENARIOS

Hazardous scenarios were developed to represent the range of possible failures associated with each
isolatable section. These failure modes were represented as releases from selected hole sizes.
For the wharf operations, the following two failure cases associated with the loading / unloading arms
were considered:
Full bore release hole size equivalent to diameter of the loading arm (approximately 250
mm)
Medium release hole size equivalent to 10% of cross-sectional area of the loading arm
(approximately 80 mm).
15 May 2013 Page 23 of 43

For other equipment, a maximum of five hole sizes were considered in the analysis to represent the
full range of potential failure modes. This range of hole sizes was considered for storage tanks,
pumps and associated internal pipelines. The hole sizes used to define the hazardous scenarios are
presented in Table 5.
Table 5: Representative Hole Sizes

Hole Size Category Representative Hole Size Hole Size Range
Small 5 mm dh 5 mm
Medium 20 mm 5 mm > dh 20 mm
Large 50 mm 20 mm > dh 50 mm
Very Large 100 mm 50 mm > dh 150 mm
Rupture Full bore dh > 150 mm
For some isolatable sections, the hole sizes presented in Table 5 were adjusted to better represent
the connections and/or piping included in that section of the process. For pipelines and pumps, the
pipe diameter was used as the hole size representing the Rupture category. For atmospheric
storage tanks and associated piping, the hole sizes representing the Very Large and Rupture
categories were adjusted as necessary to reflect the larger hole sizes associated with equipment
within the tank farm. The hole size representing the Very Large case was increased to 150 mm and
the Rupture case was assigned the size of the largest connection to the tank.
The full list of hazardous scenarios considered in the risk assessment is provided in Appendix E.
The additional hazardous scenario of tank overfill was considered for the gasoline storage tanks. This
was considered to ensure the QRA examined the range of possible consequences associated with a
tank farm, including the explosion of a vapour cloud formed following a release (refer to Section 7.4.2).
7.4 CONSEQUENCE EVENTS

7.4.1 Pool Fires
For the identified hazardous scenarios, the potential consequence events were mainly pool fires. A
pool fire is a turbulent diffusion flame, burning above a horizontal pool of vaporising flammable liquid,
with little or no momentum. The flame can emit fatal levels of radiant heat to the surrounding area.
Pool fires will result following the ignition of a continuous or instantaneous release of flammable
hydrocarbon liquids stored at atmospheric conditions.
The size of a pool fire is determined by operating conditions, the burning rate of material and the
presence of spill containment. The location of each isolatable section was reviewed to assess the
presence of spill containment for consideration in the modelling. The main types of scenarios
considered in the QRA are discussed below, with the associated spill containment:
Wharf Operations
A pool fire resulting from the ignition of a release from a loading arm. Spill containment is
provided that will limit the pool size [16].
Tank Farm
A pool fire resulting from the ignition of a release from a storage tank (and/or associated
equipment) into the surrounding bund. The size of a pool fire was limited to the surface area
of the bund (excluding the tank area).
A full-surface tank fire could occur following an internal explosion of a cone roof tank or the
sinking of a floating roof tank. The fire size was limited to the diameter of the tank.
Pipelines
A pool fire resulting from the ignition of a release from a pipeline. Pipelines either run inside a
pipe trench or on the pipeway edge, with the ground underneath sloping towards the pipe
trench. The diameter of the fire was limited to the trench width.
15 May 2013 Page 24 of 43

Pumps
A pool fire resulting from the ignition of a release from a pump. In most cases, the pumps
were located within a kerbed area, with an internal drain to the oily water sewer (OWS). The
pool size was limited to the kerbed area.
7.4.2 Vapour Cloud Explosion
In December 2005 at the Buncefield Oil Storage Depot in the UK, a number of explosions and a
subsequent fire occurred. These destroyed a large part of the facility, caused widespread damage to
the surrounding homes and businesses, resulted in 43 injuries and disruption to the local community
[17]. The fire burned for five days and emitted a large plume of smoke into the atmosphere.
The subsequent investigation determined that the incident was due to the overfilling of a fuel storage
tank containing unleaded petrol. A delivery of fuel from the pipeline feeding the tank started and the
safety systems in place to shut-off the supply of fuel to prevent overfilling failed to operate. Petrol
cascaded down the side of the tank and began to collect in the bund. As overfilling continued, the
vapour cloud formed by the mixture of petrol and air flowed over the bund wall and travelled off-site
towards the nearby industrial estate. A white mist was observed in CCTV replays of the event. The
exact nature of the mist is not known with certainty: it may have been a volatile fraction of the original
fuel, such as butane, or ice particles formed from the chilled, humid air as a consequence of the
evaporation of the escaping fuel.
The vapour cloud was believed to have ignited in the industrial estate car park and the main explosion
was massive. Subsequent explosions and a huge fire also occurred. The main explosion at the
Buncefield depot was unusual because it generated much greater overpressures than would usually
have been expected from a vapour cloud explosion. The mechanism of the violent explosion was the
subject of additional research. Phase 1 of this research [18] indicated a likely sequence of events
(although could not fully explain all the damage based on the theory). It was surmised that the gas
cloud was ignited by a source at the emergency fire water pump house and a slow flame propagated
outwards in all directions. When it reached a line of trees and vegetation in the lane outside the site,
the flame accelerated along the tree lined road. The deflagration explosion transitioned to a
detonation event further along the road. The detonation travelled in all directions, leading to a high
overpressure within the flammable gas cloud and high amounts of damage over the affected area.
Outside the gas cloud, the detonation became a blast wave which decayed rapidly with distance, due
to the shallow nature of the flammable gas cloud.
As a result of the incident and the subsequent analysis, this type of incident is now considered
important to include when assessing the risk associated with bulk fuel storage facilities. Although this
type of event is considered to have a very low likelihood of occurrence, the high explosion
overpressures that may result could cause significant far-field damage.
A scenario of this type was included in the QRA model. The scenario considered an overfill event
associated with the 16 tanks that will store varieties of unleaded petrol. To quantify the risk, a detailed
analysis was completed to determine the frequency and consequence of an overfill event. The overfill
event frequency was determined by considering the frequency of filling operations and the controls in
place that would act to prevent the event. The consequence assessment was completed based on
knowledge developed following the investigation of the Buncefield incident [8, 18].
7.5 MAJOR ACCIDENT HAZARDS

Caltex revised the list of MAHs developed for Refinery Operations to include only those relevant to
future terminal operations. Where appropriate, each hazardous scenario identified within the QRA
was linked to an MAH. The resulting list of MAHs is presented in Table 6.
15 May 2013 Page 25 of 43

Table 6: List of Caltex MAHs for new Terminal

MAH Considered
Relevant Area MAH Description
Number in QRA
Loc. Wharf Low flash point liquid hydrocarbon loading/
WRF-001 Y
unloading / Large scale loss of containment
High flash point liquid hydrocarbon loading/
WRF-003 Y
Loc. Sub Berth High flash point hydrocarbon loading/
SUB-005 Y
Loc. atmospheric tanks at Hydrocarbon vapour inside empty tank /
OMC-001 N
tank farm & associated Ignition during maintenance
pumps and pipelines Low flash point hydrocarbon storage &
OMC-002 Y
transfer / Large scale loss of containment
High flash point hydrocarbon storage &
OMC-003 Y
transfer / Large scale loss of containment
15 May 2013 Page 26 of 43

8 FREQUENCY ASSESSMENT
8.1 FAILURE FREQUENCY
The likelihood of a potential release of a material from an isolatable section was determined from the
likelihood of equipment failure within that section. Any of the identified equipment items or fittings
within the isolatable section could potentially fail and result in a release. For each isolatable
section, the frequency assessment involves counting the number of items (e.g. flanges, valves and
instrument fittings) and summing their individual failure rates, to obtain the overall failure frequency.
This parts count process was conducted using P&IDs, which detailed the items included within each
isolatable section.
A full parts count was completed for equipment configurations unique to particular sections within the
facility. The results of these full parts counts were then applied to similar equipment configurations.
For example, for a group of similar storage tanks, the full parts count completed for one storage tank
was then applied to the others within the group.
For each isolatable section, the overall failure frequency was distributed across the selected hole
sizes. This frequency distribution was then used to determine the likelihood of the corresponding
hazardous scenarios.
The frequency assessment used available historical failure rate data from the following public sources:
UK HSE - Failure Rate used for Land Use Planning Risk Assessments [19]
International Association of Oil & Gas Producers - Storage Incident Frequencies [20]
E & P Forum - Hydrocarbon Leak and Ignition Data Base [21].
These sources provide the failure rate data for equipment items and fittings, and the corresponding
failure rate distribution for a range of hole sizes. The failure rate data used in the QRA is summarised
in Appendix B.
The failure rate data obtained from public sources was used in the QRA without modification. No
specific characteristics, such as environmental factors, were identified that would require the failure
data to be modified. For example, no unusually harsh conditions are experienced at the Kurnell site
that would cause failure modes, such as corrosion, to occur at significantly higher rates than those
typical across industry. Additionally, in Terminal operations, Caltex will continue to use its established
integrity management processes, which are largely-based on industry standards. It is expected that
these established processes will serve to maintain integrity management performance at a level that is
at least equal to the performance reflected within the failure rate data used in the QRA model. Caltex
also has established processes for corporate audits, insurance engineering surveys and external
audits. These provide assurance on the effectiveness of these integrity management processes.
Therefore, it is considered reasonable to use the data summarised in Appendix B without modification.
8.2 EVENT TREE ANALYSIS

Event trees were used to estimate the frequency of a consequence event for a given release scenario.
Event tree analysis provides a systematic means of determining which factors will influence the
release, in addition to the probability associated with each of those factors.
The following parameters are generally considered in event tree analysis:

Probabilities of release detection and isolation
Time taken to detect and isolate the release
Probability of ignition (immediate ignition and delayed ignition)
An example event tree structure incorporating release detection and isolation times is presented in
Figure 6.
15 May 2013 Page 27 of 43

Figure 6: Event Tree Structure (Detection and Isolation Component)
In this analysis, a targeted approach was used to determine whether the release detection and
isolation times were included in the event tree analysis for a given scenario. These factors were only
considered for the hazardous scenarios with consequence events that were significantly influenced by
the failure to isolate. For other hazardous scenarios and consequence events (i.e. those where
isolation and detection did not significantly affect the contribution to the risk profile), event tree
analysis was not conducted.
8.3 TANK OVERFILL / EXPLOSION FREQUENCY

A detailed assessment was conducted to determine the frequency of an explosion following the overfill
of a storage tank containing unleaded petrol. The assessment did not consider tanks containing jet
fuel or diesel because these substances do not contain the light hydrocarbon components necessary
to form a large vapour cloud following an overfill event.
The frequency of an explosion following tank overfill was evaluated using a fault tree to assess the
overfill frequency and an event tree to quantify the explosion event frequency. The fault tree analysis
determined the frequency of a significant overfill resulting from an error during tank filling operations.
The analysis considered the following factors:
The number of filling operations;
The probability of operator error; and
The controls in place to prevent overfill and their effectiveness.
The investigations into the Buncefield incident developed a series of recommendations for operators
of bulk fuel storage depots. These recommendations were targeted at reducing the risk of an incident
of this nature. In transitioning to Terminal operations, Caltex performed a gap assessment against
these recommendations. This assessment helped to identify appropriate controls for an overfill /
explosion scenario involving the gasoline storage tanks. A full list of the Buncefield recommendations
is reproduced in Appendix C.
Based on the assessment, Caltex have adopted improved controls for tankage. A number of listed
controls are already in place with the others to be implemented during the Terminal transition.
15 May 2013 Page 28 of 43

Table 7: Tank Overfill / Explosion Controls

Type of Control Controls
Prevention controls Primary level indication with high level alarm (radar gauge)
Independent level indication with high-high level alarm
Independent SIL-rated trip of tank inlet valve on high-high-high level
alarm
Tank design and maintenance program in accordance with industry
good practice
Continuous monitoring of tank inventory from a centralised control
room
Operating procedures controlling quantity of material transferred
Classification of hazardous areas and selection of equipment and
protective systems is conducted in accordance with Australian
Standards HB13-2007 and AS2381
All tanks have installed earthing and maintenance program
Detection Flammable gas detectors and control room alarms for tank
compounds of low flash point flammable liquids
Remote CCTV monitoring for tank compounds of low flashpoint
flammable liquids
Tank top infra-red flame detection for low flash point flammable liquid
storage tanks
Routine operator tank farm inspections
Isolation Remote-actuated fire-rated tank inlet / outlet valves
Spill Response Bund capacity, design and construction equivalent compliance to
AS1940
Primary response capability to apply foam up to, and including, full
bund surface area of largest tank compound
Tank bund drainage isolation valves operable external to bund
Event Response Tank separation distances compliant to s5.7 of AS1940.
Caltex personnel trained in advanced fire fighting techniques,
specific Caltex equipment and incident management approach
common to Fire & Rescue NSW.
Facility Emergency Plan & Pre-incident plans.
The fault tree analysis considered those controls that would directly act to prevent the tank overfill
(e.g. tank level indication with high level alarm) or limit the amount of material released (e.g. gas
detector linked to an alarm). For each control, the effectiveness was determined by quantifying the
reliability of individual components. Where controls relied on human intervention, the derived
effectiveness accounted for the probability of operator error within the time required to respond.
The event tree analysis estimated the frequency of an explosion resulting from the ignition of a
significantly large vapour cloud formed following an overfill. In assessing the outcome frequency, the
following factors were considered:
Ignition probability;
The probability of stable weather conditions (i.e. atmospheric stability category F); and
The probability of a low wind speed that would result in the formation of a significantly large
vapour cloud.
-8
The explosion event frequency was estimated to be less than 0.01 in a million per year (<110 per
year). This event is not considered to be a significant contributor to the overall risk profile. In
-7
comparison, the average risk of fatality from a lightning strike is 0.1 in a million per year (110 per
year) [2].
15 May 2013 Page 29 of 43

9 CONSEQUENCE ANALYSIS
For each hazardous scenario, consequence modelling was conducted for a range of hole sizes. The
consequence modelling determined the area impacted by each consequence event. The
consequence modelling was conducted using the software package PHAST-RISK [5]. The models
within PHAST-RISK were used to determine the consequence impact distances for the heat radiation
from the pool fires.
The consequence impact distances for each effect type depends on the following conditions:
Release conditions (temperature, pressure, hole size and duration)
Release source (elevation, orientation)
Chemical properties
Atmospheric conditions (wind speed).
Independent of their likelihood, several pool fire events and the VCE events were considered to have
potential to cause an off-site fatality and / or injury. These results are summarised in Table 8, grouped
by MAH. Table 9 lists a number of locations along the facility boundary where the MAHs have the
potential for off-site fatality. Of these locations, only those positions adjacent to storage tanks are
impacted by the scenarios considered in the QRA model.
Table 8: Consequence Events with Off-site Fatality or Injury Impact

Related Isolatable Consequence
MAH Offsite Impact
Sections Description
Storage tanks adjacent the "Very large" spill fire Injury Only
OMC-002, OMC-003 North-Eastern, Eastern and
Full-surface bund fire Fatality and injury
Western boundaries
Transfer pipelines between Fire following a large
OMC-002, OMC-003 Fatality and injury
wharf and terminal pipeway release from pipeline
Storage tanks near the
VCE following a tank
OMC-002 North-Eastern and Eastern Fatality and injury
overfill event
boundaries
Table 9: Off-site Locations Potentially Impacted by MAH Scenarios

Location Event Type MAH No.
Intersection of Silver Beach Road and Captain
Not impacted
Cook Drive
Kurnell Social Club Not impacted
Full-surface bund
OMC-002
fire
Cook Street Boundary
VCE following a
OMC-002
tank overfill event
Full-surface bund
OMC-002
fire
Reserve Road Boundary
VCE following a
OMC-002
tank overfill event
VCE following a
National Park Boundary OMC-002
tank overfill event
Full-surface bund
Chisholm Rd Commercial Premises OMC-003
fire
Sir Joseph Banks Drive Boundary Not impacted
Full-surface bund
HCE Boundary OMC-003
fire
To provide guidance on the impact experienced from different fire events, the downwind impact
distance for a number of consequences are presented in Table 10. These are measured from the
centre point of the storage.
15 May 2013 Page 30 of 43

Table 10: Typical Impact Distances for Fire Scenarios

Distance to fatality Distance to injury
Event 2 2
(approx 12.5 kW/m ) (approx 4.7 kW/m )
Full surface tank fire up to 50 m Typically not reached at Typically not reached at
diameter ground level outside of bund ground level outside of bund
Full surface tank fire up to 78 m Typically not reached at Typically not reached at
diameter ground level outside of bund ground level outside of bund
2
Full bund fire up to 8000 m 62 m 130 m
2
Full bund fire up to 25,500 m 101 m 194 m
Fire from catastrophic failure of any
26 m 60 m
transfer pipeline
Fire from catastrophic failure of any
20 m 35 m
loading arm
Due to the relative height of the storage tanks and the observer, the heat flux radiation experienced
from a full-surface tank fire does not exceed injury levels under average weather conditions.
15 May 2013 Page 31 of 43

10 RISK ASSESSMENT
Individual risk was determined by combining the frequency and consequence data for each hazardous
scenario. Individual risk contours were developed by plotting lines that connect different locations
experiencing the same levels of risk. The individual risk of fatality contours are presented in Figure 7.
Reserve Road
Refinery Boundary
Cook Street
Refinery Boundary
Chisholm Road
Refinery Boundary
Figure 7: Location-Specific Individual Risk of Fatality (Off-site Assessment)
The risk results were compared to the risk criteria to determine the tolerability of the risk from the
proposed operations. The particular aspects of the risk criteria applicable to this study were [2]:
Hospitals, schools, child-care facilities and old age housing development should not be
-6
exposed to individual fatality risk levels in excess of 0.5 x 10 per year.
15 May 2013 Page 32 of 43

Residential developments and places of continuous occupancy, such as hotels and tourist
-6
resorts, should not be exposed to individual fatality risk levels in excess of 1 x 10 per year.
Commercial developments, including offices, retail centres, warehouses with showrooms,

restaurants and entertainment centres, should not be exposed to individual fatality risk levels
-6
in excess of 5 x 10 per year.
Sporting complexes and active open space areas should not be exposed to individual fatality
-6
risk levels in excess of 10 x 10 per year.

-6
Individual fatality risk levels for industrial sites at levels of 50 x 10 per year should, as a
target, be contained within the boundaries of the site where applicable.
-6
The 0.5 x 10 per year risk contour extends off-site in some areas but does not extend to sensitive
areas such as the pre-school, which is located to the north of the Terminal boundary on Captain Cook
Drive. This aspect of the criteria is therefore satisfied.
-6
The 1 x 10 per year risk contour extends off-site in some areas but does not extend to residential
areas. This aspect of the criteria is therefore satisfied.
-6
The 5 x 10 per year risk contour extends off-site in some areas but does not extend to commercial
developments. This aspect of the criteria is therefore satisfied.
-6
The 10 x 10 per year risk contour extends off-site in some areas but does not extend to active open
space such as the Kurnell Recreational Club, which is located to the west of the Terminal boundary on
Captain Cook Drive. This aspect of the criteria is therefore satisfied.
-6
The analysis has found the 50 x 10 per year individual risk level does not exceed the site boundary.
This aspect of the criteria is therefore satisfied.
The tolerability of the fatality risk results is summarised in Table 11.
Table 11: LSIR Fatality Risk Tolerance Criteria [2]

Tolerance Criteria
Land Use (risk in a million per LSIR Results
year)
Sensitive areas, such as hospitals and schools 0.5
Residential developments and continuous The relevant LSIR
1.0 contours do not
occupancy, such as hotels and resorts
Commercial developments, including retail extend to each of
5 these areas.
centres, offices and entertainment centres
All criteria are
Sporting complexes and active open space 10 satisfied.
Industrial areas 50
The model was used to determine the consequence events that contribute to the risk at different
locations along the boundary. Risk contributors were identified at locations corresponding to the
Reserve Road Boundary and the Chisholm Rd boundary (refer to Figure 7). The risk contributors at
these locations are presented in Table 12.
15 May 2013 Page 33 of 43

Table 12: Risk Contributors

Location Contributing Consequence Event MAH No. Risk Contribution
Full-surface bund fire associated
with storage tanks near the north- OMC-002 98%
eastern and eastern boundaries
Reserve Road
VCE following a tank overfill event
Refinery Boundary
associated with storage tanks near
OMC-002 2%
the north-eastern and eastern
boundaries
with storage tanks near the north- OMC-002 98%
eastern and eastern boundaries
Cook Street
VCE following a tank overfill event
Refinery Boundary
associated with storage tanks near
OMC-002 2%
the north-eastern and eastern
boundaries
Chisholm Road
with storage tanks near the western OMC-002 100%
Refinery Boundary
boundary
15 May 2013 Page 34 of 43


The injury risk results were generated by applying the impairment criteria defined in Section 6.2. The
resulting individual risk of injury contour for heat radiation is presented in Figure 8. A corresponding
individual risk of injury contour for explosion overpressure is not presented because the explosion
event frequency is below the criterion level.
-6
Figure 8: Location-Specific Individual Risk of Injury Heat Radiation (50 x 10 per year)
15 May 2013 Page 35 of 43

The tolerability of results was determined by comparison with the HIPAP4 injury risk criteria [2]. As the
consequence events analysed were pool fires and an explosion resulting from a tank overfill event (i.e.
no toxic vapour dispersion), the particular aspects of the risk criteria applicable to this study were:

2
Heat flux radiation at residential and sensitive land-use areas should not exceed 4.7 kW/m at
-6
a frequency of more than 50 x 10 per year.
Explosion overpressure at residential and sensitive land-use areas should not exceed 7 kPa at
-6
frequencies of more than 50 x 10 per year.
-6
The 50 x 10 per year individual risk of injury risk contour for heat flux radiation is mostly contained
on-site, only extending beyond boundary in the north-east section of the terminal. However, it does
not reach residential areas or sensitive areas (e.g. the pre-school, which is located to the north of the
terminal on Captain Cook Drive). This aspect of the criteria is therefore satisfied.
-6
The risk of explosion calculated for a tank overfill event was below 50 x 10 per year. Consequently,
an injury risk plot for explosion overpressure is not presented, as the risk does not exceed the criteria
-6
level of 50 x 10 per year at any location. This aspect of the criteria is therefore satisfied.
The injury risk criteria for toxic exposure was not applicable, as the QRA did not involve scenarios
which could result in this type of event. The acceptability of the injury risk criteria is summarised in
Table 1.
Table 13: LSIR Injury Risk Tolerance Criteria [2]

Tolerance Criteria
Individual Injury Risk Criteria (risk in a million per Tolerability
year)
Incident heat flux radiation at residential
2 50
and sensitive areas exceeding 4.7 kW/m . The relevant LSIR contours
residential and sensitive use areas should 50 areas. The criteria is met.
not exceed 7 kPa at frequencies.
Toxic concentrations in residential and
Not applicable, as the QRA
sensitive use areas exceed a level which
did not involve scenarios
would be seriously injurious to sensitive 10
which could result in this
members of the community following a
type of event.
relatively short period of exposure.
15 May 2013 Page 36 of 43

10.3 SOCIETAL RISK OFF-SITE POPULATION

The societal risk exposure for the off-site population was assessed using an F-N curve and the
indicative societal risk criteria described in HIPAP4 [2]. The F-N curve for the Project is presented
in Figure 9, which also shows the indicative societal risk criteria.
1.00E-01
1.00E-02
1.00E-03
Intolerable
1.00E-04
1.00E-05
ALARP
1.00E-06
1.00E-07
1.00E-08 Negligible
1.00E-09
1 10 100 1000
Figure 9: Societal Risk Results Off-site Population
As can be seen from Figure 9, the F-N curve lies below the negligible line. In this region, the
societal risk is not considered significant, provided other individual risk criteria are met. As described
in the preceding sections, the individual risk criteria for fatality and injury are satisfied and therefore
the societal risk is also considered tolerable.

The risk of property damage and accident propagation was assessed using the impairment criteria
defined in Section 6.4. The resulting risk contour for heat radiation is presented in Figure 10. A
corresponding risk contour for explosion overpressure is not presented because the explosion event
frequency is below the criterion level.
15 May 2013 Page 37 of 43

Figure 10: Location-Specific Risk of Property Damage and Accident Propagation Heat
-6
Radiation (50 x 10 per year)
The tolerability of results was determined by comparison with the following risk criteria defined within
HIPAP4 [2]:
Incident heat flux radiation at neighbouring potentially hazardous installations or at land zoned
-6
to accommodate such installations should not exceed a risk of 50 x 10 per year for the
2
23 kW/m heat flux level.
15 May 2013 Page 38 of 43

Incident explosion overpressure at neighbouring potentially hazardous installations, at land

zoned to accommodate such installations or at nearest public buildings should not exceed a
-6
risk of 50 x 10 per year for the 14 kPa explosion overpressure level.
-6
The 50 x 10 per year risk contour for heat flux radiation is contained on-site. Therefore, it does not
reach neighbouring areas, including potentially hazardous installations. This aspect of the criteria is
satisfied.
-6
In Figure 10, the 50 x 10 per year risk contour appears as numerous individual sections of the same
contours that are limited to the immediate area. For example, within the Tank Farm, different sections
of the contours are contained within the corresponding bunded area. This demonstrates that these
contours do not extend to impact surrounding infrastructure, such as storage tanks within adjoining
areas.
-6
The risk of explosion at the facility did not exceed 50 x 10 per year. Consequently, a risk plot for
-6
explosion overpressure is not presented, as the risk does not exceed the criteria level of 50 x 10 per
year at any location. This aspect of the criteria is therefore satisfied.
The acceptability of the risk criteria is summarised in Table 1.
Table 13: Risk of Property Damage And Accident Propagation Tolerance Criteria [2]
Tolerance Criteria
Risk Criteria (risk in a million per Tolerability
year)
Incident heat flux radiation at neighbouring
potentially hazardous installations or at
50
land zoned to accommodate such
2
installations for the 23 kW/m heat flux. The relevant LSIR contours
neighbouring potentially hazardous areas. The criteria are
installations, at land zoned to met.
50
accommodate such installations or at
nearest public buildings for the 14 kPa
explosion overpressure level

The risk to the biophysical environment examines the potential effects on the long-term viability of the
ecosystem or any species within it. The risk was assessed by examining release scenarios
associated with the operations of the facility. In assessing the potential impact, the analysis
considered the controls that would prevent, or mitigate, the impact an incident could have on the
surrounding environment.
For the wharf, the QRA identified release scenarios at the product loading arms and the pipelines
along the wharf. A release from this equipment could affect the marine environment of Botany Bay.
However, there are a number of controls in place that would minimise the potential for a release. The
equipment items are subject to testing and inspection programs, in line with Caltex integrity
management programs. During unloading operations, there are personnel in attendance who, if a
release occurred, would be able to detect the leak and isolate the source. Additionally, a spill at the
loading arms would be contained within the purpose-built spill containment areas. These factors will
limit the amount of material that would typically be released following a failure. A release of product at
the wharf is not considered likely to threaten the long-term viability of the ecosystem.
For the tank farm, the QRA identified release scenarios at the product storage tanks, as well as the
associated pipelines and pumps. The potential for release from this equipment is managed by Caltex
through a maintenance program to ensure the integrity of equipment. If a release occurs, it would be
contained within the bunded areas surrounding storage tanks and pumps or within the pipeways.
Impacts to surrounding ecosystems would be negligible. A release would be identified by the spill
15 May 2013 Page 39 of 43

detection within the Terminal that includes routine operator surveillance, routine dead tank
monitoring and flammable vapour detection. An appropriate response would then be activated to
clean-up a spill. Additionally, the containment areas can be drained to the oily water system, where
product would be retained, preventing the discharge of any remaining product direct to the
environment. Therefore, a release of product within the terminal would not threaten the long-term
viability of the ecosystem.
Caltex also maintains an Environmental Aspects and Impacts Register, as part of its requirements for
compliance with ISO 14001 [22]. The register identifies potential sources of accidental release,
assesses the potential consequence, identifies key risk controls and ranks the risk using Caltexs
Riskman2 process.
10.6 SENSITIVITY ANALYSIS

QRA models are developed based on a number of assumptions with some assumptions being more
influential than others. The assumptions used in the current study were reviewed to determine those
that could influence the risk results. Assumptions related to the following areas were considered most
influential:
Frequency Data, including modification factor and utilisation
Pool Fire Modelling; and
Heat Radiation Vulnerability.
The frequency data used in the analysis was obtained from available public source. For reasons
outlined in Section 8.1, this frequency data was applied in the QRA without modification. A sensitivity
analysis was conducted to determine the influence possible modifications would have in the results.
This analysis involved doubling the frequency used in the model, i.e. a doubling of the failure rate.
Although there was a change in the individual risk of fatality contours, these changes did not result in
any of the risk contours exceeding the applicable criteria and therefore the conclusions made
regarding risk tolerability were unchanged.
A number of assumptions were made concerning the modelling of pool fires. The magnitude of the
pool fire consequences depends on the selected representative material, operating pressure and spill
containment size. Of these parameters, the greatest variable observed is the operating pressure (and
tank level), which influences the release rate and pool fire size. While a change in pressure or level
would result in large pool forming, the physical spill containment would limit the pool size and
subsequent fire size. Adjustment of related assumptions causes an increase in the risk contours most
influenced by the medium to large releases. However, these effects are limited to on-site areas and
the risk off-site is not altered significantly. The conclusions made regarding risk tolerability remained
unchanged.
The heat radiation vulnerability model and corresponding exposure time selected for use in the QRA
are other assumptions that would influence the risk results. The vulnerability model is used to
determine the fatality impact based on the calculated heat flux and an assumed exposure time (refer
to Assumption No. 13 in Appendix A). This study used the model developed by TNO for "unprotected"
personnel. An alternate choice is the Eisenberg equation, however, a higher heat flux is required to
obtain the same fatality impact assuming the same exposure time. Therefore, the parameter of
greater influence is exposure time. A longer exposure time would results in a higher fatality for the
same heat flux. The exposure time would have to be at least doubled before the risk results would be
increased to the extent that may alter the conclusions regarding risk tolerability.
In summary, the sensitivity of the QRA model to various parameters was reviewed. Significant
variations to these assumptions were investigated. The overall conclusions of the QRA model
regarding risk tolerability remained unchanged despite these modifications to the QRA model.
15 May 2013 Page 40 of 43

11 COMPARISON TO RISK AT THE EXISTING FACILITY

The conversion to terminal operations results in a significant reduction in the number of major accident
scenarios at the site due to the shut-down of the refinery process units. Following conversion to
terminal operation, there will be a general reduction in the extent of the off-site risk. This reduction
can be attributed to the following factors:
Shut-down of refinery process units results in the decommissioning of the LPG storage
area (and the associated pipe network).
Under refinery operations, LPG storage areas were in close proximity to the site boundary
and several release scenarios had the potential to impact off-site areas. The change to
terminal operations will eliminate these scenarios.
Shut-down of refinery process units results in the ceasing of operations involving toxic
material, such as chlorine and hydrogen sulphide.
In previous studies, large release scenarios involving these materials had the potential to
extend into off-site areas. The change to terminal operations will eliminate these scenarios.
Reduced potential for events with far-reaching impacts such as boiling liquid-
expanding vapour explosion (BLEVE) scenarios.
Due to the removal of liquefied gas inventories, the potential for BLEVEs will be eliminated.
Removal of these hazardous inventories will also significantly reduce the number of potential
VCEs.
A significant reduction in the inventory of flammable and combustible liquids.

While the site will retain approximately 60% of the existing tankage, the hazardous
inventories within the refinery process units will be eliminated.
Modifications to storage tank operations.

The individual risk of fatality will be reduced at certain locations as a result of;
o Conversion of some tankage close to the site boundary to less hazardous duty (e.g.
crude tanks converted to diesel)
o The commitment to improved risk controls at some locations as a result of
implementing the Project (e.g. automated overfill protection on gasoline tanks).
15 May 2013 Page 41 of 43

12 REFERENCES
1 State Environment Planning Policy No 33 - Hazardous and Offensive Development,

published in Gazette No 36 of 13/03/1992, p 1754.
2 New South Wales Government, Department of Planning, Hazardous Industry Planning

Advisory Paper No. 4, Risk Criteria for Land Use Safety Planning, January 2011 (HIPAP
No. 4).
3 New South Wales Government, Department of Planning, Hazardous Industry Planning

Advisory Paper No. 6, Hazard Analysis, January 2011 (HIPAP No. 6).
4 Caltex Refineries (NSW) Pty Ltd., "Caltex Kurnell Refinery Neighbourhood Layout,
Drawing Number A1-127103, Revision 1.
5 Det Norske Veritas, PHAST-RISK (Safeti), Version 6.7,

http://www.dnv.com/services/software/products/safeti/safeti/index.asp
6 Taveau, J., The Buncefield explosion: were the resulting overpressures really
unforeseeable?, Process Safety Progress, Vol 31, No. 1, 2011.
7 Committee for the Prevention of Disasters, Methods for calculation of physical effects Part
2 Yellow Book CPR 14E, Third Edition, Chapter 5 Vapour Cloud Explosion, 2005.
8 DNV ENERGY, Illustrative model of a risk based land use planning system around
petroleum storage sites, Buncefield Major Incident Investigation Board, Rev 0, May 2008.
9 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Automotive Diesel Fuel, Infosafe
No. ACRJ8, November 2011.
10 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Fuel Oil, Infosafe No. AMQ17,
May 2009.
11 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Jet A-1 Fuel, Infosafe No. AMQ36,
September 2011.
12 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Super Premium Unleaded Petrol of
98 RON, Infosafe No. LPTL8, May 2009.
13 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Unleaded Petrol, Infosafe No.
AMPHO, May 2009.
14 CHRIS Manual (Chemical Hazards Response Information System), Oils: Diesel data sheet,
US Department of Transportation / US Coast Guard, June 1999.
15 CHRIS Manual (Chemical Hazards Response Information System), Oils, Fuel: 4 data
sheet, US Department of Transportation / US Coast Guard, June 1999.
16 Caltex Refineries (NSW) Pty. Ltd. Drawing, Plant 10-Wharf Breasting Island Upper Deck
Spill Containment Area, Dwg No. 147999, Rev 0, 14 September 2012.
17 Buncefield Major Incident Investigation Board, The Buncefield Incident 11 December 2005,
The Final Report of the Major Incident Investigation Board, December 2008
18 UK Health and Safety Executive, Buncefield Explosion Mechanism Phase 1, RR718, 2009.
15 May 2013 Page 42 of 43

19 UK HSE, Failure Rate and Event Data for use within Land Use Planning Risk Assessments,
2000.
20 International Association of Oil & Gas Producers, OGP Risk Assessment Data Directory;
Storage Incident Frequencies, Report No. 434-3, March 2010.
21 E & P Forum, Hydrocarbon Leak and Ignition Data Base, Report No. 11.4/180, May 1999.
22 International Standards Organisation, ISO 14001:2004, Environmental management

systems Requirements with guidance for use.
15 May 2013 Page 43 of 43

APPENDIX A ASSUMPTION REGISTER

This appendix documents the technical assumptions made during the QRA.
15 May 2013 Page A.1 of 19

List of Assumptions
Assumption No. 1: Study Boundaries ..................................................................................................... 3
Assumption No. 2: Isolatable Sections ................................................................................................... 4
Assumption No. 3: Release Rates .......................................................................................................... 5
Assumption No. 4: Representative Materials.......................................................................................... 6
Assumption No. 5: Pipe Lengths............................................................................................................. 7
Assumption No. 6: Frequency Data ........................................................................................................ 8
Assumption No. 7: General Utilisation .................................................................................................... 9
Assumption No. 8: Wharf Utilisation ..................................................................................................... 10
Assumption No. 9: Product Transfer Utilisation .................................................................................... 11
Assumption No. 10: Ignition Probability ................................................................................................ 12
Assumption No. 11: Pool Fire Modelling............................................................................................... 13
Assumption No. 12: Weather Data ....................................................................................................... 15
Assumption No. 13: Heat Radiation Vulnerability ................................................................................. 16
Assumption No. 14: Overpressure Impact ............................................................................................ 17
Assumption No. 15: Vulnerability Summary.......................................................................................... 18
Assumption No. 16 Off-site Population Data ........................................................................................ 19
15 May 2013 Page A.2 of 19

Assumption No. 1: Study Boundaries

Category: Hazard Identification
The QRA considered equipment containing/handling flammable or combustible liquids at the facility
when operating as a Terminal. The major areas considered were:
Atmospheric storage tanks within tank farms
Wharf operations, including ship loading / unloading
Internal pipelines involved in terminal operations
Pumps involved in transfer of product.
The hazards identified for the operation were the result of fabric failures, i.e. the failure of equipment
due to corrosion, material / construction defects and design error.
15 May 2013 Page A.3 of 19

Assumption No. 2: Isolatable Sections

Category: Hazard Identification
An isolatable section is a system of pipes and / or equipment within the Terminal that contain
hazardous materials. The isolatable section is bound by specific isolation points, such as valves
that can be operated remotely from the control room.
Where possible, emergency shutdown valves (ESDVs) were nominated as the isolation points,
rather than control valves.
15 May 2013 Page A.4 of 19

Assumption No. 3: Release Rates

Category: Consequence Analysis
When modelling the effects associated with the identified hazardous scenarios, constant release
rates were assumed. Release rates were calculated based on the material, hole size and operating
temperature and pressure. Where appropriate, the calculated release rates were limited to the
specified process flow rate through the corresponding pipeline.
15 May 2013 Page A.5 of 19

Assumption No. 4: Representative Materials

Category: Consequence Analysis
The material within an "isolatable section" was represented by a single representative hydrocarbon
component for modelling purposes. In each case, the physical properties of the representative
material were verified against the corresponding MSDSs provided by Caltex. The table below lists
the representative materials used in the QRA.
Material / Product Representative Material

Gasoline n-octane
Fuel Oil n-eicosane
ULP / PULP / SPULP n-octane
Jet Fuel n-dodecane
Diesel n-hexadecane
Slop* n-octane
Slop was assumed to be a mixture of diesel and gasoline. For the purposes of this analysis where
slop was modelled, it was assumed to have the same properties as gasoline.
15 May 2013 Page A.6 of 19

Assumption No. 5: Pipe Lengths

Category: Equipment Design and Layout
The analysis considered all internal pipelines involved in operations at the Terminal. This included
pipelines connecting the wharf and storage tanks. The routes taken by the pipelines were shown on
diagrams provided by Caltex. The lengths of the pipelines were estimated from the scaled facility
plot plan.
Impact:
The piping dimensions have an impact on the frequency analysis conducted in the QRA. Pipe
failure frequency is related to both the pipe size and pipe length. The failure frequency generally
decreases as the pipe size increases and it increases with pipe length. The dimensions of the
process piping also affect the inventory held within the pipe and therefore the amount of material
that may be involved in a release.
Reference:
Site Plans detailing the equipment layout was provided by Caltex.
15 May 2013 Page A.7 of 19

Assumption No. 6: Frequency Data

Category: Frequency Analysis
The failure frequency data used in the QRA was generated by reviewing leak data associated with
transfer process. This data was considered appropriate as the study mainly examines releases
involving the various hydrocarbons stored at the Terminal.
The failure frequency data used in the analysis is summarised in Appendix B.
15 May 2013 Page A.8 of 19

Assumption No. 7: General Utilisation

The Terminal was assumed to be in continuous operation, i.e. storage tanks always contained
product. However, due to the nature of the operation, equipment items such as the ship loading
arms (and connecting pipelines) would not be used continuously. The utilisation for this equipment
was adjusted based on information provided by Caltex.
15 May 2013 Page A.9 of 19

Assumption No. 8: Wharf Utilisation

The failure frequency associated with the loading / unloading of material at the wharf was based on
the number of shipments per year for terminal operation. Caltex provided data detailing the
expected number of shipments for each product, as well as the number of movements involving the
export of slop.
For each material, the utilisation was determined using the following equation:
( )
% = %
The total time to unload all shipment per year (for each material) was determined by the following:
. ( )
=
( / )
For all materials, shipment activities involved the use of two loading arms at the fixed berth on the
wharf. Diesel will also be received at the submarine berth.
For each product, the calculated utilisation was used to determine the failure frequency of the
pipelines connecting the loading arms to the corresponding storage tanks. Additional scenarios
were added representing the portion of the time that these pipelines were not in use (referred to as
static). For the static scenarios, the pipeline pressure was assumed to be based on the liquid
head, i.e. the pipe elevation.
15 May 2013 Page A.10 of 19

Assumption No. 9: Product Transfer Utilisation

The utilisation of the pipelines used to transfer product from the storage tanks to the Banksmeadow
fuel distribution terminal was determined.
In terminal operations, a number of other pumps may be used for a range of operations within the
facility. Caltexs expectation is that these pumps will be rarely used. These additional pumps have
been included in the QRA with an utilisation of 1%.
15 May 2013 Page A.11 of 19

Assumption No. 10: Ignition Probability

Category: Event Tree Analysis
The following probability values were used to quantify ignition of different materials. These
probabilities were used in the event tree analysis to determine the frequency of the resulting
consequence events. The ignition probability used for flammable liquids is summarised in the table
below.
Leak Category Release Rate Probability of Ignition

Minor < 1 kg/s 0.01
Major 1-50 kg/s 0.03
Massive > 50 kg/s 0.08
For combustible liquids, the ignition probabilities listed above were multiplied by 0.1 to reflect the
lower chance of ignition due to the higher flash points of such materials.
Reference
A.W. Cox, F.P. Lees and M.L. Ang, Classification of Hazardous Locations, IChemE, 1993.
15 May 2013 Page A.12 of 19

Assumption No. 11: Pool Fire Modelling

Category: Consequence Modelling
For scenarios involving the release and ignition of a flammable or combustible liquid spill from tank
farm operations, wharf operations or associated pipelines, the only outcome considered in the QRA
was a pool fire. Due to ambient operating temperatures, a negligible amount of vapour flash, if any,
would not occur. Therefore consequence types involving vapour dispersion (i.e. flash fires) were
not considered.
Depending on the location of the event on the site, limits were placed on the maximum pool size as
follows:
In the tank farm, the maximum pool fire diameter was limited by the bund area.
In pipeways, the maximum pool fire diameter was limited to the width of the pipe trench.
At the wharf, the maximum pool diameter was limited by the spill containment capability of
the berth at the wharf (equivalent diameter of approximately 15 m).
For pumps, the maximum pool fire diameter was limited by the area defined by surrounding
kerbing.
When modelling pool fires, the pool fire diameters were adjusted to account for the influence of the
wind, which extends the fire downwind by a distance commonly referred to as the flame drag. For
pool fire events, the average wind speed for the site was used to calculate the flame drag.
Pool fires involving materials identified at the Terminal would produce smoky flames. These fires
were are modelled within PHAST by setting the flame type to "smoky", which makes use of the
following equation:
= + Equation 1
Units:
2
Surface emissive power of flame ( ) W/m
2
Maximum luminous emissive power ( ) W/m
2
Smoke emissive power ( ) W/m
Characteristic length for decay of ( ) m
Flame diameter (D) m
In calculating the radiant heat, the model considers the fraction of radiation emitted from a flame
that is not absorbed by the atmosphere before reaching the observer. This parameter is referred to
as the atmospheric transmissivity ( ), which defined as follows:
= . . [ ( )] .
[ ( )] . [ ( )] + .
[ ( )] Equation 2
The adsorption coefficients for water vapour ( ( )) and carbon dioxide ( ( )) are defined as
follows:
.
( )= Equation 3

( )= Equation 4
Units:
Water vapour pressure ( ) Pa
Distance from flame surface to observer ( ) m
Atmospheric temperature ( ) K
15 May 2013 Page A.13 of 19

Reference:
Mudan K.S. & Croce P.A., "Fire Hazard Calculations for Large Open Hydrocarbon Fires",
The SFPE Handbook of Fire Protection Engineering, 1st Edition, 1988.
Harper, M., "POLF (Pool Fire) Theory Document", DNV, London, October 2005.
Harper, M., "EXPS Theory Document", DNV, London, October 2005.
15 May 2013 Page A.14 of 19

Assumption No. 12: Weather Data

Category: Consequence Modelling / Risk Analysis
The meteorological data used in the analysis was derived from 10-minute weather observations
taken by Caltex at the Kurnell Refinery.
Six atmospheric stability classes / wind speed combinations were considered used in the analysis,
coupled with 16 wind directions. The probability of each atmospheric stability class / wind speed
combination occurring during the daytime was also determined for use in societal risk calculations.
The probability distribution is provided below.
Average
Stability Category A/B C DL DU E F
Conditions
Wind Speed (m/s) 3.0 3.6 3.5 6.2 3.5 1.9 3.5
Temperature (C) 23.7 20.9 18.9 18.4 17.3 15.6 18.5
Relative Humidity
56% 61% 74% 69% 73% 79% 71%
(%)
Probability 8% 17% 18% 17% 12% 27% 100%
Direction Probability of Wind Direction
N 0.063 0.042 0.027 0.001 0.021 0.092 0.045
NNE 0.040 0.036 0.052 0.006 0.127 0.136 0.072
NE 0.105 0.139 0.087 0.080 0.108 0.069 0.094
ENE 0.142 0.090 0.054 0.003 0.021 0.034 0.050
E 0.107 0.052 0.057 0.010 0.026 0.034 0.043
ESE 0.073 0.055 0.086 0.044 0.044 0.017 0.048
SE 0.038 0.026 0.054 0.070 0.029 0.013 0.037
SSE 0.039 0.041 0.130 0.111 0.083 0.014 0.067
S 0.042 0.044 0.066 0.143 0.049 0.009 0.056
SSW 0.029 0.056 0.067 0.272 0.049 0.009 0.080
SW 0.018 0.048 0.083 0.145 0.086 0.015 0.064
WSW 0.016 0.020 0.033 0.027 0.072 0.039 0.034
W 0.012 0.054 0.036 0.043 0.105 0.080 0.058
WNW 0.030 0.068 0.041 0.019 0.073 0.118 0.066
NW 0.081 0.107 0.055 0.012 0.052 0.156 0.086
NNW 0.165 0.121 0.072 0.013 0.056 0.166 0.102
Daytime Probability 1.00 1.00 0.72 0.64 0.00 0.00 0.50
Reference:
CALMET files provided by Caltex for between 2003 to 2007 (2007 10 minute met.txt).
15 May 2013 Page A.15 of 19

Assumption No. 13: Heat Radiation Vulnerability

Category: Risk Analysis
The following probit equation was used in the analysis to quantify the probability of fatality for
individuals exposed to heat radiation from a pool fire:

= . + . Equation 5
Units:
2
Thermal Radiation Intensity (I) W/m
Time (t) seconds
Probit (Y) dimensionless
The "unprotected" probit was used to assess off-site risk, since an off-site population would
generally not be expected to be wearing protective clothing.
In using the probit equations, a maximum exposure duration of 20 seconds was assumed. This
value is an estimate of time taken for people to flee from harmful heat radiation. It considers the
time to react (approximately 5 seconds) and the time to move away from the area impacted by high
levels of heat radiation.
References:
Committee for the Prevention of Disasters, Methods for the determination of possible
damage, CPR 16E Green Book, 1992.
15 May 2013 Page A.16 of 19

Assumption No. 14: Overpressure Impact

The probability of fatality for individuals exposed to overpressure were defined for various levels of
overpressure, as described below. The probabilities were based on guidance provided within
HIPAP4.
Explosion Probability of Fatality

Effect
Overpressure (Outdoors)
7 kPa (1 psi) Probability of injury is 10%. No fatality 0%
20% chance of fatality to a person in a

21 kPa (3 psi) 0%
building
50% chance of fatality for a person in a
35 kPa (5 psi) building and 15 % chance of fatality for a 15%
person in the open
100% chance of fatality for a person in a
70 kPa (10 psi) 100%
building or in the open
References:
New South Wales Government, Department of Planning, Hazardous Industry Planning
Advisory Paper No. 4, Risk Criteria for Land Use Safety Planning, January 2011 (HIPAP4).
15 May 2013 Page A.17 of 19

Assumption No. 15: Vulnerability Summary

The table below details the impact that pool fire events may have on exposed personnel. The
model used to calculate the impact depended on the location of the exposed personnel, which
varied depending on the focus of the analysis.
Consequence
Impact Outdoor Indoor
Event
2 2
Heat <35 kW/m : probit <23 kW/m : no fatalities
Pool Fire 2 2
Radiation >35 kW/m : 100% fatalities >23 kW/m : 100% fatalities
Based on guidance
Overpressure VCE API 752*
provided within HIPAP 4
* The probability of fatality was estimated based on the overpressure experienced and the building
type. The building categories used were those defined in API 752, Management of Hazards
nd
Associated with Location of Process Plant Permanent Buildings, 2 edition, 2003.
15 May 2013 Page A.18 of 19

Assumption No. 16 Off-site Population Data

Category: Societal Risk Calculations
The societal risk calculations were based on population data provided by Caltex (refer to
Appendix D). For different locations, the population data detailed the expected number of people
present at different times of the day. These population changes were considered in the
corresponding risk calculations.
15 May 2013 Page A.19 of 19

APPENDIX B FAILURE RATE DATA
This appendix presents the failure frequency data used for each equipment item. For each equipment
item, the failure frequency data for a range of failure modes was obtained from historical industry data.
The failure modes are represented through a range of hole sizes.
The use of failure frequency from historical industry data without adjustment was considered
appropriate for this analysis. The UK HSE advises that adjustments should be made where, for
example, an assessed process design has a particularly arduous operating conditions or, alternatively,
provides increased reliability. However, no particular characteristics of the Terminal operations were
identified that justified adjusting the failure frequency data. For example, the environmental factors
experienced at the facility are standard for its type. No excessively harsh conditions are experienced
that would cause failure modes, such as corrosion, to occur at significantly higher rates.
Furthermore, the failure frequency data used in the QRA represent "typical" facilities with similar
operations. For example, the sources used to define the atmospheric tank failure rate were obtained
from a review of historical data for storage tank incidents. The reported data represents an average
performance derived from facilities of various ages covering many management systems. Caltex will
continue to use its established integrity management processes. These are based heavily upon
industry standards. These processes are expected to ensure that the integrity management
performance within the facility is equal to, or better than, the performance of the "typical" facility that
the failure frequency data represents. Caltex also has established processes for corporate audits,
insurance engineering surveys and external audits to provide assurance as to the effectiveness of
these integrity management processes. Therefore, it is considered appropriate to assess the Terminal
using historical data for a "typical" facility.
15 May 2013 Page B.1 of 6

B.1 LOADING ARMS FOR LIQUID CARGO

The failure frequency for the transfer of liquid cargo at the wharf was based on loading/unloading arm
failure rate from the UK HSE data [1]. Data is provided for the two failure sizes listed.
Table B-1: Loading / Unloading Arm Failure Rate

Failure Rate [1]
Hole Size (mm)
(per transfer operation)
Equivalent to 10% of cross- -5
2.9 10
sectional area of Arm
-6
Arm Diameter 3.2 10
B.2 ATMOSPHERIC STORAGE TANKS

The atmospheric tank failure frequency for various release sizes was based on data from the UK HSE
data [1] and the OPG Risk Assessment Directory detailing storage incident frequencies [2]. The
frequency distribution was derived using the OGP data.
Table B-2: Atmospheric Storage Tank Failure Rate

Failure Rate
Hole Size (mm)
(per tank per year)
-3
20 2.110
-4
50 4.210
-4
100 2.810
-6
Rupture 5.010
Historical data was used to determine the frequency of full surface fires associated with different types
of atmospheric storage tanks [2, 3].
Table B-3: Full-Surface Tank Fire Frequency

Fire Frequency
Tank Type Event Description
(per tank per year)
Floating Roof Full-Surface Tank Fire 1.210
-4
Internal Explosion and Full- -5

Fixed Roof 9.010
Surface Tank Fire
Fixed with Internal Floating Internal Explosion and Full- -5
9.010
Roof Surface Tank Fire
B.3 PROCESS PIPING

The overall frequency has been taken from the E&P Forum [4]. The total frequency was distributed to
the representative hole sizes selected for the analysis by considering information presented in the Cox
et al [5] and TNO [6].
Table B-4: Transfer Pipe (50mm < D 100mm) Failure Rate

Hole Size (mm) Failure Rate (per metre-pipe year)
-5
5 2.7 10
-6
20 7.2 10
-6
50 1.4 10
-7
Pipe Diameter (100 mm) 3.6 10

Table B-5: Transfer Pipe (100mm < D 150mm) Failure Rate

-5
5 2.7 10
-6
20 7.2 10
-6
50 1.4 10
-7
100 1.8 10
-7
Table B-6: Transfer Pipe (150mm < D 300mm ) Failure Rate

-5
5 2.0 10
-6
20 5.4 10
-6
50 1.1 10
-7
100 1.4 10
-7
B.4 PUMPS
The total failure frequency for pumps was taken from the OGP Risk Assessment Directory detailing
process releases [7]. This source also provided information detailing the frequency distribution for a
range of hole sizes.
Table B-7: Centrifugal Pump Failure Rate [7]

Process Pipe Diameter (D) Hole Size (mm) Failure Rate (per year)
-3
5 4.0 10
-4
20 5.6 10
D 100 mm -5
50 9.9 10
-5
Pipe diameter 5.8 10
-3
5 4.0 10
-4
20 5.6 10
-5
D > 100 mm 50 9.9 10
-5
100 2.9 10
-5
Pipe diameter 2.9 10
B.5 FLANGES
The total failure frequency for flanges was taken from the OGP Risk Assessment Directory detailing
process releases [7]. The data obtained from this source was distributed over the representative hole
sizes selected for the analysis [5].

Table B-8: Flange Failure Rate

Process Pipe Diameter (D) Hole Size (mm) Failure Rate (per year)
-5
5 3.0 10
D 50mm -5
20 1.2 10
-5
5 3.4 10
50mm < D 100 mm -6
20 6.9 10
-5
5 4.4 10
100 mm < D 150 mm -6
20 9.5 10
-5
5 7.0 10
D >150 mm -5
20 1.4 10
B.6 MANUAL VALVES

The total failure frequency for manual valves was taken from the OGP Risk Assessment Directory
detailing process releases [7]. This source was also used to distribute the frequency between the
representative hole sizes selected for the analysis. Other sources were not used, as those reviewed
do not make a distinction between valve types.
Table B-9: Manual Valve Failure Rate

Manual Valve Size (D) Hole Size (mm) Failure Rate (per year)
-5
5 2.6 10
D 20 mm -6
20 8.2 10
-5
5 2.6 10
-6
20 mm < D 50 mm 20 5.0 10
-6
50 3.2 10
-5
5 3.4 10
-6
20 6.9 10
50 mm < D 100 mm -6
50 1.5 10
-6
100 2.0 10
-5
5 4.2 10
-6
20 8.6 10
-6
100 mm < D 150 mm 50 1.8 10
-7
100 6.3 10
-6
150 1.8 10
-5
5 5.2 10
-5
20 1.1 10
-6
D >150 mm 50 2.6 10
-7
100 9.3 10
-6
300 2.0 10

B.7 ACTUATED VALVES

The total failure frequency for actuated valves was taken from the OGP Risk Assessment Directory
detailing process releases [7]. This source was also used to distribute the frequency between the
representative hole sizes selected for the analysis. Other sources were not used, as those reviewed
do not make a distinction between valve types.
Table B-10: Actuated Valve Failure Rate

Actuated Valve Size (D) Hole Size (mm) Failure Rate (per year)
-4
5 2.8 10
D 20 mm -5
20 6.1 10
-4
5 2.8 10
-5
20 mm < D 50 mm 20 4.5 10
-5
50 1.6 10
-4
5 2.6 10
-5
20 4.4 10
50 mm < D 100 mm -6
50 8.3 10
-6
100 9.4 10
-4
5 2.4 10
-5
20 4.1 10
-6
100 mm < D 150 mm 50 7.7 10
-6
100 2.5 10
-6
150 6.2 10
-4
5 2.4 10
-5
20 3.8 10
-6
D >150 mm 50 6.2 10
-6
100 1.8 10
-6
300 6.6 10
B.8 INSTRUMENTATION
The total failure frequency for instrumentation was taken from the OGP Risk Assessment Directory
detailing process releases [7].
Table B-11: Instrumentation Failure Rate

Hole Size (mm) Failure Rate (per year)
-4
5 2.3 10
-5
20 5.9 10
B.9 MIXERS FOR TANKS

The failure frequency data assumed for mixers connected to atmospheric tanks was based on the
data used for centrifugal pumps [7]. This data was used to represent the possible failure modes
involving a seal failure. A limited hole size distribution has been applied to reflect the likely failure
modes associated with leaks for mixer seals.

Table B-12: Atmospheric Storage Tank Mixer Failure Rate

Failure Rate
Hole Size (mm)
(per tank per year)
-3
5 4.0 10
-4
20 7.2 10
B.10 REFERENCES
1 UK HSE, Failure Rate and Event Data for use within Risk Assessments, 2012.
Storage Incident Frequencies, Report No. 434-3, March 2010.
3 LASTFIRE PROJECT, Large Atmospheric Storage Tank Fire Project, LASTFIRE Technical
Working Group, June 1997.
4 E & P Forum, Hydrocarbon Leak and Ignition Data Base, Report No. 11.4/180, May 1992.
5 A.W. Cox, F.P. Lees and M.L. Ang, Classification of Hazardous Locations, IChemE, 1993,
Table 18.1, page 39.
6 TNO, Guidelines for Quantitative Risk Assessment, Purple Book, CPR 18E, 2005.
Process release frequencies, Report No. 434-1, March 2010.

APPENDIX C BUNCEFIELD RECOMMENDATIONS
This appendix provides information on the recommendations arising from the Buncefield investigation.
A series of recommendations were by the Major Incident Investigation Board (MIIB) in relation to the
design and operation of fuel storage sites [1]. The recommendations applicable to the facility are
listed in the following table, grouped by subject.
Design and operation of fuel storage sites
RECOMMENDATION 1 Systematic assessment of safety integrity level requirements
The Competent Authority and operators of Buncefield-type sites should develop and agree a common
methodology to determine safety integrity level (SIL) requirements for overfill prevention systems in line with the
principles set out in Part 3 of BS EN 61511. This methodology should take account of:
the existence of nearby sensitive resources or populations;
the nature and intensity of depot operations;
realistic reliability expectations for tank gauging systems; and
the extent/rigour of operator monitoring.
Application of the methodology should be clearly demonstrated in the COMAH safety report submitted to the
Competent Authority for each applicable site.
Existing safety reports will need to be reviewed to ensure this methodology is adopted.
RECOMMENDATION 2 Protecting against loss of primary containment using high integrity systems
Operators of Buncefield-type sites should, as a priority, review and amend as necessary their management
systems for maintenance of equipment and systems to ensure their continuing integrity in operation. This should
include, but not be limited to reviews of the following:
the arrangements and procedures for periodic proof testing of storage tank overfill prevention systems to
minimise the likelihood of any failure that could result in loss of containment; any revisions identified
pursuant to this review should be put into immediate effect;
the procedures for implementing changes to equipment and systems to ensure any such changes do not
impair the effectiveness of equipment and systems in preventing loss of containment or in providing
emergency response.
Operators of Buncefield-type sites should protect against loss of containment of petrol and other highly
flammable liquids by fitting a high integrity, automatic operating overfill prevention system (or a number of such
systems, as appropriate) that is physically and electrically separate and independent from the tank gauging
system.
Such systems should meet the requirements of Part 1 of BS EN 61511 for the required safety integrity level, as
determined by the agreed methodology. Where independent automatic overfill prevention systems are already
provided, their efficacy and reliability should be reappraised in line with the principles of Part 1 of BS EN 61511
and for the required safety integrity level, as determined by the agreed methodology (see Recommendation 1).
15 May 2013 Page C.1 of 6

The overfill prevention system (comprising means of level detection, logic/control equipment and independent
means of flow control) should be engineered, operated and maintained to achieve and maintain an appropriate
level of safety integrity in accordance with the requirements of the recognised industry standard for safety
instrumented systems, Part 1 of BS EN 61511.
All elements of an overfill prevention system should be proof-tested in accordance with the validated
arrangements and procedures sufficiently frequently to ensure the specified safety integrity level is maintained in
practice in accordance with the requirements of Part 1 of BS EN 61511.
The sector should put in place arrangement to ensure the receiving site (as opposed to the transmitting location)
has ultimate control over the tank filling.
The sector should undertake a review of the adequacy of existing safety arrangements, including
communications, employed by those responsible for pipeline transfers of fuel.
The sector, including its supply chain of equipment manufacturers and suppliers, should review and report
without delay on the scope to develop improved components and systems, including but not limited to the
following:
alternative means of ultimate high level detection systems that do not rely on components internal to the
tank with the emphasis on ease of inspection, testing and maintenance;
increased dependability of tank gauging systems should be explored through improved validation of
measurements & trends, allowing warning of faults and using modern sensors with increased diagnostic
capability; and
systems to control and log override actions.
Operators of terminals should implement systems to ensure systematic maintenance of records pertaining to
product movement and operation of the overfill prevention systems and any associated systems
The sector and regulators should agree on a system of lead and lag performance indicators for process safety
performance.
RECOMMENDATION 11 Engineering against escalation of loss of primary containment
Operators of Buncefield-type sites should review the classification of places within COMAH sites where explosive
atmospheres may occur and their selection of equipment and protective systems (as required by the Dangerous
Substances and Explosive Atmospheres Regulations 2002). This review should take into account the likelihood
of undetected loss of containment and the possible extent of an explosive atmosphere following such an
undetected loss of containment. Operators in the wider fuel and chemicals industries should also consider such
a review, to take account of events at Buncefield.

Following on from Recommendation 11, operators of Buncefield-type sites should evaluate the siting and/or
suitable protection of emergency response facilities such as fire fighting pumps, lagoons or manual emergency
switches.
Operators of Buncefield-type sites should employ measures to detect hazardous conditions arising from loss of
primary containment, including the presence of high levels of flammable vapours in secondary containment.
Operators should without delay undertake an evaluation to identify suitable and appropriate measures. This
evaluation should include, but not be limited to, consideration of the following:
installing flammable gas detection in bunds containing vessels or tanks into which large quantities of highly
flammable liquids or vapour may be released;
the relationship between the gas detection system and the overfill prevention system. Detecting high levels
of vapour in secondary containment is an early indication of loss of containment and so should initiate action,
for example through the overfill prevention system, to limit the extent of any further loss;
installing CCTV equipment to assist operators with early detection of abnormal conditions. Operators cannot
routinely monitor large numbers of passive screens, but equipment is available that detects and responds to
changes in conditions and alerts operators to these changes.
Operators of new Buncefield-type sites or those making major modifications to existing sites (such as installing a
new storage tank) should introduce further measures including, but not limited to, preventing the formation of
flammable vapour in the event of tank overflow. Consideration should be given to modifications of tank top
design and to the safe re-routing of overflowing liquids.
The sector should begin to develop guidance without delay to incorporate the latest knowledge on preventing
loss of primary containment and on inhibiting escalation if loss occurs. This is likely to require the sector to
collaborate with the professional institutions and trade associations.
Operators of existing sites, if their risk assessments show it is not practicable to introduce measures to the same
extent as for new ones, should introduce measures as close to those recommended by Recommendation 14 as
is reasonably practicable. The outcomes of the assessment should be incorporated into the safety report
submitted to the Competent Authority.
RECOMMENDATION 17 Engineering against loss of secondary and tertiary containment
The Competent Authority and the sector should jointly review existing standards for secondary and tertiary
containment with a view to the Competent Authority producing revised guidance by the end of 2007.
The review should include, but not be limited to the following:

developing a minimum level of performance specification of secondary containment (typically this will be
bunding);
developing suitable means for assessing risk so as to prioritise the programme of engineering work in
response to the new specification;
formally specifying standards to be achieved so that they may be insisted upon in the event of lack of
progress with improvements;
improving firewater management and the installed capability to transfer contaminated liquids to a place
where they present no environmental risk in the event of loss of secondary containment and fires;

providing greater assurance of tertiary containment measures to prevent escape of liquids from site and
threatening a major accident to the environment.
RECOMMENDATION 18 Engineering against loss of secondary and tertiary containment
Revised standards should be applied in full to new build sites and to new partial installations. On
existing sites, it may not be practicable to fully upgrade bunding and site drainage. Where this is so
operators should develop and agree with the Competent Authority risk-based plans for phased
upgrading as close to new plant standards as is reasonably practicable.
RECOMMENDATION 19 Operating with high reliability organisations
The sector should work with the Competent Authority to prepare guidance and/or standards on how to achieve a
high reliability industry through placing emphasis on the assurance of human and organisational factors in
design, operation, maintenance, and testing. Of particular importance are:
understanding and defining the role and responsibilities of the control room operators (including in
automated systems) in ensuring safe transfer processes;
providing suitable information and system interfaces for front line staff to enable them to reliably detect,
diagnose and respond to potential incidents;
training, experience and competence assurance of staff for safety critical and environmental protection
activities;
defining appropriate workload, staffing levels and working conditions for front line personnel;
ensuring robust communications management within and between sites and contractors and with operators
of distribution systems and transmitting sites (such as refineries);
prequalification auditing and operational monitoring of contractors capabilities to supply, support and
maintain high integrity equipment;
providing effective standardised procedures for key activities in maintenance, testing, and operations;
clarifying arrangements for monitoring and supervision of control room staff; and
effectively managing changes that impact on people, processes and equipment.
Terminal operators should ensure the resulting guidance is fully implemented.
The sector should put in place arrangements to ensure that good practice in these areas, incorporating
experience from other higher hazard sectors, is shared openly between organisations.
The regulator should ensure that MHF Safety Cases contain demonstration that good practice in human and
organisational design, operation, maintenance and testing is implemented as rigorously as for engineering
systems.
RECOMMENDATION 23 Delivering high performance through culture and leadership
The sector should set up arrangements to collate incident data on high potential incidents including overfilling,
equipment failure, spills and alarm system defects, evaluate trends, and communicate information on risks, their
related solutions and control measures to the industry.
The arrangements set up to meet Recommendation 23 should include, but not be limited to, the following:
thorough investigation of root causes of failures and malfunctions of safety and environmental protection
critical elements during testing or maintenance, or in service;
developing incident databases that can be shared across the entire sector, subject to data protection and

other legal requirements. Examples exist of effective voluntary systems that could provide suitable models;
collaboration between the workforce and its representatives, dutyholders and regulators to ensure lessons
are learned from incidents, and best practices are shared.
In particular, the sector should draw together current knowledge of major hazard events, failure histories of safety
and environmental protection critical elements, and developments in new knowledge and innovation to
continuously improve the control of risks. This should take advantage of the experience of other high hazard
sectors such as chemical processing, offshore oil and gas operations, nuclear processing and railways.
Emergency Arrangements
RECOMMENDATION 1 Assessing the potential for a major incident
Operators of Buncefield-type sites should review their emergency arrangements to ensure they provide for
all reasonably foreseeable emergency scenarios arising out of credible major hazard incidents, including
vapour cloud explosions and severe multi-tank fires that, before Buncefield, were not considered realistically
credible. The Competent Authority should ensure that this is done.
RECOMMENDATION 2 Managing a major incident on site
The Competent Authority should review the existing COMAH guidance on preparing on-site emergency
plans. This guidance needs to reflect the HSEs Hazardous Installations Directorate (HID) Chemical
Industries Division inspection manual used by inspectors to assess the quality of the on-site plan in meeting
the COMAH Regulations. In particular, reference should be made to the need to consult with health advisors
and emergency responders.
For Buncefield-type sites, operators should review their onsite emergency plans to reflect the revised
guidance on preparing on-site emergency plans as per Recommendation 2. The Competent Authority will
need to check that this is done.
Operators should review and where necessary revise their on-site emergency arrangements to ensure that
relevant staff are trained and competent to execute the plan and should ensure that there are enough trained
staff available at all times to perform all the actions required by the on-site emergency plan.
For Buncefield-type sites, operators should evaluate the siting and/or suitable protection of emergency
response facilities such as the emergency control centre, firefighting pumps, lagoons or manual switches,
updating the safety report as appropriate and taking the necessary remedial actions.
Operators should identify vulnerable critical emergency response resources and put in place contingency
arrangements either on or off site in the event of failure at any time of the year and make appropriate
amendments to the on-site emergency plan. This should include identifying and establishing an alternative
emergency control centre with a duplicate set of plans and technical information.
RECOMMENDATION 7 Emergency preparedness, response & recovery
For COMAH sites, if the operator relies on an off-site Fire and Rescue Service to respond, the operators
plan should clearly demonstrate that there are adequate arrangements in place between the operator and
the service provider. The Competent Authority will need to check that this is done.

RECOMMENDATION 8 Warning and informing the public
COMAH site operators should review their arrangements to communicate with residents, local businesses
and the wider community, in particular to ensure the frequency of communications meets local needs and to
cover arrangements to provide for dealing with local community complaints. They should agree the
frequency and form of communications with local authorities and responders, making provision where
appropriate for joint communications with those bodies.
RECOMMENDATION 9 Warning and informing the public
The Competent Authority should review the COMAH guidance to assist operators in complying with
Recommendation 8 and should work with the Cabinet Office to integrate the COMAH guidance and the CCA
Communicating with the public guidance, so that communications regarding COMAH sites are developed
jointly by the site operator and the local emergency responders.
RECOMMENDATION 12 Preparing for and responding to a major incident off site
Communities and Local Government should complete and, where necessary, initiate an assessment of the
need for national-level arrangements to provide, fund and maintain, emergency response equipment (such
as high volume pumps, firefighting foam and specialist pollution containment equipment). The review could
also consider criteria for allocation and use of this equipment across the UK.
RECOMMENDATION 23 Responding to a major incident
The operators of industrial sites where there are risks of large explosions and/or large complicated fires
should put in place, in consultation with fire and rescue services at national level, a national industryfire
service mutual aid arrangement. The aim should be to enable industry equipment, together with operators of
it as appropriate, to be available for fighting major industrial fires. Industry should call on the relevant trade
associations and working group 6 of the Buncefield Standards Task Group to assist it, with support from
CCS. The COMAH Competent Authority should see that this is done.
C.1 REFERENCES
1 Buncefield Major Incident Investigation Board, The Buncefield Incident 11 December 2005,
The Final Report of the Major Incident Investigation Board, December 2008.

APPENDIX D OFF-SITE POPULATION DATA
D.1 INTRODUCTION
This appendix outlines the population data used in calculating the off-site societal risk F-N curve. The
population data used in the model is presented in Table D-1. This data was developed from
information provided by Caltex [1]. The terms referred to in the table are defined as follows:
Off-site location The off-site location of personnel in proximity to the Terminal.
Daytime Population The off-site population during the daytime (i.e. between the hours of 6 am to
6 pm).
Night Time The off-site population during the night time (i.e. between the hours of 6 pm
Population to 6 am).
Raw Data The off-site population data provided by Caltex to R4Risk.
Modelled Population The population data used in the analysis.
Each of the listed off-site locations is identified in Figure 1. This shows the layout of the
neighbourhood surrounding the facility [1].
The residential areas around the Terminal were subdivided as shown in Figure 2. The population
density used for the residential areas was based on the Department of Planning data. This data
indicated that the residential population density was approximately 2 people per house for an average
2
block size of 750 m . The residential population was assumed to be fully present during night time
and non-work hours, with a 75% reduction in the overall population during work hours. It was
assumed that the residential population would be located indoors 70% of the time during the daytime
and 95% of the night-time.
The residential density was applied to the off-site locations referred to as "Residential West" and
"Residential North". The total population of these areas was calculated by multiplying the density by
the area covered. For the eastern residential areas, a more detailed approach was used to estimate
the population due to the close proximity of this area to the Terminal boundary. In these areas, an
occupancy of 2 persons per block was assumed.
The Energy Australia site was also excluded from the off-site societal risk calculations because it is
typically an unpopulated site.
15 May 2013 Page D.1 of 5

D.2 POPULATION DATA
Table D-1: Population Data for Off-site Areas

Daytime Population Night Time Population
Off-site
Location Modelled Modelled
Raw Data Raw Data
Population Population
Night shift and
Day shift (weekdays): 5 outdoor Dayshift 1 outdoor
HCE Agility
8 to 10 persons 5 indoor (weekends) 2 1 indoor
persons
Light Industrial 79 people with
Area, adjacent 105 car spaces for the site 95% indoor (i.e. No night time
0
to Terminal 79 cars counted. 4 outdoor, population data
Boundary 75 indoor)
POPE licensed
for 258 people
POPE licensed for 258 Kurnell Rec. Club

people - typical
population for the
Kurnell Rec. Club - typical Kurnell Rec. Club
population is: is:
Kurnell 10 outdoor 15 outdoor
Number of people during Number of people
Recreation Club 20 indoor 45 indoor
the day = 30 during the day =
Average number of people 30
at night = 50 - 60 Average number
Number of people on of people at night
Friday night: ~100 = 50-60
Number of people
on Friday night
~100
6 outdoor No night time
Pre-School 32 people with 80% indoor 0
26 indoor population
400,000 persons per Approximately
calendar year to the park, 110 people per
Botany Bay with peak season being day No night time
0
National Park June to July for Whale 110 outdoor population
season, and Christmas and 0 indoor
new year periods.
Caltex Service 1 outdoor 1 outdoor
3 3
Station 2 indoor 2 indoor
Pizzas with 0 outdoor No night time
3 0
Muscle 3 indoor population
Kurnell 0 outdoor No night time
3 0
Pharmacy 3 indoor population
Kurnell Cellars 3 0
3 indoor population
Kurnell Fresh 0 outdoor No night time
3 0
Food Supplies 3 indoor population
Kurnell Medical 0 outdoor No night time
3 0
Centre 3 indoor population
Kurnell Grocery 3 0
3 indoor population

Daytime Population Night Time Population

Off-site
Location Modelled Modelled
Raw Data Raw Data
Population Population
Captains Pies 0 outdoor No night time
3 0
and Cakes 3 indoor population
Kurnell Art
Gallery - 6 0 outdoor No night time
3 0
Prince Charles 3 indoor population
Parade
Real Estate - 7
Captain Cook 3 0
3 indoor population
Drive, Kurnell
Endeavour
Coffee & Ice
Cream - 2 3 0
3 indoor population
Prince Charles
Parade
Department of Planning
Data:
2
Block of land size = 750 m
~2 people per house 35 outdoor 23 outdoor
Residential East 463
25% of population for day 81 indoor 440 indoor
time
Residential East estimated
2
area = 173,500 m
Data:
2
Residential ~2 people per house 27 outdoor 18 outdoor
356
Central 25% of population for day 62 indoor 338 indoor
time
2
area = 133,486 m
Data:
2
Residential ~2 people per house 133 outdoor 38 outdoor
761
West 25% of population for day 57 indoor 723 indoor
time
2
area = 285,156 m

Figure 1: Locations of Off-Site Populations

Figure 2: Locations of Residential Areas
D.3 REFERENCES
1 Email from Marian Magbiray (Caltex) to Patrick Walker (R4Risk), Population Data - Offsite
Analysis, Attachment Offsite Population.xls, 9 January 2012.

APPENDIX E LISTS OF HAZARDOUS SCENARIOS
Confidential and Sensitive Document

Exempt from disclosure under the Government Information (Public Access) Act 2009 (NSW)
The complete Preliminary Hazard Analysis Report is provided to the NSW Department of Planning &
Infrastructure (DP&I) by Caltex Refineries (NSW) Pty Ltd (Caltex) in confidence for use only within
DP&I. It is submitted on the basis that there is an overriding public interest against disclosure
pursuant to section 14(2) of the Government Information (Public Access) Act 2009 (NSW) (the Act).
The Report is exempt from disclosure under the Act on the grounds that it contains information
associated with the storage of security sensitive petroleum finished product and information that is
commercial-in-confidence.
The information which is exempt from disclosure applies specifically to the following parts of the
Report:
This report must not be copied or distributed outside DP&I without the express permission of Caltex.
15 May 2013 Page E.1 of 12

APPENDIX F QUALIFICATIONS AND EXPERIENCE OF THE

HAZARD ANALYSIS TEAM
15 May 2013 Page F.1 of 3

F.1 R4RISK PROJECT TEAM

An overview of the qualifications and experience of R4Risks project team is provided within Table 1.
Table 1: Project Team Summary

Name Project Role Qualification and Relevant Experience
Bachelor of Engineering (Chem) Hons., University of
Melbourne
Registered Professional Engineer (NPER-3); in the
categories of Chemical (general) and Fire Safety
Engineering
Project Manager Over 20 years experience in the risk management field.
Lachlan Dreher
Technical Review Technical expert in QRA with extensive experience
leading and conducting large QRA studies
Was at the forefront in the development of in-house tools
for the conduct of QRA (VRJ Risk Engineers /
ModuSpec), including defining many of the algorithms
used in these programs.
Bachelor of Engineering (Chem,) Hons., University of
NSW
Over eight years experience in a range of risk
Dr. Patrick Walker Technical Analyst assessment techniques across a number of industries.
Extensive experience in conducting consequence
modeling and QRAs for the petrochemical, chemical and
oil & gas industries.
Bachelor of Engineering (Chemical and Biomolecular)
Hons., University of Melbourne.
Flora Chung Technical Analyst
Analyst with experience in consequence modelling, fire
safety studies and quantitative risk assessments.

F.2 PROJECT TEAM EXPERIENCE

R4Risks project team has extensive experience in conducting a range of hazard and risk studies,
including QRAs. These studies involved reviewing the corresponding processes to identify,
understand and assess the risk associated with the significant hazards. A selection of these studies
that involved the team members are listed in Table 2.
Table 2: R4Risk Project Team Experience

Client Project
Legend International QRA for proposed Mount Isa Fertilizer Project (600 ktpa & 1200 ktpa)
Peer review of QRA to identify modelling flaws resulting in overstated risk
Confidential
results.
Caltex Australia QRA for Kurnell Refinery
Coogee Chemicals QRA for Mt Isa Plant Expansion
Incitec Pivot Peer review of QRA for proposed facility
QRA for proposed ammonium nitrate plant, including comparison of risks for
BHP
alternate processing technologies and alternate site locations
BHP QRA for proposed ammonia / urea fertilizer plant.
BP Kwinana Refinery: QRA of facility
Caltex Kurnell Refinery: QRA for new crude oil storage tank
Caltex Kurnell Refinery: QRA to identify risk implications for occupied buildings at site.
Marstel Terminals Coode Island bulk liquid storage terminal: QRA, including propylene oxide and
acrylonitrile storage
Mobil Mobil Altona Refinery: QRA of complete refinery
Mobil Yarraville bulk liquid storage terminal: QRA of facility
Mobil Yarraville bulk liquid storage terminal: Update QRA for changed tankage
allocation
Mobil Spotswood bulk liquid storage terminal: QRA of facility
Mobil Colmslie Terminal: QRA of proposed LPG terminal
Nufarm-Coogee Kwinana Chlor-Alkali Plant: QRA of proposed plant upgrade
Nufarm-Coogee Kemerton Chlor-Alkali Plant: QRA of proposed plant upgrade
Nufarm-Coogee Kwinana Chlor-Alkali Plant: QRA of proposed plant upgrade (modified design)
Nufarm-Coogee Kemerton Chlor-Alkali Plant: QRA of proposed plant upgrade (modified design)
Nufarm-Coogee Kwinana Chlor-Alkali Plant: QRA for plant expansion (low-pressure design)
Nufarm Belvedere Agricultural Chemicals Plant (UK): QRA for chemicals
manufacturing plant, including chlorine storage and handling
Pasminco Hobart smelter: QRAs for acid plants
Port of Brisbane Northshore Hamilton: QRA for development master plan
Process Design & Barnawartha Biodiesel Plant: QRA of proposed facility
Fabrication
Queensland Nitrates Moura ammonium nitrate plant: Preliminary QRA (including ammonia
Plant manufacture and storage)
Queensland Nitrates Moura ammonium nitrate plant: QRA for final design (including ammonia
Plant manufacture and storage)
Queensland Nitrates Moura ammonium nitrate plant: QRA Update for Major Hazard Facility
Plant compliance (including ammonia manufacture and storage)
Queensland Nitrates Moura ammonium nitrate plant: QRA for proposed plant expansion (including
Plant ammonia manufacture and storage)
Queensland Nitrates Moura ammonium nitrate plant: Risk review of ammonia storage options for
Plant proposed plant expansion (refrigerated storage vs pressurised storage)
Queensland Nitrates Quantitative & Qualitative Risk Analysis on the transportation of ammonia and
Plant ammonium nitrate
Tiwest Kwinana Pigment Plant: QRA of facility

A p p e nd ix C2
Kurnell Buncefield Review

Appendix C2 Kurnell Buncefield Review
Topic Caltex Review
Underlying Principles of Buncefield Investigation Recommendations
Measures for controlling major incident risks must integrate: The Caltex Kurnell site is currently a major hazard facility site and will remain so when converted to a fuels import and storage terminal. As such the facility is required to maintain a safety
case which demonstrates that the control measures are fully integrated and adequate with respect to the management of major hazards risks and which specifically must address the
Integrity levels at major hazards sites in relation to containment of
possibility of events such as the Buncefield VCE. A review of the Buncefield incident and its recommendations was undertaken by Caltex during the preparation of the current safety case,
dangerous goods and process safety
which resulted in a number of additional control measures being adopted, particularly on gasoline tanks in the north east corner of the site. The current conversion project will extend these
Mitigation against the effect of a major incident on off-site
improvements to all other flammables storage and in significant part, to bulk combustible storage as well. These control improvements will be reflected in revisions of the safety case.
populations and buildings
Preparedness for emergency response to limit the escalation of Specific details of approaches taken by Caltex relating to each of the first three control areas listed on the left are provided in the table below.
potential major incidents In addition, Caltex actively engages in land use planning management around its refineries and terminals ensuring that decisions made by local authorities relating to land use in potentially
Land use planning and the control of societal risk; and affected zones are properly informed by Caltex. Caltex also continues to work closely and proactively with planning authorities and state Workcover and Environment Protection authorities to
The regulatory system for inspection and enforcement at major ensure planning decisions take into account major hazards risks. For example, in Victoria Caltex is one of the first five companies to have worked collaboratively with Worksafe Victoria to
hazard industrial areas. produce published land-use planning guidelines for its terminals in that state.
Finally, Caltex has consulted with NSW Workcover in relation to the ongoing maintenance and continuous improvement of the Kurnell Site Safety Case. Whilst the submitted safety case has
not yet been formally assessed by NSW Workcover, Caltex is committed to ensuring that it continues to comply with all requirements throughout the transition of the site to a terminal only
operation, that the controls adopted continue to eliminate risk where reasonably practicable, or where not reasonably practicable to eliminate the risk, reduce risk so far as is reasonably
practicable. In the adoption and/or modification of controls, consideration has been and will continue to be made of the Buncefield Investigation recommendations and of all other major
investigation recommendations pertinent to the facility.
Caltex has committed to meeting at least quarterly with NSW Workcover to ensure these obligations continue to be met. Workcover NSW has made specific reference to the consideration of
Buncefield recommendations in its oversight and consultation agenda.
BSTG Recommendation Official MIIB Recommendation

Topic Caltex Review
Published 24 July 2007 As published in final Report 2008
Systematic Assessment of Safety Integrity levels
Safety Integrity Before protective systems are installed there is a need to determine the R1 Design & Operation 1. Caltex believes that these recommendations are adequately addressed
Control of safety systems for appropriate level of integrity that such systems are expected to achieve. The Competent Authority and operators of Buncefield-type sites should by the NSW Work Health and Safety Regulation 2011 Chapter 9 and as
petroleum storage tanks; This report uses a layer of protection study (LOPA) to provide a more develop and agree a common methodology to determine safety integrity such the requirement to demonstrate that tank overfill scenarios for all
and; consistent approach to safety integrity level (SIL) assessment. level (SIL) requirements for overfill prevention systems in line with the hazardous materials handled are properly identified, and that the
For each risk assessment/SIL determination study, operators must be able principles set out in Part 3 of BS EN 61511 (ref 3). This methodology should associated control measures to prevent and mitigate consequences are
to justify each and every claim and data used in the risk assessment and take account of: appropriate and demonstrated as adequate in terms of availability,
Incorporating the findings of SIL ensure that appropriate management systems and procedures are reliability, functionality and survivability are already mandatory
the existence of nearby sensitive resources or populations;
assessments into safety case implemented to support those claims. For COMAH top-tier sites this will requirements.
the nature and intensity of depot operations;
reports form part of the demonstration required with the safety report. Of particular 2. The current safety case for Kurnell Refinery addresses these
importance is the reliability and diversity of the independent layers of realistic reliability expectations for tank gauging systems; and requirements. Nevertheless, the adequacy demonstration for tank
protection. To avoid common mode failures, extreme care should be taken the extent/rigour of operator monitoring. primary containment controls is again being progressively reviewed to
when claiming high reliability and diversity, particularly for multiple human Application of the methodology should be clearly demonstrated in the ensure that any changes impacting tank filling operations are fully
interventions. COMAH safety report submitted to the Competent Authority for each reviewed and that the facility risk assessment is adjusted to reflect
Minimum expected good practice applicable site. agreed control measure improvements to be adopted under the
Existing safety reports will need to be reviewed to ensure this methodology proposed facility transition. The safety assessment methodology used
The overall systems for tank filling control must be of high integrity, with
is adopted. in the safety case incorporates both QRA and LOPA, and specific SIL
sufficient independence to ensure timely and safe shutdown to prevent
R4 Design & Operation assessments are undertaken where instrumented systems form part of
tank overflow.
the control measure suite (as per AS61511).
Site operators should meet the latest international standards, ie BS EN The overfill prevention system (comprising means of level detection,
3. Special QRA studies have specifically focussed on nearby population
61511:2004 Functional safety. Safety instrumented systems for the logic/control equipment and independent means of flow control) should be
exposures, specifically the fuel storage tanks located closest to
process industry sector 2. engineered, operated and maintained to achieve and maintain an residential areas. The results of the QRA studies undertaken by Caltex,
COMAH five-year periodic reviews of safety reports should incorporate appropriate level of safety integrity in accordance with the requirements of which have been recently reviewed and revised, are consistent with the
a demonstration that: the recognised industry standard for safety instrumented systems, Part 1 of Land Use Safety Study undertaken by the NSW Department of Planning
the overall systems for tank filling control are of high integrity, with BS EN 61511. (last revised in 2007). These studies found that full refinery operations at
sufficient independence to ensure timely and safe shutdown to the site did not pose a significant risk to residential areas and overall risk
prevent tank overflow; and fell within the approval guidelines. The current proposal to transition the
the overall systems for tank filling control meet BS EN site from a refinery to a terminal only will substantially lower the risk
61511:2004.2 even further through elimination of a broad range of fire, explosion and
toxic release potential incidents and through the adoption of additional
Where the SIL assessment results in a change to the safety layers of protection on both gasoline and combustible liquid storage
management system that could have significant repercussions with tanks.
respect to the prevention of major accidents or the limitation of their
Additional controls on gasoline storage tanks will include the installation
consequences, operators of top-tier sites should review their safety
of independent high- high level alarms and vapour detection systems in
C2-1
Topic Caltex Review
reports under the provisions of COMAH regulation 8(c).12. gasoline tank compounds as per subsequent MIIB and BSTG
For the majority of sites it is not expected that a revised safety report is recommendations.
required to be submitted to the Competent Authority before the next 4. Caltex will continue to work with Workcover NSW to ensure the content
five-year review. of the safety case, the methodology for safety assessments and
An appropriate demonstration of compliance should be included in safety demonstration of the adequacy of control measures continues to be of a
reports submitted to the Competent Authority by the date of the next five- satisfactory standard.
year periodic review of the safety report.
Protecting against Primary LOC using high integrity systems
Independent levels of protection R3 Design & Operation For the proposed Terminal;
Operators of Buncefield-type sites should protect against loss of 1. All bulk flammables and combustible liquid storage tanks will have
containment of petrol and other highly flammable liquids by fitting a high independent overfill protection systems designed and installed to
integrity, automatic operating overfill prevention system (or a number of Australian standards.
such systems, as appropriate) that is physically and electrically separate 2. These systems will incorporate automatic shut-down capability.
and independent from the tank gauging system. 3. These systems will be independent of the tank gauging system and will
Such systems should meet the requirements of Part 1 of BS EN 61511 for have the required assessed safety integrity level.
the required safety integrity level, as determined by the agreed 4. Design adequacy of ATG and IHLA systems has been reviewed and
methodology. Where independent automatic overfill prevention systems are verified.
already provided, their efficacy and reliability should be reappraised in line
with the principles of Part 1 of BS EN 61511 and for the required safety 5. A deviation alarm between primary and independent levels systems is
integrity level, as determined by the agreed methodology (see also being installed.
Recommendation 1). 6. See also comments against R1 and R4 above.
Management systems for Inspection & maintenance systems should already be established. R2 Design & Operation 1. Proof testing & inspection regimes for ATG and IHLA systems are
maintenance of equipment and The MIIBs third progress report indicated that there was a problem with the Operators of Buncefield-type sites should, as a priority, review and amend adopted throughout Caltex terminals and refineries in accordance with
systems to ensure their tank level monitoring system at Buncefield. An examination of the records as necessary their management systems for maintenance of equipment and documented procedures.
continuing integrity in operation for Tank 912 from the automatic tank gauging (ATG) system suggest an systems to ensure their continuing integrity in operation. This should 2. The tank level devices employed by Caltex are SAAB radar gauges
anomaly in that the ATG system indicated that the level remained static include, but not be limited to reviews of the following: and are not subject to the type of over-ride or failure mechanisms which
3
while approximately 550 m /hr of unleaded petrol was being delivered into the arrangements and procedures for periodic proof testing of storage occurred at Buncefield. Principles of safety in design have thus been
Tank 912. tank overfill prevention systems to minimise the likelihood of any failure employed.
Minimum expected good practice that could result in loss of containment; any revisions identified 3. All primary containment system elements are subject to a planned risk
Overfill protection systems should be tested periodically to prove that pursuant to this review should be put into immediate effect; and reliability driven preventative maintenance program. Effective
they would operate safely when required. the procedures for implementing changes to equipment and systems to inspection and maintenance systems and procedures are already
ensure any such changes do not impair the effectiveness of equipment established. These procedures have been reviewed several times
Proof testing should be end to end, incorporate elements of
and systems in preventing loss of containment or in providing since the Buncefield incident. Any changes to inspection and
redundancy, and include the detector at the liquid interface and the
emergency response. maintenance regimes will be strictly managed under the Caltex
valve closure element. The test period should be determined by
R5 Design & Operation Management of Change procedures and will be reflected in revisions of
calculation according to the historical failure rate for each component or
the safety case.
the system and the probability of failure on demand required to achieve All elements of an overfill prevention system should be proof tested in
the specified SIL. Records of test results, including faults found and any 4. Critical system processes for ensuring equipment integrity are already
accordance with the validated arrangements and procedures sufficiently
repairs carried out, should be retained. clearly identified in the Safety Case and implemented.
frequently to ensure the specified safety integrity level is maintained in
Procedures for implementing changes to equipment and systems practice in accordance with the requirements of Part 1 of BS EN 61511 5. Changes to any overfill protection element, to alarm set-points or to
should ensure any such changes do not impair the effectiveness of management system processes will continue to be rigorously assessed
equipment and systems in preventing loss of containment or in & managed by Caltex Management of Change processes.
providing emergency response.
C2-2
Topic Caltex Review
Testing of overfill protection Inspection and maintenance systems should already be established. Refer R2 and R5 above 1. As per comments above.
systems Overfill protection alarms or shutdown systems using high level switches or 2. The tank level devices employed by Caltex are SAAB radar gauges
other two-state detectors may be inactive for long periods and may develop and are not subject to the particular type of over-ride or failure
unrevealed faults. Such faults cause the system to fail to danger when mechanism which occurred at Buncefield. The type of independent
required to operate. level detector to be installed is an analogue device rather than a switch.
Minimum expected good practice As such the sensor will always be in active measurement mode and
All elements of an overfill prevention system should be proof tested in subject to alarm if bad input or variation from the primary LT occurs.
accordance with the validated arrangements and procedures sufficiently 3. Verification of the level indication reading will be achieved via
frequently to ensure the specified safety integrity level is maintained in automated cross-reference to the primary level gauging system as well
practice. as regular physical dips of the tanks. All alarming and interlock
components will be tested as part of the site preventative maintenance,
testing and inspection program.
4. Caltex will continue to review opportunities in maintenance regimes to
ensure acceptable practice continues to be maintained for identified
critical primary containment assets/components.
Tank overfill prevention: defining The capacities of storage tanks should be clearly defined and appropriate 1. All bulk storage tanks have defined tank capacities & safe fill levels.
tank capacity safety margins put in place to prevent a release. 2. Caltex maintains current operating procedures clearly defining tank fill
To prevent overfill, tanks must have headspace margins to ensure that the limitations and tank filling restrictions.
intake will be closed off in time. High level alarms and operator or automatic 3. Caltex terminals have an established tank level alarm standard which
actions must be adequately spaced to respond to a developing overfill requires tank alarm settings to be established on a tank by tank basis
situation. taking into account worst case filling rates and alarm response times for
Minimum expected good practice that particular tank. It also takes into account all staffing level variations
Operating practices, staffing levels and systems must provide effective and operating practices in establishing the adequacy of alarm set-
safety margins to prevent an overfilling release. points. This standard ensures appropriate time is given for response
to, and escalation of response to, an abnormal level condition before
Tank capacities and appropriate action levels should be set in
loss of containment can occur, and will be applied for all tanks
accordance with this guidance.
(gasoline as well as others in converted terminal).
Tanks should not be intentionally filled beyond the normal fill level.
4. Any change to bulk storage tank fill limitations is analysed & managed
by Caltex MOC processes.
Fire safe shut-off valves Each pipe connected to a tank is a potential source of a major leak. In the 1. Tanks valves will be upgraded to include fire proof coating as part of
event of an emergency, it is important to be able to safely isolate the the conversion works
contents of the tank. Isolation valves should be fire safe, i.e. capable of 2. All valves being purchased for hydrocarbon service are to be fire safe
maintaining a leak-proof seal under anticipated fire exposure. and will be insulated.
Fire-safe shut-off valves must be fitted close to the tank on both inlet and NOTE; Fire Safe refers to the valve being capable of maintaining its
outlet pipes. Valves must either conform to an appropriate standard (BS pressure containing ability during and after a certain period of fire as
6755-2 or BS EN ISO 10497), equivalent international standards or be of an required by API 6D.
intrinsically fire-safe design, i.e. have metal-to-metal seats (secondary metal
seats on soft-seated valves are acceptable), not be constructed of cast iron
and not be wafer bolted.
C2-3
Topic Caltex Review
Remotely operated shut-off In an emergency, rapid isolation of vessels or process plant is one of the 1. All tank valves are able to be remotely isolated, have been selected to
valves (ROSOVS) most effective means of preventing loss of containment, or limiting its size. be Fire Safe and will be fire proofed as discussed above.
A ROSOV is a valve designed, installed and maintained for the primary 2. The safety case detail will be reviewed against HGS244 to verify
purpose of achieving rapid isolation of plant items containing hazardous whether any additional requirements apply.
substances in the event of a failure of the primary containment system
(including, but not limited to, leaks from pipework, flanges, and pump seals).
Valve closure can be initiated from a point remote from the valve itself. The
valve should be capable of closing and maintaining tight shut off under
foreseeable conditions following such a failure (which may include fire).
Remotely operated shut-off valves (ROSOVs) for emergency isolation of
hazardous substances: Guidance on good practice HSG244 provides
guidance on how to assess the need to provide ROSOVs for emergency
isolation.
Minimum expected good practice
ROSOVs for the emergency isolation of hazardous substances should
be fitted to the outlet pipe tanks in scope where an assessment under
HSG244 indicates that such valves should be fitted. ROSOVs for the
emergency isolation of hazardous substances should fail safe.
Operators of existing sites should review their risk assessments to
ensure that an effective assessment has been undertaken following the
key stages in HSG244.
Safe management of fuel transfer The initial report of the Buncefield Major Incident Investigation Board R6 Design & Operation
identified an issue with regard to safety arrangements, including The sector should put in place arrangement to ensure the receiving site (as 1. The proposed Kurnell Import terminal differs fundamentally from the
communications, for fuel transfer. No existing authoritative guidance was opposed to the transmitting location) has ultimate control over the tank filling Buncefield fuel terminal in that it will be a ship import terminal. There is
found that adequately described this and so a set of principles for safe R7 Design & Operation no routine delivery of product to Kurnell via pipeline under the proposed
management of fuel transfer, which includes the adoption of principles for new terminal arrangements although the existing D-line may be used
consignment transfer agreements has been developed. The sector should undertake a review of the adequacy of existing safety
arrangements, including communications, employed by those responsible for minor product movements between Caltex Kurnell and Caltex
Minimum expected good practice for pipeline transfers of fuel Banksmeadow terminal in the short term (as per current operations). In
Companies involved in the transfer of fuel by pipeline should: R9 Design & Operation
the latter case Kurnell will retain control of the filling operations as the
receiving site.
- Adopt the principles for safe management of fuel transfer Operators of terminals should implement systems to ensure systematic 2. Caltex adopts international standards for ship to shore transfer
- Where one party controls the supply, and another controls the maintenance of records pertaining to product movement and operation of operations and these are rigorously applied. These arrangements
receiving tanks, develop consignment transfer agreements the overfill prevention systems and any associated systems include robust controls for communication protocols, transfer monitoring
consistent with these principles. R10 Design & Operation and surveillance, and for transfer cessation. All transfers are
- Ensure that suitable job factors are provided to facilitate safe fuel The sector and regulators should agree on a system of lead and lag commenced only after ullage confirmation of receiving tanks.
transfer performance indicators for process safety performance 3. Records for all product movements are systematically maintained by
Companies involved in inter-business transfer of fuel by pipeline should Caltex.
have agreed on the nomenclature to be used for their product types
4. The control system for products movement operations will record all
For ship-to-shore transfers, carry out a terminal specific review to events associated with overfill protection controls. This includes full
ensure compliance with the International Shipping Guide for Oil monitoring of dead tanks as well as tanks involved in active transfers.
Tankers and Terminals. Operating systems incorporate confirmation of safe ullage volume and
Receiving sites to develop procedures for transfer planning and review preset transfer alarms.
them with their senders and appropriate intermediates. 5. Existing safety arrangements for both ship receipt operations and
Ensure that written procedures are in place, and consistent with current internal pipeline movements have been systematically reviewed under
good practice, for safety-critical operating activities in the transfer and the site safety case and include assessment of their adequacy
storage of fuel. (including communications controls). Further reviews and where
necessary, revision will occur as part of ongoing management of
change and routine continuous improvement activities.
6. Caltex has a defined process for operational excellence performance
monitoring and governance which includes a full suite of targeted lead
and lag performance indicators appropriate to monitoring the practical
effectiveness of all control measures.
C2-4
Topic Caltex Review
Overfill Protection System design R8 Design & Operation
The sector, including its supply chain of equipment manufacturers and 1. Caltex currently relies on its testing, inspection and maintenance
suppliers, should review and report without delay on the scope to develop systems to demonstrate reliability of its ultimate high level alarm and
improved components and systems, including but not limited to the tank gauging systems.
following: 2. The Kurnell terminal bulk storage tank high levels systems will be
alternative means of ultimate high level detection systems that do monitored via Vias-OM. The system provides superior diagnostic
not rely on components internal to the tank with the emphasis on capabilities to those available at the time of the Buncefield Incident
ease of inspection, testing and maintenance. including data comparison alarms between independent systems, and
increased dependability of tank gauging systems should be smart monitoring of tank inventories.
explored through improved validation of measurements & trends, 3. Caltex continues to explore emerging technologies with equipment
allowing warning of faults and using modern sensors with suppliers for higher reliability and smarter system components and will
increased diagnostic capability. progressively adopt such systems as they become available where
systems to control and log override actions. appropriate and reasonably practicable to do so.
4. Caltex rejects the ante-tank design proposal described in Annex 4 of
the recommendations report on the basis that it has the potential to
introduce more hazards, reduce effective tank capacity, eliminate safe
response time windows and thereby increase risk.
Engineering against escalation against loss of primary containment
R11 Design & Operation
Operators of Buncefield-type sites should review the classification of places 1. Hazardous Area classifications are regularly reviewed for all Caltex
within COMAH sites where explosive atmospheres may occur and their sites to ensure they remain appropriate to the types, quantities and
selection of equipment and protective systems (as required by the activities associated with the handling of hazardous materials.
Dangerous Substances and Explosive Atmospheres Regulations 2002(ref Classification of hazardous areas and selection of equipment and
6)). This review should take into account the likelihood of undetected loss of protective systems is conducted in accordance with Australian
containment and the possible extent of an explosive atmosphere following Standards HB13-2007 and AS2381.
such an undetected loss of containment. Operators in the wider fuel and 2. The current NSW regulation relating to major hazard facilities requires
chemicals industries should also consider such a review, to take account of a comprehensive and systematic safety assessment relating to every
events at Buncefield identified major incident scenario. Part of this safety assessment is
analysis of the nature of the incident and hazards concerned,
ultimately leading to adoption of control measures which reduce risk so
far as is reasonable practicable. The analysis includes review of
potential sources of ignition in the event of a loss of containment or
other formation of flammable atmospheres and the verification of
adequacy of the controls for both prevention of loss of containment
event as well as for prevention of ignition. The safety assessment
forms part of the current safety case. All future revisions of the safety
assessment will continue to analyse and assess ignition hazards.
3. Caltex will continue with the current risk based approach and to
identify and develop action plans relating to the undetected loss of
containment and generation of explosive environments. The ongoing
review of potential scenarios is considered part of the sites continuous
improvement process for its Safety Case.
R12 Design & Operation 1. The current NSW regulations relating to major hazard facilities require
Following on from Recommendation 11, operators of Buncefield-type sites a comprehensive and systematic safety assessment to be conducted
should evaluate the siting and/or suitable protection of emergency response relating to every identified major incident scenario. Part of this safety
facilities such as fire fighting pumps, lagoons or manual emergency assessment is to analyse the nature of the incident and hazards
switches. concerned, and to adopt control measures which reduce risk so far as
is reasonable practicable.
This analysis includes review of all applicable consequence scenarios
in the event of a loss of containment or fire events and the adequacy of
siting for critical emergency response and shut-down controls. A key
part of the study is consideration of the practicality of access to these
key controls as well as survivability in the event of a major fire or
explosion. The required revision of the Safety Assessment for the
converted terminal will include review of these matters. This includes a
Fire Safety Study for the Kurnell Terminal as per HIPAP2.
C2-5
Topic Caltex Review
Operators of Buncefield-type sites should employ measures to detect 1. Reviews as per recommendation R13 have already been undertaken.
hazardous conditions arising from loss of primary containment, including the Additional hydrocarbon vapour detectors have been installed in several
presence of high levels of flammable vapours in secondary containment. existing tanks as per 2007 LUSS Recommendations, and will be
Operators should without delay undertake an evaluation to identify suitable installed in suitable locations within flammable bunds as part of the
and appropriate measures. This evaluation should include, but not be conversion upgrade works.
limited to, consideration of the following: 2. The detection of hydrocarbon vapours at or above 10% of the lower
installing flammable gas detection in bunds containing vessels or tanks explosive limit will raise a clearly visible and audible alarm.
into which large quantities of highly flammable liquids or vapour may be 3. A number of CCTV units will be situated around the site (extent yet to
released; be determined following full site security review currently being
the relationship between the gas detection system and the overfill undertaken). Where cameras are being installed for increased security
prevention system. Detecting high levels of vapour in secondary surveillance, the option of installing in those units additional IR
containment is an early indication of loss of containment and so should detection with alarming capability is being considered.
initiate action, for example through the overfill prevention system, to 4. The decision for leak surveillance equipment beyond the measures
limit the extent of any further loss; currently employed or detailed above will be made on a tank by tank
installing CCTV equipment to assist operators with early detection of basis taking into account all required factors when determining what is
abnormal conditions. Operators cannot routinely monitor large numbers reasonably practicable. Revision to the risk assessments within the
of passive screens, but equipment is available that detects and safety case will reflect these considerations.
responds to changes in conditions and alerts operators to these NOTE: this same approach is being applied for other locations; e.g.
changes. pumping stations.
R14 Design & Operation 1. The Kurnell conversion project does not include installation of any new
Operators of new Buncefield-type sites or those making major modifications bulk storage tanks.
to existing sites (such as installing a new storage tank) should introduce 2. All tanks are designed, constructed and maintained to industry
further measures including, but not limited to, preventing the formation of standards API 650 and API 653.
flammable vapour in the event of tank overflow. Consideration should be 3. Caltex is closely monitoring further research into tank top design and
given to modifications of tank top design and to the safe re-routing of others factors. It has most recently reviewed RR937 prepared by the
overflowing liquids. UK Health and Safety Laboratory for the UK Health and Safety
Executive in 2012. Any definitive learnings from emerging research
will be taken into consideration in current and subsequent safety
assessment reviews.
R15 Design & Operation 1. Where there is opportunity to participate in industry sector
The sector should begin to develop guidance without delay to incorporate collaboration on safety standards Caltex actively supports and
the latest knowledge on preventing loss of primary containment and on participates in such initiatives.
inhibiting escalation if loss occurs. This is likely to require the sector to 2. Caltex currently sits on both NSW and Victorian MHF Advisory
collaborate with the professional institutions and trade associations. committees pertaining to the management and regulatory oversight of
registered and/or licenced major hazard facilities.
Operators of existing sites, if their risk assessments show it is not 1. Refer to comments for previously listed recommendations where a
practicable to introduce measures to the same extent as for new ones, range of additional control measures which have been and/or will be
should introduce measures as close to those recommended by adopted to prevent and/or reduce vapour cloud formation have been
Recommendation 14 as is reasonably practicable. The outcomes of the discussed.
assessment should be incorporated into the safety report submitted to the
Competent Authority.
C2-6
Topic Caltex Review
Engineering against loss of secondary and tertiary containment
Bund wall and floor construction and penetration joints should be leak- R17 Engineering against loss of secondary and tertiary containment 1. As per R18, Caltex applies risk based plans agreed in consultation
tight. Surfaces should be free from any cracks, discontinuities and joint The Competent Authority and the sector should jointly review existing with NSW Workcover and Department of Planning for bunding and site
failures that may allow relatively unhindered liquid trans-boundary standards for secondary and tertiary containment with a view to the drainage upgrades.
migration. As a priority, existing bunds should be checked and any Competent Authority producing revised guidance by the end of 2007. 2. Caltex adopts AS1940 as its common standard for flammable and
damage or disrepair, which may render the structure less than leak-tight, The review should include, but not be limited to the following: combustible liquid compounds. Where new tank compounds are to be
should be remedied. constructed or existing compounds are to be substantially altered, full
developing a minimum level of performance specification of
Bund walls should be leak-tight. As a priority, existing bund walls should be secondary containment (typically this will be bunding); review of all relevant Buncefield recommendations are taken into
checked and any damage or disrepair, which may render the wall less than consideration in design of those systems.
leak-tight, should be remedied. developing suitable means for assessing risk so as to prioritise the
programme of engineering work in response to the new 3. Bund upgrade works are included in the conversion project scope of
Joints in concrete or masonry bunds walls should be capable of resisting specification; works as detailed elsewhere in this submission but these do not entail
fire. Existing bunds should be modified to meet this requirement. In addition significant alteration to current bund design. Bunds will meet key
to repairing any defects in bund joints, steel plates should be fitted across formally specifying standards to be achieved so that they may be requirements as listed in the BSTG recommendations. All bund walls
the inner surface of bund joints, and/or fire-resistant sealants should be insisted upon in the event of lack of progress with improvements; are sealed either with bitumen or are concrete encased
used to replace or augment non-fire-resistant materials. improving firewater management and the installed capability to 4. Caltex has reviewed current HSE UK guidance on secondary and
Bund capacity at existing installations should be a minimum of 110% of the transfer contaminated liquids to a place where they present no tertiary containment and refers to the following posted note indicating
largest contained tank. Should already be in place as good practice. environmental risk in the event of loss of secondary containment that the revised guidance is not yet available:
and fires;
While the technical content of this guidance remains substantially correct, some
providing greater assurance of tertiary containment measures to of the legislation referred to has been superseded. The Highly Flammable
prevent escape of liquids from site and threatening a major Liquids and Liquefied Petroleum Gases Regulations 1972 have been replaced
accident to the environment. by the Dangerous Substances and Explosive Atmospheres Regulations 2002
R18 Engineering against loss of secondary and tertiary containment (DSEAR). Legislation .. and revised guidance is due to be published in 2012.
Revised standards should be applied in full to new build sites and Caltex continues to monitor emerging industry guidance and practices
to new partial installations. On existing sites, it may not be relating to engineering design and construction standards. Pertinent
practicable to fully upgrade bunding and site drainage. Where this improvements are adopted where reasonably practicable to do so.
is so operators should develop and agree with the Competent 5. Caltex is closely monitoring current research into bund and drainage
Authority risk-based plans for phased upgrading as close to new design and others factors. It has most recently reviewed RR937
plant standards as is reasonably practicable. prepared by the UK Health and Safety Laboratory for the UK Health
and Safety Executive in 2012.
6. Caltex revises the matters listed in R17 as a matter of course when
revising its Safety Cases and their associated demonstration of
adequacy of control measures.
7. Caltex secondary and tertiary containment measures are subject to
preventative inspection and maintenance regimes as for any other
control measure to ensure that any compromise to the leak tightness
of containment is systematically identified and remedied.
Firewater management and Site-specific planning of firewater management and control measures 1. The adequacy of emergency resources and procedures is already
control measures should be undertaken with active participation of the local Fire and Rescue required to be reviewed in consultation with NSW Fire and Rescue
Service. under the major hazard facilities regulations as well as via planning
approval requirements.
2. A Fire Safety Study, as per HIPAP2 guidelines, has been prepared for
the proposed Terminal changes and is the subject of consultation with
Fire & Rescue NSW.
3. Reviews of major incident and pre-incident plans specifically address
practical firewater requirements in responding to major fire events as
well as firewater management issues.
4. Caltex has recently expended capital to improve the practicability of
fire response. This has included improved foam delivery systems and
higher capacity foam monitors for combat of tank top & bund
spills/fires.
C2-7
Topic Caltex Review
High reliability organisations
Roles responsibilities & Operators should ensure that they have: R19 Design & Operation
competence clearly identified the roles and responsibilities of all those involved in The sector should work with the Competent Authority to prepare guidance 1. Schedule 17 Part 2 of the NSW Work Health and Legislation
managing, performing or verifying work in the management of major and/or standards on how to achieve a high reliability industry through addresses these recommendations and as such Caltex is required to
hazards, including contractors; and placing emphasis on the assurance of human and organisational factors in comply as an operator of a major hazard facility.
implemented a competence management system, linked to major design, operation, maintenance, and testing. Of particular importance are: Caltexs obligations with regard to the legislation are met through the
accident risk assessment, to ensure that anyone whose work impacts understanding and defining the role and responsibilities of the control design and implementation of its Operational Excellence Management
on the control of major accident hazards is competent to do so. room operators (including in automated systems) in ensuring safe System which has specific elements which address human factor
transfer processes; hazards and competence management specifically.
providing suitable information and system interfaces for front line staff 2. Kurnell refinery has in recent years completed several detailed
to enable them to reliably detect, diagnose and respond to potential organisational and human factor effectiveness studies. This has
incidents; included detailed studies for console operators, field operators and
training, experience and competence assurance of staff for safety frontline supervisors for normal, abnormal and emergency operations.
critical and environmental protection activities; This data is being used to manage safe operations during the
defining appropriate workload, staffing levels and working conditions for transition period and will be used to assist in organisational design for
front line personnel; the new terminal arrangements.
ensuring robust communications management within and between sites 3. Caltex is using its management of change process to ensure all the
and contractors and with operators of distribution systems and matters raised in the recommendation are taken into account where
transmitting sites (such as refineries); any changes to personnel, organisation or personnel /plant interfaces
are proposed.
prequalification auditing and operational monitoring of contractors
capabilities to supply, support and maintain high integrity equipment; 4. The OEMS also has specific elements which cover Contractor Safety
Management including pre-qualification, and operational monitoring of
providing effective standardised procedures for key activities in contractors capabilities to supply, support and maintain high integrity
maintenance, testing, and operations; equipment.
clarifying arrangements for monitoring and supervision of control room 5. Caltex has long recognised the importance of establishing high
staff; and reliability in its human resource. Programs such as IIF have been an
effectively managing changes that impact on people, processes and example of industry leading initiatives in this area.
equipment. 6. Where possible, Caltex will participate in cooperative activities initiated
R20 Design & Operation and coordinated by the regulator to develop standards and guidance
Terminal operators should ensure the resulting guidance is fully relating to establishment and development of high reliability
implemented. organisations.
R21 Design & Operation 7. Adoption of any resultant standards will be managed through the
The sector should put in place arrangements to ensure that good continuous improvement activities under the OEMS.
practice in these areas, incorporating experience from other higher
hazard sectors, is shared openly between organisations.
The regulator should ensure that MHF Safety Cases contain
demonstration that good practice in human and organisational design,
operation, maintenance and testing is implemented as rigorously as for
engineering systems.
C2-8
Topic Caltex Review
Staffing and shift work Operators should: Part of R19 as detailed above 1. Current requirements for a major hazard facility operator already
arrangements Ensure they can demonstrate that staffing arrangements are adequate require consideration and management of these factors.
to detect, diagnose and recover any reasonably foreseeable hazardous 2. Kurnell refinery has in recent years completed several detailed
scenario in relation to fuel transfer and storage; and organisational & human factor effectiveness studies. This has included
ensure that shift work is adequately managed to control risks arising detailed studies for console operators, field operators and frontline
from fatigue. supervisors utilising guidance contained in:
Staffing and shift work arrangements are critical to the prevention, control a. Organisational change and major accident hazards; Chemical
and mitigation of major accident hazards. Site operators should be able to Information Sheet No. CHIS7. UK Health & Safety Executive
demonstrate that staffing arrangements ensure there are sufficient alert, 06/2003.
competent personnel to deal with both normal operation and hazardous b. Energy Institute, Safe Staffing Arrangements User Guide for
scenarios arising from abnormal events in fuel transfer and storage. CRR348/2001 Methodology, Institute of Petroleum and HSE,
Some high hazard organisations have set staffing levels based on 2004.
steadystate operations. HSE Contract Research Report Assessing the This data is being used to manage safe operations during the
safety of staffing arrangements for process operations in the chemical and transition period and will be used to assist in organisational design for
allied industries CRR 348/2001, was commissioned to provide a method to the new terminal arrangements.
demonstrate that staffing arrangements are adequate for hazardous 3. All impacts resulting from any change to staffing /personnel
scenarios as well as normal operations. arrangements will be specifically addressed by the management of
change processes focussed around organisation and training and
competency. Demonstration of the adequacy of the controls adopted
with regard to human factor matters will be articulated in revisions of
the site safety case.
Shift handover Operators should set and implement a standard for effective and safe 1. As per comments above. Current requirements for a major hazard
communications at shift and crew changes handover in relation to fuel facility operator already require consideration and management of
transfer and storage. these factors. The Caltex Operational excellence management system
For top tier COMAH sites a summary of the standard should be included in and site specific operating procedures address these factors.
the next revision of the safety report.
Organisational change and Site operating companies should ensure that: 1. Procedures are already established under the OEMS for Management
management of contractors there is a suitable policy and procedure for managing organisational of Change which includes organisational change, as well as for
changes, and for retention of corporate memory; Contractor Safety Management.
the policy and procedure ensures that the company retains adequate 2. Caltex has in recent years invested in process development & delivery
technical competence and intelligent customer capability when work of several detailed organisational & human factor effectiveness
impacting on the control of major accident hazards is outsourced; studies. These have been undertaken to assess proposed
organisational changes.
suitable arrangements are in place for managing and monitoring
contractor activities. 3. Retention of corporate memory remains a challenge for all of industry.
Caltex is no exception and relies heavily on its Safety Case and safety
management system elements to record, retain and transfer
knowledge in relation to major hazards risk. This remains a particular
focus of the management of change process for the Kurnell conversion
project.
4. As a terminal, Caltex will retain management control of all tasks
undertaken on the site by contractors.
C2-9
Topic Caltex Review
Performance evaluation and Site operators should: 1. Active performance monitoring of all controls critical to the prevention
process safety performance Ensure they have a suitable active monitoring programme in place and/or mitigation of major hazards risks is currently in place for all
measurement for those systems and procedures that are key to the control of fuel Caltex terminals and refineries. In transition to an import terminal the
transfer and storage; and site will maintain a complete performance monitoring regime. Any
Develop an integrated set of leading and lagging performance changes to controls, performance indicators for those controls, or to the
indicators for effective monitoring of process safety performance methods or frequency of performance monitoring will be strictly
managed under the management of change process and recorded in
revisions of the safety case.
2. A full suite of leading and lagging performance indicators linked to
safety management systems performance is an integral part of OEMS
operation. Reporting of performance against these indicators is
escalated to the Caltex board as a regular element of the reporting
mechanism.
3. This is already a central requirement of the MHF regime which will be
specifically verified and overseen by NSW Workcover.
Delivering high performance R23 Design & Operation 1. These recommendations are addressed to the petroleum sector more
through Culture & Leadership The sector should set up arrangements to collate incident data on high broadly. There are however some elements which can be satisfied by
potential incidents including overfilling, equipment failure, spills and alarm Caltex specifically, in relation to the Kurnell site.
system defects, evaluate trends, and communicate information on risks, 2. Caltex refining and terminals use the same corporate system for
their related solutions and control measures to the industry. internal collation and sharing of incident data across the broader
R24 Design & Operation company; the Loss Prevention System. This is a well-established and
The arrangements set up to meet Recommendation 23 should include, but implemented system which is set up to appropriately address process
not be limited to, the following: safety incidents as well as near-losses. The system also incorporates
a program of companywide alerts and an extensive investigation,
thorough investigation of root causes of failures and malfunctions of analysis and reporting program. All Caltex employees participate in
safety and environmental protection critical elements during testing or the LPS activities to ensure lessons are learned from incidents and
maintenance, or in service; good practices are shared.
developing incident databases that can be shared across the entire 3. Thorough investigations and database records meeting the
sector, subject to data protection and other legal requirements. requirements of recommendation 24 are already employed through
Examples exist of effective voluntary systems that could provide LPS.
suitable models;
4. Caltex is a leading participant of industry sectors forums such as Safe
collaboration between the workforce and its representatives, Load Pass which share information on sector hazards, incidents and
dutyholders and regulators to ensure lessons are learned from control improvements.
incidents, and good practices are shared.
In particular, the sector should draw together current knowledge of major
hazard events, failure histories of safety and environmental protection
critical elements, and developments in new knowledge and innovation to
continuously improve the control of risks. This should take advantage of the
experience of other high hazard sectors such as chemical processing,
offshore oil and gas operations, nuclear processing and railways.
C2-10
Topic Caltex Review
Emergency Arrangements
Principles for Emergency All sites in scope should prepare in writing a suitable on-site emergency R1 Emergency preparedness, response & recovery
Arrangements plan as required by the COMAH Regulations. For lower-tier COMAH sites Operators of Buncefield-type sites should review their emergency 1. The matter referred to in R1 is already a requirement of the NSW Work
the plan should be prepared as part of the MAPP. arrangements to ensure they provide for all reasonably foreseeable Health and Safety Regulation and therefore required to be
The emergency plans should consider the response to and mitigation of a emergency scenarios arising out of credible major hazard incidents, demonstrated in the locations safety case. BSTG recommendations
multiple tank fire following an explosion. The plan should cover the on-site including vapour cloud explosions and severe multi-tank fires that, 283-292 are also covered under these provisions.
consequences of such an event and the assistance available in the form of before Buncefield, were not considered realistically credible. The 2. Ongoing revisions of the sites Safety Case will continue to review
off-site mitigatory actions. Competent Authority should ensure that this is done. global Major Incidents to ensure that all Major Incident potentials at the
The incident-specific emergency response plans should consider fire facilities continue to be comprehensively identified, assessed and
management requirements in response to, and mitigation of, a multiple tank controlled.
fire. The plan should cover the on-site consequences of such an event and 3. Pre-incident plans for all identified major incident scenarios are being
the assistance available in the form of off-site mitigatory actions. Any plan reviewed and updated as part of the conversion project.
deemed necessary to deal with such an event must be capable of operating
effectively even in the event of a preceding explosion.
On-site emergency plan R2 Emergency preparedness, response & recovery
A template for an on-site emergency plan can be found at The Competent Authority should review the existing COMAH guidance 1. Caltex will continue to work in conjunction with Workcover NSW, the
www.hse.gov.uk/comah/buncefield/final.htm. It is envisaged that sites will on preparing on-site emergency plans. This guidance needs to reflect NSW Department of Planning and Infrastructure and the emergency
complete this template and that it will then act as a high-level document the HSEs Hazardous Installations Directorate (HID) 7 Chemical services (in particular NSW Fire and Rescue) in review and revision of
providing an overview of the sites arrangements. Underpinning this Industries Division inspection manual used by inspectors to assess the its emergency arrangements for the Kurnell site and specifically with
document will be a series of detailed plans relating to specific incidents. quality of the on-site plan in meeting the COMAH Regulations. In respect to the terminal conversion plan.
particular, reference should be made to the need to consult with health 2. Caltex will continue taking into account published guidelines and
advisors and emergency responders. standards issued from time to time by the various state and federal
R3 Emergency preparedness, response & recovery regulators. (e.g. HIPAP2)
For Buncefield-type sites, operators should review their onsite 3. Any revision to this guidance will be reviewed and existing safety cases
emergency plans to reflect the revised guidance on preparing on-site including emergency arrangements will be reviewed and revised as
emergency plans as per Recommendation 2. The Competent Authority necessary in response to the revised Guidelines, as per current
will need to check that this is done. arrangements.
C2-11
Topic Caltex Review
Firefighting planning and This topic comprises of two elements; firstly, the actions that should be put R5 Emergency preparedness, response & recovery 1. Requirements from both recommendation sources are implicitly
preparation in place before an event occurs and secondly, actions that should be carried For Buncefield-type sites, operators should evaluate the siting and/or covered under existing NSW legislation for major hazard facilities:
out once an event has occurred. These arrangements should be agreed by suitable protection of emergency response facilities such as the
all parties involved, including off-site responders. emergency control centre, firefighting pumps, lagoons or manual The operator of a determined major hazard facility must prepare an
Planning aids the firefighting operations immensely by determining what is switches, updating the safety report as appropriate and taking the emergency plan for the major hazard facility that:
needed to extinguish the fire or manage a controlled burn, and how to necessary remedial actions. (a) addresses all health and safety consequences of a major incident
deliver the required resources and manage firewater to prevent R6 Emergency preparedness, response & recovery occurring, and
environmental impact. Operators should identify vulnerable critical emergency response (b) includes all matters specified in Schedule 16, and
Scenario-based incident-specific emergency response plans can identify resources and put in place contingency arrangements either on or off (c) provides for testing of emergency procedures, including the
incident control resources required for accidental release, spillages and fire site in the event of failure at any time of the year and make appropriate frequency of testing.
and emergency response. They can also provide guidance on control and amendments to the on-site emergency plan. This should include
deployment of the necessary resources and importantly, can be used as a identifying and establishing an alternative emergency control centre In preparing an emergency plan, the operator must consult with:
tool to exercise against, thus closing the loop from preparation to planned with a duplicate set of plans and technical information.
and exercised response. (a) the following bodies:
(i) Fire and Rescue NSW, and
Such deliberations should form part of the environmental and safety risk R7 Emergency preparedness, response & recovery
assessment carried out by the operator when producing the on-site (ii) if the facility is within a rural fire district within the
emergency plan. This should be in consultation with the environment For COMAH sites, if the operator relies on an off-site Fire and Rescue meaning of the Rural Fires Act 1997the NSW Rural Fire
agencies, the local authorities, the emergency services (particularly the Fire Service to respond, the operators plan should clearly demonstrate that Service, and
and Rescue Service) and other stakeholders. there are adequate arrangements in place between the operator and (b) in relation to the off-site health and safety consequences of a major
the service provider. The Competent Authority will need to check that incident occurringthe local authority.
this is done.
The operator must ensure that the emergency plan addresses any
recommendation made by the emergency service organisations
consulted under subclause (2) in relation to:
(a) the testing of the emergency plan, including the manner in which
it will be tested, the frequency of testing and whether or not the
emergency service organisations will participate in the testing,
and
(b) what incidents or events at the major hazard facility should be
notified to the emergency service organisations.
The operator must have regard to any other recommendation or advice given
by a person consulted under subclause (2).
2. Current site fire safety studies and emergency plan reviews address
these recommendations. Pre-incident plans for all identified major
incident scenarios are regularly reviewed and updated, and will be
revised to reflect any changes made to plant, emergency controls and
the emergency organisation as a result of the conversion to a terminal.
3. Sites will continue, in consultation with NSW Fire and Rescue and
other nominated authorities, to identify and implement further
practicable improvements.
4. As for any other control measure, the emergency planning
arrangements and infrastructure are included in the Safety Case and
require suitable demonstration of adequacy.
Training & Competency for R4 Emergency preparedness, response & recovery
Emergency Response Trained, knowledgeable and competent personnel must be involved in the Operators should review and where necessary revise their on-site 1. As for comments against R4-R7 above, this recommendation is
exercise of the firefighting plan and in the testing of the on-site plan. They emergency arrangements to ensure that relevant staff are trained and already covered by the Work Health and Safety Regulation.
must fulfil the tasks they will be expected to fulfil during an incident. competent to execute the plan and should ensure that there are enough 2. Training and competency in the current and amended emergency plan
trained staff available at all times to perform all the actions required by the will be maintained throughout the site transition to an operating import
on-site emergency plan. terminal.
C2-12
Topic Caltex Review
Preparedness Mutual Aid R12 Emergency preparedness, response & recovery 1. Whilst these two specific recommendations are really aimed at industry
(National Framework) Communities and Local Government should complete and, where sectors and local, state and national government initiatives, Caltex
necessary, initiate an assessment of the need for national-level recognises its role as a responsible member of the Kurnell community
arrangements to provide, fund and maintain, emergency response and as such actively supports mutual aid and community emergency
equipment (such as high volume pumps, firefighting foam and specialist response arrangements.
pollution containment equipment). The review could also consider 2. The revision of the Kurnell Emergency Plan to reflect operation of the
criteria for allocation and use of this equipment across the UK. site as an import terminal will specifically revise mutual aid resourcing
R23 Emergency preparedness, response & recovery and agreements.
The operators of industrial sites where there are risks of large
explosions and/or large complicated fires should put in place, in
consultation with fire and rescue services at national level, a national
industryfire service mutual aid arrangement. The aim should be to
enable industry equipment, together with operators of it as appropriate,
to be available for fighting major industrial fires. Industry should call on
the relevant trade associations and working group 6 of the Buncefield
Standards Task Group to assist it, with support from CCS. The COMAH
Competent Authority should see that this is done.
Warning and informing the public R8 Emergency preparedness, response & recovery
COMAH site operators should review their arrangements to 1. Caltex Kurnell is an integral part of the community in which it
communicate with residents, local businesses and the wider operates and as such recognises the importance of appropriate
community, in particular to ensure the frequency of communications community information and communication.
meets local needs and to cover arrangements to provide for dealing 2. Caltex will continue to place high priority on ensuring the intended
with local community complaints. They should agree the frequency and outcome from R8 continues to be achieved.
form of communications with local authorities and responders, making 3. Caltex has the following established communication channels in
provision where appropriate for joint communications with those bodies. the event of an emergency:
R9 Emergency preparedness, response & recovery a. Appointed members of the Caltex management team in
The Competent Authority should review the COMAH guidance to assist the Emergency Operations Centre provide information
operators in complying with Recommendation 8 and should work with updates to the media, employees and contractors.
the Cabinet Office to integrate the COMAH guidance and the CCA b. Appointed members of the Caltex management team
Communicating with the public(Ref 9) guidance, so that monitor & respond to community inquiries via 1800
communications regarding COMAH sites are developed jointly by the response hotline.
site operator and the local emergency responders. c. Appointed members of the Caltex management team in
the Emergency Operations Centre provide information to
NSW Police who are responsible for communicating and
coordinating community action (e.g. evacuation) should
this be required.
d. Caltex provides subsequent feedback to community
stakeholders following an Emergency. This is typically
communicated via routine feedback at community
meetings.
C2-13

Hazard and Risk Assessment PDF

Загружено:

Сведения о документе

Оригинальное название

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Hazard and Risk Assessment PDF

Загружено:

Авторское право:

Доступные форматы

A p p e nd ix C

Hazard and Risk Assessment

Preliminary Hazard Analysis

Proposed Kurnell Product Terminal

R4Risk Pty Ltd

Confidential and Sensitive Document

Appendix E Lists of Hazardous Scenarios

15 May 2013 Page 2 of 43

Project Title Proposed Kurnell Product Terminal - Preliminary Hazard Analysis

Release Issue Date Reviewed by Approved by Comments

15 May 2013 Page 3 of 43

15 May 2013 Page 4 of 43

5.3.2 Vapour Cloud Explosions .............................................................................................. 20

Appendix A Assumption Register

15 May 2013 Page 5 of 43

The Project comprises the following principal components:

The Project is expected to be undertaken over a 54 month period.

1.1 MAJOR RISK CONTRIBUTORS

15 May 2013 Page 6 of 43

1.2 INDIVIDUAL RISK - FATALITY

1.3 INDIVIDUAL RISK - INJURY

Table 2: LSIR Injury Risk Tolerance Criteria [2]

1.4 SOCIETAL RISK - OFF-SITE

15 May 2013 Page 7 of 43

Number of Fatalities (N)

Figure 1: Societal Risk Results Off-site Population

1.5 RISK OF PROPERTY DAMAGE AND ACCIDENT PROPAGATION

1.6 BIOPHYSICAL RISK

15 May 2013 Page 8 of 43

1.7 ASSUMPTIONS AND SENSITIVITY

1.8 RELATED SAFETY STUDIES

1.9 FINDINGS AND RECOMMENDATIONS

No recommendations were made as a result of this QRA.

15 May 2013 Page 9 of 43

2 ACRONYMS & GLOSSARY

15 May 2013 Page 10 of 43

The frequency at which an individual may be expected to sustain a given

15 May 2013 Page 11 of 43

3.2 THE PROJECT

The Project is expected to be undertaken over a 54 month period.

3.3 THE PRELIMINARY HAZARD ANALYSIS

15 May 2013 Page 12 of 43

15 May 2013 Page 13 of 43

4 SITE & PROJECT DESCRIPTION

4.2 PROJECT DESCRIPTION

15 May 2013 Page 14 of 43

Figure 2: Location of Site and Project Area

15 May 2013 Page 15 of 43

Figure 3: Site Plan [4]

15 May 2013 Page 16 of 43

15 May 2013 Page 17 of 43

Major Accident Identification

Consequence Assessment Frequency Assessment

Fire / Explosions Fault Tree analysis

Impact Determination End Event Frequency Determination

Identify major risk Risk Evaluation

Figure 4: Overview of QRA Methodology

5.1 HAZARD IDENTIFICATION

15 May 2013 Page 18 of 43

Site layout plans

5.2 FREQUENCY ASSESSMENT

5.3 CONSEQUENCE ASSESSMENT

15 May 2013 Page 19 of 43