Hazard and Risk Assessment

C2 Kurnell Buncefield Review
Appendix C
Hazard and Risk Assessment
C1 Preliminary Hazard Analysis
Appendix &1
Preliminary Hazard Analysis
R4Risk Pty Ltd
ACN 134 478 050
15 Yarra Street
(PO Box 5023)
South Melbourne VIC 3205
P: 03 9268 9700
F: 03 8678 0650
E: solutions@r4risk.com.au
www.r4risk.com.au
Caltex Refineries (NSW) Pty Ltd
Proposed Kurnell Product Terminal
Preliminary Hazard Analysis
15 May 2013
R4Risk Ref.: 107-24, Release 5
CALTEX REFINERIES (NSW) PTY LTD
PROPOSED KURNELL PRODUCT TERMINAL - PRELIMINARY HAZARD ANALYSIS
15 May 2013 Page 2 of 43
Confidential and Sensitive Document
Exempt from disclosure under the Government Information (Public Access) Act 2009 (NSW)
The complete Preliminary Hazard Analysis Report is provided to the NSW Department of Planning &
Infrastructure (DP&I) by Caltex Refineries (NSW) Pty Ltd (Caltex) in confidence for use only within
DP&I. It is submitted on the basis that there is an overriding public interest against disclosure
pursuant to section 14(2) of the Government Information (Public Access) Act 2009 (NSW) (the Act).
The Report is exempt from disclosure under the Act on the grounds that it contains information
associated with the storage of security sensitive petroleum finished product and information that is
commercial-in-confidence.
The information which is exempt from disclosure applies specifically to the following parts of the
Report:
Appendix E Lists of Hazardous Scenarios
This report must not be copied or distributed outside DP&I without the express permission of Caltex.
15 May 2013 Page 3 of 43
DOCUMENT CONTROL
Project Title Proposed Kurnell Product Terminal - Preliminary Hazard Analysis
Client Name Caltex Refineries (NSW) Pty Ltd
Project No. 107-24
Project Manager Patrick Walker
Report Author (s) Patrick Walker
Release Issue Date Reviewed by Approved by Comments
Release 1 27 February 2013 L. Dreher L. Dreher Issued to Client
Release 2 18 April 2013 L. Dreher L. Dreher Revised with Client
comments
Release 3 26 April 2013 L. Dreher L. Dreher Updated
Release 4 8 May 2013 L. Dreher L. Dreher Updated
Release 5 15 May 2013 L. Dreher L. Dreher Updated
15 May 2013 Page 4 of 43
Table of Contents
1 EXECUTIVE SUMMARY................................................................................................................. 6
1.1 Major Risk Contributors........................................................................................................... 6
1.2 Individual Risk - Fatality........................................................................................................... 7
1.3 Individual Risk - Injury ............................................................................................................. 7
1.4 Societal Risk - Off-site............................................................................................................. 7
1.5 Risk of Property Damage and Accident Propagation.............................................................. 8
1.6 Biophysical Risk ...................................................................................................................... 8
1.7 Assumptions And Sensitivity ................................................................................................... 9
1.8 Related Safety Studies ............................................................................................................ 9
1.9 Findings And Recommendations............................................................................................. 9
2 ACRONYMS & GLOSSARY.......................................................................................................... 10
2.1 Acronyms............................................................................................................................... 10
2.2 Glossary................................................................................................................................. 10
3 INTRODUCTION........................................................................................................................... 12
3.1 Background............................................................................................................................ 12
3.2 The Project ............................................................................................................................ 12
3.2.1 Scope............................................................................................................................. 12
3.2.2 Aim................................................................................................................................. 12
3.3 The Preliminary Hazard Analysis .......................................................................................... 12
3.3.1 Scope............................................................................................................................. 12
3.3.2 Aim................................................................................................................................. 13
4 SITE & PROJECT DESCRIPTION................................................................................................ 14
4.1 Project Location..................................................................................................................... 14
4.2 Project Description ................................................................................................................ 14
4.2.1 Wharf Operation ............................................................................................................ 14
4.2.2 Tank Farm Operation .................................................................................................... 14
4.2.3 Associated Pipelines and Pumps .................................................................................. 14
5 METHODOLOGY .......................................................................................................................... 17
5.1 Hazard Identification.............................................................................................................. 18
5.1.1 Data Collection .............................................................................................................. 18
5.1.2 Scenario Development .................................................................................................. 19
5.2 Frequency Assessment ......................................................................................................... 19
5.2.1 Scenario Frequency ...................................................................................................... 19
5.2.2 Event Tree Analysis....................................................................................................... 19
5.3 Consequence Assessment.................................................................................................... 19
5.3.1 Pool Fires....................................................................................................................... 20
15 May 2013 Page 5 of 43
5.3.2 Vapour Cloud Explosions .............................................................................................. 20
5.3.3 Vulnerability Models ...................................................................................................... 20
5.4 Risk Assessment ................................................................................................................... 20
5.5 Study Assumptions................................................................................................................ 20
6 RISK CRITERIA ............................................................................................................................ 21
6.1 Individual Risk - Fatality......................................................................................................... 21
6.2 Individual Risk - Injury ........................................................................................................... 21
6.3 Societal Risk Criteria ............................................................................................................. 21
6.4 Risk of Property Damage and Accident Propagation............................................................ 22
6.5 Biophysical Risk .................................................................................................................... 22
7 HAZARD IDENTIFICATION.......................................................................................................... 23
7.1 Hazardous Materials.............................................................................................................. 23
7.2 Isolatable Sections ................................................................................................................ 23
7.3 Hazardous Scenarios ............................................................................................................ 23
7.4 Consequence Events ............................................................................................................ 24
7.4.1 Pool Fires....................................................................................................................... 24
7.4.2 Vapour Cloud Explosion................................................................................................ 25
7.5 Major Accident Hazards ........................................................................................................ 25
8 FREQUENCY ASSESSMENT ...................................................................................................... 27
8.1 Failure Frequency.................................................................................................................. 27
8.2 Event Tree Analysis............................................................................................................... 27
8.3 Tank Overfill / Explosion Frequency...................................................................................... 28
9 CONSEQUENCE ANALYSIS........................................................................................................ 30
10 RISK ASSESSMENT..................................................................................................................... 32
10.1 Individual Risk - Fatality......................................................................................................... 32
10.2 Individual Risk - Injury ........................................................................................................... 35
10.3 Societal Risk Off-site Population........................................................................................ 37
10.4 Risk of Property Damage and Accident Propagation............................................................ 37
10.5 Biophysical Risk .................................................................................................................... 39
10.6 Sensitivity Analysis ................................................................................................................ 40
11 COMPARISON TO RISK AT THE EXISTING FACILITY.............................................................. 41
12 REFERENCES.............................................................................................................................. 42
Appendix A Assumption Register
Appendix B Failure Rate Data
Appendix C Buncefield Recommendations
Appendix D Off-site Population Data
Appendix F Qualifications and Experience of the Hazard Analysis Team
15 May 2013 Page 6 of 43
1 EXECUTIVE SUMMARY
Caltex is seeking development approval to convert the existing Kurnell Refinery into a Finished
Product Terminal (the Project). In accordance with the NSW Department of Planning and
Infrastructure (DP&I) Director-Generals Requirements (DGRs) for the Development, a Preliminary
Hazard Analysis (PHA) Report was prepared by R4Risk for inclusion in the Environment Impact
Statement (EIS) for SSD-5544.
The PHA report was prepared with reference to the State Environment Planning Policy No 33 -
Hazardous and Offensive Development [1], and in accordance with the NSW DP&Is Hazardous
Industry Planning Advisory Papers No. 4 - Risk Criteria (HIPAP4) [2] and No. 6 - Hazard Analysis
(HIPAP6) [3].
The Project comprises the following principal components:
Continued use of parts of the existing refinery, in a manner similar to that currently in place, for
the storage and distribution of petroleum products.
A number of existing crude oil tanks are to be cleaned and modified to allow for the storage of
refined product (i.e. conversion to finished product tanks).
A small number of other tanks already storing one type of refined product are to be converted
to store alternative products.
New pumps, pipes and electrical infrastructure are to be installed within the Project Area
(defined in Section 4.1).
A range of ancillary works is also to be undertaken to improve efficiency and to facilitate the
conversion of the refinery into a terminal. These ancillary works include consolidation and
upgrades to the utilities, transportation and management systems at the site.
The refinery plant would also be shut down, depressurised, de-inventoried and left in situ. Caltex shut
down, depressurise and de-inventory the refinery plant during routine maintenance activities as part of
the existing operation and therefore this action does not form part of the Project.
The Project is expected to be undertaken over a 54 month period.
In preparing the PHA Report, R4Risk has investigated the risk of operations associated with the
following areas:
Tank farm operations
Wharf operations associated with fixed shore assets (i.e. excluding shipping activities); and
Associated pipelines and pumps.
The quantitative risk assessment (QRA) methodology was used to determine the risk profile for the
Project. The methodology involved the following key steps:
Hazard Identification
Consequence Assessment
Frequency Assessment
Risk Assessment.
The tolerability of the calculated risk was assessed by comparison with the risk criteria specified in
HIPAP4 [2]. The following sections summarise the major findings from the risk assessment. The
corresponding risk contours are presented in Section 10.
1.1 MAJOR RISK CONTRIBUTORS
The PHA examined scenarios associated with the Major Accident Hazards (MAHs) that involved the
loss of containment of flammable (gasoline, jet fuel, slops) or combustible (diesel) material. The study
considered the material that could be released from storage tanks, pumps and loading arms, as well
as the associated pipelines. The QRA determined the potential that released material would ignite,
resulting in a pool fire. The study also evaluated the frequency and potential consequence of a
15 May 2013 Page 7 of 43
Buncefield-type vapour cloud explosion (VCE). Although assessed as extremely unlikely, the
Buncefield-type VCE event was included in the QRA.
1.2 INDIVIDUAL RISK - FATALITY
Location-specific individual risk (LSIR) contours for the risk of fatality were developed. These were
used to assess the tolerability of the risk against the risk criteria described in HIPAP4. As each of the
risk contours do not extend into the respective land-use areas to which the criteria are applied, the off-
site fatality risk criteria are therefore satisfied. This is summarised in Table 1.
Table 1: LSIR Fatality Risk Tolerance Criteria [2]
Land Use
Tolerance Criteria
(risk in a million per
year)
LSIR Results
Sensitive areas, such as hospitals and schools 0.5
The relevant LSIR
contours do not
extend to each of
these areas.
All criteria are
satisfied.
Residential developments and continuous
occupancy, such as hotels and resorts
1.0
Commercial developments, including retail
centres, offices and entertainment centres
5
Sporting complexes and active open space 10
Industrial areas 50
1.3 INDIVIDUAL RISK - INJURY
Location-specific individual risk (LSIR) contours for the risk of injury were developed. The tolerability
of the injury risk results was determined by comparison with the HIPAP4 injury risk criteria. Similar to
the fatality risk contours, the injury risk contours do not extend into the respective land-use areas to
which the criteria are applied. The injury risk criteria are therefore satisfied. This is summarised in
Table 2.
Table 2: LSIR Injury Risk Tolerance Criteria [2]
Individual Injury Risk Criteria
Tolerance Criteria
year)
LSIR Results
Incident heat flux radiation at residential and
sensitive areas exceeding 4.7 kW/m
2
.
50 The relevant LSIR
contours do not
extend to these areas.
The criteria is met.
Incident explosion overpressure at residential and
sensitive use areas should not exceed 7 kPa at
frequencies.
50
Toxic concentrations in residential and sensitive
use areas exceed a level which would be
seriously injurious to sensitive members of the
community following a relatively short period of
exposure.
10
Not applicable, as the
QRA did not involve
scenarios which could
result in this type of
event.
1.4 SOCIETAL RISK - OFF-SITE
The societal risk F-N curve was developed. This considered potential impacts on the off-site
population. The tolerability of the risk was assessed using the indicative societal risk criteria
described in HIPAP4 [2]. The societal risk assessment, compared against these criteria, is presented
in Figure 1.
The societal risk F-N curve for the proposed operations lies fully below the negligible line. In this
region, the societal risk is not considered significant, provided other individual risk criteria are met. As
described in the preceding sections, the individual risk criteria for fatality and injury are satisfied.
Therefore the societal risk is also considered to be tolerable.
15 May 2013 Page 8 of 43
Figure 1: Societal Risk Results Off-site Population
1.5 RISK OF PROPERTY DAMAGE AND ACCIDENT PROPAGATION
Location-specific risk contours were developed to represent the risk of property damage and accident
propagation. The tolerability of the results was determined by comparison with corresponding risk
criteria outlined in HIPAP4. The risk contours do not extend to off-site areas. The risk criteria are
therefore satisfied. This is summarised in Table 3.
Table 3: Risk of Property Damage And Accident Propagation Tolerance Criteria [2]
Risk Criteria
Tolerance Criteria
year)
LSIR Results
Incident heat flux radiation at neighbouring
potentially hazardous installations or at
land zoned to accommodate such
installations for the 23 kW/m
2
heat flux.
50
The relevant LSIR contours
do not extend to these
areas. The criteria are
met.
Incident explosion overpressure at
neighbouring potentially hazardous
installations, at land zoned to
accommodate such installations or at
nearest public buildings for the 14 kPa
explosion overpressure level
50
1.6 BIOPHYSICAL RISK
The risk to the biophysical environment was assessed by examining the potential for identified release
scenarios to impact on the long-term viability of the surrounding ecosystems. For different sections of
the facility, the assessment considered the key controls that would prevent, or mitigate, the impact of a
release. The analysis demonstrated controls would be in place that would either minimise the
potential for a release or contain product if a release did occur. Therefore, a release of product from
the terminal would not pose a threat to the long-term viability of the ecosystem.
1.00E-09
1.00E-08
1.00E-07
1.00E-06
1.00E-05
1.00E-04
1.00E-03
1.00E-02
1.00E-01
1 10 100 1000
F
r
e
q
u
e
n
c
y

o
f

N

o
r

m
o
r
e

f
a
t
a
l
i
t
i
e
s

(
F
,

/
y
e
a
r
)
Number of Fatalities (N)
Intolerable
Negligible
ALARP
15 May 2013 Page 9 of 43
1.7 ASSUMPTIONS AND SENSITIVITY
In completing the QRA, a number of technical assumptions were made. These assumptions are
described in Appendix A. For key assumptions, details of the applied methodology and corresponding
references are also included.
To support the risk assessment conclusions, a review was conducted to determine the sensitivity of
the QRA results to key parameters. The review examined the parameters such as failure frequency
and the radiant heat vulnerability model. This review showed that the risk tolerability remained
unchanged, despite the modifications made. Details of the sensitivity analysis are provided in Section
10.6.
1.8 RELATED SAFETY STUDIES
In conducting the PHA, R4Risk reviewed, or were provide access to, a number of detailed studies
conducted for the Kurnell site. These included the following studies:
Process Hazard Analysis for the Terminal Conversion and the Caltex Port and Marine Works
Project
Major Hazard Facility Safety Report for the Kurnell Refinery
Kurnell Peninsula Land Use Safety Study 2007
Various historical fire safety studies examining the refinery operations and the proposed
terminal
Caltex review of Buncefield Report Recommendations.
1.9 FINDINGS AND RECOMMENDATIONS
This quantitative risk assessment demonstrates that the risk levels calculated for the Project satisfy
the risk criteria specified in HIPAP4. Compared with existing refinery operations, the off-site risk
profile is considerably reduced. This outcome is expected, because the Project involves a
downscaling of the existing operations, i.e. a reduction in the scale and complexity of the operations at
the site.
The studies listed in Section 1.8 provided input into the development of the design for the proposed
terminal. Caltex has identified risk reduction recommendations using its Riskman2 methodology.
These are documented in the detailed process hazard analysis records and are tracked to completion
by Caltexs project management process.
No recommendations were made as a result of this QRA.
15 May 2013 Page 10 of 43
2 ACRONYMS & GLOSSARY
2.1 ACRONYMS
ALARP As low as reasonably practicable
BLEVE Boiling-liquid expanding-vapour explosion
Caltex Caltex Refineries (NSW) Pty Ltd
CCTV Closed-circuit television
DCS Distributed control system
DGRs Director-Generals Requirements
DP&I Department of Planning and Infrastructure
EIS Environment impact statement
ESDV Emergency shutdown valve
HES Health, environment, safety
HIPAP4
New South Wales Department of Planning Hazardous Industry Planning
Advisory Paper No. 4 [2]
HIPAP6
New South Wales Department of Planning Hazardous Industry Planning
Advisory Paper No. 6 [3]
HSE Health & Safety Executive (United Kingdom)
IR Individual risk
IRPA Individual risk per annum
Loc. Loss of containment
LPG Liquefied petroleum gas
LSIR Location-specific individual risk
MAH Major Accident Hazard
MOV Motor-operated valve
MSDS Material safety data sheet
OWS Oily Water Sewer
P&ID Piping and instrumentation diagram
PFD Probability of failure on demand
PHA Preliminary hazard analysis
PULP Premium unleaded petrol
QRA Quantitative risk assessment
SSD Significant State Development
SPULP Super-premium unleaded petrol
VCE Vapour cloud explosion
ULP Unleaded petrol
2.2 GLOSSARY
Consequence
The severity associated with an event in this instance the heat radiation from
the pool fire events, i.e. the potential effects of a hazardous event.
Consequence Event
The end event associated with a failure and release, considering all
detection, isolation and ignition factors, e.g. pool fire, flash fire etc.
Eastern Tank Area
The Eastern Tank Area contains existing finished product tanks, some of
which would need minor conversion works as part of the Project. It also
contains the Oil Movements Centre (OMC).
Event Frequency The frequency assigned to a specific consequence event
Frequency
The number of occurrences of an event expressed per unit time. It is usually
expressed as the likelihood of an event occurring per annum.
Hazard
A physical situation with the potential for human injury, damage to property,
damage to the environment or some combination of these.
Hazardous Scenario
The accidental release of a hazardous material from equipment or piping,
from identified isolatable section of terminal operation.
15 May 2013 Page 11 of 43
Individual Risk (IR)
The frequency at which an individual may be expected to sustain a given
level of harm from the realisation of specified hazards.
Individual Risk
Contours
As individual risk (IR) is calculated at a point, calculating the IR at many
points allows the plotting of IR contours, these being lines that indicate
constant levels of risk. Most commonly used are the 1 chance per million-
year contour and the 10 chances per million-year contour.
Individual Risk of
Fatality
Individual risk, with harm measured in terms of fatality. It is calculated at a
particular point for a stationary, unprotected person for 24 hours per day, 365
days per year. Commonly expressed in chances of fatality per million years.
Isolatable Section
A system of pipes or vessels containing the hazardous materials that are
bounded by specific isolation points, which can be operated to isolate the
inventory in the event of an emergency.
Probability
The expression for the likelihood of an occurrence of an event or an event
sequence or the likelihood of the success or failure of an event on test or
demand. By definition, probability must be expressed as a number between
0 and 1.
Quantitative Risk
Assessment
A risk assessment undertaken by combining quantitative evaluations of event
frequency and consequence.
Risk
The combination of frequency and consequences, the chance of an event
happening that can cause specific consequences.
RiskMan2
Caltexs standard process for health, environment, safety (HES) and asset
related risk management. RiskMan2 provides a standardised and systematic
approach to the identification of hazards, assessment of risk and effective
adoption and maintenance of control measures for HES and certain asset
risks.
Western Tank Area
The Western Tank Area is primarily made up of the existing Crude Oil Tanks
and the Waste Water Treatment Plant. All the Crude Oil Tanks would
require conversion as part of the Project. It is proposed that the area would
also include the new product pumps area and the new slops pumps area.
15 May 2013 Page 12 of 43
3 INTRODUCTION
3.1 BACKGROUND
Caltex is seeking development approval to convert the existing Kurnell Refinery into a Finished
Product Terminal (the Project). In accordance with the NSW DP&I DGRs for the Development, a
PHA report was prepared by R4Risk for inclusion in the EIS for SSD-5544.
The PHA report was prepared with reference to the State Environment Planning Policy No 33 -
Hazardous and Offensive Development [1], and in accordance with the NSW DP&Is Hazardous
Industry Planning Advisory Papers No. 4 - Risk Criteria [2] and No. 6 - Hazard Analysis [3]. The
experience and qualifications of the project team are included in Appendix E.
This report details the methodology and presents the off-site risk profile for the proposed operations.
The tolerability of the results has been assessed by comparison with the risk criteria specified in
HIPAP4 [2].
3.2 THE PROJECT
3.2.1 Scope
The Project comprises the following principal components:
Continued use of parts of the existing refinery, in a manner similar to that currently in place, for
the storage and distribution of petroleum products.
A number of existing crude oil tanks are to be cleaned and modified to allow for the storage of
refined product (i.e. conversion to finished product tanks).
A small number of other tanks already storing one type of refined product are to be converted
to store alternative products.
New pumps, pipes and electrical infrastructure are to be installed within the Project Area
(defined in Section 4.1).
A range of ancillary works are also to be undertaken to improve efficiency and to facilitate the
conversion of the refinery into a terminal. These ancillary works include consolidation and
upgrades to the utilities, transportation and management systems at the site.
The refinery plant would also be shut down, depressurised, de-inventoried and left in situ. Caltex shut
down, depressurise and de-inventory the refinery plant during routine maintenance activities as part of
the existing operation and therefore this action does not form part of the Project.
The Project is expected to be undertaken over a 54 month period.
3.2.2 Aim
The aim of the Project is to allow the site to be utilised as a terminal where finished products would be
received by ship, stored in tanks and leave the site, predominantly by pipeline, to the Caltex
Banksmeadow Terminal, Silverwater Terminal, Joint User Facility at Sydney Airport, or to the Caltex
Newcastle Terminal via the Newcastle Pipeline.
The current capability for outloading via the wharf is to be retained, but would be used infrequently.
Under typical operations, road transport of products from the site would cease. However, in
exceptional circumstances, some road transport of product may be required.
3.3 THE PRELIMINARY HAZARD ANALYSIS
3.3.1 Scope
This PHA has identified and assessed hazards and risks associated with the following operational
areas of the proposed development:
Tank farm operations;
Wharf operations associated with fixed shore assets (i.e. excluding shipping activities); and
Associated pipelines and pumps.
15 May 2013 Page 13 of 43
3.3.2 Aim
The aim of the PHA is to:
Provide an assessment of the hazards and risks associated with the proposed works; and
Evaluate the calculated risk levels against the land-use planning criteria for off-site risk (as
specified in HIPAP4).
This aim is in accordance with the requirements of the NSW DP&I DGRs for the Project and is fully
consistent with Caltexs internal standards for the management of hazards and risks at its facilities.
The risk associated with the Project has been assessed quantitatively using the generally-accepted
QRA methodology.
To assess the off-site risk exposure, the following outputs were generated from the QRA model:
Individual risk of fatality contours;
Individual risk of injury contours;
Societal risk F-N curve; and
Risk of property damage and accident propagation.
In addition to this PHA report, Caltex has also undertaken a number of detailed internal Process
Hazard Analysis studies on the proposed design. These studies represent Caltexs collective
knowledge of the nature and type of hazards associated with both existing and proposed operations.
They are therefore considered an appropriate basis for the hazard identification step of this PHA.
15 May 2013 Page 14 of 43
4 SITE & PROJECT DESCRIPTION
4.1 PROJECT LOCATION
The Project Area is located at the site of the existing refinery, which is on the Kurnell Peninsula within
Sutherland Shire Local Government Area, approximately 15 km south of Sydneys CBD. The site and
Project Area are illustrated in Figure 2.
A site plan showing the existing operations is presented in Figure 3. The figure also highlights the
different land-uses that surround the site. There are a number of light-industrial sites located near the
western boundary. To the north, there is a mixture of commercial properties and residential areas.
The nearest residential areas are adjacent to the north-eastern corner of the site.
4.2 PROJECT DESCRIPTION
The Kurnell Refinery is to be converted from an operating refinery to a bulk liquid fuel terminal, storing
flammable and combustible liquids. The operations at Kurnell will be limited to wharf operations, tank
farm storage and associated pipelines and pumps for transfers of the fuels. The following sections
summarise the proposed operations at the facility.
4.2.1 Wharf Operation
Gasoline, jet fuel and fuel oil will be received by ship at the fixed berths of Kurnell Wharf. These fuels
will be then transferred to the terminal via two loading arms and associated pipelines. Receipt of
diesel will involve similar operations, however, it may also be received at the submarine berth. Slop
produced during terminal operations will be transferred to the wharf for loading onto ships.
A separate Development Application, EIS and Preliminary Hazard Analysis Report have been
produced addressing the hazards and risks associated with dredging, demolition and construction
activities, as well as those associated with operational activities due to the mooring of larger ships at
Kurnell Wharf (refer SSD-5353).
4.2.2 Tank Farm Operation
The flammable and combustible liquids received from the wharf are to be stored in the atmospheric
storage tanks of the tank farm. The Project will involve the continued use of parts of the existing
refinery plot, in a manner similar to that currently in place, for the storage and distribution of petroleum
products. A number of existing crude oil tanks would be cleaned and modified to allow for the storage
of refined product (i.e. conversion to finished product tanks). A small number of other tanks already
storing one type of refined product would be converted to store another refined product.
4.2.3 Associated Pipelines and Pumps
The flammable and combustible liquids unloaded at the wharf will be transferred via pipeline to
storage tanks within the tank farm. When required, these products will then be pumped via pipelines
from the storage tanks to the Banksmeadow Terminal for further distribution. These existing pipelines
run from the tank farm, out along the wharf before travelling beneath Botany Bay to Banksmeadow.
Lastly, slop will be pumped out to a fixed berth at the wharf, via a combination of new and existing
lines (referred to as Slop Lines).
15 May 2013 Page 15 of 43
Figure 2: Location of Site and Project Area
Site
Project Area
15 May 2013 Page 16 of 43
Figure 3: Site Plan [4]
15 May 2013 Page 17 of 43
5 METHODOLOGY
The methodology for conducting a PHA is well established in Australia. This assessment was carried
out as per the guidelines provided within HIPAP4 and HIPAP6. Consistent with the potential for a high
consequence event to occur at site, and the anticipated classification of the proposed terminal as a
Major Hazard Facility, the QRA methodology was used for the purpose of off-site risk determination.
The tolerability of the risk was assessed using the risk criteria specified in HIPAP4.
This section presents a summary of the QRA methodology applied to this project. The key steps in a
QRA are as follows:
Risk Assessment.
The approach applied in this study follows these basic steps. A flow chart illustrating this approach is
shown in Figure 4. Additional details on each of the steps are provided in the following sections.
15 May 2013 Page 18 of 43
Figure 4: Overview of QRA Methodology
5.1 HAZARD IDENTIFICATION
5.1.1 Data Collection
Data on the hazards at the site and details needed to complete the risk assessment were drawn from
technical information on the proposed Terminal operations. This information included the following, as
applicable:
Engineering drawings (e.g. process flow diagrams, piping and instrumentation diagrams
(P&IDs) etc.)
Major Accident Identification
Hazardous materials
Failure modes
Loss scenarios
P&IDs
Flow Diagrams
Emergency detection and
shutdown systems
Process Information
Workshops
Fire / Explosions
Flammable vapour dispersion
Toxic vapour dispersion
Impact Determination
Met data
Chemical
data
Emerg.
response
Plant and
equipment
layout
Fault Tree analysis
Event Tree analysis
End Event Frequency Determination
System data
Failure
data
Ignition
probabilities
Detection
and isolation
strategies
Risk Calculations
Individual risk
Societal risk
Population
data
Risk Evaluation
Determine risk acceptability
Risk
criteria
STOP
Acceptable
Not
Acceptable
Identify major risk
contributors
Propose risk
reduction measures
15 May 2013 Page 19 of 43
Site layout plans
Area plans
Major inventories of combustible, flammable and toxic substances stored / handled
Release detection and isolation strategies and systems
Release containment systems
Description of surrounding land use and estimates of population densities.
5.1.2 Scenario Development
The proposed activities for the facility when in terminal operation mode were defined to identify
potential hazardous scenarios. This process involved the completion of a Process Hazard Analysis
study by a suitably-qualified team of Caltex personnel. The study did not identify any major accident
hazards (MAHs) that were additional to those previously identified for refinery operations covering the
tank farm, wharf and sub-berth operations. Conversion to terminal operations will result in a number
of the previously-defined MAHs being eliminated. Terminal operations will not include liquefied gases
(e.g. propane, butane) or high-temperature / high-pressure processes, such as those present within
existing refinery operations. The use of liquid chlorine for biocide treatment of salt water cooling water
will also be discontinued.
The identified MAH scenarios involve the release / spill of flammable or combustible liquids resulting in
a fire when ignited. This could occur at various locations including storage tanks, pumps and loading
arms. These hazardous scenarios were analysed in the QRA, based on the associated material
properties and transfer operations. The QRA also evaluated the frequency and consequence of a
Buncefield-type vapour cloud explosion.
To determine the amount of material that could potentially be involved in a release, factors such as
inventory, leak detection, and leak isolation strategies were considered. Event tree models were
developed for each potential release scenario. As the most likely MAH scenarios involved the release
of flammable material, the main events considered in the analysis were pool fires resulting from an
ignited release.
5.2 FREQUENCY ASSESSMENT
The frequency assessment involved defining the potential release sources and then determining the
likelihood (frequency) of the various releases. The assessment is a two-stage process that involves
evaluating the release frequency and then estimating the likelihood of the possible outcomes of the
release using an event tree.
5.2.1 Scenario Frequency
The available engineering drawings for the facility were reviewed to develop a parts count of failure
items for each of the hazardous scenarios. Failure rates based on historical industry failure frequency
data were utilised to estimate the likelihood of the various hazardous scenarios. The failure rate data
for storage tanks, piping, valves, and other relevant equipment items was sourced from published
references and other appropriate sources. The failure rate data used in the study is presented in
Appendix B.
5.2.2 Event Tree Analysis
Where appropriate, event trees were developed to estimate the frequency of the potential
consequence events that may result from a given release scenario. This analysis incorporated the
effectiveness of proposed detection and isolation systems when assessing consequence events that
are most influenced by time.
5.3 CONSEQUENCE ASSESSMENT
Following the frequency assessment, the consequence events were identified. The potential impacts
of these events were assessed using the consequence models available within PHAST-RISK [5].
These models consider the nature of the release, including the release rate, discharge velocity and
duration. The models used to assess the impacts of the consequence events are outlined below.
15 May 2013 Page 20 of 43
5.3.1 Pool Fires
Pool fire impacts for bund fires, tank top fires and fires in the vicinity of pumps & pipelines were
determined using a solid flame model. The model represents the flame as a skewed cylinder that
radiates heat outwards. The dimensions of the skewed cylinder (flame length and flame tilt) are
defined using the empirical correlations within PHAST-RISK.
5.3.2 Vapour Cloud Explosions
A vapour cloud explosion (VCE) occurs following the ignition of a flammable vapour cloud, coupled
with acceleration of the flame front within the cloud. Within process areas, VCEs are typically
associated with the confinement provided by surrounding equipment that promotes mixing and,
subsequently, causes the flame front to accelerate.
The current analysis considered the potential for an explosion to result from a gasoline storage tank
overfill event. This type of event occurred at Buncefield (United Kingdom) in 2005. Investigations into
that incident concluded that the observed high levels of overpressure, and their rate of decay, are
difficult to reproduce with the standard explosion models [6] (e.g. the Multi-Energy Method [7]).
Therefore, the overpressure from these events was determined using information that was specifically
developed to assess explosions associated with tank overfills [8].
5.3.3 Vulnerability Models
In order to evaluate the risk profile, the effects of the pool fire and VCE events must be estimated in
terms of the potential to cause fatality or injury. Vulnerability models were used to correlate the impact
(e.g. heat radiation) of an event to the potential for fatality or injury. The vulnerability models used in
the study are described in Appendix A.
5.4 RISK ASSESSMENT
Both individual and societal risk results were generated to define the risk profile for terminal
operations. These results were produced by combining the frequency and consequence estimates for
each of the hazardous scenarios. The following risk measures were generated:
Location-specific individual risk (LSIR) contours for fatality and injury risk
A graphical representation of individual risk that uses the risk values at each point to
construct iso-risk contours. The contours are presented on a map showing the risk
relative to the proposed terminal and surrounding land-uses.
Societal risk F-N curve for off-site population
This is a societal risk measure that communicates the potential for hazardous
scenarios to cause multiple fatalities by plotting the frequency of N or more fatalities
(F) against the number of fatalities (N). This is presented as a graph.
Calculation of the societal risk measures requires knowledge of the population distribution surrounding
the site. The following information is required for each location where people may be present (refer to
Appendix D):
Geographical location;
Number of people present at different times of the day;
Percentage of people located indoors; and
Building type (if applicable).
From the individual risk results, a list of risk contributors at specific locations was determined. This
allowed the major contributors to the risk to be identified, as well as the most influential hazardous
scenarios. From this information, targeted risk reduction actions can be readily identified that will
deliver the most effective risk reduction outcome (i.e. the greatest reduction in risk).
5.5 STUDY ASSUMPTIONS
In conducting the QRA, a number of technical assumptions were made. The key technical
assumptions are described in Appendix A.
15 May 2013 Page 21 of 43
6 RISK CRITERIA
The tolerability of the calculated risk is assessed by comparison with an appropriate risk target or
criterion. The risk criteria used to make this assessment are specified in HIPAP4 [2]. The risk criteria
are detailed below.
The individual risk of fatality criteria described in HIPAP4 that are applicable to proposed hazardous
developments are as follows:
Hospitals, schools, child-care facilities and old age housing development should not be
exposed to individual fatality risk levels in excess of half in one million per year (0.5 x 10
-6
per
year).
Residential developments and places of continuous occupancy, such as hotels and tourist
resorts, should not be exposed to individual fatality risk levels in excess of one in a million per
year (1 x 10
-6
per year).
Commercial developments, including offices, retail centres, warehouses with showrooms,
restaurants and entertainment centres, should not be exposed to individual fatality risk levels
in excess of five in a million per year (5 x 10
-6
per year).
Sporting complexes and active open space areas should not be exposed to individual fatality
risk levels in excess of ten in a million per year (10 x 10
-6
per year).
Individual fatality risk levels for industrial sites at levels of 50 in a million per year (50 x 10
-6
per
year) should, as a target, be contained within the boundaries of the site where applicable.
These criteria were developed based on a principle that if the risk from a potentially hazardous
installation is less than most risks being experienced by the community (e.g. voluntary risks,
transportation risks), then that risk may be tolerated. This principle is consistent with the basis of risk
criteria adopted by most authorities internationally.
The criterion for residential areas is demonstrably very low in relation to the background risk. It is
considered conservative, as it assumed an individual is present and exposed for 24 hours per day,
365 days per year.
HIPAP4 also outlines risk criteria for effects that may cause injury to people but will not necessarily
cause fatality. The injury risk criteria are separated based on the different effect types, i.e., heat
radiation, explosion overpressure and toxic exposure. HIPAP4 sets the following injury risk criteria:
Heat flux radiation at residential and sensitive use areas should not exceed 4.7 kW/m
2
at a
frequency of more than 50 x 10
-6
per year.
Explosion overpressure at residential and sensitive use areas should not exceed 7 kPa at
frequencies of more than 50 x 10
-6
per year.
Toxic concentrations at residential and sensitive use areas should not exceed a level which
would be seriously injurious to sensitive members of the community following a relatively short
period of exposure at a maximum frequency of 10 x 10
-6
per year.
6.3 SOCIETAL RISK CRITERIA
The NSW DP&I has adopted indicative criteria to assess the off-site societal risk. The criteria take into
account the fact that society is particularly intolerant of accidents, which although infrequent, have the
potential to cause multiple fatalities. The criteria are presented on the F-N graph in Figure 5. The
criteria define three risk regions as follows [2]:
Intolerable: above the intolerable line, the activity is considered undesirable, even if
individual risk criteria are met.
ALARP (as low as reasonable practicable): within the ALARP region, the emphasis should
be on reducing risk as far as possible towards the negligible line (i.e. ensuring that risks have
been reduced to as low as reasonably practicable). Provided other quantitative and qualitative
criteria of HIPAP 4 are met, the risks from the activity may be considered tolerable within the
15 May 2013 Page 22 of 43
ALARP region as long as all reasonably practical risk reduction measures have been
implemented.
Negligible: below the negligible line the societal risk is not considered significant, provided
other individual risk criteria are met.
Figure 5: Indicative Societal Risk Criteria [2]
HIPAP4 sets risk criteria that reflect the potential for property damage and accident propagation.
Assessment against the criteria provides an indication of the risk that an accident at the facility may
cause damage to buildings and / or propagate to involve neighbouring industrial operations, causing
further hazardous incidents, i.e. the so-called domino effect. HIPAP4 sets the following criteria for
risk of damage to property and accident propagation:
Heat flux radiation at neighbouring potentially hazardous installations, or at land zoned to
accommodate such installations, should not exceed a risk of 50 x 10
-6
per year for the
23 kW/m
2
heat flux level.
Explosion overpressure at neighbouring potentially hazardous installations, at land zoned to
accommodate such installations or at nearest public buildings should not exceed a risk of
50 x 10
-6
per year for the 14 kPa explosion overpressure level.
HIPAP4 outlines risk criteria addressing the risk from accidental releases to biophysical environment.
The criteria focuses on the potential acute and chronic toxic impacts that an accidental release may
have on whole systems and populations, rather than individual plants or animals. HIPAP4 expresses
the criteria as follows:
Industrial developments should not be sited in proximity to sensitive natural environmental
areas where the effects (consequences) of the more likely accidental emissions may threaten
the long-term viability of the ecosystem or any species within it.
Industrial developments should not be sited in proximity to sensitive natural environmental
areas where the likelihood (probability) of impacts that may threaten the long-term viability of
the ecosystem or any species within it is not substantially lower than the background level of
threat to the ecosystem.
1.00E-09
1.00E-08
1.00E-07
1.00E-06
1.00E-05
1.00E-04
1.00E-03
1.00E-02
1.00E-01
1 10 100 1000
F
r
e
q
u
e
n
c
y

o
f

N

o
r

m
o
r
e

f
a
t
a
l
i
t
i
e
s

(
F
,

/
y
e
a
r
)
Intolerable
Negligible
ALARP
15 May 2013 Page 23 of 43
7 HAZARD IDENTIFICATION
The hazard identification phase involved a review of the planned terminal operations, engineering
diagrams and other relevant information. This material was used to identify all sections of the facility
that would contain hazardous material during future operations.
7.1 HAZARDOUS MATERIALS
The nature of the hazardous materials identified in the study was reviewed from information contained
in the Material Safety Data Sheets (MSDSs) supplied by Caltex. The materials that are to be stored
on-site are:
Gasoline (ULP / PULP / SPULP)
Jet fuel
Diesel
Fuel oil
Slop.
Slop was assumed to be a mixture of diesel and gasoline. For the purpose of this analysis, slop was
assumed to have the properties of gasoline. A list of hazardous materials identified and their
respective properties is presented in Table 4.
Table 4: Materials Properties [9, 10, 11, 12, 13, 14, 15]
Material
Name
Dangerous
Goods
Class
UN No.
HAZCHEM
Code
Flash
Point
(C)
Auto-Ignition
Temperature
(C)
Flammability
limits
(in air)
Gasoline 3 1203 3YE -40 370 1.4 - 7.4%
Jet Fuel 3 1863 3Y 40 >210 0.7 - 6.0%
Diesel C1 - - >61.5 >250 1.3 - 6.0%
Fuel Oil C1 - - >61.5 - 1.0 - 5.0%
7.2 ISOLATABLE SECTIONS
Within the QRA model, the hazardous scenarios developed following a release are dependent on the
conditions in the corresponding isolatable section. These conditions were used in the consequence
modelling for each hazardous scenario and include:
Material
Process conditions (e.g. temperature and pressure )
State (i.e. vapour or liquid)
Inventory
Flow rate
Utilisation (i.e. percentage of the time in use).
7.3 HAZARDOUS SCENARIOS
Hazardous scenarios were developed to represent the range of possible failures associated with each
isolatable section. These failure modes were represented as releases from selected hole sizes.
For the wharf operations, the following two failure cases associated with the loading / unloading arms
were considered:
Full bore release hole size equivalent to diameter of the loading arm (approximately 250
mm)
Medium release hole size equivalent to 10% of cross-sectional area of the loading arm
(approximately 80 mm).
15 May 2013 Page 24 of 43
For other equipment, a maximum of five hole sizes were considered in the analysis to represent the
full range of potential failure modes. This range of hole sizes was considered for storage tanks,
pumps and associated internal pipelines. The hole sizes used to define the hazardous scenarios are
presented in Table 5.
Table 5: Representative Hole Sizes
Hole Size Category Representative Hole Size Hole Size Range
Small 5 mm d
h
5 mm
Medium 20 mm 5 mm > d
h
20 mm
Large 50 mm 20 mm > d
h
50 mm
Very Large 100 mm 50 mm > d
h
150 mm
Rupture Full bore d
h
> 150 mm
For some isolatable sections, the hole sizes presented in Table 5 were adjusted to better represent
the connections and/or piping included in that section of the process. For pipelines and pumps, the
pipe diameter was used as the hole size representing the Rupture category. For atmospheric
storage tanks and associated piping, the hole sizes representing the Very Large and Rupture
categories were adjusted as necessary to reflect the larger hole sizes associated with equipment
within the tank farm. The hole size representing the Very Large case was increased to 150 mm and
the Rupture case was assigned the size of the largest connection to the tank.
The full list of hazardous scenarios considered in the risk assessment is provided in Appendix E.
The additional hazardous scenario of tank overfill was considered for the gasoline storage tanks. This
was considered to ensure the QRA examined the range of possible consequences associated with a
tank farm, including the explosion of a vapour cloud formed following a release (refer to Section 7.4.2).
7.4 CONSEQUENCE EVENTS
7.4.1 Pool Fires
For the identified hazardous scenarios, the potential consequence events were mainly pool fires. A
pool fire is a turbulent diffusion flame, burning above a horizontal pool of vaporising flammable liquid,
with little or no momentum. The flame can emit fatal levels of radiant heat to the surrounding area.
Pool fires will result following the ignition of a continuous or instantaneous release of flammable
hydrocarbon liquids stored at atmospheric conditions.
The size of a pool fire is determined by operating conditions, the burning rate of material and the
presence of spill containment. The location of each isolatable section was reviewed to assess the
presence of spill containment for consideration in the modelling. The main types of scenarios
considered in the QRA are discussed below, with the associated spill containment:
Wharf Operations
A pool fire resulting from the ignition of a release from a loading arm. Spill containment is
provided that will limit the pool size [16].
Tank Farm
A pool fire resulting from the ignition of a release from a storage tank (and/or associated
equipment) into the surrounding bund. The size of a pool fire was limited to the surface area
of the bund (excluding the tank area).
A full-surface tank fire could occur following an internal explosion of a cone roof tank or the
sinking of a floating roof tank. The fire size was limited to the diameter of the tank.
Pipelines
A pool fire resulting from the ignition of a release from a pipeline. Pipelines either run inside a
pipe trench or on the pipeway edge, with the ground underneath sloping towards the pipe
trench. The diameter of the fire was limited to the trench width.
15 May 2013 Page 25 of 43
Pumps
A pool fire resulting from the ignition of a release from a pump. In most cases, the pumps
were located within a kerbed area, with an internal drain to the oily water sewer (OWS). The
pool size was limited to the kerbed area.
7.4.2 Vapour Cloud Explosion
In December 2005 at the Buncefield Oil Storage Depot in the UK, a number of explosions and a
subsequent fire occurred. These destroyed a large part of the facility, caused widespread damage to
the surrounding homes and businesses, resulted in 43 injuries and disruption to the local community
[17]. The fire burned for five days and emitted a large plume of smoke into the atmosphere.
The subsequent investigation determined that the incident was due to the overfilling of a fuel storage
tank containing unleaded petrol. A delivery of fuel from the pipeline feeding the tank started and the
safety systems in place to shut-off the supply of fuel to prevent overfilling failed to operate. Petrol
cascaded down the side of the tank and began to collect in the bund. As overfilling continued, the
vapour cloud formed by the mixture of petrol and air flowed over the bund wall and travelled off-site
towards the nearby industrial estate. A white mist was observed in CCTV replays of the event. The
exact nature of the mist is not known with certainty: it may have been a volatile fraction of the original
fuel, such as butane, or ice particles formed from the chilled, humid air as a consequence of the
evaporation of the escaping fuel.
The vapour cloud was believed to have ignited in the industrial estate car park and the main explosion
was massive. Subsequent explosions and a huge fire also occurred. The main explosion at the
Buncefield depot was unusual because it generated much greater overpressures than would usually
have been expected from a vapour cloud explosion. The mechanism of the violent explosion was the
subject of additional research. Phase 1 of this research [18] indicated a likely sequence of events
(although could not fully explain all the damage based on the theory). It was surmised that the gas
cloud was ignited by a source at the emergency fire water pump house and a slow flame propagated
outwards in all directions. When it reached a line of trees and vegetation in the lane outside the site,
the flame accelerated along the tree lined road. The deflagration explosion transitioned to a
detonation event further along the road. The detonation travelled in all directions, leading to a high
overpressure within the flammable gas cloud and high amounts of damage over the affected area.
Outside the gas cloud, the detonation became a blast wave which decayed rapidly with distance, due
to the shallow nature of the flammable gas cloud.
As a result of the incident and the subsequent analysis, this type of incident is now considered
important to include when assessing the risk associated with bulk fuel storage facilities. Although this
type of event is considered to have a very low likelihood of occurrence, the high explosion
overpressures that may result could cause significant far-field damage.
A scenario of this type was included in the QRA model. The scenario considered an overfill event
associated with the 16 tanks that will store varieties of unleaded petrol. To quantify the risk, a detailed
analysis was completed to determine the frequency and consequence of an overfill event. The overfill
event frequency was determined by considering the frequency of filling operations and the controls in
place that would act to prevent the event. The consequence assessment was completed based on
knowledge developed following the investigation of the Buncefield incident [8, 18].
7.5 MAJOR ACCIDENT HAZARDS
Caltex revised the list of MAHs developed for Refinery Operations to include only those relevant to
future terminal operations. Where appropriate, each hazardous scenario identified within the QRA
was linked to an MAH. The resulting list of MAHs is presented in Table 6.
15 May 2013 Page 26 of 43
Table 6: List of Caltex MAHs for new Terminal
Relevant Area
MAH
Number
MAH Description
Considered
in QRA
Loc. Wharf
WRF-001
Low flash point liquid hydrocarbon loading/
unloading / Large scale loss of containment
Y
WRF-003
High flash point liquid hydrocarbon loading/
Y
Loc. Sub Berth
SUB-005
High flash point hydrocarbon loading/
Y
Loc. atmospheric tanks at
tank farm & associated
pumps and pipelines
OMC-001
Hydrocarbon vapour inside empty tank /
Ignition during maintenance
N
OMC-002
Low flash point hydrocarbon storage &
transfer / Large scale loss of containment
Y
OMC-003
High flash point hydrocarbon storage &
transfer / Large scale loss of containment
Y
15 May 2013 Page 27 of 43
8 FREQUENCY ASSESSMENT
8.1 FAILURE FREQUENCY
The likelihood of a potential release of a material from an isolatable section was determined from the
likelihood of equipment failure within that section. Any of the identified equipment items or fittings
within the isolatable section could potentially fail and result in a release. For each isolatable
section, the frequency assessment involves counting the number of items (e.g. flanges, valves and
instrument fittings) and summing their individual failure rates, to obtain the overall failure frequency.
This parts count process was conducted using P&IDs, which detailed the items included within each
isolatable section.
A full parts count was completed for equipment configurations unique to particular sections within the
facility. The results of these full parts counts were then applied to similar equipment configurations.
For example, for a group of similar storage tanks, the full parts count completed for one storage tank
was then applied to the others within the group.
For each isolatable section, the overall failure frequency was distributed across the selected hole
sizes. This frequency distribution was then used to determine the likelihood of the corresponding
hazardous scenarios.
The frequency assessment used available historical failure rate data from the following public sources:
UK HSE - Failure Rate used for Land Use Planning Risk Assessments [19]
International Association of Oil & Gas Producers - Storage Incident Frequencies [20]
E & P Forum - Hydrocarbon Leak and Ignition Data Base [21].
These sources provide the failure rate data for equipment items and fittings, and the corresponding
failure rate distribution for a range of hole sizes. The failure rate data used in the QRA is summarised
in Appendix B.
The failure rate data obtained from public sources was used in the QRA without modification. No
specific characteristics, such as environmental factors, were identified that would require the failure
data to be modified. For example, no unusually harsh conditions are experienced at the Kurnell site
that would cause failure modes, such as corrosion, to occur at significantly higher rates than those
typical across industry. Additionally, in Terminal operations, Caltex will continue to use its established
integrity management processes, which are largely-based on industry standards. It is expected that
these established processes will serve to maintain integrity management performance at a level that is
at least equal to the performance reflected within the failure rate data used in the QRA model. Caltex
also has established processes for corporate audits, insurance engineering surveys and external
audits. These provide assurance on the effectiveness of these integrity management processes.
Therefore, it is considered reasonable to use the data summarised in Appendix B without modification.
8.2 EVENT TREE ANALYSIS
Event trees were used to estimate the frequency of a consequence event for a given release scenario.
Event tree analysis provides a systematic means of determining which factors will influence the
release, in addition to the probability associated with each of those factors.
The following parameters are generally considered in event tree analysis:
Probabilities of release detection and isolation
Time taken to detect and isolate the release
Probability of ignition (immediate ignition and delayed ignition)
An example event tree structure incorporating release detection and isolation times is presented in
Figure 6.
15 May 2013 Page 28 of 43
Figure 6: Event Tree Structure (Detection and Isolation Component)
In this analysis, a targeted approach was used to determine whether the release detection and
isolation times were included in the event tree analysis for a given scenario. These factors were only
considered for the hazardous scenarios with consequence events that were significantly influenced by
the failure to isolate. For other hazardous scenarios and consequence events (i.e. those where
isolation and detection did not significantly affect the contribution to the risk profile), event tree
analysis was not conducted.
8.3 TANK OVERFILL / EXPLOSION FREQUENCY
A detailed assessment was conducted to determine the frequency of an explosion following the overfill
of a storage tank containing unleaded petrol. The assessment did not consider tanks containing jet
fuel or diesel because these substances do not contain the light hydrocarbon components necessary
to form a large vapour cloud following an overfill event.
The frequency of an explosion following tank overfill was evaluated using a fault tree to assess the
overfill frequency and an event tree to quantify the explosion event frequency. The fault tree analysis
determined the frequency of a significant overfill resulting from an error during tank filling operations.
The analysis considered the following factors:
The number of filling operations;
The probability of operator error; and
The controls in place to prevent overfill and their effectiveness.
The investigations into the Buncefield incident developed a series of recommendations for operators
of bulk fuel storage depots. These recommendations were targeted at reducing the risk of an incident
of this nature. In transitioning to Terminal operations, Caltex performed a gap assessment against
these recommendations. This assessment helped to identify appropriate controls for an overfill /
explosion scenario involving the gasoline storage tanks. A full list of the Buncefield recommendations
is reproduced in Appendix C.
Based on the assessment, Caltex have adopted improved controls for tankage. A number of listed
controls are already in place with the others to be implemented during the Terminal transition.
15 May 2013 Page 29 of 43
Table 7: Tank Overfill / Explosion Controls
Type of Control Controls
Prevention controls Primary level indication with high level alarm (radar gauge)
Independent level indication with high-high level alarm
Independent SIL-rated trip of tank inlet valve on high-high-high level
alarm
Tank design and maintenance program in accordance with industry
good practice
Continuous monitoring of tank inventory from a centralised control
room
Operating procedures controlling quantity of material transferred
Classification of hazardous areas and selection of equipment and
protective systems is conducted in accordance with Australian
Standards HB13-2007 and AS2381
All tanks have installed earthing and maintenance program
Detection Flammable gas detectors and control room alarms for tank
compounds of low flash point flammable liquids
Remote CCTV monitoring for tank compounds of low flashpoint
flammable liquids
Tank top infra-red flame detection for low flash point flammable liquid
storage tanks
Routine operator tank farm inspections
Isolation Remote-actuated fire-rated tank inlet / outlet valves
Spill Response Bund capacity, design and construction equivalent compliance to
AS1940
Primary response capability to apply foam up to, and including, full
bund surface area of largest tank compound
Tank bund drainage isolation valves operable external to bund
Event Response Tank separation distances compliant to s5.7 of AS1940.
Caltex personnel trained in advanced fire fighting techniques,
specific Caltex equipment and incident management approach
common to Fire & Rescue NSW.
Facility Emergency Plan & Pre-incident plans.
The fault tree analysis considered those controls that would directly act to prevent the tank overfill
(e.g. tank level indication with high level alarm) or limit the amount of material released (e.g. gas
detector linked to an alarm). For each control, the effectiveness was determined by quantifying the
reliability of individual components. Where controls relied on human intervention, the derived
effectiveness accounted for the probability of operator error within the time required to respond.
The event tree analysis estimated the frequency of an explosion resulting from the ignition of a
significantly large vapour cloud formed following an overfill. In assessing the outcome frequency, the
following factors were considered:
Ignition probability;
The probability of stable weather conditions (i.e. atmospheric stability category F); and
The probability of a low wind speed that would result in the formation of a significantly large
vapour cloud.
The explosion event frequency was estimated to be less than 0.01 in a million per year (<110
-8
per
year). This event is not considered to be a significant contributor to the overall risk profile. In
comparison, the average risk of fatality from a lightning strike is 0.1 in a million per year (110
-7
per
year) [2].
15 May 2013 Page 30 of 43
9 CONSEQUENCE ANALYSIS
For each hazardous scenario, consequence modelling was conducted for a range of hole sizes. The
consequence modelling determined the area impacted by each consequence event. The
consequence modelling was conducted using the software package PHAST-RISK [5]. The models
within PHAST-RISK were used to determine the consequence impact distances for the heat radiation
from the pool fires.
The consequence impact distances for each effect type depends on the following conditions:
Release conditions (temperature, pressure, hole size and duration)
Release source (elevation, orientation)
Chemical properties
Atmospheric conditions (wind speed).
Independent of their likelihood, several pool fire events and the VCE events were considered to have
potential to cause an off-site fatality and / or injury. These results are summarised in Table 8, grouped
by MAH. Table 9 lists a number of locations along the facility boundary where the MAHs have the
potential for off-site fatality. Of these locations, only those positions adjacent to storage tanks are
impacted by the scenarios considered in the QRA model.
Table 8: Consequence Events with Off-site Fatality or Injury Impact
MAH
Related Isolatable
Sections
Consequence
Description
Offsite Impact
OMC-002, OMC-003
Storage tanks adjacent the
North-Eastern, Eastern and
Western boundaries
"Very large" spill fire Injury Only
Full-surface bund fire Fatality and injury
OMC-002, OMC-003
Transfer pipelines between
wharf and terminal pipeway
Fire following a large
release from pipeline
Fatality and injury
OMC-002
Storage tanks near the
North-Eastern and Eastern
boundaries
VCE following a tank
overfill event
Fatality and injury
Table 9: Off-site Locations Potentially Impacted by MAH Scenarios
Location Event Type MAH No.
Intersection of Silver Beach Road and Captain
Cook Drive
Not impacted
Kurnell Social Club Not impacted
Cook Street Boundary
Full-surface bund
fire
OMC-002
VCE following a
tank overfill event
OMC-002
Reserve Road Boundary
Full-surface bund
fire
OMC-002
VCE following a
tank overfill event
OMC-002
National Park Boundary
VCE following a
tank overfill event
OMC-002
Chisholm Rd Commercial Premises
Full-surface bund
fire
OMC-003
Sir Joseph Banks Drive Boundary Not impacted
HCE Boundary
Full-surface bund
fire
OMC-003
To provide guidance on the impact experienced from different fire events, the downwind impact
distance for a number of consequences are presented in Table 10. These are measured from the
centre point of the storage.
15 May 2013 Page 31 of 43
Table 10: Typical Impact Distances for Fire Scenarios
Event
Distance to fatality
(approx 12.5 kW/m
2
)
Distance to injury
(approx 4.7 kW/m
2
)
Full surface tank fire up to 50 m
diameter
Typically not reached at
ground level outside of bund
Full surface tank fire up to 78 m
diameter
Full bund fire up to 8000 m
2
62 m 130 m
Full bund fire up to 25,500 m
2
101 m 194 m
Fire from catastrophic failure of any
transfer pipeline
26 m 60 m
Fire from catastrophic failure of any
loading arm
20 m 35 m
Due to the relative height of the storage tanks and the observer, the heat flux radiation experienced
from a full-surface tank fire does not exceed injury levels under average weather conditions.
15 May 2013 Page 32 of 43
10 RISK ASSESSMENT
Individual risk was determined by combining the frequency and consequence data for each hazardous
scenario. Individual risk contours were developed by plotting lines that connect different locations
experiencing the same levels of risk. The individual risk of fatality contours are presented in Figure 7.
Figure 7: Location-Specific Individual Risk of Fatality (Off-site Assessment)
The risk results were compared to the risk criteria to determine the tolerability of the risk from the
proposed operations. The particular aspects of the risk criteria applicable to this study were [2]:
Hospitals, schools, child-care facilities and old age housing development should not be
exposed to individual fatality risk levels in excess of 0.5 x 10
-6
per year.
Reserve Road
Refinery Boundary
Chisholm Road
Refinery Boundary
Cook Street
Refinery Boundary
15 May 2013 Page 33 of 43
Residential developments and places of continuous occupancy, such as hotels and tourist
resorts, should not be exposed to individual fatality risk levels in excess of 1 x 10
-6
per year.
Commercial developments, including offices, retail centres, warehouses with showrooms,
restaurants and entertainment centres, should not be exposed to individual fatality risk levels
in excess of 5 x 10
-6
per year.
Sporting complexes and active open space areas should not be exposed to individual fatality
risk levels in excess of 10 x 10
-6
per year.
Individual fatality risk levels for industrial sites at levels of 50 x 10
-6
per year should, as a
target, be contained within the boundaries of the site where applicable.
The 0.5 x 10
-6
per year risk contour extends off-site in some areas but does not extend to sensitive
areas such as the pre-school, which is located to the north of the Terminal boundary on Captain Cook
Drive. This aspect of the criteria is therefore satisfied.
The 1 x 10
-6
per year risk contour extends off-site in some areas but does not extend to residential
areas. This aspect of the criteria is therefore satisfied.
The 5 x 10
-6
per year risk contour extends off-site in some areas but does not extend to commercial
developments. This aspect of the criteria is therefore satisfied.
The 10 x 10
-6
per year risk contour extends off-site in some areas but does not extend to active open
space such as the Kurnell Recreational Club, which is located to the west of the Terminal boundary on
Captain Cook Drive. This aspect of the criteria is therefore satisfied.
The analysis has found the 50 x 10
-6
per year individual risk level does not exceed the site boundary.
This aspect of the criteria is therefore satisfied.
The tolerability of the fatality risk results is summarised in Table 11.
Table 11: LSIR Fatality Risk Tolerance Criteria [2]
Land Use
Tolerance Criteria
year)
LSIR Results
Sensitive areas, such as hospitals and schools 0.5
The relevant LSIR
contours do not
extend to each of
these areas.
All criteria are
satisfied.
Residential developments and continuous
occupancy, such as hotels and resorts
1.0
Commercial developments, including retail
centres, offices and entertainment centres
5
Sporting complexes and active open space 10
Industrial areas 50
The model was used to determine the consequence events that contribute to the risk at different
locations along the boundary. Risk contributors were identified at locations corresponding to the
Reserve Road Boundary and the Chisholm Rd boundary (refer to Figure 7). The risk contributors at
these locations are presented in Table 12.
15 May 2013 Page 34 of 43
Table 12: Risk Contributors
Location Contributing Consequence Event MAH No. Risk Contribution
Reserve Road
Refinery Boundary
Full-surface bund fire associated
with storage tanks near the north-
eastern and eastern boundaries
OMC-002 98%
VCE following a tank overfill event
associated with storage tanks near
the north-eastern and eastern
boundaries
OMC-002 2%
Cook Street
Refinery Boundary
with storage tanks near the north-
eastern and eastern boundaries
OMC-002 98%
VCE following a tank overfill event
associated with storage tanks near
the north-eastern and eastern
boundaries
OMC-002 2%
Chisholm Road
Refinery Boundary
with storage tanks near the western
boundary
OMC-002 100%
15 May 2013 Page 35 of 43
The injury risk results were generated by applying the impairment criteria defined in Section 6.2. The
resulting individual risk of injury contour for heat radiation is presented in Figure 8. A corresponding
individual risk of injury contour for explosion overpressure is not presented because the explosion
event frequency is below the criterion level.
Figure 8: Location-Specific Individual Risk of Injury Heat Radiation (50 x 10
-6
per year)
15 May 2013 Page 36 of 43
The tolerability of results was determined by comparison with the HIPAP4 injury risk criteria [2]. As the
consequence events analysed were pool fires and an explosion resulting from a tank overfill event (i.e.
no toxic vapour dispersion), the particular aspects of the risk criteria applicable to this study were:
Heat flux radiation at residential and sensitive land-use areas should not exceed 4.7 kW/m
2
at
a frequency of more than 50 x 10
-6
per year.
Explosion overpressure at residential and sensitive land-use areas should not exceed 7 kPa at
frequencies of more than 50 x 10
-6
per year.
The 50 x 10
-6
per year individual risk of injury risk contour for heat flux radiation is mostly contained
on-site, only extending beyond boundary in the north-east section of the terminal. However, it does
not reach residential areas or sensitive areas (e.g. the pre-school, which is located to the north of the
terminal on Captain Cook Drive). This aspect of the criteria is therefore satisfied.
The risk of explosion calculated for a tank overfill event was below 50 x 10
-6
per year. Consequently,
an injury risk plot for explosion overpressure is not presented, as the risk does not exceed the criteria
level of 50 x 10
-6
per year at any location. This aspect of the criteria is therefore satisfied.
The injury risk criteria for toxic exposure was not applicable, as the QRA did not involve scenarios
which could result in this type of event. The acceptability of the injury risk criteria is summarised in
Table 1.
Table 13: LSIR Injury Risk Tolerance Criteria [2]
Individual Injury Risk Criteria
Tolerance Criteria
year)
Tolerability
Incident heat flux radiation at residential
and sensitive areas exceeding 4.7 kW/m
2
.
50
areas. The criteria is met.
residential and sensitive use areas should
not exceed 7 kPa at frequencies.
50
Toxic concentrations in residential and
sensitive use areas exceed a level which
would be seriously injurious to sensitive
members of the community following a
relatively short period of exposure.
10
Not applicable, as the QRA
did not involve scenarios
which could result in this
type of event.
15 May 2013 Page 37 of 43
10.3 SOCIETAL RISK OFF-SITE POPULATION
The societal risk exposure for the off-site population was assessed using an F-N curve and the
indicative societal risk criteria described in HIPAP4 [2]. The F-N curve for the Project is presented
in Figure 9, which also shows the indicative societal risk criteria.
Figure 9: Societal Risk Results Off-site Population
As can be seen from Figure 9, the F-N curve lies below the negligible line. In this region, the
societal risk is not considered significant, provided other individual risk criteria are met. As described
in the preceding sections, the individual risk criteria for fatality and injury are satisfied and therefore
the societal risk is also considered tolerable.
The risk of property damage and accident propagation was assessed using the impairment criteria
defined in Section 6.4. The resulting risk contour for heat radiation is presented in Figure 10. A
corresponding risk contour for explosion overpressure is not presented because the explosion event
frequency is below the criterion level.
1.00E-09
1.00E-08
1.00E-07
1.00E-06
1.00E-05
1.00E-04
1.00E-03
1.00E-02
1.00E-01
1 10 100 1000
F
r
e
q
u
e
n
c
y

o
f

N

o
r

m
o
r
e

f
a
t
a
l
i
t
i
e
s

(
F
,

/
y
e
a
r
)
Intolerable
Negligible
ALARP
15 May 2013 Page 38 of 43
Figure 10: Location-Specific Risk of Property Damage and Accident Propagation Heat
Radiation (50 x 10
-6
per year)
The tolerability of results was determined by comparison with the following risk criteria defined within
HIPAP4 [2]:
Incident heat flux radiation at neighbouring potentially hazardous installations or at land zoned
to accommodate such installations should not exceed a risk of 50 x 10
-6
per year for the
23 kW/m
2
heat flux level.
15 May 2013 Page 39 of 43
Incident explosion overpressure at neighbouring potentially hazardous installations, at land
zoned to accommodate such installations or at nearest public buildings should not exceed a
risk of 50 x 10
-6
per year for the 14 kPa explosion overpressure level.
The 50 x 10
-6
per year risk contour for heat flux radiation is contained on-site. Therefore, it does not
reach neighbouring areas, including potentially hazardous installations. This aspect of the criteria is
satisfied.
In Figure 10, the 50 x 10
-6
per year risk contour appears as numerous individual sections of the same
contours that are limited to the immediate area. For example, within the Tank Farm, different sections
of the contours are contained within the corresponding bunded area. This demonstrates that these
contours do not extend to impact surrounding infrastructure, such as storage tanks within adjoining
areas.
The risk of explosion at the facility did not exceed 50 x 10
-6
per year. Consequently, a risk plot for
explosion overpressure is not presented, as the risk does not exceed the criteria level of 50 x 10
-6
per
year at any location. This aspect of the criteria is therefore satisfied.
The acceptability of the risk criteria is summarised in Table 1.
Table 13: Risk of Property Damage And Accident Propagation Tolerance Criteria [2]
Risk Criteria
Tolerance Criteria
year)
Tolerability
Incident heat flux radiation at neighbouring
potentially hazardous installations or at
land zoned to accommodate such
installations for the 23 kW/m
2
heat flux.
50
areas. The criteria are
met.
neighbouring potentially hazardous
installations, at land zoned to
accommodate such installations or at
nearest public buildings for the 14 kPa
explosion overpressure level
50
The risk to the biophysical environment examines the potential effects on the long-term viability of the
ecosystem or any species within it. The risk was assessed by examining release scenarios
associated with the operations of the facility. In assessing the potential impact, the analysis
considered the controls that would prevent, or mitigate, the impact an incident could have on the
surrounding environment.
For the wharf, the QRA identified release scenarios at the product loading arms and the pipelines
along the wharf. A release from this equipment could affect the marine environment of Botany Bay.
However, there are a number of controls in place that would minimise the potential for a release. The
equipment items are subject to testing and inspection programs, in line with Caltex integrity
management programs. During unloading operations, there are personnel in attendance who, if a
release occurred, would be able to detect the leak and isolate the source. Additionally, a spill at the
loading arms would be contained within the purpose-built spill containment areas. These factors will
limit the amount of material that would typically be released following a failure. A release of product at
the wharf is not considered likely to threaten the long-term viability of the ecosystem.
For the tank farm, the QRA identified release scenarios at the product storage tanks, as well as the
associated pipelines and pumps. The potential for release from this equipment is managed by Caltex
through a maintenance program to ensure the integrity of equipment. If a release occurs, it would be
contained within the bunded areas surrounding storage tanks and pumps or within the pipeways.
Impacts to surrounding ecosystems would be negligible. A release would be identified by the spill
15 May 2013 Page 40 of 43
detection within the Terminal that includes routine operator surveillance, routine dead tank
monitoring and flammable vapour detection. An appropriate response would then be activated to
clean-up a spill. Additionally, the containment areas can be drained to the oily water system, where
product would be retained, preventing the discharge of any remaining product direct to the
environment. Therefore, a release of product within the terminal would not threaten the long-term
viability of the ecosystem.
Caltex also maintains an Environmental Aspects and Impacts Register, as part of its requirements for
compliance with ISO 14001 [22]. The register identifies potential sources of accidental release,
assesses the potential consequence, identifies key risk controls and ranks the risk using Caltexs
Riskman2 process.
10.6 SENSITIVITY ANALYSIS
QRA models are developed based on a number of assumptions with some assumptions being more
influential than others. The assumptions used in the current study were reviewed to determine those
that could influence the risk results. Assumptions related to the following areas were considered most
influential:
Frequency Data, including modification factor and utilisation
Pool Fire Modelling; and
Heat Radiation Vulnerability.
The frequency data used in the analysis was obtained from available public source. For reasons
outlined in Section 8.1, this frequency data was applied in the QRA without modification. A sensitivity
analysis was conducted to determine the influence possible modifications would have in the results.
This analysis involved doubling the frequency used in the model, i.e. a doubling of the failure rate.
Although there was a change in the individual risk of fatality contours, these changes did not result in
any of the risk contours exceeding the applicable criteria and therefore the conclusions made
regarding risk tolerability were unchanged.
A number of assumptions were made concerning the modelling of pool fires. The magnitude of the
pool fire consequences depends on the selected representative material, operating pressure and spill
containment size. Of these parameters, the greatest variable observed is the operating pressure (and
tank level), which influences the release rate and pool fire size. While a change in pressure or level
would result in large pool forming, the physical spill containment would limit the pool size and
subsequent fire size. Adjustment of related assumptions causes an increase in the risk contours most
influenced by the medium to large releases. However, these effects are limited to on-site areas and
the risk off-site is not altered significantly. The conclusions made regarding risk tolerability remained
unchanged.
The heat radiation vulnerability model and corresponding exposure time selected for use in the QRA
are other assumptions that would influence the risk results. The vulnerability model is used to
determine the fatality impact based on the calculated heat flux and an assumed exposure time (refer
to Assumption No. 13 in Appendix A). This study used the model developed by TNO for "unprotected"
personnel. An alternate choice is the Eisenberg equation, however, a higher heat flux is required to
obtain the same fatality impact assuming the same exposure time. Therefore, the parameter of
greater influence is exposure time. A longer exposure time would results in a higher fatality for the
same heat flux. The exposure time would have to be at least doubled before the risk results would be
increased to the extent that may alter the conclusions regarding risk tolerability.
In summary, the sensitivity of the QRA model to various parameters was reviewed. Significant
variations to these assumptions were investigated. The overall conclusions of the QRA model
regarding risk tolerability remained unchanged despite these modifications to the QRA model.
15 May 2013 Page 41 of 43
11 COMPARISON TO RISK AT THE EXISTING FACILITY
The conversion to terminal operations results in a significant reduction in the number of major accident
scenarios at the site due to the shut-down of the refinery process units. Following conversion to
terminal operation, there will be a general reduction in the extent of the off-site risk. This reduction
can be attributed to the following factors:
Shut-down of refinery process units results in the decommissioning of the LPG storage
area (and the associated pipe network).
Under refinery operations, LPG storage areas were in close proximity to the site boundary
and several release scenarios had the potential to impact off-site areas. The change to
terminal operations will eliminate these scenarios.
Shut-down of refinery process units results in the ceasing of operations involving toxic
material, such as chlorine and hydrogen sulphide.
In previous studies, large release scenarios involving these materials had the potential to
extend into off-site areas. The change to terminal operations will eliminate these scenarios.
Reduced potential for events with far-reaching impacts such as boiling liquid-
expanding vapour explosion (BLEVE) scenarios.
Due to the removal of liquefied gas inventories, the potential for BLEVEs will be eliminated.
Removal of these hazardous inventories will also significantly reduce the number of potential
VCEs.
A significant reduction in the inventory of flammable and combustible liquids.
While the site will retain approximately 60% of the existing tankage, the hazardous
inventories within the refinery process units will be eliminated.
Modifications to storage tank operations.
The individual risk of fatality will be reduced at certain locations as a result of;
o Conversion of some tankage close to the site boundary to less hazardous duty (e.g.
crude tanks converted to diesel)
o The commitment to improved risk controls at some locations as a result of
implementing the Project (e.g. automated overfill protection on gasoline tanks).
15 May 2013 Page 42 of 43
12 REFERENCES
1 State Environment Planning Policy No 33 - Hazardous and Offensive Development,
published in Gazette No 36 of 13/03/1992, p 1754.
2 New South Wales Government, Department of Planning, Hazardous Industry Planning
Advisory Paper No. 4, Risk Criteria for Land Use Safety Planning, January 2011 (HIPAP
No. 4).
3 New South Wales Government, Department of Planning, Hazardous Industry Planning
Advisory Paper No. 6, Hazard Analysis, January 2011 (HIPAP No. 6).
4 Caltex Refineries (NSW) Pty Ltd., "Caltex Kurnell Refinery Neighbourhood Layout,
Drawing Number A1-127103, Revision 1.
5 Det Norske Veritas, PHAST-RISK (Safeti), Version 6.7,
http://www.dnv.com/services/software/products/safeti/safeti/index.asp
6 Taveau, J., The Buncefield explosion: were the resulting overpressures really
unforeseeable?, Process Safety Progress, Vol 31, No. 1, 2011.
7 Committee for the Prevention of Disasters, Methods for calculation of physical effects Part
2 Yellow Book CPR 14E, Third Edition, Chapter 5 Vapour Cloud Explosion, 2005.
8 DNV ENERGY, Illustrative model of a risk based land use planning system around
petroleum storage sites, Buncefield Major Incident Investigation Board, Rev 0, May 2008.
9 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Automotive Diesel Fuel, Infosafe
No. ACRJ8, November 2011.
10 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Fuel Oil, Infosafe No. AMQ17,
May 2009.
11 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Jet A-1 Fuel, Infosafe No. AMQ36,
September 2011.
12 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Super Premium Unleaded Petrol of
98 RON, Infosafe No. LPTL8, May 2009.
13 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Unleaded Petrol, Infosafe No.
AMPHO, May 2009.
14 CHRIS Manual (Chemical Hazards Response Information System), Oils: Diesel data sheet,
US Department of Transportation / US Coast Guard, June 1999.
15 CHRIS Manual (Chemical Hazards Response Information System), Oils, Fuel: 4 data
sheet, US Department of Transportation / US Coast Guard, June 1999.
16 Caltex Refineries (NSW) Pty. Ltd. Drawing, Plant 10-Wharf Breasting Island Upper Deck
Spill Containment Area, Dwg No. 147999, Rev 0, 14 September 2012.
17 Buncefield Major Incident Investigation Board, The Buncefield Incident 11 December 2005,
The Final Report of the Major Incident Investigation Board, December 2008
18 UK Health and Safety Executive, Buncefield Explosion Mechanism Phase 1, RR718, 2009.
15 May 2013 Page 43 of 43
19 UK HSE, Failure Rate and Event Data for use within Land Use Planning Risk Assessments,
2000.
20 International Association of Oil & Gas Producers, OGP Risk Assessment Data Directory;
Storage Incident Frequencies, Report No. 434-3, March 2010.
21 E & P Forum, Hydrocarbon Leak and Ignition Data Base, Report No. 11.4/180, May 1999.
22 International Standards Organisation, ISO 14001:2004, Environmental management
systems Requirements with guidance for use.
15 May 2013 Page A.1 of 19
APPENDIX A ASSUMPTION REGISTER
This appendix documents the technical assumptions made during the QRA.
15 May 2013 Page A.2 of 19
List of Assumptions
Assumption No. 1: Study Boundaries ..................................................................................................... 3
Assumption No. 2: Isolatable Sections ................................................................................................... 4
Assumption No. 3: Release Rates .......................................................................................................... 5
Assumption No. 4: Representative Materials.......................................................................................... 6
Assumption No. 5: Pipe Lengths............................................................................................................. 7
Assumption No. 6: Frequency Data........................................................................................................ 8
Assumption No. 7: General Utilisation .................................................................................................... 9
Assumption No. 8: Wharf Utilisation ..................................................................................................... 10
Assumption No. 9: Product Transfer Utilisation .................................................................................... 11
Assumption No. 10: Ignition Probability ................................................................................................ 12
Assumption No. 11: Pool Fire Modelling............................................................................................... 13
Assumption No. 12: Weather Data ....................................................................................................... 15
Assumption No. 13: Heat Radiation Vulnerability ................................................................................. 16
Assumption No. 14: Overpressure Impact ............................................................................................ 17
Assumption No. 15: Vulnerability Summary.......................................................................................... 18
Assumption No. 16 Off-site Population Data ........................................................................................ 19
15 May 2013 Page A.3 of 19
Assumption No. 1: Study Boundaries
Category: Hazard Identification
The QRA considered equipment containing/handling flammable or combustible liquids at the facility
when operating as a Terminal. The major areas considered were:
Atmospheric storage tanks within tank farms
Wharf operations, including ship loading / unloading
Internal pipelines involved in terminal operations
Pumps involved in transfer of product.
The hazards identified for the operation were the result of fabric failures, i.e. the failure of equipment
due to corrosion, material / construction defects and design error.
15 May 2013 Page A.4 of 19
Assumption No. 2: Isolatable Sections
Category: Hazard Identification
An isolatable section is a system of pipes and / or equipment within the Terminal that contain
hazardous materials. The isolatable section is bound by specific isolation points, such as valves
that can be operated remotely from the control room.
Where possible, emergency shutdown valves (ESDVs) were nominated as the isolation points,
rather than control valves.
15 May 2013 Page A.5 of 19
Assumption No. 3: Release Rates
Category: Consequence Analysis
When modelling the effects associated with the identified hazardous scenarios, constant release
rates were assumed. Release rates were calculated based on the material, hole size and operating
temperature and pressure. Where appropriate, the calculated release rates were limited to the
specified process flow rate through the corresponding pipeline.
15 May 2013 Page A.6 of 19
Assumption No. 4: Representative Materials
Category: Consequence Analysis
The material within an "isolatable section" was represented by a single representative hydrocarbon
component for modelling purposes. In each case, the physical properties of the representative
material were verified against the corresponding MSDSs provided by Caltex. The table below lists
the representative materials used in the QRA.
Material / Product Representative Material
Gasoline n-octane
Fuel Oil n-eicosane
ULP / PULP / SPULP n-octane
Jet Fuel n-dodecane
Diesel n-hexadecane
Slop* n-octane
Slop was assumed to be a mixture of diesel and gasoline. For the purposes of this analysis where
slop was modelled, it was assumed to have the same properties as gasoline.
15 May 2013 Page A.7 of 19
Assumption No. 5: Pipe Lengths
Category: Equipment Design and Layout
The analysis considered all internal pipelines involved in operations at the Terminal. This included
pipelines connecting the wharf and storage tanks. The routes taken by the pipelines were shown on
diagrams provided by Caltex. The lengths of the pipelines were estimated from the scaled facility
plot plan.
Impact:
The piping dimensions have an impact on the frequency analysis conducted in the QRA. Pipe
failure frequency is related to both the pipe size and pipe length. The failure frequency generally
decreases as the pipe size increases and it increases with pipe length. The dimensions of the
process piping also affect the inventory held within the pipe and therefore the amount of material
that may be involved in a release.
Reference:
Site Plans detailing the equipment layout was provided by Caltex.
15 May 2013 Page A.8 of 19
Assumption No. 6: Frequency Data
Category: Frequency Analysis
The failure frequency data used in the QRA was generated by reviewing leak data associated with
transfer process. This data was considered appropriate as the study mainly examines releases
involving the various hydrocarbons stored at the Terminal.
The failure frequency data used in the analysis is summarised in Appendix B.
15 May 2013 Page A.9 of 19
Assumption No. 7: General Utilisation
The Terminal was assumed to be in continuous operation, i.e. storage tanks always contained
product. However, due to the nature of the operation, equipment items such as the ship loading
arms (and connecting pipelines) would not be used continuously. The utilisation for this equipment
was adjusted based on information provided by Caltex.
15 May 2013 Page A.10 of 19
Assumption No. 8: Wharf Utilisation
The failure frequency associated with the loading / unloading of material at the wharf was based on
the number of shipments per year for terminal operation. Caltex provided data detailing the
expected number of shipments for each product, as well as the number of movements involving the
export of slop.
For each material, the utilisation was determined using the following equation:
% =
( )
%
The total time to unload all shipment per year (for each material) was determined by the following:
=
. ( )
( / )
For all materials, shipment activities involved the use of two loading arms at the fixed berth on the
wharf. Diesel will also be received at the submarine berth.
For each product, the calculated utilisation was used to determine the failure frequency of the
pipelines connecting the loading arms to the corresponding storage tanks. Additional scenarios
were added representing the portion of the time that these pipelines were not in use (referred to as
static). For the static scenarios, the pipeline pressure was assumed to be based on the liquid
head, i.e. the pipe elevation.
15 May 2013 Page A.11 of 19
Assumption No. 9: Product Transfer Utilisation
The utilisation of the pipelines used to transfer product from the storage tanks to the Banksmeadow
fuel distribution terminal was determined.
In terminal operations, a number of other pumps may be used for a range of operations within the
facility. Caltexs expectation is that these pumps will be rarely used. These additional pumps have
been included in the QRA with an utilisation of 1%.
15 May 2013 Page A.12 of 19
Assumption No. 10: Ignition Probability
Category: Event Tree Analysis
The following probability values were used to quantify ignition of different materials. These
probabilities were used in the event tree analysis to determine the frequency of the resulting
consequence events. The ignition probability used for flammable liquids is summarised in the table
below.
Leak Category Release Rate Probability of Ignition
Minor < 1 kg/s 0.01
Major 1-50 kg/s 0.03
Massive > 50 kg/s 0.08
For combustible liquids, the ignition probabilities listed above were multiplied by 0.1 to reflect the
lower chance of ignition due to the higher flash points of such materials.
Reference
A.W. Cox, F.P. Lees and M.L. Ang, Classification of Hazardous Locations, IChemE, 1993.
15 May 2013 Page A.13 of 19
Assumption No. 11: Pool Fire Modelling
Category: Consequence Modelling
For scenarios involving the release and ignition of a flammable or combustible liquid spill from tank
farm operations, wharf operations or associated pipelines, the only outcome considered in the QRA
was a pool fire. Due to ambient operating temperatures, a negligible amount of vapour flash, if any,
would not occur. Therefore consequence types involving vapour dispersion (i.e. flash fires) were
not considered.
Depending on the location of the event on the site, limits were placed on the maximum pool size as
follows:
In the tank farm, the maximum pool fire diameter was limited by the bund area.
In pipeways, the maximum pool fire diameter was limited to the width of the pipe trench.
At the wharf, the maximum pool diameter was limited by the spill containment capability of
the berth at the wharf (equivalent diameter of approximately 15 m).
For pumps, the maximum pool fire diameter was limited by the area defined by surrounding
kerbing.
When modelling pool fires, the pool fire diameters were adjusted to account for the influence of the
wind, which extends the fire downwind by a distance commonly referred to as the flame drag. For
pool fire events, the average wind speed for the site was used to calculate the flame drag.
Pool fires involving materials identified at the Terminal would produce smoky flames. These fires
were are modelled within PHAST by setting the flame type to "smoky", which makes use of the
following equation:
= + Equation 1
Units:
Surface emissive power of flame ( ) W/m
2
Maximum luminous emissive power ( ) W/m
2
Smoke emissive power ( ) W/m
2
Characteristic length for decay of ( ) m
Flame diameter (D) m
In calculating the radiant heat, the model considers the fraction of radiation emitted from a flame
that is not absorbed by the atmosphere before reaching the observer. This parameter is referred to
as the atmospheric transmissivity ( ), which defined as follows:
= . . [ ( )] .
[ ( )] . [ ( )] + .
[ ( )] Equation 2
The adsorption coefficients for water vapour ( ( )) and carbon dioxide ( ( )) are defined as
follows:
( ) =
.
Equation 3
( ) =

Equation 4
Units:
Water vapour pressure ( ) Pa
Distance from flame surface to observer ( ) m
Atmospheric temperature ( ) K
15 May 2013 Page A.14 of 19
Reference:
Mudan K.S. & Croce P.A., "Fire Hazard Calculations for Large Open Hydrocarbon Fires",
The SFPE Handbook of Fire Protection Engineering, 1st Edition, 1988.
Harper, M., "POLF (Pool Fire) Theory Document", DNV, London, October 2005.
Harper, M., "EXPS Theory Document", DNV, London, October 2005.
15 May 2013 Page A.15 of 19
Assumption No. 12: Weather Data
Category: Consequence Modelling / Risk Analysis
The meteorological data used in the analysis was derived from 10-minute weather observations
taken by Caltex at the Kurnell Refinery.
Six atmospheric stability classes / wind speed combinations were considered used in the analysis,
coupled with 16 wind directions. The probability of each atmospheric stability class / wind speed
combination occurring during the daytime was also determined for use in societal risk calculations.
The probability distribution is provided below.
Stability Category A/B C D
L
D
U
E F
Average
Conditions
Wind Speed (m/s)
3.0 3.6 3.5 6.2 3.5 1.9
3.5
Temperature (C)
23.7 20.9 18.9 18.4 17.3 15.6
18.5
Relative Humidity
(%)
56% 61% 74% 69% 73% 79% 71%
Probability
8% 17% 18% 17% 12% 27% 100%
Direction Probability of Wind Direction
N 0.063 0.042 0.027 0.001 0.021 0.092
0.045
NNE 0.040 0.036 0.052 0.006 0.127 0.136
0.072
NE 0.105 0.139 0.087 0.080 0.108 0.069
0.094
ENE 0.142 0.090 0.054 0.003 0.021 0.034
0.050
E 0.107 0.052 0.057 0.010 0.026 0.034
0.043
ESE 0.073 0.055 0.086 0.044 0.044 0.017
0.048
SE 0.038 0.026 0.054 0.070 0.029 0.013
0.037
SSE 0.039 0.041 0.130 0.111 0.083 0.014
0.067
S 0.042 0.044 0.066 0.143 0.049 0.009
0.056
SSW 0.029 0.056 0.067 0.272 0.049 0.009
0.080
SW 0.018 0.048 0.083 0.145 0.086 0.015
0.064
WSW 0.016 0.020 0.033 0.027 0.072 0.039
0.034
W 0.012 0.054 0.036 0.043 0.105 0.080
0.058
WNW 0.030 0.068 0.041 0.019 0.073 0.118
0.066
NW 0.081 0.107 0.055 0.012 0.052 0.156
0.086
NNW 0.165 0.121 0.072 0.013 0.056 0.166
0.102
Daytime Probability
1.00 1.00 0.72 0.64 0.00 0.00 0.50
Reference:
CALMET files provided by Caltex for between 2003 to 2007 (2007 10 minute met.txt).
15 May 2013 Page A.16 of 19
Assumption No. 13: Heat Radiation Vulnerability
Category: Risk Analysis
The following probit equation was used in the analysis to quantify the probability of fatality for
individuals exposed to heat radiation from a pool fire:
= . + .

Equation 5
Units:
Thermal Radiation Intensity (I) W/m
2
Time (t) seconds
Probit (Y) dimensionless
The "unprotected" probit was used to assess off-site risk, since an off-site population would
generally not be expected to be wearing protective clothing.
In using the probit equations, a maximum exposure duration of 20 seconds was assumed. This
value is an estimate of time taken for people to flee from harmful heat radiation. It considers the
time to react (approximately 5 seconds) and the time to move away from the area impacted by high
levels of heat radiation.
References:
Committee for the Prevention of Disasters, Methods for the determination of possible
damage, CPR 16E Green Book, 1992.
15 May 2013 Page A.17 of 19
Assumption No. 14: Overpressure Impact
The probability of fatality for individuals exposed to overpressure were defined for various levels of
overpressure, as described below. The probabilities were based on guidance provided within
HIPAP4.
Explosion
Overpressure
Effect
Probability of Fatality
(Outdoors)
7 kPa (1 psi) Probability of injury is 10%. No fatality 0%
21 kPa (3 psi)
20% chance of fatality to a person in a
building
0%
35 kPa (5 psi)
50% chance of fatality for a person in a
building and 15 % chance of fatality for a
person in the open
15%
70 kPa (10 psi)
100% chance of fatality for a person in a
building or in the open
100%
References:
New South Wales Government, Department of Planning, Hazardous Industry Planning
Advisory Paper No. 4, Risk Criteria for Land Use Safety Planning, January 2011 (HIPAP4).
15 May 2013 Page A.18 of 19
Assumption No. 15: Vulnerability Summary
The table below details the impact that pool fire events may have on exposed personnel. The
model used to calculate the impact depended on the location of the exposed personnel, which
varied depending on the focus of the analysis.
Impact
Consequence
Event
Outdoor Indoor
Heat
Radiation
Pool Fire
<35 kW/m
2
: probit
>35 kW/m
2
: 100% fatalities
<23 kW/m
2
: no fatalities
>23 kW/m
2
: 100% fatalities
Overpressure VCE
Based on guidance
provided within HIPAP 4
API 752*
* The probability of fatality was estimated based on the overpressure experienced and the building
type. The building categories used were those defined in API 752, Management of Hazards
Associated with Location of Process Plant Permanent Buildings, 2
nd
edition, 2003.
15 May 2013 Page A.19 of 19
Assumption No. 16 Off-site Population Data
Category: Societal Risk Calculations
The societal risk calculations were based on population data provided by Caltex (refer to
Appendix D). For different locations, the population data detailed the expected number of people
present at different times of the day. These population changes were considered in the
corresponding risk calculations.
15 May 2013 Page B.1 of 6
APPENDIX B FAILURE RATE DATA
This appendix presents the failure frequency data used for each equipment item. For each equipment
item, the failure frequency data for a range of failure modes was obtained from historical industry data.
The failure modes are represented through a range of hole sizes.
The use of failure frequency from historical industry data without adjustment was considered
appropriate for this analysis. The UK HSE advises that adjustments should be made where, for
example, an assessed process design has a particularly arduous operating conditions or, alternatively,
provides increased reliability. However, no particular characteristics of the Terminal operations were
identified that justified adjusting the failure frequency data. For example, the environmental factors
experienced at the facility are standard for its type. No excessively harsh conditions are experienced
that would cause failure modes, such as corrosion, to occur at significantly higher rates.
Furthermore, the failure frequency data used in the QRA represent "typical" facilities with similar
operations. For example, the sources used to define the atmospheric tank failure rate were obtained
from a review of historical data for storage tank incidents. The reported data represents an average
performance derived from facilities of various ages covering many management systems. Caltex will
continue to use its established integrity management processes. These are based heavily upon
industry standards. These processes are expected to ensure that the integrity management
performance within the facility is equal to, or better than, the performance of the "typical" facility that
the failure frequency data represents. Caltex also has established processes for corporate audits,
insurance engineering surveys and external audits to provide assurance as to the effectiveness of
these integrity management processes. Therefore, it is considered appropriate to assess the Terminal
using historical data for a "typical" facility.
B.1 LOADING ARMS FOR LIQUID CARGO
The failure frequency for the transfer of liquid cargo at the wharf was based on loading/unloading arm
failure rate from the UK HSE data [1]. Data is provided for the two failure sizes listed.
Table B-1: Loading / Unloading Arm Failure Rate
Hole Size (mm)
Failure Rate [1]
(per transfer operation)
Equivalent to 10% of cross-
sectional area of Arm
2.9 10
-5
Arm Diameter 3.2 10
-6
B.2 ATMOSPHERIC STORAGE TANKS
The atmospheric tank failure frequency for various release sizes was based on data from the UK HSE
data [1] and the OPG Risk Assessment Directory detailing storage incident frequencies [2]. The
frequency distribution was derived using the OGP data.
Table B-2: Atmospheric Storage Tank Failure Rate
Hole Size (mm)
Failure Rate
(per tank per year)
20 2.110
-3
50 4.210
-4
100 2.810
-4
Rupture 5.010
-6
Historical data was used to determine the frequency of full surface fires associated with different types
of atmospheric storage tanks [2, 3].
Table B-3: Full-Surface Tank Fire Frequency
Tank Type Event Description
Fire Frequency
(per tank per year)
Floating Roof
Full-Surface Tank Fire
1.210
-4
Fixed Roof
Internal Explosion and Full-
Surface Tank Fire
9.010
-5
Fixed with Internal Floating
Roof
Internal Explosion and Full-
Surface Tank Fire
9.010
-5
B.3 PROCESS PIPING
The overall frequency has been taken from the E&P Forum [4]. The total frequency was distributed to
the representative hole sizes selected for the analysis by considering information presented in the Cox
et al [5] and TNO [6].
Table B-4: Transfer Pipe (50mm < D 100mm) Failure Rate
Hole Size (mm) Failure Rate (per metre-pipe year)
5 2.7 10
-5
20 7.2 10
-6
50 1.4 10
-6
Pipe Diameter (100 mm) 3.6 10
-7
5 2.7 10
-5
20 7.2 10
-6
50 1.4 10
-6
100 1.8 10
-7
-7
5 2.0 10
-5
20 5.4 10
-6
50 1.1 10
-6
100 1.4 10
-7
-7
B.4 PUMPS
The total failure frequency for pumps was taken from the OGP Risk Assessment Directory detailing
process releases [7]. This source also provided information detailing the frequency distribution for a
range of hole sizes.
Table B-7: Centrifugal Pump Failure Rate [7]
Process Pipe Diameter (D) Hole Size (mm) Failure Rate (per year)
D 100 mm
5 4.0 10
-3
20 5.6 10
-4
50 9.9 10
-5
Pipe diameter 5.8 10
-5
D > 100 mm
5 4.0 10
-3
20 5.6 10
-4
50 9.9 10
-5
100 2.9 10
-5
Pipe diameter 2.9 10
-5
B.5 FLANGES
The total failure frequency for flanges was taken from the OGP Risk Assessment Directory detailing
process releases [7]. The data obtained from this source was distributed over the representative hole
sizes selected for the analysis [5].
Table B-8: Flange Failure Rate
Process Pipe Diameter (D) Hole Size (mm) Failure Rate (per year)
D 50mm
5 3.0 10
-5
20 1.2 10
-5
50mm < D 100 mm
5 3.4 10
-5
20 6.9 10
-6
100 mm < D 150 mm
5 4.4 10
-5
20 9.5 10
-6
D >150 mm
5 7.0 10
-5
20 1.4 10
-5
B.6 MANUAL VALVES
The total failure frequency for manual valves was taken from the OGP Risk Assessment Directory
detailing process releases [7]. This source was also used to distribute the frequency between the
representative hole sizes selected for the analysis. Other sources were not used, as those reviewed
do not make a distinction between valve types.
Table B-9: Manual Valve Failure Rate
Manual Valve Size (D) Hole Size (mm) Failure Rate (per year)
D 20 mm
5 2.6 10
-5
20 8.2 10
-6
20 mm < D 50 mm
5 2.6 10
-5
20 5.0 10
-6
50 3.2 10
-6
50 mm < D 100 mm
5 3.4 10
-5
20 6.9 10
-6
50 1.5 10
-6
100 2.0 10
-6
100 mm < D 150 mm
5 4.2 10
-5
20 8.6 10
-6
50 1.8 10
-6
100 6.3 10
-7
150 1.8 10
-6
D >150 mm
5 5.2 10
-5
20 1.1 10
-5
50 2.6 10
-6
100 9.3 10
-7
300 2.0 10
-6
B.7 ACTUATED VALVES
The total failure frequency for actuated valves was taken from the OGP Risk Assessment Directory
detailing process releases [7]. This source was also used to distribute the frequency between the
representative hole sizes selected for the analysis. Other sources were not used, as those reviewed
do not make a distinction between valve types.
Table B-10: Actuated Valve Failure Rate
Actuated Valve Size (D) Hole Size (mm) Failure Rate (per year)
D 20 mm
5 2.8 10
-4
20 6.1 10
-5
20 mm < D 50 mm
5 2.8 10
-4
20 4.5 10
-5
50 1.6 10
-5
50 mm < D 100 mm
5 2.6 10
-4
20 4.4 10
-5
50 8.3 10
-6
100 9.4 10
-6
100 mm < D 150 mm
5 2.4 10
-4
20 4.1 10
-5
50 7.7 10
-6
100 2.5 10
-6
150 6.2 10
-6
D >150 mm
5 2.4 10
-4
20 3.8 10
-5
50 6.2 10
-6
100 1.8 10
-6
300 6.6 10
-6
B.8 INSTRUMENTATION
The total failure frequency for instrumentation was taken from the OGP Risk Assessment Directory
detailing process releases [7].
Table B-11: Instrumentation Failure Rate
Hole Size (mm) Failure Rate (per year)
5 2.3 10
-4
20 5.9 10
-5
B.9 MIXERS FOR TANKS
The failure frequency data assumed for mixers connected to atmospheric tanks was based on the
data used for centrifugal pumps [7]. This data was used to represent the possible failure modes
involving a seal failure. A limited hole size distribution has been applied to reflect the likely failure
modes associated with leaks for mixer seals.
Table B-12: Atmospheric Storage Tank Mixer Failure Rate
Hole Size (mm)
Failure Rate
(per tank per year)
5 4.0 10
-3
20 7.2 10
-4
B.10 REFERENCES
1 UK HSE, Failure Rate and Event Data for use within Risk Assessments, 2012.
Storage Incident Frequencies, Report No. 434-3, March 2010.
3 LASTFIRE PROJECT, Large Atmospheric Storage Tank Fire Project, LASTFIRE Technical
Working Group, June 1997.
4 E & P Forum, Hydrocarbon Leak and Ignition Data Base, Report No. 11.4/180, May 1992.
5 A.W. Cox, F.P. Lees and M.L. Ang, Classification of Hazardous Locations, IChemE, 1993,
Table 18.1, page 39.
6 TNO, Guidelines for Quantitative Risk Assessment, Purple Book, CPR 18E, 2005.
Process release frequencies, Report No. 434-1, March 2010.
15 May 2013 Page C.1 of 6
APPENDIX C BUNCEFIELD RECOMMENDATIONS
This appendix provides information on the recommendations arising from the Buncefield investigation.
A series of recommendations were by the Major Incident Investigation Board (MIIB) in relation to the
design and operation of fuel storage sites [1]. The recommendations applicable to the facility are
listed in the following table, grouped by subject.
Design and operation of fuel storage sites
RECOMMENDATION 1 Systematic assessment of safety integrity level requirements
The Competent Authority and operators of Buncefield-type sites should develop and agree a common
methodology to determine safety integrity level (SIL) requirements for overfill prevention systems in line with the
principles set out in Part 3 of BS EN 61511. This methodology should take account of:
the existence of nearby sensitive resources or populations;
the nature and intensity of depot operations;
realistic reliability expectations for tank gauging systems; and
the extent/rigour of operator monitoring.
Application of the methodology should be clearly demonstrated in the COMAH safety report submitted to the
Competent Authority for each applicable site.
Existing safety reports will need to be reviewed to ensure this methodology is adopted.
RECOMMENDATION 2 Protecting against loss of primary containment using high integrity systems
Operators of Buncefield-type sites should, as a priority, review and amend as necessary their management
systems for maintenance of equipment and systems to ensure their continuing integrity in operation. This should
include, but not be limited to reviews of the following:
the arrangements and procedures for periodic proof testing of storage tank overfill prevention systems to
minimise the likelihood of any failure that could result in loss of containment; any revisions identified
pursuant to this review should be put into immediate effect;
the procedures for implementing changes to equipment and systems to ensure any such changes do not
impair the effectiveness of equipment and systems in preventing loss of containment or in providing
emergency response.
Operators of Buncefield-type sites should protect against loss of containment of petrol and other highly
flammable liquids by fitting a high integrity, automatic operating overfill prevention system (or a number of such
systems, as appropriate) that is physically and electrically separate and independent from the tank gauging
system.
Such systems should meet the requirements of Part 1 of BS EN 61511 for the required safety integrity level, as
determined by the agreed methodology. Where independent automatic overfill prevention systems are already
provided, their efficacy and reliability should be reappraised in line with the principles of Part 1 of BS EN 61511
and for the required safety integrity level, as determined by the agreed methodology (see Recommendation 1).
The overfill prevention system (comprising means of level detection, logic/control equipment and independent
means of flow control) should be engineered, operated and maintained to achieve and maintain an appropriate
level of safety integrity in accordance with the requirements of the recognised industry standard for safety
instrumented systems, Part 1 of BS EN 61511.
All elements of an overfill prevention system should be proof-tested in accordance with the validated
arrangements and procedures sufficiently frequently to ensure the specified safety integrity level is maintained in
practice in accordance with the requirements of Part 1 of BS EN 61511.
The sector should put in place arrangement to ensure the receiving site (as opposed to the transmitting location)
has ultimate control over the tank filling.
The sector should undertake a review of the adequacy of existing safety arrangements, including
communications, employed by those responsible for pipeline transfers of fuel.
The sector, including its supply chain of equipment manufacturers and suppliers, should review and report
without delay on the scope to develop improved components and systems, including but not limited to the
following:
alternative means of ultimate high level detection systems that do not rely on components internal to the
tank with the emphasis on ease of inspection, testing and maintenance;
increased dependability of tank gauging systems should be explored through improved validation of
measurements & trends, allowing warning of faults and using modern sensors with increased diagnostic
capability; and
systems to control and log override actions.
Operators of terminals should implement systems to ensure systematic maintenance of records pertaining to
product movement and operation of the overfill prevention systems and any associated systems
The sector and regulators should agree on a system of lead and lag performance indicators for process safety
performance.
RECOMMENDATION 11 Engineering against escalation of loss of primary containment
Operators of Buncefield-type sites should review the classification of places within COMAH sites where explosive
atmospheres may occur and their selection of equipment and protective systems (as required by the Dangerous
Substances and Explosive Atmospheres Regulations 2002). This review should take into account the likelihood
of undetected loss of containment and the possible extent of an explosive atmosphere following such an
undetected loss of containment. Operators in the wider fuel and chemicals industries should also consider such
a review, to take account of events at Buncefield.
Following on from Recommendation 11, operators of Buncefield-type sites should evaluate the siting and/or
suitable protection of emergency response facilities such as fire fighting pumps, lagoons or manual emergency
switches.
Operators of Buncefield-type sites should employ measures to detect hazardous conditions arising from loss of
primary containment, including the presence of high levels of flammable vapours in secondary containment.
Operators should without delay undertake an evaluation to identify suitable and appropriate measures. This
evaluation should include, but not be limited to, consideration of the following:
installing flammable gas detection in bunds containing vessels or tanks into which large quantities of highly
flammable liquids or vapour may be released;
the relationship between the gas detection system and the overfill prevention system. Detecting high levels
of vapour in secondary containment is an early indication of loss of containment and so should initiate action,
for example through the overfill prevention system, to limit the extent of any further loss;
installing CCTV equipment to assist operators with early detection of abnormal conditions. Operators cannot
routinely monitor large numbers of passive screens, but equipment is available that detects and responds to
changes in conditions and alerts operators to these changes.
Operators of new Buncefield-type sites or those making major modifications to existing sites (such as installing a
new storage tank) should introduce further measures including, but not limited to, preventing the formation of
flammable vapour in the event of tank overflow. Consideration should be given to modifications of tank top
design and to the safe re-routing of overflowing liquids.
The sector should begin to develop guidance without delay to incorporate the latest knowledge on preventing
loss of primary containment and on inhibiting escalation if loss occurs. This is likely to require the sector to
collaborate with the professional institutions and trade associations.
Operators of existing sites, if their risk assessments show it is not practicable to introduce measures to the same
extent as for new ones, should introduce measures as close to those recommended by Recommendation 14 as
is reasonably practicable. The outcomes of the assessment should be incorporated into the safety report
submitted to the Competent Authority.
RECOMMENDATION 17 Engineering against loss of secondary and tertiary containment
The Competent Authority and the sector should jointly review existing standards for secondary and tertiary
containment with a view to the Competent Authority producing revised guidance by the end of 2007.
The review should include, but not be limited to the following:
developing a minimum level of performance specification of secondary containment (typically this will be
bunding);
developing suitable means for assessing risk so as to prioritise the programme of engineering work in
response to the new specification;
formally specifying standards to be achieved so that they may be insisted upon in the event of lack of
progress with improvements;
improving firewater management and the installed capability to transfer contaminated liquids to a place
where they present no environmental risk in the event of loss of secondary containment and fires;
providing greater assurance of tertiary containment measures to prevent escape of liquids from site and
threatening a major accident to the environment.
RECOMMENDATION 18 Engineering against loss of secondary and tertiary containment
Revised standards should be applied in full to new build sites and to new partial installations. On
existing sites, it may not be practicable to fully upgrade bunding and site drainage. Where this is so
operators should develop and agree with the Competent Authority risk-based plans for phased
upgrading as close to new plant standards as is reasonably practicable.
RECOMMENDATION 19 Operating with high reliability organisations
The sector should work with the Competent Authority to prepare guidance and/or standards on how to achieve a
high reliability industry through placing emphasis on the assurance of human and organisational factors in
design, operation, maintenance, and testing. Of particular importance are:
understanding and defining the role and responsibilities of the control room operators (including in
automated systems) in ensuring safe transfer processes;
providing suitable information and system interfaces for front line staff to enable them to reliably detect,
diagnose and respond to potential incidents;
training, experience and competence assurance of staff for safety critical and environmental protection
activities;
defining appropriate workload, staffing levels and working conditions for front line personnel;
ensuring robust communications management within and between sites and contractors and with operators
of distribution systems and transmitting sites (such as refineries);
prequalification auditing and operational monitoring of contractors capabilities to supply, support and
maintain high integrity equipment;
providing effective standardised procedures for key activities in maintenance, testing, and operations;
clarifying arrangements for monitoring and supervision of control room staff; and
effectively managing changes that impact on people, processes and equipment.
Terminal operators should ensure the resulting guidance is fully implemented.
The sector should put in place arrangements to ensure that good practice in these areas, incorporating
experience from other higher hazard sectors, is shared openly between organisations.
The regulator should ensure that MHF Safety Cases contain demonstration that good practice in human and
organisational design, operation, maintenance and testing is implemented as rigorously as for engineering
systems.
RECOMMENDATION 23 Delivering high performance through culture and leadership
The sector should set up arrangements to collate incident data on high potential incidents including overfilling,
equipment failure, spills and alarm system defects, evaluate trends, and communicate information on risks, their
related solutions and control measures to the industry.
The arrangements set up to meet Recommendation 23 should include, but not be limited to, the following:
thorough investigation of root causes of failures and malfunctions of safety and environmental protection
critical elements during testing or maintenance, or in service;
developing incident databases that can be shared across the entire sector, subject to data protection and
other legal requirements. Examples exist of effective voluntary systems that could provide suitable models;
collaboration between the workforce and its representatives, dutyholders and regulators to ensure lessons
are learned from incidents, and best practices are shared.
In particular, the sector should draw together current knowledge of major hazard events, failure histories of safety
and environmental protection critical elements, and developments in new knowledge and innovation to
continuously improve the control of risks. This should take advantage of the experience of other high hazard
sectors such as chemical processing, offshore oil and gas operations, nuclear processing and railways.
Emergency Arrangements
RECOMMENDATION 1 Assessing the potential for a major incident
Operators of Buncefield-type sites should review their emergency arrangements to ensure they provide for
all reasonably foreseeable emergency scenarios arising out of credible major hazard incidents, including
vapour cloud explosions and severe multi-tank fires that, before Buncefield, were not considered realistically
credible. The Competent Authority should ensure that this is done.
RECOMMENDATION 2 Managing a major incident on site
The Competent Authority should review the existing COMAH guidance on preparing on-site emergency
plans. This guidance needs to reflect the HSEs Hazardous Installations Directorate (HID) Chemical
Industries Division inspection manual used by inspectors to assess the quality of the on-site plan in meeting
the COMAH Regulations. In particular, reference should be made to the need to consult with health advisors
and emergency responders.
For Buncefield-type sites, operators should review their onsite emergency plans to reflect the revised
guidance on preparing on-site emergency plans as per Recommendation 2. The Competent Authority will
need to check that this is done.
Operators should review and where necessary revise their on-site emergency arrangements to ensure that
relevant staff are trained and competent to execute the plan and should ensure that there are enough trained
staff available at all times to perform all the actions required by the on-site emergency plan.
For Buncefield-type sites, operators should evaluate the siting and/or suitable protection of emergency
response facilities such as the emergency control centre, firefighting pumps, lagoons or manual switches,
updating the safety report as appropriate and taking the necessary remedial actions.
Operators should identify vulnerable critical emergency response resources and put in place contingency
arrangements either on or off site in the event of failure at any time of the year and make appropriate
amendments to the on-site emergency plan. This should include identifying and establishing an alternative
emergency control centre with a duplicate set of plans and technical information.
RECOMMENDATION 7 Emergency preparedness, response & recovery
For COMAH sites, if the operator relies on an off-site Fire and Rescue Service to respond, the operators
plan should clearly demonstrate that there are adequate arrangements in place between the operator and
the service provider. The Competent Authority will need to check that this is done.
RECOMMENDATION 8 Warning and informing the public
COMAH site operators should review their arrangements to communicate with residents, local businesses
and the wider community, in particular to ensure the frequency of communications meets local needs and to
cover arrangements to provide for dealing with local community complaints. They should agree the
frequency and form of communications with local authorities and responders, making provision where
appropriate for joint communications with those bodies.
RECOMMENDATION 9 Warning and informing the public
The Competent Authority should review the COMAH guidance to assist operators in complying with
Recommendation 8 and should work with the Cabinet Office to integrate the COMAH guidance and the CCA
Communicating with the public guidance, so that communications regarding COMAH sites are developed
jointly by the site operator and the local emergency responders.
RECOMMENDATION 12 Preparing for and responding to a major incident off site
Communities and Local Government should complete and, where necessary, initiate an assessment of the
need for national-level arrangements to provide, fund and maintain, emergency response equipment (such
as high volume pumps, firefighting foam and specialist pollution containment equipment). The review could
also consider criteria for allocation and use of this equipment across the UK.
RECOMMENDATION 23 Responding to a major incident
The operators of industrial sites where there are risks of large explosions and/or large complicated fires
should put in place, in consultation with fire and rescue services at national level, a national industryfire
service mutual aid arrangement. The aim should be to enable industry equipment, together with operators of
it as appropriate, to be available for fighting major industrial fires. Industry should call on the relevant trade
associations and working group 6 of the Buncefield Standards Task Group to assist it, with support from
CCS. The COMAH Competent Authority should see that this is done.
C.1 REFERENCES
1 Buncefield Major Incident Investigation Board, The Buncefield Incident 11 December 2005,
The Final Report of the Major Incident Investigation Board, December 2008.
15 May 2013 Page D.1 of 5
APPENDIX D OFF-SITE POPULATION DATA
D.1 INTRODUCTION
This appendix outlines the population data used in calculating the off-site societal risk F-N curve. The
population data used in the model is presented in Table D-1. This data was developed from
information provided by Caltex [1]. The terms referred to in the table are defined as follows:
Off-site location The off-site location of personnel in proximity to the Terminal.
Daytime Population The off-site population during the daytime (i.e. between the hours of 6 am to
6 pm).
Night Time
Population
The off-site population during the night time (i.e. between the hours of 6 pm
to 6 am).
Raw Data The off-site population data provided by Caltex to R4Risk.
Modelled Population The population data used in the analysis.
Each of the listed off-site locations is identified in Figure 1. This shows the layout of the
neighbourhood surrounding the facility [1].
The residential areas around the Terminal were subdivided as shown in Figure 2. The population
density used for the residential areas was based on the Department of Planning data. This data
indicated that the residential population density was approximately 2 people per house for an average
block size of 750 m
2
. The residential population was assumed to be fully present during night time
and non-work hours, with a 75% reduction in the overall population during work hours. It was
assumed that the residential population would be located indoors 70% of the time during the daytime
and 95% of the night-time.
The residential density was applied to the off-site locations referred to as "Residential West" and
"Residential North". The total population of these areas was calculated by multiplying the density by
the area covered. For the eastern residential areas, a more detailed approach was used to estimate
the population due to the close proximity of this area to the Terminal boundary. In these areas, an
occupancy of 2 persons per block was assumed.
The Energy Australia site was also excluded from the off-site societal risk calculations because it is
typically an unpopulated site.
D.2 POPULATION DATA
Table D-1: Population Data for Off-site Areas
Off-site
Location
Daytime Population Night Time Population
Raw Data
Modelled
Population
Raw Data
Modelled
Population
HCE Agility
Day shift (weekdays):
8 to 10 persons
5 outdoor
5 indoor
Night shift and
Dayshift
(weekends) 2
persons
1 outdoor
1 indoor
Light Industrial
Area, adjacent
to Terminal
Boundary
105 car spaces for the site
79 cars counted.
79 people with
95% indoor (i.e.
4 outdoor,
75 indoor)
No night time
population data
0
Kurnell
Recreation Club
POPE licensed for 258
people
Kurnell Rec. Club - typical
population is:
Number of people during
the day = 30
Average number of people
at night = 50 - 60
Number of people on
Friday night: ~100
10 outdoor
20 indoor
POPE licensed
for 258 people
Kurnell Rec. Club
- typical
population for the
Kurnell Rec. Club
is:
Number of people
during the day =
30
Average number
of people at night
= 50-60
Number of people
on Friday night
~100
15 outdoor
45 indoor
Pre-School 32 people with 80% indoor
6 outdoor
26 indoor
No night time
population
0
Botany Bay
National Park
400,000 persons per
calendar year to the park,
with peak season being
June to July for Whale
season, and Christmas and
new year periods.
Approximately
110 people per
day
110 outdoor
0 indoor
No night time
population
0
Caltex Service
Station
3
1 outdoor
2 indoor
3
1 outdoor
2 indoor
Pizzas with
Muscle
3
0 outdoor
3 indoor
No night time
population
0
Kurnell
Pharmacy
3
0 outdoor
3 indoor
No night time
population
0
Kurnell Cellars 3
0 outdoor
3 indoor
No night time
population
0
Kurnell Fresh
Food Supplies
3
0 outdoor
3 indoor
No night time
population
0
Kurnell Medical
Centre
3
0 outdoor
3 indoor
No night time
population
0
Kurnell Grocery 3
0 outdoor
3 indoor
No night time
population
0
Off-site
Location
Daytime Population Night Time Population
Raw Data
Modelled
Population
Raw Data
Modelled
Population
Captains Pies
and Cakes
3
0 outdoor
3 indoor
No night time
population
0
Kurnell Art
Gallery - 6
Prince Charles
Parade
3
0 outdoor
3 indoor
No night time
population
0
Real Estate - 7
Captain Cook
Drive, Kurnell
3
0 outdoor
3 indoor
No night time
population
0
Endeavour
Coffee & Ice
Cream - 2
Prince Charles
Parade
3
0 outdoor
3 indoor
No night time
population
0
Residential East
Department of Planning
Data:
Block of land size = 750 m
2
~2 people per house
25% of population for day
time
Residential East estimated
area = 173,500 m
2
35 outdoor
81 indoor
463
23 outdoor
440 indoor
Residential
Central
Data:
2
~2 people per house
time
area = 133,486 m
2
27 outdoor
62 indoor
356
18 outdoor
338 indoor
Residential
West
Data:
2
~2 people per house
time
area = 285,156 m
2
133 outdoor
57 indoor
761
38 outdoor
723 indoor
Figure 1: Locations of Off-Site Populations
Figure 2: Locations of Residential Areas
D.3 REFERENCES
1 Email from Marian Magbiray (Caltex) to Patrick Walker (R4Risk), Population Data - Offsite
Analysis, Attachment Offsite Population.xls, 9 January 2012.
15 May 2013 Page E.1 of 12
APPENDIX E LISTS OF HAZARDOUS SCENARIOS
Confidential and Sensitive Document
Exempt from disclosure under the Government Information (Public Access) Act 2009 (NSW)
The complete Preliminary Hazard Analysis Report is provided to the NSW Department of Planning &
Infrastructure (DP&I) by Caltex Refineries (NSW) Pty Ltd (Caltex) in confidence for use only within
DP&I. It is submitted on the basis that there is an overriding public interest against disclosure
pursuant to section 14(2) of the Government Information (Public Access) Act 2009 (NSW) (the Act).
The Report is exempt from disclosure under the Act on the grounds that it contains information
associated with the storage of security sensitive petroleum finished product and information that is
commercial-in-confidence.
The information which is exempt from disclosure applies specifically to the following parts of the
Report:
This report must not be copied or distributed outside DP&I without the express permission of Caltex.
15 May 2013 Page F.1 of 3
APPENDIX F QUALIFICATIONS AND EXPERIENCE OF THE
HAZARD ANALYSIS TEAM
F.1 R4RISK PROJECT TEAM
An overview of the qualifications and experience of R4Risks project team is provided within Table 1.
Table 1: Project Team Summary
Name Project Role Qualification and Relevant Experience
Lachlan Dreher
Project Manager
Technical Review
Bachelor of Engineering (Chem) Hons., University of
Melbourne
Registered Professional Engineer (NPER-3); in the
categories of Chemical (general) and Fire Safety
Engineering
Over 20 years experience in the risk management field.
Technical expert in QRA with extensive experience
leading and conducting large QRA studies
Was at the forefront in the development of in-house tools
for the conduct of QRA (VRJ Risk Engineers /
ModuSpec), including defining many of the algorithms
used in these programs.
Dr. Patrick Walker Technical Analyst
Bachelor of Engineering (Chem,) Hons., University of
NSW
Over eight years experience in a range of risk
assessment techniques across a number of industries.
Extensive experience in conducting consequence
modeling and QRAs for the petrochemical, chemical and
oil & gas industries.
Flora Chung Technical Analyst
Bachelor of Engineering (Chemical and Biomolecular)
Hons., University of Melbourne.
Analyst with experience in consequence modelling, fire
safety studies and quantitative risk assessments.
F.2 PROJECT TEAM EXPERIENCE
R4Risks project team has extensive experience in conducting a range of hazard and risk studies,
including QRAs. These studies involved reviewing the corresponding processes to identify,
understand and assess the risk associated with the significant hazards. A selection of these studies
that involved the team members are listed in Table 2.
Table 2: R4Risk Project Team Experience
Client Project
Legend International QRA for proposed Mount Isa Fertilizer Project (600 ktpa & 1200 ktpa)
Confidential
Peer review of QRA to identify modelling flaws resulting in overstated risk
results.
Caltex Australia QRA for Kurnell Refinery
Coogee Chemicals QRA for Mt Isa Plant Expansion
Incitec Pivot Peer review of QRA for proposed facility
BHP
QRA for proposed ammonium nitrate plant, including comparison of risks for
alternate processing technologies and alternate site locations
BHP QRA for proposed ammonia / urea fertilizer plant.
BP Kwinana Refinery: QRA of facility
Caltex Kurnell Refinery: QRA for new crude oil storage tank
Caltex Kurnell Refinery: QRA to identify risk implications for occupied buildings at site.
Marstel Terminals Coode Island bulk liquid storage terminal: QRA, including propylene oxide and
acrylonitrile storage
Mobil Mobil Altona Refinery: QRA of complete refinery
Mobil Yarraville bulk liquid storage terminal: QRA of facility
Mobil Yarraville bulk liquid storage terminal: Update QRA for changed tankage
allocation
Mobil Spotswood bulk liquid storage terminal: QRA of facility
Mobil Colmslie Terminal: QRA of proposed LPG terminal
Nufarm-Coogee Kwinana Chlor-Alkali Plant: QRA of proposed plant upgrade
Nufarm-Coogee Kemerton Chlor-Alkali Plant: QRA of proposed plant upgrade
Nufarm-Coogee Kwinana Chlor-Alkali Plant: QRA of proposed plant upgrade (modified design)
Nufarm-Coogee Kemerton Chlor-Alkali Plant: QRA of proposed plant upgrade (modified design)
Nufarm-Coogee Kwinana Chlor-Alkali Plant: QRA for plant expansion (low-pressure design)
Nufarm Belvedere Agricultural Chemicals Plant (UK): QRA for chemicals
manufacturing plant, including chlorine storage and handling
Pasminco Hobart smelter: QRAs for acid plants
Port of Brisbane Northshore Hamilton: QRA for development master plan
Process Design &
Fabrication
Barnawartha Biodiesel Plant: QRA of proposed facility
Queensland Nitrates
Plant
Moura ammonium nitrate plant: Preliminary QRA (including ammonia
manufacture and storage)
Queensland Nitrates
Plant
Moura ammonium nitrate plant: QRA for final design (including ammonia
manufacture and storage)
Queensland Nitrates
Plant
Moura ammonium nitrate plant: QRA Update for Major Hazard Facility
compliance (including ammonia manufacture and storage)
Queensland Nitrates
Plant
Moura ammonium nitrate plant: QRA for proposed plant expansion (including
ammonia manufacture and storage)
Queensland Nitrates
Plant
Moura ammonium nitrate plant: Risk review of ammonia storage options for
proposed plant expansion (refrigerated storage vs pressurised storage)
Queensland Nitrates
Plant
Quantitative & Qualitative Risk Analysis on the transportation of ammonia and
ammonium nitrate
Tiwest Kwinana Pigment Plant: QRA of facility
Appendix C2
Kurnell Buncefield Review
Appendix C2 Kurnell Buncefield Review

C2-1

Topic
BSTG Recommendation
Published 24 July 2007
Official MIIB Recommendation
As published in final Report 2008
Caltex Review
Systematic Assessment of Safety Integrity levels
Safety Integrity
Control of safety systems for
petroleum storage tanks;
and;

Incorporating the findings of SIL
assessments into safety case
reports
Before protective systems are installed there is a need to determine the
appropriate level of integrity that such systems are expected to achieve.
This report uses a layer of protection study (LOPA) to provide a more
consistent approach to safety integrity level (SIL) assessment.
For each risk assessment/SIL determination study, operators must be able
to justify each and every claim and data used in the risk assessment and
ensure that appropriate management systems and procedures are
implemented to support those claims. For COMAH top-tier sites this will
form part of the demonstration required with the safety report. Of particular
importance is the reliability and diversity of the independent layers of
protection. To avoid common mode failures, extreme care should be taken
when claiming high reliability and diversity, particularly for multiple human
interventions.
Minimum expected good practice
The overall systems for tank filling control must be of high integrity, with
sufficient independence to ensure timely and safe shutdown to prevent
tank overflow.
Site operators should meet the latest international standards, ie BS EN
61511:2004 Functional safety. Safety instrumented systems for the
process industry sector 2.
COMAH five-year periodic reviews of safety reports should incorporate
a demonstration that:
the overall systems for tank filling control are of high integrity, with
sufficient independence to ensure timely and safe shutdown to
prevent tank overflow; and
the overall systems for tank filling control meet BS EN
61511:2004.2
Where the SIL assessment results in a change to the safety
management system that could have significant repercussions with
respect to the prevention of major accidents or the limitation of their
consequences, operators of top-tier sites should review their safety
R1 Design & Operation
The Competent Authority and operators of Buncefield-type sites should
develop and agree a common methodology to determine safety integrity
level (SIL) requirements for overfill prevention systems in line with the
principles set out in Part 3 of BS EN 61511 (ref 3). This methodology should
take account of:
the existence of nearby sensitive resources or populations;
the nature and intensity of depot operations;
realistic reliability expectations for tank gauging systems; and
the extent/rigour of operator monitoring.
Application of the methodology should be clearly demonstrated in the
COMAH safety report submitted to the Competent Authority for each
applicable site.
Existing safety reports will need to be reviewed to ensure this methodology
is adopted.
The overfill prevention system (comprising means of level detection,
logic/control equipment and independent means of flow control) should be
engineered, operated and maintained to achieve and maintain an
appropriate level of safety integrity in accordance with the requirements of
the recognised industry standard for safety instrumented systems, Part 1 of
BS EN 61511.
1. Caltex believes that these recommendations are adequately addressed
by the NSW Work Health and Safety Regulation 2011 Chapter 9 and as
such the requirement to demonstrate that tank overfill scenarios for all
hazardous materials handled are properly identified, and that the
associated control measures to prevent and mitigate consequences are
appropriate and demonstrated as adequate in terms of availability,
reliability, functionality and survivability are already mandatory
requirements.
2. The current safety case for Kurnell Refinery addresses these
requirements. Nevertheless, the adequacy demonstration for tank
primary containment controls is again being progressively reviewed to
ensure that any changes impacting tank filling operations are fully
reviewed and that the facility risk assessment is adjusted to reflect
agreed control measure improvements to be adopted under the
proposed facility transition. The safety assessment methodology used
in the safety case incorporates both QRA and LOPA, and specific SIL
assessments are undertaken where instrumented systems form part of
the control measure suite (as per AS61511).
3. Special QRA studies have specifically focussed on nearby population
exposures, specifically the fuel storage tanks located closest to
residential areas. The results of the QRA studies undertaken by Caltex,
which have been recently reviewed and revised, are consistent with the
Land Use Safety Study undertaken by the NSW Department of Planning
(last revised in 2007). These studies found that full refinery operations at
the site did not pose a significant risk to residential areas and overall risk
fell within the approval guidelines. The current proposal to transition the
site from a refinery to a terminal only will substantially lower the risk
even further through elimination of a broad range of fire, explosion and
toxic release potential incidents and through the adoption of additional
layers of protection on both gasoline and combustible liquid storage
tanks.
Additional controls on gasoline storage tanks will include the installation
of independent high- high level alarms and vapour detection systems in
Topic Caltex Review
Underlying Principles of Buncefield Investigation Recommendations
Measures for controlling major incident risks must integrate:
Integrity levels at major hazards sites in relation to containment of
dangerous goods and process safety
Mitigation against the effect of a major incident on off-site
populations and buildings
Preparedness for emergency response to limit the escalation of
potential major incidents
Land use planning and the control of societal risk; and
The regulatory system for inspection and enforcement at major
hazard industrial areas.
The Caltex Kurnell site is currently a major hazard facility site and will remain so when converted to a fuels import and storage terminal. As such the facility is required to maintain a safety
case which demonstrates that the control measures are fully integrated and adequate with respect to the management of major hazards risks and which specifically must address the
possibility of events such as the Buncefield VCE. A review of the Buncefield incident and its recommendations was undertaken by Caltex during the preparation of the current safety case,
which resulted in a number of additional control measures being adopted, particularly on gasoline tanks in the north east corner of the site. The current conversion project will extend these
improvements to all other flammables storage and in significant part, to bulk combustible storage as well. These control improvements will be reflected in revisions of the safety case.
Specific details of approaches taken by Caltex relating to each of the first three control areas listed on the left are provided in the table below.
In addition, Caltex actively engages in land use planning management around its refineries and terminals ensuring that decisions made by local authorities relating to land use in potentially
affected zones are properly informed by Caltex. Caltex also continues to work closely and proactively with planning authorities and state Workcover and Environment Protection authorities to
ensure planning decisions take into account major hazards risks. For example, in Victoria Caltex is one of the first five companies to have worked collaboratively with Worksafe Victoria to
produce published land-use planning guidelines for its terminals in that state.
Finally, Caltex has consulted with NSW Workcover in relation to the ongoing maintenance and continuous improvement of the Kurnell Site Safety Case. Whilst the submitted safety case has
not yet been formally assessed by NSW Workcover, Caltex is committed to ensuring that it continues to comply with all requirements throughout the transition of the site to a terminal only
operation, that the controls adopted continue to eliminate risk where reasonably practicable, or where not reasonably practicable to eliminate the risk, reduce risk so far as is reasonably
practicable. In the adoption and/or modification of controls, consideration has been and will continue to be made of the Buncefield Investigation recommendations and of all other major
investigation recommendations pertinent to the facility.
Caltex has committed to meeting at least quarterly with NSW Workcover to ensure these obligations continue to be met. Workcover NSW has made specific reference to the consideration of
Buncefield recommendations in its oversight and consultation agenda.


C2-2

Topic
BSTG Recommendation
Caltex Review
reports under the provisions of COMAH regulation 8(c).12.
For the majority of sites it is not expected that a revised safety report is
required to be submitted to the Competent Authority before the next
five-year review.
An appropriate demonstration of compliance should be included in safety
reports submitted to the Competent Authority by the date of the next five-
year periodic review of the safety report.
gasoline tank compounds as per subsequent MIIB and BSTG
recommendations.
4. Caltex will continue to work with Workcover NSW to ensure the content
of the safety case, the methodology for safety assessments and
demonstration of the adequacy of control measures continues to be of a
satisfactory standard.
Protecting against Primary LOC using high integrity systems
Independent levels of protection R3 Design & Operation
Operators of Buncefield-type sites should protect against loss of
containment of petrol and other highly flammable liquids by fitting a high
integrity, automatic operating overfill prevention system (or a number of
such systems, as appropriate) that is physically and electrically separate
and independent from the tank gauging system.
Such systems should meet the requirements of Part 1 of BS EN 61511 for
the required safety integrity level, as determined by the agreed
methodology. Where independent automatic overfill prevention systems are
already provided, their efficacy and reliability should be reappraised in line
with the principles of Part 1 of BS EN 61511 and for the required safety
integrity level, as determined by the agreed methodology (see
Recommendation 1).

For the proposed Terminal;
1. All bulk flammables and combustible liquid storage tanks will have
independent overfill protection systems designed and installed to
Australian standards.
2. These systems will incorporate automatic shut-down capability.
3. These systems will be independent of the tank gauging system and will
have the required assessed safety integrity level.
4. Design adequacy of ATG and IHLA systems has been reviewed and
verified.
5. A deviation alarm between primary and independent levels systems is
also being installed.
6. See also comments against R1 and R4 above.
Management systems for
maintenance of equipment and
systems to ensure their
continuing integrity in operation
Inspection & maintenance systems should already be established.
The MIIBs third progress report indicated that there was a problem with the
tank level monitoring system at Buncefield. An examination of the records
for Tank 912 from the automatic tank gauging (ATG) system suggest an
anomaly in that the ATG system indicated that the level remained static
while approximately 550 m
3
/hr of unleaded petrol was being delivered into
Tank 912.
Overfill protection systems should be tested periodically to prove that
they would operate safely when required.
Proof testing should be end to end, incorporate elements of
redundancy, and include the detector at the liquid interface and the
valve closure element. The test period should be determined by
calculation according to the historical failure rate for each component or
the system and the probability of failure on demand required to achieve
the specified SIL. Records of test results, including faults found and any
repairs carried out, should be retained.
Procedures for implementing changes to equipment and systems
should ensure any such changes do not impair the effectiveness of
equipment and systems in preventing loss of containment or in
providing emergency response.
Operators of Buncefield-type sites should, as a priority, review and amend
as necessary their management systems for maintenance of equipment and
systems to ensure their continuing integrity in operation. This should
include, but not be limited to reviews of the following:
the arrangements and procedures for periodic proof testing of storage
tank overfill prevention systems to minimise the likelihood of any failure
that could result in loss of containment; any revisions identified
pursuant to this review should be put into immediate effect;
the procedures for implementing changes to equipment and systems to
ensure any such changes do not impair the effectiveness of equipment
and systems in preventing loss of containment or in providing
emergency response.
All elements of an overfill prevention system should be proof tested in
accordance with the validated arrangements and procedures sufficiently
frequently to ensure the specified safety integrity level is maintained in
practice in accordance with the requirements of Part 1 of BS EN 61511
1. Proof testing & inspection regimes for ATG and IHLA systems are
adopted throughout Caltex terminals and refineries in accordance with
documented procedures.
2. The tank level devices employed by Caltex are SAAB radar gauges
and are not subject to the type of over-ride or failure mechanisms which
occurred at Buncefield. Principles of safety in design have thus been
employed.
3. All primary containment system elements are subject to a planned risk
and reliability driven preventative maintenance program. Effective
inspection and maintenance systems and procedures are already
established. These procedures have been reviewed several times
since the Buncefield incident. Any changes to inspection and
maintenance regimes will be strictly managed under the Caltex
Management of Change procedures and will be reflected in revisions of
the safety case.
4. Critical system processes for ensuring equipment integrity are already
clearly identified in the Safety Case and implemented.
5. Changes to any overfill protection element, to alarm set-points or to
management system processes will continue to be rigorously assessed
& managed by Caltex Management of Change processes.

C2-3

Topic
BSTG Recommendation
Caltex Review
Testing of overfill protection
systems
Inspection and maintenance systems should already be established.
Overfill protection alarms or shutdown systems using high level switches or
other two-state detectors may be inactive for long periods and may develop
unrevealed faults. Such faults cause the system to fail to danger when
required to operate.
All elements of an overfill prevention system should be proof tested in
accordance with the validated arrangements and procedures sufficiently
frequently to ensure the specified safety integrity level is maintained in
practice.
Refer R2 and R5 above 1. As per comments above.
2. The tank level devices employed by Caltex are SAAB radar gauges
and are not subject to the particular type of over-ride or failure
mechanism which occurred at Buncefield. The type of independent
level detector to be installed is an analogue device rather than a switch.
As such the sensor will always be in active measurement mode and
subject to alarm if bad input or variation from the primary LT occurs.
3. Verification of the level indication reading will be achieved via
automated cross-reference to the primary level gauging system as well
as regular physical dips of the tanks. All alarming and interlock
components will be tested as part of the site preventative maintenance,
testing and inspection program.
4. Caltex will continue to review opportunities in maintenance regimes to
ensure acceptable practice continues to be maintained for identified
critical primary containment assets/components.
Tank overfill prevention: defining
tank capacity
The capacities of storage tanks should be clearly defined and appropriate
safety margins put in place to prevent a release.
To prevent overfill, tanks must have headspace margins to ensure that the
intake will be closed off in time. High level alarms and operator or automatic
actions must be adequately spaced to respond to a developing overfill
situation.
Operating practices, staffing levels and systems must provide effective
safety margins to prevent an overfilling release.
Tank capacities and appropriate action levels should be set in
accordance with this guidance.
Tanks should not be intentionally filled beyond the normal fill level.
1. All bulk storage tanks have defined tank capacities & safe fill levels.
2. Caltex maintains current operating procedures clearly defining tank fill
limitations and tank filling restrictions.
3. Caltex terminals have an established tank level alarm standard which
requires tank alarm settings to be established on a tank by tank basis
taking into account worst case filling rates and alarm response times for
that particular tank. It also takes into account all staffing level variations
and operating practices in establishing the adequacy of alarm set-
points. This standard ensures appropriate time is given for response
to, and escalation of response to, an abnormal level condition before
loss of containment can occur, and will be applied for all tanks
(gasoline as well as others in converted terminal).
4. Any change to bulk storage tank fill limitations is analysed & managed
by Caltex MOC processes.
Fire safe shut-off valves Each pipe connected to a tank is a potential source of a major leak. In the
event of an emergency, it is important to be able to safely isolate the
contents of the tank. Isolation valves should be fire safe, i.e. capable of
maintaining a leak-proof seal under anticipated fire exposure.
Fire-safe shut-off valves must be fitted close to the tank on both inlet and
outlet pipes. Valves must either conform to an appropriate standard (BS
6755-2 or BS EN ISO 10497), equivalent international standards or be of an
intrinsically fire-safe design, i.e. have metal-to-metal seats (secondary metal
seats on soft-seated valves are acceptable), not be constructed of cast iron
and not be wafer bolted.
1. Tanks valves will be upgraded to include fire proof coating as part of
the conversion works
2. All valves being purchased for hydrocarbon service are to be fire safe
and will be insulated.
NOTE; Fire Safe refers to the valve being capable of maintaining its
pressure containing ability during and after a certain period of fire as
required by API 6D.

C2-4

Topic
BSTG Recommendation
Caltex Review
Remotely operated shut-off
valves (ROSOVS)
In an emergency, rapid isolation of vessels or process plant is one of the
most effective means of preventing loss of containment, or limiting its size.
A ROSOV is a valve designed, installed and maintained for the primary
purpose of achieving rapid isolation of plant items containing hazardous
substances in the event of a failure of the primary containment system
(including, but not limited to, leaks from pipework, flanges, and pump seals).
Valve closure can be initiated from a point remote from the valve itself. The
valve should be capable of closing and maintaining tight shut off under
foreseeable conditions following such a failure (which may include fire).
Remotely operated shut-off valves (ROSOVs) for emergency isolation of
hazardous substances: Guidance on good practice HSG244 provides
guidance on how to assess the need to provide ROSOVs for emergency
isolation.
ROSOVs for the emergency isolation of hazardous substances should
be fitted to the outlet pipe tanks in scope where an assessment under
HSG244 indicates that such valves should be fitted. ROSOVs for the
emergency isolation of hazardous substances should fail safe.
Operators of existing sites should review their risk assessments to
ensure that an effective assessment has been undertaken following the
key stages in HSG244.
1. All tank valves are able to be remotely isolated, have been selected to
be Fire Safe and will be fire proofed as discussed above.
2. The safety case detail will be reviewed against HGS244 to verify
whether any additional requirements apply.
Safe management of fuel transfer The initial report of the Buncefield Major Incident Investigation Board
identified an issue with regard to safety arrangements, including
communications, for fuel transfer. No existing authoritative guidance was
found that adequately described this and so a set of principles for safe
management of fuel transfer, which includes the adoption of principles for
consignment transfer agreements has been developed.
Companies involved in the transfer of fuel by pipeline should:
- Adopt the principles for safe management of fuel transfer
- Where one party controls the supply, and another controls the
receiving tanks, develop consignment transfer agreements
consistent with these principles.
- Ensure that suitable job factors are provided to facilitate safe fuel
transfer
Companies involved in inter-business transfer of fuel by pipeline should
have agreed on the nomenclature to be used for their product types
For ship-to-shore transfers, carry out a terminal specific review to
ensure compliance with the International Shipping Guide for Oil
Tankers and Terminals.
Receiving sites to develop procedures for transfer planning and review
them with their senders and appropriate intermediates.
Ensure that written procedures are in place, and consistent with current
good practice, for safety-critical operating activities in the transfer and
storage of fuel.
The sector should put in place arrangement to ensure the receiving site (as
opposed to the transmitting location) has ultimate control over the tank filling
The sector should undertake a review of the adequacy of existing safety
arrangements, including communications, employed by those responsible
for pipeline transfers of fuel
Operators of terminals should implement systems to ensure systematic
maintenance of records pertaining to product movement and operation of
the overfill prevention systems and any associated systems
The sector and regulators should agree on a system of lead and lag
performance indicators for process safety performance

1. The proposed Kurnell Import terminal differs fundamentally from the
Buncefield fuel terminal in that it will be a ship import terminal. There is
no routine delivery of product to Kurnell via pipeline under the proposed
new terminal arrangements although the existing D-line may be used
for minor product movements between Caltex Kurnell and Caltex
Banksmeadow terminal in the short term (as per current operations). In
the latter case Kurnell will retain control of the filling operations as the
receiving site.
2. Caltex adopts international standards for ship to shore transfer
operations and these are rigorously applied. These arrangements
include robust controls for communication protocols, transfer monitoring
and surveillance, and for transfer cessation. All transfers are
commenced only after ullage confirmation of receiving tanks.
3. Records for all product movements are systematically maintained by
Caltex.
4. The control system for products movement operations will record all
events associated with overfill protection controls. This includes full
monitoring of dead tanks as well as tanks involved in active transfers.
Operating systems incorporate confirmation of safe ullage volume and
preset transfer alarms.
5. Existing safety arrangements for both ship receipt operations and
internal pipeline movements have been systematically reviewed under
the site safety case and include assessment of their adequacy
(including communications controls). Further reviews and where
necessary, revision will occur as part of ongoing management of
change and routine continuous improvement activities.
6. Caltex has a defined process for operational excellence performance
monitoring and governance which includes a full suite of targeted lead
and lag performance indicators appropriate to monitoring the practical
effectiveness of all control measures.

C2-5

Topic
BSTG Recommendation
Caltex Review
Overfill Protection System design R8 Design & Operation
The sector, including its supply chain of equipment manufacturers and
suppliers, should review and report without delay on the scope to develop
improved components and systems, including but not limited to the
following:
alternative means of ultimate high level detection systems that do
not rely on components internal to the tank with the emphasis on
ease of inspection, testing and maintenance.
increased dependability of tank gauging systems should be
explored through improved validation of measurements & trends,
allowing warning of faults and using modern sensors with
increased diagnostic capability.
systems to control and log override actions.

1. Caltex currently relies on its testing, inspection and maintenance
systems to demonstrate reliability of its ultimate high level alarm and
tank gauging systems.
2. The Kurnell terminal bulk storage tank high levels systems will be
monitored via Vias-OM. The system provides superior diagnostic
capabilities to those available at the time of the Buncefield Incident
including data comparison alarms between independent systems, and
smart monitoring of tank inventories.
3. Caltex continues to explore emerging technologies with equipment
suppliers for higher reliability and smarter system components and will
progressively adopt such systems as they become available where
appropriate and reasonably practicable to do so.
4. Caltex rejects the ante-tankdesign proposal described in Annex 4 of
the recommendations report on the basis that it has the potential to
introduce more hazards, reduce effective tank capacity, eliminate safe
response time windows and thereby increase risk.
Engineering against escalation against loss of primary containment
Operators of Buncefield-type sites should review the classification of places
within COMAH sites where explosive atmospheres may occur and their
selection of equipment and protective systems (as required by the
Dangerous Substances and Explosive Atmospheres Regulations 2002(ref
6)). This review should take into account the likelihood of undetected loss of
containment and the possible extent of an explosive atmosphere following
such an undetected loss of containment. Operators in the wider fuel and
chemicals industries should also consider such a review, to take account of
events at Buncefield

1. Hazardous Area classifications are regularly reviewed for all Caltex
sites to ensure they remain appropriate to the types, quantities and
activities associated with the handling of hazardous materials.
Classification of hazardous areas and selection of equipment and
protective systems is conducted in accordance with Australian
Standards HB13-2007 and AS2381.
2. The current NSW regulation relating to major hazard facilities requires
a comprehensive and systematic safety assessment relating to every
identified major incident scenario. Part of this safety assessment is
analysis of the nature of the incident and hazards concerned,
ultimately leading to adoption of control measures which reduce risk so
far as is reasonable practicable. The analysis includes review of
potential sources of ignition in the event of a loss of containment or
other formation of flammable atmospheres and the verification of
adequacy of the controls for both prevention of loss of containment
event as well as for prevention of ignition. The safety assessment
forms part of the current safety case. All future revisions of the safety
assessment will continue to analyse and assess ignition hazards.
3. Caltex will continue with the current risk based approach and to
identify and develop action plans relating to the undetected loss of
containment and generation of explosive environments. The ongoing
review of potential scenarios is considered part of the sites continuous
improvement process for its Safety Case.
Following on from Recommendation 11, operators of Buncefield-type sites
should evaluate the siting and/or suitable protection of emergency response
facilities such as fire fighting pumps, lagoons or manual emergency
switches.

1. The current NSW regulations relating to major hazard facilities require
a comprehensive and systematic safety assessment to be conducted
relating to every identified major incident scenario. Part of this safety
assessment is to analyse the nature of the incident and hazards
concerned, and to adopt control measures which reduce risk so far as
is reasonable practicable.
This analysis includes review of all applicable consequence scenarios
in the event of a loss of containment or fire events and the adequacy of
siting for critical emergency response and shut-down controls. A key
part of the study is consideration of the practicality of access to these
key controls as well as survivability in the event of a major fire or
explosion. The required revision of the Safety Assessment for the
converted terminal will include review of these matters. This includes a
Fire Safety Study for the Kurnell Terminal as per HIPAP2.

C2-6

Topic
BSTG Recommendation
Caltex Review
Operators of Buncefield-type sites should employ measures to detect
hazardous conditions arising from loss of primary containment, including the
presence of high levels of flammable vapours in secondary containment.
Operators should without delay undertake an evaluation to identify suitable
and appropriate measures. This evaluation should include, but not be
limited to, consideration of the following:
installing flammable gas detection in bunds containing vessels or tanks
into which large quantities of highly flammable liquids or vapour may be
released;
the relationship between the gas detection system and the overfill
prevention system. Detecting high levels of vapour in secondary
containment is an early indication of loss of containment and so should
initiate action, for example through the overfill prevention system, to
limit the extent of any further loss;
installing CCTV equipment to assist operators with early detection of
abnormal conditions. Operators cannot routinely monitor large numbers
of passive screens, but equipment is available that detects and
responds to changes in conditions and alerts operators to these
changes.

1. Reviews as per recommendation R13 have already been undertaken.
Additional hydrocarbon vapour detectors have been installed in several
existing tanks as per 2007 LUSS Recommendations, and will be
installed in suitable locations within flammable bunds as part of the
conversion upgrade works.
2. The detection of hydrocarbon vapours at or above 10% of the lower
explosive limit will raise a clearly visible and audible alarm.
3. A number of CCTV units will be situated around the site (extent yet to
be determined following full site security review currently being
undertaken). Where cameras are being installed for increased security
surveillance, the option of installing in those units additional IR
detection with alarming capability is being considered.
4. The decision for leak surveillance equipment beyond the measures
currently employed or detailed above will be made on a tank by tank
basis taking into account all required factors when determining what is
reasonably practicable. Revision to the risk assessments within the
safety case will reflect these considerations.
NOTE: this same approach is being applied for other locations; e.g.
pumping stations.
Operators of new Buncefield-type sites or those making major modifications
to existing sites (such as installing a new storage tank) should introduce
further measures including, but not limited to, preventing the formation of
flammable vapour in the event of tank overflow. Consideration should be
given to modifications of tank top design and to the safe re-routing of
overflowing liquids.
1. The Kurnell conversion project does not include installation of any new
bulk storage tanks.
2. All tanks are designed, constructed and maintained to industry
standards API 650 and API 653.
3. Caltex is closely monitoring further research into tank top design and
others factors. It has most recently reviewed RR937 prepared by the
UK Health and Safety Laboratory for the UK Health and Safety
Executive in 2012. Any definitive learnings from emerging research
will be taken into consideration in current and subsequent safety
assessment reviews.
The sector should begin to develop guidance without delay to incorporate
the latest knowledge on preventing loss of primary containment and on
inhibiting escalation if loss occurs. This is likely to require the sector to
collaborate with the professional institutions and trade associations.
1. Where there is opportunity to participate in industry sector
collaboration on safety standards Caltex actively supports and
participates in such initiatives.
2. Caltex currently sits on both NSW and Victorian MHF Advisory
committees pertaining to the management and regulatory oversight of
registered and/or licenced major hazard facilities.
Operators of existing sites, if their risk assessments show it is not
practicable to introduce measures to the same extent as for new ones,
should introduce measures as close to those recommended by
Recommendation 14 as is reasonably practicable. The outcomes of the
assessment should be incorporated into the safety report submitted to the
Competent Authority.

1. Refer to comments for previously listed recommendations where a
range of additional control measures which have been and/or will be
adopted to prevent and/or reduce vapour cloud formation have been
discussed.

C2-7

Topic
BSTG Recommendation
Caltex Review
Engineering against loss of secondary and tertiary containment
Bund wall and floor construction and penetration joints should be leak-
tight. Surfaces should be free from any cracks, discontinuities and joint
failures that may allow relatively unhindered liquid trans-boundary
migration. As a priority, existing bunds should be checked and any
damage or disrepair, which may render the structure less than leak-tight,
should be remedied.
Bund walls should be leak-tight. As a priority, existing bund walls should be
checked and any damage or disrepair, which may render the wall less than
leak-tight, should be remedied.
J oints in concrete or masonry bunds walls should be capable of resisting
fire. Existing bunds should be modified to meet this requirement. In addition
to repairing any defects in bund joints, steel plates should be fitted across
the inner surface of bund joints, and/or fire-resistant sealants should be
used to replace or augment non-fire-resistant materials.
Bund capacity at existing installations should be a minimum of 110% of the
largest contained tank. Should already be in place as good practice.
R17 Engineering against loss of secondary and tertiary containment
The Competent Authority and the sector should jointly review existing
standards for secondary and tertiary containment with a view to the
Competent Authority producing revised guidance by the end of 2007.
The review should include, but not be limited to the following:
developing a minimum level of performance specification of
secondary containment (typically this will be bunding);
developing suitable means for assessing risk so as to prioritise the
programme of engineering work in response to the new
specification;
formally specifying standards to be achieved so that they may be
insisted upon in the event of lack of progress with improvements;
improving firewater management and the installed capability to
transfer contaminated liquids to a place where they present no
environmental risk in the event of loss of secondary containment
and fires;
providing greater assurance of tertiary containment measures to
prevent escape of liquids from site and threatening a major
accident to the environment.
R18 Engineering against loss of secondary and tertiary containment
Revised standards should be applied in full to new build sites and
to new partial installations. On existing sites, it may not be
practicable to fully upgrade bunding and site drainage. Where this
is so operators should develop and agree with the Competent
Authority risk-based plans for phased upgrading as close to new
plant standards as is reasonably practicable.
1. As per R18, Caltex applies risk based plans agreed in consultation
with NSW Workcover and Department of Planning for bunding and site
drainage upgrades.
2. Caltex adopts AS1940 as its common standard for flammable and
combustible liquid compounds. Where new tank compounds are to be
constructed or existing compounds are to be substantially altered, full
review of all relevant Buncefield recommendations are taken into
consideration in design of those systems.
3. Bund upgrade works are included in the conversion project scope of
works as detailed elsewhere in this submission but these do not entail
significant alteration to current bund design. Bunds will meet key
requirements as listed in the BSTG recommendations. All bund walls
are sealed either with bitumen or are concrete encased
4. Caltex has reviewed current HSE UK guidance on secondary and
tertiary containment and refers to the following posted note indicating
that the revised guidance is not yet available:
While the technical content of this guidance remains substantially correct, some
of the legislation referred to has been superseded. The Highly Flammable
Liquids and Liquefied Petroleum Gases Regulations 1972 have been replaced
by the Dangerous Substances and Explosive Atmospheres Regulations 2002
(DSEAR). Legislation .. and revised guidance is due to be published in 2012.
Caltex continues to monitor emerging industry guidance and practices
relating to engineering design and construction standards. Pertinent
improvements are adopted where reasonably practicable to do so.
5. Caltex is closely monitoring current research into bund and drainage
design and others factors. It has most recently reviewed RR937
prepared by the UK Health and Safety Laboratory for the UK Health
and Safety Executive in 2012.
6. Caltex revises the matters listed in R17 as a matter of course when
revising its Safety Cases and their associated demonstration of
adequacy of control measures.
7. Caltex secondary and tertiary containment measures are subject to
preventative inspection and maintenance regimes as for any other
control measure to ensure that any compromise to the leak tightness
of containment is systematically identified and remedied.
Firewater management and
control measures
Site-specific planning of firewater management and control measures
should be undertaken with active participation of the local Fire and Rescue
Service.
1. The adequacy of emergency resources and procedures is already
required to be reviewed in consultation with NSW Fire and Rescue
under the major hazard facilities regulations as well as via planning
approval requirements.
2. A Fire Safety Study, as per HIPAP2 guidelines, has been prepared for
the proposed Terminal changes and is the subject of consultation with
Fire & Rescue NSW.
3. Reviews of major incident and pre-incident plans specifically address
practical firewater requirements in responding to major fire events as
well as firewater management issues.
4. Caltex has recently expended capital to improve the practicability of
fire response. This has included improved foam delivery systems and
higher capacity foam monitors for combat of tank top & bund
spills/fires.

C2-8

Topic
BSTG Recommendation
Caltex Review
High reliability organisations
Roles responsibilities &
competence
Operators should ensure that they have:
clearly identified the roles and responsibilities of all those involved in
managing, performing or verifying work in the management of major
hazards, including contractors; and
implemented a competence management system, linked to major
accident risk assessment, to ensure that anyone whose work impacts
on the control of major accident hazards is competent to do so.
The sector should work with the Competent Authority to prepare guidance
and/or standards on how to achieve a high reliability industry through
placing emphasis on the assurance of human and organisational factors in
design, operation, maintenance, and testing. Of particular importance are:
understanding and defining the role and responsibilities of the control
room operators (including in automated systems) in ensuring safe
transfer processes;
providing suitable information and system interfaces for front line staff
to enable them to reliably detect, diagnose and respond to potential
incidents;
training, experience and competence assurance of staff for safety
critical and environmental protection activities;
defining appropriate workload, staffing levels and working conditions for
front line personnel;
ensuring robust communications management within and between sites
and contractors and with operators of distribution systems and
transmitting sites (such as refineries);
prequalification auditing and operational monitoring of contractors
capabilities to supply, support and maintain high integrity equipment;
providing effective standardised procedures for key activities in
maintenance, testing, and operations;
clarifying arrangements for monitoring and supervision of control room
staff; and
effectively managing changes that impact on people, processes and
equipment.
Terminal operators should ensure the resulting guidance is fully
implemented.
The sector should put in place arrangements to ensure that good
practice in these areas, incorporating experience from other higher
hazard sectors, is shared openly between organisations.
The regulator should ensure that MHF Safety Cases contain
demonstration that good practice in human and organisational design,
operation, maintenance and testing is implemented as rigorously as for
engineering systems.

1. Schedule 17 Part 2 of the NSW Work Health and Legislation
addresses these recommendations and as such Caltex is required to
comply as an operator of a major hazard facility.
Caltexs obligations with regard to the legislation are met through the
design and implementation of its Operational Excellence Management
System which has specific elements which address human factor
hazards and competence management specifically.
2. Kurnell refinery has in recent years completed several detailed
organisational and human factor effectiveness studies. This has
included detailed studies for console operators, field operators and
frontline supervisors for normal, abnormal and emergency operations.
This data is being used to manage safe operations during the
transition period and will be used to assist in organisational design for
the new terminal arrangements.
3. Caltex is using its management of change process to ensure all the
matters raised in the recommendation are taken into account where
any changes to personnel, organisation or personnel /plant interfaces
are proposed.
4. The OEMS also has specific elements which cover Contractor Safety
Management including pre-qualification, and operational monitoring of
contractors capabilities to supply, support and maintain high integrity
equipment.
5. Caltex has long recognised the importance of establishing high
reliability in its human resource. Programs such as IIF have been an
example of industry leading initiatives in this area.
6. Where possible, Caltex will participate in cooperative activities initiated
and coordinated by the regulator to develop standards and guidance
relating to establishment and development of high reliability
organisations.
7. Adoption of any resultant standards will be managed through the
continuous improvement activities under the OEMS.

C2-9

Topic
BSTG Recommendation
Caltex Review
Staffing and shift work
arrangements
Operators should:
Ensure they can demonstrate that staffing arrangements are adequate
to detect, diagnose and recover any reasonably foreseeable hazardous
scenario in relation to fuel transfer and storage; and
ensure that shift work is adequately managed to control risks arising
from fatigue.
Staffing and shift work arrangements are critical to the prevention, control
and mitigation of major accident hazards. Site operators should be able to
demonstrate that staffing arrangements ensure there are sufficient alert,
competent personnel to deal with both normal operation and hazardous
scenarios arising from abnormal events in fuel transfer and storage.
Some high hazard organisations have set staffing levels based on
steadystate operations. HSE Contract Research Report Assessing the
safety of staffing arrangements for process operations in the chemical and
allied industries CRR 348/2001, was commissioned to provide a method to
demonstrate that staffing arrangements are adequate for hazardous
scenarios as well as normal operations.

Part of R19 as detailed above 1. Current requirements for a major hazard facility operator already
require consideration and management of these factors.
2. Kurnell refinery has in recent years completed several detailed
organisational & human factor effectiveness studies. This has included
detailed studies for console operators, field operators and frontline
supervisors utilising guidance contained in:
a. Organisational change and major accident hazards; Chemical
Information Sheet No. CHIS7. UK Health & Safety Executive
06/2003.
b. Energy Institute, Safe Staffing Arrangements User Guide for
CRR348/2001 Methodology, Institute of Petroleum and HSE,
2004.
This data is being used to manage safe operations during the
transition period and will be used to assist in organisational design for
the new terminal arrangements.
3. All impacts resulting from any change to staffing /personnel
arrangements will be specifically addressed by the management of
change processes focussed around organisation and training and
competency. Demonstration of the adequacy of the controls adopted
with regard to human factor matters will be articulated in revisions of
the site safety case.
Shift handover Operators should set and implement a standard for effective and safe
communications at shift and crew changes handover in relation to fuel
transfer and storage.
For top tier COMAH sites a summary of the standard should be included in
the next revision of the safety report.
1. As per comments above. Current requirements for a major hazard
facility operator already require consideration and management of
these factors. The Caltex Operational excellence management system
and site specific operating procedures address these factors.

Organisational change and
management of contractors
Site operating companies should ensure that:
there is a suitable policy and procedure for managing organisational
changes, and for retention of corporate memory;
the policy and procedure ensures that the company retains adequate
technical competence and intelligent customer capability when work
impacting on the control of major accident hazards is outsourced;
suitable arrangements are in place for managing and monitoring
contractor activities.
1. Procedures are already established under the OEMS for Management
of Change which includes organisational change, as well as for
Contractor Safety Management.
2. Caltex has in recent years invested in process development & delivery
of several detailed organisational & human factor effectiveness
studies. These have been undertaken to assess proposed
organisational changes.
3. Retention of corporate memory remains a challenge for all of industry.
Caltex is no exception and relies heavily on its Safety Case and safety
management system elements to record, retain and transfer
knowledge in relation to major hazards risk. This remains a particular
focus of the management of change process for the Kurnell conversion
project.
4. As a terminal, Caltex will retain management control of all tasks
undertaken on the site by contractors.

C2-10

Topic
BSTG Recommendation
Caltex Review
Performance evaluation and
process safety performance
measurement
Site operators should:
Ensure they have a suitable active monitoring programme in place
for those systems and procedures that are key to the control of fuel
transfer and storage; and
Develop an integrated set of leading and lagging performance
indicators for effective monitoring of process safety performance
1. Active performance monitoring of all controls critical to the prevention
and/or mitigation of major hazards risks is currently in place for all
Caltex terminals and refineries. In transition to an import terminal the
site will maintain a complete performance monitoring regime. Any
changes to controls, performance indicators for those controls, or to the
methods or frequency of performance monitoring will be strictly
managed under the management of change process and recorded in
revisions of the safety case.
2. A full suite of leading and lagging performance indicators linked to
safety management systems performance is an integral part of OEMS
operation. Reporting of performance against these indicators is
escalated to the Caltex board as a regular element of the reporting
mechanism.
3. This is already a central requirement of the MHF regime which will be
specifically verified and overseen by NSW Workcover.
Delivering high performance
through Culture & Leadership
The sector should set up arrangements to collate incident data on high
potential incidents including overfilling, equipment failure, spills and alarm
system defects, evaluate trends, and communicate information on risks,
their related solutions and control measures to the industry.
The arrangements set up to meet Recommendation 23 should include, but
not be limited to, the following:
thorough investigation of root causes of failures and malfunctions of
safety and environmental protection critical elements during testing or
maintenance, or in service;
developing incident databases that can be shared across the entire
sector, subject to data protection and other legal requirements.
Examples exist of effective voluntary systems that could provide
suitable models;
collaboration between the workforce and its representatives,
dutyholders and regulators to ensure lessons are learned from
incidents, and good practices are shared.
In particular, the sector should draw together current knowledge of major
hazard events, failure histories of safety and environmental protection
critical elements, and developments in new knowledge and innovation to
continuously improve the control of risks. This should take advantage of the
experience of other high hazard sectors such as chemical processing,
offshore oil and gas operations, nuclear processing and railways.

1. These recommendations are addressed to the petroleum sector more
broadly. There are however some elements which can be satisfied by
Caltex specifically, in relation to the Kurnell site.
2. Caltex refining and terminals use the same corporate system for
internal collation and sharing of incident data across the broader
company; the Loss Prevention System. This is a well-established and
implemented system which is set up to appropriately address process
safety incidents as well as near-losses. The system also incorporates
a program of companywide alerts and an extensive investigation,
analysis and reporting program. All Caltex employees participate in
the LPS activities to ensure lessons are learned from incidents and
good practices are shared.
3. Thorough investigations and database records meeting the
requirements of recommendation 24 are already employed through
LPS.
4. Caltex is a leading participant of industry sectors forums such as Safe
Load Pass which share information on sector hazards, incidents and
control improvements.


C2-11

Topic
BSTG Recommendation
Caltex Review
Emergency Arrangements
Principles for Emergency
Arrangements
All sites in scope should prepare in writing a suitable on-site emergency
plan as required by the COMAH Regulations. For lower-tier COMAH sites
the plan should be prepared as part of the MAPP.
The emergency plans should consider the response to and mitigation of a
multiple tank fire following an explosion. The plan should cover the on-site
consequences of such an event and the assistance available in the form of
off-site mitigatory actions.
The incident-specific emergency response plans should consider fire
management requirements in response to, and mitigation of, a multiple tank
fire. The plan should cover the on-site consequences of such an event and
the assistance available in the form of off-site mitigatory actions. Any plan
deemed necessary to deal with such an event must be capable of operating
effectively even in the event of a preceding explosion.
R1 Emergency preparedness, response & recovery
Operators of Buncefield-type sites should review their emergency
arrangements to ensure they provide for all reasonably foreseeable
emergency scenarios arising out of credible major hazard incidents,
including vapour cloud explosions and severe multi-tank fires that,
before Buncefield, were not considered realistically credible. The
Competent Authority should ensure that this is done.

1. The matter referred to in R1 is already a requirement of the NSW Work
Health and Safety Regulation and therefore required to be
demonstrated in the locations safety case. BSTG recommendations
283-292 are also covered under these provisions.
2. Ongoing revisions of the sites Safety Case will continue to review
global Major Incidents to ensure that all Major Incident potentials at the
facilities continue to be comprehensively identified, assessed and
controlled.
3. Pre-incident plans for all identified major incident scenarios are being
reviewed and updated as part of the conversion project.
On-site emergency plan
A template for an on-site emergency plan can be found at
www.hse.gov.uk/comah/buncefield/final.htm. It is envisaged that sites will
complete this template and that it will then act as a high-level document
providing an overview of the sites arrangements. Underpinning this
document will be a series of detailed plans relating to specific incidents.

The Competent Authority should review the existing COMAH guidance
on preparing on-site emergency plans. This guidance needs to reflect
the HSEs Hazardous Installations Directorate (HID) 7 Chemical
Industries Division inspection manual used by inspectors to assess the
quality of the on-site plan in meeting the COMAH Regulations. In
particular, reference should be made to the need to consult with health
advisors and emergency responders.
For Buncefield-type sites, operators should review their onsite
emergency plans to reflect the revised guidance on preparing on-site
emergency plans as per Recommendation 2. The Competent Authority
will need to check that this is done.

1. Caltex will continue to work in conjunction with Workcover NSW, the
NSW Department of Planning and Infrastructure and the emergency
services (in particular NSW Fire and Rescue) in review and revision of
its emergency arrangements for the Kurnell site and specifically with
respect to the terminal conversion plan.
2. Caltex will continue taking into account published guidelines and
standards issued from time to time by the various state and federal
regulators. (e.g. HIPAP2)
3. Any revision to this guidance will be reviewed and existing safety cases
including emergency arrangements will be reviewed and revised as
necessary in response to the revised Guidelines, as per current
arrangements.

C2-12

Topic
BSTG Recommendation
Caltex Review
Firefighting planning and
preparation
This topic comprises of two elements; firstly, the actions that should be put
in place before an event occurs and secondly, actions that should be carried
out once an event has occurred. These arrangements should be agreed by
all parties involved, including off-site responders.
Planning aids the firefighting operations immensely by determining what is
needed to extinguish the fire or manage a controlled burn, and how to
deliver the required resources and manage firewater to prevent
environmental impact.
Scenario-based incident-specific emergency response plans can identify
incident control resources required for accidental release, spillages and fire
and emergency response. They can also provide guidance on control and
deployment of the necessary resources and importantly, can be used as a
tool to exercise against, thus closing the loop from preparation to planned
and exercised response.
Such deliberations should form part of the environmental and safety risk
assessment carried out by the operator when producing the on-site
emergency plan. This should be in consultation with the environment
agencies, the local authorities, the emergency services (particularly the Fire
and Rescue Service) and other stakeholders.

For Buncefield-type sites, operators should evaluate the siting and/or
suitable protection of emergency response facilities such as the
emergency control centre, firefighting pumps, lagoons or manual
switches, updating the safety report as appropriate and taking the
necessary remedial actions.
Operators should identify vulnerable critical emergency response
resources and put in place contingency arrangements either on or off
site in the event of failure at any time of the year and make appropriate
amendments to the on-site emergency plan. This should include
identifying and establishing an alternative emergency control centre
with a duplicate set of plans and technical information.

For COMAH sites, if the operator relies on an off-site Fire and Rescue
Service to respond, the operators plan should clearly demonstrate that
there are adequate arrangements in place between the operator and
the service provider. The Competent Authority will need to check that
this is done.
1. Requirements from both recommendation sources are implicitly
covered under existing NSW legislation for major hazard facilities:

The operator of a determined major hazard facility must prepare an
emergency plan for the major hazard facility that:
(a) addresses all health and safety consequences of a major incident
occurring, and
(b) includes all matters specified in Schedule 16, and
(c) provides for testing of emergency procedures, including the
frequency of testing.

In preparing an emergency plan, the operator must consult with:
(a) the following bodies:
(i) Fire and Rescue NSW, and
(ii) if the facility is within a rural fire district within the
meaning of the Rural Fires Act 1997the NSW Rural Fire
Service, and
(b) in relation to the off-site health and safety consequences of a major
incident occurringthe local authority.

The operator must ensure that the emergency plan addresses any
recommendation made by the emergency service organisations
consulted under subclause (2) in relation to:
(a) the testing of the emergency plan, including the manner in which
it will be tested, the frequency of testing and whether or not the
emergency service organisations will participate in the testing,
and
(b) what incidents or events at the major hazard facility should be
notified to the emergency service organisations.
The operator must have regard to any other recommendation or advice given
by a person consulted under subclause (2).
2. Current site fire safety studies and emergency plan reviews address
these recommendations. Pre-incident plans for all identified major
incident scenarios are regularly reviewed and updated, and will be
revised to reflect any changes made to plant, emergency controls and
the emergency organisation as a result of the conversion to a terminal.
3. Sites will continue, in consultation with NSW Fire and Rescue and
other nominated authorities, to identify and implement further
practicable improvements.
4. As for any other control measure, the emergency planning
arrangements and infrastructure are included in the Safety Case and
require suitable demonstration of adequacy.
Training & Competency for
Emergency Response

Trained, knowledgeable and competent personnel must be involved in the
exercise of the firefighting plan and in the testing of the on-site plan. They
must fulfil the tasks they will be expected to fulfil during an incident.
Operators should review and where necessary revise their on-site
emergency arrangements to ensure that relevant staff are trained and
competent to execute the plan and should ensure that there are enough
trained staff available at all times to perform all the actions required by the
on-site emergency plan.

1. As for comments against R4-R7 above, this recommendation is
already covered by the Work Health and Safety Regulation.
2. Training and competency in the current and amended emergency plan
will be maintained throughout the site transition to an operating import
terminal.

C2-13

Topic
BSTG Recommendation
Caltex Review
Preparedness Mutual Aid
(National Framework)
Communities and Local Government should complete and, where
necessary, initiate an assessment of the need for national-level
arrangements to provide, fund and maintain, emergency response
equipment (such as high volume pumps, firefighting foam and specialist
pollution containment equipment). The review could also consider
criteria for allocation and use of this equipment across the UK.
The operators of industrial sites where there are risks of large
explosions and/or large complicated fires should put in place, in
consultation with fire and rescue services at national level, a national
industryfire service mutual aid arrangement. The aim should be to
enable industry equipment, together with operators of it as appropriate,
to be available for fighting major industrial fires. Industry should call on
the relevant trade associations and working group 6 of the Buncefield
Standards Task Group to assist it, with support from CCS. The COMAH
Competent Authority should see that this is done.

1. Whilst these two specific recommendations are really aimed at industry
sectors and local, state and national government initiatives, Caltex
recognises its role as a responsible member of the Kurnell community
and as such actively supports mutual aid and community emergency
response arrangements.
2. The revision of the Kurnell Emergency Plan to reflect operation of the
site as an import terminal will specifically revise mutual aid resourcing
and agreements.
Warning and informing the public R8 Emergency preparedness, response & recovery
COMAH site operators should review their arrangements to
communicate with residents, local businesses and the wider
community, in particular to ensure the frequency of communications
meets local needs and to cover arrangements to provide for dealing
with local community complaints. They should agree the frequency and
form of communications with local authorities and responders, making
provision where appropriate for joint communications with those bodies.
The Competent Authority should review the COMAH guidance to assist
operators in complying with Recommendation 8 and should work with
the Cabinet Office to integrate the COMAH guidance and the CCA
Communicating with the public(Ref 9) guidance, so that
communications regarding COMAH sites are developed jointly by the
site operator and the local emergency responders.

1. Caltex Kurnell is an integral part of the community in which it
operates and as such recognises the importance of appropriate
community information and communication.
2. Caltex will continue to place high priority on ensuring the intended
outcome from R8 continues to be achieved.
3. Caltex has the following established communication channels in
the event of an emergency:
a. Appointed members of the Caltex management team in
the Emergency Operations Centre provide information
updates to the media, employees and contractors.
b. Appointed members of the Caltex management team
monitor & respond to community inquiries via 1800
response hotline.
c. Appointed members of the Caltex management team in
the Emergency Operations Centre provide information to
NSW Police who are responsible for communicating and
coordinating community action (e.g. evacuation) should
this be required.
d. Caltex provides subsequent feedback to community
stakeholders following an Emergency. This is typically
communicated via routine feedback at community
meetings.

Hazard and Risk Assessment

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Hazard and Risk Assessment

Uploaded by

Copyright:

Available Formats

C2 Kurnell Buncefield Review

You might also like